| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/11 17:31 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies the probe and firmware loading functions of the Airoha NPU platform driver (for Airoha EN7581 SoC). Platform drivers for specific hardware SoCs are not reachable in generic virtualized environments like QEMU or GCE. Furthermore, the changes are mostly limited to error logging (dev_err_probe) and a minor API change (request_firmware to request_firmware_direct).",
"WorthFuzzing": false
} |
| 1/1 | 2026/08/11 17:31 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 9f4e7b5396f458a07ed48a7045c7080a4d4ebd11\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Aug 11 17:31:38 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/ethernet/airoha/airoha_npu.c b/drivers/net/ethernet/airoha/airoha_npu.c\nindex b679bed952de3..de75376db1944 100644\n--- a/drivers/net/ethernet/airoha/airoha_npu.c\n+++ b/drivers/net/ethernet/airoha/airoha_npu.c\n@@ -202,9 +202,10 @@ static int airoha_npu_load_firmware(struct device *dev, void __iomem *addr,\n \tconst struct firmware *fw;\n \tint ret;\n \n-\tret = request_firmware(\u0026fw, fw_name, dev);\n+\tret = request_firmware_direct(\u0026fw, fw_name, dev);\n \tif (ret)\n-\t\treturn ret == -ENOENT ? -EPROBE_DEFER : ret;\n+\t\treturn dev_err_probe(dev, ret == -ENOENT ? -EPROBE_DEFER : ret,\n+\t\t\t\t \"failed to load %s\\n\", fw_name);\n \n \tif (fw-\u003esize \u003e fw_max_size) {\n \t\tdev_err(dev, \"%s: fw size too overlimit (%zu)\\n\",\n@@ -230,7 +231,8 @@ airoha_npu_load_firmware_from_dts(struct device *dev, void __iomem *addr,\n \tret = of_property_read_string_array(dev-\u003eof_node, \"firmware-name\",\n \t\t\t\t\t fw_names, ARRAY_SIZE(fw_names));\n \tif (ret != ARRAY_SIZE(fw_names))\n-\t\treturn -EINVAL;\n+\t\treturn dev_err_probe(dev, -EINVAL,\n+\t\t\t\t \"invalid firmware-name property\\n\");\n \n \tret = airoha_npu_load_firmware(dev, addr, fw_names[0],\n \t\t\t\t NPU_EN7581_FIRMWARE_RV32_MAX_SIZE);\n@@ -772,7 +774,7 @@ static int airoha_npu_probe(struct platform_device *pdev)\n \n \terr = airoha_npu_run_firmware(dev, base, \u0026res);\n \tif (err)\n-\t\treturn dev_err_probe(dev, err, \"failed to run npu firmware\\n\");\n+\t\treturn err;\n \n \tregmap_write(npu-\u003eregmap, REG_CR_NPU_MIB(10),\n \t\t res.start + NPU_EN7581_FIRMWARE_RV32_MAX_SIZE);\n"
} |
| 2/1 | 2026/08/11 17:31 | agent | patch-evaluator |
0mModel:best-expensive Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the probe and firmware loading functions of the Airoha NPU platform driver (for Airoha EN7581 SoC). Platform drivers for specific hardware SoCs are not reachable in generic virtualized environments like QEMU or GCE. Furthermore, the changes are mostly limited to error logging (dev_err_probe) and a minor API change (request_firmware to request_firmware_direct).",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 9f4e7b5396f458a07ed48a7045c7080a4d4ebd11
Author: syz-cluster <triage@syzkaller.com>
Date: Tue Aug 11 17:31:38 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/ethernet/airoha/airoha_npu.c b/drivers/net/ethernet/airoha/airoha_npu.c
index b679bed952de3..de75376db1944 100644
--- a/drivers/net/ethernet/airoha/airoha_npu.c
+++ b/drivers/net/ethernet/airoha/airoha_npu.c
@@ -202,9 +202,10 @@ static int airoha_npu_load_firmware(struct device *dev, void __iomem *addr,
const struct firmware *fw;
int ret;
- ret = request_firmware(&fw, fw_name, dev);
+ ret = request_firmware_direct(&fw, fw_name, dev);
if (ret)
- return ret == -ENOENT ? -EPROBE_DEFER : ret;
+ return dev_err_probe(dev, ret == -ENOENT ? -EPROBE_DEFER : ret,
+ "failed to load %s\n", fw_name);
if (fw->size > fw_max_size) {
dev_err(dev, "%s: fw size too overlimit (%zu)\n",
@@ -230,7 +231,8 @@ airoha_npu_load_firmware_from_dts(struct device *dev, void __iomem *addr,
ret = of_property_read_string_array(dev->of_node, "firmware-name",
fw_names, ARRAY_SIZE(fw_names));
if (ret != ARRAY_SIZE(fw_names))
- return -EINVAL;
+ return dev_err_probe(dev, -EINVAL,
+ "invalid firmware-name property\n");
ret = airoha_npu_load_firmware(dev, addr, fw_names[0],
NPU_EN7581_FIRMWARE_RV32_MAX_SIZE);
@@ -772,7 +774,7 @@ static int airoha_npu_probe(struct platform_device *pdev)
err = airoha_npu_run_firmware(dev, base, &res);
if (err)
- return dev_err_probe(dev, err, "failed to run npu firmware\n");
+ return err;
regmap_write(npu->regmap, REG_CR_NPU_MIB(10),
res.start + NPU_EN7581_FIRMWARE_RV32_MAX_SIZE);
|
| 3/2 | 2026/08/11 17:31 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2454 output: 19 thoughts: 303 Thoughts: **Analyzing the Airoha NPU Driver Patch** Okay, so I've got this patch that tweaks the `airoha_npu.c` driver. Seems like they're primarily focusing on error handling and improving firmware loading. The key changes are: replacing `request_firmware` with `request_firmware_direct`, and then some additions and removals of `dev_err_probe` calls. It appears they are now using `dev_err_probe` where appropriate and removing it where the function itself handles the error and returns. First thought is to understand what we're dealing with: this is an Airoha EN7581 SoC network driver. Right, a platform device driver, which usually means it's pretty tightly coupled to that specific hardware. Getting this thing to trigger in a virtualized environment like QEMU would likely be tricky, unless there's a specific emulation available for that particular SoC. The `airoha_npu_probe` function takes a `struct platform_device *pdev` which is a good clue that it's tightly coupled to the hardware. So, is this even worth fuzzing? The changes are mainly concerned with better error logging and the firmware loading mechanism. Switching to `request_firmware_direct` is interesting - it avoids that user-mode helper fallback. This might make the code more efficient, or even expose new attack surfaces, but the primary focus seems to be on hardening the driver. I will have to check the Kconfig file to confirm whether it is easily enabled. |
| 4/2 | 2026/08/11 17:31 | tool | grepper |
0mArgs:{
"Expression": "airoha_npu"
}Results: {
"Output": "\nFull output is too long, showing 500 out of 703 lines.\nUse more precise expression if possible.\n\ndrivers/net/ethernet/airoha/Makefile=8=airoha-eth-$(CONFIG_DEBUG_FS) += airoha_ppe_debugfs.o\ndrivers/net/ethernet/airoha/Makefile:9:obj-$(CONFIG_NET_AIROHA_NPU) += airoha_npu.o\n--\ndrivers/net/ethernet/airoha/airoha_eth.h=638=struct airoha_eth {\n--\ndrivers/net/ethernet/airoha/airoha_eth.h-645-\ndrivers/net/ethernet/airoha/airoha_eth.h:646:\tstruct airoha_npu __rcu *npu;\ndrivers/net/ethernet/airoha/airoha_eth.h-647-\n--\ndrivers/net/ethernet/airoha/airoha_npu.c=105=enum {\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-109-\ndrivers/net/ethernet/airoha/airoha_npu.c:110:struct airoha_npu_fw {\ndrivers/net/ethernet/airoha/airoha_npu.c-111-\tconst char *name;\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-114-\ndrivers/net/ethernet/airoha/airoha_npu.c:115:struct airoha_npu_soc_data {\ndrivers/net/ethernet/airoha/airoha_npu.c:116:\tstruct airoha_npu_fw fw_rv32;\ndrivers/net/ethernet/airoha/airoha_npu.c:117:\tstruct airoha_npu_fw fw_data;\ndrivers/net/ethernet/airoha/airoha_npu.c-118-};\n--\ndrivers/net/ethernet/airoha/airoha_npu.c=156=struct wlan_mbox_data {\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-162-\ndrivers/net/ethernet/airoha/airoha_npu.c:163:static int airoha_npu_send_msg(struct airoha_npu *npu, int func_id,\ndrivers/net/ethernet/airoha/airoha_npu.c-164-\t\t\t void *p, int size)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-198-\ndrivers/net/ethernet/airoha/airoha_npu.c:199:static int airoha_npu_load_firmware(struct device *dev, void __iomem *addr,\ndrivers/net/ethernet/airoha/airoha_npu.c-200-\t\t\t\t const char *fw_name, int fw_max_size)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c=224=static int\ndrivers/net/ethernet/airoha/airoha_npu.c:225:airoha_npu_load_firmware_from_dts(struct device *dev, void __iomem *addr,\ndrivers/net/ethernet/airoha/airoha_npu.c-226-\t\t\t\t void __iomem *base)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-236-\ndrivers/net/ethernet/airoha/airoha_npu.c:237:\tret = airoha_npu_load_firmware(dev, addr, fw_names[0],\ndrivers/net/ethernet/airoha/airoha_npu.c-238-\t\t\t\t NPU_EN7581_FIRMWARE_RV32_MAX_SIZE);\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-241-\ndrivers/net/ethernet/airoha/airoha_npu.c:242:\treturn airoha_npu_load_firmware(dev, base + REG_NPU_LOCAL_SRAM,\ndrivers/net/ethernet/airoha/airoha_npu.c-243-\t\t\t\t\tfw_names[1],\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-246-\ndrivers/net/ethernet/airoha/airoha_npu.c:247:static int airoha_npu_run_firmware(struct device *dev, void __iomem *base,\ndrivers/net/ethernet/airoha/airoha_npu.c-248-\t\t\t\t struct resource *res)\ndrivers/net/ethernet/airoha/airoha_npu.c-249-{\ndrivers/net/ethernet/airoha/airoha_npu.c:250:\tconst struct airoha_npu_soc_data *soc;\ndrivers/net/ethernet/airoha/airoha_npu.c-251-\tvoid __iomem *addr;\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-265-\tif (of_find_property(dev-\u003eof_node, \"firmware-name\", NULL))\ndrivers/net/ethernet/airoha/airoha_npu.c:266:\t\treturn airoha_npu_load_firmware_from_dts(dev, addr, base);\ndrivers/net/ethernet/airoha/airoha_npu.c-267-\ndrivers/net/ethernet/airoha/airoha_npu.c-268-\t/* Load rv32 npu firmware */\ndrivers/net/ethernet/airoha/airoha_npu.c:269:\tret = airoha_npu_load_firmware(dev, addr, soc-\u003efw_rv32.name,\ndrivers/net/ethernet/airoha/airoha_npu.c-270-\t\t\t\t soc-\u003efw_rv32.max_size);\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-274-\t/* Load data npu firmware */\ndrivers/net/ethernet/airoha/airoha_npu.c:275:\treturn airoha_npu_load_firmware(dev, base + REG_NPU_LOCAL_SRAM,\ndrivers/net/ethernet/airoha/airoha_npu.c-276-\t\t\t\t\tsoc-\u003efw_data.name,\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-279-\ndrivers/net/ethernet/airoha/airoha_npu.c:280:static irqreturn_t airoha_npu_mbox_handler(int irq, void *npu_instance)\ndrivers/net/ethernet/airoha/airoha_npu.c-281-{\ndrivers/net/ethernet/airoha/airoha_npu.c:282:\tstruct airoha_npu *npu = npu_instance;\ndrivers/net/ethernet/airoha/airoha_npu.c-283-\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-294-\ndrivers/net/ethernet/airoha/airoha_npu.c:295:static void airoha_npu_wdt_work(struct work_struct *work)\ndrivers/net/ethernet/airoha/airoha_npu.c-296-{\ndrivers/net/ethernet/airoha/airoha_npu.c:297:\tstruct airoha_npu_core *core;\ndrivers/net/ethernet/airoha/airoha_npu.c:298:\tstruct airoha_npu *npu;\ndrivers/net/ethernet/airoha/airoha_npu.c-299-\tvoid *dump;\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-302-\ndrivers/net/ethernet/airoha/airoha_npu.c:303:\tcore = container_of(work, struct airoha_npu_core, wdt_work);\ndrivers/net/ethernet/airoha/airoha_npu.c-304-\tnpu = core-\u003enpu;\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-317-\ndrivers/net/ethernet/airoha/airoha_npu.c:318:static irqreturn_t airoha_npu_wdt_handler(int irq, void *core_instance)\ndrivers/net/ethernet/airoha/airoha_npu.c-319-{\ndrivers/net/ethernet/airoha/airoha_npu.c:320:\tstruct airoha_npu_core *core = core_instance;\ndrivers/net/ethernet/airoha/airoha_npu.c:321:\tstruct airoha_npu *npu = core-\u003enpu;\ndrivers/net/ethernet/airoha/airoha_npu.c-322-\tint c = core - \u0026npu-\u003ecores[0];\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-332-\ndrivers/net/ethernet/airoha/airoha_npu.c:333:static int airoha_npu_ppe_init(struct airoha_npu *npu)\ndrivers/net/ethernet/airoha/airoha_npu.c-334-{\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-346-\ndrivers/net/ethernet/airoha/airoha_npu.c:347:\terr = airoha_npu_send_msg(npu, NPU_FUNC_PPE, ppe_data,\ndrivers/net/ethernet/airoha/airoha_npu.c-348-\t\t\t\t sizeof(*ppe_data));\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-353-\ndrivers/net/ethernet/airoha/airoha_npu.c:354:static int airoha_npu_ppe_deinit(struct airoha_npu *npu)\ndrivers/net/ethernet/airoha/airoha_npu.c-355-{\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-365-\ndrivers/net/ethernet/airoha/airoha_npu.c:366:\terr = airoha_npu_send_msg(npu, NPU_FUNC_PPE, ppe_data,\ndrivers/net/ethernet/airoha/airoha_npu.c-367-\t\t\t\t sizeof(*ppe_data));\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-372-\ndrivers/net/ethernet/airoha/airoha_npu.c:373:static int airoha_npu_ppe_flush_sram_entries(struct airoha_npu *npu,\ndrivers/net/ethernet/airoha/airoha_npu.c-374-\t\t\t\t\t dma_addr_t foe_addr,\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-389-\ndrivers/net/ethernet/airoha/airoha_npu.c:390:\terr = airoha_npu_send_msg(npu, NPU_FUNC_PPE, ppe_data,\ndrivers/net/ethernet/airoha/airoha_npu.c-391-\t\t\t\t sizeof(*ppe_data));\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-396-\ndrivers/net/ethernet/airoha/airoha_npu.c:397:static int airoha_npu_foe_commit_entry(struct airoha_npu *npu,\ndrivers/net/ethernet/airoha/airoha_npu.c-398-\t\t\t\t dma_addr_t foe_addr,\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-414-\ndrivers/net/ethernet/airoha/airoha_npu.c:415:\terr = airoha_npu_send_msg(npu, NPU_FUNC_PPE, ppe_data,\ndrivers/net/ethernet/airoha/airoha_npu.c-416-\t\t\t\t sizeof(*ppe_data));\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-423-\ndrivers/net/ethernet/airoha/airoha_npu.c:424:\terr = airoha_npu_send_msg(npu, NPU_FUNC_PPE, ppe_data,\ndrivers/net/ethernet/airoha/airoha_npu.c-425-\t\t\t\t sizeof(*ppe_data));\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-431-\ndrivers/net/ethernet/airoha/airoha_npu.c:432:static int airoha_npu_ppe_stats_setup(struct airoha_npu *npu,\ndrivers/net/ethernet/airoha/airoha_npu.c-433-\t\t\t\t dma_addr_t foe_stats_addr,\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-446-\ndrivers/net/ethernet/airoha/airoha_npu.c:447:\terr = airoha_npu_send_msg(npu, NPU_FUNC_PPE, ppe_data,\ndrivers/net/ethernet/airoha/airoha_npu.c-448-\t\t\t\t sizeof(*ppe_data));\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-462-\ndrivers/net/ethernet/airoha/airoha_npu.c:463:static int airoha_npu_wlan_msg_send(struct airoha_npu *npu, int ifindex,\ndrivers/net/ethernet/airoha/airoha_npu.c:464:\t\t\t\t enum airoha_npu_wlan_set_cmd func_id,\ndrivers/net/ethernet/airoha/airoha_npu.c-465-\t\t\t\t void *data, int data_len, gfp_t gfp)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-479-\ndrivers/net/ethernet/airoha/airoha_npu.c:480:\terr = airoha_npu_send_msg(npu, NPU_FUNC_WIFI, wlan_data, len);\ndrivers/net/ethernet/airoha/airoha_npu.c-481-\tkfree(wlan_data);\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-485-\ndrivers/net/ethernet/airoha/airoha_npu.c:486:static int airoha_npu_wlan_msg_get(struct airoha_npu *npu, int ifindex,\ndrivers/net/ethernet/airoha/airoha_npu.c:487:\t\t\t\t enum airoha_npu_wlan_get_cmd func_id,\ndrivers/net/ethernet/airoha/airoha_npu.c-488-\t\t\t\t void *data, int data_len, gfp_t gfp)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-501-\ndrivers/net/ethernet/airoha/airoha_npu.c:502:\terr = airoha_npu_send_msg(npu, NPU_FUNC_WIFI, wlan_data, len);\ndrivers/net/ethernet/airoha/airoha_npu.c-503-\tif (!err)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c=510=static int\ndrivers/net/ethernet/airoha/airoha_npu.c:511:airoha_npu_wlan_set_reserved_memory(struct airoha_npu *npu,\ndrivers/net/ethernet/airoha/airoha_npu.c-512-\t\t\t\t int ifindex, const char *name,\ndrivers/net/ethernet/airoha/airoha_npu.c:513:\t\t\t\t enum airoha_npu_wlan_set_cmd func_id)\ndrivers/net/ethernet/airoha/airoha_npu.c-514-{\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-525-\tval = res.start;\ndrivers/net/ethernet/airoha/airoha_npu.c:526:\treturn airoha_npu_wlan_msg_send(npu, ifindex, func_id, \u0026val,\ndrivers/net/ethernet/airoha/airoha_npu.c-527-\t\t\t\t\tsizeof(val), GFP_KERNEL);\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-529-\ndrivers/net/ethernet/airoha/airoha_npu.c:530:static int airoha_npu_wlan_init_memory(struct airoha_npu *npu)\ndrivers/net/ethernet/airoha/airoha_npu.c-531-{\ndrivers/net/ethernet/airoha/airoha_npu.c:532:\tenum airoha_npu_wlan_set_cmd cmd = WLAN_FUNC_SET_WAIT_NPU_BAND0_ONCPU;\ndrivers/net/ethernet/airoha/airoha_npu.c-533-\tu32 val = 0;\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-535-\ndrivers/net/ethernet/airoha/airoha_npu.c:536:\terr = airoha_npu_wlan_msg_send(npu, 1, cmd, \u0026val, sizeof(val),\ndrivers/net/ethernet/airoha/airoha_npu.c-537-\t\t\t\t GFP_KERNEL);\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-541-\tcmd = WLAN_FUNC_SET_WAIT_TX_BUF_CHECK_ADDR;\ndrivers/net/ethernet/airoha/airoha_npu.c:542:\terr = airoha_npu_wlan_set_reserved_memory(npu, 0, \"tx-bufid\", cmd);\ndrivers/net/ethernet/airoha/airoha_npu.c-543-\tif (err)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-546-\tcmd = WLAN_FUNC_SET_WAIT_PKT_BUF_ADDR;\ndrivers/net/ethernet/airoha/airoha_npu.c:547:\terr = airoha_npu_wlan_set_reserved_memory(npu, 0, \"pkt\", cmd);\ndrivers/net/ethernet/airoha/airoha_npu.c-548-\tif (err)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-551-\tcmd = WLAN_FUNC_SET_WAIT_TX_PKT_BUF_ADDR;\ndrivers/net/ethernet/airoha/airoha_npu.c:552:\terr = airoha_npu_wlan_set_reserved_memory(npu, 0, \"tx-pkt\", cmd);\ndrivers/net/ethernet/airoha/airoha_npu.c-553-\tif (err)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-558-\t\tcmd = WLAN_FUNC_SET_WAIT_DRAM_BA_NODE_ADDR;\ndrivers/net/ethernet/airoha/airoha_npu.c:559:\t\terr = airoha_npu_wlan_set_reserved_memory(npu, 0, \"ba\", cmd);\ndrivers/net/ethernet/airoha/airoha_npu.c-560-\t\tif (err)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-564-\tcmd = WLAN_FUNC_SET_WAIT_IS_FORCE_TO_CPU;\ndrivers/net/ethernet/airoha/airoha_npu.c:565:\treturn airoha_npu_wlan_msg_send(npu, 0, cmd, \u0026val, sizeof(val),\ndrivers/net/ethernet/airoha/airoha_npu.c-566-\t\t\t\t\tGFP_KERNEL);\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-568-\ndrivers/net/ethernet/airoha/airoha_npu.c:569:static u32 airoha_npu_wlan_queue_addr_get(struct airoha_npu *npu, int qid,\ndrivers/net/ethernet/airoha/airoha_npu.c-570-\t\t\t\t\t bool xmit)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-577-\ndrivers/net/ethernet/airoha/airoha_npu.c:578:static void airoha_npu_wlan_irq_status_set(struct airoha_npu *npu, u32 val)\ndrivers/net/ethernet/airoha/airoha_npu.c-579-{\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-582-\ndrivers/net/ethernet/airoha/airoha_npu.c:583:static u32 airoha_npu_wlan_irq_status_get(struct airoha_npu *npu, int q)\ndrivers/net/ethernet/airoha/airoha_npu.c-584-{\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-590-\ndrivers/net/ethernet/airoha/airoha_npu.c:591:static void airoha_npu_wlan_irq_enable(struct airoha_npu *npu, int q)\ndrivers/net/ethernet/airoha/airoha_npu.c-592-{\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-595-\ndrivers/net/ethernet/airoha/airoha_npu.c:596:static void airoha_npu_wlan_irq_disable(struct airoha_npu *npu, int q)\ndrivers/net/ethernet/airoha/airoha_npu.c-597-{\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-600-\ndrivers/net/ethernet/airoha/airoha_npu.c:601:struct airoha_npu *airoha_npu_get(struct device *dev)\ndrivers/net/ethernet/airoha/airoha_npu.c-602-{\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-604-\tstruct device_node *np;\ndrivers/net/ethernet/airoha/airoha_npu.c:605:\tstruct airoha_npu *npu;\ndrivers/net/ethernet/airoha/airoha_npu.c-606-\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-648-}\ndrivers/net/ethernet/airoha/airoha_npu.c:649:EXPORT_SYMBOL_GPL(airoha_npu_get);\ndrivers/net/ethernet/airoha/airoha_npu.c-650-\ndrivers/net/ethernet/airoha/airoha_npu.c:651:void airoha_npu_put(struct airoha_npu *npu)\ndrivers/net/ethernet/airoha/airoha_npu.c-652-{\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-655-}\ndrivers/net/ethernet/airoha/airoha_npu.c:656:EXPORT_SYMBOL_GPL(airoha_npu_put);\ndrivers/net/ethernet/airoha/airoha_npu.c-657-\ndrivers/net/ethernet/airoha/airoha_npu.c:658:static const struct airoha_npu_soc_data en7581_npu_soc_data = {\ndrivers/net/ethernet/airoha/airoha_npu.c-659-\t.fw_rv32 = {\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-668-\ndrivers/net/ethernet/airoha/airoha_npu.c:669:static const struct airoha_npu_soc_data an7583_npu_soc_data = {\ndrivers/net/ethernet/airoha/airoha_npu.c-670-\t.fw_rv32 = {\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-679-\ndrivers/net/ethernet/airoha/airoha_npu.c:680:static const struct of_device_id of_airoha_npu_match[] = {\ndrivers/net/ethernet/airoha/airoha_npu.c-681-\t{ .compatible = \"airoha,en7581-npu\", .data = \u0026en7581_npu_soc_data },\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-684-};\ndrivers/net/ethernet/airoha/airoha_npu.c:685:MODULE_DEVICE_TABLE(of, of_airoha_npu_match);\ndrivers/net/ethernet/airoha/airoha_npu.c-686-\ndrivers/net/ethernet/airoha/airoha_npu.c=687=static const struct regmap_config regmap_config = {\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-694-\ndrivers/net/ethernet/airoha/airoha_npu.c:695:static int airoha_npu_probe(struct platform_device *pdev)\ndrivers/net/ethernet/airoha/airoha_npu.c-696-{\ndrivers/net/ethernet/airoha/airoha_npu.c-697-\tstruct device *dev = \u0026pdev-\u003edev;\ndrivers/net/ethernet/airoha/airoha_npu.c:698:\tstruct airoha_npu *npu;\ndrivers/net/ethernet/airoha/airoha_npu.c-699-\tstruct resource res;\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-712-\tnpu-\u003edev = dev;\ndrivers/net/ethernet/airoha/airoha_npu.c:713:\tnpu-\u003eops.ppe_init = airoha_npu_ppe_init;\ndrivers/net/ethernet/airoha/airoha_npu.c:714:\tnpu-\u003eops.ppe_deinit = airoha_npu_ppe_deinit;\ndrivers/net/ethernet/airoha/airoha_npu.c:715:\tnpu-\u003eops.ppe_init_stats = airoha_npu_ppe_stats_setup;\ndrivers/net/ethernet/airoha/airoha_npu.c:716:\tnpu-\u003eops.ppe_flush_sram_entries = airoha_npu_ppe_flush_sram_entries;\ndrivers/net/ethernet/airoha/airoha_npu.c:717:\tnpu-\u003eops.ppe_foe_commit_entry = airoha_npu_foe_commit_entry;\ndrivers/net/ethernet/airoha/airoha_npu.c:718:\tnpu-\u003eops.wlan_init_reserved_memory = airoha_npu_wlan_init_memory;\ndrivers/net/ethernet/airoha/airoha_npu.c:719:\tnpu-\u003eops.wlan_send_msg = airoha_npu_wlan_msg_send;\ndrivers/net/ethernet/airoha/airoha_npu.c:720:\tnpu-\u003eops.wlan_get_msg = airoha_npu_wlan_msg_get;\ndrivers/net/ethernet/airoha/airoha_npu.c:721:\tnpu-\u003eops.wlan_get_queue_addr = airoha_npu_wlan_queue_addr_get;\ndrivers/net/ethernet/airoha/airoha_npu.c:722:\tnpu-\u003eops.wlan_set_irq_status = airoha_npu_wlan_irq_status_set;\ndrivers/net/ethernet/airoha/airoha_npu.c:723:\tnpu-\u003eops.wlan_get_irq_status = airoha_npu_wlan_irq_status_get;\ndrivers/net/ethernet/airoha/airoha_npu.c:724:\tnpu-\u003eops.wlan_enable_irq = airoha_npu_wlan_irq_enable;\ndrivers/net/ethernet/airoha/airoha_npu.c:725:\tnpu-\u003eops.wlan_disable_irq = airoha_npu_wlan_irq_disable;\ndrivers/net/ethernet/airoha/airoha_npu.c-726-\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-738-\ndrivers/net/ethernet/airoha/airoha_npu.c:739:\terr = devm_request_irq(dev, irq, airoha_npu_mbox_handler,\ndrivers/net/ethernet/airoha/airoha_npu.c-740-\t\t\t IRQF_SHARED, \"airoha-npu-mbox\", npu);\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-744-\tfor (i = 0; i \u003c ARRAY_SIZE(npu-\u003ecores); i++) {\ndrivers/net/ethernet/airoha/airoha_npu.c:745:\t\tstruct airoha_npu_core *core = \u0026npu-\u003ecores[i];\ndrivers/net/ethernet/airoha/airoha_npu.c-746-\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-753-\ndrivers/net/ethernet/airoha/airoha_npu.c:754:\t\terr = devm_request_irq(dev, irq, airoha_npu_wdt_handler,\ndrivers/net/ethernet/airoha/airoha_npu.c-755-\t\t\t\t IRQF_SHARED, \"airoha-npu-wdt\", core);\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-758-\ndrivers/net/ethernet/airoha/airoha_npu.c:759:\t\tINIT_WORK(\u0026core-\u003ewdt_work, airoha_npu_wdt_work);\ndrivers/net/ethernet/airoha/airoha_npu.c-760-\t}\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-774-\ndrivers/net/ethernet/airoha/airoha_npu.c:775:\terr = airoha_npu_run_firmware(dev, base, \u0026res);\ndrivers/net/ethernet/airoha/airoha_npu.c-776-\tif (err)\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-795-\ndrivers/net/ethernet/airoha/airoha_npu.c:796:\tif (!airoha_npu_wlan_msg_get(npu, 0, WLAN_FUNC_GET_WAIT_NPU_VERSION,\ndrivers/net/ethernet/airoha/airoha_npu.c-797-\t\t\t\t \u0026val, sizeof(val), GFP_KERNEL))\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-805-\ndrivers/net/ethernet/airoha/airoha_npu.c:806:static void airoha_npu_remove(struct platform_device *pdev)\ndrivers/net/ethernet/airoha/airoha_npu.c-807-{\ndrivers/net/ethernet/airoha/airoha_npu.c:808:\tstruct airoha_npu *npu = platform_get_drvdata(pdev);\ndrivers/net/ethernet/airoha/airoha_npu.c-809-\tint i;\n--\ndrivers/net/ethernet/airoha/airoha_npu.c-814-\ndrivers/net/ethernet/airoha/airoha_npu.c:815:static struct platform_driver airoha_npu_driver = {\ndrivers/net/ethernet/airoha/airoha_npu.c:816:\t.probe = airoha_npu_probe,\ndrivers/net/ethernet/airoha/airoha_npu.c:817:\t.remove = airoha_npu_remove,\ndrivers/net/ethernet/airoha/airoha_npu.c-818-\t.driver = {\ndrivers/net/ethernet/airoha/airoha_npu.c-819-\t\t.name = \"airoha-npu\",\ndrivers/net/ethernet/airoha/airoha_npu.c:820:\t\t.of_match_table = of_airoha_npu_match,\ndrivers/net/ethernet/airoha/airoha_npu.c-821-\t},\ndrivers/net/ethernet/airoha/airoha_npu.c-822-};\ndrivers/net/ethernet/airoha/airoha_npu.c:823:module_platform_driver(airoha_npu_driver);\ndrivers/net/ethernet/airoha/airoha_npu.c-824-\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c=598=static void airoha_ppe_foe_flow_stat_entry_reset(struct airoha_ppe *ppe,\ndrivers/net/ethernet/airoha/airoha_ppe.c:599:\t\t\t\t\t\t struct airoha_npu *npu,\ndrivers/net/ethernet/airoha/airoha_ppe.c-600-\t\t\t\t\t\t int index)\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c=606=static void airoha_ppe_foe_flow_stats_reset(struct airoha_ppe *ppe,\ndrivers/net/ethernet/airoha/airoha_ppe.c:607:\t\t\t\t\t struct airoha_npu *npu)\ndrivers/net/ethernet/airoha/airoha_ppe.c-608-{\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c=619=static void airoha_ppe_foe_flow_stats_update(struct airoha_ppe *ppe,\ndrivers/net/ethernet/airoha/airoha_ppe.c:620:\t\t\t\t\t struct airoha_npu *npu,\ndrivers/net/ethernet/airoha/airoha_ppe.c-621-\t\t\t\t\t struct airoha_foe_entry *hwe,\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c=756=static int airoha_ppe_foe_commit_entry(struct airoha_ppe *ppe,\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c-763-\tstruct airoha_eth *eth = ppe-\u003eeth;\ndrivers/net/ethernet/airoha/airoha_ppe.c:764:\tstruct airoha_npu *npu;\ndrivers/net/ethernet/airoha/airoha_ppe.c-765-\tint err = 0;\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c=1292=void airoha_ppe_foe_entry_get_stats(struct airoha_ppe *ppe, u32 hash,\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c-1296-\tint ppe_num_stats_entries;\ndrivers/net/ethernet/airoha/airoha_ppe.c:1297:\tstruct airoha_npu *npu;\ndrivers/net/ethernet/airoha/airoha_ppe.c-1298-\tu32 index;\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c=1370=static int airoha_ppe_flush_sram_entries(struct airoha_ppe *ppe)\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c-1387-\ndrivers/net/ethernet/airoha/airoha_ppe.c:1388:static struct airoha_npu *airoha_ppe_npu_get(struct airoha_eth *eth)\ndrivers/net/ethernet/airoha/airoha_ppe.c-1389-{\ndrivers/net/ethernet/airoha/airoha_ppe.c:1390:\tstruct airoha_npu *npu = airoha_npu_get(eth-\u003edev);\ndrivers/net/ethernet/airoha/airoha_ppe.c-1391-\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c-1393-\t\trequest_module(\"airoha-npu\");\ndrivers/net/ethernet/airoha/airoha_ppe.c:1394:\t\tnpu = airoha_npu_get(eth-\u003edev);\ndrivers/net/ethernet/airoha/airoha_ppe.c-1395-\t}\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c=1423=static int airoha_ppe_offload_setup(struct airoha_eth *eth)\ndrivers/net/ethernet/airoha/airoha_ppe.c-1424-{\ndrivers/net/ethernet/airoha/airoha_ppe.c:1425:\tstruct airoha_npu *npu = airoha_ppe_npu_get(eth);\ndrivers/net/ethernet/airoha/airoha_ppe.c-1426-\tstruct airoha_ppe *ppe = eth-\u003eppe;\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c-1457-error_npu_put:\ndrivers/net/ethernet/airoha/airoha_ppe.c:1458:\tairoha_npu_put(npu);\ndrivers/net/ethernet/airoha/airoha_ppe.c-1459-\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c=1653=void airoha_ppe_deinit(struct airoha_eth *eth)\ndrivers/net/ethernet/airoha/airoha_ppe.c-1654-{\ndrivers/net/ethernet/airoha/airoha_ppe.c:1655:\tstruct airoha_npu *npu;\ndrivers/net/ethernet/airoha/airoha_ppe.c-1656-\n--\ndrivers/net/ethernet/airoha/airoha_ppe.c-1663-\t\tnpu-\u003eops.ppe_deinit(npu);\ndrivers/net/ethernet/airoha/airoha_ppe.c:1664:\t\tairoha_npu_put(npu);\ndrivers/net/ethernet/airoha/airoha_ppe.c-1665-\t}\n--\ndrivers/net/wireless/mediatek/mt76/dma.c=802=mt76_dma_alloc_queue(struct mt76_dev *dev, struct mt76_queue *q,\n--\ndrivers/net/wireless/mediatek/mt76/dma.c-819-\telse if (mt76_queue_is_npu_tx(q))\ndrivers/net/wireless/mediatek/mt76/dma.c:820:\t\tsize = sizeof(struct airoha_npu_tx_dma_desc);\ndrivers/net/wireless/mediatek/mt76/dma.c-821-\telse if (mt76_queue_is_npu_rx(q))\ndrivers/net/wireless/mediatek/mt76/dma.c:822:\t\tsize = sizeof(struct airoha_npu_rx_dma_desc);\ndrivers/net/wireless/mediatek/mt76/dma.c-823-\telse\n--\ndrivers/net/wireless/mediatek/mt76/dma.h-78-\tif ((_q)-\u003eflags \u0026 MT_QFLAG_NPU) {\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/dma.h:79:\t\tstruct airoha_npu *npu;\t\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/dma.h-80-\t\t\t\t\t\t\t\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/dma.h-95-\tif ((_q)-\u003eflags \u0026 MT_QFLAG_NPU) {\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/dma.h:96:\t\tstruct airoha_npu *npu;\t\t\t\t\t\\\ndrivers/net/wireless/mediatek/mt76/dma.h-97-\t\t\t\t\t\t\t\t\t\\\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=715=struct mt76_mmio {\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-725-\tstruct airoha_ppe_dev __rcu *ppe_dev;\ndrivers/net/wireless/mediatek/mt76/mt76.h:726:\tstruct airoha_npu __rcu *npu;\ndrivers/net/wireless/mediatek/mt76/mt76.h-727-\tphys_addr_t phy_addr;\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h=1742=static inline bool mt76_ppe_device_active(struct mt76_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1746-\ndrivers/net/wireless/mediatek/mt76/mt76.h:1747:static inline int mt76_npu_send_msg(struct airoha_npu *npu, int ifindex,\ndrivers/net/wireless/mediatek/mt76/mt76.h:1748:\t\t\t\t enum airoha_npu_wlan_set_cmd cmd,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1749-\t\t\t\t u32 val, gfp_t gfp)\ndrivers/net/wireless/mediatek/mt76/mt76.h-1750-{\ndrivers/net/wireless/mediatek/mt76/mt76.h:1751:\treturn airoha_npu_wlan_send_msg(npu, ifindex, cmd, \u0026val, sizeof(val),\ndrivers/net/wireless/mediatek/mt76/mt76.h-1752-\t\t\t\t\tgfp);\n--\ndrivers/net/wireless/mediatek/mt76/mt76.h-1754-\ndrivers/net/wireless/mediatek/mt76/mt76.h:1755:static inline int mt76_npu_get_msg(struct airoha_npu *npu, int ifindex,\ndrivers/net/wireless/mediatek/mt76/mt76.h:1756:\t\t\t\t enum airoha_npu_wlan_get_cmd cmd,\ndrivers/net/wireless/mediatek/mt76/mt76.h-1757-\t\t\t\t u32 *val, gfp_t gfp)\ndrivers/net/wireless/mediatek/mt76/mt76.h-1758-{\ndrivers/net/wireless/mediatek/mt76/mt76.h:1759:\treturn airoha_npu_wlan_get_msg(npu, ifindex, cmd, val, sizeof(*val),\ndrivers/net/wireless/mediatek/mt76/mt76.h-1760-\t\t\t\t gfp);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c=707=static void mt7996_rx_poll_complete(struct mt76_dev *mdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-710-\tif (q == MT_RXQ_NPU0 || q == MT_RXQ_NPU1) {\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:711:\t\tstruct airoha_npu *npu;\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-712-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-714-\t\tif (npu)\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:715:\t\t\tairoha_npu_wlan_enable_irq(npu, q - MT_RXQ_NPU0);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-716-\t} else {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c=11=static int mt7992_npu_txrx_offload_init(struct mt7996_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:12:\t\t\t\t\tstruct airoha_npu *npu)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-13-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c=72=static int mt7996_npu_txrx_offload_init(struct mt7996_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:73:\t\t\t\t\tstruct airoha_npu *npu)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-74-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c=200=static int mt7996_npu_offload_init(struct mt7996_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:201:\t\t\t\t struct airoha_npu *npu)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-202-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-241-\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:242:static int mt7992_npu_rxd_init(struct mt7996_dev *dev, struct airoha_npu *npu)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-243-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-276-\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:277:static int mt7996_npu_rxd_init(struct mt7996_dev *dev, struct airoha_npu *npu)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-278-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-340-\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:341:static int mt7996_npu_txd_init(struct mt7996_dev *dev, struct airoha_npu *npu)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-342-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c=402=static int mt7996_npu_rx_event_init(struct mt7996_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:403:\t\t\t\t struct airoha_npu *npu)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-404-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c=437=static int mt7996_npu_set_pcie_addr(struct mt7996_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:438:\t\t\t\t struct airoha_npu *npu)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-439-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c=471=static int mt7996_npu_tx_done_init(struct mt7996_dev *dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:472:\t\t\t\t struct airoha_npu *npu)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-473-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c=516=int __mt7996_npu_hw_init(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-517-{\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:518:\tstruct airoha_npu *npu;\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-519-\tint i, err;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-553-\tfor (i = MT_RXQ_NPU0; i \u003c= MT_RXQ_NPU1; i++)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:554:\t\tairoha_npu_wlan_enable_irq(npu, i - MT_RXQ_NPU0);\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-555-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c=594=int mt7996_npu_hw_stop(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-595-{\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:596:\tstruct airoha_npu *npu;\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c-597-\tint i, err = 0;\n--\ndrivers/net/wireless/mediatek/mt76/npu.c=17=int mt76_npu_fill_rx_queue(struct mt76_dev *dev, struct mt76_queue *q)\n--\ndrivers/net/wireless/mediatek/mt76/npu.c-21-\twhile (q-\u003equeued \u003c q-\u003endesc - 1) {\ndrivers/net/wireless/mediatek/mt76/npu.c:22:\t\tstruct airoha_npu_rx_dma_desc *desc = (void *)q-\u003edesc;\ndrivers/net/wireless/mediatek/mt76/npu.c-23-\t\tstruct mt76_queue_entry *e = \u0026q-\u003eentry[q-\u003ehead];\n--\ndrivers/net/wireless/mediatek/mt76/npu.c=62=static struct sk_buff *mt76_npu_dequeue(struct mt76_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/npu.c-65-{\ndrivers/net/wireless/mediatek/mt76/npu.c:66:\tstruct airoha_npu_rx_dma_desc *desc = (void *)q-\u003edesc;\ndrivers/net/wireless/mediatek/mt76/npu.c-67-\tint i, nframes, index = q-\u003etail;\n--\ndrivers/net/wireless/mediatek/mt76/npu.c=144=static int mt76_npu_rx_poll(struct napi_struct *napi, int budget)\n--\ndrivers/net/wireless/mediatek/mt76/npu.c-147-\tenum mt76_rxq_id qid = napi - dev-\u003enapi;\ndrivers/net/wireless/mediatek/mt76/npu.c:148:\tstruct airoha_npu *npu;\ndrivers/net/wireless/mediatek/mt76/npu.c-149-\tint done = 0;\n--\ndrivers/net/wireless/mediatek/mt76/npu.c=180=static irqreturn_t mt76_npu_irq_handler(int irq, void *q_instance)\n--\ndrivers/net/wireless/mediatek/mt76/npu.c-185-\tint index = qid - MT_RXQ_NPU0;\ndrivers/net/wireless/mediatek/mt76/npu.c:186:\tstruct airoha_npu *npu;\ndrivers/net/wireless/mediatek/mt76/npu.c-187-\tu32 status;\n--\ndrivers/net/wireless/mediatek/mt76/npu.c-194-\ndrivers/net/wireless/mediatek/mt76/npu.c:195:\tstatus = airoha_npu_wlan_get_irq_status(npu, index);\ndrivers/net/wireless/mediatek/mt76/npu.c:196:\tairoha_npu_wlan_set_irq_status(npu, status);\ndrivers/net/wireless/mediatek/mt76/npu.c-197-\ndrivers/net/wireless/mediatek/mt76/npu.c:198:\tairoha_npu_wlan_disable_irq(npu, index);\ndrivers/net/wireless/mediatek/mt76/npu.c-199-\tnapi_schedule(\u0026dev-\u003enapi[qid]);\n--\ndrivers/net/wireless/mediatek/mt76/npu.c=206=int mt76_npu_dma_add_buf(struct mt76_phy *phy, struct mt76_queue *q,\n--\ndrivers/net/wireless/mediatek/mt76/npu.c-210-\tu16 txwi_len = min_t(u16, phy-\u003edev-\u003edrv-\u003etxwi_size, NPU_TXWI_LEN);\ndrivers/net/wireless/mediatek/mt76/npu.c:211:\tstruct airoha_npu_tx_dma_desc *desc = (void *)q-\u003edesc;\ndrivers/net/wireless/mediatek/mt76/npu.c-212-\tint ret;\n--\ndrivers/net/wireless/mediatek/mt76/npu.c=234=void mt76_npu_txdesc_cleanup(struct mt76_queue *q, int index)\ndrivers/net/wireless/mediatek/mt76/npu.c-235-{\ndrivers/net/wireless/mediatek/mt76/npu.c:236:\tstruct airoha_npu_tx_dma_desc *desc = (void *)q-\u003edesc;\ndrivers/net/wireless/mediatek/mt76/npu.c-237-\n\n"
} |
| 5/2 | 2026/08/11 17:31 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 17621 output: 22 thoughts: 122 Thoughts: **Analyzing the Airoha NPU Driver Landscape** Okay, so I'm digging into this Airoha NPU driver. My initial mental map shows it's integrated across a few different areas of the networking stack. Specifically, `drivers/net/ethernet/airoha/airoha_npu.c` and `drivers/net/ethernet/airoha/airoha_ppe.c` are using it, which is expected given the "ethernet" context. Intriguingly, it's *also* being employed in the Mediatek wireless space, specifically within `drivers/net/wireless/mediatek/mt76/mt7996/npu.c`. That's a point of potential synergy or, perhaps, a slightly more complex architecture to understand. The Kconfig file for the core Airoha NPU driver file, `airoha_npu.c`, is straightforward - it's controlled by `CONFIG_NET_AIROHA_NPU`. That's good; makes for easy enablement and disabling. Now, my next step is clear. To get a handle on the driver's general configuration, I need to check the relevant Kconfig file in `drivers/net/ethernet/airoha/Kconfig`. That'll be where the overarching options and dependencies are defined. |
| 6/2 | 2026/08/11 17:31 | tool | grepper |
0mArgs:{
"Expression": "NET_AIROHA_NPU"
}Results: {
"Output": "drivers/net/ethernet/airoha/Kconfig=8=if NET_VENDOR_AIROHA\ndrivers/net/ethernet/airoha/Kconfig-9-\ndrivers/net/ethernet/airoha/Kconfig:10:config NET_AIROHA_NPU\ndrivers/net/ethernet/airoha/Kconfig-11-\ttristate \"Airoha NPU support\"\n--\ndrivers/net/ethernet/airoha/Kconfig=18=config NET_AIROHA\n--\ndrivers/net/ethernet/airoha/Kconfig-20-\tdepends on NET_DSA || !NET_DSA\ndrivers/net/ethernet/airoha/Kconfig:21:\tselect NET_AIROHA_NPU\ndrivers/net/ethernet/airoha/Kconfig-22-\tselect PAGE_POOL\n--\ndrivers/net/ethernet/airoha/Kconfig=27=config NET_AIROHA_FLOW_STATS\n--\ndrivers/net/ethernet/airoha/Kconfig-29-\tbool \"Airoha flow stats\"\ndrivers/net/ethernet/airoha/Kconfig:30:\tdepends on NET_AIROHA \u0026\u0026 NET_AIROHA_NPU\ndrivers/net/ethernet/airoha/Kconfig-31-\thelp\n--\ndrivers/net/ethernet/airoha/Makefile=8=airoha-eth-$(CONFIG_DEBUG_FS) += airoha_ppe_debugfs.o\ndrivers/net/ethernet/airoha/Makefile:9:obj-$(CONFIG_NET_AIROHA_NPU) += airoha_npu.o\n--\ndrivers/net/wireless/mediatek/mt76/Kconfig=40=config MT76_NPU\ndrivers/net/wireless/mediatek/mt76/Kconfig-41-\ttristate\ndrivers/net/wireless/mediatek/mt76/Kconfig:42:\tdepends on NET_AIROHA_NPU=y || MT76_CORE=NET_AIROHA_NPU\ndrivers/net/wireless/mediatek/mt76/Kconfig-43-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig=16=config MT7996_NPU\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-18-\tdepends on MT7996E\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:19:\tdepends on NET_AIROHA_NPU=y || MT76_CORE=NET_AIROHA_NPU\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-20-\tselect MT76_NPU\n--\ninclude/linux/soc/airoha/airoha_offload.h=166=struct airoha_npu {\ninclude/linux/soc/airoha/airoha_offload.h:167:#if (IS_BUILTIN(CONFIG_NET_AIROHA_NPU) || IS_MODULE(CONFIG_NET_AIROHA_NPU))\ninclude/linux/soc/airoha/airoha_offload.h-168-\tstruct device *dev;\n--\ninclude/linux/soc/airoha/airoha_offload.h-210-\ninclude/linux/soc/airoha/airoha_offload.h:211:#if (IS_BUILTIN(CONFIG_NET_AIROHA_NPU) || IS_MODULE(CONFIG_NET_AIROHA_NPU))\ninclude/linux/soc/airoha/airoha_offload.h-212-struct airoha_npu *airoha_npu_get(struct device *dev);\n"
} |
| 7/2 | 2026/08/11 17:31 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 18973 output: 119 thoughts: 503 Thoughts: **WorthFuzzing=false: Airoha NPU Driver Patch Analysis** Okay, let's break this down. I'm looking at a patch that touches the initialization functions for the Airoha NPU driver: `airoha_npu_load_firmware`, `airoha_npu_load_firmware_from_dts`, and `airoha_npu_probe`. The key changes here are a switch from `request_firmware` to `request_firmware_direct`, and some additions or removals of `dev_err_probe`. Frankly, this doesn't scream "fuzzing target" to me. The alterations are primarily around error handling and logging – those `dev_err_probe` additions/removals are just that, logging modifications. The `request_firmware_direct` change is a bit more interesting, but it's still a specific API call during probe, and the functional difference is about avoiding the user-mode helper for firmware loading. But user-mode helpers are usually disabled these days and even if enabled, this is a narrow probe-time change. Here's the kicker: This is a platform driver for an Airoha EN7581 SoC, specifically identified by the device tree node `"airoha,en7581-npu"`. As a platform driver for this very specific SoC, this code path is unreachable in typical virtualized environments like QEMU or GCE unless there's specific emulation for this particular Airoha NPU. And I'm pretty certain there isn't. Now, let's recall the instructions. We're told to set `WorthFuzzing=false` if the patch involves things like documentation, Kconfig changes, code comments, purely decorative logging, changes to numeric constants/macros that don't alter execution flow, or code paths unreachable in virtualized environments. This patch ticks that box. The changes are mostly about logging, and the firmware loading API change occurs during probe for a platform driver. This means this is impossible to reach in standard virtualization setups. It's essentially the epitome of "unreachable code" in this context. Therefore, I'm confident in concluding: `WorthFuzzing=false`. |
| 8/2 | 2026/08/11 17:32 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies the probe and firmware loading functions of the Airoha NPU platform driver (for Airoha EN7581 SoC). Platform drivers for specific hardware SoCs are not reachable in generic virtualized environments like QEMU or GCE. Furthermore, the changes are mostly limited to error logging (dev_err_probe) and a minor API change (request_firmware to request_firmware_direct).",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies the probe and firmware loading functions of the Airoha NPU platform driver (for Airoha EN7581 SoC). Platform drivers for specific hardware SoCs are not reachable in generic virtualized environments like QEMU or GCE. Furthermore, the changes are mostly limited to error logging (dev_err_probe) and a minor API change (request_firmware to request_firmware_direct).",
"WorthFuzzing": false
} |
| 9/1 | 2026/08/11 17:32 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|