AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath12k driver, which is a hardware-specific driver for Qualcomm Wi-Fi 7 devices (PCI/AHB). There is no software emulation for this hardware in QEMU or the kernel, making the code paths impossible to reach and fuzz in virtualized environments.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit bb12879886ac03a93c4ff7228837d51003a90506\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Jun 22 23:59:12 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c\nindex af354bef5c0d79..2d539da83361cd 100644\n--- a/drivers/net/wireless/ath/ath12k/mac.c\n+++ b/drivers/net/wireless/ath/ath12k/mac.c\n@@ -10117,16 +10117,15 @@ static void ath12k_mac_update_vif_offload(struct ath12k_link_vif *arvif)\n \tif (vif-\u003etype != NL80211_IFTYPE_STATION \u0026\u0026\n \t    vif-\u003etype != NL80211_IFTYPE_AP)\n \t\tvif-\u003eoffload_flags \u0026= ~(IEEE80211_OFFLOAD_ENCAP_ENABLED |\n+\t\t\t\t\tIEEE80211_OFFLOAD_ENCAP_4ADDR |\n \t\t\t\t\tIEEE80211_OFFLOAD_DECAP_ENABLED);\n \n-\tif (vif-\u003eoffload_flags \u0026 IEEE80211_OFFLOAD_ENCAP_ENABLED) {\n+\tif (vif-\u003eoffload_flags \u0026 IEEE80211_OFFLOAD_ENCAP_ENABLED)\n \t\tahvif-\u003edp_vif.tx_encap_type = ATH12K_HW_TXRX_ETHERNET;\n-\t\tvif-\u003eoffload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;\n-\t} else if (test_bit(ATH12K_FLAG_RAW_MODE, \u0026ab-\u003edev_flags)) {\n+\telse if (test_bit(ATH12K_FLAG_RAW_MODE, \u0026ab-\u003edev_flags))\n \t\tahvif-\u003edp_vif.tx_encap_type = ATH12K_HW_TXRX_RAW;\n-\t} else {\n+\telse\n \t\tahvif-\u003edp_vif.tx_encap_type = ATH12K_HW_TXRX_NATIVE_WIFI;\n-\t}\n \n \tret = ath12k_wmi_vdev_set_param_cmd(ar, arvif-\u003evdev_id,\n \t\t\t\t\t    param_id, ahvif-\u003edp_vif.tx_encap_type);\n@@ -10136,6 +10135,9 @@ static void ath12k_mac_update_vif_offload(struct ath12k_link_vif *arvif)\n \t\tvif-\u003eoffload_flags \u0026= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;\n \t}\n \n+\tif (vif-\u003eoffload_flags \u0026 IEEE80211_OFFLOAD_ENCAP_ENABLED)\n+\t\tvif-\u003eoffload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;\n+\n \tparam_id = WMI_VDEV_PARAM_RX_DECAP_TYPE;\n \tif (vif-\u003eoffload_flags \u0026 IEEE80211_OFFLOAD_DECAP_ENABLED)\n \t\tparam_value = ATH12K_HW_TXRX_ETHERNET;\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath12k driver, which is a hardware-specific driver for Qualcomm Wi-Fi 7 devices (PCI/AHB). There is no software emulation for this hardware in QEMU or the kernel, making the code paths impossible to reach and fuzz in virtualized environments.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit bb12879886ac03a93c4ff7228837d51003a90506
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Jun 22 23:59:12 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index af354bef5c0d79..2d539da83361cd 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -10117,16 +10117,15 @@ static void ath12k_mac_update_vif_offload(struct ath12k_link_vif *arvif)
 	if (vif->type != NL80211_IFTYPE_STATION &&
 	    vif->type != NL80211_IFTYPE_AP)
 		vif->offload_flags &= ~(IEEE80211_OFFLOAD_ENCAP_ENABLED |
+					IEEE80211_OFFLOAD_ENCAP_4ADDR |
 					IEEE80211_OFFLOAD_DECAP_ENABLED);
 
-	if (vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED) {
+	if (vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
 		ahvif->dp_vif.tx_encap_type = ATH12K_HW_TXRX_ETHERNET;
-		vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
-	} else if (test_bit(ATH12K_FLAG_RAW_MODE, &ab->dev_flags)) {
+	else if (test_bit(ATH12K_FLAG_RAW_MODE, &ab->dev_flags))
 		ahvif->dp_vif.tx_encap_type = ATH12K_HW_TXRX_RAW;
-	} else {
+	else
 		ahvif->dp_vif.tx_encap_type = ATH12K_HW_TXRX_NATIVE_WIFI;
-	}
 
 	ret = ath12k_wmi_vdev_set_param_cmd(ar, arvif->vdev_id,
 					    param_id, ahvif->dp_vif.tx_encap_type);
@@ -10136,6 +10135,9 @@ static void ath12k_mac_update_vif_offload(struct ath12k_link_vif *arvif)
 		vif->offload_flags &= ~IEEE80211_OFFLOAD_ENCAP_ENABLED;
 	}
 
+	if (vif->offload_flags & IEEE80211_OFFLOAD_ENCAP_ENABLED)
+		vif->offload_flags |= IEEE80211_OFFLOAD_ENCAP_4ADDR;
+
 	param_id = WMI_VDEV_PARAM_RX_DECAP_TYPE;
 	if (vif->offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED)
 		param_value = ATH12K_HW_TXRX_ETHERNET;

gemini-3.1-pro-preview

null

null

							input: 2423
							output: 37
							thoughts: 273
						

**Analyzing a Driver Patch for Fuzzing Potential**

Okay, so I'm looking at this patch that tweaks the `ath12k_mac_update_vif_offload` function within `drivers/net/wireless/ath/ath12k/mac.c`. Specifically, it's messing with how `IEEE80211_OFFLOAD_ENCAP_4ADDR` is handled in `vif->offload_flags`. My initial thought is, "can we fuzz this?" Since it's a wireless driver, the typical approach would be to look at `mac80211_hwsim`, but this is *ath12k*, which is a specific hardware driver, meaning my traditional strategies might not apply.

I need to figure out if `ath12k` is even *reachable* in a virtualized environment. Then it hits me, this is a PCI/AHB driver for Qualcomm Wi-Fi 7 devices. That's a different beast altogether. So, can it be fuzzed? Hardware drivers are usually a no-go unless we're dealing with software emulation or maybe a USB driver fuzzed via dummy-hcd or raw-gadget. However, this is PCI/AHB; it has `pci.c` and `ahb.c`. No USB here.

Alright, so the game plan changes. I need to figure out *how* we might be able to fuzz `ath12k`. Let's dig into the kernel source and search for `ath12k` to see what kind of hooks or entry points exist.

{
  "Expression": "ath12k",
  "PathPrefix": "drivers/net/wireless/ath/ath12k/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 34901 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/ath12k/Kconfig=2=config ATH12K\ndrivers/net/wireless/ath/ath12k/Kconfig:3:\ttristate \"Qualcomm Wi-Fi 7 support (ath12k)\"\ndrivers/net/wireless/ath/ath12k/Kconfig-4-\tdepends on MAC80211 \u0026\u0026 HAS_DMA \u0026\u0026 PCI\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-14-\ndrivers/net/wireless/ath/ath12k/Kconfig:15:\t  If you choose to build a module, it'll be called ath12k.\ndrivers/net/wireless/ath/ath12k/Kconfig-16-\ndrivers/net/wireless/ath/ath12k/Kconfig=17=config ATH12K_AHB\ndrivers/net/wireless/ath/ath12k/Kconfig:18:\tbool \"Qualcomm ath12k AHB support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-19-\tdepends on ATH12K \u0026\u0026 REMOTEPROC\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=25=config ATH12K_DEBUG\ndrivers/net/wireless/ath/ath12k/Kconfig:26:\tbool \"ath12k debugging\"\ndrivers/net/wireless/ath/ath12k/Kconfig-27-\tdepends on ATH12K\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=35=config ATH12K_DEBUGFS\ndrivers/net/wireless/ath/ath12k/Kconfig:36:\tbool \"Qualcomm ath12k debugfs support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-37-\tdepends on ATH12K \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath12k/Kconfig-38-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:39:\t  Enable ath12k debugfs support\ndrivers/net/wireless/ath/ath12k/Kconfig-40-\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=44=config ATH12K_TRACING\ndrivers/net/wireless/ath/ath12k/Kconfig:45:\tbool \"ath12k tracing support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-46-\tdepends on ATH12K \u0026\u0026 EVENT_TRACING\ndrivers/net/wireless/ath/ath12k/Kconfig-47-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:48:\t  Enable ath12k tracing infrastructure.\ndrivers/net/wireless/ath/ath12k/Kconfig-49-\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=53=config ATH12K_COREDUMP\ndrivers/net/wireless/ath/ath12k/Kconfig:54:\tbool \"ath12k coredump\"\ndrivers/net/wireless/ath/ath12k/Kconfig-55-\tdepends on ATH12K\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-57-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:58:\t  Enable ath12k coredump collection\ndrivers/net/wireless/ath/ath12k/Kconfig-59-\n--\ndrivers/net/wireless/ath/ath12k/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath12k/Makefile:2:obj-$(CONFIG_ATH12K) += ath12k.o\ndrivers/net/wireless/ath/ath12k/Makefile:3:ath12k-y += core.o \\\ndrivers/net/wireless/ath/ath12k/Makefile-4-\t    hal.o \\\n--\ndrivers/net/wireless/ath/ath12k/Makefile-24-\ndrivers/net/wireless/ath/ath12k/Makefile:25:ath12k-$(CONFIG_ATH12K_AHB) += ahb.o\ndrivers/net/wireless/ath/ath12k/Makefile-26-\ndrivers/net/wireless/ath/ath12k/Makefile=27=obj-$(CONFIG_ATH12K) += wifi7/\ndrivers/net/wireless/ath/ath12k/Makefile-28-\ndrivers/net/wireless/ath/ath12k/Makefile:29:ath12k-$(CONFIG_ATH12K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o\ndrivers/net/wireless/ath/ath12k/Makefile:30:ath12k-$(CONFIG_ACPI) += acpi.o\ndrivers/net/wireless/ath/ath12k/Makefile:31:ath12k-$(CONFIG_ATH12K_TRACING) += trace.o\ndrivers/net/wireless/ath/ath12k/Makefile:32:ath12k-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/ath/ath12k/Makefile:33:ath12k-$(CONFIG_ATH12K_COREDUMP) += coredump.o\ndrivers/net/wireless/ath/ath12k/Makefile:34:ath12k-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath12k/Makefile:35:ath12k-$(CONFIG_THERMAL) += thermal.o\ndrivers/net/wireless/ath/ath12k/Makefile-36-\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-10-\ndrivers/net/wireless/ath/ath12k/acpi.c:11:static int ath12k_acpi_dsm_get_data(struct ath12k_base *ab, int func)\ndrivers/net/wireless/ath/ath12k/acpi.c-12-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-18-\tif (!root_handle) {\ndrivers/net/wireless/ath/ath12k/acpi.c:19:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"invalid acpi handler\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-20-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-26-\tif (!obj) {\ndrivers/net/wireless/ath/ath12k/acpi.c:27:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"acpi_evaluate_dsm() failed\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-28-\t\treturn -ENOENT;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-46-\t\t\t\t   ATH12K_ACPI_BDF_ANCHOR_STRING_LEN)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:47:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM BDF size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-48-\t\t\t\t\t    obj-\u003estring.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-62-\t\t\t    obj-\u003ebuffer.length \u003e ATH12K_ACPI_DSM_FUNC_MAX_BITMAP_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:63:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM func size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-64-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-75-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_TAS_CFG_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:76:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM TAS config size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-77-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-87-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_TAS_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:88:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM TAS data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-89-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-99-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_BIOS_SAR_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:100:\t\t\t\tath12k_warn(ab, \"invalid ACPI BIOS SAR data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-101-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-111-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_GEO_OFFSET_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:112:\t\t\t\tath12k_warn(ab, \"invalid ACPI GEO OFFSET data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-113-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-123-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_CCA_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:124:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM CCA data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-125-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-135-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_BAND_EDGE_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:136:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM band edge data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-137-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-147-\t} else {\ndrivers/net/wireless/ath/ath12k/acpi.c:148:\t\tath12k_warn(ab, \"ACPI DSM method returned an unsupported object type: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-149-\t\t\t    obj-\u003etype);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-160-\ndrivers/net/wireless/ath/ath12k/acpi.c:161:static int ath12k_acpi_set_power_limit(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-162-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-167-\t    tas_sar_power_table[1] != ATH12K_ACPI_TAS_DATA_ENABLE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:168:\t\tath12k_warn(ab, \"latest ACPI TAS data is invalid\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-169-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-171-\ndrivers/net/wireless/ath/ath12k/acpi.c:172:\tret = ath12k_wmi_set_bios_cmd(ab, WMI_BIOS_PARAM_TAS_DATA_TYPE,\ndrivers/net/wireless/ath/ath12k/acpi.c-173-\t\t\t\t      tas_sar_power_table,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-175-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:176:\t\tath12k_warn(ab, \"failed to send ACPI TAS data table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-177-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-182-\ndrivers/net/wireless/ath/ath12k/acpi.c:183:static int ath12k_acpi_set_bios_sar_power(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-184-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-188-\t    ab-\u003eacpi.bios_sar_data[1] != ATH12K_ACPI_POWER_LIMIT_ENABLE_FLAG) {\ndrivers/net/wireless/ath/ath12k/acpi.c:189:\t\tath12k_warn(ab, \"invalid latest ACPI BIOS SAR data\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-190-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-192-\ndrivers/net/wireless/ath/ath12k/acpi.c:193:\tret = ath12k_wmi_set_bios_sar_cmd(ab, ab-\u003eacpi.bios_sar_data);\ndrivers/net/wireless/ath/ath12k/acpi.c-194-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:195:\t\tath12k_warn(ab, \"failed to set ACPI BIOS SAR table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-196-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-201-\ndrivers/net/wireless/ath/ath12k/acpi.c:202:static void ath12k_acpi_dsm_notify(acpi_handle handle, u32 event, void *data)\ndrivers/net/wireless/ath/ath12k/acpi.c-203-{\ndrivers/net/wireless/ath/ath12k/acpi.c-204-\tint ret;\ndrivers/net/wireless/ath/ath12k/acpi.c:205:\tstruct ath12k_base *ab = data;\ndrivers/net/wireless/ath/ath12k/acpi.c-206-\ndrivers/net/wireless/ath/ath12k/acpi.c-207-\tif (event == ATH12K_ACPI_NOTIFY_EVENT) {\ndrivers/net/wireless/ath/ath12k/acpi.c:208:\t\tath12k_warn(ab, \"unknown acpi notify %u\\n\", event);\ndrivers/net/wireless/ath/ath12k/acpi.c-209-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-212-\tif (!ab-\u003eacpi.acpi_tas_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:213:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"acpi_tas_enable is false\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-214-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-216-\ndrivers/net/wireless/ath/ath12k/acpi.c:217:\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_TAS_DATA);\ndrivers/net/wireless/ath/ath12k/acpi.c-218-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:219:\t\tath12k_warn(ab, \"failed to update ACPI TAS data table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-220-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-222-\ndrivers/net/wireless/ath/ath12k/acpi.c:223:\tret = ath12k_acpi_set_power_limit(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-224-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:225:\t\tath12k_warn(ab, \"failed to set ACPI TAS power limit data: %d\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-226-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-231-\ndrivers/net/wireless/ath/ath12k/acpi.c:232:\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_BIOS_SAR);\ndrivers/net/wireless/ath/ath12k/acpi.c-233-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:234:\t\tath12k_warn(ab, \"failed to update BIOS SAR: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-235-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-237-\ndrivers/net/wireless/ath/ath12k/acpi.c:238:\tret = ath12k_acpi_set_bios_sar_power(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-239-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:240:\t\tath12k_warn(ab, \"failed to set BIOS SAR power limit: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-241-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-244-\ndrivers/net/wireless/ath/ath12k/acpi.c:245:static int ath12k_acpi_set_bios_sar_params(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-246-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-248-\ndrivers/net/wireless/ath/ath12k/acpi.c:249:\tret = ath12k_wmi_set_bios_sar_cmd(ab, ab-\u003eacpi.bios_sar_data);\ndrivers/net/wireless/ath/ath12k/acpi.c-250-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:251:\t\tath12k_warn(ab, \"failed to set ACPI BIOS SAR table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-252-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-254-\ndrivers/net/wireless/ath/ath12k/acpi.c:255:\tret = ath12k_wmi_set_bios_geo_cmd(ab, ab-\u003eacpi.geo_offset_data);\ndrivers/net/wireless/ath/ath12k/acpi.c-256-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:257:\t\tath12k_warn(ab, \"failed to set ACPI BIOS GEO table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-258-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-263-\ndrivers/net/wireless/ath/ath12k/acpi.c:264:static int ath12k_acpi_set_tas_params(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-265-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-267-\ndrivers/net/wireless/ath/ath12k/acpi.c:268:\tret = ath12k_wmi_set_bios_cmd(ab, WMI_BIOS_PARAM_TAS_CONFIG_TYPE,\ndrivers/net/wireless/ath/ath12k/acpi.c-269-\t\t\t\t      ab-\u003eacpi.tas_cfg,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-271-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:272:\t\tath12k_warn(ab, \"failed to send ACPI TAS config table parameter: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-273-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-276-\ndrivers/net/wireless/ath/ath12k/acpi.c:277:\tret = ath12k_wmi_set_bios_cmd(ab, WMI_BIOS_PARAM_TAS_DATA_TYPE,\ndrivers/net/wireless/ath/ath12k/acpi.c-278-\t\t\t\t      ab-\u003eacpi.tas_sar_power_table,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-280-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:281:\t\tath12k_warn(ab, \"failed to send ACPI TAS data table parameter: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-282-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-288-\ndrivers/net/wireless/ath/ath12k/acpi.c:289:bool ath12k_acpi_get_disable_rfkill(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-290-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-293-\ndrivers/net/wireless/ath/ath12k/acpi.c:294:bool ath12k_acpi_get_disable_11be(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-295-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-298-\ndrivers/net/wireless/ath/ath12k/acpi.c:299:void ath12k_acpi_set_dsm_func(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-300-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-308-\tif (ab-\u003eacpi.acpi_tas_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:309:\t\tret = ath12k_acpi_set_tas_params(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-310-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:311:\t\t\tath12k_warn(ab, \"failed to send ACPI TAS parameters: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-312-\t\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-316-\tif (ab-\u003eacpi.acpi_bios_sar_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:317:\t\tret = ath12k_acpi_set_bios_sar_params(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-318-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:319:\t\t\tath12k_warn(ab, \"failed to send ACPI BIOS SAR: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-320-\t\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-325-\t\tbuf = ab-\u003eacpi.cca_data + ATH12K_ACPI_CCA_THR_OFFSET_DATA_OFFSET;\ndrivers/net/wireless/ath/ath12k/acpi.c:326:\t\tret = ath12k_wmi_set_bios_cmd(ab,\ndrivers/net/wireless/ath/ath12k/acpi.c-327-\t\t\t\t\t      WMI_BIOS_PARAM_CCA_THRESHOLD_TYPE,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-330-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:331:\t\t\tath12k_warn(ab, \"failed to set ACPI DSM CCA threshold: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-332-\t\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-337-\tif (ab-\u003eacpi.acpi_band_edge_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:338:\t\tret = ath12k_wmi_set_bios_cmd(ab,\ndrivers/net/wireless/ath/ath12k/acpi.c-339-\t\t\t\t\t      WMI_BIOS_PARAM_TYPE_BANDEDGE,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-342-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:343:\t\t\tath12k_warn(ab,\ndrivers/net/wireless/ath/ath12k/acpi.c-344-\t\t\t\t    \"failed to set ACPI DSM band edge channel power: %d\\n\",\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-350-\ndrivers/net/wireless/ath/ath12k/acpi.c:351:int ath12k_acpi_start(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-352-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-368-\ndrivers/net/wireless/ath/ath12k/acpi.c:369:\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_SUPPORT_FUNCS);\ndrivers/net/wireless/ath/ath12k/acpi.c-370-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:371:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"failed to get ACPI DSM data: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-372-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-375-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_DISABLE_FLAG)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:376:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_DISABLE_FLAG);\ndrivers/net/wireless/ath/ath12k/acpi.c-377-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:378:\t\t\tath12k_warn(ab, \"failed to get ACPI DISABLE FLAG: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-379-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-391-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_BDF_EXT)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:392:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_BDF_EXT);\ndrivers/net/wireless/ath/ath12k/acpi.c-393-\t\tif (ret || ab-\u003eacpi.bdf_string[0] == '\\0') {\ndrivers/net/wireless/ath/ath12k/acpi.c:394:\t\t\tath12k_warn(ab, \"failed to get ACPI BDF EXT: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-395-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-401-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_TAS_CFG)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:402:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_TAS_CFG);\ndrivers/net/wireless/ath/ath12k/acpi.c-403-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:404:\t\t\tath12k_warn(ab, \"failed to get ACPI TAS config table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-405-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-409-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_TAS_DATA)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:410:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_TAS_DATA);\ndrivers/net/wireless/ath/ath12k/acpi.c-411-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:412:\t\t\tath12k_warn(ab, \"failed to get ACPI TAS data table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-413-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-422-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_BIOS_SAR)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:423:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_BIOS_SAR);\ndrivers/net/wireless/ath/ath12k/acpi.c-424-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:425:\t\t\tath12k_warn(ab, \"failed to get ACPI bios sar data: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-426-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-430-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_GEO_OFFSET)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:431:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_GEO_OFFSET);\ndrivers/net/wireless/ath/ath12k/acpi.c-432-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:433:\t\t\tath12k_warn(ab, \"failed to get ACPI geo offset data: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-434-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-444-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_CCA)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:445:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_INDEX_CCA);\ndrivers/net/wireless/ath/ath12k/acpi.c-446-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:447:\t\t\tath12k_warn(ab, \"failed to get ACPI DSM CCA threshold configuration: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-448-\t\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-459-\t\t\t\t       ATH12K_ACPI_FUNC_BIT_BAND_EDGE_CHAN_POWER)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:460:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_INDEX_BAND_EDGE);\ndrivers/net/wireless/ath/ath12k/acpi.c-461-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:462:\t\t\tath12k_warn(ab, \"failed to get ACPI DSM band edge channel power: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-463-\t\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-473-\t\t\t\t\t     ACPI_DEVICE_NOTIFY,\ndrivers/net/wireless/ath/ath12k/acpi.c:474:\t\t\t\t\t     ath12k_acpi_dsm_notify, ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-475-\tif (ACPI_FAILURE(status)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:476:\t\tath12k_warn(ab, \"failed to install DSM notify callback: %d\\n\", status);\ndrivers/net/wireless/ath/ath12k/acpi.c-477-\t\treturn -EIO;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-484-\ndrivers/net/wireless/ath/ath12k/acpi.c:485:int ath12k_acpi_check_bdf_variant_name(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-486-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-492-\tif (strscpy(ab-\u003eqmi.target.bdf_ext, ab-\u003eacpi.bdf_string + 4, max_len) \u003c 0)\ndrivers/net/wireless/ath/ath12k/acpi.c:493:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT,\ndrivers/net/wireless/ath/ath12k/acpi.c-494-\t\t\t   \"acpi bdf variant longer than the buffer (variant: %s)\\n\",\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-499-\ndrivers/net/wireless/ath/ath12k/acpi.c:500:void ath12k_acpi_stop(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-501-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-506-\t\t\t\t   ACPI_DEVICE_NOTIFY,\ndrivers/net/wireless/ath/ath12k/acpi.c:507:\t\t\t\t   ath12k_acpi_dsm_notify);\ndrivers/net/wireless/ath/ath12k/acpi.c-508-\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-74-\ndrivers/net/wireless/ath/ath12k/acpi.h:75:int ath12k_acpi_start(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:76:void ath12k_acpi_stop(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:77:bool ath12k_acpi_get_disable_rfkill(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:78:bool ath12k_acpi_get_disable_11be(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:79:void ath12k_acpi_set_dsm_func(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:80:int ath12k_acpi_check_bdf_variant_name(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h-81-\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-83-\ndrivers/net/wireless/ath/ath12k/acpi.h:84:static inline int ath12k_acpi_start(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-85-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-88-\ndrivers/net/wireless/ath/ath12k/acpi.h:89:static inline void ath12k_acpi_stop(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-90-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-92-\ndrivers/net/wireless/ath/ath12k/acpi.h:93:static inline bool ath12k_acpi_get_disable_rfkill(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-94-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-97-\ndrivers/net/wireless/ath/ath12k/acpi.h:98:static inline bool ath12k_acpi_get_disable_11be(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-99-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-102-\ndrivers/net/wireless/ath/ath12k/acpi.h:103:static inline void ath12k_acpi_set_dsm_func(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-104-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-106-\ndrivers/net/wireless/ath/ath12k/acpi.h:107:static inline int ath12k_acpi_check_bdf_variant_name(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-108-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-22-\ndrivers/net/wireless/ath/ath12k/ahb.c:23:static struct ath12k_ahb_driver *ath12k_ahb_family_drivers[ATH12K_DEVICE_FAMILY_MAX];\ndrivers/net/wireless/ath/ath12k/ahb.c:24:static const char ath12k_userpd_irq[][9] = {\"spawn\",\ndrivers/net/wireless/ath/ath12k/ahb.c-25-\t\t\t\t     \"ready\",\n--\ndrivers/net/wireless/ath/ath12k/ahb.c=84=enum ext_irq_num {\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-123-\ndrivers/net/wireless/ath/ath12k/ahb.c:124:static u32 ath12k_ahb_read32(struct ath12k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath12k/ahb.c-125-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-130-\ndrivers/net/wireless/ath/ath12k/ahb.c:131:static void ath12k_ahb_write32(struct ath12k_base *ab, u32 offset,\ndrivers/net/wireless/ath/ath12k/ahb.c-132-\t\t\t       u32 value)\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-139-\ndrivers/net/wireless/ath/ath12k/ahb.c:140:static void ath12k_ahb_cancel_workqueue(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-141-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-144-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:145:\t\tstruct ath12k_ce_pipe *ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath12k/ahb.c-146-\ndrivers/net/wireless/ath/ath12k/ahb.c:147:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-148-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-153-\ndrivers/net/wireless/ath/ath12k/ahb.c:154:static void ath12k_ahb_ext_grp_disable(struct ath12k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath12k/ahb.c-155-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-161-\ndrivers/net/wireless/ath/ath12k/ahb.c:162:static void __ath12k_ahb_ext_irq_disable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-163-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-166-\tfor (i = 0; i \u003c ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:167:\t\tstruct ath12k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath12k/ahb.c-168-\ndrivers/net/wireless/ath/ath12k/ahb.c:169:\t\tath12k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath12k/ahb.c-170-\t\tif (irq_grp-\u003enapi_enabled) {\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-177-\ndrivers/net/wireless/ath/ath12k/ahb.c:178:static void ath12k_ahb_ext_grp_enable(struct ath12k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath12k/ahb.c-179-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-185-\ndrivers/net/wireless/ath/ath12k/ahb.c:186:static void ath12k_ahb_setbit32(struct ath12k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath12k/ahb.c-187-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-189-\ndrivers/net/wireless/ath/ath12k/ahb.c:190:\tval = ath12k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath12k/ahb.c:191:\tath12k_ahb_write32(ab, offset, val | BIT(bit));\ndrivers/net/wireless/ath/ath12k/ahb.c-192-}\ndrivers/net/wireless/ath/ath12k/ahb.c-193-\ndrivers/net/wireless/ath/ath12k/ahb.c:194:static void ath12k_ahb_clearbit32(struct ath12k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath12k/ahb.c-195-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-197-\ndrivers/net/wireless/ath/ath12k/ahb.c:198:\tval = ath12k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath12k/ahb.c:199:\tath12k_ahb_write32(ab, offset, val \u0026 ~BIT(bit));\ndrivers/net/wireless/ath/ath12k/ahb.c-200-}\ndrivers/net/wireless/ath/ath12k/ahb.c-201-\ndrivers/net/wireless/ath/ath12k/ahb.c:202:static void ath12k_ahb_ce_irq_enable(struct ath12k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath12k/ahb.c-203-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-213-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath12k/ahb.c:214:\t\tath12k_ahb_setbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c-215-\ndrivers/net/wireless/ath/ath12k/ahb.c-216-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath12k/ahb.c:217:\t\tath12k_ahb_setbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c:218:\t\tath12k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath12k/ahb.c-219-\t\t\t\t    ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-222-\ndrivers/net/wireless/ath/ath12k/ahb.c:223:static void ath12k_ahb_ce_irq_disable(struct ath12k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath12k/ahb.c-224-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-234-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath12k/ahb.c:235:\t\tath12k_ahb_clearbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c-236-\ndrivers/net/wireless/ath/ath12k/ahb.c-237-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath12k/ahb.c:238:\t\tath12k_ahb_clearbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c:239:\t\tath12k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath12k/ahb.c-240-\t\t\t\t      ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-243-\ndrivers/net/wireless/ath/ath12k/ahb.c:244:static void ath12k_ahb_sync_ce_irqs(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-245-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-249-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:250:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-251-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-257-\ndrivers/net/wireless/ath/ath12k/ahb.c:258:static void ath12k_ahb_sync_ext_irqs(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-259-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-263-\tfor (i = 0; i \u003c ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:264:\t\tstruct ath12k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath12k/ahb.c-265-\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-272-\ndrivers/net/wireless/ath/ath12k/ahb.c:273:static void ath12k_ahb_ce_irqs_enable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-274-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-277-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:278:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-279-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath12k/ahb.c:280:\t\tath12k_ahb_ce_irq_enable(ab, i);\ndrivers/net/wireless/ath/ath12k/ahb.c-281-\t}\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-283-\ndrivers/net/wireless/ath/ath12k/ahb.c:284:static void ath12k_ahb_ce_irqs_disable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-285-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-288-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:289:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-290-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath12k/ahb.c:291:\t\tath12k_ahb_ce_irq_disable(ab, i);\ndrivers/net/wireless/ath/ath12k/ahb.c-292-\t}\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-294-\ndrivers/net/wireless/ath/ath12k/ahb.c:295:static int ath12k_ahb_start(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-296-{\ndrivers/net/wireless/ath/ath12k/ahb.c:297:\tath12k_ahb_ce_irqs_enable(ab);\ndrivers/net/wireless/ath/ath12k/ahb.c:298:\tath12k_ce_rx_post_buf(ab);\ndrivers/net/wireless/ath/ath12k/ahb.c-299-\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-302-\ndrivers/net/wireless/ath/ath12k/ahb.c:303:static void ath12k_ahb_ext_irq_enable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-304-{\ndrivers/net/wireless/ath/ath12k/ahb.c:305:\tstruct ath12k_ext_irq_grp *irq_grp;\ndrivers/net/wireless/ath/ath12k/ahb.c-306-\tint i;\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-313-\t\t}\ndrivers/net/wireless/ath/ath12k/ahb.c:314:\t\tath12k_ahb_ext_grp_enable(irq_grp);\ndrivers/net/wireless/ath/ath12k/ahb.c-315-\t}\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-317-\ndrivers/net/wireless/ath/ath12k/ahb.c:318:static void ath12k_ahb_ext_irq_disable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-319-{\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 17824
							output: 39
							thoughts: 346
						

**Fuzzing the ath12k Driver: A Reality Check**

Okay, so I'm looking at this patch and initially thought it might be related to `mac80211_hwsim`, but it's not. That's a separate thing. The patch itself is in `ath12k/mac.c`, so it's clearly related to the ath12k driver. The immediate question is, can we fuzz this thing? Does it have a test mode? Aha, there's a `drivers/net/wireless/ath/ath12k/testmode.c` file. Promising.

But hold on, syzbot has already applied a patch and it's under review. So, is syzbot actually fuzzing *this*? Does it have a virtual PCI device that it's hitting? Or is syzbot just picking up patches that happen to be in the tree? The instructions I have say to mark a patch as not worth fuzzing if the code path is unreachable in virtualized environments like QEMU or GCE. This makes me consider if ath12k is reachable in QEMU.

And there it is, the problem. ath12k is a PCI driver. Unless there's a QEMU device that emulates a Qualcomm Wi-Fi 7 PCI device, it's just not going to happen. QEMU doesn't do that. Wait a second, is it even a USB device? Nope, it's PCI and AHB. Just to be sure, let me check `drivers/net/wireless/ath/ath12k/pci.c`. The answer is probably right there.

{
  "Expression": "pci_register_driver",
  "PathPrefix": "drivers/net/wireless/ath/ath12k/"
}

{
  "Output": "drivers/net/wireless/ath/ath12k/pci.c=1797=static const struct dev_pm_ops __maybe_unused ath12k_pci_pm_ops = {\n--\ndrivers/net/wireless/ath/ath12k/pci.c-1803-\ndrivers/net/wireless/ath/ath12k/pci.c:1804:int ath12k_pci_register_driver(const enum ath12k_device_family device_id,\ndrivers/net/wireless/ath/ath12k/pci.c-1805-\t\t\t       struct ath12k_pci_driver *driver)\n--\ndrivers/net/wireless/ath/ath12k/pci.c-1830-\ndrivers/net/wireless/ath/ath12k/pci.c:1831:\treturn pci_register_driver(pci_driver);\ndrivers/net/wireless/ath/ath12k/pci.c-1832-}\ndrivers/net/wireless/ath/ath12k/pci.c:1833:EXPORT_SYMBOL(ath12k_pci_register_driver);\ndrivers/net/wireless/ath/ath12k/pci.c-1834-\n--\ndrivers/net/wireless/ath/ath12k/pci.h=176=void ath12k_pci_power_down(struct ath12k_base *ab, bool is_suspend);\ndrivers/net/wireless/ath/ath12k/pci.h:177:int ath12k_pci_register_driver(const enum ath12k_device_family device_id,\ndrivers/net/wireless/ath/ath12k/pci.h-178-\t\t\t       struct ath12k_pci_driver *driver);\n--\ndrivers/net/wireless/ath/ath12k/wifi7/pci.c=197=int ath12k_wifi7_pci_init(void)\n--\ndrivers/net/wireless/ath/ath12k/wifi7/pci.c-200-\ndrivers/net/wireless/ath/ath12k/wifi7/pci.c:201:\tret = ath12k_pci_register_driver(ATH12K_DEVICE_FAMILY_WIFI7,\ndrivers/net/wireless/ath/ath12k/wifi7/pci.c-202-\t\t\t\t\t \u0026ath12k_wifi7_pci_driver);\n"
}

gemini-3.1-pro-preview

null

null

							input: 19207
							output: 35
							thoughts: 120
						

**Exploring the Options for Accessing the ath12k Driver**

Okay, so I'm dealing with an ath12k PCI driver. The immediate challenge is that, unlike some other areas, there doesn't seem to be a software emulation framework directly available within the kernel for the ath12k module. No `mac80211_hwsim` equivalent, which is a key tool for generic mac80211 development and testing, and no `vhci` for Bluetooth which I'm also familiar with. I need a way to reach into the ath12k code without a physical device.

Wait, I need to double-check that. Does `mac80211_hwsim` have any interaction with ath12k? No, that's right, `mac80211_hwsim` is a completely separate software simulator, it’s not using `ath12k` as a backend. I need to focus on other avenues.

So, if there's no direct software emulation, what are my options? Could I potentially leverage the `nl80211` testmode framework? It's often used for interacting with wireless drivers in a controlled environment. I'll need to dig into `testmode.c` and see if there are any hooks or entry points that would allow me to interact with the ath12k driver in a meaningful way. Time to dive into the code.

{
  "Expression": "testmode",
  "PathPrefix": "drivers/net/wireless/ath/ath12k/"
}

{
  "Output": "drivers/net/wireless/ath/ath12k/Makefile=33=ath12k-$(CONFIG_ATH12K_COREDUMP) += coredump.o\ndrivers/net/wireless/ath/ath12k/Makefile:34:ath12k-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath12k/Makefile-35-ath12k-$(CONFIG_THERMAL) += thermal.o\n--\ndrivers/net/wireless/ath/ath12k/mac.c-17-#include \"dp_rx.h\"\ndrivers/net/wireless/ath/ath12k/mac.c:18:#include \"testmode.h\"\ndrivers/net/wireless/ath/ath12k/mac.c-19-#include \"peer.h\"\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-6-\ndrivers/net/wireless/ath/ath12k/testmode.c:7:#include \"testmode.h\"\ndrivers/net/wireless/ath/ath12k/testmode.c-8-#include \u003cnet/netlink.h\u003e\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-13-#include \"hif.h\"\ndrivers/net/wireless/ath/ath12k/testmode.c:14:#include \"../testmode_i.h\"\ndrivers/net/wireless/ath/ath12k/testmode.c-15-\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=45=void ath12k_tm_wmi_event_unsegmented(struct ath12k_base *ab, u32 cmd_id,\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-51-\tath12k_dbg(ab, ATH12K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath12k/testmode.c:52:\t\t   \"testmode event wmi cmd_id %d skb length %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-53-\t\t   cmd_id, skb-\u003elen);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-58-\tif (!ar) {\ndrivers/net/wireless/ath/ath12k/testmode.c:59:\t\tath12k_warn(ab, \"testmode event not handled due to invalid pdev\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-60-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-64-\ndrivers/net/wireless/ath/ath12k/testmode.c:65:\tnl_skb = cfg80211_testmode_alloc_event_skb(ar-\u003eah-\u003ehw-\u003ewiphy,\ndrivers/net/wireless/ath/ath12k/testmode.c-66-\t\t\t\t\t\t   2 * nla_total_size(sizeof(u32)) +\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-72-\t\tath12k_warn(ab,\ndrivers/net/wireless/ath/ath12k/testmode.c:73:\t\t\t    \"failed to allocate skb for unsegmented testmode wmi event\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-74-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-79-\t    nla_put(nl_skb, ATH_TM_ATTR_DATA, skb-\u003elen, skb-\u003edata)) {\ndrivers/net/wireless/ath/ath12k/testmode.c:80:\t\tath12k_warn(ab, \"failed to populate testmode unsegmented event\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-81-\t\tkfree_skb(nl_skb);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-84-\ndrivers/net/wireless/ath/ath12k/testmode.c:85:\tcfg80211_testmode_event(nl_skb, GFP_ATOMIC);\ndrivers/net/wireless/ath/ath12k/testmode.c-86-}\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=88=void ath12k_tm_process_event(struct ath12k_base *ab, u32 cmd_id,\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-99-\tath12k_dbg(ab, ATH12K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath12k/testmode.c:100:\t\t   \"testmode event wmi cmd_id %d ftm event msg %p datalen %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-101-\t\t   cmd_id, ftm_msg, length);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-105-\tif (pdev_id \u003e= ab-\u003enum_radios) {\ndrivers/net/wireless/ath/ath12k/testmode.c:106:\t\tath12k_warn(ab, \"testmode event not handled due to invalid pdev id\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-107-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-112-\tif (!ar) {\ndrivers/net/wireless/ath/ath12k/testmode.c:113:\t\tath12k_warn(ab, \"testmode event not handled due to absence of pdev\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-114-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-153-\tspin_lock_bh(\u0026ar-\u003edata_lock);\ndrivers/net/wireless/ath/ath12k/testmode.c:154:\tnl_skb = cfg80211_testmode_alloc_event_skb(ar-\u003eah-\u003ehw-\u003ewiphy,\ndrivers/net/wireless/ath/ath12k/testmode.c-155-\t\t\t\t\t\t   2 * nla_total_size(sizeof(u32)) +\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-161-\t\tath12k_warn(ab,\ndrivers/net/wireless/ath/ath12k/testmode.c:162:\t\t\t    \"failed to allocate skb for testmode wmi event\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-163-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-170-\t\t    \u0026ab-\u003eftm_event_obj.eventdata[0])) {\ndrivers/net/wireless/ath/ath12k/testmode.c:171:\t\tath12k_warn(ab, \"failed to populate testmode event\");\ndrivers/net/wireless/ath/ath12k/testmode.c-172-\t\tkfree_skb(nl_skb);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-175-\ndrivers/net/wireless/ath/ath12k/testmode.c:176:\tcfg80211_testmode_event(nl_skb, GFP_ATOMIC);\ndrivers/net/wireless/ath/ath12k/testmode.c-177-}\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=179=static int ath12k_tm_cmd_get_version(struct ath12k *ar, struct nlattr *tb[])\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-183-\tath12k_dbg(ar-\u003eab, ATH12K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath12k/testmode.c:184:\t\t   \"testmode cmd get version_major %d version_minor %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-185-\t\t   ATH_TESTMODE_VERSION_MAJOR,\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-188-\tspin_lock_bh(\u0026ar-\u003edata_lock);\ndrivers/net/wireless/ath/ath12k/testmode.c:189:\tskb = cfg80211_testmode_alloc_reply_skb(ar-\u003eah-\u003ehw-\u003ewiphy,\ndrivers/net/wireless/ath/ath12k/testmode.c-190-\t\t\t\t\t\t2 * nla_total_size(sizeof(u32)));\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-203-\ndrivers/net/wireless/ath/ath12k/testmode.c:204:\treturn cfg80211_testmode_reply(skb);\ndrivers/net/wireless/ath/ath12k/testmode.c-205-}\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=207=static int ath12k_tm_cmd_process_ftm(struct ath12k *ar, struct nlattr *tb[])\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-229-\tath12k_dbg(ar-\u003eab, ATH12K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath12k/testmode.c:230:\t\t   \"testmode cmd wmi cmd_id %d buf %p buf_len %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-231-\t\t   cmd_id, buf, buf_len);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-280-\ndrivers/net/wireless/ath/ath12k/testmode.c:281:static int ath12k_tm_cmd_testmode_start(struct ath12k *ar, struct nlattr *tb[])\ndrivers/net/wireless/ath/ath12k/testmode.c-282-{\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=300=static int ath12k_tm_cmd_wmi(struct ath12k *ar, struct nlattr *tb[])\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-318-\tif (!buf_len) {\ndrivers/net/wireless/ath/ath12k/testmode.c:319:\t\tath12k_warn(ar-\u003eab, \"No data present in testmode command\\n\");\ndrivers/net/wireless/ath/ath12k/testmode.c-320-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-331-\tath12k_dbg(ar-\u003eab, ATH12K_DBG_TESTMODE,\ndrivers/net/wireless/ath/ath12k/testmode.c:332:\t\t   \"testmode cmd wmi cmd_id %d  buf length %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-333-\t\t   cmd_id, buf_len);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-346-\t\tdev_kfree_skb(skb);\ndrivers/net/wireless/ath/ath12k/testmode.c:347:\t\tath12k_warn(ar-\u003eab, \"failed to transmit wmi command (testmode): %d\\n\",\ndrivers/net/wireless/ath/ath12k/testmode.c-348-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/testmode.c=354=int ath12k_tm_cmd(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/ath/ath12k/testmode.c-385-\tcase ATH_TM_CMD_TESTMODE_START:\ndrivers/net/wireless/ath/ath12k/testmode.c:386:\t\treturn ath12k_tm_cmd_testmode_start(ar, tb);\ndrivers/net/wireless/ath/ath12k/testmode.c-387-\tcase ATH_TM_CMD_GET_VERSION:\n--\ndrivers/net/wireless/ath/ath12k/wifi7/hw.c-24-#include \"../debugfs_sta.h\"\ndrivers/net/wireless/ath/ath12k/wifi7/hw.c:25:#include \"../testmode.h\"\ndrivers/net/wireless/ath/ath12k/wifi7/hw.c-26-#include \"hal.h\"\n--\ndrivers/net/wireless/ath/ath12k/wmi.c-26-#include \"p2p.h\"\ndrivers/net/wireless/ath/ath12k/wmi.c:27:#include \"testmode.h\"\ndrivers/net/wireless/ath/ath12k/wmi.c-28-\n"
}

gemini-3.1-pro-preview

null

null

							input: 23061
							output: 42
							thoughts: 255
						

**Analyzing the `ath12k` Vulnerability Report**

Okay, so testmode is just about sending WMI commands to the firmware. Not exactly the core issue. Now, I see this modified function, `ath12k_mac_update_vif_offload`, is called from `ath12k_mac_vif_recalc` or something very similar, which, as I recall, is part of the standard mac80211 operations. That's typical. But, hold on a second... `ath12k` is a PCI driver. It's supposed to need actual hardware. If the hardware isn't present, how is syzbot even reaching this code in the first place?

Hmm... could syzbot be fuzzing using `mac80211_hwsim`? No, no, `hwsim` is a completely separate driver, used for simulation. It's a dead end. Okay, wait... I seem to recall something about syzbot having the ability to fuzz PCI drivers using a virtual PCI bus, or something similar. But, no, that isn't true for `ath12k`, syzbot wouldn't be doing it that way.

But, hang on, there's that note from syzbot "syz-cluster: applied patch under review." If syzbot is fuzzing, it has to be reachable somehow. This is the key question. Wait a minute, if the driver isn't loaded because there's no hardware, the code *should* be unreachable. That's the baseline assumption. Okay, then, the most logical next step is to see if we can load the `ath12k` driver without the hardware present. That's the first test to perform.

{
  "Expression": "ath12k_pci_probe",
  "PathPrefix": "drivers/net/wireless/ath/ath12k/"
}

{
  "Output": "drivers/net/wireless/ath/ath12k/pci.c=1503=ath12k_get_device_family(const struct pci_device_id *pci_dev)\n--\ndrivers/net/wireless/ath/ath12k/pci.c-1523-\ndrivers/net/wireless/ath/ath12k/pci.c:1524:static int ath12k_pci_probe(struct pci_dev *pdev,\ndrivers/net/wireless/ath/ath12k/pci.c-1525-\t\t\t    const struct pci_device_id *pci_dev)\n--\ndrivers/net/wireless/ath/ath12k/pci.c=1804=int ath12k_pci_register_driver(const enum ath12k_device_family device_id,\n--\ndrivers/net/wireless/ath/ath12k/pci.c-1825-\tpci_driver-\u003eid_table = driver-\u003eid_table;\ndrivers/net/wireless/ath/ath12k/pci.c:1826:\tpci_driver-\u003eprobe = ath12k_pci_probe;\ndrivers/net/wireless/ath/ath12k/pci.c-1827-\tpci_driver-\u003eremove = ath12k_pci_remove;\n"
}

gemini-3.1-pro-preview

null

null

							input: 24089
							output: 42
							thoughts: 22
						

Here's my thought process, as if I were considering this question:

**Exploring Ath12k Beyond the Obvious**

Alright, I'm trying to figure out how to dig deeper into the ath12k driver, and the usual approaches aren't quite cutting it. I'm wondering if there's a different angle, a less common method, a way to probe it that I haven't considered. I need to be thorough.

Then my mind jumps to `ahb.c`. Could that provide some clues or alternative entry points for analysis? I'll need to refresh my memory on that section of code and its relationship to the broader driver architecture. Maybe there's a hidden gem there that I've overlooked. I have to stay focused.

{
  "Expression": "ath12k_ahb_probe",
  "PathPrefix": "drivers/net/wireless/ath/ath12k/"
}

{
  "Output": "drivers/net/wireless/ath/ath12k/ahb.c=998=ath12k_ahb_get_device_family(const struct platform_device *pdev)\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-1018-\ndrivers/net/wireless/ath/ath12k/ahb.c:1019:static int ath12k_ahb_probe(struct platform_device *pdev)\ndrivers/net/wireless/ath/ath12k/ahb.c-1020-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c=1187=int ath12k_ahb_register_driver(const enum ath12k_device_family device_id,\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-1208-\tahb_driver-\u003edriver.of_match_table = driver-\u003eid_table;\ndrivers/net/wireless/ath/ath12k/ahb.c:1209:\tahb_driver-\u003eprobe  = ath12k_ahb_probe;\ndrivers/net/wireless/ath/ath12k/ahb.c-1210-\tahb_driver-\u003eremove = ath12k_ahb_remove;\n"
}

gemini-3.1-pro-preview

null

null

							input: 24651
							output: 32
							thoughts: 253
						

**Analyzing the Reachability of `ath12k` in a Virtualized Environment**

Okay, so I'm digging into this `ath12k` situation. The core question is: can syzbot realistically trigger this code, and is it "worth fuzzing"? I'm thinking about platform device probes. Can syzbot conjure up arbitrary platform devices? Initially, I thought maybe via `syz_devlink` or something similar, or perhaps even device tree overlays. But hold on, syzbot isn't a general device creation machine unless there's a specifically crafted syzkaller description for it.

But then again, we're talking about fuzzing, so maybe there's a path. I need to keep the instructions in mind. They say `WorthFuzzing=false` if the patch involves code that's *impossible* to reach in environments like GCE or QEMU, even with emulated hardware. So, the question boils down to: is `ath12k` reachable in QEMU?

If it's a PCI device, QEMU's not emulating it. If it's a platform device, QEMU is still not going to emulate it. Now, is there any software emulation of `ath12k`? I don't believe so. Based on what I know now, it seems impossible to reach in these virtualized setups.

Let me just double-check, though. It's always worth another look to be absolutely certain. Just need to confirm no software emulation exists.

{
  "Expression": "ath12k",
  "PathPrefix": "drivers/net/wireless/ath/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 34909 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/ath/Kconfig=65=source \"drivers/net/wireless/ath/ath11k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig:66:source \"drivers/net/wireless/ath/ath12k/Kconfig\"\ndrivers/net/wireless/ath/Kconfig-67-\n--\ndrivers/net/wireless/ath/Makefile=10=obj-$(CONFIG_ATH11K)\t\t+= ath11k/\ndrivers/net/wireless/ath/Makefile:11:obj-$(CONFIG_ATH12K)\t\t+= ath12k/\ndrivers/net/wireless/ath/Makefile-12-\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=2=config ATH12K\ndrivers/net/wireless/ath/ath12k/Kconfig:3:\ttristate \"Qualcomm Wi-Fi 7 support (ath12k)\"\ndrivers/net/wireless/ath/ath12k/Kconfig-4-\tdepends on MAC80211 \u0026\u0026 HAS_DMA \u0026\u0026 PCI\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-14-\ndrivers/net/wireless/ath/ath12k/Kconfig:15:\t  If you choose to build a module, it'll be called ath12k.\ndrivers/net/wireless/ath/ath12k/Kconfig-16-\ndrivers/net/wireless/ath/ath12k/Kconfig=17=config ATH12K_AHB\ndrivers/net/wireless/ath/ath12k/Kconfig:18:\tbool \"Qualcomm ath12k AHB support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-19-\tdepends on ATH12K \u0026\u0026 REMOTEPROC\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=25=config ATH12K_DEBUG\ndrivers/net/wireless/ath/ath12k/Kconfig:26:\tbool \"ath12k debugging\"\ndrivers/net/wireless/ath/ath12k/Kconfig-27-\tdepends on ATH12K\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=35=config ATH12K_DEBUGFS\ndrivers/net/wireless/ath/ath12k/Kconfig:36:\tbool \"Qualcomm ath12k debugfs support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-37-\tdepends on ATH12K \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath12k/Kconfig-38-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:39:\t  Enable ath12k debugfs support\ndrivers/net/wireless/ath/ath12k/Kconfig-40-\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=44=config ATH12K_TRACING\ndrivers/net/wireless/ath/ath12k/Kconfig:45:\tbool \"ath12k tracing support\"\ndrivers/net/wireless/ath/ath12k/Kconfig-46-\tdepends on ATH12K \u0026\u0026 EVENT_TRACING\ndrivers/net/wireless/ath/ath12k/Kconfig-47-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:48:\t  Enable ath12k tracing infrastructure.\ndrivers/net/wireless/ath/ath12k/Kconfig-49-\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=53=config ATH12K_COREDUMP\ndrivers/net/wireless/ath/ath12k/Kconfig:54:\tbool \"ath12k coredump\"\ndrivers/net/wireless/ath/ath12k/Kconfig-55-\tdepends on ATH12K\n--\ndrivers/net/wireless/ath/ath12k/Kconfig-57-\thelp\ndrivers/net/wireless/ath/ath12k/Kconfig:58:\t  Enable ath12k coredump collection\ndrivers/net/wireless/ath/ath12k/Kconfig-59-\n--\ndrivers/net/wireless/ath/ath12k/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath12k/Makefile:2:obj-$(CONFIG_ATH12K) += ath12k.o\ndrivers/net/wireless/ath/ath12k/Makefile:3:ath12k-y += core.o \\\ndrivers/net/wireless/ath/ath12k/Makefile-4-\t    hal.o \\\n--\ndrivers/net/wireless/ath/ath12k/Makefile-24-\ndrivers/net/wireless/ath/ath12k/Makefile:25:ath12k-$(CONFIG_ATH12K_AHB) += ahb.o\ndrivers/net/wireless/ath/ath12k/Makefile-26-\ndrivers/net/wireless/ath/ath12k/Makefile=27=obj-$(CONFIG_ATH12K) += wifi7/\ndrivers/net/wireless/ath/ath12k/Makefile-28-\ndrivers/net/wireless/ath/ath12k/Makefile:29:ath12k-$(CONFIG_ATH12K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o\ndrivers/net/wireless/ath/ath12k/Makefile:30:ath12k-$(CONFIG_ACPI) += acpi.o\ndrivers/net/wireless/ath/ath12k/Makefile:31:ath12k-$(CONFIG_ATH12K_TRACING) += trace.o\ndrivers/net/wireless/ath/ath12k/Makefile:32:ath12k-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/ath/ath12k/Makefile:33:ath12k-$(CONFIG_ATH12K_COREDUMP) += coredump.o\ndrivers/net/wireless/ath/ath12k/Makefile:34:ath12k-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath12k/Makefile:35:ath12k-$(CONFIG_THERMAL) += thermal.o\ndrivers/net/wireless/ath/ath12k/Makefile-36-\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-10-\ndrivers/net/wireless/ath/ath12k/acpi.c:11:static int ath12k_acpi_dsm_get_data(struct ath12k_base *ab, int func)\ndrivers/net/wireless/ath/ath12k/acpi.c-12-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-18-\tif (!root_handle) {\ndrivers/net/wireless/ath/ath12k/acpi.c:19:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"invalid acpi handler\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-20-\t\treturn -EOPNOTSUPP;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-26-\tif (!obj) {\ndrivers/net/wireless/ath/ath12k/acpi.c:27:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"acpi_evaluate_dsm() failed\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-28-\t\treturn -ENOENT;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-46-\t\t\t\t   ATH12K_ACPI_BDF_ANCHOR_STRING_LEN)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:47:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM BDF size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-48-\t\t\t\t\t    obj-\u003estring.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-62-\t\t\t    obj-\u003ebuffer.length \u003e ATH12K_ACPI_DSM_FUNC_MAX_BITMAP_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:63:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM func size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-64-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-75-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_TAS_CFG_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:76:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM TAS config size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-77-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-87-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_TAS_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:88:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM TAS data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-89-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-99-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_BIOS_SAR_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:100:\t\t\t\tath12k_warn(ab, \"invalid ACPI BIOS SAR data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-101-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-111-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_GEO_OFFSET_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:112:\t\t\t\tath12k_warn(ab, \"invalid ACPI GEO OFFSET data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-113-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-123-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_CCA_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:124:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM CCA data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-125-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-135-\t\t\tif (obj-\u003ebuffer.length != ATH12K_ACPI_DSM_BAND_EDGE_DATA_SIZE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:136:\t\t\t\tath12k_warn(ab, \"invalid ACPI DSM band edge data size: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-137-\t\t\t\t\t    obj-\u003ebuffer.length);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-147-\t} else {\ndrivers/net/wireless/ath/ath12k/acpi.c:148:\t\tath12k_warn(ab, \"ACPI DSM method returned an unsupported object type: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-149-\t\t\t    obj-\u003etype);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-160-\ndrivers/net/wireless/ath/ath12k/acpi.c:161:static int ath12k_acpi_set_power_limit(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-162-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-167-\t    tas_sar_power_table[1] != ATH12K_ACPI_TAS_DATA_ENABLE) {\ndrivers/net/wireless/ath/ath12k/acpi.c:168:\t\tath12k_warn(ab, \"latest ACPI TAS data is invalid\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-169-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-171-\ndrivers/net/wireless/ath/ath12k/acpi.c:172:\tret = ath12k_wmi_set_bios_cmd(ab, WMI_BIOS_PARAM_TAS_DATA_TYPE,\ndrivers/net/wireless/ath/ath12k/acpi.c-173-\t\t\t\t      tas_sar_power_table,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-175-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:176:\t\tath12k_warn(ab, \"failed to send ACPI TAS data table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-177-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-182-\ndrivers/net/wireless/ath/ath12k/acpi.c:183:static int ath12k_acpi_set_bios_sar_power(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-184-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-188-\t    ab-\u003eacpi.bios_sar_data[1] != ATH12K_ACPI_POWER_LIMIT_ENABLE_FLAG) {\ndrivers/net/wireless/ath/ath12k/acpi.c:189:\t\tath12k_warn(ab, \"invalid latest ACPI BIOS SAR data\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-190-\t\treturn -EINVAL;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-192-\ndrivers/net/wireless/ath/ath12k/acpi.c:193:\tret = ath12k_wmi_set_bios_sar_cmd(ab, ab-\u003eacpi.bios_sar_data);\ndrivers/net/wireless/ath/ath12k/acpi.c-194-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:195:\t\tath12k_warn(ab, \"failed to set ACPI BIOS SAR table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-196-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-201-\ndrivers/net/wireless/ath/ath12k/acpi.c:202:static void ath12k_acpi_dsm_notify(acpi_handle handle, u32 event, void *data)\ndrivers/net/wireless/ath/ath12k/acpi.c-203-{\ndrivers/net/wireless/ath/ath12k/acpi.c-204-\tint ret;\ndrivers/net/wireless/ath/ath12k/acpi.c:205:\tstruct ath12k_base *ab = data;\ndrivers/net/wireless/ath/ath12k/acpi.c-206-\ndrivers/net/wireless/ath/ath12k/acpi.c-207-\tif (event == ATH12K_ACPI_NOTIFY_EVENT) {\ndrivers/net/wireless/ath/ath12k/acpi.c:208:\t\tath12k_warn(ab, \"unknown acpi notify %u\\n\", event);\ndrivers/net/wireless/ath/ath12k/acpi.c-209-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-212-\tif (!ab-\u003eacpi.acpi_tas_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:213:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"acpi_tas_enable is false\\n\");\ndrivers/net/wireless/ath/ath12k/acpi.c-214-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-216-\ndrivers/net/wireless/ath/ath12k/acpi.c:217:\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_TAS_DATA);\ndrivers/net/wireless/ath/ath12k/acpi.c-218-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:219:\t\tath12k_warn(ab, \"failed to update ACPI TAS data table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-220-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-222-\ndrivers/net/wireless/ath/ath12k/acpi.c:223:\tret = ath12k_acpi_set_power_limit(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-224-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:225:\t\tath12k_warn(ab, \"failed to set ACPI TAS power limit data: %d\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-226-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-231-\ndrivers/net/wireless/ath/ath12k/acpi.c:232:\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_BIOS_SAR);\ndrivers/net/wireless/ath/ath12k/acpi.c-233-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:234:\t\tath12k_warn(ab, \"failed to update BIOS SAR: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-235-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-237-\ndrivers/net/wireless/ath/ath12k/acpi.c:238:\tret = ath12k_acpi_set_bios_sar_power(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-239-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:240:\t\tath12k_warn(ab, \"failed to set BIOS SAR power limit: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-241-\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-244-\ndrivers/net/wireless/ath/ath12k/acpi.c:245:static int ath12k_acpi_set_bios_sar_params(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-246-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-248-\ndrivers/net/wireless/ath/ath12k/acpi.c:249:\tret = ath12k_wmi_set_bios_sar_cmd(ab, ab-\u003eacpi.bios_sar_data);\ndrivers/net/wireless/ath/ath12k/acpi.c-250-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:251:\t\tath12k_warn(ab, \"failed to set ACPI BIOS SAR table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-252-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-254-\ndrivers/net/wireless/ath/ath12k/acpi.c:255:\tret = ath12k_wmi_set_bios_geo_cmd(ab, ab-\u003eacpi.geo_offset_data);\ndrivers/net/wireless/ath/ath12k/acpi.c-256-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:257:\t\tath12k_warn(ab, \"failed to set ACPI BIOS GEO table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-258-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-263-\ndrivers/net/wireless/ath/ath12k/acpi.c:264:static int ath12k_acpi_set_tas_params(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-265-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-267-\ndrivers/net/wireless/ath/ath12k/acpi.c:268:\tret = ath12k_wmi_set_bios_cmd(ab, WMI_BIOS_PARAM_TAS_CONFIG_TYPE,\ndrivers/net/wireless/ath/ath12k/acpi.c-269-\t\t\t\t      ab-\u003eacpi.tas_cfg,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-271-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:272:\t\tath12k_warn(ab, \"failed to send ACPI TAS config table parameter: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-273-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-276-\ndrivers/net/wireless/ath/ath12k/acpi.c:277:\tret = ath12k_wmi_set_bios_cmd(ab, WMI_BIOS_PARAM_TAS_DATA_TYPE,\ndrivers/net/wireless/ath/ath12k/acpi.c-278-\t\t\t\t      ab-\u003eacpi.tas_sar_power_table,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-280-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:281:\t\tath12k_warn(ab, \"failed to send ACPI TAS data table parameter: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-282-\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-288-\ndrivers/net/wireless/ath/ath12k/acpi.c:289:bool ath12k_acpi_get_disable_rfkill(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-290-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-293-\ndrivers/net/wireless/ath/ath12k/acpi.c:294:bool ath12k_acpi_get_disable_11be(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-295-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-298-\ndrivers/net/wireless/ath/ath12k/acpi.c:299:void ath12k_acpi_set_dsm_func(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-300-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-308-\tif (ab-\u003eacpi.acpi_tas_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:309:\t\tret = ath12k_acpi_set_tas_params(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-310-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:311:\t\t\tath12k_warn(ab, \"failed to send ACPI TAS parameters: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-312-\t\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-316-\tif (ab-\u003eacpi.acpi_bios_sar_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:317:\t\tret = ath12k_acpi_set_bios_sar_params(ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-318-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:319:\t\t\tath12k_warn(ab, \"failed to send ACPI BIOS SAR: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-320-\t\t\treturn;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-325-\t\tbuf = ab-\u003eacpi.cca_data + ATH12K_ACPI_CCA_THR_OFFSET_DATA_OFFSET;\ndrivers/net/wireless/ath/ath12k/acpi.c:326:\t\tret = ath12k_wmi_set_bios_cmd(ab,\ndrivers/net/wireless/ath/ath12k/acpi.c-327-\t\t\t\t\t      WMI_BIOS_PARAM_CCA_THRESHOLD_TYPE,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-330-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:331:\t\t\tath12k_warn(ab, \"failed to set ACPI DSM CCA threshold: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-332-\t\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-337-\tif (ab-\u003eacpi.acpi_band_edge_enable) {\ndrivers/net/wireless/ath/ath12k/acpi.c:338:\t\tret = ath12k_wmi_set_bios_cmd(ab,\ndrivers/net/wireless/ath/ath12k/acpi.c-339-\t\t\t\t\t      WMI_BIOS_PARAM_TYPE_BANDEDGE,\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-342-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:343:\t\t\tath12k_warn(ab,\ndrivers/net/wireless/ath/ath12k/acpi.c-344-\t\t\t\t    \"failed to set ACPI DSM band edge channel power: %d\\n\",\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-350-\ndrivers/net/wireless/ath/ath12k/acpi.c:351:int ath12k_acpi_start(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-352-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-368-\ndrivers/net/wireless/ath/ath12k/acpi.c:369:\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_SUPPORT_FUNCS);\ndrivers/net/wireless/ath/ath12k/acpi.c-370-\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:371:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT, \"failed to get ACPI DSM data: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-372-\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-375-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_DISABLE_FLAG)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:376:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_DISABLE_FLAG);\ndrivers/net/wireless/ath/ath12k/acpi.c-377-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:378:\t\t\tath12k_warn(ab, \"failed to get ACPI DISABLE FLAG: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-379-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-391-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_BDF_EXT)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:392:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_BDF_EXT);\ndrivers/net/wireless/ath/ath12k/acpi.c-393-\t\tif (ret || ab-\u003eacpi.bdf_string[0] == '\\0') {\ndrivers/net/wireless/ath/ath12k/acpi.c:394:\t\t\tath12k_warn(ab, \"failed to get ACPI BDF EXT: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-395-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-401-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_TAS_CFG)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:402:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_TAS_CFG);\ndrivers/net/wireless/ath/ath12k/acpi.c-403-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:404:\t\t\tath12k_warn(ab, \"failed to get ACPI TAS config table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-405-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-409-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_TAS_DATA)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:410:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_TAS_DATA);\ndrivers/net/wireless/ath/ath12k/acpi.c-411-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:412:\t\t\tath12k_warn(ab, \"failed to get ACPI TAS data table: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-413-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-422-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_BIOS_SAR)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:423:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_BIOS_SAR);\ndrivers/net/wireless/ath/ath12k/acpi.c-424-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:425:\t\t\tath12k_warn(ab, \"failed to get ACPI bios sar data: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-426-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-430-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_GEO_OFFSET)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:431:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_GEO_OFFSET);\ndrivers/net/wireless/ath/ath12k/acpi.c-432-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:433:\t\t\tath12k_warn(ab, \"failed to get ACPI geo offset data: %d\\n\", ret);\ndrivers/net/wireless/ath/ath12k/acpi.c-434-\t\t\treturn ret;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-444-\tif (ATH12K_ACPI_FUNC_BIT_VALID(ab-\u003eacpi, ATH12K_ACPI_FUNC_BIT_CCA)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:445:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_INDEX_CCA);\ndrivers/net/wireless/ath/ath12k/acpi.c-446-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:447:\t\t\tath12k_warn(ab, \"failed to get ACPI DSM CCA threshold configuration: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-448-\t\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-459-\t\t\t\t       ATH12K_ACPI_FUNC_BIT_BAND_EDGE_CHAN_POWER)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:460:\t\tret = ath12k_acpi_dsm_get_data(ab, ATH12K_ACPI_DSM_FUNC_INDEX_BAND_EDGE);\ndrivers/net/wireless/ath/ath12k/acpi.c-461-\t\tif (ret) {\ndrivers/net/wireless/ath/ath12k/acpi.c:462:\t\t\tath12k_warn(ab, \"failed to get ACPI DSM band edge channel power: %d\\n\",\ndrivers/net/wireless/ath/ath12k/acpi.c-463-\t\t\t\t    ret);\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-473-\t\t\t\t\t     ACPI_DEVICE_NOTIFY,\ndrivers/net/wireless/ath/ath12k/acpi.c:474:\t\t\t\t\t     ath12k_acpi_dsm_notify, ab);\ndrivers/net/wireless/ath/ath12k/acpi.c-475-\tif (ACPI_FAILURE(status)) {\ndrivers/net/wireless/ath/ath12k/acpi.c:476:\t\tath12k_warn(ab, \"failed to install DSM notify callback: %d\\n\", status);\ndrivers/net/wireless/ath/ath12k/acpi.c-477-\t\treturn -EIO;\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-484-\ndrivers/net/wireless/ath/ath12k/acpi.c:485:int ath12k_acpi_check_bdf_variant_name(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-486-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-492-\tif (strscpy(ab-\u003eqmi.target.bdf_ext, ab-\u003eacpi.bdf_string + 4, max_len) \u003c 0)\ndrivers/net/wireless/ath/ath12k/acpi.c:493:\t\tath12k_dbg(ab, ATH12K_DBG_BOOT,\ndrivers/net/wireless/ath/ath12k/acpi.c-494-\t\t\t   \"acpi bdf variant longer than the buffer (variant: %s)\\n\",\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-499-\ndrivers/net/wireless/ath/ath12k/acpi.c:500:void ath12k_acpi_stop(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.c-501-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.c-506-\t\t\t\t   ACPI_DEVICE_NOTIFY,\ndrivers/net/wireless/ath/ath12k/acpi.c:507:\t\t\t\t   ath12k_acpi_dsm_notify);\ndrivers/net/wireless/ath/ath12k/acpi.c-508-\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-74-\ndrivers/net/wireless/ath/ath12k/acpi.h:75:int ath12k_acpi_start(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:76:void ath12k_acpi_stop(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:77:bool ath12k_acpi_get_disable_rfkill(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:78:bool ath12k_acpi_get_disable_11be(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:79:void ath12k_acpi_set_dsm_func(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h:80:int ath12k_acpi_check_bdf_variant_name(struct ath12k_base *ab);\ndrivers/net/wireless/ath/ath12k/acpi.h-81-\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-83-\ndrivers/net/wireless/ath/ath12k/acpi.h:84:static inline int ath12k_acpi_start(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-85-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-88-\ndrivers/net/wireless/ath/ath12k/acpi.h:89:static inline void ath12k_acpi_stop(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-90-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-92-\ndrivers/net/wireless/ath/ath12k/acpi.h:93:static inline bool ath12k_acpi_get_disable_rfkill(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-94-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-97-\ndrivers/net/wireless/ath/ath12k/acpi.h:98:static inline bool ath12k_acpi_get_disable_11be(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-99-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-102-\ndrivers/net/wireless/ath/ath12k/acpi.h:103:static inline void ath12k_acpi_set_dsm_func(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-104-{\n--\ndrivers/net/wireless/ath/ath12k/acpi.h-106-\ndrivers/net/wireless/ath/ath12k/acpi.h:107:static inline int ath12k_acpi_check_bdf_variant_name(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/acpi.h-108-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-22-\ndrivers/net/wireless/ath/ath12k/ahb.c:23:static struct ath12k_ahb_driver *ath12k_ahb_family_drivers[ATH12K_DEVICE_FAMILY_MAX];\ndrivers/net/wireless/ath/ath12k/ahb.c:24:static const char ath12k_userpd_irq[][9] = {\"spawn\",\ndrivers/net/wireless/ath/ath12k/ahb.c-25-\t\t\t\t     \"ready\",\n--\ndrivers/net/wireless/ath/ath12k/ahb.c=84=enum ext_irq_num {\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-123-\ndrivers/net/wireless/ath/ath12k/ahb.c:124:static u32 ath12k_ahb_read32(struct ath12k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath12k/ahb.c-125-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-130-\ndrivers/net/wireless/ath/ath12k/ahb.c:131:static void ath12k_ahb_write32(struct ath12k_base *ab, u32 offset,\ndrivers/net/wireless/ath/ath12k/ahb.c-132-\t\t\t       u32 value)\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-139-\ndrivers/net/wireless/ath/ath12k/ahb.c:140:static void ath12k_ahb_cancel_workqueue(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-141-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-144-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:145:\t\tstruct ath12k_ce_pipe *ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath12k/ahb.c-146-\ndrivers/net/wireless/ath/ath12k/ahb.c:147:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-148-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-153-\ndrivers/net/wireless/ath/ath12k/ahb.c:154:static void ath12k_ahb_ext_grp_disable(struct ath12k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath12k/ahb.c-155-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-161-\ndrivers/net/wireless/ath/ath12k/ahb.c:162:static void __ath12k_ahb_ext_irq_disable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-163-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-166-\tfor (i = 0; i \u003c ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:167:\t\tstruct ath12k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath12k/ahb.c-168-\ndrivers/net/wireless/ath/ath12k/ahb.c:169:\t\tath12k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath12k/ahb.c-170-\t\tif (irq_grp-\u003enapi_enabled) {\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-177-\ndrivers/net/wireless/ath/ath12k/ahb.c:178:static void ath12k_ahb_ext_grp_enable(struct ath12k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath12k/ahb.c-179-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-185-\ndrivers/net/wireless/ath/ath12k/ahb.c:186:static void ath12k_ahb_setbit32(struct ath12k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath12k/ahb.c-187-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-189-\ndrivers/net/wireless/ath/ath12k/ahb.c:190:\tval = ath12k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath12k/ahb.c:191:\tath12k_ahb_write32(ab, offset, val | BIT(bit));\ndrivers/net/wireless/ath/ath12k/ahb.c-192-}\ndrivers/net/wireless/ath/ath12k/ahb.c-193-\ndrivers/net/wireless/ath/ath12k/ahb.c:194:static void ath12k_ahb_clearbit32(struct ath12k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath12k/ahb.c-195-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-197-\ndrivers/net/wireless/ath/ath12k/ahb.c:198:\tval = ath12k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath12k/ahb.c:199:\tath12k_ahb_write32(ab, offset, val \u0026 ~BIT(bit));\ndrivers/net/wireless/ath/ath12k/ahb.c-200-}\ndrivers/net/wireless/ath/ath12k/ahb.c-201-\ndrivers/net/wireless/ath/ath12k/ahb.c:202:static void ath12k_ahb_ce_irq_enable(struct ath12k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath12k/ahb.c-203-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-213-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath12k/ahb.c:214:\t\tath12k_ahb_setbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c-215-\ndrivers/net/wireless/ath/ath12k/ahb.c-216-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath12k/ahb.c:217:\t\tath12k_ahb_setbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c:218:\t\tath12k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath12k/ahb.c-219-\t\t\t\t    ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-222-\ndrivers/net/wireless/ath/ath12k/ahb.c:223:static void ath12k_ahb_ce_irq_disable(struct ath12k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath12k/ahb.c-224-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-234-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath12k/ahb.c:235:\t\tath12k_ahb_clearbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c-236-\ndrivers/net/wireless/ath/ath12k/ahb.c-237-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath12k/ahb.c:238:\t\tath12k_ahb_clearbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath12k/ahb.c:239:\t\tath12k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath12k/ahb.c-240-\t\t\t\t      ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-243-\ndrivers/net/wireless/ath/ath12k/ahb.c:244:static void ath12k_ahb_sync_ce_irqs(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-245-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-249-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:250:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-251-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-257-\ndrivers/net/wireless/ath/ath12k/ahb.c:258:static void ath12k_ahb_sync_ext_irqs(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-259-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-263-\tfor (i = 0; i \u003c ATH12K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:264:\t\tstruct ath12k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath12k/ahb.c-265-\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-272-\ndrivers/net/wireless/ath/ath12k/ahb.c:273:static void ath12k_ahb_ce_irqs_enable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-274-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-277-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:278:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-279-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath12k/ahb.c:280:\t\tath12k_ahb_ce_irq_enable(ab, i);\ndrivers/net/wireless/ath/ath12k/ahb.c-281-\t}\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-283-\ndrivers/net/wireless/ath/ath12k/ahb.c:284:static void ath12k_ahb_ce_irqs_disable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-285-{\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-288-\tfor (i = 0; i \u003c ab-\u003ehw_params-\u003ece_count; i++) {\ndrivers/net/wireless/ath/ath12k/ahb.c:289:\t\tif (ath12k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath12k/ahb.c-290-\t\t\tcontinue;\ndrivers/net/wireless/ath/ath12k/ahb.c:291:\t\tath12k_ahb_ce_irq_disable(ab, i);\ndrivers/net/wireless/ath/ath12k/ahb.c-292-\t}\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-294-\ndrivers/net/wireless/ath/ath12k/ahb.c:295:static int ath12k_ahb_start(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-296-{\ndrivers/net/wireless/ath/ath12k/ahb.c:297:\tath12k_ahb_ce_irqs_enable(ab);\ndrivers/net/wireless/ath/ath12k/ahb.c:298:\tath12k_ce_rx_post_buf(ab);\ndrivers/net/wireless/ath/ath12k/ahb.c-299-\n--\ndrivers/net/wireless/ath/ath12k/ahb.c-302-\ndrivers/net/wireless/ath/ath12k/ahb.c:303:static void ath12k_ahb_ext_irq_enable(struct ath12k_base *ab)\ndrivers/net/wireless/ath/ath12k/ahb.c-304-{\ndrivers/net/wireless/ath/ath12k/ahb.c:305:\tstruct ath12k_ext_irq_grp *irq_grp;\ndrivers/net/wireless/ath/ath12k/ahb.c-306-\tint i;\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 39981
							output: 41
							thoughts: 338
						

**WorthFuzzing=false: A Quick Decision**

Okay, let's break this down. Syzbot flagged a patch related to `ath12k/mac.c`, but it's fuzzing `mac80211` using `mac80211_hwsim`. My initial thought is, did syzbot actually *run* the patch, or just compile it? That "applied patch under review" message is generic; it doesn't confirm fuzzing.

The instructions clearly state that a patch is not worth fuzzing if it touches "Code paths that are impossible to reach in virtualized environments." Now, `ath12k` is a hardware-specific driver, specifically for Qualcomm Wi-Fi 7 devices. It's PCI/AHB. There's no kernel emulation for this thing in QEMU or any standard virtualization setup.

So, logically, it's *impossible* to reach this code in a virtualized environment. Therefore, I need to flag this patch as `WorthFuzzing=false`.

Just to be absolutely sure, I'll quickly double-check for any `ath12k` emulation code in the `mac80211_hwsim` area – just a quick search for `ath12k` in `drivers/net/wireless/mac80211_hwsim.c` or similar to confirm. But, I am pretty sure that I am correct, so I can return `WorthFuzzing=false`.

no matches

{
  "Expression": "ath12k",
  "PathPrefix": "drivers/net/wireless/mac80211_hwsim.c"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 40698
							output: 92
							thoughts: 182
						

**WorthFuzzing=False: No Virtual Path for ath12k**

Okay, so I've been looking at this patch and I've come to a pretty definitive conclusion. The changes are all centered around the `ath12k` driver, and as far as I can tell, that's a *hardware* driver. It's designed for Qualcomm Wi-Fi 7 devices, specifically PCI or AHB configurations.

My immediate thought was to check for any kind of virtualized equivalent – maybe something in `mac80211_hwsim.c`, or perhaps tucked away in the self-tests under `tools/testing/selftests/net/` or `tools/testing/selftests/drivers/net/wireless/`. But, after digging around, it's clear: there's *no* virtual driver for `ath12k`.

That means, given my understanding of the kernel and virtualization, there's absolutely no way to reach these code paths in a QEMU environment or anything similar. The fuzzing wouldn't even *touch* the modified code. Therefore, for the purposes of effective fuzzing, I'm going to set `WorthFuzzing=false`. Time to call set-results.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath12k driver, which is a hardware-specific driver for Qualcomm Wi-Fi 7 devices (PCI/AHB). There is no software emulation for this hardware in QEMU or the kernel, making the code paths impossible to reach and fuzz in virtualized environments.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the ath12k driver, which is a hardware-specific driver for Qualcomm Wi-Fi 7 devices (PCI/AHB). There is no software emulation for this hardware in QEMU or the kernel, making the code paths impossible to reach and fuzz in virtualized environments.",
  "WorthFuzzing": false
}