AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch refactors the VGA arbiter callback interface (vga_client_register and set_decode) to pass a private data pointer instead of pci_dev. The only consumers that implement and register this callback are vendor-specific physical GPU drivers (amdgpu, radeon, nouveau, i915, lsdc) and vfio-pci. Because none of these GPU drivers or vfio-pci VGA passthrough are emulated or present in standard virtualized fuzzing environments (QEMU/GCE), the modified code in these drivers as well as the callback registration and invocation paths in vgaarb.c are structurally unreachable.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 65f3a05b2b579024b50859348b98a69ea533a7ea\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Sep 24 09:05:16 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c\nindex 62b5b4a23f17b..1344b2b1bd162 100644\n--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c\n+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c\n@@ -1435,10 +1435,10 @@ bool amdgpu_device_should_use_aspm(struct amdgpu_device *adev)\n  * Enable/disable vga decode (all asics).\n  * Returns VGA resource flags.\n  */\n-static unsigned int amdgpu_device_vga_set_decode(struct pci_dev *pdev,\n+static unsigned int amdgpu_device_vga_set_decode(void *data,\n \t\tbool state)\n {\n-\tstruct amdgpu_device *adev = drm_to_adev(pci_get_drvdata(pdev));\n+\tstruct amdgpu_device *adev = (struct amdgpu_device *)data;\n \n \tamdgpu_asic_set_vga_state(adev, state);\n \tif (state)\n@@ -4208,7 +4208,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,\n \t * ignore it\n \t */\n \tif ((adev-\u003epdev-\u003eclass \u003e\u003e 8) == PCI_CLASS_DISPLAY_VGA)\n-\t\tvga_client_register(adev-\u003epdev, amdgpu_device_vga_set_decode);\n+\t\tvga_client_register(adev-\u003epdev, amdgpu_device_vga_set_decode, adev);\n \n \tpx = amdgpu_device_supports_px(adev);\n \ndiff --git a/drivers/gpu/drm/i915/display/intel_vga.c b/drivers/gpu/drm/i915/display/intel_vga.c\nindex 4966fd7eea92b..0889edb361901 100644\n--- a/drivers/gpu/drm/i915/display/intel_vga.c\n+++ b/drivers/gpu/drm/i915/display/intel_vga.c\n@@ -283,9 +283,10 @@ void intel_vga_disable(struct intel_display *display)\n \tintel_de_posting_read(display, vga_reg);\n }\n \n-static unsigned int intel_vga_set_decode(struct pci_dev *pdev, bool enable_decode)\n+static unsigned int intel_vga_set_decode(void *data, bool enable_decode)\n {\n-\tstruct intel_display *display = to_intel_display(pdev);\n+\tstruct intel_display *display = (struct intel_display *)data;\n+\tstruct pci_dev *pdev = to_pci_dev(display-\u003edrm-\u003edev);\n \tunsigned int decodes = VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM;\n \n \tdrm_dbg_kms(display-\u003edrm, \"%s VGA decode due to VGA arbitration\\n\",\n@@ -331,7 +332,7 @@ void intel_vga_register(struct intel_display *display)\n \t * then we do not take part in VGA arbitration and the\n \t * vga_client_register() fails with -ENODEV.\n \t */\n-\tret = vga_client_register(pdev, intel_vga_set_decode);\n+\tret = vga_client_register(pdev, intel_vga_set_decode, display);\n \tdrm_WARN_ON(display-\u003edrm, ret \u0026\u0026 ret != -ENODEV);\n }\n \ndiff --git a/drivers/gpu/drm/loongson/lsdc_drv.c b/drivers/gpu/drm/loongson/lsdc_drv.c\nindex 3fd828d23271c..5a13df31eb902 100644\n--- a/drivers/gpu/drm/loongson/lsdc_drv.c\n+++ b/drivers/gpu/drm/loongson/lsdc_drv.c\n@@ -254,7 +254,7 @@ lsdc_create_device(struct pci_dev *pdev,\n \n /* For multiple GPU driver instance co-exixt in the system */\n \n-static unsigned int lsdc_vga_set_decode(struct pci_dev *pdev, bool state)\n+static unsigned int lsdc_vga_set_decode(void *data, bool state)\n {\n \treturn VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM;\n }\n@@ -291,7 +291,7 @@ static int lsdc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)\n \n \tpci_set_drvdata(pdev, ddev);\n \n-\tvga_client_register(pdev, lsdc_vga_set_decode);\n+\tvga_client_register(pdev, lsdc_vga_set_decode, NULL);\n \n \tdrmm_kms_helper_poll_init(ddev);\n \ndiff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c\nindex 29a801124e560..6662e30466f22 100644\n--- a/drivers/gpu/drm/nouveau/nouveau_vga.c\n+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c\n@@ -9,9 +9,9 @@\n #include \"nouveau_vga.h\"\n \n static unsigned int\n-nouveau_vga_set_decode(struct pci_dev *pdev, bool state)\n+nouveau_vga_set_decode(void *data, bool state)\n {\n-\tstruct nouveau_drm *drm = pci_get_drvdata(pdev);\n+\tstruct nouveau_drm *drm = (struct nouveau_drm *)data;\n \tstruct nvif_object *device = \u0026drm-\u003eclient.device.object;\n \n \tif (drm-\u003eclient.device.info.family == NV_DEVICE_INFO_V0_CURIE \u0026\u0026\n@@ -103,7 +103,7 @@ nouveau_vga_init(struct nouveau_drm *drm)\n \t\treturn;\n \tpdev = to_pci_dev(dev-\u003edev);\n \n-\tvga_client_register(pdev, nouveau_vga_set_decode);\n+\tvga_client_register(pdev, nouveau_vga_set_decode, drm);\n \n \t/* don't register Thunderbolt eGPU with vga_switcheroo */\n \tif (pci_is_thunderbolt_attached(pdev))\ndiff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c\nindex 9523240110a6a..cf8a6bd00c77e 100644\n--- a/drivers/gpu/drm/radeon/radeon_device.c\n+++ b/drivers/gpu/drm/radeon/radeon_device.c\n@@ -1076,10 +1076,9 @@ void radeon_combios_fini(struct radeon_device *rdev)\n  * Enable/disable vga decode (all asics).\n  * Returns VGA resource flags.\n  */\n-static unsigned int radeon_vga_set_decode(struct pci_dev *pdev, bool state)\n+static unsigned int radeon_vga_set_decode(void *data, bool state)\n {\n-\tstruct drm_device *dev = pci_get_drvdata(pdev);\n-\tstruct radeon_device *rdev = dev-\u003edev_private;\n+\tstruct radeon_device *rdev = (struct radeon_device *)data;\n \tradeon_vga_set_state(rdev, state);\n \tif (state)\n \t\treturn VGA_RSRC_LEGACY_IO | VGA_RSRC_LEGACY_MEM |\n@@ -1431,7 +1430,7 @@ int radeon_device_init(struct radeon_device *rdev,\n \t/* if we have \u003e 1 VGA cards, then disable the radeon VGA resources */\n \t/* this will fail for cards that aren't VGA class devices, just\n \t * ignore it */\n-\tvga_client_register(rdev-\u003epdev, radeon_vga_set_decode);\n+\tvga_client_register(rdev-\u003epdev, radeon_vga_set_decode, rdev);\n \n \tif (rdev-\u003eflags \u0026 RADEON_IS_PX)\n \t\truntime = true;\ndiff --git a/drivers/pci/vgaarb.c b/drivers/pci/vgaarb.c\nindex 3de05aee78599..3e58b2c05c854 100644\n--- a/drivers/pci/vgaarb.c\n+++ b/drivers/pci/vgaarb.c\n@@ -51,7 +51,8 @@ struct vga_device {\n \tunsigned int mem_norm_cnt;\t/* normal MEM count */\n \tbool bridge_has_one_vga;\n \tbool is_firmware_default;\t/* device selected by firmware */\n-\tunsigned int (*set_decode)(struct pci_dev *pdev, bool decode);\n+\tunsigned int (*set_decode)(void *data, bool decode);\n+\tvoid *set_decode_data;\n };\n \n static LIST_HEAD(vga_list);\n@@ -935,6 +936,7 @@ EXPORT_SYMBOL(vga_set_legacy_decoding);\n  * vga_client_register - register or unregister a VGA arbitration client\n  * @pdev: PCI device of the VGA client\n  * @set_decode: VGA decode change callback\n+ * @data: private data to pass to callback\n  *\n  * Clients have two callback mechanisms they can use.\n  *\n@@ -956,15 +958,18 @@ EXPORT_SYMBOL(vga_set_legacy_decoding);\n  * Returns: 0 on success, -ENODEV on failure\n  */\n int vga_client_register(struct pci_dev *pdev,\n-\t\tunsigned int (*set_decode)(struct pci_dev *pdev, bool decode))\n+\t\tunsigned int (*set_decode)(void *data, bool decode),\n+\t\tvoid *data)\n {\n \tunsigned long flags;\n \tstruct vga_device *vgadev;\n \n \tspin_lock_irqsave(\u0026vga_lock, flags);\n \tvgadev = vgadev_find(pdev);\n-\tif (vgadev)\n+\tif (vgadev) {\n \t\tvgadev-\u003eset_decode = set_decode;\n+\t\tvgadev-\u003eset_decode_data = data;\n+\t}\n \tspin_unlock_irqrestore(\u0026vga_lock, flags);\n \tif (!vgadev)\n \t\treturn -ENODEV;\n@@ -1464,7 +1469,7 @@ static void vga_arbiter_notify_clients(void)\n \tspin_lock_irqsave(\u0026vga_lock, flags);\n \tlist_for_each_entry(vgadev, \u0026vga_list, list) {\n \t\tif (vgadev-\u003eset_decode) {\n-\t\t\tnew_decodes = vgadev-\u003eset_decode(vgadev-\u003epdev,\n+\t\t\tnew_decodes = vgadev-\u003eset_decode(vgadev-\u003eset_decode_data,\n \t\t\t\t\t\t\t new_state);\n \t\t\tvga_update_device_decodes(vgadev, new_decodes);\n \t\t}\ndiff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c\nindex 6757054e9d875..b04ce3ded08c2 100644\n--- a/drivers/vfio/pci/vfio_pci_core.c\n+++ b/drivers/vfio/pci/vfio_pci_core.c\n@@ -162,9 +162,10 @@ static inline void vfio_pci_core_debugfs_init(struct vfio_pci_core_device *vdev)\n  * has no way to get to it and routing can be disabled externally at the\n  * bridge.\n  */\n-static unsigned int vfio_pci_set_decode(struct pci_dev *pdev, bool single_vga)\n+static unsigned int vfio_pci_set_decode(void *data, bool single_vga)\n {\n-\tstruct vfio_pci_core_device *vdev = dev_get_drvdata(\u0026pdev-\u003edev);\n+\tstruct vfio_pci_core_device *vdev = data;\n+\tstruct pci_dev *pdev = vdev-\u003epdev;\n \tstruct pci_dev *tmp = NULL;\n \tunsigned char max_busnr;\n \tunsigned int decodes;\n@@ -2159,10 +2160,10 @@ static int vfio_pci_vga_init(struct vfio_pci_core_device *vdev)\n \tif (ret)\n \t\treturn ret;\n \n-\tret = vga_client_register(pdev, vfio_pci_set_decode);\n+\tret = vga_client_register(pdev, vfio_pci_set_decode, vdev);\n \tif (ret)\n \t\treturn ret;\n-\tvga_set_legacy_decoding(pdev, vfio_pci_set_decode(pdev, false));\n+\tvga_set_legacy_decoding(pdev, vfio_pci_set_decode(vdev, false));\n \treturn 0;\n }\n \ndiff --git a/include/linux/vgaarb.h b/include/linux/vgaarb.h\nindex 97129a1bbb7df..71a364669eaf8 100644\n--- a/include/linux/vgaarb.h\n+++ b/include/linux/vgaarb.h\n@@ -33,7 +33,8 @@ struct pci_dev *vga_default_device(void);\n void vga_set_default_device(struct pci_dev *pdev);\n int vga_remove_vgacon(struct pci_dev *pdev);\n int vga_client_register(struct pci_dev *pdev,\n-\t\tunsigned int (*set_decode)(struct pci_dev *pdev, bool state));\n+\t\tunsigned int (*set_decode)(void *data, bool state),\n+\t\tvoid *data);\n #else /* CONFIG_VGA_ARB */\n static inline void vga_set_legacy_decoding(struct pci_dev *pdev,\n \t\tunsigned int decodes)\n@@ -59,7 +60,8 @@ static inline int vga_remove_vgacon(struct pci_dev *pdev)\n \treturn 0;\n }\n static inline int vga_client_register(struct pci_dev *pdev,\n-\t\tunsigned int (*set_decode)(struct pci_dev *pdev, bool state))\n+\t\tunsigned int (*set_decode)(void *data, bool state),\n+\t\tvoid *data)\n {\n \treturn 0;\n }\n@@ -97,7 +99,7 @@ static inline int vga_get_uninterruptible(struct pci_dev *pdev,\n \n static inline void vga_client_unregister(struct pci_dev *pdev)\n {\n-\tvga_client_register(pdev, NULL);\n+\tvga_client_register(pdev, NULL, NULL);\n }\n \n #endif /* LINUX_VGA_H */\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch refactors the VGA arbiter callback interface (vga_client_register and set_decode) to pass a private data pointer instead of pci_dev. The only consumers that implement and register this callback are vendor-specific physical GPU drivers (amdgpu, radeon, nouveau, i915, lsdc) and vfio-pci. Because none of these GPU drivers or vfio-pci VGA passthrough are emulated or present in standard virtualized fuzzing environments (QEMU/GCE), the modified code in these drivers as well as the callback registration and invocation paths in vgaarb.c are structurally unreachable.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 65f3a05b2b579024b50859348b98a69ea533a7ea
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Sep 24 09:05:16 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 62b5b4a23f17b..1344b2b1bd162 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1435,10 +1435,10 @@ bool amdgpu_device_should_use_aspm(struct amdgpu_device *adev)
  * Enable/disable vga decode (all asics).
  * Returns VGA resource flags.
  */
-static unsigned int amdgpu_device_vga_set_decode(struct pci_dev *pdev,
+static unsigned int amdgpu_device_vga_set_decode(void *data,
 		bool state)
 {
-	struct amdgpu_device *adev = drm_to_adev(pci_get_drvdata(pdev));
+	struct amdgpu_device *adev = (struct amdgpu_device *)data;
 
 	amdgpu_asic_set_vga_state(adev, state);
 	if (state)
@@ -4208,7 +4208,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
 	 * ignore it
 	 */
 	if ((adev->pdev->class >> 8) == PCI_CLASS_DISPLAY_VGA)
-		vga_client_register(adev->pdev, amdgpu_device_vga_set_decode);
+		vga_client_register(adev->pdev, amdgpu_device_vga_set_decode, adev);
 
 	px = amdgpu_device_supports_px(adev);
 
diff --git a/drivers/gpu/drm/i915/display/intel_vga.c b/drivers/gpu/drm/i915/display/intel_vga.c
index 4966fd7eea92b..0889edb361901 100644
--- a/drivers/gpu/drm/i915/display/intel_vga.c
+++ b/drivers/gpu/drm/i915/display/intel_vga.c
@@ -283,9 +283,10 @@ void intel_vga_disable(struct intel_display *display)
 	intel_de_posting_read(display, vga_reg);
 }
 
-static unsigned int intel_vga_set_decode(struct pci_dev *pdev, bool enable_decode)
+static unsigned int intel_vga_set_decode(void *data, bool enable_decode)
 {
-	struct intel_display *display = to_intel_display(pdev);
+	struct intel_display *display = (struct intel_display *)data;
+	struct pci_dev *pdev = to_pci_dev(display->drm->dev);
 	unsigned int decodes = VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM;
 
 	drm_dbg_kms(display->drm, "%s VGA decode due to VGA arbitration\n",
@@ -331,7 +332,7 @@ void intel_vga_register(struct intel_display *display)
 	 * then we do not take part in VGA arbitration and the
 	 * vga_client_register() fails with -ENODEV.
 	 */
-	ret = vga_client_register(pdev, intel_vga_set_decode);
+	ret = vga_client_register(pdev, intel_vga_set_decode, display);
 	drm_WARN_ON(display->drm, ret && ret != -ENODEV);
 }
 
diff --git a/drivers/gpu/drm/loongson/lsdc_drv.c b/drivers/gpu/drm/loongson/lsdc_drv.c
index 3fd828d23271c..5a13df31eb902 100644
--- a/drivers/gpu/drm/loongson/lsdc_drv.c
+++ b/drivers/gpu/drm/loongson/lsdc_drv.c
@@ -254,7 +254,7 @@ lsdc_create_device(struct pci_dev *pdev,
 
 /* For multiple GPU driver instance co-exixt in the system */
 
-static unsigned int lsdc_vga_set_decode(struct pci_dev *pdev, bool state)
+static unsigned int lsdc_vga_set_decode(void *data, bool state)
 {
 	return VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM;
 }
@@ -291,7 +291,7 @@ static int lsdc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 	pci_set_drvdata(pdev, ddev);
 
-	vga_client_register(pdev, lsdc_vga_set_decode);
+	vga_client_register(pdev, lsdc_vga_set_decode, NULL);
 
 	drmm_kms_helper_poll_init(ddev);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_vga.c b/drivers/gpu/drm/nouveau/nouveau_vga.c
index 29a801124e560..6662e30466f22 100644
--- a/drivers/gpu/drm/nouveau/nouveau_vga.c
+++ b/drivers/gpu/drm/nouveau/nouveau_vga.c
@@ -9,9 +9,9 @@
 #include "nouveau_vga.h"
 
 static unsigned int
-nouveau_vga_set_decode(struct pci_dev *pdev, bool state)
+nouveau_vga_set_decode(void *data, bool state)
 {
-	struct nouveau_drm *drm = pci_get_drvdata(pdev);
+	struct nouveau_drm *drm = (struct nouveau_drm *)data;
 	struct nvif_object *device = &drm->client.device.object;
 
 	if (drm->client.device.info.family == NV_DEVICE_INFO_V0_CURIE &&
@@ -103,7 +103,7 @@ nouveau_vga_init(struct nouveau_drm *drm)
 		return;
 	pdev = to_pci_dev(dev->dev);
 
-	vga_client_register(pdev, nouveau_vga_set_decode);
+	vga_client_register(pdev, nouveau_vga_set_decode, drm);
 
 	/* don't register Thunderbolt eGPU with vga_switcheroo */
 	if (pci_is_thunderbolt_attached(pdev))
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 9523240110a6a..cf8a6bd00c77e 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1076,10 +1076,9 @@ void radeon_combios_fini(struct radeon_device *rdev)
  * Enable/disable vga decode (all asics).
  * Returns VGA resource flags.
  */
-static unsigned int radeon_vga_set_decode(struct pci_dev *pdev, bool state)
+static unsigned int radeon_vga_set_decode(void *data, bool state)
 {
-	struct drm_device *dev = pci_get_drvdata(pdev);
-	struct radeon_device *rdev = dev->dev_private;
+	struct radeon_device *rdev = (struct radeon_device *)data;
 	radeon_vga_set_state(rdev, state);
 	if (state)
 		return VGA_RSRC_LEGACY_IO | VGA_RSRC_LEGACY_MEM |
@@ -1431,7 +1430,7 @@ int radeon_device_init(struct radeon_device *rdev,
 	/* if we have > 1 VGA cards, then disable the radeon VGA resources */
 	/* this will fail for cards that aren't VGA class devices, just
 	 * ignore it */
-	vga_client_register(rdev->pdev, radeon_vga_set_decode);
+	vga_client_register(rdev->pdev, radeon_vga_set_decode, rdev);
 
 	if (rdev->flags & RADEON_IS_PX)
 		runtime = true;
diff --git a/drivers/pci/vgaarb.c b/drivers/pci/vgaarb.c
index 3de05aee78599..3e58b2c05c854 100644
--- a/drivers/pci/vgaarb.c
+++ b/drivers/pci/vgaarb.c
@@ -51,7 +51,8 @@ struct vga_device {
 	unsigned int mem_norm_cnt;	/* normal MEM count */
 	bool bridge_has_one_vga;
 	bool is_firmware_default;	/* device selected by firmware */
-	unsigned int (*set_decode)(struct pci_dev *pdev, bool decode);
+	unsigned int (*set_decode)(void *data, bool decode);
+	void *set_decode_data;
 };
 
 static LIST_HEAD(vga_list);
@@ -935,6 +936,7 @@ EXPORT_SYMBOL(vga_set_legacy_decoding);
  * vga_client_register - register or unregister a VGA arbitration client
  * @pdev: PCI device of the VGA client
  * @set_decode: VGA decode change callback
+ * @data: private data to pass to callback
  *
  * Clients have two callback mechanisms they can use.
  *
@@ -956,15 +958,18 @@ EXPORT_SYMBOL(vga_set_legacy_decoding);
  * Returns: 0 on success, -ENODEV on failure
  */
 int vga_client_register(struct pci_dev *pdev,
-		unsigned int (*set_decode)(struct pci_dev *pdev, bool decode))
+		unsigned int (*set_decode)(void *data, bool decode),
+		void *data)
 {
 	unsigned long flags;
 	struct vga_device *vgadev;
 
 	spin_lock_irqsave(&vga_lock, flags);
 	vgadev = vgadev_find(pdev);
-	if (vgadev)
+	if (vgadev) {
 		vgadev->set_decode = set_decode;
+		vgadev->set_decode_data = data;
+	}
 	spin_unlock_irqrestore(&vga_lock, flags);
 	if (!vgadev)
 		return -ENODEV;
@@ -1464,7 +1469,7 @@ static void vga_arbiter_notify_clients(void)
 	spin_lock_irqsave(&vga_lock, flags);
 	list_for_each_entry(vgadev, &vga_list, list) {
 		if (vgadev->set_decode) {
-			new_decodes = vgadev->set_decode(vgadev->pdev,
+			new_decodes = vgadev->set_decode(vgadev->set_decode_data,
 							 new_state);
 			vga_update_device_decodes(vgadev, new_decodes);
 		}
diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
index 6757054e9d875..b04ce3ded08c2 100644
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -162,9 +162,10 @@ static inline void vfio_pci_core_debugfs_init(struct vfio_pci_core_device *vdev)
  * has no way to get to it and routing can be disabled externally at the
  * bridge.
  */
-static unsigned int vfio_pci_set_decode(struct pci_dev *pdev, bool single_vga)
+static unsigned int vfio_pci_set_decode(void *data, bool single_vga)
 {
-	struct vfio_pci_core_device *vdev = dev_get_drvdata(&pdev->dev);
+	struct vfio_pci_core_device *vdev = data;
+	struct pci_dev *pdev = vdev->pdev;
 	struct pci_dev *tmp = NULL;
 	unsigned char max_busnr;
 	unsigned int decodes;
@@ -2159,10 +2160,10 @@ static int vfio_pci_vga_init(struct vfio_pci_core_device *vdev)
 	if (ret)
 		return ret;
 
-	ret = vga_client_register(pdev, vfio_pci_set_decode);
+	ret = vga_client_register(pdev, vfio_pci_set_decode, vdev);
 	if (ret)
 		return ret;
-	vga_set_legacy_decoding(pdev, vfio_pci_set_decode(pdev, false));
+	vga_set_legacy_decoding(pdev, vfio_pci_set_decode(vdev, false));
 	return 0;
 }
 
diff --git a/include/linux/vgaarb.h b/include/linux/vgaarb.h
index 97129a1bbb7df..71a364669eaf8 100644
--- a/include/linux/vgaarb.h
+++ b/include/linux/vgaarb.h
@@ -33,7 +33,8 @@ struct pci_dev *vga_default_device(void);
 void vga_set_default_device(struct pci_dev *pdev);
 int vga_remove_vgacon(struct pci_dev *pdev);
 int vga_client_register(struct pci_dev *pdev,
-		unsigned int (*set_decode)(struct pci_dev *pdev, bool state));
+		unsigned int (*set_decode)(void *data, bool state),
+		void *data);
 #else /* CONFIG_VGA_ARB */
 static inline void vga_set_legacy_decoding(struct pci_dev *pdev,
 		unsigned int decodes)
@@ -59,7 +60,8 @@ static inline int vga_remove_vgacon(struct pci_dev *pdev)
 	return 0;
 }
 static inline int vga_client_register(struct pci_dev *pdev,
-		unsigned int (*set_decode)(struct pci_dev *pdev, bool state))
+		unsigned int (*set_decode)(void *data, bool state),
+		void *data)
 {
 	return 0;
 }
@@ -97,7 +99,7 @@ static inline int vga_get_uninterruptible(struct pci_dev *pdev,
 
 static inline void vga_client_unregister(struct pci_dev *pdev)
 {
-	vga_client_register(pdev, NULL);
+	vga_client_register(pdev, NULL, NULL);
 }
 
 #endif /* LINUX_VGA_H */

gemini-3.8-flash

null

null

							input: 6661
							output: 33
							thoughts: 503
						

**Analyzing the VGA Arbiter Patch**

Okay, let's break this down. The first thing that jumps out is the wide reach of this patch – it touches a slew of GPU-related drivers, including AMDGPU, Intel i915, Loongson, Nouveau, Radeon, VFIO-PCI, and the VGA arbiter core itself. The file changes immediately suggest a significant modification to how VGA arbiter interacts with these different graphics drivers.

So, the core change revolves around `vga_client_register`. Previously, it took the PCI device and a function pointer, `set_decode`. Now, it’s been modified to also include a `data` void pointer argument, resulting in `vga_client_register(struct pci_dev *pdev, unsigned int (*set_decode)(void *data, bool decode), void *data)`. This strongly hints at introducing a generic context or state object to the `set_decode` callback. And from a quick scan, it looks like `data` is being stored as `vgadev->set_decode_data` within `vgaarb.c`. This is my primary area of focus.

The implementation in `vga_arbiter_notify_clients()` then calls `vgadev->set_decode` with the stored `data` and the new decode state. This is exactly what I expected. The `data` pointer is passed to the `set_decode` callback.

Now, looking at how each driver utilizes this `data` pointer is interesting. Each driver, in their implementation of `set_decode`, seems to cast that `data` pointer into a specific structure appropriate for their device. AMDGPU uses `amdgpu_device`, i915 uses `intel_display`, lsdc seems to ignore the data, nouveau uses `nouveau_drm`, radeon uses `radeon_device`, and VFIO-PCI uses `vdev`. This is a clear pattern of providing driver-specific context to `set_decode`.

However, the question that is forming in my mind is - how accessible is this vgaarb functionality? Can I get at it in a QEMU environment? Is the VGA arbiter misc device `/dev/vga_arbiter` a standard part of a virtualized fuzzing environment? This is important. If I can't reach this functionality in standard virtualized fuzzing environments, I need to check how to reach it. That's a good place to start. I'll need to double check how `vgaarb.c` operates, because I don't recall this being available in QEMU.

{
  "Expression": "misc_register",
  "PathPrefix": "drivers/pci/vgaarb.c"
}

{
  "Output": "drivers/pci/vgaarb.c=1525=static int __init vga_arb_device_init(void)\n--\ndrivers/pci/vgaarb.c-1529-\ndrivers/pci/vgaarb.c:1530:\trc = misc_register(\u0026vga_arb_device);\ndrivers/pci/vgaarb.c-1531-\tif (rc \u003c 0)\n"
}

gemini-3.8-flash

null

null

							input: 7868
							output: 39
							thoughts: 38
						

Okay, here's my summary, taking the role of the expert:

**Investigating VGA Arbitration and Notification**

Alright, let's dive in. My immediate thought is to head straight to the source. I need to understand how the VGA arbitration process actually functions and, specifically, how notifications are handled. My gut tells me that `drivers/pci/vgaarb.c` is the likely place to start looking. I'll need to pinpoint where and how `vga_arbiter_notify_clients` gets invoked. More importantly, I need to get a clear picture of the surrounding context: what operations are taking place, what data structures are involved, and what's the overall flow of control around that function call. Understanding the function calls around `vga_arbiter_notify_clients` will provide a larger context for deeper analysis. I anticipate, at this point, needing to examine the arguments passed, see the conditions that trigger the notification, and then trace what each client is doing in response. That information, along with understanding what `vga_arbiter_notify_clients` is doing, itself, will be key to grasping this part of the VGA arbitration implementation. I need to see if this is a broadcast, targeted, or conditional call. Only then can I truly analyze the implications of these client notifications.

{
  "Expression": "vga_arbiter_notify_clients",
  "PathPrefix": "drivers/pci/vgaarb.c"
}

{
  "Output": "drivers/pci/vgaarb.c-35-\ndrivers/pci/vgaarb.c:36:static void vga_arbiter_notify_clients(void);\ndrivers/pci/vgaarb.c-37-\n--\ndrivers/pci/vgaarb.c=199=static void vga_check_first_use(void)\n--\ndrivers/pci/vgaarb.c-206-\t\tvga_arbiter_used = true;\ndrivers/pci/vgaarb.c:207:\t\tvga_arbiter_notify_clients();\ndrivers/pci/vgaarb.c-208-\t}\n--\ndrivers/pci/vgaarb.c=1424=static int vga_arb_release(struct inode *inode, struct file *file)\n--\ndrivers/pci/vgaarb.c-1456- */\ndrivers/pci/vgaarb.c:1457:static void vga_arbiter_notify_clients(void)\ndrivers/pci/vgaarb.c-1458-{\n--\ndrivers/pci/vgaarb.c=1480=static int pci_notify(struct notifier_block *nb, unsigned long action,\n--\ndrivers/pci/vgaarb.c-1503-\tif (notify)\ndrivers/pci/vgaarb.c:1504:\t\tvga_arbiter_notify_clients();\ndrivers/pci/vgaarb.c-1505-\treturn 0;\n"
}

gemini-3.8-flash

null

null

							input: 8615
							output: 20
							thoughts: 119
						

**Investigating VGA Arbiter Notifications**

Okay, so I'm diving into this `vga_arbiter_notify_clients()` function. The code's telling me it's triggered from two primary places: `vga_check_first_use()`, which makes sense; that's the entry point when someone's interacting with `/dev/vga_arbiter` or attempting to access VGA resources through the arbiter. The second call from `pci_notify()` is interesting - that's the bus notifier. It's likely related to PCI device hotplugging or changes on the bus, and how the VGA arbiter is informed.

Now, a crucial question pops up. Are there any VGA devices registered with `set_decode` within QEMU's configuration? If so, this has a direct bearing on this notification path and what the implications are when a device is added or removed. It changes the dynamic of the VGA resource management. I need to understand that piece.

Alright, the next step is to figure out which kernel drivers actually *call* `vga_client_register`. That's where the real game is. The devices that register as clients are the ones who are the subject of these notifications, right? Time to fire up the grep and get a good sweep across the kernel source. Let's see who's playing in this VGA client space. I need to identify what these drivers are, how they interact, and how they use this registration to provide VGA access.

{
  "Expression": "vga_client_register"
}

{
  "Output": "drivers/gpu/drm/amd/amdgpu/amdgpu_device.c=3775=int amdgpu_device_init(struct amdgpu_device *adev,\n--\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c-4210-\tif ((adev-\u003epdev-\u003eclass \u003e\u003e 8) == PCI_CLASS_DISPLAY_VGA)\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4211:\t\tvga_client_register(adev-\u003epdev, amdgpu_device_vga_set_decode, adev);\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c-4212-\n--\ndrivers/gpu/drm/i915/display/intel_vga.c=321=void intel_vga_register(struct intel_display *display)\n--\ndrivers/gpu/drm/i915/display/intel_vga.c-332-\t * then we do not take part in VGA arbitration and the\ndrivers/gpu/drm/i915/display/intel_vga.c:333:\t * vga_client_register() fails with -ENODEV.\ndrivers/gpu/drm/i915/display/intel_vga.c-334-\t */\ndrivers/gpu/drm/i915/display/intel_vga.c:335:\tret = vga_client_register(pdev, intel_vga_set_decode, display);\ndrivers/gpu/drm/i915/display/intel_vga.c-336-\tdrm_WARN_ON(display-\u003edrm, ret \u0026\u0026 ret != -ENODEV);\n--\ndrivers/gpu/drm/loongson/lsdc_drv.c=262=static int lsdc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)\n--\ndrivers/gpu/drm/loongson/lsdc_drv.c-293-\ndrivers/gpu/drm/loongson/lsdc_drv.c:294:\tvga_client_register(pdev, lsdc_vga_set_decode, NULL);\ndrivers/gpu/drm/loongson/lsdc_drv.c-295-\n--\ndrivers/gpu/drm/nouveau/nouveau_vga.c=95=nouveau_vga_init(struct nouveau_drm *drm)\n--\ndrivers/gpu/drm/nouveau/nouveau_vga.c-105-\ndrivers/gpu/drm/nouveau/nouveau_vga.c:106:\tvga_client_register(pdev, nouveau_vga_set_decode, drm);\ndrivers/gpu/drm/nouveau/nouveau_vga.c-107-\n--\ndrivers/gpu/drm/radeon/radeon_device.c=1285=int radeon_device_init(struct radeon_device *rdev,\n--\ndrivers/gpu/drm/radeon/radeon_device.c-1432-\t * ignore it */\ndrivers/gpu/drm/radeon/radeon_device.c:1433:\tvga_client_register(rdev-\u003epdev, radeon_vga_set_decode, rdev);\ndrivers/gpu/drm/radeon/radeon_device.c-1434-\n--\ndrivers/pci/vgaarb.c=933=EXPORT_SYMBOL(vga_set_legacy_decoding);\n--\ndrivers/pci/vgaarb.c-935-/**\ndrivers/pci/vgaarb.c:936: * vga_client_register - register or unregister a VGA arbitration client\ndrivers/pci/vgaarb.c-937- * @pdev: PCI device of the VGA client\n--\ndrivers/pci/vgaarb.c-959- */\ndrivers/pci/vgaarb.c:960:int vga_client_register(struct pci_dev *pdev,\ndrivers/pci/vgaarb.c-961-\t\tunsigned int (*set_decode)(void *data, bool decode),\n--\ndrivers/pci/vgaarb.c-977-}\ndrivers/pci/vgaarb.c:978:EXPORT_SYMBOL(vga_client_register);\ndrivers/pci/vgaarb.c-979-\n--\ndrivers/vfio/pci/vfio_pci_core.c=2151=static int vfio_pci_vga_init(struct vfio_pci_core_device *vdev)\n--\ndrivers/vfio/pci/vfio_pci_core.c-2162-\ndrivers/vfio/pci/vfio_pci_core.c:2163:\tret = vga_client_register(pdev, vfio_pci_set_decode, vdev);\ndrivers/vfio/pci/vfio_pci_core.c-2164-\tif (ret)\n--\ninclude/linux/vgaarb.h=34=int vga_remove_vgacon(struct pci_dev *pdev);\ninclude/linux/vgaarb.h:35:int vga_client_register(struct pci_dev *pdev,\ninclude/linux/vgaarb.h-36-\t\tunsigned int (*set_decode)(void *data, bool state),\n--\ninclude/linux/vgaarb.h=58=static inline int vga_remove_vgacon(struct pci_dev *pdev)\n--\ninclude/linux/vgaarb.h-61-}\ninclude/linux/vgaarb.h:62:static inline int vga_client_register(struct pci_dev *pdev,\ninclude/linux/vgaarb.h-63-\t\tunsigned int (*set_decode)(void *data, bool state),\n--\ninclude/linux/vgaarb.h=100=static inline void vga_client_unregister(struct pci_dev *pdev)\ninclude/linux/vgaarb.h-101-{\ninclude/linux/vgaarb.h:102:\tvga_client_register(pdev, NULL, NULL);\ninclude/linux/vgaarb.h-103-}\n"
}

gemini-3.8-flash

null

null

							input: 10621
							output: 38
							thoughts: 500
						

**My Investigation into `vga_client_register` Callers**

Okay, so I'm diving into the callers of `vga_client_register`. My initial assessment shows it's called by a bunch of hardware-specific drivers: `amdgpu`, `i915`, `lsdc`, `nouveau`, `radeon`, and `vfio-pci`.  That's pretty standard, these are all dealing with actual physical GPUs, whether integrated or discrete.

But wait a minute... what about the *emulated* VGA devices, like the ones used in QEMU?  Where are `qemu-vga`, `virtio-gpu`, `bochs-drm`, `cirrus` in all this? Surely they need to register somehow.  I did a quick `grep`, but it only turned up the drivers I listed before. That's odd. Seems like a fairly exhaustive search, so I'm inclined to believe it.

Okay, let's think this through. `vfio-pci` is on the list, but doesn't it require an actual PCI device to be bound to?  In a fuzzing environment like syzkaller, which typically runs in QEMU, can `vfio-pci` even *find* a VGA device to bind to? Or does the QEMU setup have a device it passes through for `vfio-pci` to grab? I need to clarify how that interaction works.

Let me go back and check the syzkaller documentation on structurally unreachable hardware in Section 2. Ah, here it is: "Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU." This is exactly what I was considering! This probably means there isn't a direct passthrough, and the assumption is that the vfio-pci is accessing real hardware.

Right, so that leaves me wondering about `vgaarb.c`. What's *its* role here? Could it be orchestrating something? Is it even relevant? I need to check if `drivers/pci/vgaarb.c` is even reachable from my current context. I need to understand what that file *does*. Time to read the source.

{
  "File": "drivers/pci/vgaarb.c",
  "FirstLine": 945,
  "LineCount": 45
}

{
  "Contents": " 945:\t *\n 946:\t * Rationale: we cannot disable VGA decode resources unconditionally\n 947:\t * because some single GPU laptops seem to require ACPI or BIOS access to\n 948:\t * the VGA registers to control things like backlights etc. Hopefully newer\n 949:\t * multi-GPU laptops do something saner, and desktops won't have any\n 950:\t * special ACPI for this. The driver will get a callback when VGA\n 951:\t * arbitration is first used by userspace since some older X servers have\n 952:\t * issues.\n 953:\t *\n 954:\t * Does not check whether a client for @pdev has been registered already.\n 955:\t *\n 956:\t * To unregister, call vga_client_unregister().\n 957:\t *\n 958:\t * Returns: 0 on success, -ENODEV on failure\n 959:\t */\n 960:\tint vga_client_register(struct pci_dev *pdev,\n 961:\t\t\tunsigned int (*set_decode)(void *data, bool decode),\n 962:\t\t\tvoid *data)\n 963:\t{\n 964:\t\tunsigned long flags;\n 965:\t\tstruct vga_device *vgadev;\n 966:\t\n 967:\t\tspin_lock_irqsave(\u0026vga_lock, flags);\n 968:\t\tvgadev = vgadev_find(pdev);\n 969:\t\tif (vgadev) {\n 970:\t\t\tvgadev-\u003eset_decode = set_decode;\n 971:\t\t\tvgadev-\u003eset_decode_data = data;\n 972:\t\t}\n 973:\t\tspin_unlock_irqrestore(\u0026vga_lock, flags);\n 974:\t\tif (!vgadev)\n 975:\t\t\treturn -ENODEV;\n 976:\t\treturn 0;\n 977:\t}\n 978:\tEXPORT_SYMBOL(vga_client_register);\n 979:\t\n 980:\t/*\n 981:\t * Char driver implementation\n 982:\t *\n 983:\t * Semantics is:\n 984:\t *\n 985:\t *  open       : Open user instance of the arbiter. By default, it's\n 986:\t *                attached to the default VGA device of the system.\n 987:\t *\n 988:\t *  close      : Close user instance, release locks\n 989:\t *\n"
}

gemini-3.8-flash

null

null

							input: 12333
							output: 32
							thoughts: 40
						

Okay, let's dive into this. Here's how I'd approach understanding the creation of `vgadev` in `vgaarb.c`, from an expert's perspective:

**Investigating `vgadev` in `vgaarb.c`**

Alright, my first instinct is to pin down the instantiation of the `vgadev` structure. I know it's fundamental to VGA arbitration, so tracking its origin is key. The most direct approach, of course, is to go straight to the source. Let's start with `drivers/pci/vgaarb.c` and use `grep` to hunt down instances of `vgadev`. That will show me where the structure is declared, allocated, initialized, and ultimately used. This is going to give me a good landscape of how the object comes into existence and how it is subsequently utilized. From that point I can begin to reason about the logic around its creation and its place in the VGA arbitration process.

{
  "Expression": "vgadev",
  "PathPrefix": "drivers/pci/vgaarb.c"
}

{
  "Output": "drivers/pci/vgaarb.c=104=static struct pci_dev *vga_default;\n--\ndrivers/pci/vgaarb.c-106-/* Find somebody in our list */\ndrivers/pci/vgaarb.c:107:static struct vga_device *vgadev_find(struct pci_dev *pdev)\ndrivers/pci/vgaarb.c-108-{\ndrivers/pci/vgaarb.c:109:\tstruct vga_device *vgadev;\ndrivers/pci/vgaarb.c-110-\ndrivers/pci/vgaarb.c:111:\tlist_for_each_entry(vgadev, \u0026vga_list, list)\ndrivers/pci/vgaarb.c:112:\t\tif (pdev == vgadev-\u003epdev)\ndrivers/pci/vgaarb.c:113:\t\t\treturn vgadev;\ndrivers/pci/vgaarb.c-114-\treturn NULL;\n--\ndrivers/pci/vgaarb.c=199=static void vga_check_first_use(void)\n--\ndrivers/pci/vgaarb.c-210-\ndrivers/pci/vgaarb.c:211:static struct vga_device *__vga_tryget(struct vga_device *vgadev,\ndrivers/pci/vgaarb.c-212-\t\t\t\t       unsigned int rsrc)\ndrivers/pci/vgaarb.c-213-{\ndrivers/pci/vgaarb.c:214:\tstruct device *dev = \u0026vgadev-\u003epdev-\u003edev;\ndrivers/pci/vgaarb.c-215-\tunsigned int wants, legacy_wants, match;\n--\ndrivers/pci/vgaarb.c-225-\tif ((rsrc \u0026 VGA_RSRC_NORMAL_IO) \u0026\u0026\ndrivers/pci/vgaarb.c:226:\t    (vgadev-\u003edecodes \u0026 VGA_RSRC_LEGACY_IO))\ndrivers/pci/vgaarb.c-227-\t\trsrc |= VGA_RSRC_LEGACY_IO;\ndrivers/pci/vgaarb.c-228-\tif ((rsrc \u0026 VGA_RSRC_NORMAL_MEM) \u0026\u0026\ndrivers/pci/vgaarb.c:229:\t    (vgadev-\u003edecodes \u0026 VGA_RSRC_LEGACY_MEM))\ndrivers/pci/vgaarb.c-230-\t\trsrc |= VGA_RSRC_LEGACY_MEM;\n--\ndrivers/pci/vgaarb.c-232-\tvgaarb_dbg(dev, \"%s: %d\\n\", __func__, rsrc);\ndrivers/pci/vgaarb.c:233:\tvgaarb_dbg(dev, \"%s: owns: %d\\n\", __func__, vgadev-\u003eowns);\ndrivers/pci/vgaarb.c-234-\ndrivers/pci/vgaarb.c-235-\t/* Check what resources we need to acquire */\ndrivers/pci/vgaarb.c:236:\twants = rsrc \u0026 ~vgadev-\u003eowns;\ndrivers/pci/vgaarb.c-237-\n--\ndrivers/pci/vgaarb.c-255-\t\t/* Don't conflict with myself */\ndrivers/pci/vgaarb.c:256:\t\tif (vgadev == conflict)\ndrivers/pci/vgaarb.c-257-\t\t\tcontinue;\n--\ndrivers/pci/vgaarb.c-265-\t\t */\ndrivers/pci/vgaarb.c:266:\t\tif (vgadev-\u003epdev-\u003ebus != conflict-\u003epdev-\u003ebus) {\ndrivers/pci/vgaarb.c-267-\t\t\tchange_bridge = 1;\n--\ndrivers/pci/vgaarb.c-333-\ndrivers/pci/vgaarb.c:334:\tif (!vgadev-\u003ebridge_has_one_vga) {\ndrivers/pci/vgaarb.c-335-\t\tflags |= PCI_VGA_STATE_CHANGE_DECODES;\n--\ndrivers/pci/vgaarb.c-343-\ndrivers/pci/vgaarb.c:344:\terr = pci_set_vga_state(vgadev-\u003epdev, true, pci_bits, flags);\ndrivers/pci/vgaarb.c-345-\tif (err)\n--\ndrivers/pci/vgaarb.c-347-\ndrivers/pci/vgaarb.c:348:\tvgadev-\u003eowns |= wants;\ndrivers/pci/vgaarb.c-349-lock_them:\ndrivers/pci/vgaarb.c:350:\tvgadev-\u003elocks |= (rsrc \u0026 VGA_RSRC_LEGACY_MASK);\ndrivers/pci/vgaarb.c-351-\tif (rsrc \u0026 VGA_RSRC_LEGACY_IO)\ndrivers/pci/vgaarb.c:352:\t\tvgadev-\u003eio_lock_cnt++;\ndrivers/pci/vgaarb.c-353-\tif (rsrc \u0026 VGA_RSRC_LEGACY_MEM)\ndrivers/pci/vgaarb.c:354:\t\tvgadev-\u003emem_lock_cnt++;\ndrivers/pci/vgaarb.c-355-\tif (rsrc \u0026 VGA_RSRC_NORMAL_IO)\ndrivers/pci/vgaarb.c:356:\t\tvgadev-\u003eio_norm_cnt++;\ndrivers/pci/vgaarb.c-357-\tif (rsrc \u0026 VGA_RSRC_NORMAL_MEM)\ndrivers/pci/vgaarb.c:358:\t\tvgadev-\u003emem_norm_cnt++;\ndrivers/pci/vgaarb.c-359-\n--\ndrivers/pci/vgaarb.c-362-\ndrivers/pci/vgaarb.c:363:static void __vga_put(struct vga_device *vgadev, unsigned int rsrc)\ndrivers/pci/vgaarb.c-364-{\ndrivers/pci/vgaarb.c:365:\tstruct device *dev = \u0026vgadev-\u003epdev-\u003edev;\ndrivers/pci/vgaarb.c:366:\tunsigned int old_locks = vgadev-\u003elocks;\ndrivers/pci/vgaarb.c-367-\n--\ndrivers/pci/vgaarb.c-373-\t */\ndrivers/pci/vgaarb.c:374:\tif ((rsrc \u0026 VGA_RSRC_NORMAL_IO) \u0026\u0026 vgadev-\u003eio_norm_cnt \u003e 0) {\ndrivers/pci/vgaarb.c:375:\t\tvgadev-\u003eio_norm_cnt--;\ndrivers/pci/vgaarb.c:376:\t\tif (vgadev-\u003edecodes \u0026 VGA_RSRC_LEGACY_IO)\ndrivers/pci/vgaarb.c-377-\t\t\trsrc |= VGA_RSRC_LEGACY_IO;\ndrivers/pci/vgaarb.c-378-\t}\ndrivers/pci/vgaarb.c:379:\tif ((rsrc \u0026 VGA_RSRC_NORMAL_MEM) \u0026\u0026 vgadev-\u003emem_norm_cnt \u003e 0) {\ndrivers/pci/vgaarb.c:380:\t\tvgadev-\u003emem_norm_cnt--;\ndrivers/pci/vgaarb.c:381:\t\tif (vgadev-\u003edecodes \u0026 VGA_RSRC_LEGACY_MEM)\ndrivers/pci/vgaarb.c-382-\t\t\trsrc |= VGA_RSRC_LEGACY_MEM;\ndrivers/pci/vgaarb.c-383-\t}\ndrivers/pci/vgaarb.c:384:\tif ((rsrc \u0026 VGA_RSRC_LEGACY_IO) \u0026\u0026 vgadev-\u003eio_lock_cnt \u003e 0)\ndrivers/pci/vgaarb.c:385:\t\tvgadev-\u003eio_lock_cnt--;\ndrivers/pci/vgaarb.c:386:\tif ((rsrc \u0026 VGA_RSRC_LEGACY_MEM) \u0026\u0026 vgadev-\u003emem_lock_cnt \u003e 0)\ndrivers/pci/vgaarb.c:387:\t\tvgadev-\u003emem_lock_cnt--;\ndrivers/pci/vgaarb.c-388-\n--\ndrivers/pci/vgaarb.c-392-\t */\ndrivers/pci/vgaarb.c:393:\tif (vgadev-\u003eio_lock_cnt == 0)\ndrivers/pci/vgaarb.c:394:\t\tvgadev-\u003elocks \u0026= ~VGA_RSRC_LEGACY_IO;\ndrivers/pci/vgaarb.c:395:\tif (vgadev-\u003emem_lock_cnt == 0)\ndrivers/pci/vgaarb.c:396:\t\tvgadev-\u003elocks \u0026= ~VGA_RSRC_LEGACY_MEM;\ndrivers/pci/vgaarb.c-397-\n--\ndrivers/pci/vgaarb.c-401-\t */\ndrivers/pci/vgaarb.c:402:\tif (old_locks != vgadev-\u003elocks)\ndrivers/pci/vgaarb.c-403-\t\twake_up_all(\u0026vga_wait_queue);\n--\ndrivers/pci/vgaarb.c=440=int vga_get(struct pci_dev *pdev, unsigned int rsrc, int interruptible)\ndrivers/pci/vgaarb.c-441-{\ndrivers/pci/vgaarb.c:442:\tstruct vga_device *vgadev, *conflict;\ndrivers/pci/vgaarb.c-443-\tunsigned long flags;\n--\ndrivers/pci/vgaarb.c-455-\t\tspin_lock_irqsave(\u0026vga_lock, flags);\ndrivers/pci/vgaarb.c:456:\t\tvgadev = vgadev_find(pdev);\ndrivers/pci/vgaarb.c:457:\t\tif (vgadev == NULL) {\ndrivers/pci/vgaarb.c-458-\t\t\tspin_unlock_irqrestore(\u0026vga_lock, flags);\n--\ndrivers/pci/vgaarb.c-461-\t\t}\ndrivers/pci/vgaarb.c:462:\t\tconflict = __vga_tryget(vgadev, rsrc);\ndrivers/pci/vgaarb.c-463-\t\tspin_unlock_irqrestore(\u0026vga_lock, flags);\n--\ndrivers/pci/vgaarb.c=511=static int vga_tryget(struct pci_dev *pdev, unsigned int rsrc)\ndrivers/pci/vgaarb.c-512-{\ndrivers/pci/vgaarb.c:513:\tstruct vga_device *vgadev;\ndrivers/pci/vgaarb.c-514-\tunsigned long flags;\n--\ndrivers/pci/vgaarb.c-524-\tspin_lock_irqsave(\u0026vga_lock, flags);\ndrivers/pci/vgaarb.c:525:\tvgadev = vgadev_find(pdev);\ndrivers/pci/vgaarb.c:526:\tif (vgadev == NULL) {\ndrivers/pci/vgaarb.c-527-\t\trc = -ENODEV;\n--\ndrivers/pci/vgaarb.c-529-\t}\ndrivers/pci/vgaarb.c:530:\tif (__vga_tryget(vgadev, rsrc))\ndrivers/pci/vgaarb.c-531-\t\trc = -EBUSY;\n--\ndrivers/pci/vgaarb.c=547=void vga_put(struct pci_dev *pdev, unsigned int rsrc)\ndrivers/pci/vgaarb.c-548-{\ndrivers/pci/vgaarb.c:549:\tstruct vga_device *vgadev;\ndrivers/pci/vgaarb.c-550-\tunsigned long flags;\n--\ndrivers/pci/vgaarb.c-557-\tspin_lock_irqsave(\u0026vga_lock, flags);\ndrivers/pci/vgaarb.c:558:\tvgadev = vgadev_find(pdev);\ndrivers/pci/vgaarb.c:559:\tif (vgadev == NULL)\ndrivers/pci/vgaarb.c-560-\t\tgoto bail;\ndrivers/pci/vgaarb.c:561:\t__vga_put(vgadev, rsrc);\ndrivers/pci/vgaarb.c-562-bail:\n--\ndrivers/pci/vgaarb.c=576=static bool vga_arb_integrated_gpu(struct device *dev)\n--\ndrivers/pci/vgaarb.c-585-/*\ndrivers/pci/vgaarb.c:586: * Return true if vgadev is a better default VGA device than the best one\ndrivers/pci/vgaarb.c-587- * we've seen so far.\ndrivers/pci/vgaarb.c-588- */\ndrivers/pci/vgaarb.c:589:static bool vga_is_boot_device(struct vga_device *vgadev)\ndrivers/pci/vgaarb.c-590-{\ndrivers/pci/vgaarb.c:591:\tstruct vga_device *boot_vga = vgadev_find(vga_default_device());\ndrivers/pci/vgaarb.c:592:\tstruct pci_dev *pdev = vgadev-\u003epdev;\ndrivers/pci/vgaarb.c-593-\tu16 cmd, boot_cmd;\n--\ndrivers/pci/vgaarb.c-605-\t * We always prefer a firmware default device, so if we've already\ndrivers/pci/vgaarb.c:606:\t * found one, there's no need to consider vgadev.\ndrivers/pci/vgaarb.c-607-\t */\n--\ndrivers/pci/vgaarb.c-611-\tif (vga_is_firmware_default(pdev)) {\ndrivers/pci/vgaarb.c:612:\t\tvgadev-\u003eis_firmware_default = true;\ndrivers/pci/vgaarb.c-613-\t\treturn true;\n--\ndrivers/pci/vgaarb.c-622-\t * We use the first one we find, so if we've already found one,\ndrivers/pci/vgaarb.c:623:\t * vgadev is no better.\ndrivers/pci/vgaarb.c-624-\t */\n--\ndrivers/pci/vgaarb.c-628-\ndrivers/pci/vgaarb.c:629:\tif ((vgadev-\u003eowns \u0026 VGA_RSRC_LEGACY_MASK) == VGA_RSRC_LEGACY_MASK)\ndrivers/pci/vgaarb.c-630-\t\treturn true;\n--\ndrivers/pci/vgaarb.c-651-\t\t * We prefer the first non-legacy discrete device we find.\ndrivers/pci/vgaarb.c:652:\t\t * If we already found one, vgadev is no better.\ndrivers/pci/vgaarb.c-653-\t\t */\n--\ndrivers/pci/vgaarb.c-674- */\ndrivers/pci/vgaarb.c:675:static void vga_arbiter_check_bridge_sharing(struct vga_device *vgadev)\ndrivers/pci/vgaarb.c-676-{\ndrivers/pci/vgaarb.c:677:\tstruct vga_device *same_bridge_vgadev;\ndrivers/pci/vgaarb.c-678-\tstruct pci_bus *new_bus, *bus;\n--\ndrivers/pci/vgaarb.c-680-\ndrivers/pci/vgaarb.c:681:\tvgadev-\u003ebridge_has_one_vga = true;\ndrivers/pci/vgaarb.c-682-\ndrivers/pci/vgaarb.c-683-\tif (list_empty(\u0026vga_list)) {\ndrivers/pci/vgaarb.c:684:\t\tvgaarb_info(\u0026vgadev-\u003epdev-\u003edev, \"bridge control possible\\n\");\ndrivers/pci/vgaarb.c-685-\t\treturn;\n--\ndrivers/pci/vgaarb.c-688-\t/* Iterate the new device's bridge hierarchy */\ndrivers/pci/vgaarb.c:689:\tnew_bus = vgadev-\u003epdev-\u003ebus;\ndrivers/pci/vgaarb.c-690-\twhile (new_bus) {\n--\ndrivers/pci/vgaarb.c-693-\t\t/* Go through list of devices already registered */\ndrivers/pci/vgaarb.c:694:\t\tlist_for_each_entry(same_bridge_vgadev, \u0026vga_list, list) {\ndrivers/pci/vgaarb.c:695:\t\t\tbus = same_bridge_vgadev-\u003epdev-\u003ebus;\ndrivers/pci/vgaarb.c-696-\t\t\tbridge = bus-\u003eself;\n--\ndrivers/pci/vgaarb.c-704-\t\t\t\t */\ndrivers/pci/vgaarb.c:705:\t\t\t\tsame_bridge_vgadev-\u003ebridge_has_one_vga = false;\ndrivers/pci/vgaarb.c-706-\t\t\t}\n--\ndrivers/pci/vgaarb.c-716-\ndrivers/pci/vgaarb.c:717:\t\t\t\tif (bridge \u0026\u0026 bridge == vgadev-\u003epdev-\u003ebus-\u003eself)\ndrivers/pci/vgaarb.c:718:\t\t\t\t\tvgadev-\u003ebridge_has_one_vga = false;\ndrivers/pci/vgaarb.c-719-\n--\ndrivers/pci/vgaarb.c-725-\ndrivers/pci/vgaarb.c:726:\tif (vgadev-\u003ebridge_has_one_vga)\ndrivers/pci/vgaarb.c:727:\t\tvgaarb_info(\u0026vgadev-\u003epdev-\u003edev, \"bridge control possible\\n\");\ndrivers/pci/vgaarb.c-728-\telse\ndrivers/pci/vgaarb.c:729:\t\tvgaarb_info(\u0026vgadev-\u003epdev-\u003edev, \"no bridge control possible\\n\");\ndrivers/pci/vgaarb.c-730-}\n--\ndrivers/pci/vgaarb.c=737=static bool vga_arbiter_add_pci_device(struct pci_dev *pdev)\ndrivers/pci/vgaarb.c-738-{\ndrivers/pci/vgaarb.c:739:\tstruct vga_device *vgadev;\ndrivers/pci/vgaarb.c-740-\tunsigned long flags;\n--\ndrivers/pci/vgaarb.c-745-\t/* Allocate structure */\ndrivers/pci/vgaarb.c:746:\tvgadev = kzalloc_obj(struct vga_device);\ndrivers/pci/vgaarb.c:747:\tif (vgadev == NULL) {\ndrivers/pci/vgaarb.c-748-\t\tvgaarb_err(\u0026pdev-\u003edev, \"failed to allocate VGA arbiter data\\n\");\n--\ndrivers/pci/vgaarb.c-757-\tspin_lock_irqsave(\u0026vga_lock, flags);\ndrivers/pci/vgaarb.c:758:\tif (vgadev_find(pdev) != NULL) {\ndrivers/pci/vgaarb.c-759-\t\tBUG_ON(1);\n--\ndrivers/pci/vgaarb.c-761-\t}\ndrivers/pci/vgaarb.c:762:\tvgadev-\u003epdev = pdev;\ndrivers/pci/vgaarb.c-763-\ndrivers/pci/vgaarb.c-764-\t/* By default, assume we decode everything */\ndrivers/pci/vgaarb.c:765:\tvgadev-\u003edecodes = VGA_RSRC_LEGACY_IO | VGA_RSRC_LEGACY_MEM |\ndrivers/pci/vgaarb.c-766-\t\t\t  VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM;\n--\ndrivers/pci/vgaarb.c-776-\tif (cmd \u0026 PCI_COMMAND_IO)\ndrivers/pci/vgaarb.c:777:\t\tvgadev-\u003eowns |= VGA_RSRC_LEGACY_IO;\ndrivers/pci/vgaarb.c-778-\tif (cmd \u0026 PCI_COMMAND_MEMORY)\ndrivers/pci/vgaarb.c:779:\t\tvgadev-\u003eowns |= VGA_RSRC_LEGACY_MEM;\ndrivers/pci/vgaarb.c-780-\n--\ndrivers/pci/vgaarb.c-789-\t\t\tif (!(l \u0026 PCI_BRIDGE_CTL_VGA)) {\ndrivers/pci/vgaarb.c:790:\t\t\t\tvgadev-\u003eowns = 0;\ndrivers/pci/vgaarb.c-791-\t\t\t\tbreak;\n--\ndrivers/pci/vgaarb.c-796-\ndrivers/pci/vgaarb.c:797:\tif (vga_is_boot_device(vgadev)) {\ndrivers/pci/vgaarb.c-798-\t\tvgaarb_info(\u0026pdev-\u003edev, \"setting as boot VGA device%s\\n\",\n--\ndrivers/pci/vgaarb.c-803-\ndrivers/pci/vgaarb.c:804:\tvga_arbiter_check_bridge_sharing(vgadev);\ndrivers/pci/vgaarb.c-805-\ndrivers/pci/vgaarb.c-806-\t/* Add to the list */\ndrivers/pci/vgaarb.c:807:\tlist_add_tail(\u0026vgadev-\u003elist, \u0026vga_list);\ndrivers/pci/vgaarb.c-808-\tvga_count++;\ndrivers/pci/vgaarb.c-809-\tvgaarb_info(\u0026pdev-\u003edev, \"VGA device added: decodes=%s,owns=%s,locks=%s\\n\",\ndrivers/pci/vgaarb.c:810:\t\tvga_iostate_to_str(vgadev-\u003edecodes),\ndrivers/pci/vgaarb.c:811:\t\tvga_iostate_to_str(vgadev-\u003eowns),\ndrivers/pci/vgaarb.c:812:\t\tvga_iostate_to_str(vgadev-\u003elocks));\ndrivers/pci/vgaarb.c-813-\n--\ndrivers/pci/vgaarb.c-817-\tspin_unlock_irqrestore(\u0026vga_lock, flags);\ndrivers/pci/vgaarb.c:818:\tkfree(vgadev);\ndrivers/pci/vgaarb.c-819-\treturn false;\n--\ndrivers/pci/vgaarb.c=822=static bool vga_arbiter_del_pci_device(struct pci_dev *pdev)\ndrivers/pci/vgaarb.c-823-{\ndrivers/pci/vgaarb.c:824:\tstruct vga_device *vgadev;\ndrivers/pci/vgaarb.c-825-\tunsigned long flags;\n--\ndrivers/pci/vgaarb.c-828-\tspin_lock_irqsave(\u0026vga_lock, flags);\ndrivers/pci/vgaarb.c:829:\tvgadev = vgadev_find(pdev);\ndrivers/pci/vgaarb.c:830:\tif (vgadev == NULL) {\ndrivers/pci/vgaarb.c-831-\t\tret = false;\n--\ndrivers/pci/vgaarb.c-837-\ndrivers/pci/vgaarb.c:838:\tif (vgadev-\u003edecodes \u0026 (VGA_RSRC_LEGACY_IO | VGA_RSRC_LEGACY_MEM))\ndrivers/pci/vgaarb.c-839-\t\tvga_decode_count--;\n--\ndrivers/pci/vgaarb.c-841-\t/* Remove entry from list */\ndrivers/pci/vgaarb.c:842:\tlist_del(\u0026vgadev-\u003elist);\ndrivers/pci/vgaarb.c-843-\tvga_count--;\n--\ndrivers/pci/vgaarb.c-848-\tspin_unlock_irqrestore(\u0026vga_lock, flags);\ndrivers/pci/vgaarb.c:849:\tkfree(vgadev);\ndrivers/pci/vgaarb.c-850-\treturn ret;\n--\ndrivers/pci/vgaarb.c-853-/* Called with the lock */\ndrivers/pci/vgaarb.c:854:static void vga_update_device_decodes(struct vga_device *vgadev,\ndrivers/pci/vgaarb.c-855-\t\t\t\t      unsigned int new_decodes)\ndrivers/pci/vgaarb.c-856-{\ndrivers/pci/vgaarb.c:857:\tstruct device *dev = \u0026vgadev-\u003epdev-\u003edev;\ndrivers/pci/vgaarb.c:858:\tunsigned int old_decodes = vgadev-\u003edecodes;\ndrivers/pci/vgaarb.c-859-\tunsigned int decodes_removed = ~new_decodes \u0026 old_decodes;\ndrivers/pci/vgaarb.c:860:\tunsigned int decodes_unlocked = vgadev-\u003elocks \u0026 decodes_removed;\ndrivers/pci/vgaarb.c-861-\ndrivers/pci/vgaarb.c:862:\tvgadev-\u003edecodes = new_decodes;\ndrivers/pci/vgaarb.c-863-\n--\ndrivers/pci/vgaarb.c-865-\t\t    vga_iostate_to_str(old_decodes),\ndrivers/pci/vgaarb.c:866:\t\t    vga_iostate_to_str(vgadev-\u003edecodes),\ndrivers/pci/vgaarb.c:867:\t\t    vga_iostate_to_str(vgadev-\u003eowns));\ndrivers/pci/vgaarb.c-868-\n--\ndrivers/pci/vgaarb.c-871-\t\tif (decodes_unlocked \u0026 VGA_RSRC_LEGACY_IO)\ndrivers/pci/vgaarb.c:872:\t\t\tvgadev-\u003eio_lock_cnt = 0;\ndrivers/pci/vgaarb.c-873-\t\tif (decodes_unlocked \u0026 VGA_RSRC_LEGACY_MEM)\ndrivers/pci/vgaarb.c:874:\t\t\tvgadev-\u003emem_lock_cnt = 0;\ndrivers/pci/vgaarb.c:875:\t\t__vga_put(vgadev, decodes_unlocked);\ndrivers/pci/vgaarb.c-876-\t}\n--\ndrivers/pci/vgaarb.c=888=static void __vga_set_legacy_decoding(struct pci_dev *pdev,\n--\ndrivers/pci/vgaarb.c-891-{\ndrivers/pci/vgaarb.c:892:\tstruct vga_device *vgadev;\ndrivers/pci/vgaarb.c-893-\tunsigned long flags;\n--\ndrivers/pci/vgaarb.c-897-\tspin_lock_irqsave(\u0026vga_lock, flags);\ndrivers/pci/vgaarb.c:898:\tvgadev = vgadev_find(pdev);\ndrivers/pci/vgaarb.c:899:\tif (vgadev == NULL)\ndrivers/pci/vgaarb.c-900-\t\tgoto bail;\n--\ndrivers/pci/vgaarb.c-902-\t/* Don't let userspace futz with kernel driver decodes */\ndrivers/pci/vgaarb.c:903:\tif (userspace \u0026\u0026 vgadev-\u003eset_decode)\ndrivers/pci/vgaarb.c-904-\t\tgoto bail;\n--\ndrivers/pci/vgaarb.c-906-\t/* Update the device decodes + counter */\ndrivers/pci/vgaarb.c:907:\tvga_update_device_decodes(vgadev, decodes);\ndrivers/pci/vgaarb.c-908-\n--\ndrivers/pci/vgaarb.c=960=int vga_client_register(struct pci_dev *pdev,\n--\ndrivers/pci/vgaarb.c-964-\tunsigned long flags;\ndrivers/pci/vgaarb.c:965:\tstruct vga_device *vgadev;\ndrivers/pci/vgaarb.c-966-\ndrivers/pci/vgaarb.c-967-\tspin_lock_irqsave(\u0026vga_lock, flags);\ndrivers/pci/vgaarb.c:968:\tvgadev = vgadev_find(pdev);\ndrivers/pci/vgaarb.c:969:\tif (vgadev) {\ndrivers/pci/vgaarb.c:970:\t\tvgadev-\u003eset_decode = set_decode;\ndrivers/pci/vgaarb.c:971:\t\tvgadev-\u003eset_decode_data = data;\ndrivers/pci/vgaarb.c-972-\t}\ndrivers/pci/vgaarb.c-973-\tspin_unlock_irqrestore(\u0026vga_lock, flags);\ndrivers/pci/vgaarb.c:974:\tif (!vgadev)\ndrivers/pci/vgaarb.c-975-\t\treturn -ENODEV;\n--\ndrivers/pci/vgaarb.c=1073=static ssize_t vga_arb_read(struct file *file, char __user *buf,\n--\ndrivers/pci/vgaarb.c-1076-\tstruct vga_arb_private *priv = file-\u003eprivate_data;\ndrivers/pci/vgaarb.c:1077:\tstruct vga_device *vgadev;\ndrivers/pci/vgaarb.c-1078-\tstruct pci_dev *pdev;\n--\ndrivers/pci/vgaarb.c-1098-\ndrivers/pci/vgaarb.c:1099:\t/* Find card vgadev structure */\ndrivers/pci/vgaarb.c:1100:\tvgadev = vgadev_find(pdev);\ndrivers/pci/vgaarb.c:1101:\tif (vgadev == NULL) {\ndrivers/pci/vgaarb.c-1102-\t\t/*\n--\ndrivers/pci/vgaarb.c-1114-\t\t       vga_decode_count, pci_name(pdev),\ndrivers/pci/vgaarb.c:1115:\t\t       vga_iostate_to_str(vgadev-\u003edecodes),\ndrivers/pci/vgaarb.c:1116:\t\t       vga_iostate_to_str(vgadev-\u003eowns),\ndrivers/pci/vgaarb.c:1117:\t\t       vga_iostate_to_str(vgadev-\u003elocks),\ndrivers/pci/vgaarb.c:1118:\t\t       vgadev-\u003eio_lock_cnt, vgadev-\u003emem_lock_cnt);\ndrivers/pci/vgaarb.c-1119-\n--\ndrivers/pci/vgaarb.c=1137=static ssize_t vga_arb_write(struct file *file, const char __user *buf,\n--\ndrivers/pci/vgaarb.c-1298-\t\tunsigned int domain, bus, devfn;\ndrivers/pci/vgaarb.c:1299:\t\tstruct vga_device *vgadev;\ndrivers/pci/vgaarb.c-1300-\n--\ndrivers/pci/vgaarb.c-1326-\ndrivers/pci/vgaarb.c:1327:\t\tvgadev = vgadev_find(pdev);\ndrivers/pci/vgaarb.c:1328:\t\tpr_debug(\"vgadev %p\\n\", vgadev);\ndrivers/pci/vgaarb.c:1329:\t\tif (vgadev == NULL) {\ndrivers/pci/vgaarb.c-1330-\t\t\tif (pdev) {\n--\ndrivers/pci/vgaarb.c=1457=static void vga_arbiter_notify_clients(void)\ndrivers/pci/vgaarb.c-1458-{\ndrivers/pci/vgaarb.c:1459:\tstruct vga_device *vgadev;\ndrivers/pci/vgaarb.c-1460-\tunsigned long flags;\n--\ndrivers/pci/vgaarb.c-1469-\tspin_lock_irqsave(\u0026vga_lock, flags);\ndrivers/pci/vgaarb.c:1470:\tlist_for_each_entry(vgadev, \u0026vga_list, list) {\ndrivers/pci/vgaarb.c:1471:\t\tif (vgadev-\u003eset_decode) {\ndrivers/pci/vgaarb.c:1472:\t\t\tnew_decodes = vgadev-\u003eset_decode(vgadev-\u003eset_decode_data,\ndrivers/pci/vgaarb.c-1473-\t\t\t\t\t\t\t new_state);\ndrivers/pci/vgaarb.c:1474:\t\t\tvga_update_device_decodes(vgadev, new_decodes);\ndrivers/pci/vgaarb.c-1475-\t\t}\n"
}

gemini-3.8-flash

null

null

							input: 21248
							output: 42
							thoughts: 64
						

Here's my thought process, as requested:

**Debugging the VGA Arbitration Logic**

Okay, so I need to trace how a device actually gets added to the `vga_list`. I need to figure out the entry point. The name that's immediately sticking out in my mind as a likely candidate is `vga_arbiter_add_pci_device(struct pci_dev *pdev)`. That function name itself is a pretty strong indicator.

Now, the crucial next step is to pinpoint *where* that `vga_arbiter_add_pci_device` function is being invoked. I need to trace its call sites. That should give me the complete picture of how devices are being integrated with the VGA arbitration process. Let's start digging through the code.

{
  "Expression": "vga_arbiter_add_pci_device",
  "PathPrefix": "drivers/pci/vgaarb.c"
}

{
  "Output": "drivers/pci/vgaarb.c=675=static void vga_arbiter_check_bridge_sharing(struct vga_device *vgadev)\n--\ndrivers/pci/vgaarb.c-736- */\ndrivers/pci/vgaarb.c:737:static bool vga_arbiter_add_pci_device(struct pci_dev *pdev)\ndrivers/pci/vgaarb.c-738-{\n--\ndrivers/pci/vgaarb.c=1480=static int pci_notify(struct notifier_block *nb, unsigned long action,\n--\ndrivers/pci/vgaarb.c-1498-\tif (action == BUS_NOTIFY_ADD_DEVICE)\ndrivers/pci/vgaarb.c:1499:\t\tnotify = vga_arbiter_add_pci_device(pdev);\ndrivers/pci/vgaarb.c-1500-\telse if (action == BUS_NOTIFY_DEL_DEVICE)\n--\ndrivers/pci/vgaarb.c=1525=static int __init vga_arb_device_init(void)\n--\ndrivers/pci/vgaarb.c-1541-\t\tif (pci_is_vga(pdev))\ndrivers/pci/vgaarb.c:1542:\t\t\tvga_arbiter_add_pci_device(pdev);\ndrivers/pci/vgaarb.c-1543-\t}\n"
}

gemini-3.8-flash

null

null

							input: 21907
							output: 38
							thoughts: 2384
						

**Analyzing VGA Decode Registration in QEMU and VFIO-PCI**

Okay, so here's what I'm thinking... When QEMU initializes, or when a PCI device gets added, if it's a VGA device (`pci_is_vga(pdev)`), it gets added to `vga_list`. That's standard behavior. But wait, what VGA devices are *actually* present in standard QEMU? I'm used to seeing things like standard VGA, Cirrus VGA, or virtio-vga.  But, do any of those register a client with `vga_client_register`?

Let me check the kernel code and see exactly what's registering as VGA clients. Looking at the call sites of `vga_client_register`, it looks like:

1.  `amdgpu` (AMD physical GPUs)
2.  `i915` (Intel integrated/discrete GPUs)
3.  `lsdc_drv` (Loongson GPU)
4.  `nouveau` (Nvidia GPUs)
5.  `radeon` (AMD/ATI GPUs)
6.  `vfio-pci`

So, it seems that actual physical hardware drivers are the ones that register. The emulated VGA devices like virtio-gpu, bochs, and cirrus, they are *not* registering! Interesting.

Now, wait a minute, `vfio-pci` *is* on that list. But, doesn't vfio-pci need an underlying PCI device to be bound to it?  And, isn't that under user control in QEMU? So, the user has to bind a PCI device to vfio-pci.  Why would someone bind a VGA device to vfio-pci in QEMU?  Is there a practical reason for this? Does syzkaller do this?

Let's look more closely at the patch. What exactly did the patch change? Oh, I see. The changes are in `amdgpu_device.c`, and in `vfio_pci_core.c` and in `vgaarb.c`. The core change is this: The `set_decode` function, the callback, now receives a `void *data` pointer. It also changes `vga_client_register` to pass an additional `void *data` argument.

So, in the past, `amdgpu_device_vga_set_decode` and `vfio_pci_set_decode` took a `pci_dev *` as an argument. The patch has changed that to `void *data`.  Now `amdgpu` passes the `amdgpu_device` pointer, and `vfio-pci` passes the `vfio_pci_core_device` pointer.

The reason for the change is the `vga_client_register` signature now takes a `void *data` pointer, and the callback needs that. This is the new way to pass private data to that function, replacing the old `pci_dev*` argument.  This is a significant, but isolated, change.

no matches

{
  "Expression": "vga_client_register.*data",
  "PathPrefix": "drivers/pci/vgaarb.c"
}

{
  "error": "no matches"
}

gemini-3.8-flash

null

null

							input: 25027
							output: 34
							thoughts: 1171
						

**Analyzing the Commit for Fuzzing Worthiness**

Okay, so I've got this commit, `65f3a05b2b579024b50859348b98a69ea533a7ea`, and I need to determine if it warrants fuzzing. Since I don't have direct access to `git log` or grepper at the moment, I'll work with the diff details provided. Let's start by carefully reviewing the guidelines for deciding `WorthFuzzing`.

The core triage philosophy boils down to reachability. Modifications to code that *can* execute in a standard virtualized environment (like GCE or QEMU, including software-emulated devices) are prime candidates. And I need to be skeptical of claims of "no functional change" or refactoring—those can often hide subtle bugs. New or modified assertions in reachable code are also definitely a signal.

The negative criteria are crucial to check. It's only `WorthFuzzing=false` if the code falls *strictly* into the categories of non-kernel/non-executable changes, structurally unreachable hardware (like vendor-specific PCIe switches, or GPU drivers that require physical cards), or unreachable execution paths.

Conversely, it's `WorthFuzzing=true` if it touches reachable executable code. This includes core subsystems, refactorings of reachable data structures, new assertions, and drivers accessible through virtual buses.

Now, let's examine each file modified in this patch:

1.  `drivers/gpu/drm/amd/amdgpu/amdgpu_device.c`: This is an AMD GPU driver. The guidelines specifically call out `amdgpu` as hardware that's *unreachable* in a standard QEMU environment, requiring physical hardware. So, that's a negative.

2.  `drivers/gpu/drm/i915/display/intel_vga.c`: Intel graphics driver (i915). This also requires a physical Intel graphics ASIC/PCIe hardware, making it unreachable under the criteria. Another negative.

3.  `drivers/gpu/drm/loongson/lsdc_drv.c`: Physical Loongson display controller, and on top of that, Loongson is mips/loongarch and the target is amd64, meaning that we can't fuzz this file. Unreachable hardware. Negative.

4.  `drivers/gpu/drm/nouveau/nouveau_vga.c`: Nvidia GPU driver. Requires a physical Nvidia graphics card, making it unreachable in this context. Negative.

5.  `drivers/gpu/drm/radeon/radeon_device.c`: ATI/AMD Radeon GPU driver. Needs a physical Radeon graphics card. Unreachable. Negative.

6.  `drivers/vfio/pci/vfio_pci_core.c`: Okay, hold on. This one is different. It's `vfio_pci_core.c`. I need to be sure. I'll need to figure out where `vfio_pci_vga_init` is being called to fully understand reachability in this case. Let's see...

{
  "Expression": "vfio_pci_vga_init",
  "PathPrefix": "drivers/vfio"
}

{
  "Output": "drivers/vfio/pci/vfio_pci_core.c=2140=static void vfio_pci_vf_uninit(struct vfio_pci_core_device *vdev)\n--\ndrivers/vfio/pci/vfio_pci_core.c-2150-\ndrivers/vfio/pci/vfio_pci_core.c:2151:static int vfio_pci_vga_init(struct vfio_pci_core_device *vdev)\ndrivers/vfio/pci/vfio_pci_core.c-2152-{\n--\ndrivers/vfio/pci/vfio_pci_core.c=2219=int vfio_pci_core_register_device(struct vfio_pci_core_device *vdev)\n--\ndrivers/vfio/pci/vfio_pci_core.c-2278-\t\treturn ret;\ndrivers/vfio/pci/vfio_pci_core.c:2279:\tret = vfio_pci_vga_init(vdev);\ndrivers/vfio/pci/vfio_pci_core.c-2280-\tif (ret)\n"
}

gemini-3.8-flash

null

null

							input: 27243
							output: 46
							thoughts: 30
						

Okay, here's my take on those functions, as if I were thinking it:

**Diving into VFIO Initialization**

Alright, let's get down to brass tacks. I'm going to start by taking a close look at `vfio_pci_vga_init` and `vfio_pci_core_register_device`. These are the crucial entry points for initializing and registering a VGA device within the VFIO (Virtual Function I/O) framework. I need to understand exactly what they do, in what order, and how they interact to make this virtualization possible. Specifically, I'm looking for the key registration points; what pieces of the PCI device are being mapped, configured and exposed to the hypervisor? Are there specific quirks that need to be addressed for VGA cards? What is being done with the BARs (Base Address Registers) and MMIO (Memory-Mapped I/O) regions? How are the interrupt lines being managed here, and is any special interrupt handling performed? Are there any device-specific considerations within `vfio_pci_vga_init`? It's essential to understand the control flow, the data structures used, and the allocation and deallocation logic. Any gotchas? I'm hoping to get a clearer picture of how this initialization sets the stage for a fully functional VGA device within the virtual machine. I suspect that understanding these core components, and how they work together, will unlock the keys to troubleshooting any potential VFIO-related VGA problems.

{
  "File": "drivers/vfio/pci/vfio_pci_core.c",
  "FirstLine": 2145,
  "LineCount": 40
}

{
  "Contents": "2145:\t\tbus_unregister_notifier(\u0026pci_bus_type, \u0026vdev-\u003enb);\n2146:\t\tWARN_ON(vdev-\u003evf_token-\u003eusers);\n2147:\t\tmutex_destroy(\u0026vdev-\u003evf_token-\u003elock);\n2148:\t\tkfree(vdev-\u003evf_token);\n2149:\t}\n2150:\t\n2151:\tstatic int vfio_pci_vga_init(struct vfio_pci_core_device *vdev)\n2152:\t{\n2153:\t\tstruct pci_dev *pdev = vdev-\u003epdev;\n2154:\t\tint ret;\n2155:\t\n2156:\t\tif (!vfio_pci_is_vga(pdev))\n2157:\t\t\treturn 0;\n2158:\t\n2159:\t\tret = aperture_remove_conflicting_pci_devices(pdev, vdev-\u003evdev.ops-\u003ename);\n2160:\t\tif (ret)\n2161:\t\t\treturn ret;\n2162:\t\n2163:\t\tret = vga_client_register(pdev, vfio_pci_set_decode, vdev);\n2164:\t\tif (ret)\n2165:\t\t\treturn ret;\n2166:\t\tvga_set_legacy_decoding(pdev, vfio_pci_set_decode(vdev, false));\n2167:\t\treturn 0;\n2168:\t}\n2169:\t\n2170:\tstatic void vfio_pci_vga_uninit(struct vfio_pci_core_device *vdev)\n2171:\t{\n2172:\t\tstruct pci_dev *pdev = vdev-\u003epdev;\n2173:\t\n2174:\t\tif (!vfio_pci_is_vga(pdev))\n2175:\t\t\treturn;\n2176:\t\tvga_client_unregister(pdev);\n2177:\t\tvga_set_legacy_decoding(pdev, VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM |\n2178:\t\t\t\t\t\t      VGA_RSRC_LEGACY_IO |\n2179:\t\t\t\t\t\t      VGA_RSRC_LEGACY_MEM);\n2180:\t}\n2181:\t\n2182:\tint vfio_pci_core_init_dev(struct vfio_device *core_vdev)\n2183:\t{\n2184:\t\tstruct vfio_pci_core_device *vdev =\n"
}

gemini-3.8-flash

null

null

							input: 28318
							output: 25
							thoughts: 21
						

Okay, here's my thought process laid out, as if I were thinking it:

**Digging into vfio_pci_core_register_device**

Alright, time to get to the bottom of this. I need to understand the flow here. The logical first step, as always, is to figure out where `vfio_pci_core_register_device` is actually *being* called. That's the entry point to understanding its role and impact. Let's see how the kernel is using this function. Gotta find those call sites!

{
  "Expression": "vfio_pci_core_register_device"
}

{
  "Output": "drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c=1668=static int hisi_acc_vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c-1690-\tdev_set_drvdata(\u0026pdev-\u003edev, \u0026hisi_acc_vdev-\u003ecore_device);\ndrivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c:1691:\tret = vfio_pci_core_register_device(\u0026hisi_acc_vdev-\u003ecore_device);\ndrivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c-1692-\tif (ret)\n--\ndrivers/vfio/pci/ism/main.c=355=static int ism_vfio_pci_probe(struct pci_dev *pdev,\n--\ndrivers/vfio/pci/ism/main.c-367-\ndrivers/vfio/pci/ism/main.c:368:\tret = vfio_pci_core_register_device(\u0026ivpcd-\u003ecore_device);\ndrivers/vfio/pci/ism/main.c-369-\tif (ret)\n--\ndrivers/vfio/pci/mlx5/main.c=1407=static int mlx5vf_pci_probe(struct pci_dev *pdev,\n--\ndrivers/vfio/pci/mlx5/main.c-1418-\tdev_set_drvdata(\u0026pdev-\u003edev, \u0026mvdev-\u003ecore_device);\ndrivers/vfio/pci/mlx5/main.c:1419:\tret = vfio_pci_core_register_device(\u0026mvdev-\u003ecore_device);\ndrivers/vfio/pci/mlx5/main.c-1420-\tif (ret)\n--\ndrivers/vfio/pci/nvgrace-gpu/main.c=1320=static int nvgrace_gpu_probe(struct pci_dev *pdev,\n--\ndrivers/vfio/pci/nvgrace-gpu/main.c-1361-\ndrivers/vfio/pci/nvgrace-gpu/main.c:1362:\tret = vfio_pci_core_register_device(\u0026nvdev-\u003ecore_device);\ndrivers/vfio/pci/nvgrace-gpu/main.c-1363-\tif (ret)\n--\ndrivers/vfio/pci/pds/pci_drv.c=110=static int pds_vfio_pci_probe(struct pci_dev *pdev,\n--\ndrivers/vfio/pci/pds/pci_drv.c-122-\ndrivers/vfio/pci/pds/pci_drv.c:123:\terr = vfio_pci_core_register_device(\u0026pds_vfio-\u003evfio_coredev);\ndrivers/vfio/pci/pds/pci_drv.c-124-\tif (err)\n--\ndrivers/vfio/pci/qat/main.c=644=qat_vf_vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/vfio/pci/qat/main.c-654-\tpci_set_drvdata(pdev, \u0026qat_vdev-\u003ecore_device);\ndrivers/vfio/pci/qat/main.c:655:\tret = vfio_pci_core_register_device(\u0026qat_vdev-\u003ecore_device);\ndrivers/vfio/pci/qat/main.c-656-\tif (ret)\n--\ndrivers/vfio/pci/vfio_pci.c=176=static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/vfio/pci/vfio_pci.c-190-\tvdev-\u003epci_ops = \u0026vfio_pci_dev_ops;\ndrivers/vfio/pci/vfio_pci.c:191:\tret = vfio_pci_core_register_device(vdev);\ndrivers/vfio/pci/vfio_pci.c-192-\tif (ret)\n--\ndrivers/vfio/pci/vfio_pci_core.c=2217=EXPORT_SYMBOL_GPL(vfio_pci_core_release_dev);\ndrivers/vfio/pci/vfio_pci_core.c-2218-\ndrivers/vfio/pci/vfio_pci_core.c:2219:int vfio_pci_core_register_device(struct vfio_pci_core_device *vdev)\ndrivers/vfio/pci/vfio_pci_core.c-2220-{\n--\ndrivers/vfio/pci/vfio_pci_core.c-2318-}\ndrivers/vfio/pci/vfio_pci_core.c:2319:EXPORT_SYMBOL_GPL(vfio_pci_core_register_device);\ndrivers/vfio/pci/vfio_pci_core.c-2320-\n--\ndrivers/vfio/pci/virtio/main.c=149=static int virtiovf_pci_probe(struct pci_dev *pdev,\n--\ndrivers/vfio/pci/virtio/main.c-177-\tdev_set_drvdata(\u0026pdev-\u003edev, \u0026virtvdev-\u003ecore_device);\ndrivers/vfio/pci/virtio/main.c:178:\tret = vfio_pci_core_register_device(\u0026virtvdev-\u003ecore_device);\ndrivers/vfio/pci/virtio/main.c-179-\tif (ret)\n--\ndrivers/vfio/pci/xe/main.c=543=static int xe_vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)\n--\ndrivers/vfio/pci/xe/main.c-554-\ndrivers/vfio/pci/xe/main.c:555:\tret = vfio_pci_core_register_device(\u0026xe_vdev-\u003ecore_device);\ndrivers/vfio/pci/xe/main.c-556-\tif (ret) {\n--\ninclude/linux/vfio_pci_core.h=168=void vfio_pci_core_release_dev(struct vfio_device *core_vdev);\ninclude/linux/vfio_pci_core.h:169:int vfio_pci_core_register_device(struct vfio_pci_core_device *vdev);\ninclude/linux/vfio_pci_core.h-170-void vfio_pci_core_unregister_device(struct vfio_pci_core_device *vdev);\n"
}

gemini-3.8-flash

null

null

							input: 30287
							output: 24
							thoughts: 36
						

Here's my thought process, summarized as you requested:

**Investigating the `vfio_pci_is_vga` Function**

Alright, let's dive in. I need to understand this `vfio_pci_is_vga` function. First things first, I need to know precisely where it's defined. I'll need to trace its origins within the source code to understand its purpose and how it's used within the larger VFIO-PCI context. Time to start digging through the code!

{
  "Expression": "vfio_pci_is_vga"
}

{
  "Output": "drivers/vfio/pci/vfio_pci_core.c=592=int vfio_pci_core_enable(struct vfio_pci_core_device *vdev)\n--\ndrivers/vfio/pci/vfio_pci_core.c-662-\ndrivers/vfio/pci/vfio_pci_core.c:663:\tif (!vfio_vga_disabled(vdev) \u0026\u0026 vfio_pci_is_vga(pdev))\ndrivers/vfio/pci/vfio_pci_core.c-664-\t\tvdev-\u003ehas_vga = true;\n--\ndrivers/vfio/pci/vfio_pci_core.c=2151=static int vfio_pci_vga_init(struct vfio_pci_core_device *vdev)\n--\ndrivers/vfio/pci/vfio_pci_core.c-2155-\ndrivers/vfio/pci/vfio_pci_core.c:2156:\tif (!vfio_pci_is_vga(pdev))\ndrivers/vfio/pci/vfio_pci_core.c-2157-\t\treturn 0;\n--\ndrivers/vfio/pci/vfio_pci_core.c=2170=static void vfio_pci_vga_uninit(struct vfio_pci_core_device *vdev)\n--\ndrivers/vfio/pci/vfio_pci_core.c-2173-\ndrivers/vfio/pci/vfio_pci_core.c:2174:\tif (!vfio_pci_is_vga(pdev))\ndrivers/vfio/pci/vfio_pci_core.c-2175-\t\treturn;\n--\ndrivers/vfio/pci/vfio_pci_priv.h=113=static inline int vfio_pci_zdev_feature_err(struct vfio_device *device,\n--\ndrivers/vfio/pci/vfio_pci_priv.h-120-\ndrivers/vfio/pci/vfio_pci_priv.h:121:static inline bool vfio_pci_is_vga(struct pci_dev *pdev)\ndrivers/vfio/pci/vfio_pci_priv.h-122-{\n"
}

gemini-3.8-flash

null

null

							input: 31072
							output: 45
							thoughts: 38
						

Okay, let's dive into this. Here's my take on understanding `vfio_pci_is_vga`, as if it were my own thought process:

**Diving into the VFIO PCI Code**

Alright, time to get my hands dirty. I'm going to take a look at the `vfio_pci_is_vga` function. I remember seeing that name floating around, and now I need to refresh my memory on exactly what it's responsible for. Since I already know the overall VFIO/PCI landscape, I'm expecting this to be a fairly focused check, likely related to identifying VGA compatible devices for various purposes – probably related to assigning them to VMs with specific considerations. I bet it's used somewhere to determine if we need to do something different with the device based on its VGA characteristics. Now, let's see where that takes us in `vfio_pci_priv.h`. I'm expecting this to be a quick trip down the rabbit hole, and I hope it's well-commented!

{
  "File": "drivers/vfio/pci/vfio_pci_priv.h",
  "FirstLine": 115,
  "LineCount": 20
}

{
  "Contents": " 115:\t\t\t\t\t\t    size_t argsz)\n 116:\t{\n 117:\t\treturn -ENOTTY;\n 118:\t}\n 119:\t#endif\n 120:\t\n 121:\tstatic inline bool vfio_pci_is_vga(struct pci_dev *pdev)\n 122:\t{\n 123:\t\treturn (pdev-\u003eclass \u003e\u003e 8) == PCI_CLASS_DISPLAY_VGA;\n 124:\t}\n 125:\t\n 126:\t#ifdef CONFIG_VFIO_PCI_DMABUF\n 127:\tint vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,\n 128:\t\t\t\t\t  struct vfio_device_feature_dma_buf __user *arg,\n 129:\t\t\t\t\t  size_t argsz);\n 130:\tvoid vfio_pci_dma_buf_cleanup(struct vfio_pci_core_device *vdev);\n 131:\tvoid vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked);\n 132:\t#else\n 133:\tstatic inline int\n 134:\tvfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,\n"
}

gemini-3.8-flash

null

null

							input: 31767
							output: 39
							thoughts: 132
						

Okay, let's dive back into this `vgaarb.c` file. I need to refresh my memory on the purpose of `drivers/pci/vgaarb.c` – what exactly is the role of this VGA Arbiter? Ah, right, it manages VGA resources.

Now, a key question I have is whether user-space applications can directly interact with the `/dev/vga_arbiter` device. Let's see... Yep, the `misc_register(&vga_arb_device);` call confirms it: that's where the device node `/dev/vga_arbiter` is created. That's good to know.

Therefore, the next logical step is to analyze what user-space can actually *do* with `/dev/vga_arbiter`. I should now focus my attention on the `vga_arb_write` function within `drivers/pci/vgaarb.c` to see how that interaction is handled.

{
  "File": "drivers/pci/vgaarb.c",
  "FirstLine": 1135,
  "LineCount": 90
}

{
  "Contents": "1135:\t * consider use ioctl here\n1136:\t */\n1137:\tstatic ssize_t vga_arb_write(struct file *file, const char __user *buf,\n1138:\t\t\t\t     size_t count, loff_t *ppos)\n1139:\t{\n1140:\t\tstruct vga_arb_private *priv = file-\u003eprivate_data;\n1141:\t\tstruct vga_arb_user_card *uc = NULL;\n1142:\t\tstruct pci_dev *pdev;\n1143:\t\n1144:\t\tunsigned int io_state;\n1145:\t\n1146:\t\tchar kbuf[64], *curr_pos;\n1147:\t\tsize_t remaining = count;\n1148:\t\n1149:\t\tint err;\n1150:\t\tint ret_val;\n1151:\t\tint i;\n1152:\t\n1153:\t\tif (count \u003e= sizeof(kbuf))\n1154:\t\t\treturn -EINVAL;\n1155:\t\tif (copy_from_user(kbuf, buf, count))\n1156:\t\t\treturn -EFAULT;\n1157:\t\tcurr_pos = kbuf;\n1158:\t\tkbuf[count] = '\\0';\n1159:\t\n1160:\t\tif (strncmp(curr_pos, \"lock \", 5) == 0) {\n1161:\t\t\tcurr_pos += 5;\n1162:\t\t\tremaining -= 5;\n1163:\t\n1164:\t\t\tpr_debug(\"client 0x%p called 'lock'\\n\", priv);\n1165:\t\n1166:\t\t\tif (!vga_str_to_iostate(curr_pos, remaining, \u0026io_state)) {\n1167:\t\t\t\tret_val = -EPROTO;\n1168:\t\t\t\tgoto done;\n1169:\t\t\t}\n1170:\t\t\tif (io_state == VGA_RSRC_NONE) {\n1171:\t\t\t\tret_val = -EPROTO;\n1172:\t\t\t\tgoto done;\n1173:\t\t\t}\n1174:\t\n1175:\t\t\tpdev = priv-\u003etarget;\n1176:\t\t\tif (priv-\u003etarget == NULL) {\n1177:\t\t\t\tret_val = -ENODEV;\n1178:\t\t\t\tgoto done;\n1179:\t\t\t}\n1180:\t\n1181:\t\t\terr = vga_get_uninterruptible(pdev, io_state);\n1182:\t\t\tif (err) {\n1183:\t\t\t\tret_val = err;\n1184:\t\t\t\tgoto done;\n1185:\t\t\t}\n1186:\t\n1187:\t\t\t/* Update the client's locks lists */\n1188:\t\t\tfor (i = 0; i \u003c MAX_USER_CARDS; i++) {\n1189:\t\t\t\tif (priv-\u003ecards[i].pdev == pdev) {\n1190:\t\t\t\t\tif (io_state \u0026 VGA_RSRC_LEGACY_IO)\n1191:\t\t\t\t\t\tpriv-\u003ecards[i].io_cnt++;\n1192:\t\t\t\t\tif (io_state \u0026 VGA_RSRC_LEGACY_MEM)\n1193:\t\t\t\t\t\tpriv-\u003ecards[i].mem_cnt++;\n1194:\t\t\t\t\tbreak;\n1195:\t\t\t\t}\n1196:\t\t\t}\n1197:\t\n1198:\t\t\tret_val = count;\n1199:\t\t\tgoto done;\n1200:\t\t} else if (strncmp(curr_pos, \"unlock \", 7) == 0) {\n1201:\t\t\tcurr_pos += 7;\n1202:\t\t\tremaining -= 7;\n1203:\t\n1204:\t\t\tpr_debug(\"client 0x%p called 'unlock'\\n\", priv);\n1205:\t\n1206:\t\t\tif (strncmp(curr_pos, \"all\", 3) == 0)\n1207:\t\t\t\tio_state = VGA_RSRC_LEGACY_IO | VGA_RSRC_LEGACY_MEM;\n1208:\t\t\telse {\n1209:\t\t\t\tif (!vga_str_to_iostate\n1210:\t\t\t\t    (curr_pos, remaining, \u0026io_state)) {\n1211:\t\t\t\t\tret_val = -EPROTO;\n1212:\t\t\t\t\tgoto done;\n1213:\t\t\t\t}\n1214:\t\t\t\t/* TODO: Add this?\n1215:\t\t\t\t   if (io_state == VGA_RSRC_NONE) {\n1216:\t\t\t\t   ret_val = -EPROTO;\n1217:\t\t\t\t   goto done;\n1218:\t\t\t\t   }\n1219:\t\t\t\t  */\n1220:\t\t\t}\n1221:\t\n1222:\t\t\tpdev = priv-\u003etarget;\n1223:\t\t\tif (priv-\u003etarget == NULL) {\n1224:\t\t\t\tret_val = -ENODEV;\n"
}

gemini-3.8-flash

null

null

							input: 33443
							output: 39
							thoughts: 29
						

Okay, let's dive into this `vga_arb_write` section, specifically lines 1225 through 1340. I want to get a complete picture of the write arbitration process. I'm assuming, given the naming, that this function is managing contention when multiple components want to write to the VGA memory, right? My initial guess is that it probably uses some kind of priority scheme or possibly a round-robin mechanism to decide which write request gets serviced. I need to see how the logic handles potential race conditions and ensures data integrity during concurrent writes. I'll be looking for clues about the hardware interfaces involved, any buffering strategies employed, and how the timing constraints are being addressed. It's also possible that there are optimization techniques being applied to improve write throughput. This part of the code is crucial for overall performance, so I'm expecting this to be well-designed to prevent any bottlenecks. Let's dig in and see what the author came up with. I'm particularly interested in how they've handled the asynchronous nature of the potential write requests and ensured that there aren't any deadlocks or starvation situations. I'll need to keep a close eye on the state machine implementation, if one exists, and the interrupt handling that might be associated with this.

{
  "File": "drivers/pci/vgaarb.c",
  "FirstLine": 1225,
  "LineCount": 80
}

{
  "Contents": "1225:\t\t\t\tgoto done;\n1226:\t\t\t}\n1227:\t\t\tfor (i = 0; i \u003c MAX_USER_CARDS; i++) {\n1228:\t\t\t\tif (priv-\u003ecards[i].pdev == pdev)\n1229:\t\t\t\t\tuc = \u0026priv-\u003ecards[i];\n1230:\t\t\t}\n1231:\t\n1232:\t\t\tif (!uc) {\n1233:\t\t\t\tret_val = -EINVAL;\n1234:\t\t\t\tgoto done;\n1235:\t\t\t}\n1236:\t\n1237:\t\t\tif (io_state \u0026 VGA_RSRC_LEGACY_IO \u0026\u0026 uc-\u003eio_cnt == 0) {\n1238:\t\t\t\tret_val = -EINVAL;\n1239:\t\t\t\tgoto done;\n1240:\t\t\t}\n1241:\t\n1242:\t\t\tif (io_state \u0026 VGA_RSRC_LEGACY_MEM \u0026\u0026 uc-\u003emem_cnt == 0) {\n1243:\t\t\t\tret_val = -EINVAL;\n1244:\t\t\t\tgoto done;\n1245:\t\t\t}\n1246:\t\n1247:\t\t\tvga_put(pdev, io_state);\n1248:\t\n1249:\t\t\tif (io_state \u0026 VGA_RSRC_LEGACY_IO)\n1250:\t\t\t\tuc-\u003eio_cnt--;\n1251:\t\t\tif (io_state \u0026 VGA_RSRC_LEGACY_MEM)\n1252:\t\t\t\tuc-\u003emem_cnt--;\n1253:\t\n1254:\t\t\tret_val = count;\n1255:\t\t\tgoto done;\n1256:\t\t} else if (strncmp(curr_pos, \"trylock \", 8) == 0) {\n1257:\t\t\tcurr_pos += 8;\n1258:\t\t\tremaining -= 8;\n1259:\t\n1260:\t\t\tpr_debug(\"client 0x%p called 'trylock'\\n\", priv);\n1261:\t\n1262:\t\t\tif (!vga_str_to_iostate(curr_pos, remaining, \u0026io_state)) {\n1263:\t\t\t\tret_val = -EPROTO;\n1264:\t\t\t\tgoto done;\n1265:\t\t\t}\n1266:\t\t\t/* TODO: Add this?\n1267:\t\t\t   if (io_state == VGA_RSRC_NONE) {\n1268:\t\t\t   ret_val = -EPROTO;\n1269:\t\t\t   goto done;\n1270:\t\t\t   }\n1271:\t\t\t */\n1272:\t\n1273:\t\t\tpdev = priv-\u003etarget;\n1274:\t\t\tif (priv-\u003etarget == NULL) {\n1275:\t\t\t\tret_val = -ENODEV;\n1276:\t\t\t\tgoto done;\n1277:\t\t\t}\n1278:\t\n1279:\t\t\tif (vga_tryget(pdev, io_state)) {\n1280:\t\t\t\t/* Update the client's locks lists... */\n1281:\t\t\t\tfor (i = 0; i \u003c MAX_USER_CARDS; i++) {\n1282:\t\t\t\t\tif (priv-\u003ecards[i].pdev == pdev) {\n1283:\t\t\t\t\t\tif (io_state \u0026 VGA_RSRC_LEGACY_IO)\n1284:\t\t\t\t\t\t\tpriv-\u003ecards[i].io_cnt++;\n1285:\t\t\t\t\t\tif (io_state \u0026 VGA_RSRC_LEGACY_MEM)\n1286:\t\t\t\t\t\t\tpriv-\u003ecards[i].mem_cnt++;\n1287:\t\t\t\t\t\tbreak;\n1288:\t\t\t\t\t}\n1289:\t\t\t\t}\n1290:\t\t\t\tret_val = count;\n1291:\t\t\t\tgoto done;\n1292:\t\t\t} else {\n1293:\t\t\t\tret_val = -EBUSY;\n1294:\t\t\t\tgoto done;\n1295:\t\t\t}\n1296:\t\n1297:\t\t} else if (strncmp(curr_pos, \"target \", 7) == 0) {\n1298:\t\t\tunsigned int domain, bus, devfn;\n1299:\t\t\tstruct vga_device *vgadev;\n1300:\t\n1301:\t\t\tcurr_pos += 7;\n1302:\t\t\tremaining -= 7;\n1303:\t\t\tpr_debug(\"client 0x%p called 'target'\\n\", priv);\n1304:\t\t\t/* If target is default */\n"
}

gemini-3.8-flash

null

null

							input: 34932
							output: 38
							thoughts: 661
						

**Analyzing VGA Client Registration and Arbiter Notification in a QEMU/Syzkaller Context**

Okay, let's break this down. My initial thought is to examine `vga_client_register`. I know it's called during driver initialization. Looking at the list - amdgpu, intel_vga/i915, lsdc, nouveau, radeon, vfio_pci_core - they all require specific physical ASICs or devices. The vfio case is interesting; it hinges on the device being a VGA display device.

Now, the crucial question: Does either syzkaller or a standard QEMU environment *have* these prerequisites? I'm picturing the standard QEMU setup that syzkaller utilizes. What's the typical display setup? I remember the command lines: often `-device virtio-net-pci -device virtio-rng-pci -nographic`, sometimes `-vga none`, or maybe some other device configuration. The bottom line is, syzkaller runs QEMU either without graphics entirely, or with QEMU's default, which could be Bochs, cirrus, or stdvga, or none.

Hang on. Bochs-drm, cirrus, and virtio-gpu, they don't utilize `vga_client_register`. So, what about vfio-pci? Could syzkaller even bind vfio-pci to a device? I need to remember the vfio-pci binding process: First, we *need* a VGA device to exist. Then, does syzkaller bind PCI drivers via the `/sys/bus/pci/drivers/vfio-pci/bind` sysfs entry? I should cross-reference this with the "Unreachable execution paths" in the provided document... things like driver teardown callbacks are only executed on physical PCI hot-unplug or sysfs driver unbinding. Also, "Structurally unreachable hardware" mentions vendor-specific PCIe switches, SmartNICs, or GPU drivers requiring physical hardware not emulated in QEMU.

Okay, let's shift focus to `vga_arbiter_notify_clients`. When is *that* called? I need to look at the `vgaarb.c` code. Ah, here it is: `vga_check_first_use()`. It seems that if we have more than one card, this function is responsible for informing all registered clients that we need something. This function then calls `vga_arbiter_notify_clients()`. Now, where is `vga_check_first_use()` called? A quick grep should reveal the call sites.

{
  "Expression": "vga_check_first_use",
  "PathPrefix": "drivers/pci/vgaarb.c"
}

{
  "Output": "drivers/pci/vgaarb.c=192=EXPORT_SYMBOL(vga_remove_vgacon);\n--\ndrivers/pci/vgaarb.c-198- */\ndrivers/pci/vgaarb.c:199:static void vga_check_first_use(void)\ndrivers/pci/vgaarb.c-200-{\n--\ndrivers/pci/vgaarb.c=440=int vga_get(struct pci_dev *pdev, unsigned int rsrc, int interruptible)\n--\ndrivers/pci/vgaarb.c-446-\ndrivers/pci/vgaarb.c:447:\tvga_check_first_use();\ndrivers/pci/vgaarb.c-448-\t/* The caller should check for this, but let's be sure */\n--\ndrivers/pci/vgaarb.c=511=static int vga_tryget(struct pci_dev *pdev, unsigned int rsrc)\n--\ndrivers/pci/vgaarb.c-516-\ndrivers/pci/vgaarb.c:517:\tvga_check_first_use();\ndrivers/pci/vgaarb.c-518-\n"
}

gemini-3.8-flash

null

null

							input: 36519
							output: 17
							thoughts: 2246
						

**Analysis of VGA Arbitration and QEMU Execution Paths**

Okay, so I'm looking at how the VGA arbitration mechanism in the kernel works. Specifically, I'm focusing on `vga_get()`, `vga_tryget()`, and the interaction with `/dev/vga_arbiter`. It seems that when userspace interacts with `/dev/vga_arbiter` by calling `lock` or `trylock`, it ultimately triggers `vga_check_first_use()`. This, in turn, calls `vga_arbiter_notify_clients()`.

The interesting part is within `vga_arbiter_notify_clients()`, where the code iterates through a list of VGA devices (`vga_list`) and, if a device has a `set_decode` callback function, calls it. My immediate thought is, can this `set_decode` ever be non-NULL in a QEMU environment? If not, then this path is a dead end.

I dig into where `vgadev->set_decode` is actually set. It's only assigned in `vga_client_register()`. Now, I need to figure out which drivers call `vga_client_register()`. I've identified six potential callers: `amdgpu`, `i915`, `lsdc`, `nouveau`, `radeon`, and `vfio_pci`.

Now, the critical question: are *any* of these drivers active in a standard QEMU setup, especially one used by Syzkaller?

*   `amdgpu`, `i915`, `nouveau`, and `radeon` all require physical AMD, Intel, or Nvidia hardware, which QEMU doesn't emulate. This is confirmed by the documentation, which excludes drivers requiring physical ASICs.

*   `lsdc` is specific to Loongson hardware.

*   `vfio-pci` is the last one. But even with `vfio-pci`, it doesn't bind to any devices by default in QEMU unless explicitly configured via sysfs or command-line parameters, which syzkaller doesn't use for VGA. Moreover, even if a VGA device was present, vfio-pci on VGA devices requires physical hardware to be passed through. Syzkaller doesn't do passthrough.

I also need to consider the patch itself, which changes the signature of `vga_client_register()` to include a `void *data` pointer and how the `set_decode` callback is passed. The patch updates all six callers to pass appropriate data (like `adev` for `amdgpu`, `display` for `i915`, and `vdev` for `vfio_pci`). But the core question is still if *any* of this code is executed.

In a standard QEMU environment or GCE, none of these drivers are loaded or probed. The absence of `vga_client_register()` calls means that `vgadev->set_decode` is *always* NULL. Therefore, the conditional `if (vgadev->set_decode)` within `vga_arbiter_notify_clients()` always evaluates to false, and the `set_decode` callback is never called.

I've checked the entire kernel codebase. There are no other callers of `vga_client_register()` except for these six drivers, and there are no other references to `set_decode` that haven't been accounted for. So, this path is indeed unreachable in the target QEMU environment.

{
  "Expression": "set_decode"
}

{
  "Output": "drivers/edac/i10nm_base.c=922=static int __init i10nm_init(void)\n--\ndrivers/edac/i10nm_base.c-1031-\ndrivers/edac/i10nm_base.c:1032:\tskx_set_decode(i10nm_mc_decode);\ndrivers/edac/i10nm_base.c-1033-\n--\ndrivers/edac/i10nm_base.c=1042=static void __exit i10nm_exit(void)\n--\ndrivers/edac/i10nm_base.c-1045-\ndrivers/edac/i10nm_base.c:1046:\tskx_set_decode(NULL);\ndrivers/edac/i10nm_base.c-1047-\n--\ndrivers/edac/skx_base.c=599=static int __init skx_init(void)\n--\ndrivers/edac/skx_base.c-676-\tif (nvdimm_count \u0026\u0026 skx_adxl_get() != -ENODEV) {\ndrivers/edac/skx_base.c:677:\t\tskx_set_decode(NULL);\ndrivers/edac/skx_base.c-678-\t} else {\n--\ndrivers/edac/skx_base.c-680-\t\t\tskx_printk(KERN_NOTICE, \"Only decoding DDR4 address!\\n\");\ndrivers/edac/skx_base.c:681:\t\tskx_set_decode(skx_decode);\ndrivers/edac/skx_base.c-682-\t}\n--\ndrivers/edac/skx_common.c=540=EXPORT_SYMBOL_GPL(skx_set_res_cfg);\ndrivers/edac/skx_common.c-541-\ndrivers/edac/skx_common.c:542:void skx_set_decode(skx_decode_f decode)\ndrivers/edac/skx_common.c-543-{\n--\ndrivers/edac/skx_common.c-545-}\ndrivers/edac/skx_common.c:546:EXPORT_SYMBOL_GPL(skx_set_decode);\ndrivers/edac/skx_common.c-547-\n--\ndrivers/edac/skx_common.h=349=void skx_adxl_put(void);\ndrivers/edac/skx_common.h:350:void skx_set_decode(skx_decode_f decode);\ndrivers/edac/skx_common.h-351-void skx_set_show_rrl(skx_show_rrl_f rrl);\n--\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c=1386=bool amdgpu_device_should_use_aspm(struct amdgpu_device *adev)\n--\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c-1429-/**\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c:1430: * amdgpu_device_vga_set_decode - enable/disable vga decode\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c-1431- *\n--\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c-1437- */\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c:1438:static unsigned int amdgpu_device_vga_set_decode(void *data,\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c-1439-\t\tbool state)\n--\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c=3775=int amdgpu_device_init(struct amdgpu_device *adev,\n--\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c-4210-\tif ((adev-\u003epdev-\u003eclass \u003e\u003e 8) == PCI_CLASS_DISPLAY_VGA)\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c:4211:\t\tvga_client_register(adev-\u003epdev, amdgpu_device_vga_set_decode, adev);\ndrivers/gpu/drm/amd/amdgpu/amdgpu_device.c-4212-\n--\ndrivers/gpu/drm/i915/display/intel_vga.c=179=void intel_vga_disable(struct intel_display *display)\n--\ndrivers/gpu/drm/i915/display/intel_vga.c-249-\t * Always disable VGA memory decode for iGPU so that\ndrivers/gpu/drm/i915/display/intel_vga.c:250:\t * intel_vga_set_decode() doesn't need to access VGA registers.\ndrivers/gpu/drm/i915/display/intel_vga.c-251-\t * VGA_MIS_ENB_MEM_ACCESS=0 is also the reset value.\n--\ndrivers/gpu/drm/i915/display/intel_vga.c-285-\ndrivers/gpu/drm/i915/display/intel_vga.c:286:static unsigned int intel_vga_set_decode(void *data, bool enable_decode)\ndrivers/gpu/drm/i915/display/intel_vga.c-287-{\n--\ndrivers/gpu/drm/i915/display/intel_vga.c=321=void intel_vga_register(struct intel_display *display)\n--\ndrivers/gpu/drm/i915/display/intel_vga.c-334-\t */\ndrivers/gpu/drm/i915/display/intel_vga.c:335:\tret = vga_client_register(pdev, intel_vga_set_decode, display);\ndrivers/gpu/drm/i915/display/intel_vga.c-336-\tdrm_WARN_ON(display-\u003edrm, ret \u0026\u0026 ret != -ENODEV);\n--\ndrivers/gpu/drm/loongson/lsdc_drv.c=193=lsdc_create_device(struct pci_dev *pdev,\n--\ndrivers/gpu/drm/loongson/lsdc_drv.c-256-\ndrivers/gpu/drm/loongson/lsdc_drv.c:257:static unsigned int lsdc_vga_set_decode(void *data, bool state)\ndrivers/gpu/drm/loongson/lsdc_drv.c-258-{\n--\ndrivers/gpu/drm/loongson/lsdc_drv.c=262=static int lsdc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)\n--\ndrivers/gpu/drm/loongson/lsdc_drv.c-293-\ndrivers/gpu/drm/loongson/lsdc_drv.c:294:\tvga_client_register(pdev, lsdc_vga_set_decode, NULL);\ndrivers/gpu/drm/loongson/lsdc_drv.c-295-\n--\ndrivers/gpu/drm/nouveau/nouveau_vga.c=11=static unsigned int\ndrivers/gpu/drm/nouveau/nouveau_vga.c:12:nouveau_vga_set_decode(void *data, bool state)\ndrivers/gpu/drm/nouveau/nouveau_vga.c-13-{\n--\ndrivers/gpu/drm/nouveau/nouveau_vga.c=95=nouveau_vga_init(struct nouveau_drm *drm)\n--\ndrivers/gpu/drm/nouveau/nouveau_vga.c-105-\ndrivers/gpu/drm/nouveau/nouveau_vga.c:106:\tvga_client_register(pdev, nouveau_vga_set_decode, drm);\ndrivers/gpu/drm/nouveau/nouveau_vga.c-107-\n--\ndrivers/gpu/drm/radeon/radeon_device.c=1065=void radeon_combios_fini(struct radeon_device *rdev)\n--\ndrivers/gpu/drm/radeon/radeon_device.c-1070-/**\ndrivers/gpu/drm/radeon/radeon_device.c:1071: * radeon_vga_set_decode - enable/disable vga decode\ndrivers/gpu/drm/radeon/radeon_device.c-1072- *\n--\ndrivers/gpu/drm/radeon/radeon_device.c-1078- */\ndrivers/gpu/drm/radeon/radeon_device.c:1079:static unsigned int radeon_vga_set_decode(void *data, bool state)\ndrivers/gpu/drm/radeon/radeon_device.c-1080-{\n--\ndrivers/gpu/drm/radeon/radeon_device.c=1285=int radeon_device_init(struct radeon_device *rdev,\n--\ndrivers/gpu/drm/radeon/radeon_device.c-1432-\t * ignore it */\ndrivers/gpu/drm/radeon/radeon_device.c:1433:\tvga_client_register(rdev-\u003epdev, radeon_vga_set_decode, rdev);\ndrivers/gpu/drm/radeon/radeon_device.c-1434-\n--\ndrivers/media/pci/cx25821/cx25821-medusa-video.c=406=void medusa_set_resolution(struct cx25821_dev *dev, int width,\n--\ndrivers/media/pci/cx25821/cx25821-medusa-video.c-465-\ndrivers/media/pci/cx25821/cx25821-medusa-video.c:466:static void medusa_set_decoderduration(struct cx25821_dev *dev, int decoder,\ndrivers/media/pci/cx25821/cx25821-medusa-video.c-467-\t\t\t\t       int duration)\n--\ndrivers/media/pci/cx25821/cx25821-medusa-video.c=648=int medusa_video_init(struct cx25821_dev *dev)\n--\ndrivers/media/pci/cx25821/cx25821-medusa-video.c-676-\tfor (i = 0; i \u003c dev-\u003e_max_num_decoders; i++)\ndrivers/media/pci/cx25821/cx25821-medusa-video.c:677:\t\tmedusa_set_decoderduration(dev, i, 0);\ndrivers/media/pci/cx25821/cx25821-medusa-video.c-678-\n--\ndrivers/media/pci/saa7134/saa7134-video.c=383=static void video_mux(struct saa7134_dev *dev, int input)\n--\ndrivers/media/pci/saa7134/saa7134-video.c-392-\ndrivers/media/pci/saa7134/saa7134-video.c:393:static void saa7134_set_decoder(struct saa7134_dev *dev)\ndrivers/media/pci/saa7134/saa7134-video.c-394-{\n--\ndrivers/media/pci/saa7134/saa7134-video.c=451=void saa7134_set_tvnorm_hw(struct saa7134_dev *dev)\ndrivers/media/pci/saa7134/saa7134-video.c-452-{\ndrivers/media/pci/saa7134/saa7134-video.c:453:\tsaa7134_set_decoder(dev);\ndrivers/media/pci/saa7134/saa7134-video.c-454-\n--\ndrivers/media/platform/amphion/vdec.c=650=static int vdec_drain(struct vpu_inst *inst)\n--\ndrivers/media/platform/amphion/vdec.c-669-\tvdec-\u003eparams.end_flag = 1;\ndrivers/media/platform/amphion/vdec.c:670:\tvpu_iface_set_decode_params(inst, \u0026vdec-\u003eparams, 1);\ndrivers/media/platform/amphion/vdec.c-671-\tvdec-\u003edrain = 0;\n--\ndrivers/media/platform/amphion/vdec.c=1588=static void vdec_abort(struct vpu_inst *inst)\n--\ndrivers/media/platform/amphion/vdec.c-1598-\tvdec-\u003eparams.end_flag = 1;\ndrivers/media/platform/amphion/vdec.c:1599:\tvpu_iface_set_decode_params(inst, \u0026vdec-\u003eparams, 1);\ndrivers/media/platform/amphion/vdec.c-1600-\n--\ndrivers/media/platform/amphion/vdec.c=1674=static int vdec_start(struct vpu_inst *inst)\n--\ndrivers/media/platform/amphion/vdec.c-1710-\tvdec-\u003eparams.udata.size = vdec-\u003eudata.length;\ndrivers/media/platform/amphion/vdec.c:1711:\tret = vpu_iface_set_decode_params(inst, \u0026vdec-\u003eparams, 0);\ndrivers/media/platform/amphion/vdec.c-1712-\tif (ret) {\n--\ndrivers/media/platform/amphion/vpu_cmds.c=393=int vpu_session_update_parameters(struct vpu_inst *inst, void *arg)\n--\ndrivers/media/platform/amphion/vpu_cmds.c-395-\tif (inst-\u003etype \u0026 VPU_CORE_TYPE_DEC)\ndrivers/media/platform/amphion/vpu_cmds.c:396:\t\tvpu_iface_set_decode_params(inst, arg, 1);\ndrivers/media/platform/amphion/vpu_cmds.c-397-\telse\n--\ndrivers/media/platform/amphion/vpu_malone.c=702=static int vpu_malone_update_params(struct vpu_shared_addr *shared,\n--\ndrivers/media/platform/amphion/vpu_malone.c-714-\ndrivers/media/platform/amphion/vpu_malone.c:715:int vpu_malone_set_decode_params(struct vpu_shared_addr *shared,\ndrivers/media/platform/amphion/vpu_malone.c-716-\t\t\t\t u32 instance,\n--\ndrivers/media/platform/amphion/vpu_malone.h=23=int vpu_malone_update_stream_buffer(struct vpu_shared_addr *shared,\ndrivers/media/platform/amphion/vpu_malone.h-24-\t\t\t\t    u32 instance, u32 ptr, bool write);\ndrivers/media/platform/amphion/vpu_malone.h:25:int vpu_malone_set_decode_params(struct vpu_shared_addr *shared,\ndrivers/media/platform/amphion/vpu_malone.h-26-\t\t\t\t u32 instance,\n--\ndrivers/media/platform/amphion/vpu_rpc.c=167=static struct vpu_iface_ops imx8q_rpc_ops[] = {\n--\ndrivers/media/platform/amphion/vpu_rpc.c-209-\t\t.config_stream_buffer = vpu_malone_config_stream_buffer,\ndrivers/media/platform/amphion/vpu_rpc.c:210:\t\t.set_decode_params = vpu_malone_set_decode_params,\ndrivers/media/platform/amphion/vpu_rpc.c-211-\t\t.pack_cmd = vpu_malone_pack_cmd,\n--\ndrivers/media/platform/amphion/vpu_rpc.h=42=struct vpu_iface_ops {\n--\ndrivers/media/platform/amphion/vpu_rpc.h-87-\t\t\t\t u32 update);\ndrivers/media/platform/amphion/vpu_rpc.h:88:\tint (*set_decode_params)(struct vpu_shared_addr *shared,\ndrivers/media/platform/amphion/vpu_rpc.h-89-\t\t\t\t u32 instance,\n--\ndrivers/media/platform/amphion/vpu_rpc.h=403=static inline int vpu_iface_set_encode_params(struct vpu_inst *inst,\n--\ndrivers/media/platform/amphion/vpu_rpc.h-413-\ndrivers/media/platform/amphion/vpu_rpc.h:414:static inline int vpu_iface_set_decode_params(struct vpu_inst *inst,\ndrivers/media/platform/amphion/vpu_rpc.h-415-\t\t\t\t\t      struct vpu_decode_params *params, u32 update)\n--\ndrivers/media/platform/amphion/vpu_rpc.h-418-\ndrivers/media/platform/amphion/vpu_rpc.h:419:\tif (!ops || !ops-\u003eset_decode_params  || inst-\u003eid \u003c 0)\ndrivers/media/platform/amphion/vpu_rpc.h-420-\t\treturn -EINVAL;\ndrivers/media/platform/amphion/vpu_rpc.h-421-\ndrivers/media/platform/amphion/vpu_rpc.h:422:\treturn ops-\u003eset_decode_params(inst-\u003ecore-\u003eiface, inst-\u003eid, params, update);\ndrivers/media/platform/amphion/vpu_rpc.h-423-}\n--\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c=430=static void tegra_fill_pixfmt_mp(struct v4l2_pix_format_mplane *pixfmt,\n--\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c-464-\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c:465:static void tegra_reset_decoded_fmt(struct tegra_ctx *ctx)\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c-466-{\n--\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c=656=static int tegra_s_coded_fmt(struct file *file, void *priv,\n--\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c-705-\t */\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c:706:\ttegra_reset_decoded_fmt(ctx);\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c-707-\n--\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c=808=static int tegra_open(struct file *file)\n--\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c-838-\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c:839:\ttegra_reset_decoded_fmt(ctx);\ndrivers/media/platform/nvidia/tegra-vde/v4l2.c-840-\ttegra_try_decoded_fmt(file, \u0026ctx-\u003efh, \u0026ctx-\u003edecoded_fmt);\n--\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c=113=static void rkvdec_reset_fmt(struct rkvdec_ctx *ctx, struct v4l2_format *f,\n--\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c-124-\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c:125:static void rkvdec_reset_decoded_fmt(struct rkvdec_ctx *ctx)\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c-126-{\n--\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c=149=static int rkvdec_s_ctrl(struct v4l2_ctrl *ctrl)\n--\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c-177-\t\tctx-\u003eimage_fmt = image_fmt;\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c:178:\t\trkvdec_reset_decoded_fmt(ctx);\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c-179-\t}\n--\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c=752=static int rkvdec_s_output_fmt(struct file *file, void *priv,\n--\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c-801-\tctx-\u003eimage_fmt = RKVDEC_IMG_FMT_ANY;\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c:802:\trkvdec_reset_decoded_fmt(ctx);\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c-803-\n--\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c=1279=static int rkvdec_open(struct file *filp)\n--\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c-1290-\trkvdec_reset_coded_fmt(ctx);\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c:1291:\trkvdec_reset_decoded_fmt(ctx);\ndrivers/media/platform/rockchip/rkvdec/rkvdec.c-1292-\tv4l2_fh_init(\u0026ctx-\u003efh, video_devdata(filp));\n--\ndrivers/media/rc/img-ir/img-ir-hw.c=527=static int img_ir_set_wakeup_filter(struct rc_dev *dev,\n--\ndrivers/media/rc/img-ir/img-ir-hw.c-533-/**\ndrivers/media/rc/img-ir/img-ir-hw.c:534: * img_ir_set_decoder() - Set the current decoder.\ndrivers/media/rc/img-ir/img-ir-hw.c-535- * @priv:\tIR private data.\n--\ndrivers/media/rc/img-ir/img-ir-hw.c-538- */\ndrivers/media/rc/img-ir/img-ir-hw.c:539:static void img_ir_set_decoder(struct img_ir_priv *priv,\ndrivers/media/rc/img-ir/img-ir-hw.c-540-\t\t\t       const struct img_ir_decoder *decoder,\n--\ndrivers/media/rc/img-ir/img-ir-hw.c=659=static int img_ir_change_protocol(struct rc_dev *dev, u64 *ir_type)\n--\ndrivers/media/rc/img-ir/img-ir-hw.c-668-\t\t/* disable all protocols */\ndrivers/media/rc/img-ir/img-ir-hw.c:669:\t\timg_ir_set_decoder(priv, NULL, 0);\ndrivers/media/rc/img-ir/img-ir-hw.c-670-\t\tgoto success;\n--\ndrivers/media/rc/img-ir/img-ir-hw.c-677-\t\t\t*ir_type \u0026= dec-\u003etype;\ndrivers/media/rc/img-ir/img-ir-hw.c:678:\t\t\timg_ir_set_decoder(priv, dec, *ir_type);\ndrivers/media/rc/img-ir/img-ir-hw.c-679-\t\t\tgoto success;\n--\ndrivers/media/rc/img-ir/img-ir-hw.c=1004=void img_ir_setup_hw(struct img_ir_priv *priv)\n--\ndrivers/media/rc/img-ir/img-ir-hw.c-1015-\t\t\timg_ir_set_protocol(priv, dec-\u003etype);\ndrivers/media/rc/img-ir/img-ir-hw.c:1016:\t\t\timg_ir_set_decoder(priv, dec, 0);\ndrivers/media/rc/img-ir/img-ir-hw.c-1017-\t\t\treturn;\n--\ndrivers/media/rc/img-ir/img-ir-hw.c-1019-\t}\ndrivers/media/rc/img-ir/img-ir-hw.c:1020:\timg_ir_set_decoder(priv, NULL, 0);\ndrivers/media/rc/img-ir/img-ir-hw.c-1021-}\n--\ndrivers/media/rc/img-ir/img-ir-hw.c=1042=int img_ir_probe_hw(struct img_ir_priv *priv)\n--\ndrivers/media/rc/img-ir/img-ir-hw.c-1103-err_register_rc:\ndrivers/media/rc/img-ir/img-ir-hw.c:1104:\timg_ir_set_decoder(priv, NULL, 0);\ndrivers/media/rc/img-ir/img-ir-hw.c-1105-\thw-\u003erdev = NULL;\n--\ndrivers/media/rc/img-ir/img-ir-hw.c=1115=void img_ir_remove_hw(struct img_ir_priv *priv)\n--\ndrivers/media/rc/img-ir/img-ir-hw.c-1121-\trc_unregister_device(rdev);\ndrivers/media/rc/img-ir/img-ir-hw.c:1122:\timg_ir_set_decoder(priv, NULL, 0);\ndrivers/media/rc/img-ir/img-ir-hw.c-1123-\thw-\u003erdev = NULL;\n--\ndrivers/media/test-drivers/visl/visl-video.c=272=static void visl_reset_coded_fmt(struct visl_ctx *ctx)\n--\ndrivers/media/test-drivers/visl/visl-video.c-292-\ndrivers/media/test-drivers/visl/visl-video.c:293:static int visl_reset_decoded_fmt(struct visl_ctx *ctx)\ndrivers/media/test-drivers/visl/visl-video.c-294-{\n--\ndrivers/media/test-drivers/visl/visl-video.c=313=int visl_set_default_format(struct visl_ctx *ctx)\n--\ndrivers/media/test-drivers/visl/visl-video.c-315-\tvisl_reset_coded_fmt(ctx);\ndrivers/media/test-drivers/visl/visl-video.c:316:\treturn visl_reset_decoded_fmt(ctx);\ndrivers/media/test-drivers/visl/visl-video.c-317-}\n--\ndrivers/media/test-drivers/visl/visl-video.c=452=static int visl_s_fmt_vid_out(struct file *file, void *priv,\n--\ndrivers/media/test-drivers/visl/visl-video.c-475-\ndrivers/media/test-drivers/visl/visl-video.c:476:\tret = visl_reset_decoded_fmt(ctx);\ndrivers/media/test-drivers/visl/visl-video.c-477-\tif (ret)\n--\ndrivers/media/usb/cx231xx/cx231xx-avcore.c=553=int cx231xx_set_video_input_mux(struct cx231xx *dev, u8 input)\n--\ndrivers/media/usb/cx231xx/cx231xx-avcore.c-571-\t\t}\ndrivers/media/usb/cx231xx/cx231xx-avcore.c:572:\t\tstatus = cx231xx_set_decoder_video_input(dev,\ndrivers/media/usb/cx231xx/cx231xx-avcore.c-573-\t\t\t\t\t\t\t INPUT(input)-\u003etype,\n--\ndrivers/media/usb/cx231xx/cx231xx-avcore.c-595-\t\tcase CX231XX_BOARD_EVROMEDIA_FULL_HYBRID_FULLHD:\ndrivers/media/usb/cx231xx/cx231xx-avcore.c:596:\t\t\tstatus = cx231xx_set_decoder_video_input(dev,\ndrivers/media/usb/cx231xx/cx231xx-avcore.c-597-\t\t\t\t\t\t\tCX231XX_VMUX_TELEVISION,\n--\ndrivers/media/usb/cx231xx/cx231xx-avcore.c-601-\t\t\tif (dev-\u003etuner_type == TUNER_NXP_TDA18271)\ndrivers/media/usb/cx231xx/cx231xx-avcore.c:602:\t\t\t\tstatus = cx231xx_set_decoder_video_input(dev,\ndrivers/media/usb/cx231xx/cx231xx-avcore.c-603-\t\t\t\t\t\t\tCX231XX_VMUX_TELEVISION,\n--\ndrivers/media/usb/cx231xx/cx231xx-avcore.c-605-\t\t\telse\ndrivers/media/usb/cx231xx/cx231xx-avcore.c:606:\t\t\t\tstatus = cx231xx_set_decoder_video_input(dev,\ndrivers/media/usb/cx231xx/cx231xx-avcore.c-607-\t\t\t\t\t\t\tCX231XX_VMUX_COMPOSITE1,\n--\ndrivers/media/usb/cx231xx/cx231xx-avcore.c-624-\ndrivers/media/usb/cx231xx/cx231xx-avcore.c:625:int cx231xx_set_decoder_video_input(struct cx231xx *dev,\ndrivers/media/usb/cx231xx/cx231xx-avcore.c-626-\t\t\t\tu8 pin_type, u32 input)\n--\ndrivers/media/usb/cx231xx/cx231xx.h=916=int cx231xx_set_video_input_mux(struct cx231xx *dev, u8 input);\ndrivers/media/usb/cx231xx/cx231xx.h:917:int cx231xx_set_decoder_video_input(struct cx231xx *dev, u8 pin_type, u32 input);\ndrivers/media/usb/cx231xx/cx231xx.h-918-int cx231xx_do_mode_ctrl_overrides(struct cx231xx *dev);\n--\ndrivers/pci/vgaarb.c=42=struct vga_device {\n--\ndrivers/pci/vgaarb.c-53-\tbool is_firmware_default;\t/* device selected by firmware */\ndrivers/pci/vgaarb.c:54:\tunsigned int (*set_decode)(void *data, bool decode);\ndrivers/pci/vgaarb.c:55:\tvoid *set_decode_data;\ndrivers/pci/vgaarb.c-56-};\n--\ndrivers/pci/vgaarb.c=888=static void __vga_set_legacy_decoding(struct pci_dev *pdev,\n--\ndrivers/pci/vgaarb.c-902-\t/* Don't let userspace futz with kernel driver decodes */\ndrivers/pci/vgaarb.c:903:\tif (userspace \u0026\u0026 vgadev-\u003eset_decode)\ndrivers/pci/vgaarb.c-904-\t\tgoto bail;\n--\ndrivers/pci/vgaarb.c=933=EXPORT_SYMBOL(vga_set_legacy_decoding);\n--\ndrivers/pci/vgaarb.c-937- * @pdev: PCI device of the VGA client\ndrivers/pci/vgaarb.c:938: * @set_decode: VGA decode change callback\ndrivers/pci/vgaarb.c-939- * @data: private data to pass to callback\n--\ndrivers/pci/vgaarb.c-942- *\ndrivers/pci/vgaarb.c:943: * @set_decode callback: If a client can disable its GPU VGA resource, it\ndrivers/pci/vgaarb.c-944- * will get a callback from this to set the encode/decode state.\n--\ndrivers/pci/vgaarb.c=960=int vga_client_register(struct pci_dev *pdev,\ndrivers/pci/vgaarb.c:961:\t\tunsigned int (*set_decode)(void *data, bool decode),\ndrivers/pci/vgaarb.c-962-\t\tvoid *data)\n--\ndrivers/pci/vgaarb.c-969-\tif (vgadev) {\ndrivers/pci/vgaarb.c:970:\t\tvgadev-\u003eset_decode = set_decode;\ndrivers/pci/vgaarb.c:971:\t\tvgadev-\u003eset_decode_data = data;\ndrivers/pci/vgaarb.c-972-\t}\n--\ndrivers/pci/vgaarb.c=1457=static void vga_arbiter_notify_clients(void)\n--\ndrivers/pci/vgaarb.c-1470-\tlist_for_each_entry(vgadev, \u0026vga_list, list) {\ndrivers/pci/vgaarb.c:1471:\t\tif (vgadev-\u003eset_decode) {\ndrivers/pci/vgaarb.c:1472:\t\t\tnew_decodes = vgadev-\u003eset_decode(vgadev-\u003eset_decode_data,\ndrivers/pci/vgaarb.c-1473-\t\t\t\t\t\t\t new_state);\n--\ndrivers/vfio/pci/vfio_pci_core.c=152=static inline void vfio_pci_core_debugfs_init(struct vfio_pci_core_device *vdev)\n--\ndrivers/vfio/pci/vfio_pci_core.c-164- */\ndrivers/vfio/pci/vfio_pci_core.c:165:static unsigned int vfio_pci_set_decode(void *data, bool single_vga)\ndrivers/vfio/pci/vfio_pci_core.c-166-{\n--\ndrivers/vfio/pci/vfio_pci_core.c=2151=static int vfio_pci_vga_init(struct vfio_pci_core_device *vdev)\n--\ndrivers/vfio/pci/vfio_pci_core.c-2162-\ndrivers/vfio/pci/vfio_pci_core.c:2163:\tret = vga_client_register(pdev, vfio_pci_set_decode, vdev);\ndrivers/vfio/pci/vfio_pci_core.c-2164-\tif (ret)\ndrivers/vfio/pci/vfio_pci_core.c-2165-\t\treturn ret;\ndrivers/vfio/pci/vfio_pci_core.c:2166:\tvga_set_legacy_decoding(pdev, vfio_pci_set_decode(vdev, false));\ndrivers/vfio/pci/vfio_pci_core.c-2167-\treturn 0;\n--\ninclude/linux/vgaarb.h=35=int vga_client_register(struct pci_dev *pdev,\ninclude/linux/vgaarb.h:36:\t\tunsigned int (*set_decode)(void *data, bool state),\ninclude/linux/vgaarb.h-37-\t\tvoid *data);\n--\ninclude/linux/vgaarb.h=62=static inline int vga_client_register(struct pci_dev *pdev,\ninclude/linux/vgaarb.h:63:\t\tunsigned int (*set_decode)(void *data, bool state),\ninclude/linux/vgaarb.h-64-\t\tvoid *data)\n--\ninclude/sound/seq_midi_event.h=30=void snd_midi_event_reset_encode(struct snd_midi_event *dev);\ninclude/sound/seq_midi_event.h:31:void snd_midi_event_reset_decode(struct snd_midi_event *dev);\ninclude/sound/seq_midi_event.h-32-void snd_midi_event_no_status(struct snd_midi_event *dev, int on);\n--\nsound/core/seq/oss/seq_oss_midi.c=569=send_midi_event(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, struct seq_oss_midi *mdev)\n--\nsound/core/seq/oss/seq_oss_midi.c-578-\t\tsnd_seq_oss_readq_sysex(dp-\u003ereadq, mdev-\u003eseq_device, ev);\nsound/core/seq/oss/seq_oss_midi.c:579:\t\tsnd_midi_event_reset_decode(mdev-\u003ecoder);\nsound/core/seq/oss/seq_oss_midi.c-580-\t} else {\n--\nsound/core/seq/seq_midi.c=137=static int event_process_midi(struct snd_seq_event *ev, int direct,\n--\nsound/core/seq/seq_midi.c-162-\t\tsnd_seq_dump_var_event(ev, __dump_midi, substream);\nsound/core/seq/seq_midi.c:163:\t\tsnd_midi_event_reset_decode(msynth-\u003eparser);\nsound/core/seq/seq_midi.c-164-\t} else {\n--\nsound/core/seq/seq_midi.c-172-\t\tif (dump_midi(substream, msg, len) \u003c 0)\nsound/core/seq/seq_midi.c:173:\t\t\tsnd_midi_event_reset_decode(msynth-\u003eparser);\nsound/core/seq/seq_midi.c-174-\t}\n--\nsound/core/seq/seq_midi.c=254=static int midisynth_use(void *private_data, struct snd_seq_port_subscribe *info)\n--\nsound/core/seq/seq_midi.c-277-\t}\nsound/core/seq/seq_midi.c:278:\tsnd_midi_event_reset_decode(msynth-\u003eparser);\nsound/core/seq/seq_midi.c-279-\tmsynth-\u003eoutput_rfile = rfile;\n--\nsound/core/seq/seq_midi_event.c=150=EXPORT_SYMBOL(snd_midi_event_reset_encode);\nsound/core/seq/seq_midi_event.c-151-\nsound/core/seq/seq_midi_event.c:152:void snd_midi_event_reset_decode(struct snd_midi_event *dev)\nsound/core/seq/seq_midi_event.c-153-{\n--\nsound/core/seq/seq_midi_event.c-156-}\nsound/core/seq/seq_midi_event.c:157:EXPORT_SYMBOL(snd_midi_event_reset_decode);\nsound/core/seq/seq_midi_event.c-158-\n--\nsound/core/seq/seq_midi_event.c=282=long snd_midi_event_decode(struct snd_midi_event *dev, unsigned char *buf, long count,\n--\nsound/core/seq/seq_midi_event.c-308-\tif (cmd == MIDI_CMD_COMMON_SYSEX) {\nsound/core/seq/seq_midi_event.c:309:\t\tsnd_midi_event_reset_decode(dev);\nsound/core/seq/seq_midi_event.c-310-\t\treturn snd_seq_expand_var_event(ev, count, buf, 1, 0);\n--\nsound/core/seq/seq_virmidi.c=72=static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,\n--\nsound/core/seq/seq_virmidi.c-91-\t\t\tsnd_seq_dump_var_event(ev, dump_to_rawmidi, vmidi-\u003esubstream);\nsound/core/seq/seq_virmidi.c:92:\t\t\tsnd_midi_event_reset_decode(vmidi-\u003eparser);\nsound/core/seq/seq_virmidi.c-93-\t\t} else {\n--\nsound/soc/codecs/mt6359.c=111=static void mt6359_set_topck(struct mt6359_priv *priv, bool enable)\n--\nsound/soc/codecs/mt6359.c-116-\nsound/soc/codecs/mt6359.c:117:static void mt6359_set_decoder_clk(struct mt6359_priv *priv, bool enable)\nsound/soc/codecs/mt6359.c-118-{\n--\nsound/soc/codecs/mt6359.c=853=static void mtk_hp_enable(struct mt6359_priv *priv)\n--\nsound/soc/codecs/mt6359.c-942-\t/* Enable AUD_CLK */\nsound/soc/codecs/mt6359.c:943:\tmt6359_set_decoder_clk(priv, true);\nsound/soc/codecs/mt6359.c-944-\n--\nsound/soc/codecs/mt6359.c=965=static void mtk_hp_disable(struct mt6359_priv *priv)\n--\nsound/soc/codecs/mt6359.c-982-\t/* Disable AUD_CLK */\nsound/soc/codecs/mt6359.c:983:\tmt6359_set_decoder_clk(priv, false);\nsound/soc/codecs/mt6359.c-984-\n--\nsound/soc/codecs/mt6359.c=1070=static int mt_rcv_event(struct snd_soc_dapm_widget *w,\n--\nsound/soc/codecs/mt6359.c-1113-\t\t/* Enable AUD_CLK */\nsound/soc/codecs/mt6359.c:1114:\t\tmt6359_set_decoder_clk(priv, true);\nsound/soc/codecs/mt6359.c-1115-\n--\nsound/soc/codecs/mt6359.c-1133-\t\t/* Disable AUD_CLK */\nsound/soc/codecs/mt6359.c:1134:\t\tmt6359_set_decoder_clk(priv, false);\nsound/soc/codecs/mt6359.c-1135-\n--\nsound/soc/codecs/mt6359.c=1154=static int mt_lo_event(struct snd_soc_dapm_widget *w,\n--\nsound/soc/codecs/mt6359.c-1198-\t\t/* Enable AUD_CLK */\nsound/soc/codecs/mt6359.c:1199:\t\tmt6359_set_decoder_clk(priv, true);\nsound/soc/codecs/mt6359.c-1200-\n--\nsound/soc/codecs/mt6359.c-1244-\t\t/* Disable AUD_CLK */\nsound/soc/codecs/mt6359.c:1245:\t\tmt6359_set_decoder_clk(priv, false);\nsound/soc/codecs/mt6359.c-1246-\n"
}

gemini-3.8-flash

null

null

							input: 50877
							output: 167
							thoughts: 2332
						

**Analysis of Code Reachability in Virtualized Environments**

Okay, let's break this down. My goal is to determine if the modified code is accessible within standard virtualized environments like QEMU. I see changes in several files, including the GPU drivers for AMD, Intel, Loongson, Nouveau, and Radeon. I also see modifications related to VFIO-PCI and the VGA arbitration code (`vgaarb.c` and `include/linux/vgaarb.h`).

Initially, my concern focused on `drivers/pci/vgaarb.c`. The core question here is whether `vga_client_register` or, more importantly, the `vga_arbiter_notify_clients` function, which calls the registered callback, is actually reachable.  I see that `vga_client_register` is exclusively called by those six drivers – amdgpu, i915, lsdc, nouveau, radeon, and vfio_pci_core. My immediate thought is that none of these drivers are *typically* active in a standard QEMU setup. They require specific physical hardware that isn't emulated.

Then, there's the modification in `vga_arbiter_notify_clients()`, where a callback function `vgadev->set_decode` is invoked. However, because no client registers, this pointer is always `NULL`, making that entire path effectively dead code. QEMU's emulated display devices (`virtio-gpu-pci`, `bochs-drm`, `cirrus`, `qxl`, `stdvga`) don't use `vga_client_register`. This strongly suggests the code paths are unreachable.

I pause and reread the instructions, specifically the "NEGATIVE CRITERIA" section. The rules are clear: "Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU".  And, *explicitly* lists amdgpu as an example. The other drivers, intel_vga (i915), lsdc, nouveau, and radeon, are all vendor-specific GPU drivers. This confirms my suspicion. The `vga_client_register` API in `vgaarb.c` is exclusively for those drivers (and VFIO, which requires passthrough) and is not reachable in standard virtualized environments.

I double-checked to see if other modules register the vga client, but none do. The code in `vgaarb.c` is only modified within `vga_client_register()` and when calling the registered client callback `vgadev->set_decode()`.

Therefore, the modifications are either within vendor-specific GPU drivers that demand physical hardware or within the VGA arbiter callback registration, which those unreachable drivers use. In all virtualized environments, this code is structurally unreachable. Thus, the value for `WorthFuzzing` is unequivocally `false`. The related configurations, `EnableConfigs` and `FocusSymbols` will be empty/null, and the reasoning is a direct, clear explanation of why these modifications are inaccessible in a standard virtualized environment. The changes directly impact the `set_decode` callback interface in VGA arbiter and its consumers such as amdgpu, radeon, nouveau, i915, lsdc, and vfio-pci, none of which will be active without physical hardware. Therefore, the `vga_client_register()` and `vgadev->set_decode()` functions are structurally unreachable in QEMU. Let's send the results.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch refactors the VGA arbiter callback interface (vga_client_register and set_decode) to pass a private data pointer instead of pci_dev. The only consumers that implement and register this callback are vendor-specific physical GPU drivers (amdgpu, radeon, nouveau, i915, lsdc) and vfio-pci. Because none of these GPU drivers or vfio-pci VGA passthrough are emulated or present in standard virtualized fuzzing environments (QEMU/GCE), the modified code in these drivers as well as the callback registration and invocation paths in vgaarb.c are structurally unreachable.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch refactors the VGA arbiter callback interface (vga_client_register and set_decode) to pass a private data pointer instead of pci_dev. The only consumers that implement and register this callback are vendor-specific physical GPU drivers (amdgpu, radeon, nouveau, i915, lsdc) and vfio-pci. Because none of these GPU drivers or vfio-pci VGA passthrough are emulated or present in standard virtualized fuzzing environments (QEMU/GCE), the modified code in these drivers as well as the callback registration and invocation paths in vgaarb.c are structurally unreachable.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null