AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Mediatek MT7996 wireless driver, which is a PCIe hardware driver. Since there is no software emulator for this specific hardware in virtualized environments (like QEMU or GCE), the modified code paths are unreachable during fuzzing.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit fd5a624a08dfbbfe5c6412fd673665ed514fd086\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sat Jun 20 02:02:23 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c\nindex d6f9aa1ab52d12..dbea4887b7adaa 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c\n+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c\n@@ -463,6 +463,8 @@ mt7996_init_wiphy_band(struct ieee80211_hw *hw, struct mt7996_phy *phy)\n \tradio-\u003en_freq_range = 1;\n \tradio-\u003eiface_combinations = \u0026if_comb;\n \tradio-\u003en_iface_combinations = 1;\n+\tmemcpy(dev-\u003eradio_addrs[n_radios].addr, phy-\u003emt76-\u003emacaddr, ETH_ALEN);\n+\thw-\u003ewiphy-\u003en_addresses++;\n \thw-\u003ewiphy-\u003en_radio++;\n \n \twiphy-\u003eavailable_antennas_rx |= phy-\u003emt76-\u003echainmask;\n@@ -505,6 +507,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)\n \twiphy-\u003en_iface_combinations = 1;\n \n \twiphy-\u003eradio = dev-\u003eradios;\n+\twiphy-\u003eaddresses = dev-\u003eradio_addrs;\n \n \twiphy-\u003ereg_notifier = mt7996_regd_notifier;\n \twiphy-\u003eflags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH |\ndiff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h\nindex 0d6488522ba711..cb5e60b25b89e4 100644\n--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h\n+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h\n@@ -411,6 +411,7 @@ struct mt7996_dev {\n \tstruct mt7996_phy *radio_phy[MT7996_MAX_RADIOS];\n \tstruct wiphy_radio radios[MT7996_MAX_RADIOS];\n \tstruct wiphy_radio_freq_range radio_freqs[MT7996_MAX_RADIOS];\n+\tstruct mac_address radio_addrs[MT7996_MAX_RADIOS];\n \n \tstruct mt7996_hif *hif2;\n \tstruct mt7996_reg_desc reg;\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Mediatek MT7996 wireless driver, which is a PCIe hardware driver. Since there is no software emulator for this specific hardware in virtualized environments (like QEMU or GCE), the modified code paths are unreachable during fuzzing.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit fd5a624a08dfbbfe5c6412fd673665ed514fd086
Author: syz-cluster <triage@syzkaller.com>
Date:   Sat Jun 20 02:02:23 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/init.c b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
index d6f9aa1ab52d12..dbea4887b7adaa 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/init.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/init.c
@@ -463,6 +463,8 @@ mt7996_init_wiphy_band(struct ieee80211_hw *hw, struct mt7996_phy *phy)
 	radio->n_freq_range = 1;
 	radio->iface_combinations = &if_comb;
 	radio->n_iface_combinations = 1;
+	memcpy(dev->radio_addrs[n_radios].addr, phy->mt76->macaddr, ETH_ALEN);
+	hw->wiphy->n_addresses++;
 	hw->wiphy->n_radio++;
 
 	wiphy->available_antennas_rx |= phy->mt76->chainmask;
@@ -505,6 +507,7 @@ mt7996_init_wiphy(struct ieee80211_hw *hw, struct mtk_wed_device *wed)
 	wiphy->n_iface_combinations = 1;
 
 	wiphy->radio = dev->radios;
+	wiphy->addresses = dev->radio_addrs;
 
 	wiphy->reg_notifier = mt7996_regd_notifier;
 	wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH |
diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
index 0d6488522ba711..cb5e60b25b89e4 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h
@@ -411,6 +411,7 @@ struct mt7996_dev {
 	struct mt7996_phy *radio_phy[MT7996_MAX_RADIOS];
 	struct wiphy_radio radios[MT7996_MAX_RADIOS];
 	struct wiphy_radio_freq_range radio_freqs[MT7996_MAX_RADIOS];
+	struct mac_address radio_addrs[MT7996_MAX_RADIOS];
 
 	struct mt7996_hif *hif2;
 	struct mt7996_reg_desc reg;

gemini-3.1-pro-preview

null

null

							input: 2385
							output: 44
							thoughts: 294
						

**Analyzing a Mediatek MT7996 Driver Patch**

Okay, so I'm looking at a patch that touches `drivers/net/wireless/mediatek/mt76/mt7996/init.c` and `drivers/net/wireless/mediatek/mt76/mt7996/mt7996.h`. It looks like they're adding some crucial address management capabilities for the MT7996 wireless device. Specifically, I see `memcpy` calls to copy MAC addresses, incrementing address counts in the `wiphy`, and an array `radio_addrs` being set up. This strongly suggests the driver is now handling multiple radios or interfaces within a single physical device, which is typical for modern Wi-Fi chipsets.

My initial thought is to consider the environment. This is a Mediatek MT7996 driver, and the question that immediately pops into my head is whether this is even *reachable* in a virtualized or emulated environment. Wi-Fi drivers, especially those targeting specific hardware like the MT7996, are notoriously difficult to test without the actual hardware. I'd typically expect to use something like `mac80211_hwsim` for general testing, but it's not a direct MT7996 emulator, and I doubt it can work here.

Wait a moment, I am thinking of Syzkaller's USB fuzzing capabilities... is the MT7996 actually PCIe? I need to double-check that... If it *is* PCIe, then things get considerably more complicated, as direct PCIe device access in virtual machines is not typically straightforward, it often requires special configurations. Let me see...

{
  "Expression": "mt7996",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7996/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 6518 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-2-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:3:obj-$(CONFIG_MT7996E) += mt7996e.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-4-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:5:mt7996e-y := pci.o init.o dma.o eeprom.o main.o mcu.o mac.o \\\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-6-\t     debugfs.o mmio.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile-7-\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:8:mt7996e-$(CONFIG_MT7996_NPU) += npu.o\ndrivers/net/wireless/mediatek/mt76/mt7996/Makefile:9:mt7996e-$(CONFIG_DEV_COREDUMP) += coredump.o\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=12=MODULE_PARM_DESC(coredump_memdump, \"Optional ability to dump firmware memory\");\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-13-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:14:static const struct mt7996_mem_region mt7996_mem_regions[] = {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-15-\t{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-46-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:47:const struct mt7996_mem_region*\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:48:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-49-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-52-\tcase MT7996_DEVICE_ID_2:\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:53:\t\t*num = ARRAY_SIZE(mt7996_mem_regions);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:54:\t\treturn \u0026mt7996_mem_regions[0];\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-55-\tdefault:\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-59-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:60:static int mt7996_coredump_get_mem_size(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-61-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:62:\tconst struct mt7996_mem_region *mem_region;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-63-\tsize_t size = 0;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-66-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:67:\tmem_region = mt7996_coredump_get_mem_layout(dev, \u0026num);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-68-\tif (!mem_region)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-76-\t/* reserve space for the headers */\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:77:\tsize += num * sizeof(struct mt7996_mem_hdr);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-78-\t/* make sure it is aligned 4 bytes for debug message print out */\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-83-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:84:struct mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-85-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:86:\tstruct mt7996_crash_data *crash_data = dev-\u003ecoredump.crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-87-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=100=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:101:mt7996_coredump_fw_state(struct mt7996_dev *dev, struct mt7996_coredump *dump,\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-102-\t\t\t bool *exception)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c=117=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:118:mt7996_coredump_fw_stack(struct mt7996_dev *dev, struct mt7996_coredump *dump,\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-119-\t\t\t bool exception)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-161-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:162:static struct mt7996_coredump *mt7996_coredump_build(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-163-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:164:\tstruct mt7996_crash_data *crash_data = dev-\u003ecoredump.crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:165:\tstruct mt7996_coredump *dump;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:166:\tstruct mt7996_coredump_mem *dump_mem;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-167-\tsize_t len, sofar = 0, hdr_len = sizeof(*dump);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-186-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:187:\tdump = (struct mt7996_coredump *)(buf);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-188-\tdump-\u003elen = len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-200-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:201:\tmt7996_coredump_fw_state(dev, dump, \u0026exception);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:202:\tmt7996_coredump_fw_stack(dev, dump, exception);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-203-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-204-\t/* gather memory content */\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:205:\tdump_mem = (struct mt7996_coredump_mem *)(buf + sofar);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-206-\tdump_mem-\u003elen = crash_data-\u003ememdump_buf_len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-215-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:216:int mt7996_coredump_submit(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-217-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:218:\tstruct mt7996_coredump *dump;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-219-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:220:\tdump = mt7996_coredump_build(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-221-\tif (!dump) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-230-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:231:int mt7996_coredump_register(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-232-{\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:233:\tstruct mt7996_crash_data *crash_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-234-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-241-\tif (coredump_memdump) {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:242:\t\tcrash_data-\u003ememdump_buf_len = mt7996_coredump_get_mem_size(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-243-\t\tif (!crash_data-\u003ememdump_buf_len)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-256-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c:257:void mt7996_coredump_unregister(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.c-258-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-6-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:7:#include \"mt7996.h\"\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-8-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:9:struct mt7996_coredump {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-10-\tchar magic[16];\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-39-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:40:struct mt7996_coredump_mem {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-41-\tu32 len;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-44-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:45:struct mt7996_mem_hdr {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-46-\tu32 start;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-50-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:51:struct mt7996_mem_region {\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-52-\tu32 start;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-59-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:60:const struct mt7996_mem_region *\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:61:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:62:struct mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:63:int mt7996_coredump_submit(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:64:int mt7996_coredump_register(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:65:void mt7996_coredump_unregister(struct mt7996_dev *dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-66-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-68-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:69:static inline const struct mt7996_mem_region *\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:70:mt7996_coredump_get_mem_layout(struct mt7996_dev *dev, u32 *num)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-71-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-74-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:75:static inline int mt7996_coredump_submit(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-76-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h=80=static inline struct\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:81:mt7996_crash_data *mt7996_coredump_new(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-82-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-85-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:86:static inline int mt7996_coredump_register(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-87-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-90-\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h:91:static inline void mt7996_coredump_unregister(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/coredump.h-92-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-6-#include \u003clinux/relay.h\u003e\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:7:#include \"mt7996.h\"\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-8-#include \"eeprom.h\"\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=23=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:24:mt7996_implicit_txbf_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-25-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:26:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-27-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-32-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:33:\treturn mt7996_mcu_set_txbf(dev, BF_HW_EN_UPDATE);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-34-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=36=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:37:mt7996_implicit_txbf_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-38-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:39:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-40-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-45-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:46:DEFINE_DEBUGFS_ATTRIBUTE(fops_implicit_txbf, mt7996_implicit_txbf_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:47:\t\t\t mt7996_implicit_txbf_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-48-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=50=static ssize_t\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:51:mt7996_sys_recovery_set(struct file *file, const char __user *user_buf,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-52-\t\t\tsize_t count, loff_t *ppos)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-53-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:54:\tstruct mt7996_dev *dev = file-\u003eprivate_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-55-\tchar buf[16], *sep;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-91-\tcase UNI_CMD_SER_QUERY:\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:92:\t\tret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_QUERY, 0, band);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-93-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-100-\tcase UNI_CMD_SER_SET_RECOVER_L4_MDP:\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:101:\t\tret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_SET, BIT(val), band);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-102-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-104-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:105:\t\tret = mt7996_mcu_set_ser(dev, UNI_CMD_SER_TRIGGER, val, band);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-106-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-111-\t\tdev-\u003erecovery.state |= MT_MCU_CMD_WDT_MASK;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:112:\t\tmt7996_reset(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-113-\t\tbreak;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-116-\tcase UNI_CMD_SER_SET_SYSTEM_ASSERT:\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:117:\t\tret = mt7996_mcu_trigger_assert(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-118-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=128=static ssize_t\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:129:mt7996_sys_recovery_get(struct file *file, char __user *user_buf,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-130-\t\t\tsize_t count, loff_t *ppos)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-131-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:132:\tstruct mt7996_dev *dev = file-\u003eprivate_data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-133-\tchar *buff;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-214-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:215:static const struct file_operations mt7996_sys_recovery_ops = {\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:216:\t.write = mt7996_sys_recovery_set,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:217:\t.read = mt7996_sys_recovery_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-218-\t.open = simple_open,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=222=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:223:mt7996_radar_trigger(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-224-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-226-#define RADAR_BACKGROUND\t2\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:227:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:228:\tstruct mt7996_phy *phy = mt7996_band_phy(dev, NL80211_BAND_5GHZ);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-229-\tstruct cfg80211_chan_def *chandef;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-247-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:248:\trdd_idx = mt7996_get_rdd_idx(phy, val == RADAR_BACKGROUND);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-249-\tif (rdd_idx \u003c 0) {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-258-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:259:\treturn mt7996_mcu_rdd_cmd(dev, RDD_RADAR_EMULATE, rdd_idx, 0);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-260-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=262=DEFINE_DEBUGFS_ATTRIBUTE(fops_radar_trigger, NULL,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:263:\t\t\t mt7996_radar_trigger, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-264-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=265=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:266:mt7996_rdd_monitor(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-267-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:268:\tstruct mt7996_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-269-\tstruct cfg80211_chan_def *chandef = \u0026dev-\u003erdd2_chandef;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=312=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:313:mt7996_fw_debug_wm_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-314-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:315:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-316-\tenum {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-337-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:338:\tret = mt7996_mcu_fw_log_2_host(dev, MCU_FW_LOG_WM, val);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-339-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-350-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:351:\t\tret = mt7996_mcu_fw_dbg_ctrl(dev, debug, val);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-352-\t\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=359=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:360:mt7996_fw_debug_wm_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-361-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:362:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-363-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-368-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:369:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_wm, mt7996_fw_debug_wm_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:370:\t\t\t mt7996_fw_debug_wm_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-371-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=372=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:373:mt7996_fw_debug_wa_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-374-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:375:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-376-\tint ret;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-379-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:380:\tret = mt7996_mcu_fw_log_2_host(dev, MCU_FW_LOG_WA, dev-\u003efw_debug_wa);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-381-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-383-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:384:\treturn mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(SET), MCU_WA_PARAM_PDMA_RX,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-385-\t\t\t\t !!dev-\u003efw_debug_wa, 0);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=388=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:389:mt7996_fw_debug_wa_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-390-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:391:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-392-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-397-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:398:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_wa, mt7996_fw_debug_wa_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:399:\t\t\t mt7996_fw_debug_wa_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-400-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=425=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:426:mt7996_fw_debug_bin_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-427-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-431-\t};\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:432:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-433-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-443-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:444:\treturn mt7996_fw_debug_wm_set(dev, dev-\u003efw_debug_wm);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-445-}\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=447=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:448:mt7996_fw_debug_bin_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-449-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:450:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-451-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-456-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:457:DEFINE_DEBUGFS_ATTRIBUTE(fops_fw_debug_bin, mt7996_fw_debug_bin_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:458:\t\t\t mt7996_fw_debug_bin_set, \"%lld\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-459-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=460=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:461:mt7996_fw_util_wa_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-462-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:463:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-464-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-465-\tif (dev-\u003efw_debug_wa)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:466:\t\treturn mt7996_mcu_wa_cmd(dev, MCU_WA_PARAM_CMD(QUERY),\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-467-\t\t\t\t\t MCU_WA_PARAM_CPU_UTIL, 0, 0);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-471-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:472:DEFINE_SHOW_ATTRIBUTE(mt7996_fw_util_wa);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-473-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=474=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:475:mt7996_ampdu_stat_read_phy(struct mt7996_phy *phy, struct seq_file *file)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-476-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:477:\tstruct mt7996_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-478-\tint bound[15], range[8], i;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=504=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:505:mt7996_txbf_stat_read_phy(struct mt7996_phy *phy, struct seq_file *s)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-506-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=552=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:553:mt7996_tx_stats_show_phy(struct seq_file *file, struct mt7996_phy *phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-554-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-558-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:559:\tmt7996_mac_update_stats(phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:560:\tmt7996_ampdu_stat_read_phy(phy, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-561-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-568-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:569:\tmt7996_txbf_stat_read_phy(phy, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-570-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=584=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:585:mt7996_tx_stats_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-586-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:587:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:588:\tstruct mt7996_phy *phy = \u0026dev-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-589-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-591-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:592:\tmt7996_tx_stats_show_phy(file, phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:593:\tphy = mt7996_phy2(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-594-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:595:\t\tmt7996_tx_stats_show_phy(file, phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:596:\tphy = mt7996_phy3(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-597-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:598:\t\tmt7996_tx_stats_show_phy(file, phy);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-599-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-604-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:605:DEFINE_SHOW_ATTRIBUTE(mt7996_tx_stats);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-606-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=607=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:608:mt7996_hw_queue_read(struct seq_file *s, u32 size,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-609-\t\t     const struct hw_queue_map *map)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-610-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:611:\tstruct mt7996_phy *phy = s-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:612:\tstruct mt7996_dev *dev = phy-\u003edev;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-613-\tu32 i, val;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=638=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:639:mt7996_sta_hw_queue_read(void *data, struct ieee80211_sta *sta)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-640-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:641:\tstruct mt7996_sta *msta = (struct mt7996_sta *)sta-\u003edrv_priv;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:642:\tstruct mt7996_vif *mvif = msta-\u003evif;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:643:\tstruct mt7996_phy *phy = mt7996_vif_link_phy(\u0026mvif-\u003edeflink);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-644-\tstruct ieee80211_link_sta *link_sta;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-646-\tstruct ieee80211_vif *vif;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:647:\tstruct mt7996_dev *dev;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-648-\tunsigned int link_id;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-658-\tfor_each_sta_active_link(vif, sta, link_sta, link_id) {\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:659:\t\tstruct mt7996_sta_link *msta_link;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-660-\t\tstruct mt76_vif_link *mlink;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-666-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:667:\t\tmsta_link = mt7996_sta_link(msta, link_id);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-668-\t\tif (!msta_link)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=694=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:695:mt7996_hw_queues_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-696-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:697:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:698:\tstruct mt7996_phy *phy = \u0026dev-\u003ephy;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-699-\tstatic const struct hw_queue_map ple_queue_map[] = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-747-\tseq_puts(file, \"PLE non-empty queue info:\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:748:\tmt7996_hw_queue_read(file, ARRAY_SIZE(ple_queue_map),\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-749-\t\t\t     \u0026ple_queue_map[0]);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-752-\tieee80211_iterate_stations_atomic(phy-\u003emt76-\u003ehw,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:753:\t\t\t\t\t  mt7996_sta_hw_queue_read, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:754:\tphy = mt7996_phy2(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-755-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-756-\t\tieee80211_iterate_stations_atomic(phy-\u003emt76-\u003ehw,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:757:\t\t\t\t\t\t  mt7996_sta_hw_queue_read, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:758:\tphy = mt7996_phy3(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-759-\tif (phy)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-760-\t\tieee80211_iterate_stations_atomic(phy-\u003emt76-\u003ehw,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:761:\t\t\t\t\t\t  mt7996_sta_hw_queue_read, file);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-762-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-764-\tseq_puts(file, \"PSE non-empty queue info:\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:765:\tmt7996_hw_queue_read(file, ARRAY_SIZE(pse_queue_map),\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-766-\t\t\t     \u0026pse_queue_map[0]);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-770-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:771:DEFINE_SHOW_ATTRIBUTE(mt7996_hw_queues);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-772-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=773=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:774:mt7996_xmit_queues_show(struct seq_file *file, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-775-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:776:\tstruct mt7996_dev *dev = file-\u003eprivate;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:777:\tstruct mt7996_phy *phy;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-778-\tstruct {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-790-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:791:\tphy = mt7996_phy2(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-792-\tif (phy)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-794-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:795:\tphy = mt7996_phy3(dev);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-796-\tif (phy)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-813-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:814:DEFINE_SHOW_ATTRIBUTE(mt7996_xmit_queues);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-815-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=816=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:817:mt7996_twt_stats(struct seq_file *s, void *data)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-818-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:819:\tstruct mt7996_dev *dev = dev_get_drvdata(s-\u003eprivate);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:820:\tstruct mt7996_twt_flow *iter;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-821-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=845=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:846:mt7996_rf_regval_get(void *data, u64 *val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-847-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:848:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-849-\tu32 regval;\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-851-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:852:\tret = mt7996_mcu_rf_regval(dev, dev-\u003emt76.debugfs_reg, \u0026regval, false);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-853-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=861=static int\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:862:mt7996_rf_regval_set(void *data, u64 val)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-863-{\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:864:\tstruct mt7996_dev *dev = data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-865-\tu32 val32 = val;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-866-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:867:\treturn mt7996_mcu_rf_regval(dev, dev-\u003emt76.debugfs_reg, \u0026val32, true);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-868-}\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-869-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:870:DEFINE_DEBUGFS_ATTRIBUTE(fops_rf_regval, mt7996_rf_regval_get,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:871:\t\t\t mt7996_rf_regval_set, \"0x%08llx\\n\");\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-872-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:873:int mt7996_init_debugfs(struct mt7996_dev *dev)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-874-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-879-\tdebugfs_create_file(\"hw-queues\", 0400, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:880:\t\t\t    \u0026mt7996_hw_queues_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-881-\tdebugfs_create_file(\"xmit-queues\", 0400, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:882:\t\t\t    \u0026mt7996_xmit_queues_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:883:\tdebugfs_create_file(\"tx_stats\", 0400, dir, dev, \u0026mt7996_tx_stats_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-884-\tdebugfs_create_file(\"sys_recovery\", 0600, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:885:\t\t\t    \u0026mt7996_sys_recovery_ops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-886-\tdebugfs_create_file(\"fw_debug_wm\", 0600, dir, dev, \u0026fops_fw_debug_wm);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-890-\tdebugfs_create_file(\"fw_util_wa\", 0400, dir, dev,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:891:\t\t\t    \u0026mt7996_fw_util_wa_fops);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-892-\tdebugfs_create_file(\"implicit_txbf\", 0600, dir, dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-894-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"twt_stats\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:895:\t\t\t\t    mt7996_twt_stats);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-896-\tdebugfs_create_file(\"rf_regval\", 0600, dir, dev, \u0026fops_rf_regval);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-901-\tdebugfs_create_devm_seqfile(dev-\u003emt76.dev, \"rdd_monitor\", dir,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:902:\t\t\t\t    mt7996_rdd_monitor);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-903-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=909=static void\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:910:mt7996_debugfs_write_fwlog(struct mt7996_dev *dev, const void *hdr, int hdrlen,\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-911-\t\t\t   const void *data, int len)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-933-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:934:void mt7996_debugfs_rx_fw_monitor(struct mt7996_dev *dev, const void *data, int len)\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-935-{\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-955-\thdr.len = *(__le16 *)data;\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:956:\tmt7996_debugfs_write_fwlog(dev, \u0026hdr, sizeof(hdr), data, len);\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-957-}\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-958-\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 19912
							output: 43
							thoughts: 142
						

**Analyzing the MT7996 Driver**

Okay, the output's a bit verbose; I need to refine my approach. Let's quickly determine the execution context. Is this a pure hardware interaction, or are we dealing with some level of emulation? The reference indicates a driver for the Mediatek MT7996, which is interesting. The "PCIe driver" designation immediately narrows the possibilities.

Now, a crucial question arises: can this code even be reached within a virtualized environment? Given it's a PCIe driver for that specific chipset, it's highly improbable that a QEMU device exists, let alone one that specifically emulates the MT7996. Therefore, barring some extremely rare circumstances, the driver's probe function is going to remain untouched in a virtualized setting.

To confirm this, I should probably check `drivers/net/wireless/mediatek/mt76/mt7996/pci.c` to confirm it is indeed a PCI driver as suspected.

{
  "Expression": "pci_driver",
  "PathPrefix": "drivers/net/wireless/mediatek/mt76/mt7996/"
}

{
  "Output": "drivers/net/wireless/mediatek/mt76/mt7996/mmio.c=868=static int __init mt7996_init(void)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-875-\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:876:\tret = pci_register_driver(\u0026mt7996_pci_driver);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-877-\tif (ret)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c=883=static void __exit mt7996_exit(void)\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-884-{\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c:885:\tpci_unregister_driver(\u0026mt7996_pci_driver);\ndrivers/net/wireless/mediatek/mt76/mt7996/mmio.c-886-\tpci_unregister_driver(\u0026mt7996_hif_driver);\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h=669=extern const struct ieee80211_ops mt7996_ops;\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:670:extern struct pci_driver mt7996_pci_driver;\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:671:extern struct pci_driver mt7996_hif_driver;\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-672-\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c=233=static void mt7996_pci_remove(struct pci_dev *pdev)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-243-\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c:244:struct pci_driver mt7996_hif_driver = {\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-245-\t.name\t\t= KBUILD_MODNAME \"_hif\",\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-250-\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c:251:struct pci_driver mt7996_pci_driver = {\ndrivers/net/wireless/mediatek/mt76/mt7996/pci.c-252-\t.name\t\t= KBUILD_MODNAME,\n"
}

gemini-3.1-pro-preview

null

null

							input: 21127
							output: 86
							thoughts: 341
						

**My Assessment: Unfuzzable Code Path**

Okay, so this is definitely a PCI driver – that much is clear. The question is, can I even *get* to this code without the actual hardware? The instructions are pretty specific: "Return WorthFuzzing=false if the patch only contains code paths that are impossible to reach in virtualized environments..."

And that's the crux of it. This driver is for the Mediatek MT7996, a PCIe device. There isn't, as far as I know, any kernel-level software emulator for *this* specific hardware, or even a close approximation within QEMU. Things like USB gadget or mac80211_hwsim don't apply here. This code path is, by definition, unreachable in a virtualized environment.

Let me just double-check… I need to make *absolutely* sure. Hmm, `mt7996_init_wiphy_band` is the key function. It's called from `mt7996_init_wiphy`, which in turn is called by either `mt7996_register_ext_phy` or `mt7996_register_device`. Those are called during the probe process, right? And *probe* only gets called if the PCI device is actually present. Since QEMU/GCE don't *have* that PCI device, probe *won't* be called. Therefore, no matter what, those code paths are inaccessible.

So, I'm confident in saying WorthFuzzing=false. Let's summarize it for clarity: "The patch modifies the Mediatek MT7996 wireless driver, which is a PCIe hardware driver. Since there is no software emulator for this specific hardware in virtualized environments (like QEMU or GCE), the modified code paths are unreachable during fuzzing."

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Mediatek MT7996 wireless driver, which is a PCIe hardware driver. Since there is no software emulator for this specific hardware in virtualized environments (like QEMU or GCE), the modified code paths are unreachable during fuzzing.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies the Mediatek MT7996 wireless driver, which is a PCIe hardware driver. Since there is no software emulator for this specific hardware in virtualized environments (like QEMU or GCE), the modified code paths are unreachable during fuzzing.",
  "WorthFuzzing": false
}