AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/09/14 11:54 flow patch-triage
4m Args:
null

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "KMSANReasoning": "",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies `__shmem_writeback` in `drivers/gpu/drm/i915/gem/i915_gem_shmem.c`, which is part of the Intel i915 GPU driver. i915 is a vendor-specific GPU driver requiring physical Intel graphics hardware not emulated in standard QEMU or virtualized cloud environments (GCE). Consequently, the modified code is structurally unreachable for syzkaller fuzzing.",
  "WorthFuzzing": false
}

1/1 2026/09/14 11:54 action read-patch-diff
0m Args:
null

Results:
{
  "PatchDiff": "commit a389322ab979d8b8b7765048d4fcd4889b427dc7\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Sep 14 11:54:51 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c\nindex ef94401662955..e7b18f7f9644c 100644\n--- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c\n+++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c\n@@ -322,10 +322,16 @@ void __shmem_writeback(size_t size, struct address_space *mapping)\n \t * as normal.\n \t */\n \twhile ((folio = writeback_iter(mapping, \u0026wbc, folio, \u0026error))) {\n-\t\tif (folio_mapped(folio))\n+\t\tif (folio_mapped(folio)) {\n \t\t\tfolio_redirty_for_writepage(\u0026wbc, folio);\n-\t\telse\n+\t\t\tfolio_unlock(folio);\n+\t\t} else {\n \t\t\terror = shmem_write_folio(folio);\n+\t\t\tif (error == AOP_WRITEPAGE_ACTIVATE) {\n+\t\t\t\tfolio_unlock(folio);\n+\t\t\t\terror = 0;\n+\t\t\t}\n+\t\t}\n \t}\n }\n \n"
}

2/1 2026/09/14 11:54 agent patch-evaluator
4m Model:
core

Args:
null

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies `__shmem_writeback` in `drivers/gpu/drm/i915/gem/i915_gem_shmem.c`, which is part of the Intel i915 GPU driver. i915 is a vendor-specific GPU driver requiring physical Intel graphics hardware not emulated in standard QEMU or virtualized cloud environments (GCE). Consequently, the modified code is structurally unreachable for syzkaller fuzzing.",
  "WorthFuzzing": false
}

Instruction:
You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt:
Target architecture: amd64

For your convenience, here is the diff of the changes:
commit a389322ab979d8b8b7765048d4fcd4889b427dc7
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Sep 14 11:54:51 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
index ef94401662955..e7b18f7f9644c 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
@@ -322,10 +322,16 @@ void __shmem_writeback(size_t size, struct address_space *mapping)
 	 * as normal.
 	 */
 	while ((folio = writeback_iter(mapping, &wbc, folio, &error))) {
-		if (folio_mapped(folio))
+		if (folio_mapped(folio)) {
 			folio_redirty_for_writepage(&wbc, folio);
-		else
+			folio_unlock(folio);
+		} else {
 			error = shmem_write_folio(folio);
+			if (error == AOP_WRITEPAGE_ACTIVATE) {
+				folio_unlock(folio);
+				error = 0;
+			}
+		}
 	}
 }
 

3/2 2026/09/14 11:54 llm patch-evaluator
3m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 3007
							output: 39
							thoughts: 752
						

Thoughts:
**Analyzing the Patch and Context for Accessibility**

Okay, let's break this down. First, the patch modifies `drivers/gpu/drm/i915/gem/i915_gem_shmem.c`. The code itself seems straightforward: it's adjusting the handling of folio writeback, specifically regarding locking and error conditions when a folio isn't mapped. But, as an expert in this, I know the real question is *where* this code executes and whether it's relevant in our testing context.

The immediate question that pops into my head is whether `i915` is actually *reachable* in a standard virtualized environment like QEMU or GCE. I know these environments aren't perfect emulators for *every* piece of hardware, especially specialized devices.

The prompt, specifically section 2, highlights "Structurally unreachable hardware" – and it explicitly lists several examples. My mind immediately jumps to the implication: is `i915` one of those unreachable components? QEMU, in general, doesn't emulate hardware like Intel integrated graphics. It offers *other* virtualized graphics devices like bochs-drm, virtio-gpu, and so on. But, my understanding is that full `i915` emulation, particularly for recent generations, is a no-go in standard QEMU. It's either hardware passthrough or, maybe, GVT-g, which also implies hardware requirements on the host.

Therefore, is `i915` like `amdgpu` or `nouveau`, requiring a physical ASIC/PCIe card and thus not emulated in standard QEMU?

I need to confirm if `i915` even *has* a mock or dummy device implementation. I need to know if it's considered "structurally unreachable" in this scenario, or if syzkaller targets it. I'll need to dig into the codebase and Git logs to get a solid answer. I need to determine if there's *any* viable path to fuzzing this code without direct hardware access or with some simulated/emulated mode. I will also re-read the prompt and make sure I'm not missing any relevant details.



4/2 2026/09/14 11:57 tool grepper
0m Args:
{
  "Expression": "CONFIG_DRM_I915",
  "PathPrefix": "drivers/gpu/drm/i915"
}

Results:
{
  "Output": "\nFull output is too long, showing 500 out of 1342 lines.\nUse more precise expression if possible.\n\ndrivers/gpu/drm/i915/.kunitconfig=7=CONFIG_DRM=y\ndrivers/gpu/drm/i915/.kunitconfig:8:CONFIG_DRM_I915=y\ndrivers/gpu/drm/i915/.kunitconfig:9:CONFIG_DRM_I915_KUNIT_TEST=y\n--\ndrivers/gpu/drm/i915/Makefile=7=subdir-ccflags-y += $(call cc-option, -Wformat-truncation)\n--\ndrivers/gpu/drm/i915/Makefile-9-# Enable -Werror in CI and development\ndrivers/gpu/drm/i915/Makefile:10:subdir-ccflags-$(CONFIG_DRM_I915_WERROR) += -Werror\ndrivers/gpu/drm/i915/Makefile-11-\n--\ndrivers/gpu/drm/i915/Makefile=337=i915-y += \\\n--\ndrivers/gpu/drm/i915/Makefile-385-\ndrivers/gpu/drm/i915/Makefile:386:i915-$(CONFIG_DRM_I915_DP_TUNNEL) += \\\ndrivers/gpu/drm/i915/Makefile-387-\tdisplay/intel_dp_tunnel.o\ndrivers/gpu/drm/i915/Makefile-388-\ndrivers/gpu/drm/i915/Makefile:389:obj-$(CONFIG_DRM_I915_KUNIT_TEST) += display/tests/\ndrivers/gpu/drm/i915/Makefile-390-\ndrivers/gpu/drm/i915/Makefile:391:i915-$(CONFIG_DRM_I915_GVT) += \\\ndrivers/gpu/drm/i915/Makefile-392-\tdisplay/intel_gvt_api.o\n--\ndrivers/gpu/drm/i915/Makefile=398=i915-y += \\\n--\ndrivers/gpu/drm/i915/Makefile-402-\ndrivers/gpu/drm/i915/Makefile:403:i915-$(CONFIG_DRM_I915_PXP) += \\\ndrivers/gpu/drm/i915/Makefile-404-\tpxp/intel_pxp_cmd.o \\\n--\ndrivers/gpu/drm/i915/Makefile-411-# Post-mortem debug and GPU hang state capture\ndrivers/gpu/drm/i915/Makefile:412:i915-$(CONFIG_DRM_I915_CAPTURE_ERROR) += \\\ndrivers/gpu/drm/i915/Makefile-413-\ti915_gpu_error.o\ndrivers/gpu/drm/i915/Makefile:414:i915-$(CONFIG_DRM_I915_SELFTEST) += \\\ndrivers/gpu/drm/i915/Makefile-415-\tgem/selftests/i915_gem_client_blt.o \\\n--\ndrivers/gpu/drm/i915/Makefile=429=i915-y += \\\n--\ndrivers/gpu/drm/i915/Makefile-431-\ndrivers/gpu/drm/i915/Makefile:432:i915-$(CONFIG_DRM_I915_GVT) += \\\ndrivers/gpu/drm/i915/Makefile-433-\tintel_gvt.o \\\n--\ndrivers/gpu/drm/i915/Makefile=435=include $(src)/gvt/Makefile\ndrivers/gpu/drm/i915/Makefile-436-\ndrivers/gpu/drm/i915/Makefile:437:obj-$(CONFIG_DRM_I915) += i915.o\ndrivers/gpu/drm/i915/Makefile:438:obj-$(CONFIG_DRM_I915_GVT_KVMGT) += kvmgt.o\ndrivers/gpu/drm/i915/Makefile-439-\n--\ndrivers/gpu/drm/i915/Makefile-441-#\ndrivers/gpu/drm/i915/Makefile:442:# Enable locally for CONFIG_DRM_I915_WERROR=y. See also scripts/Makefile.build\ndrivers/gpu/drm/i915/Makefile:443:ifdef CONFIG_DRM_I915_WERROR\ndrivers/gpu/drm/i915/Makefile-444-    cmd_checkdoc = PYTHONDONTWRITEBYTECODE=1 $(PYTHON3) $(KERNELDOC) -none -Werror $\u003c\n--\ndrivers/gpu/drm/i915/Makefile=450=no-header-test := \\\n--\ndrivers/gpu/drm/i915/Makefile-452-\ndrivers/gpu/drm/i915/Makefile:453:always-$(CONFIG_DRM_I915_WERROR) += \\\ndrivers/gpu/drm/i915/Makefile-454-\t$(patsubst %.h,%.hdrtest, $(filter-out $(no-header-test), \\\n--\ndrivers/gpu/drm/i915/display/intel_crtc.c=587=void intel_pipe_update_start(struct intel_atomic_state *state,\n--\ndrivers/gpu/drm/i915/display/intel_crtc.c-656-\ndrivers/gpu/drm/i915/display/intel_crtc.c:657:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_VBLANK_EVADE)\ndrivers/gpu/drm/i915/display/intel_crtc.c-658-static void dbg_vblank_evade(struct intel_crtc *crtc, ktime_t end)\n--\ndrivers/gpu/drm/i915/display/intel_display_debugfs.c=412=static void intel_scaler_info(struct seq_file *m, struct intel_crtc *crtc)\n--\ndrivers/gpu/drm/i915/display/intel_display_debugfs.c-440-\ndrivers/gpu/drm/i915/display/intel_display_debugfs.c:441:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_VBLANK_EVADE)\ndrivers/gpu/drm/i915/display/intel_display_debugfs.c-442-static void crtc_updates_info(struct seq_file *m,\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c=526=static void __async_put_domains_mask(struct i915_power_domains *power_domains,\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c-534-\ndrivers/gpu/drm/i915/display/intel_display_power.c:535:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)\ndrivers/gpu/drm/i915/display/intel_display_power.c-536-\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c=619=verify_async_put_domains_state(struct i915_power_domains *power_domains)\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c-622-\ndrivers/gpu/drm/i915/display/intel_display_power.c:623:#endif /* CONFIG_DRM_I915_DEBUG_RUNTIME_PM */\ndrivers/gpu/drm/i915/display/intel_display_power.c-624-\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c=996=intel_display_power_flush_work_sync(struct intel_display *display)\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c-1007-\ndrivers/gpu/drm/i915/display/intel_display_power.c:1008:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)\ndrivers/gpu/drm/i915/display/intel_display_power.c-1009-/**\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c=1049=intel_display_power_get_in_set(struct intel_display *display,\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c-1057-\twf = intel_display_power_get(display, domain);\ndrivers/gpu/drm/i915/display/intel_display_power.c:1058:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)\ndrivers/gpu/drm/i915/display/intel_display_power.c-1059-\tpower_domain_set-\u003ewakerefs[domain] = wf;\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c=1065=intel_display_power_get_in_set_if_enabled(struct intel_display *display,\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c-1076-\ndrivers/gpu/drm/i915/display/intel_display_power.c:1077:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)\ndrivers/gpu/drm/i915/display/intel_display_power.c-1078-\tpower_domain_set-\u003ewakerefs[domain] = wf;\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c=1086=intel_display_power_put_mask_in_set(struct intel_display *display,\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c-1097-\ndrivers/gpu/drm/i915/display/intel_display_power.c:1098:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)\ndrivers/gpu/drm/i915/display/intel_display_power.c-1099-\t\twf = fetch_and_zero(\u0026power_domain_set-\u003ewakerefs[domain]);\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c=2325=static void intel_power_domains_resume(struct intel_display *display)\n--\ndrivers/gpu/drm/i915/display/intel_display_power.c-2338-\ndrivers/gpu/drm/i915/display/intel_display_power.c:2339:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)\ndrivers/gpu/drm/i915/display/intel_display_power.c-2340-\n--\ndrivers/gpu/drm/i915/display/intel_display_power.h=195=struct intel_display_power_domain_set {\ndrivers/gpu/drm/i915/display/intel_display_power.h-196-\tstruct intel_power_domain_mask mask;\ndrivers/gpu/drm/i915/display/intel_display_power.h:197:#ifdef CONFIG_DRM_I915_DEBUG_RUNTIME_PM\ndrivers/gpu/drm/i915/display/intel_display_power.h-198-\tstruct ref_tracker *wakerefs[POWER_DOMAIN_NUM];\n--\ndrivers/gpu/drm/i915/display/intel_display_power.h=240=void intel_display_power_flush_work(struct intel_display *display);\ndrivers/gpu/drm/i915/display/intel_display_power.h:241:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)\ndrivers/gpu/drm/i915/display/intel_display_power.h-242-void intel_display_power_put(struct intel_display *display,\n--\ndrivers/gpu/drm/i915/display/intel_display_power_well.c=518=icl_combo_phy_aux_power_well_disable(struct intel_display *display,\n--\ndrivers/gpu/drm/i915/display/intel_display_power_well.c-537-\ndrivers/gpu/drm/i915/display/intel_display_power_well.c:538:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)\ndrivers/gpu/drm/i915/display/intel_display_power_well.c-539-\n--\ndrivers/gpu/drm/i915/display/intel_display_types.h=1496=struct intel_crtc {\n--\ndrivers/gpu/drm/i915/display/intel_display_types.h-1562-\t\tint scanline_start;\ndrivers/gpu/drm/i915/display/intel_display_types.h:1563:#ifdef CONFIG_DRM_I915_DEBUG_VBLANK_EVADE\ndrivers/gpu/drm/i915/display/intel_display_types.h-1564-\t\tstruct {\n--\ndrivers/gpu/drm/i915/display/intel_dp_tunnel.h=21=struct intel_link_bw_limits;\ndrivers/gpu/drm/i915/display/intel_dp_tunnel.h-22-\ndrivers/gpu/drm/i915/display/intel_dp_tunnel.h:23:#if (IS_ENABLED(CONFIG_DRM_I915_DP_TUNNEL) \u0026\u0026 defined(I915)) || \\\ndrivers/gpu/drm/i915/display/intel_dp_tunnel.h-24-\t(IS_ENABLED(CONFIG_DRM_XE_DP_TUNNEL) \u0026\u0026 !defined(I915))\n--\ndrivers/gpu/drm/i915/display/intel_dp_tunnel.h=155=static inline void intel_dp_tunnel_mgr_cleanup(struct intel_display *display) {}\ndrivers/gpu/drm/i915/display/intel_dp_tunnel.h-156-\ndrivers/gpu/drm/i915/display/intel_dp_tunnel.h:157:#endif /* CONFIG_DRM_I915_DP_TUNNEL || CONFIG_DRM_XE_DP_TUNNEL */\ndrivers/gpu/drm/i915/display/intel_dp_tunnel.h-158-\n--\ndrivers/gpu/drm/i915/display/intel_tc.c=47=struct intel_tc_port {\n--\ndrivers/gpu/drm/i915/display/intel_tc.c-53-\tstruct ref_tracker *lock_wakeref;\ndrivers/gpu/drm/i915/display/intel_tc.c:54:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)\ndrivers/gpu/drm/i915/display/intel_tc.c-55-\tenum intel_display_power_domain lock_power_domain;\n--\ndrivers/gpu/drm/i915/display/intel_tc.c=195=tc_cold_block(struct intel_tc_port *tc)\n--\ndrivers/gpu/drm/i915/display/intel_tc.c-200-\twakeref = __tc_cold_block(tc, \u0026domain);\ndrivers/gpu/drm/i915/display/intel_tc.c:201:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)\ndrivers/gpu/drm/i915/display/intel_tc.c-202-\ttc-\u003elock_power_domain = domain;\n--\ndrivers/gpu/drm/i915/display/intel_tc.c=217=tc_cold_unblock(struct intel_tc_port *tc, struct ref_tracker *wakeref)\n--\ndrivers/gpu/drm/i915/display/intel_tc.c-221-\ndrivers/gpu/drm/i915/display/intel_tc.c:222:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_RUNTIME_PM)\ndrivers/gpu/drm/i915/display/intel_tc.c-223-\tdrm_WARN_ON(display-\u003edrm, tc-\u003elock_power_domain != domain);\n--\ndrivers/gpu/drm/i915/display/tests/Makefile=3=subdir-ccflags-y += -I$(srctree)/drivers/gpu/drm/i915/display/\ndrivers/gpu/drm/i915/display/tests/Makefile-4-\ndrivers/gpu/drm/i915/display/tests/Makefile:5:obj-$(CONFIG_DRM_I915_KUNIT_TEST) += i915_display_test.o\ndrivers/gpu/drm/i915/display/tests/Makefile-6-i915_display_test-y = \\\n--\ndrivers/gpu/drm/i915/gem/i915_gem_context.c=975=static int intel_context_set_gem(struct intel_context *ce,\n--\ndrivers/gpu/drm/i915/gem/i915_gem_context.c-998-\ndrivers/gpu/drm/i915/gem/i915_gem_context.c:999:\tif (CONFIG_DRM_I915_REQUEST_TIMEOUT \u0026\u0026\ndrivers/gpu/drm/i915/gem/i915_gem_context.c-1000-\t    ctx-\u003ei915-\u003eparams.request_timeout_ms) {\n--\ndrivers/gpu/drm/i915/gem/i915_gem_context.c=2114=static int set_context_image(struct i915_gem_context *ctx,\n--\ndrivers/gpu/drm/i915/gem/i915_gem_context.c-2123-\ndrivers/gpu/drm/i915/gem/i915_gem_context.c:2124:\tif (!IS_ENABLED(CONFIG_DRM_I915_REPLAY_GPU_HANGS_API))\ndrivers/gpu/drm/i915/gem/i915_gem_context.c-2125-\t\treturn -EINVAL;\n--\ndrivers/gpu/drm/i915/gem/i915_gem_context.c=2676=i915_gem_engines_iter_next(struct i915_gem_engines_iter *it)\n--\ndrivers/gpu/drm/i915/gem/i915_gem_context.c-2693-\ndrivers/gpu/drm/i915/gem/i915_gem_context.c:2694:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gem/i915_gem_context.c-2695-#include \"selftests/mock_context.c\"\n--\ndrivers/gpu/drm/i915/gem/i915_gem_context.c=2704=int __init i915_gem_context_module_init(void)\n--\ndrivers/gpu/drm/i915/gem/i915_gem_context.c-2709-\ndrivers/gpu/drm/i915/gem/i915_gem_context.c:2710:\tif (IS_ENABLED(CONFIG_DRM_I915_REPLAY_GPU_HANGS_API)) {\ndrivers/gpu/drm/i915/gem/i915_gem_context.c-2711-\t\tpr_notice(\"**************************************************************\\n\");\n--\ndrivers/gpu/drm/i915/gem/i915_gem_context.c-2716-\t\telse\ndrivers/gpu/drm/i915/gem/i915_gem_context.c:2717:\t\t\tpr_notice(\"** CONFIG_DRM_I915_REPLAY_GPU_HANGS_API builds are intended **\\n\");\ndrivers/gpu/drm/i915/gem/i915_gem_context.c-2718-\t\tpr_notice(\"** for specific userspace graphics stack developers only!   **\\n\");\n--\ndrivers/gpu/drm/i915/gem/i915_gem_dmabuf.c=281=struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev,\n--\ndrivers/gpu/drm/i915/gem/i915_gem_dmabuf.c-343-\ndrivers/gpu/drm/i915/gem/i915_gem_dmabuf.c:344:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gem/i915_gem_dmabuf.c-345-#include \"selftests/mock_dmabuf.c\"\n--\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c=49=enum {\n--\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c-78-/* Catch emission of unexpected errors for CI! */\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c:79:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM)\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c-80-#undef EINVAL\n--\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c=245=struct i915_execbuffer {\n--\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c-314-\tunsigned long num_fences;\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c:315:#if IS_ENABLED(CONFIG_DRM_I915_CAPTURE_ERROR)\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c-316-\tstruct i915_capture_list *capture_lists[MAX_ENGINE_INSTANCE + 1];\n--\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c=1973=eb_find_first_request_added(struct i915_execbuffer *eb)\n--\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c-1985-\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c:1986:#if IS_ENABLED(CONFIG_DRM_I915_CAPTURE_ERROR)\ndrivers/gpu/drm/i915/gem/i915_gem_execbuffer.c-1987-\n--\ndrivers/gpu/drm/i915/gem/i915_gem_mman.c=338=static vm_fault_t vm_fault_gtt(struct vm_fault *vmf)\n--\ndrivers/gpu/drm/i915/gem/i915_gem_mman.c-477-\ndrivers/gpu/drm/i915/gem/i915_gem_mman.c:478:\tif (CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND)\ndrivers/gpu/drm/i915/gem/i915_gem_mman.c-479-\t\tintel_wakeref_auto(\u0026i915-\u003eruntime_pm.userfault_wakeref,\ndrivers/gpu/drm/i915/gem/i915_gem_mman.c:480:\t\t\t\t   msecs_to_jiffies_timeout(CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND));\ndrivers/gpu/drm/i915/gem/i915_gem_mman.c-481-\n--\ndrivers/gpu/drm/i915/gem/i915_gem_mman.c=1116=int i915_gem_fb_mmap(struct drm_i915_gem_object *obj, struct vm_area_struct *vma)\n--\ndrivers/gpu/drm/i915/gem/i915_gem_mman.c-1153-\ndrivers/gpu/drm/i915/gem/i915_gem_mman.c:1154:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gem/i915_gem_mman.c-1155-#include \"selftests/i915_gem_mman.c\"\n--\ndrivers/gpu/drm/i915/gem/i915_gem_object.c=960=bool i915_gem_object_has_unknown_state(struct drm_i915_gem_object *obj)\n--\ndrivers/gpu/drm/i915/gem/i915_gem_object.c-970-\ndrivers/gpu/drm/i915/gem/i915_gem_object.c:971:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gem/i915_gem_object.c-972-#include \"selftests/huge_gem_object.c\"\n--\ndrivers/gpu/drm/i915/gem/i915_gem_phys.c=227=int i915_gem_object_attach_phys(struct drm_i915_gem_object *obj, int align)\n--\ndrivers/gpu/drm/i915/gem/i915_gem_phys.c-263-\ndrivers/gpu/drm/i915/gem/i915_gem_phys.c:264:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gem/i915_gem_phys.c-265-#include \"selftests/i915_gem_phys.c\"\n--\ndrivers/gpu/drm/i915/gem/i915_gem_stolen.c=597=static void dbg_poison(struct i915_ggtt *ggtt,\n--\ndrivers/gpu/drm/i915/gem/i915_gem_stolen.c-600-{\ndrivers/gpu/drm/i915/gem/i915_gem_stolen.c:601:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM)\ndrivers/gpu/drm/i915/gem/i915_gem_stolen.c-602-\tif (!drm_mm_node_allocated(\u0026ggtt-\u003eerror_capture))\n--\ndrivers/gpu/drm/i915/gem/i915_gem_ttm.c=1042=static vm_fault_t vm_fault_ttm(struct vm_fault *vmf)\n--\ndrivers/gpu/drm/i915/gem/i915_gem_ttm.c-1140-\ndrivers/gpu/drm/i915/gem/i915_gem_ttm.c:1141:\tif (wakeref \u0026\u0026 CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND != 0)\ndrivers/gpu/drm/i915/gem/i915_gem_ttm.c-1142-\t\tintel_wakeref_auto(\u0026to_i915(obj-\u003ebase.dev)-\u003eruntime_pm.userfault_wakeref,\ndrivers/gpu/drm/i915/gem/i915_gem_ttm.c:1143:\t\t\t\t   msecs_to_jiffies_timeout(CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND));\ndrivers/gpu/drm/i915/gem/i915_gem_ttm.c-1144-\n--\ndrivers/gpu/drm/i915/gem/i915_gem_ttm_move.c-32- */\ndrivers/gpu/drm/i915/gem/i915_gem_ttm_move.c:33:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gem/i915_gem_ttm_move.c-34-static bool fail_gpu_migration;\n--\ndrivers/gpu/drm/i915/gt/intel_context.c=638=bool intel_context_revoke(struct intel_context *ce)\n--\ndrivers/gpu/drm/i915/gt/intel_context.c-647-\ndrivers/gpu/drm/i915/gt/intel_context.c:648:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_context.c-649-#include \"selftest_context.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_context.h=373=intel_context_clear_nopreempt(struct intel_context *ce)\n--\ndrivers/gpu/drm/i915/gt/intel_context.h-377-\ndrivers/gpu/drm/i915/gt/intel_context.h:378:#if IS_ENABLED(CONFIG_DRM_I915_REPLAY_GPU_HANGS_API)\ndrivers/gpu/drm/i915/gt/intel_context.h-379-static inline bool intel_context_has_own_state(const struct intel_context *ce)\n--\ndrivers/gpu/drm/i915/gt/intel_context_types.h=77=struct intel_context {\n--\ndrivers/gpu/drm/i915/gt/intel_context_types.h-308-\ndrivers/gpu/drm/i915/gt/intel_context_types.h:309:#ifdef CONFIG_DRM_I915_SELFTEST\ndrivers/gpu/drm/i915/gt/intel_context_types.h-310-\t/**\n--\ndrivers/gpu/drm/i915/gt/intel_engine.h=301=intel_engine_has_preempt_reset(const struct intel_engine_cs *engine)\ndrivers/gpu/drm/i915/gt/intel_engine.h-302-{\ndrivers/gpu/drm/i915/gt/intel_engine.h:303:\tif (!CONFIG_DRM_I915_PREEMPT_TIMEOUT)\ndrivers/gpu/drm/i915/gt/intel_engine.h-304-\t\treturn false;\n--\ndrivers/gpu/drm/i915/gt/intel_engine.h=338=intel_engine_has_heartbeat(const struct intel_engine_cs *engine)\ndrivers/gpu/drm/i915/gt/intel_engine.h-339-{\ndrivers/gpu/drm/i915/gt/intel_engine.h:340:\tif (!CONFIG_DRM_I915_HEARTBEAT_INTERVAL)\ndrivers/gpu/drm/i915/gt/intel_engine.h-341-\t\treturn false;\n--\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c=449=static int intel_engine_setup(struct intel_gt *gt, enum intel_engine_id id,\n--\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c-510-\tengine-\u003eprops.heartbeat_interval_ms =\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c:511:\t\tCONFIG_DRM_I915_HEARTBEAT_INTERVAL;\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c-512-\tengine-\u003eprops.max_busywait_duration_ns =\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c:513:\t\tCONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT;\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c-514-\tengine-\u003eprops.preempt_timeout_ms =\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c:515:\t\tCONFIG_DRM_I915_PREEMPT_TIMEOUT;\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c-516-\tengine-\u003eprops.stop_timeout_ms =\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c:517:\t\tCONFIG_DRM_I915_STOP_TIMEOUT;\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c-518-\tengine-\u003eprops.timeslice_duration_ms =\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c:519:\t\tCONFIG_DRM_I915_TIMESLICE_DURATION;\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c-520-\n--\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c-527-\tif (GRAPHICS_VER(i915) == 12 \u0026\u0026 (engine-\u003eflags \u0026 I915_ENGINE_HAS_RCS_REG_STATE))\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c:528:\t\tengine-\u003eprops.preempt_timeout_ms = CONFIG_DRM_I915_PREEMPT_TIMEOUT_COMPUTE;\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c-529-\n--\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c=2541=void xehp_enable_ccs_engines(struct intel_engine_cs *engine)\n--\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c-2557-\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c:2558:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_engine_cs.c-2559-#include \"mock_engine.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c=120=reset_engine(struct intel_engine_cs *engine, struct i915_request *rq)\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c-121-{\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c:122:\tif (IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c-123-\t\tshow_heartbeat(rq, engine);\n--\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c=245=void intel_engine_unpark_heartbeat(struct intel_engine_cs *engine)\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c-246-{\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c:247:\tif (!CONFIG_DRM_I915_HEARTBEAT_INTERVAL)\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c-248-\t\treturn;\n--\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c=393=int intel_engine_flush_barriers(struct intel_engine_cs *engine)\n--\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c-426-\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c:427:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_engine_heartbeat.c-428-#include \"selftest_engine_heartbeat.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_engine_pm.c=35=static void dbg_poison_ce(struct intel_context *ce)\ndrivers/gpu/drm/i915/gt/intel_engine_pm.c-36-{\ndrivers/gpu/drm/i915/gt/intel_engine_pm.c:37:\tif (!IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))\ndrivers/gpu/drm/i915/gt/intel_engine_pm.c-38-\t\treturn;\n--\ndrivers/gpu/drm/i915/gt/intel_engine_pm.c=311=void intel_engine_reset_pinned_contexts(struct intel_engine_cs *engine)\n--\ndrivers/gpu/drm/i915/gt/intel_engine_pm.c-325-\ndrivers/gpu/drm/i915/gt/intel_engine_pm.c:326:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_engine_pm.c-327-#include \"selftest_engine_pm.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_engine_types.h=683=intel_engine_has_timeslices(const struct intel_engine_cs *engine)\ndrivers/gpu/drm/i915/gt/intel_engine_types.h-684-{\ndrivers/gpu/drm/i915/gt/intel_engine_types.h:685:\tif (!CONFIG_DRM_I915_TIMESLICE_DURATION)\ndrivers/gpu/drm/i915/gt/intel_engine_types.h-686-\t\treturn false;\n--\ndrivers/gpu/drm/i915/gt/intel_engine_user.c=206=void intel_engines_driver_register(struct drm_i915_private *i915)\n--\ndrivers/gpu/drm/i915/gt/intel_engine_user.c-261-\ndrivers/gpu/drm/i915/gt/intel_engine_user.c:262:\tif (IS_ENABLED(CONFIG_DRM_I915_SELFTEST) \u0026\u0026\ndrivers/gpu/drm/i915/gt/intel_engine_user.c:263:\t    IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM)) {\ndrivers/gpu/drm/i915/gt/intel_engine_user.c-264-\t\tstruct intel_engine_cs *engine;\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c=415=execlists_context_status_change(struct i915_request *rq, unsigned long status)\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-420-\t */\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c:421:\tif (!IS_ENABLED(CONFIG_DRM_I915_GVT))\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-422-\t\treturn;\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c=472=__execlists_schedule_in(struct i915_request *rq)\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-485-\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c:486:\tif (IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-487-\t\tlrc_check_regs(ce, engine, \"before\");\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c=586=static void __execlists_schedule_out(struct i915_request * const rq,\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-600-\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c:601:\tif (IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-602-\t\tlrc_check_regs(ce, engine, \"after\");\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c=941=static bool ctx_single_port_submission(const struct intel_context *ce)\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-942-{\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c:943:\treturn (IS_ENABLED(CONFIG_DRM_I915_GVT) \u0026\u0026\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-944-\t\tintel_context_force_single_submission(ce));\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c=2325=static void execlists_capture(struct intel_engine_cs *engine)\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-2329-\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c:2330:\tif (!IS_ENABLED(CONFIG_DRM_I915_CAPTURE_ERROR))\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-2331-\t\treturn;\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c=2410=static bool preempt_timeout(const struct intel_engine_cs *const engine)\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-2413-\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c:2414:\tif (!CONFIG_DRM_I915_PREEMPT_TIMEOUT)\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-2415-\t\treturn false;\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c=2854=static void execlists_sanitize(struct intel_engine_cs *engine)\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-2866-\t */\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c:2867:\tif (IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-2868-\t\tmemset(engine-\u003estatus_page.addr, POISON_INUSE, PAGE_SIZE);\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c=3427=logical_ring_default_vfuncs(struct intel_engine_cs *engine)\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-3472-\t\t\tengine-\u003eflags |= I915_ENGINE_HAS_PREEMPTION;\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c:3473:\t\t\tif (CONFIG_DRM_I915_TIMESLICE_DURATION)\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-3474-\t\t\t\tengine-\u003eflags |= I915_ENGINE_HAS_TIMESLICES;\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c=4159=void intel_execlists_dump_active_requests(struct intel_engine_cs *engine,\n--\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-4174-\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c:4175:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_execlists_submission.c-4176-#include \"selftest_execlists.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_gt.c=631=static int __engines_verify_workarounds(struct intel_gt *gt)\n--\ndrivers/gpu/drm/i915/gt/intel_gt.c-636-\ndrivers/gpu/drm/i915/gt/intel_gt.c:637:\tif (!IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))\ndrivers/gpu/drm/i915/gt/intel_gt.c-638-\t\treturn 0;\n--\ndrivers/gpu/drm/i915/gt/intel_gt_clock_utils.c=172=void intel_gt_init_clock_frequency(struct intel_gt *gt)\n--\ndrivers/gpu/drm/i915/gt/intel_gt_clock_utils.c-189-\ndrivers/gpu/drm/i915/gt/intel_gt_clock_utils.c:190:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM)\ndrivers/gpu/drm/i915/gt/intel_gt_clock_utils.c-191-void intel_gt_check_clock_frequency(const struct intel_gt *gt)\n--\ndrivers/gpu/drm/i915/gt/intel_gt_clock_utils.h=13=void intel_gt_init_clock_frequency(struct intel_gt *gt);\ndrivers/gpu/drm/i915/gt/intel_gt_clock_utils.h-14-\ndrivers/gpu/drm/i915/gt/intel_gt_clock_utils.h:15:#if IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM)\ndrivers/gpu/drm/i915/gt/intel_gt_clock_utils.h-16-void intel_gt_check_clock_frequency(const struct intel_gt *gt);\n--\ndrivers/gpu/drm/i915/gt/intel_gt_pm.c=419=ktime_t intel_gt_get_awake_time(const struct intel_gt *gt)\n--\ndrivers/gpu/drm/i915/gt/intel_gt_pm.c-431-\ndrivers/gpu/drm/i915/gt/intel_gt_pm.c:432:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_gt_pm.c-433-#include \"selftest_gt_pm.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_gtt.c=346=static void poison_scratch_page(struct drm_i915_gem_object *scratch)\n--\ndrivers/gpu/drm/i915/gt/intel_gtt.c-351-\tval = 0;\ndrivers/gpu/drm/i915/gt/intel_gtt.c:352:\tif (IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))\ndrivers/gpu/drm/i915/gt/intel_gtt.c-353-\t\tval = POISON_FREE;\n--\ndrivers/gpu/drm/i915/gt/intel_gtt.c=716=__vm_create_scratch_for_read_pinned(struct i915_address_space *vm, unsigned long size)\n--\ndrivers/gpu/drm/i915/gt/intel_gtt.c-734-\ndrivers/gpu/drm/i915/gt/intel_gtt.c:735:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_gtt.c-736-#include \"selftests/mock_gtt.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_gtt.h-36-\ndrivers/gpu/drm/i915/gt/intel_gtt.h:37:#if IS_ENABLED(CONFIG_DRM_I915_TRACE_GTT)\ndrivers/gpu/drm/i915/gt/intel_gtt.h-38-#define GTT_TRACE(...) trace_printk(__VA_ARGS__)\n--\ndrivers/gpu/drm/i915/gt/intel_llc.c=157=void intel_llc_disable(struct intel_llc *llc)\n--\ndrivers/gpu/drm/i915/gt/intel_llc.c-161-\ndrivers/gpu/drm/i915/gt/intel_llc.c:162:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_llc.c-163-#include \"selftest_llc.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_lrc.c=967=set_redzone(void *vaddr, const struct intel_engine_cs *engine)\ndrivers/gpu/drm/i915/gt/intel_lrc.c-968-{\ndrivers/gpu/drm/i915/gt/intel_lrc.c:969:\tif (!IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))\ndrivers/gpu/drm/i915/gt/intel_lrc.c-970-\t\treturn;\n--\ndrivers/gpu/drm/i915/gt/intel_lrc.c=978=check_redzone(const void *vaddr, const struct intel_engine_cs *engine)\ndrivers/gpu/drm/i915/gt/intel_lrc.c-979-{\ndrivers/gpu/drm/i915/gt/intel_lrc.c:980:\tif (!IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))\ndrivers/gpu/drm/i915/gt/intel_lrc.c-981-\t\treturn;\n--\ndrivers/gpu/drm/i915/gt/intel_lrc.c=1074=__lrc_alloc_state(struct intel_context *ce, struct intel_engine_cs *engine)\n--\ndrivers/gpu/drm/i915/gt/intel_lrc.c-1081-\ndrivers/gpu/drm/i915/gt/intel_lrc.c:1082:\tif (IS_ENABLED(CONFIG_DRM_I915_DEBUG_GEM))\ndrivers/gpu/drm/i915/gt/intel_lrc.c-1083-\t\tcontext_size += I915_GTT_PAGE_SIZE; /* for redzone */\n--\ndrivers/gpu/drm/i915/gt/intel_lrc.c=1930=static void st_runtime_underflow(struct intel_context_stats *stats, s32 dt)\ndrivers/gpu/drm/i915/gt/intel_lrc.c-1931-{\ndrivers/gpu/drm/i915/gt/intel_lrc.c:1932:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_lrc.c-1933-\tstats-\u003eruntime.num_underflow++;\n--\ndrivers/gpu/drm/i915/gt/intel_lrc.c=1950=void lrc_update_runtime(struct intel_context *ce)\n--\ndrivers/gpu/drm/i915/gt/intel_lrc.c-1972-\ndrivers/gpu/drm/i915/gt/intel_lrc.c:1973:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_lrc.c-1974-#include \"selftest_lrc.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_migrate.c=1151=void intel_migrate_fini(struct intel_migrate *m)\n--\ndrivers/gpu/drm/i915/gt/intel_migrate.c-1161-\ndrivers/gpu/drm/i915/gt/intel_migrate.c:1162:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_migrate.c-1163-#include \"selftest_migrate.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_mocs.c=666=void intel_mocs_init(struct intel_gt *gt)\n--\ndrivers/gpu/drm/i915/gt/intel_mocs.c-686-\ndrivers/gpu/drm/i915/gt/intel_mocs.c:687:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_mocs.c-688-#include \"selftest_mocs.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_rc6.c=857=void intel_rc6_print_residency(struct seq_file *m, const char *title,\n--\ndrivers/gpu/drm/i915/gt/intel_rc6.c-869-\ndrivers/gpu/drm/i915/gt/intel_rc6.c:870:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_rc6.c-871-#include \"selftest_rc6.c\"\n--\ndrivers/gpu/drm/i915/gt/intel_reset.c=1717=bool intel_engine_reset_needs_wa_22011802037(struct intel_gt *gt)\n--\ndrivers/gpu/drm/i915/gt/intel_reset.c-1730-\ndrivers/gpu/drm/i915/gt/intel_reset.c:1731:#if IS_ENABLED(CONFIG_DRM_I915_SELFTEST)\ndrivers/gpu/drm/i915/gt/intel_reset.c-1732-#include \"selftest_reset.c\"\n--\n\n"
}

5/2 2026/09/14 11:57 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 18427
							output: 41
							thoughts: 209
						

Thoughts:
**Analyzing the Prompt's Hardware Limitations**

Okay, hold on a second. Let's really dissect this prompt. It's highlighting "structurally unreachable hardware," specifically vendor-specific PCIe switches, SmartNICs, and GPU drivers. The examples given – mlxsw, pds_core, qed, ionic, amdgpu – all have this caveat: they *require* physical ASIC/PCIe cards, and critically, these aren't emulated in standard QEMU.

Now, my mind immediately jumps to i915. Is *it* subject to the same limitations? Does i915 demand physical ASIC/PCIe cards, or could it potentially be emulated within the QEMU environment?

The core question then becomes: Does QEMU, in its standard configuration, offer any emulation support for Intel's integrated GPUs, specifically the i915? That's a resounding "no" based on my experience. QEMU hasn't historically included an Intel integrated GPU emulator for i915.

So, the critical next step is to determine if i915 can even be probed or initialized without specific hardware dependencies. I need to investigate the initialization path – potentially diving into `i915_pci.c` or examining how i915 binds to the system. This will help determine if it requires direct hardware interaction.



6/2 2026/09/14 11:58 tool grepper
0m Args:
{
  "Expression": "pci_register_driver.*i915",
  "PathPrefix": "drivers/gpu/drm/i915"
}

Results:
{
  "Output": "drivers/gpu/drm/i915/i915_pci.c=1037=int i915_pci_register_driver(void)\ndrivers/gpu/drm/i915/i915_pci.c-1038-{\ndrivers/gpu/drm/i915/i915_pci.c:1039:\treturn pci_register_driver(\u0026i915_pci_driver);\ndrivers/gpu/drm/i915/i915_pci.c-1040-}\n"
}

7/2 2026/09/14 11:58 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 19122
							output: 49
							thoughts: 27
						

Thoughts:
Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into the i915 PCI Driver**

Okay, time to get to the heart of this. Let's start with `i915_pci_driver`, and I'll jump right into `i915_pci.c`. I need to understand how the PCI driver is interacting with the underlying hardware, how it's managing the device probe and removal, and the all-important resource allocation. Specifically, I need to understand: the PCI configuration space accesses. Are there any unusual BAR mappings or interrupt handling strategies? I’m hoping to understand how it's setting up the mmio regions and handling the various platform quirks that always seem to pop up. This file is probably the best place to start.



8/2 2026/09/14 11:58 tool read-file
0m Args:
{
  "File": "drivers/gpu/drm/i915/i915_pci.c",
  "FirstLine": 1020,
  "LineCount": 40
}

Results:
{
  "Contents": "1020:\t\n1021:\tstatic void i915_pci_shutdown(struct pci_dev *pdev)\n1022:\t{\n1023:\t\tstruct drm_i915_private *i915 = pdev_to_i915(pdev);\n1024:\t\n1025:\t\ti915_driver_shutdown(i915);\n1026:\t}\n1027:\t\n1028:\tstatic struct pci_driver i915_pci_driver = {\n1029:\t\t.name = DRIVER_NAME,\n1030:\t\t.id_table = pciidlist,\n1031:\t\t.probe = i915_pci_probe,\n1032:\t\t.remove = i915_pci_remove,\n1033:\t\t.shutdown = i915_pci_shutdown,\n1034:\t\t.driver.pm = \u0026i915_pm_ops,\n1035:\t};\n1036:\t\n1037:\tint i915_pci_register_driver(void)\n1038:\t{\n1039:\t\treturn pci_register_driver(\u0026i915_pci_driver);\n1040:\t}\n1041:\t\n1042:\tvoid i915_pci_unregister_driver(void)\n1043:\t{\n1044:\t\tpci_unregister_driver(\u0026i915_pci_driver);\n1045:\t}\n"
}

9/2 2026/09/14 11:58 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 19791
							output: 48
							thoughts: 22
						

Thoughts:
Here's my take on those thoughts, tailored for an expert audience:

**Diving into the i915 PCI ID List**

Okay, so I need to get a handle on how these Intel i915 graphics cards are being identified, specifically in relation to the PCI bus. Time to dig into the `i915_pci.c` source code. The `pciidlist` variable is my first stop. That's where the critical matching magic likely happens, the bread and butter of knowing which devices we're dealing with and how to handle them correctly. I want to see how they're enumerated, how the IDs are structured, and what vendor/device combinations are currently supported. I'm expecting to find a list of PCI device IDs that the driver recognizes, along with associated flags or data that tell the driver how to initialize or interact with each specific hardware variant. I'll be looking for any clues that suggest the addition or alteration of device support over time, and any trends in how different revisions are handled. There might be some interesting quirks in the list too, potentially some entries that required specific workarounds or handling of edge cases. Let's see what we've got.



10/2 2026/09/14 11:58 tool read-file
0m Args:
{
  "File": "drivers/gpu/drm/i915/i915_pci.c",
  "FirstLine": 950,
  "LineCount": 40
}

Results:
{
  "Contents": " 950:\tstatic bool intel_mmio_bar_valid(struct pci_dev *pdev, struct intel_device_info *intel_info)\n 951:\t{\n 952:\t\treturn i915_pci_resource_valid(pdev, intel_mmio_bar(intel_info-\u003e__runtime.graphics.ip.ver));\n 953:\t}\n 954:\t\n 955:\tstatic int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)\n 956:\t{\n 957:\t\tstruct intel_device_info *intel_info =\n 958:\t\t\t(struct intel_device_info *) ent-\u003edriver_data;\n 959:\t\tint err;\n 960:\t\n 961:\t\tif (!intel_info)\n 962:\t\t\treturn -ENODEV;\n 963:\t\n 964:\t\tif (intel_info-\u003erequire_force_probe \u0026\u0026 !id_forced(pdev-\u003edevice)) {\n 965:\t\t\tdev_info(\u0026pdev-\u003edev,\n 966:\t\t\t\t \"Your graphics device %04x is not properly supported by i915 in this\\n\"\n 967:\t\t\t\t \"kernel version. To force driver probe anyway, use i915.force_probe=%04x\\n\"\n 968:\t\t\t\t \"module parameter or CONFIG_DRM_I915_FORCE_PROBE=%04x configuration option,\\n\"\n 969:\t\t\t\t \"or (recommended) check for kernel updates.\\n\",\n 970:\t\t\t\t pdev-\u003edevice, pdev-\u003edevice, pdev-\u003edevice);\n 971:\t\t\treturn -ENODEV;\n 972:\t\t}\n 973:\t\n 974:\t\tif (id_blocked(pdev-\u003edevice)) {\n 975:\t\t\tdev_info(\u0026pdev-\u003edev, \"I915 probe blocked for Device ID %04x.\\n\",\n 976:\t\t\t\t pdev-\u003edevice);\n 977:\t\t\treturn -ENODEV;\n 978:\t\t}\n 979:\t\n 980:\t\tif (intel_info-\u003erequire_force_probe) {\n 981:\t\t\tdev_info(\u0026pdev-\u003edev, \"Force probing unsupported Device ID %04x, tainting kernel\\n\",\n 982:\t\t\t\t pdev-\u003edevice);\n 983:\t\t\tadd_taint(TAINT_USER, LOCKDEP_STILL_OK);\n 984:\t\t}\n 985:\t\n 986:\t\t/* Only bind to function 0 of the device. Early generations\n 987:\t\t * used function 1 as a placeholder for multi-head. This causes\n 988:\t\t * us confusion instead, especially on the systems where both\n 989:\t\t * functions have the same PCI-ID!\n"
}

11/2 2026/09/14 11:58 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 20851
							output: 52
							thoughts: 50
						

Thoughts:
Here's my take on those thoughts:

**Investigating the `__shmem_writeback` Function**

Okay, so I need to get a handle on `__shmem_writeback`. Seems like this is a key function, and the name hints at some kind of shared memory writeback operation within the kernel. My first move will be to dive into the source code to get a proper understanding of it. I'll need to see how it's implemented and, even more importantly, *who* is calling this thing. Understanding the call flow will be crucial for understanding its role in the greater scheme of things. Let's start with the likely candidate: `drivers/gpu/drm/i915/gem/i915_gem_shmem.c`. That's where I'd expect to find the definition and any related code. Let's see what's in there.



12/2 2026/09/14 11:58 tool read-file
0m Args:
{
  "File": "drivers/gpu/drm/i915/gem/i915_gem_shmem.c",
  "FirstLine": 300,
  "LineCount": 50
}

Results:
{
  "Contents": " 300:\t\tshmem_truncate_range(file_inode(obj-\u003ebase.filp), 0, (loff_t)-1);\n 301:\t\tobj-\u003emm.madv = __I915_MADV_PURGED;\n 302:\t\tobj-\u003emm.pages = ERR_PTR(-EFAULT);\n 303:\t\n 304:\t\treturn 0;\n 305:\t}\n 306:\t\n 307:\tvoid __shmem_writeback(size_t size, struct address_space *mapping)\n 308:\t{\n 309:\t\tstruct writeback_control wbc = {\n 310:\t\t\t.sync_mode = WB_SYNC_NONE,\n 311:\t\t\t.nr_to_write = SWAP_CLUSTER_MAX,\n 312:\t\t\t.range_start = 0,\n 313:\t\t\t.range_end = LLONG_MAX,\n 314:\t\t};\n 315:\t\tstruct folio *folio = NULL;\n 316:\t\tint error = 0;\n 317:\t\n 318:\t\t/*\n 319:\t\t * Leave mmapings intact (GTT will have been revoked on unbinding,\n 320:\t\t * leaving only CPU mmapings around) and add those folios to the LRU\n 321:\t\t * instead of invoking writeback so they are aged and paged out\n 322:\t\t * as normal.\n 323:\t\t */\n 324:\t\twhile ((folio = writeback_iter(mapping, \u0026wbc, folio, \u0026error))) {\n 325:\t\t\tif (folio_mapped(folio)) {\n 326:\t\t\t\tfolio_redirty_for_writepage(\u0026wbc, folio);\n 327:\t\t\t\tfolio_unlock(folio);\n 328:\t\t\t} else {\n 329:\t\t\t\terror = shmem_write_folio(folio);\n 330:\t\t\t\tif (error == AOP_WRITEPAGE_ACTIVATE) {\n 331:\t\t\t\t\tfolio_unlock(folio);\n 332:\t\t\t\t\terror = 0;\n 333:\t\t\t\t}\n 334:\t\t\t}\n 335:\t\t}\n 336:\t}\n 337:\t\n 338:\tstatic void\n 339:\tshmem_writeback(struct drm_i915_gem_object *obj)\n 340:\t{\n 341:\t\t__shmem_writeback(obj-\u003ebase.size, obj-\u003ebase.filp-\u003ef_mapping);\n 342:\t}\n 343:\t\n 344:\tstatic int shmem_shrink(struct drm_i915_gem_object *obj, unsigned int flags)\n 345:\t{\n 346:\t\tswitch (obj-\u003emm.madv) {\n 347:\t\tcase I915_MADV_DONTNEED:\n 348:\t\t\treturn i915_gem_object_truncate(obj);\n 349:\t\tcase __I915_MADV_PURGED:\n"
}

13/2 2026/09/14 11:58 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 21935
							output: 20
							thoughts: 55
						

Thoughts:
Here's my take on those thoughts:

**Analyzing the `__shmem_writeback` Function**

Okay, so I'm looking at `__shmem_writeback`, and it's pretty clear that `shmem_writeback(struct drm_i915_gem_object *obj)` is one entry point. But, as an expert, I know that one specific calling function is rarely the whole story. I need to understand the wider context. Where *else* is this `__shmem_writeback` function being invoked? I need to meticulously trace its call graph. Knowing all the callers will be essential for forming a comprehensive understanding of the code's behavior, especially regarding the memory management implications. I need to identify any subtle side effects or potential bottlenecks this function might introduce across the driver. Time to dig in and find all of the other call sites.



14/2 2026/09/14 11:58 tool grepper
0m Args:
{
  "Expression": "__shmem_writeback"
}

Results:
{
  "Output": "drivers/gpu/drm/i915/gem/i915_gem_object.h=844=void shmem_sg_free_table(struct sg_table *st, struct address_space *mapping,\ndrivers/gpu/drm/i915/gem/i915_gem_object.h-845-\t\t\t bool dirty, bool backup);\ndrivers/gpu/drm/i915/gem/i915_gem_object.h:846:void __shmem_writeback(size_t size, struct address_space *mapping);\ndrivers/gpu/drm/i915/gem/i915_gem_object.h-847-\n--\ndrivers/gpu/drm/i915/gem/i915_gem_shmem.c=292=shmem_truncate(struct drm_i915_gem_object *obj)\n--\ndrivers/gpu/drm/i915/gem/i915_gem_shmem.c-306-\ndrivers/gpu/drm/i915/gem/i915_gem_shmem.c:307:void __shmem_writeback(size_t size, struct address_space *mapping)\ndrivers/gpu/drm/i915/gem/i915_gem_shmem.c-308-{\n--\ndrivers/gpu/drm/i915/gem/i915_gem_shmem.c=339=shmem_writeback(struct drm_i915_gem_object *obj)\ndrivers/gpu/drm/i915/gem/i915_gem_shmem.c-340-{\ndrivers/gpu/drm/i915/gem/i915_gem_shmem.c:341:\t__shmem_writeback(obj-\u003ebase.size, obj-\u003ebase.filp-\u003ef_mapping);\ndrivers/gpu/drm/i915/gem/i915_gem_shmem.c-342-}\n--\ndrivers/gpu/drm/i915/gem/i915_gem_ttm.c=463=static int i915_ttm_shrink(struct drm_i915_gem_object *obj, unsigned int flags)\n--\ndrivers/gpu/drm/i915/gem/i915_gem_ttm.c-504-\tif (flags \u0026 I915_GEM_OBJECT_SHRINK_WRITEBACK)\ndrivers/gpu/drm/i915/gem/i915_gem_ttm.c:505:\t\t__shmem_writeback(obj-\u003ebase.size, i915_tt-\u003efilp-\u003ef_mapping);\ndrivers/gpu/drm/i915/gem/i915_gem_ttm.c-506-\n"
}

15/2 2026/09/14 11:58 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 22908
							output: 40
							thoughts: 1071
						

Thoughts:
**Analyzing the Scope of i915 in this Context**

Okay, so I'm looking at where `__shmem_writeback` is called, specifically within `shmem_writeback` and `i915_ttm_shrink`, both clearly tied to `i915`. The critical question is whether `i915` falls under the category of "structurally unreachable hardware," as the prompt instructions define. I need to be precise here, so I'm re-reading Section 2 of the prompt.  It lays out specific examples of unreachable hardware: vendor-specific PCIe switches, SmartNICs, or *GPU drivers* requiring physical hardware that isn't emulated by standard QEMU.  Crucially, the prompt gives examples: mlxsw, pds_core, qed, ionic, amdgpu.

Now, does `i915` fit that description?  Absolutely!  `i915` represents Intel's graphics drivers, which are intimately tied to the physical hardware – the integrated GPUs in Intel CPUs or discrete Intel GPUs like Intel Arc.  And standard QEMU, the kind used by something like GCE VMs, *doesn't* emulate those Intel graphics chips.  It's just not set up to do that.

So, am I able to use syzkaller on this? The prompt says I can't look at syzkaller syzlang descriptions or anything with "long syz_". I'm remembering that `syz-grepper` and `read-syz-spec` are specifically mentioned as the tools to do that, so I will have to look at the list of available tools.  Let's see what is available:
1. `grepper`
2. `read-file`
3. `codesearch-dir-index`
4. `set-results`

Nope, `syz-grepper` and `read-syz-spec` are not available here.

Okay, let's think this through carefully.  Is `i915` a *vendor-specific GPU driver* that needs physical hardware? The examples in Section 2 are crucial here: specifically, the list of *GPU drivers* like amdgpu.  That reinforces the point: I915 is in the same category as AMD or Nouveau or any of the other GPUs!  Neither AMD nor Intel nor NVIDIA GPUs are emulated in standard QEMU or are available in GCE/QEMU virtual machines used by syzkaller.

What DOES run in QEMU?  I have to remember that.  I know that virtio-gpu, bochs-drm, cirrus, qxl, vmwgfx, vkms, simpledrm can all work in QEMU, but not I915!

Now, *is* there anything in `i915` that *might* be accessible in QEMU?  Maybe some kind of mock device, a dummy driver? Let's go back and look at that earlier grep. Ah! "i915-$(CONFIG_DRM_I915_SELFTEST) += gem/selftests/..."  That's interesting. `selftests/mock_engine.c`, `selftests/mock_context.c`, `selftests/mock_gtt.c`. That sounds like it!  I need to check `CONFIG_DRM_I915_SELFTEST` in Kconfig to understand that further.



16/2 2026/09/14 11:58 tool grepper
0m Args:
{
  "Expression": "config DRM_I915_SELFTEST",
  "PathPrefix": "drivers/gpu/drm/i915"
}

Results:
{
  "Output": "drivers/gpu/drm/i915/Kconfig.debug=178=config DRM_I915_DEBUG_GUC\n--\ndrivers/gpu/drm/i915/Kconfig.debug-190-\ndrivers/gpu/drm/i915/Kconfig.debug:191:config DRM_I915_SELFTEST\ndrivers/gpu/drm/i915/Kconfig.debug-192-\tbool \"Enable selftests upon driver load\"\n--\ndrivers/gpu/drm/i915/Kconfig.debug-208-\ndrivers/gpu/drm/i915/Kconfig.debug:209:config DRM_I915_SELFTEST_BROKEN\ndrivers/gpu/drm/i915/Kconfig.debug-210-\tbool \"Enable broken and dangerous selftests\"\n"
}

17/2 2026/09/14 11:58 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 24991
							output: 43
							thoughts: 28
						

Thoughts:
Here's my take on the thought process, as if it were my own:

**Investigating Intel GPU Debugging Configuration**

Okay, so I need to dive into the Intel GPU driver's debug configuration. Specifically, I'm thinking I should start by examining the `Kconfig.debug` file within the `drivers/gpu/drm/i915/` directory. Line 191 is a likely spot to begin my investigation. It's probably where a relevant debug option, or section of them, is defined or introduced. I’m hoping to understand how debugging features are enabled and configured for this specific driver. Knowing the underlying configuration is fundamental to understanding how to enable, disable, or adjust debug logging within the i915 driver for Intel GPUs. This kind of information is crucial for any real deep dive into this area. It'll give me a strong foundation. Let's see what's there.



18/2 2026/09/14 11:58 tool read-file
0m Args:
{
  "File": "drivers/gpu/drm/i915/Kconfig.debug",
  "FirstLine": 185,
  "LineCount": 40
}

Results:
{
  "Contents": " 185:\t\t  performance but will help resolve GuC related issues.\n 186:\t\n 187:\t\t  Recommended for driver developers only.\n 188:\t\n 189:\t\t  If in doubt, say \"N\".\n 190:\t\n 191:\tconfig DRM_I915_SELFTEST\n 192:\t\tbool \"Enable selftests upon driver load\"\n 193:\t\tdepends on DRM_I915\n 194:\t\tdefault n\n 195:\t\tselect DRM_EXPORT_FOR_TESTS if m\n 196:\t\tselect FAULT_INJECTION\n 197:\t\tselect PRIME_NUMBERS\n 198:\t\tselect CRC32\n 199:\t\thelp\n 200:\t\t  Choose this option to allow the driver to perform selftests upon\n 201:\t\t  loading; also requires the i915.selftest=1 module parameter. To\n 202:\t\t  exit the module after running the selftests (i.e. to prevent normal\n 203:\t\t  module initialisation afterwards) use i915.selftest=-1.\n 204:\t\n 205:\t\t  Recommended for driver developers only.\n 206:\t\n 207:\t\t  If in doubt, say \"N\".\n 208:\t\n 209:\tconfig DRM_I915_SELFTEST_BROKEN\n 210:\t\tbool \"Enable broken and dangerous selftests\"\n 211:\t\tdepends on DRM_I915_SELFTEST\n 212:\t\tdepends on BROKEN\n 213:\t\tdefault n\n 214:\t\thelp\n 215:\t\t  This option enables the execution of selftests that are \"dangerous\"\n 216:\t\t  and may trigger unintended HW side-effects as they break strict\n 217:\t\t  rules given in the HW specification. For science.\n 218:\t\n 219:\t\t  Recommended for masochistic driver developers only.\n 220:\t\n 221:\t\t  If in doubt, say \"N\".\n 222:\t\n 223:\tconfig DRM_I915_KUNIT_TEST\n 224:\t\ttristate \"KUnit tests for the drm i915 driver\" if !KUNIT_ALL_TESTS\n"
}

19/2 2026/09/14 11:58 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 25855
							output: 37
							thoughts: 252
						

Thoughts:
**My Assessment of the i915 Driver Selftest**

Okay, so `CONFIG_DRM_I915_SELFTEST` is really just enabling a self-test routine that happens when the driver, `i915.ko`, is loaded. Makes sense, a load-time selftest. But, of course, the i915 driver is specific to Intel hardware, so the driver *needs* to find Intel hardware to even do anything, right?

Alright, let me just confirm something... if there's no Intel PCI GPU device, does `i915.ko` even bother probing? I'm thinking about `i915_pci_probe()`. Let me refresh my memory of the code... `static int i915_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)`. Yep, that's it. And, the PCI core *only* calls this function when it finds a matching PCI ID from the `pciidlist` on the PCI bus. So, in a standard QEMU or GCE environment - those that don't have an Intel GPU - the driver wouldn't find any PCI devices to match against, and `i915_pci_probe()` wouldn't ever run. That means even if someone *forced* the `i915` module to load, it would find nothing and bail.

But wait, hold on... Can `i915` be loaded, and then run mock selftests? Hmm, time to dig deeper. I'll need to check the code that implements the mock selftests, `i915_mock_selftests`, or maybe `i915_pci.c`. I have to see how it works!



20/2 2026/09/14 11:59 tool grepper
0m Args:
{
  "Expression": "i915_selftest",
  "PathPrefix": "drivers/gpu/drm/i915"
}

Results:
{
  "Output": "drivers/gpu/drm/i915/Makefile=414=i915-$(CONFIG_DRM_I915_SELFTEST) += \\\n--\ndrivers/gpu/drm/i915/Makefile-417-\tselftests/i915_random.o \\\ndrivers/gpu/drm/i915/Makefile:418:\tselftests/i915_selftest.o \\\ndrivers/gpu/drm/i915/Makefile-419-\tselftests/igt_atomic.o \\\n--\ndrivers/gpu/drm/i915/gem/i915_gem_object_types.h-15-#include \"i915_active.h\"\ndrivers/gpu/drm/i915/gem/i915_gem_object_types.h:16:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gem/i915_gem_object_types.h-17-#include \"i915_vma_resource.h\"\n--\ndrivers/gpu/drm/i915/gem/i915_gem_ttm_move.h-9-\ndrivers/gpu/drm/i915/gem/i915_gem_ttm_move.h:10:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gem/i915_gem_ttm_move.h-11-\n--\ndrivers/gpu/drm/i915/gem/selftests/huge_pages.c-10-\ndrivers/gpu/drm/i915/gem/selftests/huge_pages.c:11:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gem/selftests/huge_pages.c-12-\n--\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_client_blt.c-7-\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_client_blt.c:8:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_client_blt.c-9-\n--\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_coherency.c-14-\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_coherency.c:15:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_coherency.c-16-#include \"selftests/i915_random.h\"\n--\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_context.c-16-#include \"gt/intel_reset.h\"\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_context.c:17:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_context.c-18-\n--\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_context.c=33=static int live_nop_switch(void *arg)\n--\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_context.c-111-\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_context.c:112:\t\tend_time = jiffies + i915_selftest.timeout_jiffies;\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_context.c-113-\t\tfor_each_prime_number_from(prime, 2, 8192) {\n--\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c-7-#include \"i915_drv.h\"\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c:8:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c-9-#include \"gem/i915_gem_context.h\"\n--\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c-25-#include \"huge_gem_object.h\"\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c:26:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c-27-#include \"selftests/i915_random.h\"\n--\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_object.c-6-\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_object.c:7:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_object.c-8-\n--\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_phys.c-6-\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_phys.c:7:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gem/selftests/i915_gem_phys.c-8-\n--\ndrivers/gpu/drm/i915/gt/intel_engine.h-15-#include \"i915_request.h\"\ndrivers/gpu/drm/i915/gt/intel_engine.h:16:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/intel_engine.h-17-#include \"intel_engine_types.h\"\n--\ndrivers/gpu/drm/i915/gt/intel_engine_types.h-22-#include \"i915_priolist_types.h\"\ndrivers/gpu/drm/i915/gt/intel_engine_types.h:23:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/intel_engine_types.h-24-#include \"intel_sseu.h\"\n--\ndrivers/gpu/drm/i915/gt/intel_gtt.h-28-#include \"gt/intel_reset.h\"\ndrivers/gpu/drm/i915/gt/intel_gtt.h:29:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/intel_gtt.h-30-#include \"i915_vma_resource.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_context.c-7-\ndrivers/gpu/drm/i915/gt/selftest_context.c:8:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_context.c-9-#include \"intel_engine_heartbeat.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_engine.c-5-\ndrivers/gpu/drm/i915/gt/selftest_engine.c:6:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_engine.c-7-#include \"selftest_engine.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_engine_cs.c-11-\ndrivers/gpu/drm/i915/gt/selftest_engine_cs.c:12:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_engine_cs.c-13-#include \"selftests/igt_flush_test.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_engine_heartbeat.c-10-#include \"intel_gt_requests.h\"\ndrivers/gpu/drm/i915/gt/selftest_engine_heartbeat.c:11:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_engine_heartbeat.c-12-#include \"selftest_engine_heartbeat.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_engine_pm.c-8-#include \"gt/intel_gt_print.h\"\ndrivers/gpu/drm/i915/gt/selftest_engine_pm.c:9:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_engine_pm.c-10-#include \"intel_engine_regs.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_execlists.c-16-#include \"i915_jiffies.h\"\ndrivers/gpu/drm/i915/gt/selftest_execlists.c:17:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_execlists.c-18-#include \"selftests/i915_random.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_execlists.c=3638=static int live_preempt_smoke(void *arg)\n--\ndrivers/gpu/drm/i915/gt/selftest_execlists.c-3641-\t\t.gt = arg,\ndrivers/gpu/drm/i915/gt/selftest_execlists.c:3642:\t\t.prng = I915_RND_STATE_INITIALIZER(i915_selftest.random_seed),\ndrivers/gpu/drm/i915/gt/selftest_execlists.c-3643-\t\t.ncontext = 256,\n--\ndrivers/gpu/drm/i915/gt/selftest_hangcheck.c-16-\ndrivers/gpu/drm/i915/gt/selftest_hangcheck.c:17:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_hangcheck.c-18-#include \"selftests/i915_random.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_lrc.c-10-#include \"i915_drv.h\"\ndrivers/gpu/drm/i915/gt/selftest_lrc.c:11:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_lrc.c-12-#include \"intel_engine_heartbeat.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_mocs.c-7-#include \"gt/intel_gpu_commands.h\"\ndrivers/gpu/drm/i915/gt/selftest_mocs.c:8:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_mocs.c-9-\n--\ndrivers/gpu/drm/i915/gt/selftest_reset.c-10-#include \"i915_memcpy.h\"\ndrivers/gpu/drm/i915/gt/selftest_reset.c:11:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_reset.c-12-#include \"intel_gpu_commands.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_ring_submission.c-5-\ndrivers/gpu/drm/i915/gt/selftest_ring_submission.c:6:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_ring_submission.c-7-#include \"intel_engine_pm.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-19-#include \"../selftests/i915_random.h\"\ndrivers/gpu/drm/i915/gt/selftest_timeline.c:20:#include \"../i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-21-\n--\ndrivers/gpu/drm/i915/gt/selftest_timeline.c=142=static int mock_hwsp_freelist(void *arg)\n--\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-161-\tINIT_RADIX_TREE(\u0026state.cachelines, GFP_KERNEL);\ndrivers/gpu/drm/i915/gt/selftest_timeline.c:162:\tstate.prng = I915_RND_STATE_INITIALIZER(i915_selftest.random_seed);\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-163-\n--\ndrivers/gpu/drm/i915/gt/selftest_timeline.c=287=static int bench_sync(void *arg)\n--\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-302-\t */\ndrivers/gpu/drm/i915/gt/selftest_timeline.c:303:\tprandom_seed_state(\u0026prng, i915_selftest.random_seed);\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-304-\tcount = 0;\n--\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-320-\t/* Benchmark (only) setting random context ids */\ndrivers/gpu/drm/i915/gt/selftest_timeline.c:321:\tprandom_seed_state(\u0026prng, i915_selftest.random_seed);\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-322-\tcount = 0;\n--\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-336-\t/* Benchmark looking up the exact same context ids as we just set */\ndrivers/gpu/drm/i915/gt/selftest_timeline.c:337:\tprandom_seed_state(\u0026prng, i915_selftest.random_seed);\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-338-\tend_time = count;\n--\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-389-\t/* Benchmark searching for a random context id and maybe changing it */\ndrivers/gpu/drm/i915/gt/selftest_timeline.c:390:\tprandom_seed_state(\u0026prng, i915_selftest.random_seed);\ndrivers/gpu/drm/i915/gt/selftest_timeline.c-391-\tcount = 0;\n--\ndrivers/gpu/drm/i915/gt/selftest_tlb.c-11-#include \"i915_gem_ww.h\"\ndrivers/gpu/drm/i915/gt/selftest_tlb.c:12:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_tlb.c-13-#include \"i915_wait_util.h\"\n--\ndrivers/gpu/drm/i915/gt/selftest_workarounds.c-9-#include \"gt/intel_gt.h\"\ndrivers/gpu/drm/i915/gt/selftest_workarounds.c:10:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/gt/selftest_workarounds.c-11-#include \"intel_reset.h\"\n--\ndrivers/gpu/drm/i915/i915_drv.h=155=struct i915_virtual_gpu {\n--\ndrivers/gpu/drm/i915/i915_drv.h-163-\ndrivers/gpu/drm/i915/i915_drv.h:164:struct i915_selftest_stash {\ndrivers/gpu/drm/i915/i915_drv.h-165-\tatomic_t counter;\n--\ndrivers/gpu/drm/i915/i915_drv.h=169=struct drm_i915_private {\n--\ndrivers/gpu/drm/i915/i915_drv.h-319-\ndrivers/gpu/drm/i915/i915_drv.h:320:\tI915_SELFTEST_DECLARE(struct i915_selftest_stash selftest;)\ndrivers/gpu/drm/i915/i915_drv.h-321-\n--\ndrivers/gpu/drm/i915/i915_module.c-18-#include \"i915_scheduler.h\"\ndrivers/gpu/drm/i915/i915_module.c:19:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/i915_module.c-20-#include \"i915_vma.h\"\n--\ndrivers/gpu/drm/i915/i915_request.h-43-#include \"i915_scheduler.h\"\ndrivers/gpu/drm/i915/i915_request.h:44:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/i915_request.h-45-#include \"i915_sw_fence.h\"\n--\ndrivers/gpu/drm/i915/i915_selftest.h=32=struct drm_i915_private;\ndrivers/gpu/drm/i915/i915_selftest.h-33-\ndrivers/gpu/drm/i915/i915_selftest.h:34:struct i915_selftest {\ndrivers/gpu/drm/i915/i915_selftest.h-35-\tunsigned long timeout_jiffies;\n--\ndrivers/gpu/drm/i915/i915_selftest.h-47-\ndrivers/gpu/drm/i915/i915_selftest.h:48:extern struct i915_selftest i915_selftest;\ndrivers/gpu/drm/i915/i915_selftest.h-49-\n--\ndrivers/gpu/drm/i915/i915_selftest.h=121=static inline int i915_perf_selftests(struct pci_dev *pdev) { return 0; }\n--\ndrivers/gpu/drm/i915/i915_selftest.h-128-\ndrivers/gpu/drm/i915/i915_selftest.h:129:/* Using the i915_selftest_ prefix becomes a little unwieldy with the helpers.\ndrivers/gpu/drm/i915/i915_selftest.h-130- * Instead we use the igt_ shorthand, in reference to the intel-gpu-tools\n--\ndrivers/gpu/drm/i915/i915_selftest.h-134-#define IGT_TIMEOUT(name__) \\\ndrivers/gpu/drm/i915/i915_selftest.h:135:\tunsigned long name__ = jiffies + i915_selftest.timeout_jiffies\ndrivers/gpu/drm/i915/i915_selftest.h-136-\n--\ndrivers/gpu/drm/i915/i915_sw_fence.c-12-#include \"i915_sw_fence.h\"\ndrivers/gpu/drm/i915/i915_sw_fence.c:13:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/i915_sw_fence.c-14-\n--\ndrivers/gpu/drm/i915/i915_syncmap.c-29-#include \"i915_gem.h\" /* GEM_BUG_ON() */\ndrivers/gpu/drm/i915/i915_syncmap.c:30:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/i915_syncmap.c-31-\n--\ndrivers/gpu/drm/i915/intel_region_ttm.h-9-\ndrivers/gpu/drm/i915/intel_region_ttm.h:10:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/intel_region_ttm.h-11-\n--\ndrivers/gpu/drm/i915/selftests/i915_active.c-14-\ndrivers/gpu/drm/i915/selftests/i915_active.c:15:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/i915_active.c-16-\n--\ndrivers/gpu/drm/i915/selftests/i915_gem.c-15-\ndrivers/gpu/drm/i915/selftests/i915_gem.c:16:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/i915_gem.c-17-\n--\ndrivers/gpu/drm/i915/selftests/i915_gem_evict.c-31-\ndrivers/gpu/drm/i915/selftests/i915_gem_evict.c:32:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/i915_gem_evict.c-33-\n--\ndrivers/gpu/drm/i915/selftests/i915_gem_gtt.c-37-#include \"i915_random.h\"\ndrivers/gpu/drm/i915/selftests/i915_gem_gtt.c:38:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/i915_gem_gtt.c-39-#include \"i915_vma_resource.h\"\n--\ndrivers/gpu/drm/i915/selftests/i915_live_selftests.h-15- *\ndrivers/gpu/drm/i915/selftests/i915_live_selftests.h:16: * Tests are executed in order by igt/i915_selftest\ndrivers/gpu/drm/i915/selftests/i915_live_selftests.h-17- */\n--\ndrivers/gpu/drm/i915/selftests/i915_mock_selftests.h-15- *\ndrivers/gpu/drm/i915/selftests/i915_mock_selftests.h:16: * Tests are executed in order by igt/i915_selftest\ndrivers/gpu/drm/i915/selftests/i915_mock_selftests.h-17- */\n--\ndrivers/gpu/drm/i915/selftests/i915_perf.c-11-\ndrivers/gpu/drm/i915/selftests/i915_perf.c:12:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/i915_perf.c-13-\n--\ndrivers/gpu/drm/i915/selftests/i915_perf_selftests.h-15- *\ndrivers/gpu/drm/i915/selftests/i915_perf_selftests.h:16: * Tests are executed in order by igt/i915_selftest\ndrivers/gpu/drm/i915/selftests/i915_perf_selftests.h-17- */\n--\ndrivers/gpu/drm/i915/selftests/i915_random.h-30-\ndrivers/gpu/drm/i915/selftests/i915_random.h:31:#include \"../i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/i915_random.h-32-\n--\ndrivers/gpu/drm/i915/selftests/i915_random.h-39-#define I915_RND_STATE(name__) \\\ndrivers/gpu/drm/i915/selftests/i915_random.h:40:\tstruct rnd_state name__ = I915_RND_STATE_INITIALIZER(i915_selftest.random_seed)\ndrivers/gpu/drm/i915/selftests/i915_random.h-41-\n--\ndrivers/gpu/drm/i915/selftests/i915_request.c-42-#include \"i915_random.h\"\ndrivers/gpu/drm/i915/selftests/i915_request.c:43:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/i915_request.c-44-#include \"i915_wait_util.h\"\n--\ndrivers/gpu/drm/i915/selftests/i915_request.c=455=static int mock_breadcrumbs_smoketest(void *arg)\n--\ndrivers/gpu/drm/i915/selftests/i915_request.c-512-\ndrivers/gpu/drm/i915/selftests/i915_request.c:513:\tmsleep(jiffies_to_msecs(i915_selftest.timeout_jiffies));\ndrivers/gpu/drm/i915/selftests/i915_request.c-514-\n--\ndrivers/gpu/drm/i915/selftests/i915_request.c=1542=static int wait_for_all(struct drm_i915_private *i915)\n--\ndrivers/gpu/drm/i915/selftests/i915_request.c-1548-\t\t\t\t   !atomic_read(\u0026i915-\u003eselftest.counter),\ndrivers/gpu/drm/i915/selftests/i915_request.c:1549:\t\t\t\t   i915_selftest.timeout_jiffies))\ndrivers/gpu/drm/i915/selftests/i915_request.c-1550-\t\treturn 0;\n--\ndrivers/gpu/drm/i915/selftests/i915_request.c=1725=static int live_breadcrumbs_smoketest(void *arg)\n--\ndrivers/gpu/drm/i915/selftests/i915_request.c-1824-\ndrivers/gpu/drm/i915/selftests/i915_request.c:1825:\tmsleep(jiffies_to_msecs(i915_selftest.timeout_jiffies));\ndrivers/gpu/drm/i915/selftests/i915_request.c-1826-\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-33-#include \"i915_jiffies.h\"\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:34:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-35-#include \"i915_wait_util.h\"\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-37-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:38:struct i915_selftest i915_selftest __read_mostly = {\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-39-\t.timeout_ms = 500,\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c=222=static int __run_selftests(const char *name,\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-230-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:231:\tif (i915_selftest.userspace_pid)\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:232:\t\tu_pid_nr = i915_selftest.userspace_pid;\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-233-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:234:\twhile (!i915_selftest.random_seed)\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:235:\t\ti915_selftest.random_seed = get_random_u32();\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-236-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:237:\ti915_selftest.timeout_jiffies =\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:238:\t\ti915_selftest.timeout_ms ?\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:239:\t\tmsecs_to_jiffies_timeout(i915_selftest.timeout_ms) :\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-240-\t\tMAX_SCHEDULE_TIMEOUT;\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-244-\tpr_info(DRIVER_NAME \": Performing %s selftests with st_random_seed=0x%x st_timeout=%u\\n\",\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:245:\t\tname, i915_selftest.random_seed, i915_selftest.timeout_ms);\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-246-\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c=305=int i915_mock_selftests(void)\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-308-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:309:\tif (!i915_selftest.mock)\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-310-\t\treturn 0;\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-313-\tif (err) {\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:314:\t\ti915_selftest.mock = err;\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-315-\t\treturn 1;\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-317-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:318:\tif (i915_selftest.mock \u003c 0) {\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:319:\t\ti915_selftest.mock = -ENOTTY;\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-320-\t\treturn 1;\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c=326=int i915_live_selftests(struct pci_dev *pdev)\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-333-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:334:\tif (!i915_selftest.live)\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-335-\t\treturn 0;\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-354-\tif (err) {\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:355:\t\ti915_selftest.live = err;\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-356-\t\treturn err;\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-358-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:359:\tif (i915_selftest.live \u003c 0) {\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:360:\t\ti915_selftest.live = -ENOTTY;\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-361-\t\treturn 1;\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c=367=int i915_perf_selftests(struct pci_dev *pdev)\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-371-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:372:\tif (!i915_selftest.perf)\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-373-\t\treturn 0;\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-379-\tif (err) {\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:380:\t\ti915_selftest.perf = err;\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-381-\t\treturn err;\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-383-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:384:\tif (i915_selftest.perf \u003c 0) {\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:385:\t\ti915_selftest.perf = -ENOTTY;\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-386-\t\treturn 1;\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c=392=static bool apply_subtest_filter(const char *caller, const char *name)\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-396-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:397:\tfilter = kstrdup(i915_selftest.filter, GFP_KERNEL);\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-398-\tfor (sep = filter; (tok = strsep(\u0026sep, \",\"));) {\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c=548=void igt_hexdump(const void *buf, size_t len)\n--\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-576-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:577:module_param_named(st_random_seed, i915_selftest.random_seed, uint, 0400);\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:578:module_param_named(st_timeout, i915_selftest.timeout_ms, uint, 0400);\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:579:module_param_named(st_filter, i915_selftest.filter, charp, 0400);\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:580:module_param_named(st_userspace_pid, i915_selftest.userspace_pid, uint, 0400);\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-581-MODULE_PARM_DESC(st_userspace_pid, \"For usage in tests that map userspace memory and require address space with controllable lifetime.\");\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-582-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:583:module_param_named_unsafe(mock_selftests, i915_selftest.mock, int, 0400);\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-584-MODULE_PARM_DESC(mock_selftests, \"Run selftests before loading, using mock hardware (0:disabled [default], 1:run tests then load driver, -1:run tests...\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-585-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:586:module_param_named_unsafe(live_selftests, i915_selftest.live, int, 0400);\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-587-MODULE_PARM_DESC(live_selftests, \"Run selftests after driver initialisation on the live system (0:disabled [default], 1:run tests then continue, -1:r...\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-588-\ndrivers/gpu/drm/i915/selftests/i915_selftest.c:589:module_param_named_unsafe(perf_selftests, i915_selftest.perf, int, 0400);\ndrivers/gpu/drm/i915/selftests/i915_selftest.c-590-MODULE_PARM_DESC(perf_selftests, \"Run performance orientated selftests after driver initialisation on the live system (0:disabled [default], 1:run te...\n--\ndrivers/gpu/drm/i915/selftests/i915_sw_fence.c-28-\ndrivers/gpu/drm/i915/selftests/i915_sw_fence.c:29:#include \"../i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/i915_sw_fence.c-30-\n--\ndrivers/gpu/drm/i915/selftests/i915_sw_fence.c=579=static int test_timer(void *arg)\n--\ndrivers/gpu/drm/i915/selftests/i915_sw_fence.c-592-\ndrivers/gpu/drm/i915/selftests/i915_sw_fence.c:593:\tfor_each_prime_number(delay, i915_selftest.timeout_jiffies/2) {\ndrivers/gpu/drm/i915/selftests/i915_sw_fence.c-594-\t\tpreempt_disable();\n--\ndrivers/gpu/drm/i915/selftests/i915_sw_fence.c=669=static int test_dma_fence(void *arg)\n--\ndrivers/gpu/drm/i915/selftests/i915_sw_fence.c-671-\tstruct i915_sw_fence *timeout = NULL, *not = NULL;\ndrivers/gpu/drm/i915/selftests/i915_sw_fence.c:672:\tunsigned long delay = i915_selftest.timeout_jiffies;\ndrivers/gpu/drm/i915/selftests/i915_sw_fence.c-673-\tunsigned long end, sleep;\n--\ndrivers/gpu/drm/i915/selftests/i915_syncmap.c-24-\ndrivers/gpu/drm/i915/selftests/i915_syncmap.c:25:#include \"../i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/i915_syncmap.c-26-#include \"i915_random.h\"\n--\ndrivers/gpu/drm/i915/selftests/i915_vma.c-31-#include \"i915_scatterlist.h\"\ndrivers/gpu/drm/i915/selftests/i915_vma.c:32:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/i915_vma.c-33-\n--\ndrivers/gpu/drm/i915/selftests/igt_flush_test.c-10-#include \"i915_drv.h\"\ndrivers/gpu/drm/i915/selftests/igt_flush_test.c:11:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/igt_flush_test.c-12-\n--\ndrivers/gpu/drm/i915/selftests/igt_live_test.c-10-\ndrivers/gpu/drm/i915/selftests/igt_live_test.c:11:#include \"../i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/igt_live_test.c-12-#include \"igt_flush_test.h\"\n--\ndrivers/gpu/drm/i915/selftests/igt_spinner.h-14-#include \"i915_request.h\"\ndrivers/gpu/drm/i915/selftests/igt_spinner.h:15:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/igt_spinner.h-16-\n--\ndrivers/gpu/drm/i915/selftests/intel_memory_region.c-10-\ndrivers/gpu/drm/i915/selftests/intel_memory_region.c:11:#include \"../i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/intel_memory_region.c-12-\n--\ndrivers/gpu/drm/i915/selftests/intel_scheduler_helpers.c-10-#include \"i915_drv.h\"\ndrivers/gpu/drm/i915/selftests/intel_scheduler_helpers.c:11:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/intel_scheduler_helpers.c-12-\n--\ndrivers/gpu/drm/i915/selftests/intel_uncore.c-24-\ndrivers/gpu/drm/i915/selftests/intel_uncore.c:25:#include \"../i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/intel_uncore.c-26-\n--\ndrivers/gpu/drm/i915/selftests/scatterlist.c-26-\ndrivers/gpu/drm/i915/selftests/scatterlist.c:27:#include \"i915_selftest.h\"\ndrivers/gpu/drm/i915/selftests/scatterlist.c-28-#include \"i915_utils.h\"\n--\ndrivers/gpu/drm/i915/selftests/scatterlist.c=278=static int igt_sg_alloc(void *ignored)\n--\ndrivers/gpu/drm/i915/selftests/scatterlist.c-297-\t\t\t\tprandom_seed_state(\u0026prng,\ndrivers/gpu/drm/i915/selftests/scatterlist.c:298:\t\t\t\t\t\t   i915_selftest.random_seed);\ndrivers/gpu/drm/i915/selftests/scatterlist.c-299-\t\t\t\terr = alloc_table(\u0026pt, sz, sz, *npages, \u0026prng,\n--\ndrivers/gpu/drm/i915/selftests/scatterlist.c-306-\t\t\t\tprandom_seed_state(\u0026prng,\ndrivers/gpu/drm/i915/selftests/scatterlist.c:307:\t\t\t\t\t\t   i915_selftest.random_seed);\ndrivers/gpu/drm/i915/selftests/scatterlist.c-308-\t\t\t\terr = expect_pfn_sgtable(\u0026pt, *npages, \u0026prng,\n--\ndrivers/gpu/drm/i915/selftests/scatterlist.c=325=static int igt_sg_trim(void *ignored)\n--\ndrivers/gpu/drm/i915/selftests/scatterlist.c-339-\ndrivers/gpu/drm/i915/selftests/scatterlist.c:340:\t\t\tprandom_seed_state(\u0026prng, i915_selftest.random_seed);\ndrivers/gpu/drm/i915/selftests/scatterlist.c-341-\t\t\terr = alloc_table(\u0026pt, prime, max, *npages, \u0026prng,\n--\ndrivers/gpu/drm/i915/selftests/scatterlist.c-355-\t\t\t\t\tprandom_seed_state(\u0026prng,\ndrivers/gpu/drm/i915/selftests/scatterlist.c:356:\t\t\t\t\t\t\t   i915_selftest.random_seed);\ndrivers/gpu/drm/i915/selftests/scatterlist.c-357-\t\t\t\t\terr = expect_pfn_sgtable(\u0026pt,\n"
}

21/2 2026/09/14 11:59 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 39006
							output: 52
							thoughts: 143
						

Thoughts:
**Analyzing the i915 Selftest Parameter**

Okay, so I'm looking at this `module_param_named_unsafe` declaration: `mock_selftests, i915_selftest.mock, int, 0400`. Right, it looks like it's setting up an option to run selftests for the i915 driver. The description says it lets you run these tests using "mock hardware". The parameter itself, `i915.mock_selftests`, seems pretty straightforward: `0` disables it (which is the default, makes sense), `1` runs the tests before loading the driver, and `-1` runs the tests and then exits. 

This is clearly an internal framework, for unit tests specifically. I'm assuming it's for i915, because it's in the `i915_selftest` namespace. But I want to be certain about its exact behavior. Specifically, I'm trying to determine whether this creates a device node or some character device, or opens itself up to userland interaction with any fuzzers. To understand how it truly works, I need to check the `i915_mock_selftests()` function itself and see what it actually does.



22/2 2026/09/14 11:59 tool read-file
0m Args:
{
  "File": "drivers/gpu/drm/i915/selftests/i915_selftest.c",
  "FirstLine": 300,
  "LineCount": 35
}

Results:
{
  "Contents": " 300:\t}\n 301:\t\n 302:\t#define run_selftests(x, data) \\\n 303:\t\t__run_selftests(#x, x##_selftests, ARRAY_SIZE(x##_selftests), data)\n 304:\t\n 305:\tint i915_mock_selftests(void)\n 306:\t{\n 307:\t\tint err;\n 308:\t\n 309:\t\tif (!i915_selftest.mock)\n 310:\t\t\treturn 0;\n 311:\t\n 312:\t\terr = run_selftests(mock, NULL);\n 313:\t\tif (err) {\n 314:\t\t\ti915_selftest.mock = err;\n 315:\t\t\treturn 1;\n 316:\t\t}\n 317:\t\n 318:\t\tif (i915_selftest.mock \u003c 0) {\n 319:\t\t\ti915_selftest.mock = -ENOTTY;\n 320:\t\t\treturn 1;\n 321:\t\t}\n 322:\t\n 323:\t\treturn 0;\n 324:\t}\n 325:\t\n 326:\tint i915_live_selftests(struct pci_dev *pdev)\n 327:\t{\n 328:\t\tstruct drm_i915_private *i915 = pdev_to_i915(pdev);\n 329:\t\tstruct intel_uncore *uncore = \u0026i915-\u003euncore;\n 330:\t\tint err;\n 331:\t\tu32 pg_enable;\n 332:\t\tintel_wakeref_t wakeref;\n 333:\t\n 334:\t\tif (!i915_selftest.live)\n"
}

23/2 2026/09/14 11:59 llm patch-evaluator
0m Model:
gemini-3.8-flash

Args:
null

Results:
null

Tokens:
							input: 39983
							output: 130
							thoughts: 1183
						

Thoughts:
**Analysis of Fuzzing Worthiness**

Okay, let's break this down. First, `mock_selftests` are internal and don't create a DRM device, which isn't relevant here anyway. `i915_pci_probe` needs Intel PCI hardware.  The key is the criteria for *not* fuzzing, as outlined in section 2 of the system prompt. Specifically, I'm focusing on the condition related to structurally unreachable hardware.

The primary change is in `drivers/gpu/drm/i915/gem/i915_gem_shmem.c`, specifically the `__shmem_writeback` function. I need to determine if `drm/i915` falls under the "structurally unreachable hardware" category.  The prompt explicitly lists examples like `amdgpu` which also need dedicated hardware to test in a meaningful way.

Yes, `drm/i915` *is* Intel's GPU driver, supporting Intel integrated and discrete GPUs. This is vendor-specific, requiring Intel hardware, and crucially, it won't run correctly in standard QEMU or GCE VMs. I double-checked; the code is *entirely* contained within `drivers/gpu/drm/i915/`. No other callers outside the `drm/i915` driver.

Since the modified code is within a driver that needs specific, non-emulated hardware, it's structurally unreachable in our standard fuzzing setup. Therefore, I can confidently set:

*   `WorthFuzzing = false`
*   `FocusSymbols = []`
*   `EnableConfigs = []`

The reasoning is concise and clear: the modification is within the Intel i915 DRM driver, which requires physical Intel GPU hardware that is not emulated in standard QEMU or GCE environments. Thus, the code path is structurally unreachable for fuzzing. All set.



24/2 2026/09/14 11:59 tool set-results
0m Args:
{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch modifies `__shmem_writeback` in `drivers/gpu/drm/i915/gem/i915_gem_shmem.c`, which is part of the Intel i915 GPU driver. i915 is a vendor-specific GPU driver requiring physical Intel graphics hardware not emulated in standard QEMU or virtualized cloud environments (GCE). Consequently, the modified code is structurally unreachable for syzkaller fuzzing.",
  "WorthFuzzing": false
}

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch modifies `__shmem_writeback` in `drivers/gpu/drm/i915/gem/i915_gem_shmem.c`, which is part of the Intel i915 GPU driver. i915 is a vendor-specific GPU driver requiring physical Intel graphics hardware not emulated in standard QEMU or virtualized cloud environments (GCE). Consequently, the modified code is structurally unreachable for syzkaller fuzzing.",
  "WorthFuzzing": false
}

25/1 2026/09/14 11:59 action If
0m Args:
{
  "WorthFuzzing": false
}

Results:
null

LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)