AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/09/25 13:44 flow patch-triage
1m Args:
null

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies amd_mp2_irq_isr and amd_mp2_unregister_cb in drivers/i2c/busses/i2c-amd-mp2-pci.c. This driver supports the AMD MP2 PCIe I2C controller (PCI ID 1022:15e6), which is vendor-specific physical hardware not emulated in standard virtualized environments (QEMU or GCE). Consequently, the modified interrupt service routine and unregister callback are structurally unreachable during fuzzing.",
  "WorthFuzzing": false
}

1/1 2026/09/25 13:44 action read-patch-diff
0m Args:
null

Results:
{
  "PatchDiff": "commit 0045db9d5a9520258c5cbfbdd4f90c69024c28cc\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Fri Sep 25 13:44:51 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/i2c/busses/i2c-amd-mp2-pci.c b/drivers/i2c/busses/i2c-amd-mp2-pci.c\nindex 60edbabc2986b..8c81247806ece 100644\n--- a/drivers/i2c/busses/i2c-amd-mp2-pci.c\n+++ b/drivers/i2c/busses/i2c-amd-mp2-pci.c\n@@ -209,7 +209,7 @@ static irqreturn_t amd_mp2_irq_isr(int irq, void *dev)\n \tenum irqreturn ret = IRQ_NONE;\n \n \tfor (bus_id = 0; bus_id \u003c 2; bus_id++) {\n-\t\ti2c_common = privdata-\u003ebusses[bus_id];\n+\t\ti2c_common = READ_ONCE(privdata-\u003ebusses[bus_id]);\n \t\tif (!i2c_common)\n \t\t\tcontinue;\n \n@@ -268,7 +268,9 @@ int amd_mp2_unregister_cb(struct amd_i2c_common *i2c_common)\n {\n \tstruct amd_mp2_dev *privdata = i2c_common-\u003emp2_dev;\n \n-\tprivdata-\u003ebusses[i2c_common-\u003ebus_id] = NULL;\n+\tWRITE_ONCE(privdata-\u003ebusses[i2c_common-\u003ebus_id], NULL);\n+\n+\tsynchronize_irq(privdata-\u003edev_irq);\n \n \treturn 0;\n }\n"
}

2/1 2026/09/25 13:44 agent patch-evaluator
1m Model:
core

Args:
null

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies amd_mp2_irq_isr and amd_mp2_unregister_cb in drivers/i2c/busses/i2c-amd-mp2-pci.c. This driver supports the AMD MP2 PCIe I2C controller (PCI ID 1022:15e6), which is vendor-specific physical hardware not emulated in standard virtualized environments (QEMU or GCE). Consequently, the modified interrupt service routine and unregister callback are structurally unreachable during fuzzing.",
  "WorthFuzzing": false
}

Instruction:
You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt:
Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 0045db9d5a9520258c5cbfbdd4f90c69024c28cc
Author: syz-cluster <triage@syzkaller.com>
Date:   Fri Sep 25 13:44:51 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/i2c/busses/i2c-amd-mp2-pci.c b/drivers/i2c/busses/i2c-amd-mp2-pci.c
index 60edbabc2986b..8c81247806ece 100644
--- a/drivers/i2c/busses/i2c-amd-mp2-pci.c
+++ b/drivers/i2c/busses/i2c-amd-mp2-pci.c
@@ -209,7 +209,7 @@ static irqreturn_t amd_mp2_irq_isr(int irq, void *dev)
 	enum irqreturn ret = IRQ_NONE;
 
 	for (bus_id = 0; bus_id < 2; bus_id++) {
-		i2c_common = privdata->busses[bus_id];
+		i2c_common = READ_ONCE(privdata->busses[bus_id]);
 		if (!i2c_common)
 			continue;
 
@@ -268,7 +268,9 @@ int amd_mp2_unregister_cb(struct amd_i2c_common *i2c_common)
 {
 	struct amd_mp2_dev *privdata = i2c_common->mp2_dev;
 
-	privdata->busses[i2c_common->bus_id] = NULL;
+	WRITE_ONCE(privdata->busses[i2c_common->bus_id], NULL);
+
+	synchronize_irq(privdata->dev_irq);
 
 	return 0;
 }

3/2 2026/09/25 13:44 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 3084
							output: 32
							thoughts: 465
						

Thoughts:
**Patch Triage: i2c-amd-mp2-pci.c**

Okay, let's get down to business. I need to evaluate this patch for `drivers/i2c/busses/i2c-amd-mp2-pci.c`. My immediate concern, as always, is whether this introduces any immediate, high-severity cyber offensive risks. Since this is for syzkaller fuzzing triage and Linux kernel QA/security engineering, the priority here is bug finding, so I need to check the code for any potentially exploitable issues. I see that this is a benign patch from a QA/developer perspective.

Now, let's dive into the code itself. Examining the diff, the changes seem straightforward. In `amd_mp2_irq_isr`, the code changes `i2c_common = privdata->busses[bus_id];` to `i2c_common = READ_ONCE(privdata->busses[bus_id]);`. In `amd_mp2_unregister_cb`, `privdata->busses[i2c_common->bus_id] = NULL;` is replaced with `WRITE_ONCE(privdata->busses[i2c_common->bus_id], NULL);` and `synchronize_irq(privdata->dev_irq);` is added. The introduction of `READ_ONCE` and `WRITE_ONCE` suggests a potential concurrency issue or memory model issue. This is exactly the sort of thing I'm looking for in fuzzing triage. The added `synchronize_irq` further points to the removal of a race condition.

I need to understand this code's context thoroughly. To ensure I'm getting the complete picture, I'm going to run `read-file` and/or `grepper` to inspect `drivers/i2c/busses/i2c-amd-mp2-pci.c` and its surrounding context, paying close attention to its Kconfig and how these `busses` are used and accessed. That will help me understand the potential implications of these changes and whether they effectively eliminate a race.



4/2 2026/09/25 13:45 tool grepper
0m Args:
{
  "Expression": "AMD_MP2",
  "PathPrefix": "drivers/i2c/busses"
}

Results:
{
  "Output": "drivers/i2c/busses/Kconfig=65=config I2C_AMD8111\n--\ndrivers/i2c/busses/Kconfig-74-\ndrivers/i2c/busses/Kconfig:75:config I2C_AMD_MP2\ndrivers/i2c/busses/Kconfig-76-\ttristate \"AMD MP2 PCIe\"\n--\ndrivers/i2c/busses/Makefile=37=obj-$(CONFIG_I2C_ALTERA)\t+= i2c-altera.o\ndrivers/i2c/busses/Makefile:38:obj-$(CONFIG_I2C_AMD_MP2)\t+= i2c-amd-mp2-pci.o i2c-amd-mp2-plat.o\ndrivers/i2c/busses/Makefile-39-obj-$(CONFIG_I2C_AMD_ASF)\t+= i2c-amd-asf-plat.o\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c=440=static const struct pci_device_id amd_mp2_pci_tbl[] = {\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:441:\t{PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_MP2)},\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-442-\t{0}\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-20-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:21:#define AMD_MP2_I2C_MAX_RW_LENGTH ((1 \u003c\u003c 12) - 1)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-22-#define AMD_I2C_TIMEOUT (msecs_to_jiffies(250))\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c=240=static const struct i2c_adapter_quirks amd_i2c_dev_quirks = {\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:241:\t.max_read_len = AMD_MP2_I2C_MAX_RW_LENGTH,\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:242:\t.max_write_len = AMD_MP2_I2C_MAX_RW_LENGTH,\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-243-};\n--\ndrivers/i2c/busses/i2c-amd-mp2.h-15-\ndrivers/i2c/busses/i2c-amd-mp2.h:16:#define PCI_DEVICE_ID_AMD_MP2\t0x15E6\ndrivers/i2c/busses/i2c-amd-mp2.h-17-\n"
}

5/2 2026/09/25 13:45 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 4822
							output: 38
							thoughts: 27
						

Thoughts:
Okay, let's dive into this. Here's my take on those lines from the Kconfig file:

**Navigating the I2C Driver Landscape: A Kconfig Dive**

Alright, I'm going to pull up the `drivers/i2c/busses/Kconfig` file and zero in on the area around line 75. My initial thought is that this section likely deals with a specific I2C bus driver, perhaps a common one or a driver for a particular platform. I expect to see `config` options, `depends on` statements, maybe some help text, and possibly some default configurations. The goal is to get a feel for how this particular driver fits into the larger I2C framework, its dependencies on other components, and what configuration options are available to tailor its behavior. I’m keen to see if this area defines new features or configurations and to understand how these integrate with the other features. I’ll be looking for any hints about performance characteristics or potential areas for optimization within this driver. Knowing the context of this configuration helps to better understand where and how the I2C bus features can be adapted.



6/2 2026/09/25 13:45 tool read-file
0m Args:
{
  "File": "drivers/i2c/busses/Kconfig",
  "FirstLine": 70,
  "LineCount": 25
}

Results:
{
  "Contents": "  70:\t\t  second (SMBus 2.0) AMD 8111 mainboard I2C interface.\n  71:\t\n  72:\t\t  This driver can also be built as a module.  If so, the module\n  73:\t\t  will be called i2c-amd8111.\n  74:\t\n  75:\tconfig I2C_AMD_MP2\n  76:\t\ttristate \"AMD MP2 PCIe\"\n  77:\t\tdepends on PCI \u0026\u0026 ACPI\n  78:\t\thelp\n  79:\t\t  If you say yes to this option, support will be included for the AMD\n  80:\t\t  MP2 PCIe I2C adapter.\n  81:\t\n  82:\t\t  This driver can also be built as modules.  If so, the modules will\n  83:\t\t  be called i2c-amd-mp2-pci and i2c-amd-mp2-plat.\n  84:\t\n  85:\tconfig I2C_AMD_ASF\n  86:\t\ttristate \"AMD ASF I2C Controller Support\"\n  87:\t\tdepends on I2C_PIIX4\n  88:\t\tselect I2C_SLAVE\n  89:\t\thelp\n  90:\t\t  This option enables support for the AMD ASF (Alert Standard Format)\n  91:\t\t  I2C controller. The AMD ASF controller is an SMBus controller with\n  92:\t\t  built-in ASF functionality, allowing it to issue generic SMBus\n  93:\t\t  packets and communicate with the DASH controller using MCTP over\n  94:\t\t  ASF.\n"
}

7/2 2026/09/25 13:45 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 5533
							output: 50
							thoughts: 72
						

Thoughts:
Here's my summary, as though I'm thinking through this myself:

**Investigating the i2c-amd-mp2-pci Driver**

Okay, time to dig into the `i2c-amd-mp2-pci.c` driver. I need to get a better handle on how it's functioning. Let me start by homing in on some key sections. I'll focus on lines roughly around 200 to 280, and then jump down to the area from approximately lines 400 to 470. That should give me a good initial view of its core operations, probably covering initialization or transaction handling – that's often where the meat of these drivers resides. I'll be looking for register access patterns and interrupt handling. Time to dive in.



8/2 2026/09/25 13:45 tool read-file
0m Args:
{
  "File": "drivers/i2c/busses/i2c-amd-mp2-pci.c",
  "FirstLine": 195,
  "LineCount": 85
}

Results:
{
  "Contents": " 195:\t\n 196:\t\ti2c_common-\u003ereqcmd = i2c_none;\n 197:\t\tamd_mp2_c2p_mutex_unlock(i2c_common);\n 198:\t}\n 199:\tEXPORT_SYMBOL_GPL(amd_mp2_process_event);\n 200:\t\n 201:\tstatic irqreturn_t amd_mp2_irq_isr(int irq, void *dev)\n 202:\t{\n 203:\t\tstruct amd_mp2_dev *privdata = dev;\n 204:\t\tstruct pci_dev *pdev = privdata-\u003epci_dev;\n 205:\t\tstruct amd_i2c_common *i2c_common;\n 206:\t\tu32 val;\n 207:\t\tunsigned int bus_id;\n 208:\t\tvoid __iomem *reg;\n 209:\t\tenum irqreturn ret = IRQ_NONE;\n 210:\t\n 211:\t\tfor (bus_id = 0; bus_id \u003c 2; bus_id++) {\n 212:\t\t\ti2c_common = READ_ONCE(privdata-\u003ebusses[bus_id]);\n 213:\t\t\tif (!i2c_common)\n 214:\t\t\t\tcontinue;\n 215:\t\n 216:\t\t\treg = privdata-\u003emmio + ((bus_id == 0) ?\n 217:\t\t\t\t\t\tAMD_P2C_MSG1 : AMD_P2C_MSG2);\n 218:\t\t\tval = readl(reg);\n 219:\t\t\tif (val != 0) {\n 220:\t\t\t\twritel(0, reg);\n 221:\t\t\t\twritel(0, privdata-\u003emmio + AMD_P2C_MSG_INTEN);\n 222:\t\t\t\ti2c_common-\u003eeventval.ul = val;\n 223:\t\t\t\ti2c_common-\u003ecmd_completion(i2c_common);\n 224:\t\n 225:\t\t\t\tret = IRQ_HANDLED;\n 226:\t\t\t}\n 227:\t\t}\n 228:\t\n 229:\t\tif (ret != IRQ_HANDLED) {\n 230:\t\t\tval = readl(privdata-\u003emmio + AMD_P2C_MSG_INTEN);\n 231:\t\t\tif (val != 0) {\n 232:\t\t\t\twritel(0, privdata-\u003emmio + AMD_P2C_MSG_INTEN);\n 233:\t\t\t\tpci_warn(pdev, \"received irq without message\\n\");\n 234:\t\t\t\tret = IRQ_HANDLED;\n 235:\t\t\t}\n 236:\t\t}\n 237:\t\n 238:\t\treturn ret;\n 239:\t}\n 240:\t\n 241:\tvoid amd_mp2_rw_timeout(struct amd_i2c_common *i2c_common)\n 242:\t{\n 243:\t\ti2c_common-\u003ereqcmd = i2c_none;\n 244:\t\tamd_mp2_c2p_mutex_unlock(i2c_common);\n 245:\t}\n 246:\tEXPORT_SYMBOL_GPL(amd_mp2_rw_timeout);\n 247:\t\n 248:\tint amd_mp2_register_cb(struct amd_i2c_common *i2c_common)\n 249:\t{\n 250:\t\tstruct amd_mp2_dev *privdata = i2c_common-\u003emp2_dev;\n 251:\t\tstruct pci_dev *pdev = privdata-\u003epci_dev;\n 252:\t\n 253:\t\tif (i2c_common-\u003ebus_id \u003e 1)\n 254:\t\t\treturn -EINVAL;\n 255:\t\n 256:\t\tif (privdata-\u003ebusses[i2c_common-\u003ebus_id]) {\n 257:\t\t\tpci_err(pdev, \"Bus %d already taken!\\n\", i2c_common-\u003ebus_id);\n 258:\t\t\treturn -EINVAL;\n 259:\t\t}\n 260:\t\n 261:\t\tprivdata-\u003ebusses[i2c_common-\u003ebus_id] = i2c_common;\n 262:\t\n 263:\t\treturn 0;\n 264:\t}\n 265:\tEXPORT_SYMBOL_GPL(amd_mp2_register_cb);\n 266:\t\n 267:\tint amd_mp2_unregister_cb(struct amd_i2c_common *i2c_common)\n 268:\t{\n 269:\t\tstruct amd_mp2_dev *privdata = i2c_common-\u003emp2_dev;\n 270:\t\n 271:\t\tWRITE_ONCE(privdata-\u003ebusses[i2c_common-\u003ebus_id], NULL);\n 272:\t\n 273:\t\tsynchronize_irq(privdata-\u003edev_irq);\n 274:\t\n 275:\t\treturn 0;\n 276:\t}\n 277:\tEXPORT_SYMBOL_GPL(amd_mp2_unregister_cb);\n 278:\t\n 279:\tstatic void amd_mp2_clear_reg(struct amd_mp2_dev *privdata)\n"
}

9/2 2026/09/25 13:45 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 7238
							output: 22
							thoughts: 552
						

Thoughts:
**Analyzing the AMD MP2 I2C Driver for Fuzzing Suitability**

Okay, let's dive into this `drivers/i2c/busses/i2c-amd-mp2-pci.c` file and see if it's a good target. First, how is this driver registered? Ah, it's a PCI driver. I see the PCI ID table, `amd_mp2_pci_tbl`, and the associated `pci_driver` struct. It looks pretty standard: probe, remove, and power management callbacks. And that ID, `PCI_DEVICE_ID_AMD_MP2`, is defined as `0x15E6`. Right, that's the AMD MP2 sensor hub/I2C controller, common in AMD processors like Raven Ridge. 

Now, the crucial question: can this hardware be emulated? Does it meet my criteria for fuzzing? Let's refresh my memory on the core triage philosophy, specifically the negative criteria. Remember, I only want to return `WorthFuzzing=false` if the modified code fits strictly into certain categories, like structurally unreachable hardware.

And the criteria I am most interested in now are "Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU".

Is the AMD MP2 in that list? No.

Okay, is there other criteria? "Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding."

Hm, let's think about this `amd_mp2_unregister_cb` callback. Is it called in a way that is easily reachable? I need to check the callers of `amd_mp2_unregister_cb` and `amd_mp2_register_cb`. That will tell me if the `remove` function is easily reachable by any trigger other than a full system shutdown or hot unplug. If it is not, then this driver is going to be difficult to fuzz. Let's see...



10/2 2026/09/25 13:45 tool grepper
0m Args:
{
  "Expression": "amd_mp2_unregister_cb"
}

Results:
{
  "Output": "drivers/i2c/busses/i2c-amd-mp2-pci.c=265=EXPORT_SYMBOL_GPL(amd_mp2_register_cb);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-266-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:267:int amd_mp2_unregister_cb(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-268-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-276-}\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:277:EXPORT_SYMBOL_GPL(amd_mp2_unregister_cb);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-278-\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c=325=static void i2c_amd_remove(struct platform_device *pdev)\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-332-\ti2c_amd_enable_set(i2c_dev, false);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:333:\tamd_mp2_unregister_cb(i2c_common);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-334-\ti2c_common-\u003emp2_dev = NULL;\n--\ndrivers/i2c/busses/i2c-amd-mp2.h=198=int amd_mp2_register_cb(struct amd_i2c_common *i2c_common);\ndrivers/i2c/busses/i2c-amd-mp2.h:199:int amd_mp2_unregister_cb(struct amd_i2c_common *i2c_common);\ndrivers/i2c/busses/i2c-amd-mp2.h-200-\n"
}

11/2 2026/09/25 13:45 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 8863
							output: 33
							thoughts: 92
						

Thoughts:
**Dissecting the i2c-amd-mp2 Driver Unregistration**

Okay, so I'm looking at `amd_mp2_unregister_cb`, and I see it's called within `i2c_amd_remove` in `i2c-amd-mp2-plat.c`. The immediate question that pops into my head is, where is that `i2c-amd-mp2-plat.c` module actually registered or created? I need to trace its initialization to understand the full lifecycle. The platform driver part is the key here.

Let's dig into `i2c_amd_remove` further, see if we can understand the removal function better in the `i2c-amd-mp2-plat.c` file. Then I need to shift my focus to `i2c-amd-mp2-pci.c`. The platform device creation is likely handled there, since `i2c-amd-mp2-plat.c` is the platform-specific glue code, it'll be connected to the underlying PCI device. I'll check how the PCI driver interacts with the platform device and how it handles unregistration. That should give me the full picture.



12/2 2026/09/25 13:45 tool grepper
0m Args:
{
  "Expression": "i2c_amd",
  "PathPrefix": "drivers/i2c/busses"
}

Results:
{
  "Output": "drivers/i2c/busses/Kconfig=85=config I2C_AMD_ASF\n--\ndrivers/i2c/busses/Kconfig-99-\t  To compile this driver as a module, choose M here: the module will\ndrivers/i2c/busses/Kconfig:100:\t  be called i2c_amd_asf_plat.\ndrivers/i2c/busses/Kconfig-101-\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c=446=static struct pci_driver amd_mp2_pci_driver = {\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:447:\t.name\t\t= \"i2c_amd_mp2\",\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-448-\t.id_table\t= amd_mp2_pci_tbl,\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c=31=struct amd_i2c_dev {\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-40-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:41:static int i2c_amd_dma_map(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-42-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-63-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:64:static void i2c_amd_dma_unmap(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-65-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-76-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:77:static void i2c_amd_start_cmd(struct amd_i2c_dev *i2c_dev)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-78-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-84-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:85:static void i2c_amd_cmd_completion(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-86-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-96-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:97:static int i2c_amd_check_cmd_completion(struct amd_i2c_dev *i2c_dev)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-98-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-107-\t    i2c_common-\u003emsg-\u003elen \u003e 32)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:108:\t\ti2c_amd_dma_unmap(i2c_common);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-109-\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-122-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:123:static int i2c_amd_enable_set(struct amd_i2c_dev *i2c_dev, bool enable)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-124-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-126-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:127:\ti2c_amd_start_cmd(i2c_dev);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-128-\tamd_mp2_bus_enable_set(i2c_common, enable);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-129-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:130:\treturn i2c_amd_check_cmd_completion(i2c_dev);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-131-}\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-132-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:133:static int i2c_amd_xfer_msg(struct amd_i2c_dev *i2c_dev, struct i2c_msg *pmsg)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-134-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-136-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:137:\ti2c_amd_start_cmd(i2c_dev);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-138-\ti2c_common-\u003emsg = pmsg;\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-140-\tif (pmsg-\u003elen \u003e 32)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:141:\t\tif (i2c_amd_dma_map(i2c_common))\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-142-\t\t\treturn -EIO;\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-148-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:149:\treturn i2c_amd_check_cmd_completion(i2c_dev);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-150-}\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-151-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:152:static int i2c_amd_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-153-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-166-\t\tpmsg = \u0026msgs[i];\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:167:\t\terr = i2c_amd_xfer_msg(i2c_dev, pmsg);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-168-\t\tif (err)\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-175-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:176:static u32 i2c_amd_func(struct i2c_adapter *a)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-177-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-180-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:181:static const struct i2c_algorithm i2c_amd_algorithm = {\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:182:\t.xfer = i2c_amd_xfer,\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:183:\t.functionality = i2c_amd_func,\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-184-};\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-186-#ifdef CONFIG_PM\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:187:static int i2c_amd_suspend(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-188-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-190-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:191:\ti2c_amd_enable_set(i2c_dev, false);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-192-\treturn 0;\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-194-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:195:static int i2c_amd_resume(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-196-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-198-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:199:\treturn i2c_amd_enable_set(i2c_dev, true);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-200-}\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c=203=static const u32 supported_speeds[] = {\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-210-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:211:static enum speed_enum i2c_amd_get_bus_speed(struct platform_device *pdev)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-212-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c=240=static const struct i2c_adapter_quirks amd_i2c_dev_quirks = {\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-244-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:245:static int i2c_amd_probe(struct platform_device *pdev)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-246-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-277-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:278:\ti2c_dev-\u003ecommon.cmd_completion = \u0026i2c_amd_cmd_completion;\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-279-#ifdef CONFIG_PM\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:280:\ti2c_dev-\u003ecommon.suspend = \u0026i2c_amd_suspend;\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:281:\ti2c_dev-\u003ecommon.resume = \u0026i2c_amd_resume;\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-282-#endif\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-292-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:293:\ti2c_dev-\u003ecommon.i2c_speed = i2c_amd_get_bus_speed(pdev);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-294-\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-296-\ti2c_dev-\u003eadap.owner = THIS_MODULE;\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:297:\ti2c_dev-\u003eadap.algo = \u0026i2c_amd_algorithm;\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-298-\ti2c_dev-\u003eadap.quirks = \u0026amd_i2c_dev_quirks;\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-310-\t/* Enable the bus */\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:311:\tif (i2c_amd_enable_set(i2c_dev, true))\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-312-\t\tdev_err(\u0026pdev-\u003edev, \"initial bus enable failed\\n\");\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-324-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:325:static void i2c_amd_remove(struct platform_device *pdev)\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-326-{\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-331-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:332:\ti2c_amd_enable_set(i2c_dev, false);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-333-\tamd_mp2_unregister_cb(i2c_common);\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-340-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:341:static const struct acpi_device_id i2c_amd_acpi_match[] = {\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-342-\t{ \"AMDI0011\" },\n--\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-344-};\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:345:MODULE_DEVICE_TABLE(acpi, i2c_amd_acpi_match);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-346-\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:347:static struct platform_driver i2c_amd_plat_driver = {\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:348:\t.probe = i2c_amd_probe,\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:349:\t.remove = i2c_amd_remove,\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-350-\t.driver = {\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:351:\t\t.name = \"i2c_amd_mp2\",\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:352:\t\t.acpi_match_table = ACPI_PTR(i2c_amd_acpi_match),\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-353-\t},\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-354-};\ndrivers/i2c/busses/i2c-amd-mp2-plat.c:355:module_platform_driver(i2c_amd_plat_driver);\ndrivers/i2c/busses/i2c-amd-mp2-plat.c-356-\n"
}

13/2 2026/09/25 13:45 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 13669
							output: 50
							thoughts: 98
						

Thoughts:
Here's my analysis of the situation:

**Investigating the AMD I2C Driver Landscape**

Okay, so I'm looking at this kernel code and immediately I see something interesting: we've got two distinct drivers here, both related to I2C on AMD platforms. `i2c-amd-mp2-plat.c` is clearly an ACPI platform driver, and it's specifically matching on "AMDI0011". That suggests it's likely responsible for handling I2C controllers that are integrated directly onto the platform, possibly in an embedded controller or Southbridge. Then, `i2c-amd-mp2-pci.c` is a PCI driver, which means it handles I2C controllers that are connected through the PCI bus. It's matching a PCI ID of 0x15e6, and based on my knowledge of AMD hardware, that ID will likely map to a specific I2C controller implementation on a chipset or discrete device. The key here is to understand the probe path of the PCI implementation, so I'm going to dive into the `amd_mp2_pci_probe` function within `i2c-amd-mp2-pci.c` to see how that side of things works.



14/2 2026/09/25 13:45 tool read-file
0m Args:
{
  "File": "drivers/i2c/busses/i2c-amd-mp2-pci.c",
  "FirstLine": 315,
  "LineCount": 80
}

Results:
{
  "Contents": " 315:\t\n 316:\t\t/* request and enable interrupt */\n 317:\t\twritel(0, privdata-\u003emmio + AMD_P2C_MSG_INTEN);\n 318:\t\trc = pci_alloc_irq_vectors(pci_dev, 1, 1, PCI_IRQ_ALL_TYPES);\n 319:\t\tif (rc \u003c 0) {\n 320:\t\t\tdev_err(\u0026pci_dev-\u003edev, \"Failed to allocate single IRQ err=%d\\n\", rc);\n 321:\t\t\tgoto err_dma_mask;\n 322:\t\t}\n 323:\t\n 324:\t\tprivdata-\u003edev_irq = pci_irq_vector(pci_dev, 0);\n 325:\t\tif (!pci_dev-\u003emsix_enabled \u0026\u0026 !pci_dev-\u003emsi_enabled)\n 326:\t\t\tirq_flag = IRQF_SHARED;\n 327:\t\n 328:\t\trc = devm_request_irq(\u0026pci_dev-\u003edev, privdata-\u003edev_irq,\n 329:\t\t\t\t      amd_mp2_irq_isr, irq_flag, dev_name(\u0026pci_dev-\u003edev), privdata);\n 330:\t\tif (rc) {\n 331:\t\t\tpci_err(pci_dev, \"Failure requesting irq %i: %d\\n\", privdata-\u003edev_irq, rc);\n 332:\t\t\tgoto err_dma_mask;\n 333:\t\t}\n 334:\t\n 335:\t\treturn rc;\n 336:\t\n 337:\terr_dma_mask:\n 338:\t\tpci_clear_master(pci_dev);\n 339:\terr_pci_enable:\n 340:\t\tpci_set_drvdata(pci_dev, NULL);\n 341:\t\treturn rc;\n 342:\t}\n 343:\t\n 344:\tstatic int amd_mp2_pci_probe(struct pci_dev *pci_dev,\n 345:\t\t\t\t     const struct pci_device_id *id)\n 346:\t{\n 347:\t\tstruct amd_mp2_dev *privdata;\n 348:\t\tint rc;\n 349:\t\n 350:\t\tprivdata = devm_kzalloc(\u0026pci_dev-\u003edev, sizeof(*privdata), GFP_KERNEL);\n 351:\t\tif (!privdata)\n 352:\t\t\treturn -ENOMEM;\n 353:\t\n 354:\t\tprivdata-\u003epci_dev = pci_dev;\n 355:\t\trc = amd_mp2_pci_init(privdata, pci_dev);\n 356:\t\tif (rc)\n 357:\t\t\treturn rc;\n 358:\t\n 359:\t\tmutex_init(\u0026privdata-\u003ec2p_lock);\n 360:\t\n 361:\t\tpm_runtime_set_autosuspend_delay(\u0026pci_dev-\u003edev, 1000);\n 362:\t\tpm_runtime_use_autosuspend(\u0026pci_dev-\u003edev);\n 363:\t\tpm_runtime_put_autosuspend(\u0026pci_dev-\u003edev);\n 364:\t\tpm_runtime_allow(\u0026pci_dev-\u003edev);\n 365:\t\n 366:\t\tprivdata-\u003eprobed = true;\n 367:\t\n 368:\t\tpci_info(pci_dev, \"MP2 device registered.\\n\");\n 369:\t\treturn 0;\n 370:\t}\n 371:\t\n 372:\tstatic void amd_mp2_pci_remove(struct pci_dev *pci_dev)\n 373:\t{\n 374:\t\tstruct amd_mp2_dev *privdata = pci_get_drvdata(pci_dev);\n 375:\t\n 376:\t\tpm_runtime_forbid(\u0026pci_dev-\u003edev);\n 377:\t\tpm_runtime_get_noresume(\u0026pci_dev-\u003edev);\n 378:\t\n 379:\t\tpci_clear_master(pci_dev);\n 380:\t\n 381:\t\tamd_mp2_clear_reg(privdata);\n 382:\t}\n 383:\t\n 384:\t#ifdef CONFIG_PM\n 385:\tstatic int amd_mp2_pci_suspend(struct device *dev)\n 386:\t{\n 387:\t\tstruct pci_dev *pci_dev = to_pci_dev(dev);\n 388:\t\tstruct amd_mp2_dev *privdata = pci_get_drvdata(pci_dev);\n 389:\t\tstruct amd_i2c_common *i2c_common;\n 390:\t\tunsigned int bus_id;\n 391:\t\tint ret = 0;\n 392:\t\n 393:\t\tfor (bus_id = 0; bus_id \u003c 2; bus_id++) {\n 394:\t\t\ti2c_common = privdata-\u003ebusses[bus_id];\n"
}

15/2 2026/09/25 13:45 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 15446
							output: 18
							thoughts: 921
						

Thoughts:
**Analysis of the AMD MP2 PCIe Driver Patch for Fuzzing Suitability**

Okay, let's break this down. First, I need to understand exactly what hardware we're dealing with here: it's the AMD MP2 PCIe driver, specifically `i2c-amd-mp2-pci.c`. The device itself is an AMD MP2 PCIe device, identified by the PCI vendor and device IDs (1022:15e6). The key question is whether this device is accessible within a standard virtualized environment, like GCE or QEMU, since that's critical for fuzzing.

I know QEMU *doesn't* emulate this specific AMD MP2 device. That's a huge red flag. Looking back at the instructions, Section 2 outlines the negative criteria for WorthFuzzing=false. "Structurally unreachable hardware" is a key category. It specifically lists vendor-specific PCIe devices that aren't emulated in standard QEMU, and this *definitely* seems to fall into that category.

Next, I need to understand what this specific patch is modifying. It's touching two functions: `amd_mp2_irq_isr` and `amd_mp2_unregister_cb`. `amd_mp2_irq_isr` has a READ_ONCE added to access `privdata->busses`, and `amd_mp2_unregister_cb` has a WRITE_ONCE and a `synchronize_irq` added to it to NULL out the `privdata->busses` entries.

Now, the important question: Can `i2c-amd-mp2-pci` be reached in *any* way without the physical AMD MP2 hardware? My immediate answer is no. Standard QEMU doesn't emulate it. This is not an abstract concept; it's an embedded sensor hub co-processor on Ryzen APUs. It's a very specific piece of hardware. I know from experience that even driver overrides through sysfs wouldn't work, because `amd_mp2_pci_init` requires direct access to BAR2 and other device-specific registers through `pcim_iomap`, which are only available on the actual physical device.

The implication is that neither Syzkaller nor any other standard fuzzing environment (running in QEMU or GCE VMs) will be able to reach this code. The device's PCI ID is simply not supported in those environments. Specifically, `amd_mp2_unregister_cb` is a driver teardown callback as well, making this even more critical, as that function is only executed during physical PCI hot-unplug.

Therefore, since the patch *requires* the AMD MP2 PCIe driver to be probed, which can only happen with the physical hardware, it looks like this patch is *not* suitable for standard fuzzing. The updated code will not be reached without it. Let me just double check, grep the entire kernel for any other `amd_mp2_*` references, but I'm pretty confident in my assessment.



16/2 2026/09/25 13:45 tool grepper
0m Args:
{
  "Expression": "amd_mp2"
}

Results:
{
  "Output": "\nFull output is too long, showing 500 out of 814 lines.\nUse more precise expression if possible.\n\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c=37=int amd_sfh_get_report(struct hid_device *hid, int report_id, int report_type)\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-42-\tstruct amd_input_data *in_data = cli_data-\u003ein_data;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:43:\tstruct amd_mp2_dev *mp2;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-44-\tint i;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-45-\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:46:\tmp2 = container_of(in_data, struct amd_mp2_dev, in_data);\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-47-\tguard(mutex)(\u0026mp2-\u003elock);\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c=70=void amd_sfh_work(struct work_struct *work)\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-76-\tu8 current_index, sensor_index;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:77:\tstruct amd_mp2_ops *mp2_ops;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:78:\tstruct amd_mp2_dev *mp2;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-79-\tu8 report_id, node_type;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-81-\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:82:\tmp2 = container_of(in_data, struct amd_mp2_dev, in_data);\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-83-\tguard(mutex)(\u0026mp2-\u003elock);\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c=119=void amd_sfh_work_buffer(struct work_struct *work)\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-122-\tstruct amd_input_data *in_data = cli_data-\u003ein_data;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:123:\tstruct amd_mp2_dev *mp2;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-124-\tu8 report_size;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-126-\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:127:\tmp2 = container_of(in_data, struct amd_mp2_dev, in_data);\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-128-\tguard(mutex)(\u0026mp2-\u003elock);\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-139-\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:140:static u32 amd_sfh_wait_for_response(struct amd_mp2_dev *mp2, u8 sid, u32 sensor_sts)\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-141-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c=148=static const char *get_sensor_name(int idx)\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-168-\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:169:static void amd_sfh_resume(struct amd_mp2_dev *mp2)\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-170-{\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-171-\tstruct amdtp_cl_data *cl_data = mp2-\u003ecl_data;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:172:\tstruct amd_mp2_sensor_info info;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-173-\tint i, status;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-194-\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:195:static void amd_sfh_suspend(struct amd_mp2_dev *mp2)\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-196-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-217-\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:218:int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-219-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-221-\tstruct amdtp_cl_data *cl_data = privdata-\u003ecl_data;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:222:\tstruct amd_mp2_ops *mp2_ops = privdata-\u003emp2_ops;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:223:\tstruct amd_mp2_sensor_info info;\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-224-\tstruct request_list *req_list;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-237-\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:238:\tcl_data-\u003enum_hid_devices = amd_mp2_get_sensor_num(privdata, \u0026cl_data-\u003esensor_idx[0]);\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-239-\tif (cl_data-\u003enum_hid_devices == 0)\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-361-\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c:362:int amd_sfh_hid_client_deinit(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/amd_sfh_client.c-363-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h=31=enum cmd_id {\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-37-\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:38:struct amd_mp2_sensor_info {\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-39-\tu8 sensor_idx;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h=44=struct sfh_dev_status {\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-50-\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:51:struct amd_mp2_dev {\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-52-\tstruct pci_dev *pdev;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-56-\tconst struct amd_sfh1_1_ops *sfh1_1_ops;\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:57:\tstruct amd_mp2_ops *mp2_ops;\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-58-\tstruct amd_input_data in_data;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-68-\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:69:struct amd_mp2_ops {\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:70:\tvoid (*start)(struct amd_mp2_dev *privdata, struct amd_mp2_sensor_info info);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:71:\tvoid (*stop)(struct amd_mp2_dev *privdata, u16 sensor_idx);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:72:\tvoid (*stop_all)(struct amd_mp2_dev *privdata);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:73:\tint (*response)(struct amd_mp2_dev *mp2, u8 sid, u32 sensor_sts);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:74:\tvoid (*clear_intr)(struct amd_mp2_dev *privdata);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:75:\tint (*init_intr)(struct amd_mp2_dev *privdata);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:76:\tint (*discovery_status)(struct amd_mp2_dev *privdata);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:77:\tvoid (*suspend)(struct amd_mp2_dev *mp2);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:78:\tvoid (*resume)(struct amd_mp2_dev *mp2);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-79-\tvoid (*remove)(void *privdata);\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h=88=void amd_sfh_work_buffer(struct work_struct *work);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:89:void amd_sfh_clear_intr_v2(struct amd_mp2_dev *privdata);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:90:int amd_sfh_irq_init_v2(struct amd_mp2_dev *privdata);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:91:void amd_sfh_clear_intr(struct amd_mp2_dev *privdata);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:92:int amd_sfh_irq_init(struct amd_mp2_dev *privdata);\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-93-\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:94:static inline u64 amd_get_c2p_val(struct amd_mp2_dev *mp2, u32 idx)\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-95-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-98-\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h:99:static inline u64 amd_get_p2c_val(struct amd_mp2_dev *mp2, u32 idx)\ndrivers/hid/amd-sfh-hid/amd_sfh_common.h-100-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_hid.c=126=int amdtp_hid_probe(u32 cur_hid_dev, struct amdtp_cl_data *cli_data)\ndrivers/hid/amd-sfh-hid/amd_sfh_hid.c-127-{\ndrivers/hid/amd-sfh-hid/amd_sfh_hid.c:128:\tstruct amd_mp2_dev *mp2 = container_of(cli_data-\u003ein_data, struct amd_mp2_dev, in_data);\ndrivers/hid/amd-sfh-hid/amd_sfh_hid.c-129-\tstruct device *dev = \u0026mp2-\u003epdev-\u003edev;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c=41=static bool intr_disable = true;\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-42-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:43:static int amd_sfh_wait_response_v2(struct amd_mp2_dev *mp2, u8 sid, u32 sensor_sts)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-44-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-56-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:57:static void amd_start_sensor_v2(struct amd_mp2_dev *privdata, struct amd_mp2_sensor_info info)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-58-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-74-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:75:static void amd_stop_sensor_v2(struct amd_mp2_dev *privdata, u16 sensor_idx)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-76-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-89-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:90:static void amd_stop_all_sensor_v2(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-91-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-101-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:102:void amd_sfh_clear_intr_v2(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-103-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-109-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:110:void amd_sfh_clear_intr(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-111-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c=116=static irqreturn_t amd_sfh_irq_handler(int irq, void *data)\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-122-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:123:int amd_sfh_irq_init_v2(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-124-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-139-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:140:static int amd_sfh_dis_sts_v2(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-141-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-145-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:146:static void amd_start_sensor(struct amd_mp2_dev *privdata, struct amd_mp2_sensor_info info)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-147-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-166-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:167:static void amd_stop_sensor(struct amd_mp2_dev *privdata, u16 sensor_idx)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-168-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-180-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:181:static void amd_stop_all_sensors(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-182-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c=194=static const struct dmi_system_id dmi_sensor_mask_overrides[] = {\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-209-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:210:int amd_mp2_get_sensor_num(struct amd_mp2_dev *privdata, u8 *sensor_id)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-211-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-250-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:251:static void amd_mp2_pci_remove(void *privdata)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-252-{\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:253:\tstruct amd_mp2_dev *mp2 = privdata;\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-254-\tamd_sfh_hid_client_deinit(privdata);\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-259-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:260:static struct amd_mp2_ops amd_sfh_ops_v2 = {\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-261-\t.start = amd_start_sensor_v2,\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-267-\t.discovery_status = amd_sfh_dis_sts_v2,\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:268:\t.remove = amd_mp2_pci_remove,\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-269-};\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-270-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:271:static struct amd_mp2_ops amd_sfh_ops = {\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-272-\t.start = amd_start_sensor,\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-274-\t.stop_all = amd_stop_all_sensors,\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:275:\t.remove = amd_mp2_pci_remove,\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-276-};\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-277-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:278:static void mp2_select_ops(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-279-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-294-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:295:int amd_sfh_irq_init(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-296-{\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c=338=static ssize_t hpd_show(struct device *dev, struct device_attribute *attr, char *buf)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-339-{\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:340:\tstruct amd_mp2_dev *mp2 = dev_get_drvdata(dev);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-341-\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c=345=static ssize_t hpd_store(struct device *dev,\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-348-{\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:349:\tstruct amd_mp2_dev *mp2 = dev_get_drvdata(dev);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-350-\tbool enabled;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c=363=static umode_t sfh_attr_is_visible(struct kobject *kobj, struct attribute *attr, int idx)\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-365-\tstruct device *dev = kobj_to_dev(kobj);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:366:\tstruct amd_mp2_dev *mp2 = dev_get_drvdata(dev);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-367-\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c=389=static void sfh1_1_init_work(struct work_struct *work)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-390-{\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:391:\tstruct amd_mp2_dev *mp2 = container_of(work, struct amd_mp2_dev, work);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-392-\tint rc;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c=407=static void sfh_init_work(struct work_struct *work)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-408-{\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:409:\tstruct amd_mp2_dev *mp2 = container_of(work, struct amd_mp2_dev, work);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-410-\tstruct pci_dev *pdev = mp2-\u003epdev;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c=424=static void amd_sfh_remove(struct pci_dev *pdev)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-425-{\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:426:\tstruct amd_mp2_dev *mp2 = pci_get_drvdata(pdev);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-427-\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-432-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:433:static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-434-{\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:435:\tstruct amd_mp2_dev *privdata;\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-436-\tint rc;\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c=504=static void amd_sfh_shutdown(struct pci_dev *pdev)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-505-{\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:506:\tstruct amd_mp2_dev *mp2 = pci_get_drvdata(pdev);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-507-\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-514-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:515:static int __maybe_unused amd_mp2_pci_resume(struct device *dev)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-516-{\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:517:\tstruct amd_mp2_dev *mp2 = dev_get_drvdata(dev);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-518-\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-525-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:526:static int __maybe_unused amd_mp2_pci_suspend(struct device *dev)\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-527-{\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:528:\tstruct amd_mp2_dev *mp2 = dev_get_drvdata(dev);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-529-\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-536-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:537:static SIMPLE_DEV_PM_OPS(amd_mp2_pm_ops, amd_mp2_pci_suspend,\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:538:\t\tamd_mp2_pci_resume);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-539-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:540:static const struct pci_device_id amd_mp2_pci_tbl[] = {\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-541-\t{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_MP2) },\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-545-};\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:546:MODULE_DEVICE_TABLE(pci, amd_mp2_pci_tbl);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-547-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:548:static struct pci_driver amd_mp2_pci_driver = {\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-549-\t.name\t\t= DRIVER_NAME,\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:550:\t.id_table\t= amd_mp2_pci_tbl,\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:551:\t.probe\t\t= amd_mp2_pci_probe,\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:552:\t.driver.pm\t= \u0026amd_mp2_pm_ops,\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-553-\t.shutdown\t= amd_sfh_shutdown,\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-556-};\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c:557:module_pci_driver(amd_mp2_pci_driver);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.c-558-\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.h=91=struct hpd_status {\n--\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.h-102-\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.h:103:int amd_mp2_get_sensor_num(struct amd_mp2_dev *privdata, u8 *sensor_id);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.h:104:int amd_sfh_hid_client_init(struct amd_mp2_dev *privdata);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.h:105:int amd_sfh_hid_client_deinit(struct amd_mp2_dev *privdata);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.h:106:void amd_sfh_set_desc_ops(struct amd_mp2_ops *mp2_ops);\ndrivers/hid/amd-sfh-hid/amd_sfh_pcie.h-107-\n--\ndrivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.c=206=static u8 get_input_report(u8 current_index, int sensor_idx, int report_id,\n--\ndrivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.c-208-{\ndrivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.c:209:\tstruct amd_mp2_dev *privdata = container_of(in_data, struct amd_mp2_dev, in_data);\ndrivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.c-210-\tu32 *sensor_virt_addr = in_data-\u003esensor_virt_addr[current_index];\n--\ndrivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.c-282-\ndrivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.c:283:void amd_sfh_set_desc_ops(struct amd_mp2_ops *mp2_ops)\ndrivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.c-284-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c=176=static u8 get_input_rep(u8 current_index, int sensor_idx, int report_id,\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c-178-{\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c:179:\tstruct amd_mp2_dev *mp2 = container_of(in_data, struct amd_mp2_dev, in_data);\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c-180-\tu8 *input_report = in_data-\u003einput_report[current_index];\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c=263=static u32 get_desc_size(int sensor_idx, int descriptor_name)\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c-320-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c:321:void amd_sfh1_1_set_desc_ops(struct amd_mp2_ops *mp2_ops)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c-322-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-17-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:18:static int amd_sfh_get_sensor_num(struct amd_mp2_dev *mp2, u8 *sensor_id)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-19-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-44-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:45:static u32 amd_sfh_wait_for_response(struct amd_mp2_dev *mp2, u8 sid, u32 cmd_id)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-46-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c=53=static const char *get_sensor_name(int idx)\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-72-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:73:static int amd_sfh_hid_client_deinit(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-74-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-109-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:110:static int amd_sfh1_1_hid_client_init(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-111-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-113-\tstruct amdtp_cl_data *cl_data = privdata-\u003ecl_data;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:114:\tstruct amd_mp2_ops *mp2_ops = privdata-\u003emp2_ops;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:115:\tstruct amd_mp2_sensor_info info;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-116-\tstruct request_list *req_list;\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-253-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:254:static void amd_sfh_resume(struct amd_mp2_dev *mp2)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-255-{\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-256-\tstruct amdtp_cl_data *cl_data = mp2-\u003ecl_data;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:257:\tstruct amd_mp2_sensor_info info;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-258-\tint i, status;\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-288-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:289:static void amd_sfh_suspend(struct amd_mp2_dev *mp2)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-290-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-320-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:321:void amd_sfh_toggle_hpd(struct amd_mp2_dev *mp2, bool enabled)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-322-{\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-323-\tstruct amdtp_cl_data *cl_data = mp2-\u003ecl_data;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:324:\tstruct amd_mp2_sensor_info info;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-325-\tint i, status;\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-358-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:359:static void amd_mp2_pci_remove(void *privdata)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-360-{\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:361:\tstruct amd_mp2_dev *mp2 = privdata;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-362-\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-369-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:370:static void amd_sfh_set_ops(struct amd_mp2_dev *mp2)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-371-{\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:372:\tstruct amd_mp2_ops *mp2_ops;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-373-\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-379-\tmp2_ops-\u003eresume = amd_sfh_resume;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:380:\tmp2_ops-\u003eremove = amd_mp2_pci_remove;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-381-}\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-382-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c:383:int amd_sfh1_1_init(struct amd_mp2_dev *mp2)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.c-384-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.h=16=struct amd_sfh1_1_ops {\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.h:17:\tint (*init)(struct amd_mp2_dev *mp2);\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.h:18:\tvoid (*toggle_hpd)(struct amd_mp2_dev *mp2, bool enable);\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.h-19-};\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.h-20-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.h:21:int amd_sfh1_1_init(struct amd_mp2_dev *mp2);\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.h:22:void amd_sfh_toggle_hpd(struct amd_mp2_dev *mp2, bool enabled);\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_init.h-23-\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-15-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c:16:static struct amd_mp2_dev *emp2;\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-17-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c:18:static int amd_sfh_wait_response(struct amd_mp2_dev *mp2, u8 sid, u32 cmd_id)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-19-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-31-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c:32:static void amd_start_sensor(struct amd_mp2_dev *privdata, struct amd_mp2_sensor_info info)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-33-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-44-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c:45:static void amd_stop_sensor(struct amd_mp2_dev *privdata, u16 sensor_idx)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-46-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-58-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c:59:static void amd_stop_all_sensor(struct amd_mp2_dev *privdata)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-60-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-71-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c:72:static struct amd_mp2_ops amd_sfh_ops = {\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-73-\t.start = amd_start_sensor,\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c=79=void sfh_deinit_emp2(void)\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-83-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c:84:void sfh_interface_init(struct amd_mp2_dev *mp2)\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.c-85-{\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h=168=struct sfh_op_mode {\n--\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h-186-\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h:187:void sfh_interface_init(struct amd_mp2_dev *mp2);\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h-188-void sfh_deinit_emp2(void);\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h:189:void amd_sfh1_1_set_desc_ops(struct amd_mp2_ops *mp2_ops);\ndrivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_interface.h-190-int amd_sfh_float_to_int(u32 flt32_val);\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-18-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:19:static void amd_mp2_c2p_mutex_lock(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-20-{\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:21:\tstruct amd_mp2_dev *privdata = i2c_common-\u003emp2_dev;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-22-\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-27-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:28:static void amd_mp2_c2p_mutex_unlock(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-29-{\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:30:\tstruct amd_mp2_dev *privdata = i2c_common-\u003emp2_dev;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-31-\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-41-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:42:static int amd_mp2_cmd(struct amd_i2c_common *i2c_common,\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-43-\t\t       union i2c_cmd_base i2c_cmd_base)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-44-{\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:45:\tstruct amd_mp2_dev *privdata = i2c_common-\u003emp2_dev;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-46-\tvoid __iomem *reg;\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-56-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:57:int amd_mp2_bus_enable_set(struct amd_i2c_common *i2c_common, bool enable)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-58-{\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:59:\tstruct amd_mp2_dev *privdata = i2c_common-\u003emp2_dev;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-60-\tunion i2c_cmd_base i2c_cmd_base;\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-68-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:69:\tamd_mp2_c2p_mutex_lock(i2c_common);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-70-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:71:\treturn amd_mp2_cmd(i2c_common, i2c_cmd_base);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-72-}\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:73:EXPORT_SYMBOL_GPL(amd_mp2_bus_enable_set);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-74-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:75:static void amd_mp2_cmd_rw_fill(struct amd_i2c_common *i2c_common,\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-76-\t\t\t\tunion i2c_cmd_base *i2c_cmd_base,\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-85-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:86:int amd_mp2_rw(struct amd_i2c_common *i2c_common, enum i2c_cmd reqcmd)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-87-{\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:88:\tstruct amd_mp2_dev *privdata = i2c_common-\u003emp2_dev;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-89-\tunion i2c_cmd_base i2c_cmd_base;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-90-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:91:\tamd_mp2_cmd_rw_fill(i2c_common, \u0026i2c_cmd_base, reqcmd);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:92:\tamd_mp2_c2p_mutex_lock(i2c_common);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-93-\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-105-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:106:\treturn amd_mp2_cmd(i2c_common, i2c_cmd_base);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-107-}\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:108:EXPORT_SYMBOL_GPL(amd_mp2_rw);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-109-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:110:static void amd_mp2_pci_check_rw_event(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-111-{\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:112:\tstruct amd_mp2_dev *privdata = i2c_common-\u003emp2_dev;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-113-\tstruct pci_dev *pdev = privdata-\u003epci_dev;\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-133-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:134:static void __amd_mp2_process_event(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-135-{\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:136:\tstruct amd_mp2_dev *privdata = i2c_common-\u003emp2_dev;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-137-\tstruct pci_dev *pdev = privdata-\u003epci_dev;\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-150-\t\tif (sts == i2c_readcomplete_event) {\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:151:\t\t\tamd_mp2_pci_check_rw_event(i2c_common);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-152-\t\t\tif (len \u003c= 32)\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-161-\t\tif (sts == i2c_writecomplete_event)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:162:\t\t\tamd_mp2_pci_check_rw_event(i2c_common);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-163-\t\telse if (sts != i2c_writefail_event)\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-182-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:183:void amd_mp2_process_event(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-184-{\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:185:\tstruct amd_mp2_dev *privdata = i2c_common-\u003emp2_dev;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-186-\tstruct pci_dev *pdev = privdata-\u003epci_dev;\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-193-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:194:\t__amd_mp2_process_event(i2c_common);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-195-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-196-\ti2c_common-\u003ereqcmd = i2c_none;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:197:\tamd_mp2_c2p_mutex_unlock(i2c_common);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-198-}\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:199:EXPORT_SYMBOL_GPL(amd_mp2_process_event);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-200-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:201:static irqreturn_t amd_mp2_irq_isr(int irq, void *dev)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-202-{\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:203:\tstruct amd_mp2_dev *privdata = dev;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-204-\tstruct pci_dev *pdev = privdata-\u003epci_dev;\n--\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-240-\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:241:void amd_mp2_rw_timeout(struct amd_i2c_common *i2c_common)\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-242-{\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-243-\ti2c_common-\u003ereqcmd = i2c_none;\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:244:\tamd_mp2_c2p_mutex_unlock(i2c_common);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-245-}\ndrivers/i2c/busses/i2c-amd-mp2-pci.c:246:EXPORT_SYMBOL_GPL(amd_mp2_rw_timeout);\ndrivers/i2c/busses/i2c-amd-mp2-pci.c-247-\n\n"
}

17/2 2026/09/25 13:45 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 32651
							output: 143
							thoughts: 937
						

Thoughts:
**WorthFuzzing Assessment: i2c-amd-mp2-pci.c**

Okay, so I'm looking at `drivers/i2c/busses/i2c-amd-mp2-pci.c`, which is the PCI driver for that AMD MP2 I2C controller. I can see it's tied to the `PCI_DEVICE_ID_AMD_MP2` (0x15e6) and interacts directly with the MMIO registers of the hardware – AMD_P2C_MSG1, AMD_P2C_MSG2, that sort of thing. The problem, as always with these specialized drivers, is that standard virtual environments like QEMU or GCE don't emulate this particular hardware.

Therefore, the `amd_mp2_pci_probe()` function will never be called, and the interrupt routine, `amd_mp2_irq_isr`, is never invoked. Consequently, the driver isn't properly registered, and `amd_mp2_unregister_cb` – which is called during removal – is also never touched.

Now, let's go back to the triage guidelines. This fits *perfectly* under the "Structurally unreachable hardware" category. The AMD MP2 PCIe I2C controller is vendor-specific and not emulated. Also,  `amd_mp2_unregister_cb` is executed only during driver teardown, triggered by device removal.

So, the conclusion is clear: this patch should not be fuzzed. `WorthFuzzing` has to be `false`.

Now, according to the schema, `FocusSymbols` should be empty (or null). `EnableConfigs` would be `I2C_AMD_MP2` if it was enabled. However, since `WorthFuzzing` is `false`, both `FocusSymbols` and `EnableConfigs` should be empty lists.

So I'll set:

*   `WorthFuzzing`: `false`
*   `FocusSymbols`: `[]`
*   `EnableConfigs`: `[]`
*   `Reasoning`: "The patch modifies `amd_mp2_irq_isr` and `amd_mp2_unregister_cb` in `drivers/i2c/busses/i2c-amd-mp2-pci.c`. This driver supports the AMD MP2 PCIe I2C adapter, which is vendor-specific physical hardware (PCI ID 1022:15e6) that is not emulated in standard virtualized test environments (QEMU/GCE). Consequently, the modified code is structurally unreachable during fuzzing."

Time to invoke `set-results`.



18/2 2026/09/25 13:45 tool set-results
0m Args:
{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies amd_mp2_irq_isr and amd_mp2_unregister_cb in drivers/i2c/busses/i2c-amd-mp2-pci.c. This driver supports the AMD MP2 PCIe I2C controller (PCI ID 1022:15e6), which is vendor-specific physical hardware not emulated in standard virtualized environments (QEMU or GCE). Consequently, the modified interrupt service routine and unregister callback are structurally unreachable during fuzzing.",
  "WorthFuzzing": false
}

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies amd_mp2_irq_isr and amd_mp2_unregister_cb in drivers/i2c/busses/i2c-amd-mp2-pci.c. This driver supports the AMD MP2 PCIe I2C controller (PCI ID 1022:15e6), which is vendor-specific physical hardware not emulated in standard virtualized environments (QEMU or GCE). Consequently, the modified interrupt service routine and unregister callback are structurally unreachable during fuzzing.",
  "WorthFuzzing": false
}

19/1 2026/09/25 13:45 action If
0m Args:
{
  "WorthFuzzing": false
}

Results:
null

LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)