AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The changes are confined to drivers/net/wireless/mediatek/mt76/mt7996/, which is a vendor-specific PCIe wireless driver for MediaTek MT7996/MT7992/MT7990 devices. These PCIe devices require specific physical hardware and are not emulated in standard virtualized environments (such as QEMU/GCE), making the modified code unreachable for fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 684b02e7d5617204e9d8f00d8023fe4908ccd5f3\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Sep 2 08:52:09 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c\nindex 1cba381a78b82..fe7a31b0bc687 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c\n@@ -932,7 +932,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,\n \t} else if (beacon) {\n \t\tp_fmt = MT_TX_TYPE_FW;\n \t\tq_idx = MT_LMAC_BCN0;\n-\t} else if (qid \u003e= MT_TXQ_PSD) {\n+\t} else if (qid \u003e= MT_TXQ_PSD || (!(wcid-\u003etx_info \u0026 MT_WCID_TX_INFO_SET))) {\n \t\tp_fmt = MT_TX_TYPE_CT;\n \t\tq_idx = MT_LMAC_ALTX0;\n \t} else {\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c\nindex e218856b0c454..00ddb9d31ed32 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c\n@@ -1415,6 +1415,7 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,\n \t\t\t\tgoto unlock;\n \t\t\tbreak;\n \t\tcase MT76_STA_EVENT_DISASSOC:\n+\t\t\tmsta_link-\u003ewcid.tx_info \u0026= ~MT_WCID_TX_INFO_SET;\n \t\t\tfor (i = 0; i \u003c ARRAY_SIZE(msta_link-\u003etwt.flow); i++)\n \t\t\t\tmt7996_mac_twt_teardown_flow(dev, link,\n \t\t\t\t\t\t\t     msta_link, i);\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c\nindex fbfbb96a742f7..4e335e6015814 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c\n@@ -391,29 +391,31 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,\n \t\t\t  size_t len)\n {\n \tu32 addr = __mt7996_reg_addr(dev, offset);\n+\tunsigned long flags;\n \n \tif (addr != INVALID_REG_ADDR) {\n \t\tmemcpy_fromio(buf, dev-\u003emt76.mmio.regs + addr, len);\n \t\treturn;\n \t}\n \n-\tspin_lock_bh(\u0026dev-\u003ereg_lock);\n+\tspin_lock_irqsave(\u0026dev-\u003ereg_lock, flags);\n \tmemcpy_fromio(buf, dev-\u003emt76.mmio.regs +\n \t\t\t   __mt7996_reg_remap_addr(dev, offset), len);\n-\tspin_unlock_bh(\u0026dev-\u003ereg_lock);\n+\tspin_unlock_irqrestore(\u0026dev-\u003ereg_lock, flags);\n }\n \n static u32 mt7996_rr(struct mt76_dev *mdev, u32 offset)\n {\n \tstruct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);\n \tu32 addr = __mt7996_reg_addr(dev, offset), val;\n+\tunsigned long flags;\n \n \tif (addr != INVALID_REG_ADDR)\n \t\treturn dev-\u003ebus_ops-\u003err(mdev, addr);\n \n-\tspin_lock_bh(\u0026dev-\u003ereg_lock);\n+\tspin_lock_irqsave(\u0026dev-\u003ereg_lock, flags);\n \tval = dev-\u003ebus_ops-\u003err(mdev, __mt7996_reg_remap_addr(dev, offset));\n-\tspin_unlock_bh(\u0026dev-\u003ereg_lock);\n+\tspin_unlock_irqrestore(\u0026dev-\u003ereg_lock, flags);\n \n \treturn val;\n }\n@@ -422,28 +424,30 @@ static void mt7996_wr(struct mt76_dev *mdev, u32 offset, u32 val)\n {\n \tstruct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);\n \tu32 addr = __mt7996_reg_addr(dev, offset);\n+\tunsigned long flags;\n \n \tif (addr != INVALID_REG_ADDR) {\n \t\tdev-\u003ebus_ops-\u003ewr(mdev, addr, val);\n \t\treturn;\n \t}\n \n-\tspin_lock_bh(\u0026dev-\u003ereg_lock);\n+\tspin_lock_irqsave(\u0026dev-\u003ereg_lock, flags);\n \tdev-\u003ebus_ops-\u003ewr(mdev, __mt7996_reg_remap_addr(dev, offset), val);\n-\tspin_unlock_bh(\u0026dev-\u003ereg_lock);\n+\tspin_unlock_irqrestore(\u0026dev-\u003ereg_lock, flags);\n }\n \n static u32 mt7996_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)\n {\n \tstruct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);\n \tu32 addr = __mt7996_reg_addr(dev, offset);\n+\tunsigned long flags;\n \n \tif (addr != INVALID_REG_ADDR)\n \t\treturn dev-\u003ebus_ops-\u003ermw(mdev, addr, mask, val);\n \n-\tspin_lock_bh(\u0026dev-\u003ereg_lock);\n+\tspin_lock_irqsave(\u0026dev-\u003ereg_lock, flags);\n \tval = dev-\u003ebus_ops-\u003ermw(mdev, __mt7996_reg_remap_addr(dev, offset), mask, val);\n-\tspin_unlock_bh(\u0026dev-\u003ereg_lock);\n+\tspin_unlock_irqrestore(\u0026dev-\u003ereg_lock, flags);\n \n \treturn val;\n }\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The changes are confined to drivers/net/wireless/mediatek/mt76/mt7996/, which is a vendor-specific PCIe wireless driver for MediaTek MT7996/MT7992/MT7990 devices. These PCIe devices require specific physical hardware and are not emulated in standard virtualized environments (such as QEMU/GCE), making the modified code unreachable for fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
  even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).
- Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed,
  ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU.
- Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove)
  that are executed only during PCI hot-unplug or sysfs driver unbind operations.

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
   Prefer non-static, non-inlined API entrypoint functions over internal static helper functions
   (which are inlined by the compiler and do not have distinct symbol addresses).
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs
   needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs
   output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 684b02e7d5617204e9d8f00d8023fe4908ccd5f3
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Sep 2 08:52:09 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
index 1cba381a78b82..fe7a31b0bc687 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c
@@ -932,7 +932,7 @@ void mt7996_mac_write_txwi(struct mt7996_dev *dev, __le32 *txwi,
 	} else if (beacon) {
 		p_fmt = MT_TX_TYPE_FW;
 		q_idx = MT_LMAC_BCN0;
-	} else if (qid >= MT_TXQ_PSD) {
+	} else if (qid >= MT_TXQ_PSD || (!(wcid->tx_info & MT_WCID_TX_INFO_SET))) {
 		p_fmt = MT_TX_TYPE_CT;
 		q_idx = MT_LMAC_ALTX0;
 	} else {
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index e218856b0c454..00ddb9d31ed32 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -1415,6 +1415,7 @@ mt7996_mac_sta_event(struct mt7996_dev *dev, struct ieee80211_vif *vif,
 				goto unlock;
 			break;
 		case MT76_STA_EVENT_DISASSOC:
+			msta_link->wcid.tx_info &= ~MT_WCID_TX_INFO_SET;
 			for (i = 0; i < ARRAY_SIZE(msta_link->twt.flow); i++)
 				mt7996_mac_twt_teardown_flow(dev, link,
 							     msta_link, i);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
index fbfbb96a742f7..4e335e6015814 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mmio.c
@@ -391,29 +391,31 @@ void mt7996_memcpy_fromio(struct mt7996_dev *dev, void *buf, u32 offset,
 			  size_t len)
 {
 	u32 addr = __mt7996_reg_addr(dev, offset);
+	unsigned long flags;
 
 	if (addr != INVALID_REG_ADDR) {
 		memcpy_fromio(buf, dev->mt76.mmio.regs + addr, len);
 		return;
 	}
 
-	spin_lock_bh(&dev->reg_lock);
+	spin_lock_irqsave(&dev->reg_lock, flags);
 	memcpy_fromio(buf, dev->mt76.mmio.regs +
 			   __mt7996_reg_remap_addr(dev, offset), len);
-	spin_unlock_bh(&dev->reg_lock);
+	spin_unlock_irqrestore(&dev->reg_lock, flags);
 }
 
 static u32 mt7996_rr(struct mt76_dev *mdev, u32 offset)
 {
 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
 	u32 addr = __mt7996_reg_addr(dev, offset), val;
+	unsigned long flags;
 
 	if (addr != INVALID_REG_ADDR)
 		return dev->bus_ops->rr(mdev, addr);
 
-	spin_lock_bh(&dev->reg_lock);
+	spin_lock_irqsave(&dev->reg_lock, flags);
 	val = dev->bus_ops->rr(mdev, __mt7996_reg_remap_addr(dev, offset));
-	spin_unlock_bh(&dev->reg_lock);
+	spin_unlock_irqrestore(&dev->reg_lock, flags);
 
 	return val;
 }
@@ -422,28 +424,30 @@ static void mt7996_wr(struct mt76_dev *mdev, u32 offset, u32 val)
 {
 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
 	u32 addr = __mt7996_reg_addr(dev, offset);
+	unsigned long flags;
 
 	if (addr != INVALID_REG_ADDR) {
 		dev->bus_ops->wr(mdev, addr, val);
 		return;
 	}
 
-	spin_lock_bh(&dev->reg_lock);
+	spin_lock_irqsave(&dev->reg_lock, flags);
 	dev->bus_ops->wr(mdev, __mt7996_reg_remap_addr(dev, offset), val);
-	spin_unlock_bh(&dev->reg_lock);
+	spin_unlock_irqrestore(&dev->reg_lock, flags);
 }
 
 static u32 mt7996_rmw(struct mt76_dev *mdev, u32 offset, u32 mask, u32 val)
 {
 	struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
 	u32 addr = __mt7996_reg_addr(dev, offset);
+	unsigned long flags;
 
 	if (addr != INVALID_REG_ADDR)
 		return dev->bus_ops->rmw(mdev, addr, mask, val);
 
-	spin_lock_bh(&dev->reg_lock);
+	spin_lock_irqsave(&dev->reg_lock, flags);
 	val = dev->bus_ops->rmw(mdev, __mt7996_reg_remap_addr(dev, offset), mask, val);
-	spin_unlock_bh(&dev->reg_lock);
+	spin_unlock_irqrestore(&dev->reg_lock, flags);
 
 	return val;
 }

gemini-3.7-flash

null

null

							input: 3664
							output: 39
							thoughts: 170
						

**My Initial Assessment of the Patch**

Okay, let's dive into this patch and figure out its potential fuzzing value. My first thought is to determine if this introduces any functional changes that are ripe for fuzzing. The fact that it's touching wireless network drivers, specifically the `mt7996` family, immediately piques my interest. I need to quickly establish if this code is relevant to a virtualized environment like QEMU, or if it's primarily tied to hardware interactions that would be difficult or impossible to reach without specific hardware.

To do this, I'll need to understand the MT7996 chipset a bit better. What bus does it utilize? Is it PCIe, USB, something else? I'll probably fire up `grepper` (or use my preferred code search tool if it's not available) and search the codebase for references to MT7996, paying close attention to any mentions of bus-related configurations. Alternatively, I should be able to check the Kconfig files within the `drivers/net/wireless/mediatek/mt76/mt7996/` directory to get a sense of the hardware dependencies. Knowing the bus type will be crucial in deciding if I can effectively fuzz this within a standard QEMU setup.

{
  "Expression": "CONFIG_MT7996",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/Makefile=50=obj-$(CONFIG_MT7921_COMMON) += mt7921/\ndrivers/net/wireless/mediatek/mt76/Makefile:51:obj-$(CONFIG_MT7996E) += mt7996/\ndrivers/net/wireless/mediatek/mt76/Makefile-52-obj-$(CONFIG_MT7925_COMMON) += mt7925/\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:3:obj-$(CONFIG_MT7996E) += mt7996e.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-4-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile=5=mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \\\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-7-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:8:mt7996e-$(CONFIG_MT7996_NPU) += npu.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-9-mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c=2399=mt7996_net_fill_forward_path(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-2456-\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c:2457:#if defined(CONFIG_NET_MEDIATEK_SOC_WED) || defined(CONFIG_MT7996_NPU)\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-2458-static int\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c=2546=const struct ieee80211_ops mt7996_ops = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-2600-\t.net_fill_forward_path = mt7996_net_fill_forward_path,\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c:2601:#if defined(CONFIG_NET_MEDIATEK_SOC_WED) || defined(CONFIG_MT7996_NPU)\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-2602-\t.net_setup_tc = mt7996_net_setup_tc,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h=950=void mt7996_dma_rro_start(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-951-\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:952:#ifdef CONFIG_MT7996_NPU\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-953-int __mt7996_npu_hw_init(struct mt7996_dev *dev);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h=973=static inline int mt7996_npu_rx_queues_init(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-976-}\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:977:#endif /* CONFIG_MT7996_NPU */\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-978-\n"
}

gemini-3.7-flash

null

null

							input: 5307
							output: 37
							thoughts: 21
						

Here's my take on those thoughts:

**Analyzing the Mediatek Wireless Driver Configuration**

Okay, so I need to dive into the Mediatek wireless driver situation. My immediate instinct is to look at the configuration file, `drivers/net/wireless/mediatek/mt76/Kconfig`. That's where all the build options and dependencies for that specific driver should be defined. From the Kconfig, I can determine which features are enabled by default, what modules are available, how to enable/disable specific hardware support, and what other kernel components it might depend on. This will give me a solid base understanding of how this driver is structured and how to control it during the build process. It's the logical starting point for understanding how this driver integrates into the kernel configuration. Knowing how it's configured is key to making any progress.

{
  "Expression": "MT7996",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76"
}

{
  "Output": "\nFull output is too long, showing 500 out of 1582 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/Makefile=50=obj-$(CONFIG_MT7921_COMMON) += mt7921/\ndrivers/net/wireless/mediatek/mt76/Makefile:51:obj-$(CONFIG_MT7996E) += mt7996/\ndrivers/net/wireless/mediatek/mt76/Makefile-52-obj-$(CONFIG_MT7925_COMMON) += mt7925/\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:2:config MT7996E\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:3:\ttristate \"MediaTek MT7996 (PCIe) support\"\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-4-\tselect MT76_CONNAC_LIB\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-9-\thelp\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:10:\t  This adds support for MT7996-based PCIe wireless devices,\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-11-\t  which support concurrent tri-band operation at 6GHz, 5GHz,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-15-\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:16:config MT7996_NPU\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:17:\tbool \"MT7996 (PCIe) NPU support\"\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:18:\tdepends on MT7996E\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-19-\tdepends on NET_AIROHA_NPU=y || MT76_CORE=NET_AIROHA_NPU\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:3:obj-$(CONFIG_MT7996E) += mt7996e.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-4-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile=5=mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \\\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-7-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:8:mt7996e-$(CONFIG_MT7996_NPU) += npu.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-9-mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=48=mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-50-\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:51:\tcase MT7996_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:52:\tcase MT7996_DEVICE_ID_2:\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-53-\t\t*num = ARRAY_SIZE(mt7996_mem_regions);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c=46=static void mt7996_dma_config(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-59-\t/* rx queue */\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:60:\tRXQ_CONFIG(MT_RXQ_MCU, WFDMA0, MT_INT_RX_DONE_WM, MT7996_RXQ_MCU_WM);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-61-\t/* for mt7990, RX ring 1 is for SDO instead */\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:62:\tRXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_RX_DONE_WA, MT7996_RXQ_MCU_WA);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:63:\tRXQ_CONFIG(MT_RXQ_MAIN, WFDMA0, MT_INT_RX_DONE_BAND0, MT7996_RXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-64-\tif (mt7996_has_wa(dev))\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-65-\t\tRXQ_CONFIG(MT_RXQ_MAIN_WA, WFDMA0, MT_INT_RX_DONE_WA_MAIN,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:66:\t\t\t   MT7996_RXQ_MCU_WA_MAIN);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-67-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-69-\tcase MT7992_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:70:\t\tRXQ_CONFIG(MT_RXQ_BAND1_WA, WFDMA0, MT_INT_RX_DONE_WA_EXT, MT7996_RXQ_MCU_WA_EXT);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:71:\t\tRXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_RX_DONE_BAND1, MT7996_RXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-72-\t\tbreak;\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-73-\tcase MT7990_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:74:\t\tRXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_RX_DONE_BAND1, MT7996_RXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-75-\t\tRXQ_CONFIG(MT_RXQ_TXFREE_BAND0, WFDMA0,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-80-\t\tbreak;\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:81:\tcase MT7996_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-82-\tdefault:\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-83-\t\t/* mt7996 band2 */\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:84:\t\tRXQ_CONFIG(MT_RXQ_BAND2_WA, WFDMA0, MT_INT_RX_DONE_WA_TRI, MT7996_RXQ_MCU_WA_TRI);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:85:\t\tRXQ_CONFIG(MT_RXQ_BAND2, WFDMA0, MT_INT_RX_DONE_BAND2, MT7996_RXQ_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-86-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-91-\t\tRXQ_CONFIG(MT_RXQ_RRO_BAND0, WFDMA0, MT_INT_RX_DONE_RRO_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:92:\t\t\t   MT7996_RXQ_RRO_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-93-\t\tif (dev-\u003emt76.hwrro_mode == MT76_HWRRO_V3)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-95-\t\t\t\t   MT_INT_RX_DONE_MSDU_PG_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:96:\t\t\t\t   MT7996_RXQ_MSDU_PG_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-97-\t\tif (is_mt7996(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-98-\t\t\tRXQ_CONFIG(MT_RXQ_TXFREE_BAND0, WFDMA0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:99:\t\t\t\t   MT_INT_RX_TXFREE_MAIN, MT7996_RXQ_TXFREE0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-100-\t\t\t/* band1 */\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-102-\t\t\t\t   MT_INT_RX_DONE_MSDU_PG_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:103:\t\t\t\t   MT7996_RXQ_MSDU_PG_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-104-\t\t\t/* band2 */\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-106-\t\t\t\t   MT_INT_RX_DONE_RRO_BAND2,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:107:\t\t\t\t   MT7996_RXQ_RRO_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-108-\t\t\tRXQ_CONFIG(MT_RXQ_MSDU_PAGE_BAND2, WFDMA0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-109-\t\t\t\t   MT_INT_RX_DONE_MSDU_PG_BAND2,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:110:\t\t\t\t   MT7996_RXQ_MSDU_PG_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-111-\t\t\tRXQ_CONFIG(MT_RXQ_TXFREE_BAND2, WFDMA0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:112:\t\t\t\t   MT_INT_RX_TXFREE_TRI, MT7996_RXQ_TXFREE2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-113-\t\t} else {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-115-\t\t\t\t   MT_INT_RX_DONE_RRO_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:116:\t\t\t\t   MT7996_RXQ_RRO_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-117-\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-121-\t\t\t\t   MT_INT_RX_DONE_RRO_IND,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:122:\t\t\t\t   MT7996_RXQ_RRO_IND);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-123-\t\telse\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-125-\t\t\t\t   MT_INT_RX_DONE_RRO_RXDMAD_C,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:126:\t\t\t\t   MT7996_RXQ_RRO_RXDMAD_C);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-127-\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-133-\t\t\t\tTXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND2,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:134:\t\t\t\t\t   MT7996_TXQ_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-135-\t\t\t\tTXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:136:\t\t\t\t\t   MT7996_TXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-137-\t\t\t\tTXQ_CONFIG(2, WFDMA0, MT_INT_TX_DONE_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:138:\t\t\t\t\t   MT7996_TXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-139-\t\t\t} else {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-141-\t\t\t\tTXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:142:\t\t\t\t\t   MT7996_TXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-143-\t\t\t\tTXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:144:\t\t\t\t\t   MT7996_TXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-145-\t\t\t\tTXQ_CONFIG(2, WFDMA0, MT_INT_TX_DONE_BAND2,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:146:\t\t\t\t\t   MT7996_TXQ_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-147-\t\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-150-\t\t\tTXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:151:\t\t\t\t   MT7996_TXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-152-\t\t\tTXQ_CONFIG(2, WFDMA0, MT_INT_TX_DONE_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:153:\t\t\t\t   MT7996_TXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-154-\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-158-\t\t\tTXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:159:\t\t\t\t   MT7996_TXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-160-\t\t\tTXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND2,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:161:\t\t\t\t   MT7996_TXQ_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-162-\t\t} else {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-164-\t\t\tTXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:165:\t\t\t\t   MT7996_TXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-166-\t\t\tTXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:167:\t\t\t\t   MT7996_TXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-168-\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-171-\t/* mcu tx queue */\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:172:\tMCUQ_CONFIG(MT_MCUQ_FWDL, WFDMA0, MT_INT_TX_DONE_FWDL, MT7996_TXQ_FWDL);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:173:\tMCUQ_CONFIG(MT_MCUQ_WM, WFDMA0, MT_INT_TX_DONE_MCU_WM, MT7996_TXQ_MCU_WM);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-174-\tif (mt7996_has_wa(dev))\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-175-\t\tMCUQ_CONFIG(MT_MCUQ_WA, WFDMA0, MT_INT_TX_DONE_MCU_WA,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:176:\t\t\t    MT7996_TXQ_MCU_WA);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-177-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c=521=int mt7996_dma_rro_init(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-535-\t\t\t\t       MT_RXQ_ID(MT_RXQ_RRO_RXDMAD_C),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:536:\t\t\t\t       MT7996_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:537:\t\t\t\t       MT7996_RX_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-538-\t\t\t\t       MT_RXQ_RRO_AP_RING_BASE);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-561-\t\t\t       MT_RXQ_ID(MT_RXQ_RRO_IND),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:562:\t\t\t       MT7996_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-563-\t\t\t       0, MT_RXQ_RRO_IND_RING_BASE);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-574-\tsize = is_mt7996(mdev) \u0026\u0026 mt76_npu_device_active(mdev)\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:575:\t       ? MT7996_NPU_RX_RING_SIZE / 4 : MT7996_RX_RING_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-576-\tret = mt76_queue_alloc(dev, \u0026mdev-\u003eq_rx[MT_RXQ_MSDU_PAGE_BAND0],\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-577-\t\t\t       MT_RXQ_ID(MT_RXQ_MSDU_PAGE_BAND0),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:578:\t\t\t       size, MT7996_RX_MSDU_PAGE_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-579-\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_MSDU_PAGE_BAND0));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-591-\t\tsize = is_mt7996(mdev) \u0026\u0026 mt76_npu_device_active(mdev)\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:592:\t\t       ? MT7996_NPU_RX_RING_SIZE / 2 : MT7996_RX_RING_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-593-\t\tret = mt76_queue_alloc(dev, \u0026mdev-\u003eq_rx[MT_RXQ_MSDU_PAGE_BAND1],\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-594-\t\t\t\t       MT_RXQ_ID(MT_RXQ_MSDU_PAGE_BAND1),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:595:\t\t\t\t       size, MT7996_RX_MSDU_PAGE_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-596-\t\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_MSDU_PAGE_BAND1));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-609-\t\tsize = is_mt7996(mdev) \u0026\u0026 mt76_npu_device_active(mdev)\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:610:\t\t       ? MT7996_NPU_RX_RING_SIZE : MT7996_RX_RING_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-611-\t\tret = mt76_queue_alloc(dev, \u0026mdev-\u003eq_rx[MT_RXQ_MSDU_PAGE_BAND2],\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-612-\t\t\t\t       MT_RXQ_ID(MT_RXQ_MSDU_PAGE_BAND2),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:613:\t\t\t\t       size, MT7996_RX_MSDU_PAGE_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-614-\t\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_MSDU_PAGE_BAND2));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c=664=int mt7996_dma_init(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-683-\t\tret = mt7996_init_tx_queues(\u0026dev-\u003ephy, MT_TXQ_ID(0),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:684:\t\t\t\t\t    MT7996_NPU_TX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-685-\t\t\t\t\t    MT_TXQ_RING_BASE(0) + hif1_ofs,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-689-\t\t\t\t\t    MT_TXQ_ID(dev-\u003emphy.band_idx),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:690:\t\t\t\t\t    MT7996_TX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-691-\t\t\t\t\t    MT_TXQ_RING_BASE(0), wed);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-697-\t\t\t\t  MT_MCUQ_ID(MT_MCUQ_WM),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:698:\t\t\t\t  MT7996_TX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-699-\t\t\t\t  MT_MCUQ_RING_BASE(MT_MCUQ_WM));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-706-\t\t\t\t\t  MT_MCUQ_ID(MT_MCUQ_WA),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:707:\t\t\t\t\t  MT7996_TX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-708-\t\t\t\t\t  MT_MCUQ_RING_BASE(MT_MCUQ_WA));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-715-\t\t\t\t  MT_MCUQ_ID(MT_MCUQ_FWDL),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:716:\t\t\t\t  MT7996_TX_FWDL_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-717-\t\t\t\t  MT_MCUQ_RING_BASE(MT_MCUQ_FWDL));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-723-\t\t\t       MT_RXQ_ID(MT_RXQ_MCU),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:724:\t\t\t       MT7996_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:725:\t\t\t       MT7996_RX_MCU_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-726-\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_MCU));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-732-\t\t\t       MT_RXQ_ID(MT_RXQ_MCU_WA),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:733:\t\t\t       MT7996_RX_MCU_RING_SIZE_WA,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:734:\t\t\t       MT7996_RX_MCU_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-735-\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_MCU_WA));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-746-\t\t\t       MT_RXQ_ID(MT_RXQ_MAIN),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:747:\t\t\t       MT7996_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-748-\t\t\t       MT_RX_BUF_SIZE,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-766-\t\t\t\t       MT_RXQ_ID(MT_RXQ_MAIN_WA),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:767:\t\t\t\t       MT7996_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-768-\t\t\t\t       MT_RX_BUF_SIZE,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-778-\t\t\t\t       MT_RXQ_ID(MT_RXQ_TXFREE_BAND0),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:779:\t\t\t\t       MT7996_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:780:\t\t\t\t       MT7996_RX_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-781-\t\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_TXFREE_BAND0));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-792-\t\t\t\t       MT_RXQ_ID(MT_RXQ_TXFREE_BAND1),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:793:\t\t\t\t       MT7996_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:794:\t\t\t\t       MT7996_RX_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-795-\t\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_TXFREE_BAND1));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-804-\t\t\t\t       MT_RXQ_ID(MT_RXQ_BAND2),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:805:\t\t\t\t       MT7996_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-806-\t\t\t\t       MT_RX_BUF_SIZE,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-820-\t\t\t\t       MT_RXQ_ID(MT_RXQ_BAND2_WA),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:821:\t\t\t\t       MT7996_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-822-\t\t\t\t       MT_RX_BUF_SIZE,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-835-\t\t\t\t       MT_RXQ_ID(MT_RXQ_BAND1),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:836:\t\t\t\t       MT7996_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-837-\t\t\t\t       MT_RX_BUF_SIZE,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-852-\t\t\t\t\t       MT_RXQ_ID(MT_RXQ_BAND1_WA),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:853:\t\t\t\t\t       MT7996_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-854-\t\t\t\t\t       MT_RX_BUF_SIZE,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-868-\t\t\t\t       MT_RXQ_ID(MT_RXQ_RRO_BAND0),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:869:\t\t\t\t       MT7996_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:870:\t\t\t\t       MT7996_RX_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-871-\t\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_RRO_BAND0));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-883-\t\t\t\t\t       MT_RXQ_ID(MT_RXQ_RRO_BAND1),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:884:\t\t\t\t\t       MT7996_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:885:\t\t\t\t\t       MT7996_RX_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-886-\t\t\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_RRO_BAND1) + hif1_ofs);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-900-\t\t\t\t\t       MT_RXQ_ID(MT_RXQ_TXFREE_BAND0),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:901:\t\t\t\t\t       MT7996_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:902:\t\t\t\t\t       MT7996_RX_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-903-\t\t\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_TXFREE_BAND0));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-919-\t\t\t       mt76_npu_device_active(\u0026dev-\u003emt76)\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:920:\t\t\t       ? MT7996_NPU_RX_RING_SIZE : MT7996_RX_RING_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-921-\t\t\tret = mt76_queue_alloc(dev, \u0026dev-\u003emt76.q_rx[MT_RXQ_RRO_BAND2],\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-922-\t\t\t\t\t       MT_RXQ_ID(MT_RXQ_RRO_BAND2),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:923:\t\t\t\t\t       size, MT7996_RX_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-924-\t\t\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_RRO_BAND2) + hif1_ofs);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-934-\t\t\t\t\t       MT_RXQ_ID(MT_RXQ_TXFREE_BAND2),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:935:\t\t\t\t\t       MT7996_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:936:\t\t\t\t\t       MT7996_RX_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-937-\t\t\t\t\t       MT_RXQ_RING_BASE(MT_RXQ_TXFREE_BAND2) + hif1_ofs);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c=10=static int mt7996_check_eeprom(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-15-\tswitch (val) {\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:16:\tcase MT7996_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-17-\t\treturn is_mt7996(\u0026dev-\u003emt76) ? 0 : -EINVAL;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c=27=static char *mt7996_eeprom_name(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-32-\t\tcase MT7992_VAR_TYPE_23:\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:33:\t\t\tif (dev-\u003evar.fem == MT7996_FEM_INT)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-34-\t\t\t\treturn MT7992_EEPROM_DEFAULT_23_INT;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-39-\t\tdefault:\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:40:\t\t\tif (dev-\u003evar.fem == MT7996_FEM_INT)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-41-\t\t\t\treturn MT7992_EEPROM_DEFAULT_INT;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:42:\t\t\tif (dev-\u003evar.fem == MT7996_FEM_MIX)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-43-\t\t\t\treturn MT7992_EEPROM_DEFAULT_MIX;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-46-\tcase MT7990_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:47:\t\tif (dev-\u003evar.fem == MT7996_FEM_INT)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-48-\t\t\treturn MT7990_EEPROM_DEFAULT_INT;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-49-\t\treturn MT7990_EEPROM_DEFAULT;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:50:\tcase MT7996_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-51-\tdefault:\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-52-\t\tswitch (dev-\u003evar.type) {\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:53:\t\tcase MT7996_VAR_TYPE_233:\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:54:\t\t\tif (dev-\u003evar.fem == MT7996_FEM_INT)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:55:\t\t\t\treturn MT7996_EEPROM_DEFAULT_233_INT;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:56:\t\t\treturn MT7996_EEPROM_DEFAULT_233;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:57:\t\tcase MT7996_VAR_TYPE_444:\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-58-\t\tdefault:\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:59:\t\t\tif (dev-\u003evar.fem == MT7996_FEM_INT)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:60:\t\t\t\treturn MT7996_EEPROM_DEFAULT_INT;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:61:\t\t\treturn MT7996_EEPROM_DEFAULT;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-62-\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c=98=static bool mt7996_eeprom_variant_valid(struct mt7996_dev *dev, const u8 *def)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-108-\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:109:\tif (dev-\u003evar.fem == MT7996_FEM_EXT \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-110-\t    !(fem[0] == FEM_EXT \u0026\u0026 fem[1] == FEM_EXT))\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-111-\t\treturn false;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:112:\telse if (dev-\u003evar.fem == MT7996_FEM_INT \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-113-\t\t !(fem[0] == FEM_INT \u0026\u0026 fem[1] == FEM_INT))\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-114-\t\treturn false;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:115:\telse if (dev-\u003evar.fem == MT7996_FEM_MIX \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-116-\t\t !(fem[0] == FEM_INT \u0026\u0026 fem[1] == FEM_EXT))\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c=137=mt7996_eeprom_check_or_use_default(struct mt7996_dev *dev, bool use_default)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-152-\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:153:\tif (fw-\u003esize \u003c MT7996_EEPROM_SIZE) {\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-154-\t\tdev_err(dev-\u003emt76.dev, \"Invalid default bin size\\n\");\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-162-\tdev_warn(dev-\u003emt76.dev, \"eeprom load fail, use default bin\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:163:\tmemcpy(eeprom, fw-\u003edata, MT7996_EEPROM_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-164-\tdev-\u003eeeprom_mode = EEPROM_MODE_DEFAULT_BIN;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c=172=static int mt7996_eeprom_load(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-177-\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:178:\tret = mt76_eeprom_init(\u0026dev-\u003emt76, MT7996_EEPROM_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-179-\tif (ret \u003c 0)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-186-\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:187:\tmemset(dev-\u003emt76.eeprom.data, 0, MT7996_EEPROM_SIZE);\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-188-\tif (mt7996_has_ext_eeprom(dev)) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-190-\t\tdev-\u003eeeprom_mode = EEPROM_MODE_EXT;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:191:\t\teeprom_blk_size = MT7996_EXT_EEPROM_BLOCK_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-192-\t} else {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-196-\t\tdev-\u003eeeprom_mode = EEPROM_MODE_EFUSE;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:197:\t\teeprom_blk_size = MT7996_EEPROM_BLOCK_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-198-\t\tret = mt7996_mcu_get_efuse_free_block(dev, \u0026free_block_num);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-217-\t/* read eeprom data from fw */\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:218:\tblock_num = DIV_ROUND_UP(MT7996_EEPROM_SIZE, eeprom_blk_size);\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-219-\tfor (i = 1; i \u003c block_num; i++) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-222-\t\tif (i == block_num - 1)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:223:\t\t\tlen = MT7996_EEPROM_SIZE % eeprom_blk_size;\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-224-\t\tret = mt7996_mcu_get_eeprom(dev, i * eeprom_blk_size,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c=395=bool mt7996_eeprom_has_background_radar(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-397-\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:398:\tcase MT7996_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:399:\t\tif (dev-\u003evar.type == MT7996_VAR_TYPE_233)\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c-400-\t\t\treturn false;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.h-5-\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.h:6:#ifndef __MT7996_EEPROM_H\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.h:7:#define __MT7996_EEPROM_H\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.h-8-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=17=static const struct ieee80211_iface_limit if_limits_global = {\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:18:\t.max = MT7996_MAX_INTERFACES * MT7996_MAX_RADIOS,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-19-\t.types = BIT(NL80211_IFTYPE_STATION)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=27=static const struct ieee80211_iface_combination if_comb_global = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-29-\t.n_limits = 1,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:30:\t.max_interfaces = MT7996_MAX_INTERFACES * MT7996_MAX_RADIOS,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:31:\t.num_different_channels = MT7996_MAX_RADIOS,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-32-\t.radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=39=static const struct ieee80211_iface_combination if_comb_global_7992 = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-42-\t.max_interfaces = 32,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:43:\t.num_different_channels = MT7996_MAX_RADIOS - 1,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-44-\t.radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=51=static const struct ieee80211_iface_limit if_limits[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-58-\t}, {\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:59:\t\t.max = MT7996_MAX_INTERFACES,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-60-\t\t.types = BIT(NL80211_IFTYPE_STATION)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=64=static const struct ieee80211_iface_combination if_comb = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-66-\t.n_limits = ARRAY_SIZE(if_limits),\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:67:\t.max_interfaces = MT7996_MAX_INTERFACES,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-68-\t.num_different_channels = 1,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=84=static const struct wiphy_iftype_ext_capab iftypes_ext_capa[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-92-\t\t\tFIELD_PREP_CONST(IEEE80211_MLD_CAP_OP_MAX_SIMUL_LINKS,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:93:\t\t\t\t\t MT7996_MAX_RADIOS - 1),\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-94-\t}, {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-101-\t\t\tFIELD_PREP_CONST(IEEE80211_MLD_CAP_OP_MAX_SIMUL_LINKS,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:102:\t\t\t\t\t MT7996_MAX_RADIOS - 1),\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-103-\t},\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=132=static ssize_t mt7996_thermal_temp_store(struct device *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-147-\t/* add a safety margin ~10 */\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:148:\tif ((i - 1 == MT7996_CRIT_TEMP_IDX \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:149:\t     val \u003e phy-\u003ethrottle_temp[MT7996_MAX_TEMP_IDX] - 10) ||\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:150:\t    (i - 1 == MT7996_MAX_TEMP_IDX \u0026\u0026\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:151:\t     val - 10 \u003c phy-\u003ethrottle_temp[MT7996_CRIT_TEMP_IDX])) {\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-152-\t\tdev_err(phy-\u003edev-\u003emt76.dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=183=mt7996_thermal_get_max_throttle_state(struct thermal_cooling_device *cdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-185-{\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:186:\t*state = MT7996_CDEV_THROTTLE_MAX;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-187-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=203=mt7996_thermal_set_cur_throttle_state(struct thermal_cooling_device *cdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-206-\tstruct mt7996_phy *phy = cdev-\u003edevdata;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:207:\tu8 throttling = MT7996_THERMAL_THROTTLE_MAX - state;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-208-\tint ret;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-209-\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:210:\tif (state \u003e MT7996_CDEV_THROTTLE_MAX) {\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-211-\t\tdev_err(phy-\u003edev-\u003emt76.dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=250=static int mt7996_thermal_init(struct mt7996_phy *phy)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-274-\t/* initialize critical/maximum high temperature */\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:275:\tphy-\u003ethrottle_temp[MT7996_CRIT_TEMP_IDX] = MT7996_CRIT_TEMP;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:276:\tphy-\u003ethrottle_temp[MT7996_MAX_TEMP_IDX] = MT7996_MAX_TEMP;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-277-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=603=static void mt7996_mac_init_basic_rates(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-609-\t\t/* odd index for driver, even index for firmware */\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:610:\t\tu16 idx = MT7996_BASIC_RATES_TBL + 2 * i;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-611-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=690=static int mt7996_register_phy(struct mt7996_dev *dev, enum mt76_band_id band)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-753-\t\t\t   mt76_npu_device_active(\u0026dev-\u003emt76)\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:754:\t\t\t   ? MT7996_NPU_TX_RING_SIZE / 2 : MT7996_TX_RING_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-755-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=833=static void mt7996_rro_hw_init_v3(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-843-\t\twed-\u003ewlan.ind_cmd.win_size =\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:844:\t\t\tffs(MT7996_RRO_WINDOW_MAX_LEN) - 6;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-845-\t\tif (is_mt7996(\u0026dev-\u003emt76))\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-846-\t\t\twed-\u003ewlan.ind_cmd.particular_sid =\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:847:\t\t\t\tMT7996_RRO_MAX_SESSION;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-848-\t\telse\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-851-\t\t\tdev-\u003ewed_rro.session.phy_addr;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:852:\t\twed-\u003ewlan.ind_cmd.se_group_nums = MT7996_RRO_ADDR_ELEM_LEN;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-853-\t\twed-\u003ewlan.ind_cmd.ack_sn_addr = MT_RRO_ACK_SN_CTRL;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-869-\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:870:\tsession_id = is_mt7996(\u0026dev-\u003emt76) ? MT7996_RRO_MAX_SESSION : 1;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-871-\tmt76_wr(dev, MT_RRO_PARTICULAR_CFG1,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=957=static int mt7996_wed_rro_init(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-969-\t\t\tptr = dmam_alloc_coherent(dev-\u003emt76.dma_dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:970:\t\t\t\t\t\t  MT7996_RRO_BA_BITMAP_CR_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-971-\t\t\t\t\t\t  \u0026dev-\u003ewed_rro.ba_bitmap[i].phy_addr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-983-\t\tptr = dmam_alloc_coherent(dev-\u003emt76.dma_dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:984:\t\t\t\tMT7996_RRO_WINDOW_MAX_SIZE * sizeof(*addr),\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-985-\t\t\t\t\u0026dev-\u003ewed_rro.addr_elem[i].phy_addr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-991-\t\tmemset(dev-\u003ewed_rro.addr_elem[i].ptr, 0,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:992:\t\t       MT7996_RRO_WINDOW_MAX_SIZE * sizeof(*addr));\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-993-\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-994-\t\taddr = dev-\u003ewed_rro.addr_elem[i].ptr;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:995:\t\tfor (j = 0; j \u003c MT7996_RRO_WINDOW_MAX_SIZE; j++) {\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-996-\t\t\taddr-\u003edata = cpu_to_le32(val);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1018-\t\tptr = dmam_alloc_coherent(dev-\u003emt76.dma_dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:1019:\t\t\t\t\t  MT7996_RRO_MSDU_PG_SIZE_PER_CR,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1020-\t\t\t\t\t  \u0026dev-\u003ewed_rro.msdu_pg[i].phy_addr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1027-\t\tmemset(dev-\u003ewed_rro.msdu_pg[i].ptr, 0,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:1028:\t\t       MT7996_RRO_MSDU_PG_SIZE_PER_CR);\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1029-\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1052-\tptr = dmam_alloc_coherent(dev-\u003emt76.dma_dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:1053:\t\t\t\t  MT7996_RRO_WINDOW_MAX_LEN * sizeof(*addr),\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1054-\t\t\t\t  \u0026dev-\u003ewed_rro.session.phy_addr,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1060-\taddr = dev-\u003ewed_rro.session.ptr;\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:1061:\tfor (i = 0; i \u003c MT7996_RRO_WINDOW_MAX_LEN; i++) {\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1062-\t\taddr-\u003edata = cpu_to_le32(val);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c=1075=static void mt7996_wed_rro_free(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1086-\t\tdmam_free_coherent(dev-\u003emt76.dma_dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:1087:\t\t\t\t   MT7996_RRO_BA_BITMAP_CR_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c-1088-\t\t\t\t   dev-\u003ewed_rro.ba_bitmap[i].ptr,\n--\n\n"
}

gemini-3.7-flash

null

null

							input: 23723
							output: 50
							thoughts: 97
						

**Analyzing the MT7996 Driver**

Okay, so I'm looking at the `mt7996` driver, specifically within the MediaTek WiFi suite, under `drivers/net/wireless/mediatek/mt76/mt7996/`. I need to figure out the PCI device specifics of this. My next step is to drill down into `pci.c` within that directory. I'm hoping to get a clear picture of what PCI devices are supported and, critically, whether this driver handles solely physical PCIe hardware, or if it might also incorporate some form of emulation. Understanding this distinction is crucial for my current task, so `pci.c` it is.

{
  "File": "drivers/net/wireless/mediatek/mt76/mt7996/pci.c",
  "FirstLine": 1,
  "LineCount": 100
}

{
  "Contents": "   1:\t// SPDX-License-Identifier: BSD-3-Clause-Clear\n   2:\t/*\n   3:\t * Copyright (C) 2022 MediaTek Inc.\n   4:\t */\n   5:\t\n   6:\t#include \u003clinux/kernel.h\u003e\n   7:\t#include \u003clinux/module.h\u003e\n   8:\t#include \u003clinux/pci.h\u003e\n   9:\t\n  10:\t#include \"mt7996.h\"\n  11:\t#include \"mac.h\"\n  12:\t#include \"../trace.h\"\n  13:\t\n  14:\tstatic LIST_HEAD(hif_list);\n  15:\tstatic DEFINE_SPINLOCK(hif_lock);\n  16:\tstatic u32 hif_idx;\n  17:\t\n  18:\tstatic const struct pci_device_id mt7996_pci_device_table[] = {\n  19:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID) },\n  20:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID) },\n  21:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID) },\n  22:\t\t{ },\n  23:\t};\n  24:\t\n  25:\tstatic const struct pci_device_id mt7996_hif_device_table[] = {\n  26:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID_2) },\n  27:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID_2) },\n  28:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID_2) },\n  29:\t\t{ },\n  30:\t};\n  31:\t\n  32:\tstatic struct mt7996_hif *mt7996_pci_get_hif2(u32 idx)\n  33:\t{\n  34:\t\tstruct mt7996_hif *hif;\n  35:\t\tu32 val;\n  36:\t\n  37:\t\tspin_lock_bh(\u0026hif_lock);\n  38:\t\n  39:\t\tlist_for_each_entry(hif, \u0026hif_list, list) {\n  40:\t\t\tval = readl(hif-\u003eregs + MT_PCIE_RECOG_ID);\n  41:\t\t\tval \u0026= MT_PCIE_RECOG_ID_MASK;\n  42:\t\t\tif (val != idx)\n  43:\t\t\t\tcontinue;\n  44:\t\n  45:\t\t\tget_device(hif-\u003edev);\n  46:\t\t\tgoto out;\n  47:\t\t}\n  48:\t\thif = NULL;\n  49:\t\n  50:\tout:\n  51:\t\tspin_unlock_bh(\u0026hif_lock);\n  52:\t\n  53:\t\treturn hif;\n  54:\t}\n  55:\t\n  56:\tstatic void mt7996_put_hif2(struct mt7996_hif *hif)\n  57:\t{\n  58:\t\tif (!hif)\n  59:\t\t\treturn;\n  60:\t\n  61:\t\tput_device(hif-\u003edev);\n  62:\t}\n  63:\t\n  64:\tstatic struct mt7996_hif *mt7996_pci_init_hif2(struct pci_dev *pdev)\n  65:\t{\n  66:\t\thif_idx++;\n  67:\t\n  68:\t\tif (!pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID_2, NULL) \u0026\u0026\n  69:\t\t    !pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID_2, NULL) \u0026\u0026\n  70:\t\t    !pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID_2, NULL))\n  71:\t\t\treturn NULL;\n  72:\t\n  73:\t\twritel(hif_idx | MT_PCIE_RECOG_ID_SEM,\n  74:\t\t       pcim_iomap_table(pdev)[0] + MT_PCIE_RECOG_ID);\n  75:\t\n  76:\t\treturn mt7996_pci_get_hif2(hif_idx);\n  77:\t}\n  78:\t\n  79:\tstatic int mt7996_pci_hif2_probe(struct pci_dev *pdev)\n  80:\t{\n  81:\t\tstruct mt7996_hif *hif;\n  82:\t\n  83:\t\thif = devm_kzalloc(\u0026pdev-\u003edev, sizeof(*hif), GFP_KERNEL);\n  84:\t\tif (!hif)\n  85:\t\t\treturn -ENOMEM;\n  86:\t\n  87:\t\thif-\u003edev = \u0026pdev-\u003edev;\n  88:\t\thif-\u003eregs = pcim_iomap_table(pdev)[0];\n  89:\t\thif-\u003eirq = pdev-\u003eirq;\n  90:\t\tpcie_bandwidth_available(pdev, NULL, \u0026hif-\u003espeed, \u0026hif-\u003ewidth);\n  91:\t\tspin_lock_bh(\u0026hif_lock);\n  92:\t\tlist_add(\u0026hif-\u003elist, \u0026hif_list);\n  93:\t\tspin_unlock_bh(\u0026hif_lock);\n  94:\t\tpci_set_drvdata(pdev, hif);\n  95:\t\n  96:\t\treturn 0;\n  97:\t}\n  98:\t\n  99:\tstatic int mt7996_pci_probe(struct pci_dev *pdev,\n 100:\t\t\t\t    const struct pci_device_id *id)\n"
}

gemini-3.7-flash

null

null

							input: 25602
							output: 36
							thoughts: 376
						

**My Assessment of the Patch's Fuzzing Worthiness**

Okay, let's break this down. First, the instructions are pretty clear: certain modifications automatically mean "no" to fuzzing. It's essentially a list of things that don't introduce new execution paths that a fuzzer would care about. Documentation, comments, decorative logging, inconsequential numeric changes, unreachable code in virtualized environments, hardware-specific drivers that are impossible to emulate, and teardown callbacks - all no-gos.

Now, my initial thought: is this patch focused on a MediaTek WiFi driver, specifically mt7996? If so, is it limited to PCIe hardware? That's the critical question. I need to determine if it's strictly dependent on physical hardware or if there's any pathway to reach it through USB, `mac80211_hwsim`, or any other method that *can* be used in a virtualized fuzzing environment.

My next step is to dive into the code. I'm going to exhaustively examine all the files within the `drivers/net/wireless/mediatek/mt76/mt7996/` directory. This will be my decisive step in determining whether this is worth the effort to fuzz. I need to ascertain if the code touches core kernel logic, drivers, or architectures that are realistically executable.

{
  "Dir": "drivers/net/wireless/mediatek/mt76/mt7996"
}

{
  "Files": [
    "coredump.c",
    "coredump.h",
    "debugfs.c",
    "dma.c",
    "eeprom.c",
    "eeprom.h",
    "init.c",
    "mac.c",
    "mac.h",
    "main.c",
    "mcu.c",
    "mcu.h",
    "mmio.c",
    "mt7996.h",
    "npu.c",
    "pci.c",
    "regs.h"
  ],
  "Subdirs": null
}

gemini-3.7-flash

null

null

							input: 26434
							output: 55
							thoughts: 41
						

Okay, let's dive into this. Here's how I'd approach that file...

**Analyzing mt7996's PCI Driver**

Alright, before I get too deep into this particular module (`drivers/net/wireless/mediatek/mt76/mt7996/pci.c`), I need to quickly determine the scope of its bus support. It's titled "pci.c," so the obvious assumption is PCI. But, with these newer Mediatek implementations, they often share core code across different bus interfaces. So, I need to confirm that this file is *only* dealing with PCI, or if there's some abstraction going on. I'm going to scan the code for anything that might indicate support for other bus types like SDIO or USB. I'll be looking for conditional compilation, device ID checks, or any kind of bus-specific initialization routines that hint at multi-bus support within this module. If it's solely PCI, that simplifies things a bit, but I still need to understand how tightly coupled it is to the PCI-specific features and the Mediatek wireless chipset.

{
  "Expression": "module_init|module_pci_driver|pci_register_driver",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7996"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7996/mmio.c=889=static int __init mt7996_init(void)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-892-\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:893:\tret = pci_register_driver(\u0026mt7996_hif_driver);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-894-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-896-\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:897:\tret = pci_register_driver(\u0026mt7996_pci_driver);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-898-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c=904=static void __exit mt7996_exit(void)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-909-\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:910:module_init(mt7996_init);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-911-module_exit(mt7996_exit);\n"
}

gemini-3.7-flash

null

null

							input: 27215
							output: 122
							thoughts: 686
						

**My Assessment of the Fuzzing Potential**

Okay, so I've looked at this patch and I'm pretty certain it's not going to be fruitful for fuzzing in a standard QEMU or GCE environment. Let's break it down: `mt7996` is exclusively a PCIe driver, right? We're talking about specific MediaTek PCIe wireless cards – those specific device IDs (0x7996, 0x7992, 0x7990 with vendor 0x14c3). Now, the problem is, and this is the crux of the matter, QEMU and GCE just don't emulate those MediaTek PCIe Wi-Fi NICs. No dice.

I quickly checked, there's no virtualized or emulated support for that hardware in QEMU. USB is a dead end here. We could look at USB gadget or raw-gadget / dummy_hcd, but that's not relevant; this is strictly PCIe. Mac80211 hwsim, which emulates mac80211 radios directly, also bypasses vendor drivers like `mt7996`, so it's irrelevant.

Then, I double-checked the guidelines. We're explicitly told to avoid code paths that are impossible to reach in virtualized environments, even with software emulation. We are also told to stay away from specific PCIe switch, SmartNIC, or GPU drivers that require real hardware not available in standard QEMU. That's exactly where we are: a vendor-specific PCIe Wi-Fi driver.

The changes in this patch series are all in `drivers/net/wireless/mediatek/mt76/mt7996/` - `mac.c`, `main.c`, and `mmio.c`. That's the `mt7996e` module, and that's the vendor driver. Without the actual MediaTek PCIe hardware, this driver won't even probe, making its functions completely unreachable in a QEMU/GCE fuzzing setup.

Therefore, for all these reasons I have to conclude that `WorthFuzzing` should be `false`.

So, here's my prepared reasoning:

*   The modifications are located specifically within the `drivers/net/wireless/mediatek/mt76/mt7996/` directory, specifically within the MediaTek PCIe driver that supports the MT7996 / MT7992 / MT7990 Wi-Fi devices.
*   The required physical PCIe devices are not emulated in virtualized fuzzing environments such as QEMU or GCE. Software emulation also won't work: USB gadgets or mac80211\_hwsim aren't relevant.
*   As a result, the code is unreachable during fuzzing.

And now I'm going to call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The changes are confined to drivers/net/wireless/mediatek/mt76/mt7996/, which is a vendor-specific PCIe wireless driver for MediaTek MT7996/MT7992/MT7990 devices. These PCIe devices require specific physical hardware and are not emulated in standard virtualized environments (such as QEMU/GCE), making the modified code unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The changes are confined to drivers/net/wireless/mediatek/mt76/mt7996/, which is a vendor-specific PCIe wireless driver for MediaTek MT7996/MT7992/MT7990 devices. These PCIe devices require specific physical hardware and are not emulated in standard virtualized environments (such as QEMU/GCE), making the modified code unreachable for fuzzing.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null