AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "All changes in this patch series are restricted to Documentation and the arch/riscv/ tree (implementing paravirtualized spinlocks and KVM SBI pvlock support for RISC-V). Since the target architecture is amd64, these code paths are exclusive to RISC-V and are structurally unreachable and not compiled on amd64.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 7012de575da931c91ca7a4630dd5d361b50dd3e3\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Sep 23 10:36:12 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt\nindex 33cd30996e47e..d32bb7db9f919 100644\n--- a/Documentation/admin-guide/kernel-parameters.txt\n+++ b/Documentation/admin-guide/kernel-parameters.txt\n@@ -4632,7 +4632,7 @@ Kernel parameters\n \t\t\tas generic guest with no PV drivers. Currently support\n \t\t\tXEN HVM, KVM, HYPER_V and VMWARE guest.\n \n-\tnopvspin\t[X86,XEN,KVM,EARLY]\n+\tnopvspin\t[X86,RISCV,XEN,KVM,EARLY]\n \t\t\tDisables the qspinlock slow path using PV optimizations\n \t\t\twhich allow the hypervisor to 'idle' the guest on lock\n \t\t\tcontention.\ndiff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig\nindex d6c2dbf8455ce..9af53ef5ee956 100644\n--- a/arch/riscv/Kconfig\n+++ b/arch/riscv/Kconfig\n@@ -1165,6 +1165,18 @@ config PARAVIRT_TIME_ACCOUNTING\n \n \t  If in doubt, say N here.\n \n+config PARAVIRT_SPINLOCKS\n+\tbool \"Paravirtualization layer for spinlocks\"\n+\tdepends on QUEUED_SPINLOCKS\n+\tdefault y\n+\thelp\n+\t  Paravirtualized spinlocks allow a unfair qspinlock to replace the\n+\t  test-set kvm-guest virt spinlock implementation with something\n+\t  virtualization-friendly, for example, halt the virtual CPU rather\n+\t  than spinning.\n+\n+\t  If you are unsure how to answer this question, answer Y.\n+\n config RELOCATABLE\n \tbool \"Build a relocatable kernel\"\n \tselect MODULE_SECTIONS if MODULES\ndiff --git a/arch/riscv/include/asm/Kbuild b/arch/riscv/include/asm/Kbuild\nindex 7721b63642f41..3d8800d4fe48d 100644\n--- a/arch/riscv/include/asm/Kbuild\n+++ b/arch/riscv/include/asm/Kbuild\n@@ -13,7 +13,6 @@ generic-y += spinlock_types.h\n generic-y += ticket_spinlock.h\n generic-y += qrwlock.h\n generic-y += qrwlock_types.h\n-generic-y += qspinlock.h\n generic-y += ring_buffer.h\n generic-y += user.h\n generic-y += vmlinux.lds.h\ndiff --git a/arch/riscv/include/asm/kvm_vcpu_sbi.h b/arch/riscv/include/asm/kvm_vcpu_sbi.h\nindex f01a2860c7511..cdc16e64ad199 100644\n--- a/arch/riscv/include/asm/kvm_vcpu_sbi.h\n+++ b/arch/riscv/include/asm/kvm_vcpu_sbi.h\n@@ -114,6 +114,7 @@ extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_fwft;\n extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_mpxy;\n extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_experimental;\n extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_vendor;\n+extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_pvlock;\n \n #ifdef CONFIG_RISCV_PMU_SBI\n extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_pmu;\ndiff --git a/arch/riscv/include/asm/qspinlock.h b/arch/riscv/include/asm/qspinlock.h\nnew file mode 100644\nindex 0000000000000..9c7108baa40a1\n--- /dev/null\n+++ b/arch/riscv/include/asm/qspinlock.h\n@@ -0,0 +1,57 @@\n+/* SPDX-License-Identifier: GPL-2.0-only */\n+/*\n+ * Copyright (C) 2026 GUO Ren (XuanTie) \u003cguoren@kernel.org\u003e\n+ */\n+\n+#ifndef _ASM_RISCV_QSPINLOCK_H\n+#define _ASM_RISCV_QSPINLOCK_H\n+\n+#ifdef CONFIG_PARAVIRT_SPINLOCKS\n+#include \u003casm/qspinlock_paravirt.h\u003e\n+\n+/* How long a lock should spin before we consider blocking */\n+#define SPIN_THRESHOLD\t\t(1 \u003c\u003c 15)\n+\n+extern bool nopvspin;\n+\n+void native_queued_spin_lock_slowpath(struct qspinlock *lock, u32 val);\n+void __pv_init_lock_hash(void);\n+void __pv_queued_spin_lock_slowpath(struct qspinlock *lock, u32 val);\n+\n+static inline void queued_spin_lock_slowpath(struct qspinlock *lock, u32 val)\n+{\n+\tstatic_call(pv_queued_spin_lock_slowpath)(lock, val);\n+}\n+\n+#define queued_spin_unlock\tqueued_spin_unlock\n+static inline void queued_spin_unlock(struct qspinlock *lock)\n+{\n+\tstatic_call(pv_queued_spin_unlock)(lock);\n+}\n+#endif /* CONFIG_PARAVIRT_SPINLOCKS */\n+\n+#include \u003casm-generic/qspinlock.h\u003e\n+#include \u003casm/jump_label.h\u003e\n+\n+/*\n+ * KVM guests fall back to a Test-and-Set spinlock because fair locks suffer\n+ * from severe lock-holder-preemption issues. When virt_spin_lock_key is\n+ * enabled, virt_spin_lock() shortcuts queued_spin_lock_slowpath() and hijacks\n+ * the lock acquisition.\n+ */\n+DECLARE_STATIC_KEY_FALSE(virt_spin_lock_key);\n+\n+#define virt_spin_lock rv_virt_spin_lock\n+static inline bool rv_virt_spin_lock(struct qspinlock *lock)\n+{\n+\tif (!static_branch_likely(\u0026virt_spin_lock_key))\n+\t\treturn false;\n+\n+\tdo {\n+\t\tsmp_cond_load_relaxed((s32 *)\u0026lock-\u003eval, VAL == 0);\n+\t} while (atomic_cmpxchg(\u0026lock-\u003eval, 0, _Q_LOCKED_VAL) != 0);\n+\n+\treturn true;\n+}\n+\n+#endif /* _ASM_RISCV_QSPINLOCK_H */\ndiff --git a/arch/riscv/include/asm/qspinlock_paravirt.h b/arch/riscv/include/asm/qspinlock_paravirt.h\nnew file mode 100644\nindex 0000000000000..7261cd9b13b2e\n--- /dev/null\n+++ b/arch/riscv/include/asm/qspinlock_paravirt.h\n@@ -0,0 +1,26 @@\n+/* SPDX-License-Identifier: GPL-2.0-only */\n+/*\n+ * Copyright (C) 2026 GUO Ren (XuanTie) \u003cguoren@kernel.org\u003e\n+ */\n+\n+#ifndef _ASM_RISCV_QSPINLOCK_PARAVIRT_H\n+#define _ASM_RISCV_QSPINLOCK_PARAVIRT_H\n+\n+void pv_wait(u8 *ptr, u8 val);\n+void pv_kick(int cpu);\n+\n+void dummy_queued_spin_lock_slowpath(struct qspinlock *lock, u32 val);\n+void dummy_queued_spin_unlock(struct qspinlock *lock);\n+\n+DECLARE_STATIC_CALL(pv_queued_spin_lock_slowpath, dummy_queued_spin_lock_slowpath);\n+DECLARE_STATIC_CALL(pv_queued_spin_unlock, dummy_queued_spin_unlock);\n+\n+bool __init pv_qspinlock_init(void);\n+\n+void __pv_queued_spin_unlock_slowpath(struct qspinlock *lock, u8 locked);\n+\n+bool pv_is_native_spin_unlock(void);\n+\n+void __pv_queued_spin_unlock(struct qspinlock *lock);\n+\n+#endif /* _ASM_RISCV_QSPINLOCK_PARAVIRT_H */\ndiff --git a/arch/riscv/include/asm/sbi.h b/arch/riscv/include/asm/sbi.h\nindex 5725e0ca4dda3..724ab834ad859 100644\n--- a/arch/riscv/include/asm/sbi.h\n+++ b/arch/riscv/include/asm/sbi.h\n@@ -38,6 +38,7 @@ enum sbi_ext_id {\n \tSBI_EXT_FWFT = 0x46574654,\n \tSBI_EXT_MPXY = 0x4D505859,\n \tSBI_EXT_DBTR = 0x44425452,\n+\tSBI_EXT_PVLOCK = 0x50564C4B,\n \n \t/* Experimentals extensions must lie within this range */\n \tSBI_EXT_EXPERIMENTAL_START = 0x08000000,\n@@ -534,6 +535,10 @@ union sbi_dbtr_shmem_entry {\n \tstruct sbi_dbtr_id_msg id;\n };\n \n+enum sbi_ext_pvlock_fid {\n+\tSBI_EXT_PVLOCK_KICK_CPU = 0,\n+};\n+\n /* SBI spec version fields */\n #define SBI_SPEC_VERSION_DEFAULT\t0x1\n #define SBI_SPEC_VERSION_MAJOR_SHIFT\t24\ndiff --git a/arch/riscv/include/uapi/asm/kvm.h b/arch/riscv/include/uapi/asm/kvm.h\nindex 20d9959ca44fc..110a0d62113f8 100644\n--- a/arch/riscv/include/uapi/asm/kvm.h\n+++ b/arch/riscv/include/uapi/asm/kvm.h\n@@ -228,6 +228,7 @@ enum KVM_RISCV_SBI_EXT_ID {\n \tKVM_RISCV_SBI_EXT_SUSP,\n \tKVM_RISCV_SBI_EXT_FWFT,\n \tKVM_RISCV_SBI_EXT_MPXY,\n+\tKVM_RISCV_SBI_EXT_PVLOCK,\n \tKVM_RISCV_SBI_EXT_MAX,\n };\n \ndiff --git a/arch/riscv/kernel/Makefile b/arch/riscv/kernel/Makefile\nindex ebe1c3588177b..b9b0763dba321 100644\n--- a/arch/riscv/kernel/Makefile\n+++ b/arch/riscv/kernel/Makefile\n@@ -130,3 +130,5 @@ obj-$(CONFIG_GENERIC_CPU_VULNERABILITIES) += bugs.o\n obj-$(CONFIG_RISCV_USER_CFI) += usercfi.o\n \n obj-$(CONFIG_RISCV_ISA_SSQOSID) += qos.o\n+\n+obj-$(CONFIG_PARAVIRT_SPINLOCKS) += qspinlock_paravirt.o\ndiff --git a/arch/riscv/kernel/qspinlock_paravirt.c b/arch/riscv/kernel/qspinlock_paravirt.c\nnew file mode 100644\nindex 0000000000000..28c6c78d7e84c\n--- /dev/null\n+++ b/arch/riscv/kernel/qspinlock_paravirt.c\n@@ -0,0 +1,82 @@\n+// SPDX-License-Identifier: GPL-2.0-only\n+/*\n+ * Copyright (C) 2026 GUO Ren (XuanTie) \u003cguoren@kernel.org\u003e\n+ */\n+\n+#include \u003clinux/static_call.h\u003e\n+#include \u003casm/qspinlock_paravirt.h\u003e\n+#include \u003casm/sbi.h\u003e\n+\n+#define CREATE_TRACE_POINTS\n+#include \"trace_events_filter_paravirt.h\"\n+\n+void pv_kick(int cpu)\n+{\n+\ttrace_pv_kick(smp_processor_id(), cpu);\n+\n+\tsbi_ecall(SBI_EXT_PVLOCK, SBI_EXT_PVLOCK_KICK_CPU,\n+\t\t  cpuid_to_hartid_map(cpu), 0, 0, 0, 0, 0);\n+}\n+\n+void pv_wait(u8 *ptr, u8 val)\n+{\n+\tunsigned long flags;\n+\n+\tif (in_nmi())\n+\t\treturn;\n+\n+\tlocal_irq_save(flags);\n+\tif (READ_ONCE(*ptr) != val)\n+\t\tgoto out;\n+\n+\twait_for_interrupt();\n+\n+\ttrace_pv_wait(smp_processor_id());\n+out:\n+\tlocal_irq_restore(flags);\n+}\n+\n+static void native_queued_spin_unlock(struct qspinlock *lock)\n+{\n+\t/*\n+\t * unlock() needs release semantics:\n+\t */\n+\tsmp_store_release(\u0026lock-\u003elocked, 0);\n+}\n+\n+DEFINE_STATIC_CALL(pv_queued_spin_lock_slowpath, native_queued_spin_lock_slowpath);\n+EXPORT_STATIC_CALL(pv_queued_spin_lock_slowpath);\n+\n+DEFINE_STATIC_CALL(pv_queued_spin_unlock, native_queued_spin_unlock);\n+EXPORT_STATIC_CALL(pv_queued_spin_unlock);\n+\n+DEFINE_STATIC_KEY_FALSE(virt_spin_lock_key);\n+\n+bool __init pv_qspinlock_init(void)\n+{\n+\tif (num_possible_cpus() == 1)\n+\t\treturn false;\n+\n+\tif (!sbi_probe_extension(SBI_EXT_PVLOCK))\n+\t\treturn false;\n+\n+\tif (nopvspin) {\n+\t\tstatic_branch_enable(\u0026virt_spin_lock_key);\n+\t\tpr_info(\"virt_spin_lock enabled by nopvspin\\n\");\n+\t\treturn true;\n+\t}\n+\n+\tpr_info(\"PV qspinlocks enabled\\n\");\n+\t__pv_init_lock_hash();\n+\n+\tstatic_call_update(pv_queued_spin_lock_slowpath, __pv_queued_spin_lock_slowpath);\n+\tstatic_call_update(pv_queued_spin_unlock, __pv_queued_spin_unlock);\n+\n+\treturn true;\n+}\n+\n+bool pv_is_native_spin_unlock(void)\n+{\n+\treturn static_call_query(pv_queued_spin_unlock) ==\n+\t       native_queued_spin_unlock;\n+}\ndiff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c\nindex a32344bb220df..ccfa92b7c81ae 100644\n--- a/arch/riscv/kernel/setup.c\n+++ b/arch/riscv/kernel/setup.c\n@@ -281,6 +281,11 @@ static void __init riscv_spinlock_init(void)\n \t\treturn;\n \t}\n \n+#ifdef CONFIG_PARAVIRT_SPINLOCKS\n+\tif (pv_qspinlock_init())\n+\t\treturn;\n+#endif\n+\n \tif (IS_ENABLED(CONFIG_RISCV_ISA_ZABHA) \u0026\u0026\n \t    IS_ENABLED(CONFIG_RISCV_ISA_ZACAS) \u0026\u0026\n \t    IS_ENABLED(CONFIG_TOOLCHAIN_HAS_ZACAS) \u0026\u0026\ndiff --git a/arch/riscv/kernel/trace_events_filter_paravirt.h b/arch/riscv/kernel/trace_events_filter_paravirt.h\nnew file mode 100644\nindex 0000000000000..8d57efda2c177\n--- /dev/null\n+++ b/arch/riscv/kernel/trace_events_filter_paravirt.h\n@@ -0,0 +1,58 @@\n+/* SPDX-License-Identifier: GPL-2.0-only */\n+/*\n+ * Copyright (C) 2026 GUO Ren (XuanTie) \u003cguoren@kernel.org\u003e\n+ */\n+#undef TRACE_SYSTEM\n+#define TRACE_SYSTEM paravirt\n+\n+#if !defined(_TRACE_PARAVIRT_H) || defined(TRACE_HEADER_MULTI_READ)\n+#define _TRACE_PARAVIRT_H\n+\n+#include \u003clinux/tracepoint.h\u003e\n+\n+TRACE_EVENT(pv_kick,\n+\tTP_PROTO(int cpu, int target),\n+\tTP_ARGS(cpu, target),\n+\n+\tTP_STRUCT__entry(\n+\t\t__field(int, cpu)\n+\t\t__field(int, target)\n+\t),\n+\n+\tTP_fast_assign(\n+\t\t__entry-\u003ecpu = cpu;\n+\t\t__entry-\u003etarget = target;\n+\t),\n+\n+\tTP_printk(\"cpu %d pv_kick target cpu %d\",\n+\t\t__entry-\u003ecpu,\n+\t\t__entry-\u003etarget\n+\t)\n+);\n+\n+TRACE_EVENT(pv_wait,\n+\tTP_PROTO(int cpu),\n+\tTP_ARGS(cpu),\n+\n+\tTP_STRUCT__entry(\n+\t\t__field(int, cpu)\n+\t),\n+\n+\tTP_fast_assign(\n+\t\t__entry-\u003ecpu = cpu;\n+\t),\n+\n+\tTP_printk(\"cpu %d out of wfi\",\n+\t\t__entry-\u003ecpu\n+\t)\n+);\n+\n+#endif /* _TRACE_PARAVIRT_H || TRACE_HEADER_MULTI_READ */\n+\n+#undef TRACE_INCLUDE_PATH\n+#undef TRACE_INCLUDE_FILE\n+#define TRACE_INCLUDE_PATH ../../../arch/riscv/kernel/\n+#define TRACE_INCLUDE_FILE trace_events_filter_paravirt\n+\n+/* This part must be outside protection */\n+#include \u003ctrace/define_trace.h\u003e\ndiff --git a/arch/riscv/kvm/Makefile b/arch/riscv/kvm/Makefile\nindex 296c2ba05089a..404a4c5f89846 100644\n--- a/arch/riscv/kvm/Makefile\n+++ b/arch/riscv/kvm/Makefile\n@@ -38,6 +38,7 @@ kvm-y += vcpu_sbi_sta.o\n kvm-y += vcpu_sbi_system.o\n kvm-$(CONFIG_RISCV_SBI_V01) += vcpu_sbi_v01.o\n kvm-y += vcpu_switch.o\n+kvm-y += vcpu_sbi_pvlock.o\n kvm-y += vcpu_timer.o\n kvm-y += vcpu_vector.o\n kvm-y += vm.o\ndiff --git a/arch/riscv/kvm/vcpu_sbi.c b/arch/riscv/kvm/vcpu_sbi.c\nindex 1c4f874368fbe..07f72e619fd52 100644\n--- a/arch/riscv/kvm/vcpu_sbi.c\n+++ b/arch/riscv/kvm/vcpu_sbi.c\n@@ -94,6 +94,10 @@ static const struct kvm_riscv_sbi_extension_entry sbi_ext[] = {\n \t\t.ext_idx = KVM_RISCV_SBI_EXT_VENDOR,\n \t\t.ext_ptr = \u0026vcpu_sbi_ext_vendor,\n \t},\n+\t{\n+\t\t.ext_idx = KVM_RISCV_SBI_EXT_PVLOCK,\n+\t\t.ext_ptr = \u0026vcpu_sbi_ext_pvlock,\n+\t},\n };\n \n static const struct kvm_riscv_sbi_extension_entry *\ndiff --git a/arch/riscv/kvm/vcpu_sbi_pvlock.c b/arch/riscv/kvm/vcpu_sbi_pvlock.c\nnew file mode 100644\nindex 0000000000000..728e59f3f18fb\n--- /dev/null\n+++ b/arch/riscv/kvm/vcpu_sbi_pvlock.c\n@@ -0,0 +1,54 @@\n+// SPDX-License-Identifier: GPL-2.0-only\n+/*\n+ * Copyright (C) 2026 GUO Ren (XuanTie) \u003cguoren@kernel.org\u003e\n+ */\n+\n+#include \u003clinux/errno.h\u003e\n+#include \u003clinux/err.h\u003e\n+#include \u003clinux/kvm_host.h\u003e\n+#include \u003casm/sbi.h\u003e\n+#include \u003casm/kvm_vcpu_sbi.h\u003e\n+\n+static int kvm_sbi_ext_pvlock_kick_cpu(struct kvm_vcpu *vcpu)\n+{\n+\tstruct kvm_cpu_context *cp = \u0026vcpu-\u003earch.guest_context;\n+\tstruct kvm *kvm = vcpu-\u003ekvm;\n+\tstruct kvm_vcpu *target;\n+\n+\ttarget = kvm_get_vcpu_by_id(kvm, cp-\u003ea0);\n+\tif (!target)\n+\t\treturn SBI_ERR_INVALID_PARAM;\n+\n+\tkvm_vcpu_kick(target);\n+\n+\tif (READ_ONCE(target-\u003eready))\n+\t\tkvm_vcpu_yield_to(target);\n+\n+\treturn SBI_SUCCESS;\n+}\n+\n+static int kvm_sbi_ext_pvlock_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,\n+\t\t\t\t      struct kvm_vcpu_sbi_return *retdata)\n+{\n+\tint ret = 0;\n+\tstruct kvm_cpu_context *cp = \u0026vcpu-\u003earch.guest_context;\n+\tunsigned long funcid = cp-\u003ea6;\n+\n+\tswitch (funcid) {\n+\tcase SBI_EXT_PVLOCK_KICK_CPU:\n+\t\tret = kvm_sbi_ext_pvlock_kick_cpu(vcpu);\n+\t\tbreak;\n+\tdefault:\n+\t\tret = SBI_ERR_NOT_SUPPORTED;\n+\t}\n+\n+\tretdata-\u003eerr_val = ret;\n+\n+\treturn 0;\n+}\n+\n+const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_pvlock = {\n+\t.extid_start = SBI_EXT_PVLOCK,\n+\t.extid_end = SBI_EXT_PVLOCK,\n+\t.handler = kvm_sbi_ext_pvlock_handler,\n+};\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "All changes in this patch series are restricted to Documentation and the arch/riscv/ tree (implementing paravirtualized spinlocks and KVM SBI pvlock support for RISC-V). Since the target architecture is amd64, these code paths are exclusive to RISC-V and are structurally unreachable and not compiled on amd64.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 7012de575da931c91ca7a4630dd5d361b50dd3e3
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Sep 23 10:36:12 2026 +0000

    syz-cluster: applied patch under review

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 33cd30996e47e..d32bb7db9f919 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -4632,7 +4632,7 @@ Kernel parameters
 			as generic guest with no PV drivers. Currently support
 			XEN HVM, KVM, HYPER_V and VMWARE guest.
 
-	nopvspin	[X86,XEN,KVM,EARLY]
+	nopvspin	[X86,RISCV,XEN,KVM,EARLY]
 			Disables the qspinlock slow path using PV optimizations
 			which allow the hypervisor to 'idle' the guest on lock
 			contention.
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index d6c2dbf8455ce..9af53ef5ee956 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -1165,6 +1165,18 @@ config PARAVIRT_TIME_ACCOUNTING
 
 	  If in doubt, say N here.
 
+config PARAVIRT_SPINLOCKS
+	bool "Paravirtualization layer for spinlocks"
+	depends on QUEUED_SPINLOCKS
+	default y
+	help
+	  Paravirtualized spinlocks allow a unfair qspinlock to replace the
+	  test-set kvm-guest virt spinlock implementation with something
+	  virtualization-friendly, for example, halt the virtual CPU rather
+	  than spinning.
+
+	  If you are unsure how to answer this question, answer Y.
+
 config RELOCATABLE
 	bool "Build a relocatable kernel"
 	select MODULE_SECTIONS if MODULES
diff --git a/arch/riscv/include/asm/Kbuild b/arch/riscv/include/asm/Kbuild
index 7721b63642f41..3d8800d4fe48d 100644
--- a/arch/riscv/include/asm/Kbuild
+++ b/arch/riscv/include/asm/Kbuild
@@ -13,7 +13,6 @@ generic-y += spinlock_types.h
 generic-y += ticket_spinlock.h
 generic-y += qrwlock.h
 generic-y += qrwlock_types.h
-generic-y += qspinlock.h
 generic-y += ring_buffer.h
 generic-y += user.h
 generic-y += vmlinux.lds.h
diff --git a/arch/riscv/include/asm/kvm_vcpu_sbi.h b/arch/riscv/include/asm/kvm_vcpu_sbi.h
index f01a2860c7511..cdc16e64ad199 100644
--- a/arch/riscv/include/asm/kvm_vcpu_sbi.h
+++ b/arch/riscv/include/asm/kvm_vcpu_sbi.h
@@ -114,6 +114,7 @@ extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_fwft;
 extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_mpxy;
 extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_experimental;
 extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_vendor;
+extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_pvlock;
 
 #ifdef CONFIG_RISCV_PMU_SBI
 extern const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_pmu;
diff --git a/arch/riscv/include/asm/qspinlock.h b/arch/riscv/include/asm/qspinlock.h
new file mode 100644
index 0000000000000..9c7108baa40a1
--- /dev/null
+++ b/arch/riscv/include/asm/qspinlock.h
@@ -0,0 +1,57 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2026 GUO Ren (XuanTie) <guoren@kernel.org>
+ */
+
+#ifndef _ASM_RISCV_QSPINLOCK_H
+#define _ASM_RISCV_QSPINLOCK_H
+
+#ifdef CONFIG_PARAVIRT_SPINLOCKS
+#include <asm/qspinlock_paravirt.h>
+
+/* How long a lock should spin before we consider blocking */
+#define SPIN_THRESHOLD		(1 << 15)
+
+extern bool nopvspin;
+
+void native_queued_spin_lock_slowpath(struct qspinlock *lock, u32 val);
+void __pv_init_lock_hash(void);
+void __pv_queued_spin_lock_slowpath(struct qspinlock *lock, u32 val);
+
+static inline void queued_spin_lock_slowpath(struct qspinlock *lock, u32 val)
+{
+	static_call(pv_queued_spin_lock_slowpath)(lock, val);
+}
+
+#define queued_spin_unlock	queued_spin_unlock
+static inline void queued_spin_unlock(struct qspinlock *lock)
+{
+	static_call(pv_queued_spin_unlock)(lock);
+}
+#endif /* CONFIG_PARAVIRT_SPINLOCKS */
+
+#include <asm-generic/qspinlock.h>
+#include <asm/jump_label.h>
+
+/*
+ * KVM guests fall back to a Test-and-Set spinlock because fair locks suffer
+ * from severe lock-holder-preemption issues. When virt_spin_lock_key is
+ * enabled, virt_spin_lock() shortcuts queued_spin_lock_slowpath() and hijacks
+ * the lock acquisition.
+ */
+DECLARE_STATIC_KEY_FALSE(virt_spin_lock_key);
+
+#define virt_spin_lock rv_virt_spin_lock
+static inline bool rv_virt_spin_lock(struct qspinlock *lock)
+{
+	if (!static_branch_likely(&virt_spin_lock_key))
+		return false;
+
+	do {
+		smp_cond_load_relaxed((s32 *)&lock->val, VAL == 0);
+	} while (atomic_cmpxchg(&lock->val, 0, _Q_LOCKED_VAL) != 0);
+
+	return true;
+}
+
+#endif /* _ASM_RISCV_QSPINLOCK_H */
diff --git a/arch/riscv/include/asm/qspinlock_paravirt.h b/arch/riscv/include/asm/qspinlock_paravirt.h
new file mode 100644
index 0000000000000..7261cd9b13b2e
--- /dev/null
+++ b/arch/riscv/include/asm/qspinlock_paravirt.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2026 GUO Ren (XuanTie) <guoren@kernel.org>
+ */
+
+#ifndef _ASM_RISCV_QSPINLOCK_PARAVIRT_H
+#define _ASM_RISCV_QSPINLOCK_PARAVIRT_H
+
+void pv_wait(u8 *ptr, u8 val);
+void pv_kick(int cpu);
+
+void dummy_queued_spin_lock_slowpath(struct qspinlock *lock, u32 val);
+void dummy_queued_spin_unlock(struct qspinlock *lock);
+
+DECLARE_STATIC_CALL(pv_queued_spin_lock_slowpath, dummy_queued_spin_lock_slowpath);
+DECLARE_STATIC_CALL(pv_queued_spin_unlock, dummy_queued_spin_unlock);
+
+bool __init pv_qspinlock_init(void);
+
+void __pv_queued_spin_unlock_slowpath(struct qspinlock *lock, u8 locked);
+
+bool pv_is_native_spin_unlock(void);
+
+void __pv_queued_spin_unlock(struct qspinlock *lock);
+
+#endif /* _ASM_RISCV_QSPINLOCK_PARAVIRT_H */
diff --git a/arch/riscv/include/asm/sbi.h b/arch/riscv/include/asm/sbi.h
index 5725e0ca4dda3..724ab834ad859 100644
--- a/arch/riscv/include/asm/sbi.h
+++ b/arch/riscv/include/asm/sbi.h
@@ -38,6 +38,7 @@ enum sbi_ext_id {
 	SBI_EXT_FWFT = 0x46574654,
 	SBI_EXT_MPXY = 0x4D505859,
 	SBI_EXT_DBTR = 0x44425452,
+	SBI_EXT_PVLOCK = 0x50564C4B,
 
 	/* Experimentals extensions must lie within this range */
 	SBI_EXT_EXPERIMENTAL_START = 0x08000000,
@@ -534,6 +535,10 @@ union sbi_dbtr_shmem_entry {
 	struct sbi_dbtr_id_msg id;
 };
 
+enum sbi_ext_pvlock_fid {
+	SBI_EXT_PVLOCK_KICK_CPU = 0,
+};
+
 /* SBI spec version fields */
 #define SBI_SPEC_VERSION_DEFAULT	0x1
 #define SBI_SPEC_VERSION_MAJOR_SHIFT	24
diff --git a/arch/riscv/include/uapi/asm/kvm.h b/arch/riscv/include/uapi/asm/kvm.h
index 20d9959ca44fc..110a0d62113f8 100644
--- a/arch/riscv/include/uapi/asm/kvm.h
+++ b/arch/riscv/include/uapi/asm/kvm.h
@@ -228,6 +228,7 @@ enum KVM_RISCV_SBI_EXT_ID {
 	KVM_RISCV_SBI_EXT_SUSP,
 	KVM_RISCV_SBI_EXT_FWFT,
 	KVM_RISCV_SBI_EXT_MPXY,
+	KVM_RISCV_SBI_EXT_PVLOCK,
 	KVM_RISCV_SBI_EXT_MAX,
 };
 
diff --git a/arch/riscv/kernel/Makefile b/arch/riscv/kernel/Makefile
index ebe1c3588177b..b9b0763dba321 100644
--- a/arch/riscv/kernel/Makefile
+++ b/arch/riscv/kernel/Makefile
@@ -130,3 +130,5 @@ obj-$(CONFIG_GENERIC_CPU_VULNERABILITIES) += bugs.o
 obj-$(CONFIG_RISCV_USER_CFI) += usercfi.o
 
 obj-$(CONFIG_RISCV_ISA_SSQOSID) += qos.o
+
+obj-$(CONFIG_PARAVIRT_SPINLOCKS) += qspinlock_paravirt.o
diff --git a/arch/riscv/kernel/qspinlock_paravirt.c b/arch/riscv/kernel/qspinlock_paravirt.c
new file mode 100644
index 0000000000000..28c6c78d7e84c
--- /dev/null
+++ b/arch/riscv/kernel/qspinlock_paravirt.c
@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2026 GUO Ren (XuanTie) <guoren@kernel.org>
+ */
+
+#include <linux/static_call.h>
+#include <asm/qspinlock_paravirt.h>
+#include <asm/sbi.h>
+
+#define CREATE_TRACE_POINTS
+#include "trace_events_filter_paravirt.h"
+
+void pv_kick(int cpu)
+{
+	trace_pv_kick(smp_processor_id(), cpu);
+
+	sbi_ecall(SBI_EXT_PVLOCK, SBI_EXT_PVLOCK_KICK_CPU,
+		  cpuid_to_hartid_map(cpu), 0, 0, 0, 0, 0);
+}
+
+void pv_wait(u8 *ptr, u8 val)
+{
+	unsigned long flags;
+
+	if (in_nmi())
+		return;
+
+	local_irq_save(flags);
+	if (READ_ONCE(*ptr) != val)
+		goto out;
+
+	wait_for_interrupt();
+
+	trace_pv_wait(smp_processor_id());
+out:
+	local_irq_restore(flags);
+}
+
+static void native_queued_spin_unlock(struct qspinlock *lock)
+{
+	/*
+	 * unlock() needs release semantics:
+	 */
+	smp_store_release(&lock->locked, 0);
+}
+
+DEFINE_STATIC_CALL(pv_queued_spin_lock_slowpath, native_queued_spin_lock_slowpath);
+EXPORT_STATIC_CALL(pv_queued_spin_lock_slowpath);
+
+DEFINE_STATIC_CALL(pv_queued_spin_unlock, native_queued_spin_unlock);
+EXPORT_STATIC_CALL(pv_queued_spin_unlock);
+
+DEFINE_STATIC_KEY_FALSE(virt_spin_lock_key);
+
+bool __init pv_qspinlock_init(void)
+{
+	if (num_possible_cpus() == 1)
+		return false;
+
+	if (!sbi_probe_extension(SBI_EXT_PVLOCK))
+		return false;
+
+	if (nopvspin) {
+		static_branch_enable(&virt_spin_lock_key);
+		pr_info("virt_spin_lock enabled by nopvspin\n");
+		return true;
+	}
+
+	pr_info("PV qspinlocks enabled\n");
+	__pv_init_lock_hash();
+
+	static_call_update(pv_queued_spin_lock_slowpath, __pv_queued_spin_lock_slowpath);
+	static_call_update(pv_queued_spin_unlock, __pv_queued_spin_unlock);
+
+	return true;
+}
+
+bool pv_is_native_spin_unlock(void)
+{
+	return static_call_query(pv_queued_spin_unlock) ==
+	       native_queued_spin_unlock;
+}
diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
index a32344bb220df..ccfa92b7c81ae 100644
--- a/arch/riscv/kernel/setup.c
+++ b/arch/riscv/kernel/setup.c
@@ -281,6 +281,11 @@ static void __init riscv_spinlock_init(void)
 		return;
 	}
 
+#ifdef CONFIG_PARAVIRT_SPINLOCKS
+	if (pv_qspinlock_init())
+		return;
+#endif
+
 	if (IS_ENABLED(CONFIG_RISCV_ISA_ZABHA) &&
 	    IS_ENABLED(CONFIG_RISCV_ISA_ZACAS) &&
 	    IS_ENABLED(CONFIG_TOOLCHAIN_HAS_ZACAS) &&
diff --git a/arch/riscv/kernel/trace_events_filter_paravirt.h b/arch/riscv/kernel/trace_events_filter_paravirt.h
new file mode 100644
index 0000000000000..8d57efda2c177
--- /dev/null
+++ b/arch/riscv/kernel/trace_events_filter_paravirt.h
@@ -0,0 +1,58 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2026 GUO Ren (XuanTie) <guoren@kernel.org>
+ */
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM paravirt
+
+#if !defined(_TRACE_PARAVIRT_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_PARAVIRT_H
+
+#include <linux/tracepoint.h>
+
+TRACE_EVENT(pv_kick,
+	TP_PROTO(int cpu, int target),
+	TP_ARGS(cpu, target),
+
+	TP_STRUCT__entry(
+		__field(int, cpu)
+		__field(int, target)
+	),
+
+	TP_fast_assign(
+		__entry->cpu = cpu;
+		__entry->target = target;
+	),
+
+	TP_printk("cpu %d pv_kick target cpu %d",
+		__entry->cpu,
+		__entry->target
+	)
+);
+
+TRACE_EVENT(pv_wait,
+	TP_PROTO(int cpu),
+	TP_ARGS(cpu),
+
+	TP_STRUCT__entry(
+		__field(int, cpu)
+	),
+
+	TP_fast_assign(
+		__entry->cpu = cpu;
+	),
+
+	TP_printk("cpu %d out of wfi",
+		__entry->cpu
+	)
+);
+
+#endif /* _TRACE_PARAVIRT_H || TRACE_HEADER_MULTI_READ */
+
+#undef TRACE_INCLUDE_PATH
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_PATH ../../../arch/riscv/kernel/
+#define TRACE_INCLUDE_FILE trace_events_filter_paravirt
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
diff --git a/arch/riscv/kvm/Makefile b/arch/riscv/kvm/Makefile
index 296c2ba05089a..404a4c5f89846 100644
--- a/arch/riscv/kvm/Makefile
+++ b/arch/riscv/kvm/Makefile
@@ -38,6 +38,7 @@ kvm-y += vcpu_sbi_sta.o
 kvm-y += vcpu_sbi_system.o
 kvm-$(CONFIG_RISCV_SBI_V01) += vcpu_sbi_v01.o
 kvm-y += vcpu_switch.o
+kvm-y += vcpu_sbi_pvlock.o
 kvm-y += vcpu_timer.o
 kvm-y += vcpu_vector.o
 kvm-y += vm.o
diff --git a/arch/riscv/kvm/vcpu_sbi.c b/arch/riscv/kvm/vcpu_sbi.c
index 1c4f874368fbe..07f72e619fd52 100644
--- a/arch/riscv/kvm/vcpu_sbi.c
+++ b/arch/riscv/kvm/vcpu_sbi.c
@@ -94,6 +94,10 @@ static const struct kvm_riscv_sbi_extension_entry sbi_ext[] = {
 		.ext_idx = KVM_RISCV_SBI_EXT_VENDOR,
 		.ext_ptr = &vcpu_sbi_ext_vendor,
 	},
+	{
+		.ext_idx = KVM_RISCV_SBI_EXT_PVLOCK,
+		.ext_ptr = &vcpu_sbi_ext_pvlock,
+	},
 };
 
 static const struct kvm_riscv_sbi_extension_entry *
diff --git a/arch/riscv/kvm/vcpu_sbi_pvlock.c b/arch/riscv/kvm/vcpu_sbi_pvlock.c
new file mode 100644
index 0000000000000..728e59f3f18fb
--- /dev/null
+++ b/arch/riscv/kvm/vcpu_sbi_pvlock.c
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2026 GUO Ren (XuanTie) <guoren@kernel.org>
+ */
+
+#include <linux/errno.h>
+#include <linux/err.h>
+#include <linux/kvm_host.h>
+#include <asm/sbi.h>
+#include <asm/kvm_vcpu_sbi.h>
+
+static int kvm_sbi_ext_pvlock_kick_cpu(struct kvm_vcpu *vcpu)
+{
+	struct kvm_cpu_context *cp = &vcpu->arch.guest_context;
+	struct kvm *kvm = vcpu->kvm;
+	struct kvm_vcpu *target;
+
+	target = kvm_get_vcpu_by_id(kvm, cp->a0);
+	if (!target)
+		return SBI_ERR_INVALID_PARAM;
+
+	kvm_vcpu_kick(target);
+
+	if (READ_ONCE(target->ready))
+		kvm_vcpu_yield_to(target);
+
+	return SBI_SUCCESS;
+}
+
+static int kvm_sbi_ext_pvlock_handler(struct kvm_vcpu *vcpu, struct kvm_run *run,
+				      struct kvm_vcpu_sbi_return *retdata)
+{
+	int ret = 0;
+	struct kvm_cpu_context *cp = &vcpu->arch.guest_context;
+	unsigned long funcid = cp->a6;
+
+	switch (funcid) {
+	case SBI_EXT_PVLOCK_KICK_CPU:
+		ret = kvm_sbi_ext_pvlock_kick_cpu(vcpu);
+		break;
+	default:
+		ret = SBI_ERR_NOT_SUPPORTED;
+	}
+
+	retdata->err_val = ret;
+
+	return 0;
+}
+
+const struct kvm_vcpu_sbi_extension vcpu_sbi_ext_pvlock = {
+	.extid_start = SBI_EXT_PVLOCK,
+	.extid_end = SBI_EXT_PVLOCK,
+	.handler = kvm_sbi_ext_pvlock_handler,
+};

gemini-3.8-flash

null

null

							input: 8529
							output: 102
							thoughts: 1476
						

**Analysis of the Patch: WorthFuzzing Evaluation**

Okay, let's break this down. First, I need to understand the scope of this patch. The target architecture is amd64, so anything not relevant to that is immediately suspect. Now, let's see what's changed: `Documentation/admin-guide/kernel-parameters.txt` and a bunch of files within `arch/riscv/`. That's the key. Every single modified file is either documentation or RISC-V specific code. I'm looking at RISC-V, RISC-V, RISC-V... and a bit of documentation.

No generic kernel code, no core infrastructure, nothing that *could* hypothetically touch x86_64. I'm triple-checking the paths: `Documentation`, `arch/riscv/Kconfig`, `arch/riscv/include/...`, `arch/riscv/kernel/...`, `arch/riscv/kvm/...`. Nope, it's all clearly architecture-specific.

Now, let's pull up the instructions: specifically, Section 2, the "WHEN TO RETURN WorthFuzzing=false" criteria. I'm looking for *negative* criteria. We have: documentation changes, or code paths exclusive to architectures other than the target. Hmm, all the modified code here falls squarely into the *second* category: it's all RISC-V. The `arch/riscv/include/uapi/asm/kvm.h` file might have caught my attention for a moment, but that's the *uapi* one for RISC-V, not a generic KVM include. Absolutely nothing here would ever be compiled or executed on an amd64 system.

To be extra certain, I need to confirm: The diff confirms it is all in `Documentation/` or `arch/riscv/`. Not a single generic file is touched.

This is a clear-cut case. Both of the "negative" criteria apply.

Therefore:
- WorthFuzzing: false
- FocusSymbols: []
- EnableConfigs: []
- Reasoning: All modified code is either documentation or exclusive to the RISC-V architecture, and therefore not compiled or executed on the amd64 target architecture.

Time to call `set-results`.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "All changes in this patch series are restricted to Documentation and the arch/riscv/ tree (implementing paravirtualized spinlocks and KVM SBI pvlock support for RISC-V). Since the target architecture is amd64, these code paths are exclusive to RISC-V and are structurally unreachable and not compiled on amd64.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "All changes in this patch series are restricted to Documentation and the arch/riscv/ tree (implementing paravirtualized spinlocks and KVM SBI pvlock support for RISC-V). Since the target architecture is amd64, these code paths are exclusive to RISC-V and are structurally unreachable and not compiled on amd64.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null