AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/06/28 10:04 flow patch-triage
0m Args:
null

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies LED registration logic for the Mediatek MT7996 wireless driver. LEDs are purely decorative and do not affect core execution flow. Furthermore, MT7996 is a specific hardware device (PCIe) that is not emulated in virtualized environments like QEMU or GCE, making these code paths unreachable during fuzzing.",
  "WorthFuzzing": false
}

1/1 2026/06/28 10:04 action read-patch-diff
0m Args:
null

Results:
{
  "PatchDiff": "commit 4e5dfb29e51092ca5d776a31cdfd9267716358f3\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Jun 28 10:04:46 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c\nindex 13c4e8abe28191..e56fb95ce4a7fd 100644\n--- a/drivers/net/wireless/mediatek/mt76/mac80211.c\n+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c\n@@ -228,11 +228,19 @@ static int mt76_led_init(struct mt76_phy *phy)\n \t\t wiphy_name(hw-\u003ewiphy));\n \n \tphy-\u003eleds.cdev.name = phy-\u003eleds.name;\n-\tphy-\u003eleds.cdev.default_trigger =\n-\t\tieee80211_create_tpt_led_trigger(hw,\n-\t\t\t\t\tIEEE80211_TPT_LEDTRIG_FL_RADIO,\n-\t\t\t\t\tmt76_tpt_blink,\n-\t\t\t\t\tARRAY_SIZE(mt76_tpt_blink));\n+\t/* The throughput trigger is created once per ieee80211_hw. Under\n+\t * single-wiphy MLO every band registers its own LED classdev for the\n+\t * same hw and the bands can come up in any order, so create the trigger\n+\t * on the first call, stash it on the primary phy and let the other bands\n+\t * reuse it; calling it again would trip a WARN_ON().\n+\t */\n+\tif (!dev-\u003ephy.leds.cdev.default_trigger)\n+\t\tdev-\u003ephy.leds.cdev.default_trigger =\n+\t\t\tieee80211_create_tpt_led_trigger(hw,\n+\t\t\t\t\t\t\t IEEE80211_TPT_LEDTRIG_FL_RADIO,\n+\t\t\t\t\t\t\t mt76_tpt_blink,\n+\t\t\t\t\t\t\t ARRAY_SIZE(mt76_tpt_blink));\n+\tphy-\u003eleds.cdev.default_trigger = dev-\u003ephy.leds.cdev.default_trigger;\n \n \tdev_info(dev-\u003edev,\n \t\t\"registering led '%s'\\n\", phy-\u003eleds.name);\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c\nindex d6f9aa1ab52d12..b77b85654acf04 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c\n@@ -472,6 +472,18 @@ mt7996_init_wiphy_band(struct ieee80211_hw *hw, struct mt7996_phy *phy)\n \tmt7996_set_stream_vht_txbf_caps(phy);\n \tmt7996_set_stream_he_eht_caps(phy);\n \tmt7996_init_txpower(phy);\n+\n+\t/* Register a LED classdev for every band, not just the primary one.\n+\t * Under single-wiphy MLO the 5/6 GHz bands are brought up through\n+\t * mt7996_register_phy(); without these callbacks mt76_led_init() skips\n+\t * them and only the 2.4 GHz LED is exposed. The hardware TX-blink path\n+\t * is already indexed by band_idx, so per-band blink works once the\n+\t * classdev exists.\n+\t */\n+\tif (IS_ENABLED(CONFIG_MT76_LEDS)) {\n+\t\tphy-\u003emt76-\u003eleds.cdev.brightness_set = mt7996_led_set_brightness;\n+\t\tphy-\u003emt76-\u003eleds.cdev.blink_set = mt7996_led_set_blink;\n+\t}\n }\n \n static void\n@@ -542,12 +554,6 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)\n \thw-\u003emax_tx_fragments = 4;\n \twiphy-\u003etxq_memory_limit = 32 \u003c\u003c 20; /* 32 MiB */\n \n-\t/* init led callbacks */\n-\tif (IS_ENABLED(CONFIG_MT76_LEDS)) {\n-\t\tdev-\u003emphy.leds.cdev.brightness_set = mt7996_led_set_brightness;\n-\t\tdev-\u003emphy.leds.cdev.blink_set = mt7996_led_set_blink;\n-\t}\n-\n \twiphy-\u003emax_scan_ssids = 4;\n \twiphy-\u003emax_scan_ie_len = IEEE80211_MAX_DATA_LEN;\n \n"
}

2/1 2026/06/28 10:04 agent patch-evaluator
0m Model:
gemini-3.1-pro-preview

Args:
null

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies LED registration logic for the Mediatek MT7996 wireless driver. LEDs are purely decorative and do not affect core execution flow. Furthermore, MT7996 is a specific hardware device (PCIe) that is not emulated in virtualized environments like QEMU or GCE, making these code paths unreachable during fuzzing.",
  "WorthFuzzing": false
}

Instruction:
You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt:
For your convenience, here is the diff of the changes:
commit 4e5dfb29e51092ca5d776a31cdfd9267716358f3
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Jun 28 10:04:46 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 13c4e8abe28191..e56fb95ce4a7fd 100644
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -228,11 +228,19 @@ static int mt76_led_init(struct mt76_phy *phy)
 		 wiphy_name(hw->wiphy));
 
 	phy->leds.cdev.name = phy->leds.name;
-	phy->leds.cdev.default_trigger =
-		ieee80211_create_tpt_led_trigger(hw,
-					IEEE80211_TPT_LEDTRIG_FL_RADIO,
-					mt76_tpt_blink,
-					ARRAY_SIZE(mt76_tpt_blink));
+	/* The throughput trigger is created once per ieee80211_hw. Under
+	 * single-wiphy MLO every band registers its own LED classdev for the
+	 * same hw and the bands can come up in any order, so create the trigger
+	 * on the first call, stash it on the primary phy and let the other bands
+	 * reuse it; calling it again would trip a WARN_ON().
+	 */
+	if (!dev->phy.leds.cdev.default_trigger)
+		dev->phy.leds.cdev.default_trigger =
+			ieee80211_create_tpt_led_trigger(hw,
+							 IEEE80211_TPT_LEDTRIG_FL_RADIO,
+							 mt76_tpt_blink,
+							 ARRAY_SIZE(mt76_tpt_blink));
+	phy->leds.cdev.default_trigger = dev->phy.leds.cdev.default_trigger;
 
 	dev_info(dev->dev,
 		"registering led '%s'\n", phy->leds.name);
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index d6f9aa1ab52d12..b77b85654acf04 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -472,6 +472,18 @@ mt7996_init_wiphy_band(struct ieee80211_hw *hw, struct mt7996_phy *phy)
 	mt7996_set_stream_vht_txbf_caps(phy);
 	mt7996_set_stream_he_eht_caps(phy);
 	mt7996_init_txpower(phy);
+
+	/* Register a LED classdev for every band, not just the primary one.
+	 * Under single-wiphy MLO the 5/6 GHz bands are brought up through
+	 * mt7996_register_phy(); without these callbacks mt76_led_init() skips
+	 * them and only the 2.4 GHz LED is exposed. The hardware TX-blink path
+	 * is already indexed by band_idx, so per-band blink works once the
+	 * classdev exists.
+	 */
+	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
+		phy->mt76->leds.cdev.brightness_set = mt7996_led_set_brightness;
+		phy->mt76->leds.cdev.blink_set = mt7996_led_set_blink;
+	}
 }
 
 static void
@@ -542,12 +554,6 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
 	hw->max_tx_fragments = 4;
 	wiphy->txq_memory_limit = 32 << 20; /* 32 MiB */
 
-	/* init led callbacks */
-	if (IS_ENABLED(CONFIG_MT76_LEDS)) {
-		dev->mphy.leds.cdev.brightness_set = mt7996_led_set_brightness;
-		dev->mphy.leds.cdev.blink_set = mt7996_led_set_blink;
-	}
-
 	wiphy->max_scan_ssids = 4;
 	wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
 

3/2 2026/06/28 10:04 llm patch-evaluator
0m Model:
gemini-3.1-pro-preview

Args:
null

Results:
null

Tokens:
							input: 2885
							output: 44
							thoughts: 238
						

Thoughts:
**Analyzing a MT76 Wireless Driver LED Initialization Patch**

Okay, so this patch is touching `mac80211.c` and `init.c` within the MT76 wireless driver, specifically the MT7996 variant. It's all about LED initialization. My immediate thought is, why are we messing with LEDs? Typically, they're not a high-priority fuzzing target, they're mostly cosmetic, and very hardware-dependent.

But wait, hold on a second. Could this initialization path *actually* be reachable in a virtualized environment? I need to think this through. The MT76 driver is, of course, for Mediatek wireless devices, but is the MT7996 chip a PCI, USB, or SDIO device? That's the critical question here. If it *is* virtualizable, then this becomes more interesting.

Let me take a look inside the `drivers/net/wireless/mediatek/mt76/mt7996/` directory to understand how the hardware is interfaced. I need to figure out if there's a possibility of simulating the hardware enough to reach this LED initialization code. If there is, it's worth a closer look at these changes. Moving LED callbacks initialization from `mt7996_init_wiphy` to `mt7996_init_wiphy_band` to register a LED classdev for every band is an interesting modification, and the change to `mt76_led_init` to only create the throughput trigger once per `ieee80211_hw` merits some deep investigation.



4/2 2026/06/28 10:05 tool grepper
0m Args:
{
  "Expression": "mt7996",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7996/"
}

Results:
{
  "Output": "\nFull output is too long, showing 500 out of 6522 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:3:obj-$(CONFIG_MT7996E) += mt7996e.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-4-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:5:mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \\\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-6-\t     debugfs.o mmio.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-7-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:8:mt7996e-$(CONFIG_MT7996_NPU) += npu.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:9:mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=12=MODULE_PARM_DESC(coredump_memdump, \"Optional ability to dump firmware memory\");\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-13-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:14:static const struct mt7996_mem_region mt7996_mem_regions[] = {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-15-\t{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-46-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:47:const struct mt7996_mem_region*\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:48:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-49-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-52-\tcase MT7996_DEVICE_ID_2:\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:53:\t\t*num = ARRAY_SIZE(mt7996_mem_regions);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:54:\t\treturn \u0026mt7996_mem_regions[0];\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-55-\tdefault:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-59-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:60:static int mt7996_coredump_get_mem_size(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-61-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:62:\tconst struct mt7996_mem_region *mem_region;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-63-\tsize_t size = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-66-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:67:\tmem_region = mt7996_coredump_get_mem_layout(dev, \u0026num);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-68-\tif (!mem_region)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-76-\t/* reserve space for the headers */\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:77:\tsize += num * sizeof(struct mt7996_mem_hdr);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-78-\t/* make sure it is aligned 4 bytes for debug message print out */\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-83-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:84:struct mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-85-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:86:\tstruct mt7996_crash_data *crash_data = dev-\u003ecoredump.crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-87-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=100=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:101:mt7996_coredump_fw_state(struct mt7996_dev *dev, struct mt7996_coredump *dump,\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-102-\t\t\t bool *exception)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=117=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:118:mt7996_coredump_fw_stack(struct mt7996_dev *dev, struct mt7996_coredump *dump,\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-119-\t\t\t bool exception)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-161-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:162:static struct mt7996_coredump *mt7996_coredump_build(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-163-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:164:\tstruct mt7996_crash_data *crash_data = dev-\u003ecoredump.crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:165:\tstruct mt7996_coredump *dump;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:166:\tstruct mt7996_coredump_mem *dump_mem;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-167-\tsize_t len, sofar = 0, hdr_len = sizeof(*dump);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-186-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:187:\tdump = (struct mt7996_coredump *)(buf);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-188-\tdump-\u003elen = len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-200-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:201:\tmt7996_coredump_fw_state(dev, dump, \u0026exception);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:202:\tmt7996_coredump_fw_stack(dev, dump, exception);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-203-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-204-\t/* gather memory content */\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:205:\tdump_mem = (struct mt7996_coredump_mem *)(buf + sofar);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-206-\tdump_mem-\u003elen = crash_data-\u003ememdump_buf_len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-215-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:216:int mt7996_coredump_submit(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-217-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:218:\tstruct mt7996_coredump *dump;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-219-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:220:\tdump = mt7996_coredump_build(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-221-\tif (!dump) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-230-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:231:int mt7996_coredump_register(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-232-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:233:\tstruct mt7996_crash_data *crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-234-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-241-\tif (coredump_memdump) {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:242:\t\tcrash_data-\u003ememdump_buf_len = mt7996_coredump_get_mem_size(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-243-\t\tif (!crash_data-\u003ememdump_buf_len)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-256-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:257:void mt7996_coredump_unregister(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-258-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-6-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:7:#include \"mt7996.h\"\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-8-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:9:struct mt7996_coredump {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-10-\tchar magic[16];\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-39-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:40:struct mt7996_coredump_mem {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-41-\tu32 len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-44-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:45:struct mt7996_mem_hdr {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-46-\tu32 start;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-50-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:51:struct mt7996_mem_region {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-52-\tu32 start;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-59-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:60:const struct mt7996_mem_region *\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:61:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:62:struct mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:63:int mt7996_coredump_submit(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:64:int mt7996_coredump_register(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:65:void mt7996_coredump_unregister(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-66-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-68-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:69:static inline const struct mt7996_mem_region *\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:70:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-71-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-74-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:75:static inline int mt7996_coredump_submit(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-76-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h=80=static inline struct\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:81:mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-82-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-85-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:86:static inline int mt7996_coredump_register(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-87-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-90-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:91:static inline void mt7996_coredump_unregister(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-92-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-6-#include \u003clinux/relay.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:7:#include \"mt7996.h\"\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-8-#include \"eeprom.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=23=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:24:mt7996_implicit_txbf_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-25-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:26:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-27-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-32-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:33:\treturn mt7996_mcu_set_txbf(dev, BF_HW_EN_UPDATE);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-34-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=36=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:37:mt7996_implicit_txbf_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-38-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:39:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-40-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-45-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:46:DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7996_implicit_txbf_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:47:\t\t\t mt7996_implicit_txbf_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-48-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=50=static ssize_t\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:51:mt7996_sys_recovery_set(struct file *file, const char __user *user_buf,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-52-\t\t\tsize_t count, loff_t *ppos)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-53-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:54:\tstruct mt7996_dev *dev = file-\u003eprivate_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-55-\tchar buf[16], *sep;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-91-\tcase UNI_CMD_SER_QUERY:\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:92:\t\tret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_QUERY, 0, band);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-93-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-100-\tcase UNI_CMD_SER_SET_RECOVER_L4_MDP:\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:101:\t\tret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_SET, BIT(val), band);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-102-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-104-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:105:\t\tret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_TRIGGER, val, band);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-106-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-111-\t\tdev-\u003erecovery.state |= MT_MCU_CMD_WDT_MASK;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:112:\t\tmt7996_reset(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-113-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-116-\tcase UNI_CMD_SER_SET_SYSTEM_ASSERT:\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:117:\t\tret = mt7996_mcu_trigger_assert(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-118-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=128=static ssize_t\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:129:mt7996_sys_recovery_get(struct file *file, char __user *user_buf,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-130-\t\t\tsize_t count, loff_t *ppos)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-131-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:132:\tstruct mt7996_dev *dev = file-\u003eprivate_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-133-\tchar *buff;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-214-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:215:static const struct file_operations mt7996_sys_recovery_ops = {\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:216:\t.write = mt7996_sys_recovery_set,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:217:\t.read = mt7996_sys_recovery_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-218-\t.open = simple_open,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=222=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:223:mt7996_radar_trigger(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-224-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-226-#define RADAR_BACKGROUND\t2\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:227:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:228:\tstruct mt7996_phy *phy = mt7996_band_phy(dev, NL80211_BAND_5GHZ);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-229-\tstruct cfg80211_chan_def *chandef;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-247-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:248:\trdd_idx = mt7996_get_rdd_idx(phy, val == RADAR_BACKGROUND);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-249-\tif (rdd_idx \u003c 0) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-258-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:259:\treturn mt7996_mcu_rdd_cmd(dev, RDD_RADAR_EMULATE, rdd_idx, 0);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-260-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=262=DEFINE_DEBUGFS_ATTRIBUTE(fops_radar_trigger, NULL,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:263:\t\t\t mt7996_radar_trigger, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-264-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=265=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:266:mt7996_rdd_monitor(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-267-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:268:\tstruct mt7996_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-269-\tstruct cfg80211_chan_def *chandef = \u0026dev-\u003erdd2_chandef;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=312=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:313:mt7996_fw_debug_wm_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-314-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:315:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-316-\tenum {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-337-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:338:\tret = mt7996_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, val);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-339-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-350-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:351:\t\tret = mt7996_mcu_fw_dbg_ctrl(dev, debug, val);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-352-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=359=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:360:mt7996_fw_debug_wm_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-361-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:362:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-363-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-368-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:369:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_wm, mt7996_fw_debug_wm_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:370:\t\t\t mt7996_fw_debug_wm_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-371-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=372=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:373:mt7996_fw_debug_wa_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-374-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:375:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-376-\tint ret;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-379-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:380:\tret = mt7996_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, dev-\u003efw_debug_wa);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-381-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-383-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:384:\treturn mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), MCU_WA_PARAM_PDMA_RX,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-385-\t\t\t\t !!dev-\u003efw_debug_wa, 0);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=388=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:389:mt7996_fw_debug_wa_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-390-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:391:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-392-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-397-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:398:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_wa, mt7996_fw_debug_wa_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:399:\t\t\t mt7996_fw_debug_wa_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-400-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=425=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:426:mt7996_fw_debug_bin_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-427-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-431-\t};\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:432:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-433-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-443-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:444:\treturn mt7996_fw_debug_wm_set(dev, dev-\u003efw_debug_wm);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-445-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=447=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:448:mt7996_fw_debug_bin_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-449-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:450:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-451-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-456-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:457:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_bin, mt7996_fw_debug_bin_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:458:\t\t\t mt7996_fw_debug_bin_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-459-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=460=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:461:mt7996_fw_util_wa_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-462-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:463:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-464-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-465-\tif (dev-\u003efw_debug_wa)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:466:\t\treturn mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(QUERY),\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-467-\t\t\t\t\t MCU_WA_PARAM_CPU_UTIL, 0, 0);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-471-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:472:DEFINE_SHOW_ATTRIBUTE(mt7996_fw_util_wa);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-473-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=474=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:475:mt7996_ampdu_stat_read_phy(struct mt7996_phy *phy, struct seq_file *file)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-476-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:477:\tstruct mt7996_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-478-\tint bound[15], range[8], i;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=504=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:505:mt7996_txbf_stat_read_phy(struct mt7996_phy *phy, struct seq_file *s)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-506-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=552=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:553:mt7996_tx_stats_show_phy(struct seq_file *file, struct mt7996_phy *phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-554-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-558-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:559:\tmt7996_mac_update_stats(phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:560:\tmt7996_ampdu_stat_read_phy(phy, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-561-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-568-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:569:\tmt7996_txbf_stat_read_phy(phy, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-570-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=584=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:585:mt7996_tx_stats_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-586-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:587:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:588:\tstruct mt7996_phy *phy = \u0026dev-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-589-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-591-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:592:\tmt7996_tx_stats_show_phy(file, phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:593:\tphy = mt7996_phy2(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-594-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:595:\t\tmt7996_tx_stats_show_phy(file, phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:596:\tphy = mt7996_phy3(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-597-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:598:\t\tmt7996_tx_stats_show_phy(file, phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-599-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-604-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:605:DEFINE_SHOW_ATTRIBUTE(mt7996_tx_stats);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-606-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=607=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:608:mt7996_hw_queue_read(struct seq_file *s, u32 size,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-609-\t\t     const struct hw_queue_map *map)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-610-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:611:\tstruct mt7996_phy *phy = s-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:612:\tstruct mt7996_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-613-\tu32 i, val;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=638=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:639:mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-640-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:641:\tstruct mt7996_sta *msta = (struct mt7996_sta *)sta-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:642:\tstruct mt7996_vif *mvif = msta-\u003evif;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:643:\tstruct mt7996_phy *phy = mt7996_vif_link_phy(\u0026mvif-\u003edeflink);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-644-\tstruct ieee80211_link_sta *link_sta;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-646-\tstruct ieee80211_vif *vif;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:647:\tstruct mt7996_dev *dev;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-648-\tunsigned int link_id;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-658-\tfor_each_sta_active_link(vif, sta, link_sta, link_id) {\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:659:\t\tstruct mt7996_sta_link *msta_link;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-660-\t\tstruct mt76_vif_link *mlink;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-666-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:667:\t\tmsta_link = mt7996_sta_link(msta, link_id);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-668-\t\tif (!msta_link)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=694=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:695:mt7996_hw_queues_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-696-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:697:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:698:\tstruct mt7996_phy *phy = \u0026dev-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-699-\tstatic const struct hw_queue_map ple_queue_map[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-747-\tseq_puts(file, \"PLE non-empty queue info:\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:748:\tmt7996_hw_queue_read(file, ARRAY_SIZE(ple_queue_map),\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-749-\t\t\t     \u0026ple_queue_map[0]);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-752-\tieee80211_iterate_stations_atomic(phy-\u003emt76-\u003ehw,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:753:\t\t\t\t\t  mt7996_sta_hw_queue_read, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:754:\tphy = mt7996_phy2(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-755-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-756-\t\tieee80211_iterate_stations_atomic(phy-\u003emt76-\u003ehw,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:757:\t\t\t\t\t\t  mt7996_sta_hw_queue_read, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:758:\tphy = mt7996_phy3(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-759-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-760-\t\tieee80211_iterate_stations_atomic(phy-\u003emt76-\u003ehw,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:761:\t\t\t\t\t\t  mt7996_sta_hw_queue_read, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-762-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-764-\tseq_puts(file, \"PSE non-empty queue info:\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:765:\tmt7996_hw_queue_read(file, ARRAY_SIZE(pse_queue_map),\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-766-\t\t\t     \u0026pse_queue_map[0]);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-770-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:771:DEFINE_SHOW_ATTRIBUTE(mt7996_hw_queues);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-772-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=773=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:774:mt7996_xmit_queues_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-775-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:776:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:777:\tstruct mt7996_phy *phy;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-778-\tstruct {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-790-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:791:\tphy = mt7996_phy2(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-792-\tif (phy)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-794-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:795:\tphy = mt7996_phy3(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-796-\tif (phy)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-813-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:814:DEFINE_SHOW_ATTRIBUTE(mt7996_xmit_queues);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-815-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=816=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:817:mt7996_twt_stats(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-818-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:819:\tstruct mt7996_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:820:\tstruct mt7996_twt_flow *iter;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-821-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=845=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:846:mt7996_rf_regval_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-847-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:848:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-849-\tu32 regval;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-851-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:852:\tret = mt7996_mcu_rf_regval(dev, dev-\u003emt76.debugfs_reg, \u0026regval, false);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-853-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=861=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:862:mt7996_rf_regval_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-863-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:864:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-865-\tu32 val32 = val;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-866-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:867:\treturn mt7996_mcu_rf_regval(dev, dev-\u003emt76.debugfs_reg, \u0026val32, true);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-868-}\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-869-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:870:DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_regval, mt7996_rf_regval_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:871:\t\t\t mt7996_rf_regval_set, \"0x%08llx\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-872-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:873:int mt7996_init_debugfs(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-874-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-879-\tdebugfs_create_file(\"hw-queues\", 0400, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:880:\t\t\t    \u0026mt7996_hw_queues_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-881-\tdebugfs_create_file(\"xmit-queues\", 0400, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:882:\t\t\t    \u0026mt7996_xmit_queues_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:883:\tdebugfs_create_file(\"tx_stats\", 0400, dir, dev, \u0026mt7996_tx_stats_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-884-\tdebugfs_create_file(\"sys_recovery\", 0600, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:885:\t\t\t    \u0026mt7996_sys_recovery_ops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-886-\tdebugfs_create_file(\"fw_debug_wm\", 0600, dir, dev, \u0026fops_fw_debug_wm);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-890-\tdebugfs_create_file(\"fw_util_wa\", 0400, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:891:\t\t\t    \u0026mt7996_fw_util_wa_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-892-\tdebugfs_create_file(\"implicit_txbf\", 0600, dir, dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-894-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"twt_stats\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:895:\t\t\t\t    mt7996_twt_stats);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-896-\tdebugfs_create_file(\"rf_regval\", 0600, dir, dev, \u0026fops_rf_regval);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-901-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"rdd_monitor\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:902:\t\t\t\t    mt7996_rdd_monitor);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-903-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=909=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:910:mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-911-\t\t\t   const void *data, int len)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-933-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:934:void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int len)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-935-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-955-\thdr.len = *(__le16 *)data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:956:\tmt7996_debugfs_write_fwlog(dev, \u0026hdr, sizeof(hdr), data, len);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-957-}\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-958-\n\n"
}

5/2 2026/06/28 10:05 llm patch-evaluator
0m Model:
gemini-3.1-pro-preview

Args:
null

Results:
null

Tokens:
							input: 20340
							output: 105
							thoughts: 472
						

Thoughts:
**WorthFuzzing Assessment: A Mediatek MT76 LED Driver Patch**

Okay, let's break this down. This patch is touching `mt76_led_init` and `mt7996_init_wiphy_band`, so immediately I'm thinking about the Mediatek MT76 wireless drivers. The description specifies it's all about LED classdev registration, which sets off a red flag in terms of fuzzing potential. These are primarily for visual feedback, not core functionality. It's registering a LED for each band under a single-wiphy MLO and ensuring the throughput trigger is only created once per `ieee80211_hw`.

My gut says this isn't worth fuzzing, but I need to be thorough. The question is, does this affect *anything* critical? No, the changes are purely decorative – they're not touching execution flow, networking logic, or the functional aspects of the driver. Plus, the MT7996 is a PCIe device, and I know that syzkaller doesn't emulate that hardware. It's highly unlikely we'd get any coverage from this in a standard syzkaller setup.

Just to be absolutely sure, let's look closer. The code is just setting up the LED callbacks: `mt7996_led_set_brightness` and `mt7996_led_set_blink`. These callbacks are purely for visual indication, there's nothing here that's going to cause a kernel crash or security vulnerability.

Now, let's reference the prompt, what it states is *not* worth fuzzing. It's asking if the patch is: documentation, Kconfig, comments, logging, tracepoints, non-functional numeric changes, or code paths unreachable in virtualized environments like GCE or QEMU. That's a direct match to the current situation. The MT7996 hardware is inaccessible in the syzkaller setup, and the patch deals solely with decorative LED functionality.

Therefore, `WorthFuzzing=false`. No point in spending the effort on this one.



6/2 2026/06/28 10:05 tool set-results
0m Args:
{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies LED registration logic for the Mediatek MT7996 wireless driver. LEDs are purely decorative and do not affect core execution flow. Furthermore, MT7996 is a specific hardware device (PCIe) that is not emulated in virtualized environments like QEMU or GCE, making these code paths unreachable during fuzzing.",
  "WorthFuzzing": false
}

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies LED registration logic for the Mediatek MT7996 wireless driver. LEDs are purely decorative and do not affect core execution flow. Furthermore, MT7996 is a specific hardware device (PCIe) that is not emulated in virtualized environments like QEMU or GCE, making these code paths unreachable during fuzzing.",
  "WorthFuzzing": false
}

LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)