AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/09/08 15:58	flow	patch-triage	1m Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "KMSANReasoning": "", "NeedsKMSAN": false, "Reasoning": "The patch adds RTL8723BS SDIO support and modifies SDIO transmit/receive handling in the Realtek rtw88 wireless driver. SDIO wireless adapters require physical hardware not emulated in standard virtualized fuzzing environments (QEMU/GCE) and are not accessible via virtual buses like USB raw-gadget, making the modified code structurally unreachable.", "WorthFuzzing": false }
1/1	2026/09/08 15:58	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 0fa39f67133774d6e2e5284863c38735ef02d914\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Tue Sep 8 15:58:32 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h\nindex c6e981ba79868..8f86f7c12de5a 100644\n--- a/drivers/net/wireless/realtek/rtw88/main.h\n+++ b/drivers/net/wireless/realtek/rtw88/main.h\n@@ -194,6 +194,7 @@ enum rtw_chip_type {\n \tRTW_CHIP_TYPE_8723D,\n \tRTW_CHIP_TYPE_8821C,\n \tRTW_CHIP_TYPE_8703B,\n+\tRTW_CHIP_TYPE_8723B,\n \tRTW_CHIP_TYPE_8821A,\n \tRTW_CHIP_TYPE_8812A,\n \tRTW_CHIP_TYPE_8814A,\n@@ -2194,6 +2195,12 @@ static inline bool rtw_chip_has_tx_stbc(struct rtw_dev rtwdev)\n \treturn rtwdev-\u003echip-\u003etx_stbc;\n }\n \n+static inline bool rtw_is_8723bs(struct rtw_dev rtwdev)\n+{\n+\treturn rtwdev-\u003echip-\u003eid == RTW_CHIP_TYPE_8723B \u0026\u0026\n+\t rtwdev-\u003ehci.type == RTW_HCI_TYPE_SDIO;\n+}\n+\n static inline u8 rtw_acquire_macid(struct rtw_dev rtwdev)\n {\n \tunsigned long mac_id;\ndiff --git a/drivers/net/wireless/realtek/rtw88/rx.c b/drivers/net/wireless/realtek/rtw88/rx.c\nindex 01fd299abb7fe..fde21c840ac02 100644\n--- a/drivers/net/wireless/realtek/rtw88/rx.c\n+++ b/drivers/net/wireless/realtek/rtw88/rx.c\n@@ -253,10 +253,12 @@ static void rtw_rx_fill_rx_status(struct rtw_dev rtwdev,\n \n \trtw_rx_addr_match(rtwdev, pkt_stat, hdr);\n \n-\t/* Rtl8723cs driver checks for size \u003c 14 or size \u003e 8192 and\n-\t * simply drops the packet.\n+\t/\n+\t Rtl8723cs and rtl8723bs drivers check for size \u003c 14 or size \u003e 8192\n+\t * and simply drop the packet.\n \t /\n-\tif (rtwdev-\u003echip-\u003eid == RTW_CHIP_TYPE_8703B \u0026\u0026 pkt_stat-\u003epkt_len == 0) {\n+\tif (pkt_stat-\u003epkt_len == 0 \u0026\u0026\n+\t (rtwdev-\u003echip-\u003eid == RTW_CHIP_TYPE_8703B \|\| rtw_is_8723bs(rtwdev))) {\n \t\trx_status-\u003eflag \|= RX_FLAG_NO_PSDU;\n \t\trtw_dbg(rtwdev, RTW_DBG_RX, \"zero length packet\");\n \t}\ndiff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c\nindex 5b40d74b16ee0..b594bd5b75a67 100644\n--- a/drivers/net/wireless/realtek/rtw88/sdio.c\n+++ b/drivers/net/wireless/realtek/rtw88/sdio.c\n@@ -20,6 +20,12 @@\n #include \"tx.h\"\n \n #define RTW_SDIO_INDIRECT_RW_RETRIES\t\t\t50\n+#define RTW_SDIO_OQT_TIMEOUT_MS\t\t\t\t1000\n+\n+/ Bounds the queueing latency of the otherwise unbounded per-AC software FIFO. /\n+#define RTW_SDIO_TX_FIFO_HIWATER\t\t\t16\n+#define RTW_SDIO_TX_FIFO_LOWATER\t\t\t8\n+#define RTW_SDIO_TX_RETRY_DELAY\t\t\tmsecs_to_jiffies(1)\n \n static bool rtw_sdio_is_bus_addr(u32 addr)\n {\n@@ -548,12 +554,149 @@ static int rtw_sdio_read_port(struct rtw_dev rtwdev, u8 buf, size_t count)\n \treturn ret;\n }\n \n+/\n+ * The counters are atomic_t because rtw_sdio_start() seeds them outside\n+ * tx_credit_lock, which the transmit paths hold while using them.\n+ /\n+static void rtw_sdio_8723bs_store_free_txpg(struct rtw_dev rtwdev,\n+\t\t\t\t\t u32 free_txpg)\n+{\n+\tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n+\n+\tatomic_set(\u0026rtwsdio-\u003efree_pg_high,\n+\t\t u32_get_bits(free_txpg, BIT_FREE_TXPG_HIGH));\n+\tatomic_set(\u0026rtwsdio-\u003efree_pg_normal,\n+\t\t u32_get_bits(free_txpg, BIT_FREE_TXPG_NORMAL));\n+\tatomic_set(\u0026rtwsdio-\u003efree_pg_low,\n+\t\t u32_get_bits(free_txpg, BIT_FREE_TXPG_LOW));\n+\tatomic_set(\u0026rtwsdio-\u003efree_pg_pub,\n+\t\t u32_get_bits(free_txpg, BIT_FREE_TXPG_PUB));\n+}\n+\n+static bool rtw_sdio_8723bs_sync_free_txpg(struct rtw_dev rtwdev)\n+{\n+\tu32 free_txpg = rtw_read32(rtwdev, REG_SDIO_FREE_TXPG);\n+\n+\tif (!free_txpg)\n+\t\treturn false;\n+\n+\trtw_sdio_8723bs_store_free_txpg(rtwdev, free_txpg);\n+\n+\treturn true;\n+}\n+\n+static int rtw_sdio_8723bs_pubq_num(struct rtw_dev rtwdev, u16 pubq_num)\n+{\n+\tconst struct rtw_page_table pg_tbl = \u0026rtwdev-\u003echip-\u003epage_table[0];\n+\tu16 acq_pg_num = rtwdev-\u003efifo.acq_pg_num;\n+\tu16 reserved_num;\n+\n+\treserved_num = pg_tbl-\u003ehq_num + pg_tbl-\u003elq_num + pg_tbl-\u003enq_num +\n+\t\t pg_tbl-\u003eexq_num + pg_tbl-\u003egapq_num;\n+\tif (acq_pg_num \u003c= reserved_num) {\n+\t\trtw_err(rtwdev,\n+\t\t\t\"no transmit pages left for the public queue: %u of %u reserved\\n\",\n+\t\t\treserved_num, acq_pg_num);\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tpubq_num = acq_pg_num - reserved_num;\n+\n+\treturn 0;\n+}\n+\n+static int rtw_sdio_8723bs_init_free_txpg(struct rtw_dev rtwdev)\n+{\n+\tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n+\tconst struct rtw_page_table pg_tbl;\n+\tu16 pubq_num;\n+\tint ret;\n+\n+\t/ Seed from the page table when the chip has nothing to report yet. /\n+\tif (!rtw_sdio_8723bs_sync_free_txpg(rtwdev)) {\n+\t\tret = rtw_sdio_8723bs_pubq_num(rtwdev, \u0026pubq_num);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\n+\t\tpg_tbl = \u0026rtwdev-\u003echip-\u003epage_table[0];\n+\t\tatomic_set(\u0026rtwsdio-\u003efree_pg_high, pg_tbl-\u003ehq_num);\n+\t\tatomic_set(\u0026rtwsdio-\u003efree_pg_normal, pg_tbl-\u003enq_num);\n+\t\tatomic_set(\u0026rtwsdio-\u003efree_pg_low, pg_tbl-\u003elq_num);\n+\t\tatomic_set(\u0026rtwsdio-\u003efree_pg_pub, pubq_num);\n+\t}\n+\n+\tatomic_set(\u0026rtwsdio-\u003etx_oqt_free,\n+\t\t rtw_read8(rtwdev, REG_SDIO_OQT_FREE_PG));\n+\n+\treturn 0;\n+}\n+\n+/\n+ * Clamped at zero: a lost update against rtw_sdio_8723bs_consume_txpg() can\n+ * briefly drive a counter negative, and wrapping would hide the shortage\n+ * instead of triggering a resync from the chip.\n+ /\n+static unsigned int rtw_sdio_8723bs_pages_free(struct rtw_dev rtwdev,\n+\t\t\t\t\t atomic_t dedicated)\n+{\n+\tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n+\tint free;\n+\n+\tfree = atomic_read(dedicated) + atomic_read(\u0026rtwsdio-\u003efree_pg_pub);\n+\n+\treturn free \u003e 0 ? free : 0;\n+}\n+\n+/\n+ * The pool a queue draws from follows the transmit FIFO that\n+ * rtw_sdio_get_tx_addr() writes into, since that is the one the chip charges.\n+ * RTW_TX_QUEUE_MGMT is the exception: it goes to the extra FIFO, which\n+ * REG_SDIO_FREE_TXPG has no counter for and this chip allocates no pages to,\n+ * so it is accounted against the high pool and served from the public one.\n+ /\n+static atomic_t rtw_sdio_8723bs_free_txpg(struct rtw_dev rtwdev, u8 queue)\n+{\n+\tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n+\n+\tswitch (queue) {\n+\tcase RTW_TX_QUEUE_VI:\n+\tcase RTW_TX_QUEUE_VO:\n+\t\treturn \u0026rtwsdio-\u003efree_pg_normal;\n+\tcase RTW_TX_QUEUE_BE:\n+\tcase RTW_TX_QUEUE_BK:\n+\t\treturn \u0026rtwsdio-\u003efree_pg_low;\n+\tcase RTW_TX_QUEUE_BCN:\n+\tcase RTW_TX_QUEUE_H2C:\n+\tcase RTW_TX_QUEUE_HI0:\n+\tcase RTW_TX_QUEUE_MGMT:\n+\t\treturn \u0026rtwsdio-\u003efree_pg_high;\n+\tdefault:\n+\t\treturn NULL;\n+\t}\n+}\n+\n static int rtw_sdio_check_free_txpg(struct rtw_dev rtwdev, u8 queue,\n \t\t\t\t size_t count)\n {\n \tunsigned int pages_free, pages_needed;\n \n-\tif (rtw_chip_wcpu_8051(rtwdev)) {\n+\tif (rtw_is_8723bs(rtwdev)) {\n+\t\tatomic_t dedicated;\n+\n+\t\tdedicated = rtw_sdio_8723bs_free_txpg(rtwdev, queue);\n+\t\tif (!dedicated) {\n+\t\t\trtw_warn(rtwdev, \"Unknown mapping for queue %u\\n\", queue);\n+\t\t\treturn -EINVAL;\n+\t\t}\n+\n+\t\tpages_free = rtw_sdio_8723bs_pages_free(rtwdev, dedicated);\n+\t\tpages_needed = DIV_ROUND_UP(count, rtwdev-\u003echip-\u003epage_size);\n+\t\tif (pages_needed \u003c= pages_free)\n+\t\t\treturn 0;\n+\n+\t\trtw_sdio_8723bs_sync_free_txpg(rtwdev);\n+\t\tpages_free = rtw_sdio_8723bs_pages_free(rtwdev, dedicated);\n+\t} else if (rtw_chip_wcpu_8051(rtwdev)) {\n \t\tu32 free_txpg;\n \n \t\tfree_txpg = rtw_sdio_read32(rtwdev, REG_SDIO_FREE_TXPG);\n@@ -632,24 +775,60 @@ static int rtw_sdio_check_free_txpg(struct rtw_dev rtwdev, u8 queue,\n \treturn 0;\n }\n \n-static int rtw_sdio_write_port(struct rtw_dev rtwdev, struct sk_buff skb,\n-\t\t\t enum rtw_tx_queue_type queue)\n+static int rtw_sdio_8723bs_wait_tx_oqt(struct rtw_dev rtwdev)\n {\n \tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n-\tbool bus_claim;\n-\tsize_t txsize;\n-\tu32 txaddr;\n-\tint ret;\n+\tunsigned long deadline;\n+\tu8 free;\n \n-\ttxaddr = rtw_sdio_get_tx_addr(rtwdev, skb-\u003elen, queue);\n-\tif (!txaddr)\n-\t\treturn -EINVAL;\n+\tlockdep_assert_held(\u0026rtwsdio-\u003etx_credit_lock);\n \n-\ttxsize = sdio_align_size(rtwsdio-\u003esdio_func, skb-\u003elen);\n+\tif (atomic_add_unless(\u0026rtwsdio-\u003etx_oqt_free, -1, 0))\n+\t\treturn 0;\n \n-\tret = rtw_sdio_check_free_txpg(rtwdev, queue, txsize);\n-\tif (ret)\n-\t\treturn ret;\n+\tdeadline = jiffies + msecs_to_jiffies(RTW_SDIO_OQT_TIMEOUT_MS);\n+\tdo {\n+\t\tfree = rtw_read8(rtwdev, REG_SDIO_OQT_FREE_PG);\n+\t\tif (free) {\n+\t\t\tatomic_set(\u0026rtwsdio-\u003etx_oqt_free, free - 1);\n+\t\t\treturn 0;\n+\t\t}\n+\t\tusleep_range(1000, 2000);\n+\t} while (time_before(jiffies, deadline));\n+\n+\treturn -EBUSY;\n+}\n+\n+static void rtw_sdio_8723bs_consume_txpg(struct rtw_dev rtwdev, u8 queue,\n+\t\t\t\t\t unsigned int pages)\n+{\n+\tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n+\tatomic_t dedicated;\n+\tunsigned int taken;\n+\tint free;\n+\n+\tlockdep_assert_held(\u0026rtwsdio-\u003etx_credit_lock);\n+\n+\tdedicated = rtw_sdio_8723bs_free_txpg(rtwdev, queue);\n+\tif (!dedicated)\n+\t\treturn;\n+\n+\tfree = atomic_read(dedicated);\n+\ttaken = min_t(unsigned int, pages, free \u003e 0 ? free : 0);\n+\tatomic_sub(taken, dedicated);\n+\n+\tpages -= taken;\n+\tif (pages \u0026\u0026 atomic_sub_return(pages, \u0026rtwsdio-\u003efree_pg_pub) \u003c 0)\n+\t\tatomic_set(\u0026rtwsdio-\u003efree_pg_pub, 0);\n+}\n+\n+static int rtw_sdio_write_to_port(struct rtw_dev rtwdev, struct sk_buff skb,\n+\t\t\t\t enum rtw_tx_queue_type queue, u32 txaddr,\n+\t\t\t\t size_t write_size)\n+{\n+\tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n+\tbool bus_claim;\n+\tint ret;\n \n \tif (!IS_ALIGNED((unsigned long)skb-\u003edata, RTW_SDIO_DATA_PTR_ALIGN))\n \t\trtw_warn(rtwdev, \"Got unaligned SKB in %s() for queue %u\\n\",\n@@ -660,7 +839,8 @@ static int rtw_sdio_write_port(struct rtw_dev rtwdev, struct sk_buff skb,\n \tif (bus_claim)\n \t\tsdio_claim_host(rtwsdio-\u003esdio_func);\n \n-\tret = sdio_memcpy_toio(rtwsdio-\u003esdio_func, txaddr, skb-\u003edata, txsize);\n+\tret = sdio_memcpy_toio(rtwsdio-\u003esdio_func, txaddr, skb-\u003edata,\n+\t\t\t write_size);\n \n \tif (bus_claim)\n \t\tsdio_release_host(rtwsdio-\u003esdio_func);\n@@ -668,16 +848,92 @@ static int rtw_sdio_write_port(struct rtw_dev rtwdev, struct sk_buff skb,\n \tif (ret)\n \t\trtw_warn(rtwdev,\n \t\t\t \"Failed to write %zu byte(s) to SDIO port 0x%08x\",\n-\t\t\t txsize, txaddr);\n+\t\t\t write_size, txaddr);\n \n \treturn ret;\n }\n \n+static int rtw_sdio_write_port_8723bs(struct rtw_dev rtwdev,\n+\t\t\t\t struct sk_buff skb,\n+\t\t\t\t enum rtw_tx_queue_type queue)\n+{\n+\tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n+\tunsigned int pages;\n+\tsize_t write_size;\n+\tsize_t txsize;\n+\tu32 txaddr;\n+\tint ret;\n+\n+\ttxaddr = rtw_sdio_get_tx_addr(rtwdev, skb-\u003elen, queue);\n+\tif (!txaddr)\n+\t\treturn -EINVAL;\n+\n+\ttxsize = round_up(skb-\u003elen, 4);\n+\twrite_size = sdio_align_size(rtwsdio-\u003esdio_func, skb-\u003elen);\n+\n+\tguard(mutex)(\u0026rtwsdio-\u003etx_credit_lock);\n+\n+\tret = rtw_sdio_check_free_txpg(rtwdev, queue, txsize);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tret = rtw_sdio_8723bs_wait_tx_oqt(rtwdev);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tret = rtw_sdio_write_to_port(rtwdev, skb, queue, txaddr, write_size);\n+\tif (ret) {\n+\t\t/ nothing was queued, so hand the output queue entry back /\n+\t\tatomic_inc(\u0026rtwsdio-\u003etx_oqt_free);\n+\t\treturn ret;\n+\t}\n+\n+\tpages = DIV_ROUND_UP(txsize, rtwdev-\u003echip-\u003epage_size);\n+\trtw_sdio_8723bs_consume_txpg(rtwdev, queue, pages);\n+\n+\treturn 0;\n+}\n+\n+static int rtw_sdio_write_port_generic(struct rtw_dev rtwdev,\n+\t\t\t\t struct sk_buff skb,\n+\t\t\t\t enum rtw_tx_queue_type queue)\n+{\n+\tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n+\tsize_t txsize;\n+\tu32 txaddr;\n+\tint ret;\n+\n+\ttxaddr = rtw_sdio_get_tx_addr(rtwdev, skb-\u003elen, queue);\n+\tif (!txaddr)\n+\t\treturn -EINVAL;\n+\n+\ttxsize = sdio_align_size(rtwsdio-\u003esdio_func, skb-\u003elen);\n+\n+\tret = rtw_sdio_check_free_txpg(rtwdev, queue, txsize);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\treturn rtw_sdio_write_to_port(rtwdev, skb, queue, txaddr, txsize);\n+}\n+\n+static int rtw_sdio_write_port(struct rtw_dev rtwdev, struct sk_buff skb,\n+\t\t\t enum rtw_tx_queue_type queue)\n+{\n+\tif (rtw_is_8723bs(rtwdev))\n+\t\treturn rtw_sdio_write_port_8723bs(rtwdev, skb, queue);\n+\n+\treturn rtw_sdio_write_port_generic(rtwdev, skb, queue);\n+}\n+\n static void rtw_sdio_init(struct rtw_dev rtwdev)\n {\n \tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n \n-\trtwsdio-\u003eirq_mask = REG_SDIO_HIMR_RX_REQUEST \| REG_SDIO_HIMR_CPWM1;\n+\tif (rtw_is_8723bs(rtwdev))\n+\t\trtwsdio-\u003eirq_mask = REG_SDIO_HIMR_RX_REQUEST;\n+\telse\n+\t\trtwsdio-\u003eirq_mask = REG_SDIO_HIMR_RX_REQUEST \|\n+\t\t\t\t REG_SDIO_HIMR_CPWM1;\n }\n \n static void rtw_sdio_enable_rx_aggregation(struct rtw_dev rtwdev)\n@@ -685,6 +941,7 @@ static void rtw_sdio_enable_rx_aggregation(struct rtw_dev rtwdev)\n \tu8 size, timeout;\n \n \tswitch (rtwdev-\u003echip-\u003eid) {\n+\tcase RTW_CHIP_TYPE_8723B:\n \tcase RTW_CHIP_TYPE_8703B:\n \tcase RTW_CHIP_TYPE_8821A:\n \tcase RTW_CHIP_TYPE_8812A:\n@@ -712,6 +969,8 @@ static void rtw_sdio_enable_rx_aggregation(struct rtw_dev rtwdev)\n \t\t FIELD_PREP(BIT_DMA_AGG_TO_V1, timeout));\n \n \trtw_write8_set(rtwdev, REG_RXDMA_MODE, BIT_DMA_MODE);\n+\tif (rtw_is_8723bs(rtwdev))\n+\t\trtw_write8_mask(rtwdev, REG_RXDMA_MODE, BIT_DMA_BURST_CNT, 0x3);\n }\n \n static void rtw_sdio_enable_interrupt(struct rtw_dev rtwdev)\n@@ -749,9 +1008,61 @@ static int rtw_sdio_setup(struct rtw_dev rtwdev)\n \treturn 0;\n }\n \n+/\n+ * Reprogram the queue page allocation if the chip came up with none. This is\n+ * a repair path, not part of the normal start sequence: a non-zero free page\n+ * count means the allocation latched during power on and must be left alone,\n+ * and without a transmit page pool there is nothing to divide up either.\n+ /\n+static int rtw_sdio_8723bs_check_rqpn(struct rtw_dev rtwdev)\n+{\n+\tconst struct rtw_chip_info chip = rtwdev-\u003echip;\n+\tstruct rtw_fifo_conf fifo = \u0026rtwdev-\u003efifo;\n+\tconst struct rtw_page_table pg_tbl;\n+\tu32 free_txpg;\n+\tu16 pubq_num;\n+\tint ret;\n+\n+\tfree_txpg = rtw_read32(rtwdev, REG_SDIO_FREE_TXPG);\n+\tif (free_txpg \|\| !fifo-\u003eacq_pg_num)\n+\t\treturn 0;\n+\n+\tret = rtw_sdio_8723bs_pubq_num(rtwdev, \u0026pubq_num);\n+\tif (ret)\n+\t\treturn ret;\n+\n+\tpg_tbl = \u0026chip-\u003epage_table[0];\n+\trtw_write32(rtwdev, REG_RQPN_NPQ,\n+\t\t BIT_RQPN_NE(pg_tbl-\u003enq_num, pg_tbl-\u003eexq_num));\n+\trtw_write32(rtwdev, REG_RQPN,\n+\t\t BIT_RQPN_HLP(pg_tbl-\u003ehq_num, pg_tbl-\u003elq_num, pubq_num));\n+\n+\treturn 0;\n+}\n+\n static int rtw_sdio_start(struct rtw_dev rtwdev)\n {\n+\tu32 clear;\n+\n+\tif (rtw_is_8723bs(rtwdev)) {\n+\t\tint ret = rtw_sdio_8723bs_check_rqpn(rtwdev);\n+\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\n+\t\tret = rtw_sdio_8723bs_init_free_txpg(rtwdev);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\t}\n+\n \trtw_sdio_enable_rx_aggregation(rtwdev);\n+\n+\tif (rtw_is_8723bs(rtwdev)) {\n+\t\tclear = rtw_read32(rtwdev, REG_SDIO_HISR) \u0026 RTW_SDIO_HISR_CLEAR_MASK;\n+\t\tif (clear)\n+\t\t\trtw_write32(rtwdev, REG_SDIO_HISR, clear);\n+\t}\n+\n \trtw_sdio_enable_interrupt(rtwdev);\n \n \treturn 0;\n@@ -815,7 +1126,11 @@ static void rtw_sdio_tx_kick_off(struct rtw_dev rtwdev)\n {\n \tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n \n-\tqueue_work(rtwsdio-\u003etxwq, \u0026rtwsdio-\u003etx_handler_data-\u003ework);\n+\t/\n+\t * A retry may already be pending with a delay; re-arm it so a newly\n+\t * queued frame is not held back by it.\n+\t /\n+\tmod_delayed_work(rtwsdio-\u003etxwq, \u0026rtwsdio-\u003etx_handler_data-\u003ework, 0);\n }\n \n static void rtw_sdio_link_ps(struct rtw_dev rtwdev, bool enter)\n@@ -831,6 +1146,8 @@ static void rtw_sdio_interface_cfg(struct rtw_dev rtwdev)\n \n \tval = rtw_read32(rtwdev, REG_SDIO_TX_CTRL);\n \tval \u0026= 0xfff8;\n+\tif (rtw_is_8723bs(rtwdev))\n+\t\tval \|= BIT_SDIO_TX_CTRL_ALWAYS_RECOGNIZE;\n \trtw_write32(rtwdev, REG_SDIO_TX_CTRL, val);\n }\n \n@@ -922,12 +1239,61 @@ static int rtw_sdio_write_data_h2c(struct rtw_dev rtwdev, u8 buf, u32 size)\n \treturn rtw_sdio_write_data(rtwdev, \u0026pkt_info, skb, RTW_TX_QUEUE_H2C);\n }\n \n+/\n+ * Both this and the wake below hold the TX queue lock across the length check\n+ * and the flag update, so a queue is only ever stopped while it really is\n+ * above the watermark, and the drain path always sees the flag the producer\n+ * set.\n+ /\n+static void rtw_sdio_8723bs_stop_tx_queue(struct rtw_dev rtwdev,\n+\t\t\t\t\t enum rtw_tx_queue_type queue,\n+\t\t\t\t\t u16 q_map)\n+{\n+\tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n+\n+\tif (!rtw_is_8723bs(rtwdev) \|\| queue \u003e= RTW_TX_QUEUE_BCN)\n+\t\treturn;\n+\n+\tguard(spinlock_irqsave)(\u0026rtwsdio-\u003etx_queue[queue].lock);\n+\n+\tif (rtwsdio-\u003etx_queue_stopped[queue])\n+\t\treturn;\n+\n+\tif (skb_queue_len(\u0026rtwsdio-\u003etx_queue[queue]) \u003c RTW_SDIO_TX_FIFO_HIWATER)\n+\t\treturn;\n+\n+\trtwsdio-\u003etx_queue_stopped[queue] = true;\n+\tieee80211_stop_queue(rtwdev-\u003ehw, q_map);\n+}\n+\n+static void rtw_sdio_8723bs_wake_tx_queue(struct rtw_dev rtwdev,\n+\t\t\t\t\t enum rtw_tx_queue_type queue,\n+\t\t\t\t\t u16 q_map)\n+{\n+\tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n+\n+\tif (!rtw_is_8723bs(rtwdev) \|\| queue \u003e= RTW_TX_QUEUE_BCN)\n+\t\treturn;\n+\n+\tguard(spinlock_irqsave)(\u0026rtwsdio-\u003etx_queue[queue].lock);\n+\n+\tif (!rtwsdio-\u003etx_queue_stopped[queue])\n+\t\treturn;\n+\n+\tif (skb_queue_len(\u0026rtwsdio-\u003etx_queue[queue]) \u003e RTW_SDIO_TX_FIFO_LOWATER)\n+\t\treturn;\n+\n+\trtwsdio-\u003etx_queue_stopped[queue] = false;\n+\tieee80211_wake_queue(rtwdev-\u003ehw, q_map);\n+}\n+\n static int rtw_sdio_tx_write(struct rtw_dev rtwdev,\n \t\t\t struct rtw_tx_pkt_info pkt_info,\n \t\t\t struct sk_buff skb)\n {\n \tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n \tenum rtw_tx_queue_type queue = rtw_tx_queue_mapping(skb);\n+\tu16 q_map = skb_get_queue_mapping(skb);\n \tstruct rtw_sdio_tx_data tx_data;\n \n \trtw_sdio_tx_skb_prepare(rtwdev, pkt_info, skb, queue);\n@@ -935,8 +1301,11 @@ static int rtw_sdio_tx_write(struct rtw_dev rtwdev,\n \ttx_data = rtw_sdio_get_tx_data(skb);\n \ttx_data-\u003esn = pkt_info-\u003esn;\n \n+\t/* The TX worker may already have freed the skb, so do not touch it. /\n \tskb_queue_tail(\u0026rtwsdio-\u003etx_queue[queue], skb);\n \n+\trtw_sdio_8723bs_stop_tx_queue(rtwdev, queue, q_map);\n+\n \treturn 0;\n }\n \n@@ -1095,6 +1464,14 @@ static void rtw_sdio_handle_interrupt(struct sdio_func sdio_func)\n \t\trtw_sdio_rx_isr(rtwdev);\n \t}\n \n+\t/\n+\t RTL8723BS keeps raising the interrupt after resume if undefined\n+\t * status bits are written back, so acknowledge only the bits this\n+\t * driver defines. Other chips keep the existing behaviour.\n+\t /\n+\tif (rtw_is_8723bs(rtwdev))\n+\t\thisr \u0026= RTW_SDIO_HISR_CLEAR_MASK;\n+\n \trtw_write32(rtwdev, REG_SDIO_HISR, hisr);\n \n \trtwsdio-\u003eirq_thread = NULL;\n@@ -1231,33 +1608,79 @@ static void rtw_sdio_indicate_tx_status(struct rtw_dev rtwdev,\n \tieee80211_tx_status_irqsafe(hw, skb);\n }\n \n-static void rtw_sdio_process_tx_queue(struct rtw_dev rtwdev,\n-\t\t\t\t enum rtw_tx_queue_type queue)\n+/\n+ * Send one frame from @queue. Returns 0 when a frame was written, 1 when the\n+ * queue was empty and a negative errno when the write failed, in which case\n+ * the frame is put back at the head of the queue.\n+ /\n+static int rtw_sdio_process_tx_queue(struct rtw_dev rtwdev,\n+\t\t\t\t enum rtw_tx_queue_type queue)\n {\n \tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n \tstruct sk_buff skb;\n+\tu16 q_map;\n \tint ret;\n \n \tskb = skb_dequeue(\u0026rtwsdio-\u003etx_queue[queue]);\n \tif (!skb)\n-\t\treturn;\n+\t\treturn 1;\n \n \tret = rtw_sdio_write_port(rtwdev, skb, queue);\n \tif (ret) {\n \t\tskb_queue_head(\u0026rtwsdio-\u003etx_queue[queue], skb);\n-\t\treturn;\n+\t\treturn ret;\n \t}\n \n+\t/ rtw_sdio_indicate_tx_status() consumes the skb, so read this first /\n+\tq_map = skb_get_queue_mapping(skb);\n+\n \trtw_sdio_indicate_tx_status(rtwdev, skb);\n+\n+\trtw_sdio_8723bs_wake_tx_queue(rtwdev, queue, q_map);\n+\n+\treturn 0;\n+}\n+\n+/\n+ * A page or output queue shortage is transient and leaves the frame queued, so\n+ * come back for it shortly. That matters once the mac80211 queue can be\n+ * stopped: a stopped queue is handed no further frames, so nothing else would\n+ * kick this work item and the access category would stay stopped for good.\n+ * The remaining errors are logged where they happen and are not retried.\n+ \n+ After a management frame, restart from the highest priority queue so the\n+ * join sequence is not held up behind a data backlog.\n+ /\n+static bool rtw_sdio_8723bs_reschedule_tx(struct rtw_dev rtwdev,\n+\t\t\t\t\t struct rtw_sdio_work_data work_data,\n+\t\t\t\t\t enum rtw_tx_queue_type queue, int ret)\n+{\n+\tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n+\tunsigned long delay;\n+\n+\tif (!rtw_is_8723bs(rtwdev))\n+\t\treturn false;\n+\n+\tif (ret == -EBUSY)\n+\t\tdelay = RTW_SDIO_TX_RETRY_DELAY;\n+\telse if (ret == 0 \u0026\u0026 queue == RTW_TX_QUEUE_MGMT)\n+\t\tdelay = 0;\n+\telse\n+\t\treturn false;\n+\n+\tqueue_delayed_work(rtwsdio-\u003etxwq, \u0026work_data-\u003ework, delay);\n+\n+\treturn true;\n }\n \n static void rtw_sdio_tx_handler(struct work_struct work)\n {\n \tstruct rtw_sdio_work_data work_data =\n-\t\tcontainer_of(work, struct rtw_sdio_work_data, work);\n+\t\tcontainer_of(to_delayed_work(work), struct rtw_sdio_work_data,\n+\t\t\t work);\n \tstruct rtw_sdio rtwsdio;\n \tstruct rtw_dev rtwdev;\n-\tint limit, queue;\n+\tint limit, queue, ret;\n \n \trtwdev = work_data-\u003ertwdev;\n \trtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n@@ -1267,7 +1690,13 @@ static void rtw_sdio_tx_handler(struct work_struct work)\n \n \tfor (queue = RTK_MAX_TX_QUEUE_NUM - 1; queue \u003e= 0; queue--) {\n \t\tfor (limit = 0; limit \u003c 1000; limit++) {\n-\t\t\trtw_sdio_process_tx_queue(rtwdev, queue);\n+\t\t\tret = rtw_sdio_process_tx_queue(rtwdev, queue);\n+\t\t\tif (ret \u003e 0)\n+\t\t\t\tbreak;\n+\n+\t\t\tif (rtw_sdio_8723bs_reschedule_tx(rtwdev, work_data,\n+\t\t\t\t\t\t\t queue, ret))\n+\t\t\t\treturn;\n \n \t\t\tif (skb_queue_empty(\u0026rtwsdio-\u003etx_queue[queue]))\n \t\t\t\tbreak;\n@@ -1294,18 +1723,23 @@ static int rtw_sdio_init_tx(struct rtw_dev rtwdev)\n \t\treturn -ENOMEM;\n \t}\n \n-\tfor (i = 0; i \u003c RTK_MAX_TX_QUEUE_NUM; i++)\n+\tmutex_init(\u0026rtwsdio-\u003etx_credit_lock);\n+\n+\tfor (i = 0; i \u003c RTK_MAX_TX_QUEUE_NUM; i++) {\n \t\tskb_queue_head_init(\u0026rtwsdio-\u003etx_queue[i]);\n+\t\trtwsdio-\u003etx_queue_stopped[i] = false;\n+\t}\n \trtwsdio-\u003etx_handler_data = kmalloc_obj(rtwsdio-\u003etx_handler_data);\n \tif (!rtwsdio-\u003etx_handler_data)\n \t\tgoto err_destroy_wq;\n \n \trtwsdio-\u003etx_handler_data-\u003ertwdev = rtwdev;\n-\tINIT_WORK(\u0026rtwsdio-\u003etx_handler_data-\u003ework, rtw_sdio_tx_handler);\n+\tINIT_DELAYED_WORK(\u0026rtwsdio-\u003etx_handler_data-\u003ework, rtw_sdio_tx_handler);\n \n \treturn 0;\n \n err_destroy_wq:\n+\tmutex_destroy(\u0026rtwsdio-\u003etx_credit_lock);\n \tdestroy_workqueue(rtwsdio-\u003etxwq);\n \treturn -ENOMEM;\n }\n@@ -1315,11 +1749,14 @@ static void rtw_sdio_deinit_tx(struct rtw_dev rtwdev)\n \tstruct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev-\u003epriv;\n \tint i;\n \n+\tcancel_delayed_work_sync(\u0026rtwsdio-\u003etx_handler_data-\u003ework);\n \tdestroy_workqueue(rtwsdio-\u003etxwq);\n \tkfree(rtwsdio-\u003etx_handler_data);\n \n \tfor (i = 0; i \u003c RTK_MAX_TX_QUEUE_NUM; i++)\n \t\tieee80211_purge_tx_queue(rtwdev-\u003ehw, \u0026rtwsdio-\u003etx_queue[i]);\n+\n+\tmutex_destroy(\u0026rtwsdio-\u003etx_credit_lock);\n }\n \n int rtw_sdio_probe(struct sdio_func sdio_func,\ndiff --git a/drivers/net/wireless/realtek/rtw88/sdio.h b/drivers/net/wireless/realtek/rtw88/sdio.h\nindex 457e8b02380e5..6e7e6009744b0 100644\n--- a/drivers/net/wireless/realtek/rtw88/sdio.h\n+++ b/drivers/net/wireless/realtek/rtw88/sdio.h\n@@ -22,6 +22,7 @@\n \n / SDIO Tx Control /\n #define REG_SDIO_TX_CTRL\t\t\t(SDIO_LOCAL_OFFSET + 0x0000)\n+#define BIT_SDIO_TX_CTRL_ALWAYS_RECOGNIZE\tBIT(4)\n \n /SDIO status timeout/\n #define REG_SDIO_TIMEOUT\t\t\t(SDIO_LOCAL_OFFSET + 0x0002)\n@@ -77,6 +78,14 @@\n / the following two are RTL8188 SDIO Specific /\n #define REG_SDIO_HISR_MCU_ERR\t\t\tBIT(28)\n #define REG_SDIO_HISR_TSF_BIT32_TOGGLE\t\tBIT(29)\n+#define RTW_SDIO_HISR_CLEAR_MASK\t\t\\\n+\t(REG_SDIO_HISR_TXERR \| REG_SDIO_HISR_RXERR \| \\\n+\t REG_SDIO_HISR_TXFOVW \| REG_SDIO_HISR_RXFOVW \| \\\n+\t REG_SDIO_HISR_TXBCNOK \| REG_SDIO_HISR_TXBCNERR \| \\\n+\t REG_SDIO_HISR_C2HCMD \| REG_SDIO_HISR_CPWM1 \| \\\n+\t REG_SDIO_HISR_CPWM2 \| REG_SDIO_HISR_HSISR_IND \| \\\n+\t REG_SDIO_HISR_GTINT3_IND \| REG_SDIO_HISR_GTINT4_IND \| \\\n+\t REG_SDIO_HISR_PSTIMEOUT \| REG_SDIO_HISR_OCPINT)\n \n / HCI Current Power Mode /\n #define REG_SDIO_HCPWM\t\t\t\t(SDIO_LOCAL_OFFSET + 0x0019)\n@@ -86,6 +95,10 @@\n #define REG_SDIO_OQT_FREE_PG\t\t\t(SDIO_LOCAL_OFFSET + 0x001E)\n / Free Tx Buffer Page /\n #define REG_SDIO_FREE_TXPG\t\t\t(SDIO_LOCAL_OFFSET + 0x0020)\n+#define BIT_FREE_TXPG_HIGH\t\t\tGENMASK(7, 0)\n+#define BIT_FREE_TXPG_NORMAL\t\t\tGENMASK(15, 8)\n+#define BIT_FREE_TXPG_LOW\t\t\tGENMASK(23, 16)\n+#define BIT_FREE_TXPG_PUB\t\t\tGENMASK(31, 24)\n / HCI Current Power Mode 1 /\n #define REG_SDIO_HCPWM1\t\t\t\t(SDIO_LOCAL_OFFSET + 0x0024)\n / HCI Current Power Mode 2 /\n@@ -143,7 +156,7 @@ struct rtw_sdio_tx_data {\n };\n \n struct rtw_sdio_work_data {\n-\tstruct work_struct work;\n+\tstruct delayed_work work;\n \tstruct rtw_dev rtwdev;\n };\n \n@@ -159,6 +172,15 @@ struct rtw_sdio {\n \tstruct workqueue_struct txwq;\n \tstruct rtw_sdio_work_data tx_handler_data;\n \tstruct sk_buff_head tx_queue[RTK_MAX_TX_QUEUE_NUM];\n+\tbool tx_queue_stopped[RTK_MAX_TX_QUEUE_NUM];\n+\n+\tatomic_t free_pg_high;\n+\tatomic_t free_pg_normal;\n+\tatomic_t free_pg_low;\n+\tatomic_t free_pg_pub;\n+\tatomic_t tx_oqt_free;\n+\t/* one writer at a time between the credit check and the accounting /\n+\tstruct mutex tx_credit_lock;\n };\n \n extern const struct dev_pm_ops rtw_sdio_pm_ops;\ndiff --git a/drivers/net/wireless/realtek/rtw88/tx.c b/drivers/net/wireless/realtek/rtw88/tx.c\nindex 8786bbb421c2b..4e110a457e71d 100644\n--- a/drivers/net/wireless/realtek/rtw88/tx.c\n+++ b/drivers/net/wireless/realtek/rtw88/tx.c\n@@ -208,8 +208,9 @@ void rtw_tx_report_enqueue(struct rtw_dev rtwdev, struct sk_buff *skb, u8 sn)\n \t__skb_queue_tail(\u0026tx_report-\u003equeue, skb);\n \tspin_unlock_irqrestore(\u0026tx_report-\u003eq_lock, flags);\n \n-\tif (rtwdev-\u003echip-\u003eid == RTW_CHIP_TYPE_8723D \u0026\u0026\n-\t rtwdev-\u003ehci.type == RTW_HCI_TYPE_USB)\n+\tif ((rtwdev-\u003echip-\u003eid == RTW_CHIP_TYPE_8723D \u0026\u0026\n+\t rtwdev-\u003ehci.type == RTW_HCI_TYPE_USB) \|\|\n+\t rtw_is_8723bs(rtwdev))\n \t\ttimeout = msecs_to_jiffies(2500);\n \n \tmod_timer(\u0026tx_report-\u003epurge_timer, jiffies + timeout);\n" }
2/1	2026/09/08 15:58	agent	patch-evaluator	1m Model: core Args: null Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch adds RTL8723BS SDIO support and modifies SDIO transmit/receive handling in the Realtek rtw88 wireless driver. SDIO wireless adapters require physical hardware not emulated in standard virtualized fuzzing environments (QEMU/GCE) and are not accessible via virtual buses like USB raw-gadget, making the modified code structurally unreachable.", "WorthFuzzing": false } Instruction: You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 0fa39f67133774d6e2e5284863c38735ef02d914 Author: syz-cluster <triage@syzkaller.com> Date: Tue Sep 8 15:58:32 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/net/wireless/realtek/rtw88/main.h b/drivers/net/wireless/realtek/rtw88/main.h index c6e981ba79868..8f86f7c12de5a 100644 --- a/drivers/net/wireless/realtek/rtw88/main.h +++ b/drivers/net/wireless/realtek/rtw88/main.h @@ -194,6 +194,7 @@ enum rtw_chip_type { RTW_CHIP_TYPE_8723D, RTW_CHIP_TYPE_8821C, RTW_CHIP_TYPE_8703B, + RTW_CHIP_TYPE_8723B, RTW_CHIP_TYPE_8821A, RTW_CHIP_TYPE_8812A, RTW_CHIP_TYPE_8814A, @@ -2194,6 +2195,12 @@ static inline bool rtw_chip_has_tx_stbc(struct rtw_dev rtwdev) return rtwdev->chip->tx_stbc; } +static inline bool rtw_is_8723bs(struct rtw_dev rtwdev) +{ + return rtwdev->chip->id == RTW_CHIP_TYPE_8723B && + rtwdev->hci.type == RTW_HCI_TYPE_SDIO; +} + static inline u8 rtw_acquire_macid(struct rtw_dev rtwdev) { unsigned long mac_id; diff --git a/drivers/net/wireless/realtek/rtw88/rx.c b/drivers/net/wireless/realtek/rtw88/rx.c index 01fd299abb7fe..fde21c840ac02 100644 --- a/drivers/net/wireless/realtek/rtw88/rx.c +++ b/drivers/net/wireless/realtek/rtw88/rx.c @@ -253,10 +253,12 @@ static void rtw_rx_fill_rx_status(struct rtw_dev rtwdev, rtw_rx_addr_match(rtwdev, pkt_stat, hdr); - /* Rtl8723cs driver checks for size < 14 or size > 8192 and - * simply drops the packet. + /* + * Rtl8723cs and rtl8723bs drivers check for size < 14 or size > 8192 + * and simply drop the packet. / - if (rtwdev->chip->id == RTW_CHIP_TYPE_8703B && pkt_stat->pkt_len == 0) { + if (pkt_stat->pkt_len == 0 && + (rtwdev->chip->id == RTW_CHIP_TYPE_8703B \|\| rtw_is_8723bs(rtwdev))) { rx_status->flag \|= RX_FLAG_NO_PSDU; rtw_dbg(rtwdev, RTW_DBG_RX, "zero length packet"); } diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c index 5b40d74b16ee0..b594bd5b75a67 100644 --- a/drivers/net/wireless/realtek/rtw88/sdio.c +++ b/drivers/net/wireless/realtek/rtw88/sdio.c @@ -20,6 +20,12 @@ #include "tx.h" #define RTW_SDIO_INDIRECT_RW_RETRIES 50 +#define RTW_SDIO_OQT_TIMEOUT_MS 1000 + +/ Bounds the queueing latency of the otherwise unbounded per-AC software FIFO. / +#define RTW_SDIO_TX_FIFO_HIWATER 16 +#define RTW_SDIO_TX_FIFO_LOWATER 8 +#define RTW_SDIO_TX_RETRY_DELAY msecs_to_jiffies(1) static bool rtw_sdio_is_bus_addr(u32 addr) { @@ -548,12 +554,149 @@ static int rtw_sdio_read_port(struct rtw_dev rtwdev, u8 buf, size_t count) return ret; } +/ + * The counters are atomic_t because rtw_sdio_start() seeds them outside + * tx_credit_lock, which the transmit paths hold while using them. + / +static void rtw_sdio_8723bs_store_free_txpg(struct rtw_dev rtwdev, + u32 free_txpg) +{ + struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; + + atomic_set(&rtwsdio->free_pg_high, + u32_get_bits(free_txpg, BIT_FREE_TXPG_HIGH)); + atomic_set(&rtwsdio->free_pg_normal, + u32_get_bits(free_txpg, BIT_FREE_TXPG_NORMAL)); + atomic_set(&rtwsdio->free_pg_low, + u32_get_bits(free_txpg, BIT_FREE_TXPG_LOW)); + atomic_set(&rtwsdio->free_pg_pub, + u32_get_bits(free_txpg, BIT_FREE_TXPG_PUB)); +} + +static bool rtw_sdio_8723bs_sync_free_txpg(struct rtw_dev rtwdev) +{ + u32 free_txpg = rtw_read32(rtwdev, REG_SDIO_FREE_TXPG); + + if (!free_txpg) + return false; + + rtw_sdio_8723bs_store_free_txpg(rtwdev, free_txpg); + + return true; +} + +static int rtw_sdio_8723bs_pubq_num(struct rtw_dev rtwdev, u16 pubq_num) +{ + const struct rtw_page_table pg_tbl = &rtwdev->chip->page_table[0]; + u16 acq_pg_num = rtwdev->fifo.acq_pg_num; + u16 reserved_num; + + reserved_num = pg_tbl->hq_num + pg_tbl->lq_num + pg_tbl->nq_num + + pg_tbl->exq_num + pg_tbl->gapq_num; + if (acq_pg_num <= reserved_num) { + rtw_err(rtwdev, + "no transmit pages left for the public queue: %u of %u reserved\n", + reserved_num, acq_pg_num); + return -EINVAL; + } + + pubq_num = acq_pg_num - reserved_num; + + return 0; +} + +static int rtw_sdio_8723bs_init_free_txpg(struct rtw_dev rtwdev) +{ + struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; + const struct rtw_page_table pg_tbl; + u16 pubq_num; + int ret; + + / Seed from the page table when the chip has nothing to report yet. / + if (!rtw_sdio_8723bs_sync_free_txpg(rtwdev)) { + ret = rtw_sdio_8723bs_pubq_num(rtwdev, &pubq_num); + if (ret) + return ret; + + pg_tbl = &rtwdev->chip->page_table[0]; + atomic_set(&rtwsdio->free_pg_high, pg_tbl->hq_num); + atomic_set(&rtwsdio->free_pg_normal, pg_tbl->nq_num); + atomic_set(&rtwsdio->free_pg_low, pg_tbl->lq_num); + atomic_set(&rtwsdio->free_pg_pub, pubq_num); + } + + atomic_set(&rtwsdio->tx_oqt_free, + rtw_read8(rtwdev, REG_SDIO_OQT_FREE_PG)); + + return 0; +} + +/ + * Clamped at zero: a lost update against rtw_sdio_8723bs_consume_txpg() can + * briefly drive a counter negative, and wrapping would hide the shortage + * instead of triggering a resync from the chip. + / +static unsigned int rtw_sdio_8723bs_pages_free(struct rtw_dev rtwdev, + atomic_t dedicated) +{ + struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; + int free; + + free = atomic_read(dedicated) + atomic_read(&rtwsdio->free_pg_pub); + + return free > 0 ? free : 0; +} + +/ + * The pool a queue draws from follows the transmit FIFO that + * rtw_sdio_get_tx_addr() writes into, since that is the one the chip charges. + * RTW_TX_QUEUE_MGMT is the exception: it goes to the extra FIFO, which + * REG_SDIO_FREE_TXPG has no counter for and this chip allocates no pages to, + * so it is accounted against the high pool and served from the public one. + / +static atomic_t rtw_sdio_8723bs_free_txpg(struct rtw_dev rtwdev, u8 queue) +{ + struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; + + switch (queue) { + case RTW_TX_QUEUE_VI: + case RTW_TX_QUEUE_VO: + return &rtwsdio->free_pg_normal; + case RTW_TX_QUEUE_BE: + case RTW_TX_QUEUE_BK: + return &rtwsdio->free_pg_low; + case RTW_TX_QUEUE_BCN: + case RTW_TX_QUEUE_H2C: + case RTW_TX_QUEUE_HI0: + case RTW_TX_QUEUE_MGMT: + return &rtwsdio->free_pg_high; + default: + return NULL; + } +} + static int rtw_sdio_check_free_txpg(struct rtw_dev rtwdev, u8 queue, size_t count) { unsigned int pages_free, pages_needed; - if (rtw_chip_wcpu_8051(rtwdev)) { + if (rtw_is_8723bs(rtwdev)) { + atomic_t dedicated; + + dedicated = rtw_sdio_8723bs_free_txpg(rtwdev, queue); + if (!dedicated) { + rtw_warn(rtwdev, "Unknown mapping for queue %u\n", queue); + return -EINVAL; + } + + pages_free = rtw_sdio_8723bs_pages_free(rtwdev, dedicated); + pages_needed = DIV_ROUND_UP(count, rtwdev->chip->page_size); + if (pages_needed <= pages_free) + return 0; + + rtw_sdio_8723bs_sync_free_txpg(rtwdev); + pages_free = rtw_sdio_8723bs_pages_free(rtwdev, dedicated); + } else if (rtw_chip_wcpu_8051(rtwdev)) { u32 free_txpg; free_txpg = rtw_sdio_read32(rtwdev, REG_SDIO_FREE_TXPG); @@ -632,24 +775,60 @@ static int rtw_sdio_check_free_txpg(struct rtw_dev rtwdev, u8 queue, return 0; } -static int rtw_sdio_write_port(struct rtw_dev rtwdev, struct sk_buff skb, - enum rtw_tx_queue_type queue) +static int rtw_sdio_8723bs_wait_tx_oqt(struct rtw_dev rtwdev) { struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; - bool bus_claim; - size_t txsize; - u32 txaddr; - int ret; + unsigned long deadline; + u8 free; - txaddr = rtw_sdio_get_tx_addr(rtwdev, skb->len, queue); - if (!txaddr) - return -EINVAL; + lockdep_assert_held(&rtwsdio->tx_credit_lock); - txsize = sdio_align_size(rtwsdio->sdio_func, skb->len); + if (atomic_add_unless(&rtwsdio->tx_oqt_free, -1, 0)) + return 0; - ret = rtw_sdio_check_free_txpg(rtwdev, queue, txsize); - if (ret) - return ret; + deadline = jiffies + msecs_to_jiffies(RTW_SDIO_OQT_TIMEOUT_MS); + do { + free = rtw_read8(rtwdev, REG_SDIO_OQT_FREE_PG); + if (free) { + atomic_set(&rtwsdio->tx_oqt_free, free - 1); + return 0; + } + usleep_range(1000, 2000); + } while (time_before(jiffies, deadline)); + + return -EBUSY; +} + +static void rtw_sdio_8723bs_consume_txpg(struct rtw_dev rtwdev, u8 queue, + unsigned int pages) +{ + struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; + atomic_t dedicated; + unsigned int taken; + int free; + + lockdep_assert_held(&rtwsdio->tx_credit_lock); + + dedicated = rtw_sdio_8723bs_free_txpg(rtwdev, queue); + if (!dedicated) + return; + + free = atomic_read(dedicated); + taken = min_t(unsigned int, pages, free > 0 ? free : 0); + atomic_sub(taken, dedicated); + + pages -= taken; + if (pages && atomic_sub_return(pages, &rtwsdio->free_pg_pub) < 0) + atomic_set(&rtwsdio->free_pg_pub, 0); +} + +static int rtw_sdio_write_to_port(struct rtw_dev rtwdev, struct sk_buff skb, + enum rtw_tx_queue_type queue, u32 txaddr, + size_t write_size) +{ + struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; + bool bus_claim; + int ret; if (!IS_ALIGNED((unsigned long)skb->data, RTW_SDIO_DATA_PTR_ALIGN)) rtw_warn(rtwdev, "Got unaligned SKB in %s() for queue %u\n", @@ -660,7 +839,8 @@ static int rtw_sdio_write_port(struct rtw_dev rtwdev, struct sk_buff skb, if (bus_claim) sdio_claim_host(rtwsdio->sdio_func); - ret = sdio_memcpy_toio(rtwsdio->sdio_func, txaddr, skb->data, txsize); + ret = sdio_memcpy_toio(rtwsdio->sdio_func, txaddr, skb->data, + write_size); if (bus_claim) sdio_release_host(rtwsdio->sdio_func); @@ -668,16 +848,92 @@ static int rtw_sdio_write_port(struct rtw_dev rtwdev, struct sk_buff skb, if (ret) rtw_warn(rtwdev, "Failed to write %zu byte(s) to SDIO port 0x%08x", - txsize, txaddr); + write_size, txaddr); return ret; } +static int rtw_sdio_write_port_8723bs(struct rtw_dev rtwdev, + struct sk_buff skb, + enum rtw_tx_queue_type queue) +{ + struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; + unsigned int pages; + size_t write_size; + size_t txsize; + u32 txaddr; + int ret; + + txaddr = rtw_sdio_get_tx_addr(rtwdev, skb->len, queue); + if (!txaddr) + return -EINVAL; + + txsize = round_up(skb->len, 4); + write_size = sdio_align_size(rtwsdio->sdio_func, skb->len); + + guard(mutex)(&rtwsdio->tx_credit_lock); + + ret = rtw_sdio_check_free_txpg(rtwdev, queue, txsize); + if (ret) + return ret; + + ret = rtw_sdio_8723bs_wait_tx_oqt(rtwdev); + if (ret) + return ret; + + ret = rtw_sdio_write_to_port(rtwdev, skb, queue, txaddr, write_size); + if (ret) { + / nothing was queued, so hand the output queue entry back / + atomic_inc(&rtwsdio->tx_oqt_free); + return ret; + } + + pages = DIV_ROUND_UP(txsize, rtwdev->chip->page_size); + rtw_sdio_8723bs_consume_txpg(rtwdev, queue, pages); + + return 0; +} + +static int rtw_sdio_write_port_generic(struct rtw_dev rtwdev, + struct sk_buff skb, + enum rtw_tx_queue_type queue) +{ + struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; + size_t txsize; + u32 txaddr; + int ret; + + txaddr = rtw_sdio_get_tx_addr(rtwdev, skb->len, queue); + if (!txaddr) + return -EINVAL; + + txsize = sdio_align_size(rtwsdio->sdio_func, skb->len); + + ret = rtw_sdio_check_free_txpg(rtwdev, queue, txsize); + if (ret) + return ret; + + return rtw_sdio_write_to_port(rtwdev, skb, queue, txaddr, txsize); +} + +static int rtw_sdio_write_port(struct rtw_dev rtwdev, struct sk_buff skb, + enum rtw_tx_queue_type queue) +{ + if (rtw_is_8723bs(rtwdev)) + return rtw_sdio_write_port_8723bs(rtwdev, skb, queue); + + return rtw_sdio_write_port_generic(rtwdev, skb, queue); +} + static void rtw_sdio_init(struct rtw_dev rtwdev) { struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; - rtwsdio->irq_mask = REG_SDIO_HIMR_RX_REQUEST \| REG_SDIO_HIMR_CPWM1; + if (rtw_is_8723bs(rtwdev)) + rtwsdio->irq_mask = REG_SDIO_HIMR_RX_REQUEST; + else + rtwsdio->irq_mask = REG_SDIO_HIMR_RX_REQUEST \| + REG_SDIO_HIMR_CPWM1; } static void rtw_sdio_enable_rx_aggregation(struct rtw_dev rtwdev) @@ -685,6 +941,7 @@ static void rtw_sdio_enable_rx_aggregation(struct rtw_dev rtwdev) u8 size, timeout; switch (rtwdev->chip->id) { + case RTW_CHIP_TYPE_8723B: case RTW_CHIP_TYPE_8703B: case RTW_CHIP_TYPE_8821A: case RTW_CHIP_TYPE_8812A: @@ -712,6 +969,8 @@ static void rtw_sdio_enable_rx_aggregation(struct rtw_dev rtwdev) FIELD_PREP(BIT_DMA_AGG_TO_V1, timeout)); rtw_write8_set(rtwdev, REG_RXDMA_MODE, BIT_DMA_MODE); + if (rtw_is_8723bs(rtwdev)) + rtw_write8_mask(rtwdev, REG_RXDMA_MODE, BIT_DMA_BURST_CNT, 0x3); } static void rtw_sdio_enable_interrupt(struct rtw_dev rtwdev) @@ -749,9 +1008,61 @@ static int rtw_sdio_setup(struct rtw_dev rtwdev) return 0; } +/ + * Reprogram the queue page allocation if the chip came up with none. This is + * a repair path, not part of the normal start sequence: a non-zero free page + * count means the allocation latched during power on and must be left alone, + * and without a transmit page pool there is nothing to divide up either. + / +static int rtw_sdio_8723bs_check_rqpn(struct rtw_dev rtwdev) +{ + const struct rtw_chip_info chip = rtwdev->chip; + struct rtw_fifo_conf fifo = &rtwdev->fifo; + const struct rtw_page_table pg_tbl; + u32 free_txpg; + u16 pubq_num; + int ret; + + free_txpg = rtw_read32(rtwdev, REG_SDIO_FREE_TXPG); + if (free_txpg \|\| !fifo->acq_pg_num) + return 0; + + ret = rtw_sdio_8723bs_pubq_num(rtwdev, &pubq_num); + if (ret) + return ret; + + pg_tbl = &chip->page_table[0]; + rtw_write32(rtwdev, REG_RQPN_NPQ, + BIT_RQPN_NE(pg_tbl->nq_num, pg_tbl->exq_num)); + rtw_write32(rtwdev, REG_RQPN, + BIT_RQPN_HLP(pg_tbl->hq_num, pg_tbl->lq_num, pubq_num)); + + return 0; +} + static int rtw_sdio_start(struct rtw_dev rtwdev) { + u32 clear; + + if (rtw_is_8723bs(rtwdev)) { + int ret = rtw_sdio_8723bs_check_rqpn(rtwdev); + + if (ret) + return ret; + + ret = rtw_sdio_8723bs_init_free_txpg(rtwdev); + if (ret) + return ret; + } + rtw_sdio_enable_rx_aggregation(rtwdev); + + if (rtw_is_8723bs(rtwdev)) { + clear = rtw_read32(rtwdev, REG_SDIO_HISR) & RTW_SDIO_HISR_CLEAR_MASK; + if (clear) + rtw_write32(rtwdev, REG_SDIO_HISR, clear); + } + rtw_sdio_enable_interrupt(rtwdev); return 0; @@ -815,7 +1126,11 @@ static void rtw_sdio_tx_kick_off(struct rtw_dev rtwdev) { struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; - queue_work(rtwsdio->txwq, &rtwsdio->tx_handler_data->work); + / + * A retry may already be pending with a delay; re-arm it so a newly + * queued frame is not held back by it. + / + mod_delayed_work(rtwsdio->txwq, &rtwsdio->tx_handler_data->work, 0); } static void rtw_sdio_link_ps(struct rtw_dev rtwdev, bool enter) @@ -831,6 +1146,8 @@ static void rtw_sdio_interface_cfg(struct rtw_dev rtwdev) val = rtw_read32(rtwdev, REG_SDIO_TX_CTRL); val &= 0xfff8; + if (rtw_is_8723bs(rtwdev)) + val \|= BIT_SDIO_TX_CTRL_ALWAYS_RECOGNIZE; rtw_write32(rtwdev, REG_SDIO_TX_CTRL, val); } @@ -922,12 +1239,61 @@ static int rtw_sdio_write_data_h2c(struct rtw_dev rtwdev, u8 buf, u32 size) return rtw_sdio_write_data(rtwdev, &pkt_info, skb, RTW_TX_QUEUE_H2C); } +/ + * Both this and the wake below hold the TX queue lock across the length check + * and the flag update, so a queue is only ever stopped while it really is + * above the watermark, and the drain path always sees the flag the producer + * set. + / +static void rtw_sdio_8723bs_stop_tx_queue(struct rtw_dev rtwdev, + enum rtw_tx_queue_type queue, + u16 q_map) +{ + struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; + + if (!rtw_is_8723bs(rtwdev) \|\| queue >= RTW_TX_QUEUE_BCN) + return; + + guard(spinlock_irqsave)(&rtwsdio->tx_queue[queue].lock); + + if (rtwsdio->tx_queue_stopped[queue]) + return; + + if (skb_queue_len(&rtwsdio->tx_queue[queue]) < RTW_SDIO_TX_FIFO_HIWATER) + return; + + rtwsdio->tx_queue_stopped[queue] = true; + ieee80211_stop_queue(rtwdev->hw, q_map); +} + +static void rtw_sdio_8723bs_wake_tx_queue(struct rtw_dev rtwdev, + enum rtw_tx_queue_type queue, + u16 q_map) +{ + struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; + + if (!rtw_is_8723bs(rtwdev) \|\| queue >= RTW_TX_QUEUE_BCN) + return; + + guard(spinlock_irqsave)(&rtwsdio->tx_queue[queue].lock); + + if (!rtwsdio->tx_queue_stopped[queue]) + return; + + if (skb_queue_len(&rtwsdio->tx_queue[queue]) > RTW_SDIO_TX_FIFO_LOWATER) + return; + + rtwsdio->tx_queue_stopped[queue] = false; + ieee80211_wake_queue(rtwdev->hw, q_map); +} + static int rtw_sdio_tx_write(struct rtw_dev rtwdev, struct rtw_tx_pkt_info pkt_info, struct sk_buff skb) { struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; enum rtw_tx_queue_type queue = rtw_tx_queue_mapping(skb); + u16 q_map = skb_get_queue_mapping(skb); struct rtw_sdio_tx_data tx_data; rtw_sdio_tx_skb_prepare(rtwdev, pkt_info, skb, queue); @@ -935,8 +1301,11 @@ static int rtw_sdio_tx_write(struct rtw_dev rtwdev, tx_data = rtw_sdio_get_tx_data(skb); tx_data->sn = pkt_info->sn; + /* The TX worker may already have freed the skb, so do not touch it. / skb_queue_tail(&rtwsdio->tx_queue[queue], skb); + rtw_sdio_8723bs_stop_tx_queue(rtwdev, queue, q_map); + return 0; } @@ -1095,6 +1464,14 @@ static void rtw_sdio_handle_interrupt(struct sdio_func sdio_func) rtw_sdio_rx_isr(rtwdev); } + /* + * RTL8723BS keeps raising the interrupt after resume if undefined + * status bits are written back, so acknowledge only the bits this + * driver defines. Other chips keep the existing behaviour. + / + if (rtw_is_8723bs(rtwdev)) + hisr &= RTW_SDIO_HISR_CLEAR_MASK; + rtw_write32(rtwdev, REG_SDIO_HISR, hisr); rtwsdio->irq_thread = NULL; @@ -1231,33 +1608,79 @@ static void rtw_sdio_indicate_tx_status(struct rtw_dev rtwdev, ieee80211_tx_status_irqsafe(hw, skb); } -static void rtw_sdio_process_tx_queue(struct rtw_dev rtwdev, - enum rtw_tx_queue_type queue) +/ + * Send one frame from @queue. Returns 0 when a frame was written, 1 when the + * queue was empty and a negative errno when the write failed, in which case + * the frame is put back at the head of the queue. + / +static int rtw_sdio_process_tx_queue(struct rtw_dev rtwdev, + enum rtw_tx_queue_type queue) { struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; struct sk_buff skb; + u16 q_map; int ret; skb = skb_dequeue(&rtwsdio->tx_queue[queue]); if (!skb) - return; + return 1; ret = rtw_sdio_write_port(rtwdev, skb, queue); if (ret) { skb_queue_head(&rtwsdio->tx_queue[queue], skb); - return; + return ret; } + / rtw_sdio_indicate_tx_status() consumes the skb, so read this first / + q_map = skb_get_queue_mapping(skb); + rtw_sdio_indicate_tx_status(rtwdev, skb); + + rtw_sdio_8723bs_wake_tx_queue(rtwdev, queue, q_map); + + return 0; +} + +/ + * A page or output queue shortage is transient and leaves the frame queued, so + * come back for it shortly. That matters once the mac80211 queue can be + * stopped: a stopped queue is handed no further frames, so nothing else would + * kick this work item and the access category would stay stopped for good. + * The remaining errors are logged where they happen and are not retried. + * + * After a management frame, restart from the highest priority queue so the + * join sequence is not held up behind a data backlog. + / +static bool rtw_sdio_8723bs_reschedule_tx(struct rtw_dev rtwdev, + struct rtw_sdio_work_data work_data, + enum rtw_tx_queue_type queue, int ret) +{ + struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; + unsigned long delay; + + if (!rtw_is_8723bs(rtwdev)) + return false; + + if (ret == -EBUSY) + delay = RTW_SDIO_TX_RETRY_DELAY; + else if (ret == 0 && queue == RTW_TX_QUEUE_MGMT) + delay = 0; + else + return false; + + queue_delayed_work(rtwsdio->txwq, &work_data->work, delay); + + return true; } static void rtw_sdio_tx_handler(struct work_struct work) { struct rtw_sdio_work_data work_data = - container_of(work, struct rtw_sdio_work_data, work); + container_of(to_delayed_work(work), struct rtw_sdio_work_data, + work); struct rtw_sdio rtwsdio; struct rtw_dev rtwdev; - int limit, queue; + int limit, queue, ret; rtwdev = work_data->rtwdev; rtwsdio = (struct rtw_sdio )rtwdev->priv; @@ -1267,7 +1690,13 @@ static void rtw_sdio_tx_handler(struct work_struct work) for (queue = RTK_MAX_TX_QUEUE_NUM - 1; queue >= 0; queue--) { for (limit = 0; limit < 1000; limit++) { - rtw_sdio_process_tx_queue(rtwdev, queue); + ret = rtw_sdio_process_tx_queue(rtwdev, queue); + if (ret > 0) + break; + + if (rtw_sdio_8723bs_reschedule_tx(rtwdev, work_data, + queue, ret)) + return; if (skb_queue_empty(&rtwsdio->tx_queue[queue])) break; @@ -1294,18 +1723,23 @@ static int rtw_sdio_init_tx(struct rtw_dev rtwdev) return -ENOMEM; } - for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++) + mutex_init(&rtwsdio->tx_credit_lock); + + for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++) { skb_queue_head_init(&rtwsdio->tx_queue[i]); + rtwsdio->tx_queue_stopped[i] = false; + } rtwsdio->tx_handler_data = kmalloc_obj(rtwsdio->tx_handler_data); if (!rtwsdio->tx_handler_data) goto err_destroy_wq; rtwsdio->tx_handler_data->rtwdev = rtwdev; - INIT_WORK(&rtwsdio->tx_handler_data->work, rtw_sdio_tx_handler); + INIT_DELAYED_WORK(&rtwsdio->tx_handler_data->work, rtw_sdio_tx_handler); return 0; err_destroy_wq: + mutex_destroy(&rtwsdio->tx_credit_lock); destroy_workqueue(rtwsdio->txwq); return -ENOMEM; } @@ -1315,11 +1749,14 @@ static void rtw_sdio_deinit_tx(struct rtw_dev rtwdev) struct rtw_sdio rtwsdio = (struct rtw_sdio )rtwdev->priv; int i; + cancel_delayed_work_sync(&rtwsdio->tx_handler_data->work); destroy_workqueue(rtwsdio->txwq); kfree(rtwsdio->tx_handler_data); for (i = 0; i < RTK_MAX_TX_QUEUE_NUM; i++) ieee80211_purge_tx_queue(rtwdev->hw, &rtwsdio->tx_queue[i]); + + mutex_destroy(&rtwsdio->tx_credit_lock); } int rtw_sdio_probe(struct sdio_func sdio_func, diff --git a/drivers/net/wireless/realtek/rtw88/sdio.h b/drivers/net/wireless/realtek/rtw88/sdio.h index 457e8b02380e5..6e7e6009744b0 100644 --- a/drivers/net/wireless/realtek/rtw88/sdio.h +++ b/drivers/net/wireless/realtek/rtw88/sdio.h @@ -22,6 +22,7 @@ / SDIO Tx Control / #define REG_SDIO_TX_CTRL (SDIO_LOCAL_OFFSET + 0x0000) +#define BIT_SDIO_TX_CTRL_ALWAYS_RECOGNIZE BIT(4) /SDIO status timeout/ #define REG_SDIO_TIMEOUT (SDIO_LOCAL_OFFSET + 0x0002) @@ -77,6 +78,14 @@ / the following two are RTL8188 SDIO Specific / #define REG_SDIO_HISR_MCU_ERR BIT(28) #define REG_SDIO_HISR_TSF_BIT32_TOGGLE BIT(29) +#define RTW_SDIO_HISR_CLEAR_MASK \ + (REG_SDIO_HISR_TXERR \| REG_SDIO_HISR_RXERR \| \ + REG_SDIO_HISR_TXFOVW \| REG_SDIO_HISR_RXFOVW \| \ + REG_SDIO_HISR_TXBCNOK \| REG_SDIO_HISR_TXBCNERR \| \ + REG_SDIO_HISR_C2HCMD \| REG_SDIO_HISR_CPWM1 \| \ + REG_SDIO_HISR_CPWM2 \| REG_SDIO_HISR_HSISR_IND \| \ + REG_SDIO_HISR_GTINT3_IND \| REG_SDIO_HISR_GTINT4_IND \| \ + REG_SDIO_HISR_PSTIMEOUT \| REG_SDIO_HISR_OCPINT) / HCI Current Power Mode / #define REG_SDIO_HCPWM (SDIO_LOCAL_OFFSET + 0x0019) @@ -86,6 +95,10 @@ #define REG_SDIO_OQT_FREE_PG (SDIO_LOCAL_OFFSET + 0x001E) / Free Tx Buffer Page / #define REG_SDIO_FREE_TXPG (SDIO_LOCAL_OFFSET + 0x0020) +#define BIT_FREE_TXPG_HIGH GENMASK(7, 0) +#define BIT_FREE_TXPG_NORMAL GENMASK(15, 8) +#define BIT_FREE_TXPG_LOW GENMASK(23, 16) +#define BIT_FREE_TXPG_PUB GENMASK(31, 24) / HCI Current Power Mode 1 / #define REG_SDIO_HCPWM1 (SDIO_LOCAL_OFFSET + 0x0024) / HCI Current Power Mode 2 / @@ -143,7 +156,7 @@ struct rtw_sdio_tx_data { }; struct rtw_sdio_work_data { - struct work_struct work; + struct delayed_work work; struct rtw_dev rtwdev; }; @@ -159,6 +172,15 @@ struct rtw_sdio { struct workqueue_struct txwq; struct rtw_sdio_work_data tx_handler_data; struct sk_buff_head tx_queue[RTK_MAX_TX_QUEUE_NUM]; + bool tx_queue_stopped[RTK_MAX_TX_QUEUE_NUM]; + + atomic_t free_pg_high; + atomic_t free_pg_normal; + atomic_t free_pg_low; + atomic_t free_pg_pub; + atomic_t tx_oqt_free; + /* one writer at a time between the credit check and the accounting / + struct mutex tx_credit_lock; }; extern const struct dev_pm_ops rtw_sdio_pm_ops; diff --git a/drivers/net/wireless/realtek/rtw88/tx.c b/drivers/net/wireless/realtek/rtw88/tx.c index 8786bbb421c2b..4e110a457e71d 100644 --- a/drivers/net/wireless/realtek/rtw88/tx.c +++ b/drivers/net/wireless/realtek/rtw88/tx.c @@ -208,8 +208,9 @@ void rtw_tx_report_enqueue(struct rtw_dev rtwdev, struct sk_buff *skb, u8 sn) __skb_queue_tail(&tx_report->queue, skb); spin_unlock_irqrestore(&tx_report->q_lock, flags); - if (rtwdev->chip->id == RTW_CHIP_TYPE_8723D && - rtwdev->hci.type == RTW_HCI_TYPE_USB) + if ((rtwdev->chip->id == RTW_CHIP_TYPE_8723D && + rtwdev->hci.type == RTW_HCI_TYPE_USB) \|\| + rtw_is_8723bs(rtwdev)) timeout = msecs_to_jiffies(2500); mod_timer(&tx_report->purge_timer, jiffies + timeout);
3/2	2026/09/08 15:58	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 14244 output: 21 thoughts: 488 Thoughts: Analyzing the Patch's Reachability for Fuzzing Okay, let's dive into this patch. I see it touches `rtw88` across several files: `main.h`, `rx.c`, `sdio.c`, `sdio.h`, and `tx.c`. My immediate thought is, "Can we even reach this code in a standard fuzzing setup, like with syzkaller and QEMU?" I need to figure out what `rtw88` is all about, specifically how SDIO devices are handled within it, and whether they are accessible via those fuzzing environments. Hold on, before I get too deep, I should probably check if SDIO wireless drivers are typically reachable within virtualized environments. I need to understand if SDIO devices can even be emulated, or if this `rtw88` implementation is locked down to specific hardware. I should probably check how this SDIO driver works. Right, time to re-read those instructions, specifically Sections 2 and 3. The key is reachability. If the code can't execute in a standard virtualized environment, it's a no-go for fuzzing, no matter how clever the code is. I'm focusing on "Structurally unreachable hardware." This means I need to assess whether SDIO falls into the category of "hardware requiring physical cards not emulated in standard QEMU," or whether it's reachable via some virtual bus. Is SDIO inherently a hardware-dependent thing, or is there a virtual bridge to it? Does it leverage something like virtio, USB gadget, loopback, netlink, binder, or sockets? I need to know how this driver interacts with the system. Okay, let's think more broadly about mac80211, mac80211_hwsim, USB, and SDIO. Does `rtw88` have any SDIO probe routines? What about USB probes? I need to check the kernel source. Time to dig into the kernel repo and search for anything related to SDIO, `rtw88`, and how they fit together. I need to understand the connection between these components to assess if this patch is even worth my time.
4/2	2026/09/08 15:58	tool	grepper	0m Args: { "Expression": "rtw_sdio_probe" } Results: { "Output": "drivers/net/wireless/realtek/rtw88/rtw8723cs.c=21=static struct sdio_driver rtw_8723cs_driver = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723cs.c-23-\t.id_table = rtw_8723cs_id_table,\ndrivers/net/wireless/realtek/rtw88/rtw8723cs.c:24:\t.probe = rtw_sdio_probe,\ndrivers/net/wireless/realtek/rtw88/rtw8723cs.c-25-\t.remove = rtw_sdio_remove,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723ds.c=27=static struct sdio_driver rtw_8723ds_driver = {\ndrivers/net/wireless/realtek/rtw88/rtw8723ds.c-28-\t.name = KBUILD_MODNAME,\ndrivers/net/wireless/realtek/rtw88/rtw8723ds.c:29:\t.probe = rtw_sdio_probe,\ndrivers/net/wireless/realtek/rtw88/rtw8723ds.c-30-\t.remove = rtw_sdio_remove,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821cs.c=22=static struct sdio_driver rtw_8821cs_driver = {\ndrivers/net/wireless/realtek/rtw88/rtw8821cs.c-23-\t.name = KBUILD_MODNAME,\ndrivers/net/wireless/realtek/rtw88/rtw8821cs.c:24:\t.probe = rtw_sdio_probe,\ndrivers/net/wireless/realtek/rtw88/rtw8821cs.c-25-\t.remove = rtw_sdio_remove,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822bs.c=22=static struct sdio_driver rtw_8822bs_driver = {\ndrivers/net/wireless/realtek/rtw88/rtw8822bs.c-23-\t.name = KBUILD_MODNAME,\ndrivers/net/wireless/realtek/rtw88/rtw8822bs.c:24:\t.probe = rtw_sdio_probe,\ndrivers/net/wireless/realtek/rtw88/rtw8822bs.c-25-\t.remove = rtw_sdio_remove,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c=22=static struct sdio_driver rtw_8822cs_driver = {\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c-23-\t.name = KBUILD_MODNAME,\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c:24:\t.probe = rtw_sdio_probe,\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c-25-\t.remove = rtw_sdio_remove,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=1747=static void rtw_sdio_deinit_tx(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1761-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1762:int rtw_sdio_probe(struct sdio_func sdio_func,\ndrivers/net/wireless/realtek/rtw88/sdio.c-1763-\t\t const struct sdio_device_id id)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1836-}\ndrivers/net/wireless/realtek/rtw88/sdio.c:1837:EXPORT_SYMBOL(rtw_sdio_probe);\ndrivers/net/wireless/realtek/rtw88/sdio.c-1838-\n--\ndrivers/net/wireless/realtek/rtw88/sdio.h=186=extern const struct dev_pm_ops rtw_sdio_pm_ops;\ndrivers/net/wireless/realtek/rtw88/sdio.h-187-\ndrivers/net/wireless/realtek/rtw88/sdio.h:188:int rtw_sdio_probe(struct sdio_func sdio_func,\ndrivers/net/wireless/realtek/rtw88/sdio.h-189-\t\t const struct sdio_device_id *id);\n" }
5/2	2026/09/08 15:58	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 16479 output: 20 thoughts: 98 Thoughts: SDIO Emulation and Fuzzing Feasibility Okay, let's get down to brass tacks. I need to figure out if we can leverage the existing infrastructure to test SDIO drivers, specifically using fuzzing. My initial thought is to see if there's any SDIO emulation or gadget functionality already present in the Linux kernel itself, within QEMU, or even in the context of syzkaller. The core question is this: can we probe and fuzz SDIO drivers through syzkaller or within a virtual environment? I'm already aware that syzkaller utilizes USB for fuzzing, and it does this through mechanisms like raw-gadget or the dummy_hcd. So, the key here is to determine if Linux offers an analogous SDIO gadget or a means to emulate an SDIO bus that syzkaller could utilize. My next step is to dive into the kernel source, specifically areas like `drivers/mmc` and other potentially relevant directories. I'll need to see if any such emulation or gadget capabilities exist that could be leveraged for SDIO driver testing.
6/2	2026/09/08 15:58	tool	grepper	0m Args: { "Expression": "sdio_register_driver" } Results: { "Output": "drivers/bluetooth/btmrvl_sdio.c=1745=static int __init btmrvl_sdio_init_module(void)\ndrivers/bluetooth/btmrvl_sdio.c-1746-{\ndrivers/bluetooth/btmrvl_sdio.c:1747:\tif (sdio_register_driver(\u0026bt_mrvl_sdio) != 0) {\ndrivers/bluetooth/btmrvl_sdio.c-1748-\t\tBT_ERR(\"SDIO Driver Registration Failed\");\n--\ndrivers/mmc/core/sdio_bus.c=274=static void sdio_legacy_shutdown(struct sdio_func func)\n--\ndrivers/mmc/core/sdio_bus.c-282-/\ndrivers/mmc/core/sdio_bus.c:283: \t__sdio_register_driver - register a function driver\ndrivers/mmc/core/sdio_bus.c-284- \t@drv: SDIO function driver\n--\ndrivers/mmc/core/sdio_bus.c-286- /\ndrivers/mmc/core/sdio_bus.c:287:int __sdio_register_driver(struct sdio_driver drv, struct module owner)\ndrivers/mmc/core/sdio_bus.c-288-{\n--\ndrivers/mmc/core/sdio_bus.c-301-}\ndrivers/mmc/core/sdio_bus.c:302:EXPORT_SYMBOL_GPL(__sdio_register_driver);\ndrivers/mmc/core/sdio_bus.c-303-\n--\ndrivers/mmc/core/sdio_uart.c=1115=static int __init sdio_uart_init(void)\n--\ndrivers/mmc/core/sdio_uart.c-1140-\ndrivers/mmc/core/sdio_uart.c:1141:\tret = sdio_register_driver(\u0026sdio_uart_driver);\ndrivers/mmc/core/sdio_uart.c-1142-\tif (ret)\n--\ndrivers/net/wireless/broadcom/b43/sdio.c=195=int b43_sdio_init(void)\ndrivers/net/wireless/broadcom/b43/sdio.c-196-{\ndrivers/net/wireless/broadcom/b43/sdio.c:197:\treturn sdio_register_driver(\u0026b43_sdio_driver);\ndrivers/net/wireless/broadcom/b43/sdio.c-198-}\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c=1271=int brcmf_sdio_register(void)\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c-1272-{\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c:1273:\treturn sdio_register_driver(\u0026brcmf_sdmmc_driver);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c-1274-}\n--\ndrivers/net/wireless/marvell/libertas/if_sdio.c=1390=static int __init if_sdio_init_module(void)\n--\ndrivers/net/wireless/marvell/libertas/if_sdio.c-1396-\ndrivers/net/wireless/marvell/libertas/if_sdio.c:1397:\tret = sdio_register_driver(\u0026if_sdio_driver);\ndrivers/net/wireless/marvell/libertas/if_sdio.c-1398-\n--\ndrivers/net/wireless/silabs/wfx/main.c=503=static int __init wfx_core_init(void)\n--\ndrivers/net/wireless/silabs/wfx/main.c-512-\tif (IS_ENABLED(CONFIG_MMC)) {\ndrivers/net/wireless/silabs/wfx/main.c:513:\t\tret = sdio_register_driver(\u0026wfx_sdio_driver);\ndrivers/net/wireless/silabs/wfx/main.c-514-\t\tif (ret)\n--\ndrivers/net/wireless/st/cw1200/cw1200_sdio.c=388=static int __init cw1200_sdio_init(void)\n--\ndrivers/net/wireless/st/cw1200/cw1200_sdio.c-400-\ndrivers/net/wireless/st/cw1200/cw1200_sdio.c:401:\tret = sdio_register_driver(\u0026sdio_driver);\ndrivers/net/wireless/st/cw1200/cw1200_sdio.c-402-\tif (ret)\n--\ndrivers/staging/rtl8723bs/os_dep/sdio_intf.c=453=static int __init rtw_drv_entry(void)\ndrivers/staging/rtl8723bs/os_dep/sdio_intf.c-454-{\ndrivers/staging/rtl8723bs/os_dep/sdio_intf.c:455:\treturn sdio_register_driver(\u0026rtl8723bs_sdio_driver);\ndrivers/staging/rtl8723bs/os_dep/sdio_intf.c-456-}\n--\ninclude/linux/mmc/sdio_func.h=75=struct sdio_driver {\n--\ninclude/linux/mmc/sdio_func.h-110-/* use a macro to avoid include chaining to get THIS_MODULE /\ninclude/linux/mmc/sdio_func.h:111:#define sdio_register_driver(drv) \\\ninclude/linux/mmc/sdio_func.h:112:\t__sdio_register_driver(drv, THIS_MODULE)\ninclude/linux/mmc/sdio_func.h:113:extern int __sdio_register_driver(struct sdio_driver , struct module );\ninclude/linux/mmc/sdio_func.h-114-extern void sdio_unregister_driver(struct sdio_driver );\n--\ninclude/linux/mmc/sdio_func.h-124-#define module_sdio_driver(__sdio_driver) \\\ninclude/linux/mmc/sdio_func.h:125:\tmodule_driver(__sdio_driver, sdio_register_driver, \\\ninclude/linux/mmc/sdio_func.h-126-\t\t sdio_unregister_driver)\n" }
7/2	2026/09/08 15:58	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 18538 output: 42 thoughts: 835 Thoughts: SDIO Card Emulation Conundrum Okay, so I need to figure out if I can emulate or instantiate SDIO cards, specifically, the Realtek RTL8723BS. First, I need to check if QEMU even has an MMC/SDIO host controller emulated. Does it? And, more importantly, does QEMU emulate the RTL8723BS specifically? Nope. No luck there. Can USB be used to emulate SDIO? No. Alright, what about using syzkaller to fuzz these SDIO devices? Can I do that without real hardware or a virtual bus like raw-gadget? Let's see... what virtual buses are available in syzkaller? Reading the documentation, it seems the primary concern is reachability. Fuzzing is only effective if the code can execute in a standard virtualized environment like GCE or QEMU, and uses software-emulated devices. That makes sense. Unreachable hardware, like vendor-specific PCIe switches or NICs not emulated in QEMU, are out. Reachable drivers are those that can be accessed via virtual buses: virtio, USB gadget, loopback, netlink, binder, sockets, etc. Now, the critical question: is `rtw88` an SDIO-only driver, or does it support USB or PCI as well? I need to check what `rtw88` supports, and how this patch interacts with that support. Looking at the patch diff: I see the `RTW_CHIP_TYPE_8723B` enum is added, and a `rtw_is_8723bs()` function is introduced. Then, there's SDIO-specific TX handling for 8723bs in `sdio.c`. Also, conditional code in `rx.c` and `tx.c` based on chipset type and HCI type. Specifically, the patch touches `sdio.c`, implying SDIO support, and includes logic for both USB and SDIO variants of the chip in different parts of the driver. So the question is, is `rtw88` reachable via USB? Let's dig into `rtw88` USB support to make sure that's the case. It looks like it might be!
8/2	2026/09/08 15:58	tool	grepper	0m Args: { "Expression": "RTW_HCI_TYPE_USB", "PathPrefix": "drivers/net/wireless/realtek/rtw88" } Results: { "Output": "drivers/net/wireless/realtek/rtw88/mac.c=62=static int rtw_mac_pre_system_cfg(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/mac.c-103-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/mac.c:104:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/mac.c-105-\t\tbreak;\n--\ndrivers/net/wireless/realtek/rtw88/mac.c=230=int rtw_pwr_seq_parser(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/mac.c-245-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/mac.c:246:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/mac.c-247-\t\tintf_mask = RTW_PWR_INTF_USB_MSK;\n--\ndrivers/net/wireless/realtek/rtw88/mac.c=272=static int rtw_mac_power_switch(struct rtw_dev rtwdev, bool pwr_on)\n--\ndrivers/net/wireless/realtek/rtw88/mac.c-292-\t\tcur_pwr = false;\ndrivers/net/wireless/realtek/rtw88/mac.c:293:\telse if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB \u0026\u0026\ndrivers/net/wireless/realtek/rtw88/mac.c-294-\t\t chip-\u003eid != RTW_CHIP_TYPE_8814A \u0026\u0026\n--\ndrivers/net/wireless/realtek/rtw88/mac.c-313-\ndrivers/net/wireless/realtek/rtw88/mac.c:314:\tif (pwr_on \u0026\u0026 rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB) {\ndrivers/net/wireless/realtek/rtw88/mac.c-315-\t\tif (chip-\u003eid == RTW_CHIP_TYPE_8822C \|\|\n--\ndrivers/net/wireless/realtek/rtw88/mac.c=546=send_firmware_pkt(struct rtw_dev rtwdev, u16 pg_addr, const u8 data, u32 size)\n--\ndrivers/net/wireless/realtek/rtw88/mac.c-549-\ndrivers/net/wireless/realtek/rtw88/mac.c:550:\tif (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB \u0026\u0026\ndrivers/net/wireless/realtek/rtw88/mac.c-551-\t !((size + TX_DESC_SIZE) \u0026 (512 - 1)))\n--\ndrivers/net/wireless/realtek/rtw88/mac.c=1087=static int txdma_queue_mapping(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/mac.c-1096-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/mac.c:1097:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/mac.c-1098-\t\tif (rtwdev-\u003ehci.bulkout_num == 2)\n--\ndrivers/net/wireless/realtek/rtw88/mac.c-1130-\t\trtw_write32(rtwdev, REG_SDIO_TX_CTRL, 0);\ndrivers/net/wireless/realtek/rtw88/mac.c:1131:\t} else if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB) {\ndrivers/net/wireless/realtek/rtw88/mac.c-1132-\t\trtw_write8_set(rtwdev, REG_TXDMA_PQ_MAP, BIT_RXDMA_ARBBW_EN);\n--\ndrivers/net/wireless/realtek/rtw88/mac.c=1192=static int __priority_queue_cfg(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/mac.c-1213-\ndrivers/net/wireless/realtek/rtw88/mac.c:1214:\tif (rtwdev-\u003ehci.type == RTW_HCI_TYPE_USB) {\ndrivers/net/wireless/realtek/rtw88/mac.c-1215-\t\trtw_write8_mask(rtwdev, REG_AUTO_LLT_V1, BIT_MASK_BLK_DESC_NUM,\n--\ndrivers/net/wireless/realtek/rtw88/mac.c=1260=static int priority_queue_cfg(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/mac.c-1275-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/mac.c:1276:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/mac.c-1277-\t\tif (rtwdev-\u003ehci.bulkout_num == 2)\n--\ndrivers/net/wireless/realtek/rtw88/main.c=1866=static int rtw_chip_parameter_setup(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/main.c-1880-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/main.c:1881:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/main.c-1882-\t\trtwdev-\u003ehci.rpwm_addr = 0xfe58;\n--\ndrivers/net/wireless/realtek/rtw88/main.h=55=enum rtw_hci_type {\ndrivers/net/wireless/realtek/rtw88/main.h-56-\tRTW_HCI_TYPE_PCIE,\ndrivers/net/wireless/realtek/rtw88/main.h:57:\tRTW_HCI_TYPE_USB,\ndrivers/net/wireless/realtek/rtw88/main.h-58-\tRTW_HCI_TYPE_SDIO,\n--\ndrivers/net/wireless/realtek/rtw88/phy.c=1103=void rtw_phy_setup_phy_cond(struct rtw_dev rtwdev, u32 pkg)\n--\ndrivers/net/wireless/realtek/rtw88/phy.c-1115-\tswitch (rtw_hci_type(rtwdev)) {\ndrivers/net/wireless/realtek/rtw88/phy.c:1116:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/phy.c-1117-\t\tcond.intf = INTF_USB;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c=179=static void efuse_debug_dump(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c-213-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c:214:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c-215-\t\trtw8723xu_efuse_debug(rtwdev, map);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c=253=static int __rtw8723x_read_efuse(struct rtw_dev rtwdev, u8 log_map)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c-284-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c:285:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/rtw8723x.c-286-\t\trtw8723xu_efuse_parsing(efuse, map);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c=32=static void rtw8814a_read_rfe_type(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-40-\t\tefuse-\u003erfe_option = 0;\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:41:\telse if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB)\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-42-\t\tefuse-\u003erfe_option = 1;\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c=73=static void rtw8814a_read_rf_type(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-81-\tcase 0xee: / 3T3R /\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:82:\t\tif (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB \u0026\u0026\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-83-\t\t rtwusb-\u003eudev-\u003espeed != USB_SPEED_SUPER)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c=129=static int rtw8814a_read_efuse(struct rtw_dev rtwdev, u8 log_map)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-166-\tswitch (rtw_hci_type(rtwdev)) {\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:167:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-168-\t\tether_addr_copy(efuse-\u003eaddr, map-\u003eu.mac_addr);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c=283=static void rtw8814a_phy_set_param(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-288-\t/* power on BB/RF domain /\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:289:\tif (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB)\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-290-\t\trtw_write8_set(rtwdev, REG_SYS_FUNC_EN, BIT_FEN_USBA);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-346-\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:347:\tif (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB) {\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-348-\t\t/ Reset USB mode switch setting /\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c=382=static int rtw8814a_mac_init(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-390-\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:391:\tif (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB)\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-392-\t\trtw_write8(rtwdev, REG_AUTO_LLT_V1 + 3,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-440-\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c:441:\tif (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB \u0026\u0026\ndrivers/net/wireless/realtek/rtw88/rtw8814a.c-442-\t rtwusb-\u003eudev-\u003espeed == USB_SPEED_SUPER) {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c=48=static int rtw8821c_read_efuse(struct rtw_dev rtwdev, u8 log_map)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c-96-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c:97:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/rtw8821c.c-98-\t\trtw8821cu_efuse_parsing(efuse, map);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c=41=static int rtw8822b_read_efuse(struct rtw_dev rtwdev, u8 log_map)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-71-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c:72:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-73-\t\trtw8822bu_efuse_parsing(efuse, map);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=44=static int rtw8822c_read_efuse(struct rtw_dev rtwdev, u8 log_map)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-73-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:74:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-75-\t\trtw8822cu_efuse_parsing(efuse, map);\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c=80=static void rtw8812a_read_rfe_type(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-85-\tif (map-\u003erfe_option == 0xff) {\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c:86:\t\tif (rtwdev-\u003ehci.type == RTW_HCI_TYPE_USB)\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-87-\t\t\tefuse-\u003erfe_option = 0;\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-115-\t\t efuse-\u003eext_lna_5g \|\| efuse-\u003eext_lna_2g)) {\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c:116:\t\t\tif (rtwdev-\u003ehci.type == RTW_HCI_TYPE_USB)\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-117-\t\t\t\tefuse-\u003erfe_option = 0;\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c=200=int rtw88xxa_read_efuse(struct rtw_dev rtwdev, u8 log_map)\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-260-\tswitch (rtw_hci_type(rtwdev)) {\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c:261:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-262-\t\tif (chip-\u003eid == RTW_CHIP_TYPE_8821A)\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c=418=static void rtw88xxau_init_queue_reserved_page(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-429-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c:430:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-431-\t\tif (rtwdev-\u003ehci.bulkout_num == 2)\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c=466=static int rtw88xxau_init_queue_priority(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-476-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c:477:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-478-\t\tif (bulkout_num == 2)\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-505-\t/ Packet in Hi Queue Tx immediately (No constraint for ATIM Period). /\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c:506:\tif (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB \u0026\u0026 bulkout_num == 4)\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.c-507-\t\trtw_write8(rtwdev, REG_HIQ_NO_LMT_EN, 0xff);\n--\ndrivers/net/wireless/realtek/rtw88/tx.c=196=void rtw_tx_report_enqueue(struct rtw_dev rtwdev, struct sk_buff skb, u8 sn)\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-211-\tif ((rtwdev-\u003echip-\u003eid == RTW_CHIP_TYPE_8723D \u0026\u0026\ndrivers/net/wireless/realtek/rtw88/tx.c:212:\t rtwdev-\u003ehci.type == RTW_HCI_TYPE_USB) \|\|\ndrivers/net/wireless/realtek/rtw88/tx.c-213-\t rtw_is_8723bs(rtwdev))\n--\ndrivers/net/wireless/realtek/rtw88/usb.c=1263=int rtw_usb_probe(struct usb_interface intf, const struct usb_device_id id)\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-1280-\trtwdev-\u003ehci.ops = \u0026rtw_usb_ops;\ndrivers/net/wireless/realtek/rtw88/usb.c:1281:\trtwdev-\u003ehci.type = RTW_HCI_TYPE_USB;\ndrivers/net/wireless/realtek/rtw88/usb.c-1282-\n--\ndrivers/net/wireless/realtek/rtw88/wow.c=435=static void rtw_wow_avoid_reset_mac(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/wow.c-443-\tcase RTW_HCI_TYPE_PCIE:\ndrivers/net/wireless/realtek/rtw88/wow.c:444:\tcase RTW_HCI_TYPE_USB:\ndrivers/net/wireless/realtek/rtw88/wow.c-445-\t\trtw_write8(rtwdev, REG_RSV_CTRL, BIT_WLOCK_1C_B6);\n" }
9/2	2026/09/08 15:58	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 25474 output: 46 thoughts: 99 Thoughts: Investigating rtw88 and USB Driver Support Okay, let's take a look at this `rtw88` situation. Right, so I see it explicitly supports USB. That's good, with the `rtw_usb_probe` function and those various USB drivers like `rtw8822cu` and `rtw8723du` as good examples. But, hold on a second. I need to be completely sure about something. Does `rtw88` actually have a driver for the 8723B chipset specifically for USB? Or is that particular chip family limited to SDIO for this implementation? I seem to remember it being SDIO. To nail this down, I'm going to quickly cross-reference the `RTW_CHIP_TYPE_8723B` define within the code to be absolutely certain of the USB driver availability. Need to verify that quickly.
10/2	2026/09/08 15:58	tool	grepper	0m Args: { "Expression": "RTW_CHIP_TYPE_8723B", "PathPrefix": "drivers/net/wireless/realtek/rtw88" } Results: { "Output": "drivers/net/wireless/realtek/rtw88/main.h=191=enum rtw_chip_type {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-196-\tRTW_CHIP_TYPE_8703B,\ndrivers/net/wireless/realtek/rtw88/main.h:197:\tRTW_CHIP_TYPE_8723B,\ndrivers/net/wireless/realtek/rtw88/main.h-198-\tRTW_CHIP_TYPE_8821A,\n--\ndrivers/net/wireless/realtek/rtw88/main.h=2198=static inline bool rtw_is_8723bs(struct rtw_dev rtwdev)\ndrivers/net/wireless/realtek/rtw88/main.h-2199-{\ndrivers/net/wireless/realtek/rtw88/main.h:2200:\treturn rtwdev-\u003echip-\u003eid == RTW_CHIP_TYPE_8723B \u0026\u0026\ndrivers/net/wireless/realtek/rtw88/main.h-2201-\t rtwdev-\u003ehci.type == RTW_HCI_TYPE_SDIO;\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=939=static void rtw_sdio_enable_rx_aggregation(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-943-\tswitch (rtwdev-\u003echip-\u003eid) {\ndrivers/net/wireless/realtek/rtw88/sdio.c:944:\tcase RTW_CHIP_TYPE_8723B:\ndrivers/net/wireless/realtek/rtw88/sdio.c-945-\tcase RTW_CHIP_TYPE_8703B:\n" }
11/2	2026/09/08 15:58	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 26317 output: 31 thoughts: 31 Thoughts: Okay, here's my take on those thoughts, framed as an expert's internal monologue: Investigating the Realtek Wireless Driver Structure Alright, time to get my hands dirty. Let's dive right into the `drivers/net/wireless/realtek/rtw88/` directory. I want to quickly understand the landscape of this Realtek wireless driver implementation. What modules are they using? What's the file structure looking like? Give me a directory listing so I can start forming a mental map of the key components. I need a quick visual of what's present before I start digging into any particular section. Let's see what we've got.
12/2	2026/09/08 15:59	tool	codesearch-dir-index	0m Args: { "Dir": "drivers/net/wireless/realtek/rtw88" } Results: { "Files": [ "bf.c", "bf.h", "coex.c", "coex.h", "debug.c", "debug.h", "efuse.c", "efuse.h", "fw.c", "fw.h", "hci.h", "led.c", "led.h", "mac.c", "mac.h", "mac80211.c", "main.c", "main.h", "pci.c", "pci.h", "phy.c", "phy.h", "ps.c", "ps.h", "reg.h", "regd.c", "regd.h", "rtw8703b.c", "rtw8703b.h", "rtw8703b_tables.c", "rtw8703b_tables.h", "rtw8723cs.c", "rtw8723d.c", "rtw8723d.h", "rtw8723d_table.c", "rtw8723d_table.h", "rtw8723de.c", "rtw8723ds.c", "rtw8723du.c", "rtw8723x.c", "rtw8723x.h", "rtw8812a.c", "rtw8812a.h", "rtw8812a_table.c", "rtw8812a_table.h", "rtw8812au.c", "rtw8814a.c", "rtw8814a.h", "rtw8814a_table.c", "rtw8814a_table.h", "rtw8814ae.c", "rtw8814au.c", "rtw8821a.c", "rtw8821a.h", "rtw8821a_table.c", "rtw8821a_table.h", "rtw8821au.c", "rtw8821c.c", "rtw8821c.h", "rtw8821c_table.c", "rtw8821c_table.h", "rtw8821ce.c", "rtw8821cs.c", "rtw8821cu.c", "rtw8822b.c", "rtw8822b.h", "rtw8822b_table.c", "rtw8822b_table.h", "rtw8822be.c", "rtw8822bs.c", "rtw8822bu.c", "rtw8822c.c", "rtw8822c.h", "rtw8822c_table.c", "rtw8822c_table.h", "rtw8822ce.c", "rtw8822cs.c", "rtw8822cu.c", "rtw88xxa.c", "rtw88xxa.h", "rx.c", "rx.h", "sar.c", "sar.h", "sdio.c", "sdio.h", "sec.c", "sec.h", "tx.c", "tx.h", "usb.c", "usb.h", "util.c", "util.h", "wow.c", "wow.h" ], "Subdirs": null }
13/2	2026/09/08 15:59	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 27475 output: 38 thoughts: 136 Thoughts: SDIO Driver Analysis Okay, here's what I'm seeing: I've got a whole suite of SDIO drivers here, specifically `rtw8723cs.c`, `rtw8723ds.c`, `rtw8821cs.c`, `rtw8822bs.c`, and `rtw8822cs.c`. They're all variations on the SDIO theme, which is good. But hold on, I just noticed something that gives me pause. I don't see an `rtw8723b.c` or `rtw8723bs.c` here. That's a little unusual, given the existing naming convention. Before I jump to any conclusions, I should probably double-check with a broader search. Let me see if I can find `8723b` referenced anywhere in the rtw88 codebase using `grepper`. I'll get a clearer picture from that.
14/2	2026/09/08 15:59	tool	grepper	0m Args: { "Expression": "8723b", "PathPrefix": "drivers/net/wireless/realtek/rtw88" } Results: { "Output": "drivers/net/wireless/realtek/rtw88/main.h=2193=static inline bool rtw_chip_has_tx_stbc(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/main.h-2197-\ndrivers/net/wireless/realtek/rtw88/main.h:2198:static inline bool rtw_is_8723bs(struct rtw_dev rtwdev)\ndrivers/net/wireless/realtek/rtw88/main.h-2199-{\n--\ndrivers/net/wireless/realtek/rtw88/rx.c=197=static void rtw_rx_fill_rx_status(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/rx.c-256-\t/\ndrivers/net/wireless/realtek/rtw88/rx.c:257:\t * Rtl8723cs and rtl8723bs drivers check for size \u003c 14 or size \u003e 8192\ndrivers/net/wireless/realtek/rtw88/rx.c-258-\t * and simply drop the packet.\n--\ndrivers/net/wireless/realtek/rtw88/rx.c-260-\tif (pkt_stat-\u003epkt_len == 0 \u0026\u0026\ndrivers/net/wireless/realtek/rtw88/rx.c:261:\t (rtwdev-\u003echip-\u003eid == RTW_CHIP_TYPE_8703B \|\| rtw_is_8723bs(rtwdev))) {\ndrivers/net/wireless/realtek/rtw88/rx.c-262-\t\trx_status-\u003eflag \|= RX_FLAG_NO_PSDU;\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=513=static int rtw_sdio_read_port(struct rtw_dev rtwdev, u8 buf, size_t count)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-560- /\ndrivers/net/wireless/realtek/rtw88/sdio.c:561:static void rtw_sdio_8723bs_store_free_txpg(struct rtw_dev rtwdev,\ndrivers/net/wireless/realtek/rtw88/sdio.c-562-\t\t\t\t\t u32 free_txpg)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-575-\ndrivers/net/wireless/realtek/rtw88/sdio.c:576:static bool rtw_sdio_8723bs_sync_free_txpg(struct rtw_dev rtwdev)\ndrivers/net/wireless/realtek/rtw88/sdio.c-577-{\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-582-\ndrivers/net/wireless/realtek/rtw88/sdio.c:583:\trtw_sdio_8723bs_store_free_txpg(rtwdev, free_txpg);\ndrivers/net/wireless/realtek/rtw88/sdio.c-584-\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-587-\ndrivers/net/wireless/realtek/rtw88/sdio.c:588:static int rtw_sdio_8723bs_pubq_num(struct rtw_dev rtwdev, u16 pubq_num)\ndrivers/net/wireless/realtek/rtw88/sdio.c-589-{\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-607-\ndrivers/net/wireless/realtek/rtw88/sdio.c:608:static int rtw_sdio_8723bs_init_free_txpg(struct rtw_dev rtwdev)\ndrivers/net/wireless/realtek/rtw88/sdio.c-609-{\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-615-\t/* Seed from the page table when the chip has nothing to report yet. /\ndrivers/net/wireless/realtek/rtw88/sdio.c:616:\tif (!rtw_sdio_8723bs_sync_free_txpg(rtwdev)) {\ndrivers/net/wireless/realtek/rtw88/sdio.c:617:\t\tret = rtw_sdio_8723bs_pubq_num(rtwdev, \u0026pubq_num);\ndrivers/net/wireless/realtek/rtw88/sdio.c-618-\t\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-634-/\ndrivers/net/wireless/realtek/rtw88/sdio.c:635: * Clamped at zero: a lost update against rtw_sdio_8723bs_consume_txpg() can\ndrivers/net/wireless/realtek/rtw88/sdio.c-636- * briefly drive a counter negative, and wrapping would hide the shortage\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-638- /\ndrivers/net/wireless/realtek/rtw88/sdio.c:639:static unsigned int rtw_sdio_8723bs_pages_free(struct rtw_dev rtwdev,\ndrivers/net/wireless/realtek/rtw88/sdio.c-640-\t\t\t\t\t atomic_t dedicated)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-656- /\ndrivers/net/wireless/realtek/rtw88/sdio.c:657:static atomic_t rtw_sdio_8723bs_free_txpg(struct rtw_dev rtwdev, u8 queue)\ndrivers/net/wireless/realtek/rtw88/sdio.c-658-{\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=678=static int rtw_sdio_check_free_txpg(struct rtw_dev rtwdev, u8 queue,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-682-\ndrivers/net/wireless/realtek/rtw88/sdio.c:683:\tif (rtw_is_8723bs(rtwdev)) {\ndrivers/net/wireless/realtek/rtw88/sdio.c-684-\t\tatomic_t dedicated;\ndrivers/net/wireless/realtek/rtw88/sdio.c-685-\ndrivers/net/wireless/realtek/rtw88/sdio.c:686:\t\tdedicated = rtw_sdio_8723bs_free_txpg(rtwdev, queue);\ndrivers/net/wireless/realtek/rtw88/sdio.c-687-\t\tif (!dedicated) {\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-691-\ndrivers/net/wireless/realtek/rtw88/sdio.c:692:\t\tpages_free = rtw_sdio_8723bs_pages_free(rtwdev, dedicated);\ndrivers/net/wireless/realtek/rtw88/sdio.c-693-\t\tpages_needed = DIV_ROUND_UP(count, rtwdev-\u003echip-\u003epage_size);\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-696-\ndrivers/net/wireless/realtek/rtw88/sdio.c:697:\t\trtw_sdio_8723bs_sync_free_txpg(rtwdev);\ndrivers/net/wireless/realtek/rtw88/sdio.c:698:\t\tpages_free = rtw_sdio_8723bs_pages_free(rtwdev, dedicated);\ndrivers/net/wireless/realtek/rtw88/sdio.c-699-\t} else if (rtw_chip_wcpu_8051(rtwdev)) {\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-777-\ndrivers/net/wireless/realtek/rtw88/sdio.c:778:static int rtw_sdio_8723bs_wait_tx_oqt(struct rtw_dev rtwdev)\ndrivers/net/wireless/realtek/rtw88/sdio.c-779-{\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-801-\ndrivers/net/wireless/realtek/rtw88/sdio.c:802:static void rtw_sdio_8723bs_consume_txpg(struct rtw_dev rtwdev, u8 queue,\ndrivers/net/wireless/realtek/rtw88/sdio.c-803-\t\t\t\t\t unsigned int pages)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-811-\ndrivers/net/wireless/realtek/rtw88/sdio.c:812:\tdedicated = rtw_sdio_8723bs_free_txpg(rtwdev, queue);\ndrivers/net/wireless/realtek/rtw88/sdio.c-813-\tif (!dedicated)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=825=static int rtw_sdio_write_to_port(struct rtw_dev rtwdev, struct sk_buff skb,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-855-\ndrivers/net/wireless/realtek/rtw88/sdio.c:856:static int rtw_sdio_write_port_8723bs(struct rtw_dev rtwdev,\ndrivers/net/wireless/realtek/rtw88/sdio.c-857-\t\t\t\t struct sk_buff skb,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-879-\ndrivers/net/wireless/realtek/rtw88/sdio.c:880:\tret = rtw_sdio_8723bs_wait_tx_oqt(rtwdev);\ndrivers/net/wireless/realtek/rtw88/sdio.c-881-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-891-\tpages = DIV_ROUND_UP(txsize, rtwdev-\u003echip-\u003epage_size);\ndrivers/net/wireless/realtek/rtw88/sdio.c:892:\trtw_sdio_8723bs_consume_txpg(rtwdev, queue, pages);\ndrivers/net/wireless/realtek/rtw88/sdio.c-893-\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=919=static int rtw_sdio_write_port(struct rtw_dev rtwdev, struct sk_buff skb,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-921-{\ndrivers/net/wireless/realtek/rtw88/sdio.c:922:\tif (rtw_is_8723bs(rtwdev))\ndrivers/net/wireless/realtek/rtw88/sdio.c:923:\t\treturn rtw_sdio_write_port_8723bs(rtwdev, skb, queue);\ndrivers/net/wireless/realtek/rtw88/sdio.c-924-\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=928=static void rtw_sdio_init(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-931-\ndrivers/net/wireless/realtek/rtw88/sdio.c:932:\tif (rtw_is_8723bs(rtwdev))\ndrivers/net/wireless/realtek/rtw88/sdio.c-933-\t\trtwsdio-\u003eirq_mask = REG_SDIO_HIMR_RX_REQUEST;\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=939=static void rtw_sdio_enable_rx_aggregation(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-971-\trtw_write8_set(rtwdev, REG_RXDMA_MODE, BIT_DMA_MODE);\ndrivers/net/wireless/realtek/rtw88/sdio.c:972:\tif (rtw_is_8723bs(rtwdev))\ndrivers/net/wireless/realtek/rtw88/sdio.c-973-\t\trtw_write8_mask(rtwdev, REG_RXDMA_MODE, BIT_DMA_BURST_CNT, 0x3);\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=1005=static int rtw_sdio_setup(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1016- /\ndrivers/net/wireless/realtek/rtw88/sdio.c:1017:static int rtw_sdio_8723bs_check_rqpn(struct rtw_dev rtwdev)\ndrivers/net/wireless/realtek/rtw88/sdio.c-1018-{\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1029-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1030:\tret = rtw_sdio_8723bs_pubq_num(rtwdev, \u0026pubq_num);\ndrivers/net/wireless/realtek/rtw88/sdio.c-1031-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=1043=static int rtw_sdio_start(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1046-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1047:\tif (rtw_is_8723bs(rtwdev)) {\ndrivers/net/wireless/realtek/rtw88/sdio.c:1048:\t\tint ret = rtw_sdio_8723bs_check_rqpn(rtwdev);\ndrivers/net/wireless/realtek/rtw88/sdio.c-1049-\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1052-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1053:\t\tret = rtw_sdio_8723bs_init_free_txpg(rtwdev);\ndrivers/net/wireless/realtek/rtw88/sdio.c-1054-\t\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1059-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1060:\tif (rtw_is_8723bs(rtwdev)) {\ndrivers/net/wireless/realtek/rtw88/sdio.c-1061-\t\tclear = rtw_read32(rtwdev, REG_SDIO_HISR) \u0026 RTW_SDIO_HISR_CLEAR_MASK;\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=1141=static void rtw_sdio_interface_cfg(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1148-\tval \u0026= 0xfff8;\ndrivers/net/wireless/realtek/rtw88/sdio.c:1149:\tif (rtw_is_8723bs(rtwdev))\ndrivers/net/wireless/realtek/rtw88/sdio.c-1150-\t\tval \|= BIT_SDIO_TX_CTRL_ALWAYS_RECOGNIZE;\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=1230=static int rtw_sdio_write_data_h2c(struct rtw_dev rtwdev, u8 buf, u32 size)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1247- /\ndrivers/net/wireless/realtek/rtw88/sdio.c:1248:static void rtw_sdio_8723bs_stop_tx_queue(struct rtw_dev rtwdev,\ndrivers/net/wireless/realtek/rtw88/sdio.c-1249-\t\t\t\t\t enum rtw_tx_queue_type queue,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1253-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1254:\tif (!rtw_is_8723bs(rtwdev) \|\| queue \u003e= RTW_TX_QUEUE_BCN)\ndrivers/net/wireless/realtek/rtw88/sdio.c-1255-\t\treturn;\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1268-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1269:static void rtw_sdio_8723bs_wake_tx_queue(struct rtw_dev rtwdev,\ndrivers/net/wireless/realtek/rtw88/sdio.c-1270-\t\t\t\t\t enum rtw_tx_queue_type queue,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1274-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1275:\tif (!rtw_is_8723bs(rtwdev) \|\| queue \u003e= RTW_TX_QUEUE_BCN)\ndrivers/net/wireless/realtek/rtw88/sdio.c-1276-\t\treturn;\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=1290=static int rtw_sdio_tx_write(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1306-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1307:\trtw_sdio_8723bs_stop_tx_queue(rtwdev, queue, q_map);\ndrivers/net/wireless/realtek/rtw88/sdio.c-1308-\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=1446=static void rtw_sdio_handle_interrupt(struct sdio_func sdio_func)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1471-\t /\ndrivers/net/wireless/realtek/rtw88/sdio.c:1472:\tif (rtw_is_8723bs(rtwdev))\ndrivers/net/wireless/realtek/rtw88/sdio.c-1473-\t\thisr \u0026= RTW_SDIO_HISR_CLEAR_MASK;\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=1616=static int rtw_sdio_process_tx_queue(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1638-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1639:\trtw_sdio_8723bs_wake_tx_queue(rtwdev, queue, q_map);\ndrivers/net/wireless/realtek/rtw88/sdio.c-1640-\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1653- /\ndrivers/net/wireless/realtek/rtw88/sdio.c:1654:static bool rtw_sdio_8723bs_reschedule_tx(struct rtw_dev rtwdev,\ndrivers/net/wireless/realtek/rtw88/sdio.c-1655-\t\t\t\t\t struct rtw_sdio_work_data work_data,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1660-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1661:\tif (!rtw_is_8723bs(rtwdev))\ndrivers/net/wireless/realtek/rtw88/sdio.c-1662-\t\treturn false;\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=1676=static void rtw_sdio_tx_handler(struct work_struct work)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1696-\ndrivers/net/wireless/realtek/rtw88/sdio.c:1697:\t\t\tif (rtw_sdio_8723bs_reschedule_tx(rtwdev, work_data,\ndrivers/net/wireless/realtek/rtw88/sdio.c-1698-\t\t\t\t\t\t\t queue, ret))\n--\ndrivers/net/wireless/realtek/rtw88/tx.c=196=void rtw_tx_report_enqueue(struct rtw_dev rtwdev, struct sk_buff skb, u8 sn)\n--\ndrivers/net/wireless/realtek/rtw88/tx.c-212-\t rtwdev-\u003ehci.type == RTW_HCI_TYPE_USB) \|\|\ndrivers/net/wireless/realtek/rtw88/tx.c:213:\t rtw_is_8723bs(rtwdev))\ndrivers/net/wireless/realtek/rtw88/tx.c-214-\t\ttimeout = msecs_to_jiffies(2500);\n" }
15/2	2026/09/08 15:59	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 33714 output: 46 thoughts: 450 Thoughts: Analyzing the Code's Chipset Dependencies Okay, let's break this down. I see that `rtw_is_8723bs(rtwdev)` is being checked in several key locations: `rtw_rx_fill_rx_status` in `rx.c`, `rtw_tx_report_enqueue` in `tx.c`, and also in `sdio.c`. My immediate concern is, could a USB or PCIe device inadvertently execute this modified code path? I need to verify the conditions. Looking specifically at `rx.c`, I see a conditional statement: `if (pkt_stat->pkt_len == 0 && (rtwdev->chip->id == RTW_CHIP_TYPE_8703B \|\| rtw_is_8723bs(rtwdev)))`. Alright, so if the packet length is zero and the chip ID matches either `RTW_CHIP_TYPE_8703B` or the `rtw_is_8723bs` function returns true, we're in this conditional block. Now, let's dissect the chip IDs. What does `rtw_is_8723bs` actually mean? From the code, it looks like `rtw_is_8723bs` is checking for `rtwdev->chip->id == RTW_CHIP_TYPE_8723B && rtwdev->hci.type == RTW_HCI_TYPE_SDIO`. Right, that confirms it's an SDIO-specific check. But what about `RTW_CHIP_TYPE_8703B`? Is that also tied to SDIO, or could it be USB or PCIe? I need to find out what hardware that ID corresponds to. I'm going to search for instances of `RTW_CHIP_TYPE_8703B` to see where it's defined and how it's used to determine the device's interface.
16/2	2026/09/08 15:59	tool	grepper	0m Args: { "Expression": "RTW_CHIP_TYPE_8703B", "PathPrefix": "drivers/net/wireless/realtek/rtw88" } Results: { "Output": "drivers/net/wireless/realtek/rtw88/mac.c=948=static int __rtw_download_firmware_legacy(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/mac.c-953-\t/ reset firmware if still present /\ndrivers/net/wireless/realtek/rtw88/mac.c:954:\tif (rtwdev-\u003echip-\u003eid == RTW_CHIP_TYPE_8703B \u0026\u0026\ndrivers/net/wireless/realtek/rtw88/mac.c-955-\t rtw_read8_mask(rtwdev, REG_MCUFW_CTRL, BIT_RAM_DL_SEL)) {\n--\ndrivers/net/wireless/realtek/rtw88/main.h=191=enum rtw_chip_type {\n--\ndrivers/net/wireless/realtek/rtw88/main.h-195-\tRTW_CHIP_TYPE_8821C,\ndrivers/net/wireless/realtek/rtw88/main.h:196:\tRTW_CHIP_TYPE_8703B,\ndrivers/net/wireless/realtek/rtw88/main.h-197-\tRTW_CHIP_TYPE_8723B,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c=1886=const struct rtw_chip_info rtw8703b_hw_spec = {\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1887-\t.ops = \u0026rtw8703b_ops,\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c:1888:\t.id = RTW_CHIP_TYPE_8703B,\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1889-\n--\ndrivers/net/wireless/realtek/rtw88/rx.c=197=static void rtw_rx_fill_rx_status(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/rx.c-260-\tif (pkt_stat-\u003epkt_len == 0 \u0026\u0026\ndrivers/net/wireless/realtek/rtw88/rx.c:261:\t (rtwdev-\u003echip-\u003eid == RTW_CHIP_TYPE_8703B \|\| rtw_is_8723bs(rtwdev))) {\ndrivers/net/wireless/realtek/rtw88/rx.c-262-\t\trx_status-\u003eflag \|= RX_FLAG_NO_PSDU;\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=939=static void rtw_sdio_enable_rx_aggregation(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-944-\tcase RTW_CHIP_TYPE_8723B:\ndrivers/net/wireless/realtek/rtw88/sdio.c:945:\tcase RTW_CHIP_TYPE_8703B:\ndrivers/net/wireless/realtek/rtw88/sdio.c-946-\tcase RTW_CHIP_TYPE_8821A:\n--\ndrivers/net/wireless/realtek/rtw88/usb.c=929=static void rtw_usb_dynamic_rx_agg(struct rtw_dev rtwdev, bool enable)\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-944-\t\tbreak;\ndrivers/net/wireless/realtek/rtw88/usb.c:945:\tcase RTW_CHIP_TYPE_8703B:\ndrivers/net/wireless/realtek/rtw88/usb.c-946-\t\t/* Likely not found in USB devices. */\n" }
17/2	2026/09/08 15:59	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 35680 output: 44 thoughts: 60 Thoughts: Investigating the RTL8703B Driver Dependencies Okay, let's break this down. First, I need to remind myself… `rtw8703b` is used by `rtw8723cs`, which I know is the SDIO variant, the RTL8723CS. Now, I need to understand the relationship and usage of `rtw8703b_hw_spec`. I'll want to trace how that particular specification is utilized across the broader driver framework. This should help me better understand any potential interactions and any areas for optimization or bug fixing. Time to dig in!
18/2	2026/09/08 15:59	tool	grepper	0m Args: { "Expression": "rtw8703b_hw_spec", "PathPrefix": "drivers/net/wireless/realtek/rtw88" } Results: { "Output": "drivers/net/wireless/realtek/rtw88/rtw8703b.c=1836=static const struct rtw_chip_ops rtw8703b_ops = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1885-\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c:1886:const struct rtw_chip_info rtw8703b_hw_spec = {\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1887-\t.ops = \u0026rtw8703b_ops,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-2000-};\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c:2001:EXPORT_SYMBOL(rtw8703b_hw_spec);\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-2002-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.h-8-\ndrivers/net/wireless/realtek/rtw88/rtw8703b.h:9:extern const struct rtw_chip_info rtw8703b_hw_spec;\ndrivers/net/wireless/realtek/rtw88/rtw8703b.h-10-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723cs.c=11=static const struct sdio_device_id rtw_8723cs_id_table[] = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8723cs.c-14-\t\t\t SDIO_DEVICE_ID_REALTEK_RTW8723CS),\ndrivers/net/wireless/realtek/rtw88/rtw8723cs.c:15:\t\t.driver_data = (kernel_ulong_t)\u0026rtw8703b_hw_spec,\ndrivers/net/wireless/realtek/rtw88/rtw8723cs.c-16-\t},\n" }
19/2	2026/09/08 15:59	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 36511 output: 17 thoughts: 253 Thoughts: My Line of Inquiry: SDIO Driver Fuzzing Potential Okay, so `rtw8703b_hw_spec` is exclusively tied to `rtw8723cs.c`, which, as I recall, is an SDIO device driver. My immediate question is whether SDIO devices are even viable candidates for fuzzing, and specifically, whether syzkaller and my virtualized test environments can handle them. The key question is whether SDIO is supported in the kernel and by tools such as syzkaller in virtualised environemnts, such as QEMU or GCE. Hold on, let's step back and consider syzkaller's existing hardware fuzzing strategies. I know it leverages raw-gadget for USB drivers, employing functions like `syz_usb_connect` and `syz_usb_ep_write`. Network drivers get love via `tun`, `tap`, `veth`, and all those kernel networking tools. It also tackles virtual buses with virtio devices, and virtual HCI for Bluetooth using vhci. So far, so good. But where does SDIO fall into this picture? I need to search syzkaller's source code, as well as the kernel itself, to determine if any virtual SDIO bus, driver, or gadget is available to facilitate fuzzing. That's the crucial missing piece.
20/2	2026/09/08 15:59	tool	grepper	0m Args: { "Expression": "CONFIG_MMC" } Results: { "Output": "\nFull output is too long, showing 500 out of 1292 lines.\nUse more precise expression if possible.\n\nDocumentation/admin-guide/devices.txt-2441-\t\tThe start of next SD/MMC card can be configured with\nDocumentation/admin-guide/devices.txt:2442:\t\tCONFIG_MMC_BLOCK_MINORS, or overridden at boot/modprobe\nDocumentation/admin-guide/devices.txt-2443-\t\ttime using the mmcblk.perdev_minors option. That would\n--\nDocumentation/arch/arm/omap/omap.rst=15=v4.18+\t\tUpdate is needed for custom .config files to make sure\nDocumentation/arch/arm/omap/omap.rst:16:\t\tCONFIG_MMC_SDHCI_OMAP is enabled for all MMC instances\nDocumentation/arch/arm/omap/omap.rst-17-\t\tto work in DRA7 and K2G based boards.\n--\nDocumentation/driver-api/mmc/mmc-test.rst=27=To use the ``mmc_test`` framework, follow these steps:\n--\nDocumentation/driver-api/mmc/mmc-test.rst-30-\nDocumentation/driver-api/mmc/mmc-test.rst:31: Ensure that the ``CONFIG_MMC_TEST`` kernel configuration option is enabled. This can be done by configuring the kernel:\nDocumentation/driver-api/mmc/mmc-test.rst-32-\n--\nDocumentation/driver-api/mmc/mmc-test.rst-46-\nDocumentation/driver-api/mmc/mmc-test.rst:47: echo \"CONFIG_MMC_TEST=y\" \u003e\u003e .config\nDocumentation/driver-api/mmc/mmc-test.rst-48-\n--\narch/arc/configs/axs101_defconfig=84=CONFIG_USB_STORAGE=y\narch/arc/configs/axs101_defconfig:85:CONFIG_MMC=y\narch/arc/configs/axs101_defconfig:86:CONFIG_MMC_SDHCI=y\narch/arc/configs/axs101_defconfig:87:CONFIG_MMC_SDHCI_PLTFM=y\narch/arc/configs/axs101_defconfig:88:CONFIG_MMC_DW=y\narch/arc/configs/axs101_defconfig-89-# CONFIG_IOMMU_SUPPORT is not set\n--\narch/arc/configs/axs103_defconfig=82=CONFIG_USB_STORAGE=y\narch/arc/configs/axs103_defconfig:83:CONFIG_MMC=y\narch/arc/configs/axs103_defconfig:84:CONFIG_MMC_SDHCI=y\narch/arc/configs/axs103_defconfig:85:CONFIG_MMC_SDHCI_PLTFM=y\narch/arc/configs/axs103_defconfig:86:CONFIG_MMC_DW=y\narch/arc/configs/axs103_defconfig-87-# CONFIG_IOMMU_SUPPORT is not set\n--\narch/arc/configs/axs103_smp_defconfig=84=CONFIG_USB_STORAGE=y\narch/arc/configs/axs103_smp_defconfig:85:CONFIG_MMC=y\narch/arc/configs/axs103_smp_defconfig:86:CONFIG_MMC_SDHCI=y\narch/arc/configs/axs103_smp_defconfig:87:CONFIG_MMC_SDHCI_PLTFM=y\narch/arc/configs/axs103_smp_defconfig:88:CONFIG_MMC_DW=y\narch/arc/configs/axs103_smp_defconfig-89-# CONFIG_IOMMU_SUPPORT is not set\n--\narch/arc/configs/hsdk_defconfig=71=CONFIG_USB_STORAGE=y\narch/arc/configs/hsdk_defconfig:72:CONFIG_MMC=y\narch/arc/configs/hsdk_defconfig:73:CONFIG_MMC_SDHCI=y\narch/arc/configs/hsdk_defconfig:74:CONFIG_MMC_SDHCI_PLTFM=y\narch/arc/configs/hsdk_defconfig:75:CONFIG_MMC_DW=y\narch/arc/configs/hsdk_defconfig-76-CONFIG_DMADEVICES=y\n--\narch/arc/configs/vdk_hs38_smp_defconfig=76=CONFIG_USB_SERIAL=y\narch/arc/configs/vdk_hs38_smp_defconfig:77:CONFIG_MMC=y\narch/arc/configs/vdk_hs38_smp_defconfig:78:CONFIG_MMC_SDHCI=y\narch/arc/configs/vdk_hs38_smp_defconfig:79:CONFIG_MMC_SDHCI_PLTFM=y\narch/arc/configs/vdk_hs38_smp_defconfig:80:CONFIG_MMC_DW=y\narch/arc/configs/vdk_hs38_smp_defconfig-81-CONFIG_UIO=y\n--\narch/arm/configs/am200epdkit_defconfig=73=CONFIG_USB_ETH=m\narch/arm/configs/am200epdkit_defconfig:74:CONFIG_MMC=y\narch/arm/configs/am200epdkit_defconfig:75:CONFIG_MMC_PXA=y\narch/arm/configs/am200epdkit_defconfig-76-# CONFIG_DNOTIFY is not set\n--\narch/arm/configs/aspeed_g4_defconfig=187=CONFIG_USB_CONFIGFS_F_PRINTER=y\narch/arm/configs/aspeed_g4_defconfig:188:CONFIG_MMC=y\narch/arm/configs/aspeed_g4_defconfig-189-# CONFIG_PWRSEQ_EMMC is not set\narch/arm/configs/aspeed_g4_defconfig-190-# CONFIG_PWRSEQ_SIMPLE is not set\narch/arm/configs/aspeed_g4_defconfig:191:CONFIG_MMC_SDHCI=y\narch/arm/configs/aspeed_g4_defconfig:192:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/aspeed_g4_defconfig:193:CONFIG_MMC_SDHCI_OF_ASPEED=y\narch/arm/configs/aspeed_g4_defconfig-194-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/aspeed_g5_defconfig=220=CONFIG_USB_CONFIGFS_F_HID=y\narch/arm/configs/aspeed_g5_defconfig:221:CONFIG_MMC=y\narch/arm/configs/aspeed_g5_defconfig:222:CONFIG_MMC_SDHCI=y\narch/arm/configs/aspeed_g5_defconfig:223:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/aspeed_g5_defconfig:224:CONFIG_MMC_SDHCI_OF_ASPEED=y\narch/arm/configs/aspeed_g5_defconfig-225-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/at91_dt_defconfig=175=CONFIG_USB_G_SERIAL=y\narch/arm/configs/at91_dt_defconfig:176:CONFIG_MMC=y\narch/arm/configs/at91_dt_defconfig:177:CONFIG_MMC_SDHCI=y\narch/arm/configs/at91_dt_defconfig:178:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/at91_dt_defconfig:179:CONFIG_MMC_SDHCI_OF_AT91=y\narch/arm/configs/at91_dt_defconfig:180:CONFIG_MMC_ATMELMCI=y\narch/arm/configs/at91_dt_defconfig:181:CONFIG_MMC_SPI=m\narch/arm/configs/at91_dt_defconfig-182-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/axm55xx_defconfig=184=CONFIG_USB_STORAGE=y\narch/arm/configs/axm55xx_defconfig:185:CONFIG_MMC=y\narch/arm/configs/axm55xx_defconfig:186:CONFIG_MMC_ARMMMCI=y\narch/arm/configs/axm55xx_defconfig-187-CONFIG_DMADEVICES=y\n--\narch/arm/configs/bcm2835_defconfig=123=CONFIG_USB_G_SERIAL=m\narch/arm/configs/bcm2835_defconfig:124:CONFIG_MMC=y\narch/arm/configs/bcm2835_defconfig:125:CONFIG_MMC_SDHCI=y\narch/arm/configs/bcm2835_defconfig:126:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/bcm2835_defconfig:127:CONFIG_MMC_SDHCI_IPROC=y\narch/arm/configs/bcm2835_defconfig:128:CONFIG_MMC_BCM2835=y\narch/arm/configs/bcm2835_defconfig-129-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/davinci_all_defconfig=198=CONFIG_USB_CDC_COMPOSITE=m\narch/arm/configs/davinci_all_defconfig:199:CONFIG_MMC=y\narch/arm/configs/davinci_all_defconfig:200:CONFIG_MMC_DAVINCI=y\narch/arm/configs/davinci_all_defconfig-201-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/dove_defconfig=81=CONFIG_USB_STORAGE=y\narch/arm/configs/dove_defconfig:82:CONFIG_MMC=y\narch/arm/configs/dove_defconfig:83:CONFIG_MMC_SDHCI=y\narch/arm/configs/dove_defconfig:84:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/dove_defconfig:85:CONFIG_MMC_SDHCI_DOVE=y\narch/arm/configs/dove_defconfig-86-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/ep93xx_defconfig=90=CONFIG_USB_SERIAL_PL2303=y\narch/arm/configs/ep93xx_defconfig:91:CONFIG_MMC=y\narch/arm/configs/ep93xx_defconfig:92:CONFIG_MMC_SPI=y\narch/arm/configs/ep93xx_defconfig-93-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/exynos_defconfig=277=CONFIG_USB_ETH=y\narch/arm/configs/exynos_defconfig:278:CONFIG_MMC=y\narch/arm/configs/exynos_defconfig:279:CONFIG_MMC_BLOCK_MINORS=16\narch/arm/configs/exynos_defconfig:280:CONFIG_MMC_SDHCI=y\narch/arm/configs/exynos_defconfig:281:CONFIG_MMC_SDHCI_S3C=y\narch/arm/configs/exynos_defconfig:282:CONFIG_MMC_SDHCI_S3C_DMA=y\narch/arm/configs/exynos_defconfig:283:CONFIG_MMC_DW=y\narch/arm/configs/exynos_defconfig:284:CONFIG_MMC_DW_EXYNOS=y\narch/arm/configs/exynos_defconfig-285-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/hisi_defconfig=66=CONFIG_NOP_USB_XCEIV=y\narch/arm/configs/hisi_defconfig:67:CONFIG_MMC=y\narch/arm/configs/hisi_defconfig:68:CONFIG_MMC_DW=y\narch/arm/configs/hisi_defconfig:69:CONFIG_MMC_DW_PLTFM=y\narch/arm/configs/hisi_defconfig-70-CONFIG_RTC_CLASS=y\n--\narch/arm/configs/imx_v4_v5_defconfig=125=CONFIG_USB_ETH=m\narch/arm/configs/imx_v4_v5_defconfig:126:CONFIG_MMC=y\narch/arm/configs/imx_v4_v5_defconfig:127:CONFIG_MMC_SDHCI=y\narch/arm/configs/imx_v4_v5_defconfig:128:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/imx_v4_v5_defconfig:129:CONFIG_MMC_SDHCI_ESDHC_IMX=y\narch/arm/configs/imx_v4_v5_defconfig:130:CONFIG_MMC_MXC=y\narch/arm/configs/imx_v4_v5_defconfig-131-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/imx_v6_v7_defconfig=370=CONFIG_USB_G_SERIAL=m\narch/arm/configs/imx_v6_v7_defconfig:371:CONFIG_MMC=y\narch/arm/configs/imx_v6_v7_defconfig:372:CONFIG_MMC_SDHCI=y\narch/arm/configs/imx_v6_v7_defconfig:373:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/imx_v6_v7_defconfig:374:CONFIG_MMC_SDHCI_ESDHC_IMX=y\narch/arm/configs/imx_v6_v7_defconfig-375-CONFIG_LEDS_GPIO=y\n--\narch/arm/configs/imxrt_defconfig=20=CONFIG_GPIO_MXC=y\narch/arm/configs/imxrt_defconfig:21:CONFIG_MMC=y\narch/arm/configs/imxrt_defconfig:22:CONFIG_MMC_SDHCI=y\narch/arm/configs/imxrt_defconfig:23:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/imxrt_defconfig:24:CONFIG_MMC_SDHCI_ESDHC_IMX=y\narch/arm/configs/imxrt_defconfig-25-CONFIG_DMADEVICES=y\n--\narch/arm/configs/integrator_defconfig=61=CONFIG_LOGO=y\narch/arm/configs/integrator_defconfig:62:CONFIG_MMC=y\narch/arm/configs/integrator_defconfig:63:CONFIG_MMC_ARMMMCI=y\narch/arm/configs/integrator_defconfig-64-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/keystone_defconfig=174=CONFIG_NOP_USB_XCEIV=y\narch/arm/configs/keystone_defconfig:175:CONFIG_MMC=y\narch/arm/configs/keystone_defconfig:176:CONFIG_MMC_SDHCI=y\narch/arm/configs/keystone_defconfig:177:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/keystone_defconfig:178:CONFIG_MMC_OMAP_HS=y\narch/arm/configs/keystone_defconfig:179:CONFIG_MMC_SDHCI_OMAP=y\narch/arm/configs/keystone_defconfig-180-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/lpc18xx_defconfig=117=CONFIG_USB_STORAGE=y\narch/arm/configs/lpc18xx_defconfig:118:CONFIG_MMC=y\narch/arm/configs/lpc18xx_defconfig:119:CONFIG_MMC_DW=y\narch/arm/configs/lpc18xx_defconfig-120-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/lpc32xx_defconfig=129=CONFIG_USB_G_SERIAL=m\narch/arm/configs/lpc32xx_defconfig:130:CONFIG_MMC=y\narch/arm/configs/lpc32xx_defconfig:131:CONFIG_MMC_ARMMMCI=y\narch/arm/configs/lpc32xx_defconfig:132:CONFIG_MMC_SPI=y\narch/arm/configs/lpc32xx_defconfig-133-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/mmp2_defconfig=47=CONFIG_BACKLIGHT_MAX8925=y\n--\narch/arm/configs/mmp2_defconfig-49-# CONFIG_USB_SUPPORT is not set\narch/arm/configs/mmp2_defconfig:50:CONFIG_MMC=y\narch/arm/configs/mmp2_defconfig-51-CONFIG_RTC_CLASS=y\n--\narch/arm/configs/moxart_defconfig=95=CONFIG_MOXART_WDT=y\narch/arm/configs/moxart_defconfig-96-# CONFIG_USB_SUPPORT is not set\narch/arm/configs/moxart_defconfig:97:CONFIG_MMC=y\narch/arm/configs/moxart_defconfig:98:CONFIG_MMC_SDHCI=y\narch/arm/configs/moxart_defconfig:99:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/moxart_defconfig:100:CONFIG_MMC_MOXART=y\narch/arm/configs/moxart_defconfig-101-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/multi_v5_defconfig=218=CONFIG_USB_CONFIGFS=m\narch/arm/configs/multi_v5_defconfig:219:CONFIG_MMC=y\narch/arm/configs/multi_v5_defconfig-220-CONFIG_SDIO_UART=y\narch/arm/configs/multi_v5_defconfig:221:CONFIG_MMC_SDHCI=m\narch/arm/configs/multi_v5_defconfig:222:CONFIG_MMC_SDHCI_PLTFM=m\narch/arm/configs/multi_v5_defconfig:223:CONFIG_MMC_SDHCI_OF_ASPEED=m\narch/arm/configs/multi_v5_defconfig:224:CONFIG_MMC_ATMELMCI=y\narch/arm/configs/multi_v5_defconfig:225:CONFIG_MMC_MVSDIO=y\narch/arm/configs/multi_v5_defconfig:226:CONFIG_MMC_SUNXI=y\narch/arm/configs/multi_v5_defconfig-227-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/multi_v7_defconfig=952=CONFIG_TYPEC_STUSB160X=m\narch/arm/configs/multi_v7_defconfig:953:CONFIG_MMC=y\narch/arm/configs/multi_v7_defconfig:954:CONFIG_MMC_BLOCK_MINORS=16\narch/arm/configs/multi_v7_defconfig:955:CONFIG_MMC_ARMMMCI=y\narch/arm/configs/multi_v7_defconfig:956:CONFIG_MMC_SDHCI=y\narch/arm/configs/multi_v7_defconfig:957:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/multi_v7_defconfig:958:CONFIG_MMC_SDHCI_OF_ARASAN=y\narch/arm/configs/multi_v7_defconfig:959:CONFIG_MMC_SDHCI_OF_AT91=y\narch/arm/configs/multi_v7_defconfig:960:CONFIG_MMC_SDHCI_OF_ESDHC=y\narch/arm/configs/multi_v7_defconfig:961:CONFIG_MMC_SDHCI_ESDHC_IMX=y\narch/arm/configs/multi_v7_defconfig:962:CONFIG_MMC_SDHCI_DOVE=y\narch/arm/configs/multi_v7_defconfig:963:CONFIG_MMC_SDHCI_TEGRA=y\narch/arm/configs/multi_v7_defconfig:964:CONFIG_MMC_SDHCI_S3C=y\narch/arm/configs/multi_v7_defconfig:965:CONFIG_MMC_SDHCI_PXAV3=y\narch/arm/configs/multi_v7_defconfig:966:CONFIG_MMC_SDHCI_PXAV2=m\narch/arm/configs/multi_v7_defconfig:967:CONFIG_MMC_SDHCI_SPEAR=y\narch/arm/configs/multi_v7_defconfig:968:CONFIG_MMC_SDHCI_S3C_DMA=y\narch/arm/configs/multi_v7_defconfig:969:CONFIG_MMC_SDHCI_BCM_KONA=y\narch/arm/configs/multi_v7_defconfig:970:CONFIG_MMC_MESON_MX_SDHC=y\narch/arm/configs/multi_v7_defconfig:971:CONFIG_MMC_MESON_MX_SDIO=y\narch/arm/configs/multi_v7_defconfig:972:CONFIG_MMC_SDHCI_ST=y\narch/arm/configs/multi_v7_defconfig:973:CONFIG_MMC_OMAP=y\narch/arm/configs/multi_v7_defconfig:974:CONFIG_MMC_OMAP_HS=y\narch/arm/configs/multi_v7_defconfig:975:CONFIG_MMC_ATMELMCI=y\narch/arm/configs/multi_v7_defconfig:976:CONFIG_MMC_SDHCI_MSM=y\narch/arm/configs/multi_v7_defconfig:977:CONFIG_MMC_MVSDIO=y\narch/arm/configs/multi_v7_defconfig:978:CONFIG_MMC_SDHI=y\narch/arm/configs/multi_v7_defconfig:979:CONFIG_MMC_UNIPHIER=y\narch/arm/configs/multi_v7_defconfig:980:CONFIG_MMC_DW=y\narch/arm/configs/multi_v7_defconfig:981:CONFIG_MMC_DW_EXYNOS=y\narch/arm/configs/multi_v7_defconfig:982:CONFIG_MMC_DW_ROCKCHIP=y\narch/arm/configs/multi_v7_defconfig:983:CONFIG_MMC_SH_MMCIF=y\narch/arm/configs/multi_v7_defconfig:984:CONFIG_MMC_SUNXI=y\narch/arm/configs/multi_v7_defconfig:985:CONFIG_MMC_BCM2835=y\narch/arm/configs/multi_v7_defconfig:986:CONFIG_MMC_SDHCI_OMAP=y\narch/arm/configs/multi_v7_defconfig:987:CONFIG_MMC_OWL=y\narch/arm/configs/multi_v7_defconfig-988-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/mvebu_v5_defconfig=139=CONFIG_USB_STORAGE_JUMPSHOT=y\narch/arm/configs/mvebu_v5_defconfig:140:CONFIG_MMC=y\narch/arm/configs/mvebu_v5_defconfig-141-CONFIG_SDIO_UART=y\narch/arm/configs/mvebu_v5_defconfig:142:CONFIG_MMC_MVSDIO=y\narch/arm/configs/mvebu_v5_defconfig-143-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/mvebu_v7_defconfig=106=CONFIG_NOP_USB_XCEIV=y\narch/arm/configs/mvebu_v7_defconfig:107:CONFIG_MMC=y\narch/arm/configs/mvebu_v7_defconfig:108:CONFIG_MMC_SDHCI=y\narch/arm/configs/mvebu_v7_defconfig:109:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/mvebu_v7_defconfig:110:CONFIG_MMC_SDHCI_DOVE=y\narch/arm/configs/mvebu_v7_defconfig:111:CONFIG_MMC_SDHCI_PXAV3=y\narch/arm/configs/mvebu_v7_defconfig:112:CONFIG_MMC_MVSDIO=y\narch/arm/configs/mvebu_v7_defconfig-113-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/mxs_defconfig=113=CONFIG_USB_MASS_STORAGE=m\narch/arm/configs/mxs_defconfig:114:CONFIG_MMC=y\narch/arm/configs/mxs_defconfig:115:CONFIG_MMC_MXS=y\narch/arm/configs/mxs_defconfig-116-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/nhk8815_defconfig=100=CONFIG_LOGO=y\narch/arm/configs/nhk8815_defconfig:101:CONFIG_MMC=y\narch/arm/configs/nhk8815_defconfig:102:CONFIG_MMC_ARMMMCI=y\narch/arm/configs/nhk8815_defconfig-103-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/omap1_defconfig=170=CONFIG_USB_MASS_STORAGE=m\narch/arm/configs/omap1_defconfig:171:CONFIG_MMC=y\narch/arm/configs/omap1_defconfig:172:CONFIG_MMC_SDHCI=y\narch/arm/configs/omap1_defconfig:173:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/omap1_defconfig:174:CONFIG_MMC_OMAP=y\narch/arm/configs/omap1_defconfig-175-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/omap2plus_defconfig=598=CONFIG_USB_G_NOKIA=m\narch/arm/configs/omap2plus_defconfig:599:CONFIG_MMC=y\narch/arm/configs/omap2plus_defconfig-600-CONFIG_SDIO_UART=y\narch/arm/configs/omap2plus_defconfig:601:CONFIG_MMC_SDHCI=y\narch/arm/configs/omap2plus_defconfig:602:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/omap2plus_defconfig:603:CONFIG_MMC_OMAP=y\narch/arm/configs/omap2plus_defconfig:604:CONFIG_MMC_OMAP_HS=y\narch/arm/configs/omap2plus_defconfig:605:CONFIG_MMC_SDHCI_OMAP=y\narch/arm/configs/omap2plus_defconfig-606-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/pxa3xx_defconfig=70=CONFIG_LOGO=y\narch/arm/configs/pxa3xx_defconfig-71-# CONFIG_USB_SUPPORT is not set\narch/arm/configs/pxa3xx_defconfig:72:CONFIG_MMC=y\narch/arm/configs/pxa3xx_defconfig:73:CONFIG_MMC_PXA=y\narch/arm/configs/pxa3xx_defconfig-74-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/pxa_defconfig=503=CONFIG_USB_CDC_COMPOSITE=m\narch/arm/configs/pxa_defconfig:504:CONFIG_MMC=m\narch/arm/configs/pxa_defconfig:505:CONFIG_MMC_BLOCK_MINORS=16\narch/arm/configs/pxa_defconfig-506-CONFIG_SDIO_UART=m\narch/arm/configs/pxa_defconfig:507:CONFIG_MMC_PXA=m\narch/arm/configs/pxa_defconfig:508:CONFIG_MMC_SDHCI=m\narch/arm/configs/pxa_defconfig:509:CONFIG_MMC_SDHCI_PLTFM=m\narch/arm/configs/pxa_defconfig:510:CONFIG_MMC_TMIO=m\narch/arm/configs/pxa_defconfig:511:CONFIG_MMC_DW=m\narch/arm/configs/pxa_defconfig:512:CONFIG_MMC_DW_EXYNOS=m\narch/arm/configs/pxa_defconfig-513-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/qcom_defconfig=190=CONFIG_USB_ETH=m\narch/arm/configs/qcom_defconfig:191:CONFIG_MMC=y\narch/arm/configs/qcom_defconfig:192:CONFIG_MMC_BLOCK_MINORS=32\narch/arm/configs/qcom_defconfig:193:CONFIG_MMC_ARMMMCI=y\narch/arm/configs/qcom_defconfig:194:CONFIG_MMC_SDHCI=y\narch/arm/configs/qcom_defconfig:195:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/qcom_defconfig:196:CONFIG_MMC_SDHCI_MSM=y\narch/arm/configs/qcom_defconfig-197-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/realview_defconfig=76=CONFIG_USB_ISP1760=y\narch/arm/configs/realview_defconfig:77:CONFIG_MMC=y\narch/arm/configs/realview_defconfig:78:CONFIG_MMC_ARMMMCI=y\narch/arm/configs/realview_defconfig-79-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/s3c6400_defconfig=47=CONFIG_USB_SERIAL_PL2303=m\narch/arm/configs/s3c6400_defconfig:48:CONFIG_MMC=y\narch/arm/configs/s3c6400_defconfig-49-CONFIG_SDIO_UART=y\narch/arm/configs/s3c6400_defconfig:50:CONFIG_MMC_DEBUG=y\narch/arm/configs/s3c6400_defconfig:51:CONFIG_MMC_SDHCI=y\narch/arm/configs/s3c6400_defconfig:52:CONFIG_MMC_SDHCI_S3C=y\narch/arm/configs/s3c6400_defconfig-53-CONFIG_RTC_CLASS=y\n--\narch/arm/configs/s5pv210_defconfig=90=CONFIG_USB_DWC2=y\narch/arm/configs/s5pv210_defconfig:91:CONFIG_MMC=y\narch/arm/configs/s5pv210_defconfig:92:CONFIG_MMC_SDHCI=y\narch/arm/configs/s5pv210_defconfig:93:CONFIG_MMC_SDHCI_S3C=y\narch/arm/configs/s5pv210_defconfig:94:CONFIG_MMC_SDHCI_S3C_DMA=y\narch/arm/configs/s5pv210_defconfig-95-CONFIG_RTC_CLASS=y\n--\narch/arm/configs/sama5_defconfig=189=CONFIG_USB_G_SERIAL=y\narch/arm/configs/sama5_defconfig:190:CONFIG_MMC=y\narch/arm/configs/sama5_defconfig:191:CONFIG_MMC_SDHCI=y\narch/arm/configs/sama5_defconfig:192:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/sama5_defconfig:193:CONFIG_MMC_SDHCI_OF_AT91=y\narch/arm/configs/sama5_defconfig:194:CONFIG_MMC_ATMELMCI=y\narch/arm/configs/sama5_defconfig-195-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/sama7_defconfig=186=CONFIG_USB_G_SERIAL=m\narch/arm/configs/sama7_defconfig:187:CONFIG_MMC=y\narch/arm/configs/sama7_defconfig:188:CONFIG_MMC_SDHCI=y\narch/arm/configs/sama7_defconfig:189:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/sama7_defconfig:190:CONFIG_MMC_SDHCI_OF_AT91=y\narch/arm/configs/sama7_defconfig-191-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/shmobile_defconfig=177=CONFIG_USB_ETH=y\narch/arm/configs/shmobile_defconfig:178:CONFIG_MMC=y\narch/arm/configs/shmobile_defconfig:179:CONFIG_MMC_SDHCI=y\narch/arm/configs/shmobile_defconfig:180:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/shmobile_defconfig:181:CONFIG_MMC_SDHCI_OF_ARASAN=y\narch/arm/configs/shmobile_defconfig:182:CONFIG_MMC_SDHI=y\narch/arm/configs/shmobile_defconfig:183:CONFIG_MMC_SH_MMCIF=y\narch/arm/configs/shmobile_defconfig-184-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/socfpga_defconfig=112=CONFIG_USB_GADGET=y\narch/arm/configs/socfpga_defconfig:113:CONFIG_MMC=y\narch/arm/configs/socfpga_defconfig:114:CONFIG_MMC_DW=y\narch/arm/configs/socfpga_defconfig-115-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/spear13xx_defconfig=74=CONFIG_USB_STORAGE=y\narch/arm/configs/spear13xx_defconfig:75:CONFIG_MMC=y\narch/arm/configs/spear13xx_defconfig:76:CONFIG_MMC_SDHCI=y\narch/arm/configs/spear13xx_defconfig:77:CONFIG_MMC_SDHCI_SPEAR=y\narch/arm/configs/spear13xx_defconfig-78-CONFIG_RTC_CLASS=y\n--\narch/arm/configs/spear3xx_defconfig=58=CONFIG_USB_OHCI_HCD=y\narch/arm/configs/spear3xx_defconfig:59:CONFIG_MMC=y\narch/arm/configs/spear3xx_defconfig:60:CONFIG_MMC_SDHCI=y\narch/arm/configs/spear3xx_defconfig:61:CONFIG_MMC_SDHCI_SPEAR=y\narch/arm/configs/spear3xx_defconfig-62-CONFIG_RTC_CLASS=y\n--\narch/arm/configs/spitz_defconfig=186=CONFIG_USB_G_SERIAL=m\narch/arm/configs/spitz_defconfig:187:CONFIG_MMC=y\narch/arm/configs/spitz_defconfig:188:CONFIG_MMC_PXA=y\narch/arm/configs/spitz_defconfig-189-CONFIG_EXT2_FS=y\n--\narch/arm/configs/stm32_defconfig=52=CONFIG_REGULATOR_FIXED_VOLTAGE=y\narch/arm/configs/stm32_defconfig-53-# CONFIG_USB_SUPPORT is not set\narch/arm/configs/stm32_defconfig:54:CONFIG_MMC=y\narch/arm/configs/stm32_defconfig:55:CONFIG_MMC_ARMMMCI=y\narch/arm/configs/stm32_defconfig-56-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/sunxi_defconfig=134=CONFIG_USB_GADGET=y\narch/arm/configs/sunxi_defconfig:135:CONFIG_MMC=y\narch/arm/configs/sunxi_defconfig:136:CONFIG_MMC_SUNXI=y\narch/arm/configs/sunxi_defconfig-137-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/tegra_defconfig=259=CONFIG_USB_GADGET=y\narch/arm/configs/tegra_defconfig:260:CONFIG_MMC=y\narch/arm/configs/tegra_defconfig:261:CONFIG_MMC_BLOCK_MINORS=16\narch/arm/configs/tegra_defconfig:262:CONFIG_MMC_SDHCI=y\narch/arm/configs/tegra_defconfig:263:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm/configs/tegra_defconfig:264:CONFIG_MMC_SDHCI_TEGRA=y\narch/arm/configs/tegra_defconfig-265-CONFIG_LEDS_GPIO=y\n--\narch/arm/configs/u8500_defconfig=131=CONFIG_USB_ETH=m\narch/arm/configs/u8500_defconfig:132:CONFIG_MMC=y\narch/arm/configs/u8500_defconfig:133:CONFIG_MMC_ARMMMCI=y\narch/arm/configs/u8500_defconfig-134-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/versatile_defconfig=66=CONFIG_SND_ARMAACI=m\narch/arm/configs/versatile_defconfig:67:CONFIG_MMC=y\narch/arm/configs/versatile_defconfig:68:CONFIG_MMC_ARMMMCI=y\narch/arm/configs/versatile_defconfig-69-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/vexpress_defconfig=108=CONFIG_USB_ISP1760=y\narch/arm/configs/vexpress_defconfig:109:CONFIG_MMC=y\narch/arm/configs/vexpress_defconfig:110:CONFIG_MMC_ARMMMCI=y\narch/arm/configs/vexpress_defconfig-111-CONFIG_NEW_LEDS=y\n--\narch/arm/configs/vt8500_v6_v7_defconfig=65=CONFIG_USB_ULPI=y\narch/arm/configs/vt8500_v6_v7_defconfig:66:CONFIG_MMC=y\narch/arm/configs/vt8500_v6_v7_defconfig:67:CONFIG_MMC_DEBUG=y\narch/arm/configs/vt8500_v6_v7_defconfig-68-CONFIG_NEW_LEDS=y\n--\narch/arm/mach-omap1/board-nokia770.c=154=static struct omap_usb_config nokia770_usb_config __initdata = {\n--\narch/arm/mach-omap1/board-nokia770.c-162-\narch/arm/mach-omap1/board-nokia770.c:163:#if IS_ENABLED(CONFIG_MMC_OMAP)\narch/arm/mach-omap1/board-nokia770.c-164-\n--\narch/arm/mach-omap1/board-palmte.c=177=static struct spi_board_info palmte_spi_info[] __initdata = {\n--\narch/arm/mach-omap1/board-palmte.c-185-\narch/arm/mach-omap1/board-palmte.c:186:#if IS_ENABLED(CONFIG_MMC_OMAP)\narch/arm/mach-omap1/board-palmte.c-187-\n--\narch/arm/mach-omap1/board-palmte.c=200=static void palmte_mmc_init(void)\n--\narch/arm/mach-omap1/board-palmte.c-204-\narch/arm/mach-omap1/board-palmte.c:205:#else /* CONFIG_MMC_OMAP /\narch/arm/mach-omap1/board-palmte.c-206-\narch/arm/mach-omap1/board-palmte.c=207=static void palmte_mmc_init(void)\n--\narch/arm/mach-omap1/board-palmte.c-210-\narch/arm/mach-omap1/board-palmte.c:211:#endif / CONFIG_MMC_OMAP /\narch/arm/mach-omap1/board-palmte.c-212-\n--\narch/arm/mach-omap1/board-sx1-mmc.c-17-\narch/arm/mach-omap1/board-sx1-mmc.c:18:#if IS_ENABLED(CONFIG_MMC_OMAP)\narch/arm/mach-omap1/board-sx1-mmc.c-19-\n--\narch/arm/mach-omap1/devices.c=61=static inline void omap_init_rtc(void) {}\n--\narch/arm/mach-omap1/devices.c-65-\narch/arm/mach-omap1/devices.c:66:#if IS_ENABLED(CONFIG_MMC_OMAP)\narch/arm/mach-omap1/devices.c-67-\n--\narch/arm/mach-omap1/mmc.h-10-\narch/arm/mach-omap1/mmc.h:11:#if IS_ENABLED(CONFIG_MMC_OMAP)\narch/arm/mach-omap1/mmc.h-12-void omap1_init_mmc(struct omap_mmc_platform_data mmc_data,\n--\narch/arm/mach-omap2/board-n8x0.c=104=static void __init n8x0_usb_init(void) {}\n--\narch/arm/mach-omap2/board-n8x0.c-107-\narch/arm/mach-omap2/board-n8x0.c:108:#if defined(CONFIG_MENELAUS) \u0026\u0026 IS_ENABLED(CONFIG_MMC_OMAP)\narch/arm/mach-omap2/board-n8x0.c-109-\n--\narch/arm/mach-omap2/board-n8x0.c=147=static int n8x0_mmc_set_power_menelaus(struct device dev, int slot,\n--\narch/arm/mach-omap2/board-n8x0.c-151-\narch/arm/mach-omap2/board-n8x0.c:152:#ifdef CONFIG_MMC_DEBUG\narch/arm/mach-omap2/board-n8x0.c-153-\tdev_dbg(dev, \"Set slot %d power: %s (vdd %d)\\n\", slot + 1,\n--\narch/arm/mach-omap2/board-n8x0.c=261=static void n8x0_mmc_callback(void data, u8 card_mask)\narch/arm/mach-omap2/board-n8x0.c-262-{\narch/arm/mach-omap2/board-n8x0.c:263:#ifdef CONFIG_MMC_OMAP\narch/arm/mach-omap2/board-n8x0.c-264-\tint bit, openp, index;\n--\narch/arm/mach-omap2/board-n8x0.c=420=static void __init n8x0_mmc_init(void)\n--\narch/arm/mach-omap2/board-n8x0.c-422-}\narch/arm/mach-omap2/board-n8x0.c:423:#endif\t/* CONFIG_MMC_OMAP /\narch/arm/mach-omap2/board-n8x0.c-424-\n--\narch/arm/mach-pxa/gumstix.c=83=static struct platform_device devices[] __initdata = {\n--\narch/arm/mach-pxa/gumstix.c-86-\narch/arm/mach-pxa/gumstix.c:87:#ifdef CONFIG_MMC_PXA\narch/arm/mach-pxa/gumstix.c-88-static struct pxamci_platform_data gumstix_mci_platform_data = {\n--\narch/arm/mach-pxa/spitz.c=703=static inline void spitz_spi_init(void) {}\n--\narch/arm/mach-pxa/spitz.c-708- *****************************************************************************/\narch/arm/mach-pxa/spitz.c:709:#if defined(CONFIG_MMC_PXA) \|\| defined(CONFIG_MMC_PXA_MODULE)\narch/arm/mach-pxa/spitz.c-710-/\n--\narch/arm64/configs/defconfig=1275=CONFIG_TYPEC_DP_ALTMODE=m\narch/arm64/configs/defconfig:1276:CONFIG_MMC=y\narch/arm64/configs/defconfig:1277:CONFIG_MMC_BLOCK_MINORS=32\narch/arm64/configs/defconfig:1278:CONFIG_MMC_ARMMMCI=y\narch/arm64/configs/defconfig:1279:CONFIG_MMC_SDHCI=y\narch/arm64/configs/defconfig:1280:CONFIG_MMC_SDHCI_ACPI=y\narch/arm64/configs/defconfig:1281:CONFIG_MMC_SDHCI_PLTFM=y\narch/arm64/configs/defconfig:1282:CONFIG_MMC_SDHCI_OF_ARASAN=y\narch/arm64/configs/defconfig:1283:CONFIG_MMC_SDHCI_OF_ESDHC=y\narch/arm64/configs/defconfig:1284:CONFIG_MMC_SDHCI_OF_DWCMSHC=y\narch/arm64/configs/defconfig:1285:CONFIG_MMC_SDHCI_OF_SPARX5=y\narch/arm64/configs/defconfig:1286:CONFIG_MMC_SDHCI_CADENCE=y\narch/arm64/configs/defconfig:1287:CONFIG_MMC_SDHCI_ESDHC_IMX=y\narch/arm64/configs/defconfig:1288:CONFIG_MMC_SDHCI_TEGRA=y\narch/arm64/configs/defconfig:1289:CONFIG_MMC_SDHCI_BST=y\narch/arm64/configs/defconfig:1290:CONFIG_MMC_SDHCI_F_SDH30=y\n\n" }
21/2	2026/09/08 15:59	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 49082 output: 43 thoughts: 1066 Thoughts: Analyzing the Fuzzing Potential of This Patch Okay, so I'm looking at this patch and my initial thought is, "SDIO... that could be tricky." Unlike USB, which has the `dummy_hcd` and `raw-gadget` setup allowing user-space emulation, SDIO doesn't seem to have a readily available user-space emulator for arbitrary SDIO Wi-Fi cards. That's a red flag. However, I need to be methodical. Let's not jump to conclusions. First, I need to meticulously apply the negative criteria outlined in Section 2. Remember, I should only return `WorthFuzzing=false` if all modified code falls into those categories: non-kernel/non-executable changes, structurally unreachable hardware (e.g., vendor-specific stuff that QEMU doesn't emulate), or unreachable execution paths. Crucially, Section 1 reminds me that reachability is the primary gate. If the code is structurally unreachable, forget it; no fuzzing, no matter how complex the logic. Reachability means execution in a standard virtualized environment like GCE or QEMU, leveraging emulated devices like USB gadgets, netdev, or tun/tap. So, the game plan is: I need to examine every single changed line and file in this patch and see if any touch code accessible via USB, PCIe, netdev, mac80211_hwsim, or any virtual bus. Alright, let's dive into the code: 1. `drivers/net/wireless/realtek/rtw88/main.h`: This introduces a new chip type, `RTW_CHIP_TYPE_8723B`, and an inline function `rtw_is_8723bs`. This function checks for this specific chip type and that the HCI (Host Controller Interface) is SDIO. Looks innocent enough so far. 2. `drivers/net/wireless/realtek/rtw88/rx.c`: This modifies `rtw_rx_fill_rx_status`. Wait a minute, what is `rtw_rx_fill_rx_status`? It looks like it is used when receiving packets in rtw88. The comment mentions Realtek 8723 drivers and packet size checks in `rx.c`. I now need to understand what calls `rtw_rx_fill_rx_status` within the rtw88 framework. If this is a receive path, and it can receive traffic from a netdev or other emulated device, we might be in business! But it is conditional to if the chip ID is 8703B or calls the function `rtw_is_8723bs`.
22/2	2026/09/08 15:59	tool	grepper	0m Args: { "Expression": "rtw_rx_fill_rx_status", "PathPrefix": "drivers/net/wireless/realtek/rtw88" } Results: { "Output": "drivers/net/wireless/realtek/rtw88/rx.c=195=EXPORT_SYMBOL(rtw_update_rx_freq_from_ie);\ndrivers/net/wireless/realtek/rtw88/rx.c-196-\ndrivers/net/wireless/realtek/rtw88/rx.c:197:static void rtw_rx_fill_rx_status(struct rtw_dev rtwdev,\ndrivers/net/wireless/realtek/rtw88/rx.c-198-\t\t\t\t struct rtw_rx_pkt_stat pkt_stat,\n--\ndrivers/net/wireless/realtek/rtw88/rx.c=267=int rtw_rx_query_rx_desc(struct rtw_dev rtwdev, void rx_desc8,\n--\ndrivers/net/wireless/realtek/rtw88/rx.c-330-\ndrivers/net/wireless/realtek/rtw88/rx.c:331:\trtw_rx_fill_rx_status(rtwdev, pkt_stat, hdr, rx_status);\ndrivers/net/wireless/realtek/rtw88/rx.c-332-\n" }
23/2	2026/09/08 15:59	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 51099 output: 43 thoughts: 48 Thoughts: Here's my thought process, as requested: Deconstructing the Receive Path Okay, so I'm digging into this receive path. I see `rtw_rx_fill_rx_status` is being called by `rtw_rx_query_rx_desc`. That's a key interaction. Now, the critical question is who is calling `rtw_rx_query_rx_desc`? Understanding the caller of this function will give me insight into the control flow and the broader context of how received data is being processed and its status queried. I need to trace back from this point to get a clearer picture.
24/2	2026/09/08 15:59	tool	grepper	0m Args: { "Expression": "rtw_rx_query_rx_desc", "PathPrefix": "drivers/net/wireless/realtek/rtw88" } Results: { "Output": "drivers/net/wireless/realtek/rtw88/pci.c=1042=static u32 rtw_pci_rx_napi(struct rtw_dev rtwdev, struct rtw_pci rtwpci,\n--\ndrivers/net/wireless/realtek/rtw88/pci.c-1070-\t\trx_desc = skb-\u003edata;\ndrivers/net/wireless/realtek/rtw88/pci.c:1071:\t\tret = rtw_rx_query_rx_desc(rtwdev, rx_desc,\ndrivers/net/wireless/realtek/rtw88/pci.c-1072-\t\t\t\t\t \u0026pkt_stat, \u0026rx_status);\n--\ndrivers/net/wireless/realtek/rtw88/rx.c=197=static void rtw_rx_fill_rx_status(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/rx.c-266-\ndrivers/net/wireless/realtek/rtw88/rx.c:267:int rtw_rx_query_rx_desc(struct rtw_dev rtwdev, void rx_desc8,\ndrivers/net/wireless/realtek/rtw88/rx.c-268-\t\t\t struct rtw_rx_pkt_stat pkt_stat,\n--\ndrivers/net/wireless/realtek/rtw88/rx.c-334-}\ndrivers/net/wireless/realtek/rtw88/rx.c:335:EXPORT_SYMBOL(rtw_rx_query_rx_desc);\n--\ndrivers/net/wireless/realtek/rtw88/rx.h=46=void rtw_rx_stats(struct rtw_dev rtwdev, struct ieee80211_vif vif,\ndrivers/net/wireless/realtek/rtw88/rx.h-47-\t\t struct sk_buff skb);\ndrivers/net/wireless/realtek/rtw88/rx.h:48:int rtw_rx_query_rx_desc(struct rtw_dev rtwdev, void rx_desc8,\ndrivers/net/wireless/realtek/rtw88/rx.h-49-\t\t\t struct rtw_rx_pkt_stat pkt_stat,\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c=1340=static void rtw_sdio_rxfifo_recv(struct rtw_dev rtwdev, u32 rx_len)\n--\ndrivers/net/wireless/realtek/rtw88/sdio.c-1366-\t\trx_desc = skb-\u003edata;\ndrivers/net/wireless/realtek/rtw88/sdio.c:1367:\t\tret = rtw_rx_query_rx_desc(rtwdev, rx_desc,\ndrivers/net/wireless/realtek/rtw88/sdio.c-1368-\t\t\t\t\t \u0026pkt_stat, \u0026rx_status);\n--\ndrivers/net/wireless/realtek/rtw88/usb.c=610=static void rtw_usb_rx_handler(struct work_struct work)\n--\ndrivers/net/wireless/realtek/rtw88/usb.c-638-\t\tdo {\ndrivers/net/wireless/realtek/rtw88/usb.c:639:\t\t\tret = rtw_rx_query_rx_desc(rtwdev, rx_desc,\ndrivers/net/wireless/realtek/rtw88/usb.c-640-\t\t\t\t\t\t \u0026pkt_stat, \u0026rx_status);\n" }
25/2	2026/09/08 15:59	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 52254 output: 37 thoughts: 705 Thoughts: Analyzing Realtek Driver Logic for Packet Handling Okay, so I'm looking at how this Realtek driver handles incoming packets, specifically focusing on some conditional logic and how it branches based on chip and interface type. `rtw_rx_query_rx_desc` is clearly the central function here, called from USB, PCI, and SDIO paths. I'm seeing a change in `rtw_rx_fill_rx_status` where they've added a check for zero-length packets. The original check was specific to `RTW_CHIP_TYPE_8703B` and packets of length zero, but the new condition looks for `pkt_stat->pkt_len == 0 && (RTW_CHIP_TYPE_8703B \|\| rtw_is_8723bs(rtwdev))`. Hmm, `rtw_is_8723bs` is key; I need to remember that it's equivalent to `RTW_CHIP_TYPE_8723B && rtwdev->hci.type == RTW_HCI_TYPE_SDIO`. Now, the important question is: can `RTW_CHIP_TYPE_8723B` or `rtw_is_8723bs` actually be reached via a USB interface? No, since `rtw_is_8723bs` explicitly requires the SDIO interface, so this new addition only applies to SDIO-based devices. Okay, makes sense so far. Next, I'm checking the `tx.c` file. The concern is how they handle the new `rtw_is_8723bs` condition. There is a change in the condition used in `rtw_tx_report_enqueue`: `(RTW_CHIP_TYPE_8723D && RTW_HCI_TYPE_USB) \|\| rtw_is_8723bs(rtwdev)`. For USB-based devices (e.g., `RTW_CHIP_TYPE_8723D`), this change has no effect, the logic functions the same way. Finally, I need to check `sdio.c` just to be thorough, especially since `rtw_is_8723bs` involves SDIO. I should check the Kconfig and Makefile for `rtw88` too, just to be certain. Given what I've seen, this looks like a targeted change specifically for SDIO-based 8723B devices.
26/2	2026/09/08 15:59	tool	grepper	0m Args: { "Expression": "RTW88", "PathPrefix": "drivers/net/wireless/realtek/rtw88" } Results: { "Output": "drivers/net/wireless/realtek/rtw88/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/realtek/rtw88/Kconfig:2:menuconfig RTW88\ndrivers/net/wireless/realtek/rtw88/Kconfig-3-\ttristate \"Realtek 802.11ac wireless chips support\"\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-10-\ndrivers/net/wireless/realtek/rtw88/Kconfig:11:if RTW88\ndrivers/net/wireless/realtek/rtw88/Kconfig-12-\ndrivers/net/wireless/realtek/rtw88/Kconfig:13:config RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig-14-\ttristate\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-16-\ndrivers/net/wireless/realtek/rtw88/Kconfig:17:config RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig-18-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-19-\ndrivers/net/wireless/realtek/rtw88/Kconfig:20:config RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig-21-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-22-\ndrivers/net/wireless/realtek/rtw88/Kconfig:23:config RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig-24-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-25-\ndrivers/net/wireless/realtek/rtw88/Kconfig:26:config RTW88_8822B\ndrivers/net/wireless/realtek/rtw88/Kconfig-27-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-28-\ndrivers/net/wireless/realtek/rtw88/Kconfig:29:config RTW88_8822C\ndrivers/net/wireless/realtek/rtw88/Kconfig-30-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-31-\ndrivers/net/wireless/realtek/rtw88/Kconfig:32:config RTW88_8723X\ndrivers/net/wireless/realtek/rtw88/Kconfig-33-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-34-\ndrivers/net/wireless/realtek/rtw88/Kconfig:35:config RTW88_8703B\ndrivers/net/wireless/realtek/rtw88/Kconfig-36-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig:37:\tselect RTW88_8723X\ndrivers/net/wireless/realtek/rtw88/Kconfig-38-\ndrivers/net/wireless/realtek/rtw88/Kconfig:39:config RTW88_8723D\ndrivers/net/wireless/realtek/rtw88/Kconfig-40-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig:41:\tselect RTW88_8723X\ndrivers/net/wireless/realtek/rtw88/Kconfig-42-\ndrivers/net/wireless/realtek/rtw88/Kconfig:43:config RTW88_8821C\ndrivers/net/wireless/realtek/rtw88/Kconfig-44-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-45-\ndrivers/net/wireless/realtek/rtw88/Kconfig:46:config RTW88_88XXA\ndrivers/net/wireless/realtek/rtw88/Kconfig-47-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-48-\ndrivers/net/wireless/realtek/rtw88/Kconfig:49:config RTW88_8821A\ndrivers/net/wireless/realtek/rtw88/Kconfig-50-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig:51:\tselect RTW88_88XXA\ndrivers/net/wireless/realtek/rtw88/Kconfig-52-\ndrivers/net/wireless/realtek/rtw88/Kconfig:53:config RTW88_8812A\ndrivers/net/wireless/realtek/rtw88/Kconfig-54-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig:55:\tselect RTW88_88XXA\ndrivers/net/wireless/realtek/rtw88/Kconfig-56-\ndrivers/net/wireless/realtek/rtw88/Kconfig:57:config RTW88_8814A\ndrivers/net/wireless/realtek/rtw88/Kconfig-58-\ttristate\ndrivers/net/wireless/realtek/rtw88/Kconfig-59-\ndrivers/net/wireless/realtek/rtw88/Kconfig:60:config RTW88_8822BE\ndrivers/net/wireless/realtek/rtw88/Kconfig-61-\ttristate \"Realtek 8822BE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-62-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:63:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:64:\tselect RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:65:\tselect RTW88_8822B\ndrivers/net/wireless/realtek/rtw88/Kconfig-66-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-70-\ndrivers/net/wireless/realtek/rtw88/Kconfig:71:config RTW88_8822BS\ndrivers/net/wireless/realtek/rtw88/Kconfig-72-\ttristate \"Realtek 8822BS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-73-\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig:74:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:75:\tselect RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig:76:\tselect RTW88_8822B\ndrivers/net/wireless/realtek/rtw88/Kconfig-77-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-81-\ndrivers/net/wireless/realtek/rtw88/Kconfig:82:config RTW88_8822BU\ndrivers/net/wireless/realtek/rtw88/Kconfig-83-\ttristate \"Realtek 8822BU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-84-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:85:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:86:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:87:\tselect RTW88_8822B\ndrivers/net/wireless/realtek/rtw88/Kconfig-88-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-92-\ndrivers/net/wireless/realtek/rtw88/Kconfig:93:config RTW88_8822CE\ndrivers/net/wireless/realtek/rtw88/Kconfig-94-\ttristate \"Realtek 8822CE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-95-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:96:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:97:\tselect RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:98:\tselect RTW88_8822C\ndrivers/net/wireless/realtek/rtw88/Kconfig-99-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-103-\ndrivers/net/wireless/realtek/rtw88/Kconfig:104:config RTW88_8822CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-105-\ttristate \"Realtek 8822CS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-106-\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig:107:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:108:\tselect RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig:109:\tselect RTW88_8822C\ndrivers/net/wireless/realtek/rtw88/Kconfig-110-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-114-\ndrivers/net/wireless/realtek/rtw88/Kconfig:115:config RTW88_8822CU\ndrivers/net/wireless/realtek/rtw88/Kconfig-116-\ttristate \"Realtek 8822CU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-117-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:118:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:119:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:120:\tselect RTW88_8822C\ndrivers/net/wireless/realtek/rtw88/Kconfig-121-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-125-\ndrivers/net/wireless/realtek/rtw88/Kconfig:126:config RTW88_8723DE\ndrivers/net/wireless/realtek/rtw88/Kconfig-127-\ttristate \"Realtek 8723DE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-128-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:129:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:130:\tselect RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:131:\tselect RTW88_8723D\ndrivers/net/wireless/realtek/rtw88/Kconfig-132-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-136-\ndrivers/net/wireless/realtek/rtw88/Kconfig:137:config RTW88_8723DS\ndrivers/net/wireless/realtek/rtw88/Kconfig-138-\ttristate \"Realtek 8723DS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-139-\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig:140:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:141:\tselect RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig:142:\tselect RTW88_8723D\ndrivers/net/wireless/realtek/rtw88/Kconfig-143-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-147-\ndrivers/net/wireless/realtek/rtw88/Kconfig:148:config RTW88_8723CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-149-\ttristate \"Realtek 8723CS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-150-\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig:151:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:152:\tselect RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig:153:\tselect RTW88_8703B\ndrivers/net/wireless/realtek/rtw88/Kconfig-154-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-161-\ndrivers/net/wireless/realtek/rtw88/Kconfig:162:config RTW88_8723DU\ndrivers/net/wireless/realtek/rtw88/Kconfig-163-\ttristate \"Realtek 8723DU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-164-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:165:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:166:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:167:\tselect RTW88_8723D\ndrivers/net/wireless/realtek/rtw88/Kconfig-168-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-172-\ndrivers/net/wireless/realtek/rtw88/Kconfig:173:config RTW88_8821CE\ndrivers/net/wireless/realtek/rtw88/Kconfig-174-\ttristate \"Realtek 8821CE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-175-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:176:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:177:\tselect RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:178:\tselect RTW88_8821C\ndrivers/net/wireless/realtek/rtw88/Kconfig-179-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-183-\ndrivers/net/wireless/realtek/rtw88/Kconfig:184:config RTW88_8821CS\ndrivers/net/wireless/realtek/rtw88/Kconfig-185-\ttristate \"Realtek 8821CS SDIO wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-186-\tdepends on MMC\ndrivers/net/wireless/realtek/rtw88/Kconfig:187:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:188:\tselect RTW88_SDIO\ndrivers/net/wireless/realtek/rtw88/Kconfig:189:\tselect RTW88_8821C\ndrivers/net/wireless/realtek/rtw88/Kconfig-190-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-194-\ndrivers/net/wireless/realtek/rtw88/Kconfig:195:config RTW88_8821CU\ndrivers/net/wireless/realtek/rtw88/Kconfig-196-\ttristate \"Realtek 8821CU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-197-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:198:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:199:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:200:\tselect RTW88_8821C\ndrivers/net/wireless/realtek/rtw88/Kconfig-201-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-205-\ndrivers/net/wireless/realtek/rtw88/Kconfig:206:config RTW88_8821AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-207-\ttristate \"Realtek 8821AU/8811AU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-208-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:209:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:210:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:211:\tselect RTW88_8821A\ndrivers/net/wireless/realtek/rtw88/Kconfig-212-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-216-\ndrivers/net/wireless/realtek/rtw88/Kconfig:217:config RTW88_8812AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-218-\ttristate \"Realtek 8812AU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-219-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:220:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:221:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:222:\tselect RTW88_8812A\ndrivers/net/wireless/realtek/rtw88/Kconfig-223-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-227-\ndrivers/net/wireless/realtek/rtw88/Kconfig:228:config RTW88_8814AE\ndrivers/net/wireless/realtek/rtw88/Kconfig-229-\ttristate \"Realtek 8814AE PCI wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-230-\tdepends on PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:231:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:232:\tselect RTW88_PCI\ndrivers/net/wireless/realtek/rtw88/Kconfig:233:\tselect RTW88_8814A\ndrivers/net/wireless/realtek/rtw88/Kconfig-234-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-238-\ndrivers/net/wireless/realtek/rtw88/Kconfig:239:config RTW88_8814AU\ndrivers/net/wireless/realtek/rtw88/Kconfig-240-\ttristate \"Realtek 8814AU USB wireless network adapter\"\ndrivers/net/wireless/realtek/rtw88/Kconfig-241-\tdepends on USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:242:\tselect RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig:243:\tselect RTW88_USB\ndrivers/net/wireless/realtek/rtw88/Kconfig:244:\tselect RTW88_8814A\ndrivers/net/wireless/realtek/rtw88/Kconfig-245-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-249-\ndrivers/net/wireless/realtek/rtw88/Kconfig:250:config RTW88_DEBUG\ndrivers/net/wireless/realtek/rtw88/Kconfig-251-\tbool \"Realtek rtw88 debug support\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:252:\tdepends on RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig-253-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-257-\ndrivers/net/wireless/realtek/rtw88/Kconfig:258:config RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/Kconfig-259-\tbool \"Realtek rtw88 debugfs support\"\ndrivers/net/wireless/realtek/rtw88/Kconfig:260:\tdepends on RTW88_CORE\ndrivers/net/wireless/realtek/rtw88/Kconfig-261-\thelp\n--\ndrivers/net/wireless/realtek/rtw88/Kconfig-265-\ndrivers/net/wireless/realtek/rtw88/Kconfig:266:config RTW88_LEDS\ndrivers/net/wireless/realtek/rtw88/Kconfig-267-\tbool\n--\ndrivers/net/wireless/realtek/rtw88/Makefile-2-\ndrivers/net/wireless/realtek/rtw88/Makefile:3:obj-$(CONFIG_RTW88_CORE)\t+= rtw88_core.o\ndrivers/net/wireless/realtek/rtw88/Makefile-4-rtw88_core-y += main.o \\\n--\ndrivers/net/wireless/realtek/rtw88/Makefile=21=rtw88_core-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/realtek/rtw88/Makefile-22-\ndrivers/net/wireless/realtek/rtw88/Makefile:23:rtw88_core-$(CONFIG_RTW88_LEDS) += led.o\ndrivers/net/wireless/realtek/rtw88/Makefile-24-\ndrivers/net/wireless/realtek/rtw88/Makefile:25:obj-$(CONFIG_RTW88_8822B)\t+= rtw88_8822b.o\ndrivers/net/wireless/realtek/rtw88/Makefile-26-rtw88_8822b-objs\t\t:= rtw8822b.o rtw8822b_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-27-\ndrivers/net/wireless/realtek/rtw88/Makefile:28:obj-$(CONFIG_RTW88_8822BE)\t+= rtw88_8822be.o\ndrivers/net/wireless/realtek/rtw88/Makefile-29-rtw88_8822be-objs\t\t:= rtw8822be.o\ndrivers/net/wireless/realtek/rtw88/Makefile-30-\ndrivers/net/wireless/realtek/rtw88/Makefile:31:obj-$(CONFIG_RTW88_8822BS)\t+= rtw88_8822bs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-32-rtw88_8822bs-objs\t\t:= rtw8822bs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-33-\ndrivers/net/wireless/realtek/rtw88/Makefile:34:obj-$(CONFIG_RTW88_8822BU)\t+= rtw88_8822bu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-35-rtw88_8822bu-objs\t\t:= rtw8822bu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-36-\ndrivers/net/wireless/realtek/rtw88/Makefile:37:obj-$(CONFIG_RTW88_8822C)\t+= rtw88_8822c.o\ndrivers/net/wireless/realtek/rtw88/Makefile-38-rtw88_8822c-objs\t\t:= rtw8822c.o rtw8822c_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-39-\ndrivers/net/wireless/realtek/rtw88/Makefile:40:obj-$(CONFIG_RTW88_8822CE)\t+= rtw88_8822ce.o\ndrivers/net/wireless/realtek/rtw88/Makefile-41-rtw88_8822ce-objs\t\t:= rtw8822ce.o\ndrivers/net/wireless/realtek/rtw88/Makefile-42-\ndrivers/net/wireless/realtek/rtw88/Makefile:43:obj-$(CONFIG_RTW88_8822CS)\t+= rtw88_8822cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-44-rtw88_8822cs-objs\t\t:= rtw8822cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-45-\ndrivers/net/wireless/realtek/rtw88/Makefile:46:obj-$(CONFIG_RTW88_8822CU)\t+= rtw88_8822cu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-47-rtw88_8822cu-objs\t\t:= rtw8822cu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-48-\ndrivers/net/wireless/realtek/rtw88/Makefile:49:obj-$(CONFIG_RTW88_8723X)\t+= rtw88_8723x.o\ndrivers/net/wireless/realtek/rtw88/Makefile-50-rtw88_8723x-objs\t\t:= rtw8723x.o\ndrivers/net/wireless/realtek/rtw88/Makefile-51-\ndrivers/net/wireless/realtek/rtw88/Makefile:52:obj-$(CONFIG_RTW88_8703B)\t+= rtw88_8703b.o\ndrivers/net/wireless/realtek/rtw88/Makefile-53-rtw88_8703b-objs\t\t:= rtw8703b.o rtw8703b_tables.o\ndrivers/net/wireless/realtek/rtw88/Makefile-54-\ndrivers/net/wireless/realtek/rtw88/Makefile:55:obj-$(CONFIG_RTW88_8723CS)\t+= rtw88_8723cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-56-rtw88_8723cs-objs\t\t:= rtw8723cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-57-\ndrivers/net/wireless/realtek/rtw88/Makefile:58:obj-$(CONFIG_RTW88_8723D)\t+= rtw88_8723d.o\ndrivers/net/wireless/realtek/rtw88/Makefile-59-rtw88_8723d-objs\t\t:= rtw8723d.o rtw8723d_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-60-\ndrivers/net/wireless/realtek/rtw88/Makefile:61:obj-$(CONFIG_RTW88_8723DE)\t+= rtw88_8723de.o\ndrivers/net/wireless/realtek/rtw88/Makefile-62-rtw88_8723de-objs\t\t:= rtw8723de.o\ndrivers/net/wireless/realtek/rtw88/Makefile-63-\ndrivers/net/wireless/realtek/rtw88/Makefile:64:obj-$(CONFIG_RTW88_8723DS)\t+= rtw88_8723ds.o\ndrivers/net/wireless/realtek/rtw88/Makefile-65-rtw88_8723ds-objs\t\t:= rtw8723ds.o\ndrivers/net/wireless/realtek/rtw88/Makefile-66-\ndrivers/net/wireless/realtek/rtw88/Makefile:67:obj-$(CONFIG_RTW88_8723DU)\t+= rtw88_8723du.o\ndrivers/net/wireless/realtek/rtw88/Makefile-68-rtw88_8723du-objs\t\t:= rtw8723du.o\ndrivers/net/wireless/realtek/rtw88/Makefile-69-\ndrivers/net/wireless/realtek/rtw88/Makefile:70:obj-$(CONFIG_RTW88_8821C)\t+= rtw88_8821c.o\ndrivers/net/wireless/realtek/rtw88/Makefile-71-rtw88_8821c-objs\t\t:= rtw8821c.o rtw8821c_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-72-\ndrivers/net/wireless/realtek/rtw88/Makefile:73:obj-$(CONFIG_RTW88_8821CE)\t+= rtw88_8821ce.o\ndrivers/net/wireless/realtek/rtw88/Makefile-74-rtw88_8821ce-objs\t\t:= rtw8821ce.o\ndrivers/net/wireless/realtek/rtw88/Makefile-75-\ndrivers/net/wireless/realtek/rtw88/Makefile:76:obj-$(CONFIG_RTW88_8821CS)\t+= rtw88_8821cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-77-rtw88_8821cs-objs\t\t:= rtw8821cs.o\ndrivers/net/wireless/realtek/rtw88/Makefile-78-\ndrivers/net/wireless/realtek/rtw88/Makefile:79:obj-$(CONFIG_RTW88_8821CU)\t+= rtw88_8821cu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-80-rtw88_8821cu-objs\t\t:= rtw8821cu.o\ndrivers/net/wireless/realtek/rtw88/Makefile-81-\ndrivers/net/wireless/realtek/rtw88/Makefile:82:obj-$(CONFIG_RTW88_88XXA)\t+= rtw88_88xxa.o\ndrivers/net/wireless/realtek/rtw88/Makefile-83-rtw88_88xxa-objs\t\t:= rtw88xxa.o\ndrivers/net/wireless/realtek/rtw88/Makefile-84-\ndrivers/net/wireless/realtek/rtw88/Makefile:85:obj-$(CONFIG_RTW88_8821A)\t+= rtw88_8821a.o\ndrivers/net/wireless/realtek/rtw88/Makefile-86-rtw88_8821a-objs\t\t:= rtw8821a.o rtw8821a_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-87-\ndrivers/net/wireless/realtek/rtw88/Makefile:88:obj-$(CONFIG_RTW88_8812A)\t+= rtw88_8812a.o\ndrivers/net/wireless/realtek/rtw88/Makefile-89-rtw88_8812a-objs\t\t:= rtw8812a.o rtw8812a_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-90-\ndrivers/net/wireless/realtek/rtw88/Makefile:91:obj-$(CONFIG_RTW88_8821AU)\t+= rtw88_8821au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-92-rtw88_8821au-objs\t\t:= rtw8821au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-93-\ndrivers/net/wireless/realtek/rtw88/Makefile:94:obj-$(CONFIG_RTW88_8812AU)\t+= rtw88_8812au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-95-rtw88_8812au-objs\t\t:= rtw8812au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-96-\ndrivers/net/wireless/realtek/rtw88/Makefile:97:obj-$(CONFIG_RTW88_8814A)\t+= rtw88_8814a.o\ndrivers/net/wireless/realtek/rtw88/Makefile-98-rtw88_8814a-objs\t\t:= rtw8814a.o rtw8814a_table.o\ndrivers/net/wireless/realtek/rtw88/Makefile-99-\ndrivers/net/wireless/realtek/rtw88/Makefile:100:obj-$(CONFIG_RTW88_8814AE)\t+= rtw88_8814ae.o\ndrivers/net/wireless/realtek/rtw88/Makefile-101-rtw88_8814ae-objs\t\t:= rtw8814ae.o\ndrivers/net/wireless/realtek/rtw88/Makefile-102-\ndrivers/net/wireless/realtek/rtw88/Makefile:103:obj-$(CONFIG_RTW88_8814AU)\t+= rtw88_8814au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-104-rtw88_8814au-objs\t\t:= rtw8814au.o\ndrivers/net/wireless/realtek/rtw88/Makefile-105-\ndrivers/net/wireless/realtek/rtw88/Makefile:106:obj-$(CONFIG_RTW88_PCI)\t\t+= rtw88_pci.o\ndrivers/net/wireless/realtek/rtw88/Makefile-107-rtw88_pci-objs\t\t\t:= pci.o\ndrivers/net/wireless/realtek/rtw88/Makefile-108-\ndrivers/net/wireless/realtek/rtw88/Makefile:109:obj-$(CONFIG_RTW88_SDIO)\t+= rtw88_sdio.o\ndrivers/net/wireless/realtek/rtw88/Makefile-110-rtw88_sdio-objs\t\t\t:= sdio.o\ndrivers/net/wireless/realtek/rtw88/Makefile-111-\ndrivers/net/wireless/realtek/rtw88/Makefile:112:obj-$(CONFIG_RTW88_USB)\t\t+= rtw88_usb.o\ndrivers/net/wireless/realtek/rtw88/Makefile-113-rtw88_usb-objs\t\t\t:= usb.o\n--\ndrivers/net/wireless/realtek/rtw88/coex.c=3553=void rtw_coex_wl_ccklock_work(struct work_struct work)\n--\ndrivers/net/wireless/realtek/rtw88/coex.c-3563-\ndrivers/net/wireless/realtek/rtw88/coex.c:3564:#ifdef CONFIG_RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/coex.c-3565-#define INFO_SIZE\t80\n--\ndrivers/net/wireless/realtek/rtw88/coex.c=3936=void rtw_coex_display_coex_info(struct rtw_dev rtwdev, struct seq_file m)\n--\ndrivers/net/wireless/realtek/rtw88/coex.c-4204-}\ndrivers/net/wireless/realtek/rtw88/coex.c:4205:#endif / CONFIG_RTW88_DEBUGFS /\n--\ndrivers/net/wireless/realtek/rtw88/debug.c-16-\ndrivers/net/wireless/realtek/rtw88/debug.c:17:#ifdef CONFIG_RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/debug.c-18-\n--\ndrivers/net/wireless/realtek/rtw88/debug.c=1349=void rtw_debugfs_deinit(struct rtw_dev rtwdev)\n--\ndrivers/net/wireless/realtek/rtw88/debug.c-1352-}\ndrivers/net/wireless/realtek/rtw88/debug.c:1353:#endif /* CONFIG_RTW88_DEBUGFS /\ndrivers/net/wireless/realtek/rtw88/debug.c-1354-\ndrivers/net/wireless/realtek/rtw88/debug.c:1355:#ifdef CONFIG_RTW88_DEBUG\ndrivers/net/wireless/realtek/rtw88/debug.c-1356-\n--\ndrivers/net/wireless/realtek/rtw88/debug.c=1373=EXPORT_SYMBOL(rtw_dbg);\ndrivers/net/wireless/realtek/rtw88/debug.c-1374-\ndrivers/net/wireless/realtek/rtw88/debug.c:1375:#endif / CONFIG_RTW88_DEBUG /\n--\ndrivers/net/wireless/realtek/rtw88/debug.h=8=enum rtw_debug_mask {\n--\ndrivers/net/wireless/realtek/rtw88/debug.h-33-\ndrivers/net/wireless/realtek/rtw88/debug.h:34:#ifdef CONFIG_RTW88_DEBUGFS\ndrivers/net/wireless/realtek/rtw88/debug.h-35-\n--\ndrivers/net/wireless/realtek/rtw88/debug.h=43=static inline void rtw_debugfs_deinit(struct rtw_dev rtwdev) {}\ndrivers/net/wireless/realtek/rtw88/debug.h-44-\ndrivers/net/wireless/realtek/rtw88/debug.h:45:#endif /* CONFIG_RTW88_DEBUGFS /\ndrivers/net/wireless/realtek/rtw88/debug.h-46-\ndrivers/net/wireless/realtek/rtw88/debug.h:47:#ifdef CONFIG_RTW88_DEBUG\ndrivers/net/wireless/realtek/rtw88/debug.h-48-\n--\ndrivers/net/wireless/realtek/rtw88/debug.h=64=static inline bool rtw_dbg_is_enabled(struct rtw_dev rtwdev,\n--\ndrivers/net/wireless/realtek/rtw88/debug.h-69-\ndrivers/net/wireless/realtek/rtw88/debug.h:70:#endif /* CONFIG_RTW88_DEBUG /\ndrivers/net/wireless/realtek/rtw88/debug.h-71-\n--\ndrivers/net/wireless/realtek/rtw88/led.h-7-\ndrivers/net/wireless/realtek/rtw88/led.h:8:#ifdef CONFIG_RTW88_LEDS\ndrivers/net/wireless/realtek/rtw88/led.h-9-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c=1886=const struct rtw_chip_info rtw8703b_hw_spec = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1995-\t/ These registers are used to read (and print) from if\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c:1996:\t * CONFIG_RTW88_DEBUGFS is enabled.\ndrivers/net/wireless/realtek/rtw88/rtw8703b.c-1997-\t /\n--\ndrivers/net/wireless/realtek/rtw88/rtw8812a.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8812a.h:5:#ifndef __RTW8812A_H__\ndrivers/net/wireless/realtek/rtw88/rtw8812a.h:6:#define __RTW8812A_H__\ndrivers/net/wireless/realtek/rtw88/rtw8812a.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8812a_table.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8812a_table.h:5:#ifndef __RTW8812A_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8812a_table.h:6:#define __RTW8812A_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8812a_table.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8814a.h:5:#ifndef __RTW8814A_H__\ndrivers/net/wireless/realtek/rtw88/rtw8814a.h:6:#define __RTW8814A_H__\ndrivers/net/wireless/realtek/rtw88/rtw8814a.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.h:5:#ifndef __RTW8814A_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.h:6:#define __RTW8814A_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8814a_table.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821a.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8821a.h:5:#ifndef __RTW8821A_H__\ndrivers/net/wireless/realtek/rtw88/rtw8821a.h:6:#define __RTW8821A_H__\ndrivers/net/wireless/realtek/rtw88/rtw8821a.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821a_table.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8821a_table.h:5:#ifndef __RTW8821A_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8821a_table.h:6:#define __RTW8821A_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8821a_table.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h:5:#ifndef __RTW8821C_H__\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h:6:#define __RTW8821C_H__\ndrivers/net/wireless/realtek/rtw88/rtw8821c.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821c_table.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8821c_table.h:5:#ifndef __RTW8821C_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8821c_table.h:6:#define __RTW8821C_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8821c_table.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821cs.c=12=static const struct sdio_device_id rtw_8821cs_id_table[] = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8821cs.c-14-\t\tSDIO_DEVICE(SDIO_VENDOR_ID_REALTEK,\ndrivers/net/wireless/realtek/rtw88/rtw8821cs.c:15:\t\t\t SDIO_DEVICE_ID_REALTEK_RTW8821CS),\ndrivers/net/wireless/realtek/rtw88/rtw8821cs.c-16-\t\t.driver_data = (kernel_ulong_t)\u0026rtw8821c_hw_spec,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c=1543=static void rtw8822b_adaptivity_init(struct rtw_dev rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-1544-{\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c:1545:\trtw_phy_set_edcca_th(rtwdev, RTW8822B_EDCCA_MAX, RTW8822B_EDCCA_MAX);\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-1546-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-1550-\trtw_write32_mask(rtwdev, REG_EDCCA_SOURCE, BIT_SOURCE_OPTION,\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c:1551:\t\t\t RTW8822B_EDCCA_SRC_DEF);\ndrivers/net/wireless/realtek/rtw88/rtw8822b.c-1552-\trtw_write32_mask(rtwdev, REG_EDCCA_POW_MA, BIT_MA_LEVEL, 0);\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h:5:#ifndef __RTW8822B_H__\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h:6:#define __RTW8822B_H__\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h=110=_rtw_write32s_mask(struct rtw_dev rtwdev, u32 addr, u32 mask, u32 data)\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h-151-\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h:152:#define RTW8822B_EDCCA_MAX\t0x7f\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h:153:#define RTW8822B_EDCCA_SRC_DEF\t1\ndrivers/net/wireless/realtek/rtw88/rtw8822b.h-154-#define REG_HTSTFWT\t0x800\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.h:5:#ifndef __RTW8822B_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.h:6:#define __RTW8822B_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8822b_table.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822bs.c=12=static const struct sdio_device_id rtw_8822bs_id_table[] = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822bs.c-14-\t\tSDIO_DEVICE(SDIO_VENDOR_ID_REALTEK,\ndrivers/net/wireless/realtek/rtw88/rtw8822bs.c:15:\t\t\t SDIO_DEVICE_ID_REALTEK_RTW8822BS),\ndrivers/net/wireless/realtek/rtw88/rtw8822bs.c-16-\t\t.driver_data = (kernel_ulong_t)\u0026rtw8822b_hw_spec,\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c=4512=static void rtw8822c_adaptivity_init(struct rtw_dev rtwdev)\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-4513-{\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c:4514:\trtw_phy_set_edcca_th(rtwdev, RTW8822C_EDCCA_MAX, RTW8822C_EDCCA_MAX);\ndrivers/net/wireless/realtek/rtw88/rtw8822c.c-4515-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:5:#ifndef __RTW8822C_H__\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:6:#define __RTW8822C_H__\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h=133=const struct rtw_table name ## _tbl = {\t\t\t\\\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-179-\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h:180:#define RTW8822C_EDCCA_MAX\t0x7f\ndrivers/net/wireless/realtek/rtw88/rtw8822c.h-181-#define REG_ANAPARLDO_POW_MAC\t0x0029\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.h:5:#ifndef __RTW8822C_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.h:6:#define __RTW8822C_TABLE_H__\ndrivers/net/wireless/realtek/rtw88/rtw8822c_table.h-7-\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c=12=static const struct sdio_device_id rtw_8822cs_id_table[] = {\n--\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c-14-\t\tSDIO_DEVICE(SDIO_VENDOR_ID_REALTEK,\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c:15:\t\t\t SDIO_DEVICE_ID_REALTEK_RTW8822CS),\ndrivers/net/wireless/realtek/rtw88/rtw8822cs.c-16-\t\t.driver_data = (kernel_ulong_t)\u0026rtw8822c_hw_spec,\n--\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h-4-\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h:5:#ifndef __RTW88XXA_H__\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h:6:#define __RTW88XXA_H__\ndrivers/net/wireless/realtek/rtw88/rtw88xxa.h-7-\n" }
27/2	2026/09/08 15:59	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 67648 output: 108 thoughts: 1810 Thoughts: Analysis of the RTW88 SDIO Patch: Is it Worth Fuzzing? Okay, so I'm looking at this patch and it seems to be adding support for the `RTL8723BS` SDIO wireless device, or preparing the SDIO code in the `rtw88` driver. My initial thought is to figure out what this entails. I see it's modifying the `sdio.c` file and related files: `sdio.h`, `rx.c`, `tx.c`, `main.h`. It looks like this `sdio.c` is the core SDIO HCI driver module used by all the RTW88 SDIO wireless adapters like the `rtw8723cs`, `rtw8723ds`, `rtw8821cs`, `rtw8822bs`, and `rtw8822cs`. Now the core question: can we even reach this code in a fuzzing environment like syzkaller? Syzkaller typically runs in a virtualized QEMU or GCE environment. It's great for fuzzing USB devices using USB raw-gadget / dummy_hcd, or PCI devices with virtio-pci, but does it emulate SDIO devices? From what I can tell, no. There's nothing like a SDIO gadget or a dummy SDIO device emulator for these specific Realtek SDIO Wi-Fi chips. MMC block devices can be connected if QEMU provides an SD card image, but this is a function device (like a WiFi chip). These are specialized SDIO hardware chips, communicating using the SDIO CMD52/CMD53 commands, not just generic SD memory cards. There's no equivalent software mock driver for SDIO WiFi cards in standard Linux or QEMU environments. I recall the instructions, and I'm reminded of the criteria in Section 2 for returning `WorthFuzzing=false`. Specifically, it points out structurally unreachable hardware: "Vendor-specific PCIe switches, SmartNICs, or GPU drivers requiring physical ASIC/PCIe cards not emulated in standard QEMU." This seems directly applicable. SDIO WiFi adapters require physical SDIO hardware or an SDIO device on an SDIO bus, which is not emulated in standard QEMU. And unlike USB devices, which are reachable via raw-gadget, SDIO isn't. Looking at the code changes, it’s all centered around the Realtek RTW88 wireless driver's SDIO transport layer and handling of the `RTL8723BS` SDIO chip. The modifications in `rx.c` guard a check, `tx.c` adds a timeout, and `main.h` defines a chip type/check. This modified code is unreachable because SDIO wireless hardware cannot be emulated and is not accessible within standard syzkaller fuzzing environments. Section 3 lists the positive criteria. This patch doesn't meet any of them. Therefore, according to my expertise and the criteria, `WorthFuzzing` should be `false`. Just to be thorough, let me double-check: the target architecture is amd64. The modified files include `main.h`, `rx.c`, `sdio.c`, `sdio.h`, and `tx.c`. No focus symbols are relevant. No special configs are needed. The concise reasoning is: this patch deals with a wireless SDIO adapter that requires hardware not emulated in fuzzing environments. The SDIO wireless network adapters require physical SDIO hardware which is not emulated in standard QEMU/virtualized fuzzing environments (unlike USB devices accessible via raw-gadget), making the modified code structurally unreachable. Therefore I should set-results with `WorthFuzzing = false`.
28/2	2026/09/08 16:00	tool	set-results	0m Args: { "EnableConfigs": [], "FocusSymbols": [], "Reasoning": "The patch adds RTL8723BS SDIO support and modifies SDIO transmit/receive handling in the Realtek rtw88 wireless driver. SDIO wireless adapters require physical hardware not emulated in standard virtualized fuzzing environments (QEMU/GCE) and are not accessible via virtual buses like USB raw-gadget, making the modified code structurally unreachable.", "WorthFuzzing": false } Results: { "EnableConfigs": null, "FocusSymbols": [], "Reasoning": "The patch adds RTL8723BS SDIO support and modifies SDIO transmit/receive handling in the Realtek rtw88 wireless driver. SDIO wireless adapters require physical hardware not emulated in standard virtualized fuzzing environments (QEMU/GCE) and are not accessible via virtual buses like USB raw-gadget, making the modified code structurally unreachable.", "WorthFuzzing": false }
29/1	2026/09/08 16:00	action	If	0m Args: { "WorthFuzzing": false } Results: null

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)