| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/10/30 02:55 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"KMSANReasoning": "",
"NeedsKMSAN": false,
"Reasoning": "The patch modifies ath11k_mac_update_vif_chan() in drivers/net/wireless/ath/ath11k/mac.c. ath11k is a driver for Qualcomm 802.11ax wireless devices, connecting exclusively via PCIe or Qualcomm AHB (platform bus) and relying on Qualcomm MHI/QMI firmware communication. It requires physical Qualcomm hardware that is not emulated in standard QEMU or GCE virtualized environments, making this code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
} |
| 1/1 | 2026/10/30 02:55 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 6836c9ad17bcefa90d0e9f8cec42c54301356ccf\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Fri Oct 30 02:55:21 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c\nindex 1a237adaa37d16..a9b940c2da410c 100644\n--- a/drivers/net/wireless/ath/ath11k/mac.c\n+++ b/drivers/net/wireless/ath/ath11k/mac.c\n@@ -7793,6 +7793,7 @@ ath11k_mac_update_vif_chan(struct ath11k *ar,\n \tint ret;\n \tint i;\n \tbool monitor_vif = false;\n+\tunsigned long stopped = 0;\n \n \tlockdep_assert_held(\u0026ar-\u003econf_mutex);\n \n@@ -7802,6 +7803,33 @@ ath11k_mac_update_vif_chan(struct ath11k *ar,\n \n \t/* TODO: Update ar-\u003erx_channel */\n \n+\t/* Take every vdev that is up down and stop it before any of them\n+\t * starts on the new channel, as a fresh start of the radio does.\n+\t * Restarting the vdevs in place, or stopping and starting them one\n+\t * at a time while the others stay started, leaves the radio sending\n+\t * at far lower rates on the new channel until it is restarted.\n+\t */\n+\tfor (i = 0; i \u003c n_vifs \u0026\u0026 i \u003c BITS_PER_LONG; i++) {\n+\t\tarvif = ath11k_vif_to_arvif(vifs[i].vif);\n+\n+\t\tif (!arvif-\u003eis_started || !arvif-\u003eis_up)\n+\t\t\tcontinue;\n+\n+\t\tret = ath11k_wmi_vdev_down(ar, arvif-\u003evdev_id);\n+\t\tif (ret)\n+\t\t\tath11k_warn(ab, \"failed to down vdev %d: %d\\n\",\n+\t\t\t\t arvif-\u003evdev_id, ret);\n+\n+\t\tret = ath11k_mac_vdev_stop(arvif);\n+\t\tif (ret) {\n+\t\t\tath11k_warn(ab, \"failed to stop vdev %d: %d\\n\",\n+\t\t\t\t arvif-\u003evdev_id, ret);\n+\t\t\tcontinue;\n+\t\t}\n+\n+\t\tstopped |= BIT(i);\n+\t}\n+\n \tfor (i = 0; i \u003c n_vifs; i++) {\n \t\tarvif = ath11k_vif_to_arvif(vifs[i].vif);\n \n@@ -7815,7 +7843,18 @@ ath11k_mac_update_vif_chan(struct ath11k *ar,\n \t\t * Firmware expect vdev_restart only if vdev is up.\n \t\t * If vdev is down then it expect vdev_stop-\u003evdev_start.\n \t\t */\n-\t\tif (arvif-\u003eis_up) {\n+\t\tif (i \u003c BITS_PER_LONG \u0026\u0026 (stopped \u0026 BIT(i))) {\n+\t\t\tret = ath11k_mac_vdev_start(arvif, vifs[i].new_ctx);\n+\t\t\tif (ret) {\n+\t\t\t\tath11k_warn(ab, \"failed to start vdev %d: %d\\n\",\n+\t\t\t\t\t arvif-\u003evdev_id, ret);\n+\t\t\t\tcontinue;\n+\t\t\t}\n+\n+\t\t\t/* as enabling the beacon did for the first start */\n+\t\t\tath11k_mac_set_he_txbf_conf(arvif);\n+\t\t} else if (arvif-\u003eis_up) {\n+\t\t\t/* the vdev could not be stopped */\n \t\t\tret = ath11k_mac_vdev_restart(arvif, vifs[i].new_ctx);\n \t\t\tif (ret) {\n \t\t\t\tath11k_warn(ab, \"failed to restart vdev %d: %d\\n\",\n"
} |
| 2/1 | 2026/10/30 02:55 | agent | patch-evaluator |
0mModel:core Args: null Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies ath11k_mac_update_vif_chan() in drivers/net/wireless/ath/ath11k/mac.c. ath11k is a driver for Qualcomm 802.11ax wireless devices, connecting exclusively via PCIe or Qualcomm AHB (platform bus) and relying on Qualcomm MHI/QMI firmware communication. It requires physical Qualcomm hardware that is not emulated in standard QEMU or GCE virtualized environments, making this code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
}Instruction: You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.
IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.
================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.
- REACHABILITY IS THE PRIMARY GATE:
Fuzzing can only discover bugs in code that can actually execute in standard virtualized
environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
regardless of whether it adds assertions or complex logic.
- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
Patch authors routinely label changes as "cleanups", "refactorings", or state
"No functional change intended". Do NOT take these claims at face value.
Code refactorings that rearrange logic, introduce helper functions, or alter state management
in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
If reachable executable code is modified or refactored, it MUST be fuzzed.
- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
Even if the author believes the invariant always holds, fuzzing is essential to verify whether
an unusual sequence of operations can violate it.
================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:
- Non-kernel and non-executable changes:
* Modifications to Documentation/, comments, or spelling fixes.
* User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
that do not affect the compiled kernel image (vmlinux) or kernel modules.
* Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
that do not alter control flow or data structures.
* Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
* Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
* Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
physical PCI hot-unplug or manual sysfs driver unbinding.
* Code paths exclusive to architectures other than the target architecture.
================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
* Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
* Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
* Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
* Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).
================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:
- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
Do NOT list generic, ubiquitous functions called by almost every program in the corpus
(including, but not limited to: general memory allocators and deallocators, page fault
and trap handlers, or core synchronization primitives; this is not an exhaustive list).
Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
which severely dilutes fuzzing effort away from the actual changes.
- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
List functions that specifically implement the logic being added or altered, or direct API entrypoints
for the subsystem feature under review.
- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).
================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Target architecture: amd64
For your convenience, here is the diff of the changes:
commit 6836c9ad17bcefa90d0e9f8cec42c54301356ccf
Author: syz-cluster <triage@syzkaller.com>
Date: Fri Oct 30 02:55:21 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c
index 1a237adaa37d16..a9b940c2da410c 100644
--- a/drivers/net/wireless/ath/ath11k/mac.c
+++ b/drivers/net/wireless/ath/ath11k/mac.c
@@ -7793,6 +7793,7 @@ ath11k_mac_update_vif_chan(struct ath11k *ar,
int ret;
int i;
bool monitor_vif = false;
+ unsigned long stopped = 0;
lockdep_assert_held(&ar->conf_mutex);
@@ -7802,6 +7803,33 @@ ath11k_mac_update_vif_chan(struct ath11k *ar,
/* TODO: Update ar->rx_channel */
+ /* Take every vdev that is up down and stop it before any of them
+ * starts on the new channel, as a fresh start of the radio does.
+ * Restarting the vdevs in place, or stopping and starting them one
+ * at a time while the others stay started, leaves the radio sending
+ * at far lower rates on the new channel until it is restarted.
+ */
+ for (i = 0; i < n_vifs && i < BITS_PER_LONG; i++) {
+ arvif = ath11k_vif_to_arvif(vifs[i].vif);
+
+ if (!arvif->is_started || !arvif->is_up)
+ continue;
+
+ ret = ath11k_wmi_vdev_down(ar, arvif->vdev_id);
+ if (ret)
+ ath11k_warn(ab, "failed to down vdev %d: %d\n",
+ arvif->vdev_id, ret);
+
+ ret = ath11k_mac_vdev_stop(arvif);
+ if (ret) {
+ ath11k_warn(ab, "failed to stop vdev %d: %d\n",
+ arvif->vdev_id, ret);
+ continue;
+ }
+
+ stopped |= BIT(i);
+ }
+
for (i = 0; i < n_vifs; i++) {
arvif = ath11k_vif_to_arvif(vifs[i].vif);
@@ -7815,7 +7843,18 @@ ath11k_mac_update_vif_chan(struct ath11k *ar,
* Firmware expect vdev_restart only if vdev is up.
* If vdev is down then it expect vdev_stop->vdev_start.
*/
- if (arvif->is_up) {
+ if (i < BITS_PER_LONG && (stopped & BIT(i))) {
+ ret = ath11k_mac_vdev_start(arvif, vifs[i].new_ctx);
+ if (ret) {
+ ath11k_warn(ab, "failed to start vdev %d: %d\n",
+ arvif->vdev_id, ret);
+ continue;
+ }
+
+ /* as enabling the beacon did for the first start */
+ ath11k_mac_set_he_txbf_conf(arvif);
+ } else if (arvif->is_up) {
+ /* the vdev could not be stopped */
ret = ath11k_mac_vdev_restart(arvif, vifs[i].new_ctx);
if (ret) {
ath11k_warn(ab, "failed to restart vdev %d: %d\n",
|
| 3/2 | 2026/10/30 02:55 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 3811 output: 38 thoughts: 167 Thoughts: **Analyzing the Atheros Wi-Fi 6 Driver Modification** Okay, so the diff I'm looking at impacts `drivers/net/wireless/ath/ath11k/mac.c`. Specifically, the `ath11k_mac_update_vif_chan` function. The first thing I'm doing is getting a feel for the `ath11k` driver itself. I'm wondering if this change is going to be relevant to standard virtualization setups like QEMU or Google Compute Engine. A quick memory jog tells me `ath11k` is Qualcomm Atheros' 802.11ax, or Wi-Fi 6, driver and is typically seen on PCIe or AHB connected devices, particularly Qualcomm SoCs. I need to understand what hardware this supports. I have a hunch it isn't going to have any direct USB interface. I'm also doubting it has `mac80211_hwsim` support or any virtual device emulation. I'm going to quickly scan the codebase with `grepper` or `codesearch` to get a clearer picture of its capabilities and the scope of this change. |
| 4/2 | 2026/10/30 02:55 | tool | grepper |
0mArgs:{
"Expression": "ath11k",
"PathPrefixes": [
"drivers/net/wireless/ath/ath11k/"
]
}Results: {
"Output": "\nFull output is too long, showing 200 out of 26741 lines.\nUse more precise expression or PathPrefixes if possible.\n\nNumber of matching lines per file (70 files in total):\ndrivers/net/wireless/ath/ath11k/Kconfig:12\ndrivers/net/wireless/ath/ath11k/Makefile:14\ndrivers/net/wireless/ath/ath11k/ahb.c:255\ndrivers/net/wireless/ath/ath11k/ahb.h:5\ndrivers/net/wireless/ath/ath11k/ce.c:154\ndrivers/net/wireless/ath/ath11k/ce.h:30\ndrivers/net/wireless/ath/ath11k/cfr.c:154\ndrivers/net/wireless/ath/ath11k/cfr.h:54\ndrivers/net/wireless/ath/ath11k/core.c:472\ndrivers/net/wireless/ath/ath11k/core.h:195\ndrivers/net/wireless/ath/ath11k/coredump.c:9\ndrivers/net/wireless/ath/ath11k/coredump.h:10\ndrivers/net/wireless/ath/ath11k/dbring.c:63\ndrivers/net/wireless/ath/ath11k/dbring.h:28\ndrivers/net/wireless/ath/ath11k/debug.c:20\ndrivers/net/wireless/ath/ath11k/debug.h:18\ndrivers/net/wireless/ath/ath11k/debugfs.c:225\ndrivers/net/wireless/ath/ath11k/debugfs.h:48\ndrivers/net/wireless/ath/ath11k/debugfs_htt_stats.c:42\ndrivers/net/wireless/ath/ath11k/debugfs_htt_stats.h:6\ndrivers/net/wireless/ath/ath11k/debugfs_sta.c:101\ndrivers/net/wireless/ath/ath11k/debugfs_sta.h:8\ndrivers/net/wireless/ath/ath11k/dp.c:178\ndrivers/net/wireless/ath/ath11k/dp.h:46\ndrivers/net/wireless/ath/ath11k/dp_rx.c:794\ndrivers/net/wireless/ath/ath11k/dp_rx.h:33\ndrivers/net/wireless/ath/ath11k/dp_tx.c:139\ndrivers/net/wireless/ath/ath11k/dp_tx.h:14\ndrivers/net/wireless/ath/ath11k/fw.c:21\ndrivers/net/wireless/ath/ath11k/fw.h:4\ndrivers/net/wireless/ath/ath11k/hal.c:142\ndrivers/net/wireless/ath/ath11k/hal.h:38\ndrivers/net/wireless/ath/ath11k/hal_desc.h:13\ndrivers/net/wireless/ath/ath11k/hal_rx.c:81\ndrivers/net/wireless/ath/ath11k/hal_rx.h:19\ndrivers/net/wireless/ath/ath11k/hal_tx.c:10\ndrivers/net/wireless/ath/ath11k/hal_tx.h:5\ndrivers/net/wireless/ath/ath11k/hif.h:37\ndrivers/net/wireless/ath/ath11k/htc.c:130\ndrivers/net/wireless/ath/ath11k/htc.h:55\ndrivers/net/wireless/ath/ath11k/hw.c:443\ndrivers/net/wireless/ath/ath11k/hw.h:55\ndrivers/net/wireless/ath/ath11k/mac.c:1520\ndrivers/net/wireless/ath/ath11k/mac.h:40\ndrivers/net/wireless/ath/ath11k/mhi.c:81\ndrivers/net/wireless/ath/ath11k/mhi.h:9\ndrivers/net/wireless/ath/ath11k/p2p.c:24\ndrivers/net/wireless/ath/ath11k/p2p.h:7\ndrivers/net/wireless/ath/ath11k/pci.c:310\ndrivers/net/wireless/ath/ath11k/pci.h:8\n... and 20 more files\n\ndrivers/net/wireless/ath/ath11k/Kconfig=2=config ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-10-\ndrivers/net/wireless/ath/ath11k/Kconfig:11:\t If you choose to build a module, it'll be called ath11k.\ndrivers/net/wireless/ath/ath11k/Kconfig-12-\ndrivers/net/wireless/ath/ath11k/Kconfig=13=config ATH11K_AHB\ndrivers/net/wireless/ath/ath11k/Kconfig:14:\ttristate \"Atheros ath11k AHB support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-15-\tdepends on ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=23=config ATH11K_PCI\ndrivers/net/wireless/ath/ath11k/Kconfig:24:\ttristate \"Atheros ath11k PCI support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-25-\tdepends on ATH11K \u0026\u0026 PCI\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=33=config ATH11K_DEBUG\ndrivers/net/wireless/ath/ath11k/Kconfig:34:\tbool \"QCA ath11k debugging\"\ndrivers/net/wireless/ath/ath11k/Kconfig-35-\tdepends on ATH11K\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=41=config ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig:42:\tbool \"QCA ath11k debugfs support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-43-\tdepends on ATH11K \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-44-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:45:\t Enable ath11k debugfs support\ndrivers/net/wireless/ath/ath11k/Kconfig-46-\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=49=config ATH11K_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig:50:\tbool \"ath11k tracing support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-51-\tdepends on ATH11K \u0026\u0026 EVENT_TRACING\ndrivers/net/wireless/ath/ath11k/Kconfig-52-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:53:\t Select this to use ath11k tracing infrastructure.\ndrivers/net/wireless/ath/ath11k/Kconfig-54-\ndrivers/net/wireless/ath/ath11k/Kconfig=55=config ATH11K_SPECTRAL\ndrivers/net/wireless/ath/ath11k/Kconfig:56:\tbool \"QCA ath11k spectral scan support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-57-\tdepends on ATH11K_DEBUGFS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-59-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:60:\t Enable ath11k spectral scan support\ndrivers/net/wireless/ath/ath11k/Kconfig-61-\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=64=config ATH11K_CFR\ndrivers/net/wireless/ath/ath11k/Kconfig:65:\tbool \"ath11k channel frequency response support\"\ndrivers/net/wireless/ath/ath11k/Kconfig-66-\tdepends on ATH11K_DEBUGFS\n--\ndrivers/net/wireless/ath/ath11k/Kconfig-68-\thelp\ndrivers/net/wireless/ath/ath11k/Kconfig:69:\t Enable ath11k channel frequency response dump support.\ndrivers/net/wireless/ath/ath11k/Kconfig-70-\t This option exposes debugfs nodes that will allow the user\n--\ndrivers/net/wireless/ath/ath11k/Makefile-1-# SPDX-License-Identifier: BSD-3-Clause-Clear\ndrivers/net/wireless/ath/ath11k/Makefile:2:obj-$(CONFIG_ATH11K) += ath11k.o\ndrivers/net/wireless/ath/ath11k/Makefile:3:ath11k-y += core.o \\\ndrivers/net/wireless/ath/ath11k/Makefile-4-\t hal.o \\\n--\ndrivers/net/wireless/ath/ath11k/Makefile-23-\ndrivers/net/wireless/ath/ath11k/Makefile:24:ath11k-$(CONFIG_ATH11K_DEBUGFS) += debugfs.o debugfs_htt_stats.o debugfs_sta.o\ndrivers/net/wireless/ath/ath11k/Makefile:25:ath11k-$(CONFIG_NL80211_TESTMODE) += testmode.o\ndrivers/net/wireless/ath/ath11k/Makefile:26:ath11k-$(CONFIG_ATH11K_TRACING) += trace.o\ndrivers/net/wireless/ath/ath11k/Makefile:27:ath11k-$(CONFIG_THERMAL) += thermal.o\ndrivers/net/wireless/ath/ath11k/Makefile:28:ath11k-$(CONFIG_ATH11K_SPECTRAL) += spectral.o\ndrivers/net/wireless/ath/ath11k/Makefile:29:ath11k-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/ath/ath11k/Makefile:30:ath11k-$(CONFIG_DEV_COREDUMP) += coredump.o\ndrivers/net/wireless/ath/ath11k/Makefile:31:ath11k-$(CONFIG_ATH11K_CFR) += cfr.o\ndrivers/net/wireless/ath/ath11k/Makefile-32-\ndrivers/net/wireless/ath/ath11k/Makefile:33:obj-$(CONFIG_ATH11K_AHB) += ath11k_ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile:34:ath11k_ahb-y += ahb.o\ndrivers/net/wireless/ath/ath11k/Makefile-35-\ndrivers/net/wireless/ath/ath11k/Makefile:36:obj-$(CONFIG_ATH11K_PCI) += ath11k_pci.o\ndrivers/net/wireless/ath/ath11k/Makefile:37:ath11k_pci-y += mhi.o pci.o\ndrivers/net/wireless/ath/ath11k/Makefile-38-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-23-\ndrivers/net/wireless/ath/ath11k/ahb.c:24:static const struct of_device_id ath11k_ahb_of_match[] = {\ndrivers/net/wireless/ath/ath11k/ahb.c-25-\t/* TODO: Should we change the compatible string to something similar\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-42-\ndrivers/net/wireless/ath/ath11k/ahb.c:43:MODULE_DEVICE_TABLE(of, ath11k_ahb_of_match);\ndrivers/net/wireless/ath/ath11k/ahb.c-44-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=144=static int\ndrivers/net/wireless/ath/ath11k/ahb.c:145:ath11k_ahb_get_msi_irq_wcn6750(struct ath11k_base *ab, unsigned int vector)\ndrivers/net/wireless/ath/ath11k/ahb.c-146-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=150=static inline u32\ndrivers/net/wireless/ath/ath11k/ahb.c:151:ath11k_ahb_get_window_start_wcn6750(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-152-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=166=static void\ndrivers/net/wireless/ath/ath11k/ahb.c:167:ath11k_ahb_window_write32_wcn6750(struct ath11k_base *ab, u32 offset, u32 value)\ndrivers/net/wireless/ath/ath11k/ahb.c-168-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-171-\t/* WCN6750 uses static window based register access*/\ndrivers/net/wireless/ath/ath11k/ahb.c:172:\twindow_start = ath11k_ahb_get_window_start_wcn6750(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c-173-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-177-\ndrivers/net/wireless/ath/ath11k/ahb.c:178:static u32 ath11k_ahb_window_read32_wcn6750(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-179-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-183-\t/* WCN6750 uses static window based register access */\ndrivers/net/wireless/ath/ath11k/ahb.c:184:\twindow_start = ath11k_ahb_get_window_start_wcn6750(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c-185-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-190-\ndrivers/net/wireless/ath/ath11k/ahb.c:191:static const struct ath11k_pci_ops ath11k_ahb_pci_ops_wcn6750 = {\ndrivers/net/wireless/ath/ath11k/ahb.c-192-\t.wakeup = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c-193-\t.release = NULL,\ndrivers/net/wireless/ath/ath11k/ahb.c:194:\t.get_msi_irq = ath11k_ahb_get_msi_irq_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c:195:\t.window_write32 = ath11k_ahb_window_write32_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c:196:\t.window_read32 = ath11k_ahb_window_read32_wcn6750,\ndrivers/net/wireless/ath/ath11k/ahb.c-197-};\ndrivers/net/wireless/ath/ath11k/ahb.c-198-\ndrivers/net/wireless/ath/ath11k/ahb.c:199:static inline u32 ath11k_ahb_read32(struct ath11k_base *ab, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-200-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-203-\ndrivers/net/wireless/ath/ath11k/ahb.c:204:static inline void ath11k_ahb_write32(struct ath11k_base *ab, u32 offset, u32 value)\ndrivers/net/wireless/ath/ath11k/ahb.c-205-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-208-\ndrivers/net/wireless/ath/ath11k/ahb.c:209:static void ath11k_ahb_kill_tasklets(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-210-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-213-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:214:\t\tstruct ath11k_ce_pipe *ce_pipe = \u0026ab-\u003ece.ce_pipe[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-215-\ndrivers/net/wireless/ath/ath11k/ahb.c:216:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-217-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-222-\ndrivers/net/wireless/ath/ath11k/ahb.c:223:static void ath11k_ahb_ext_grp_disable(struct ath11k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath11k/ahb.c-224-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-230-\ndrivers/net/wireless/ath/ath11k/ahb.c:231:static void __ath11k_ahb_ext_irq_disable(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-232-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-235-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:236:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-237-\ndrivers/net/wireless/ath/ath11k/ahb.c:238:\t\tath11k_ahb_ext_grp_disable(irq_grp);\ndrivers/net/wireless/ath/ath11k/ahb.c-239-\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-247-\ndrivers/net/wireless/ath/ath11k/ahb.c:248:static void ath11k_ahb_ext_grp_enable(struct ath11k_ext_irq_grp *irq_grp)\ndrivers/net/wireless/ath/ath11k/ahb.c-249-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-255-\ndrivers/net/wireless/ath/ath11k/ahb.c:256:static void ath11k_ahb_setbit32(struct ath11k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-257-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-259-\ndrivers/net/wireless/ath/ath11k/ahb.c:260:\tval = ath11k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c:261:\tath11k_ahb_write32(ab, offset, val | BIT(bit));\ndrivers/net/wireless/ath/ath11k/ahb.c-262-}\ndrivers/net/wireless/ath/ath11k/ahb.c-263-\ndrivers/net/wireless/ath/ath11k/ahb.c:264:static void ath11k_ahb_clearbit32(struct ath11k_base *ab, u8 bit, u32 offset)\ndrivers/net/wireless/ath/ath11k/ahb.c-265-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-267-\ndrivers/net/wireless/ath/ath11k/ahb.c:268:\tval = ath11k_ahb_read32(ab, offset);\ndrivers/net/wireless/ath/ath11k/ahb.c:269:\tath11k_ahb_write32(ab, offset, val \u0026 ~BIT(bit));\ndrivers/net/wireless/ath/ath11k/ahb.c-270-}\ndrivers/net/wireless/ath/ath11k/ahb.c-271-\ndrivers/net/wireless/ath/ath11k/ahb.c:272:static void ath11k_ahb_ce_irq_enable(struct ath11k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath11k/ahb.c-273-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-283-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath11k/ahb.c:284:\t\tath11k_ahb_setbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c-285-\ndrivers/net/wireless/ath/ath11k/ahb.c-286-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath11k/ahb.c:287:\t\tath11k_ahb_setbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c:288:\t\tath11k_ahb_setbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath11k/ahb.c-289-\t\t\t\t ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-292-\ndrivers/net/wireless/ath/ath11k/ahb.c:293:static void ath11k_ahb_ce_irq_disable(struct ath11k_base *ab, u16 ce_id)\ndrivers/net/wireless/ath/ath11k/ahb.c-294-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-304-\tif (ce_attr-\u003esrc_nentries)\ndrivers/net/wireless/ath/ath11k/ahb.c:305:\t\tath11k_ahb_clearbit32(ab, ce_id, ie1_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c-306-\ndrivers/net/wireless/ath/ath11k/ahb.c-307-\tif (ce_attr-\u003edest_nentries) {\ndrivers/net/wireless/ath/ath11k/ahb.c:308:\t\tath11k_ahb_clearbit32(ab, ce_id, ie2_reg_addr);\ndrivers/net/wireless/ath/ath11k/ahb.c:309:\t\tath11k_ahb_clearbit32(ab, ce_id + CE_HOST_IE_3_SHIFT,\ndrivers/net/wireless/ath/ath11k/ahb.c-310-\t\t\t\t ie3_reg_addr);\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-313-\ndrivers/net/wireless/ath/ath11k/ahb.c:314:static void ath11k_ahb_sync_ce_irqs(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-315-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-319-\tfor (i = 0; i \u003c ab-\u003ehw_params.ce_count; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:320:\t\tif (ath11k_ce_get_attr_flags(ab, i) \u0026 CE_ATTR_DIS_INTR)\ndrivers/net/wireless/ath/ath11k/ahb.c-321-\t\t\tcontinue;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-327-\ndrivers/net/wireless/ath/ath11k/ahb.c:328:static void ath11k_ahb_sync_ext_irqs(struct ath11k_base *ab)\ndrivers/net/wireless/ath/ath11k/ahb.c-329-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-333-\tfor (i = 0; i \u003c ATH11K_EXT_IRQ_GRP_NUM_MAX; i++) {\ndrivers/net/wireless/ath/ath11k/ahb.c:334:\t\tstruct ath11k_ext_irq_grp *irq_grp = \u0026ab-\u003eext_irq_grp[i];\ndrivers/net/wireless/ath/ath11k/ahb.c-335-\n--\n\n"
} |
| 5/2 | 2026/10/30 02:55 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 11027 output: 42 thoughts: 22 Thoughts: Okay, here's my summary, tailored for an expert audience, as if I'm thinking these thoughts: **Analyzing ath11k PCI Device ID Matching** Alright, time to get to the heart of how ath11k is identifying PCI devices. I need to dive into `pci.c` specifically, because that's where the initial device probe and ID matching magic is likely happening. My focus is pin-pointing the exact logic or table that correlates specific PCI device IDs with the ath11k driver. I'm looking for the criteria it uses to determine if a given PCI device is a target for this particular driver. I need to understand this to confirm a device is supported. |
| 6/2 | 2026/10/30 02:55 | tool | grepper |
0mArgs:{
"Expression": "MODULE_DEVICE_TABLE\\(pci",
"PathPrefixes": [
"drivers/net/wireless/ath/ath11k/"
]
}Results: {
"Output": "drivers/net/wireless/ath/ath11k/pci.c=36=static const struct pci_device_id ath11k_pci_id_table[] = {\n--\ndrivers/net/wireless/ath/ath11k/pci.c-42-\ndrivers/net/wireless/ath/ath11k/pci.c:43:MODULE_DEVICE_TABLE(pci, ath11k_pci_id_table);\ndrivers/net/wireless/ath/ath11k/pci.c-44-\n"
} |
| 7/2 | 2026/10/30 02:55 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 11384 output: 44 thoughts: 17 Thoughts: Okay, let's dive into this. Here's my take on those lines around line 36 of `pci.c`: **Deep Dive into `pci.c` Line 36 (ish)** Alright, so the initial instruction tells me to focus on `pci.c` around line 36. My first thought is, depending on the kernel and device being probed, this could be anything. In my experience, line 36 often sits within an initializer, or perhaps a section where a key structure is populated, an interrupt setup, or even early device discovery. It's often close to the beginning of a function, perhaps a setup function, so the context is crucial. Given the potential context, I'm already mentally running through the probable kernel versions and their PCI initialization practices. Is this an older kernel using the legacy PCI interfaces, or something more modern with PCI Express support and device tree integration? Knowing the kernel version will change how I approach it. I'll need to keep in mind the possible architecture as well. I’m anticipating that it's likely a call to `pci_request_regions()`, `pci_enable_device()`, `pci_set_master()`, `pci_alloc_irq_vectors()`, or a similar fundamental PCI operation. More likely, line 36 is within some kind of probe function. I'll probably be able to determine what it does after a quick glimpse. From there, I'll assess how it's setting up resources, enabling the device, mapping memory, or claiming IRQs. I'm going to look for any potential areas of concern, like uninitialized variables or race conditions, or if the region allocation is done with the correct flags (IO resource, memory resource, and any relevant options like prefetchable or not). I'll keep in mind the implications of each function. So, I'm expecting some kind of basic setup. Let's see if the code confirms my expectations. |
| 8/2 | 2026/10/30 02:55 | tool | read-file |
0mArgs:{
"File": "drivers/net/wireless/ath/ath11k/pci.c",
"FirstLine": 25,
"LineCount": 30
}Results: {
"Contents": " 25:\t\n 26:\t#define TCSR_SOC_HW_VERSION\t\t0x0224\n 27:\t#define TCSR_SOC_HW_VERSION_MAJOR_MASK\tGENMASK(11, 8)\n 28:\t#define TCSR_SOC_HW_VERSION_MINOR_MASK\tGENMASK(7, 0)\n 29:\t\n 30:\t#define QCA6390_DEVICE_ID\t\t0x1101\n 31:\t#define QCN9074_DEVICE_ID\t\t0x1104\n 32:\t#define WCN6855_DEVICE_ID\t\t0x1103\n 33:\t\n 34:\t#define TCSR_SOC_HW_SUB_VER\t0x1910010\n 35:\t\n 36:\tstatic const struct pci_device_id ath11k_pci_id_table[] = {\n 37:\t\t{ PCI_VDEVICE(QCOM, QCA6390_DEVICE_ID) },\n 38:\t\t{ PCI_VDEVICE(QCOM, WCN6855_DEVICE_ID) },\n 39:\t\t{ PCI_VDEVICE(QCOM, QCN9074_DEVICE_ID) },\n 40:\t\t{}\n 41:\t};\n 42:\t\n 43:\tMODULE_DEVICE_TABLE(pci, ath11k_pci_id_table);\n 44:\t\n 45:\tstatic int ath11k_pci_bus_wake_up(struct ath11k_base *ab)\n 46:\t{\n 47:\t\tstruct ath11k_pci *ab_pci = ath11k_pci_priv(ab);\n 48:\t\n 49:\t\treturn mhi_device_get_sync(ab_pci-\u003emhi_ctrl-\u003emhi_dev);\n 50:\t}\n 51:\t\n 52:\tstatic void ath11k_pci_bus_release(struct ath11k_base *ab)\n 53:\t{\n 54:\t\tstruct ath11k_pci *ab_pci = ath11k_pci_priv(ab);\n"
} |
| 9/2 | 2026/10/30 02:55 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 12444 output: 40 thoughts: 759 Thoughts: **Analyzing the Accessibility of the `ath11k` Driver for Fuzzing** Okay, let's break this down. I'm looking at `ath11k`, a driver specifically for Qualcomm Wi-Fi chipsets like the QCA6390, WCN6855, and QCN9074. The initial observation is that it seems to be primarily designed for AHB and PCI interfaces on certain Qualcomm platforms, specifically ARM-based ones through device trees. Now, the key question for me is whether this is fuzzable, meaning whether I can test it without physically having the hardware. My first thought is, does QEMU emulate these Qualcomm `ath11k` devices? A quick check confirms that it doesn't. Okay, that's a hurdle, but let's dig deeper. Could I possibly use it through USB somehow? Checking the `Makefile`, it's clear the driver is built around AHB and PCI with specific object files like `ath11k_ahb.o` and `ath11k_pci.o`, which means no USB support. So, is there any other way to get at this driver, perhaps through some other emulated interface? What about using `mac80211_hwsim`? But `mac80211_hwsim` is a completely different beast - it's a software simulator, not a gateway into `ath11k`. They're separate. The question then becomes: can `syzkaller` even touch `ath11k` without physical hardware? I'm going to have to carefully consider the criteria for skipping a fuzzing target. It looks like "structurally unreachable hardware" is a potential red flag here. Specifically, "vendor-specific PCIe switches, SmartNICs, or GPU drivers...requiring physical ASIC/PCIe cards not emulated in standard QEMU". Is `ath11k` such a "vendor-specific" piece of hardware? Well, it's a driver for Qualcomm hardware, and, no matter how I look at it, this seems to depend on Qualcomm's wireless chipsets. It is looking increasingly likely that this fits the description of "unreachable" hardware. I need to confirm that no virtual or emulated mechanisms – no USB gadget, no virtio, nothing – can be used to interact with `ath11k`. I've already confirmed no USB support, and the PCI device IDs confirm: QCA6390, WCN6855, QCN9074. These are definitely Qualcomm wireless chipsets. Given that QEMU doesn't emulate the hardware, I'm stuck, it looks like this driver does not have a virtual hardware model. It seems like it's unlikely this driver can be reached without actual hardware, and I'll need to figure out how `ath11k_mac_update_vif_chan` gets called. I'm going to check the call sites to see if anything else is going on. |
| 10/2 | 2026/10/30 02:55 | tool | grepper |
0mArgs:{
"Expression": "ath11k_mac_update_vif_chan",
"PathPrefixes": [
"drivers/net/wireless/"
]
}Results: {
"Output": "drivers/net/wireless/ath/ath11k/mac.c=7786=static void\ndrivers/net/wireless/ath/ath11k/mac.c:7787:ath11k_mac_update_vif_chan(struct ath11k *ar,\ndrivers/net/wireless/ath/ath11k/mac.c-7788-\t\t\t struct ieee80211_vif_chanctx_switch *vifs,\n--\ndrivers/net/wireless/ath/ath11k/mac.c=7918=ath11k_mac_update_active_vif_chan(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/mac.c-7940-\ndrivers/net/wireless/ath/ath11k/mac.c:7941:\tath11k_mac_update_vif_chan(ar, arg.vifs, arg.n_vifs);\ndrivers/net/wireless/ath/ath11k/mac.c-7942-\n--\ndrivers/net/wireless/ath/ath11k/mac.c=8598=ath11k_mac_op_switch_vif_chanctx(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/ath/ath11k/mac.c-8609-\t\t n_vifs, mode);\ndrivers/net/wireless/ath/ath11k/mac.c:8610:\tath11k_mac_update_vif_chan(ar, vifs, n_vifs);\ndrivers/net/wireless/ath/ath11k/mac.c-8611-\n"
} |
| 11/2 | 2026/10/30 02:55 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 14326 output: 49 thoughts: 135 Thoughts: **Analyzing the Callers of `ath11k_mac_update_vif_chan`** Okay, so I'm digging into the ath11k driver's channel management and want to understand the calls to `ath11k_mac_update_vif_chan`. Based on the code, it's called from two places: `ath11k_mac_update_active_vif_chan` within `drivers/net/wireless/ath/ath11k/mac.c` and also from `ath11k_mac_op_switch_vif_chanctx`. The second one is particularly interesting as it is the `.switch_vif_chanctx` mac80211 callback. This means it's a critical entry point for channel context switching. I need to understand the control flow better, so the next step is to examine where `ath11k_mac_update_active_vif_chan` itself is called, as this is the direct path from the mac80211 core to this specific update function, and should indicate how/when active channels are changed. |
| 12/2 | 2026/10/30 02:55 | tool | grepper |
0mArgs:{
"Expression": "ath11k_mac_update_active_vif_chan",
"PathPrefixes": [
"drivers/net/wireless/ath/ath11k/"
]
}Results: {
"Output": "drivers/net/wireless/ath/ath11k/mac.c=7917=static void\ndrivers/net/wireless/ath/ath11k/mac.c:7918:ath11k_mac_update_active_vif_chan(struct ath11k *ar,\ndrivers/net/wireless/ath/ath11k/mac.c-7919-\t\t\t\t struct ieee80211_chanctx_conf *ctx)\n--\ndrivers/net/wireless/ath/ath11k/mac.c=7946=static void ath11k_mac_op_change_chanctx(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/ath/ath11k/mac.c-7966-\t changed \u0026 IEEE80211_CHANCTX_CHANGE_RADAR)\ndrivers/net/wireless/ath/ath11k/mac.c:7967:\t\tath11k_mac_update_active_vif_chan(ar, ctx);\ndrivers/net/wireless/ath/ath11k/mac.c-7968-\n"
} |
| 13/2 | 2026/10/30 02:55 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 15046 output: 36 thoughts: 235 Thoughts: **My Investigation into ath11k Channel Context Updates** Okay, so I'm trying to understand how channel context updates work within the `ath11k` driver, specifically focusing on `ath11k_mac_update_vif_chan`. It appears this function is exclusively called through `ath11k`'s mac80211 operations, namely `ath11k_mac_op_change_chanctx` and `ath11k_mac_op_switch_vif_chanctx`. That makes sense; these ops are the standard interface. But, the crucial point is that *both* of those operations demand a valid `struct ieee80211_hw` instance that's backed by the `ath11k` driver. Now, an `ath11k` instance, from my understanding, only comes into being when an `ath11k` device is successfully probed. So, I need to trace the probe path. Let's see how these devices are actually initialized. Looking at the `pci.c` file, I find `ath11k_pci_probe`, which is triggered by a PCI device. And over in `ahb.c`, there's `ath11k_ahb_probe`, suggesting support for AHB-based devices. Now, the question is, are those the *only* probe points? I need to be sure I haven't missed a potential entry point. It's time to thoroughly check the entire `ath11k` codebase for any other probing mechanisms. |
| 14/2 | 2026/10/30 02:56 | tool | grepper |
0mArgs:{
"Expression": "_probe",
"PathPrefixes": [
"drivers/net/wireless/ath/ath11k/"
]
}Results: {
"Output": "\nFull output is too long, showing 200 out of 202 lines.\nUse more precise expression or PathPrefixes if possible.\n\nNumber of matching lines per file (5 files in total):\ndrivers/net/wireless/ath/ath11k/ahb.c:3\ndrivers/net/wireless/ath/ath11k/mac.c:11\ndrivers/net/wireless/ath/ath11k/pci.c:2\ndrivers/net/wireless/ath/ath11k/wmi.c:19\ndrivers/net/wireless/ath/ath11k/wmi.h:14\n\ndrivers/net/wireless/ath/ath11k/ahb.c=835=static int ath11k_core_get_rproc(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-848-\tif (!prproc)\ndrivers/net/wireless/ath/ath11k/ahb.c:849:\t\treturn dev_err_probe(\u0026ab-\u003epdev-\u003edev, -EPROBE_DEFER, \"failed to get rproc\\n\");\ndrivers/net/wireless/ath/ath11k/ahb.c-850-\tab_ahb-\u003etgt_rproc = prproc;\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1111=static int ath11k_ahb_fw_resource_deinit(struct ath11k_base *ab)\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1145-\ndrivers/net/wireless/ath/ath11k/ahb.c:1146:static int ath11k_ahb_probe(struct platform_device *pdev)\ndrivers/net/wireless/ath/ath11k/ahb.c-1147-{\n--\ndrivers/net/wireless/ath/ath11k/ahb.c=1343=static struct platform_driver ath11k_ahb_driver = {\n--\ndrivers/net/wireless/ath/ath11k/ahb.c-1347-\t},\ndrivers/net/wireless/ath/ath11k/ahb.c:1348:\t.probe = ath11k_ahb_probe,\ndrivers/net/wireless/ath/ath11k/ahb.c-1349-\t.remove = ath11k_ahb_remove,\n--\ndrivers/net/wireless/ath/ath11k/mac.c=3319=static int ath11k_mac_fils_discovery(struct ath11k_vif *arvif,\n--\ndrivers/net/wireless/ath/ath11k/mac.c-3325-\tu32 interval;\ndrivers/net/wireless/ath/ath11k/mac.c:3326:\tbool unsol_bcast_probe_resp_enabled = false;\ndrivers/net/wireless/ath/ath11k/mac.c-3327-\n--\ndrivers/net/wireless/ath/ath11k/mac.c-3334-\t\t\t\t\t\t\t tmpl);\ndrivers/net/wireless/ath/ath11k/mac.c:3335:\t} else if (info-\u003eunsol_bcast_probe_resp_interval) {\ndrivers/net/wireless/ath/ath11k/mac.c:3336:\t\tunsol_bcast_probe_resp_enabled = 1;\ndrivers/net/wireless/ath/ath11k/mac.c:3337:\t\tinterval = info-\u003eunsol_bcast_probe_resp_interval;\ndrivers/net/wireless/ath/ath11k/mac.c-3338-\ndrivers/net/wireless/ath/ath11k/mac.c:3339:\t\ttmpl = ieee80211_get_unsol_bcast_probe_resp_tmpl(ar-\u003ehw,\ndrivers/net/wireless/ath/ath11k/mac.c-3340-\t\t\t\t\t\t\t\t arvif-\u003evif, 0);\ndrivers/net/wireless/ath/ath11k/mac.c-3341-\t\tif (tmpl)\ndrivers/net/wireless/ath/ath11k/mac.c:3342:\t\t\tret = ath11k_wmi_probe_resp_tmpl(ar, arvif-\u003evdev_id,\ndrivers/net/wireless/ath/ath11k/mac.c-3343-\t\t\t\t\t\t\t tmpl);\n--\ndrivers/net/wireless/ath/ath11k/mac.c-3350-\t\t\t \"mac vdev %i failed to retrieve %s template\\n\",\ndrivers/net/wireless/ath/ath11k/mac.c:3351:\t\t\t arvif-\u003evdev_id, (unsol_bcast_probe_resp_enabled ?\ndrivers/net/wireless/ath/ath11k/mac.c-3352-\t\t\t \"unsolicited broadcast probe response\" :\n--\ndrivers/net/wireless/ath/ath11k/mac.c-3359-\t\tret = ath11k_wmi_fils_discovery(ar, arvif-\u003evdev_id, interval,\ndrivers/net/wireless/ath/ath11k/mac.c:3360:\t\t\t\t\t\tunsol_bcast_probe_resp_enabled);\ndrivers/net/wireless/ath/ath11k/mac.c-3361-\n--\ndrivers/net/wireless/ath/ath11k/mac.c=4200=static int ath11k_mac_op_hw_scan(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/ath/ath11k/mac.c-4306-\tif (req-\u003eflags \u0026 NL80211_SCAN_FLAG_RANDOM_ADDR) {\ndrivers/net/wireless/ath/ath11k/mac.c:4307:\t\targ-\u003escan_f_add_spoofed_mac_in_probe = 1;\ndrivers/net/wireless/ath/ath11k/mac.c-4308-\t\tether_addr_copy(arg-\u003emac_addr.addr, req-\u003emac_addr);\n--\ndrivers/net/wireless/ath/ath11k/mac.c=6193=static int ath11k_mac_mgmt_tx_wmi(struct ath11k *ar, struct ath11k_vif *arvif,\n--\ndrivers/net/wireless/ath/ath11k/mac.c-6247-\tif (ar-\u003ecfr_enabled \u0026\u0026\ndrivers/net/wireless/ath/ath11k/mac.c:6248:\t ieee80211_is_probe_resp(hdr-\u003eframe_control) \u0026\u0026\ndrivers/net/wireless/ath/ath11k/mac.c-6249-\t peer_in_unassoc_pool)\n--\ndrivers/net/wireless/ath/ath11k/mac.c=6521=static void ath11k_mac_op_tx(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/ath/ath11k/mac.c-6547-\t} else if (ieee80211_is_mgmt(hdr-\u003eframe_control)) {\ndrivers/net/wireless/ath/ath11k/mac.c:6548:\t\tis_prb_rsp = ieee80211_is_probe_resp(hdr-\u003eframe_control);\ndrivers/net/wireless/ath/ath11k/mac.c-6549-\t\tret = ath11k_mac_mgmt_tx(ar, skb, is_prb_rsp);\n--\ndrivers/net/wireless/ath/ath11k/pci.c=940=static int ath11k_pci_set_irq_affinity_hint(struct ath11k_pci *ab_pci,\n--\ndrivers/net/wireless/ath/ath11k/pci.c-948-\ndrivers/net/wireless/ath/ath11k/pci.c:949:static int ath11k_pci_probe(struct pci_dev *pdev,\ndrivers/net/wireless/ath/ath11k/pci.c-950-\t\t\t const struct pci_device_id *pci_dev)\n--\ndrivers/net/wireless/ath/ath11k/pci.c=1296=static struct pci_driver ath11k_pci_driver = {\n--\ndrivers/net/wireless/ath/ath11k/pci.c-1298-\t.id_table = ath11k_pci_id_table,\ndrivers/net/wireless/ath/ath11k/pci.c:1299:\t.probe = ath11k_pci_probe,\ndrivers/net/wireless/ath/ath11k/pci.c-1300-\t.remove = ath11k_pci_remove,\n--\ndrivers/net/wireless/ath/ath11k/wmi.c=93=static const struct wmi_tlv_policy wmi_tlv_policies[] = {\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-146-\t[WMI_TAG_OFFLOAD_PRB_RSP_TX_STATUS_EVENT] = {\ndrivers/net/wireless/ath/ath11k/wmi.c:147:\t\t.min_len = sizeof(struct wmi_probe_resp_tx_status_event) },\ndrivers/net/wireless/ath/ath11k/wmi.c-148-\t[WMI_TAG_VDEV_DELETE_RESP_EVENT] = {\n--\ndrivers/net/wireless/ath/ath11k/wmi.c=2146=void ath11k_wmi_start_scan_init(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-2161-\targ-\u003emax_rest_time = 500;\ndrivers/net/wireless/ath/ath11k/wmi.c:2162:\targ-\u003erepeat_probe_time = 0;\ndrivers/net/wireless/ath/ath11k/wmi.c-2163-\targ-\u003eprobe_spacing_time = 0;\n--\ndrivers/net/wireless/ath/ath11k/wmi.c=2188=ath11k_wmi_copy_scan_event_cntrl_flags(struct wmi_start_scan_cmd *cmd,\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-2236-\t\tcmd-\u003escan_ctrl_flags |= WMI_SCAN_FILTER_PROBE_REQ;\ndrivers/net/wireless/ath/ath11k/wmi.c:2237:\tif (param-\u003escan_f_bcast_probe)\ndrivers/net/wireless/ath/ath11k/wmi.c-2238-\t\tcmd-\u003escan_ctrl_flags |= WMI_SCAN_ADD_BCAST_PROBE_REQ;\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-2244-\t\tcmd-\u003escan_ctrl_flags |= WMI_SCAN_FLAG_FORCE_ACTIVE_ON_DFS;\ndrivers/net/wireless/ath/ath11k/wmi.c:2245:\tif (param-\u003escan_f_add_tpc_ie_in_probe)\ndrivers/net/wireless/ath/ath11k/wmi.c-2246-\t\tcmd-\u003escan_ctrl_flags |= WMI_SCAN_ADD_TPC_IE_IN_PROBE_REQ;\ndrivers/net/wireless/ath/ath11k/wmi.c:2247:\tif (param-\u003escan_f_add_ds_ie_in_probe)\ndrivers/net/wireless/ath/ath11k/wmi.c-2248-\t\tcmd-\u003escan_ctrl_flags |= WMI_SCAN_ADD_DS_IE_IN_PROBE_REQ;\ndrivers/net/wireless/ath/ath11k/wmi.c:2249:\tif (param-\u003escan_f_add_spoofed_mac_in_probe)\ndrivers/net/wireless/ath/ath11k/wmi.c-2250-\t\tcmd-\u003escan_ctrl_flags |= WMI_SCAN_ADD_SPOOF_MAC_IN_PROBE_REQ;\ndrivers/net/wireless/ath/ath11k/wmi.c:2251:\tif (param-\u003escan_f_add_rand_seq_in_probe)\ndrivers/net/wireless/ath/ath11k/wmi.c-2252-\t\tcmd-\u003escan_ctrl_flags |= WMI_SCAN_RANDOM_SEQ_NO_IN_PROBE_REQ;\ndrivers/net/wireless/ath/ath11k/wmi.c:2253:\tif (param-\u003escan_f_en_ie_whitelist_in_probe)\ndrivers/net/wireless/ath/ath11k/wmi.c-2254-\t\tcmd-\u003escan_ctrl_flags |=\n--\ndrivers/net/wireless/ath/ath11k/wmi.c=2264=int ath11k_wmi_send_scan_start_cmd(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-2332-\tcmd-\u003emax_rest_time = params-\u003emax_rest_time;\ndrivers/net/wireless/ath/ath11k/wmi.c:2333:\tcmd-\u003erepeat_probe_time = params-\u003erepeat_probe_time;\ndrivers/net/wireless/ath/ath11k/wmi.c-2334-\tcmd-\u003eprobe_spacing_time = params-\u003eprobe_spacing_time;\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-2342-\tcmd-\u003eie_len = params-\u003eextraie.len;\ndrivers/net/wireless/ath/ath11k/wmi.c:2343:\tcmd-\u003en_probes = params-\u003en_probes;\ndrivers/net/wireless/ath/ath11k/wmi.c-2344-\tether_addr_copy(cmd-\u003emac_addr.addr, params-\u003emac_addr.addr);\n--\ndrivers/net/wireless/ath/ath11k/wmi.c=3965=int ath11k_wmi_peer_set_cfr_capture_conf(struct ath11k *ar,\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-4005-\ndrivers/net/wireless/ath/ath11k/wmi.c:4006:int ath11k_wmi_probe_resp_tmpl(struct ath11k *ar, u32 vdev_id,\ndrivers/net/wireless/ath/ath11k/wmi.c-4007-\t\t\t struct sk_buff *tmpl)\ndrivers/net/wireless/ath/ath11k/wmi.c-4008-{\ndrivers/net/wireless/ath/ath11k/wmi.c:4009:\tstruct wmi_probe_tmpl_cmd *cmd;\ndrivers/net/wireless/ath/ath11k/wmi.c-4010-\tstruct wmi_bcn_prb_info *probe_info;\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-4025-\ndrivers/net/wireless/ath/ath11k/wmi.c:4026:\tcmd = (struct wmi_probe_tmpl_cmd *)skb-\u003edata;\ndrivers/net/wireless/ath/ath11k/wmi.c-4027-\tcmd-\u003etlv_header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_PRB_TMPL_CMD) |\n--\ndrivers/net/wireless/ath/ath11k/wmi.c=4063=int ath11k_wmi_fils_discovery(struct ath11k *ar, u32 vdev_id, u32 interval,\ndrivers/net/wireless/ath/ath11k/wmi.c:4064:\t\t\t bool unsol_bcast_probe_resp_enabled)\ndrivers/net/wireless/ath/ath11k/wmi.c-4065-{\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-4071-\t\t \"vdev %i set %s interval to %u TU\\n\",\ndrivers/net/wireless/ath/ath11k/wmi.c:4072:\t\t vdev_id, unsol_bcast_probe_resp_enabled ?\ndrivers/net/wireless/ath/ath11k/wmi.c-4073-\t\t \"unsolicited broadcast probe response\" : \"FILS discovery\",\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-4085-\tcmd-\u003einterval = interval;\ndrivers/net/wireless/ath/ath11k/wmi.c:4086:\tcmd-\u003econfig = unsol_bcast_probe_resp_enabled;\ndrivers/net/wireless/ath/ath11k/wmi.c-4087-\n--\ndrivers/net/wireless/ath/ath11k/wmi.c=8544=static void ath11k_fils_discovery_event(struct ath11k_base *ab,\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-8575-\ndrivers/net/wireless/ath/ath11k/wmi.c:8576:static void ath11k_probe_resp_tx_status_event(struct ath11k_base *ab,\ndrivers/net/wireless/ath/ath11k/wmi.c-8577-\t\t\t\t\t struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-8579-\tconst void **tb;\ndrivers/net/wireless/ath/ath11k/wmi.c:8580:\tconst struct wmi_probe_resp_tx_status_event *ev;\ndrivers/net/wireless/ath/ath11k/wmi.c-8581-\tint ret;\n--\ndrivers/net/wireless/ath/ath11k/wmi.c=8928=static void ath11k_wmi_tlv_op_rx(struct ath11k_base *ab, struct sk_buff *skb)\n--\ndrivers/net/wireless/ath/ath11k/wmi.c-9027-\tcase WMI_OFFLOAD_PROB_RESP_TX_STATUS_EVENTID:\ndrivers/net/wireless/ath/ath11k/wmi.c:9028:\t\tath11k_probe_resp_tx_status_event(ab, skb);\ndrivers/net/wireless/ath/ath11k/wmi.c-9029-\t\tbreak;\n--\ndrivers/net/wireless/ath/ath11k/wmi.h=3278=struct wmi_start_scan_cmd {\n--\ndrivers/net/wireless/ath/ath11k/wmi.h-3288-\tu32 max_rest_time;\ndrivers/net/wireless/ath/ath11k/wmi.h:3289:\tu32 repeat_probe_time;\ndrivers/net/wireless/ath/ath11k/wmi.h-3290-\tu32 probe_spacing_time;\n--\ndrivers/net/wireless/ath/ath11k/wmi.h-3299-\tu32 ie_len;\ndrivers/net/wireless/ath/ath11k/wmi.h:3300:\tu32 n_probes;\ndrivers/net/wireless/ath/ath11k/wmi.h-3301-\tstruct wmi_mac_addr mac_addr;\n--\ndrivers/net/wireless/ath/ath11k/wmi.h=3363=struct scan_req_params {\n--\ndrivers/net/wireless/ath/ath11k/wmi.h-3389-\tu32 max_rest_time;\ndrivers/net/wireless/ath/ath11k/wmi.h:3390:\tu32 repeat_probe_time;\ndrivers/net/wireless/ath/ath11k/wmi.h-3391-\tu32 probe_spacing_time;\n--\ndrivers/net/wireless/ath/ath11k/wmi.h-3395-\tu32 scan_f_passive:1,\ndrivers/net/wireless/ath/ath11k/wmi.h:3396:\t scan_f_bcast_probe:1,\ndrivers/net/wireless/ath/ath11k/wmi.h-3397-\t scan_f_cck_rates:1,\n--\ndrivers/net/wireless/ath/ath11k/wmi.h-3410-\t scan_f_force_active_dfs_chn:1,\ndrivers/net/wireless/ath/ath11k/wmi.h:3411:\t scan_f_add_tpc_ie_in_probe:1,\ndrivers/net/wireless/ath/ath11k/wmi.h:3412:\t scan_f_add_ds_ie_in_probe:1,\ndrivers/net/wireless/ath/ath11k/wmi.h:3413:\t scan_f_add_spoofed_mac_in_probe:1,\ndrivers/net/wireless/ath/ath11k/wmi.h:3414:\t scan_f_add_rand_seq_in_probe:1,\ndrivers/net/wireless/ath/ath11k/wmi.h:3415:\t scan_f_en_ie_whitelist_in_probe:1,\ndrivers/net/wireless/ath/ath11k/wmi.h-3416-\t scan_f_forced:1,\n--\ndrivers/net/wireless/ath/ath11k/wmi.h-3424-\tu32 num_ssids;\ndrivers/net/wireless/ath/ath11k/wmi.h:3425:\tu32 n_probes;\ndrivers/net/wireless/ath/ath11k/wmi.h-3426-\tu32 notify_scan_events;\n--\ndrivers/net/wireless/ath/ath11k/wmi.h=4678=struct wmi_fils_discovery_event {\n--\ndrivers/net/wireless/ath/ath11k/wmi.h-4683-\ndrivers/net/wireless/ath/ath11k/wmi.h:4684:struct wmi_probe_resp_tx_status_event {\ndrivers/net/wireless/ath/ath11k/wmi.h-4685-\tu32 vdev_id;\n--\ndrivers/net/wireless/ath/ath11k/wmi.h=5733=struct wmi_fils_discovery_tmpl_cmd {\n--\ndrivers/net/wireless/ath/ath11k/wmi.h-5738-\ndrivers/net/wireless/ath/ath11k/wmi.h:5739:struct wmi_probe_tmpl_cmd {\ndrivers/net/wireless/ath/ath11k/wmi.h-5740-\tu32 tlv_header;\n--\ndrivers/net/wireless/ath/ath11k/wmi.h=6586=int ath11k_wmi_fils_discovery(struct ath11k *ar, u32 vdev_id, u32 interval,\ndrivers/net/wireless/ath/ath11k/wmi.h:6587:\t\t\t bool unsol_bcast_probe_resp_enabled);\n\n"
} |
| 15/2 | 2026/10/30 02:56 | llm | patch-evaluator |
0mModel:gemini-3.8-flash Args: null Results: null Tokens: input: 21696 output: 144 thoughts: 1600 Thoughts: **Ath11k Fuzzing Feasibility Assessment** Okay, let's assess whether syzkaller can effectively target the `ath11k` driver. My initial thought is to check if it has descriptions or supports it at all. Then, I remember the crucial caveat: "structurally unreachable hardware," specifically vendor-specific PCIe cards requiring physical ASICs. This immediately raises a red flag. Does `ath11k` fall into that category? Yes, unfortunately, it does. `ath11k` targets specific Qualcomm hardware: QCA6390, WCN6855, QCN9074 (PCIe), and Qualcomm SoC (AHB). Can we emulate any of this hardware in a standard QEMU setup? No, definitely not. What about other wireless devices that we can fuzz with syzkaller? `mac80211_hwsim` is a possibility (virtual mac80211 hardware simulator), and syzkaller's USB emulation handles USB wifi dongles. But does `ath11k` support USB? No, I remember that only `ath9k_htc` has USB support. `ath10k` and `ath11k` are based around either PCI or AHB. To be absolutely sure, I'll quickly check the files in `drivers/net/wireless/ath/ath11k/`. After quickly scanning them, it becomes clear: there's no USB driver here; the implementation is focused solely on `ath11k_pci.c` and `ath11k_ahb.c`. A closer look at `pci.c` confirms the requirement for specific PCI vendor and device IDs linked to Qualcomm (0x17cb/0x1101, 0x1103, 0x1104, etc.) devices. Moreover, `ath11k` relies on Qualcomm's MHI bus for communication with firmware on the modem and uses QMI. Neither QEMU nor Google Compute Engine (GCE) emulates these crucial Qualcomm components. Therefore, in a typical virtualized environment, `ath11k` can't even probe, let alone instantiate its core structure or call into `ath11k_mac_update_vif_chan()`. Reviewing the fuzzing criteria reinforces this conclusion: only code accessible via virtual buses is considered worthwhile. `ath11k` is explicitly not accessible through virtual buses (no USB, virtio, loopback, etc.). It needs the actual Qualcomm hardware. Given all of this, the modified code is *structurally unreachable* in the standard fuzzing environment. Thus, the fuzzing is not worthwhile. The `WorthFuzzing` value must be `false`. To make the reasoning clear, I'll explain: The patch changes `ath11k_mac_update_vif_chan()` in `drivers/net/wireless/ath/ath11k/mac.c`. `ath11k` is specifically for Qualcomm's 802.11ax PCIe and AHB chips, requiring physical hardware and Qualcomm firmware. Because this hardware is not emulated in standard QEMU or GCE virtual environments, the code can't be reached or executed during fuzzing (structurally unreachable hardware). I will use this reasoning to set the results. |
| 16/2 | 2026/10/30 02:56 | tool | set-results |
0mArgs:{
"EnableConfigs": [],
"FocusSymbols": [],
"Reasoning": "The patch modifies ath11k_mac_update_vif_chan() in drivers/net/wireless/ath/ath11k/mac.c. ath11k is a driver for Qualcomm 802.11ax wireless devices, connecting exclusively via PCIe or Qualcomm AHB (platform bus) and relying on Qualcomm MHI/QMI firmware communication. It requires physical Qualcomm hardware that is not emulated in standard QEMU or GCE virtualized environments, making this code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
}Results: {
"EnableConfigs": null,
"FocusSymbols": [],
"Reasoning": "The patch modifies ath11k_mac_update_vif_chan() in drivers/net/wireless/ath/ath11k/mac.c. ath11k is a driver for Qualcomm 802.11ax wireless devices, connecting exclusively via PCIe or Qualcomm AHB (platform bus) and relying on Qualcomm MHI/QMI firmware communication. It requires physical Qualcomm hardware that is not emulated in standard QEMU or GCE virtualized environments, making this code structurally unreachable for syzkaller fuzzing.",
"WorthFuzzing": false
} |
| 17/1 | 2026/10/30 02:56 | action | If |
0mArgs:{
"WorthFuzzing": false
}Results: null |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|