AI Trajectory

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies documentation and ARM64-specific KVM/pKVM code (under arch/arm64/) to support SVE in protected VMs. Since the target architecture is amd64, all modified code paths are exclusive to arm64 and structurally unreachable.",
  "WorthFuzzing": false
}

null

{
  "PatchDiff": "commit 6dab8f2126f66a20db2816e3de0360761715307a\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Sun Nov 8 08:16:26 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/Documentation/virt/kvm/arm/pkvm.rst b/Documentation/virt/kvm/arm/pkvm.rst\nindex b75bb8ad6f26dc..163aa01ac50672 100644\n--- a/Documentation/virt/kvm/arm/pkvm.rst\n+++ b/Documentation/virt/kvm/arm/pkvm.rst\n@@ -134,9 +134,9 @@ A protected VM boots from a single primary vCPU. Before the first\n * Set the primary vCPU's boot state with ``KVM_SET_ONE_REG``: the kernel\n   entry address in ``PC`` and the DTB pointer in ``x0``.\n \n-``PC`` and ``x0`` are the only registers EL2 takes from the host. Other\n-pre-run writes are accepted, but the guest starts from the state the\n-hypervisor resets it to.\n+``PC``, ``x0`` and the SVE vector lengths (``KVM_REG_ARM64_SVE_VLS``) are\n+the only registers EL2 takes from the host. Other pre-run writes are\n+accepted, but the guest starts from the state the hypervisor resets it to.\n \n Secondary vCPUs are started by the guest itself through PSCI ``CPU_ON``\n (see `Power state`_), which supplies their entry point and context ID.\ndiff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h\nindex b0e42be3d9eef9..b9455ff8d7bdb1 100644\n--- a/arch/arm64/include/asm/kvm_hyp.h\n+++ b/arch/arm64/include/asm/kvm_hyp.h\n@@ -144,6 +144,7 @@ void __noreturn __host_enter(struct kvm_cpu_context *host_ctxt);\n extern u64 kvm_nvhe_sym(id_aa64pfr0_el1_sys_val);\n extern u64 kvm_nvhe_sym(id_aa64pfr1_el1_sys_val);\n extern u64 kvm_nvhe_sym(id_aa64pfr2_el1_sys_val);\n+extern u64 kvm_nvhe_sym(id_aa64zfr0_el1_sys_val);\n extern u64 kvm_nvhe_sym(id_aa64isar0_el1_sys_val);\n extern u64 kvm_nvhe_sym(id_aa64isar1_el1_sys_val);\n extern u64 kvm_nvhe_sym(id_aa64isar2_el1_sys_val);\n@@ -157,6 +158,7 @@ extern unsigned int kvm_nvhe_sym(kvm_arm_vmid_bits);\n extern enum mitigation_state kvm_nvhe_sym(spectre_v2_state);\n extern enum mitigation_state kvm_nvhe_sym(spectre_v4_state);\n extern enum mitigation_state kvm_nvhe_sym(spectre_bhb_state);\n+extern unsigned int kvm_nvhe_sym(kvm_sve_max_vl);\n extern unsigned int kvm_nvhe_sym(kvm_host_sve_max_vl);\n extern unsigned long kvm_nvhe_sym(hyp_nr_cpus);\n extern unsigned int kvm_nvhe_sym(hyp_gicv3_nr_lr);\ndiff --git a/arch/arm64/include/asm/kvm_pkvm.h b/arch/arm64/include/asm/kvm_pkvm.h\nindex fd042d2b54624c..5f1b3308b42e13 100644\n--- a/arch/arm64/include/asm/kvm_pkvm.h\n+++ b/arch/arm64/include/asm/kvm_pkvm.h\n@@ -40,6 +40,7 @@ static inline bool kvm_pkvm_ext_allowed(struct kvm *kvm, long ext)\n \tcase KVM_CAP_MAX_VCPU_ID:\n \tcase KVM_CAP_MSI_DEVID:\n \tcase KVM_CAP_ARM_VM_IPA_SIZE:\n+\tcase KVM_CAP_ARM_SVE:\n \tcase KVM_CAP_ARM_PTRAUTH_ADDRESS:\n \tcase KVM_CAP_ARM_PTRAUTH_GENERIC:\n \tcase KVM_CAP_ONE_REG:\ndiff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c\nindex 157bf4b8120201..be5127ce388a86 100644\n--- a/arch/arm64/kvm/arm.c\n+++ b/arch/arm64/kvm/arm.c\n@@ -2827,6 +2827,7 @@ static void kvm_hyp_init_symbols(void)\n \tkvm_nvhe_sym(id_aa64pfr0_el1_sys_val) = get_hyp_id_aa64pfr0_el1();\n \tkvm_nvhe_sym(id_aa64pfr1_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64PFR1_EL1);\n \tkvm_nvhe_sym(id_aa64pfr2_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64PFR2_EL1);\n+\tkvm_nvhe_sym(id_aa64zfr0_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ZFR0_EL1);\n \tkvm_nvhe_sym(id_aa64isar0_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ISAR0_EL1);\n \tkvm_nvhe_sym(id_aa64isar1_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ISAR1_EL1);\n \tkvm_nvhe_sym(id_aa64isar2_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ISAR2_EL1);\ndiff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c\nindex 179d7c8277b883..ea762788e325ea 100644\n--- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c\n+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c\n@@ -482,7 +482,7 @@ static void __hyp_sve_save_guest(struct kvm_vcpu *vcpu)\n \t * on the VL, so use a consistent (i.e., the maximum) guest VL.\n \t */\n \tsve_cond_update_zcr_vq(vcpu_sve_max_vq(vcpu) - 1, SYS_ZCR_EL2);\n-\tsve_save_state(kern_hyp_va(vcpu-\u003earch.sve_state), true);\n+\tsve_save_state(vcpu-\u003earch.sve_state, true);\n \tfpsimd_save_common(\u0026vcpu-\u003earch.ctxt.fp_regs);\n \twrite_sysreg_s(sve_vq_from_vl(kvm_host_sve_max_vl) - 1, SYS_ZCR_EL2);\n }\n@@ -531,7 +531,7 @@ static void fpsimd_sve_sync(struct kvm_vcpu *vcpu)\n \telse\n \t\tfpsimd_save_state(\u0026vcpu-\u003earch.ctxt.fp_regs);\n \n-\thas_fpmr = kvm_has_fpmr(kern_hyp_va(vcpu-\u003ekvm));\n+\thas_fpmr = kvm_has_fpmr(vcpu-\u003ekvm);\n \tif (has_fpmr)\n \t\t__vcpu_assign_sys_reg(vcpu, FPMR, read_sysreg_s(SYS_FPMR));\n \ndiff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c\nindex fc0475f0877d19..6500acbd849694 100644\n--- a/arch/arm64/kvm/hyp/nvhe/pkvm.c\n+++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c\n@@ -30,6 +30,7 @@ unsigned long __icache_flags;\n /* Used by kvm_get_vttbr(). */\n unsigned int kvm_arm_vmid_bits;\n \n+unsigned int kvm_sve_max_vl;\n unsigned int kvm_host_sve_max_vl;\n \n /*\n@@ -476,7 +477,7 @@ static void unpin_host_vcpu(struct kvm_vcpu *host_vcpu)\n \t\thyp_unpin_shared_mem(host_vcpu, host_vcpu + 1);\n }\n \n-static void unpin_host_sve_state(struct pkvm_hyp_vcpu *hyp_vcpu)\n+static void teardown_sve_state(struct pkvm_hyp_vcpu *hyp_vcpu)\n {\n \tvoid *sve_state;\n \n@@ -484,8 +485,10 @@ static void unpin_host_sve_state(struct pkvm_hyp_vcpu *hyp_vcpu)\n \tif (!sve_state)\n \t\treturn;\n \n-\thyp_unpin_shared_mem(sve_state,\n-\t\t\t     sve_state + vcpu_sve_state_size(\u0026hyp_vcpu-\u003evcpu));\n+\tif (pkvm_hyp_vcpu_is_protected(hyp_vcpu))\n+\t\thyp_free(sve_state);\n+\telse\n+\t\thyp_unpin_shared_mem(sve_state, sve_state + vcpu_sve_state_size(\u0026hyp_vcpu-\u003evcpu));\n }\n \n static void unpin_host_vcpus(struct pkvm_hyp_vcpu *hyp_vcpus[],\n@@ -500,7 +503,7 @@ static void unpin_host_vcpus(struct pkvm_hyp_vcpu *hyp_vcpus[],\n \t\t\tcontinue;\n \n \t\tunpin_host_vcpu(hyp_vcpu-\u003ehost_vcpu);\n-\t\tunpin_host_sve_state(hyp_vcpu);\n+\t\tteardown_sve_state(hyp_vcpu);\n \t}\n }\n \n@@ -543,18 +546,25 @@ static int pkvm_vcpu_init_sve(struct pkvm_hyp_vcpu *hyp_vcpu, struct kvm_vcpu *h\n \t\treturn 0;\n \t}\n \n-\t/* Limit guest vector length to the maximum supported by the host. */\n-\tsve_max_vl = min(READ_ONCE(host_vcpu-\u003earch.sve_max_vl), kvm_host_sve_max_vl);\n-\tsve_state = kern_hyp_va(READ_ONCE(host_vcpu-\u003earch.sve_state));\n-\n-\tif (!sve_vl_valid(sve_max_vl) || !sve_state)\n+\tsve_max_vl = READ_ONCE(host_vcpu-\u003earch.sve_max_vl);\n+\tif (!sve_vl_valid(sve_max_vl) || sve_max_vl \u003e kvm_sve_max_vl)\n \t\treturn -EINVAL;\n \n \tsve_state_size = sve_state_size_from_vl(sve_max_vl);\n \n-\tret = hyp_pin_shared_mem(sve_state, sve_state + sve_state_size);\n-\tif (ret)\n-\t\treturn ret;\n+\tif (pkvm_hyp_vcpu_is_protected(hyp_vcpu)) {\n+\t\tsve_state = hyp_alloc(sve_state_size);\n+\t\tif (!sve_state)\n+\t\t\treturn hyp_alloc_errno();\n+\t} else {\n+\t\tsve_state = kern_hyp_va(READ_ONCE(host_vcpu-\u003earch.sve_state));\n+\t\tif (!sve_state)\n+\t\t\treturn -EINVAL;\n+\n+\t\tret = hyp_pin_shared_mem(sve_state, sve_state + sve_state_size);\n+\t\tif (ret)\n+\t\t\treturn ret;\n+\t}\n \n \tvcpu-\u003earch.sve_state = sve_state;\n \tvcpu-\u003earch.sve_max_vl = sve_max_vl;\n@@ -643,7 +653,7 @@ static int init_pkvm_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu,\n done:\n \tif (ret) {\n \t\tunpin_host_vcpu(host_vcpu);\n-\t\tunpin_host_sve_state(hyp_vcpu);\n+\t\tteardown_sve_state(hyp_vcpu);\n \t}\n \treturn ret;\n }\n@@ -1015,7 +1025,7 @@ int __pkvm_init_vcpu(pkvm_handle_t handle, struct kvm_vcpu *host_vcpu)\n \tret = register_hyp_vcpu(hyp_vm, hyp_vcpu);\n \tif (ret) {\n \t\tunpin_host_vcpu(host_vcpu);\n-\t\tunpin_host_sve_state(hyp_vcpu);\n+\t\tteardown_sve_state(hyp_vcpu);\n \t\tgoto unclaim;\n \t}\n \tgoto unlock;\n@@ -1243,6 +1253,9 @@ int pkvm_reset_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)\n \t\t\t    PSCI_0_2_AFFINITY_LEVEL_ON) != PSCI_0_2_AFFINITY_LEVEL_ON_PENDING)\n \t\treturn -ECANCELED;\n \n+\tif (vcpu_has_sve(\u0026hyp_vcpu-\u003evcpu))\n+\t\tmemset(hyp_vcpu-\u003evcpu.arch.sve_state, 0, vcpu_sve_state_size(\u0026hyp_vcpu-\u003evcpu));\n+\n \tkvm_reset_vcpu_core(\u0026hyp_vcpu-\u003evcpu);\n \tkvm_reset_pvm_sys_regs(\u0026hyp_vcpu-\u003evcpu);\n \ndiff --git a/arch/arm64/kvm/hyp/nvhe/switch.c b/arch/arm64/kvm/hyp/nvhe/switch.c\nindex 89fb9dd351ad5d..0626f4203ba6db 100644\n--- a/arch/arm64/kvm/hyp/nvhe/switch.c\n+++ b/arch/arm64/kvm/hyp/nvhe/switch.c\n@@ -230,6 +230,7 @@ static const exit_handler_fn pvm_exit_handlers[] = {\n \t[ESR_ELx_EC_WFx]\t\t= kvm_handle_pvm_wfx,\n \t[ESR_ELx_EC_HVC64]\t\t= kvm_handle_pvm_hvc64,\n \t[ESR_ELx_EC_SYS64]\t\t= kvm_handle_pvm_sys64,\n+\t[ESR_ELx_EC_SVE]\t\t= kvm_handle_pvm_fpsimd,\n \t[ESR_ELx_EC_FP_ASIMD]\t\t= kvm_handle_pvm_fpsimd,\n \t[ESR_ELx_EC_IABT_LOW]\t\t= kvm_hyp_handle_iabt_low,\n \t[ESR_ELx_EC_DABT_LOW]\t\t= kvm_hyp_handle_dabt_low,\ndiff --git a/arch/arm64/kvm/hyp/nvhe/sys_regs.c b/arch/arm64/kvm/hyp/nvhe/sys_regs.c\nindex 32e82653ebf7e7..0ddddf957f5ab5 100644\n--- a/arch/arm64/kvm/hyp/nvhe/sys_regs.c\n+++ b/arch/arm64/kvm/hyp/nvhe/sys_regs.c\n@@ -21,6 +21,7 @@\n u64 id_aa64pfr0_el1_sys_val;\n u64 id_aa64pfr1_el1_sys_val;\n u64 id_aa64pfr2_el1_sys_val;\n+u64 id_aa64zfr0_el1_sys_val;\n u64 id_aa64isar0_el1_sys_val;\n u64 id_aa64isar1_el1_sys_val;\n u64 id_aa64isar2_el1_sys_val;\n@@ -114,6 +115,22 @@ static const struct pvm_ftr_bits pvmid_aa64pfr2[] = {\n \tFEAT_END\n };\n \n+static const struct pvm_ftr_bits pvmid_aa64zfr0[] = {\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, SVEver, SVE2p3, vm_has_sve),\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, AES, AES2, vm_has_sve),\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, EltPerm, IMP, vm_has_sve),\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, BitPerm, IMP, vm_has_sve),\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, BF16, EBF16, vm_has_sve),\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, B16B16, B16MM, vm_has_sve),\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, SHA3, IMP, vm_has_sve),\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, SM4, IMP, vm_has_sve),\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, I8MM, IMP, vm_has_sve),\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, F16MM, IMP, vm_has_sve),\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, F32MM, IMP, vm_has_sve),\n+\tMAX_FEAT_FUNC(ID_AA64ZFR0_EL1, F64MM, IMP, vm_has_sve),\n+\tFEAT_END\n+};\n+\n static const struct pvm_ftr_bits pvmid_aa64mmfr0[] = {\n \tMAX_FEAT_ENUM(ID_AA64MMFR0_EL1, PARANGE, 40),\n \tMAX_FEAT_ENUM(ID_AA64MMFR0_EL1, ASIDBITS, 16),\n@@ -232,6 +249,8 @@ static u64 pvm_calc_id_reg(const struct kvm_vcpu *vcpu, u32 id)\n \t\treturn get_restricted_features(vcpu, id_aa64pfr1_el1_sys_val, pvmid_aa64pfr1);\n \tcase SYS_ID_AA64PFR2_EL1:\n \t\treturn get_restricted_features(vcpu, id_aa64pfr2_el1_sys_val, pvmid_aa64pfr2);\n+\tcase SYS_ID_AA64ZFR0_EL1:\n+\t\treturn get_restricted_features(vcpu, id_aa64zfr0_el1_sys_val, pvmid_aa64zfr0);\n \tcase SYS_ID_AA64ISAR0_EL1:\n \t\treturn id_aa64isar0_el1_sys_val;\n \tcase SYS_ID_AA64ISAR1_EL1:\n@@ -483,8 +502,6 @@ static const struct sys_reg_desc pvm_sys_reg_descs[] = {\n \tID_UNALLOCATED(7,6),\n \tID_UNALLOCATED(7,7),\n \n-\t/* Scalable Vector Registers are restricted. */\n-\n \tHOST_HANDLED(SYS_ICC_PMR_EL1),\n \n \tRAZ_WI(SYS_ERRIDR_EL1),\n@@ -570,6 +587,7 @@ static const struct sys_reg_desc_reset pvm_sys_reg_reset_vals[] = {\n \tRESET_UNKNOWN(MAIR_EL1),\n \tRESET_ZERO(AMAIR_EL1),\n \tRESET_ZERO(MDSCR_EL1),\n+\tRESET_ZERO(ZCR_EL1),\n \tRESET_ZERO(CNTV_CTL_EL0),\n \tRESET_UNKNOWN(TTBR0_EL1),\n \tRESET_UNKNOWN(TTBR1_EL1),\ndiff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c\nindex 10eb7249aa9e88..aaaa1b8634ba41 100644\n--- a/arch/arm64/kvm/reset.c\n+++ b/arch/arm64/kvm/reset.c\n@@ -52,6 +52,8 @@ int __init kvm_arm_init_sve(void)\n \t\tif (WARN_ON(kvm_sve_max_vl \u003e VL_ARCH_MAX))\n \t\t\tkvm_sve_max_vl = VL_ARCH_MAX;\n \n+\t\tkvm_nvhe_sym(kvm_sve_max_vl) = kvm_sve_max_vl;\n+\n \t\t/*\n \t\t * Don't even try to make use of vector lengths that\n \t\t * aren't available on all CPUs, for now:\n"
}

core

null

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies documentation and ARM64-specific KVM/pKVM code (under arch/arm64/) to support SVE in protected VMs. Since the target architecture is amd64, all modified code paths are exclusive to arm64 and structurally unreachable.",
  "WorthFuzzing": false
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 6dab8f2126f66a20db2816e3de0360761715307a
Author: syz-cluster <triage@syzkaller.com>
Date:   Sun Nov 8 08:16:26 2026 +0000

    syz-cluster: applied patch under review

diff --git a/Documentation/virt/kvm/arm/pkvm.rst b/Documentation/virt/kvm/arm/pkvm.rst
index b75bb8ad6f26dc..163aa01ac50672 100644
--- a/Documentation/virt/kvm/arm/pkvm.rst
+++ b/Documentation/virt/kvm/arm/pkvm.rst
@@ -134,9 +134,9 @@ A protected VM boots from a single primary vCPU. Before the first
 * Set the primary vCPU's boot state with ``KVM_SET_ONE_REG``: the kernel
   entry address in ``PC`` and the DTB pointer in ``x0``.
 
-``PC`` and ``x0`` are the only registers EL2 takes from the host. Other
-pre-run writes are accepted, but the guest starts from the state the
-hypervisor resets it to.
+``PC``, ``x0`` and the SVE vector lengths (``KVM_REG_ARM64_SVE_VLS``) are
+the only registers EL2 takes from the host. Other pre-run writes are
+accepted, but the guest starts from the state the hypervisor resets it to.
 
 Secondary vCPUs are started by the guest itself through PSCI ``CPU_ON``
 (see `Power state`_), which supplies their entry point and context ID.
diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h
index b0e42be3d9eef9..b9455ff8d7bdb1 100644
--- a/arch/arm64/include/asm/kvm_hyp.h
+++ b/arch/arm64/include/asm/kvm_hyp.h
@@ -144,6 +144,7 @@ void __noreturn __host_enter(struct kvm_cpu_context *host_ctxt);
 extern u64 kvm_nvhe_sym(id_aa64pfr0_el1_sys_val);
 extern u64 kvm_nvhe_sym(id_aa64pfr1_el1_sys_val);
 extern u64 kvm_nvhe_sym(id_aa64pfr2_el1_sys_val);
+extern u64 kvm_nvhe_sym(id_aa64zfr0_el1_sys_val);
 extern u64 kvm_nvhe_sym(id_aa64isar0_el1_sys_val);
 extern u64 kvm_nvhe_sym(id_aa64isar1_el1_sys_val);
 extern u64 kvm_nvhe_sym(id_aa64isar2_el1_sys_val);
@@ -157,6 +158,7 @@ extern unsigned int kvm_nvhe_sym(kvm_arm_vmid_bits);
 extern enum mitigation_state kvm_nvhe_sym(spectre_v2_state);
 extern enum mitigation_state kvm_nvhe_sym(spectre_v4_state);
 extern enum mitigation_state kvm_nvhe_sym(spectre_bhb_state);
+extern unsigned int kvm_nvhe_sym(kvm_sve_max_vl);
 extern unsigned int kvm_nvhe_sym(kvm_host_sve_max_vl);
 extern unsigned long kvm_nvhe_sym(hyp_nr_cpus);
 extern unsigned int kvm_nvhe_sym(hyp_gicv3_nr_lr);
diff --git a/arch/arm64/include/asm/kvm_pkvm.h b/arch/arm64/include/asm/kvm_pkvm.h
index fd042d2b54624c..5f1b3308b42e13 100644
--- a/arch/arm64/include/asm/kvm_pkvm.h
+++ b/arch/arm64/include/asm/kvm_pkvm.h
@@ -40,6 +40,7 @@ static inline bool kvm_pkvm_ext_allowed(struct kvm *kvm, long ext)
 	case KVM_CAP_MAX_VCPU_ID:
 	case KVM_CAP_MSI_DEVID:
 	case KVM_CAP_ARM_VM_IPA_SIZE:
+	case KVM_CAP_ARM_SVE:
 	case KVM_CAP_ARM_PTRAUTH_ADDRESS:
 	case KVM_CAP_ARM_PTRAUTH_GENERIC:
 	case KVM_CAP_ONE_REG:
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 157bf4b8120201..be5127ce388a86 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -2827,6 +2827,7 @@ static void kvm_hyp_init_symbols(void)
 	kvm_nvhe_sym(id_aa64pfr0_el1_sys_val) = get_hyp_id_aa64pfr0_el1();
 	kvm_nvhe_sym(id_aa64pfr1_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64PFR1_EL1);
 	kvm_nvhe_sym(id_aa64pfr2_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64PFR2_EL1);
+	kvm_nvhe_sym(id_aa64zfr0_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ZFR0_EL1);
 	kvm_nvhe_sym(id_aa64isar0_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ISAR0_EL1);
 	kvm_nvhe_sym(id_aa64isar1_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ISAR1_EL1);
 	kvm_nvhe_sym(id_aa64isar2_el1_sys_val) = read_sanitised_ftr_reg(SYS_ID_AA64ISAR2_EL1);
diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
index 179d7c8277b883..ea762788e325ea 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
@@ -482,7 +482,7 @@ static void __hyp_sve_save_guest(struct kvm_vcpu *vcpu)
 	 * on the VL, so use a consistent (i.e., the maximum) guest VL.
 	 */
 	sve_cond_update_zcr_vq(vcpu_sve_max_vq(vcpu) - 1, SYS_ZCR_EL2);
-	sve_save_state(kern_hyp_va(vcpu->arch.sve_state), true);
+	sve_save_state(vcpu->arch.sve_state, true);
 	fpsimd_save_common(&vcpu->arch.ctxt.fp_regs);
 	write_sysreg_s(sve_vq_from_vl(kvm_host_sve_max_vl) - 1, SYS_ZCR_EL2);
 }
@@ -531,7 +531,7 @@ static void fpsimd_sve_sync(struct kvm_vcpu *vcpu)
 	else
 		fpsimd_save_state(&vcpu->arch.ctxt.fp_regs);
 
-	has_fpmr = kvm_has_fpmr(kern_hyp_va(vcpu->kvm));
+	has_fpmr = kvm_has_fpmr(vcpu->kvm);
 	if (has_fpmr)
 		__vcpu_assign_sys_reg(vcpu, FPMR, read_sysreg_s(SYS_FPMR));
 
diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
index fc0475f0877d19..6500acbd849694 100644
--- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
+++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
@@ -30,6 +30,7 @@ unsigned long __icache_flags;
 /* Used by kvm_get_vttbr(). */
 unsigned int kvm_arm_vmid_bits;
 
+unsigned int kvm_sve_max_vl;
 unsigned int kvm_host_sve_max_vl;
 
 /*
@@ -476,7 +477,7 @@ static void unpin_host_vcpu(struct kvm_vcpu *host_vcpu)
 		hyp_unpin_shared_mem(host_vcpu, host_vcpu + 1);
 }
 
-static void unpin_host_sve_state(struct pkvm_hyp_vcpu *hyp_vcpu)
+static void teardown_sve_state(struct pkvm_hyp_vcpu *hyp_vcpu)
 {
 	void *sve_state;
 
@@ -484,8 +485,10 @@ static void unpin_host_sve_state(struct pkvm_hyp_vcpu *hyp_vcpu)
 	if (!sve_state)
 		return;
 
-	hyp_unpin_shared_mem(sve_state,
-			     sve_state + vcpu_sve_state_size(&hyp_vcpu->vcpu));
+	if (pkvm_hyp_vcpu_is_protected(hyp_vcpu))
+		hyp_free(sve_state);
+	else
+		hyp_unpin_shared_mem(sve_state, sve_state + vcpu_sve_state_size(&hyp_vcpu->vcpu));
 }
 
 static void unpin_host_vcpus(struct pkvm_hyp_vcpu *hyp_vcpus[],
@@ -500,7 +503,7 @@ static void unpin_host_vcpus(struct pkvm_hyp_vcpu *hyp_vcpus[],
 			continue;
 
 		unpin_host_vcpu(hyp_vcpu->host_vcpu);
-		unpin_host_sve_state(hyp_vcpu);
+		teardown_sve_state(hyp_vcpu);
 	}
 }
 
@@ -543,18 +546,25 @@ static int pkvm_vcpu_init_sve(struct pkvm_hyp_vcpu *hyp_vcpu, struct kvm_vcpu *h
 		return 0;
 	}
 
-	/* Limit guest vector length to the maximum supported by the host. */
-	sve_max_vl = min(READ_ONCE(host_vcpu->arch.sve_max_vl), kvm_host_sve_max_vl);
-	sve_state = kern_hyp_va(READ_ONCE(host_vcpu->arch.sve_state));
-
-	if (!sve_vl_valid(sve_max_vl) || !sve_state)
+	sve_max_vl = READ_ONCE(host_vcpu->arch.sve_max_vl);
+	if (!sve_vl_valid(sve_max_vl) || sve_max_vl > kvm_sve_max_vl)
 		return -EINVAL;
 
 	sve_state_size = sve_state_size_from_vl(sve_max_vl);
 
-	ret = hyp_pin_shared_mem(sve_state, sve_state + sve_state_size);
-	if (ret)
-		return ret;
+	if (pkvm_hyp_vcpu_is_protected(hyp_vcpu)) {
+		sve_state = hyp_alloc(sve_state_size);
+		if (!sve_state)
+			return hyp_alloc_errno();
+	} else {
+		sve_state = kern_hyp_va(READ_ONCE(host_vcpu->arch.sve_state));
+		if (!sve_state)
+			return -EINVAL;
+
+		ret = hyp_pin_shared_mem(sve_state, sve_state + sve_state_size);
+		if (ret)
+			return ret;
+	}
 
 	vcpu->arch.sve_state = sve_state;
 	vcpu->arch.sve_max_vl = sve_max_vl;
@@ -643,7 +653,7 @@ static int init_pkvm_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu,
 done:
 	if (ret) {
 		unpin_host_vcpu(host_vcpu);
-		unpin_host_sve_state(hyp_vcpu);
+		teardown_sve_state(hyp_vcpu);
 	}
 	return ret;
 }
@@ -1015,7 +1025,7 @@ int __pkvm_init_vcpu(pkvm_handle_t handle, struct kvm_vcpu *host_vcpu)
 	ret = register_hyp_vcpu(hyp_vm, hyp_vcpu);
 	if (ret) {
 		unpin_host_vcpu(host_vcpu);
-		unpin_host_sve_state(hyp_vcpu);
+		teardown_sve_state(hyp_vcpu);
 		goto unclaim;
 	}
 	goto unlock;
@@ -1243,6 +1253,9 @@ int pkvm_reset_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu)
 			    PSCI_0_2_AFFINITY_LEVEL_ON) != PSCI_0_2_AFFINITY_LEVEL_ON_PENDING)
 		return -ECANCELED;
 
+	if (vcpu_has_sve(&hyp_vcpu->vcpu))
+		memset(hyp_vcpu->vcpu.arch.sve_state, 0, vcpu_sve_state_size(&hyp_vcpu->vcpu));
+
 	kvm_reset_vcpu_core(&hyp_vcpu->vcpu);
 	kvm_reset_pvm_sys_regs(&hyp_vcpu->vcpu);
 
diff --git a/arch/arm64/kvm/hyp/nvhe/switch.c b/arch/arm64/kvm/hyp/nvhe/switch.c
index 89fb9dd351ad5d..0626f4203ba6db 100644
--- a/arch/arm64/kvm/hyp/nvhe/switch.c
+++ b/arch/arm64/kvm/hyp/nvhe/switch.c
@@ -230,6 +230,7 @@ static const exit_handler_fn pvm_exit_handlers[] = {
 	[ESR_ELx_EC_WFx]		= kvm_handle_pvm_wfx,
 	[ESR_ELx_EC_HVC64]		= kvm_handle_pvm_hvc64,
 	[ESR_ELx_EC_SYS64]		= kvm_handle_pvm_sys64,
+	[ESR_ELx_EC_SVE]		= kvm_handle_pvm_fpsimd,
 	[ESR_ELx_EC_FP_ASIMD]		= kvm_handle_pvm_fpsimd,
 	[ESR_ELx_EC_IABT_LOW]		= kvm_hyp_handle_iabt_low,
 	[ESR_ELx_EC_DABT_LOW]		= kvm_hyp_handle_dabt_low,
diff --git a/arch/arm64/kvm/hyp/nvhe/sys_regs.c b/arch/arm64/kvm/hyp/nvhe/sys_regs.c
index 32e82653ebf7e7..0ddddf957f5ab5 100644
--- a/arch/arm64/kvm/hyp/nvhe/sys_regs.c
+++ b/arch/arm64/kvm/hyp/nvhe/sys_regs.c
@@ -21,6 +21,7 @@
 u64 id_aa64pfr0_el1_sys_val;
 u64 id_aa64pfr1_el1_sys_val;
 u64 id_aa64pfr2_el1_sys_val;
+u64 id_aa64zfr0_el1_sys_val;
 u64 id_aa64isar0_el1_sys_val;
 u64 id_aa64isar1_el1_sys_val;
 u64 id_aa64isar2_el1_sys_val;
@@ -114,6 +115,22 @@ static const struct pvm_ftr_bits pvmid_aa64pfr2[] = {
 	FEAT_END
 };
 
+static const struct pvm_ftr_bits pvmid_aa64zfr0[] = {
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, SVEver, SVE2p3, vm_has_sve),
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, AES, AES2, vm_has_sve),
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, EltPerm, IMP, vm_has_sve),
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, BitPerm, IMP, vm_has_sve),
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, BF16, EBF16, vm_has_sve),
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, B16B16, B16MM, vm_has_sve),
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, SHA3, IMP, vm_has_sve),
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, SM4, IMP, vm_has_sve),
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, I8MM, IMP, vm_has_sve),
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, F16MM, IMP, vm_has_sve),
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, F32MM, IMP, vm_has_sve),
+	MAX_FEAT_FUNC(ID_AA64ZFR0_EL1, F64MM, IMP, vm_has_sve),
+	FEAT_END
+};
+
 static const struct pvm_ftr_bits pvmid_aa64mmfr0[] = {
 	MAX_FEAT_ENUM(ID_AA64MMFR0_EL1, PARANGE, 40),
 	MAX_FEAT_ENUM(ID_AA64MMFR0_EL1, ASIDBITS, 16),
@@ -232,6 +249,8 @@ static u64 pvm_calc_id_reg(const struct kvm_vcpu *vcpu, u32 id)
 		return get_restricted_features(vcpu, id_aa64pfr1_el1_sys_val, pvmid_aa64pfr1);
 	case SYS_ID_AA64PFR2_EL1:
 		return get_restricted_features(vcpu, id_aa64pfr2_el1_sys_val, pvmid_aa64pfr2);
+	case SYS_ID_AA64ZFR0_EL1:
+		return get_restricted_features(vcpu, id_aa64zfr0_el1_sys_val, pvmid_aa64zfr0);
 	case SYS_ID_AA64ISAR0_EL1:
 		return id_aa64isar0_el1_sys_val;
 	case SYS_ID_AA64ISAR1_EL1:
@@ -483,8 +502,6 @@ static const struct sys_reg_desc pvm_sys_reg_descs[] = {
 	ID_UNALLOCATED(7,6),
 	ID_UNALLOCATED(7,7),
 
-	/* Scalable Vector Registers are restricted. */
-
 	HOST_HANDLED(SYS_ICC_PMR_EL1),
 
 	RAZ_WI(SYS_ERRIDR_EL1),
@@ -570,6 +587,7 @@ static const struct sys_reg_desc_reset pvm_sys_reg_reset_vals[] = {
 	RESET_UNKNOWN(MAIR_EL1),
 	RESET_ZERO(AMAIR_EL1),
 	RESET_ZERO(MDSCR_EL1),
+	RESET_ZERO(ZCR_EL1),
 	RESET_ZERO(CNTV_CTL_EL0),
 	RESET_UNKNOWN(TTBR0_EL1),
 	RESET_UNKNOWN(TTBR1_EL1),
diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
index 10eb7249aa9e88..aaaa1b8634ba41 100644
--- a/arch/arm64/kvm/reset.c
+++ b/arch/arm64/kvm/reset.c
@@ -52,6 +52,8 @@ int __init kvm_arm_init_sve(void)
 		if (WARN_ON(kvm_sve_max_vl > VL_ARCH_MAX))
 			kvm_sve_max_vl = VL_ARCH_MAX;
 
+		kvm_nvhe_sym(kvm_sve_max_vl) = kvm_sve_max_vl;
+
 		/*
 		 * Don't even try to make use of vector lengths that
 		 * aren't available on all CPUs, for now:

gemini-3.8-flash

null

null

							input: 8596
							output: 25
							thoughts: 584
						

**My Assessment of the Patch Series for Syzkaller Fuzzing**

Okay, so the user wants me to evaluate this patch series for syzkaller. First things first, let's nail down the target architecture.  "Target architecture: amd64". Right, amd64, got it. Hold on, let me just confirm that... yes, "Target architecture: amd64". Good, we're on the same page.

Now, let's dive into the patch diff. Hmm, what do we have here... a bunch of files: `Documentation/virt/kvm/arm/pkvm.rst`, `arch/arm64/include/asm/kvm_hyp.h`, `arch/arm64/include/asm/kvm_pkvm.h`, and so on. Wait a minute... *every single file* is either in `arch/arm64/` or `Documentation/virt/kvm/arm/`!

Okay, time to take a step back and make sure I'm following instructions correctly. Let's re-read section 2 of the guidelines. "WHEN TO RETURN WorthFuzzing=false". Right, the negative criteria. Okay, let's see...  "Code paths exclusive to architectures other than the target architecture." Bingo!  The target is amd64, and these files are all ARM64. Wait... can files in `arch/arm64/` *ever* be compiled or executed on amd64? No, that's impossible. `arch/arm64/` is strictly for ARM64 (aarch64) architecture. On amd64 (x86_64), those files are completely excluded from the build.

Just to be 100% sure, let's verify if any of those ARM64 files are included on x86/amd64... nope, not one. KVM ARM is only built on ARM64 (`arch/arm64/kvm/`). Let's double-check with `git log` or `grep` just in case, but my intuition says we're good.

{
  "Expression": "pkvm_vcpu_init_sve"
}

{
  "Output": "arch/arm64/kvm/hyp/nvhe/pkvm.c=510=static void init_pkvm_hyp_vm(struct kvm *host_kvm, struct pkvm_hyp_vm *hyp_vm,\n--\narch/arm64/kvm/hyp/nvhe/pkvm.c-535-\narch/arm64/kvm/hyp/nvhe/pkvm.c:536:static int pkvm_vcpu_init_sve(struct pkvm_hyp_vcpu *hyp_vcpu, struct kvm_vcpu *host_vcpu)\narch/arm64/kvm/hyp/nvhe/pkvm.c-537-{\n--\narch/arm64/kvm/hyp/nvhe/pkvm.c=604=static int init_pkvm_hyp_vcpu(struct pkvm_hyp_vcpu *hyp_vcpu,\n--\narch/arm64/kvm/hyp/nvhe/pkvm.c-645-\narch/arm64/kvm/hyp/nvhe/pkvm.c:646:\tret = pkvm_vcpu_init_sve(hyp_vcpu, host_vcpu);\narch/arm64/kvm/hyp/nvhe/pkvm.c-647-\tif (ret)\n"
}

gemini-3.8-flash

null

null

							input: 10017
							output: 23
							thoughts: 669
						

**Analysis of the Patch for Fuzzing Eligibility**

Okay, let's re-examine this diff. First, a quick sanity check of the file list: `diff --git ...` and the modified files are all precisely within the `arm64` architecture domain, with modifications to documentation and code that's specific to ARM64 KVM and pKVM, including `Documentation/virt/kvm/arm/pkvm.rst`, `arch/arm64/...` files for headers, core logic and hypervisor components.

Now, let's recall the criteria. The prompt specifies to return `WorthFuzzing=false` *only if* all changes fall into certain categories. The relevant ones here are, without a doubt: documentation changes *and* changes exclusively to architectures other than the target architecture, which is `amd64` in this case.

This check directly satisfies those conditions: we have documentation changes and exclusively `arm64` code. There's zero overlap with the target architecture, `amd64`. It's a completely unreachable code path.

Therefore, applying those criteria, `WorthFuzzing` is definitively `false`. No ambiguity here. Since it's false, the guidance says `EnableConfigs` should be an empty list, and `FocusSymbols` is also an empty list.

The reasoning is straightforward: The changes are purely in documentation and ARM64-specific code for pKVM and SVE support. These code paths are fundamentally unreachable on an `amd64` system. This is an easy call.

Just to be absolutely certain, let me double check the patch series, and then the git log. Just to be sure.

{
  "Expression": "syz-cluster: applied patch under review"
}

{
  "Output": "no matches"
}

gemini-3.8-flash

null

null

							input: 11080
							output: 86
							thoughts: 33
						

Here's my take on the situation:

**Making a Clean Call**

Okay, everything's lining up perfectly. Based on the current state, the most sensible action is to execute the `set-results` command with some specific parameters. I'm going to set `WorthFuzzing` to `false` because the conditions don't warrant further fuzzing at this stage. I'll also pass an empty list for `FocusSymbols`, indicating that no particular symbols need special attention in this round. Similarly, `EnableConfigs` will be an empty list; the default configuration should suffice. Finally, I'll be sure to include a clear and accurate explanation of the reasoning behind this decision. It's the cleanest and most efficient approach right now.

{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies documentation and ARM64-specific KVM/pKVM code (under arch/arm64/) to support SVE in protected VMs. Since the target architecture is amd64, all modified code paths are exclusive to arm64 and structurally unreachable.",
  "WorthFuzzing": false
}

{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies documentation and ARM64-specific KVM/pKVM code (under arch/arm64/) to support SVE in protected VMs. Since the target architecture is amd64, all modified code paths are exclusive to arm64 and structurally unreachable.",
  "WorthFuzzing": false
}

{
  "WorthFuzzing": false
}

null