AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/09/06 12:47	flow	patch-triage	1m Args: null Results: { "EnableConfigs": [ "ATH9K_HTC", "USB", "MAC80211", "WLAN_VENDOR_ATH" ], "FocusSymbols": [ "hif_usb_send_regout", "ath9k_reg_rmw_buffer", "ath9k_reg_rmw_flush", "ath9k_reg_rmw", "hif_usb_send" ], "KMSANReasoning": "The patch addresses a USB communication issue in the ath9k driver where USB packets that are exact multiples of endpoint maxpacket size cause firmware delivery stalls. The changes consist of:\n1. Adding a check in `hif_usb_send_regout()` to warn and reject skbs whose length is an exact multiple of the endpoint maxpacket size.\n2. Correcting the buffer size calculation in `ath9k_reg_rmw_buffer()` from `sizeof(struct register_write)` (8 bytes) to `sizeof(struct register_rmw)` (12 bytes).\n3. Lowering `MAX_RMW_CMD_NUMBER` from 15 to 14 in `wmi.h` to avoid 64-byte aligned USB payloads.\n\nRegarding memory initialization:\n- All fields (`reg`, `set`, `clr`) of the `struct register_rmw` array elements in `priv-\u003ewmi-\u003emulti_rmw` are explicitly initialized before being sent via `ath9k_wmi_cmd()`.\n- No user-space copy paths or uninitialized kernel structure fields are exposed or modified.\n- No branch conditions rely on uninitialized values.\n\nTherefore, this patch introduces no uninitialized memory risks, and a dedicated KMSAN fuzzing session is not required.", "NeedsKMSAN": false, "Reasoning": "The patch modifies the USB wireless driver ath9k_htc, which is reachable via USB gadget/device emulation in syzkaller. The changes add a new WARN_ONCE runtime assertion and check in hif_usb_send_regout to prevent sending packets whose length is an exact multiple of the USB maxpacket size, correct the element size calculation in ath9k_reg_rmw_buffer from sizeof(struct register_write) to sizeof(struct register_rmw), and reduce MAX_RMW_CMD_NUMBER. Fuzzing is warranted to test the new assertion and altered RMW command batching logic.", "WorthFuzzing": true }
1/1	2026/09/06 12:47	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 4a872e85917d67040075191978246f39b0b95e47\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sun Sep 6 12:47:33 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c\nindex d3491ff08e6ef..49303c7e3fef4 100644\n--- a/drivers/net/wireless/ath/ath9k/hif_usb.c\n+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c\n@@ -99,10 +99,17 @@ static void hif_usb_regout_cb(struct urb urb)\n static int hif_usb_send_regout(struct hif_device_usb hif_dev,\n \t\t\t struct sk_buff skb)\n {\n+\tu16 maxpacket = usb_maxpacket(hif_dev-\u003eudev,\n+\t\t\t\t usb_sndintpipe(hif_dev-\u003eudev,\n+\t\t\t\t\t\t USB_REG_OUT_PIPE));\n \tstruct urb urb;\n \tstruct cmd_buf cmd;\n \tint ret = 0;\n \n+\tif (WARN_ONCE(maxpacket \u0026\u0026 skb-\u003elen % maxpacket == 0,\n+\t\t \"%u-byte command fills whole USB packets\\n\", skb-\u003elen))\n+\t\treturn -EINVAL;\n+\n \turb = usb_alloc_urb(0, GFP_KERNEL);\n \tif (urb == NULL)\n \t\treturn -ENOMEM;\ndiff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c\nindex 6de78ae857268..0b49d2cc99f0b 100644\n--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c\n+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c\n@@ -405,7 +405,7 @@ static void ath9k_reg_rmw_buffer(void hw_priv,\n \tif (priv-\u003ewmi-\u003emulti_rmw_idx == MAX_RMW_CMD_NUMBER) {\n \t\tr = ath9k_wmi_cmd(priv-\u003ewmi, WMI_REG_RMW_CMDID,\n \t\t\t (u8 ) \u0026priv-\u003ewmi-\u003emulti_rmw,\n-\t\t\t sizeof(struct register_write) priv-\u003ewmi-\u003emulti_rmw_idx,\n+\t\t\t sizeof(struct register_rmw) * priv-\u003ewmi-\u003emulti_rmw_idx,\n \t\t\t (u8 ) \u0026rsp_status, sizeof(rsp_status),\n \t\t\t 100);\n \t\tif (unlikely(r)) {\ndiff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h\nindex 5c3b710b8f319..256f46098a6b1 100644\n--- a/drivers/net/wireless/ath/ath9k/wmi.h\n+++ b/drivers/net/wireless/ath/ath9k/wmi.h\n@@ -126,7 +126,8 @@ enum wmi_event_id {\n };\n \n #define MAX_CMD_NUMBER 62\n-#define MAX_RMW_CMD_NUMBER 15\n+/ 15 entries make 192 bytes, three full USB packets: never delivered. */\n+#define MAX_RMW_CMD_NUMBER 14\n \n struct register_write {\n \t__be32 reg;\n" }
2/1	2026/09/06 12:47	agent	patch-evaluator	0m Model: core Args: null Results: { "EnableConfigs": [ "ATH9K_HTC", "USB", "MAC80211", "WLAN_VENDOR_ATH" ], "FocusSymbols": [ "hif_usb_send_regout", "ath9k_reg_rmw_buffer", "ath9k_reg_rmw_flush", "ath9k_reg_rmw", "hif_usb_send" ], "Reasoning": "The patch modifies the USB wireless driver ath9k_htc, which is reachable via USB gadget/device emulation in syzkaller. The changes add a new WARN_ONCE runtime assertion and check in hif_usb_send_regout to prevent sending packets whose length is an exact multiple of the USB maxpacket size, correct the element size calculation in ath9k_reg_rmw_buffer from sizeof(struct register_write) to sizeof(struct register_rmw), and reduce MAX_RMW_CMD_NUMBER. Fuzzing is warranted to test the new assertion and altered RMW command batching logic.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 4a872e85917d67040075191978246f39b0b95e47 Author: syz-cluster <triage@syzkaller.com> Date: Sun Sep 6 12:47:33 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index d3491ff08e6ef..49303c7e3fef4 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -99,10 +99,17 @@ static void hif_usb_regout_cb(struct urb urb) static int hif_usb_send_regout(struct hif_device_usb hif_dev, struct sk_buff skb) { + u16 maxpacket = usb_maxpacket(hif_dev->udev, + usb_sndintpipe(hif_dev->udev, + USB_REG_OUT_PIPE)); struct urb urb; struct cmd_buf cmd; int ret = 0; + if (WARN_ONCE(maxpacket && skb->len % maxpacket == 0, + "%u-byte command fills whole USB packets\n", skb->len)) + return -EINVAL; + urb = usb_alloc_urb(0, GFP_KERNEL); if (urb == NULL) return -ENOMEM; diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c index 6de78ae857268..0b49d2cc99f0b 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c @@ -405,7 +405,7 @@ static void ath9k_reg_rmw_buffer(void hw_priv, if (priv->wmi->multi_rmw_idx == MAX_RMW_CMD_NUMBER) { r = ath9k_wmi_cmd(priv->wmi, WMI_REG_RMW_CMDID, (u8 ) &priv->wmi->multi_rmw, - sizeof(struct register_write) priv->wmi->multi_rmw_idx, + sizeof(struct register_rmw) * priv->wmi->multi_rmw_idx, (u8 ) &rsp_status, sizeof(rsp_status), 100); if (unlikely(r)) { diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h index 5c3b710b8f319..256f46098a6b1 100644 --- a/drivers/net/wireless/ath/ath9k/wmi.h +++ b/drivers/net/wireless/ath/ath9k/wmi.h @@ -126,7 +126,8 @@ enum wmi_event_id { }; #define MAX_CMD_NUMBER 62 -#define MAX_RMW_CMD_NUMBER 15 +/ 15 entries make 192 bytes, three full USB packets: never delivered. */ +#define MAX_RMW_CMD_NUMBER 14 struct register_write { __be32 reg;
3/2	2026/09/06 12:47	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 3577 output: 37 thoughts: 335 Thoughts: Analyzing this Patch for USB Vulnerabilities Okay, let's break this down. First, I need to understand what this patch is actually doing. It looks like we have changes across three files in the `ath9k` wireless driver: `hif_usb.c`, `htc_drv_init.c`, and `wmi.h`. Specifically: * In `hif_usb.c`, it seems we're adding a check within `hif_usb_send_regout` related to USB packet size. We calculate `maxpacket` using `usb_maxpacket()` and then add a `WARN_ONCE` call to return `-EINVAL` if the skb's length is a multiple of `maxpacket`. This is interesting; I need to understand why they're adding this. Is there a potential buffer overrun condition they're trying to prevent with the integer division's modulus of zero? Perhaps an off-by-one or data integrity issue? * Next, in `htc_drv_init.c`, the patch modifies a size calculation within `ath9k_reg_rmw_buffer`. It seems we're switching from `struct register_write` to `struct register_rmw`. This suggests a potential change in the underlying data structure being used for register read-modify-write operations, which I need to investigate further. It also appears the `priv->wmi->multi_rmw_idx` value will also need checking with that change. * Finally, in `wmi.h`, `MAX_RMW_CMD_NUMBER` is being changed from 15 to 14. This suggests a change in the maximum number of register read-modify-write commands that can be issued. This seems related to the changes in `htc_drv_init.c`. Now, the crucial question: can we reach this `ath9k_htc` driver through USB emulation? Yes, based on my understanding and quick check, `ath9k_htc` is indeed a USB wireless network driver. I'm going to quickly check the Kconfig to confirm its dependencies. If we can reach it, then this patch becomes significantly more interesting from a security perspective. It is good to know it is reachable and, thus, potentially vulnerable. I'll need to focus on how these changes might impact fuzzing or exploit development.
4/2	2026/09/06 12:47	tool	grepper	0m Args: { "Expression": "ATH9K_HTC", "PathPrefix": "drivers/net/wireless/ath/ath9k/" } Results: { "Output": "drivers/net/wireless/ath/ath9k/Kconfig=13=config ATH9K_BTCOEX_SUPPORT\ndrivers/net/wireless/ath/ath9k/Kconfig-14-\tbool \"Atheros bluetooth coexistence support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:15:\tdepends on (ATH9K \|\| ATH9K_HTC)\ndrivers/net/wireless/ath/ath9k/Kconfig-16-\tdefault y\n--\ndrivers/net/wireless/ath/ath9k/Kconfig=156=config ATH9K_PCI_NO_EEPROM\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-171-\ndrivers/net/wireless/ath/ath9k/Kconfig:172:config ATH9K_HTC\ndrivers/net/wireless/ath/ath9k/Kconfig-173-\ttristate \"Atheros HTC based wireless cards support\"\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-186-\ndrivers/net/wireless/ath/ath9k/Kconfig:187:config ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-188-\tbool \"Atheros ath9k_htc debugging\"\ndrivers/net/wireless/ath/ath9k/Kconfig:189:\tdepends on ATH9K_HTC \u0026\u0026 DEBUG_FS\ndrivers/net/wireless/ath/ath9k/Kconfig-190-\tselect ATH9K_COMMON_DEBUG\n--\ndrivers/net/wireless/ath/ath9k/Kconfig=206=config ATH9K_COMMON_SPECTRAL\ndrivers/net/wireless/ath/ath9k/Kconfig-207-\tbool \"Atheros ath9k/ath9k_htc spectral scan support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:208:\tdepends on ATH9K_DEBUGFS \|\| ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-209-\tselect RELAY\n--\ndrivers/net/wireless/ath/ath9k/Makefile=68=ath9k_htc-y +=\thtc_hst.o \\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-76-\ndrivers/net/wireless/ath/ath9k/Makefile:77:ath9k_htc-$(CONFIG_ATH9K_HTC_DEBUGFS) += htc_drv_debug.o\ndrivers/net/wireless/ath/ath9k/Makefile-78-\ndrivers/net/wireless/ath/ath9k/Makefile:79:obj-$(CONFIG_ATH9K_HTC) += ath9k_htc.o\ndrivers/net/wireless/ath/ath9k/Makefile-80-\n--\ndrivers/net/wireless/ath/ath9k/ar9003_eeprom.c=3390=static bool ath9k_hw_ar9300_fill_eeprom(struct ath_hw ah)\n--\ndrivers/net/wireless/ath/ath9k/ar9003_eeprom.c-3400-\ndrivers/net/wireless/ath/ath9k/ar9003_eeprom.c:3401:#if defined(CONFIG_ATH9K_DEBUGFS) \|\| defined(CONFIG_ATH9K_HTC_DEBUGFS)\ndrivers/net/wireless/ath/ath9k/ar9003_eeprom.c-3402-static u32 ar9003_dump_modal_eeprom(char buf, u32 len, u32 size,\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c=239=static inline void ath9k_skb_queue_complete(struct hif_device_usb hif_dev,\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-245-\twhile ((skb = __skb_dequeue(queue)) != NULL) {\ndrivers/net/wireless/ath/ath9k/hif_usb.c:246:#ifdef CONFIG_ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/hif_usb.c-247-\t\tint ln = skb-\u003elen;\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c=383=static int hif_usb_send_tx(struct hif_device_usb hif_dev, struct sk_buff skb)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-406-\t/ Mgmt/Beacon frames don't use the TX buffer pool /\ndrivers/net/wireless/ath/ath9k/hif_usb.c:407:\tif ((tx_ctl-\u003etype == ATH9K_HTC_MGMT) \|\|\ndrivers/net/wireless/ath/ath9k/hif_usb.c:408:\t (tx_ctl-\u003etype == ATH9K_HTC_BEACON)) {\ndrivers/net/wireless/ath/ath9k/hif_usb.c-409-\t\tret = hif_usb_send_mgmt(hif_dev, skb);\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-413-\ndrivers/net/wireless/ath/ath9k/hif_usb.c:414:\tif ((tx_ctl-\u003etype == ATH9K_HTC_NORMAL) \|\|\ndrivers/net/wireless/ath/ath9k/hif_usb.c:415:\t (tx_ctl-\u003etype == ATH9K_HTC_AMPDU)) {\ndrivers/net/wireless/ath/ath9k/hif_usb.c-416-\t\t__skb_queue_tail(\u0026hif_dev-\u003etx.tx_skb_queue, skb);\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c=494=static inline bool check_index(struct sk_buff skb, u8 idx)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-499-\ndrivers/net/wireless/ath/ath9k/hif_usb.c:500:\tif ((tx_ctl-\u003etype == ATH9K_HTC_AMPDU) \u0026\u0026\ndrivers/net/wireless/ath/ath9k/hif_usb.c-501-\t (tx_ctl-\u003esta_idx == idx))\n--\ndrivers/net/wireless/ath/ath9k/htc.h=56=enum htc_opmode {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-64-\ndrivers/net/wireless/ath/ath9k/htc.h:65:#define ATH9K_HTC_AMPDU 1\ndrivers/net/wireless/ath/ath9k/htc.h:66:#define ATH9K_HTC_NORMAL 2\ndrivers/net/wireless/ath/ath9k/htc.h:67:#define ATH9K_HTC_BEACON 3\ndrivers/net/wireless/ath/ath9k/htc.h:68:#define ATH9K_HTC_MGMT 4\ndrivers/net/wireless/ath/ath9k/htc.h-69-\ndrivers/net/wireless/ath/ath9k/htc.h:70:#define ATH9K_HTC_TX_CTSONLY 0x1\ndrivers/net/wireless/ath/ath9k/htc.h:71:#define ATH9K_HTC_TX_RTSCTS 0x2\ndrivers/net/wireless/ath/ath9k/htc.h-72-\ndrivers/net/wireless/ath/ath9k/htc.h=73=struct tx_frame_hdr {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-77-\tu8 tidno;\ndrivers/net/wireless/ath/ath9k/htc.h:78:\t__be32 flags; /* ATH9K_HTC_TX_* /\ndrivers/net/wireless/ath/ath9k/htc.h-79-\tu8 key_type;\n--\ndrivers/net/wireless/ath/ath9k/htc.h=194=struct ath9k_htc_target_rx_stats {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-199-\ndrivers/net/wireless/ath/ath9k/htc.h:200:#define ATH9K_HTC_MAX_VIF 2\ndrivers/net/wireless/ath/ath9k/htc.h:201:#define ATH9K_HTC_MAX_BCN_VIF 2\ndrivers/net/wireless/ath/ath9k/htc.h-202-\n--\ndrivers/net/wireless/ath/ath9k/htc.h=249=struct ath9k_vif_iter_data {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-253-\ndrivers/net/wireless/ath/ath9k/htc.h:254:#define ATH9K_HTC_MAX_STA 8\ndrivers/net/wireless/ath/ath9k/htc.h:255:#define ATH9K_HTC_MAX_TID 8\ndrivers/net/wireless/ath/ath9k/htc.h-256-\n--\ndrivers/net/wireless/ath/ath9k/htc.h=264=struct ath9k_htc_sta {\ndrivers/net/wireless/ath/ath9k/htc.h-265-\tu8 index;\ndrivers/net/wireless/ath/ath9k/htc.h:266:\tenum tid_aggr_state tid_state[ATH9K_HTC_MAX_TID];\ndrivers/net/wireless/ath/ath9k/htc.h-267-\tstruct work_struct rc_update_work;\n--\ndrivers/net/wireless/ath/ath9k/htc.h-270-\ndrivers/net/wireless/ath/ath9k/htc.h:271:#define ATH9K_HTC_RXBUF 256\ndrivers/net/wireless/ath/ath9k/htc.h-272-#define HTC_RX_FRAME_HEADER_SIZE 40\n--\ndrivers/net/wireless/ath/ath9k/htc.h=281=struct ath9k_htc_rx {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-286-\ndrivers/net/wireless/ath/ath9k/htc.h:287:#define ATH9K_HTC_TX_CLEANUP_INTERVAL 50 / ms /\ndrivers/net/wireless/ath/ath9k/htc.h:288:#define ATH9K_HTC_TX_TIMEOUT_INTERVAL 3000 / ms /\ndrivers/net/wireless/ath/ath9k/htc.h:289:#define ATH9K_HTC_TX_RESERVE 10\ndrivers/net/wireless/ath/ath9k/htc.h:290:#define ATH9K_HTC_TX_TIMEOUT_COUNT 40\ndrivers/net/wireless/ath/ath9k/htc.h:291:#define ATH9K_HTC_TX_THRESHOLD (MAX_TX_BUF_NUM - ATH9K_HTC_TX_RESERVE)\ndrivers/net/wireless/ath/ath9k/htc.h-292-\ndrivers/net/wireless/ath/ath9k/htc.h:293:#define ATH9K_HTC_OP_TX_QUEUES_STOP BIT(0)\ndrivers/net/wireless/ath/ath9k/htc.h:294:#define ATH9K_HTC_OP_TX_DRAIN BIT(1)\ndrivers/net/wireless/ath/ath9k/htc.h-295-\n--\ndrivers/net/wireless/ath/ath9k/htc.h=311=struct ath9k_htc_tx_ctl {\ndrivers/net/wireless/ath/ath9k/htc.h:312:\tu8 type; / ATH9K_HTC_* /\ndrivers/net/wireless/ath/ath9k/htc.h-313-\tu8 epid;\n--\ndrivers/net/wireless/ath/ath9k/htc.h=319=static inline struct ath9k_htc_tx_ctl HTC_SKB_CB(struct sk_buff skb)\n--\ndrivers/net/wireless/ath/ath9k/htc.h-327-\ndrivers/net/wireless/ath/ath9k/htc.h:328:#ifdef CONFIG_ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/htc.h-329-#define __STAT_SAFE(hif_dev, expr)\tdo { ((hif_dev)-\u003ehtc_handle-\u003edrv_priv ? (expr) : 0); } while (0)\n--\ndrivers/net/wireless/ath/ath9k/htc.h=388=static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc.h-392-\ndrivers/net/wireless/ath/ath9k/htc.h:393:#endif /* CONFIG_ATH9K_HTC_DEBUGFS /\ndrivers/net/wireless/ath/ath9k/htc.h-394-\n--\ndrivers/net/wireless/ath/ath9k/htc.h=409=struct htc_beacon {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-415-\ndrivers/net/wireless/ath/ath9k/htc.h:416:\tstruct ieee80211_vif bslot[ATH9K_HTC_MAX_BCN_VIF];\ndrivers/net/wireless/ath/ath9k/htc.h-417-\tu32 bmisscnt;\n--\ndrivers/net/wireless/ath/ath9k/htc.h=456=struct ath9k_htc_priv {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-478-\tu8 sta_slot;\ndrivers/net/wireless/ath/ath9k/htc.h:479:\tu8 vif_sta_pos[ATH9K_HTC_MAX_VIF];\ndrivers/net/wireless/ath/ath9k/htc.h-480-\tu8 num_ibss_vif;\n--\ndrivers/net/wireless/ath/ath9k/htc.h-535-\tstruct delayed_work duty_cycle_work;\ndrivers/net/wireless/ath/ath9k/htc.h:536:#ifdef CONFIG_ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/htc.h-537-\tstruct ath9k_debug debug;\n--\ndrivers/net/wireless/ath/ath9k/htc.h=641=int ath9k_htc_resume(struct htc_target htc_handle);\ndrivers/net/wireless/ath/ath9k/htc.h-642-#endif\ndrivers/net/wireless/ath/ath9k/htc.h:643:#ifdef CONFIG_ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/htc.h-644-int ath9k_htc_init_debug(struct ath_hw ah);\n--\ndrivers/net/wireless/ath/ath9k/htc.h=648=static inline void ath9k_htc_deinit_debug(struct ath9k_htc_priv priv)\n--\ndrivers/net/wireless/ath/ath9k/htc.h-650-}\ndrivers/net/wireless/ath/ath9k/htc.h:651:#endif / CONFIG_ATH9K_HTC_DEBUGFS /\ndrivers/net/wireless/ath/ath9k/htc.h-652-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c=111=static void ath9k_htc_beacon_config_ap(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-116-\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:117:\tath9k_cmn_beacon_config_ap(ah, conf, ATH9K_HTC_MAX_BCN_VIF);\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-118-\tath9k_htc_beacon_init(priv, conf, false);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c=191=static void ath9k_htc_send_beacon(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-242-\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:243:\ttx_ctl-\u003etype = ATH9K_HTC_BEACON;\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-244-\ttx_ctl-\u003eepid = priv-\u003ebeacon_ep;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c=264=static int ath9k_htc_choose_bslot(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-276-\ttsftu = TSF_TO_TU(tsf \u003e\u003e 32, tsf);\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:277:\tslot = ((tsftu % intval) * ATH9K_HTC_MAX_BCN_VIF) / intval;\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:278:\tslot = ATH9K_HTC_MAX_BCN_VIF - slot - 1;\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-279-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c=325=void ath9k_htc_assign_bslot(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-332-\tspin_lock_bh(\u0026priv-\u003ebeacon_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:333:\tfor (i = 0; i \u003c ATH9K_HTC_MAX_BCN_VIF; i++) {\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-334-\t\tif (priv-\u003ebeacon.bslot[i] == NULL) {\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c=365=void ath9k_htc_set_tsfadjust(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-380-\t /\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:381:\ttsfadjust = cur_conf-\u003ebeacon_interval avp-\u003ebslot / ATH9K_HTC_MAX_BCN_VIF;\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-382-\tavp-\u003etsfadjust = cpu_to_le64(TU_TO_USEC(tsfadjust));\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c=398=static const char ath9k_htc_gstrings_stats[][ETH_GSTRING_LEN] = {\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-418-};\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c:419:#define ATH9K_HTC_SSTATS_LEN ARRAY_SIZE(ath9k_htc_gstrings_stats)\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-420-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c=430=int ath9k_htc_get_et_sset_count(struct ieee80211_hw hw,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-433-\tif (sset == ETH_SS_STATS)\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c:434:\t\treturn ATH9K_HTC_SSTATS_LEN;\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-435-\treturn 0;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c=448=void ath9k_htc_get_et_stats(struct ieee80211_hw hw,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-473-\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c:474:\tWARN_ON(i != ATH9K_HTC_SSTATS_LEN);\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-475-}\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c=606=static int ath9k_init_priv(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-673-\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:674:\tfor (i = 0; i \u003c ATH9K_HTC_MAX_BCN_VIF; i++)\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-675-\t\tpriv-\u003ebeacon.bslot[i] = NULL;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=184=void ath9k_htc_reset(struct ath9k_htc_priv priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-233-\tmod_timer(\u0026priv-\u003etx.cleanup_timer,\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:234:\t\t jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-235-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=240=static int ath9k_htc_set_channel(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-311-\tmod_timer(\u0026priv-\u003etx.cleanup_timer,\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:312:\t\t jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-313-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=350=static int ath9k_htc_add_monitor_interface(struct ath9k_htc_priv priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-357-\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:358:\tif ((priv-\u003envifs \u003e= ATH9K_HTC_MAX_VIF) \|\|\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:359:\t (priv-\u003enstations \u003e= ATH9K_HTC_MAX_STA)) {\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-360-\t\tret = -ENOBUFS;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-364-\tsta_idx = ffz(priv-\u003esta_slot);\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:365:\tif ((sta_idx \u003c 0) \|\| (sta_idx \u003e ATH9K_HTC_MAX_STA)) {\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-366-\t\tret = -ENOBUFS;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=466=static int ath9k_htc_add_station(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-477-\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:478:\tif (priv-\u003enstations \u003e= ATH9K_HTC_MAX_STA)\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-479-\t\treturn -ENOBUFS;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-481-\tsta_idx = ffz(priv-\u003esta_slot);\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:482:\tif ((sta_idx \u003c 0) \|\| (sta_idx \u003e ATH9K_HTC_MAX_STA))\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-483-\t\treturn -ENOBUFS;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=702=static int ath9k_htc_tx_aggr_oper(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-713-\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:714:\tif (tid \u003e= ATH9K_HTC_MAX_TID)\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-715-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=907=static int ath9k_htc_start(struct ieee80211_hw hw)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-960-\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:961:\tpriv-\u003etx.flags \u0026= ~ATH9K_HTC_OP_TX_QUEUES_STOP;\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-962-\tspin_unlock_bh(\u0026priv-\u003etx.tx_lock);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-966-\tmod_timer(\u0026priv-\u003etx.cleanup_timer,\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:967:\t\t jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-968-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=1658=static int ath9k_htc_ampdu_action(struct ieee80211_hw hw,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-1688-\tcase IEEE80211_AMPDU_TX_OPERATIONAL:\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:1689:\t\tif (tid \u003e= ATH9K_HTC_MAX_TID) {\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-1690-\t\t\tret = -EINVAL;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=1874=struct ieee80211_ops ath9k_htc_ops = {\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-1906-\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:1907:#ifdef CONFIG_ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-1908-\t.get_et_sset_count = ath9k_htc_get_et_sset_count,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=23=static const int subtype_txq_to_hwq[] = {\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-29-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:30:#define ATH9K_HTC_INIT_TXQ(subtype) do {\t\t\t\\\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-31-\t\tqi.tqi_subtype = subtype_txq_to_hwq[subtype];\t\\\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=56=void ath9k_htc_check_stop_queues(struct ath9k_htc_priv priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-59-\tpriv-\u003etx.queued_cnt++;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:60:\tif ((priv-\u003etx.queued_cnt \u003e= ATH9K_HTC_TX_THRESHOLD) \u0026\u0026\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:61:\t !(priv-\u003etx.flags \u0026 ATH9K_HTC_OP_TX_QUEUES_STOP)) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:62:\t\tpriv-\u003etx.flags \|= ATH9K_HTC_OP_TX_QUEUES_STOP;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-63-\t\tieee80211_stop_queues(priv-\u003ehw);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=68=void ath9k_htc_check_wake_queues(struct ath9k_htc_priv priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-70-\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:71:\tif ((priv-\u003etx.queued_cnt \u003c ATH9K_HTC_TX_THRESHOLD) \u0026\u0026\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:72:\t (priv-\u003etx.flags \u0026 ATH9K_HTC_OP_TX_QUEUES_STOP)) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:73:\t\tpriv-\u003etx.flags \u0026= ~ATH9K_HTC_OP_TX_QUEUES_STOP;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-74-\t\tieee80211_wake_queues(priv-\u003ehw);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=214=static void ath9k_htc_tx_mgmt(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-240-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:241:\ttx_ctl-\u003etype = ATH9K_HTC_MGMT;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-242-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=260=static void ath9k_htc_tx_data(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-292-\tif (tx_info-\u003eflags \u0026 IEEE80211_TX_CTL_AMPDU) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:293:\t\ttx_ctl-\u003etype = ATH9K_HTC_AMPDU;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:294:\t\ttx_hdr.data_type = ATH9K_HTC_AMPDU;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-295-\t} else {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:296:\t\ttx_ctl-\u003etype = ATH9K_HTC_NORMAL;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:297:\t\ttx_hdr.data_type = ATH9K_HTC_NORMAL;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-298-\t}\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-312-\t\tif (skb-\u003elen \u003e priv-\u003ehw-\u003ewiphy-\u003erts_threshold)\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:313:\t\t\tflags \|= ATH9K_HTC_TX_RTSCTS;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-314-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-315-\t/* CTS-to-self /\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:316:\tif (!(flags \u0026 ATH9K_HTC_TX_RTSCTS) \u0026\u0026\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-317-\t (vif \u0026\u0026 vif-\u003ebss_conf.use_cts_prot))\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:318:\t\tflags \|= ATH9K_HTC_TX_CTSONLY;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-319-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=392=static inline bool __ath9k_htc_check_tx_aggr(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-397-\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:398:\tif ((tid \u003c ATH9K_HTC_MAX_TID) \u0026\u0026 (ista-\u003etid_state[tid] == AGGR_STOP))\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-399-\t\tret = true;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=445=static void ath9k_htc_tx_process(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-478-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:479:\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_ACK) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-480-\t\ttx_info-\u003eflags \|= IEEE80211_TX_STAT_ACK;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-484-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:485:\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_FILT)\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-486-\t\ttx_info-\u003eflags \|= IEEE80211_TX_STAT_TX_FILTERED;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-487-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:488:\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_RTC_CTS)\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-489-\t\trate-\u003eflags \|= IEEE80211_TX_RC_USE_RTS_CTS;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-491-\trate-\u003ecount = 1;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:492:\trate-\u003eidx = MS(txs-\u003ets_rate, ATH9K_HTC_TXSTAT_RATE);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-493-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:494:\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_MCS) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-495-\t\trate-\u003eflags \|= IEEE80211_TX_RC_MCS;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-496-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:497:\t\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_CW40)\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-498-\t\t\trate-\u003eflags \|= IEEE80211_TX_RC_40_MHZ_WIDTH;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:499:\t\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_SGI)\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-500-\t\t\trate-\u003eflags \|= IEEE80211_TX_RC_SHORT_GI;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=539=void ath9k_htc_tx_drain(struct ath9k_htc_priv priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-543-\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:544:\tpriv-\u003etx.flags \|= ATH9K_HTC_OP_TX_DRAIN;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-545-\tspin_unlock_bh(\u0026priv-\u003etx.tx_lock);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-573-\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:574:\tpriv-\u003etx.flags \u0026= ~ATH9K_HTC_OP_TX_DRAIN;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-575-\tspin_unlock_bh(\u0026priv-\u003etx.tx_lock);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=578=void ath9k_tx_failed_tasklet(struct tasklet_struct t)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-582-\tspin_lock(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:583:\tif (priv-\u003etx.flags \u0026 ATH9K_HTC_OP_TX_DRAIN) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-584-\t\tspin_unlock(\u0026priv-\u003etx.tx_lock);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=618=static struct sk_buff ath9k_htc_tx_get_packet(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-624-\tunsigned long flags;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:625:\tu8 epid = MS(txs-\u003ets_rate, ATH9K_HTC_TXSTAT_EPID);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-626-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=716=static inline bool check_packet(struct ath9k_htc_priv priv, struct sk_buff skb)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-724-\t\t tx_ctl-\u003etimestamp +\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:725:\t\t msecs_to_jiffies(ATH9K_HTC_TX_TIMEOUT_INTERVAL))) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-726-\t\tath_dbg(common, XMIT, \"Dropping a packet due to TX timeout\\n\");\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=761=void ath9k_htc_tx_cleanup_timer(struct timer_list t)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-776-\t\t\t\tevent-\u003etxs.cookie,\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:777:\t\t\t\tMS(event-\u003etxs.ts_rate, ATH9K_HTC_TXSTAT_EPID));\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-778-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-784-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:785:\t\tif (++event-\u003ecount \u003e= ATH9K_HTC_TX_TIMEOUT_COUNT) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-786-\t\t\tlist_del(\u0026event-\u003elist);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-805-\tmod_timer(\u0026priv-\u003etx.cleanup_timer,\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:806:\t\t jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-807-}\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=827=bool ath9k_htc_txq_setup(struct ath9k_htc_priv priv, int subtype)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-834-\tmemset(\u0026qi, 0, sizeof(qi));\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:835:\tATH9K_HTC_INIT_TXQ(subtype);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-836-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=852=int ath9k_htc_cabq_setup(struct ath9k_htc_priv priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-856-\tmemset(\u0026qi, 0, sizeof(qi));\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:857:\tATH9K_HTC_INIT_TXQ(0);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-858-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=1187=int ath9k_rx_init(struct ath9k_htc_priv priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-1193-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:1194:\tfor (i = 0; i \u003c ATH9K_HTC_RXBUF; i++) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-1195-\t\tstruct ath9k_htc_rxbuf rxbuf =\n--\ndrivers/net/wireless/ath/ath9k/wmi.c=138=void ath9k_wmi_event_tasklet(struct tasklet_struct t)\n--\ndrivers/net/wireless/ath/ath9k/wmi.c-178-\t\t\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/wmi.c:179:\t\t\tif (priv-\u003etx.flags \u0026 ATH9K_HTC_OP_TX_DRAIN) {\ndrivers/net/wireless/ath/ath9k/wmi.c-180-\t\t\t\tspin_unlock_bh(\u0026priv-\u003etx.tx_lock);\n--\ndrivers/net/wireless/ath/ath9k/wmi.h=39=struct wmi_event_swba {\n--\ndrivers/net/wireless/ath/ath9k/wmi.h-50-\ndrivers/net/wireless/ath/ath9k/wmi.h:51:#define ATH9K_HTC_TXSTAT_ACK BIT(0)\ndrivers/net/wireless/ath/ath9k/wmi.h:52:#define ATH9K_HTC_TXSTAT_FILT BIT(1)\ndrivers/net/wireless/ath/ath9k/wmi.h:53:#define ATH9K_HTC_TXSTAT_RTC_CTS BIT(2)\ndrivers/net/wireless/ath/ath9k/wmi.h:54:#define ATH9K_HTC_TXSTAT_MCS BIT(3)\ndrivers/net/wireless/ath/ath9k/wmi.h:55:#define ATH9K_HTC_TXSTAT_CW40 BIT(4)\ndrivers/net/wireless/ath/ath9k/wmi.h:56:#define ATH9K_HTC_TXSTAT_SGI BIT(5)\ndrivers/net/wireless/ath/ath9k/wmi.h-57-\n--\ndrivers/net/wireless/ath/ath9k/wmi.h-63- /\ndrivers/net/wireless/ath/ath9k/wmi.h:64:#define ATH9K_HTC_TXSTAT_RATE 0x0f\ndrivers/net/wireless/ath/ath9k/wmi.h:65:#define ATH9K_HTC_TXSTAT_RATE_S 0\ndrivers/net/wireless/ath/ath9k/wmi.h-66-\ndrivers/net/wireless/ath/ath9k/wmi.h:67:#define ATH9K_HTC_TXSTAT_EPID 0xf0\ndrivers/net/wireless/ath/ath9k/wmi.h:68:#define ATH9K_HTC_TXSTAT_EPID_S 4\ndrivers/net/wireless/ath/ath9k/wmi.h-69-\n" }
5/2	2026/09/06 12:47	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 16915 output: 42 thoughts: 32 Thoughts: Okay, here's my take on those thoughts, framed as an expert's internal monologue: Checking ATH9K_HTC Dependencies Right, let's dive straight in. I need to pinpoint the exact dependencies for `ATH9K_HTC`. I know it's a critical module, so I can't afford any assumptions here. The most reliable place to get the definitive answer on dependencies, particularly for a driver like this, is always the `Kconfig` file in its directory. That'll be `drivers/net/wireless/ath/ath9k/Kconfig`. No need to guess or rely on outdated documentation; the Kconfig is the source of truth for the build system. Let's see what it's tied to.
6/2	2026/09/06 12:47	tool	read-file	0m Args: { "File": "drivers/net/wireless/ath/ath9k/Kconfig", "FirstLine": 170, "LineCount": 40 } Results: { "Contents": " 170:\t\t If unsure say N.\n 171:\t\n 172:\tconfig ATH9K_HTC\n 173:\t\ttristate \"Atheros HTC based wireless cards support\"\n 174:\t\tdepends on USB \u0026\u0026 MAC80211\n 175:\t\tselect MAC80211_LEDS if LEDS_CLASS=y \|\| LEDS_CLASS=MAC80211\n 176:\t\tselect ATH9K_HW\n 177:\t\tselect ATH9K_COMMON\n 178:\t\thelp\n 179:\t\t Support for Atheros HTC based cards.\n 180:\t\t Chipsets supported: AR9271\n 181:\t\n 182:\t\t For more information:\n 183:\t\t https://wireless.wiki.kernel.org/en/users/Drivers/ath9k_htc\n 184:\t\n 185:\t\t The built module will be ath9k_htc.\n 186:\t\n 187:\tconfig ATH9K_HTC_DEBUGFS\n 188:\t\tbool \"Atheros ath9k_htc debugging\"\n 189:\t\tdepends on ATH9K_HTC \u0026\u0026 DEBUG_FS\n 190:\t\tselect ATH9K_COMMON_DEBUG\n 191:\t\thelp\n 192:\t\t Say Y, if you need access to ath9k_htc's statistics.\n 193:\t\t As well as access to the FFT/spectral data.\n 194:\t\n 195:\tconfig ATH9K_HWRNG\n 196:\t\tbool \"Random number generator support\"\n 197:\t\tdepends on ATH9K \u0026\u0026 (HW_RANDOM = y \|\| HW_RANDOM = ATH9K)\n 198:\t\tdefault n\n 199:\t\thelp\n 200:\t\t This option incorporates the ADC register output as a source of\n 201:\t\t randomness into Linux entropy pool (/dev/urandom and /dev/random)\n 202:\t\n 203:\t\t Say Y, feeds the entropy directly from the WiFi driver to the input\n 204:\t\t pool.\n 205:\t\n 206:\tconfig ATH9K_COMMON_SPECTRAL\n 207:\t\tbool \"Atheros ath9k/ath9k_htc spectral scan support\"\n 208:\t\tdepends on ATH9K_DEBUGFS \|\| ATH9K_HTC_DEBUGFS\n 209:\t\tselect RELAY\n" }
7/2	2026/09/06 12:47	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 17788 output: 45 thoughts: 55 Thoughts: Okay, let's dive into this. I need to understand the connection between these two functions and how they're being utilized in the code. I'll start by examining `hif_usb.c` and `htc_drv_init.c`. My primary focus is on how `hif_usb_send_regout` and `ath9k_reg_rmw_buffer` are used. I want to trace the call paths to these functions to understand the contexts in which they operate and how the system eventually reaches their execution. Understanding these interconnections will likely give me insights into how the register output is being handled and how it relates to the broader system initialization within the HTC driver.
8/2	2026/09/06 12:47	tool	read-file	0m Args: { "File": "drivers/net/wireless/ath/ath9k/hif_usb.c", "FirstLine": 95, "LineCount": 50 } Results: { "Contents": " 95:\t\tkfree_skb(cmd-\u003eskb);\n 96:\t\tkfree(cmd);\n 97:\t}\n 98:\t\n 99:\tstatic int hif_usb_send_regout(struct hif_device_usb hif_dev,\n 100:\t\t\t\t struct sk_buff skb)\n 101:\t{\n 102:\t\tu16 maxpacket = usb_maxpacket(hif_dev-\u003eudev,\n 103:\t\t\t\t\t usb_sndintpipe(hif_dev-\u003eudev,\n 104:\t\t\t\t\t\t\t USB_REG_OUT_PIPE));\n 105:\t\tstruct urb urb;\n 106:\t\tstruct cmd_buf cmd;\n 107:\t\tint ret = 0;\n 108:\t\n 109:\t\tif (WARN_ONCE(maxpacket \u0026\u0026 skb-\u003elen % maxpacket == 0,\n 110:\t\t\t \"%u-byte command fills whole USB packets\\n\", skb-\u003elen))\n 111:\t\t\treturn -EINVAL;\n 112:\t\n 113:\t\turb = usb_alloc_urb(0, GFP_KERNEL);\n 114:\t\tif (urb == NULL)\n 115:\t\t\treturn -ENOMEM;\n 116:\t\n 117:\t\tcmd = kzalloc_obj(cmd);\n 118:\t\tif (cmd == NULL) {\n 119:\t\t\tusb_free_urb(urb);\n 120:\t\t\treturn -ENOMEM;\n 121:\t\t}\n 122:\t\n 123:\t\tcmd-\u003eskb = skb;\n 124:\t\tcmd-\u003ehif_dev = hif_dev;\n 125:\t\n 126:\t\tusb_fill_int_urb(urb, hif_dev-\u003eudev,\n 127:\t\t\t\t usb_sndintpipe(hif_dev-\u003eudev, USB_REG_OUT_PIPE),\n 128:\t\t\t\t skb-\u003edata, skb-\u003elen,\n 129:\t\t\t\t hif_usb_regout_cb, cmd, 1);\n 130:\t\n 131:\t\tusb_anchor_urb(urb, \u0026hif_dev-\u003eregout_submitted);\n 132:\t\tret = usb_submit_urb(urb, GFP_KERNEL);\n 133:\t\tif (ret) {\n 134:\t\t\tusb_unanchor_urb(urb);\n 135:\t\t\tkfree(cmd);\n 136:\t\t}\n 137:\t\tusb_free_urb(urb);\n 138:\t\n 139:\t\treturn ret;\n 140:\t}\n 141:\t\n 142:\tstatic void hif_usb_mgmt_cb(struct urb urb)\n 143:\t{\n 144:\t\tstruct cmd_buf *cmd = urb-\u003econtext;\n" }
9/2	2026/09/06 12:47	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 18781 output: 41 thoughts: 17 Thoughts: Okay, here's my summary, taking on the persona you requested: Tracing the Calls to hif_usb_send_regout Alright, let's dive in. I need to understand the flow here, so I'm going to start by tracing the calls to `hif_usb_send_regout`. I'm thinking I'll need to use some tooling, probably static analysis initially, to get a clear picture of the call graph. I'm hoping it's straightforward; a complex chain of indirect function calls is the last thing I need right now. I should be able to identify the key modules or subsystems that are initiating these register output operations. Knowing the context of those calls will be critical for figuring out the intent behind each of them. Then, based on the calls themselves, I'll be able to quickly see if there's any obvious redundancy or unexpected behavior. I'll need to pay close attention to the arguments being passed to this function, too. Are they consistent across callers? Are there any patterns or discrepancies that jump out? This is a crucial area to explore, since the arguments will reveal what is being sent out, and likely why. I'll need to think about the data structures being passed, potentially checking the definitions of those structs and enums. Once I understand the callers and the parameters, I should be in a solid position to analyze the impact of this function, its potential bottlenecks, and any areas ripe for optimization or improvement. This is my starting point, and I expect to adjust my approach as I go, but this seems like a solid plan.
10/2	2026/09/06 12:47	tool	grepper	0m Args: { "Expression": "hif_usb_send_regout", "PathPrefix": "drivers/net/wireless/ath/ath9k/" } Results: { "Output": "drivers/net/wireless/ath/ath9k/hif_usb.c=71=static void hif_usb_regout_cb(struct urb urb)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-98-\ndrivers/net/wireless/ath/ath9k/hif_usb.c:99:static int hif_usb_send_regout(struct hif_device_usb hif_dev,\ndrivers/net/wireless/ath/ath9k/hif_usb.c-100-\t\t\t struct sk_buff skb)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c=472=static int hif_usb_send(void hif_handle, u8 pipe_id, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-481-\tcase USB_REG_OUT_PIPE:\ndrivers/net/wireless/ath/ath9k/hif_usb.c:482:\t\tret = hif_usb_send_regout(hif_dev, skb);\ndrivers/net/wireless/ath/ath9k/hif_usb.c-483-\t\tbreak;\n" }
11/2	2026/09/06 12:47	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 19499 output: 48 thoughts: 21 Thoughts: Here's a summary of my immediate thought process: Diving into the Driver Initialization Okay, time to dig in. I need to get a handle on what's happening with this HTC driver. Let's start with `htc_drv_init.c` – that's usually a good place to begin, especially with initialization. Specifically, I'm going to jump to around line 405. That section is often where critical initial setup or resource allocation takes place. I'm expecting to find the key function calls, data structure assignments, or perhaps some early hardware probing that will shed light on what the driver is up to. Let's see what secrets that particular section holds.
12/2	2026/09/06 12:47	tool	read-file	0m Args: { "File": "drivers/net/wireless/ath/ath9k/htc_drv_init.c", "FirstLine": 395, "LineCount": 45 } Results: { "Contents": " 395:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].reg =\n 396:\t\t\tcpu_to_be32(reg_offset);\n 397:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].set =\n 398:\t\t\tcpu_to_be32(set);\n 399:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].clr =\n 400:\t\t\tcpu_to_be32(clr);\n 401:\t\n 402:\t\tpriv-\u003ewmi-\u003emulti_rmw_idx++;\n 403:\t\n 404:\t\t/* If the buffer is full, send it out. /\n 405:\t\tif (priv-\u003ewmi-\u003emulti_rmw_idx == MAX_RMW_CMD_NUMBER) {\n 406:\t\t\tr = ath9k_wmi_cmd(priv-\u003ewmi, WMI_REG_RMW_CMDID,\n 407:\t\t\t\t (u8 ) \u0026priv-\u003ewmi-\u003emulti_rmw,\n 408:\t\t\t\t sizeof(struct register_rmw) * priv-\u003ewmi-\u003emulti_rmw_idx,\n 409:\t\t\t\t (u8 ) \u0026rsp_status, sizeof(rsp_status),\n 410:\t\t\t\t 100);\n 411:\t\t\tif (unlikely(r)) {\n 412:\t\t\t\tath_dbg(common, WMI,\n 413:\t\t\t\t\t\"REGISTER RMW FAILED, multi len: %d\\n\",\n 414:\t\t\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx);\n 415:\t\t\t}\n 416:\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx = 0;\n 417:\t\t}\n 418:\t\n 419:\t\tmutex_unlock(\u0026priv-\u003ewmi-\u003emulti_rmw_mutex);\n 420:\t}\n 421:\t\n 422:\tstatic void ath9k_reg_rmw_flush(void hw_priv)\n 423:\t{\n 424:\t\tstruct ath_hw ah = hw_priv;\n 425:\t\tstruct ath_common common = ath9k_hw_common(ah);\n 426:\t\tstruct ath9k_htc_priv priv = common-\u003epriv;\n 427:\t\tu32 rsp_status;\n 428:\t\tint r;\n 429:\t\n 430:\t\tif (test_bit(HTC_FWFLAG_NO_RMW, \u0026priv-\u003efw_flags))\n 431:\t\t\treturn;\n 432:\t\n 433:\t\tatomic_dec(\u0026priv-\u003ewmi-\u003em_rmw_cnt);\n 434:\t\n 435:\t\tmutex_lock(\u0026priv-\u003ewmi-\u003emulti_rmw_mutex);\n 436:\t\n 437:\t\tif (priv-\u003ewmi-\u003emulti_rmw_idx) {\n 438:\t\t\tr = ath9k_wmi_cmd(priv-\u003ewmi, WMI_REG_RMW_CMDID,\n 439:\t\t\t\t (u8 ) \u0026priv-\u003ewmi-\u003emulti_rmw,\n" }
13/2	2026/09/06 12:47	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 20550 output: 40 thoughts: 810 Thoughts: My Analysis of the ath9k_htc Patch for Fuzzing Okay, let's break this down. First, I'm seeing a potential buffer overflow vulnerability fixed in `ath9k_reg_rmw_buffer`. The original code was calculating the buffer size incorrectly, using the size of a `struct register_write` (8 bytes) instead of a `struct register_rmw` (12 bytes) when dealing with multiple read-modify-write commands (`multi_rmw_idx`). Specifically, when `multi_rmw_idx` hit `MAX_RMW_CMD_NUMBER` (which was 15), it sent 120 bytes instead of the expected 180 bytes. That's a clear error. I'm also seeing a comment about why 15 entries didn't work. The comment mentions 192 bytes and full USB packets not being delivered. 15 entries * 12 bytes = 180, plus header, that would fit, so the comment looks like it may have an error. The fix in `hif_usb_send_regout` adds a `WARN_ONCE` assertion, which is good. This is a defensive measure. It's warning if the command fills a whole USB packet. This is returning `-EINVAL`. This is great. Now, the important question: is this fuzzable? Absolutely. `ath9k_htc` is a USB wireless driver, and USB devices are easily attached in QEMU/virtualized environments using USB Raw Gadget or syzkaller's USB emulation. This is definitely reachable. Section 1 and 3 of the fuzzing guidance confirms this. Modified assertions are exactly what we want to target. It's a prime target for fuzzing. My next step is identifying the relevant functions for focus: - `hif_usb_send_regout` – the newly asserted function. - `ath9k_reg_rmw_buffer` – the buffer size calculation fixed. - `ath9k_reg_rmw_flush` – a function calling `ath9k_wmi_cmd` with `multi_rmw`. - `hif_usb_send` – an entrypoint in hif\_usb - `ath9k_wmi_cmd` – as it is used with `multi_rmw` I need to confirm these function names and their definitions within `drivers/net/wireless/ath/ath9k/`. I can then build test cases to exercise the relevant code paths and trigger that `WARN_ONCE` assertion. This looks like a solid fuzzing target.
14/2	2026/09/06 12:48	tool	grepper	0m Args: { "Expression": "ath9k_reg_rmw", "PathPrefix": "drivers/net/wireless/ath/ath9k/" } Results: { "Output": "drivers/net/wireless/ath/ath9k/htc_drv_init.c=367=static void ath9k_regwrite_flush(void hw_priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-382-\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:383:static void ath9k_reg_rmw_buffer(void hw_priv,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-384-\t\t\t\t u32 reg_offset, u32 set, u32 clr)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-421-\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:422:static void ath9k_reg_rmw_flush(void hw_priv)\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-423-{\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c=454=static void ath9k_enable_rmw_buffer(void hw_priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-465-\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:466:static void ath9k_reg_rmw_single(void hw_priv,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-467-\t\t\t\t u32 reg_offset, u32 set, u32 clr)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-488-\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:489:static u32 ath9k_reg_rmw(void hw_priv, u32 reg_offset, u32 set, u32 clr)\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-490-{\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-506-\tif (atomic_read(\u0026priv-\u003ewmi-\u003em_rmw_cnt))\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:507:\t\tath9k_reg_rmw_buffer(hw_priv, reg_offset, set, clr);\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-508-\telse\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:509:\t\tath9k_reg_rmw_single(hw_priv, reg_offset, set, clr);\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-510-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c=606=static int ath9k_init_priv(struct ath9k_htc_priv priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-628-\tah-\u003ereg_ops.enable_rmw_buffer = ath9k_enable_rmw_buffer;\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:629:\tah-\u003ereg_ops.rmw_flush = ath9k_reg_rmw_flush;\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:630:\tah-\u003ereg_ops.rmw = ath9k_reg_rmw;\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-631-\tpriv-\u003eah = ah;\n--\ndrivers/net/wireless/ath/ath9k/init.c=204=static void ath9k_multi_ioread32(void hw_priv, u32 addr,\n--\ndrivers/net/wireless/ath/ath9k/init.c-213-\ndrivers/net/wireless/ath/ath9k/init.c:214:static unsigned int __ath9k_reg_rmw(struct ath_softc sc, u32 reg_offset,\ndrivers/net/wireless/ath/ath9k/init.c-215-\t\t\t\t u32 set, u32 clr)\n--\ndrivers/net/wireless/ath/ath9k/init.c-226-\ndrivers/net/wireless/ath/ath9k/init.c:227:static unsigned int ath9k_reg_rmw(void hw_priv, u32 reg_offset, u32 set, u32 clr)\ndrivers/net/wireless/ath/ath9k/init.c-228-{\n--\ndrivers/net/wireless/ath/ath9k/init.c-236-\t\tspin_lock_irqsave(\u0026sc-\u003esc_serial_rw, flags);\ndrivers/net/wireless/ath/ath9k/init.c:237:\t\tval = __ath9k_reg_rmw(sc, reg_offset, set, clr);\ndrivers/net/wireless/ath/ath9k/init.c-238-\t\tspin_unlock_irqrestore(\u0026sc-\u003esc_serial_rw, flags);\ndrivers/net/wireless/ath/ath9k/init.c-239-\t} else\ndrivers/net/wireless/ath/ath9k/init.c:240:\t\tval = __ath9k_reg_rmw(sc, reg_offset, set, clr);\ndrivers/net/wireless/ath/ath9k/init.c-241-\n--\ndrivers/net/wireless/ath/ath9k/init.c=656=static int ath9k_init_softc(u16 devid, struct ath_softc sc,\n--\ndrivers/net/wireless/ath/ath9k/init.c-676-\tah-\u003ereg_ops.write = ath9k_iowrite32;\ndrivers/net/wireless/ath/ath9k/init.c:677:\tah-\u003ereg_ops.rmw = ath9k_reg_rmw;\ndrivers/net/wireless/ath/ath9k/init.c-678-\tpCap = \u0026ah-\u003ecaps;\n" }
15/2	2026/09/06 12:48	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 23598 output: 31 thoughts: 75 Thoughts: Examining the Atheros Wireless Driver Configuration Okay, let's dive into the configuration for this Atheros wireless driver. First, I need to verify what settings are available, starting with the `EnableConfigs`. Specifically, I'm checking the `drivers/net/wireless/ath/ath9k/Kconfig` file. I see that `ATH9K_HTC` is dependent on both `USB` and `MAC80211`, which makes perfect sense given the hardware architecture. Now, I need to make sure I'm not overlooking any other crucial dependencies or configurations. I'll need to expand the search and review other potential configurations. Let's move on and examine the `drivers/net/wireless/ath/Kconfig` file and explore the contents to ensure I identify any other needed settings. This will give me a comprehensive picture of what's required for this driver to function correctly within the wider system.
16/2	2026/09/06 12:48	tool	grepper	0m Args: { "Expression": "ATH9K", "PathPrefix": "drivers/net/wireless/ath/" } Results: { "Output": "\nFull output is too long, showing 500 out of 5076 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/Makefile=2=obj-$(CONFIG_ATH5K)\t\t+= ath5k/\ndrivers/net/wireless/ath/Makefile:3:obj-$(CONFIG_ATH9K_HW)\t\t+= ath9k/\ndrivers/net/wireless/ath/Makefile-4-obj-$(CONFIG_CARL9170)\t\t+= carl9170/\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-1-# SPDX-License-Identifier: ISC\ndrivers/net/wireless/ath/ath9k/Kconfig:2:config ATH9K_HW\ndrivers/net/wireless/ath/ath9k/Kconfig-3-\ttristate\ndrivers/net/wireless/ath/ath9k/Kconfig:4:config ATH9K_COMMON\ndrivers/net/wireless/ath/ath9k/Kconfig-5-\ttristate\ndrivers/net/wireless/ath/ath9k/Kconfig-6-\tselect ATH_COMMON\ndrivers/net/wireless/ath/ath9k/Kconfig:7:config ATH9K_COMMON_DEBUG\ndrivers/net/wireless/ath/ath9k/Kconfig-8-\tbool\ndrivers/net/wireless/ath/ath9k/Kconfig:9:config ATH9K_DFS_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-10-\tdef_bool y\ndrivers/net/wireless/ath/ath9k/Kconfig:11:\tdepends on ATH9K_DEBUGFS \u0026\u0026 ATH9K_DFS_CERTIFIED\ndrivers/net/wireless/ath/ath9k/Kconfig-12-\ndrivers/net/wireless/ath/ath9k/Kconfig:13:config ATH9K_BTCOEX_SUPPORT\ndrivers/net/wireless/ath/ath9k/Kconfig-14-\tbool \"Atheros bluetooth coexistence support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:15:\tdepends on (ATH9K \|\| ATH9K_HTC)\ndrivers/net/wireless/ath/ath9k/Kconfig-16-\tdefault y\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-20-\ndrivers/net/wireless/ath/ath9k/Kconfig:21:config ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig-22-\ttristate \"Atheros 802.11n wireless cards support\"\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-24-\tselect MAC80211_LEDS if LEDS_CLASS=y \|\| LEDS_CLASS=MAC80211\ndrivers/net/wireless/ath/ath9k/Kconfig:25:\tselect ATH9K_HW\ndrivers/net/wireless/ath/ath9k/Kconfig:26:\tselect ATH9K_COMMON\ndrivers/net/wireless/ath/ath9k/Kconfig-27-\thelp\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-38-\ndrivers/net/wireless/ath/ath9k/Kconfig:39:config ATH9K_PCI\ndrivers/net/wireless/ath/ath9k/Kconfig-40-\tbool \"Atheros ath9k PCI/PCIe bus support\"\ndrivers/net/wireless/ath/ath9k/Kconfig-41-\tdefault y\ndrivers/net/wireless/ath/ath9k/Kconfig:42:\tdepends on ATH9K \u0026\u0026 PCI\ndrivers/net/wireless/ath/ath9k/Kconfig-43-\thelp\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-47-\ndrivers/net/wireless/ath/ath9k/Kconfig:48:config ATH9K_AHB\ndrivers/net/wireless/ath/ath9k/Kconfig-49-\tbool \"Atheros ath9k AHB bus support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:50:\tdepends on ATH9K \u0026\u0026 OF\ndrivers/net/wireless/ath/ath9k/Kconfig-51-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-57-\ndrivers/net/wireless/ath/ath9k/Kconfig:58:config ATH9K_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-59-\tbool \"Atheros ath9k debugging\"\ndrivers/net/wireless/ath/ath9k/Kconfig:60:\tdepends on ATH9K \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig:61:\tselect ATH9K_COMMON_DEBUG\ndrivers/net/wireless/ath/ath9k/Kconfig-62-\thelp\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-68-\ndrivers/net/wireless/ath/ath9k/Kconfig:69:config ATH9K_STATION_STATISTICS\ndrivers/net/wireless/ath/ath9k/Kconfig-70-\tbool \"Detailed station statistics\"\ndrivers/net/wireless/ath/ath9k/Kconfig:71:\tdepends on ATH9K \u0026\u0026 ATH9K_DEBUGFS \u0026\u0026 DEBUG_FS\ndrivers/net/wireless/ath/ath9k/Kconfig-72-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-75-\ndrivers/net/wireless/ath/ath9k/Kconfig:76:config ATH9K_TX99\ndrivers/net/wireless/ath/ath9k/Kconfig-77-\tbool \"Atheros ath9k TX99 testing support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:78:\tdepends on ATH9K_DEBUGFS \u0026\u0026 CFG80211_CERTIFICATION_ONUS\ndrivers/net/wireless/ath/ath9k/Kconfig-79-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-95-\ndrivers/net/wireless/ath/ath9k/Kconfig:96:config ATH9K_DFS_CERTIFIED\ndrivers/net/wireless/ath/ath9k/Kconfig-97-\tbool \"Atheros DFS support for certified platforms\"\ndrivers/net/wireless/ath/ath9k/Kconfig:98:\tdepends on ATH9K \u0026\u0026 CFG80211_CERTIFICATION_ONUS\ndrivers/net/wireless/ath/ath9k/Kconfig-99-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-114-\ndrivers/net/wireless/ath/ath9k/Kconfig:115:config ATH9K_DYNACK\ndrivers/net/wireless/ath/ath9k/Kconfig-116-\tbool \"Atheros ath9k ACK timeout estimation algorithm\"\ndrivers/net/wireless/ath/ath9k/Kconfig:117:\tdepends on ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig-118-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-123-\ndrivers/net/wireless/ath/ath9k/Kconfig:124:config ATH9K_WOW\ndrivers/net/wireless/ath/ath9k/Kconfig-125-\tbool \"Wake on Wireless LAN support (EXPERIMENTAL)\"\ndrivers/net/wireless/ath/ath9k/Kconfig:126:\tdepends on ATH9K \u0026\u0026 PM\ndrivers/net/wireless/ath/ath9k/Kconfig-127-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-131-\ndrivers/net/wireless/ath/ath9k/Kconfig:132:config ATH9K_RFKILL\ndrivers/net/wireless/ath/ath9k/Kconfig-133-\tbool \"Atheros ath9k rfkill support\" if EXPERT\ndrivers/net/wireless/ath/ath9k/Kconfig:134:\tdepends on ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig:135:\tdepends on RFKILL=y \|\| RFKILL=ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig-136-\tdefault y\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-141-\ndrivers/net/wireless/ath/ath9k/Kconfig:142:config ATH9K_CHANNEL_CONTEXT\ndrivers/net/wireless/ath/ath9k/Kconfig-143-\tbool \"Channel Context support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:144:\tdepends on ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig-145-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-150-\ndrivers/net/wireless/ath/ath9k/Kconfig:151:config ATH9K_PCOEM\ndrivers/net/wireless/ath/ath9k/Kconfig-152-\tbool \"Atheros ath9k support for PC OEM cards\" if EXPERT\ndrivers/net/wireless/ath/ath9k/Kconfig:153:\tdepends on ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig-154-\tdefault y\ndrivers/net/wireless/ath/ath9k/Kconfig-155-\ndrivers/net/wireless/ath/ath9k/Kconfig:156:config ATH9K_PCI_NO_EEPROM\ndrivers/net/wireless/ath/ath9k/Kconfig-157-\ttristate \"Atheros ath9k pci loader for EEPROM-less chips\"\ndrivers/net/wireless/ath/ath9k/Kconfig:158:\tdepends on ATH9K_PCI\ndrivers/net/wireless/ath/ath9k/Kconfig-159-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-171-\ndrivers/net/wireless/ath/ath9k/Kconfig:172:config ATH9K_HTC\ndrivers/net/wireless/ath/ath9k/Kconfig-173-\ttristate \"Atheros HTC based wireless cards support\"\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-175-\tselect MAC80211_LEDS if LEDS_CLASS=y \|\| LEDS_CLASS=MAC80211\ndrivers/net/wireless/ath/ath9k/Kconfig:176:\tselect ATH9K_HW\ndrivers/net/wireless/ath/ath9k/Kconfig:177:\tselect ATH9K_COMMON\ndrivers/net/wireless/ath/ath9k/Kconfig-178-\thelp\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-186-\ndrivers/net/wireless/ath/ath9k/Kconfig:187:config ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-188-\tbool \"Atheros ath9k_htc debugging\"\ndrivers/net/wireless/ath/ath9k/Kconfig:189:\tdepends on ATH9K_HTC \u0026\u0026 DEBUG_FS\ndrivers/net/wireless/ath/ath9k/Kconfig:190:\tselect ATH9K_COMMON_DEBUG\ndrivers/net/wireless/ath/ath9k/Kconfig-191-\thelp\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-194-\ndrivers/net/wireless/ath/ath9k/Kconfig:195:config ATH9K_HWRNG\ndrivers/net/wireless/ath/ath9k/Kconfig-196-\tbool \"Random number generator support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:197:\tdepends on ATH9K \u0026\u0026 (HW_RANDOM = y \|\| HW_RANDOM = ATH9K)\ndrivers/net/wireless/ath/ath9k/Kconfig-198-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-205-\ndrivers/net/wireless/ath/ath9k/Kconfig:206:config ATH9K_COMMON_SPECTRAL\ndrivers/net/wireless/ath/ath9k/Kconfig-207-\tbool \"Atheros ath9k/ath9k_htc spectral scan support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:208:\tdepends on ATH9K_DEBUGFS \|\| ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-209-\tselect RELAY\n--\ndrivers/net/wireless/ath/ath9k/Makefile=2=ath9k-y +=\tbeacon.o \\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-11-\ndrivers/net/wireless/ath/ath9k/Makefile:12:ath9k-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += mci.o\ndrivers/net/wireless/ath/ath9k/Makefile:13:ath9k-$(CONFIG_ATH9K_PCI) += pci.o\ndrivers/net/wireless/ath/ath9k/Makefile:14:ath9k-$(CONFIG_ATH9K_AHB) += ahb.o\ndrivers/net/wireless/ath/ath9k/Makefile:15:ath9k-$(CONFIG_ATH9K_DFS_DEBUGFS) += dfs_debug.o\ndrivers/net/wireless/ath/ath9k/Makefile:16:ath9k-$(CONFIG_ATH9K_DFS_CERTIFIED) += dfs.o\ndrivers/net/wireless/ath/ath9k/Makefile:17:ath9k-$(CONFIG_ATH9K_TX99) += tx99.o\ndrivers/net/wireless/ath/ath9k/Makefile:18:ath9k-$(CONFIG_ATH9K_WOW) += wow.o\ndrivers/net/wireless/ath/ath9k/Makefile:19:ath9k-$(CONFIG_ATH9K_HWRNG) += rng.o\ndrivers/net/wireless/ath/ath9k/Makefile-20-\ndrivers/net/wireless/ath/ath9k/Makefile:21:ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o\ndrivers/net/wireless/ath/ath9k/Makefile-22-\ndrivers/net/wireless/ath/ath9k/Makefile:23:ath9k-$(CONFIG_ATH9K_STATION_STATISTICS) += debug_sta.o\ndrivers/net/wireless/ath/ath9k/Makefile-24-\ndrivers/net/wireless/ath/ath9k/Makefile:25:obj-$(CONFIG_ATH9K) += ath9k.o\ndrivers/net/wireless/ath/ath9k/Makefile-26-\ndrivers/net/wireless/ath/ath9k/Makefile=27=ath9k_hw-y:=\t\\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-47-\ndrivers/net/wireless/ath/ath9k/Makefile:48:ath9k_hw-$(CONFIG_ATH9K_WOW) += ar9003_wow.o\ndrivers/net/wireless/ath/ath9k/Makefile-49-\ndrivers/net/wireless/ath/ath9k/Makefile:50:ath9k_hw-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += btcoex.o \\\ndrivers/net/wireless/ath/ath9k/Makefile-51-\t\t\t\t\t ar9003_mci.o \\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-53-\ndrivers/net/wireless/ath/ath9k/Makefile:54:ath9k_hw-$(CONFIG_ATH9K_PCOEM) += ar9003_rtt.o\ndrivers/net/wireless/ath/ath9k/Makefile-55-\ndrivers/net/wireless/ath/ath9k/Makefile:56:ath9k_hw-$(CONFIG_ATH9K_DYNACK) += dynack.o\ndrivers/net/wireless/ath/ath9k/Makefile-57-\ndrivers/net/wireless/ath/ath9k/Makefile:58:obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o\ndrivers/net/wireless/ath/ath9k/Makefile-59-\ndrivers/net/wireless/ath/ath9k/Makefile:60:obj-$(CONFIG_ATH9K_COMMON) += ath9k_common.o\ndrivers/net/wireless/ath/ath9k/Makefile-61-ath9k_common-y:=\tcommon.o \\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-64-\ndrivers/net/wireless/ath/ath9k/Makefile:65:ath9k_common-$(CONFIG_ATH9K_COMMON_DEBUG) += common-debug.o\ndrivers/net/wireless/ath/ath9k/Makefile:66:ath9k_common-$(CONFIG_ATH9K_COMMON_SPECTRAL) += common-spectral.o\ndrivers/net/wireless/ath/ath9k/Makefile-67-\ndrivers/net/wireless/ath/ath9k/Makefile=68=ath9k_htc-y +=\thtc_hst.o \\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-76-\ndrivers/net/wireless/ath/ath9k/Makefile:77:ath9k_htc-$(CONFIG_ATH9K_HTC_DEBUGFS) += htc_drv_debug.o\ndrivers/net/wireless/ath/ath9k/Makefile-78-\ndrivers/net/wireless/ath/ath9k/Makefile:79:obj-$(CONFIG_ATH9K_HTC) += ath9k_htc.o\ndrivers/net/wireless/ath/ath9k/Makefile-80-\ndrivers/net/wireless/ath/ath9k/Makefile:81:obj-$(CONFIG_ATH9K_PCI_NO_EEPROM) += ath9k_pci_owl_loader.o\n--\ndrivers/net/wireless/ath/ath9k/ani.c=39=static const struct ani_ofdm_level_entry ofdm_level_table[] = {\n--\ndrivers/net/wireless/ath/ath9k/ani.c-51-};\ndrivers/net/wireless/ath/ath9k/ani.c:52:#define ATH9K_ANI_OFDM_NUM_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c-53-\tARRAY_SIZE(ofdm_level_table)\ndrivers/net/wireless/ath/ath9k/ani.c:54:#define ATH9K_ANI_OFDM_MAX_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c:55:\t(ATH9K_ANI_OFDM_NUM_LEVEL-1)\ndrivers/net/wireless/ath/ath9k/ani.c:56:#define ATH9K_ANI_OFDM_DEF_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c-57-\t3 /* default level - matches the INI settings /\n--\ndrivers/net/wireless/ath/ath9k/ani.c=85=static const struct ani_cck_level_entry cck_level_table[] = {\n--\ndrivers/net/wireless/ath/ath9k/ani.c-97-\ndrivers/net/wireless/ath/ath9k/ani.c:98:#define ATH9K_ANI_CCK_NUM_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c-99-\tARRAY_SIZE(cck_level_table)\ndrivers/net/wireless/ath/ath9k/ani.c:100:#define ATH9K_ANI_CCK_MAX_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c:101:\t(ATH9K_ANI_CCK_NUM_LEVEL-1)\ndrivers/net/wireless/ath/ath9k/ani.c:102:#define ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI \\\ndrivers/net/wireless/ath/ath9k/ani.c:103:\t(ATH9K_ANI_CCK_NUM_LEVEL-3)\ndrivers/net/wireless/ath/ath9k/ani.c:104:#define ATH9K_ANI_CCK_DEF_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c-105-\t2 / default level - matches the INI settings /\n--\ndrivers/net/wireless/ath/ath9k/ani.c=149=static void ath9k_hw_set_ofdm_nil(struct ath_hw ah, u8 immunityLevel,\n--\ndrivers/net/wireless/ath/ath9k/ani.c-160-\t\timmunityLevel, BEACON_RSSI(ah),\ndrivers/net/wireless/ath/ath9k/ani.c:161:\t\tATH9K_ANI_RSSI_THR_LOW,\ndrivers/net/wireless/ath/ath9k/ani.c:162:\t\tATH9K_ANI_RSSI_THR_HIGH);\ndrivers/net/wireless/ath/ath9k/ani.c-163-\ndrivers/net/wireless/ath/ath9k/ani.c:164:\tif (AR_SREV_9100(ah) \u0026\u0026 immunityLevel \u003c ATH9K_ANI_OFDM_DEF_LEVEL)\ndrivers/net/wireless/ath/ath9k/ani.c:165:\t\timmunityLevel = ATH9K_ANI_OFDM_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c-166-\n--\ndrivers/net/wireless/ath/ath9k/ani.c-174-\t\tath9k_hw_ani_control(ah,\ndrivers/net/wireless/ath/ath9k/ani.c:175:\t\t\t\t ATH9K_ANI_SPUR_IMMUNITY_LEVEL,\ndrivers/net/wireless/ath/ath9k/ani.c-176-\t\t\t\t entry_ofdm-\u003espur_immunity_level);\n--\ndrivers/net/wireless/ath/ath9k/ani.c-180-\t\tath9k_hw_ani_control(ah,\ndrivers/net/wireless/ath/ath9k/ani.c:181:\t\t\t\t ATH9K_ANI_FIRSTEP_LEVEL,\ndrivers/net/wireless/ath/ath9k/ani.c-182-\t\t\t\t entry_ofdm-\u003efir_step_level);\n--\ndrivers/net/wireless/ath/ath9k/ani.c-185-\tif (ah-\u003eopmode == NL80211_IFTYPE_STATION \u0026\u0026\ndrivers/net/wireless/ath/ath9k/ani.c:186:\t BEACON_RSSI(ah) \u003c= ATH9K_ANI_RSSI_THR_HIGH)\ndrivers/net/wireless/ath/ath9k/ani.c-187-\t\tweak_sig = true;\n--\ndrivers/net/wireless/ath/ath9k/ani.c-202-\tif (aniState-\u003eofdmWeakSigDetect != weak_sig)\ndrivers/net/wireless/ath/ath9k/ani.c:203:\t\tath9k_hw_ani_control(ah, ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION,\ndrivers/net/wireless/ath/ath9k/ani.c-204-\t\t\t\t weak_sig);\n--\ndrivers/net/wireless/ath/ath9k/ani.c-208-\ndrivers/net/wireless/ath/ath9k/ani.c:209:\tif (aniState-\u003eofdmNoiseImmunityLevel \u003e= ATH9K_ANI_OFDM_DEF_LEVEL) {\ndrivers/net/wireless/ath/ath9k/ani.c:210:\t\tah-\u003econfig.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH;\ndrivers/net/wireless/ath/ath9k/ani.c:211:\t\tah-\u003econfig.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW_ABOVE_INI;\ndrivers/net/wireless/ath/ath9k/ani.c-212-\t} else {\ndrivers/net/wireless/ath/ath9k/ani.c:213:\t\tah-\u003econfig.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH_BELOW_INI;\ndrivers/net/wireless/ath/ath9k/ani.c:214:\t\tah-\u003econfig.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW;\ndrivers/net/wireless/ath/ath9k/ani.c-215-\t}\n--\ndrivers/net/wireless/ath/ath9k/ani.c=218=static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw ah)\n--\ndrivers/net/wireless/ath/ath9k/ani.c-221-\ndrivers/net/wireless/ath/ath9k/ani.c:222:\tif (aniState-\u003eofdmNoiseImmunityLevel \u003c ATH9K_ANI_OFDM_MAX_LEVEL)\ndrivers/net/wireless/ath/ath9k/ani.c-223-\t\tath9k_hw_set_ofdm_nil(ah, aniState-\u003eofdmNoiseImmunityLevel + 1, false);\n--\ndrivers/net/wireless/ath/ath9k/ani.c=229=static void ath9k_hw_set_cck_nil(struct ath_hw ah, u_int8_t immunityLevel,\n--\ndrivers/net/wireless/ath/ath9k/ani.c-238-\t\taniState-\u003ecckNoiseImmunityLevel, immunityLevel,\ndrivers/net/wireless/ath/ath9k/ani.c:239:\t\tBEACON_RSSI(ah), ATH9K_ANI_RSSI_THR_LOW,\ndrivers/net/wireless/ath/ath9k/ani.c:240:\t\tATH9K_ANI_RSSI_THR_HIGH);\ndrivers/net/wireless/ath/ath9k/ani.c-241-\ndrivers/net/wireless/ath/ath9k/ani.c:242:\tif (AR_SREV_9100(ah) \u0026\u0026 immunityLevel \u003c ATH9K_ANI_CCK_DEF_LEVEL)\ndrivers/net/wireless/ath/ath9k/ani.c:243:\t\timmunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c-244-\ndrivers/net/wireless/ath/ath9k/ani.c-245-\tif (ah-\u003eopmode == NL80211_IFTYPE_STATION \u0026\u0026\ndrivers/net/wireless/ath/ath9k/ani.c:246:\t BEACON_RSSI(ah) \u003c= ATH9K_ANI_RSSI_THR_LOW \u0026\u0026\ndrivers/net/wireless/ath/ath9k/ani.c:247:\t immunityLevel \u003e ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI)\ndrivers/net/wireless/ath/ath9k/ani.c:248:\t\timmunityLevel = ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI;\ndrivers/net/wireless/ath/ath9k/ani.c-249-\n--\ndrivers/net/wireless/ath/ath9k/ani.c-258-\t\tath9k_hw_ani_control(ah,\ndrivers/net/wireless/ath/ath9k/ani.c:259:\t\t\t\t ATH9K_ANI_FIRSTEP_LEVEL,\ndrivers/net/wireless/ath/ath9k/ani.c-260-\t\t\t\t entry_cck-\u003efir_step_level);\n--\ndrivers/net/wireless/ath/ath9k/ani.c-268-\t\tath9k_hw_ani_control(ah,\ndrivers/net/wireless/ath/ath9k/ani.c:269:\t\t\t\t ATH9K_ANI_MRC_CCK,\ndrivers/net/wireless/ath/ath9k/ani.c-270-\t\t\t\t entry_cck-\u003emrc_cck_on);\n--\ndrivers/net/wireless/ath/ath9k/ani.c=273=static void ath9k_hw_ani_cck_err_trigger(struct ath_hw ah)\n--\ndrivers/net/wireless/ath/ath9k/ani.c-276-\ndrivers/net/wireless/ath/ath9k/ani.c:277:\tif (aniState-\u003ecckNoiseImmunityLevel \u003c ATH9K_ANI_CCK_MAX_LEVEL)\ndrivers/net/wireless/ath/ath9k/ani.c-278-\t\tath9k_hw_set_cck_nil(ah, aniState-\u003ecckNoiseImmunityLevel + 1,\n--\ndrivers/net/wireless/ath/ath9k/ani.c=309=void ath9k_ani_reset(struct ath_hw ah, bool is_scanning)\n--\ndrivers/net/wireless/ath/ath9k/ani.c-321-\ndrivers/net/wireless/ath/ath9k/ani.c:322:\tofdm_nil = max_t(int, ATH9K_ANI_OFDM_DEF_LEVEL,\ndrivers/net/wireless/ath/ath9k/ani.c-323-\t\t\t aniState-\u003eofdmNoiseImmunityLevel);\ndrivers/net/wireless/ath/ath9k/ani.c:324:\tcck_nil = max_t(int, ATH9K_ANI_CCK_DEF_LEVEL,\ndrivers/net/wireless/ath/ath9k/ani.c-325-\t\t\t aniState-\u003ecckNoiseImmunityLevel);\n--\ndrivers/net/wireless/ath/ath9k/ani.c-336-\t\tif (aniState-\u003eofdmNoiseImmunityLevel !=\ndrivers/net/wireless/ath/ath9k/ani.c:337:\t\t ATH9K_ANI_OFDM_DEF_LEVEL \|\|\ndrivers/net/wireless/ath/ath9k/ani.c-338-\t\t aniState-\u003ecckNoiseImmunityLevel !=\ndrivers/net/wireless/ath/ath9k/ani.c:339:\t\t ATH9K_ANI_CCK_DEF_LEVEL) {\ndrivers/net/wireless/ath/ath9k/ani.c-340-\t\t\tath_dbg(common, ANI,\n--\ndrivers/net/wireless/ath/ath9k/ani.c-347-\ndrivers/net/wireless/ath/ath9k/ani.c:348:\t\t\tofdm_nil = ATH9K_ANI_OFDM_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c:349:\t\t\tcck_nil = ATH9K_ANI_CCK_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c-350-\t\t}\n--\ndrivers/net/wireless/ath/ath9k/ani.c=477=void ath9k_hw_ani_init(struct ath_hw ah)\n--\ndrivers/net/wireless/ath/ath9k/ani.c-484-\tif (AR_SREV_9300_20_OR_LATER(ah)) {\ndrivers/net/wireless/ath/ath9k/ani.c:485:\t\tah-\u003econfig.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH;\ndrivers/net/wireless/ath/ath9k/ani.c:486:\t\tah-\u003econfig.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW;\ndrivers/net/wireless/ath/ath9k/ani.c:487:\t\tah-\u003econfig.cck_trig_high = ATH9K_ANI_CCK_TRIG_HIGH;\ndrivers/net/wireless/ath/ath9k/ani.c:488:\t\tah-\u003econfig.cck_trig_low = ATH9K_ANI_CCK_TRIG_LOW;\ndrivers/net/wireless/ath/ath9k/ani.c-489-\t} else {\ndrivers/net/wireless/ath/ath9k/ani.c:490:\t\tah-\u003econfig.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH_OLD;\ndrivers/net/wireless/ath/ath9k/ani.c:491:\t\tah-\u003econfig.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW_OLD;\ndrivers/net/wireless/ath/ath9k/ani.c:492:\t\tah-\u003econfig.cck_trig_high = ATH9K_ANI_CCK_TRIG_HIGH_OLD;\ndrivers/net/wireless/ath/ath9k/ani.c:493:\t\tah-\u003econfig.cck_trig_low = ATH9K_ANI_CCK_TRIG_LOW_OLD;\ndrivers/net/wireless/ath/ath9k/ani.c-494-\t}\ndrivers/net/wireless/ath/ath9k/ani.c-495-\ndrivers/net/wireless/ath/ath9k/ani.c:496:\tani-\u003espurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL;\ndrivers/net/wireless/ath/ath9k/ani.c:497:\tani-\u003efirstepLevel = ATH9K_ANI_FIRSTEP_LVL;\ndrivers/net/wireless/ath/ath9k/ani.c-498-\tani-\u003emrcCCK = AR_SREV_9300_20_OR_LATER(ah) ? true : false;\n--\ndrivers/net/wireless/ath/ath9k/ani.c-500-\tani-\u003eofdmWeakSigDetect = true;\ndrivers/net/wireless/ath/ath9k/ani.c:501:\tani-\u003ecckNoiseImmunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c:502:\tani-\u003eofdmNoiseImmunityLevel = ATH9K_ANI_OFDM_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c-503-\n--\ndrivers/net/wireless/ath/ath9k/ani.c-507-\t /\ndrivers/net/wireless/ath/ath9k/ani.c:508:\tah-\u003eaniperiod = ATH9K_ANI_PERIOD;\ndrivers/net/wireless/ath/ath9k/ani.c:509:\tah-\u003econfig.ani_poll_interval = ATH9K_ANI_POLLINTERVAL;\ndrivers/net/wireless/ath/ath9k/ani.c-510-\n--\ndrivers/net/wireless/ath/ath9k/ani.h-22-/* units are errors per second /\ndrivers/net/wireless/ath/ath9k/ani.h:23:#define ATH9K_ANI_OFDM_TRIG_HIGH 3500\ndrivers/net/wireless/ath/ath9k/ani.h:24:#define ATH9K_ANI_OFDM_TRIG_HIGH_BELOW_INI 1000\ndrivers/net/wireless/ath/ath9k/ani.h:25:#define ATH9K_ANI_OFDM_TRIG_HIGH_OLD 500\ndrivers/net/wireless/ath/ath9k/ani.h-26-\ndrivers/net/wireless/ath/ath9k/ani.h:27:#define ATH9K_ANI_OFDM_TRIG_LOW 400\ndrivers/net/wireless/ath/ath9k/ani.h:28:#define ATH9K_ANI_OFDM_TRIG_LOW_ABOVE_INI 900\ndrivers/net/wireless/ath/ath9k/ani.h:29:#define ATH9K_ANI_OFDM_TRIG_LOW_OLD 200\ndrivers/net/wireless/ath/ath9k/ani.h-30-\ndrivers/net/wireless/ath/ath9k/ani.h:31:#define ATH9K_ANI_CCK_TRIG_HIGH 600\ndrivers/net/wireless/ath/ath9k/ani.h:32:#define ATH9K_ANI_CCK_TRIG_HIGH_OLD 200\ndrivers/net/wireless/ath/ath9k/ani.h:33:#define ATH9K_ANI_CCK_TRIG_LOW 300\ndrivers/net/wireless/ath/ath9k/ani.h:34:#define ATH9K_ANI_CCK_TRIG_LOW_OLD 100\ndrivers/net/wireless/ath/ath9k/ani.h-35-\ndrivers/net/wireless/ath/ath9k/ani.h:36:#define ATH9K_ANI_SPUR_IMMUNE_LVL 3\ndrivers/net/wireless/ath/ath9k/ani.h:37:#define ATH9K_ANI_FIRSTEP_LVL 2\ndrivers/net/wireless/ath/ath9k/ani.h-38-\ndrivers/net/wireless/ath/ath9k/ani.h:39:#define ATH9K_ANI_RSSI_THR_HIGH 40\ndrivers/net/wireless/ath/ath9k/ani.h:40:#define ATH9K_ANI_RSSI_THR_LOW 7\ndrivers/net/wireless/ath/ath9k/ani.h-41-\ndrivers/net/wireless/ath/ath9k/ani.h:42:#define ATH9K_ANI_PERIOD 300\ndrivers/net/wireless/ath/ath9k/ani.h-43-\ndrivers/net/wireless/ath/ath9k/ani.h-44-/ in ms /\ndrivers/net/wireless/ath/ath9k/ani.h:45:#define ATH9K_ANI_POLLINTERVAL 1000\ndrivers/net/wireless/ath/ath9k/ani.h-46-\ndrivers/net/wireless/ath/ath9k/ani.h:47:#define ATH9K_SIG_FIRSTEP_SETTING_MIN 0\ndrivers/net/wireless/ath/ath9k/ani.h:48:#define ATH9K_SIG_FIRSTEP_SETTING_MAX 20\ndrivers/net/wireless/ath/ath9k/ani.h:49:#define ATH9K_SIG_SPUR_IMM_SETTING_MIN 0\ndrivers/net/wireless/ath/ath9k/ani.h:50:#define ATH9K_SIG_SPUR_IMM_SETTING_MAX 22\ndrivers/net/wireless/ath/ath9k/ani.h-51-\n--\ndrivers/net/wireless/ath/ath9k/ani.h=54=enum ath9k_ani_cmd {\ndrivers/net/wireless/ath/ath9k/ani.h:55:\tATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION = 0x1,\ndrivers/net/wireless/ath/ath9k/ani.h:56:\tATH9K_ANI_FIRSTEP_LEVEL = 0x2,\ndrivers/net/wireless/ath/ath9k/ani.h:57:\tATH9K_ANI_SPUR_IMMUNITY_LEVEL = 0x4,\ndrivers/net/wireless/ath/ath9k/ani.h:58:\tATH9K_ANI_MRC_CCK = 0x8,\ndrivers/net/wireless/ath/ath9k/ani.h:59:\tATH9K_ANI_ALL = 0xfff\ndrivers/net/wireless/ath/ath9k/ani.h-60-};\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c=953=static bool ar5008_hw_ani_control_new(struct ath_hw ah,\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-962-\tswitch (cmd \u0026 ah-\u003eani_function) {\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:963:\tcase ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION:{\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-964-\t\t/\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1043-\t}\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1044:\tcase ATH9K_ANI_FIRSTEP_LEVEL:{\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1045-\t\tu32 level = param;\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1058-\t\t\t\tlevel,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1059:\t\t\t\tATH9K_ANI_FIRSTEP_LVL,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1060-\t\t\t\tvalue,\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1066-\t\t\t\tlevel,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1067:\t\t\t\tATH9K_ANI_FIRSTEP_LVL,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1068-\t\t\t\tvalue,\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1077-\t}\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1078:\tcase ATH9K_ANI_SPUR_IMMUNITY_LEVEL:{\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1079-\t\tu32 level = param;\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1093-\t\t\t\tlevel,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1094:\t\t\t\tATH9K_ANI_SPUR_IMMUNE_LVL,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1095-\t\t\t\tvalue,\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1101-\t\t\t\tlevel,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1102:\t\t\t\tATH9K_ANI_SPUR_IMMUNE_LVL,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1103-\t\t\t\tvalue,\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1112-\t}\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1113:\tcase ATH9K_ANI_MRC_CCK:\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1114-\t\t/\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c=1169=static void ar5008_hw_ani_cache_ini_regs(struct ath_hw ah)\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1213-\t/ these levels just got reset to defaults by the INI /\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1214:\taniState-\u003espurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL;\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1215:\taniState-\u003efirstepLevel = ATH9K_ANI_FIRSTEP_LVL;\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1216-\taniState-\u003eofdmWeakSigDetect = true;\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c=32=static bool ar9002_hw_get_isr(struct ath_hw ah, enum ath9k_int masked,\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-66-\t\t\tif (isr2 \u0026 AR_ISR_S2_TIM)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:67:\t\t\t\tmask2 \|= ATH9K_INT_TIM;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-68-\t\t\tif (isr2 \u0026 AR_ISR_S2_DTIM)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:69:\t\t\t\tmask2 \|= ATH9K_INT_DTIM;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-70-\t\t\tif (isr2 \u0026 AR_ISR_S2_DTIMSYNC)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:71:\t\t\t\tmask2 \|= ATH9K_INT_DTIMSYNC;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-72-\t\t\tif (isr2 \u0026 (AR_ISR_S2_CABEND))\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:73:\t\t\t\tmask2 \|= ATH9K_INT_CABEND;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-74-\t\t\tif (isr2 \u0026 AR_ISR_S2_GTT)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:75:\t\t\t\tmask2 \|= ATH9K_INT_GTT;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-76-\t\t\tif (isr2 \u0026 AR_ISR_S2_CST)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:77:\t\t\t\tmask2 \|= ATH9K_INT_CST;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-78-\t\t\tif (isr2 \u0026 AR_ISR_S2_TSFOOR)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:79:\t\t\t\tmask2 \|= ATH9K_INT_TSFOOR;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-80-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:81:\t\t\tif (!(pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED)) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-82-\t\t\t\tREG_WRITE(ah, AR_ISR_S2, isr2);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-86-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:87:\t\tif (pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-88-\t\t\tisr = REG_READ(ah, AR_ISR_RAC);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-94-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:95:\t\tmasked = isr \u0026 ATH9K_INT_COMMON;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-96-\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-98-\t\t\t AR_ISR_RXOK \| AR_ISR_RXERR))\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:99:\t\t\tmasked \|= ATH9K_INT_RX;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-100-\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-105-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:106:\t\t\tmasked \|= ATH9K_INT_TX;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-107-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:108:\t\t\tif (pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-109-\t\t\t\ts0_s = REG_READ(ah, AR_ISR_S0_S);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-139-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:140:\t\tif (pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-141-\t\t\ts5_s = REG_READ(ah, AR_ISR_S5_S(ah));\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-152-\t\tif (ah-\u003eintr_gen_timer_trigger)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:153:\t\t\tmasked \|= ATH9K_INT_GENTIMER;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-154-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-155-\t\tif ((s5_s \u0026 AR_ISR_S5_TIM_TIMER) \u0026\u0026\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:156:\t\t !(pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_AUTOSLEEP))\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:157:\t\t\tmasked \|= ATH9K_INT_TIM_TIMER;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-158-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:159:\t\tif (!(pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED)) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-160-\t\t\tREG_WRITE(ah, AR_ISR_S5, s5_s);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-164-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:165:\tif (!(pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED)) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-166-\t\tREG_WRITE(ah, AR_ISR, isr);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-189-\t\t\t}\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:190:\t\t\tmasked \|= ATH9K_INT_FATAL;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-191-\t\t}\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-196-\t\t\tREG_WRITE(ah, AR_RC, 0);\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:197:\t\t\tmasked \|= ATH9K_INT_FATAL;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-198-\t\t}\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c=212=ar9002_set_txdesc(struct ath_hw ah, void ds, struct ath_tx_info i)\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-260-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:261:\tctl1 \|= (i-\u003ekeyix != ATH9K_TXKEYIX_INVALID ? SM(i-\u003ekeyix, AR_DestIdx) : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-262-\t\t\| SM(i-\u003etype, AR_FrameType)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:263:\t\t\| (i-\u003eflags \u0026 ATH9K_TXDESC_NOACK ? AR_NoAck : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:264:\t\t\| (i-\u003eflags \u0026 ATH9K_TXDESC_EXT_ONLY ? AR_ExtOnly : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:265:\t\t\| (i-\u003eflags \u0026 ATH9K_TXDESC_EXT_AND_CTL ? AR_ExtAndCtl : 0);\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-266-\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-282-\tWRITE_ONCE(ads-\u003eds_ctl0, (i-\u003epkt_len \u0026 AR_FrameLen)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:283:\t\t\| (i-\u003eflags \u0026 ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-284-\t\t\| SM(i-\u003etxpower[0], AR_XmitPower0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:285:\t\t\| (i-\u003eflags \u0026 ATH9K_TXDESC_VEOL ? AR_VEOL : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:286:\t\t\| (i-\u003eflags \u0026 ATH9K_TXDESC_INTREQ ? AR_TxIntrReq : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:287:\t\t\| (i-\u003ekeyix != ATH9K_TXKEYIX_INVALID ? AR_DestIdxValid : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:288:\t\t\| (i-\u003eflags \u0026 ATH9K_TXDESC_CLRDMASK ? AR_ClrDestMask : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:289:\t\t\| (i-\u003eflags \u0026 ATH9K_TXDESC_RTSENA ? AR_RTSEnable :\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:290:\t\t (i-\u003eflags \u0026 ATH9K_TXDESC_CTSENA ? AR_CTSEnable : 0)));\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-291-\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c=316=static int ar9002_hw_proc_txdesc(struct ath_hw ah, void *ds,\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-330-\tif (status \u0026 AR_TxOpExceeded)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:331:\t\tts-\u003ets_status \|= ATH9K_TXERR_XTXOP;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-332-\tts-\u003etid = MS(status, AR_TxTid);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-340-\tif (status \u0026 AR_TxBaStatus) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:341:\t\tts-\u003ets_flags \|= ATH9K_TX_BA;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-342-\t\tts-\u003eba_low = ads-\u003eAR_BaBitmapLow;\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-347-\tif (status \u0026 AR_FrmXmitOK)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:348:\t\tts-\u003ets_status \|= ATH9K_TX_ACKED;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-349-\telse {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-350-\t\tif (status \u0026 AR_ExcessiveRetries)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:351:\t\t\tts-\u003ets_status \|= ATH9K_TXERR_XRETRY;\n\n" }
17/2	2026/09/06 12:48	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 38351 output: 29 thoughts: 30 Thoughts: Okay, here's my interpretation of that thought process, as if I were thinking it myself, tailored for someone in my field: Digging into ATH9K_HTC Dependencies Right, let's dive into the `drivers/net/wireless/ath/Kconfig` file. I need to refresh my memory on the surrounding configurations related to `ATH9K_HTC`. Specifically, I'm thinking I should check to see if there are any other enclosing or conditional configurations that might impact or depend on `ATH9K_HTC`. It's crucial to understand the broader context. Understanding dependencies is key to avoid unintended consequences or missing critical elements when modifying this module. Gotta trace the inheritance.
18/2	2026/09/06 12:48	tool	grepper	0m Args: { "Expression": "source.ath", "PathPrefix": "drivers/net/wireless/" } Results:* { "Output": "drivers/net/wireless/Kconfig=21=source \"drivers/net/wireless/admtek/Kconfig\"\ndrivers/net/wireless/Kconfig:22:source \"drivers/net/wireless/ath/Kconfig\"\ndrivers/net/wireless/Kconfig-23-source \"drivers/net/wireless/atmel/Kconfig\"\n--\ndrivers/net/wireless/ath/Kconfig=49=config ATH_REG_DYNAMIC_USER_CERT_TESTING\n--\ndrivers/net/wireless/ath/Kconfig-56-\ndrivers/net/wireless/ath/Kconfig:57:source \"drivers/net/wireless/ath/ath5k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:58:source \"drivers/net/wireless/ath/ath9k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:59:source \"drivers/net/wireless/ath/carl9170/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:60:source \"drivers/net/wireless/ath/ath6kl/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:61:source \"drivers/net/wireless/ath/ar5523/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:62:source \"drivers/net/wireless/ath/wil6210/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:63:source \"drivers/net/wireless/ath/ath10k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:64:source \"drivers/net/wireless/ath/wcn36xx/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:65:source \"drivers/net/wireless/ath/ath11k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:66:source \"drivers/net/wireless/ath/ath12k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig-67-\n--\ndrivers/net/wireless/ath/ath10k/ahb.c=430=static void ath10k_ahb_irq_disable(struct ath10k ar)\n--\ndrivers/net/wireless/ath/ath10k/ahb.c-435-\ndrivers/net/wireless/ath/ath10k/ahb.c:436:static int ath10k_ahb_resource_init(struct ath10k ar)\ndrivers/net/wireless/ath/ath10k/ahb.c-437-{\n--\ndrivers/net/wireless/ath/ath10k/ahb.c-523-\ndrivers/net/wireless/ath/ath10k/ahb.c:524:static void ath10k_ahb_resource_deinit(struct ath10k ar)\ndrivers/net/wireless/ath/ath10k/ahb.c-525-{\n--\ndrivers/net/wireless/ath/ath10k/mac.c=204=ath10k_mac_max_vht_nss(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])\n--\ndrivers/net/wireless/ath/ath10k/mac.c-214-\ndrivers/net/wireless/ath/ath10k/mac.c:215:int ath10k_mac_ext_resource_config(struct ath10k ar, u32 val)\ndrivers/net/wireless/ath/ath10k/mac.c-216-{\n--\ndrivers/net/wireless/ath/ath10k/mac.h=70=struct ieee80211_txq ath10k_mac_txq_lookup(struct ath10k ar,\n--\ndrivers/net/wireless/ath/ath10k/mac.h-72-\t\t\t\t\t u8 tid);\ndrivers/net/wireless/ath/ath10k/mac.h:73:int ath10k_mac_ext_resource_config(struct ath10k ar, u32 val);\ndrivers/net/wireless/ath/ath10k/mac.h-74-void ath10k_mac_wait_tx_complete(struct ath10k ar);\n--\ndrivers/net/wireless/ath/ath10k/pci.c=1789=void ath10k_pci_hif_send_complete_check(struct ath10k ar, u8 pipe,\n--\ndrivers/net/wireless/ath/ath10k/pci.c-1804-\t\t /\ndrivers/net/wireless/ath/ath10k/pci.c:1805:\t\tresources = ath10k_pci_hif_get_free_queue_number(ar, pipe);\ndrivers/net/wireless/ath/ath10k/pci.c-1806-\n--\ndrivers/net/wireless/ath/ath10k/pci.c=3437=static bool ath10k_pci_chip_is_supported(u32 dev_id, u32 chip_id)\n--\ndrivers/net/wireless/ath/ath10k/pci.c-3453-\ndrivers/net/wireless/ath/ath10k/pci.c:3454:int ath10k_pci_setup_resource(struct ath10k ar)\ndrivers/net/wireless/ath/ath10k/pci.c-3455-{\n--\ndrivers/net/wireless/ath/ath10k/pci.c-3510-\ndrivers/net/wireless/ath/ath10k/pci.c:3511:void ath10k_pci_release_resource(struct ath10k ar)\ndrivers/net/wireless/ath/ath10k/pci.c-3512-{\n--\ndrivers/net/wireless/ath/ath10k/pci.h=250=int ath10k_pci_wait_for_target_init(struct ath10k ar);\ndrivers/net/wireless/ath/ath10k/pci.h:251:int ath10k_pci_setup_resource(struct ath10k ar);\ndrivers/net/wireless/ath/ath10k/pci.h:252:void ath10k_pci_release_resource(struct ath10k ar);\ndrivers/net/wireless/ath/ath10k/pci.h-253-\n--\ndrivers/net/wireless/ath/ath10k/snoc.c=761=static void ath10k_snoc_hif_send_complete_check(struct ath10k ar, u8 pipe,\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-768-\tif (!force) {\ndrivers/net/wireless/ath/ath10k/snoc.c:769:\t\tresources = ath10k_snoc_hif_get_free_queue_number(ar, pipe);\ndrivers/net/wireless/ath/ath10k/snoc.c-770-\n--\ndrivers/net/wireless/ath/ath10k/snoc.c=1305=static void ath10k_snoc_free_irq(struct ath10k ar)\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-1313-\ndrivers/net/wireless/ath/ath10k/snoc.c:1314:static int ath10k_snoc_resource_init(struct ath10k ar)\ndrivers/net/wireless/ath/ath10k/snoc.c-1315-{\n--\ndrivers/net/wireless/ath/ath10k/snoc.c=1371=int ath10k_snoc_fw_indication(struct ath10k ar, u64 type)\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-1408-\ndrivers/net/wireless/ath/ath10k/snoc.c:1409:static int ath10k_snoc_setup_resource(struct ath10k ar)\ndrivers/net/wireless/ath/ath10k/snoc.c-1410-{\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-1437-\ndrivers/net/wireless/ath/ath10k/snoc.c:1438:static void ath10k_snoc_release_resource(struct ath10k ar)\ndrivers/net/wireless/ath/ath10k/snoc.c-1439-{\n--\ndrivers/net/wireless/ath/ath10k/snoc.c=1573=static void ath10k_modem_deinit(struct ath10k ar)\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-1582-\ndrivers/net/wireless/ath/ath10k/snoc.c:1583:static int ath10k_setup_msa_resources(struct ath10k ar, u32 msa_size)\ndrivers/net/wireless/ath/ath10k/snoc.c-1584-{\n--\ndrivers/net/wireless/ath/ath10k/snoc.c=1732=static int ath10k_snoc_probe(struct platform_device pdev)\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-1894-\ndrivers/net/wireless/ath/ath10k/snoc.c:1895:static int ath10k_snoc_free_resources(struct ath10k ar)\ndrivers/net/wireless/ath/ath10k/snoc.c-1896-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c=74=static void ath10k_usb_cleanup_recv_urb(struct ath10k_urb_context urb_context)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-81-\ndrivers/net/wireless/ath/ath10k/usb.c:82:static void ath10k_usb_free_pipe_resources(struct ath10k ar,\ndrivers/net/wireless/ath/ath10k/usb.c-83-\t\t\t\t\t struct ath10k_usb_pipe pipe)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-113-\ndrivers/net/wireless/ath/ath10k/usb.c:114:static void ath10k_usb_cleanup_pipe_resources(struct ath10k ar)\ndrivers/net/wireless/ath/ath10k/usb.c-115-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c=746=static u8 ath10k_usb_get_logical_pipe_num(u8 ep_address, int urb_count)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-790-\ndrivers/net/wireless/ath/ath10k/usb.c:791:static int ath10k_usb_alloc_pipe_resources(struct ath10k ar,\ndrivers/net/wireless/ath/ath10k/usb.c-792-\t\t\t\t\t struct ath10k_usb_pipe pipe,\n--\ndrivers/net/wireless/ath/ath10k/usb.c-822-\ndrivers/net/wireless/ath/ath10k/usb.c:823:static int ath10k_usb_setup_pipe_resources(struct ath10k ar,\ndrivers/net/wireless/ath/ath10k/usb.c-824-\t\t\t\t\t struct usb_interface interface)\n--\ndrivers/net/wireless/ath/ath10k/wmi-ops.h=14=struct wmi_ops {\n--\ndrivers/net/wireless/ath/ath10k/wmi-ops.h-209-\t\t\t\t\t\t\tu32 detect_margin);\ndrivers/net/wireless/ath/ath10k/wmi-ops.h:210:\tstruct sk_buff (ext_resource_config)(struct ath10k ar,\ndrivers/net/wireless/ath/ath10k/wmi-ops.h-211-\t\t\t\t\t enum wmi_host_platform_type type,\n--\ndrivers/net/wireless/ath/ath10k/wmi-ops.h=1579=static inline int\ndrivers/net/wireless/ath/ath10k/wmi-ops.h:1580:ath10k_wmi_ext_resource_config(struct ath10k ar,\ndrivers/net/wireless/ath/ath10k/wmi-ops.h-1581-\t\t\t enum wmi_host_platform_type type,\n--\ndrivers/net/wireless/ath/ath10k/wmi.c=8855=static struct sk_buff \ndrivers/net/wireless/ath/ath10k/wmi.c:8856:ath10k_wmi_10_4_ext_resource_config(struct ath10k ar,\ndrivers/net/wireless/ath/ath10k/wmi.c-8857-\t\t\t\t enum wmi_host_platform_type type,\n--\ndrivers/net/wireless/ath/ath10k/wmi.c=9438=static const struct wmi_ops wmi_10_4_ops = {\n--\ndrivers/net/wireless/ath/ath10k/wmi.c-9496-\t.fw_stats_fill = ath10k_wmi_10_4_op_fw_stats_fill,\ndrivers/net/wireless/ath/ath10k/wmi.c:9497:\t.ext_resource_config = ath10k_wmi_10_4_ext_resource_config,\ndrivers/net/wireless/ath/ath10k/wmi.c-9498-\t.gen_update_fw_tdls_state = ath10k_wmi_10_4_gen_update_fw_tdls_state,\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=828=static int ath11k_core_get_rproc(struct ath11k_base ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-847-\ndrivers/net/wireless/ath/ath11k/ahb.c:848:static int ath11k_ahb_setup_msi_resources(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-849-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=916=static void ath11k_ahb_release_smp2p_handle(struct ath11k_base ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-925-\ndrivers/net/wireless/ath/ath11k/ahb.c:926:static int ath11k_ahb_setup_resources(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-927-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-946-\ndrivers/net/wireless/ath/ath11k/ahb.c:947:static int ath11k_ahb_setup_msa_resources(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-948-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=999=static void ath11k_ahb_ce_unmap(struct ath11k_base ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1004-\ndrivers/net/wireless/ath/ath11k/ahb.c:1005:static int ath11k_ahb_fw_resources_init(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-1006-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1103-\ndrivers/net/wireless/ath/ath11k/ahb.c:1104:static int ath11k_ahb_fw_resource_deinit(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-1105-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1264=static void ath11k_ahb_remove_prepare(struct ath11k_base ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1279-\ndrivers/net/wireless/ath/ath11k/ahb.c:1280:static void ath11k_ahb_free_resources(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-1281-{\n--\ndrivers/net/wireless/ath/ath11k/dp.c=43=int ath11k_dp_peer_setup(struct ath11k ar, int vdev_id, const u8 addr)\n--\ndrivers/net/wireless/ath/ath11k/dp.c-78-\ndrivers/net/wireless/ath/ath11k/dp.c:79:\t/* TODO: Setup other peer specific resource used in data path /\ndrivers/net/wireless/ath/ath11k/dp.c-80-\n--\ndrivers/net/wireless/ath/ath11k/qmi.c=3364=EXPORT_SYMBOL(ath11k_qmi_deinit_service);\ndrivers/net/wireless/ath/ath11k/qmi.c-3365-\ndrivers/net/wireless/ath/ath11k/qmi.c:3366:void ath11k_qmi_free_resource(struct ath11k_base ab)\ndrivers/net/wireless/ath/ath11k/qmi.c-3367-{\n--\ndrivers/net/wireless/ath/ath11k/qmi.h=521=int ath11k_qmi_init_service(struct ath11k_base ab);\ndrivers/net/wireless/ath/ath11k/qmi.h:522:void ath11k_qmi_free_resource(struct ath11k_base ab);\ndrivers/net/wireless/ath/ath11k/qmi.h-523-int ath11k_qmi_fwreset_from_cold_boot(struct ath11k_base ab);\n--\ndrivers/net/wireless/ath/ath12k/ahb.c=1011=static void ath12k_ahb_deconfigure_rproc(struct ath12k_base ab)\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-1035-\ndrivers/net/wireless/ath/ath12k/ahb.c:1036:static int ath12k_ahb_resource_init(struct ath12k_base ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-1037-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-1099-\ndrivers/net/wireless/ath/ath12k/ahb.c:1100:static void ath12k_ahb_resource_deinit(struct ath12k_base ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-1101-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c=1267=static void ath12k_ahb_remove_prepare(struct ath12k_base ab)\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-1282-\ndrivers/net/wireless/ath/ath12k/ahb.c:1283:static void ath12k_ahb_free_resources(struct ath12k_base ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-1284-{\n--\ndrivers/net/wireless/ath/ath12k/dp.c=47=int ath12k_dp_peer_setup(struct ath12k ar, int vdev_id, const u8 addr)\n--\ndrivers/net/wireless/ath/ath12k/dp.c-82-\ndrivers/net/wireless/ath/ath12k/dp.c:83:\t/* TODO: Setup other peer specific resource used in data path /\ndrivers/net/wireless/ath/ath12k/dp.c-84-\n--\ndrivers/net/wireless/ath/ath12k/qmi.c=4103=void ath12k_qmi_deinit_service(struct ath12k_base ab)\n--\ndrivers/net/wireless/ath/ath12k/qmi.c-4116-\ndrivers/net/wireless/ath/ath12k/qmi.c:4117:void ath12k_qmi_free_resource(struct ath12k_base ab)\ndrivers/net/wireless/ath/ath12k/qmi.c-4118-{\n--\ndrivers/net/wireless/ath/ath12k/qmi.h=633=int ath12k_qmi_init_service(struct ath12k_base ab);\ndrivers/net/wireless/ath/ath12k/qmi.h:634:void ath12k_qmi_free_resource(struct ath12k_base ab);\ndrivers/net/wireless/ath/ath12k/qmi.h-635-void ath12k_qmi_trigger_host_cap(struct ath12k_base ab);\n--\ndrivers/net/wireless/ath/ath12k/wmi.c=4143=static void\ndrivers/net/wireless/ath/ath12k/wmi.c:4144:ath12k_wmi_copy_resource_config(struct ath12k_base ab,\ndrivers/net/wireless/ath/ath12k/wmi.c-4145-\t\t\t\tstruct ath12k_wmi_resource_config_params wmi_cfg,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c=177=static inline struct ath6kl_usb ath6kl_usb_priv(struct ath6kl ar)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-182-/* pipe resource allocation/cleanup /\ndrivers/net/wireless/ath/ath6kl/usb.c:183:static int ath6kl_usb_alloc_pipe_resources(struct ath6kl_usb_pipe pipe,\ndrivers/net/wireless/ath/ath6kl/usb.c-184-\t\t\t\t\t int urb_cnt)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-217-\ndrivers/net/wireless/ath/ath6kl/usb.c:218:static void ath6kl_usb_free_pipe_resources(struct ath6kl_usb_pipe pipe)\ndrivers/net/wireless/ath/ath6kl/usb.c-219-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-248-\ndrivers/net/wireless/ath/ath6kl/usb.c:249:static void ath6kl_usb_cleanup_pipe_resources(struct ath6kl_usb ar_usb)\ndrivers/net/wireless/ath/ath6kl/usb.c-250-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c=257=static u8 ath6kl_usb_get_logical_pipe_num(struct ath6kl_usb ar_usb,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-302-\ndrivers/net/wireless/ath/ath6kl/usb.c:303:static int ath6kl_usb_setup_pipe_resources(struct ath6kl_usb ar_usb)\ndrivers/net/wireless/ath/ath6kl/usb.c-304-{\n" }
19/2	2026/09/06 12:48	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 44746 output: 36 thoughts: 22 Thoughts: Here's my thought process, as it is: Checking `ATH_COMMON` in `drivers/net/wireless/ath/Kconfig` Okay, so I need to understand what's going on with the Atheros wireless drivers in this kernel build, and the first logical step is to check the configuration options. Specifically, I'm thinking about `ATH_COMMON`. I know that's a key common configuration for the Atheros driver, so that's where I'll start looking. I'll need to see how it's defined, its dependencies, and what other options are influenced by its state. This will help me understand the overall build configuration and pinpoint any potential issues or understand the rationale behind certain settings, given my expertise in the field.
20/2	2026/09/06 12:48	tool	read-file	0m Args: { "File": "drivers/net/wireless/ath/Kconfig", "FirstLine": 1, "LineCount": 40 } Results: { "Contents": " 1:\t# SPDX-License-Identifier: ISC\n 2:\tconfig ATH_COMMON\n 3:\t\ttristate\n 4:\t\n 5:\tconfig WLAN_VENDOR_ATH\n 6:\t\tbool \"Atheros/Qualcomm devices\"\n 7:\t\tdefault y\n 8:\t\thelp\n 9:\t\t If you have a wireless card belonging to this class, say Y.\n 10:\t\n 11:\t\t Note that the answer to this question doesn't directly affect the\n 12:\t\t kernel: saying N will just cause the configurator to skip all the\n 13:\t\t questions about these cards. If you say Y, you will be asked for\n 14:\t\t your specific card in the following questions.\n 15:\t\n 16:\t\t For more information and documentation on this module you can visit:\n 17:\t\n 18:\t\t https://wireless.wiki.kernel.org/en/users/Drivers/ath\n 19:\t\n 20:\t\t For information on all Atheros wireless drivers visit:\n 21:\t\n 22:\t\t https://wireless.wiki.kernel.org/en/users/Drivers/Atheros\n 23:\t\n 24:\tif WLAN_VENDOR_ATH\n 25:\t\n 26:\tconfig ATH_DEBUG\n 27:\t\tbool \"Atheros wireless debugging\"\n 28:\t\thelp\n 29:\t\t Say Y, if you want to debug atheros wireless drivers.\n 30:\t\t Right now only ath9k makes use of this.\n 31:\t\n 32:\tconfig ATH_TRACEPOINTS\n 33:\t\tbool \"Atheros wireless tracing\"\n 34:\t\tdepends on ATH_DEBUG\n 35:\t\tdepends on EVENT_TRACING\n 36:\t\thelp\n 37:\t\t This option enables tracepoints for atheros wireless drivers.\n 38:\t\t Currently, ath9k makes use of this facility.\n 39:\t\n 40:\tconfig ATH_REG_DYNAMIC_USER_REG_HINTS\n" }
21/2	2026/09/06 12:48	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 45480 output: 40 thoughts: 415 Thoughts: My Analysis of the ath9k_htc Driver Dependencies and Symbol Scope Okay, let's break this down systematically. First, I need to confirm the core dependencies. It looks like the relevant configuration options are: `USB`, `MAC80211`, `ATH9K_HTC`, and `WLAN_VENDOR_ATH`. Specifically, `CONFIG_ATH9K_HTC` appears to be the primary configuration option, and I also need to ensure that `CONFIG_USB`, `CONFIG_MAC80211`, and `CONFIG_WLAN_VENDOR_ATH` are all enabled. Now, let's drill down into the key symbols that are directly impacted or strongly connected to this code. It seems like the focus is on these: * `hif_usb_send_regout`: This one was directly modified, specifically with the addition of a `WARN_ONCE` check. * `ath9k_reg_rmw_buffer`: This was directly modified, where there was a fix made for a register_rmw sizeof calculation. * `ath9k_reg_rmw`: This is a caller of `ath9k_reg_rmw_buffer`, so it's relevant in terms of control flow. * `ath9k_reg_rmw_flush`: This one is responsible for flushing the buffer, so it's important for the overall register modification process. * `hif_usb_send`: This one calls `hif_usb_send_regout`. I need to understand the scope and visibility of these functions – are they static, exported, or part of the binary symbols? Even static functions, if not inlined, contribute to the symbol coverage, so they're worth investigating. Let's start with `ath9k_reg_rmw_buffer`. Yes, it is static void. And `hif_usb_send_regout` is static int. And `hif_usb_send` is also static in `hif_usb.c`, but it's a callback, defined under `hif_ops->send`. This means I need to figure out how `hif_dev->hif_ops` or the `hif_usb` callbacks are registered to understand how these static functions are actually used and exposed within the broader system.
22/2	2026/09/06 12:48	tool	grepper	0m Args: { "Expression": "hif_usb_send\\b", "PathPrefix": "drivers/net/wireless/ath/ath9k/" } Results: { "Output": "drivers/net/wireless/ath/ath9k/hif_usb.c=443=static void hif_usb_stop(void hif_handle)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-471-\ndrivers/net/wireless/ath/ath9k/hif_usb.c:472:static int hif_usb_send(void hif_handle, u8 pipe_id, struct sk_buff *skb)\ndrivers/net/wireless/ath/ath9k/hif_usb.c-473-{\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c=528=static struct ath9k_htc_hif hif_usb = {\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-537-\t.sta_drain = hif_usb_sta_drain,\ndrivers/net/wireless/ath/ath9k/hif_usb.c:538:\t.send = hif_usb_send,\ndrivers/net/wireless/ath/ath9k/hif_usb.c-539-};\n" }
23/2	2026/09/06 12:48	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 46742 output: 37 thoughts: 22 Thoughts: Here's my summary, as if I were thinking these thoughts: Analyzing the HTC/WMI Layer's Interaction with `hif_usb_send` Okay, so I need to get a clear picture of how the `hif_usb_send` function is actually being called within the HTC/WMI layer. It's crucial to understand this interaction for [ Insert the relevant technical field, e.g., debugging a USB communication issue, optimizing data transfer, analyzing driver behavior, etc. ]. I need to trace the call paths to identify the entry points and the context in which this function is used. My initial plan is to examine the code where HTC and WMI are integrated. I'm going to follow the function calls from the higher level protocols to the point where the `hif_usb_send` function is invoked. This will illuminate the exact data that's being sent over USB and the implications for performance or any potential vulnerabilities. I need to note any parameters that are passed and understand how the data is being constructed.
24/2	2026/09/06 12:48	tool	grepper	0m Args: { "Expression": "-\u003ehif-\u003esend", "PathPrefix": "drivers/net/wireless/ath/ath9k/" } Results: { "Output": "drivers/net/wireless/ath/ath9k/htc_hst.c=21=static int htc_issue_send(struct htc_target target, struct sk_buff skb,\n--\ndrivers/net/wireless/ath/ath9k/htc_hst.c-34-\ndrivers/net/wireless/ath/ath9k/htc_hst.c:35:\tstatus = target-\u003ehif-\u003esend(target-\u003ehif_dev, endpoint-\u003eul_pipeid, skb);\ndrivers/net/wireless/ath/ath9k/htc_hst.c-36-\n" }
25/2	2026/09/06 12:48	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 47179 output: 249 thoughts: 720 Thoughts: Fuzzing Verdict: Ready to Execute Okay, let's break this down for the fuzzing run. I've got a list of target functions: `htc_issue_send`, `htc_send`, `ath9k_wmi_cmd`, `ath9k_reg_rmw`, `ath9k_reg_rmw_buffer`, `ath9k_reg_rmw_flush`, `hif_usb_send`, and `hif_usb_send_regout`. I need to nail down the parameters for `set-results`. First, `WorthFuzzing`? Absolutely, true. The `Reasoning` will be a concise explanation, and this is what I'm thinking: The patch introduces new error handling with a `WARN_ONCE` in `hif_usb_send_regout` to prevent sending packets of a specific length, tweaks a structure size calculation in `ath9k_reg_rmw_buffer`, and reduces `MAX_RMW_CMD_NUMBER`. This driver, `ath9k_htc`, is accessible via emulated USB devices (like Raw Gadget), and these changes warrant fuzzing to make sure everything's correct. Next, the `FocusSymbols`. I've got a shortlist from above: `hif_usb_send_regout`, `ath9k_reg_rmw_buffer`, `ath9k_reg_rmw_flush`, `ath9k_reg_rmw`, and `hif_usb_send`. They're specific and non-ubiquitous, just like we want. Then, the `EnableConfigs`. We need these kernel config flags, without the `CONFIG_` prefix: `ATH9K_HTC`, `USB`, `MAC80211`, and `WLAN_VENDOR_ATH`. I've made sure to review the instructions: the goal is to discover crashes, regressions, new bugs, and triggered assertions. The new or changed assertions are key – we need to fuzz those to make sure they're solid. And this driver is reachable via USB. Also, I've confirmed that the focus symbols are specific. Let's double-check all of this, one last time. Configs: `ATH9K_HTC`, `USB`, `MAC80211`, `WLAN_VENDOR_ATH` – check. Symbols: `hif_usb_send_regout`, `ath9k_reg_rmw_buffer`, `ath9k_reg_rmw_flush`, `ath9k_reg_rmw`, `hif_usb_send` – check. My reasoning still holds: this patch introduces a `WARN_ONCE` in `hif_usb_send_regout`, structure fixes in `ath9k_reg_rmw_buffer` and reduces `MAX_RMW_CMD_NUMBER`. The driver (`ath9k_htc`) is reachable through emulated USB, and we need to fuzz the new assertion and modified buffer handling to prevent regressions. Alright, everything's accurate and ready to go. Time to call `set-results`.
26/2	2026/09/06 12:48	tool	set-results	0m Args: { "EnableConfigs": [ "ATH9K_HTC", "USB", "MAC80211", "WLAN_VENDOR_ATH" ], "FocusSymbols": [ "hif_usb_send_regout", "ath9k_reg_rmw_buffer", "ath9k_reg_rmw_flush", "ath9k_reg_rmw", "hif_usb_send" ], "Reasoning": "The patch modifies the USB wireless driver ath9k_htc, which is reachable via USB gadget/device emulation in syzkaller. The changes add a new WARN_ONCE runtime assertion and check in hif_usb_send_regout to prevent sending packets whose length is an exact multiple of the USB maxpacket size, correct the element size calculation in ath9k_reg_rmw_buffer from sizeof(struct register_write) to sizeof(struct register_rmw), and reduce MAX_RMW_CMD_NUMBER. Fuzzing is warranted to test the new assertion and altered RMW command batching logic.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "ATH9K_HTC", "USB", "MAC80211", "WLAN_VENDOR_ATH" ], "FocusSymbols": [ "hif_usb_send_regout", "ath9k_reg_rmw_buffer", "ath9k_reg_rmw_flush", "ath9k_reg_rmw", "hif_usb_send" ], "Reasoning": "The patch modifies the USB wireless driver ath9k_htc, which is reachable via USB gadget/device emulation in syzkaller. The changes add a new WARN_ONCE runtime assertion and check in hif_usb_send_regout to prevent sending packets whose length is an exact multiple of the USB maxpacket size, correct the element size calculation in ath9k_reg_rmw_buffer from sizeof(struct register_write) to sizeof(struct register_rmw), and reduce MAX_RMW_CMD_NUMBER. Fuzzing is warranted to test the new assertion and altered RMW command batching logic.", "WorthFuzzing": true }
27/1	2026/09/06 12:48	action	If	0m Args: { "WorthFuzzing": true } Results: null
28/2	2026/09/06 12:48	agent	kmsan-evaluator	0m Model: core Args: null Results: { "KMSANReasoning": "The patch addresses a USB communication issue in the ath9k driver where USB packets that are exact multiples of endpoint maxpacket size cause firmware delivery stalls. The changes consist of:\n1. Adding a check in `hif_usb_send_regout()` to warn and reject skbs whose length is an exact multiple of the endpoint maxpacket size.\n2. Correcting the buffer size calculation in `ath9k_reg_rmw_buffer()` from `sizeof(struct register_write)` (8 bytes) to `sizeof(struct register_rmw)` (12 bytes).\n3. Lowering `MAX_RMW_CMD_NUMBER` from 15 to 14 in `wmi.h` to avoid 64-byte aligned USB payloads.\n\nRegarding memory initialization:\n- All fields (`reg`, `set`, `clr`) of the `struct register_rmw` array elements in `priv-\u003ewmi-\u003emulti_rmw` are explicitly initialized before being sent via `ath9k_wmi_cmd()`.\n- No user-space copy paths or uninitialized kernel structure fields are exposed or modified.\n- No branch conditions rely on uninitialized values.\n\nTherefore, this patch introduces no uninitialized memory risks, and a dedicated KMSAN fuzzing session is not required.", "NeedsKMSAN": false } Instruction: You are an expert Linux kernel security engineer specializing in kernel memory error detectors (KASAN and KMSAN). Your job is to review the provided patch series and determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer) fuzzing session in addition to standard KASAN fuzzing. CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN: - Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable a comprehensive suite of debugging tools and sanitizers, including KASAN (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks. - KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap, or page allocations) and kernel-to-user memory info-leaks. Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN, LOCKDEP, OR OTHER STANDARD BUG DETECTORS. A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks that are detected ONLY by KMSAN. Look holistically at the patch series and surrounding code. Even if no direct uninitialized field accesses or new buffer allocations are added in the diff itself, a patch may alter control flow, bounds checking, or data length calculations in ways that change how the rest of the code operates on existing buffers (e.g. allowing uninitialized stack/heap memory to be read, copied to user space, or used in control flow). Do not hesitate to use your code access tools to inspect the surrounding code, called functions, and callers. Set NeedsKMSAN=true ONLY IF the patch introduces or modifies: 1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb attributes, ioctl output arguments, socket options, or BPF buffers) where fields or structure padding might not be fully initialized/zeroed. 2. Conditional logic or branching that depends on potentially uninitialized variables or struct fields. 3. Allocation or initialization of complex data structures where uninitialized fields could be read later in reachable code paths. 4. Bounds checks, lengths, or logic in a way that allows surrounding code to access uninitialized bytes of existing buffers. Set NeedsKMSAN=false IF: - The code changes primarily risk out-of-bounds access, array overflows, NULL pointer dereferences, locking deadlocks, or use-after-free bugs (these are already caught by KASAN, LOCKDEP, or standard bug detectors). - All stack/heap structures touched or introduced by the patch are fully zeroed or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied. - The patch does not introduce any risk of uninitialized memory usage or info-leaks. Use your code access tools to inspect the surrounding code if necessary, then provide detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch. Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 4a872e85917d67040075191978246f39b0b95e47 Author: syz-cluster <triage@syzkaller.com> Date: Sun Sep 6 12:47:33 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index d3491ff08e6ef..49303c7e3fef4 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -99,10 +99,17 @@ static void hif_usb_regout_cb(struct urb urb) static int hif_usb_send_regout(struct hif_device_usb hif_dev, struct sk_buff skb) { + u16 maxpacket = usb_maxpacket(hif_dev->udev, + usb_sndintpipe(hif_dev->udev, + USB_REG_OUT_PIPE)); struct urb urb; struct cmd_buf cmd; int ret = 0; + if (WARN_ONCE(maxpacket && skb->len % maxpacket == 0, + "%u-byte command fills whole USB packets\n", skb->len)) + return -EINVAL; + urb = usb_alloc_urb(0, GFP_KERNEL); if (urb == NULL) return -ENOMEM; diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c index 6de78ae857268..0b49d2cc99f0b 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c @@ -405,7 +405,7 @@ static void ath9k_reg_rmw_buffer(void hw_priv, if (priv->wmi->multi_rmw_idx == MAX_RMW_CMD_NUMBER) { r = ath9k_wmi_cmd(priv->wmi, WMI_REG_RMW_CMDID, (u8 ) &priv->wmi->multi_rmw, - sizeof(struct register_write) priv->wmi->multi_rmw_idx, + sizeof(struct register_rmw) * priv->wmi->multi_rmw_idx, (u8 ) &rsp_status, sizeof(rsp_status), 100); if (unlikely(r)) { diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h index 5c3b710b8f319..256f46098a6b1 100644 --- a/drivers/net/wireless/ath/ath9k/wmi.h +++ b/drivers/net/wireless/ath/ath9k/wmi.h @@ -126,7 +126,8 @@ enum wmi_event_id { }; #define MAX_CMD_NUMBER 62 -#define MAX_RMW_CMD_NUMBER 15 +/ 15 entries make 192 bytes, three full USB packets: never delivered. */ +#define MAX_RMW_CMD_NUMBER 14 struct register_write { __be32 reg;
29/3	2026/09/06 12:48	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 2789 output: 36 thoughts: 412 Thoughts: Analyzing a WLAN Driver Patch Okay, so this patch is touching the Atheros ath9k wireless driver, specifically within the USB host interface (`hif_usb.c`), the HTC driver initialization (`htc_drv_init.c`), and the WMI header (`wmi.h`). Let's break down these changes to see what's going on. First, in `hif_usb_send_regout`, there's a new sanity check. It's looking at the USB packet size being used for register output. It appears the code now checks `usb_maxpacket` to determine the maximum packet size for the output interrupt pipe. If the command, `skb->len`, perfectly fills a whole USB packet (meaning it's a multiple of `maxpacket`) without a short packet or zero-length packet being sent, then it returns `-EINVAL`. This is interesting; it's a potential error condition being flagged, probably related to some edge case with USB transfers that wasn't being handled before. I need to understand why this full-packet condition is problematic. Is it a potential endpoint buffering issue or perhaps a signaling problem related to a particular hardware quirk? I need to dig deeper. Moving on to `htc_drv_init.c`, it's modifying the `ath9k_reg_rmw_buffer` allocation. The size calculation is changing from using `struct register_write` to `struct register_rmw`. This is a crucial detail. I need to figure out what the difference is between these two structures. A size change indicates either a data structure revision, a bug fix, or an optimization. Is there a new field or a changed field within `struct register_rmw` compared to `struct register_write`? I'll need to compare the definitions to understand the memory implications. Finally, in `wmi.h`, there's a simple change, but important, `MAX_RMW_CMD_NUMBER` is being reduced from 15 to 14. This almost certainly means that there's a limitation on the number of Register-Modify-Write (RMW) commands that can be queued or processed. I'm curious about the rationale for this change. Does it indicate a bug fix, or is it related to hardware constraints or a WMI protocol change? Perhaps the command slot count was incorrect to begin with? To get a better picture, I'll use `read-file` or `grepper` to examine `htc_drv_init.c` around line 405 (where the `ath9k_reg_rmw_buffer` is allocated) and `wmi.h` to see those structure definitions and the surrounding code. That should illuminate the reasons for these changes.
30/3	2026/09/06 12:48	tool	grepper	0m Args: { "Expression": "register_rmw", "PathPrefix": "drivers/net/wireless/ath/ath9k/" } Results: { "Output": "drivers/net/wireless/ath/ath9k/htc_drv_init.c=383=static void ath9k_reg_rmw_buffer(void hw_priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-407-\t\t\t (u8 ) \u0026priv-\u003ewmi-\u003emulti_rmw,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:408:\t\t\t sizeof(struct register_rmw) * priv-\u003ewmi-\u003emulti_rmw_idx,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-409-\t\t\t (u8 ) \u0026rsp_status, sizeof(rsp_status),\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c=422=static void ath9k_reg_rmw_flush(void hw_priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-439-\t\t\t (u8 ) \u0026priv-\u003ewmi-\u003emulti_rmw,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:440:\t\t\t sizeof(struct register_rmw) priv-\u003ewmi-\u003emulti_rmw_idx,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-441-\t\t\t (u8 ) \u0026rsp_status, sizeof(rsp_status),\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c=466=static void ath9k_reg_rmw_single(void hw_priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-471-\tstruct ath9k_htc_priv *priv = common-\u003epriv;\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:472:\tstruct register_rmw buf, buf_ret;\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-473-\tint ret;\n--\ndrivers/net/wireless/ath/ath9k/wmi.h=132=struct register_write {\n--\ndrivers/net/wireless/ath/ath9k/wmi.h-136-\ndrivers/net/wireless/ath/ath9k/wmi.h:137:struct register_rmw {\ndrivers/net/wireless/ath/ath9k/wmi.h-138-\t__be32 reg;\n--\ndrivers/net/wireless/ath/ath9k/wmi.h=149=struct wmi {\n--\ndrivers/net/wireless/ath/ath9k/wmi.h-175-\tatomic_t m_rmw_cnt;\ndrivers/net/wireless/ath/ath9k/wmi.h:176:\tstruct register_rmw multi_rmw[MAX_RMW_CMD_NUMBER];\ndrivers/net/wireless/ath/ath9k/wmi.h-177-\tu32 multi_rmw_idx;\n" }
31/3	2026/09/06 12:48	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 4615 output: 48 thoughts: 52 Thoughts: Okay, let's dive into this. I need to refresh my memory on some `ath9k` nuances, specifically around the HTC driver initialization. My focus is on understanding the register manipulation routines, specifically `ath9k_reg_rmw_buffer` and `ath9k_reg_rmw_flush`. I suspect they play a key role in how the driver handles register reads, modifications, and write-backs, likely during hardware setup and initialization. I should find these within `drivers/net/wireless/ath/ath9k/htc_drv_init.c`. Understanding their purpose is crucial to ensuring proper hardware configuration and preventing potential register corruption which, in turn, is key to overall performance and stability. Let's see what those functions are doing.
32/3	2026/09/06 12:48	tool	read-file	0m Args: { "File": "drivers/net/wireless/ath/ath9k/htc_drv_init.c", "FirstLine": 380, "LineCount": 70 } Results: { "Contents": " 380:\t\tmutex_unlock(\u0026priv-\u003ewmi-\u003emulti_write_mutex);\n 381:\t}\n 382:\t\n 383:\tstatic void ath9k_reg_rmw_buffer(void hw_priv,\n 384:\t\t\t\t\t u32 reg_offset, u32 set, u32 clr)\n 385:\t{\n 386:\t\tstruct ath_hw ah = hw_priv;\n 387:\t\tstruct ath_common common = ath9k_hw_common(ah);\n 388:\t\tstruct ath9k_htc_priv priv = common-\u003epriv;\n 389:\t\tu32 rsp_status;\n 390:\t\tint r;\n 391:\t\n 392:\t\tmutex_lock(\u0026priv-\u003ewmi-\u003emulti_rmw_mutex);\n 393:\t\n 394:\t\t/* Store the register/value /\n 395:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].reg =\n 396:\t\t\tcpu_to_be32(reg_offset);\n 397:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].set =\n 398:\t\t\tcpu_to_be32(set);\n 399:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].clr =\n 400:\t\t\tcpu_to_be32(clr);\n 401:\t\n 402:\t\tpriv-\u003ewmi-\u003emulti_rmw_idx++;\n 403:\t\n 404:\t\t/ If the buffer is full, send it out. /\n 405:\t\tif (priv-\u003ewmi-\u003emulti_rmw_idx == MAX_RMW_CMD_NUMBER) {\n 406:\t\t\tr = ath9k_wmi_cmd(priv-\u003ewmi, WMI_REG_RMW_CMDID,\n 407:\t\t\t\t (u8 ) \u0026priv-\u003ewmi-\u003emulti_rmw,\n 408:\t\t\t\t sizeof(struct register_rmw) * priv-\u003ewmi-\u003emulti_rmw_idx,\n 409:\t\t\t\t (u8 ) \u0026rsp_status, sizeof(rsp_status),\n 410:\t\t\t\t 100);\n 411:\t\t\tif (unlikely(r)) {\n 412:\t\t\t\tath_dbg(common, WMI,\n 413:\t\t\t\t\t\"REGISTER RMW FAILED, multi len: %d\\n\",\n 414:\t\t\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx);\n 415:\t\t\t}\n 416:\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx = 0;\n 417:\t\t}\n 418:\t\n 419:\t\tmutex_unlock(\u0026priv-\u003ewmi-\u003emulti_rmw_mutex);\n 420:\t}\n 421:\t\n 422:\tstatic void ath9k_reg_rmw_flush(void hw_priv)\n 423:\t{\n 424:\t\tstruct ath_hw ah = hw_priv;\n 425:\t\tstruct ath_common common = ath9k_hw_common(ah);\n 426:\t\tstruct ath9k_htc_priv priv = common-\u003epriv;\n 427:\t\tu32 rsp_status;\n 428:\t\tint r;\n 429:\t\n 430:\t\tif (test_bit(HTC_FWFLAG_NO_RMW, \u0026priv-\u003efw_flags))\n 431:\t\t\treturn;\n 432:\t\n 433:\t\tatomic_dec(\u0026priv-\u003ewmi-\u003em_rmw_cnt);\n 434:\t\n 435:\t\tmutex_lock(\u0026priv-\u003ewmi-\u003emulti_rmw_mutex);\n 436:\t\n 437:\t\tif (priv-\u003ewmi-\u003emulti_rmw_idx) {\n 438:\t\t\tr = ath9k_wmi_cmd(priv-\u003ewmi, WMI_REG_RMW_CMDID,\n 439:\t\t\t\t (u8 ) \u0026priv-\u003ewmi-\u003emulti_rmw,\n 440:\t\t\t\t sizeof(struct register_rmw) * priv-\u003ewmi-\u003emulti_rmw_idx,\n 441:\t\t\t\t (u8 *) \u0026rsp_status, sizeof(rsp_status),\n 442:\t\t\t\t 100);\n 443:\t\t\tif (unlikely(r)) {\n 444:\t\t\t\tath_dbg(common, WMI,\n 445:\t\t\t\t\t\"REGISTER RMW FAILED, multi len: %d\\n\",\n 446:\t\t\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx);\n 447:\t\t\t}\n 448:\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx = 0;\n 449:\t\t}\n" }
33/3	2026/09/06 12:48	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 6120 output: 45 thoughts: 374 Thoughts: Analyzing the ath9k Register Write/Modify Problem Okay, let's break this down. In `ath9k_reg_rmw_buffer`, before this patch, we were passing `sizeof(struct register_write) * priv->wmi->multi_rmw_idx`. A `struct register_write` is 8 bytes – just `reg` and `val`. But, the corresponding `ath9k_reg_rmw_flush` was already using the correct size, `sizeof(struct register_rmw) * priv->wmi->multi_rmw_idx`, which is 12 bytes because it includes `reg`, `set`, and `clr`. So, in the buffer allocation, we were calculating the buffer size incorrectly: 8 bytes times some index, when we needed 12 bytes times the index. For example, if `multi_rmw_idx` is 15, we were allocating 120 bytes instead of 180. Now, wait a minute... why the change in `MAX_RMW_CMD_NUMBER` from 15 to 14? Fifteen register commands would result in 15 * 12 bytes = 180 bytes. Add the HTC/WMI headers and it should be 192 bytes, which is exactly three times the typical 64-byte USB packet size. With 14 commands, we would have 168 bytes, and maybe a partial packet? USB bulk and interrupt transfers that are exact multiples of the `maxpacket` size (without a ZLP - Zero Length Packet) can potentially hang, and the data might never be delivered if the firmware expects a shorter packet. And I'm recalling that `hif_usb_send_regout` actually warns if `skb->len % maxpacket == 0`. We need to investigate `hif_usb.c` around `hif_usb_send_regout` to confirm this.
34/3	2026/09/06 12:48	tool	read-file	0m Args: { "File": "drivers/net/wireless/ath/ath9k/hif_usb.c", "FirstLine": 95, "LineCount": 45 } Results: { "Contents": " 95:\t\tkfree_skb(cmd-\u003eskb);\n 96:\t\tkfree(cmd);\n 97:\t}\n 98:\t\n 99:\tstatic int hif_usb_send_regout(struct hif_device_usb hif_dev,\n 100:\t\t\t\t struct sk_buff skb)\n 101:\t{\n 102:\t\tu16 maxpacket = usb_maxpacket(hif_dev-\u003eudev,\n 103:\t\t\t\t\t usb_sndintpipe(hif_dev-\u003eudev,\n 104:\t\t\t\t\t\t\t USB_REG_OUT_PIPE));\n 105:\t\tstruct urb urb;\n 106:\t\tstruct cmd_buf cmd;\n 107:\t\tint ret = 0;\n 108:\t\n 109:\t\tif (WARN_ONCE(maxpacket \u0026\u0026 skb-\u003elen % maxpacket == 0,\n 110:\t\t\t \"%u-byte command fills whole USB packets\\n\", skb-\u003elen))\n 111:\t\t\treturn -EINVAL;\n 112:\t\n 113:\t\turb = usb_alloc_urb(0, GFP_KERNEL);\n 114:\t\tif (urb == NULL)\n 115:\t\t\treturn -ENOMEM;\n 116:\t\n 117:\t\tcmd = kzalloc_obj(*cmd);\n 118:\t\tif (cmd == NULL) {\n 119:\t\t\tusb_free_urb(urb);\n 120:\t\t\treturn -ENOMEM;\n 121:\t\t}\n 122:\t\n 123:\t\tcmd-\u003eskb = skb;\n 124:\t\tcmd-\u003ehif_dev = hif_dev;\n 125:\t\n 126:\t\tusb_fill_int_urb(urb, hif_dev-\u003eudev,\n 127:\t\t\t\t usb_sndintpipe(hif_dev-\u003eudev, USB_REG_OUT_PIPE),\n 128:\t\t\t\t skb-\u003edata, skb-\u003elen,\n 129:\t\t\t\t hif_usb_regout_cb, cmd, 1);\n 130:\t\n 131:\t\tusb_anchor_urb(urb, \u0026hif_dev-\u003eregout_submitted);\n 132:\t\tret = usb_submit_urb(urb, GFP_KERNEL);\n 133:\t\tif (ret) {\n 134:\t\t\tusb_unanchor_urb(urb);\n 135:\t\t\tkfree(cmd);\n 136:\t\t}\n 137:\t\tusb_free_urb(urb);\n 138:\t\n 139:\t\treturn ret;\n" }
35/3	2026/09/06 12:48	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 7657 output: 302 thoughts: 817 Thoughts: KMSAN Assessment: No Need Here Okay, let's break down this patch and see if we need to bring in KMSAN. First, the core of the changes: 1. `ath9k_reg_rmw_buffer` Fix: This is the most crucial part. It looks like we were accidentally sending a truncated structure size (`sizeof(struct register_write)`) to `ath9k_wmi_cmd()` instead of the correct size (`sizeof(struct register_rmw)`) for the `multi_rmw` array. The code populates the `multi_rmw` array (of `struct register_rmw` elements), specifically filling the `reg`, `set`, and `clr` fields for each entry. The correction now ensures that we send the complete, initialized data. Before, we were effectively truncating data to 8 bytes, but sending the data size as though it were 12 bytes. 2. `MAX_RMW_CMD_NUMBER` Adjustment: Reducing this constant from 15 to 14 seems to be a USB-specific optimization. It's done to prevent USB packet length from being a multiple of 64 bytes, preventing endpoint hang. This primarily affects the size of the array, `multi_rmw`. 3. `hif_usb_send_regout` Check: This adds a simple length check, returning `-EINVAL` if `skb->len` (the initialized length of the skb) is a multiple of `maxpacket`. Now, does any of this scream "KMSAN risk"? Let's go through the checklist: * Structure Exposure to Userspace: No. This is internal communication between the driver and the USB hardware/firmware. No data is being leaked to userspace. * Uninitialized Variable Dependence: Nope. `maxpacket` is the result of `usb_maxpacket()`, and `skb->len` comes from the `skb`'s initialized length. These are checked and well-defined. * Complex Data Structure Mishandling: No. The `multi_rmw` array is allocated and meticulously populated. All fields within the array elements are initialized before being sent. * Bounds Check Problems: The size correction in `ath9k_reg_rmw_buffer` fixes a potential issue, ensuring we're sending the correct size of the fully initialized data in `multi_rmw`. We weren't reading uninitialized memory, we were truncating the size sent. Therefore, given the nature of the changes, particularly that they are within internal driver operations and the structures are properly initialized, I don't see any risk of uninitialized memory reads or leaks that KMSAN would specifically catch. Standard detectors should be adequate here. So, let's set `NeedsKMSAN=false` with the reasoning that the patch fixes a size discrepancy to pass fully initialized structs, and alters sizes safely.
36/3	2026/09/06 12:48	tool	set-results	0m Args: { "KMSANReasoning": "The patch addresses a USB communication issue in the ath9k driver where USB packets that are exact multiples of endpoint maxpacket size cause firmware delivery stalls. The changes consist of:\n1. Adding a check in `hif_usb_send_regout()` to warn and reject skbs whose length is an exact multiple of the endpoint maxpacket size.\n2. Correcting the buffer size calculation in `ath9k_reg_rmw_buffer()` from `sizeof(struct register_write)` (8 bytes) to `sizeof(struct register_rmw)` (12 bytes).\n3. Lowering `MAX_RMW_CMD_NUMBER` from 15 to 14 in `wmi.h` to avoid 64-byte aligned USB payloads.\n\nRegarding memory initialization:\n- All fields (`reg`, `set`, `clr`) of the `struct register_rmw` array elements in `priv-\u003ewmi-\u003emulti_rmw` are explicitly initialized before being sent via `ath9k_wmi_cmd()`.\n- No user-space copy paths or uninitialized kernel structure fields are exposed or modified.\n- No branch conditions rely on uninitialized values.\n\nTherefore, this patch introduces no uninitialized memory risks, and a dedicated KMSAN fuzzing session is not required.", "NeedsKMSAN": false } Results: { "KMSANReasoning": "The patch addresses a USB communication issue in the ath9k driver where USB packets that are exact multiples of endpoint maxpacket size cause firmware delivery stalls. The changes consist of:\n1. Adding a check in `hif_usb_send_regout()` to warn and reject skbs whose length is an exact multiple of the endpoint maxpacket size.\n2. Correcting the buffer size calculation in `ath9k_reg_rmw_buffer()` from `sizeof(struct register_write)` (8 bytes) to `sizeof(struct register_rmw)` (12 bytes).\n3. Lowering `MAX_RMW_CMD_NUMBER` from 15 to 14 in `wmi.h` to avoid 64-byte aligned USB payloads.\n\nRegarding memory initialization:\n- All fields (`reg`, `set`, `clr`) of the `struct register_rmw` array elements in `priv-\u003ewmi-\u003emulti_rmw` are explicitly initialized before being sent via `ath9k_wmi_cmd()`.\n- No user-space copy paths or uninitialized kernel structure fields are exposed or modified.\n- No branch conditions rely on uninitialized values.\n\nTherefore, this patch introduces no uninitialized memory risks, and a dedicated KMSAN fuzzing session is not required.", "NeedsKMSAN": false }

{
  "EnableConfigs": [
    "ATH9K_HTC",
    "USB",
    "MAC80211",
    "WLAN_VENDOR_ATH"
  ],
  "FocusSymbols": [
    "hif_usb_send_regout",
    "ath9k_reg_rmw_buffer",
    "ath9k_reg_rmw_flush",
    "ath9k_reg_rmw",
    "hif_usb_send"
  ],
  "KMSANReasoning": "The patch addresses a USB communication issue in the ath9k driver where USB packets that are exact multiples of endpoint maxpacket size cause firmware delivery stalls. The changes consist of:\n1. Adding a check in `hif_usb_send_regout()` to warn and reject skbs whose length is an exact multiple of the endpoint maxpacket size.\n2. Correcting the buffer size calculation in `ath9k_reg_rmw_buffer()` from `sizeof(struct register_write)` (8 bytes) to `sizeof(struct register_rmw)` (12 bytes).\n3. Lowering `MAX_RMW_CMD_NUMBER` from 15 to 14 in `wmi.h` to avoid 64-byte aligned USB payloads.\n\nRegarding memory initialization:\n- All fields (`reg`, `set`, `clr`) of the `struct register_rmw` array elements in `priv-\u003ewmi-\u003emulti_rmw` are explicitly initialized before being sent via `ath9k_wmi_cmd()`.\n- No user-space copy paths or uninitialized kernel structure fields are exposed or modified.\n- No branch conditions rely on uninitialized values.\n\nTherefore, this patch introduces no uninitialized memory risks, and a dedicated KMSAN fuzzing session is not required.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies the USB wireless driver ath9k_htc, which is reachable via USB gadget/device emulation in syzkaller. The changes add a new WARN_ONCE runtime assertion and check in hif_usb_send_regout to prevent sending packets whose length is an exact multiple of the USB maxpacket size, correct the element size calculation in ath9k_reg_rmw_buffer from sizeof(struct register_write) to sizeof(struct register_rmw), and reduce MAX_RMW_CMD_NUMBER. Fuzzing is warranted to test the new assertion and altered RMW command batching logic.",
  "WorthFuzzing": true
}

{
  "PatchDiff": "commit 4a872e85917d67040075191978246f39b0b95e47\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Sep 6 12:47:33 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c\nindex d3491ff08e6ef..49303c7e3fef4 100644\n--- a/drivers/net/wireless/ath/ath9k/hif_usb.c\n+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c\n@@ -99,10 +99,17 @@ static void hif_usb_regout_cb(struct urb *urb)\n static int hif_usb_send_regout(struct hif_device_usb *hif_dev,\n \t\t\t       struct sk_buff *skb)\n {\n+\tu16 maxpacket = usb_maxpacket(hif_dev-\u003eudev,\n+\t\t\t\t      usb_sndintpipe(hif_dev-\u003eudev,\n+\t\t\t\t\t\t     USB_REG_OUT_PIPE));\n \tstruct urb *urb;\n \tstruct cmd_buf *cmd;\n \tint ret = 0;\n \n+\tif (WARN_ONCE(maxpacket \u0026\u0026 skb-\u003elen % maxpacket == 0,\n+\t\t      \"%u-byte command fills whole USB packets\\n\", skb-\u003elen))\n+\t\treturn -EINVAL;\n+\n \turb = usb_alloc_urb(0, GFP_KERNEL);\n \tif (urb == NULL)\n \t\treturn -ENOMEM;\ndiff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c\nindex 6de78ae857268..0b49d2cc99f0b 100644\n--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c\n+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c\n@@ -405,7 +405,7 @@ static void ath9k_reg_rmw_buffer(void *hw_priv,\n \tif (priv-\u003ewmi-\u003emulti_rmw_idx == MAX_RMW_CMD_NUMBER) {\n \t\tr = ath9k_wmi_cmd(priv-\u003ewmi, WMI_REG_RMW_CMDID,\n \t\t\t  (u8 *) \u0026priv-\u003ewmi-\u003emulti_rmw,\n-\t\t\t  sizeof(struct register_write) * priv-\u003ewmi-\u003emulti_rmw_idx,\n+\t\t\t  sizeof(struct register_rmw) * priv-\u003ewmi-\u003emulti_rmw_idx,\n \t\t\t  (u8 *) \u0026rsp_status, sizeof(rsp_status),\n \t\t\t  100);\n \t\tif (unlikely(r)) {\ndiff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h\nindex 5c3b710b8f319..256f46098a6b1 100644\n--- a/drivers/net/wireless/ath/ath9k/wmi.h\n+++ b/drivers/net/wireless/ath/ath9k/wmi.h\n@@ -126,7 +126,8 @@ enum wmi_event_id {\n };\n \n #define MAX_CMD_NUMBER 62\n-#define MAX_RMW_CMD_NUMBER 15\n+/* 15 entries make 192 bytes, three full USB packets: never delivered. */\n+#define MAX_RMW_CMD_NUMBER 14\n \n struct register_write {\n \t__be32 reg;\n"
}

{
  "EnableConfigs": [
    "ATH9K_HTC",
    "USB",
    "MAC80211",
    "WLAN_VENDOR_ATH"
  ],
  "FocusSymbols": [
    "hif_usb_send_regout",
    "ath9k_reg_rmw_buffer",
    "ath9k_reg_rmw_flush",
    "ath9k_reg_rmw",
    "hif_usb_send"
  ],
  "Reasoning": "The patch modifies the USB wireless driver ath9k_htc, which is reachable via USB gadget/device emulation in syzkaller. The changes add a new WARN_ONCE runtime assertion and check in hif_usb_send_regout to prevent sending packets whose length is an exact multiple of the USB maxpacket size, correct the element size calculation in ath9k_reg_rmw_buffer from sizeof(struct register_write) to sizeof(struct register_rmw), and reduce MAX_RMW_CMD_NUMBER. Fuzzing is warranted to test the new assertion and altered RMW command batching logic.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 4a872e85917d67040075191978246f39b0b95e47
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Sep 6 12:47:33 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index d3491ff08e6ef..49303c7e3fef4 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -99,10 +99,17 @@ static void hif_usb_regout_cb(struct urb *urb)
 static int hif_usb_send_regout(struct hif_device_usb *hif_dev,
 			       struct sk_buff *skb)
 {
+	u16 maxpacket = usb_maxpacket(hif_dev->udev,
+				      usb_sndintpipe(hif_dev->udev,
+						     USB_REG_OUT_PIPE));
 	struct urb *urb;
 	struct cmd_buf *cmd;
 	int ret = 0;
 
+	if (WARN_ONCE(maxpacket && skb->len % maxpacket == 0,
+		      "%u-byte command fills whole USB packets\n", skb->len))
+		return -EINVAL;
+
 	urb = usb_alloc_urb(0, GFP_KERNEL);
 	if (urb == NULL)
 		return -ENOMEM;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 6de78ae857268..0b49d2cc99f0b 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -405,7 +405,7 @@ static void ath9k_reg_rmw_buffer(void *hw_priv,
 	if (priv->wmi->multi_rmw_idx == MAX_RMW_CMD_NUMBER) {
 		r = ath9k_wmi_cmd(priv->wmi, WMI_REG_RMW_CMDID,
 			  (u8 *) &priv->wmi->multi_rmw,
-			  sizeof(struct register_write) * priv->wmi->multi_rmw_idx,
+			  sizeof(struct register_rmw) * priv->wmi->multi_rmw_idx,
 			  (u8 *) &rsp_status, sizeof(rsp_status),
 			  100);
 		if (unlikely(r)) {
diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h
index 5c3b710b8f319..256f46098a6b1 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.h
+++ b/drivers/net/wireless/ath/ath9k/wmi.h
@@ -126,7 +126,8 @@ enum wmi_event_id {
 };
 
 #define MAX_CMD_NUMBER 62
-#define MAX_RMW_CMD_NUMBER 15
+/* 15 entries make 192 bytes, three full USB packets: never delivered. */
+#define MAX_RMW_CMD_NUMBER 14
 
 struct register_write {
 	__be32 reg;

							input: 3577
							output: 37
							thoughts: 335

**Analyzing this Patch for USB Vulnerabilities**

Okay, let's break this down. First, I need to understand what this patch is actually doing. It looks like we have changes across three files in the `ath9k` wireless driver: `hif_usb.c`, `htc_drv_init.c`, and `wmi.h`. Specifically:

*   In `hif_usb.c`, it seems we're adding a check within `hif_usb_send_regout` related to USB packet size. We calculate `maxpacket` using `usb_maxpacket()` and then add a `WARN_ONCE` call to return `-EINVAL` if the skb's length is a multiple of `maxpacket`. This is interesting; I need to understand why they're adding this. Is there a potential buffer overrun condition they're trying to prevent with the integer division's modulus of zero? Perhaps an off-by-one or data integrity issue?

*   Next, in `htc_drv_init.c`, the patch modifies a size calculation within `ath9k_reg_rmw_buffer`. It seems we're switching from `struct register_write` to `struct register_rmw`. This suggests a potential change in the underlying data structure being used for register read-modify-write operations, which I need to investigate further. It also appears the `priv->wmi->multi_rmw_idx` value will also need checking with that change.

*   Finally, in `wmi.h`, `MAX_RMW_CMD_NUMBER` is being changed from 15 to 14. This suggests a change in the maximum number of register read-modify-write commands that can be issued. This seems related to the changes in `htc_drv_init.c`.

Now, the crucial question: can we reach this `ath9k_htc` driver through USB emulation? Yes, based on my understanding and quick check, `ath9k_htc` is indeed a USB wireless network driver. I'm going to quickly check the Kconfig to confirm its dependencies. If we can reach it, then this patch becomes significantly more interesting from a security perspective. It is good to know it is reachable and, thus, potentially vulnerable. I'll need to focus on how these changes might impact fuzzing or exploit development.

{
  "Expression": "ATH9K_HTC",
  "PathPrefix": "drivers/net/wireless/ath/ath9k/"
}

{
  "Output": "drivers/net/wireless/ath/ath9k/Kconfig=13=config ATH9K_BTCOEX_SUPPORT\ndrivers/net/wireless/ath/ath9k/Kconfig-14-\tbool \"Atheros bluetooth coexistence support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:15:\tdepends on (ATH9K || ATH9K_HTC)\ndrivers/net/wireless/ath/ath9k/Kconfig-16-\tdefault y\n--\ndrivers/net/wireless/ath/ath9k/Kconfig=156=config ATH9K_PCI_NO_EEPROM\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-171-\ndrivers/net/wireless/ath/ath9k/Kconfig:172:config ATH9K_HTC\ndrivers/net/wireless/ath/ath9k/Kconfig-173-\ttristate \"Atheros HTC based wireless cards support\"\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-186-\ndrivers/net/wireless/ath/ath9k/Kconfig:187:config ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-188-\tbool \"Atheros ath9k_htc debugging\"\ndrivers/net/wireless/ath/ath9k/Kconfig:189:\tdepends on ATH9K_HTC \u0026\u0026 DEBUG_FS\ndrivers/net/wireless/ath/ath9k/Kconfig-190-\tselect ATH9K_COMMON_DEBUG\n--\ndrivers/net/wireless/ath/ath9k/Kconfig=206=config ATH9K_COMMON_SPECTRAL\ndrivers/net/wireless/ath/ath9k/Kconfig-207-\tbool \"Atheros ath9k/ath9k_htc spectral scan support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:208:\tdepends on ATH9K_DEBUGFS || ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-209-\tselect RELAY\n--\ndrivers/net/wireless/ath/ath9k/Makefile=68=ath9k_htc-y +=\thtc_hst.o \\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-76-\ndrivers/net/wireless/ath/ath9k/Makefile:77:ath9k_htc-$(CONFIG_ATH9K_HTC_DEBUGFS) += htc_drv_debug.o\ndrivers/net/wireless/ath/ath9k/Makefile-78-\ndrivers/net/wireless/ath/ath9k/Makefile:79:obj-$(CONFIG_ATH9K_HTC) += ath9k_htc.o\ndrivers/net/wireless/ath/ath9k/Makefile-80-\n--\ndrivers/net/wireless/ath/ath9k/ar9003_eeprom.c=3390=static bool ath9k_hw_ar9300_fill_eeprom(struct ath_hw *ah)\n--\ndrivers/net/wireless/ath/ath9k/ar9003_eeprom.c-3400-\ndrivers/net/wireless/ath/ath9k/ar9003_eeprom.c:3401:#if defined(CONFIG_ATH9K_DEBUGFS) || defined(CONFIG_ATH9K_HTC_DEBUGFS)\ndrivers/net/wireless/ath/ath9k/ar9003_eeprom.c-3402-static u32 ar9003_dump_modal_eeprom(char *buf, u32 len, u32 size,\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c=239=static inline void ath9k_skb_queue_complete(struct hif_device_usb *hif_dev,\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-245-\twhile ((skb = __skb_dequeue(queue)) != NULL) {\ndrivers/net/wireless/ath/ath9k/hif_usb.c:246:#ifdef CONFIG_ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/hif_usb.c-247-\t\tint ln = skb-\u003elen;\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c=383=static int hif_usb_send_tx(struct hif_device_usb *hif_dev, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-406-\t/* Mgmt/Beacon frames don't use the TX buffer pool */\ndrivers/net/wireless/ath/ath9k/hif_usb.c:407:\tif ((tx_ctl-\u003etype == ATH9K_HTC_MGMT) ||\ndrivers/net/wireless/ath/ath9k/hif_usb.c:408:\t    (tx_ctl-\u003etype == ATH9K_HTC_BEACON)) {\ndrivers/net/wireless/ath/ath9k/hif_usb.c-409-\t\tret = hif_usb_send_mgmt(hif_dev, skb);\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-413-\ndrivers/net/wireless/ath/ath9k/hif_usb.c:414:\tif ((tx_ctl-\u003etype == ATH9K_HTC_NORMAL) ||\ndrivers/net/wireless/ath/ath9k/hif_usb.c:415:\t    (tx_ctl-\u003etype == ATH9K_HTC_AMPDU)) {\ndrivers/net/wireless/ath/ath9k/hif_usb.c-416-\t\t__skb_queue_tail(\u0026hif_dev-\u003etx.tx_skb_queue, skb);\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c=494=static inline bool check_index(struct sk_buff *skb, u8 idx)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-499-\ndrivers/net/wireless/ath/ath9k/hif_usb.c:500:\tif ((tx_ctl-\u003etype == ATH9K_HTC_AMPDU) \u0026\u0026\ndrivers/net/wireless/ath/ath9k/hif_usb.c-501-\t    (tx_ctl-\u003esta_idx == idx))\n--\ndrivers/net/wireless/ath/ath9k/htc.h=56=enum htc_opmode {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-64-\ndrivers/net/wireless/ath/ath9k/htc.h:65:#define ATH9K_HTC_AMPDU  1\ndrivers/net/wireless/ath/ath9k/htc.h:66:#define ATH9K_HTC_NORMAL 2\ndrivers/net/wireless/ath/ath9k/htc.h:67:#define ATH9K_HTC_BEACON 3\ndrivers/net/wireless/ath/ath9k/htc.h:68:#define ATH9K_HTC_MGMT   4\ndrivers/net/wireless/ath/ath9k/htc.h-69-\ndrivers/net/wireless/ath/ath9k/htc.h:70:#define ATH9K_HTC_TX_CTSONLY      0x1\ndrivers/net/wireless/ath/ath9k/htc.h:71:#define ATH9K_HTC_TX_RTSCTS       0x2\ndrivers/net/wireless/ath/ath9k/htc.h-72-\ndrivers/net/wireless/ath/ath9k/htc.h=73=struct tx_frame_hdr {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-77-\tu8 tidno;\ndrivers/net/wireless/ath/ath9k/htc.h:78:\t__be32 flags; /* ATH9K_HTC_TX_* */\ndrivers/net/wireless/ath/ath9k/htc.h-79-\tu8 key_type;\n--\ndrivers/net/wireless/ath/ath9k/htc.h=194=struct ath9k_htc_target_rx_stats {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-199-\ndrivers/net/wireless/ath/ath9k/htc.h:200:#define ATH9K_HTC_MAX_VIF 2\ndrivers/net/wireless/ath/ath9k/htc.h:201:#define ATH9K_HTC_MAX_BCN_VIF 2\ndrivers/net/wireless/ath/ath9k/htc.h-202-\n--\ndrivers/net/wireless/ath/ath9k/htc.h=249=struct ath9k_vif_iter_data {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-253-\ndrivers/net/wireless/ath/ath9k/htc.h:254:#define ATH9K_HTC_MAX_STA 8\ndrivers/net/wireless/ath/ath9k/htc.h:255:#define ATH9K_HTC_MAX_TID 8\ndrivers/net/wireless/ath/ath9k/htc.h-256-\n--\ndrivers/net/wireless/ath/ath9k/htc.h=264=struct ath9k_htc_sta {\ndrivers/net/wireless/ath/ath9k/htc.h-265-\tu8 index;\ndrivers/net/wireless/ath/ath9k/htc.h:266:\tenum tid_aggr_state tid_state[ATH9K_HTC_MAX_TID];\ndrivers/net/wireless/ath/ath9k/htc.h-267-\tstruct work_struct rc_update_work;\n--\ndrivers/net/wireless/ath/ath9k/htc.h-270-\ndrivers/net/wireless/ath/ath9k/htc.h:271:#define ATH9K_HTC_RXBUF 256\ndrivers/net/wireless/ath/ath9k/htc.h-272-#define HTC_RX_FRAME_HEADER_SIZE 40\n--\ndrivers/net/wireless/ath/ath9k/htc.h=281=struct ath9k_htc_rx {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-286-\ndrivers/net/wireless/ath/ath9k/htc.h:287:#define ATH9K_HTC_TX_CLEANUP_INTERVAL 50 /* ms */\ndrivers/net/wireless/ath/ath9k/htc.h:288:#define ATH9K_HTC_TX_TIMEOUT_INTERVAL 3000 /* ms */\ndrivers/net/wireless/ath/ath9k/htc.h:289:#define ATH9K_HTC_TX_RESERVE 10\ndrivers/net/wireless/ath/ath9k/htc.h:290:#define ATH9K_HTC_TX_TIMEOUT_COUNT 40\ndrivers/net/wireless/ath/ath9k/htc.h:291:#define ATH9K_HTC_TX_THRESHOLD (MAX_TX_BUF_NUM - ATH9K_HTC_TX_RESERVE)\ndrivers/net/wireless/ath/ath9k/htc.h-292-\ndrivers/net/wireless/ath/ath9k/htc.h:293:#define ATH9K_HTC_OP_TX_QUEUES_STOP BIT(0)\ndrivers/net/wireless/ath/ath9k/htc.h:294:#define ATH9K_HTC_OP_TX_DRAIN       BIT(1)\ndrivers/net/wireless/ath/ath9k/htc.h-295-\n--\ndrivers/net/wireless/ath/ath9k/htc.h=311=struct ath9k_htc_tx_ctl {\ndrivers/net/wireless/ath/ath9k/htc.h:312:\tu8 type; /* ATH9K_HTC_* */\ndrivers/net/wireless/ath/ath9k/htc.h-313-\tu8 epid;\n--\ndrivers/net/wireless/ath/ath9k/htc.h=319=static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath9k/htc.h-327-\ndrivers/net/wireless/ath/ath9k/htc.h:328:#ifdef CONFIG_ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/htc.h-329-#define __STAT_SAFE(hif_dev, expr)\tdo { ((hif_dev)-\u003ehtc_handle-\u003edrv_priv ? (expr) : 0); } while (0)\n--\ndrivers/net/wireless/ath/ath9k/htc.h=388=static inline void ath9k_htc_err_stat_rx(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc.h-392-\ndrivers/net/wireless/ath/ath9k/htc.h:393:#endif /* CONFIG_ATH9K_HTC_DEBUGFS */\ndrivers/net/wireless/ath/ath9k/htc.h-394-\n--\ndrivers/net/wireless/ath/ath9k/htc.h=409=struct htc_beacon {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-415-\ndrivers/net/wireless/ath/ath9k/htc.h:416:\tstruct ieee80211_vif *bslot[ATH9K_HTC_MAX_BCN_VIF];\ndrivers/net/wireless/ath/ath9k/htc.h-417-\tu32 bmisscnt;\n--\ndrivers/net/wireless/ath/ath9k/htc.h=456=struct ath9k_htc_priv {\n--\ndrivers/net/wireless/ath/ath9k/htc.h-478-\tu8 sta_slot;\ndrivers/net/wireless/ath/ath9k/htc.h:479:\tu8 vif_sta_pos[ATH9K_HTC_MAX_VIF];\ndrivers/net/wireless/ath/ath9k/htc.h-480-\tu8 num_ibss_vif;\n--\ndrivers/net/wireless/ath/ath9k/htc.h-535-\tstruct delayed_work duty_cycle_work;\ndrivers/net/wireless/ath/ath9k/htc.h:536:#ifdef CONFIG_ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/htc.h-537-\tstruct ath9k_debug debug;\n--\ndrivers/net/wireless/ath/ath9k/htc.h=641=int ath9k_htc_resume(struct htc_target *htc_handle);\ndrivers/net/wireless/ath/ath9k/htc.h-642-#endif\ndrivers/net/wireless/ath/ath9k/htc.h:643:#ifdef CONFIG_ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/htc.h-644-int ath9k_htc_init_debug(struct ath_hw *ah);\n--\ndrivers/net/wireless/ath/ath9k/htc.h=648=static inline void ath9k_htc_deinit_debug(struct ath9k_htc_priv *priv)\n--\ndrivers/net/wireless/ath/ath9k/htc.h-650-}\ndrivers/net/wireless/ath/ath9k/htc.h:651:#endif /* CONFIG_ATH9K_HTC_DEBUGFS */\ndrivers/net/wireless/ath/ath9k/htc.h-652-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c=111=static void ath9k_htc_beacon_config_ap(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-116-\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:117:\tath9k_cmn_beacon_config_ap(ah, conf, ATH9K_HTC_MAX_BCN_VIF);\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-118-\tath9k_htc_beacon_init(priv, conf, false);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c=191=static void ath9k_htc_send_beacon(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-242-\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:243:\ttx_ctl-\u003etype = ATH9K_HTC_BEACON;\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-244-\ttx_ctl-\u003eepid = priv-\u003ebeacon_ep;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c=264=static int ath9k_htc_choose_bslot(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-276-\ttsftu = TSF_TO_TU(tsf \u003e\u003e 32, tsf);\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:277:\tslot = ((tsftu % intval) * ATH9K_HTC_MAX_BCN_VIF) / intval;\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:278:\tslot = ATH9K_HTC_MAX_BCN_VIF - slot - 1;\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-279-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c=325=void ath9k_htc_assign_bslot(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-332-\tspin_lock_bh(\u0026priv-\u003ebeacon_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:333:\tfor (i = 0; i \u003c ATH9K_HTC_MAX_BCN_VIF; i++) {\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-334-\t\tif (priv-\u003ebeacon.bslot[i] == NULL) {\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c=365=void ath9k_htc_set_tsfadjust(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-380-\t */\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c:381:\ttsfadjust = cur_conf-\u003ebeacon_interval * avp-\u003ebslot / ATH9K_HTC_MAX_BCN_VIF;\ndrivers/net/wireless/ath/ath9k/htc_drv_beacon.c-382-\tavp-\u003etsfadjust = cpu_to_le64(TU_TO_USEC(tsfadjust));\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c=398=static const char ath9k_htc_gstrings_stats[][ETH_GSTRING_LEN] = {\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-418-};\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c:419:#define ATH9K_HTC_SSTATS_LEN ARRAY_SIZE(ath9k_htc_gstrings_stats)\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-420-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c=430=int ath9k_htc_get_et_sset_count(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-433-\tif (sset == ETH_SS_STATS)\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c:434:\t\treturn ATH9K_HTC_SSTATS_LEN;\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-435-\treturn 0;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c=448=void ath9k_htc_get_et_stats(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-473-\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c:474:\tWARN_ON(i != ATH9K_HTC_SSTATS_LEN);\ndrivers/net/wireless/ath/ath9k/htc_drv_debug.c-475-}\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c=606=static int ath9k_init_priv(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-673-\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:674:\tfor (i = 0; i \u003c ATH9K_HTC_MAX_BCN_VIF; i++)\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-675-\t\tpriv-\u003ebeacon.bslot[i] = NULL;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=184=void ath9k_htc_reset(struct ath9k_htc_priv *priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-233-\tmod_timer(\u0026priv-\u003etx.cleanup_timer,\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:234:\t\t  jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-235-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=240=static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-311-\tmod_timer(\u0026priv-\u003etx.cleanup_timer,\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:312:\t\t  jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-313-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=350=static int ath9k_htc_add_monitor_interface(struct ath9k_htc_priv *priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-357-\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:358:\tif ((priv-\u003envifs \u003e= ATH9K_HTC_MAX_VIF) ||\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:359:\t    (priv-\u003enstations \u003e= ATH9K_HTC_MAX_STA)) {\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-360-\t\tret = -ENOBUFS;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-364-\tsta_idx = ffz(priv-\u003esta_slot);\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:365:\tif ((sta_idx \u003c 0) || (sta_idx \u003e ATH9K_HTC_MAX_STA)) {\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-366-\t\tret = -ENOBUFS;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=466=static int ath9k_htc_add_station(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-477-\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:478:\tif (priv-\u003enstations \u003e= ATH9K_HTC_MAX_STA)\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-479-\t\treturn -ENOBUFS;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-481-\tsta_idx = ffz(priv-\u003esta_slot);\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:482:\tif ((sta_idx \u003c 0) || (sta_idx \u003e ATH9K_HTC_MAX_STA))\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-483-\t\treturn -ENOBUFS;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=702=static int ath9k_htc_tx_aggr_oper(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-713-\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:714:\tif (tid \u003e= ATH9K_HTC_MAX_TID)\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-715-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=907=static int ath9k_htc_start(struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-960-\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:961:\tpriv-\u003etx.flags \u0026= ~ATH9K_HTC_OP_TX_QUEUES_STOP;\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-962-\tspin_unlock_bh(\u0026priv-\u003etx.tx_lock);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-966-\tmod_timer(\u0026priv-\u003etx.cleanup_timer,\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:967:\t\t  jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-968-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=1658=static int ath9k_htc_ampdu_action(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-1688-\tcase IEEE80211_AMPDU_TX_OPERATIONAL:\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:1689:\t\tif (tid \u003e= ATH9K_HTC_MAX_TID) {\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-1690-\t\t\tret = -EINVAL;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c=1874=struct ieee80211_ops ath9k_htc_ops = {\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-1906-\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c:1907:#ifdef CONFIG_ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/htc_drv_main.c-1908-\t.get_et_sset_count  = ath9k_htc_get_et_sset_count,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=23=static const int subtype_txq_to_hwq[] = {\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-29-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:30:#define ATH9K_HTC_INIT_TXQ(subtype) do {\t\t\t\\\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-31-\t\tqi.tqi_subtype = subtype_txq_to_hwq[subtype];\t\\\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=56=void ath9k_htc_check_stop_queues(struct ath9k_htc_priv *priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-59-\tpriv-\u003etx.queued_cnt++;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:60:\tif ((priv-\u003etx.queued_cnt \u003e= ATH9K_HTC_TX_THRESHOLD) \u0026\u0026\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:61:\t    !(priv-\u003etx.flags \u0026 ATH9K_HTC_OP_TX_QUEUES_STOP)) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:62:\t\tpriv-\u003etx.flags |= ATH9K_HTC_OP_TX_QUEUES_STOP;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-63-\t\tieee80211_stop_queues(priv-\u003ehw);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=68=void ath9k_htc_check_wake_queues(struct ath9k_htc_priv *priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-70-\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:71:\tif ((priv-\u003etx.queued_cnt \u003c ATH9K_HTC_TX_THRESHOLD) \u0026\u0026\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:72:\t    (priv-\u003etx.flags \u0026 ATH9K_HTC_OP_TX_QUEUES_STOP)) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:73:\t\tpriv-\u003etx.flags \u0026= ~ATH9K_HTC_OP_TX_QUEUES_STOP;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-74-\t\tieee80211_wake_queues(priv-\u003ehw);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=214=static void ath9k_htc_tx_mgmt(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-240-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:241:\ttx_ctl-\u003etype = ATH9K_HTC_MGMT;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-242-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=260=static void ath9k_htc_tx_data(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-292-\tif (tx_info-\u003eflags \u0026 IEEE80211_TX_CTL_AMPDU) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:293:\t\ttx_ctl-\u003etype = ATH9K_HTC_AMPDU;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:294:\t\ttx_hdr.data_type = ATH9K_HTC_AMPDU;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-295-\t} else {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:296:\t\ttx_ctl-\u003etype = ATH9K_HTC_NORMAL;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:297:\t\ttx_hdr.data_type = ATH9K_HTC_NORMAL;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-298-\t}\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-312-\t\tif (skb-\u003elen \u003e priv-\u003ehw-\u003ewiphy-\u003erts_threshold)\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:313:\t\t\tflags |= ATH9K_HTC_TX_RTSCTS;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-314-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-315-\t/* CTS-to-self */\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:316:\tif (!(flags \u0026 ATH9K_HTC_TX_RTSCTS) \u0026\u0026\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-317-\t    (vif \u0026\u0026 vif-\u003ebss_conf.use_cts_prot))\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:318:\t\tflags |= ATH9K_HTC_TX_CTSONLY;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-319-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=392=static inline bool __ath9k_htc_check_tx_aggr(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-397-\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:398:\tif ((tid \u003c ATH9K_HTC_MAX_TID) \u0026\u0026 (ista-\u003etid_state[tid] == AGGR_STOP))\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-399-\t\tret = true;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=445=static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-478-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:479:\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_ACK) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-480-\t\ttx_info-\u003eflags |= IEEE80211_TX_STAT_ACK;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-484-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:485:\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_FILT)\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-486-\t\ttx_info-\u003eflags |= IEEE80211_TX_STAT_TX_FILTERED;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-487-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:488:\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_RTC_CTS)\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-489-\t\trate-\u003eflags |= IEEE80211_TX_RC_USE_RTS_CTS;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-491-\trate-\u003ecount = 1;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:492:\trate-\u003eidx = MS(txs-\u003ets_rate, ATH9K_HTC_TXSTAT_RATE);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-493-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:494:\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_MCS) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-495-\t\trate-\u003eflags |= IEEE80211_TX_RC_MCS;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-496-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:497:\t\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_CW40)\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-498-\t\t\trate-\u003eflags |= IEEE80211_TX_RC_40_MHZ_WIDTH;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:499:\t\tif (txs-\u003ets_flags \u0026 ATH9K_HTC_TXSTAT_SGI)\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-500-\t\t\trate-\u003eflags |= IEEE80211_TX_RC_SHORT_GI;\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=539=void ath9k_htc_tx_drain(struct ath9k_htc_priv *priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-543-\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:544:\tpriv-\u003etx.flags |= ATH9K_HTC_OP_TX_DRAIN;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-545-\tspin_unlock_bh(\u0026priv-\u003etx.tx_lock);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-573-\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:574:\tpriv-\u003etx.flags \u0026= ~ATH9K_HTC_OP_TX_DRAIN;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-575-\tspin_unlock_bh(\u0026priv-\u003etx.tx_lock);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=578=void ath9k_tx_failed_tasklet(struct tasklet_struct *t)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-582-\tspin_lock(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:583:\tif (priv-\u003etx.flags \u0026 ATH9K_HTC_OP_TX_DRAIN) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-584-\t\tspin_unlock(\u0026priv-\u003etx.tx_lock);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=618=static struct sk_buff* ath9k_htc_tx_get_packet(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-624-\tunsigned long flags;\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:625:\tu8 epid = MS(txs-\u003ets_rate, ATH9K_HTC_TXSTAT_EPID);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-626-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=716=static inline bool check_packet(struct ath9k_htc_priv *priv, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-724-\t\t       tx_ctl-\u003etimestamp +\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:725:\t\t       msecs_to_jiffies(ATH9K_HTC_TX_TIMEOUT_INTERVAL))) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-726-\t\tath_dbg(common, XMIT, \"Dropping a packet due to TX timeout\\n\");\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=761=void ath9k_htc_tx_cleanup_timer(struct timer_list *t)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-776-\t\t\t\tevent-\u003etxs.cookie,\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:777:\t\t\t\tMS(event-\u003etxs.ts_rate, ATH9K_HTC_TXSTAT_EPID));\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-778-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-784-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:785:\t\tif (++event-\u003ecount \u003e= ATH9K_HTC_TX_TIMEOUT_COUNT) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-786-\t\t\tlist_del(\u0026event-\u003elist);\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-805-\tmod_timer(\u0026priv-\u003etx.cleanup_timer,\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:806:\t\t  jiffies + msecs_to_jiffies(ATH9K_HTC_TX_CLEANUP_INTERVAL));\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-807-}\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=827=bool ath9k_htc_txq_setup(struct ath9k_htc_priv *priv, int subtype)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-834-\tmemset(\u0026qi, 0, sizeof(qi));\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:835:\tATH9K_HTC_INIT_TXQ(subtype);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-836-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=852=int ath9k_htc_cabq_setup(struct ath9k_htc_priv *priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-856-\tmemset(\u0026qi, 0, sizeof(qi));\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:857:\tATH9K_HTC_INIT_TXQ(0);\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-858-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c=1187=int ath9k_rx_init(struct ath9k_htc_priv *priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-1193-\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c:1194:\tfor (i = 0; i \u003c ATH9K_HTC_RXBUF; i++) {\ndrivers/net/wireless/ath/ath9k/htc_drv_txrx.c-1195-\t\tstruct ath9k_htc_rxbuf *rxbuf =\n--\ndrivers/net/wireless/ath/ath9k/wmi.c=138=void ath9k_wmi_event_tasklet(struct tasklet_struct *t)\n--\ndrivers/net/wireless/ath/ath9k/wmi.c-178-\t\t\tspin_lock_bh(\u0026priv-\u003etx.tx_lock);\ndrivers/net/wireless/ath/ath9k/wmi.c:179:\t\t\tif (priv-\u003etx.flags \u0026 ATH9K_HTC_OP_TX_DRAIN) {\ndrivers/net/wireless/ath/ath9k/wmi.c-180-\t\t\t\tspin_unlock_bh(\u0026priv-\u003etx.tx_lock);\n--\ndrivers/net/wireless/ath/ath9k/wmi.h=39=struct wmi_event_swba {\n--\ndrivers/net/wireless/ath/ath9k/wmi.h-50-\ndrivers/net/wireless/ath/ath9k/wmi.h:51:#define ATH9K_HTC_TXSTAT_ACK        BIT(0)\ndrivers/net/wireless/ath/ath9k/wmi.h:52:#define ATH9K_HTC_TXSTAT_FILT       BIT(1)\ndrivers/net/wireless/ath/ath9k/wmi.h:53:#define ATH9K_HTC_TXSTAT_RTC_CTS    BIT(2)\ndrivers/net/wireless/ath/ath9k/wmi.h:54:#define ATH9K_HTC_TXSTAT_MCS        BIT(3)\ndrivers/net/wireless/ath/ath9k/wmi.h:55:#define ATH9K_HTC_TXSTAT_CW40       BIT(4)\ndrivers/net/wireless/ath/ath9k/wmi.h:56:#define ATH9K_HTC_TXSTAT_SGI        BIT(5)\ndrivers/net/wireless/ath/ath9k/wmi.h-57-\n--\ndrivers/net/wireless/ath/ath9k/wmi.h-63- */\ndrivers/net/wireless/ath/ath9k/wmi.h:64:#define ATH9K_HTC_TXSTAT_RATE       0x0f\ndrivers/net/wireless/ath/ath9k/wmi.h:65:#define ATH9K_HTC_TXSTAT_RATE_S     0\ndrivers/net/wireless/ath/ath9k/wmi.h-66-\ndrivers/net/wireless/ath/ath9k/wmi.h:67:#define ATH9K_HTC_TXSTAT_EPID       0xf0\ndrivers/net/wireless/ath/ath9k/wmi.h:68:#define ATH9K_HTC_TXSTAT_EPID_S     4\ndrivers/net/wireless/ath/ath9k/wmi.h-69-\n"
}

							input: 16915
							output: 42
							thoughts: 32

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Checking ATH9K_HTC Dependencies**

Right, let's dive straight in. I need to pinpoint the *exact* dependencies for `ATH9K_HTC`. I know it's a critical module, so I can't afford any assumptions here. The most reliable place to get the definitive answer on dependencies, particularly for a driver like this, is always the `Kconfig` file in its directory. That'll be `drivers/net/wireless/ath/ath9k/Kconfig`. No need to guess or rely on outdated documentation; the Kconfig is the source of truth for the build system. Let's see what it's tied to.

{
  "File": "drivers/net/wireless/ath/ath9k/Kconfig",
  "FirstLine": 170,
  "LineCount": 40
}

{
  "Contents": " 170:\t\t  If unsure say N.\n 171:\t\n 172:\tconfig ATH9K_HTC\n 173:\t\ttristate \"Atheros HTC based wireless cards support\"\n 174:\t\tdepends on USB \u0026\u0026 MAC80211\n 175:\t\tselect MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211\n 176:\t\tselect ATH9K_HW\n 177:\t\tselect ATH9K_COMMON\n 178:\t\thelp\n 179:\t\t  Support for Atheros HTC based cards.\n 180:\t\t  Chipsets supported: AR9271\n 181:\t\n 182:\t\t  For more information:\n 183:\t\t  https://wireless.wiki.kernel.org/en/users/Drivers/ath9k_htc\n 184:\t\n 185:\t\t  The built module will be ath9k_htc.\n 186:\t\n 187:\tconfig ATH9K_HTC_DEBUGFS\n 188:\t\tbool \"Atheros ath9k_htc debugging\"\n 189:\t\tdepends on ATH9K_HTC \u0026\u0026 DEBUG_FS\n 190:\t\tselect ATH9K_COMMON_DEBUG\n 191:\t\thelp\n 192:\t\t  Say Y, if you need access to ath9k_htc's statistics.\n 193:\t\t  As well as access to the FFT/spectral data.\n 194:\t\n 195:\tconfig ATH9K_HWRNG\n 196:\t\tbool \"Random number generator support\"\n 197:\t\tdepends on ATH9K \u0026\u0026 (HW_RANDOM = y || HW_RANDOM = ATH9K)\n 198:\t\tdefault n\n 199:\t\thelp\n 200:\t\t  This option incorporates the ADC register output as a source of\n 201:\t\t  randomness into Linux entropy pool (/dev/urandom and /dev/random)\n 202:\t\n 203:\t\t  Say Y, feeds the entropy directly from the WiFi driver to the input\n 204:\t\t  pool.\n 205:\t\n 206:\tconfig ATH9K_COMMON_SPECTRAL\n 207:\t\tbool \"Atheros ath9k/ath9k_htc spectral scan support\"\n 208:\t\tdepends on ATH9K_DEBUGFS || ATH9K_HTC_DEBUGFS\n 209:\t\tselect RELAY\n"
}

							input: 17788
							output: 45
							thoughts: 55

Okay, let's dive into this. I need to understand the connection between these two functions and how they're being utilized in the code. I'll start by examining `hif_usb.c` and `htc_drv_init.c`. My primary focus is on how `hif_usb_send_regout` and `ath9k_reg_rmw_buffer` are used. I want to trace the call paths to these functions to understand the contexts in which they operate and how the system eventually reaches their execution. Understanding these interconnections will likely give me insights into how the register output is being handled and how it relates to the broader system initialization within the HTC driver.

{
  "File": "drivers/net/wireless/ath/ath9k/hif_usb.c",
  "FirstLine": 95,
  "LineCount": 50
}

{
  "Contents": "  95:\t\tkfree_skb(cmd-\u003eskb);\n  96:\t\tkfree(cmd);\n  97:\t}\n  98:\t\n  99:\tstatic int hif_usb_send_regout(struct hif_device_usb *hif_dev,\n 100:\t\t\t\t       struct sk_buff *skb)\n 101:\t{\n 102:\t\tu16 maxpacket = usb_maxpacket(hif_dev-\u003eudev,\n 103:\t\t\t\t\t      usb_sndintpipe(hif_dev-\u003eudev,\n 104:\t\t\t\t\t\t\t     USB_REG_OUT_PIPE));\n 105:\t\tstruct urb *urb;\n 106:\t\tstruct cmd_buf *cmd;\n 107:\t\tint ret = 0;\n 108:\t\n 109:\t\tif (WARN_ONCE(maxpacket \u0026\u0026 skb-\u003elen % maxpacket == 0,\n 110:\t\t\t      \"%u-byte command fills whole USB packets\\n\", skb-\u003elen))\n 111:\t\t\treturn -EINVAL;\n 112:\t\n 113:\t\turb = usb_alloc_urb(0, GFP_KERNEL);\n 114:\t\tif (urb == NULL)\n 115:\t\t\treturn -ENOMEM;\n 116:\t\n 117:\t\tcmd = kzalloc_obj(*cmd);\n 118:\t\tif (cmd == NULL) {\n 119:\t\t\tusb_free_urb(urb);\n 120:\t\t\treturn -ENOMEM;\n 121:\t\t}\n 122:\t\n 123:\t\tcmd-\u003eskb = skb;\n 124:\t\tcmd-\u003ehif_dev = hif_dev;\n 125:\t\n 126:\t\tusb_fill_int_urb(urb, hif_dev-\u003eudev,\n 127:\t\t\t\t usb_sndintpipe(hif_dev-\u003eudev, USB_REG_OUT_PIPE),\n 128:\t\t\t\t skb-\u003edata, skb-\u003elen,\n 129:\t\t\t\t hif_usb_regout_cb, cmd, 1);\n 130:\t\n 131:\t\tusb_anchor_urb(urb, \u0026hif_dev-\u003eregout_submitted);\n 132:\t\tret = usb_submit_urb(urb, GFP_KERNEL);\n 133:\t\tif (ret) {\n 134:\t\t\tusb_unanchor_urb(urb);\n 135:\t\t\tkfree(cmd);\n 136:\t\t}\n 137:\t\tusb_free_urb(urb);\n 138:\t\n 139:\t\treturn ret;\n 140:\t}\n 141:\t\n 142:\tstatic void hif_usb_mgmt_cb(struct urb *urb)\n 143:\t{\n 144:\t\tstruct cmd_buf *cmd = urb-\u003econtext;\n"
}

							input: 18781
							output: 41
							thoughts: 17

Okay, here's my summary, taking on the persona you requested:

**Tracing the Calls to hif_usb_send_regout**

Alright, let's dive in. I need to understand the flow here, so I'm going to start by tracing the calls to `hif_usb_send_regout`. I'm thinking I'll need to use some tooling, probably static analysis initially, to get a clear picture of the call graph. I'm hoping it's straightforward; a complex chain of indirect function calls is the last thing I need right now. I should be able to identify the key modules or subsystems that are initiating these register output operations. Knowing the context of those calls will be critical for figuring out the intent behind each of them. Then, based on the calls themselves, I'll be able to quickly see if there's any obvious redundancy or unexpected behavior. I'll need to pay close attention to the arguments being passed to this function, too. Are they consistent across callers? Are there any patterns or discrepancies that jump out? This is a crucial area to explore, since the arguments will reveal *what* is being sent out, and likely *why*. I'll need to think about the data structures being passed, potentially checking the definitions of those structs and enums. Once I understand the callers and the parameters, I should be in a solid position to analyze the impact of this function, its potential bottlenecks, and any areas ripe for optimization or improvement. This is my starting point, and I expect to adjust my approach as I go, but this seems like a solid plan.

{
  "Expression": "hif_usb_send_regout",
  "PathPrefix": "drivers/net/wireless/ath/ath9k/"
}

{
  "Output": "drivers/net/wireless/ath/ath9k/hif_usb.c=71=static void hif_usb_regout_cb(struct urb *urb)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-98-\ndrivers/net/wireless/ath/ath9k/hif_usb.c:99:static int hif_usb_send_regout(struct hif_device_usb *hif_dev,\ndrivers/net/wireless/ath/ath9k/hif_usb.c-100-\t\t\t       struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c=472=static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-481-\tcase USB_REG_OUT_PIPE:\ndrivers/net/wireless/ath/ath9k/hif_usb.c:482:\t\tret = hif_usb_send_regout(hif_dev, skb);\ndrivers/net/wireless/ath/ath9k/hif_usb.c-483-\t\tbreak;\n"
}

							input: 19499
							output: 48
							thoughts: 21

Here's a summary of my immediate thought process:

**Diving into the Driver Initialization**

Okay, time to dig in. I need to get a handle on what's happening with this HTC driver. Let's start with `htc_drv_init.c` – that's usually a good place to begin, especially with initialization. Specifically, I'm going to jump to around line 405. That section is often where critical initial setup or resource allocation takes place. I'm expecting to find the key function calls, data structure assignments, or perhaps some early hardware probing that will shed light on what the driver is up to. Let's see what secrets that particular section holds.

{
  "File": "drivers/net/wireless/ath/ath9k/htc_drv_init.c",
  "FirstLine": 395,
  "LineCount": 45
}

{
  "Contents": " 395:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].reg =\n 396:\t\t\tcpu_to_be32(reg_offset);\n 397:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].set =\n 398:\t\t\tcpu_to_be32(set);\n 399:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].clr =\n 400:\t\t\tcpu_to_be32(clr);\n 401:\t\n 402:\t\tpriv-\u003ewmi-\u003emulti_rmw_idx++;\n 403:\t\n 404:\t\t/* If the buffer is full, send it out. */\n 405:\t\tif (priv-\u003ewmi-\u003emulti_rmw_idx == MAX_RMW_CMD_NUMBER) {\n 406:\t\t\tr = ath9k_wmi_cmd(priv-\u003ewmi, WMI_REG_RMW_CMDID,\n 407:\t\t\t\t  (u8 *) \u0026priv-\u003ewmi-\u003emulti_rmw,\n 408:\t\t\t\t  sizeof(struct register_rmw) * priv-\u003ewmi-\u003emulti_rmw_idx,\n 409:\t\t\t\t  (u8 *) \u0026rsp_status, sizeof(rsp_status),\n 410:\t\t\t\t  100);\n 411:\t\t\tif (unlikely(r)) {\n 412:\t\t\t\tath_dbg(common, WMI,\n 413:\t\t\t\t\t\"REGISTER RMW FAILED, multi len: %d\\n\",\n 414:\t\t\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx);\n 415:\t\t\t}\n 416:\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx = 0;\n 417:\t\t}\n 418:\t\n 419:\t\tmutex_unlock(\u0026priv-\u003ewmi-\u003emulti_rmw_mutex);\n 420:\t}\n 421:\t\n 422:\tstatic void ath9k_reg_rmw_flush(void *hw_priv)\n 423:\t{\n 424:\t\tstruct ath_hw *ah = hw_priv;\n 425:\t\tstruct ath_common *common = ath9k_hw_common(ah);\n 426:\t\tstruct ath9k_htc_priv *priv = common-\u003epriv;\n 427:\t\tu32 rsp_status;\n 428:\t\tint r;\n 429:\t\n 430:\t\tif (test_bit(HTC_FWFLAG_NO_RMW, \u0026priv-\u003efw_flags))\n 431:\t\t\treturn;\n 432:\t\n 433:\t\tatomic_dec(\u0026priv-\u003ewmi-\u003em_rmw_cnt);\n 434:\t\n 435:\t\tmutex_lock(\u0026priv-\u003ewmi-\u003emulti_rmw_mutex);\n 436:\t\n 437:\t\tif (priv-\u003ewmi-\u003emulti_rmw_idx) {\n 438:\t\t\tr = ath9k_wmi_cmd(priv-\u003ewmi, WMI_REG_RMW_CMDID,\n 439:\t\t\t\t  (u8 *) \u0026priv-\u003ewmi-\u003emulti_rmw,\n"
}

							input: 20550
							output: 40
							thoughts: 810

**My Analysis of the ath9k_htc Patch for Fuzzing**

Okay, let's break this down. First, I'm seeing a potential buffer overflow vulnerability fixed in `ath9k_reg_rmw_buffer`. The original code was calculating the buffer size incorrectly, using the size of a `struct register_write` (8 bytes) instead of a `struct register_rmw` (12 bytes) when dealing with multiple read-modify-write commands (`multi_rmw_idx`). Specifically, when `multi_rmw_idx` hit `MAX_RMW_CMD_NUMBER` (which was 15), it sent 120 bytes instead of the expected 180 bytes. That's a clear error.

I'm also seeing a comment about why 15 entries didn't work. The comment mentions 192 bytes and full USB packets not being delivered. 15 entries * 12 bytes = 180, plus header, that would fit, so the comment looks like it may have an error.

The fix in `hif_usb_send_regout` adds a `WARN_ONCE` assertion, which is good. This is a defensive measure. It's warning if the command fills a whole USB packet. This is returning `-EINVAL`. This is great.

Now, the important question: is this fuzzable? Absolutely. `ath9k_htc` is a USB wireless driver, and USB devices are easily attached in QEMU/virtualized environments using USB Raw Gadget or syzkaller's USB emulation. This is definitely reachable. Section 1 and 3 of the fuzzing guidance confirms this. Modified assertions are exactly what we want to target. It's a prime target for fuzzing.

My next step is identifying the relevant functions for focus:
-   `hif_usb_send_regout` – the newly asserted function.
-   `ath9k_reg_rmw_buffer` – the buffer size calculation fixed.
-   `ath9k_reg_rmw_flush` – a function calling `ath9k_wmi_cmd` with `multi_rmw`.
-   `hif_usb_send` – an entrypoint in hif\_usb
-   `ath9k_wmi_cmd` – as it is used with `multi_rmw`

I need to confirm these function names and their definitions within `drivers/net/wireless/ath/ath9k/`. I can then build test cases to exercise the relevant code paths and trigger that `WARN_ONCE` assertion. This looks like a solid fuzzing target.

{
  "Expression": "ath9k_reg_rmw",
  "PathPrefix": "drivers/net/wireless/ath/ath9k/"
}

{
  "Output": "drivers/net/wireless/ath/ath9k/htc_drv_init.c=367=static void ath9k_regwrite_flush(void *hw_priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-382-\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:383:static void ath9k_reg_rmw_buffer(void *hw_priv,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-384-\t\t\t\t u32 reg_offset, u32 set, u32 clr)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-421-\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:422:static void ath9k_reg_rmw_flush(void *hw_priv)\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-423-{\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c=454=static void ath9k_enable_rmw_buffer(void *hw_priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-465-\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:466:static void ath9k_reg_rmw_single(void *hw_priv,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-467-\t\t\t\t u32 reg_offset, u32 set, u32 clr)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-488-\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:489:static u32 ath9k_reg_rmw(void *hw_priv, u32 reg_offset, u32 set, u32 clr)\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-490-{\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-506-\tif (atomic_read(\u0026priv-\u003ewmi-\u003em_rmw_cnt))\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:507:\t\tath9k_reg_rmw_buffer(hw_priv, reg_offset, set, clr);\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-508-\telse\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:509:\t\tath9k_reg_rmw_single(hw_priv, reg_offset, set, clr);\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-510-\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c=606=static int ath9k_init_priv(struct ath9k_htc_priv *priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-628-\tah-\u003ereg_ops.enable_rmw_buffer = ath9k_enable_rmw_buffer;\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:629:\tah-\u003ereg_ops.rmw_flush = ath9k_reg_rmw_flush;\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:630:\tah-\u003ereg_ops.rmw = ath9k_reg_rmw;\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-631-\tpriv-\u003eah = ah;\n--\ndrivers/net/wireless/ath/ath9k/init.c=204=static void ath9k_multi_ioread32(void *hw_priv, u32 *addr,\n--\ndrivers/net/wireless/ath/ath9k/init.c-213-\ndrivers/net/wireless/ath/ath9k/init.c:214:static unsigned int __ath9k_reg_rmw(struct ath_softc *sc, u32 reg_offset,\ndrivers/net/wireless/ath/ath9k/init.c-215-\t\t\t\t    u32 set, u32 clr)\n--\ndrivers/net/wireless/ath/ath9k/init.c-226-\ndrivers/net/wireless/ath/ath9k/init.c:227:static unsigned int ath9k_reg_rmw(void *hw_priv, u32 reg_offset, u32 set, u32 clr)\ndrivers/net/wireless/ath/ath9k/init.c-228-{\n--\ndrivers/net/wireless/ath/ath9k/init.c-236-\t\tspin_lock_irqsave(\u0026sc-\u003esc_serial_rw, flags);\ndrivers/net/wireless/ath/ath9k/init.c:237:\t\tval = __ath9k_reg_rmw(sc, reg_offset, set, clr);\ndrivers/net/wireless/ath/ath9k/init.c-238-\t\tspin_unlock_irqrestore(\u0026sc-\u003esc_serial_rw, flags);\ndrivers/net/wireless/ath/ath9k/init.c-239-\t} else\ndrivers/net/wireless/ath/ath9k/init.c:240:\t\tval = __ath9k_reg_rmw(sc, reg_offset, set, clr);\ndrivers/net/wireless/ath/ath9k/init.c-241-\n--\ndrivers/net/wireless/ath/ath9k/init.c=656=static int ath9k_init_softc(u16 devid, struct ath_softc *sc,\n--\ndrivers/net/wireless/ath/ath9k/init.c-676-\tah-\u003ereg_ops.write = ath9k_iowrite32;\ndrivers/net/wireless/ath/ath9k/init.c:677:\tah-\u003ereg_ops.rmw = ath9k_reg_rmw;\ndrivers/net/wireless/ath/ath9k/init.c-678-\tpCap = \u0026ah-\u003ecaps;\n"
}

							input: 23598
							output: 31
							thoughts: 75

**Examining the Atheros Wireless Driver Configuration**

Okay, let's dive into the configuration for this Atheros wireless driver. First, I need to verify what settings are available, starting with the `EnableConfigs`. Specifically, I'm checking the `drivers/net/wireless/ath/ath9k/Kconfig` file. I see that `ATH9K_HTC` is dependent on both `USB` and `MAC80211`, which makes perfect sense given the hardware architecture.

Now, I need to make sure I'm not overlooking any other crucial dependencies or configurations. I'll need to expand the search and review other potential configurations. Let's move on and examine the `drivers/net/wireless/ath/Kconfig` file and explore the contents to ensure I identify any other needed settings. This will give me a comprehensive picture of what's required for this driver to function correctly within the wider system.

{
  "Expression": "ATH9K",
  "PathPrefix": "drivers/net/wireless/ath/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 5076 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/Makefile=2=obj-$(CONFIG_ATH5K)\t\t+= ath5k/\ndrivers/net/wireless/ath/Makefile:3:obj-$(CONFIG_ATH9K_HW)\t\t+= ath9k/\ndrivers/net/wireless/ath/Makefile-4-obj-$(CONFIG_CARL9170)\t\t+= carl9170/\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-1-# SPDX-License-Identifier: ISC\ndrivers/net/wireless/ath/ath9k/Kconfig:2:config ATH9K_HW\ndrivers/net/wireless/ath/ath9k/Kconfig-3-\ttristate\ndrivers/net/wireless/ath/ath9k/Kconfig:4:config ATH9K_COMMON\ndrivers/net/wireless/ath/ath9k/Kconfig-5-\ttristate\ndrivers/net/wireless/ath/ath9k/Kconfig-6-\tselect ATH_COMMON\ndrivers/net/wireless/ath/ath9k/Kconfig:7:config ATH9K_COMMON_DEBUG\ndrivers/net/wireless/ath/ath9k/Kconfig-8-\tbool\ndrivers/net/wireless/ath/ath9k/Kconfig:9:config ATH9K_DFS_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-10-\tdef_bool y\ndrivers/net/wireless/ath/ath9k/Kconfig:11:\tdepends on ATH9K_DEBUGFS \u0026\u0026 ATH9K_DFS_CERTIFIED\ndrivers/net/wireless/ath/ath9k/Kconfig-12-\ndrivers/net/wireless/ath/ath9k/Kconfig:13:config ATH9K_BTCOEX_SUPPORT\ndrivers/net/wireless/ath/ath9k/Kconfig-14-\tbool \"Atheros bluetooth coexistence support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:15:\tdepends on (ATH9K || ATH9K_HTC)\ndrivers/net/wireless/ath/ath9k/Kconfig-16-\tdefault y\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-20-\ndrivers/net/wireless/ath/ath9k/Kconfig:21:config ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig-22-\ttristate \"Atheros 802.11n wireless cards support\"\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-24-\tselect MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211\ndrivers/net/wireless/ath/ath9k/Kconfig:25:\tselect ATH9K_HW\ndrivers/net/wireless/ath/ath9k/Kconfig:26:\tselect ATH9K_COMMON\ndrivers/net/wireless/ath/ath9k/Kconfig-27-\thelp\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-38-\ndrivers/net/wireless/ath/ath9k/Kconfig:39:config ATH9K_PCI\ndrivers/net/wireless/ath/ath9k/Kconfig-40-\tbool \"Atheros ath9k PCI/PCIe bus support\"\ndrivers/net/wireless/ath/ath9k/Kconfig-41-\tdefault y\ndrivers/net/wireless/ath/ath9k/Kconfig:42:\tdepends on ATH9K \u0026\u0026 PCI\ndrivers/net/wireless/ath/ath9k/Kconfig-43-\thelp\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-47-\ndrivers/net/wireless/ath/ath9k/Kconfig:48:config ATH9K_AHB\ndrivers/net/wireless/ath/ath9k/Kconfig-49-\tbool \"Atheros ath9k AHB bus support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:50:\tdepends on ATH9K \u0026\u0026 OF\ndrivers/net/wireless/ath/ath9k/Kconfig-51-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-57-\ndrivers/net/wireless/ath/ath9k/Kconfig:58:config ATH9K_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-59-\tbool \"Atheros ath9k debugging\"\ndrivers/net/wireless/ath/ath9k/Kconfig:60:\tdepends on ATH9K \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig:61:\tselect ATH9K_COMMON_DEBUG\ndrivers/net/wireless/ath/ath9k/Kconfig-62-\thelp\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-68-\ndrivers/net/wireless/ath/ath9k/Kconfig:69:config ATH9K_STATION_STATISTICS\ndrivers/net/wireless/ath/ath9k/Kconfig-70-\tbool \"Detailed station statistics\"\ndrivers/net/wireless/ath/ath9k/Kconfig:71:\tdepends on ATH9K \u0026\u0026 ATH9K_DEBUGFS \u0026\u0026 DEBUG_FS\ndrivers/net/wireless/ath/ath9k/Kconfig-72-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-75-\ndrivers/net/wireless/ath/ath9k/Kconfig:76:config ATH9K_TX99\ndrivers/net/wireless/ath/ath9k/Kconfig-77-\tbool \"Atheros ath9k TX99 testing support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:78:\tdepends on ATH9K_DEBUGFS \u0026\u0026 CFG80211_CERTIFICATION_ONUS\ndrivers/net/wireless/ath/ath9k/Kconfig-79-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-95-\ndrivers/net/wireless/ath/ath9k/Kconfig:96:config ATH9K_DFS_CERTIFIED\ndrivers/net/wireless/ath/ath9k/Kconfig-97-\tbool \"Atheros DFS support for certified platforms\"\ndrivers/net/wireless/ath/ath9k/Kconfig:98:\tdepends on ATH9K \u0026\u0026 CFG80211_CERTIFICATION_ONUS\ndrivers/net/wireless/ath/ath9k/Kconfig-99-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-114-\ndrivers/net/wireless/ath/ath9k/Kconfig:115:config ATH9K_DYNACK\ndrivers/net/wireless/ath/ath9k/Kconfig-116-\tbool \"Atheros ath9k ACK timeout estimation algorithm\"\ndrivers/net/wireless/ath/ath9k/Kconfig:117:\tdepends on ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig-118-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-123-\ndrivers/net/wireless/ath/ath9k/Kconfig:124:config ATH9K_WOW\ndrivers/net/wireless/ath/ath9k/Kconfig-125-\tbool \"Wake on Wireless LAN support (EXPERIMENTAL)\"\ndrivers/net/wireless/ath/ath9k/Kconfig:126:\tdepends on ATH9K \u0026\u0026 PM\ndrivers/net/wireless/ath/ath9k/Kconfig-127-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-131-\ndrivers/net/wireless/ath/ath9k/Kconfig:132:config ATH9K_RFKILL\ndrivers/net/wireless/ath/ath9k/Kconfig-133-\tbool \"Atheros ath9k rfkill support\" if EXPERT\ndrivers/net/wireless/ath/ath9k/Kconfig:134:\tdepends on ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig:135:\tdepends on RFKILL=y || RFKILL=ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig-136-\tdefault y\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-141-\ndrivers/net/wireless/ath/ath9k/Kconfig:142:config ATH9K_CHANNEL_CONTEXT\ndrivers/net/wireless/ath/ath9k/Kconfig-143-\tbool \"Channel Context support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:144:\tdepends on ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig-145-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-150-\ndrivers/net/wireless/ath/ath9k/Kconfig:151:config ATH9K_PCOEM\ndrivers/net/wireless/ath/ath9k/Kconfig-152-\tbool \"Atheros ath9k support for PC OEM cards\" if EXPERT\ndrivers/net/wireless/ath/ath9k/Kconfig:153:\tdepends on ATH9K\ndrivers/net/wireless/ath/ath9k/Kconfig-154-\tdefault y\ndrivers/net/wireless/ath/ath9k/Kconfig-155-\ndrivers/net/wireless/ath/ath9k/Kconfig:156:config ATH9K_PCI_NO_EEPROM\ndrivers/net/wireless/ath/ath9k/Kconfig-157-\ttristate \"Atheros ath9k pci loader for EEPROM-less chips\"\ndrivers/net/wireless/ath/ath9k/Kconfig:158:\tdepends on ATH9K_PCI\ndrivers/net/wireless/ath/ath9k/Kconfig-159-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-171-\ndrivers/net/wireless/ath/ath9k/Kconfig:172:config ATH9K_HTC\ndrivers/net/wireless/ath/ath9k/Kconfig-173-\ttristate \"Atheros HTC based wireless cards support\"\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-175-\tselect MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211\ndrivers/net/wireless/ath/ath9k/Kconfig:176:\tselect ATH9K_HW\ndrivers/net/wireless/ath/ath9k/Kconfig:177:\tselect ATH9K_COMMON\ndrivers/net/wireless/ath/ath9k/Kconfig-178-\thelp\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-186-\ndrivers/net/wireless/ath/ath9k/Kconfig:187:config ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-188-\tbool \"Atheros ath9k_htc debugging\"\ndrivers/net/wireless/ath/ath9k/Kconfig:189:\tdepends on ATH9K_HTC \u0026\u0026 DEBUG_FS\ndrivers/net/wireless/ath/ath9k/Kconfig:190:\tselect ATH9K_COMMON_DEBUG\ndrivers/net/wireless/ath/ath9k/Kconfig-191-\thelp\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-194-\ndrivers/net/wireless/ath/ath9k/Kconfig:195:config ATH9K_HWRNG\ndrivers/net/wireless/ath/ath9k/Kconfig-196-\tbool \"Random number generator support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:197:\tdepends on ATH9K \u0026\u0026 (HW_RANDOM = y || HW_RANDOM = ATH9K)\ndrivers/net/wireless/ath/ath9k/Kconfig-198-\tdefault n\n--\ndrivers/net/wireless/ath/ath9k/Kconfig-205-\ndrivers/net/wireless/ath/ath9k/Kconfig:206:config ATH9K_COMMON_SPECTRAL\ndrivers/net/wireless/ath/ath9k/Kconfig-207-\tbool \"Atheros ath9k/ath9k_htc spectral scan support\"\ndrivers/net/wireless/ath/ath9k/Kconfig:208:\tdepends on ATH9K_DEBUGFS || ATH9K_HTC_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-209-\tselect RELAY\n--\ndrivers/net/wireless/ath/ath9k/Makefile=2=ath9k-y +=\tbeacon.o \\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-11-\ndrivers/net/wireless/ath/ath9k/Makefile:12:ath9k-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += mci.o\ndrivers/net/wireless/ath/ath9k/Makefile:13:ath9k-$(CONFIG_ATH9K_PCI) += pci.o\ndrivers/net/wireless/ath/ath9k/Makefile:14:ath9k-$(CONFIG_ATH9K_AHB) += ahb.o\ndrivers/net/wireless/ath/ath9k/Makefile:15:ath9k-$(CONFIG_ATH9K_DFS_DEBUGFS) += dfs_debug.o\ndrivers/net/wireless/ath/ath9k/Makefile:16:ath9k-$(CONFIG_ATH9K_DFS_CERTIFIED) += dfs.o\ndrivers/net/wireless/ath/ath9k/Makefile:17:ath9k-$(CONFIG_ATH9K_TX99) += tx99.o\ndrivers/net/wireless/ath/ath9k/Makefile:18:ath9k-$(CONFIG_ATH9K_WOW) += wow.o\ndrivers/net/wireless/ath/ath9k/Makefile:19:ath9k-$(CONFIG_ATH9K_HWRNG) += rng.o\ndrivers/net/wireless/ath/ath9k/Makefile-20-\ndrivers/net/wireless/ath/ath9k/Makefile:21:ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o\ndrivers/net/wireless/ath/ath9k/Makefile-22-\ndrivers/net/wireless/ath/ath9k/Makefile:23:ath9k-$(CONFIG_ATH9K_STATION_STATISTICS) += debug_sta.o\ndrivers/net/wireless/ath/ath9k/Makefile-24-\ndrivers/net/wireless/ath/ath9k/Makefile:25:obj-$(CONFIG_ATH9K) += ath9k.o\ndrivers/net/wireless/ath/ath9k/Makefile-26-\ndrivers/net/wireless/ath/ath9k/Makefile=27=ath9k_hw-y:=\t\\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-47-\ndrivers/net/wireless/ath/ath9k/Makefile:48:ath9k_hw-$(CONFIG_ATH9K_WOW) += ar9003_wow.o\ndrivers/net/wireless/ath/ath9k/Makefile-49-\ndrivers/net/wireless/ath/ath9k/Makefile:50:ath9k_hw-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += btcoex.o \\\ndrivers/net/wireless/ath/ath9k/Makefile-51-\t\t\t\t\t   ar9003_mci.o \\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-53-\ndrivers/net/wireless/ath/ath9k/Makefile:54:ath9k_hw-$(CONFIG_ATH9K_PCOEM) += ar9003_rtt.o\ndrivers/net/wireless/ath/ath9k/Makefile-55-\ndrivers/net/wireless/ath/ath9k/Makefile:56:ath9k_hw-$(CONFIG_ATH9K_DYNACK) += dynack.o\ndrivers/net/wireless/ath/ath9k/Makefile-57-\ndrivers/net/wireless/ath/ath9k/Makefile:58:obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o\ndrivers/net/wireless/ath/ath9k/Makefile-59-\ndrivers/net/wireless/ath/ath9k/Makefile:60:obj-$(CONFIG_ATH9K_COMMON) += ath9k_common.o\ndrivers/net/wireless/ath/ath9k/Makefile-61-ath9k_common-y:=\tcommon.o \\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-64-\ndrivers/net/wireless/ath/ath9k/Makefile:65:ath9k_common-$(CONFIG_ATH9K_COMMON_DEBUG) += common-debug.o\ndrivers/net/wireless/ath/ath9k/Makefile:66:ath9k_common-$(CONFIG_ATH9K_COMMON_SPECTRAL) += common-spectral.o\ndrivers/net/wireless/ath/ath9k/Makefile-67-\ndrivers/net/wireless/ath/ath9k/Makefile=68=ath9k_htc-y +=\thtc_hst.o \\\n--\ndrivers/net/wireless/ath/ath9k/Makefile-76-\ndrivers/net/wireless/ath/ath9k/Makefile:77:ath9k_htc-$(CONFIG_ATH9K_HTC_DEBUGFS) += htc_drv_debug.o\ndrivers/net/wireless/ath/ath9k/Makefile-78-\ndrivers/net/wireless/ath/ath9k/Makefile:79:obj-$(CONFIG_ATH9K_HTC) += ath9k_htc.o\ndrivers/net/wireless/ath/ath9k/Makefile-80-\ndrivers/net/wireless/ath/ath9k/Makefile:81:obj-$(CONFIG_ATH9K_PCI_NO_EEPROM) += ath9k_pci_owl_loader.o\n--\ndrivers/net/wireless/ath/ath9k/ani.c=39=static const struct ani_ofdm_level_entry ofdm_level_table[] = {\n--\ndrivers/net/wireless/ath/ath9k/ani.c-51-};\ndrivers/net/wireless/ath/ath9k/ani.c:52:#define ATH9K_ANI_OFDM_NUM_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c-53-\tARRAY_SIZE(ofdm_level_table)\ndrivers/net/wireless/ath/ath9k/ani.c:54:#define ATH9K_ANI_OFDM_MAX_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c:55:\t(ATH9K_ANI_OFDM_NUM_LEVEL-1)\ndrivers/net/wireless/ath/ath9k/ani.c:56:#define ATH9K_ANI_OFDM_DEF_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c-57-\t3 /* default level - matches the INI settings */\n--\ndrivers/net/wireless/ath/ath9k/ani.c=85=static const struct ani_cck_level_entry cck_level_table[] = {\n--\ndrivers/net/wireless/ath/ath9k/ani.c-97-\ndrivers/net/wireless/ath/ath9k/ani.c:98:#define ATH9K_ANI_CCK_NUM_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c-99-\tARRAY_SIZE(cck_level_table)\ndrivers/net/wireless/ath/ath9k/ani.c:100:#define ATH9K_ANI_CCK_MAX_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c:101:\t(ATH9K_ANI_CCK_NUM_LEVEL-1)\ndrivers/net/wireless/ath/ath9k/ani.c:102:#define ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI \\\ndrivers/net/wireless/ath/ath9k/ani.c:103:\t(ATH9K_ANI_CCK_NUM_LEVEL-3)\ndrivers/net/wireless/ath/ath9k/ani.c:104:#define ATH9K_ANI_CCK_DEF_LEVEL \\\ndrivers/net/wireless/ath/ath9k/ani.c-105-\t2 /* default level - matches the INI settings */\n--\ndrivers/net/wireless/ath/ath9k/ani.c=149=static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel,\n--\ndrivers/net/wireless/ath/ath9k/ani.c-160-\t\timmunityLevel, BEACON_RSSI(ah),\ndrivers/net/wireless/ath/ath9k/ani.c:161:\t\tATH9K_ANI_RSSI_THR_LOW,\ndrivers/net/wireless/ath/ath9k/ani.c:162:\t\tATH9K_ANI_RSSI_THR_HIGH);\ndrivers/net/wireless/ath/ath9k/ani.c-163-\ndrivers/net/wireless/ath/ath9k/ani.c:164:\tif (AR_SREV_9100(ah) \u0026\u0026 immunityLevel \u003c ATH9K_ANI_OFDM_DEF_LEVEL)\ndrivers/net/wireless/ath/ath9k/ani.c:165:\t\timmunityLevel = ATH9K_ANI_OFDM_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c-166-\n--\ndrivers/net/wireless/ath/ath9k/ani.c-174-\t\tath9k_hw_ani_control(ah,\ndrivers/net/wireless/ath/ath9k/ani.c:175:\t\t\t\t     ATH9K_ANI_SPUR_IMMUNITY_LEVEL,\ndrivers/net/wireless/ath/ath9k/ani.c-176-\t\t\t\t     entry_ofdm-\u003espur_immunity_level);\n--\ndrivers/net/wireless/ath/ath9k/ani.c-180-\t\tath9k_hw_ani_control(ah,\ndrivers/net/wireless/ath/ath9k/ani.c:181:\t\t\t\t     ATH9K_ANI_FIRSTEP_LEVEL,\ndrivers/net/wireless/ath/ath9k/ani.c-182-\t\t\t\t     entry_ofdm-\u003efir_step_level);\n--\ndrivers/net/wireless/ath/ath9k/ani.c-185-\tif (ah-\u003eopmode == NL80211_IFTYPE_STATION \u0026\u0026\ndrivers/net/wireless/ath/ath9k/ani.c:186:\t    BEACON_RSSI(ah) \u003c= ATH9K_ANI_RSSI_THR_HIGH)\ndrivers/net/wireless/ath/ath9k/ani.c-187-\t\tweak_sig = true;\n--\ndrivers/net/wireless/ath/ath9k/ani.c-202-\tif (aniState-\u003eofdmWeakSigDetect != weak_sig)\ndrivers/net/wireless/ath/ath9k/ani.c:203:\t\tath9k_hw_ani_control(ah, ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION,\ndrivers/net/wireless/ath/ath9k/ani.c-204-\t\t\t\t     weak_sig);\n--\ndrivers/net/wireless/ath/ath9k/ani.c-208-\ndrivers/net/wireless/ath/ath9k/ani.c:209:\tif (aniState-\u003eofdmNoiseImmunityLevel \u003e= ATH9K_ANI_OFDM_DEF_LEVEL) {\ndrivers/net/wireless/ath/ath9k/ani.c:210:\t\tah-\u003econfig.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH;\ndrivers/net/wireless/ath/ath9k/ani.c:211:\t\tah-\u003econfig.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW_ABOVE_INI;\ndrivers/net/wireless/ath/ath9k/ani.c-212-\t} else {\ndrivers/net/wireless/ath/ath9k/ani.c:213:\t\tah-\u003econfig.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH_BELOW_INI;\ndrivers/net/wireless/ath/ath9k/ani.c:214:\t\tah-\u003econfig.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW;\ndrivers/net/wireless/ath/ath9k/ani.c-215-\t}\n--\ndrivers/net/wireless/ath/ath9k/ani.c=218=static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)\n--\ndrivers/net/wireless/ath/ath9k/ani.c-221-\ndrivers/net/wireless/ath/ath9k/ani.c:222:\tif (aniState-\u003eofdmNoiseImmunityLevel \u003c ATH9K_ANI_OFDM_MAX_LEVEL)\ndrivers/net/wireless/ath/ath9k/ani.c-223-\t\tath9k_hw_set_ofdm_nil(ah, aniState-\u003eofdmNoiseImmunityLevel + 1, false);\n--\ndrivers/net/wireless/ath/ath9k/ani.c=229=static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel,\n--\ndrivers/net/wireless/ath/ath9k/ani.c-238-\t\taniState-\u003ecckNoiseImmunityLevel, immunityLevel,\ndrivers/net/wireless/ath/ath9k/ani.c:239:\t\tBEACON_RSSI(ah), ATH9K_ANI_RSSI_THR_LOW,\ndrivers/net/wireless/ath/ath9k/ani.c:240:\t\tATH9K_ANI_RSSI_THR_HIGH);\ndrivers/net/wireless/ath/ath9k/ani.c-241-\ndrivers/net/wireless/ath/ath9k/ani.c:242:\tif (AR_SREV_9100(ah) \u0026\u0026 immunityLevel \u003c ATH9K_ANI_CCK_DEF_LEVEL)\ndrivers/net/wireless/ath/ath9k/ani.c:243:\t\timmunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c-244-\ndrivers/net/wireless/ath/ath9k/ani.c-245-\tif (ah-\u003eopmode == NL80211_IFTYPE_STATION \u0026\u0026\ndrivers/net/wireless/ath/ath9k/ani.c:246:\t    BEACON_RSSI(ah) \u003c= ATH9K_ANI_RSSI_THR_LOW \u0026\u0026\ndrivers/net/wireless/ath/ath9k/ani.c:247:\t    immunityLevel \u003e ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI)\ndrivers/net/wireless/ath/ath9k/ani.c:248:\t\timmunityLevel = ATH9K_ANI_CCK_MAX_LEVEL_LOW_RSSI;\ndrivers/net/wireless/ath/ath9k/ani.c-249-\n--\ndrivers/net/wireless/ath/ath9k/ani.c-258-\t\tath9k_hw_ani_control(ah,\ndrivers/net/wireless/ath/ath9k/ani.c:259:\t\t\t\t     ATH9K_ANI_FIRSTEP_LEVEL,\ndrivers/net/wireless/ath/ath9k/ani.c-260-\t\t\t\t     entry_cck-\u003efir_step_level);\n--\ndrivers/net/wireless/ath/ath9k/ani.c-268-\t\tath9k_hw_ani_control(ah,\ndrivers/net/wireless/ath/ath9k/ani.c:269:\t\t\t\t     ATH9K_ANI_MRC_CCK,\ndrivers/net/wireless/ath/ath9k/ani.c-270-\t\t\t\t     entry_cck-\u003emrc_cck_on);\n--\ndrivers/net/wireless/ath/ath9k/ani.c=273=static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)\n--\ndrivers/net/wireless/ath/ath9k/ani.c-276-\ndrivers/net/wireless/ath/ath9k/ani.c:277:\tif (aniState-\u003ecckNoiseImmunityLevel \u003c ATH9K_ANI_CCK_MAX_LEVEL)\ndrivers/net/wireless/ath/ath9k/ani.c-278-\t\tath9k_hw_set_cck_nil(ah, aniState-\u003ecckNoiseImmunityLevel + 1,\n--\ndrivers/net/wireless/ath/ath9k/ani.c=309=void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)\n--\ndrivers/net/wireless/ath/ath9k/ani.c-321-\ndrivers/net/wireless/ath/ath9k/ani.c:322:\tofdm_nil = max_t(int, ATH9K_ANI_OFDM_DEF_LEVEL,\ndrivers/net/wireless/ath/ath9k/ani.c-323-\t\t\t aniState-\u003eofdmNoiseImmunityLevel);\ndrivers/net/wireless/ath/ath9k/ani.c:324:\tcck_nil = max_t(int, ATH9K_ANI_CCK_DEF_LEVEL,\ndrivers/net/wireless/ath/ath9k/ani.c-325-\t\t\t aniState-\u003ecckNoiseImmunityLevel);\n--\ndrivers/net/wireless/ath/ath9k/ani.c-336-\t\tif (aniState-\u003eofdmNoiseImmunityLevel !=\ndrivers/net/wireless/ath/ath9k/ani.c:337:\t\t    ATH9K_ANI_OFDM_DEF_LEVEL ||\ndrivers/net/wireless/ath/ath9k/ani.c-338-\t\t    aniState-\u003ecckNoiseImmunityLevel !=\ndrivers/net/wireless/ath/ath9k/ani.c:339:\t\t    ATH9K_ANI_CCK_DEF_LEVEL) {\ndrivers/net/wireless/ath/ath9k/ani.c-340-\t\t\tath_dbg(common, ANI,\n--\ndrivers/net/wireless/ath/ath9k/ani.c-347-\ndrivers/net/wireless/ath/ath9k/ani.c:348:\t\t\tofdm_nil = ATH9K_ANI_OFDM_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c:349:\t\t\tcck_nil = ATH9K_ANI_CCK_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c-350-\t\t}\n--\ndrivers/net/wireless/ath/ath9k/ani.c=477=void ath9k_hw_ani_init(struct ath_hw *ah)\n--\ndrivers/net/wireless/ath/ath9k/ani.c-484-\tif (AR_SREV_9300_20_OR_LATER(ah)) {\ndrivers/net/wireless/ath/ath9k/ani.c:485:\t\tah-\u003econfig.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH;\ndrivers/net/wireless/ath/ath9k/ani.c:486:\t\tah-\u003econfig.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW;\ndrivers/net/wireless/ath/ath9k/ani.c:487:\t\tah-\u003econfig.cck_trig_high = ATH9K_ANI_CCK_TRIG_HIGH;\ndrivers/net/wireless/ath/ath9k/ani.c:488:\t\tah-\u003econfig.cck_trig_low = ATH9K_ANI_CCK_TRIG_LOW;\ndrivers/net/wireless/ath/ath9k/ani.c-489-\t} else {\ndrivers/net/wireless/ath/ath9k/ani.c:490:\t\tah-\u003econfig.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH_OLD;\ndrivers/net/wireless/ath/ath9k/ani.c:491:\t\tah-\u003econfig.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW_OLD;\ndrivers/net/wireless/ath/ath9k/ani.c:492:\t\tah-\u003econfig.cck_trig_high = ATH9K_ANI_CCK_TRIG_HIGH_OLD;\ndrivers/net/wireless/ath/ath9k/ani.c:493:\t\tah-\u003econfig.cck_trig_low = ATH9K_ANI_CCK_TRIG_LOW_OLD;\ndrivers/net/wireless/ath/ath9k/ani.c-494-\t}\ndrivers/net/wireless/ath/ath9k/ani.c-495-\ndrivers/net/wireless/ath/ath9k/ani.c:496:\tani-\u003espurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL;\ndrivers/net/wireless/ath/ath9k/ani.c:497:\tani-\u003efirstepLevel = ATH9K_ANI_FIRSTEP_LVL;\ndrivers/net/wireless/ath/ath9k/ani.c-498-\tani-\u003emrcCCK = AR_SREV_9300_20_OR_LATER(ah) ? true : false;\n--\ndrivers/net/wireless/ath/ath9k/ani.c-500-\tani-\u003eofdmWeakSigDetect = true;\ndrivers/net/wireless/ath/ath9k/ani.c:501:\tani-\u003ecckNoiseImmunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c:502:\tani-\u003eofdmNoiseImmunityLevel = ATH9K_ANI_OFDM_DEF_LEVEL;\ndrivers/net/wireless/ath/ath9k/ani.c-503-\n--\ndrivers/net/wireless/ath/ath9k/ani.c-507-\t */\ndrivers/net/wireless/ath/ath9k/ani.c:508:\tah-\u003eaniperiod = ATH9K_ANI_PERIOD;\ndrivers/net/wireless/ath/ath9k/ani.c:509:\tah-\u003econfig.ani_poll_interval = ATH9K_ANI_POLLINTERVAL;\ndrivers/net/wireless/ath/ath9k/ani.c-510-\n--\ndrivers/net/wireless/ath/ath9k/ani.h-22-/* units are errors per second */\ndrivers/net/wireless/ath/ath9k/ani.h:23:#define ATH9K_ANI_OFDM_TRIG_HIGH           3500\ndrivers/net/wireless/ath/ath9k/ani.h:24:#define ATH9K_ANI_OFDM_TRIG_HIGH_BELOW_INI 1000\ndrivers/net/wireless/ath/ath9k/ani.h:25:#define ATH9K_ANI_OFDM_TRIG_HIGH_OLD       500\ndrivers/net/wireless/ath/ath9k/ani.h-26-\ndrivers/net/wireless/ath/ath9k/ani.h:27:#define ATH9K_ANI_OFDM_TRIG_LOW           400\ndrivers/net/wireless/ath/ath9k/ani.h:28:#define ATH9K_ANI_OFDM_TRIG_LOW_ABOVE_INI 900\ndrivers/net/wireless/ath/ath9k/ani.h:29:#define ATH9K_ANI_OFDM_TRIG_LOW_OLD       200\ndrivers/net/wireless/ath/ath9k/ani.h-30-\ndrivers/net/wireless/ath/ath9k/ani.h:31:#define ATH9K_ANI_CCK_TRIG_HIGH           600\ndrivers/net/wireless/ath/ath9k/ani.h:32:#define ATH9K_ANI_CCK_TRIG_HIGH_OLD       200\ndrivers/net/wireless/ath/ath9k/ani.h:33:#define ATH9K_ANI_CCK_TRIG_LOW            300\ndrivers/net/wireless/ath/ath9k/ani.h:34:#define ATH9K_ANI_CCK_TRIG_LOW_OLD        100\ndrivers/net/wireless/ath/ath9k/ani.h-35-\ndrivers/net/wireless/ath/ath9k/ani.h:36:#define ATH9K_ANI_SPUR_IMMUNE_LVL         3\ndrivers/net/wireless/ath/ath9k/ani.h:37:#define ATH9K_ANI_FIRSTEP_LVL             2\ndrivers/net/wireless/ath/ath9k/ani.h-38-\ndrivers/net/wireless/ath/ath9k/ani.h:39:#define ATH9K_ANI_RSSI_THR_HIGH           40\ndrivers/net/wireless/ath/ath9k/ani.h:40:#define ATH9K_ANI_RSSI_THR_LOW            7\ndrivers/net/wireless/ath/ath9k/ani.h-41-\ndrivers/net/wireless/ath/ath9k/ani.h:42:#define ATH9K_ANI_PERIOD                  300\ndrivers/net/wireless/ath/ath9k/ani.h-43-\ndrivers/net/wireless/ath/ath9k/ani.h-44-/* in ms */\ndrivers/net/wireless/ath/ath9k/ani.h:45:#define ATH9K_ANI_POLLINTERVAL            1000\ndrivers/net/wireless/ath/ath9k/ani.h-46-\ndrivers/net/wireless/ath/ath9k/ani.h:47:#define ATH9K_SIG_FIRSTEP_SETTING_MIN     0\ndrivers/net/wireless/ath/ath9k/ani.h:48:#define ATH9K_SIG_FIRSTEP_SETTING_MAX     20\ndrivers/net/wireless/ath/ath9k/ani.h:49:#define ATH9K_SIG_SPUR_IMM_SETTING_MIN    0\ndrivers/net/wireless/ath/ath9k/ani.h:50:#define ATH9K_SIG_SPUR_IMM_SETTING_MAX    22\ndrivers/net/wireless/ath/ath9k/ani.h-51-\n--\ndrivers/net/wireless/ath/ath9k/ani.h=54=enum ath9k_ani_cmd {\ndrivers/net/wireless/ath/ath9k/ani.h:55:\tATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION = 0x1,\ndrivers/net/wireless/ath/ath9k/ani.h:56:\tATH9K_ANI_FIRSTEP_LEVEL = 0x2,\ndrivers/net/wireless/ath/ath9k/ani.h:57:\tATH9K_ANI_SPUR_IMMUNITY_LEVEL = 0x4,\ndrivers/net/wireless/ath/ath9k/ani.h:58:\tATH9K_ANI_MRC_CCK = 0x8,\ndrivers/net/wireless/ath/ath9k/ani.h:59:\tATH9K_ANI_ALL = 0xfff\ndrivers/net/wireless/ath/ath9k/ani.h-60-};\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c=953=static bool ar5008_hw_ani_control_new(struct ath_hw *ah,\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-962-\tswitch (cmd \u0026 ah-\u003eani_function) {\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:963:\tcase ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION:{\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-964-\t\t/*\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1043-\t}\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1044:\tcase ATH9K_ANI_FIRSTEP_LEVEL:{\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1045-\t\tu32 level = param;\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1058-\t\t\t\tlevel,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1059:\t\t\t\tATH9K_ANI_FIRSTEP_LVL,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1060-\t\t\t\tvalue,\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1066-\t\t\t\tlevel,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1067:\t\t\t\tATH9K_ANI_FIRSTEP_LVL,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1068-\t\t\t\tvalue,\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1077-\t}\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1078:\tcase ATH9K_ANI_SPUR_IMMUNITY_LEVEL:{\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1079-\t\tu32 level = param;\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1093-\t\t\t\tlevel,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1094:\t\t\t\tATH9K_ANI_SPUR_IMMUNE_LVL,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1095-\t\t\t\tvalue,\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1101-\t\t\t\tlevel,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1102:\t\t\t\tATH9K_ANI_SPUR_IMMUNE_LVL,\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1103-\t\t\t\tvalue,\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1112-\t}\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1113:\tcase ATH9K_ANI_MRC_CCK:\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1114-\t\t/*\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c=1169=static void ar5008_hw_ani_cache_ini_regs(struct ath_hw *ah)\n--\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1213-\t/* these levels just got reset to defaults by the INI */\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1214:\taniState-\u003espurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL;\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c:1215:\taniState-\u003efirstepLevel = ATH9K_ANI_FIRSTEP_LVL;\ndrivers/net/wireless/ath/ath9k/ar5008_phy.c-1216-\taniState-\u003eofdmWeakSigDetect = true;\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c=32=static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked,\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-66-\t\t\tif (isr2 \u0026 AR_ISR_S2_TIM)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:67:\t\t\t\tmask2 |= ATH9K_INT_TIM;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-68-\t\t\tif (isr2 \u0026 AR_ISR_S2_DTIM)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:69:\t\t\t\tmask2 |= ATH9K_INT_DTIM;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-70-\t\t\tif (isr2 \u0026 AR_ISR_S2_DTIMSYNC)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:71:\t\t\t\tmask2 |= ATH9K_INT_DTIMSYNC;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-72-\t\t\tif (isr2 \u0026 (AR_ISR_S2_CABEND))\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:73:\t\t\t\tmask2 |= ATH9K_INT_CABEND;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-74-\t\t\tif (isr2 \u0026 AR_ISR_S2_GTT)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:75:\t\t\t\tmask2 |= ATH9K_INT_GTT;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-76-\t\t\tif (isr2 \u0026 AR_ISR_S2_CST)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:77:\t\t\t\tmask2 |= ATH9K_INT_CST;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-78-\t\t\tif (isr2 \u0026 AR_ISR_S2_TSFOOR)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:79:\t\t\t\tmask2 |= ATH9K_INT_TSFOOR;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-80-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:81:\t\t\tif (!(pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED)) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-82-\t\t\t\tREG_WRITE(ah, AR_ISR_S2, isr2);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-86-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:87:\t\tif (pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-88-\t\t\tisr = REG_READ(ah, AR_ISR_RAC);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-94-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:95:\t\t*masked = isr \u0026 ATH9K_INT_COMMON;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-96-\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-98-\t\t\t   AR_ISR_RXOK | AR_ISR_RXERR))\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:99:\t\t\t*masked |= ATH9K_INT_RX;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-100-\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-105-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:106:\t\t\t*masked |= ATH9K_INT_TX;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-107-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:108:\t\t\tif (pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-109-\t\t\t\ts0_s = REG_READ(ah, AR_ISR_S0_S);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-139-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:140:\t\tif (pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-141-\t\t\ts5_s = REG_READ(ah, AR_ISR_S5_S(ah));\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-152-\t\tif (ah-\u003eintr_gen_timer_trigger)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:153:\t\t\t*masked |= ATH9K_INT_GENTIMER;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-154-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-155-\t\tif ((s5_s \u0026 AR_ISR_S5_TIM_TIMER) \u0026\u0026\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:156:\t\t    !(pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_AUTOSLEEP))\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:157:\t\t\t*masked |= ATH9K_INT_TIM_TIMER;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-158-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:159:\t\tif (!(pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED)) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-160-\t\t\tREG_WRITE(ah, AR_ISR_S5, s5_s);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-164-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:165:\tif (!(pCap-\u003ehw_caps \u0026 ATH9K_HW_CAP_RAC_SUPPORTED)) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-166-\t\tREG_WRITE(ah, AR_ISR, isr);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-189-\t\t\t}\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:190:\t\t\t*masked |= ATH9K_INT_FATAL;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-191-\t\t}\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-196-\t\t\tREG_WRITE(ah, AR_RC, 0);\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:197:\t\t\t*masked |= ATH9K_INT_FATAL;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-198-\t\t}\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c=212=ar9002_set_txdesc(struct ath_hw *ah, void *ds, struct ath_tx_info *i)\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-260-\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:261:\tctl1 |= (i-\u003ekeyix != ATH9K_TXKEYIX_INVALID ? SM(i-\u003ekeyix, AR_DestIdx) : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-262-\t\t| SM(i-\u003etype, AR_FrameType)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:263:\t\t| (i-\u003eflags \u0026 ATH9K_TXDESC_NOACK ? AR_NoAck : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:264:\t\t| (i-\u003eflags \u0026 ATH9K_TXDESC_EXT_ONLY ? AR_ExtOnly : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:265:\t\t| (i-\u003eflags \u0026 ATH9K_TXDESC_EXT_AND_CTL ? AR_ExtAndCtl : 0);\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-266-\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-282-\tWRITE_ONCE(ads-\u003eds_ctl0, (i-\u003epkt_len \u0026 AR_FrameLen)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:283:\t\t| (i-\u003eflags \u0026 ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-284-\t\t| SM(i-\u003etxpower[0], AR_XmitPower0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:285:\t\t| (i-\u003eflags \u0026 ATH9K_TXDESC_VEOL ? AR_VEOL : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:286:\t\t| (i-\u003eflags \u0026 ATH9K_TXDESC_INTREQ ? AR_TxIntrReq : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:287:\t\t| (i-\u003ekeyix != ATH9K_TXKEYIX_INVALID ? AR_DestIdxValid : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:288:\t\t| (i-\u003eflags \u0026 ATH9K_TXDESC_CLRDMASK ? AR_ClrDestMask : 0)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:289:\t\t| (i-\u003eflags \u0026 ATH9K_TXDESC_RTSENA ? AR_RTSEnable :\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:290:\t\t   (i-\u003eflags \u0026 ATH9K_TXDESC_CTSENA ? AR_CTSEnable : 0)));\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-291-\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c=316=static int ar9002_hw_proc_txdesc(struct ath_hw *ah, void *ds,\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-330-\tif (status \u0026 AR_TxOpExceeded)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:331:\t\tts-\u003ets_status |= ATH9K_TXERR_XTXOP;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-332-\tts-\u003etid = MS(status, AR_TxTid);\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-340-\tif (status \u0026 AR_TxBaStatus) {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:341:\t\tts-\u003ets_flags |= ATH9K_TX_BA;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-342-\t\tts-\u003eba_low = ads-\u003eAR_BaBitmapLow;\n--\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-347-\tif (status \u0026 AR_FrmXmitOK)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:348:\t\tts-\u003ets_status |= ATH9K_TX_ACKED;\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-349-\telse {\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c-350-\t\tif (status \u0026 AR_ExcessiveRetries)\ndrivers/net/wireless/ath/ath9k/ar9002_mac.c:351:\t\t\tts-\u003ets_status |= ATH9K_TXERR_XRETRY;\n\n"
}

							input: 38351
							output: 29
							thoughts: 30

Okay, here's my interpretation of that thought process, as if I were thinking it myself, tailored for someone in my field:

**Digging into ATH9K_HTC Dependencies**

Right, let's dive into the `drivers/net/wireless/ath/Kconfig` file. I need to refresh my memory on the surrounding configurations related to `ATH9K_HTC`. Specifically, I'm thinking I should check to see if there are any other enclosing or conditional configurations that might impact or depend on `ATH9K_HTC`. It's crucial to understand the broader context. Understanding dependencies is key to avoid unintended consequences or missing critical elements when modifying this module. Gotta trace the inheritance.

{
  "Expression": "source.*ath",
  "PathPrefix": "drivers/net/wireless/"
}

{
  "Output": "drivers/net/wireless/Kconfig=21=source \"drivers/net/wireless/admtek/Kconfig\"\ndrivers/net/wireless/Kconfig:22:source \"drivers/net/wireless/ath/Kconfig\"\ndrivers/net/wireless/Kconfig-23-source \"drivers/net/wireless/atmel/Kconfig\"\n--\ndrivers/net/wireless/ath/Kconfig=49=config ATH_REG_DYNAMIC_USER_CERT_TESTING\n--\ndrivers/net/wireless/ath/Kconfig-56-\ndrivers/net/wireless/ath/Kconfig:57:source \"drivers/net/wireless/ath/ath5k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:58:source \"drivers/net/wireless/ath/ath9k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:59:source \"drivers/net/wireless/ath/carl9170/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:60:source \"drivers/net/wireless/ath/ath6kl/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:61:source \"drivers/net/wireless/ath/ar5523/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:62:source \"drivers/net/wireless/ath/wil6210/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:63:source \"drivers/net/wireless/ath/ath10k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:64:source \"drivers/net/wireless/ath/wcn36xx/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:65:source \"drivers/net/wireless/ath/ath11k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:66:source \"drivers/net/wireless/ath/ath12k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig-67-\n--\ndrivers/net/wireless/ath/ath10k/ahb.c=430=static void ath10k_ahb_irq_disable(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/ahb.c-435-\ndrivers/net/wireless/ath/ath10k/ahb.c:436:static int ath10k_ahb_resource_init(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/ahb.c-437-{\n--\ndrivers/net/wireless/ath/ath10k/ahb.c-523-\ndrivers/net/wireless/ath/ath10k/ahb.c:524:static void ath10k_ahb_resource_deinit(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/ahb.c-525-{\n--\ndrivers/net/wireless/ath/ath10k/mac.c=204=ath10k_mac_max_vht_nss(const u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])\n--\ndrivers/net/wireless/ath/ath10k/mac.c-214-\ndrivers/net/wireless/ath/ath10k/mac.c:215:int ath10k_mac_ext_resource_config(struct ath10k *ar, u32 val)\ndrivers/net/wireless/ath/ath10k/mac.c-216-{\n--\ndrivers/net/wireless/ath/ath10k/mac.h=70=struct ieee80211_txq *ath10k_mac_txq_lookup(struct ath10k *ar,\n--\ndrivers/net/wireless/ath/ath10k/mac.h-72-\t\t\t\t\t    u8 tid);\ndrivers/net/wireless/ath/ath10k/mac.h:73:int ath10k_mac_ext_resource_config(struct ath10k *ar, u32 val);\ndrivers/net/wireless/ath/ath10k/mac.h-74-void ath10k_mac_wait_tx_complete(struct ath10k *ar);\n--\ndrivers/net/wireless/ath/ath10k/pci.c=1789=void ath10k_pci_hif_send_complete_check(struct ath10k *ar, u8 pipe,\n--\ndrivers/net/wireless/ath/ath10k/pci.c-1804-\t\t */\ndrivers/net/wireless/ath/ath10k/pci.c:1805:\t\tresources = ath10k_pci_hif_get_free_queue_number(ar, pipe);\ndrivers/net/wireless/ath/ath10k/pci.c-1806-\n--\ndrivers/net/wireless/ath/ath10k/pci.c=3437=static bool ath10k_pci_chip_is_supported(u32 dev_id, u32 chip_id)\n--\ndrivers/net/wireless/ath/ath10k/pci.c-3453-\ndrivers/net/wireless/ath/ath10k/pci.c:3454:int ath10k_pci_setup_resource(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/pci.c-3455-{\n--\ndrivers/net/wireless/ath/ath10k/pci.c-3510-\ndrivers/net/wireless/ath/ath10k/pci.c:3511:void ath10k_pci_release_resource(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/pci.c-3512-{\n--\ndrivers/net/wireless/ath/ath10k/pci.h=250=int ath10k_pci_wait_for_target_init(struct ath10k *ar);\ndrivers/net/wireless/ath/ath10k/pci.h:251:int ath10k_pci_setup_resource(struct ath10k *ar);\ndrivers/net/wireless/ath/ath10k/pci.h:252:void ath10k_pci_release_resource(struct ath10k *ar);\ndrivers/net/wireless/ath/ath10k/pci.h-253-\n--\ndrivers/net/wireless/ath/ath10k/snoc.c=761=static void ath10k_snoc_hif_send_complete_check(struct ath10k *ar, u8 pipe,\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-768-\tif (!force) {\ndrivers/net/wireless/ath/ath10k/snoc.c:769:\t\tresources = ath10k_snoc_hif_get_free_queue_number(ar, pipe);\ndrivers/net/wireless/ath/ath10k/snoc.c-770-\n--\ndrivers/net/wireless/ath/ath10k/snoc.c=1305=static void ath10k_snoc_free_irq(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-1313-\ndrivers/net/wireless/ath/ath10k/snoc.c:1314:static int ath10k_snoc_resource_init(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/snoc.c-1315-{\n--\ndrivers/net/wireless/ath/ath10k/snoc.c=1371=int ath10k_snoc_fw_indication(struct ath10k *ar, u64 type)\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-1408-\ndrivers/net/wireless/ath/ath10k/snoc.c:1409:static int ath10k_snoc_setup_resource(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/snoc.c-1410-{\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-1437-\ndrivers/net/wireless/ath/ath10k/snoc.c:1438:static void ath10k_snoc_release_resource(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/snoc.c-1439-{\n--\ndrivers/net/wireless/ath/ath10k/snoc.c=1573=static void ath10k_modem_deinit(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-1582-\ndrivers/net/wireless/ath/ath10k/snoc.c:1583:static int ath10k_setup_msa_resources(struct ath10k *ar, u32 msa_size)\ndrivers/net/wireless/ath/ath10k/snoc.c-1584-{\n--\ndrivers/net/wireless/ath/ath10k/snoc.c=1732=static int ath10k_snoc_probe(struct platform_device *pdev)\n--\ndrivers/net/wireless/ath/ath10k/snoc.c-1894-\ndrivers/net/wireless/ath/ath10k/snoc.c:1895:static int ath10k_snoc_free_resources(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/snoc.c-1896-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c=74=static void ath10k_usb_cleanup_recv_urb(struct ath10k_urb_context *urb_context)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-81-\ndrivers/net/wireless/ath/ath10k/usb.c:82:static void ath10k_usb_free_pipe_resources(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c-83-\t\t\t\t\t   struct ath10k_usb_pipe *pipe)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-113-\ndrivers/net/wireless/ath/ath10k/usb.c:114:static void ath10k_usb_cleanup_pipe_resources(struct ath10k *ar)\ndrivers/net/wireless/ath/ath10k/usb.c-115-{\n--\ndrivers/net/wireless/ath/ath10k/usb.c=746=static u8 ath10k_usb_get_logical_pipe_num(u8 ep_address, int *urb_count)\n--\ndrivers/net/wireless/ath/ath10k/usb.c-790-\ndrivers/net/wireless/ath/ath10k/usb.c:791:static int ath10k_usb_alloc_pipe_resources(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c-792-\t\t\t\t\t   struct ath10k_usb_pipe *pipe,\n--\ndrivers/net/wireless/ath/ath10k/usb.c-822-\ndrivers/net/wireless/ath/ath10k/usb.c:823:static int ath10k_usb_setup_pipe_resources(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/usb.c-824-\t\t\t\t\t   struct usb_interface *interface)\n--\ndrivers/net/wireless/ath/ath10k/wmi-ops.h=14=struct wmi_ops {\n--\ndrivers/net/wireless/ath/ath10k/wmi-ops.h-209-\t\t\t\t\t\t\tu32 detect_margin);\ndrivers/net/wireless/ath/ath10k/wmi-ops.h:210:\tstruct sk_buff *(*ext_resource_config)(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/wmi-ops.h-211-\t\t\t\t\t       enum wmi_host_platform_type type,\n--\ndrivers/net/wireless/ath/ath10k/wmi-ops.h=1579=static inline int\ndrivers/net/wireless/ath/ath10k/wmi-ops.h:1580:ath10k_wmi_ext_resource_config(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/wmi-ops.h-1581-\t\t\t       enum wmi_host_platform_type type,\n--\ndrivers/net/wireless/ath/ath10k/wmi.c=8855=static struct sk_buff *\ndrivers/net/wireless/ath/ath10k/wmi.c:8856:ath10k_wmi_10_4_ext_resource_config(struct ath10k *ar,\ndrivers/net/wireless/ath/ath10k/wmi.c-8857-\t\t\t\t    enum wmi_host_platform_type type,\n--\ndrivers/net/wireless/ath/ath10k/wmi.c=9438=static const struct wmi_ops wmi_10_4_ops = {\n--\ndrivers/net/wireless/ath/ath10k/wmi.c-9496-\t.fw_stats_fill = ath10k_wmi_10_4_op_fw_stats_fill,\ndrivers/net/wireless/ath/ath10k/wmi.c:9497:\t.ext_resource_config = ath10k_wmi_10_4_ext_resource_config,\ndrivers/net/wireless/ath/ath10k/wmi.c-9498-\t.gen_update_fw_tdls_state = ath10k_wmi_10_4_gen_update_fw_tdls_state,\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=828=static int ath11k_core_get_rproc(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-847-\ndrivers/net/wireless/ath/ath11k/ahb.c:848:static int ath11k_ahb_setup_msi_resources(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-849-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=916=static void ath11k_ahb_release_smp2p_handle(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-925-\ndrivers/net/wireless/ath/ath11k/ahb.c:926:static int ath11k_ahb_setup_resources(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-927-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-946-\ndrivers/net/wireless/ath/ath11k/ahb.c:947:static int ath11k_ahb_setup_msa_resources(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-948-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=999=static void ath11k_ahb_ce_unmap(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1004-\ndrivers/net/wireless/ath/ath11k/ahb.c:1005:static int ath11k_ahb_fw_resources_init(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-1006-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1103-\ndrivers/net/wireless/ath/ath11k/ahb.c:1104:static int ath11k_ahb_fw_resource_deinit(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-1105-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1264=static void ath11k_ahb_remove_prepare(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1279-\ndrivers/net/wireless/ath/ath11k/ahb.c:1280:static void ath11k_ahb_free_resources(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-1281-{\n--\ndrivers/net/wireless/ath/ath11k/dp.c=43=int ath11k_dp_peer_setup(struct ath11k *ar, int vdev_id, const u8 *addr)\n--\ndrivers/net/wireless/ath/ath11k/dp.c-78-\ndrivers/net/wireless/ath/ath11k/dp.c:79:\t/* TODO: Setup other peer specific resource used in data path */\ndrivers/net/wireless/ath/ath11k/dp.c-80-\n--\ndrivers/net/wireless/ath/ath11k/qmi.c=3364=EXPORT_SYMBOL(ath11k_qmi_deinit_service);\ndrivers/net/wireless/ath/ath11k/qmi.c-3365-\ndrivers/net/wireless/ath/ath11k/qmi.c:3366:void ath11k_qmi_free_resource(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/qmi.c-3367-{\n--\ndrivers/net/wireless/ath/ath11k/qmi.h=521=int ath11k_qmi_init_service(struct ath11k_base *ab);\ndrivers/net/wireless/ath/ath11k/qmi.h:522:void ath11k_qmi_free_resource(struct ath11k_base *ab);\ndrivers/net/wireless/ath/ath11k/qmi.h-523-int ath11k_qmi_fwreset_from_cold_boot(struct ath11k_base *ab);\n--\ndrivers/net/wireless/ath/ath12k/ahb.c=1011=static void ath12k_ahb_deconfigure_rproc(struct ath12k_base *ab)\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-1035-\ndrivers/net/wireless/ath/ath12k/ahb.c:1036:static int ath12k_ahb_resource_init(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-1037-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-1099-\ndrivers/net/wireless/ath/ath12k/ahb.c:1100:static void ath12k_ahb_resource_deinit(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-1101-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c=1267=static void ath12k_ahb_remove_prepare(struct ath12k_base *ab)\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-1282-\ndrivers/net/wireless/ath/ath12k/ahb.c:1283:static void ath12k_ahb_free_resources(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-1284-{\n--\ndrivers/net/wireless/ath/ath12k/dp.c=47=int ath12k_dp_peer_setup(struct ath12k *ar, int vdev_id, const u8 *addr)\n--\ndrivers/net/wireless/ath/ath12k/dp.c-82-\ndrivers/net/wireless/ath/ath12k/dp.c:83:\t/* TODO: Setup other peer specific resource used in data path */\ndrivers/net/wireless/ath/ath12k/dp.c-84-\n--\ndrivers/net/wireless/ath/ath12k/qmi.c=4103=void ath12k_qmi_deinit_service(struct ath12k_base *ab)\n--\ndrivers/net/wireless/ath/ath12k/qmi.c-4116-\ndrivers/net/wireless/ath/ath12k/qmi.c:4117:void ath12k_qmi_free_resource(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/qmi.c-4118-{\n--\ndrivers/net/wireless/ath/ath12k/qmi.h=633=int ath12k_qmi_init_service(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/qmi.h:634:void ath12k_qmi_free_resource(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/qmi.h-635-void ath12k_qmi_trigger_host_cap(struct ath12k_base *ab);\n--\ndrivers/net/wireless/ath/ath12k/wmi.c=4143=static void\ndrivers/net/wireless/ath/ath12k/wmi.c:4144:ath12k_wmi_copy_resource_config(struct ath12k_base *ab,\ndrivers/net/wireless/ath/ath12k/wmi.c-4145-\t\t\t\tstruct ath12k_wmi_resource_config_params *wmi_cfg,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c=177=static inline struct ath6kl_usb *ath6kl_usb_priv(struct ath6kl *ar)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-182-/* pipe resource allocation/cleanup */\ndrivers/net/wireless/ath/ath6kl/usb.c:183:static int ath6kl_usb_alloc_pipe_resources(struct ath6kl_usb_pipe *pipe,\ndrivers/net/wireless/ath/ath6kl/usb.c-184-\t\t\t\t\t   int urb_cnt)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-217-\ndrivers/net/wireless/ath/ath6kl/usb.c:218:static void ath6kl_usb_free_pipe_resources(struct ath6kl_usb_pipe *pipe)\ndrivers/net/wireless/ath/ath6kl/usb.c-219-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-248-\ndrivers/net/wireless/ath/ath6kl/usb.c:249:static void ath6kl_usb_cleanup_pipe_resources(struct ath6kl_usb *ar_usb)\ndrivers/net/wireless/ath/ath6kl/usb.c-250-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c=257=static u8 ath6kl_usb_get_logical_pipe_num(struct ath6kl_usb *ar_usb,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-302-\ndrivers/net/wireless/ath/ath6kl/usb.c:303:static int ath6kl_usb_setup_pipe_resources(struct ath6kl_usb *ar_usb)\ndrivers/net/wireless/ath/ath6kl/usb.c-304-{\n"
}

							input: 44746
							output: 36
							thoughts: 22

Here's my thought process, as it is:

**Checking `ATH_COMMON` in `drivers/net/wireless/ath/Kconfig`**

Okay, so I need to understand what's going on with the Atheros wireless drivers in this kernel build, and the first logical step is to check the configuration options. Specifically, I'm thinking about `ATH_COMMON`. I know that's a key common configuration for the Atheros driver, so that's where I'll start looking. I'll need to see how it's defined, its dependencies, and what other options are influenced by its state. This will help me understand the overall build configuration and pinpoint any potential issues or understand the rationale behind certain settings, given my expertise in the field.

{
  "File": "drivers/net/wireless/ath/Kconfig",
  "FirstLine": 1,
  "LineCount": 40
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: ISC\n   2:\tconfig ATH_COMMON\n   3:\t\ttristate\n   4:\t\n   5:\tconfig WLAN_VENDOR_ATH\n   6:\t\tbool \"Atheros/Qualcomm devices\"\n   7:\t\tdefault y\n   8:\t\thelp\n   9:\t\t  If you have a wireless card belonging to this class, say Y.\n  10:\t\n  11:\t\t  Note that the answer to this question doesn't directly affect the\n  12:\t\t  kernel: saying N will just cause the configurator to skip all the\n  13:\t\t  questions about these cards. If you say Y, you will be asked for\n  14:\t\t  your specific card in the following questions.\n  15:\t\n  16:\t\t  For more information and documentation on this module you can visit:\n  17:\t\n  18:\t\t  https://wireless.wiki.kernel.org/en/users/Drivers/ath\n  19:\t\n  20:\t\t  For information on all Atheros wireless drivers visit:\n  21:\t\n  22:\t\t  https://wireless.wiki.kernel.org/en/users/Drivers/Atheros\n  23:\t\n  24:\tif WLAN_VENDOR_ATH\n  25:\t\n  26:\tconfig ATH_DEBUG\n  27:\t\tbool \"Atheros wireless debugging\"\n  28:\t\thelp\n  29:\t\t  Say Y, if you want to debug atheros wireless drivers.\n  30:\t\t  Right now only ath9k makes use of this.\n  31:\t\n  32:\tconfig ATH_TRACEPOINTS\n  33:\t\tbool \"Atheros wireless tracing\"\n  34:\t\tdepends on ATH_DEBUG\n  35:\t\tdepends on EVENT_TRACING\n  36:\t\thelp\n  37:\t\t  This option enables tracepoints for atheros wireless drivers.\n  38:\t\t  Currently, ath9k makes use of this facility.\n  39:\t\n  40:\tconfig ATH_REG_DYNAMIC_USER_REG_HINTS\n"
}

							input: 45480
							output: 40
							thoughts: 415

**My Analysis of the ath9k_htc Driver Dependencies and Symbol Scope**

Okay, let's break this down systematically. First, I need to confirm the core dependencies. It looks like the relevant configuration options are: `USB`, `MAC80211`, `ATH9K_HTC`, and `WLAN_VENDOR_ATH`. Specifically, `CONFIG_ATH9K_HTC` appears to be the primary configuration option, and I also need to ensure that `CONFIG_USB`, `CONFIG_MAC80211`, and `CONFIG_WLAN_VENDOR_ATH` are all enabled.

Now, let's drill down into the key symbols that are directly impacted or strongly connected to this code. It seems like the focus is on these:

*   `hif_usb_send_regout`: This one was directly modified, specifically with the addition of a `WARN_ONCE` check.
*   `ath9k_reg_rmw_buffer`: This was directly modified, where there was a fix made for a register_rmw sizeof calculation.
*   `ath9k_reg_rmw`: This is a caller of `ath9k_reg_rmw_buffer`, so it's relevant in terms of control flow.
*   `ath9k_reg_rmw_flush`: This one is responsible for flushing the buffer, so it's important for the overall register modification process.
*   `hif_usb_send`: This one calls `hif_usb_send_regout`.

I need to understand the scope and visibility of these functions – are they static, exported, or part of the binary symbols? Even static functions, if not inlined, contribute to the symbol coverage, so they're worth investigating. Let's start with `ath9k_reg_rmw_buffer`. Yes, it is static void. And `hif_usb_send_regout` is static int. And `hif_usb_send` is also static in `hif_usb.c`, but it's a callback, defined under `hif_ops->send`.

This means I need to figure out how `hif_dev->hif_ops` or the `hif_usb` callbacks are registered to understand how these static functions are actually used and exposed within the broader system.

{
  "Expression": "hif_usb_send\\b",
  "PathPrefix": "drivers/net/wireless/ath/ath9k/"
}

{
  "Output": "drivers/net/wireless/ath/ath9k/hif_usb.c=443=static void hif_usb_stop(void *hif_handle)\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-471-\ndrivers/net/wireless/ath/ath9k/hif_usb.c:472:static int hif_usb_send(void *hif_handle, u8 pipe_id, struct sk_buff *skb)\ndrivers/net/wireless/ath/ath9k/hif_usb.c-473-{\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c=528=static struct ath9k_htc_hif hif_usb = {\n--\ndrivers/net/wireless/ath/ath9k/hif_usb.c-537-\t.sta_drain = hif_usb_sta_drain,\ndrivers/net/wireless/ath/ath9k/hif_usb.c:538:\t.send = hif_usb_send,\ndrivers/net/wireless/ath/ath9k/hif_usb.c-539-};\n"
}

							input: 46742
							output: 37
							thoughts: 22

Here's my summary, as if I were thinking these thoughts:

**Analyzing the HTC/WMI Layer's Interaction with `hif_usb_send`**

Okay, so I need to get a clear picture of how the `hif_usb_send` function is actually being called within the HTC/WMI layer. It's crucial to understand this interaction for [ *Insert the relevant technical field, e.g., debugging a USB communication issue, optimizing data transfer, analyzing driver behavior, etc.* ]. I need to trace the call paths to identify the entry points and the context in which this function is used. My initial plan is to examine the code where HTC and WMI are integrated. I'm going to follow the function calls from the higher level protocols to the point where the `hif_usb_send` function is invoked. This will illuminate the exact data that's being sent over USB and the implications for performance or any potential vulnerabilities. I need to note any parameters that are passed and understand how the data is being constructed.

{
  "Expression": "-\u003ehif-\u003esend",
  "PathPrefix": "drivers/net/wireless/ath/ath9k/"
}

{
  "Output": "drivers/net/wireless/ath/ath9k/htc_hst.c=21=static int htc_issue_send(struct htc_target *target, struct sk_buff* skb,\n--\ndrivers/net/wireless/ath/ath9k/htc_hst.c-34-\ndrivers/net/wireless/ath/ath9k/htc_hst.c:35:\tstatus = target-\u003ehif-\u003esend(target-\u003ehif_dev, endpoint-\u003eul_pipeid, skb);\ndrivers/net/wireless/ath/ath9k/htc_hst.c-36-\n"
}

							input: 47179
							output: 249
							thoughts: 720

**Fuzzing Verdict: Ready to Execute**

Okay, let's break this down for the fuzzing run. I've got a list of target functions: `htc_issue_send`, `htc_send`, `ath9k_wmi_cmd`, `ath9k_reg_rmw`, `ath9k_reg_rmw_buffer`, `ath9k_reg_rmw_flush`, `hif_usb_send`, and `hif_usb_send_regout`.

I need to nail down the parameters for `set-results`. First, `WorthFuzzing`? Absolutely, true. The `Reasoning` will be a concise explanation, and this is what I'm thinking: The patch introduces new error handling with a `WARN_ONCE` in `hif_usb_send_regout` to prevent sending packets of a specific length, tweaks a structure size calculation in `ath9k_reg_rmw_buffer`, and reduces `MAX_RMW_CMD_NUMBER`.  This driver, `ath9k_htc`, is accessible via emulated USB devices (like Raw Gadget), and these changes warrant fuzzing to make sure everything's correct.

Next, the `FocusSymbols`.  I've got a shortlist from above: `hif_usb_send_regout`, `ath9k_reg_rmw_buffer`, `ath9k_reg_rmw_flush`, `ath9k_reg_rmw`, and `hif_usb_send`. They're specific and non-ubiquitous, just like we want.

Then, the `EnableConfigs`.  We need these kernel config flags, without the `CONFIG_` prefix: `ATH9K_HTC`, `USB`, `MAC80211`, and `WLAN_VENDOR_ATH`. I've made sure to review the instructions: the goal is to discover crashes, regressions, new bugs, and triggered assertions. The new or changed assertions are *key* – we need to fuzz those to make sure they're solid. And this driver is reachable via USB. Also, I've confirmed that the focus symbols are specific.

Let's double-check all of this, one last time.

Configs: `ATH9K_HTC`, `USB`, `MAC80211`, `WLAN_VENDOR_ATH` – check.

Symbols: `hif_usb_send_regout`, `ath9k_reg_rmw_buffer`, `ath9k_reg_rmw_flush`, `ath9k_reg_rmw`, `hif_usb_send` – check.

My reasoning still holds: this patch introduces a `WARN_ONCE` in `hif_usb_send_regout`, structure fixes in `ath9k_reg_rmw_buffer` and reduces `MAX_RMW_CMD_NUMBER`. The driver (`ath9k_htc`) is reachable through emulated USB, and we need to fuzz the new assertion and modified buffer handling to prevent regressions.

Alright, everything's accurate and ready to go. Time to call `set-results`.

{
  "EnableConfigs": [
    "ATH9K_HTC",
    "USB",
    "MAC80211",
    "WLAN_VENDOR_ATH"
  ],
  "FocusSymbols": [
    "hif_usb_send_regout",
    "ath9k_reg_rmw_buffer",
    "ath9k_reg_rmw_flush",
    "ath9k_reg_rmw",
    "hif_usb_send"
  ],
  "Reasoning": "The patch modifies the USB wireless driver ath9k_htc, which is reachable via USB gadget/device emulation in syzkaller. The changes add a new WARN_ONCE runtime assertion and check in hif_usb_send_regout to prevent sending packets whose length is an exact multiple of the USB maxpacket size, correct the element size calculation in ath9k_reg_rmw_buffer from sizeof(struct register_write) to sizeof(struct register_rmw), and reduce MAX_RMW_CMD_NUMBER. Fuzzing is warranted to test the new assertion and altered RMW command batching logic.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "ATH9K_HTC",
    "USB",
    "MAC80211",
    "WLAN_VENDOR_ATH"
  ],
  "FocusSymbols": [
    "hif_usb_send_regout",
    "ath9k_reg_rmw_buffer",
    "ath9k_reg_rmw_flush",
    "ath9k_reg_rmw",
    "hif_usb_send"
  ],
  "Reasoning": "The patch modifies the USB wireless driver ath9k_htc, which is reachable via USB gadget/device emulation in syzkaller. The changes add a new WARN_ONCE runtime assertion and check in hif_usb_send_regout to prevent sending packets whose length is an exact multiple of the USB maxpacket size, correct the element size calculation in ath9k_reg_rmw_buffer from sizeof(struct register_write) to sizeof(struct register_rmw), and reduce MAX_RMW_CMD_NUMBER. Fuzzing is warranted to test the new assertion and altered RMW command batching logic.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

{
  "KMSANReasoning": "The patch addresses a USB communication issue in the ath9k driver where USB packets that are exact multiples of endpoint maxpacket size cause firmware delivery stalls. The changes consist of:\n1. Adding a check in `hif_usb_send_regout()` to warn and reject skbs whose length is an exact multiple of the endpoint maxpacket size.\n2. Correcting the buffer size calculation in `ath9k_reg_rmw_buffer()` from `sizeof(struct register_write)` (8 bytes) to `sizeof(struct register_rmw)` (12 bytes).\n3. Lowering `MAX_RMW_CMD_NUMBER` from 15 to 14 in `wmi.h` to avoid 64-byte aligned USB payloads.\n\nRegarding memory initialization:\n- All fields (`reg`, `set`, `clr`) of the `struct register_rmw` array elements in `priv-\u003ewmi-\u003emulti_rmw` are explicitly initialized before being sent via `ath9k_wmi_cmd()`.\n- No user-space copy paths or uninitialized kernel structure fields are exposed or modified.\n- No branch conditions rely on uninitialized values.\n\nTherefore, this patch introduces no uninitialized memory risks, and a dedicated KMSAN fuzzing session is not required.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 4a872e85917d67040075191978246f39b0b95e47
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Sep 6 12:47:33 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index d3491ff08e6ef..49303c7e3fef4 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -99,10 +99,17 @@ static void hif_usb_regout_cb(struct urb *urb)
 static int hif_usb_send_regout(struct hif_device_usb *hif_dev,
 			       struct sk_buff *skb)
 {
+	u16 maxpacket = usb_maxpacket(hif_dev->udev,
+				      usb_sndintpipe(hif_dev->udev,
+						     USB_REG_OUT_PIPE));
 	struct urb *urb;
 	struct cmd_buf *cmd;
 	int ret = 0;
 
+	if (WARN_ONCE(maxpacket && skb->len % maxpacket == 0,
+		      "%u-byte command fills whole USB packets\n", skb->len))
+		return -EINVAL;
+
 	urb = usb_alloc_urb(0, GFP_KERNEL);
 	if (urb == NULL)
 		return -ENOMEM;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index 6de78ae857268..0b49d2cc99f0b 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -405,7 +405,7 @@ static void ath9k_reg_rmw_buffer(void *hw_priv,
 	if (priv->wmi->multi_rmw_idx == MAX_RMW_CMD_NUMBER) {
 		r = ath9k_wmi_cmd(priv->wmi, WMI_REG_RMW_CMDID,
 			  (u8 *) &priv->wmi->multi_rmw,
-			  sizeof(struct register_write) * priv->wmi->multi_rmw_idx,
+			  sizeof(struct register_rmw) * priv->wmi->multi_rmw_idx,
 			  (u8 *) &rsp_status, sizeof(rsp_status),
 			  100);
 		if (unlikely(r)) {
diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h
index 5c3b710b8f319..256f46098a6b1 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.h
+++ b/drivers/net/wireless/ath/ath9k/wmi.h
@@ -126,7 +126,8 @@ enum wmi_event_id {
 };
 
 #define MAX_CMD_NUMBER 62
-#define MAX_RMW_CMD_NUMBER 15
+/* 15 entries make 192 bytes, three full USB packets: never delivered. */
+#define MAX_RMW_CMD_NUMBER 14
 
 struct register_write {
 	__be32 reg;

							input: 2789
							output: 36
							thoughts: 412

**Analyzing a WLAN Driver Patch**

Okay, so this patch is touching the Atheros ath9k wireless driver, specifically within the USB host interface (`hif_usb.c`), the HTC driver initialization (`htc_drv_init.c`), and the WMI header (`wmi.h`). Let's break down these changes to see what's going on.

First, in `hif_usb_send_regout`, there's a new sanity check. It's looking at the USB packet size being used for register output. It appears the code now checks `usb_maxpacket` to determine the maximum packet size for the output interrupt pipe. If the command, `skb->len`, perfectly fills a whole USB packet (meaning it's a multiple of `maxpacket`) *without* a short packet or zero-length packet being sent, then it returns `-EINVAL`. This is interesting; it's a potential error condition being flagged, probably related to some edge case with USB transfers that wasn't being handled before. I need to understand *why* this full-packet condition is problematic. Is it a potential endpoint buffering issue or perhaps a signaling problem related to a particular hardware quirk? I need to dig deeper.

Moving on to `htc_drv_init.c`, it's modifying the `ath9k_reg_rmw_buffer` allocation. The size calculation is changing from using `struct register_write` to `struct register_rmw`. This is a crucial detail. I need to figure out what the difference is between these two structures. A size change indicates either a data structure revision, a bug fix, or an optimization. Is there a new field or a changed field within `struct register_rmw` compared to `struct register_write`? I'll need to compare the definitions to understand the memory implications.

Finally, in `wmi.h`, there's a simple change, but important, `MAX_RMW_CMD_NUMBER` is being reduced from 15 to 14. This almost certainly means that there's a limitation on the number of Register-Modify-Write (RMW) commands that can be queued or processed. I'm curious about the rationale for this change. Does it indicate a bug fix, or is it related to hardware constraints or a WMI protocol change? Perhaps the command slot count was incorrect to begin with?

To get a better picture, I'll use `read-file` or `grepper` to examine `htc_drv_init.c` around line 405 (where the `ath9k_reg_rmw_buffer` is allocated) and `wmi.h` to see those structure definitions and the surrounding code. That should illuminate the reasons for these changes.

{
  "Expression": "register_rmw",
  "PathPrefix": "drivers/net/wireless/ath/ath9k/"
}

{
  "Output": "drivers/net/wireless/ath/ath9k/htc_drv_init.c=383=static void ath9k_reg_rmw_buffer(void *hw_priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-407-\t\t\t  (u8 *) \u0026priv-\u003ewmi-\u003emulti_rmw,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:408:\t\t\t  sizeof(struct register_rmw) * priv-\u003ewmi-\u003emulti_rmw_idx,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-409-\t\t\t  (u8 *) \u0026rsp_status, sizeof(rsp_status),\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c=422=static void ath9k_reg_rmw_flush(void *hw_priv)\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-439-\t\t\t  (u8 *) \u0026priv-\u003ewmi-\u003emulti_rmw,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:440:\t\t\t  sizeof(struct register_rmw) * priv-\u003ewmi-\u003emulti_rmw_idx,\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-441-\t\t\t  (u8 *) \u0026rsp_status, sizeof(rsp_status),\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c=466=static void ath9k_reg_rmw_single(void *hw_priv,\n--\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-471-\tstruct ath9k_htc_priv *priv = common-\u003epriv;\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c:472:\tstruct register_rmw buf, buf_ret;\ndrivers/net/wireless/ath/ath9k/htc_drv_init.c-473-\tint ret;\n--\ndrivers/net/wireless/ath/ath9k/wmi.h=132=struct register_write {\n--\ndrivers/net/wireless/ath/ath9k/wmi.h-136-\ndrivers/net/wireless/ath/ath9k/wmi.h:137:struct register_rmw {\ndrivers/net/wireless/ath/ath9k/wmi.h-138-\t__be32 reg;\n--\ndrivers/net/wireless/ath/ath9k/wmi.h=149=struct wmi {\n--\ndrivers/net/wireless/ath/ath9k/wmi.h-175-\tatomic_t m_rmw_cnt;\ndrivers/net/wireless/ath/ath9k/wmi.h:176:\tstruct register_rmw multi_rmw[MAX_RMW_CMD_NUMBER];\ndrivers/net/wireless/ath/ath9k/wmi.h-177-\tu32 multi_rmw_idx;\n"
}

							input: 4615
							output: 48
							thoughts: 52

Okay, let's dive into this. I need to refresh my memory on some `ath9k` nuances, specifically around the HTC driver initialization. My focus is on understanding the register manipulation routines, specifically `ath9k_reg_rmw_buffer` and `ath9k_reg_rmw_flush`. I suspect they play a key role in how the driver handles register reads, modifications, and write-backs, likely during hardware setup and initialization. I should find these within `drivers/net/wireless/ath/ath9k/htc_drv_init.c`. Understanding their purpose is crucial to ensuring proper hardware configuration and preventing potential register corruption which, in turn, is key to overall performance and stability. Let's see what those functions are doing.

{
  "File": "drivers/net/wireless/ath/ath9k/htc_drv_init.c",
  "FirstLine": 380,
  "LineCount": 70
}

{
  "Contents": " 380:\t\tmutex_unlock(\u0026priv-\u003ewmi-\u003emulti_write_mutex);\n 381:\t}\n 382:\t\n 383:\tstatic void ath9k_reg_rmw_buffer(void *hw_priv,\n 384:\t\t\t\t\t u32 reg_offset, u32 set, u32 clr)\n 385:\t{\n 386:\t\tstruct ath_hw *ah = hw_priv;\n 387:\t\tstruct ath_common *common = ath9k_hw_common(ah);\n 388:\t\tstruct ath9k_htc_priv *priv = common-\u003epriv;\n 389:\t\tu32 rsp_status;\n 390:\t\tint r;\n 391:\t\n 392:\t\tmutex_lock(\u0026priv-\u003ewmi-\u003emulti_rmw_mutex);\n 393:\t\n 394:\t\t/* Store the register/value */\n 395:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].reg =\n 396:\t\t\tcpu_to_be32(reg_offset);\n 397:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].set =\n 398:\t\t\tcpu_to_be32(set);\n 399:\t\tpriv-\u003ewmi-\u003emulti_rmw[priv-\u003ewmi-\u003emulti_rmw_idx].clr =\n 400:\t\t\tcpu_to_be32(clr);\n 401:\t\n 402:\t\tpriv-\u003ewmi-\u003emulti_rmw_idx++;\n 403:\t\n 404:\t\t/* If the buffer is full, send it out. */\n 405:\t\tif (priv-\u003ewmi-\u003emulti_rmw_idx == MAX_RMW_CMD_NUMBER) {\n 406:\t\t\tr = ath9k_wmi_cmd(priv-\u003ewmi, WMI_REG_RMW_CMDID,\n 407:\t\t\t\t  (u8 *) \u0026priv-\u003ewmi-\u003emulti_rmw,\n 408:\t\t\t\t  sizeof(struct register_rmw) * priv-\u003ewmi-\u003emulti_rmw_idx,\n 409:\t\t\t\t  (u8 *) \u0026rsp_status, sizeof(rsp_status),\n 410:\t\t\t\t  100);\n 411:\t\t\tif (unlikely(r)) {\n 412:\t\t\t\tath_dbg(common, WMI,\n 413:\t\t\t\t\t\"REGISTER RMW FAILED, multi len: %d\\n\",\n 414:\t\t\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx);\n 415:\t\t\t}\n 416:\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx = 0;\n 417:\t\t}\n 418:\t\n 419:\t\tmutex_unlock(\u0026priv-\u003ewmi-\u003emulti_rmw_mutex);\n 420:\t}\n 421:\t\n 422:\tstatic void ath9k_reg_rmw_flush(void *hw_priv)\n 423:\t{\n 424:\t\tstruct ath_hw *ah = hw_priv;\n 425:\t\tstruct ath_common *common = ath9k_hw_common(ah);\n 426:\t\tstruct ath9k_htc_priv *priv = common-\u003epriv;\n 427:\t\tu32 rsp_status;\n 428:\t\tint r;\n 429:\t\n 430:\t\tif (test_bit(HTC_FWFLAG_NO_RMW, \u0026priv-\u003efw_flags))\n 431:\t\t\treturn;\n 432:\t\n 433:\t\tatomic_dec(\u0026priv-\u003ewmi-\u003em_rmw_cnt);\n 434:\t\n 435:\t\tmutex_lock(\u0026priv-\u003ewmi-\u003emulti_rmw_mutex);\n 436:\t\n 437:\t\tif (priv-\u003ewmi-\u003emulti_rmw_idx) {\n 438:\t\t\tr = ath9k_wmi_cmd(priv-\u003ewmi, WMI_REG_RMW_CMDID,\n 439:\t\t\t\t  (u8 *) \u0026priv-\u003ewmi-\u003emulti_rmw,\n 440:\t\t\t\t  sizeof(struct register_rmw) * priv-\u003ewmi-\u003emulti_rmw_idx,\n 441:\t\t\t\t  (u8 *) \u0026rsp_status, sizeof(rsp_status),\n 442:\t\t\t\t  100);\n 443:\t\t\tif (unlikely(r)) {\n 444:\t\t\t\tath_dbg(common, WMI,\n 445:\t\t\t\t\t\"REGISTER RMW FAILED, multi len: %d\\n\",\n 446:\t\t\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx);\n 447:\t\t\t}\n 448:\t\t\tpriv-\u003ewmi-\u003emulti_rmw_idx = 0;\n 449:\t\t}\n"
}

							input: 6120
							output: 45
							thoughts: 374

**Analyzing the ath9k Register Write/Modify Problem**

Okay, let's break this down. In `ath9k_reg_rmw_buffer`, before this patch, we were passing `sizeof(struct register_write) * priv->wmi->multi_rmw_idx`.  A `struct register_write` is 8 bytes – just `reg` and `val`.  But, the corresponding `ath9k_reg_rmw_flush` was already using the correct size, `sizeof(struct register_rmw) * priv->wmi->multi_rmw_idx`, which is 12 bytes because it includes `reg`, `set`, and `clr`.  So, in the buffer allocation, we were calculating the buffer size incorrectly: 8 bytes times some index, when we needed 12 bytes times the index.  For example, if `multi_rmw_idx` is 15, we were allocating 120 bytes instead of 180.

Now, wait a minute... why the change in `MAX_RMW_CMD_NUMBER` from 15 to 14?  Fifteen register commands would result in 15 * 12 bytes = 180 bytes.  Add the HTC/WMI headers and it should be 192 bytes, which is exactly three times the typical 64-byte USB packet size.  With 14 commands, we would have 168 bytes, and maybe a partial packet? USB bulk and interrupt transfers that are *exact* multiples of the `maxpacket` size (without a ZLP - Zero Length Packet) can potentially hang, and the data might never be delivered if the firmware expects a shorter packet. And I'm recalling that `hif_usb_send_regout` actually *warns* if `skb->len % maxpacket == 0`. We need to investigate `hif_usb.c` around `hif_usb_send_regout` to confirm this.

{
  "File": "drivers/net/wireless/ath/ath9k/hif_usb.c",
  "FirstLine": 95,
  "LineCount": 45
}

{
  "Contents": "  95:\t\tkfree_skb(cmd-\u003eskb);\n  96:\t\tkfree(cmd);\n  97:\t}\n  98:\t\n  99:\tstatic int hif_usb_send_regout(struct hif_device_usb *hif_dev,\n 100:\t\t\t\t       struct sk_buff *skb)\n 101:\t{\n 102:\t\tu16 maxpacket = usb_maxpacket(hif_dev-\u003eudev,\n 103:\t\t\t\t\t      usb_sndintpipe(hif_dev-\u003eudev,\n 104:\t\t\t\t\t\t\t     USB_REG_OUT_PIPE));\n 105:\t\tstruct urb *urb;\n 106:\t\tstruct cmd_buf *cmd;\n 107:\t\tint ret = 0;\n 108:\t\n 109:\t\tif (WARN_ONCE(maxpacket \u0026\u0026 skb-\u003elen % maxpacket == 0,\n 110:\t\t\t      \"%u-byte command fills whole USB packets\\n\", skb-\u003elen))\n 111:\t\t\treturn -EINVAL;\n 112:\t\n 113:\t\turb = usb_alloc_urb(0, GFP_KERNEL);\n 114:\t\tif (urb == NULL)\n 115:\t\t\treturn -ENOMEM;\n 116:\t\n 117:\t\tcmd = kzalloc_obj(*cmd);\n 118:\t\tif (cmd == NULL) {\n 119:\t\t\tusb_free_urb(urb);\n 120:\t\t\treturn -ENOMEM;\n 121:\t\t}\n 122:\t\n 123:\t\tcmd-\u003eskb = skb;\n 124:\t\tcmd-\u003ehif_dev = hif_dev;\n 125:\t\n 126:\t\tusb_fill_int_urb(urb, hif_dev-\u003eudev,\n 127:\t\t\t\t usb_sndintpipe(hif_dev-\u003eudev, USB_REG_OUT_PIPE),\n 128:\t\t\t\t skb-\u003edata, skb-\u003elen,\n 129:\t\t\t\t hif_usb_regout_cb, cmd, 1);\n 130:\t\n 131:\t\tusb_anchor_urb(urb, \u0026hif_dev-\u003eregout_submitted);\n 132:\t\tret = usb_submit_urb(urb, GFP_KERNEL);\n 133:\t\tif (ret) {\n 134:\t\t\tusb_unanchor_urb(urb);\n 135:\t\t\tkfree(cmd);\n 136:\t\t}\n 137:\t\tusb_free_urb(urb);\n 138:\t\n 139:\t\treturn ret;\n"
}

							input: 7657
							output: 302
							thoughts: 817

**KMSAN Assessment: No Need Here**

Okay, let's break down this patch and see if we need to bring in KMSAN. First, the core of the changes:

1.  **`ath9k_reg_rmw_buffer` Fix:** This is the most crucial part. It looks like we were accidentally sending a truncated structure size (`sizeof(struct register_write)`) to `ath9k_wmi_cmd()` instead of the correct size (`sizeof(struct register_rmw)`) for the `multi_rmw` array. The code populates the `multi_rmw` array (of `struct register_rmw` elements), specifically filling the `reg`, `set`, and `clr` fields for each entry. The correction now ensures that we send the complete, initialized data. Before, we were effectively truncating data to 8 bytes, but sending the data size as though it were 12 bytes.

2.  **`MAX_RMW_CMD_NUMBER` Adjustment:** Reducing this constant from 15 to 14 seems to be a USB-specific optimization. It's done to prevent USB packet length from being a multiple of 64 bytes, preventing endpoint hang. This primarily affects the size of the array, `multi_rmw`.

3.  **`hif_usb_send_regout` Check:** This adds a simple length check, returning `-EINVAL` if `skb->len` (the initialized length of the skb) is a multiple of `maxpacket`.

Now, does any of this scream "KMSAN risk"? Let's go through the checklist:

*   **Structure Exposure to Userspace:** No. This is internal communication between the driver and the USB hardware/firmware. No data is being leaked to userspace.
*   **Uninitialized Variable Dependence:** Nope. `maxpacket` is the result of `usb_maxpacket()`, and `skb->len` comes from the `skb`'s initialized length. These are checked and well-defined.
*   **Complex Data Structure Mishandling:** No. The `multi_rmw` array is allocated and meticulously populated. All fields within the array elements are initialized before being sent.
*   **Bounds Check Problems:** The size correction in `ath9k_reg_rmw_buffer` *fixes* a potential issue, ensuring we're sending the correct size of the fully initialized data in `multi_rmw`. We *weren't* reading uninitialized memory, we were *truncating* the size sent.

Therefore, given the nature of the changes, particularly that they are within internal driver operations and the structures are properly initialized, I don't see any risk of uninitialized memory reads or leaks that KMSAN would specifically catch. Standard detectors should be adequate here. So, let's set `NeedsKMSAN=false` with the reasoning that the patch fixes a size discrepancy to pass fully initialized structs, and alters sizes safely.

{
  "KMSANReasoning": "The patch addresses a USB communication issue in the ath9k driver where USB packets that are exact multiples of endpoint maxpacket size cause firmware delivery stalls. The changes consist of:\n1. Adding a check in `hif_usb_send_regout()` to warn and reject skbs whose length is an exact multiple of the endpoint maxpacket size.\n2. Correcting the buffer size calculation in `ath9k_reg_rmw_buffer()` from `sizeof(struct register_write)` (8 bytes) to `sizeof(struct register_rmw)` (12 bytes).\n3. Lowering `MAX_RMW_CMD_NUMBER` from 15 to 14 in `wmi.h` to avoid 64-byte aligned USB payloads.\n\nRegarding memory initialization:\n- All fields (`reg`, `set`, `clr`) of the `struct register_rmw` array elements in `priv-\u003ewmi-\u003emulti_rmw` are explicitly initialized before being sent via `ath9k_wmi_cmd()`.\n- No user-space copy paths or uninitialized kernel structure fields are exposed or modified.\n- No branch conditions rely on uninitialized values.\n\nTherefore, this patch introduces no uninitialized memory risks, and a dedicated KMSAN fuzzing session is not required.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch addresses a USB communication issue in the ath9k driver where USB packets that are exact multiples of endpoint maxpacket size cause firmware delivery stalls. The changes consist of:\n1. Adding a check in `hif_usb_send_regout()` to warn and reject skbs whose length is an exact multiple of the endpoint maxpacket size.\n2. Correcting the buffer size calculation in `ath9k_reg_rmw_buffer()` from `sizeof(struct register_write)` (8 bytes) to `sizeof(struct register_rmw)` (12 bytes).\n3. Lowering `MAX_RMW_CMD_NUMBER` from 15 to 14 in `wmi.h` to avoid 64-byte aligned USB payloads.\n\nRegarding memory initialization:\n- All fields (`reg`, `set`, `clr`) of the `struct register_rmw` array elements in `priv-\u003ewmi-\u003emulti_rmw` are explicitly initialized before being sent via `ath9k_wmi_cmd()`.\n- No user-space copy paths or uninitialized kernel structure fields are exposed or modified.\n- No branch conditions rely on uninitialized values.\n\nTherefore, this patch introduces no uninitialized memory risks, and a dedicated KMSAN fuzzing session is not required.",
  "NeedsKMSAN": false
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)