| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/10/19 01:59 | flow | patch-triage |
1mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The changes modify error handling in `mt7996_run()` and `mt7996_add_interface()` within the MediaTek MT7996 wireless driver (`drivers/net/wireless/mediatek/mt76/mt7996/`). This driver is exclusively a PCIe driver requiring physical MediaTek MT7996/MT7992/MT7990 hardware that is not emulated in standard QEMU or virtualized test environments. Consequently, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/10/19 01:59 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 8e915cc807af94cbdb4da19bc12ce469c1cbc436\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Mon Oct 19 01:59:26 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c\nindex dd7a01c02a7ca..1cea0515a413d 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c\n@@ -24,15 +24,15 @@ int mt7996_run(struct mt7996_phy *phy)\n \n \tret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_RX_PATH);\n \tif (ret)\n-\t\treturn ret;\n+\t\tgoto disable_radio;\n \n \tret = mt7996_mcu_set_thermal_throttling(phy, MT7996_THERMAL_THROTTLE_MAX);\n \tif (ret)\n-\t\treturn ret;\n+\t\tgoto disable_radio;\n \n \tret = mt7996_mcu_set_thermal_protect(phy, true);\n \tif (ret)\n-\t\treturn ret;\n+\t\tgoto disable_radio;\n \n \tset_bit(MT76_STATE_RUNNING, \u0026phy-\u003emt76-\u003estate);\n \n@@ -45,6 +45,11 @@ int mt7996_run(struct mt7996_phy *phy)\n \t}\n \n \treturn 0;\n+\n+disable_radio:\n+\tmt7996_mcu_set_radio_en(phy, false);\n+\n+\treturn ret;\n }\n \n static int mt7996_start(struct ieee80211_hw *hw)\n@@ -558,6 +563,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,\n \tstruct mt7996_vif *mvif = (struct mt7996_vif *)vif-\u003edrv_priv;\n \tstruct wireless_dev *wdev = ieee80211_vif_to_wdev(vif);\n \tstruct mt7996_dev *dev = mt7996_hw_dev(hw);\n+\tunsigned long started = 0;\n \tint i, err = 0;\n \n \tmutex_lock(\u0026dev-\u003emt76.mutex);\n@@ -572,6 +578,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,\n \t\terr = mt7996_run(phy);\n \t\tif (err)\n \t\t\tgoto out;\n+\t\tset_bit(i, \u0026started);\n \n \t\tif (vif-\u003etype == NL80211_IFTYPE_MONITOR)\n \t\t\tmt7996_set_monitor(phy, true);\n@@ -584,6 +591,19 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,\n \n out:\n \tmutex_unlock(\u0026dev-\u003emt76.mutex);\n+\tif (err) {\n+\t\tfor_each_set_bit(i, \u0026started, MT7996_MAX_RADIOS) {\n+\t\t\tstruct mt7996_phy *phy = dev-\u003eradio_phy[i];\n+\n+\t\t\tif (vif-\u003etype == NL80211_IFTYPE_MONITOR) {\n+\t\t\t\tmutex_lock(\u0026dev-\u003emt76.mutex);\n+\t\t\t\tmt7996_set_monitor(phy, false);\n+\t\t\t\tmutex_unlock(\u0026dev-\u003emt76.mutex);\n+\t\t\t}\n+\n+\t\t\tmt7996_stop_phy(phy);\n+\t\t}\n+\t}\n \n \treturn err;\n }\n"
} |
| 2/1 | 2026/10/19 01:59 | agent | patch-evaluator |
1mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The changes modify error handling in `mt7996_run()` and `mt7996_add_interface()` within the MediaTek MT7996 wireless driver (`drivers/net/wireless/mediatek/mt76/mt7996/`). This driver is exclusively a PCIe driver requiring physical MediaTek MT7996/MT7992/MT7990 hardware that is not emulated in standard QEMU or virtualized test environments. Consequently, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 8e915cc807af94cbdb4da19bc12ce469c1cbc436
Author: syz-cluster <triage@syzkaller.com>
Date: Mon Oct 19 01:59:26 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index dd7a01c02a7ca..1cea0515a413d 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -24,15 +24,15 @@ int mt7996_run(struct mt7996_phy *phy)
ret = mt7996_mcu_set_chan_info(phy, UNI_CHANNEL_RX_PATH);
if (ret)
- return ret;
+ goto disable_radio;
ret = mt7996_mcu_set_thermal_throttling(phy, MT7996_THERMAL_THROTTLE_MAX);
if (ret)
- return ret;
+ goto disable_radio;
ret = mt7996_mcu_set_thermal_protect(phy, true);
if (ret)
- return ret;
+ goto disable_radio;
set_bit(MT76_STATE_RUNNING, &phy->mt76->state);
@@ -45,6 +45,11 @@ int mt7996_run(struct mt7996_phy *phy)
}
return 0;
+
+disable_radio:
+ mt7996_mcu_set_radio_en(phy, false);
+
+ return ret;
}
static int mt7996_start(struct ieee80211_hw *hw)
@@ -558,6 +563,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
struct wireless_dev *wdev = ieee80211_vif_to_wdev(vif);
struct mt7996_dev *dev = mt7996_hw_dev(hw);
+ unsigned long started = 0;
int i, err = 0;
mutex_lock(&dev->mt76.mutex);
@@ -572,6 +578,7 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
err = mt7996_run(phy);
if (err)
goto out;
+ set_bit(i, &started);
if (vif->type == NL80211_IFTYPE_MONITOR)
mt7996_set_monitor(phy, true);
@@ -584,6 +591,19 @@ static int mt7996_add_interface(struct ieee80211_hw *hw,
out:
mutex_unlock(&dev->mt76.mutex);
+ if (err) {
+ for_each_set_bit(i, &started, MT7996_MAX_RADIOS) {
+ struct mt7996_phy *phy = dev->radio_phy[i];
+
+ if (vif->type == NL80211_IFTYPE_MONITOR) {
+ mutex_lock(&dev->mt76.mutex);
+ mt7996_set_monitor(phy, false);
+ mutex_unlock(&dev->mt76.mutex);
+ }
+
+ mt7996_stop_phy(phy);
+ }
+ }
return err;
}
|
| 3/2 | 2026/10/19 01:59 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 3791 output: 39 thoughts: 124 Thoughts: **Analyzing the `mt7996` Wireless Driver Patch** Okay, so I need to evaluate this patch applied to `drivers/net/wireless/mediatek/mt76/mt7996/main.c`. My first thought is to understand the scope of the change. Let's quickly establish the fundamentals. This is clearly a `mt7996` driver, located within the Mediatek wireless family, specifically in the `mt76` sub-directory. Next, I need to understand the hardware. Is this a PCI, USB, or perhaps an SoC integrated solution? Knowing the interface is crucial for understanding potential power-related or initialization dependencies. My next step is to consider the practicality of testing. Can I easily get this running in a QEMU environment, or any other standard virtualization setup? Being able to quickly reproduce and debug is paramount for a proper evaluation. Finally, before diving into the code, I'll examine the supporting infrastructure. I need to review the `Kconfig` and `Makefile` for `mt7996` to understand any build-time configurations or dependencies and ensure I have a complete understanding of how it's integrated into the kernel build process. This will give me a solid foundation for a thorough analysis. |
| 4/2 | 2026/10/19 01:59 | tool | grepper |
0mArgs:{
"Expression": "MT7996",
"PathPrefixes": [
"drivers/net/wireless/mediatek/mt76/"
]
}Results: {
"Output": "\nFull output is too long, showing 200 out of 1586 lines.\nUse more precise expression or PathPrefixes if possible.\n\nNumber of matching lines per file (18 files in total):\ndrivers/net/wireless/mediatek/mt76/Makefile:1\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:6\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:2\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:2\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:73\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:27\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.h:2\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:49\ndrivers/net/wireless/mediatek/mt76/mt7996/mac.c:22\ndrivers/net/wireless/mediatek/mt76/mt7996/mac.h:2\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c:22\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c:82\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.h:21\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:27\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:130\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:14\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c:8\ndrivers/net/wireless/mediatek/mt76/mt7996/regs.h:2\n\ndrivers/net/wireless/mediatek/mt76/Makefile=50=obj-$(CONFIG_MT7921_COMMON) += mt7921/\ndrivers/net/wireless/mediatek/mt76/Makefile:51:obj-$(CONFIG_MT7996E) += mt7996/\ndrivers/net/wireless/mediatek/mt76/Makefile-52-obj-$(CONFIG_MT7925_COMMON) += mt7925/\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:2:config MT7996E\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:3:\ttristate \"MediaTek MT7996 (PCIe) support\"\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-4-\tselect MT76_CONNAC_LIB\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-9-\thelp\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:10:\t This adds support for MT7996-based PCIe wireless devices,\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-11-\t which support concurrent tri-band operation at 6GHz, 5GHz,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-15-\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:16:config MT7996_NPU\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:17:\tbool \"MT7996 (PCIe) NPU support\"\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig:18:\tdepends on MT7996E\ndrivers/net/wireless/mediatek/mt76/mt7996/Kconfig-19-\tdepends on NET_AIROHA_NPU=y || MT76_CORE=NET_AIROHA_NPU\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:3:obj-$(CONFIG_MT7996E) += mt7996e.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-4-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile=5=mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \\\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-7-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:8:mt7996e-$(CONFIG_MT7996_NPU) += npu.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-9-mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=48=mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-50-\tswitch (mt76_chip(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:51:\tcase MT7996_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:52:\tcase MT7996_DEVICE_ID_2:\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-53-\t\t*num = ARRAY_SIZE(mt7996_mem_regions);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c=46=static void mt7996_dma_config(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-59-\t/* rx queue */\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:60:\tRXQ_CONFIG(MT_RXQ_MCU, WFDMA0, MT_INT_RX_DONE_WM, MT7996_RXQ_MCU_WM);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-61-\t/* for mt7990, RX ring 1 is for SDO instead */\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:62:\tRXQ_CONFIG(MT_RXQ_MCU_WA, WFDMA0, MT_INT_RX_DONE_WA, MT7996_RXQ_MCU_WA);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:63:\tRXQ_CONFIG(MT_RXQ_MAIN, WFDMA0, MT_INT_RX_DONE_BAND0, MT7996_RXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-64-\tif (mt7996_has_wa(dev))\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-65-\t\tRXQ_CONFIG(MT_RXQ_MAIN_WA, WFDMA0, MT_INT_RX_DONE_WA_MAIN,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:66:\t\t\t MT7996_RXQ_MCU_WA_MAIN);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-67-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-69-\tcase MT7992_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:70:\t\tRXQ_CONFIG(MT_RXQ_BAND1_WA, WFDMA0, MT_INT_RX_DONE_WA_EXT, MT7996_RXQ_MCU_WA_EXT);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:71:\t\tRXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_RX_DONE_BAND1, MT7996_RXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-72-\t\tbreak;\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-73-\tcase MT7990_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:74:\t\tRXQ_CONFIG(MT_RXQ_BAND1, WFDMA0, MT_INT_RX_DONE_BAND1, MT7996_RXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-75-\t\tRXQ_CONFIG(MT_RXQ_TXFREE_BAND0, WFDMA0,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-80-\t\tbreak;\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:81:\tcase MT7996_DEVICE_ID:\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-82-\tdefault:\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-83-\t\t/* mt7996 band2 */\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:84:\t\tRXQ_CONFIG(MT_RXQ_BAND2_WA, WFDMA0, MT_INT_RX_DONE_WA_TRI, MT7996_RXQ_MCU_WA_TRI);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:85:\t\tRXQ_CONFIG(MT_RXQ_BAND2, WFDMA0, MT_INT_RX_DONE_BAND2, MT7996_RXQ_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-86-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-91-\t\tRXQ_CONFIG(MT_RXQ_RRO_BAND0, WFDMA0, MT_INT_RX_DONE_RRO_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:92:\t\t\t MT7996_RXQ_RRO_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-93-\t\tif (dev-\u003emt76.hwrro_mode == MT76_HWRRO_V3)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-95-\t\t\t\t MT_INT_RX_DONE_MSDU_PG_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:96:\t\t\t\t MT7996_RXQ_MSDU_PG_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-97-\t\tif (is_mt7996(\u0026dev-\u003emt76)) {\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-98-\t\t\tRXQ_CONFIG(MT_RXQ_TXFREE_BAND0, WFDMA0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:99:\t\t\t\t MT_INT_RX_TXFREE_MAIN, MT7996_RXQ_TXFREE0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-100-\t\t\t/* band1 */\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-102-\t\t\t\t MT_INT_RX_DONE_MSDU_PG_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:103:\t\t\t\t MT7996_RXQ_MSDU_PG_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-104-\t\t\t/* band2 */\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-106-\t\t\t\t MT_INT_RX_DONE_RRO_BAND2,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:107:\t\t\t\t MT7996_RXQ_RRO_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-108-\t\t\tRXQ_CONFIG(MT_RXQ_MSDU_PAGE_BAND2, WFDMA0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-109-\t\t\t\t MT_INT_RX_DONE_MSDU_PG_BAND2,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:110:\t\t\t\t MT7996_RXQ_MSDU_PG_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-111-\t\t\tRXQ_CONFIG(MT_RXQ_TXFREE_BAND2, WFDMA0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:112:\t\t\t\t MT_INT_RX_TXFREE_TRI, MT7996_RXQ_TXFREE2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-113-\t\t} else {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-115-\t\t\t\t MT_INT_RX_DONE_RRO_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:116:\t\t\t\t MT7996_RXQ_RRO_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-117-\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-121-\t\t\t\t MT_INT_RX_DONE_RRO_IND,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:122:\t\t\t\t MT7996_RXQ_RRO_IND);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-123-\t\telse\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-125-\t\t\t\t MT_INT_RX_DONE_RRO_RXDMAD_C,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:126:\t\t\t\t MT7996_RXQ_RRO_RXDMAD_C);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-127-\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-133-\t\t\t\tTXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND2,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:134:\t\t\t\t\t MT7996_TXQ_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-135-\t\t\t\tTXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:136:\t\t\t\t\t MT7996_TXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-137-\t\t\t\tTXQ_CONFIG(2, WFDMA0, MT_INT_TX_DONE_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:138:\t\t\t\t\t MT7996_TXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-139-\t\t\t} else {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-141-\t\t\t\tTXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:142:\t\t\t\t\t MT7996_TXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-143-\t\t\t\tTXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:144:\t\t\t\t\t MT7996_TXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-145-\t\t\t\tTXQ_CONFIG(2, WFDMA0, MT_INT_TX_DONE_BAND2,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:146:\t\t\t\t\t MT7996_TXQ_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-147-\t\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-150-\t\t\tTXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:151:\t\t\t\t MT7996_TXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-152-\t\t\tTXQ_CONFIG(2, WFDMA0, MT_INT_TX_DONE_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:153:\t\t\t\t MT7996_TXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-154-\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-158-\t\t\tTXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:159:\t\t\t\t MT7996_TXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-160-\t\t\tTXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND2,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:161:\t\t\t\t MT7996_TXQ_BAND2);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-162-\t\t} else {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-164-\t\t\tTXQ_CONFIG(0, WFDMA0, MT_INT_TX_DONE_BAND0,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:165:\t\t\t\t MT7996_TXQ_BAND0);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-166-\t\t\tTXQ_CONFIG(1, WFDMA0, MT_INT_TX_DONE_BAND1,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:167:\t\t\t\t MT7996_TXQ_BAND1);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-168-\t\t}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-171-\t/* mcu tx queue */\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:172:\tMCUQ_CONFIG(MT_MCUQ_FWDL, WFDMA0, MT_INT_TX_DONE_FWDL, MT7996_TXQ_FWDL);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:173:\tMCUQ_CONFIG(MT_MCUQ_WM, WFDMA0, MT_INT_TX_DONE_MCU_WM, MT7996_TXQ_MCU_WM);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-174-\tif (mt7996_has_wa(dev))\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-175-\t\tMCUQ_CONFIG(MT_MCUQ_WA, WFDMA0, MT_INT_TX_DONE_MCU_WA,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:176:\t\t\t MT7996_TXQ_MCU_WA);\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-177-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c=521=int mt7996_dma_rro_init(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-535-\t\t\t\t MT_RXQ_ID(MT_RXQ_RRO_RXDMAD_C),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:536:\t\t\t\t MT7996_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:537:\t\t\t\t MT7996_RX_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-538-\t\t\t\t MT_RXQ_RRO_AP_RING_BASE);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-561-\t\t\t MT_RXQ_ID(MT_RXQ_RRO_IND),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:562:\t\t\t MT7996_RX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-563-\t\t\t 0, MT_RXQ_RRO_IND_RING_BASE);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-574-\tsize = is_mt7996(mdev) \u0026\u0026 mt76_npu_device_active(mdev)\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:575:\t ? MT7996_NPU_RX_RING_SIZE / 4 : MT7996_RX_RING_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-576-\tret = mt76_queue_alloc(dev, \u0026mdev-\u003eq_rx[MT_RXQ_MSDU_PAGE_BAND0],\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-577-\t\t\t MT_RXQ_ID(MT_RXQ_MSDU_PAGE_BAND0),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:578:\t\t\t size, MT7996_RX_MSDU_PAGE_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-579-\t\t\t MT_RXQ_RING_BASE(MT_RXQ_MSDU_PAGE_BAND0));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-591-\t\tsize = is_mt7996(mdev) \u0026\u0026 mt76_npu_device_active(mdev)\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:592:\t\t ? MT7996_NPU_RX_RING_SIZE / 2 : MT7996_RX_RING_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-593-\t\tret = mt76_queue_alloc(dev, \u0026mdev-\u003eq_rx[MT_RXQ_MSDU_PAGE_BAND1],\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-594-\t\t\t\t MT_RXQ_ID(MT_RXQ_MSDU_PAGE_BAND1),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:595:\t\t\t\t size, MT7996_RX_MSDU_PAGE_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-596-\t\t\t\t MT_RXQ_RING_BASE(MT_RXQ_MSDU_PAGE_BAND1));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-609-\t\tsize = is_mt7996(mdev) \u0026\u0026 mt76_npu_device_active(mdev)\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:610:\t\t ? MT7996_NPU_RX_RING_SIZE : MT7996_RX_RING_SIZE;\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-611-\t\tret = mt76_queue_alloc(dev, \u0026mdev-\u003eq_rx[MT_RXQ_MSDU_PAGE_BAND2],\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-612-\t\t\t\t MT_RXQ_ID(MT_RXQ_MSDU_PAGE_BAND2),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:613:\t\t\t\t size, MT7996_RX_MSDU_PAGE_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-614-\t\t\t\t MT_RXQ_RING_BASE(MT_RXQ_MSDU_PAGE_BAND2));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c=664=int mt7996_dma_init(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-683-\t\tret = mt7996_init_tx_queues(\u0026dev-\u003ephy, MT_TXQ_ID(0),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:684:\t\t\t\t\t MT7996_NPU_TX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-685-\t\t\t\t\t MT_TXQ_RING_BASE(0) + hif1_ofs,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-689-\t\t\t\t\t MT_TXQ_ID(dev-\u003emphy.band_idx),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:690:\t\t\t\t\t MT7996_TX_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-691-\t\t\t\t\t MT_TXQ_RING_BASE(0), wed);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-697-\t\t\t\t MT_MCUQ_ID(MT_MCUQ_WM),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:698:\t\t\t\t MT7996_TX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-699-\t\t\t\t MT_MCUQ_RING_BASE(MT_MCUQ_WM));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-706-\t\t\t\t\t MT_MCUQ_ID(MT_MCUQ_WA),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:707:\t\t\t\t\t MT7996_TX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-708-\t\t\t\t\t MT_MCUQ_RING_BASE(MT_MCUQ_WA));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-715-\t\t\t\t MT_MCUQ_ID(MT_MCUQ_FWDL),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:716:\t\t\t\t MT7996_TX_FWDL_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-717-\t\t\t\t MT_MCUQ_RING_BASE(MT_MCUQ_FWDL));\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-723-\t\t\t MT_RXQ_ID(MT_RXQ_MCU),\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:724:\t\t\t MT7996_RX_MCU_RING_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:725:\t\t\t MT7996_RX_MCU_BUF_SIZE,\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c-726-\t\t\t MT_RXQ_RING_BASE(MT_RXQ_MCU));\n--\n\n"
} |
| 5/2 | 2026/10/19 01:59 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 12371 output: 36 thoughts: 67 Thoughts: Okay, let's dive into this. **Examining the MT7996 Driver** Right, my immediate thought is to zero in on `drivers/net/wireless/mediatek/mt76/mt7996/pci.c`. The core question I need to answer first is, does the MT7996 chipset architecture allow for both PCIe and USB interfaces, or is it solely a PCIe-bound device? I need to quickly establish the scope of its potential support. Knowing this will influence everything else. Then, assuming this is PCIe, or regardless, I'll need to explore that `/mt7996/` directory more broadly. Are there other files there that might offer clues about the broader feature set, perhaps USB support if it exists, or alternative configurations, or even debug options? A broader look beyond `pci.c` is going to be essential for a complete understanding. |
| 6/2 | 2026/10/19 01:59 | tool | codesearch-dir-index |
0mArgs:{
"Dir": "drivers/net/wireless/mediatek/mt76/mt7996"
}Results: {
"Files": [
"coredump.c",
"coredump.h",
"debugfs.c",
"dma.c",
"eeprom.c",
"eeprom.h",
"init.c",
"mac.c",
"mac.h",
"main.c",
"mcu.c",
"mcu.h",
"mmio.c",
"mt7996.h",
"npu.c",
"pci.c",
"regs.h"
],
"Subdirs": null
} |
| 7/2 | 2026/10/19 01:59 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 12800 output: 49 thoughts: 21 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience and presented in the first person: **Focusing on the PCI and MMIO Drivers** Alright, so the initial thought process is pretty straightforward. I'm zeroing in on a targeted area: specifically, `pci.c` and `mmio.c`. No need to get bogged down in everything else right now. The immediate next step is clear – I'm going to dive straight into `pci.c`. My primary interest lies there, and hopefully the solution, or at least a large piece of it, resides within its logic. I’m thinking about the hardware interaction and how it's handled. Let's see what we can find. |
| 8/2 | 2026/10/19 01:59 | tool | read-file |
0mArgs:{
"File": "drivers/net/wireless/mediatek/mt76/mt7996/pci.c",
"FirstLine": 1,
"LineCount": 80
}Results: {
"Contents": " 1:\t// SPDX-License-Identifier: BSD-3-Clause-Clear\n 2:\t/*\n 3:\t * Copyright (C) 2022 MediaTek Inc.\n 4:\t */\n 5:\t\n 6:\t#include \u003clinux/kernel.h\u003e\n 7:\t#include \u003clinux/module.h\u003e\n 8:\t#include \u003clinux/pci.h\u003e\n 9:\t\n 10:\t#include \"mt7996.h\"\n 11:\t#include \"mac.h\"\n 12:\t#include \"../trace.h\"\n 13:\t\n 14:\tstatic LIST_HEAD(hif_list);\n 15:\tstatic DEFINE_SPINLOCK(hif_lock);\n 16:\tstatic u32 hif_idx;\n 17:\t\n 18:\tstatic const struct pci_device_id mt7996_pci_device_table[] = {\n 19:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID) },\n 20:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID) },\n 21:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID) },\n 22:\t\t{ },\n 23:\t};\n 24:\t\n 25:\tstatic const struct pci_device_id mt7996_hif_device_table[] = {\n 26:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID_2) },\n 27:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID_2) },\n 28:\t\t{ PCI_DEVICE(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID_2) },\n 29:\t\t{ },\n 30:\t};\n 31:\t\n 32:\tstatic struct mt7996_hif *mt7996_pci_get_hif2(u32 idx)\n 33:\t{\n 34:\t\tstruct mt7996_hif *hif;\n 35:\t\tu32 val;\n 36:\t\n 37:\t\tspin_lock_bh(\u0026hif_lock);\n 38:\t\n 39:\t\tlist_for_each_entry(hif, \u0026hif_list, list) {\n 40:\t\t\tval = readl(hif-\u003eregs + MT_PCIE_RECOG_ID);\n 41:\t\t\tval \u0026= MT_PCIE_RECOG_ID_MASK;\n 42:\t\t\tif (val != idx)\n 43:\t\t\t\tcontinue;\n 44:\t\n 45:\t\t\tget_device(hif-\u003edev);\n 46:\t\t\tgoto out;\n 47:\t\t}\n 48:\t\thif = NULL;\n 49:\t\n 50:\tout:\n 51:\t\tspin_unlock_bh(\u0026hif_lock);\n 52:\t\n 53:\t\treturn hif;\n 54:\t}\n 55:\t\n 56:\tstatic void mt7996_put_hif2(struct mt7996_hif *hif)\n 57:\t{\n 58:\t\tif (!hif)\n 59:\t\t\treturn;\n 60:\t\n 61:\t\tput_device(hif-\u003edev);\n 62:\t}\n 63:\t\n 64:\tstatic struct mt7996_hif *mt7996_pci_init_hif2(struct pci_dev *pdev)\n 65:\t{\n 66:\t\thif_idx++;\n 67:\t\n 68:\t\tif (!pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7996_DEVICE_ID_2, NULL) \u0026\u0026\n 69:\t\t !pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7992_DEVICE_ID_2, NULL) \u0026\u0026\n 70:\t\t !pci_get_device(PCI_VENDOR_ID_MEDIATEK, MT7990_DEVICE_ID_2, NULL))\n 71:\t\t\treturn NULL;\n 72:\t\n 73:\t\twritel(hif_idx | MT_PCIE_RECOG_ID_SEM,\n 74:\t\t pcim_iomap_table(pdev)[0] + MT_PCIE_RECOG_ID);\n 75:\t\n 76:\t\treturn mt7996_pci_get_hif2(hif_idx);\n 77:\t}\n 78:\t\n 79:\tstatic int mt7996_pci_hif2_probe(struct pci_dev *pdev)\n 80:\t{\n"
} |
| 9/2 | 2026/10/19 01:59 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 14285 output: 30 thoughts: 300 Thoughts: **My Assessment of the MT7996 Driver** Okay, let's take a look at this `mt7996` driver. The description says it's `MediaTek MT7996 (PCIe) support`. Right, so it's a PCIe device driver, which immediately makes me think about whether it's solely tied to physical hardware or if there's any sort of virtual or software interface. I need to know if I can interact with it without having the actual card. Let me see... Section 2 might have a clue. Ah, here it is: "Structurally unreachable hardware...". This section lists things like vendor-specific PCIe switches, SmartNICs, and GPU drivers – those kinds of things that need a physical ASIC or PCIe card, and aren't emulated in standard QEMU. That list gives me a hint, so now my question is whether `mt7996` is emulated in QEMU. Wait a second... it's not! Standard QEMU doesn't emulate the MediaTek MT7996 PCIe Wi-Fi NIC. That rules out one easy avenue. Okay, next thought - could I maybe load it or fuzz it using `mac80211_hwsim` or something similar? No, `mac80211_hwsim` is a separate driver (`drivers/net/wireless/virtual/mac80211_hwsim.c`), so that's a dead end too. Alright, what about a simulated, mocked, or virtual device, perhaps via USB? I need to check to see if `mt7996` has any USB support. Where would I find that? I'll start by checking the `drivers/net/wireless/mediatek/mt76/` directory. Maybe it shares some infrastructure or has some other clues in there. Let me see what other drivers are in that `mt76` directory... |
| 10/2 | 2026/10/19 01:59 | tool | codesearch-dir-index |
0mArgs:{
"Dir": "drivers/net/wireless/mediatek/mt76"
}Results: {
"Files": [
"agg-rx.c",
"channel.c",
"debugfs.c",
"dma.c",
"dma.h",
"eeprom.c",
"mac80211.c",
"mcu.c",
"mmio.c",
"mt76.h",
"mt76_connac.h",
"mt76_connac2_mac.h",
"mt76_connac3_mac.c",
"mt76_connac3_mac.h",
"mt76_connac_mac.c",
"mt76_connac_mcu.c",
"mt76_connac_mcu.h",
"mt76x02.h",
"mt76x02_beacon.c",
"mt76x02_debugfs.c",
"mt76x02_dfs.c",
"mt76x02_dfs.h",
"mt76x02_dma.h",
"mt76x02_eeprom.c",
"mt76x02_eeprom.h",
"mt76x02_mac.c",
"mt76x02_mac.h",
"mt76x02_mcu.c",
"mt76x02_mcu.h",
"mt76x02_mmio.c",
"mt76x02_phy.c",
"mt76x02_phy.h",
"mt76x02_regs.h",
"mt76x02_trace.c",
"mt76x02_trace.h",
"mt76x02_txrx.c",
"mt76x02_usb.h",
"mt76x02_usb_core.c",
"mt76x02_usb_mcu.c",
"mt76x02_util.c",
"mt792x.h",
"mt792x_acpi_sar.c",
"mt792x_acpi_sar.h",
"mt792x_core.c",
"mt792x_debugfs.c",
"mt792x_dma.c",
"mt792x_mac.c",
"mt792x_regs.h",
"mt792x_trace.c",
"mt792x_trace.h",
"mt792x_usb.c",
"npu.c",
"pci.c",
"scan.c",
"sdio.c",
"sdio.h",
"sdio_txrx.c",
"testmode.c",
"testmode.h",
"trace.c",
"trace.h",
"tx.c",
"usb.c",
"usb_trace.c",
"usb_trace.h",
"util.c",
"util.h",
"wed.c"
],
"Subdirs": [
"mt7603",
"mt7615",
"mt76x0",
"mt76x2",
"mt7915",
"mt7921",
"mt7925",
"mt7996"
]
} |
| 11/2 | 2026/10/19 01:59 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 15846 output: 19 thoughts: 35 Thoughts: Okay, here's my thought process on that: **Investigating mt7996 Usage Outside Its Core Directory** Alright, so the task at hand is to determine if any code outside of the dedicated `drivers/net/wireless/mediatek/mt76/mt7996/` directory is referencing or interacting with the `mt7996` wireless driver. It's a fairly standard sanity check, really. The question is, does this driver have unwanted dependencies or potential conflicts with other modules, or is it properly isolated within its defined scope? I need to ascertain this to ensure code integrity and avoid accidental side effects. |
| 12/2 | 2026/10/19 01:59 | tool | grepper |
0mArgs:{
"Expression": "mt7996"
}Results: {
"Output": "\nFull output is too long, showing 200 out of 6667 lines.\nUse more precise expression or PathPrefixes if possible.\n\nNumber of matching lines per file (22 files in total):\ndrivers/net/wireless/mediatek/mt76/Kconfig:1\ndrivers/net/wireless/mediatek/mt76/Makefile:1\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:2\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:4\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:28\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:17\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:136\ndrivers/net/wireless/mediatek/mt76/mt7996/dma.c:90\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.c:37\ndrivers/net/wireless/mediatek/mt76/mt7996/eeprom.h:5\ndrivers/net/wireless/mediatek/mt76/mt7996/init.c:193\ndrivers/net/wireless/mediatek/mt76/mt7996/mac.c:289\ndrivers/net/wireless/mediatek/mt76/mt7996/mac.h:2\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c:430\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.c:491\ndrivers/net/wireless/mediatek/mt76/mt7996/mcu.h:27\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:91\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:286\ndrivers/net/wireless/mediatek/mt76/mt7996/npu.c:31\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c:39\ndrivers/net/wireless/mediatek/mt76/mt7996/regs.h:1\ndrivers/net/wireless/mediatek/mt76/npu.c:1\n\ndrivers/net/wireless/mediatek/mt76/Kconfig=49=source \"drivers/net/wireless/mediatek/mt76/mt7921/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig:50:source \"drivers/net/wireless/mediatek/mt76/mt7996/Kconfig\"\ndrivers/net/wireless/mediatek/mt76/Kconfig-51-source \"drivers/net/wireless/mediatek/mt76/mt7925/Kconfig\"\n--\ndrivers/net/wireless/mediatek/mt76/Makefile=50=obj-$(CONFIG_MT7921_COMMON) += mt7921/\ndrivers/net/wireless/mediatek/mt76/Makefile:51:obj-$(CONFIG_MT7996E) += mt7996/\ndrivers/net/wireless/mediatek/mt76/Makefile-52-obj-$(CONFIG_MT7925_COMMON) += mt7925/\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=251=static inline bool is_mt798x(struct mt76_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-255-\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:256:static inline bool is_mt7996(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-257-{\n--\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h=272=static inline bool is_mt799x(struct mt76_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-273-{\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h:274:\treturn is_mt7996(dev) || is_mt7992(dev) || is_mt7990(dev);\ndrivers/net/wireless/mediatek/mt76/mt76_connac.h-275-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:3:obj-$(CONFIG_MT7996E) += mt7996e.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-4-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:5:mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \\\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-6-\t debugfs.o mmio.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-7-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:8:mt7996e-$(CONFIG_MT7996_NPU) += npu.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:9:mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=12=MODULE_PARM_DESC(coredump_memdump, \"Optional ability to dump firmware memory\");\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-13-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:14:static const struct mt7996_mem_region mt7996_mem_regions[] = {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-15-\t{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-46-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:47:const struct mt7996_mem_region*\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:48:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-49-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-52-\tcase MT7996_DEVICE_ID_2:\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:53:\t\t*num = ARRAY_SIZE(mt7996_mem_regions);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:54:\t\treturn \u0026mt7996_mem_regions[0];\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-55-\tdefault:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-59-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:60:static int mt7996_coredump_get_mem_size(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-61-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:62:\tconst struct mt7996_mem_region *mem_region;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-63-\tsize_t size = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-66-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:67:\tmem_region = mt7996_coredump_get_mem_layout(dev, \u0026num);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-68-\tif (!mem_region)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-76-\t/* reserve space for the headers */\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:77:\tsize += num * sizeof(struct mt7996_mem_hdr);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-78-\t/* make sure it is aligned 4 bytes for debug message print out */\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-83-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:84:struct mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-85-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:86:\tstruct mt7996_crash_data *crash_data = dev-\u003ecoredump.crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-87-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=100=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:101:mt7996_coredump_fw_state(struct mt7996_dev *dev, struct mt7996_coredump *dump,\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-102-\t\t\t bool *exception)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=117=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:118:mt7996_coredump_fw_stack(struct mt7996_dev *dev, struct mt7996_coredump *dump,\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-119-\t\t\t bool exception)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-161-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:162:static struct mt7996_coredump *mt7996_coredump_build(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-163-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:164:\tstruct mt7996_crash_data *crash_data = dev-\u003ecoredump.crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:165:\tstruct mt7996_coredump *dump;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:166:\tstruct mt7996_coredump_mem *dump_mem;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-167-\tsize_t len, sofar = 0, hdr_len = sizeof(*dump);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-186-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:187:\tdump = (struct mt7996_coredump *)(buf);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-188-\tdump-\u003elen = len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-200-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:201:\tmt7996_coredump_fw_state(dev, dump, \u0026exception);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:202:\tmt7996_coredump_fw_stack(dev, dump, exception);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-203-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-204-\t/* gather memory content */\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:205:\tdump_mem = (struct mt7996_coredump_mem *)(buf + sofar);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-206-\tdump_mem-\u003elen = crash_data-\u003ememdump_buf_len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-215-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:216:int mt7996_coredump_submit(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-217-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:218:\tstruct mt7996_coredump *dump;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-219-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:220:\tdump = mt7996_coredump_build(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-221-\tif (!dump) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-230-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:231:int mt7996_coredump_register(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-232-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:233:\tstruct mt7996_crash_data *crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-234-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-241-\tif (coredump_memdump) {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:242:\t\tcrash_data-\u003ememdump_buf_len = mt7996_coredump_get_mem_size(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-243-\t\tif (!crash_data-\u003ememdump_buf_len)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-256-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:257:void mt7996_coredump_unregister(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-258-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-6-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:7:#include \"mt7996.h\"\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-8-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:9:struct mt7996_coredump {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-10-\tchar magic[16];\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-39-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:40:struct mt7996_coredump_mem {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-41-\tu32 len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-44-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:45:struct mt7996_mem_hdr {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-46-\tu32 start;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-50-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:51:struct mt7996_mem_region {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-52-\tu32 start;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-59-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:60:const struct mt7996_mem_region *\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:61:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:62:struct mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:63:int mt7996_coredump_submit(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:64:int mt7996_coredump_register(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:65:void mt7996_coredump_unregister(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-66-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-68-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:69:static inline const struct mt7996_mem_region *\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:70:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-71-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-74-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:75:static inline int mt7996_coredump_submit(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-76-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h=80=static inline struct\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:81:mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-82-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-85-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:86:static inline int mt7996_coredump_register(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-87-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-90-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:91:static inline void mt7996_coredump_unregister(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-92-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-6-#include \u003clinux/relay.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:7:#include \"mt7996.h\"\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-8-#include \"eeprom.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=23=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:24:mt7996_implicit_txbf_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-25-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:26:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-27-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-32-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:33:\treturn mt7996_mcu_set_txbf(dev, BF_HW_EN_UPDATE);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-34-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=36=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:37:mt7996_implicit_txbf_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-38-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:39:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-40-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-45-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:46:DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7996_implicit_txbf_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:47:\t\t\t mt7996_implicit_txbf_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-48-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=50=static ssize_t\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:51:mt7996_sys_recovery_set(struct file *file, const char __user *user_buf,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-52-\t\t\tsize_t count, loff_t *ppos)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-53-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:54:\tstruct mt7996_dev *dev = file-\u003eprivate_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-55-\tchar buf[16], *sep;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-91-\tcase UNI_CMD_SER_QUERY:\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:92:\t\tret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_QUERY, 0, band);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-93-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-100-\tcase UNI_CMD_SER_SET_RECOVER_L4_MDP:\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:101:\t\tret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_SET, BIT(val), band);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-102-\t\tif (ret)\n\n"
} |
| 13/2 | 2026/10/19 01:59 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 23058 output: 53 thoughts: 53 Thoughts: Here's my take on those thoughts: **Analyzing the mt7996 Driver Registration** Okay, so the `mt7996` device is showing up strictly as a PCI driver. The kernel module registration, something like `module_pci_driver(mt7996_pci_driver);`, is the giveaway. No other registration methods are readily apparent. My next step is to dive into `pci.c`, which is the logical place to start poking around. I need to understand how the PCI bus interacts with this driver and how that might be affecting its behavior. Hopefully, I can see how the PCI subsystem is handling the device discovery and resource allocation, and from there I can start to reason about any possible issues. |
| 14/2 | 2026/10/19 02:00 | tool | grepper |
0mArgs:{
"Expression": "module_pci_driver|pci_register_driver",
"PathPrefixes": [
"drivers/net/wireless/mediatek/mt76/mt7996/"
]
}Results: {
"Output": "drivers/net/wireless/mediatek/mt76/mt7996/mmio.c=885=static int __init mt7996_init(void)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-888-\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:889:\tret = pci_register_driver(\u0026mt7996_hif_driver);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-890-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-892-\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:893:\tret = pci_register_driver(\u0026mt7996_pci_driver);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-894-\tif (ret)\n"
} |
| 15/2 | 2026/10/19 02:00 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 23607 output: 51 thoughts: 93 Thoughts: Here's my thought process, as it went down: **Investigating MT7996 Driver Initialization** Okay, so I'm looking at `mmio.c` and the first thing that jumps out is the `pci_register_driver` calls. Specifically, I see `pci_register_driver(&mt7996_hif_driver);` and `pci_register_driver(&mt7996_pci_driver);`. Seems pretty standard for a PCI device. But... wait a minute. This is a Mediatek driver for the MT7996 chipset, and I know they're not *just* PCI. They often have SDIO variants, maybe even USB. I need to make sure I'm not missing something in the initialization sequence. Let's dig deeper and get the full picture. My next step is going to be to check other potential bus initialization, and I'll start with the file path I can see, `drivers/net/wireless/mediatek/mt76/mt7996/mmio.c`. Hopefully, there will be more detail there. |
| 16/2 | 2026/10/19 02:00 | tool | read-file |
0mArgs:{
"File": "drivers/net/wireless/mediatek/mt76/mt7996/mmio.c",
"FirstLine": 870,
"LineCount": 40
}Results: {
"Contents": " 870:\t\tif (ret)\n 871:\t\t\tgoto error;\n 872:\t\n 873:\t\ttasklet_setup(\u0026mdev-\u003eirq_tasklet, mt7996_irq_tasklet);\n 874:\t\n 875:\t\tmt76_wr(dev, MT_INT_MASK_CSR, 0);\n 876:\t\n 877:\t\treturn dev;\n 878:\t\n 879:\terror:\n 880:\t\tmt76_free_device(\u0026dev-\u003emt76);\n 881:\t\n 882:\t\treturn ERR_PTR(ret);\n 883:\t}\n 884:\t\n 885:\tstatic int __init mt7996_init(void)\n 886:\t{\n 887:\t\tint ret;\n 888:\t\n 889:\t\tret = pci_register_driver(\u0026mt7996_hif_driver);\n 890:\t\tif (ret)\n 891:\t\t\treturn ret;\n 892:\t\n 893:\t\tret = pci_register_driver(\u0026mt7996_pci_driver);\n 894:\t\tif (ret)\n 895:\t\t\tpci_unregister_driver(\u0026mt7996_hif_driver);\n 896:\t\n 897:\t\treturn ret;\n 898:\t}\n 899:\t\n 900:\tstatic void __exit mt7996_exit(void)\n 901:\t{\n 902:\t\tpci_unregister_driver(\u0026mt7996_pci_driver);\n 903:\t\tpci_unregister_driver(\u0026mt7996_hif_driver);\n 904:\t}\n 905:\t\n 906:\tmodule_init(mt7996_init);\n 907:\tmodule_exit(mt7996_exit);\n 908:\tMODULE_DESCRIPTION(\"MediaTek MT7996 MMIO helpers\");\n 909:\tMODULE_LICENSE(\"Dual BSD/GPL\");\n"
} |
| 17/2 | 2026/10/19 02:00 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 24560 output: 47 thoughts: 94 Thoughts: Okay, here's my summary, tailored for an expert audience, in the first person: **Initialization and Cross-Referencing** Right, so `mt7996_init` is the entry point, and it's registering both the `mt7996_hif_driver` and `mt7996_pci_driver`. That's standard initialization procedure. Now, my immediate thought is to check for potential race conditions or unexpected interactions. Are there any *other* callers of `mt7996_run` or `mt7996_add_interface`? I need to be sure that these key functions aren't being invoked outside of the intended driver context, which could lead to resource contention or undefined behavior. It's a good practice to proactively look at where these functions are used, and that's precisely what I'll do. A solid code review would want to ensure that those functions are called only by these drivers. |
| 18/2 | 2026/10/19 02:00 | tool | grepper |
0mArgs:{
"Expression": "mt7996_run|mt7996_add_interface",
"PathPrefixes": [
"drivers/net/wireless/mediatek/"
]
}Results: {
"Output": "drivers/net/wireless/mediatek/mt76/mt7996/mac.c=2286=mt7996_mac_restart(struct mt7996_dev *dev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mac.c-2403-\ndrivers/net/wireless/mediatek/mt76/mt7996/mac.c:2404:\t\tret = mt7996_run(phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/mac.c-2405-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-9-\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c:10:int mt7996_run(struct mt7996_phy *phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-11-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c=535=static void mt7996_set_monitor(struct mt7996_phy *phy, bool enabled)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-559-\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c:560:static int mt7996_add_interface(struct ieee80211_hw *hw,\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-561-\t\t\t\tstruct ieee80211_vif *vif)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-577-\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c:578:\t\terr = mt7996_run(phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-579-\t\tif (err)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c=2573=const struct ieee80211_ops mt7996_ops = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-2582-\t.stop = mt7996_stop,\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c:2583:\t.add_interface = mt7996_add_interface,\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-2584-\t.remove_interface = mt7996_remove_interface,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h=702=void mt7996_reset(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:703:int mt7996_run(struct mt7996_phy *phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-704-int mt7996_mcu_init(struct mt7996_dev *dev);\n"
} |
| 19/2 | 2026/10/19 02:00 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 25812 output: 37 thoughts: 82 Thoughts: Here's my take on the thought process, as if I were analyzing this code: **Diving into the MT7996 Driver** Okay, so I'm looking at this `mt7996_add_interface` function. It's a callback within `ieee80211_ops mt7996_ops`, which immediately tells me this is likely how the driver hooks into the mac80211 stack. Makes sense - the hardware-specific stuff gets handled through those `ops` structures. And since `mt7996_ops` is registered during device probe, that's the entry point to how the mt7996 driver initializes itself when it finds the physical hardware. Now, I need to see the full picture. My immediate question is: *Where* else is `mt7996_ops` used? I'll dig through the code to trace how `mt7996_ops` is being leveraged beyond the initial registration. I want to see which other functions within the `ieee80211_ops` struct are being called, and how the driver interacts with the mac80211 layer. That's where the real meat of the operation is. Need to trace the control flow to see how they're handling packets, scanning, and all the rest of the radio's duties. This is a good starting point, but I need to quickly verify my initial understanding and then see the bigger picture. |
| 20/2 | 2026/10/19 02:00 | tool | grepper |
0mArgs:{
"Expression": "mt7996_ops",
"PathPrefixes": [
"drivers/net/wireless/mediatek/"
]
}Results: {
"Output": "drivers/net/wireless/mediatek/mt76/mt7996/main.c=2559=mt7996_set_eml_op_mode(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-2572-\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c:2573:const struct ieee80211_ops mt7996_ops = {\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-2574-\t.add_chanctx = mt76_add_chanctx,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c=832=struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-862-\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:863:\tmdev = mt76_alloc_device(pdev, sizeof(*dev), \u0026mt7996_ops, \u0026drv_ops);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-864-\tif (!mdev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h=656=mt7996_sta_link_protected(struct mt7996_dev *dev, struct mt7996_sta *msta,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-668-\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:669:extern const struct ieee80211_ops mt7996_ops;\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-670-extern struct pci_driver mt7996_pci_driver;\n"
} |
| 21/2 | 2026/10/19 02:00 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 26849 output: 40 thoughts: 43 Thoughts: Okay, here's my interpretation of that thought process, from an expert's perspective: **Investigating the Callers of `mt7996_mmio_probe`** Alright, so `mt7996_mmio_probe` is apparently called only within the `pci.c` file. Right, let's just make sure that's accurate and understand where that function is being invoked. It's a key function for initialization, so it is necessary to trace it and its inputs. The `mt7996_mmio_probe` function is vital to proper functioning of the hardware. Gotta pinpoint the exact call site to fully grasp its role in this system. Time to dig in and verify its usage. |
| 22/2 | 2026/10/19 02:00 | tool | grepper |
0mArgs:{
"Expression": "mt7996_mmio_probe",
"PathPrefixes": [
"drivers/net/wireless/mediatek/"
]
}Results: {
"Output": "drivers/net/wireless/mediatek/mt76/mt7996/mmio.c=808=irqreturn_t mt7996_irq_handler(int irq, void *dev_instance)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-831-\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:832:struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-833-\t\t\t\t void __iomem *mem_base, u32 device_id)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h=671=extern struct pci_driver mt7996_hif_driver;\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-672-\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:673:struct mt7996_dev *mt7996_mmio_probe(struct device *pdev,\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-674-\t\t\t\t void __iomem *mem_base, u32 device_id);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c=99=static int mt7996_pci_probe(struct pci_dev *pdev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-132-\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c:133:\tdev = mt7996_mmio_probe(\u0026pdev-\u003edev, pcim_iomap_table(pdev)[0],\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-134-\t\t\t\tid-\u003edevice);\n"
} |
| 23/2 | 2026/10/19 02:00 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 27663 output: 41 thoughts: 659 Thoughts: **WorthFuzzing Decision for mt7996_mmio_probe** Okay, so `mt7996_mmio_probe` is only called by `mt7996_pci_probe`. `mt7996_pci_probe` is the probe function for PCI devices with specific IDs – specifically those related to the MT7996, MT7992, and MT7990, all from vendor MEDIATEK. I need to figure out if this is something worth fuzzing, based on the provided instructions. First, I need to focus on reachability. The instructions are very clear: if the code is unreachable in a standard virtualized environment (QEMU, GCE with emulated devices), *don't* fuzz it. Specifically, the negative criteria list includes "structurally unreachable hardware" like vendor-specific PCIe switches. Given that this is a PCIe device, my immediate thought is that it might fall into that category. So, the question becomes: is the mt7996 driver accessible through standard virtualized environments? I remember that some other mt76 drivers, like `mt76x0u`, `mt76x2u`, and `mt7921u`, have USB interfaces that can be fuzzed using USB gadget. However, I need to confirm if mt7996 has any USB support. Let's do a quick check. I'll examine the files in `drivers/net/wireless/mediatek/mt76/mt7996/`. Based on a quick check, there's no `usb.c` file. Searching the directory yields no USB related files. Therefore, the mt7996 driver is strictly PCIe. Since PCIe devices can potentially be structurally unreachable, and this is *not* a USB interface driver (as might be fuzzable via USB gadget), I have to conclude that this should *not* be fuzzed. |
| 24/2 | 2026/10/19 02:00 | tool | grepper |
0mError:no matches Args: {
"Expression": "usb",
"PathPrefixes": [
"drivers/net/wireless/mediatek/mt76/mt7996/"
]
}Results: {
"error": "no matches"
} |
| 25/2 | 2026/10/19 02:00 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 28800 output: 43 thoughts: 49 Thoughts: Okay, here's my summary, tailored as requested: **Debugging the MT7996 and USB Interaction** Alright, the initial scan for "usb" within the mt7996 driver yielded absolutely nothing. That's a bit of a surprise, but not entirely unexpected given the potential for the USB interface to be handled at a higher level or in a more abstracted way. My next step is to consider the platform driver aspect. Is the mt7996 even registered as a platform driver? If not, is it registered in some other capacity that might handle the USB interaction? I'll need to confirm the device's registration type to understand how its resources are managed. To get a concrete answer, I need to check how `platform_driver` is implemented, if at all, within the mt7996 code. That's where I'll find my answer. I'll search for how the device is registered with the kernel. |
| 26/2 | 2026/10/19 02:00 | tool | grepper |
0mError:no matches Args: {
"Expression": "platform_driver",
"PathPrefixes": [
"drivers/net/wireless/mediatek/mt76/mt7996/"
]
}Results: {
"error": "no matches"
} |
| 27/2 | 2026/10/19 02:00 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 29109 output: 147 thoughts: 499 Thoughts: **Analysis of the MediaTek MT7996 PCIe Wi-Fi Driver for Fuzzing** Okay, so I've hit a dead end here. It's become clear that this code is purely a PCI driver, specifically for MediaTek MT7996/MT7992/MT7990 PCIe Wi-Fi NICs. And here's the kicker: QEMU doesn't emulate these physical PCIe NICs from MediaTek. That's a major roadblock. Without the actual physical PCIe hardware, the driver can't probe – specifically, the `mt7996_pci_probe` function will never execute. This means no `ieee80211_hw` or wireless device will ever be created, and critically, the core functions I'm interested in, `mt7996_run` and `mt7996_add_interface`, will remain structurally unreachable. They're simply inaccessible in standard virtualized fuzzing environments like QEMU or GCE. Let me just double-check the patch content. Hmm, it primarily touches `drivers/net/wireless/mediatek/mt76/mt7996/main.c`. Specifically, functions like `mt7996_run` and `mt7996_add_interface` are the targets of the patch. These are all part of the MediaTek MT7996 PCIe Wi-Fi driver, within `mt7996e.ko`. Right, I'm confirming my initial assessment. This driver is dependent on vendor-specific PCIe hardware – MediaTek's hardware. And because it's not emulated in standard QEMU or any virtualized environment I'm familiar with, it's definitely under the "Structurally unreachable hardware" category. This is similar to stuff like vendor-specific PCIe switches, SmartNICs, or GPU drivers like mlxsw, pds_core, qed, ionic, and amdgpu, all of which require actual physical ASIC/PCIe cards. This is a clear negative for fuzzing suitability. Therefore, `WorthFuzzing` should be set to `false`, that is, this code is not worth fuzzing. If `WorthFuzzing` is set to `false`, my configurations should be an empty array or null for `EnableConfigs` and `FocusSymbols` and a concise explanation in the `Reasoning` field. The reasoning should simply state that the code is structurally unreachable because it's a PCIe wireless driver that requires physical MediaTek MT7996 hardware, and that hardware isn't emulated in standard QEMU or virtual fuzzing environments. Let's make sure the schema is right...Yep, `EnableConfigs`: string array, `FocusSymbols`: string array, `Reasoning`: string, and `WorthFuzzing`: boolean. Okay, all checks out. I'm ready to call `set-results`. This is a definite "no go" for fuzzing in this setup. |
| 28/2 | 2026/10/19 02:01 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The changes modify error handling in `mt7996_run()` and `mt7996_add_interface()` within the MediaTek MT7996 wireless driver (`drivers/net/wireless/mediatek/mt76/mt7996/`). This driver is exclusively a PCIe driver requiring physical MediaTek MT7996/MT7992/MT7990 hardware that is not emulated in standard QEMU or virtualized test environments. Consequently, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The changes modify error handling in `mt7996_run()` and `mt7996_add_interface()` within the MediaTek MT7996 wireless driver (`drivers/net/wireless/mediatek/mt76/mt7996/`). This driver is exclusively a PCIe driver requiring physical MediaTek MT7996/MT7992/MT7990 hardware that is not emulated in standard QEMU or virtualized test environments. Consequently, the modified code is structurally unreachable for fuzzing.",
"WorthFuzzing": false
} |
| 29/1 | 2026/10/19 02:01 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|