syzbot

Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. , Status: RESOURCE_EXHAUSTED, Details: [map[@type:type.googleapis.com/google.rpc.Help links:[map[description:Learn more about Gemini API quotas url:https://ai.google.dev/gemini-api/docs/rate-limits]]] map[@type:type.googleapis.com/google.rpc.DebugInfo detail:[ORIGINAL ERROR] generic::resource_exhausted: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit.  [google.rpc.error_details_ext] { message: "You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. " details { type_url: "type.googleapis.com/language_labs.genai.debug.GeminiApiDebugInfo" value: "R\212\001\n\207\001\nTgenerativelanguage.googleapis.com/generate_content_paid_tier_1_input_tokens_internal\022\022\n\010location\022\006global\022\027\n\005model\022\016gemini-3.1-pro\030\300\204=" } details { [type.googleapis.com/google.rpc.Help] { links { description: "Learn more about Gemini API quotas" url: "https://ai.google.dev/gemini-api/docs/rate-limits" } } } }]]

map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/ec9e25b392423d2a117ee1d291abb801b14e649f]

map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/8dcf2ce4d7946b0fb65017066c5b58037e3d6bdc]

map[Index:codesearch-index]

gemini-3-pro-preview

Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. , Status: RESOURCE_EXHAUSTED, Details: [map[@type:type.googleapis.com/google.rpc.Help links:[map[description:Learn more about Gemini API quotas url:https://ai.google.dev/gemini-api/docs/rate-limits]]] map[@type:type.googleapis.com/google.rpc.DebugInfo detail:[ORIGINAL ERROR] generic::resource_exhausted: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit.  [google.rpc.error_details_ext] { message: "You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. " details { type_url: "type.googleapis.com/language_labs.genai.debug.GeminiApiDebugInfo" value: "R\212\001\n\207\001\nTgenerativelanguage.googleapis.com/generate_content_paid_tier_1_input_tokens_internal\022\022\n\010location\022\006global\022\027\n\005model\022\016gemini-3.1-pro\030\300\204=" } details { [type.googleapis.com/google.rpc.Help] { links { description: "Learn more about Gemini API quotas" url: "https://ai.google.dev/gemini-api/docs/rate-limits" } } } }]]

You are an expert in the Linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug.
In the final output provide only the syz program that triggers the bug, and could be executed directly,
without backticks.

Don't make assumptions about the kernel source code, use the provided codesearch tools
to examine the kernel code instead.

Document about syzkaller program syntax:
===
# Program syntax

Syzkaller uses a compact domain-specific language (DSL) for programs
to log executed programs, test its code, and persist programs in the
corpus. This page provides a brief description of the corresponding
syntax. Some useful information can also be found in the
[existing examples](/sys/linux/test) and in the program
[deserialization code](/prog/encoding.go).

Together with execution options, the DSL provides everything that
syz-executor needs to run a program.

For example, consider the program:
```
r0 = syz_open_dev$loop(&(0x7f00000011c0), 0x0, 0x0)
r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, r1)
```

Each line in this program describes a particular syscall invocation,
with the first two calls saving the result in temporary variables `r0`
and `r1`, which are passed to the third call.

```
line = assignment | call
assignment = variable " = " call
call = syscall-name "(" [arg ["," arg]*] ")"  ["(" [call-prop ["," call-prop*] ")"]
arg = "nil" | "AUTO" | const-arg | resource-arg | result-arg | pointer-arg | string-arg | struct-arg | array-arg | union-arg
const-arg = "0x" hex-integer
resource-arg = variable ["/" hex-integer] ["+" hex-integer]
result-arg = "<" variable "=>" arg
pointer-arg = "&" pointer-arg-addr ["=ANY"] "=" arg
pointer-arg-addr = "AUTO" | "(" pointer-addr ["/" region-size] ")"
string-arg = "'" escaped-string "'" | "\"" escaped-string "\"" | "\"$" escaped-string "\""
struct-arg =  "{" [arg ["," arg]*] "}"
array-arg = "[" [arg ["," arg]*] "]"
union-arg = "@" field-name ["=" arg]
call-prop = prop-name ": " prop-value
variable = "r" dec-integer
pointer-addr = hex-integer
region-size = hex-integer
```

Programs may also contain blank lines and comments.
```
# Obtain a file handle
r0 = openat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x42, 0x1ff)

# Perform a write operation
write(r0, &AUTO="01010101", 0x4)
```

### Memory management

Memory management is performed by syzkaller itself. It will allocate
virtual memory regions of the necessary size and set the final values
of pointer arguments.

By using the `AUTO` keyword, programs can give syzkaller the full
control over storing the data. This may be convenient e.g. when a
parameter must be passed by reference, but the exact location of its
value is not of particular importance.

```
r1 = syz_genetlink_get_family_id$nl80211(&AUTO='nl80211\x00', 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &AUTO={'wlan0\x00', <r2=>0x0})
```

Alternatively, some data can be "anchored" to specific addresses. It
may be especially important when a memory region must be shared
between multiple calls.  In this case, pointer addresses must be given
at the 0x7f0000000000 offset. Before the actual execution, syzkaller
will adjust pointers to the start of the actual mmap'ed region.

### Call properties

Call properties specify extra information about how a specific call
must be executed. Each call within a program has its own set of call
properties. If no properties are provided, syzkaller takes the default
ones.

Currently, syzkaller supports the following call properties.

#### Fault injection
Syntax: `fail_nth: N`.

It takes an integer (base 10) argument `N`. If the argument is
non-negative, a fault will be injected into the `N`-th occasion.

```
r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, r0) (fail_nth: 5)
```

#### Async
Syntax: `async`.

Instructs `syz-executor` not to wait until the call completes and
to proceed immediately to the next call.

```
r0 = openat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x42, 0x1ff)
write(r0, &AUTO="01010101", 0x4) (async)
read(r0, &AUTO=""/4, 0x4)
close(r0)
```

When setting `async` flags be aware of the following considerations:
* Such programs should only be executed in threaded mode (i.e. `-threaded`
flag must be passed to `syz-executor`.
* Each `async` call is executed in a separate thread and there's a
limited number of available threads (`kMaxThreads = 16`).
* If an `async` call produces a resource, keep in mind that some other call
might take it as input and `syz-executor` will just pass 0 if the resource-
producing call has not finished by that time.

===

Document about syzlang system call descriptions syntax:
===
# Syscall description language

aka `syzlang` (`[siːzˈlæŋg]`)

Pseudo-formal grammar of syscall description:

```
syscallname "(" [arg ["," arg]*] ")" [type] ["(" attribute* ")"]
arg = argname type
argname = identifier
type = typename [ "[" type-options "]" ]
typename = "const" | "intN" | "intptr" | "flags" | "array" | "ptr" |
	   "string" | "filename" | "glob" | "len" |
	   "bytesize" | "bytesizeN" | "bitsize" | "vma" | "proc" |
	   "compressed_image"
type-options = [type-opt ["," type-opt]]
```

common type-options include:

```
"opt" - the argument is optional (like mmap fd argument, or accept peer argument)
```

rest of the type-options are type-specific:

```
"const": integer constant, type-options:
	value, underlying type (one of "intN", "intptr")
"intN"/"intptr": an integer without a particular meaning, type-options:
	either an optional range of values (e.g. "5:10", or "100:200")
	or a reference to flags description (see below),
	or a single value
	optionally followed by an alignment parameter if using a range
"flags": a set of values, type-options:
	reference to flags description (see below), underlying int type (e.g. "int32")
"array": a variable/fixed-length array, type-options:
	type of elements, optional size (fixed "5", or ranged "5:10", boundaries inclusive)
"ptr"/"ptr64": a pointer to an object, type-options:
	direction (in/out/inout); type of the object
	ptr64 has size of 8 bytes regardless of target pointer size
"string": a zero-terminated memory buffer (no pointer indirection implied), type-options:
	either a string value in quotes for constant strings (e.g. "foo" or `deadbeef` for hex literal),
	or a reference to string flags (special value `filename` produces file names),
	optionally followed by a buffer size (string values will be padded with \x00 to that size)
"stringnoz": a non-zero-terminated memory buffer (no pointer indirection implied), type-options:
	either a string value in quotes for constant strings (e.g. "foo" or `deadbeef` for hex literal),
	or a reference to string flags,
"glob": glob pattern to match on the target files, type-options:
	a pattern string in quotes (syntax: https://golang.org/pkg/path/filepath/#Match)
	(e.g. "/sys/" or "/sys/**/*"),
	or include exclude glob too (e.g. "/sys/**/*:-/sys/power/state")
"fmt": a string representation of an integer (not zero-terminated), type-options:
	format (one of "dec", "hex", "oct") and the value (a resource, int, flags or proc)
	the resulting data is always fixed-size (formatted as "%020llu", "0x%016llx" or "%023llo", respectively)
"len": length of another field (for array it is number of elements), type-options:
	argname of the object
"bytesize": similar to "len", but always denotes the size in bytes, type-options:
	argname of the object
"bitsize": similar to "len", but always denotes the size in bits, type-options:
	argname of the object
"offsetof": offset of the field from the beginning of the parent struct, type-options:
	field
"vma"/"vma64": a pointer to a set of pages (used as input for mmap/munmap/mremap/madvise), type-options:
	optional number of pages (e.g. vma[7]), or a range of pages (e.g. vma[2-4])
	vma64 has size of 8 bytes regardless of target pointer size
"proc": per process int (see description below), type-options:
	value range start, how many values per process, underlying type
"compressed_image": zlib-compressed disk image
	syscalls accepting compressed images must be marked with `no_generate`
	and `no_minimize` call attributes. if the content of the decompressed image
	can be checked by a `fsck`-like command, use the `fsck` syscall attribute
"text": machine code of the specified type, type-options:
	text type (x86_real, x86_16, x86_32, x86_64, arm64)
"void": type with static size 0
	mostly useful inside of templates and varlen unions, can't be syscall argument
```

flags/len/flags also have trailing underlying type type-option when used in structs/unions/pointers.

Flags are described as:

```
flagname = const ["," const]*
```

or for string flags as:

```
flagname = "\"" literal "\"" ["," "\"" literal "\""]*
```

Call attributes are:

```
"disabled": the call will not be used in fuzzing; useful to temporary disable some calls
	or prohibit particular argument combinations.
"timeout[N]": additional execution timeout (in ms) for the call on top of some default value.
"prog_timeout[N]": additional execution timeout (in ms) for the whole program if it contains this call;
	if a program contains several such calls, the max value is used.
"ignore_return": ignore return value of this syscall in fallback feedback; need to be used for calls
	that don't return fixed error codes but rather something else (e.g. the current time).
"breaks_returns": ignore return values of all subsequent calls in the program in fallback feedback (can't be trusted).
"no_generate": do not try to generate this syscall, i.e. use only seed descriptions to produce it.
"no_minimize": do not modify instances of this syscall when trying to minimize a crashing program.
"no_squash": do not attempt to pass squashed arguments to this syscall.
	Without that, the fuzzer will sometimes attempt to replace complex structures with arrays of bytes,
	possibly triggering interesting mutations, but also making programs hard to reason about.
"fsck": the content of the compressed buffer argument for this syscall is a file system and the
	string argument is a fsck-like command that will be called to verify the filesystem.
"remote_cover": wait longer to collect remote coverage for this call.
"kfuzz_test": the call is a kfuzztest target.
"snapshot": the call is enabled by default only in snapshot fuzzing mode, but can also be enabled in
    the non-snasphot mode when listed in "enable_syscalls" with its full name (as opposed to a wildcard match).
    It can also always be disabled via "disable_syscalls".
    The attribute is generally used to mark calls that are not safe to execute in non-snapshot mode
	(can lead to false positives, or lost connections to test machines.
```

## Ints

`int8`, `int16`, `int32` and `int64` denote an integer of the corresponding size.
`intptr` denotes a pointer-sized integer, i.e. C `long` type.

By appending `be` suffix (e.g. `int16be`) integers become big-endian.

It's possible to specify a range of values for an integer in the format of `int32[0:100]` or `int32[0:4096, 512]` for a 512-aligned int.

Integers can also take a reference to flags description or a value as its first type-option.
In that case, the alignment parameter is not supported.

To denote a bitfield of size N use `int64:N`.

It's possible to use these various kinds of ints as base types for `const`, `flags`, `len` and `proc`.

```
example_struct {
	f0	int8			# random 1-byte integer
	f1	const[0x42, int16be]	# const 2-byte integer with value 0x4200 (big-endian 0x42)
	f2	int32[0:100]		# random 4-byte integer with values from 0 to 100 inclusive
	f3	int32[1:10, 2]		# random 4-byte integer with values {1, 3, 5, 7, 9}
	f4	int64:20		# random 20-bit bitfield
	f5	int8[10]		# const 1-byte integer with value 10
	f6	int32[flagname]		# random 4-byte integer from the set of values referenced by flagname
}
```

## Structs

Structs are described as:

```
structname "{" "\n"
	(fieldname type ("(" fieldattribute* ")")? (if[expression])? "\n")+
"}" ("[" attribute* "]")?
```

Fields can have attributes specified in parentheses after the field, independent
of their type. `in/out/inout` attribute specify per-field direction, for example:

```
foo {
	field0	const[1, int32]	(in)
	field1	int32		(inout)
	field2	fd		(out)
}
```

You may specify conditions that determine whether a field will be included:

```
foo {
	field0	int32
	field1	int32 (if[value[field0] == 0x1])
}
```

See [the corresponding section](syscall_descriptions_syntax.md#conditional-fields)
for more details.

`out_overlay` attribute allows to have separate input and output layouts for the struct.
Fields before the `out_overlay` field are input, fields starting from `out_overlay` are output.
Input and output fields overlap in memory (both start from the beginning of the struct in memory).
For example:

```
foo {
	in0	const[1, int32]
	in1	flags[bar, int8]
	in2	ptr[in, string]
	out0	fd	(out_overlay)
	out1	int32
}
```

Structs can have attributes specified in square brackets after the struct.
Attributes are:

- `packed`: the struct does not have paddings between fields and has alignment 1; this is similar to GNU C `__attribute__((packed))`; struct alignment can be overridden with `align` attribute
- `align[N]`: the struct has alignment N and padded up to multiple of `N`; contents of the padding are unspecified (though, frequently are zeros); similar to GNU C `__attribute__((aligned(N)))`
- `size[N]`: the struct is padded up to the specified size `N`; contents of the padding are unspecified (though, frequently are zeros)

## Unions

Unions are described as:

```
unionname "[" "\n"
	(fieldname type (if[expression])? "\n")+
"]" ("[" attribute* "]")?
```

During fuzzing, syzkaller randomly picks one of the union options.

You may also specify conditions that determine whether the corresponding
option may or may not be selected, depending on values of other fields. See
[the corresponding section](syscall_descriptions_syntax.md#conditional-fields)
for more details.

Unions can have attributes specified in square brackets after the union.
Attributes are:

- `varlen`: union size is the size of the particular chosen option (not statically known); without this attribute unions are statically sized as maximum of all options (similar to C unions)
- `size[N]`: the union is padded up to the specified size `N`; contents of the padding are unspecified (though, frequently are zeros)

## Resources

Resources represent values that need to be passed from output of one syscall to input of another syscall. For example, `close` syscall requires an input value (fd) previously returned by `open` or `pipe` syscall. To achieve this, `fd` is declared as a resource. This is a way of modelling dependencies between syscalls, as defining a syscall as the producer of a resource and another syscall as the consumer defines a loose sense of ordering between them. Resources are described as:

```
"resource" identifier "[" underlying_type "]" [ ":" const ("," const)* ]
```

`underlying_type` is either one of `int8`, `int16`, `int32`, `int64`, `intptr` or another resource (which models inheritance, for example, a socket is a subtype of fd). The optional set of constants represent resource special values, for example, `0xffffffffffffffff` (-1) for "no fd", or `AT_FDCWD` for "the current dir". Special values are used once in a while as resource values. If no special values specified, special value of `0` is used. Resources can then be used as types, for example:

```
resource fd[int32]: 0xffffffffffffffff, AT_FDCWD, 1000000
resource sock[fd]
resource sock_unix[sock]

socket(...) sock
accept(fd sock, ...) sock
listen(fd sock, backlog int32)
```

Resources don't have to be necessarily returned by a syscall. They can be used as any other data type. For example:

```
resource my_resource[int32]

request_producer(..., arg ptr[out, my_resource])
request_consumer(..., arg ptr[inout, test_struct])

test_struct {
	...
	attr	my_resource
}
```

For more complex producer/consumer scenarios, field attributes can be utilized.
For example:

```
resource my_resource_1[int32]
resource my_resource_2[int32]

request_produce1_consume2(..., arg ptr[inout, test_struct])

test_struct {
	...
	field0	my_resource_1	(out)
	field1	my_resource_2	(in)
}
```

Each resource type must be "produced" (used as an output) by at least one syscall
(outside of unions and optional pointers) and "consumed" (used as an input)
by at least one syscall.

## Type Aliases

Complex types that are often repeated can be given short type aliases using the
following syntax:

```
type identifier underlying_type
```

For example:

```
type signalno int32[0:65]
type net_port proc[20000, 4, int16be]
```

Then, type alias can be used instead of the underlying type in any contexts.
Underlying type needs to be described as if it's a struct field, that is,
with the base type if it's required. However, type alias can be used as syscall
arguments as well. Underlying types are currently restricted to integer types,
`ptr`, `ptr64`, `const`, `flags` and `proc` types.

There are some builtin type aliases:

```
type bool8	int8[0:1]
type bool16	int16[0:1]
type bool32	int32[0:1]
type bool64	int64[0:1]
type boolptr	intptr[0:1]

type fileoff[BASE] BASE

type filename string[filename]

type buffer[DIR] ptr[DIR, array[int8]]
```

## Type Templates

Type templates can be declared as follows:

```
type buffer[DIR] ptr[DIR, array[int8]]
type fileoff[BASE] BASE
type nlattr[TYPE, PAYLOAD] {
	nla_len		len[parent, int16]
	nla_type	const[TYPE, int16]
	payload		PAYLOAD
} [align_4]
```

and later used as follows:

```
syscall(a buffer[in], b fileoff[int64], c ptr[in, nlattr[FOO, int32]])
```

There is builtin type template `optional` defined as:

```
type optional[T] [
	val	T
	void	void
] [varlen]
```

## Length

You can specify length of a particular field in struct or a named argument by
using `len`, `bytesize` and `bitsize` types, for example:

```
write(fd fd, buf ptr[in, array[int8]], count len[buf])

sock_fprog {
	len	len[filter, int16]
	filter	ptr[in, array[sock_filter]]
}
```

If `len`'s argument is a pointer, then the length of the pointee argument is used.

To denote the length of a field in N-byte words use `bytesizeN`, possible values
for N are 1, 2, 4 and 8.

To denote the length of the parent struct, you can use `len[parent, int8]`.
To denote the length of the higher level parent when structs are embedded into
one another, you can specify the type name of the particular parent:

```
s1 {
    f0      len[s2]  # length of s2
}

s2 {
    f0      s1
    f1      array[int32]
    f2      len[parent, int32]
}
```

`len` argument can also be a path expression which allows more complex
addressing. Path expressions are similar to C field references, but also allow
referencing parent and sibling elements. A special reference `syscall` used
in the beginning of the path allows to refer directly to the syscall arguments.
For example:

```
s1 {
	a	ptr[in, s2]
	b	ptr[in, s3]
	c	array[int8]
}

s2 {
	d	array[int8]
}

s3 {
# This refers to the array c in the parent s1.
	e	len[s1:c, int32]
# This refers to the array d in the sibling s2.
	f	len[s1:a:d, int32]
# This refers to the array k in the child s4.
	g	len[i:j, int32]
# This refers to syscall argument l.
	h	len[syscall:l, int32]
	i	ptr[in, s4]
}

s4 {
	j	array[int8]
}

foo(k ptr[in, s1], l ptr[in, array[int8]])
```

## Proc

The `proc` type can be used to denote per process integers.
The idea is to have a separate range of values for each executor, so they don't interfere.

The simplest example is a port number.
The `proc[20000, 4, int16be]` type means that we want to generate an `int16be`
integer starting from `20000` and assign `4` values for each process.
As a result the executor number `n` will get values in the `[20000 + n * 4, 20000 + (n + 1) * 4)` range.

## Integer Constants

Integer constants can be specified as decimal literals, as `0x`-prefixed
hex literals, as `'`-surrounded char literals, or as symbolic constants
extracted from kernel headers or defined by `define` directives. For example:

```
foo(a const[10], b const[-10])
foo(a const[0xabcd])
foo(a int8['a':'z'])
foo(a const[PATH_MAX])
foo(a int32[PATH_MAX])
foo(a ptr[in, array[int8, MY_PATH_MAX]])
define MY_PATH_MAX	PATH_MAX + 2
```

## Conditional fields

### In structures

In syzlang, it's possible to specify a condition for every struct field that
determines whether the field should be included or omitted:

```
header_fields {
  magic       const[0xabcd, int16]
  haveInteger int8
} [packed]

packet {
  header  header_fields
  integer int64  (if[value[header:haveInteger] == 0x1])
  body    array[int8]
} [packed]

some_call(a ptr[in, packet])
```

In this example, the `packet` structure will include the field `integer` only
if `header.haveInteger == 1`. In memory, `packet` will have the following
layout:

| header.magic = 0xabcd | header.haveInteger = 0x1 | integer | body |
| --------------------- | ------------------------ | ------- | ---- |

That corresponds to e.g. the following program:

```
some_call(&AUTO={{AUTO, 0x1}, @value=0xabcd, []})
```

If `header.haveInteger` is not `1`, syzkaller will just pretend that the field
`integer` does not exist.

```
some_call(&AUTO={{AUTO, 0x0}, @void, []})
```

| header.magic = 0xabcd | header.haveInteger = 0x0 | body |
| --------------------- | ------------------------ | ---- |

Every conditional field is assumed to be of variable length and so is the struct
to which this field belongs.

When a variable length field appears in the middle of a structure, the structure
must be marked with `[packed].`

Conditions on bitfields are prohibited:

```
struct {
  f0 int
  f1 int:3 (if[value[f0] == 0x1])  # It will not compile.
}
```

But you may reference bitfields in your conditions:

```
struct {
  f0 int:1
  f1 int:7
  f2 int   (if[value[f0] == value[f1]])
} [packed]
```

### In unions

Let's consider the following example.

```
struct {
  type int
  body alternatives
}

alternatives [
  int     int64 (if[value[struct:type] == 0x1])
  arr     array[int64, 5] (if[value[struct:type] == 0x2])
  default int32
] [varlen]

some_call(a ptr[in, struct])
```

In this case, the union option will be selected depending on the value of the
`type` field. For example, if `type` is `0x1`, then it can be either `int` or
`default`:

```
some_call(&AUTO={0x1, @int=0x123})
some_call(&AUTO={0x1, @default=0x123})
```

If `type` is `0x2`, it can be either `arr` or `default`.

If `type` is neither `0x1` nor `0x2`, syzkaller may only select `default`:

```
some_call(&AUTO={0x0, @default=0xabcd})
```

To ensure that a union can always be constructed, the last union field **must always
have no condition**.

Thus, the following definition would fail to compile:

```
alternatives [
  int int64 (if[value[struct:type] == 0x1])
  arr array[int64, 5] (if[value[struct:type] == 0x1])
] [varlen]
```

During prog mutation and generation syzkaller will select a random union field
whose condition is satisfied.

### Expression syntax

Currently, only `==`, `!=`, `&` and `||` operators are supported. However, the
functionality was designed in such a way that adding more operators is easy.
Feel free to file a GitHub issue or write us an email in case it's needed.

Expressions are evaluated as `int64` values. If the final result of an
expression is not 0, it's assumed to be satisfied.

If you want to reference a field's value, you can do it via
`value[path:to:field]`, which is similar to the `len[]` argument.

```
sub_struct {
  f0 int
  # Reference a field in a parent struct.
  f1 int (if[value[struct:f2]]) # Same as if[value[struct:f2] != 0].
}

struct {
  f2 int
  f3 sub_struct
  f4 int (if[value[f2] == 0x2]) # Reference a sibling field.
  f5 int (if[value[f3:f0] == 0x1]) # Reference a nested field.
  f6 int (if[value[f3:f0] == 0x1 || value[f3:f0] == 0x2]) # Reference a nested field which either equals to 0x1 or 0x2.
} [packed]

call(a ptr[in, struct])
```

The referenced field must be of integer type and there must be no
conditional fields in the path to it. For example, the following
descriptions will not compile.

```
struct {
  f0 int
  f1 int (if[value[f0] == 0x1])
  f2 int (if[value[f1] == 0x1])
}
```

You may also reference constants in expressions:

```
struct {
  f0 int
  f1 int
  f2 int (if[value[f0] & SOME_CONST == OTHER_CONST])
}
```

## Meta

Description files can also contain `meta` directives that specify meta-information for the whole file.

```
meta noextract
```

Tells `make extract` to not extract constants for this file.
Though, `syz-extract` can still be invoked manually on this file.

```
meta arches["arch1", "arch2"]
```

Restricts this file only to the given set of architectures.
`make extract` and `make generate` will not use it on other architectures.

## Misc

Description files also contain `include` directives that refer to Linux kernel header files,
`incdir` directives that refer to custom Linux kernel header directories
and `define` directives that define symbolic constant values.

The syzkaller executor defines some [pseudo system calls](./pseudo_syscalls.md)
that can be used as any other syscall in a description file. These pseudo
system calls expand to literal C code and can perform user-defined
custom actions. You can find some examples in
[executor/common_linux.h](../executor/common_linux.h).

Also see [tips](syscall_descriptions.md#tips) on writing good descriptions.

===

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug title: INFO: task hung in con_install

The bug report to reproduce:
INFO: task syz.8.2015:13960 blocked for more than 143 seconds.
      Tainted: G     U       L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.2015      state:D stack:28008 pid:13960 tgid:13959 ppid:13034  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x6120 kernel/sched/core.c:6908
 __schedule_loop kernel/sched/core.c:6990 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:7005
 schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75
 ___down_common kernel/locking/semaphore.c:268 [inline]
 __down_common+0x396/0x790 kernel/locking/semaphore.c:293
 down+0x74/0xa0 kernel/locking/semaphore.c:100
 console_lock+0x5b/0xa0 kernel/printk/printk.c:2896
 class_console_lock_constructor include/linux/console.h:736 [inline]
 con_install+0x99/0x620 drivers/tty/vt/vt.c:3640
 tty_driver_install_tty drivers/tty/tty_io.c:1295 [inline]
 tty_init_dev.part.0+0x9e/0x470 drivers/tty/tty_io.c:1407
 tty_init_dev include/linux/err.h:78 [inline]
 tty_open_by_driver drivers/tty/tty_io.c:2073 [inline]
 tty_open+0xa63/0xfa0 drivers/tty/tty_io.c:2120
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6d8/0x1660 fs/open.c:949
 vfs_open+0x82/0x3f0 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x208c/0x31a0 fs/namei.c:4830
 do_file_open+0x20e/0x430 fs/namei.c:4859
 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7412b9c799
RSP: 002b:00007f74139cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f7412e15fa0 RCX: 00007f7412b9c799
RDX: 0000000000000800 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00007f7412c32bd9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7412e16038 R14: 00007f7412e15fa0 R15: 00007ffd31d42f18
 </TASK>
INFO: task syz.7.2016:13971 blocked for more than 143 seconds.
      Tainted: G     U       L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.7.2016      state:D stack:26792 pid:13971 tgid:13968 ppid:13030  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x6120 kernel/sched/core.c:6908
 __schedule_loop kernel/sched/core.c:6990 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:7005
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7062
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
 tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6d8/0x1660 fs/open.c:949
 vfs_open+0x82/0x3f0 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x208c/0x31a0 fs/namei.c:4830
 do_file_open+0x20e/0x430 fs/namei.c:4859
 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1a9c19c799
RSP: 002b:00007f1a9d0a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f1a9c416180 RCX: 00007f1a9c19c799
RDX: 0000000000000201 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00007f1a9c232bd9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1a9c416218 R14: 00007f1a9c416180 R15: 00007fff425ac1b8
 </TASK>
INFO: task syz.7.2016:13972 blocked for more than 143 seconds.
      Tainted: G     U       L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.7.2016      state:D stack:28792 pid:13972 tgid:13968 ppid:13030  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0xfee/0x6120 kernel/sched/core.c:6908
 __schedule_loop kernel/sched/core.c:6990 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:7005
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7062
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
 tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6d8/0x1660 fs/open.c:949
 vfs_open+0x82/0x3f0 fs/open.c:1081
 do_open fs/namei.c:4671 [inline]
 path_openat+0x208c/0x31a0 fs/namei.c:4830
 do_file_open+0x20e/0x430 fs/namei.c:4859
 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366
 do_sys_open fs/open.c:1372 [inline]
 __do_sys_openat fs/open.c:1388 [inline]
 __se_sys_openat fs/open.c:1383 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1383
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1a9c19c799
RSP: 002b:00007f1a9d086028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f1a9c416270 RCX: 00007f1a9c19c799
RDX: 0000000000048f41 RSI: 0000200000000000 RDI: ffffffffffffff9c
RBP: 00007f1a9c232bd9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1a9c416308 R14: 00007f1a9c416270 R15: 00007fff425ac1b8
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
 #0: ffffffff8e7e9220 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #0: ffffffff8e7e9220 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #0: ffffffff8e7e9220 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
1 lock held by udevd/5196:
2 locks held by getty/6448:
 #0: ffff8880347d60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900046142f0 (&ldata->atomic_read_lock){+.+.}-{4:4}
, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
2 locks held by kworker/u10:3/6622:
 #0: ffff88801f31b948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250
 #1: ffffc9000547fd08 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251
2 locks held by kworker/u10:6/6663:
 #0: ffff88801f31b948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250
 #1: ffffc90003917d08 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251
6 locks held by syz.5.2008/13906:
2 locks held by syz.8.2015/13960:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
 #1: ffff88803224d1c0 (&tty->legacy_mutex){+.+.}-{4:4}, at: tty_init_dev.part.0+0x39/0x470 drivers/tty/tty_io.c:1406
1 lock held by syz.7.2016/13971:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.7.2016/13972:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.6.2021/14032:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.6.2021/14034:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.9.2025/14079:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.0.2038/14196:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: ptmx_open drivers/tty/pty.c:798 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: ptmx_open+0x150/0x3c0 drivers/tty/pty.c:765
1 lock held by syz.1.2053/14298:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.2.2081/14379:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.4.2077/14397:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.5.2092/14490:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.3.2094/14500:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.8.2131/14654:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.7.2132/14660:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.9.2146/14760:
1 lock held by syz.6.2151/14783:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.0.2141/14823:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.1.2154/14832:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by syz.9.2159/14874:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
3 locks held by syz-executor/14877:
2 locks held by syz.2.2156/14881:
 #0: ffffffff905fc8d0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:577
 #1: ffffffff90615128 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x21e/0x780 net/ipv4/ip_tunnel.c:1146
1 lock held by syz.2.2156/14883:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
1 lock held by dhcpcd/14886:

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G     U       L      syzkaller #0 PREEMPT(full) 
Tainted: [U]=USER, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xd25/0x1050 kernel/hung_task.c:515
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


The list of existing description files:
acpi_thermal_rel.txt
aio.txt
auto.txt
binfmt.txt
bpf.txt
bpf_prog.txt
bpf_trace.txt
cgroup.txt
damon.txt
dev_ashmem.txt
dev_bifrost.txt
dev_binder.txt
dev_binderfs.txt
dev_block.txt
dev_bsg.txt
dev_bus_usb.txt
dev_camx.txt
dev_cdrom.txt
dev_cec.txt
dev_char_usb.txt
dev_comedi.txt
dev_dma_heap.txt
dev_dri.txt
dev_dsp.txt
dev_dvb_demux.txt
dev_dvb_dvr.txt
dev_dvb_frontend.txt
dev_fb.txt
dev_floppy.txt
dev_hidraw.txt
dev_i2c.txt
dev_i915.txt
dev_img_rogue.txt
dev_infiniband_rdma.txt
dev_infiniband_rdma_cm.txt
dev_input.txt
dev_iommu.txt
dev_kvm.txt
dev_kvm_amd64.txt
dev_kvm_arm64.txt
dev_kvm_extra.txt
dev_kvm_riscv64.txt
dev_loop.txt
dev_mali.txt
dev_media.txt
dev_msm.txt
dev_msr.txt
dev_nbd.txt
dev_net_tun.txt
dev_panthor.txt
dev_ppp.txt
dev_ptmx.txt
dev_ptp.txt
dev_qat_adf_ctl.txt
dev_qrtr_tun.txt
dev_random.txt
dev_rfkill.txt
dev_rtc.txt
dev_sequencer.txt
dev_sg.txt
dev_snapshot.txt
dev_snd_control.txt
dev_snd_hw.txt
dev_snd_midi.txt
dev_snd_pcm.txt
dev_snd_seq.txt
dev_snd_timer.txt
dev_sr.txt
dev_sw_sync.txt
dev_tlk_device.txt
dev_trusty.txt
dev_udmabuf.txt
dev_uhid.txt
dev_uinput.txt
dev_usb_hiddev.txt
dev_usbmon.txt
dev_userio.txt
dev_vfio.txt
dev_vga_arbiter.txt
dev_vhci.txt
dev_video4linux.txt
dev_video4linux_vim2m.txt
dev_virtual_nci.txt
dev_vtpm.txt
fanotify.txt
filesystem.txt
fs_9p.txt
fs_fuse.txt
fs_incfs.txt
fs_ioctl.txt
fs_ioctl_autofs.txt
fs_ioctl_btrfs.txt
fs_ioctl_ext4.txt
fs_ioctl_f2fs.txt
fs_ioctl_fat.txt
fs_ioctl_fscrypt.txt
fs_ioctl_fsverity.txt
fs_ioctl_xfs.txt
futex.txt
hafnium.txt
inotify.txt
io_uring.txt
ipc.txt
key.txt
kfuzztest.txt
l2cap.txt
landlock.txt
lsm.txt
namespaces.txt
net_80211.txt
netfilter.txt
netfilter_arp.txt
netfilter_bridge.txt
netfilter_ipv4.txt
netfilter_ipv6.txt
netfilter_ipvs.txt
netfilter_targets.txt
pagemap_ioctl.txt
perf.txt
prctl.txt
quotactl.txt
seccomp.txt
security_apparmor.txt
security_selinux.txt
security_smack.txt
socket.txt
socket_alg.txt
socket_ax25.txt
socket_bluetooth.txt
socket_caif.txt
socket_can.txt
socket_ieee802154.txt
socket_inet.txt
socket_inet6.txt
socket_inet_dccp.txt
socket_inet_icmp.txt
socket_inet_igmp.txt
socket_inet_l2tp.txt
socket_inet_sctp.txt
socket_inet_tcp.txt
socket_inet_udp.txt
socket_ip_tunnel.txt
socket_isdn.txt
socket_kcm.txt
socket_key.txt
socket_llc.txt
socket_netlink.txt
socket_netlink_audit.txt
socket_netlink_crypto.txt
socket_netlink_generic.txt
socket_netlink_generic_80211.txt
socket_netlink_generic_batadv.txt
socket_netlink_generic_devlink.txt
socket_netlink_generic_ethtool.txt
socket_netlink_generic_fou.txt
socket_netlink_generic_gtp.txt
socket_netlink_generic_mptcp.txt
socket_netlink_generic_net_dm.txt
socket_netlink_generic_netlabel.txt
socket_netlink_generic_nfc.txt
socket_netlink_generic_seg6.txt
socket_netlink_generic_smc.txt
socket_netlink_generic_team.txt
socket_netlink_generic_wireguard.txt
socket_netlink_netfilter.txt
socket_netlink_netfilter_acct.txt
socket_netlink_netfilter_conntrack.txt
socket_netlink_netfilter_conntrack_exp.txt
socket_netlink_netfilter_conntrack_helper.txt
socket_netlink_netfilter_ipset.txt
socket_netlink_netfilter_log.txt
socket_netlink_netfilter_nft_compat.txt
socket_netlink_netfilter_nftables.txt
socket_netlink_netfilter_osf.txt
socket_netlink_netfilter_queue.txt
socket_netlink_netfilter_timeout.txt
socket_netlink_rdma.txt
socket_netlink_route.txt
socket_netlink_route_sched.txt
socket_netlink_route_sched_retired.txt
socket_netlink_sock_diag.txt
socket_netlink_xfrm.txt
socket_netrom.txt
socket_nfc.txt
socket_nvme_of_tcp.txt
socket_packet.txt
socket_phonet.txt
socket_pppox.txt
socket_qipcrtr.txt
socket_rds.txt
socket_rose.txt
socket_rxrpc.txt
socket_tipc.txt
socket_tipc_netlink.txt
socket_unix.txt
socket_vnet.txt
socket_x25.txt
socket_xdp.txt
sys.txt
uffd.txt
usbip.txt
vmw_vmci.txt
vnet.txt
vnet_mptcp.txt
vusb.txt
watch_queue.txt
xattr.txt

gemini-3-pro-preview

							input: 19727
							output: 41
							thoughts: 431
						

**Debugging a Concurrency Issue in TTY Device Handling**

Okay, so I've got this bug report – "INFO: task hung in con_install." Sounds like a classic concurrency issue. Multiple tasks are apparently colliding when trying to open a TTY device. The stack trace points to the `con_install` function as the culprit, and it seems like the tasks are getting blocked in that area.

Looking at the trace, I see that the primary blocker is `console_lock()` within `con_install`. Further down, I see another task is blocked on `tty_mutex` inside `tty_open_by_driver`. It's starting to click - `con_install` is clearly related to the virtual console (vt). I need to determine what device is actually being opened. I can see `tty_open` is involved, and it is handling a character device, but I need to link this back to the virtual console.

Alright, the critical function `con_install` lives in `drivers/tty/vt/vt.c`. Time to dig into the source code of `con_install` and understand precisely how those locks are being handled and what resource contention is occurring. I need to understand the logic flow and pinpoint the exact source of the deadlock or contention. I can definitely see how multiple tasks could hit this path simultaneously if they are all trying to grab control of the virtual console. I need to consider whether it's a true deadlock, or just an unfortunate race condition that's causing excessive blocking.

map[ContextFile:drivers/tty/vt/vt.c IncludeLines:true Name:con_install]

map[SourceCode:3631:	/*
3632:	 * Allocate the console screen memory.
3633:	 */
3634:	static int con_install(struct tty_driver *driver, struct tty_struct *tty)
3635:	{
3636:		unsigned int currcons = tty->index;
3637:		struct vc_data *vc;
3638:		int ret;
3639:	
3640:		guard(console_lock)();
3641:		ret = vc_allocate(currcons);
3642:		if (ret)
3643:			return ret;
3644:	
3645:		vc = vc_cons[currcons].d;
3646:	
3647:		/* Still being freed */
3648:		if (vc->port.tty)
3649:			return -ERESTARTSYS;
3650:	
3651:		ret = tty_port_install(&vc->port, driver, tty);
3652:		if (ret)
3653:			return ret;
3654:	
3655:		tty->driver_data = vc;
3656:		vc->port.tty = tty;
3657:		tty_port_get(&vc->port);
3658:	
3659:		if (!tty->winsize.ws_row && !tty->winsize.ws_col) {
3660:			tty->winsize.ws_row = vc_cons[currcons].d->vc_rows;
3661:			tty->winsize.ws_col = vc_cons[currcons].d->vc_cols;
3662:		}
3663:		if (vc->vc_utf)
3664:			tty->termios.c_iflag |= IUTF8;
3665:		else
3666:			tty->termios.c_iflag &= ~IUTF8;
3667:	
3668:		return 0;
3669:	}
 SourceFile:drivers/tty/vt/vt.c]

gemini-3-pro-preview

							input: 21091
							output: 39
							thoughts: 1175
						

**Analyzing the Console Lock Contention**

Okay, so I'm looking at a task that's waiting on `console_lock()`. My initial thought is to figure out *who* has it. I need to understand the current lock state of the system, so I'll pull the list of held locks.

Alright, got the lock information. I see a bunch of tasks holding different locks.  `khungtaskd` is holding an `rcu_read_lock`, `udevd` has one, `getty` has two, then some kworkers. Nothing jumps out initially, but I need to see if any of them are related to console activity. Also, `syz.5.2008` is holding a whopping six locks, which is a bit of a red flag. The output's truncated, so I'll need to figure out what those locks are. That could provide some useful context.

I need to dig deeper into what `syz.5.2008` is doing. I have to find out what that process is. In the meantime, I should check whether *any* other task is holding `console_lock` right now, just to be sure.

My experience tells me that when a task's waiting on `console_lock`, it means another task is doing a lot of printing or maybe got blocked while printing. I should remember that it's a semaphore. Time to go looking in the source for `kernel/printk/printk.c`. Let's see how `console_lock` is being used within the printk subsystem. Hopefully, I'll find a clue there.

map[ContextFile:kernel/printk/printk.c IncludeLines:true Name:console_lock]

map[SourceCode:2880:	/**
2881:	 * console_lock - block the console subsystem from printing
2882:	 *
2883:	 * Acquires a lock which guarantees that no consoles will
2884:	 * be in or enter their write() callback.
2885:	 *
2886:	 * Can sleep, returns nothing.
2887:	 */
2888:	void console_lock(void)
2889:	{
2890:		might_sleep();
2891:	
2892:		/* On panic, the console_lock must be left to the panic cpu. */
2893:		while (panic_on_other_cpu())
2894:			msleep(1000);
2895:	
2896:		down_console_sem();
2897:		console_locked = 1;
2898:		console_may_schedule = 1;
2899:	}
 SourceFile:kernel/printk/printk.c]

gemini-3-pro-preview

							input: 22936
							output: 41
							thoughts: 30
						

Okay, here's my take on those thoughts, framed as my own:

**Analyzing Semaphore Usage in Console Operations**

Right, so I'm looking at this code and immediately recognize `console_lock` – that's a semaphore, no doubt. The next logical step is to understand how it's being used. Specifically, I need to trace its lifecycle: how it's acquired and released. Therefore, I need to identify the calls to the semaphore primitives. I'll search for uses of this semphore by the name of `down_console_sem` and `console_sem` to understand the lock usage.

requested entity does not exist

map[ContextFile:kernel/printk/printk.c IncludeLines:true Name:down_console_sem]

map[SourceCode: SourceFile:]

gemini-3-pro-preview

							input: 23161
							output: 19
							thoughts: 22
						

Here's my thought process, as if I were considering this myself:

**Investigating a Potential Kernel Concurrency Issue**

Okay, so I'm suspecting there might be something going on with how the console is handled, specifically within the kernel's printk system. I've got this gut feeling, and it's time to dig into it. First thing I'm going to do is use `grep`. I know that a semaphore named `down_console_sem` is often associated with the console's write lock, in Linux kernel code. That means this semaphore is probably the one that synchronizes access to the console device. A good starting point would be to search for its usage, and potential issues within `kernel/printk/printk.c`. Let's see what's actually using the semaphore, and where in that file it's used. Time to get that `grep` command running.

map[Expression:down_console_sem]

map[Output:kernel/printk/printk.c=307=EXPORT_SYMBOL(console_srcu_read_unlock);
--
kernel/printk/printk.c-312- */
kernel/printk/printk.c:313:#define down_console_sem() do { \
kernel/printk/printk.c-314-	down(&console_sem);\
--
kernel/printk/printk.c=2888=void console_lock(void)
--
kernel/printk/printk.c-2895-
kernel/printk/printk.c:2896:	down_console_sem();
kernel/printk/printk.c-2897-	console_locked = 1;
]

gemini-3-pro-preview

							input: 23574
							output: 39
							thoughts: 265
						

**Debugging a Console Hang**

Okay, so we've got a `console_sem`, which is a semaphore, and the bug report suggests a hang related to it. My initial thought is to figure out if another task is holding this semaphore. The bug report mentions six locks are held by `syz.5.2008/13906`, but frustratingly, it doesn't specify which ones! And the stack trace for `syz.5.2008/13906` is also missing. Ugh, more information would be really helpful right now.

The bug title itself, "INFO: task hung in con_install," jumps out at me. This is a classic hung task scenario. So the `console_lock` is probably the culprit, and it's either held by something that's blocked or by something that's just running forever and spamming messages. If it was blocked, that might make sense.

If it were message spamming, that task wouldn't be blocked... but 143 seconds is a long time for a hung task timeout. That does make me think it could be something holding `console_lock` and just printing tons and tons of messages, and never releasing the lock. However, `console_unlock` is *supposed* to release the lock and reacquire it to avoid exactly this situation. I should go check the implementation of `console_unlock` and confirm it's working as expected.

map[ContextFile:kernel/printk/printk.c IncludeLines:true Name:console_unlock]

map[SourceCode:3395:	/**
3396:	 * console_unlock - unblock the legacy console subsystem from printing
3397:	 *
3398:	 * Releases the console_lock which the caller holds to block printing of
3399:	 * the legacy console subsystem.
3400:	 *
3401:	 * While the console_lock was held, console output may have been buffered
3402:	 * by printk(). If this is the case, console_unlock() emits the output on
3403:	 * legacy consoles prior to releasing the lock.
3404:	 *
3405:	 * console_unlock(); may be called from any context.
3406:	 */
3407:	void console_unlock(void)
3408:	{
3409:		struct console_flush_type ft;
3410:	
3411:		printk_get_console_flush_type(&ft);
3412:		if (ft.legacy_direct)
3413:			__console_flush_and_unlock();
3414:		else
3415:			__console_unlock();
3416:	}
 SourceFile:kernel/printk/printk.c]

gemini-3-pro-preview

							input: 24521
							output: 44
							thoughts: 14
						

Okay, let's dive into this. Here's my take on those thoughts, as if they're my own:

**Analyzing `__console_flush_and_unlock`**

Alright, so the focus is clearly on `__console_flush_and_unlock`. This function name immediately screams low-level console interaction and likely some kind of synchronization mechanism. My gut feeling is that we're dealing with a system-level call, probably within an operating system kernel or a very tightly coupled driver. The `flush` suggests that data is being pushed out to a physical or virtual console device – a common scenario for printing debugging information, status updates, or standard output. The `unlock` part is the key: it implies a mutex, semaphore, or some form of lock is involved, ensuring that concurrent access to the console (and potentially the shared data structures it uses) is handled safely. The naming convention likely means this is not a user space library, but internal to some OS or device driver code. I'll need to dig deeper into the specific context to understand the exact locking mechanism, the data structures it protects, and any potential race conditions that are addressed by this call. I'm wondering if this is related to a custom implementation or a standard library. My suspicion is this is an unusual implementation or maybe a very old library. There may be some interesting performance or safety considerations in how this is being handled. This could be a critical point of analysis for performance bottlenecks, deadlocks, or security vulnerabilities, especially if the code isn't thoroughly reviewed and tested. Time to start digging!

map[ContextFile:kernel/printk/printk.c IncludeLines:true Name:__console_flush_and_unlock]

map[SourceCode:3350:	static void __console_flush_and_unlock(void)
3351:	{
3352:		bool do_cond_resched;
3353:		bool handover;
3354:		bool flushed;
3355:		u64 next_seq;
3356:	
3357:		/*
3358:		 * Console drivers are called with interrupts disabled, so
3359:		 * @console_may_schedule should be cleared before; however, we may
3360:		 * end up dumping a lot of lines, for example, if called from
3361:		 * console registration path, and should invoke cond_resched()
3362:		 * between lines if allowable.  Not doing so can cause a very long
3363:		 * scheduling stall on a slow console leading to RCU stall and
3364:		 * softlockup warnings which exacerbate the issue with more
3365:		 * messages practically incapacitating the system. Therefore, create
3366:		 * a local to use for the printing loop.
3367:		 */
3368:		do_cond_resched = console_may_schedule;
3369:	
3370:		do {
3371:			console_may_schedule = 0;
3372:	
3373:			flushed = console_flush_all(do_cond_resched, &next_seq, &handover);
3374:			if (!handover)
3375:				__console_unlock();
3376:	
3377:			/*
3378:			 * Abort if there was a failure to flush all messages to all
3379:			 * usable consoles. Either it is not possible to flush (in
3380:			 * which case it would be an infinite loop of retrying) or
3381:			 * another context has taken over printing.
3382:			 */
3383:			if (!flushed)
3384:				break;
3385:	
3386:			/*
3387:			 * Some context may have added new records after
3388:			 * console_flush_all() but before unlocking the console.
3389:			 * Re-check if there is a new record to flush. If the trylock
3390:			 * fails, another context is already handling the printing.
3391:			 */
3392:		} while (prb_read_valid(prb, next_seq, NULL) && console_trylock());
3393:	}
 SourceFile:kernel/printk/printk.c]

gemini-3-pro-preview

							input: 25593
							output: 17
							thoughts: 845
						

**Analyzing a Softlockup in the Kernel**

Okay, first things first, this bug report is pointing to a softlockup, indicated by the `[L]=SOFTLOCKUP` taint flag. That means something's spinning with interrupts or preemption disabled, which is a major issue. Unfortunately, I don't have the full log, just the report, but the taint flag implies a softlockup *happened* earlier.

The report mentions a process, `syz.5.2008`, holding six locks. That's a lot of locks! Could this be the root cause? The bug report doesn't explicitly name the locks, though, just that they exist. I need to figure out *what* these locks are. My immediate suspicion is that `syz.5.2008` is holding `console_sem` and blocked on something else, or it's spinning.

Let's look at `con_install` function in the console driver code again. I recall that `con_install` is called with a `tty_mutex` lock held. Specifically:

```c
static int con_install(struct tty_driver *driver, struct tty_struct *tty)
{
	unsigned int currcons = tty->index;
	struct vc_data *vc;
	int ret;

	guard(console_lock)();
	ret = vc_allocate(currcons);
...
```

The function acquires `console_lock`. Meanwhile, `tty_open`, which eventually calls `con_install`, acquires `tty_mutex` first.

```c
	mutex_lock(&tty_mutex);
	tty = tty_open_by_driver(device, inode, filp);
	mutex_unlock(&tty_mutex);
```

If `con_install` blocks while trying to acquire `console_lock` *after* holding `tty_mutex`, that could be a deadlock. Other tasks calling `tty_open` would block on `tty_mutex`, which is consistent with the report's second trace:

```
1 lock held by syz.7.2016/13971:
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline]
 #0: ffffffff8f4f0608 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120
```

So `syz.8.2015` is blocked on `console_lock` while holding `tty_mutex`. That really smells like a deadlock. My next step is to find out what's *holding* `console_lock`. Is there a codepath that acquires `console_lock` and then *tries* to get `tty_mutex`? I'll need to search in `drivers/tty/vt/vt.c` and `drivers/tty/vt/vt_ioctl.c` for any suspicious lock acquisition sequences.

map[Expression:tty_mutex]

map[Output:drivers/accessibility/speakup/spk_ttyio.c=22=static struct tty_struct *speakup_tty;
drivers/accessibility/speakup/spk_ttyio.c-23-/* This mutex serializes the use of such global speakup_tty variable */
drivers/accessibility/speakup/spk_ttyio.c:24:static DEFINE_MUTEX(speakup_tty_mutex);
drivers/accessibility/speakup/spk_ttyio.c-25-
--
drivers/accessibility/speakup/spk_ttyio.c=143=static int spk_ttyio_initialise_ldisc(struct spk_synth *synth)
--
drivers/accessibility/speakup/spk_ttyio.c-185-
drivers/accessibility/speakup/spk_ttyio.c:186:	mutex_lock(&speakup_tty_mutex);
drivers/accessibility/speakup/spk_ttyio.c-187-	speakup_tty = tty;
--
drivers/accessibility/speakup/spk_ttyio.c-189-	speakup_tty = NULL;
drivers/accessibility/speakup/spk_ttyio.c:190:	mutex_unlock(&speakup_tty_mutex);
drivers/accessibility/speakup/spk_ttyio.c-191-
--
drivers/tty/Makefile=2=obj-$(CONFIG_TTY)		+= tty_io.o n_tty.o tty_ioctl.o tty_ldisc.o \
drivers/tty/Makefile:3:				   tty_buffer.o tty_port.o tty_mutex.o \
drivers/tty/Makefile-4-				   tty_ldsem.o tty_baudrate.o tty_jobctrl.o \
--
drivers/tty/ipwireless/tty.c=46=struct ipw_tty {
--
drivers/tty/ipwireless/tty.c-54-	unsigned int control_lines;
drivers/tty/ipwireless/tty.c:55:	struct mutex ipw_tty_mutex;
drivers/tty/ipwireless/tty.c-56-	int tx_bytes_queued;
--
drivers/tty/ipwireless/tty.c=88=static int ipw_open(struct tty_struct *linux_tty, struct file *filp)
--
drivers/tty/ipwireless/tty.c-94-
drivers/tty/ipwireless/tty.c:95:	mutex_lock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-96-	if (tty->port.count == 0)
--
drivers/tty/ipwireless/tty.c-106-
drivers/tty/ipwireless/tty.c:107:	mutex_unlock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-108-
--
drivers/tty/ipwireless/tty.c=129=static void ipw_hangup(struct tty_struct *linux_tty)
--
drivers/tty/ipwireless/tty.c-135-
drivers/tty/ipwireless/tty.c:136:	mutex_lock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-137-	if (tty->port.count == 0) {
drivers/tty/ipwireless/tty.c:138:		mutex_unlock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-139-		return;
--
drivers/tty/ipwireless/tty.c-143-
drivers/tty/ipwireless/tty.c:144:	mutex_unlock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-145-}
--
drivers/tty/ipwireless/tty.c=153=void ipwireless_tty_received(struct ipw_tty *tty, unsigned char *data,
--
drivers/tty/ipwireless/tty.c-157-
drivers/tty/ipwireless/tty.c:158:	mutex_lock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-159-
drivers/tty/ipwireless/tty.c-160-	if (!tty->port.count) {
drivers/tty/ipwireless/tty.c:161:		mutex_unlock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-162-		return;
drivers/tty/ipwireless/tty.c-163-	}
drivers/tty/ipwireless/tty.c:164:	mutex_unlock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-165-
--
drivers/tty/ipwireless/tty.c=189=static ssize_t ipw_write(struct tty_struct *linux_tty, const u8 *buf,
--
drivers/tty/ipwireless/tty.c-197-
drivers/tty/ipwireless/tty.c:198:	mutex_lock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-199-	if (!tty->port.count) {
drivers/tty/ipwireless/tty.c:200:		mutex_unlock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-201-		return -EINVAL;
--
drivers/tty/ipwireless/tty.c-211-	if (count == 0) {
drivers/tty/ipwireless/tty.c:212:		mutex_unlock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-213-		return 0;
--
drivers/tty/ipwireless/tty.c-219-	if (ret < 0) {
drivers/tty/ipwireless/tty.c:220:		mutex_unlock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-221-		return 0;
--
drivers/tty/ipwireless/tty.c-224-	tty->tx_bytes_queued += count;
drivers/tty/ipwireless/tty.c:225:	mutex_unlock(&tty->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-226-
--
drivers/tty/ipwireless/tty.c=435=static int add_tty(int j,
--
drivers/tty/ipwireless/tty.c-448-	ttys[j]->tty_type = tty_type;
drivers/tty/ipwireless/tty.c:449:	mutex_init(&ttys[j]->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-450-	tty_port_init(&ttys[j]->port);
--
drivers/tty/ipwireless/tty.c=512=void ipwireless_tty_free(struct ipw_tty *tty)
--
drivers/tty/ipwireless/tty.c-521-		if (ttyj) {
drivers/tty/ipwireless/tty.c:522:			mutex_lock(&ttyj->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-523-			if (get_tty(j))
--
drivers/tty/ipwireless/tty.c-527-			if (ttyj->port.tty != NULL) {
drivers/tty/ipwireless/tty.c:528:				mutex_unlock(&ttyj->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-529-				tty_vhangup(ttyj->port.tty);
--
drivers/tty/ipwireless/tty.c-533-				 * are gone */
drivers/tty/ipwireless/tty.c:534:				mutex_lock(&ttyj->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-535-			}
--
drivers/tty/ipwireless/tty.c-542-			ttys[j] = NULL;
drivers/tty/ipwireless/tty.c:543:			mutex_unlock(&ttyj->ipw_tty_mutex);
drivers/tty/ipwireless/tty.c-544-			kfree(ttyj);
--
drivers/tty/pty.c=332=static void pty_stop(struct tty_struct *tty)
--
drivers/tty/pty.c-352- *
drivers/tty/pty.c:353: *	Locking: the caller must hold the tty_mutex
drivers/tty/pty.c-354- */
--
drivers/tty/pty.c=645=static long pty_unix98_compat_ioctl(struct tty_struct *tty,
--
drivers/tty/pty.c-664- *
drivers/tty/pty.c:665: *	Look up a pty master device. Called under the tty_mutex for now.
drivers/tty/pty.c-666- *	This provides our locking.
--
drivers/tty/pty.c=669=static struct tty_struct *ptm_unix98_lookup(struct tty_driver *driver,
--
drivers/tty/pty.c-681- *
drivers/tty/pty.c:682: *	Look up a pty master device. Called under the tty_mutex for now.
drivers/tty/pty.c-683- *	This provides our locking for the tty pointer.
--
drivers/tty/pty.c=737=static const struct tty_operations pty_unix98_ops = {
--
drivers/tty/pty.c-759- *
drivers/tty/pty.c:760: *	Locking: tty_mutex protects the init_dev work. tty->count should
drivers/tty/pty.c-761- *		protect the rest.
--
drivers/tty/pty.c=765=static int ptmx_open(struct inode *inode, struct file *filp)
--
drivers/tty/pty.c-797-	/* The tty returned here is locked so we can safely drop the mutex */
drivers/tty/pty.c:798:	scoped_guard(mutex, &tty_mutex)
drivers/tty/pty.c-799-		tty = tty_init_dev(ptm_driver, index);
--
drivers/tty/tty_io.c=142=LIST_HEAD(tty_drivers);			/* linked list of tty drivers */
--
drivers/tty/tty_io.c-144-/* Mutex to protect creating and releasing a tty */
drivers/tty/tty_io.c:145:DEFINE_MUTEX(tty_mutex);
drivers/tty/tty_io.c-146-
--
drivers/tty/tty_io.c=273=static void check_tty_count(struct tty_struct *tty, const char *routine)
--
drivers/tty/tty_io.c-303- *
drivers/tty/tty_io.c:304: * Locking: caller must hold tty_mutex
drivers/tty/tty_io.c-305- */
drivers/tty/tty_io.c=306=static struct tty_driver *get_tty_driver(dev_t device, int *index)
--
drivers/tty/tty_io.c-329- *
drivers/tty/tty_io.c:330: * Locking: this acquires tty_mutex to protect the tty_drivers list from
drivers/tty/tty_io.c-331- *	being modified while we are traversing it, and makes sure to
--
drivers/tty/tty_io.c=334=int tty_dev_name_to_number(const char *name, dev_t *number)
--
drivers/tty/tty_io.c-352-
drivers/tty/tty_io.c:353:	guard(mutex)(&tty_mutex);
drivers/tty/tty_io.c-354-
--
drivers/tty/tty_io.c=378=struct tty_driver *tty_find_polling_driver(char *name, int *line)
--
drivers/tty/tty_io.c-393-
drivers/tty/tty_io.c:394:	guard(mutex)(&tty_mutex);
drivers/tty/tty_io.c-395-
--
drivers/tty/tty_io.c=1194=static ssize_t tty_line_name(struct tty_driver *driver, int index, char *p)
--
drivers/tty/tty_io.c-1211- *
drivers/tty/tty_io.c:1212: * Locking: tty_mutex must be held. If the tty is found, bump the tty kref.
drivers/tty/tty_io.c-1213- */
drivers/tty/tty_io.c=1214=static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver,
--
drivers/tty/tty_io.c-1238- * Initialise the termios structure for this tty. This runs under the
drivers/tty/tty_io.c:1239: * %tty_mutex currently so we can be relaxed about ordering.
drivers/tty/tty_io.c-1240- */
--
drivers/tty/tty_io.c=1279=EXPORT_SYMBOL_GPL(tty_standard_install);
--
drivers/tty/tty_io.c-1289- *
drivers/tty/tty_io.c:1290: * Locking: tty_mutex for now
drivers/tty/tty_io.c-1291- */
drivers/tty/tty_io.c=1292=static int tty_driver_install_tty(struct tty_driver *driver,
--
drivers/tty/tty_io.c-1306- *
drivers/tty/tty_io.c:1307: * Locking: tty_mutex for now
drivers/tty/tty_io.c-1308- */
--
drivers/tty/tty_io.c=1326=static int tty_reopen(struct tty_struct *tty)
--
drivers/tty/tty_io.c-1369- * Locking:
drivers/tty/tty_io.c:1370: *	The function is called under the tty_mutex, which protects us from the
drivers/tty/tty_io.c-1371- *	tty struct or driver itself going away.
--
drivers/tty/tty_io.c=1559=EXPORT_SYMBOL(tty_kref_put);
--
drivers/tty/tty_io.c-1569- * Locking:
drivers/tty/tty_io.c:1570: *	tty_mutex
drivers/tty/tty_io.c-1571- *	takes the file list lock internally when working on the list of ttys
--
drivers/tty/tty_io.c=1574=static void release_tty(struct tty_struct *tty, int idx)
--
drivers/tty/tty_io.c-1577-	WARN_ON(tty->index != idx);
drivers/tty/tty_io.c:1578:	WARN_ON(!mutex_is_locked(&tty_mutex));
drivers/tty/tty_io.c-1579-	if (tty->ops->shutdown)
--
drivers/tty/tty_io.c=1646=void tty_kclose(struct tty_struct *tty)
--
drivers/tty/tty_io.c-1660-	 */
drivers/tty/tty_io.c:1661:	mutex_lock(&tty_mutex);
drivers/tty/tty_io.c-1662-	tty_port_set_kopened(tty->port, 0);
drivers/tty/tty_io.c-1663-	release_tty(tty, tty->index);
drivers/tty/tty_io.c:1664:	mutex_unlock(&tty_mutex);
drivers/tty/tty_io.c-1665-}
--
drivers/tty/tty_io.c=1676=void tty_release_struct(struct tty_struct *tty, int idx)
--
drivers/tty/tty_io.c-1690-	 */
drivers/tty/tty_io.c:1691:	mutex_lock(&tty_mutex);
drivers/tty/tty_io.c-1692-	release_tty(tty, idx);
drivers/tty/tty_io.c:1693:	mutex_unlock(&tty_mutex);
drivers/tty/tty_io.c-1694-}
--
drivers/tty/tty_io.c=1867=static struct tty_struct *tty_open_current_tty(dev_t device, struct file *filp)
--
drivers/tty/tty_io.c-1900- *
drivers/tty/tty_io.c:1901: * Locking: %tty_mutex protects get_tty_driver()
drivers/tty/tty_io.c-1902- *
--
drivers/tty/tty_io.c=1944=static struct tty_struct *tty_kopen(dev_t device, int shared)
--
drivers/tty/tty_io.c-1949-
drivers/tty/tty_io.c:1950:	mutex_lock(&tty_mutex);
drivers/tty/tty_io.c-1951-	driver = tty_lookup_driver(device, NULL, &index);
drivers/tty/tty_io.c-1952-	if (IS_ERR(driver)) {
drivers/tty/tty_io.c:1953:		mutex_unlock(&tty_mutex);
drivers/tty/tty_io.c-1954-		return ERR_CAST(driver);
--
drivers/tty/tty_io.c-1972-out:
drivers/tty/tty_io.c:1973:	mutex_unlock(&tty_mutex);
drivers/tty/tty_io.c-1974-	tty_driver_kref_put(driver);
--
drivers/tty/tty_io.c-1984- *
drivers/tty/tty_io.c:1985: * Claims the global %tty_mutex to serialize:
drivers/tty/tty_io.c-1986- *  * concurrent first-time tty initialization
--
drivers/tty/tty_io.c=2011=EXPORT_SYMBOL_GPL(tty_kopen_shared);
--
drivers/tty/tty_io.c-2021- *
drivers/tty/tty_io.c:2022: * Claims the global tty_mutex to serialize:
drivers/tty/tty_io.c-2023- *  * concurrent first-time tty initialization
--
drivers/tty/tty_io.c=2029=static struct tty_struct *tty_open_by_driver(dev_t device,
--
drivers/tty/tty_io.c-2036-
drivers/tty/tty_io.c:2037:	mutex_lock(&tty_mutex);
drivers/tty/tty_io.c-2038-	driver = tty_lookup_driver(device, filp, &index);
drivers/tty/tty_io.c-2039-	if (IS_ERR(driver)) {
drivers/tty/tty_io.c:2040:		mutex_unlock(&tty_mutex);
drivers/tty/tty_io.c-2041-		return ERR_CAST(driver);
--
drivers/tty/tty_io.c-2046-	if (IS_ERR(tty)) {
drivers/tty/tty_io.c:2047:		mutex_unlock(&tty_mutex);
drivers/tty/tty_io.c-2048-		goto out;
--
drivers/tty/tty_io.c-2053-			tty_kref_put(tty);
drivers/tty/tty_io.c:2054:			mutex_unlock(&tty_mutex);
drivers/tty/tty_io.c-2055-			tty = ERR_PTR(-EBUSY);
--
drivers/tty/tty_io.c-2057-		}
drivers/tty/tty_io.c:2058:		mutex_unlock(&tty_mutex);
drivers/tty/tty_io.c-2059-		retval = tty_lock_interruptible(tty);
--
drivers/tty/tty_io.c-2073-		tty = tty_init_dev(driver, index);
drivers/tty/tty_io.c:2074:		mutex_unlock(&tty_mutex);
drivers/tty/tty_io.c-2075-	}
--
drivers/tty/tty_io.c-2097- * Locking:
drivers/tty/tty_io.c:2098: *  * %tty_mutex protects tty, tty_lookup_driver() and tty_init_dev().
drivers/tty/tty_io.c-2099- *  * @tty->count should protect the rest.
--
drivers/tty/tty_io.c-2101- *
drivers/tty/tty_io.c:2102: * Note: the tty_unlock/lock cases without a ref are only safe due to %tty_mutex
drivers/tty/tty_io.c-2103- */
--
drivers/tty/tty_io.c=3425=int tty_register_driver(struct tty_driver *driver)
--
drivers/tty/tty_io.c-3451-
drivers/tty/tty_io.c:3452:	scoped_guard(mutex, &tty_mutex)
drivers/tty/tty_io.c-3453-		list_add(&driver->tty_drivers, &tty_drivers);
--
drivers/tty/tty_io.c-3471-
drivers/tty/tty_io.c:3472:	scoped_guard(mutex, &tty_mutex)
drivers/tty/tty_io.c-3473-		list_del(&driver->tty_drivers);
--
drivers/tty/tty_io.c=3488=void tty_unregister_driver(struct tty_driver *driver)
--
drivers/tty/tty_io.c-3491-				driver->num);
drivers/tty/tty_io.c:3492:	scoped_guard(mutex, &tty_mutex)
drivers/tty/tty_io.c-3493-		list_del(&driver->tty_drivers);
--
drivers/tty/tty_jobctrl.c=196=int tty_signal_session_leader(struct tty_struct *tty, int exit_session)
--
drivers/tty/tty_jobctrl.c-259- *		  called from no_tty().
drivers/tty/tty_jobctrl.c:260: *		  tty_mutex is taken to protect tty
drivers/tty/tty_jobctrl.c-261- *		  ->siglock is taken to protect ->signal/->sighand
--
fs/proc/proc_tty.c=104=static void *t_start(struct seq_file *m, loff_t *pos)
fs/proc/proc_tty.c-105-{
fs/proc/proc_tty.c:106:	mutex_lock(&tty_mutex);
fs/proc/proc_tty.c-107-	return seq_list_start(&tty_drivers, *pos);
--
fs/proc/proc_tty.c=115=static void t_stop(struct seq_file *m, void *v)
fs/proc/proc_tty.c-116-{
fs/proc/proc_tty.c:117:	mutex_unlock(&tty_mutex);
fs/proc/proc_tty.c-118-}
--
include/linux/serial_core.h=34=struct gpio_desc;
--
include/linux/serial_core.h-352- *
include/linux/serial_core.h:353: *	Locking: %tty_mutex and tty_port->mutex taken.
include/linux/serial_core.h-354- *	Interrupts: n/a.
--
include/linux/tty.h=460=int tty_standard_install(struct tty_driver *driver,
--
include/linux/tty.h-462-
include/linux/tty.h:463:extern struct mutex tty_mutex;
include/linux/tty.h-464-
--
include/linux/tty.h=499=long vt_compat_ioctl(struct tty_struct *tty, unsigned int cmd,
--
include/linux/tty.h-501-
include/linux/tty.h:502:/* tty_mutex.c */
include/linux/tty.h-503-/* functions for preparation of BKL removal */
--
include/linux/tty_driver.h=93=enum tty_driver_subtype {
--
include/linux/tty_driver.h-112- *	one currently in use and an %ERR_PTR value on error. Called under
include/linux/tty_driver.h:113: *	%tty_mutex (for now!)
include/linux/tty_driver.h-114- *
]

gemini-3-pro-preview

							input: 33550
							output: 41
							thoughts: 827
						

**Analyzing a Potential Console Lockup**

Okay, so I'm diving into this `tty_mutex` situation. It looks like the mutex is acquired in a few key places: `tty_io.c`, `pty.c`, `proc_tty.c`, and `tty_jobctrl.c`.  I'm trying to trace the locking order to see if there's a potential for deadlock. Right, `tty_open` grabs `tty_mutex`, then calls `tty_open_by_driver` which eventually leads to `con_install`, and `con_install` is the one that grabs `console_lock`. So, the established order is `tty_mutex` before `console_lock`.

The critical question now is, is there *anywhere* where `console_lock` is acquired first, followed by an attempt to acquire `tty_mutex`?  That's where a deadlock could occur. Let me scan the codebase, starting with the typical suspects like `kernel/printk/printk.c` and `drivers/tty/vt/vt.c`, to check for any reverse locking. Hold on, `tty_mutex` isn't even exported, it's defined in the `include/linux/tty.h`, which I should have known! So, I'll search those files and related ioctl file again. Okay, nothing there.

Hmm, what about the possibility of a task holding `console_lock` and then getting blocked on something else, indirectly leading to a problem? Let's check what's going on with `syz.5.2008/13906`. It looks like it's holding six locks! Is it being blocked on `console_lock`? The bug report doesn't explicitly show that.

Wait, looking closer at the bug report, it states "INFO: task hung in con_install" and lists tasks like `syz.8.2015`, `syz.7.2016`, etc. Also, an NMI backtrace shows `khungtaskd` - that's just printing the backtrace. Still, where is the culprit holding `console_lock`? If it's held and a task is looping infinitely, that would trigger a softlockup. And yes, the kernel is tainted with `[L]=SOFTLOCKUP`!  Aha!  So some task *is* spinning with `console_lock` held.

The million-dollar question is: where? Let's trace it down. Time to check `console_unlock`. It's looping through messages and printing them. If there's an infinite stream of messages, then `console_unlock` would loop indefinitely. But isn't there `cond_resched()` if `console_may_schedule` is true? Right, `console_may_schedule` is set to 1 in `console_lock()`. Looking at `__console_flush_and_unlock`: `do_cond_resched` is set to `console_may_schedule`, and that value is passed to `console_flush_all`. If `do_cond_resched` is true then `console_flush_all` calls `cond_resched()`! Wait, `console_flush_all` calls `console_emit_next_record`. Now, the pieces are falling into place!

map[ContextFile:kernel/printk/printk.c IncludeLines:true Name:console_flush_all]

map[SourceCode:3311:	/*
3312:	 * Print out all remaining records to all consoles.
3313:	 *
3314:	 * @do_cond_resched is set by the caller. It can be true only in schedulable
3315:	 * context.
3316:	 *
3317:	 * @next_seq is set to the sequence number after the last available record.
3318:	 * The value is valid only when this function returns true. It means that all
3319:	 * usable consoles are completely flushed.
3320:	 *
3321:	 * @handover will be set to true if a printk waiter has taken over the
3322:	 * console_lock, in which case the caller is no longer holding the
3323:	 * console_lock. Otherwise it is set to false.
3324:	 *
3325:	 * Returns true when there was at least one usable console and all messages
3326:	 * were flushed to all usable consoles. A returned false informs the caller
3327:	 * that everything was not flushed (either there were no usable consoles or
3328:	 * another context has taken over printing or it is a panic situation and this
3329:	 * is not the panic CPU). Regardless the reason, the caller should assume it
3330:	 * is not useful to immediately try again.
3331:	 *
3332:	 * Requires the console_lock.
3333:	 */
3334:	static bool console_flush_all(bool do_cond_resched, u64 *next_seq, bool *handover)
3335:	{
3336:		bool try_again;
3337:		bool ret;
3338:	
3339:		*next_seq = 0;
3340:		*handover = false;
3341:	
3342:		do {
3343:			ret = console_flush_one_record(do_cond_resched, next_seq,
3344:						       handover, &try_again);
3345:		} while (try_again);
3346:	
3347:		return ret;
3348:	}
 SourceFile:kernel/printk/printk.c]

gemini-3-pro-preview

							input: 35748
							output: 43
							thoughts: 13
						

Okay, let's dive into this. Here's my take on `console_flush_one_record`, as an expert:

**Analyzing `console_flush_one_record`**

Alright, so we're looking at `console_flush_one_record`. Just the name itself tells me we're dealing with console output, likely logging or some form of diagnostic data. The "flush" part immediately suggests some kind of buffering mechanism, and this function's job is to ensure a *single* record gets written out. This is intriguing. Why would we need to force a flush for just one record?

My initial questions are piling up. Is this about real-time debugging, where minimizing latency is crucial? Or perhaps a scenario where we have critical events that *must* be logged immediately, regardless of any internal buffering strategy? Context is everything here.

I'm starting to think about potential implementations. Is this function thread-safe? Does it acquire a lock on the console output stream? What happens if the flush fails? Does it retry? Does it provide error handling? Does this function take a specific log level into consideration or flush regardless?

I'm also curious about its integration within the larger logging framework. Is it part of a larger, more sophisticated system that handles other output formats or destinations? Knowing this will significantly affect how I view this function. Depending on the size of the record, it may affect performance in a multi-threaded system.

So, while the name is straightforward, `console_flush_one_record` already raises questions and prompts me to consider the system's design and intent. I'd love to see the surrounding code, the calling context, and the overall logging architecture to get a complete picture.

map[ContextFile:kernel/printk/printk.c IncludeLines:true Name:console_flush_one_record]

map[SourceCode:3210:	/*
3211:	 * Print out one record for each console.
3212:	 *
3213:	 * @do_cond_resched is set by the caller. It can be true only in schedulable
3214:	 * context.
3215:	 *
3216:	 * @next_seq is set to the sequence number after the last available record.
3217:	 * The value is valid only when all usable consoles were flushed. It is
3218:	 * when the function returns true (can do the job) and @try_again parameter
3219:	 * is set to false, see below.
3220:	 *
3221:	 * @handover will be set to true if a printk waiter has taken over the
3222:	 * console_lock, in which case the caller is no longer holding the
3223:	 * console_lock. Otherwise it is set to false.
3224:	 *
3225:	 * @try_again will be set to true when it still makes sense to call this
3226:	 * function again. The function could do the job, see the return value.
3227:	 * And some consoles still make progress.
3228:	 *
3229:	 * Returns true when the function could do the job. Some consoles are usable,
3230:	 * and there was no takeover and no panic_on_other_cpu().
3231:	 *
3232:	 * Requires the console_lock.
3233:	 */
3234:	static bool console_flush_one_record(bool do_cond_resched, u64 *next_seq, bool *handover,
3235:					     bool *try_again)
3236:	{
3237:		struct console_flush_type ft;
3238:		bool any_usable = false;
3239:		struct console *con;
3240:		int cookie;
3241:	
3242:		*try_again = false;
3243:	
3244:		printk_get_console_flush_type(&ft);
3245:	
3246:		cookie = console_srcu_read_lock();
3247:		for_each_console_srcu(con) {
3248:			short flags = console_srcu_read_flags(con);
3249:			u64 printk_seq;
3250:			bool progress;
3251:	
3252:			/*
3253:			 * console_flush_one_record() is only responsible for
3254:			 * nbcon consoles when the nbcon consoles cannot print via
3255:			 * their atomic or threaded flushing.
3256:			 */
3257:			if ((flags & CON_NBCON) && (ft.nbcon_atomic || ft.nbcon_offload))
3258:				continue;
3259:	
3260:			if (!console_is_usable(con, flags, !do_cond_resched))
3261:				continue;
3262:			any_usable = true;
3263:	
3264:			if (flags & CON_NBCON) {
3265:				progress = nbcon_legacy_emit_next_record(con, handover, cookie,
3266:									 !do_cond_resched);
3267:				printk_seq = nbcon_seq_read(con);
3268:			} else {
3269:				progress = console_emit_next_record(con, handover, cookie);
3270:				printk_seq = con->seq;
3271:			}
3272:	
3273:			/*
3274:			 * If a handover has occurred, the SRCU read lock
3275:			 * is already released.
3276:			 */
3277:			if (*handover)
3278:				goto fail;
3279:	
3280:			/* Track the next of the highest seq flushed. */
3281:			if (printk_seq > *next_seq)
3282:				*next_seq = printk_seq;
3283:	
3284:			if (!progress)
3285:				continue;
3286:	
3287:			/*
3288:			 * An usable console made a progress. There might still be
3289:			 * pending messages.
3290:			 */
3291:			*try_again = true;
3292:	
3293:			/* Allow panic_cpu to take over the consoles safely. */
3294:			if (panic_on_other_cpu())
3295:				goto fail_srcu;
3296:	
3297:			if (do_cond_resched)
3298:				cond_resched();
3299:		}
3300:		console_srcu_read_unlock(cookie);
3301:	
3302:		return any_usable;
3303:	
3304:	fail_srcu:
3305:		console_srcu_read_unlock(cookie);
3306:	fail:
3307:		*try_again = false;
3308:		return false;
3309:	}
 SourceFile:kernel/printk/printk.c]

gemini-3-pro-preview

							input: 37602
							output: 40
							thoughts: 159
						

**Analyzing the Console Flushing Logic**

Okay, so I'm digging into this `console_flush_one_record` function and I see it calls `cond_resched()` only when `do_cond_resched` is true. That makes sense, but the crucial point is *when* is `do_cond_resched` false? We need to figure out the scheduling behavior.

I recall that `__console_flush_and_unlock` sets `do_cond_resched` to the value of `console_may_schedule`. Alright, so far so good. `console_may_schedule` gets set to 1 within `console_lock()`.

But hold on, isn't `console_may_schedule` also cleared somewhere in `vprintk_emit` or `console_trylock`? I've seen that behavior before. That's the key. I need to refresh my memory and check out the implementation of `console_trylock`. That's where I need to look to understand the conditions when preemption is disabled.

map[ContextFile:kernel/printk/printk.c IncludeLines:true Name:console_trylock]

map[SourceCode:2902:	/**
2903:	 * console_trylock - try to block the console subsystem from printing
2904:	 *
2905:	 * Try to acquire a lock which guarantees that no consoles will
2906:	 * be in or enter their write() callback.
2907:	 *
2908:	 * returns 1 on success, and 0 on failure to acquire the lock.
2909:	 */
2910:	int console_trylock(void)
2911:	{
2912:		/* On panic, the console_lock must be left to the panic cpu. */
2913:		if (panic_on_other_cpu())
2914:			return 0;
2915:		if (down_trylock_console_sem())
2916:			return 0;
2917:		console_locked = 1;
2918:		console_may_schedule = 0;
2919:		return 1;
2920:	}
 SourceFile:kernel/printk/printk.c]

gemini-3-pro-preview

							input: 38324
							output: 40
							thoughts: 117
						

**Analyzing a Potential Console Softlock**

Okay, so I'm looking at this `console_trylock` function, and it's setting `console_may_schedule` to 0. That's immediately making me think about potential scheduling issues. If a process grabs the console lock with `console_trylock` and then quickly releases it with `console_unlock`, the `do_cond_resched` flag will be zero. This means `console_flush_all` could bypass the scheduler with its loop over all the messages, without calling `cond_resched()`. If there are a *lot* of messages backed up, that could create a nasty softlockup situation, potentially starving other processes. But hang on...isn't `console_trylock` called from `vprintk_emit`? I should probably double-check the `vprintk_emit` function to see exactly how that interaction works and if this scenario is actually plausible in practice. I need to understand the control flow better.

map[ContextFile:kernel/printk/printk.c IncludeLines:true Name:vprintk_emit]

map[SourceCode:2423:	asmlinkage int vprintk_emit(int facility, int level,
2424:				    const struct dev_printk_info *dev_info,
2425:				    const char *fmt, va_list args)
2426:	{
2427:		struct console_flush_type ft;
2428:		int printed_len;
2429:	
2430:		/* Suppress unimportant messages after panic happens */
2431:		if (unlikely(suppress_printk))
2432:			return 0;
2433:	
2434:		/*
2435:		 * The messages on the panic CPU are the most important. If
2436:		 * non-panic CPUs are generating any messages, they will be
2437:		 * silently dropped.
2438:		 */
2439:		if (panic_on_other_cpu() &&
2440:		    !debug_non_panic_cpus &&
2441:		    !panic_triggering_all_cpu_backtrace)
2442:			return 0;
2443:	
2444:		printk_get_console_flush_type(&ft);
2445:	
2446:		/* If called from the scheduler, we can not call up(). */
2447:		if (level == LOGLEVEL_SCHED) {
2448:			level = LOGLEVEL_DEFAULT;
2449:			ft.legacy_offload |= ft.legacy_direct && !console_irqwork_blocked;
2450:			ft.legacy_direct = false;
2451:		}
2452:	
2453:		printk_delay(level);
2454:	
2455:		printed_len = vprintk_store(facility, level, dev_info, fmt, args);
2456:	
2457:		if (ft.nbcon_atomic)
2458:			nbcon_atomic_flush_pending();
2459:	
2460:		if (ft.nbcon_offload)
2461:			nbcon_kthreads_wake();
2462:	
2463:		if (ft.legacy_direct) {
2464:			/*
2465:			 * The caller may be holding system-critical or
2466:			 * timing-sensitive locks. Disable preemption during
2467:			 * printing of all remaining records to all consoles so that
2468:			 * this context can return as soon as possible. Hopefully
2469:			 * another printk() caller will take over the printing.
2470:			 */
2471:			preempt_disable();
2472:			/*
2473:			 * Try to acquire and then immediately release the console
2474:			 * semaphore. The release will print out buffers. With the
2475:			 * spinning variant, this context tries to take over the
2476:			 * printing from another printing context.
2477:			 */
2478:			if (console_trylock_spinning())
2479:				console_unlock();
2480:			preempt_enable();
2481:		}
2482:	
2483:		if (ft.legacy_offload)
2484:			defer_console_output();
2485:		else if (!console_irqwork_blocked)
2486:			wake_up_klogd();
2487:	
2488:		return printed_len;
2489:	}
 SourceFile:kernel/printk/printk.c]

gemini-3-pro-preview

							input: 39651
							output: 40
							thoughts: 541
						

**Debugging a Printk Softlockup**

Okay, so I'm looking at this `vprintk_emit` code, and I see it uses `console_trylock_spinning()` followed by `console_unlock()`. The annoying thing is, it disables preemption before this, so `console_unlock()` is called with preemption disabled. The initial thought is, if there are a ton of messages, this `console_unlock()` could spin for a long time, leading to a softlockup.

But hang on, `console_trylock_spinning` sets `console_may_schedule = 0`. So, `do_cond_resched` is zero. And, the `console_unlock` function loops through all the messages. If another task keeps hitting `printk`, it seems this task could spin in `console_unlock` indefinitely, right?

Wait, there's a handover mechanism in `console_unlock`!

```c
		/*
		 * Try to acquire and then immediately release the console
		 * semaphore. The release will print out buffers. With the
		 * spinning variant, this context tries to take over the
		 * printing from another printing context.
		 */
		if (console_trylock_spinning())
			console_unlock();
```

So, if another task calls `printk`, it'll call `console_trylock_spinning()`, which will set `console_waiter` and spin until the current printer hands over the lock. The current printer should hand over the lock and exit `console_unlock()`. Hmm, so a single task *shouldn't* spin forever in `console_unlock()` if other tasks are calling `printk`.

But what if the *same* task is calling `printk` in a loop? It would keep adding and printing messages. If it's a softlockup, it has to be spinning for a long time—like 20+ seconds.

Okay, let's look at the bug report. It says:

```
INFO: task hung in con_install
```

This is *not* a softlockup panic, it's a *hung task*! The softlockup is just a taint, `[L]=SOFTLOCKUP`. The hung task timeout is 143 seconds. That's the key.

So, `con_install` is blocked for 143 seconds! That means `console_lock` is held for a *massive* 143 seconds. Who would hold `console_lock` for that long? Could it be something like `tty_open`?

Wait, if `con_install` is blocked on `console_lock`, that means *someone else* is holding `console_lock`. Okay, that's the key. Who's holding it? I need to check the callers of `console_lock` now.

map[ContextFile:kernel/printk/printk.c IncludeSnippetLines:0 Name:console_lock]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__pr_flush SourceFile:kernel/printk/printk.c SourceLine:4495] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__pr_flush SourceFile:kernel/printk/printk.c SourceLine:4517] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:activate SourceFile:drivers/video/fbdev/core/fbsysfs.c SourceLine:20] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:class_console_lock_constructor SourceFile:include/linux/console.h SourceLine:736] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:con_driver_unregister_callback SourceFile:drivers/tty/vt/vt.c SourceLine:4460] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:con_init SourceFile:drivers/tty/vt/vt.c SourceLine:3747] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:console_call_setup SourceFile:kernel/printk/printk.c SourceLine:3881] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:console_device SourceFile:kernel/printk/printk.c SourceLine:3576] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:console_unblank SourceFile:kernel/printk/printk.c SourceLine:3466] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:cursor_blink_show SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:3262] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:cursor_blink_store SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:3289] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:do_fb_ioctl SourceFile:drivers/video/fbdev/core/fb_chrdev.c SourceLine:86] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:do_fb_ioctl SourceFile:drivers/video/fbdev/core/fb_chrdev.c SourceLine:123] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:do_fb_ioctl SourceFile:drivers/video/fbdev/core/fb_chrdev.c SourceLine:143] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:drm_fb_helper_resume_worker SourceFile:drivers/gpu/drm/drm_fb_helper.c SourceLine:222] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:drm_fb_helper_set_suspend_unlocked SourceFile:drivers/gpu/drm/drm_fb_helper.c SourceLine:641] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fb_console_init SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:3383] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fbcon_fb_registered SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:3039] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fbcon_fb_unbind SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:2841] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fbcon_fb_unregistered SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:2889] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fbcon_get_con2fb_map_ioctl SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:3162] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fbcon_remap_all SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:2936] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:fbcon_set_con2fb_map_ioctl SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:3145] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:get_init_console_seq SourceFile:kernel/printk/printk.c SourceLine:3991] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:get_init_console_seq SourceFile:kernel/printk/printk.c SourceLine:4008] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:hvc_remove SourceFile:drivers/tty/hvc/hvc_console.c SourceLine:984] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:legacy_kthread_func SourceFile:kernel/printk/printk.c SourceLine:3711] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rotate_all_store SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:3222] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rotate_show SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:3242] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:rotate_store SourceFile:drivers/video/fbdev/core/fbcon.c SourceLine:3200] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:show_cons_active SourceFile:drivers/tty/tty_io.c SourceLine:3566] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:show_console_dev SourceFile:fs/proc/consoles.c SourceLine:43] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:store_blank SourceFile:drivers/video/fbdev/core/fbsysfs.c SourceLine:233] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:store_fbstate SourceFile:drivers/video/fbdev/core/fbsysfs.c SourceLine:331] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:store_modes SourceFile:drivers/video/fbdev/core/fbsysfs.c SourceLine:105] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:store_pan SourceFile:drivers/video/fbdev/core/fbsysfs.c SourceLine:296] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:uart_configure_port SourceFile:drivers/tty/serial/serial_core.c SourceLine:2519] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:uart_configure_port SourceFile:drivers/tty/serial/serial_core.c SourceLine:2530] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:vcs_read SourceFile:drivers/tty/vt/vc_screen.c SourceLine:454] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:vcs_write SourceFile:drivers/tty/vt/vc_screen.c SourceLine:634] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:vga_remove_vgacon SourceFile:drivers/pci/vgaarb.c SourceLine:175] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:vt_ioctl SourceFile:drivers/tty/vt/vt_ioctl.c SourceLine:945]] TruncatedOutput:false]

gemini-3-pro-preview

							input: 43147
							output: 43
							thoughts: 26
						

Here's my thought process, summarized as you requested:

**Investigating a Potential Locking Issue in `vt_ioctl`**

Okay, so I see a call to `console_lock` inside `vt_ioctl`. That raises a red flag. We need to understand the implications of that call. My immediate instinct is to dive into the `vt_ioctl` code itself. I want to see precisely what operations are being protected by that lock, and how long the lock is held. We need to assess if this introduces any potential contention or performance bottlenecks. What's the context? What data structures are we protecting? Let's get a look at the code!

map[ContextFile:drivers/tty/vt/vt_ioctl.c IncludeLines:true Name:vt_ioctl]

map[SourceCode: 723:	/*
 724:	 * We handle the console-specific ioctl's here.  We allow the
 725:	 * capability to modify any console, not just the fg_console.
 726:	 */
 727:	int vt_ioctl(struct tty_struct *tty,
 728:		     unsigned int cmd, unsigned long arg)
 729:	{
 730:		struct vc_data *vc = tty->driver_data;
 731:		void __user *up = (void __user *)arg;
 732:		int i, perm;
 733:		int ret;
 734:	
 735:		/*
 736:		 * To have permissions to do most of the vt ioctls, we either have
 737:		 * to be the owner of the tty, or have CAP_SYS_TTY_CONFIG.
 738:		 */
 739:		perm = 0;
 740:		if (current->signal->tty == tty || capable(CAP_SYS_TTY_CONFIG))
 741:			perm = 1;
 742:	
 743:		ret = vt_k_ioctl(tty, cmd, arg, perm);
 744:		if (ret != -ENOIOCTLCMD)
 745:			return ret;
 746:	
 747:		ret = vt_io_ioctl(vc, cmd, up, perm);
 748:		if (ret != -ENOIOCTLCMD)
 749:			return ret;
 750:	
 751:		switch (cmd) {
 752:		case TIOCLINUX:
 753:			return tioclinux(tty, arg);
 754:		case VT_SETMODE:
 755:		{
 756:			struct vt_mode tmp;
 757:	
 758:			if (!perm)
 759:				return -EPERM;
 760:			if (copy_from_user(&tmp, up, sizeof(struct vt_mode)))
 761:				return -EFAULT;
 762:			if (tmp.mode != VT_AUTO && tmp.mode != VT_PROCESS)
 763:				return -EINVAL;
 764:	
 765:			guard(console_lock)();
 766:			vc->vt_mode = tmp;
 767:			/* the frsig is ignored, so we set it to 0 */
 768:			vc->vt_mode.frsig = 0;
 769:			put_pid(vc->vt_pid);
 770:			vc->vt_pid = get_pid(task_pid(current));
 771:			/* no switch is required -- saw@shade.msu.ru */
 772:			vc->vt_newvt = -1;
 773:			break;
 774:		}
 775:	
 776:		case VT_GETMODE:
 777:		{
 778:			struct vt_mode tmp;
 779:			int rc;
 780:	
 781:			scoped_guard(console_lock)
 782:				memcpy(&tmp, &vc->vt_mode, sizeof(struct vt_mode));
 783:	
 784:			rc = copy_to_user(up, &tmp, sizeof(struct vt_mode));
 785:			if (rc)
 786:				return -EFAULT;
 787:			break;
 788:		}
 789:	
 790:		/*
 791:		 * Returns global vt state. Note that VT 0 is always open, since
 792:		 * it's an alias for the current VT, and people can't use it here.
 793:		 * We cannot return state for more than 16 VTs, since v_state is short.
 794:		 */
 795:		case VT_GETSTATE:
 796:		{
 797:			struct vt_stat __user *vtstat = up;
 798:			unsigned short state, mask;
 799:	
 800:			if (put_user(fg_console + 1, &vtstat->v_active))
 801:				return -EFAULT;
 802:	
 803:			state = 1;	/* /dev/tty0 is always open */
 804:			scoped_guard(console_lock) /* required by vt_in_use() */
 805:				for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask; ++i, mask <<= 1)
 806:					if (vt_in_use(i))
 807:						state |= mask;
 808:			return put_user(state, &vtstat->v_state);
 809:		}
 810:	
 811:		/*
 812:		 * Returns the first available (non-opened) console.
 813:		 */
 814:		case VT_OPENQRY:
 815:			scoped_guard(console_lock) /* required by vt_in_use() */
 816:				for (i = 0; i < MAX_NR_CONSOLES; ++i)
 817:					if (!vt_in_use(i))
 818:						break;
 819:			i = i < MAX_NR_CONSOLES ? (i+1) : -1;
 820:			return put_user(i, (int __user *)arg);
 821:	
 822:		/*
 823:		 * ioctl(fd, VT_ACTIVATE, num) will cause us to switch to vt # num,
 824:		 * with num >= 1 (switches to vt 0, our console, are not allowed, just
 825:		 * to preserve sanity).
 826:		 */
 827:		case VT_ACTIVATE:
 828:			if (!perm)
 829:				return -EPERM;
 830:			if (arg == 0 || arg > MAX_NR_CONSOLES)
 831:				return -ENXIO;
 832:	
 833:			arg--;
 834:			arg = array_index_nospec(arg, MAX_NR_CONSOLES);
 835:			scoped_guard(console_lock) {
 836:				ret = vc_allocate(arg);
 837:				if (ret)
 838:					return ret;
 839:			}
 840:			set_console(arg);
 841:			break;
 842:	
 843:		case VT_SETACTIVATE:
 844:			if (!perm)
 845:				return -EPERM;
 846:	
 847:			return vt_setactivate(up);
 848:	
 849:		/*
 850:		 * wait until the specified VT has been activated
 851:		 */
 852:		case VT_WAITACTIVE:
 853:			if (!perm)
 854:				return -EPERM;
 855:			if (arg == 0 || arg > MAX_NR_CONSOLES)
 856:				return -ENXIO;
 857:			return vt_waitactive(arg);
 858:	
 859:		/*
 860:		 * If a vt is under process control, the kernel will not switch to it
 861:		 * immediately, but postpone the operation until the process calls this
 862:		 * ioctl, allowing the switch to complete.
 863:		 *
 864:		 * According to the X sources this is the behavior:
 865:		 *	0:	pending switch-from not OK
 866:		 *	1:	pending switch-from OK
 867:		 *	2:	completed switch-to OK
 868:		 */
 869:		case VT_RELDISP:
 870:		{
 871:			if (!perm)
 872:				return -EPERM;
 873:	
 874:			guard(console_lock)();
 875:			return vt_reldisp(vc, arg);
 876:		}
 877:	
 878:		 /*
 879:		  * Disallocate memory associated to VT (but leave VT1)
 880:		  */
 881:		 case VT_DISALLOCATE:
 882:			if (arg > MAX_NR_CONSOLES)
 883:				return -ENXIO;
 884:	
 885:			if (arg == 0) {
 886:				vt_disallocate_all();
 887:				break;
 888:			}
 889:	
 890:			arg = array_index_nospec(arg - 1, MAX_NR_CONSOLES);
 891:			return vt_disallocate(arg);
 892:	
 893:		case VT_RESIZE:
 894:		{
 895:			struct vt_sizes __user *vtsizes = up;
 896:			struct vc_data *vc;
 897:			ushort ll,cc;
 898:	
 899:			if (!perm)
 900:				return -EPERM;
 901:			if (get_user(ll, &vtsizes->v_rows) ||
 902:			    get_user(cc, &vtsizes->v_cols))
 903:				return -EFAULT;
 904:	
 905:			guard(console_lock)();
 906:			for (i = 0; i < MAX_NR_CONSOLES; i++) {
 907:				vc = vc_cons[i].d;
 908:	
 909:				if (vc) {
 910:					/* FIXME: review v tty lock */
 911:					ret = __vc_resize(vc_cons[i].d, cc, ll, true);
 912:					if (ret)
 913:						return ret;
 914:				}
 915:			}
 916:			break;
 917:		}
 918:	
 919:		case VT_RESIZEX:
 920:			if (!perm)
 921:				return -EPERM;
 922:	
 923:			return vt_resizex(vc, up);
 924:	
 925:		case VT_LOCKSWITCH:
 926:			if (!capable(CAP_SYS_TTY_CONFIG))
 927:				return -EPERM;
 928:			vt_dont_switch = true;
 929:			break;
 930:		case VT_UNLOCKSWITCH:
 931:			if (!capable(CAP_SYS_TTY_CONFIG))
 932:				return -EPERM;
 933:			vt_dont_switch = false;
 934:			break;
 935:		case VT_GETHIFONTMASK:
 936:			return put_user(vc->vc_hi_font_mask,
 937:						(unsigned short __user *)arg);
 938:		case VT_WAITEVENT:
 939:			return vt_event_wait_ioctl((struct vt_event __user *)arg);
 940:	
 941:		case VT_GETCONSIZECSRPOS:
 942:		{
 943:			struct vt_consizecsrpos concsr;
 944:	
 945:			console_lock();
 946:			concsr.con_cols = vc->vc_cols;
 947:			concsr.con_rows = vc->vc_rows;
 948:			concsr.csr_col = vc->state.x;
 949:			concsr.csr_row = vc->state.y;
 950:			console_unlock();
 951:			if (copy_to_user(up, &concsr, sizeof(concsr)))
 952:				return -EFAULT;
 953:			return 0;
 954:		}
 955:	
 956:		default:
 957:			return -ENOIOCTLCMD;
 958:		}
 959:	
 960:		return 0;
 961:	}
 SourceFile:drivers/tty/vt/vt_ioctl.c]

gemini-3-pro-preview

							input: 46736
							output: 42
							thoughts: 449
						

**Analyzing a Potential VT_RESIZE Hang**

Okay, let's break this down. I see that the `vt_ioctl` function handles `VT_RESIZE` with a `guard(console_lock)()`. Right, that's expected; it needs synchronization across consoles. Inside the `VT_RESIZE` case, it iterates through consoles and calls `__vc_resize`. The critical part is the potential blocking nature of `__vc_resize`.

My immediate concern is: does `__vc_resize` hold `console_lock` if it blocks? Yes, it seems like it does because the `guard` is not released until the end. Now, I recall that `__vc_resize` calls `vc_do_resize` which allocates memory. Aha, that's a key point. Could we be seeing a hang due to blocking in memory allocation within `vc_do_resize` while holding the `console_lock`? It's certainly plausible.

If it were blocked in memory allocation, it *should* show up in the hung task report. However, the hung task report is only pointing at `con_install` being blocked on `console_lock`. That's a puzzle. The report is not telling me what I want.

Now, the bug report says `syz.5.2008` is holding the `console_lock`. And it says the task is holding six locks. That's strange. The report should explicitly list the locks. It doesn't.

If `syz.5.2008` is running and blocked, perhaps it is in an infinite loop somewhere. Where could it be looping while holding the `console_lock`? I need to check the code again. Let's start by looking closely at `__vc_resize` because it is the one that is called from the section that takes the lock and is called for each console.

map[ContextFile:drivers/tty/vt/vt.c IncludeLines:true Name:__vc_resize]

map[SourceCode:1281:	/**
1282:	 * __vc_resize - resize a VT
1283:	 * @vc: virtual console
1284:	 * @cols: columns
1285:	 * @rows: rows
1286:	 * @from_user: invoked by a user?
1287:	 *
1288:	 * Resize a virtual console as seen from the console end of things. We use the
1289:	 * common vc_do_resize() method to update the structures.
1290:	 *
1291:	 * Locking: The caller must hold the console sem to protect console internals
1292:	 * and @vc->port.tty.
1293:	 */
1294:	int __vc_resize(struct vc_data *vc, unsigned int cols, unsigned int rows,
1295:			bool from_user)
1296:	{
1297:		return vc_do_resize(vc->port.tty, vc, cols, rows, from_user);
1298:	}
 SourceFile:drivers/tty/vt/vt.c]

gemini-3-pro-preview

							input: 47936
							output: 43
							thoughts: 11
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Investigating `vc_do_resize`**

Alright, time to dive in. My mind immediately goes to `vc_do_resize`. It's the logical starting point, isn't it? We know we're dealing with resizing, so I need to understand what's happening at the core level. Let's see what's triggered, what parameters are being fed into it, and what other functions are getting called within `vc_do_resize`. Gotta track down what logic is being used to make the relevant decisions here and get an overview of the data flow.

map[ContextFile:drivers/tty/vt/vt.c IncludeLines:true Name:vc_do_resize]

map[SourceCode:1120:	/**
1121:	 * vc_do_resize - resizing method for the tty
1122:	 * @tty: tty being resized
1123:	 * @vc: virtual console private data
1124:	 * @cols: columns
1125:	 * @lines: lines
1126:	 * @from_user: invoked by a user?
1127:	 *
1128:	 * Resize a virtual console, clipping according to the actual constraints. If
1129:	 * the caller passes a tty structure then update the termios winsize
1130:	 * information and perform any necessary signal handling.
1131:	 *
1132:	 * Locking: Caller must hold the console semaphore. Takes the termios rwsem and
1133:	 * ctrl.lock of the tty IFF a tty is passed.
1134:	 */
1135:	static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
1136:				unsigned int cols, unsigned int lines, bool from_user)
1137:	{
1138:		unsigned long old_origin, new_origin, new_scr_end, rlth, rrem, err = 0;
1139:		unsigned long end;
1140:		unsigned int old_rows, old_row_size, first_copied_row;
1141:		unsigned int new_cols, new_rows, new_row_size, new_screen_size;
1142:		unsigned short *oldscreen, *newscreen;
1143:		u32 **new_uniscr = NULL;
1144:	
1145:		WARN_CONSOLE_UNLOCKED();
1146:	
1147:		if (cols > VC_MAXCOL || lines > VC_MAXROW)
1148:			return -EINVAL;
1149:	
1150:		new_cols = (cols ? cols : vc->vc_cols);
1151:		new_rows = (lines ? lines : vc->vc_rows);
1152:		new_row_size = new_cols << 1;
1153:		new_screen_size = new_row_size * new_rows;
1154:	
1155:		if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) {
1156:			/*
1157:			 * This function is being called here to cover the case
1158:			 * where the userspace calls the FBIOPUT_VSCREENINFO twice,
1159:			 * passing the same fb_var_screeninfo containing the fields
1160:			 * yres/xres equal to a number non-multiple of vc_font.height
1161:			 * and yres_virtual/xres_virtual equal to number lesser than the
1162:			 * vc_font.height and yres/xres.
1163:			 * In the second call, the struct fb_var_screeninfo isn't
1164:			 * being modified by the underlying driver because of the
1165:			 * if above, and this causes the fbcon_display->vrows to become
1166:			 * negative and it eventually leads to out-of-bound
1167:			 * access by the imageblit function.
1168:			 * To give the correct values to the struct and to not have
1169:			 * to deal with possible errors from the code below, we call
1170:			 * the resize_screen here as well.
1171:			 */
1172:			return resize_screen(vc, new_cols, new_rows, from_user);
1173:		}
1174:	
1175:		if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size)
1176:			return -EINVAL;
1177:		newscreen = kzalloc(new_screen_size, GFP_USER);
1178:		if (!newscreen)
1179:			return -ENOMEM;
1180:	
1181:		if (vc->vc_uni_lines) {
1182:			new_uniscr = vc_uniscr_alloc(new_cols, new_rows);
1183:			if (!new_uniscr) {
1184:				kfree(newscreen);
1185:				return -ENOMEM;
1186:			}
1187:		}
1188:	
1189:		if (vc_is_sel(vc))
1190:			clear_selection();
1191:	
1192:		old_rows = vc->vc_rows;
1193:		old_row_size = vc->vc_size_row;
1194:	
1195:		err = resize_screen(vc, new_cols, new_rows, from_user);
1196:		if (err) {
1197:			kfree(newscreen);
1198:			vc_uniscr_free(new_uniscr);
1199:			return err;
1200:		}
1201:	
1202:		vc->vc_rows = new_rows;
1203:		vc->vc_cols = new_cols;
1204:		vc->vc_size_row = new_row_size;
1205:		vc->vc_screenbuf_size = new_screen_size;
1206:	
1207:		rlth = min(old_row_size, new_row_size);
1208:		rrem = new_row_size - rlth;
1209:		old_origin = vc->vc_origin;
1210:		new_origin = (long) newscreen;
1211:		new_scr_end = new_origin + new_screen_size;
1212:	
1213:		if (vc->state.y > new_rows) {
1214:			if (old_rows - vc->state.y < new_rows) {
1215:				/*
1216:				 * Cursor near the bottom, copy contents from the
1217:				 * bottom of buffer
1218:				 */
1219:				first_copied_row = (old_rows - new_rows);
1220:			} else {
1221:				/*
1222:				 * Cursor is in no man's land, copy 1/2 screenful
1223:				 * from the top and bottom of cursor position
1224:				 */
1225:				first_copied_row = (vc->state.y - new_rows/2);
1226:			}
1227:			old_origin += first_copied_row * old_row_size;
1228:		} else
1229:			first_copied_row = 0;
1230:		end = old_origin + old_row_size * min(old_rows, new_rows);
1231:	
1232:		vc_uniscr_copy_area(new_uniscr, new_cols, new_rows,
1233:				    vc->vc_uni_lines, rlth/2, first_copied_row,
1234:				    min(old_rows, new_rows));
1235:		vc_uniscr_set(vc, new_uniscr);
1236:	
1237:		update_attr(vc);
1238:	
1239:		while (old_origin < end) {
1240:			scr_memcpyw((unsigned short *) new_origin,
1241:				    (unsigned short *) old_origin, rlth);
1242:			if (rrem)
1243:				scr_memsetw((void *)(new_origin + rlth),
1244:					    vc->vc_video_erase_char, rrem);
1245:			old_origin += old_row_size;
1246:			new_origin += new_row_size;
1247:		}
1248:		if (new_scr_end > new_origin)
1249:			scr_memsetw((void *)new_origin, vc->vc_video_erase_char,
1250:				    new_scr_end - new_origin);
1251:		oldscreen = vc->vc_screenbuf;
1252:		vc->vc_screenbuf = newscreen;
1253:		vc->vc_screenbuf_size = new_screen_size;
1254:		set_origin(vc);
1255:		kfree(oldscreen);
1256:	
1257:		/* do part of a reset_terminal() */
1258:		vc->vc_top = 0;
1259:		vc->vc_bottom = vc->vc_rows;
1260:		gotoxy(vc, vc->state.x, vc->state.y);
1261:		save_cur(vc);
1262:	
1263:		if (tty) {
1264:			/* Rewrite the requested winsize data with the actual
1265:			   resulting sizes */
1266:			struct winsize ws;
1267:			memset(&ws, 0, sizeof(ws));
1268:			ws.ws_row = vc->vc_rows;
1269:			ws.ws_col = vc->vc_cols;
1270:			ws.ws_ypixel = vc->vc_scan_lines;
1271:			tty_do_resize(tty, &ws);
1272:		}
1273:	
1274:		if (con_is_visible(vc))
1275:			update_screen(vc);
1276:		vt_event_post(VT_EVENT_RESIZE, vc->vc_num, vc->vc_num);
1277:		notify_update(vc);
1278:		return err;
1279:	}
 SourceFile:drivers/tty/vt/vt.c]

gemini-3-pro-preview

							input: 50774
							output: 43
							thoughts: 300
						

**Analyzing a Potential Hang During VT_RESIZE**

Okay, so I'm looking at this trace and trying to piece together why a task seems to be hanging for over two minutes during a virtual terminal resize (`VT_RESIZE`). The core function seems to be `vc_do_resize`, and the immediate thing that jumps out is that it uses `kzalloc(new_screen_size, GFP_USER)`. My gut tells me that `GFP_USER` is a potential red flag, because it can block waiting on memory reclaim. That would cause a hang, but I'd expect to see that in the hung task report, which I don't.

But wait, what if the context is more specific? My hypothesis now is that `syz.5.2008` is calling `VT_RESIZE` inside of `vt_ioctl` and that it's doing it for *every* console. Let's see... looking at the code, it iterates through `MAX_NR_CONSOLES`, calling `__vc_resize` on each one. If `MAX_NR_CONSOLES` is 63, that’s 63 resize operations, sequentially. That's a lot of operations. But that still shouldn't take over two minutes unless it's blocked.

So what's the blocking resource? Could it be `tty_mutex`? Let's trace it through `__vc_resize` to `vc_do_resize`, and then to `tty_do_resize` to see if we see it locking that mutex. If it is blocking on that mutex, that would explain the hang.

map[ContextFile:drivers/tty/tty_io.c IncludeLines:true Name:tty_do_resize]

map[SourceCode:2316:	/**
2317:	 * tty_do_resize - resize event
2318:	 * @tty: tty being resized
2319:	 * @ws: new dimensions
2320:	 *
2321:	 * Update the termios variables and send the necessary signals to peform a
2322:	 * terminal resize correctly.
2323:	 */
2324:	int tty_do_resize(struct tty_struct *tty, struct winsize *ws)
2325:	{
2326:		struct pid *pgrp;
2327:	
2328:		guard(mutex)(&tty->winsize_mutex);
2329:	
2330:		if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
2331:			return 0;
2332:	
2333:		/* Signal the foreground process group */
2334:		pgrp = tty_get_pgrp(tty);
2335:		if (pgrp)
2336:			kill_pgrp(pgrp, SIGWINCH, 1);
2337:		put_pid(pgrp);
2338:	
2339:		tty->winsize = *ws;
2340:	
2341:		return 0;
2342:	}
 SourceFile:drivers/tty/tty_io.c]

gemini-3-pro-preview

							input: 51857
							output: 43
							thoughts: 1179
						

**Analyzing a Softlockup in Console Unlock**

Okay, let's break this down. I see a `tty_do_resize` call attempting to acquire `tty->winsize_mutex`. The question is, is that mutex held by someone else? If it were, `syz.5.2008` (the task in question, I'm assuming from the bug report) would be blocked. But the bug report doesn't show it as blocked. That's a key observation.

If `syz.5.2008` isn't blocked, it must be running. And if it's running but causing a lockup, it's *spinning*. The question is, where? `console_unlock` is the obvious suspect. Wait, if it's spinning in `console_unlock`, it would be holding `console_lock`. And it would be running, so still wouldn't be in the blocked tasks list. The fact the bug report shows `[L]=SOFTLOCKUP` is the clincher. So, it's highly likely `syz.5.2008` is spinning in `console_unlock`.

Why would it be spinning there? Because something is *constantly* calling `printk`. Is it a tight loop in another task? Or, could it be the task itself, perhaps via a Syzkaller test? `console_unlock` loops over the printk buffer. But, `console_unlock` has a lock handoff mechanism - it should yield if other tasks call `printk` continuously. So, it shouldn't spin forever with other tasks calling `printk`.

But what if the *other* task isn't calling `printk` directly? What if it's generating messages that an interrupt handler prints? Or what if `syz.5.2008` is generating a huge stream of output itself? Let's check on the locks. `syz.5.2008` is holding six locks. If it's in `console_unlock`, it *must* hold `console_lock`. What are the other five? Maybe a syscall with internal `printk` calls? A likely scenario is `tty_open` since I have seen `tty_mutex` and `tty->legacy_mutex` used there.

Ah, look! I see `syz.8.2015` holds `tty_mutex` and `tty->legacy_mutex`! `syz.8.2015` is blocked in `con_install` on `console_lock`. So, it's *not* the one holding `console_lock`. Okay, back to square one, who *is* holding `console_lock`? Could it be `syz.5.2008`?

If `syz.5.2008` is in `console_unlock`, it's likely generating a ton of messages, somehow. A Syzkaller program causing a flood of warnings, perhaps? I know `console_unlock` can softlockup with massive printk output, but Syzkaller usually ignores these unless they lead to a hung task. But here it did - because `con_install` is blocked for 143 seconds.

Now, is there a way to trigger an infinite loop in `console_unlock` *without* another task explicitly calling `printk` in a tight loop? Yes! If the *console driver itself* calls `printk`! If the `write` function of the console driver calls `printk`, it feeds the infinite loop!

The bug report mentions `con_install`, so it's a virtual console (`vt`). Now, I need to check the `vt_console_driver`'s `write` function for any `printk` calls. I bet that's where the bug lies. Let's dig into the code!

map[ContextFile:drivers/tty/vt/vt.c IncludeLines:true Name:vt_console_print]

map[SourceCode:3345:	static void vt_console_print(struct console *co, const char *b, unsigned count)
3346:	{
3347:		struct vc_data *vc = vc_cons[fg_console].d;
3348:		unsigned char c;
3349:		static DEFINE_SPINLOCK(printing_lock);
3350:		const ushort *start;
3351:		ushort start_x, cnt;
3352:		int kmsg_console;
3353:	
3354:		WARN_CONSOLE_UNLOCKED();
3355:	
3356:		/* this protects against concurrent oops only */
3357:		if (!spin_trylock(&printing_lock))
3358:			return;
3359:	
3360:		kmsg_console = vt_get_kmsg_redirect();
3361:		if (kmsg_console && vc_cons_allocated(kmsg_console - 1))
3362:			vc = vc_cons[kmsg_console - 1].d;
3363:	
3364:		if (!vc_cons_allocated(fg_console)) {
3365:			/* impossible */
3366:			/* printk("vt_console_print: tty %d not allocated ??\n", currcons+1); */
3367:			goto quit;
3368:		}
3369:	
3370:		if (vc->vc_mode != KD_TEXT)
3371:			goto quit;
3372:	
3373:		/* undraw cursor first */
3374:		if (con_is_fg(vc))
3375:			hide_cursor(vc);
3376:	
3377:		start = (ushort *)vc->vc_pos;
3378:		start_x = vc->state.x;
3379:		cnt = 0;
3380:		while (count--) {
3381:			c = *b++;
3382:			if (c == ASCII_LINEFEED || c == ASCII_CAR_RET ||
3383:			    c == ASCII_BACKSPACE || vc->vc_need_wrap) {
3384:				if (cnt && con_is_visible(vc))
3385:					vc->vc_sw->con_putcs(vc, start, cnt, vc->state.y, start_x);
3386:				cnt = 0;
3387:				if (c == ASCII_BACKSPACE) {
3388:					bs(vc);
3389:					start = (ushort *)vc->vc_pos;
3390:					start_x = vc->state.x;
3391:					continue;
3392:				}
3393:				if (c != ASCII_CAR_RET)
3394:					lf(vc);
3395:				cr(vc);
3396:				start = (ushort *)vc->vc_pos;
3397:				start_x = vc->state.x;
3398:				if (c == ASCII_LINEFEED || c == ASCII_CAR_RET)
3399:					continue;
3400:			}
3401:			vc_uniscr_putc(vc, c);
3402:			scr_writew((vc->vc_attr << 8) + c, (unsigned short *)vc->vc_pos);
3403:			notify_write(vc, c);
3404:			cnt++;
3405:			if (vc->state.x == vc->vc_cols - 1) {
3406:				vc->vc_need_wrap = 1;
3407:			} else {
3408:				vc->vc_pos += 2;
3409:				vc->state.x++;
3410:			}
3411:		}
3412:		if (cnt && con_is_visible(vc))
3413:			vc->vc_sw->con_putcs(vc, start, cnt, vc->state.y, start_x);
3414:		set_cursor(vc);
3415:		notify_update(vc);
3416:	
3417:	quit:
3418:		spin_unlock(&printing_lock);
3419:	}
 SourceFile:drivers/tty/vt/vt.c]

gemini-3-pro-preview

							input: 55075
							output: 41
							thoughts: 44
						

Okay, let's see...

**Deconstructing the Console Output Process**

Hmm, so `vt_console_print` is the key function here. Now, that function's calling `notify_write(vc, c)` and `notify_update(vc)`. Right, right. That makes sense on the surface – we're writing to something and then likely updating the display. My gut tells me these functions are where the real work of sending characters to the screen happens. Now I need to dive deeper into `notify_write` and `notify_update` to understand precisely *how* the console is being managed. That's where the interesting stuff likely is – the character handling and actual screen buffer updates. Let's dig in.

map[ContextFile:drivers/tty/vt/vt.c IncludeLines:true Name:notify_write]

map[SourceCode: 258:	static void notify_write(struct vc_data *vc, unsigned int unicode)
 259:	{
 260:		struct vt_notifier_param param = { .vc = vc, .c = unicode };
 261:		atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
 262:	}
 SourceFile:drivers/tty/vt/vt.c]

gemini-3-pro-preview

							input: 55443
							output: 44
							thoughts: 40
						

**Delving into the Virtual Terminal Notifier Mechanism**

Okay, so I'm looking at this `atomic_notifier_call_chain` function and it's clear it's the core of the notifier system. My initial focus is on figuring out *who* is actually getting notified, and more specifically, who's registering themselves with this `vt_notifier_list`. That's the key to understanding how these virtual terminal events are actually handled.

So, where do I start? The most logical move is to look for the registration call, and that means I'm going to search the kernel source for the `register_vt_notifier` function. That should lead me directly to the code that’s setting up the notification chain. From there, I can analyze the registered functions to understand the response.

map[ContextFile:drivers/tty/vt/vt.c IncludeSnippetLines:0 Name:register_vt_notifier]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:vcs_poll_data_get SourceFile:drivers/tty/vt/vc_screen.c SourceLine:149]] TruncatedOutput:false]

gemini-3-pro-preview

							input: 55773
							output: 48
							thoughts: 29
						

Here's a summary of my thought process, as if I were analyzing that code snippet:

**Diving into the `vcs_poll_data_get` Function**

Okay, so I'm seeing `vcs_poll_data_get` mentioned, and it looks like it's registering a notifier. My first instinct, as always, is to dig deeper. I need to understand what this function *does* and why it's using a notifier. Is it related to handling asynchronous events, or perhaps signal propagation? Is this an internal polling function?

I'm mentally running through potential scenarios. What kind of VCS is this related to? Git? Mercurial? Something custom? The context around `vcs_poll_data_get` is critical. Without that surrounding information, I can only make high level guesses, for instance, in a Git context, this might be related to fetching remote data in the background, or tracking changes to the working tree. Let me get right to `vcs_poll_data_get`.

map[ContextFile:drivers/tty/vt/vc_screen.c IncludeLines:true Name:vcs_poll_data_get]

map[SourceCode: 126:	static struct vcs_poll_data *
 127:	vcs_poll_data_get(struct file *file)
 128:	{
 129:		struct vcs_poll_data *poll = file->private_data, *kill = NULL;
 130:	
 131:		if (poll)
 132:			return poll;
 133:	
 134:		poll = kzalloc_obj(*poll);
 135:		if (!poll)
 136:			return NULL;
 137:		poll->cons_num = console(file_inode(file));
 138:		init_waitqueue_head(&poll->waitq);
 139:		poll->notifier.notifier_call = vcs_notifier;
 140:		/*
 141:		 * In order not to lose any update event, we must pretend one might
 142:		 * have occurred before we have a chance to register our notifier.
 143:		 * This is also how user space has come to detect which kernels
 144:		 * support POLLPRI on /dev/vcs* devices i.e. using poll() with
 145:		 * POLLPRI and a zero timeout.
 146:		 */
 147:		poll->event = VT_UPDATE;
 148:	
 149:		if (register_vt_notifier(&poll->notifier) != 0) {
 150:			kfree(poll);
 151:			return NULL;
 152:		}
 153:	
 154:		/*
 155:		 * This code may be called either through ->poll() or ->fasync().
 156:		 * If we have two threads using the same file descriptor, they could
 157:		 * both enter this function, both notice that the structure hasn't
 158:		 * been allocated yet and go ahead allocating it in parallel, but
 159:		 * only one of them must survive and be shared otherwise we'd leak
 160:		 * memory with a dangling notifier callback.
 161:		 */
 162:		spin_lock(&file->f_lock);
 163:		if (!file->private_data) {
 164:			file->private_data = poll;
 165:		} else {
 166:			/* someone else raced ahead of us */
 167:			kill = poll;
 168:			poll = file->private_data;
 169:		}
 170:		spin_unlock(&file->f_lock);
 171:		if (kill)
 172:			vcs_poll_data_free(kill);
 173:	
 174:		return poll;
 175:	}
 SourceFile:drivers/tty/vt/vc_screen.c]

gemini-3-pro-preview

							input: 56827
							output: 44
							thoughts: 45
						

Okay, here's my interpretation of those thoughts, presented as a personal thought process, as requested:

**Navigating the VCS Polling Logic**

Alright, let's see, I'm trying to trace the flow of this version control system polling mechanism. The core question is: where does the data retrieval actually *happen*? My initial thought is about the relationship between `vcs_poll_data_get` and its callers. Is it being triggered directly by `vcs_poll`, or is it being scheduled via `vcs_fasync`? That distinction is important for understanding how concurrency and the event loop are involved.

And since I suspect these are all interelated, I'm thinking, "if `vcs_notifier` is invoked, what's its purpose? What does it do?" The call to `vcs_notifier` likely signifies the point where updates or changes have happened, maybe events that can be used to wake up the system to take action, and I need to figure out what that action is. Understanding the roles of these function calls is crucial to understanding the full picture of the data flow and any associated threading.

map[ContextFile:drivers/tty/vt/vc_screen.c IncludeLines:true Name:vcs_notifier]

map[SourceCode:  85:	static int
  86:	vcs_notifier(struct notifier_block *nb, unsigned long code, void *_param)
  87:	{
  88:		struct vt_notifier_param *param = _param;
  89:		struct vc_data *vc = param->vc;
  90:		struct vcs_poll_data *poll =
  91:			container_of(nb, struct vcs_poll_data, notifier);
  92:		int currcons = poll->cons_num;
  93:		int fa_band;
  94:	
  95:		switch (code) {
  96:		case VT_UPDATE:
  97:			fa_band = POLL_PRI;
  98:			break;
  99:		case VT_DEALLOCATE:
 100:			fa_band = POLL_HUP;
 101:			break;
 102:		default:
 103:			return NOTIFY_DONE;
 104:		}
 105:	
 106:		if (currcons == 0)
 107:			currcons = fg_console;
 108:		else
 109:			currcons--;
 110:		if (currcons != vc->vc_num)
 111:			return NOTIFY_DONE;
 112:	
 113:		poll->event = code;
 114:		wake_up_interruptible(&poll->waitq);
 115:		kill_fasync(&poll->fasync, SIGIO, fa_band);
 116:		return NOTIFY_OK;
 117:	}
 SourceFile:drivers/tty/vt/vc_screen.c]

gemini-3-pro-preview

							input: 57621
							output: 41
							thoughts: 626
						

**Analyzing Potential Performance Bottlenecks in Virtual Console Resizing**

Okay, let's break this down. My initial thought is that `vcs_notifier` is the key – it calls `wake_up_interruptible` and `kill_fasync`. If `kill_fasync` sends a signal, that could be where things get triggered. But, the question is what triggers `vcs_notifier`. It looks like it can be called from `vt_console_print` via `notify_update(vc)` and `atomic_notifier_call_chain(&vt_notifier_list, VT_UPDATE, &param)`. I need to ensure there isn't a `printk` call hidden inside the calls that happen following that sequence. I almost never see printk inside the kill_fasync or wake_up_interruptible code.

Then I wondered, is the console driver `fbcon`? `fbcon` is a console driver, and I need to check whether it's the culprit. Does `fbcon` call `printk`? I'll investigate `fbcon_putcs` or `fbcon_cursor`. If it does, that's a straightforward bug. It's important to remember that `fbcon` isn't the only console driver, so I can't write it off completely.

My focus then shifts to the hypothetical `syz.5.2008` doing an `ioctl(VT_RESIZE)`. If that's the case, it holds `console_lock`. The critical detail here is that the resize loops through *all* consoles:

```c
		guard(console_lock)();
		for (i = 0; i < MAX_NR_CONSOLES; i++) {
			vc = vc_cons[i].d;

			if (vc) {
				/* FIXME: review v tty lock */
				ret = __vc_resize(vc_cons[i].d, cc, ll, true);
				if (ret)
					return ret;
			}
		}
```

Now, the concern is that if `__vc_resize` takes too long, it holds `console_lock` for a long time. Why might `__vc_resize` be slow? Because it allocates memory: `kzalloc(new_screen_size, GFP_USER)`. If `new_screen_size` is large, it could trigger memory reclaim, which, as we know, can be expensive.

Okay, let's put in some guardrails. I realize that `new_screen_size` is limited by `KMALLOC_MAX_SIZE`:

```c
	if (new_screen_size > KMALLOC_MAX_SIZE || !new_screen_size)
		return -EINVAL;
```

`KMALLOC_MAX_SIZE` is likely 4MB or 8MB. So, if we allocate 4MB 63 times, we're talking about around 252MB. This *shouldn't* take 143 seconds to allocate. I need to dig deeper. What if `__vc_resize` then calls `resize_screen`? That's the next avenue to explore.

map[ContextFile:drivers/tty/vt/vt.c IncludeLines:true Name:resize_screen]

map[SourceCode:1108:	static inline int resize_screen(struct vc_data *vc, int width, int height,
1109:					bool from_user)
1110:	{
1111:		/* Resizes the resolution of the display adapater */
1112:		int err = 0;
1113:	
1114:		if (vc->vc_sw->con_resize)
1115:			err = vc->vc_sw->con_resize(vc, width, height, from_user);
1116:	
1117:		return err;
1118:	}
 SourceFile:drivers/tty/vt/vt.c]

gemini-3-pro-preview

							input: 59173
							output: 46
							thoughts: 19
						

Here's my summary, as I see it:

**Thinking Through a Console Resize**

Alright, let me break this down. I'm looking at `vc->vc_sw->con_resize`. That pointer chain is pretty standard in the console subsystem. My gut reaction is that we might be able to simplify things by making this equivalent to `fbcon_resize`. It seems like a clean mapping that could streamline the code and reduce some redundancy. I need to dig deeper, of course, but that's my initial hypothesis. There may be some nuances specific to the framebuffer console that need to be addressed, but this alignment is definitely worth exploring. Simplifying this could have benefits down the line.

map[ContextFile:drivers/video/fbdev/core/fbcon.c IncludeLines:true Name:fbcon_resize]

map[SourceCode:2042:	static int fbcon_resize(struct vc_data *vc, unsigned int width,
2043:				unsigned int height, bool from_user)
2044:	{
2045:		struct fb_info *info = fbcon_info_from_console(vc->vc_num);
2046:		struct fbcon_par *par = info->fbcon_par;
2047:		struct fbcon_display *p = &fb_display[vc->vc_num];
2048:		struct fb_var_screeninfo var = info->var;
2049:		int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
2050:	
2051:		if (p->userfont && FNTSIZE(vc->vc_font.data)) {
2052:			int size;
2053:			int pitch = PITCH(vc->vc_font.width);
2054:	
2055:			/*
2056:			 * If user font, ensure that a possible change to user font
2057:			 * height or width will not allow a font data out-of-bounds access.
2058:			 * NOTE: must use original charcount in calculation as font
2059:			 * charcount can change and cannot be used to determine the
2060:			 * font data allocated size.
2061:			 */
2062:			if (pitch <= 0)
2063:				return -EINVAL;
2064:			size = CALC_FONTSZ(vc->vc_font.height, pitch, vc->vc_font.charcount);
2065:			if (size > FNTSIZE(vc->vc_font.data))
2066:				return -EINVAL;
2067:		}
2068:	
2069:		virt_w = FBCON_SWAP(par->rotate, width, height);
2070:		virt_h = FBCON_SWAP(par->rotate, height, width);
2071:		virt_fw = FBCON_SWAP(par->rotate, vc->vc_font.width, vc->vc_font.height);
2072:		virt_fh = FBCON_SWAP(par->rotate, vc->vc_font.height, vc->vc_font.width);
2073:		var.xres = virt_w * virt_fw;
2074:		var.yres = virt_h * virt_fh;
2075:		x_diff = info->var.xres - var.xres;
2076:		y_diff = info->var.yres - var.yres;
2077:		if (x_diff < 0 || x_diff > virt_fw ||
2078:		    y_diff < 0 || y_diff > virt_fh) {
2079:			const struct fb_videomode *mode;
2080:	
2081:			pr_debug("attempting resize %ix%i\n", var.xres, var.yres);
2082:			mode = fb_find_best_mode(&var, &info->modelist);
2083:			if (mode == NULL)
2084:				return -EINVAL;
2085:			display_to_var(&var, p);
2086:			fb_videomode_to_var(&var, mode);
2087:	
2088:			if (virt_w > var.xres/virt_fw || virt_h > var.yres/virt_fh)
2089:				return -EINVAL;
2090:	
2091:			pr_debug("resize now %ix%i\n", var.xres, var.yres);
2092:			if (con_is_visible(vc) && vc->vc_mode == KD_TEXT) {
2093:				var.activate = FB_ACTIVATE_NOW |
2094:					FB_ACTIVATE_FORCE;
2095:				fb_set_var(info, &var);
2096:			}
2097:			var_to_display(p, &info->var, info);
2098:			par->var = info->var;
2099:		}
2100:		updatescrollmode(p, info, vc);
2101:		return 0;
2102:	}
 SourceFile:drivers/video/fbdev/core/fbcon.c]

gemini-3-pro-preview

							input: 60555
							output: 47
							thoughts: 1663
						

**Analyzing the Console Lock Hang in syz.5.2008**

Okay, let's break this down. My initial thought was that the long duration was directly related to the `fbcon_resize` call, specifically the potentially slow `fb_set_var` function, which, I recalled, can block on hardware or locks. However, upon further review, `fbcon_resize` is called per console, and only one console is visible at a time. This would mean that `fb_set_var` is not the culprit because it's only called once when the visible console changes.

I considered `__vc_resize` and the subsequent `update_screen` which, if the console is visible, calls `set_origin` and `vc->vc_sw->con_switch`. I initially thought that with `syz.5.2008` looping over multiple consoles, allocating memory and copying screen buffers for each, that could be the slow process, especially given the `scr_memcpyw` calls. The code snippet for `vc_do_resize` confirms this memory copy. But, even if there are a lot of consoles, the memory copy for each is at most `KMALLOC_MAX_SIZE` which is 4MB. Multiplying 4MB by 63 consoles results in 252MB. This shouldn't take 143 seconds.

I had to rethink this. Could `syz.5.2008` simply be a random task reported by the hung task detector, and not the actual owner of the lock? The bug report only mentions locks held by that task. The hung task detector actually prints locks held by all tasks in the system. The lockdep output from the bug report is thus misleading. Therefore, I need to figure out who is *actually* holding `console_lock`.

If the lock holder were blocked, it would be in the "blocked tasks" list. The list provided shows several tasks blocked in `tty_open` and `con_install`, one being `syz.8.2015` blocked in `con_install` and holding `tty_mutex`. All other blocked tasks were blocked on `tty_mutex` in either `tty_open` or `ptmx_open`. This means `syz.8.2015` is blocked while waiting for `console_lock` and holding `tty_mutex`.

Therefore, the `console_lock` holder must be *running*, if it isn't listed as blocked. A long timeout (143 seconds) on a running task suggests a spinlock. And the bug report does, in fact, show a soft lockup. The lock is being held by a running task. The location where the spinlock is occurring is `console_unlock`. That's the key.

Why would something spin in `console_unlock`? An infinite stream of `printk` messages! Could this be `syzkaller` itself generating the messages? That's a known potential source of problems. But if it's *just* printk messages, the task in `console_unlock` should eventually complete, or release the lock to another task. Unless the task generating the messages is the same task holding `console_lock`! If a task holds `console_lock` and calls `printk`, the message is queued but *not* printed immediately because the lock is held. So when that task calls `console_unlock` it loops over and *prints* the buffer. If that printing itself generates *more* messages, it's an infinite loop!

Does the printing generate more messages? I looked at `vt_console_print`. It calls `notify_write` and `notify_update`. `notify_write` uses `atomic_notifier_call_chain` with `VT_WRITE`. Is there a notifier registered that calls `printk`? After checking, the `vcs_notifier` does *not* do this. But could some other part of the console subsystem be doing it? I considered `fbcon`. If `fbcon` is in use, `vc->vc_sw->con_putcs` would be `fbcon_putcs`. I'll have to investigate that.

map[ContextFile:drivers/video/fbdev/core/fbcon.c IncludeLines:true Name:fbcon_putcs]

map[SourceCode:1336:	static void fbcon_putcs(struct vc_data *vc, const u16 *s, unsigned int count,
1337:				unsigned int ypos, unsigned int xpos)
1338:	{
1339:		struct fb_info *info = fbcon_info_from_console(vc->vc_num);
1340:		struct fbcon_display *p = &fb_display[vc->vc_num];
1341:		struct fbcon_par *par = info->fbcon_par;
1342:	
1343:		if (fbcon_is_active(vc, info))
1344:			par->bitops->putcs(vc, info, s, count, real_y(p, ypos), xpos,
1345:					   get_fg_color(vc, info, scr_readw(s)),
1346:					   get_bg_color(vc, info, scr_readw(s)));
1347:	}
 SourceFile:drivers/video/fbdev/core/fbcon.c]

gemini-3-pro-preview

							input: 63455
							output: 44
							thoughts: 1810
						

**Analyzing a Long Lock Hold in the Console Subsystem**

Okay, let's break this down. We've got a likely hang, and the smoking gun seems to be `syz.5.2008` holding `console_lock` for an excessive 143 seconds, preventing `syz.8.2015` from proceeding.  My first hunch, given the context, was `par->bitops->putcs` and whether it might be calling `printk` in some convoluted way, but that appears to be a dead end.

My mind immediately jumps to `ioctl(VT_RESIZE)` because it's known to be a console-related function that can take time. If `syz.5.2008` is the one doing `ioctl(VT_RESIZE)`, that would definitely hold `console_lock`, and the fact that it iterates over all 63 consoles is a red flag, as this implies a loop that could be time-consuming. However, a quick check of the task lists indicates the task is not blocked, meaning it's either in the R state or is spinning in the lock.

If `syz.5.2008` *is* running, maybe it's doing an `ioctl(VT_RESIZE)` that is being blocked in memory reclaim because of large allocations within that `ioctl` call, specifically the `kzalloc(new_screen_size, GFP_USER)`.  If that allocation blocks in memory reclaim using `GFP_USER`, then the process would be in the blocked tasks list. However, if the process is in the running (`R`) state, that means it is not in the blocked tasks list. If it is running, it could be spinning in `console_unlock`, but this doesn't explain the 143 seconds. Furthermore, `syz.5.2008` seems to be holding 6 locks, including `console_lock`, which is interesting.

So, if it *is* in `vt_ioctl` doing a `VT_RESIZE`, it should not be spinning in `console_unlock` because the lock is already held. Why is it taking so long, though?  Could it be interrupts constantly interrupting the process? Or is `VT_RESIZE` caught in some kind of loop? If it's the `VT_RESIZE` loop, the lock should be released and reacquired after each iteration. If it *is* releasing the lock, then `syz.8.2015` should have been able to proceed. Since `syz.8.2015` *is* blocked for 143 seconds, that means `console_lock` is *not* being released.  So who's holding it without releasing it?

Looking back at the `VT_RESIZE` implementation, there's a loop that calls `__vc_resize` for each console.  If `__vc_resize` returns an error, it exits and releases the lock. The critical part is that `__vc_resize` then calls `vc_do_resize`, which could potentially hold the lock for a while.

If the old and new row sizes are exceptionally large inside `vc_do_resize`, this could explain the hang. But `cols` and `lines` are capped by `VC_MAXCOL` and `VC_MAXROW` which are both huge values (32767).  This suggests `new_screen_size` could become massive - up to ~2GB - but that's then capped by `KMALLOC_MAX_SIZE`. If `KMALLOC_MAX_SIZE` is, say, 8MB, even then 63 loops of 8MB is 504MB. Copying 504MB on modern hardware is quite fast, it can't take 143 seconds.

Okay, let's step back. If it's *not* `VT_RESIZE`, what else could be holding the `console_lock`?  Time to exhaustively check everything. My list of functions shows a significant set of possibilities: all the `vt_ioctl` operations, `con_install`, `console_unblank`, many framebuffer and DRM related functions, console device, and some sysfs entries and legacy kernel threads. Then, *boom!* `vcs_read` and `vcs_write` appear on the list. These read/write the virtual console screen. That's interesting. I need to investigate those further. It's time to check what `syz.5.2008` is actually doing.

map[ContextFile:drivers/tty/vt/vc_screen.c IncludeLines:true Name:vcs_read]

map[SourceCode: 363:	static ssize_t
 364:	vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
 365:	{
 366:		struct inode *inode = file_inode(file);
 367:		struct vc_data *vc;
 368:		struct vcs_poll_data *poll;
 369:		unsigned int read;
 370:		ssize_t ret;
 371:		loff_t pos;
 372:		bool viewed, attr, uni_mode;
 373:	
 374:		char *con_buf __free(free_page_ptr) = (char *)__get_free_page(GFP_KERNEL);
 375:		if (!con_buf)
 376:			return -ENOMEM;
 377:	
 378:		pos = *ppos;
 379:	
 380:		/* Select the proper current console and verify
 381:		 * sanity of the situation under the console lock.
 382:		 */
 383:		guard(console_lock)();
 384:	
 385:		uni_mode = use_unicode(inode);
 386:		attr = use_attributes(inode);
 387:	
 388:		if (pos < 0)
 389:			return -EINVAL;
 390:		/* we enforce 32-bit alignment for pos and count in unicode mode */
 391:		if (uni_mode && (pos | count) & 3)
 392:			return -EINVAL;
 393:	
 394:		poll = file->private_data;
 395:		if (count && poll)
 396:			poll->event = 0;
 397:		read = 0;
 398:		ret = 0;
 399:		while (count) {
 400:			unsigned int this_round, skip = 0;
 401:			int size;
 402:	
 403:			vc = vcs_vc(inode, &viewed);
 404:			if (!vc) {
 405:				ret = -ENXIO;
 406:				break;
 407:			}
 408:	
 409:			/* Check whether we are above size each round,
 410:			 * as copy_to_user at the end of this loop
 411:			 * could sleep.
 412:			 */
 413:			size = vcs_size(vc, attr, uni_mode);
 414:			if (size < 0) {
 415:				ret = size;
 416:				break;
 417:			}
 418:			if (pos >= size)
 419:				break;
 420:			if (count > size - pos)
 421:				count = size - pos;
 422:	
 423:			this_round = count;
 424:			if (this_round > CON_BUF_SIZE)
 425:				this_round = CON_BUF_SIZE;
 426:	
 427:			/* Perform the whole read into the local con_buf.
 428:			 * Then we can drop the console spinlock and safely
 429:			 * attempt to move it to userspace.
 430:			 */
 431:	
 432:			if (uni_mode) {
 433:				ret = vcs_read_buf_uni(vc, con_buf, pos, this_round,
 434:						viewed);
 435:				if (ret)
 436:					break;
 437:			} else if (!attr) {
 438:				vcs_read_buf_noattr(vc, con_buf, pos, this_round,
 439:						viewed);
 440:			} else {
 441:				this_round = vcs_read_buf(vc, con_buf, pos, this_round,
 442:						viewed, &skip);
 443:			}
 444:	
 445:			/* Finally, release the console semaphore while we push
 446:			 * all the data to userspace from our temporary buffer.
 447:			 *
 448:			 * AKPM: Even though it's a semaphore, we should drop it because
 449:			 * the pagefault handling code may want to call printk().
 450:			 */
 451:	
 452:			console_unlock();
 453:			ret = copy_to_user(buf, con_buf + skip, this_round);
 454:			console_lock();
 455:	
 456:			if (ret) {
 457:				read += this_round - ret;
 458:				ret = -EFAULT;
 459:				break;
 460:			}
 461:			buf += this_round;
 462:			pos += this_round;
 463:			read += this_round;
 464:			count -= this_round;
 465:		}
 466:		*ppos += read;
 467:		if (read)
 468:			return read;
 469:	
 470:		return ret;
 471:	}
 SourceFile:drivers/tty/vt/vc_screen.c]

gemini-3-pro-preview

							input: 67792
							output: 44
							thoughts: 613
						

**Analyzing the Concurrency in `vcs_read`**

Okay, so I'm looking at this `vcs_read` function, and the first thing that jumps out is that it has `guard(console_lock)();` at the very beginning. Right, that's using the `DEFINE_GUARD` macro, so it's acquiring the `console_lock` and it should automatically release it when the function scope ends. Seems straightforward.

But then I see this bit of code inside the loop:

```c
		console_unlock();
		ret = copy_to_user(buf, con_buf + skip, this_round);
		console_lock();
```

My initial thought was, "Hold on, aren't we releasing and re-acquiring the lock unnecessarily? The guard should handle that." But then I re-read the macro. `guard(console_lock)` will release the lock at the *end* of the function. So, if the code were to break out of the loop *after* the `console_unlock()` call but *before* `console_lock()`, we'd have a double unlock! Bad news.

So, I need to check the loop's exit conditions. It seems that `copy_to_user` sets a failure and then `ret = -EFAULT` which triggers a `break`. After the `if(ret)` statement the program breaks with `console_lock()` held, and the guard should then call `console_unlock()` before returning. That's a valid path.

Let's look at `vcs_read_buf_uni` now. It's the same pattern, returning an error breaks the loop. In that case, too, the lock is correctly held and the guard will release the lock at the end. That's good.

Wait a second, what about infinite loops? Could `vcs_read` get stuck in an endless loop? I see that `count` is decreased by `this_round`, and `this_round` is limited to `CON_BUF_SIZE`. So, even if `count` is huge, the loop would run a number of times. Crucially, the code is releasing `console_lock` and reacquiring it in each iteration. It isn't holding the lock for an extended period, so it should be fine. I feel pretty good about it now.

Now, let's take a look at the `vcs_write` function...

map[ContextFile:drivers/tty/vt/vc_screen.c IncludeLines:true Name:vcs_write]

map[SourceCode: 584:	static ssize_t
 585:	vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 586:	{
 587:		struct inode *inode = file_inode(file);
 588:		struct vc_data *vc;
 589:		u16 *org0, *org;
 590:		unsigned int written;
 591:		int size;
 592:		ssize_t ret;
 593:		loff_t pos;
 594:		bool viewed, attr;
 595:	
 596:		if (use_unicode(inode))
 597:			return -EOPNOTSUPP;
 598:	
 599:		char *con_buf __free(free_page_ptr) = (char *)__get_free_page(GFP_KERNEL);
 600:		if (!con_buf)
 601:			return -ENOMEM;
 602:	
 603:		pos = *ppos;
 604:	
 605:		/* Select the proper current console and verify
 606:		 * sanity of the situation under the console lock.
 607:		 */
 608:		guard(console_lock)();
 609:	
 610:		attr = use_attributes(inode);
 611:		vc = vcs_vc(inode, &viewed);
 612:		if (!vc)
 613:			return -ENXIO;
 614:	
 615:		size = vcs_size(vc, attr, false);
 616:		if (size < 0)
 617:			return size;
 618:		if (pos < 0 || pos > size)
 619:			return -EINVAL;
 620:		if (count > size - pos)
 621:			count = size - pos;
 622:		written = 0;
 623:		while (count) {
 624:			unsigned int this_round = count;
 625:	
 626:			if (this_round > CON_BUF_SIZE)
 627:				this_round = CON_BUF_SIZE;
 628:	
 629:			/* Temporarily drop the console lock so that we can read
 630:			 * in the write data from userspace safely.
 631:			 */
 632:			console_unlock();
 633:			ret = copy_from_user(con_buf, buf, this_round);
 634:			console_lock();
 635:	
 636:			if (ret) {
 637:				this_round -= ret;
 638:				if (!this_round) {
 639:					/* Abort loop if no data were copied. Otherwise
 640:					 * fail with -EFAULT.
 641:					 */
 642:					if (written)
 643:						break;
 644:					return -EFAULT;
 645:				}
 646:			}
 647:	
 648:			/* The vc might have been freed or vcs_size might have changed
 649:			 * while we slept to grab the user buffer, so recheck.
 650:			 * Return data written up to now on failure.
 651:			 */
 652:			vc = vcs_vc(inode, &viewed);
 653:			if (!vc) {
 654:				if (written)
 655:					break;
 656:				return -ENXIO;
 657:			}
 658:			size = vcs_size(vc, attr, false);
 659:			if (size < 0) {
 660:				if (written)
 661:					break;
 662:				return size;
 663:			}
 664:			if (pos >= size)
 665:				break;
 666:			if (this_round > size - pos)
 667:				this_round = size - pos;
 668:	
 669:			/* OK, now actually push the write to the console
 670:			 * under the lock using the local kernel buffer.
 671:			 */
 672:	
 673:			if (attr)
 674:				org = vcs_write_buf(vc, con_buf, pos, this_round,
 675:						viewed, &org0);
 676:			else
 677:				org = vcs_write_buf_noattr(vc, con_buf, pos, this_round,
 678:						viewed, &org0);
 679:	
 680:			count -= this_round;
 681:			written += this_round;
 682:			buf += this_round;
 683:			pos += this_round;
 684:			if (org)
 685:				update_region(vc, (unsigned long)(org0), org - org0);
 686:		}
 687:		*ppos += written;
 688:		ret = written;
 689:		if (written)
 690:			vcs_scr_updated(vc);
 691:	
 692:		return ret;
 693:	}
 SourceFile:drivers/tty/vt/vc_screen.c]

gemini-3-pro-preview

							input: 70470
							output: 44
							thoughts: 885
						

**Debugging a Console Lock Hang**

Okay, so `vcs_write` releases the `console_lock` pretty quickly within its loop, which is good to know. The question then becomes, what else holds the `console_lock` for a significant amount of time? Ah, `con_install`. That function is holding it. Specifically, it calls `vc_allocate`, which allocates memory for the console. Could `vc_allocate` block for a long time? Potentially, if it gets stuck in `kzalloc`, it would show up on the blocked tasks list.

But, the crash report states that the process is hung in `con_install` *on* `console_lock`, which means it's *waiting* for the lock, not *holding* it. That's a key distinction. So, who *has* the `console_lock`? If nothing on the blocked tasks list has it, the lock-holder must be actively running. If it's running but stalled, it's *spinning*. Where could it be spinning? My gut tells me `console_unlock` is the likely culprit.

Why would `console_unlock` spin? Because an infinite stream of `printk` messages! How might we trigger this? `/dev/kmsg`? Writing to it in a loop seems like a possibility, but since `console_unlock` would hand over the lock eventually, that's not it. Wait! What if `console_unlock` is called with preemption *disabled*, and loops through the messages, but the messages are generated by an interrupt handler? Ah, that's a clever possibility.

If an interrupt handler generates messages faster than `console_unlock` can print them, then the lock would spin forever! Which interrupt handler could do this? A timer interrupt? A network interrupt? Or, could syzkaller be triggering some sort of warning in an interrupt handler? If syzkaller triggers a warning in an interrupt handler, a backtrace gets printed. That would generate a ton of messages, but normally syzkaller reports warnings. Wait, the bug title indicates that there isn't a prior warning, so that is unlikely.

But what if the infinite loop isn't in `console_unlock`? What about `vt_ioctl`? `VT_RESIZE` loops over `MAX_NR_CONSOLES`. Now, in the call to `__vc_resize`, it *looks* like there is some potential for issues. I would need to analyze that more closely. However, it only loops `MAX_NR_CONSOLES` which is 63, so it can't be an *infinite* loop. Could it be `VT_DISALLOCATE`? It looks like it could call `vt_disallocate_all`, which calls `vc_deallocate`.

map[ContextFile:drivers/tty/vt/vt.c IncludeLines:true Name:vt_disallocate_all]

map[SourceCode: 643:	/* deallocate all unused consoles, but leave 0 */
 644:	static void vt_disallocate_all(void)
 645:	{
 646:		struct vc_data *vc[MAX_NR_CONSOLES];
 647:		int i;
 648:	
 649:		scoped_guard(console_lock)
 650:			for (i = 1; i < MAX_NR_CONSOLES; i++)
 651:				if (!vt_busy(i))
 652:					vc[i] = vc_deallocate(i);
 653:				else
 654:					vc[i] = NULL;
 655:	
 656:		for (i = 1; i < MAX_NR_CONSOLES; i++) {
 657:			if (vc[i] && i >= MIN_NR_CONSOLES)
 658:				tty_port_put(&vc[i]->port);
 659:		}
 660:	}
 SourceFile:drivers/tty/vt/vt_ioctl.c]

gemini-3-pro-preview

							input: 72302
							output: 44
							thoughts: 317
						

**Analyzing a Performance Bottleneck: Disallocation and Active Console Waiting**

Okay, let's break this down. The problem seems to be an unexpectedly long delay, potentially 143 seconds, when dealing with virtual consoles. I've been tracing a call to `vt_disallocate_all`, and I see it iterates 63 times. Inside that loop, it calls `vc_deallocate`. Now, I know `vc_deallocate` is generally a fast operation. It involves freeing a `vc_data` structure and associated resources, calling `con_deinit`, decrementing a process ID reference count, freeing some unicode data, freeing the screen buffer, and clearing an allocated flag. Given my understanding of these operations, none of them should, individually or combined, consume that amount of time. Therefore, the issue isn't likely stemming from the repeated calls to `vc_deallocate`, as this should be quick.

My next line of investigation has to be what could be happening in the wider code base. I see that the kernel function `VT_WAITACTIVE` takes a console number as an argument. The function seems to wait for the console to become active before returning. It checks permissions and console numbers. It looks like it is returning a call to `vt_waitactive(arg)`. That's where the problem is. Maybe this is where the bottleneck is.

map[ContextFile:drivers/tty/vt/vt_ioctl.c IncludeLines:true Name:vt_waitactive]

map[SourceCode: 217:	int vt_waitactive(int n)
 218:	{
 219:		struct vt_event_wait vw;
 220:		do {
 221:			vw.event.event = VT_EVENT_SWITCH;
 222:			__vt_event_queue(&vw);
 223:			if (n == fg_console + 1) {
 224:				__vt_event_dequeue(&vw);
 225:				break;
 226:			}
 227:			__vt_event_wait(&vw);
 228:			__vt_event_dequeue(&vw);
 229:			if (vw.done == 0)
 230:				return -EINTR;
 231:		} while (vw.event.newev != n);
 232:		return 0;
 233:	}
 SourceFile:drivers/tty/vt/vt_ioctl.c]

gemini-3-pro-preview

							input: 73219
							output: 45
							thoughts: 107
						

Okay, let me break this down.

**Understanding Console Activation and Release**

Right, so `vt_waitactive` is designed to wait for a virtual console to become active. Critically, it *doesn't* hold the `console_lock`. That's important for concurrency, obviously. It's designed to be asynchronous.

Now, I'm thinking about how `VT_RELDISP` fits into this picture. We're dealing with display release, and that's usually where things get interesting, especially in multi-user environments. Let's look at that code snippet. Aha, `VT_RELDISP` has a permission check first, which makes sense to prevent unauthorized release of the display.

And there it is! `guard(console_lock)()` is used with `vt_reldisp`. It's protecting the release with a mutex. So the `console_lock` is held during `vt_reldisp` and then presumably released. This guarantees that `vt_reldisp` does its job correctly and prevents race conditions. Now it's clear: `vt_waitactive` waits, `vt_reldisp` releases, and the lock is used to control the state of the console. Good, good.

map[ContextFile:drivers/tty/vt/vt_ioctl.c IncludeLines:true Name:vt_reldisp]

map[SourceCode: 553:	static int vt_reldisp(struct vc_data *vc, unsigned int swtch)
 554:	{
 555:		int newvt, ret;
 556:	
 557:		if (vc->vt_mode.mode != VT_PROCESS)
 558:			return -EINVAL;
 559:	
 560:		/* Switched-to response */
 561:		if (vc->vt_newvt < 0) {
 562:			 /* If it's just an ACK, ignore it */
 563:			return swtch == VT_ACKACQ ? 0 : -EINVAL;
 564:		}
 565:	
 566:		/* Switching-from response */
 567:		if (swtch == 0) {
 568:			/* Switch disallowed, so forget we were trying to do it. */
 569:			vc->vt_newvt = -1;
 570:			return 0;
 571:		}
 572:	
 573:		/* The current vt has been released, so complete the switch. */
 574:		newvt = vc->vt_newvt;
 575:		vc->vt_newvt = -1;
 576:		ret = vc_allocate(newvt);
 577:		if (ret)
 578:			return ret;
 579:	
 580:		/*
 581:		 * When we actually do the console switch, make sure we are atomic with
 582:		 * respect to other console switches..
 583:		 */
 584:		complete_change_console(vc_cons[newvt].d);
 585:	
 586:		return 0;
 587:	}
 SourceFile:drivers/tty/vt/vt_ioctl.c]

gemini-3-pro-preview

							input: 74152
							output: 43
							thoughts: 19
						

Okay, here's my interpretation of those thoughts, framed as if they are my own:

**Analyzing the Console Switch**

Alright, let's break this down. `complete_change_console`... that sounds like the final piece of the console switching puzzle. The critical question here isn't *what* it does, but *how* it does it. Does this function, this `complete_change_console`, handle the transition in a synchronous, blocking manner? Or does it potentially loop, perhaps waiting for some condition to be met or some asynchronous process to complete? Understanding the control flow is essential. Depending on the answer, it would have critical implications for thread management, responsiveness, and potential deadlock scenarios. We need to look closely at its implementation to determine the nature of its interaction with other processes or threads.

map[ContextFile:drivers/tty/vt/vt.c IncludeLines:true Name:complete_change_console]

map[SourceCode:1120:	/*
1121:	 * Performs the back end of a vt switch. Called under the console
1122:	 * semaphore.
1123:	 */
1124:	static void complete_change_console(struct vc_data *vc)
1125:	{
1126:		unsigned char old_vc_mode;
1127:		int old = fg_console;
1128:	
1129:		last_console = fg_console;
1130:	
1131:		/*
1132:		 * If we're switching, we could be going from KD_GRAPHICS to
1133:		 * KD_TEXT mode or vice versa, which means we need to blank or
1134:		 * unblank the screen later.
1135:		 */
1136:		old_vc_mode = vc_cons[fg_console].d->vc_mode;
1137:		switch_screen(vc);
1138:	
1139:		/*
1140:		 * This can't appear below a successful kill_pid().  If it did,
1141:		 * then the *blank_screen operation could occur while X, having
1142:		 * received acqsig, is waking up on another processor.  This
1143:		 * condition can lead to overlapping accesses to the VGA range
1144:		 * and the framebuffer (causing system lockups).
1145:		 *
1146:		 * To account for this we duplicate this code below only if the
1147:		 * controlling process is gone and we've called reset_vc.
1148:		 */
1149:		if (old_vc_mode != vc->vc_mode) {
1150:			if (vc->vc_mode == KD_TEXT)
1151:				do_unblank_screen(1);
1152:			else
1153:				do_blank_screen(1);
1154:		}
1155:	
1156:		/*
1157:		 * If this new console is under process control, send it a signal
1158:		 * telling it that it has acquired. Also check if it has died and
1159:		 * clean up (similar to logic employed in change_console())
1160:		 */
1161:		if (vc->vt_mode.mode == VT_PROCESS) {
1162:			/*
1163:			 * Send the signal as privileged - kill_pid() will
1164:			 * tell us if the process has gone or something else
1165:			 * is awry
1166:			 */
1167:			if (kill_pid(vc->vt_pid, vc->vt_mode.acqsig, 1) != 0) {
1168:			/*
1169:			 * The controlling process has died, so we revert back to
1170:			 * normal operation. In this case, we'll also change back
1171:			 * to KD_TEXT mode. I'm not sure if this is strictly correct
1172:			 * but it saves the agony when the X server dies and the screen
1173:			 * remains blanked due to KD_GRAPHICS! It would be nice to do
1174:			 * this outside of VT_PROCESS but there is no single process
1175:			 * to account for and tracking tty count may be undesirable.
1176:			 */
1177:				reset_vc(vc);
1178:	
1179:				if (old_vc_mode != vc->vc_mode) {
1180:					if (vc->vc_mode == KD_TEXT)
1181:						do_unblank_screen(1);
1182:					else
1183:						do_blank_screen(1);
1184:				}
1185:			}
1186:		}
1187:	
1188:		/*
1189:		 * Wake anyone waiting for their VT to activate
1190:		 */
1191:		vt_event_post(VT_EVENT_SWITCH, old, vc->vc_num);
1192:		return;
1193:	}
 SourceFile:drivers/tty/vt/vt_ioctl.c]

gemini-3-pro-preview

							input: 75514
							output: 44
							thoughts: 1006
						

**Debugging a Potential Block in `complete_change_console`**

Okay, so `complete_change_console` is calling `switch_screen(vc)`. My immediate thought is, does `switch_screen` block? If it calls `fbcon_switch`, it's *possible*, but 143 seconds is a very long time for a virtual terminal switch.

Now, I'm thinking about the context of this issue with `syz.5.2008` and `VT_RESIZE`.  If it's looping through `vt_ioctl` and calling `fb_set_var` 63 times, and if `fb_set_var` is taking an excessive amount of time, say 2 seconds per call, that could add up. 63 times 2 seconds, that is 126 seconds, not far off!  Why would `fb_set_var` take so long though? Slow hardware? A deliberate sleep perhaps?

However, syzkaller is using `fbcon` with either `dummycon`, `vgacon`, or `drm`, like `vkms`.  If we were using `vkms`, then maybe `fb_set_var` *could* take a bit longer.

But wait, `fbcon_resize` *only* calls `fb_set_var` if `con_is_visible(vc)` is true.

```c
		if (con_is_visible(vc) && vc->vc_mode == KD_TEXT) {
			var.activate = FB_ACTIVATE_NOW |
				FB_ACTIVATE_FORCE;
			fb_set_var(info, &var);
		}
```

And `con_is_visible(vc)` is true *only* for the `fg_console`. So that means `fb_set_var` is called at most ONCE during the 63 iterations. So that's not it, it won't be 126 seconds.

Okay, so what else could be taking an excessive amount of time in `VT_RESIZE`? Let's look at the loop:

```c
	for (i = 0; i < MAX_NR_CONSOLES; i++) {
		vc = vc_cons[i].d;

		if (vc) {
			/* FIXME: review v tty lock */
			ret = __vc_resize(vc_cons[i].d, cc, ll, true);
			if (ret)
				return ret;
		}
	}
```

It's looping through each console and calling `__vc_resize`.  What does `__vc_resize` do? Memory allocation, copying the screen buffer, and freeing the old memory. If `cc` and `ll` (new columns and lines) are very large, `new_screen_size` could be large, but that's limited by `KMALLOC_MAX_SIZE`.

Hold on... What if `cc` and `ll` are *small*, but `vc->vc_uni_lines` is large?

```c
	if (vc->vc_uni_lines) {
		new_uniscr = vc_uniscr_alloc(new_cols, new_rows);
		if (!new_uniscr) {
			kfree(newscreen);
			return -ENOMEM;
		}
	}
```

Aha! `vc_uniscr_alloc` allocates memory for the unicode screen. Let's dig in there:

```c
	struct uni_screen *uniscr = kmalloc(sizeof(*uniscr), GFP_USER);
	if (!uniscr)
		return NULL;
	uniscr->lines = kcalloc(rows, sizeof(char32_t *), GFP_USER);
	if (!uniscr->lines) {
		kfree(uniscr);
		return NULL;
	}
	for (i = 0; i < rows; i++) {
		uniscr->lines[i] = kcalloc(cols, sizeof(char32_t), GFP_USER);
		if (!uniscr->lines[i]) {
			vc_uniscr_free(uniscr);
			return NULL;
		}
	}
```

*Bingo!* `vc_uniscr_alloc` loops `rows` times and calls `kcalloc` for each row! If `rows` is `VC_MAXROW` (32767), it’s calling `kcalloc` 32767 times! And it does this for *EACH* console! So for 63 consoles * 

map[ContextFile:drivers/tty/vt/vt.c IncludeLines:true Name:vc_uniscr_alloc]

map[SourceCode: 323:	static u32 **vc_uniscr_alloc(unsigned int cols, unsigned int rows)
 324:	{
 325:		u32 **uni_lines;
 326:		void *p;
 327:		unsigned int memsize, i, col_size = cols * sizeof(**uni_lines);
 328:	
 329:		/* allocate everything in one go */
 330:		memsize = col_size * rows;
 331:		memsize += rows * sizeof(*uni_lines);
 332:		uni_lines = vzalloc(memsize);
 333:		if (!uni_lines)
 334:			return NULL;
 335:	
 336:		/* initial line pointers */
 337:		p = uni_lines + rows;
 338:		for (i = 0; i < rows; i++) {
 339:			uni_lines[i] = p;
 340:			p += col_size;
 341:		}
 342:	
 343:		return uni_lines;
 344:	}
 SourceFile:drivers/tty/vt/vt.c]

gemini-3-pro-preview

							input: 77922
							output: 109
							thoughts: 4802
						

**Analysis of a Hung Task in Console Initialization**

Okay, so I've been dissecting this issue where a task gets hung in `con_install`, specifically focusing on how the `console_lock` semaphore plays a role. My initial thought was that a slow `vc_uniscr_alloc` or a problematic `VT_RESIZE` might be the culprit. However, after careful examination, the memory allocation in `vc_uniscr_alloc` is efficient, using `vzalloc` once, and the resize operations are typically fast, especially considering the `KMALLOC_MAX_SIZE` limitations. I initially considered a large `fb_find_best_mode` or a slow `updatescrollmode` but dismissed them.

I then explored the possibility of other `ioctl` calls like `VT_DISALLOCATE`, `VT_ACTIVATE`, and others. However, those are also quick, and looping them 63 times did not seem to be the bottleneck. I considered `vcs_read` and `vcs_write`, but these release the `console_lock` during I/O operations and therefore don't hold them for an excessively long time.

The core realization here is that the hung task is blocked on `console_lock`, indicated by the stack trace. The crucial piece is understanding when and why this lock is held for a significant duration. The bug report points to the lock being held for a long time by a call to `con_install` from a tty open.

I theorized that this long hold time is most likely due to a flood of `printk` messages. The key is in `console_unlock`, which, when printing a large amount of messages, can hold `console_lock` for a prolonged period, especially if there's a slow serial console. With that, `syz.8.2015` will get stuck on `console_lock`.

If there are too many messages, it blocks everything. This then led me to the conclusion that a syzkaller program could cause this by generating a huge amount of printk output through `/dev/kmsg`. If a syzkaller program continuously writes to `/dev/kmsg` or otherwise generates printk output, the console will be blocked from other tasks that attempt to use it, thus creating the hung task issue. With this being the most likely scenario, I considered other operations but they all ultimately release and re-acquire `console_lock`. 

I've come to the conclusion that flooding the `/dev/kmsg` with write operations combined with trying to open a console is the root cause.

call #0 openat: escaping filename "/dev/kmsg\x00"

map[ReproSyz:r0 = openat(0xffffffffffffff9c, &AUTO='/dev/kmsg\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &AUTO='/dev/tty1\x00', 0x2, 0x0)
write(r0, &AUTO='A', 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 83412
							output: 151
							thoughts: 26
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Kernel Message Stream Modification**

Alright, that's it, the crucial piece of the puzzle clicks. The filename, the kernel message buffer, is indeed `/dev/kmsg\x00`. Time to adjust the syntax accordingly. No need to overthink it - the intention is clear: correct the filename string to match the specified kernel message buffer. With that in place, the rest of the parsing should follow smoothly. Let's make the change, and then move on.

call #0 openat: escaping filename "/dev/kmsg\x00"

map[ReproSyz:r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kmsg\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/tty1\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)='A', 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 83739
							output: 109
							thoughts: 21
						

Okay, here's my interpretation of that thought process, assuming I'm an expert in this field, presented as a first-person summary:

**String Configuration Considerations**

Alright, hang on. I'm processing something related to string handling, and there's a specific syntax requirement I need to nail down. Let's see...I was just looking at the configuration for, possibly, a system call or device interaction. And the key is the string...yes, there it is! The expected syntax for that string is `&AUTO="/dev/kmsg\x00"`. That `\x00` is crucial. It's indicating a null termination, of course. Need to remember this syntax, as a string formatted like this is a specific piece of configuration for a program, call, or system component. I might need this later in this work, or a related task. I'll make a mental note, and move on.

failed to parse identifier at pos 39
line #1:39: r0 = openat(0xffffffffffffff9c, &AUTO="<<<!!ERROR!!>>>/dev/kmsg\x00", 0x2, 0x0)

map[ReproSyz:r0 = openat(0xffffffffffffff9c, &AUTO="/dev/kmsg\x00", 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &AUTO="/dev/tty1\x00", 0x2, 0x0)
write(r0, &AUTO="A", 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 84141
							output: 150
							thoughts: 76
						

**Debugging a Filename Escape Issue**

Okay, so I'm looking at this syntax, and initially, I was thinking it should be `&(0x7f0000000000)='/dev/kmsg\x00'`. However, the error message specifically mentioned "escaping filename". That's a key clue. My initial attempt used single quotes. Ah, the problem lies there! Single quotes don't allow for the interpretation of escape sequences like `\x00`. I need to switch to double quotes. Double quotes are what's needed for the escape sequence to work correctly. Therefore, I should use `&(0x7f0000000000)="/dev/kmsg\x00"` instead.

failed to parse identifier at pos 51
line #1:51: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)="<<<!!ERROR!!>>>/dev/kmsg\x00", 0x2, 0x0)

map[ReproSyz:r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)="/dev/kmsg\x00", 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)="/dev/tty1\x00", 0x2, 0x0)
write(r0, &(0x7f0000000080)="A", 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 84619
							output: 18
							thoughts: 139
						

**Debugging a Shell Syntax Error**

Okay, so I'm looking at this error, "escaping filename," and the command I'm using is `&(0x7f0000000000)='/dev/kmsg\x00'`. Hmm, that syntax *should* be correct. According to my mental model of string arguments, it should work: single quotes, or double quotes, or even the `\$` construct, around the escaped string like that should be fine. I've used this type of syntax numerous times, I know that.

Wait a second… Could the problem actually be with `openat` itself and how it interprets the arguments? Perhaps it's not expecting a string in that precise way. Time to quickly pull up `sys.txt` and check the documentation for `openat`. I'll need to verify the argument types there.

map[File:sys.txt]

map[Output:# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

# Description of syscall arguments. See README.md for details.

include <linux/socket.h>
include <linux/ptrace.h>
include <linux/resource.h>
include <linux/stat.h>
include <linux/mman.h>
include <linux/time.h>
include <linux/mount.h>
include <linux/fs.h>
include <linux/eventpoll.h>
include <linux/signalfd.h>
include <linux/eventfd.h>
include <linux/timerfd.h>
include <linux/personality.h>
include <linux/wait.h>
include <linux/user.h>
include <linux/un.h>
include <linux/ioctl.h>
include <linux/fadvise.h>
include <linux/falloc.h>
include <linux/kexec.h>
include <linux/elf.h>
include <linux/fiemap.h>
include <linux/kd.h>
include <linux/vt.h>
include <linux/if_alg.h>
include <linux/nfc.h>
include <linux/sockios.h>
include <linux/net_tstamp.h>
include <linux/termios.h>
include <linux/fcntl.h>
include <linux/sched.h>
include <linux/mqueue.h>
include <linux/mempolicy.h>
include <linux/in.h>
include <linux/ip.h>
include <linux/tcp.h>
include <linux/udp.h>
include <linux/kcmp.h>
include <linux/nfs.h>
include <linux/syslog.h>
include <linux/exportfs.h>
include <linux/splice.h>
include <linux/filelock.h>
include <fs/overlayfs/overlayfs.h>
include <uapi/linux/memfd.h>
include <uapi/linux/module.h>
include <linux/ioprio.h>
include <linux/membarrier.h>
include <uapi/linux/kcov.h>
include <uapi/linux/membarrier.h>
include <uapi/linux/capability.h>
include <uapi/linux/seccomp.h>
include <uapi/linux/wait.h>
include <uapi/linux/watch_queue.h>
include <kernel/sched/sched.h>
include <uapi/linux/close_range.h>
include <uapi/linux/netfilter/xt_cgroup.h>
include <fs/smb/client/cifsglob.h>
include <xen/interface/io/xs_wire.h>
include <uapi/linux/prctl.h>
include <asm/prctl.h>
include <linux/reboot.h>
include <linux/swap.h>

resource fd[int32]: -1
resource fd_dir[fd]: AT_FDCWD

# alignptr/align32/align64/padto64 can be used when ABI uses int64/intptr to hold a smaller type.
# E.g. pid/uid stored as intptr/int64.
type alignptr[T] {
	v	T
} [align[PTR_SIZE]]

type align32[T] {
	v	T
} [align[4]]

type align64[T] {
	v	T
} [align[8]]

type padto32[T] {
	v	T
} [size[4]]

type padto64[T] {
	v	T
} [size[8]]

type signalno int32[0:65]
type signalnoptr intptr[0:65]

# syz_execute_func caused multiple problems:
# 1. First it lead to corpus explosion. The program used existing values in registers
# to pollute output area. We tried to zero registers (though, not reliably).
# 2. It lead to explosion again. The exact mechanics are unknown, here is one sample:
# syz_execute_func(&(0x7f0000000440)="f2af91930f0124eda133fa20430fbafce842f66188d0d4
#	430fc7f314c1ab5bf9e2f9660f3a0fae5e090000ba023c1fb63ac4817d73d74ec482310d46f44
#	9f216c863fa438036a91bdbae95aaaa420f383c02c401405c6bfd49d768d768f833fefbab6464
#	660f38323c8f26dbc1a1fe5ff6f6df0804f4c4efa59c0f01c4288ba6452e000054c4431d5cc100")
# 3. The code can also execute syscalls (and it is know to), but it's not subject to
# target.SanitizeCall. As the result it can do things that programs are not supposed to do.
# 4. Besides linux, corpus explosion also happens on freebsd and is clearly attributable
# to syz_execute_func based on corpus contents. Mechanics are also not known.
# It also did not cause finding of any new bugs (at least not that I know of).
# So it's disabled on all OSes until we figure out how to resolve all these problems.
syz_execute_func(text ptr[in, text[target]]) (disabled)

# Exclude /sys/power/state as reported in https://lkml.org/lkml/2021/5/27/653
openat$sysfs(fd const[AT_FDCWD], dir ptr[in, glob["/sys/**/*:-/sys/power/state"]], flags flags[open_flags], mode flags[open_mode]) fd

open(file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd (automatic_helper)
# Just so that we have something that creates fd_dir resources.
open$dir(file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd_dir (automatic_helper)
openat$dir(fd const[AT_FDCWD], file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd_dir (automatic_helper)
openat(fd fd_dir[opt], file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd
openat2$dir(fd const[AT_FDCWD], file ptr[in, filename], how ptr[in, open_how], size bytesize[how]) fd_dir (automatic_helper)
openat2(fd fd_dir[opt], file ptr[in, filename], how ptr[in, open_how], size bytesize[how]) fd
creat(file ptr[in, filename], mode flags[open_mode]) fd
close(fd fd)
read(fd fd, buf buffer[out], count len[buf])
pread64(fd fd, buf buffer[out], count len[buf], pos fileoff)
readv(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec])
preadv(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec], off_low int32, off_high int32)
preadv2(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec], off_low int32, off_high int32, flags flags[rwf_flags])
write(fd fd, buf buffer[in], count len[buf])
pwrite64(fd fd, buf buffer[in], count len[buf], pos fileoff)
writev(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec])
pwritev(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], off_low int32, off_high int32)
pwritev2(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], off_low int32, off_high int32, flags flags[rwf_flags])
# lseek can return negative offsets when the file has FMODE_UNSIGNED_OFFSET flag:
# https://elixir.bootlin.com/linux/v6.11-rc7/source/fs/read_write.c#L56
# It's unclear how it's then even possible to distinguish error from valid offset, but it's not our problem.
# We just have to ignore return values of lseek.
lseek(fd fd, offset fileoff, whence flags[seek_whence]) (ignore_return)
copy_file_range(fd_in fd, off_in ptr[inout, fileoff[int64], opt], fd_out fd, off_out ptr[inout, fileoff[int64], opt], len intptr, flags flags[copy_file_range_flags])

rwf_flags = RWF_DSYNC, RWF_HIPRI, RWF_SYNC, RWF_NOWAIT, RWF_APPEND
copy_file_range_flags = 0

dup(oldfd fd) fd
dup2(oldfd fd, newfd fd) fd
dup3(oldfd fd, newfd fd, flags flags[dup_flags]) fd

pipe(pipefd ptr[out, pipefd])
pipe2(pipefd ptr[out, pipefd], flags flags[pipe_flags])

tee(fdin fd, fdout fd, len intptr, f flags[splice_flags])
splice(fdin fd, offin ptr[in, fileoff[int64]], fdout fd, offout ptr[in, fileoff[int64]], len intptr, f flags[splice_flags])
vmsplice(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], f flags[splice_flags])
sendfile(fdout fd, fdin fd, off ptr[inout, fileoff[intptr], opt], count intptr)
sendfile64(fdout fd, fdin fd, off ptr[inout, fileoff[int64], opt], count intptr)

cachestat_range {
	off	fileoff[int64]
	len	int64
}

cachestat {
	nr_cache		int64
	nr_dirty		int64
	nr_writeback		int64
	nr_evicted		int64
	nr_recently_evicted	int64
}

stat(file ptr[in, filename], statbuf ptr[out, stat])
lstat(file ptr[in, filename], statbuf ptr[out, stat])
fstat(fd fd, statbuf ptr[out, stat])
newfstatat(dfd const[AT_FDCWD], file ptr[in, filename], statbuf ptr[out, stat], flag flags[statx_flags])
stat64(file ptr[in, filename], statbuf ptr[out, stat64])
lstat64(file ptr[in, filename], statbuf ptr[out, stat64])
fstat64(fd fd, statbuf ptr[out, stat64])
fstatat64(dfd const[AT_FDCWD], file ptr[in, filename], statbuf ptr[out, stat64], flag flags[statx_flags])
statx(fd fd_dir, file ptr[in, filename], flags flags[statx_flags], mask flags[statx_mask], statxbuf ptr[out, statx])
cachestat(fd fd, cstat_range ptr[in, cachestat_range], cstat ptr[out, cachestat], flags const[0])

poll(fds ptr[in, array[pollfd]], nfds len[fds], timeout int32)
ppoll(fds ptr[in, array[pollfd]], nfds len[fds], tsp ptr[in, timespec], sigmask ptr[in, sigset_t], size len[sigmask])
select(n len[inp], inp ptr[inout, fd_set], outp ptr[inout, fd_set], exp ptr[inout, fd_set], tvp ptr[inout, timeval])
pselect6(n len[inp], inp ptr[inout, fd_set], outp ptr[inout, fd_set], exp ptr[inout, fd_set], tvp ptr[inout, timespec], sig ptr[in, sigset_size])

resource fd_epoll[fd]
epoll_create(size int32) fd_epoll
epoll_create1(flags flags[epoll_flags]) fd_epoll
epoll_ctl$EPOLL_CTL_ADD(epfd fd_epoll, op const[EPOLL_CTL_ADD], fd fd, ev ptr[in, epoll_event])
epoll_ctl$EPOLL_CTL_MOD(epfd fd_epoll, op const[EPOLL_CTL_MOD], fd fd, ev ptr[in, epoll_event])
epoll_ctl$EPOLL_CTL_DEL(epfd fd_epoll, op const[EPOLL_CTL_DEL], fd fd)
epoll_wait(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout int32)
epoll_pwait(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout int32, sigmask ptr[in, sigset_t], size bytesize[sigmask])
epoll_pwait2(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout ptr[in, timespec], sigmask ptr[in, sigset_t], size bytesize[sigmask])

resource fd_timer[fd]
signalfd(fd fd, mask ptr[in, sigset_t], size len[mask]) fd
signalfd4(fd fd, mask ptr[in, sigset_t], size len[mask], flags flags[signalfd_flags]) fd
timerfd_create(clockid flags[clock_type], flags flags[timerfd_create_flags]) fd_timer
timerfd_settime(fd fd_timer, flags flags[timerfd_settime_flags], new ptr[in, itimerspec], old ptr[out, itimerspec])
timerfd_gettime(fd fd_timer, cur ptr[out, itimerspec])
ioctl$TFD_IOC_SET_TICKS(fd fd_timer, cmd const[TFD_IOC_SET_TICKS], arg ptr[in, int64])

resource fd_event[fd]
eventfd(initval int32) fd_event
eventfd2(initval int32, flags flags[eventfd_flags]) fd_event
read$eventfd(fd fd_event, val ptr[out, int64], len len[val])
write$eventfd(fd fd_event, val ptr[in, int64], len len[val])

brk(brk intptr)
mmap(addr vma, len len[addr], prot flags[mmap_prot], flags flags[mmap_flags], fd fd, offset intptr[0:0xffffffff, 0x1000])
munmap(addr vma, len len[addr])
mremap(addr vma, len len[addr], newlen len[newaddr], flags flags[mremap_flags], newaddr vma)
remap_file_pages(addr vma, size len[addr], prot flags[mmap_prot], pgoff intptr, flags flags[mmap_flags])
mprotect(addr vma, len len[addr], prot flags[mmap_prot])
msync(addr vma, len len[addr], f flags[msync_flags])
madvise(addr vma, len len[addr], advice flags[madvise_flags])
process_madvise(pidfd fd_pidfd, vec ptr[in, array[iovec_in]], vlen len[vec], advice flags[madvise_flags], flags const[0])
process_mrelease(pidfd fd_pidfd, flags const[0])
fadvise64(fd fd, offset fileoff, len intptr, advice flags[fadvise_flags])
readahead(fd fd, off intptr, count intptr)
mbind(addr vma, len len[addr], mode flags[mbind_mode], nodemask ptr[in, int64], maxnode intptr, flags flags[mbind_flags])
move_pages(pid pid, nr len[pages], pages ptr[in, array[vma]], nodes ptr[in, array[int32], opt], status ptr[out, array[int32]], flags flags[move_pages_flags])
migrate_pages(pid pid, maxnode intptr, old ptr[in, int64], new ptr[in, int64])
set_mempolicy(mode flags[mbind_mode], nodemask ptr[in, int64], maxnode intptr)
get_mempolicy(mode ptr[out, int32], nodemask ptr[out, int64], maxnode intptr, addr vma, flags flags[mempolicy_flags])
set_mempolicy_home_node(addr vma, len len[addr], home_node intptr[0:3], flags const[0])
mincore(addr vma, size len[addr], vec buffer[out])
mlock(addr vma, size len[addr])
mlock2(addr vma, size len[addr], flags flags[mlock_flags])
munlock(addr vma, size len[addr])
mlockall(flags flags[mlockall_flags])
munlockall()
kcmp(pid1 pid, pid2 pid, type flags[kcmp_flags], fd1 fd, fd2 fd)
kcmp$KCMP_EPOLL_TFD(pid1 pid, pid2 pid, type const[KCMP_EPOLL_TFD], fd1 fd, idx2 ptr[in, kcmp_epoll_slot])

resource fd_memfd[fd]
memfd_create(name ptr[in, string], flags flags[memfd_flags]) fd_memfd
memfd_flags = MFD_CLOEXEC, MFD_ALLOW_SEALING, MFD_HUGETLB
_ = MFD_HUGE_SHIFT, MFD_HUGE_MASK, MFD_HUGE_64KB, MFD_HUGE_512KB, MFD_HUGE_1MB, MFD_HUGE_2MB, MFD_HUGE_8MB, MFD_HUGE_16MB

memfd_secret(flags flags[memfd_secret_flags]) fd
memfd_secret_flags = O_CLOEXEC

resource pkey[int32]: -1
pkey_alloc(flags const[0], val flags[pkey_flags]) pkey
pkey_free(key pkey)
pkey_mprotect(addr vma, len len[addr], prot flags[mmap_prot], key pkey)
syz_pkey_set(key pkey, val flags[pkey_flags])

pkey_flags = PKEY_DISABLE_ACCESS, PKEY_DISABLE_WRITE

restart_syscall()

# Almighty!
ioctl(fd fd, cmd int32, arg buffer[in])

ioctl$int_in(fd fd, cmd flags[ioctl_int_in], v ptr[in, int64])
ioctl$int_out(fd fd, cmd flags[ioctl_int_out], v ptr[out, intptr])

ioctl$FIOCLEX(fd fd, cmd const[FIOCLEX])
ioctl$FIONCLEX(fd fd, cmd const[FIONCLEX])
ioctl$FITHAW(fd fd, cmd const[FITHAW])

# FIFREEZE is enabled in sandbox mode only because it can easily kill the machine.
ioctl$FIFREEZE(fd fd, cmd const[FIFREEZE]) (snapshot)

fcntl$dupfd(fd fd, cmd flags[fcntl_dupfd], arg fd) fd
fcntl$getflags(fd fd, cmd flags[fcntl_getflags])
fcntl$setflags(fd fd, cmd const[F_SETFD], flags flags[fcntl_flags])
fcntl$setstatus(fd fd, cmd const[F_SETFL], flags flags[fcntl_status])
fcntl$lock(fd fd, cmd flags[fcntl_lock], lock ptr[in, flock])
fcntl$getown(fd fd, cmd const[F_GETOWN]) pid (automatic_helper)
fcntl$setown(fd fd, cmd const[F_SETOWN], pid pid)
fcntl$getownex(fd fd, cmd const[F_GETOWN_EX], arg ptr[out, f_owner_ex])
fcntl$setownex(fd fd, cmd const[F_SETOWN_EX], arg ptr[in, f_owner_ex])
fcntl$setsig(fd fd, cmd const[F_SETSIG], sig signalnoptr)
fcntl$setlease(fd fd, cmd const[F_SETLEASE], typ flags[flock_type])
fcntl$notify(fd fd, cmd const[F_NOTIFY], typ flags[fcntl_notify])
fcntl$setpipe(fd fd, cmd const[F_SETPIPE_SZ], sz intptr)
fcntl$addseals(fd fd, cmd const[F_ADD_SEALS], seals flags[seal_types])
fcntl$F_GET_RW_HINT(fd fd, cmd const[F_GET_RW_HINT], hint ptr[out, int64])
fcntl$F_GET_FILE_RW_HINT(fd fd, cmd const[F_GET_FILE_RW_HINT], hint ptr[out, int64])
fcntl$F_SET_RW_HINT(fd fd, cmd const[F_SET_RW_HINT], hint ptr[in, flags[fcntl_rw_hint, int64]])
fcntl$F_SET_FILE_RW_HINT(fd fd, cmd const[F_SET_FILE_RW_HINT], hint ptr[in, flags[fcntl_rw_hint, int64]])

# Only some commands break return values.
# When/if we have stricter enforcement of arguments, we may remove some of breaks_returns attributes.
ptrace(req flags[ptrace_req], pid pid) (breaks_returns)
ptrace$peek(req flags[ptrace_req_peek], pid pid, addr ptr[out, intptr]) (breaks_returns)
ptrace$poke(req flags[ptrace_req_poke], pid pid, addr ptr[out, intptr], data intptr) (breaks_returns)
ptrace$peekuser(req const[PTRACE_PEEKUSR], pid pid, addr intptr) (breaks_returns)
ptrace$pokeuser(req const[PTRACE_POKEUSR], pid pid, addr intptr, data intptr) (breaks_returns)
ptrace$getregs(req flags[ptrace_req_getregs], pid pid, ignored intptr, data buffer[out]) (breaks_returns)
ptrace$getregset(req const[PTRACE_GETREGSET], pid pid, what flags[pthread_regset], data ptr[in, iovec_out]) (breaks_returns)
ptrace$setregs(req flags[ptrace_req_setregs], pid pid, ignored intptr, data buffer[in]) (breaks_returns)
ptrace$setregset(req const[PTRACE_SETREGSET], pid pid, what flags[pthread_regset], data ptr[in, iovec_in]) (breaks_returns)
ptrace$getsig(req const[PTRACE_GETSIGINFO], pid pid, ignored intptr, data ptr[out, siginfo]) (breaks_returns)
ptrace$setsig(req const[PTRACE_SETSIGINFO], pid pid, ignored intptr, data ptr[in, siginfo]) (breaks_returns)
ptrace$setopts(req flags[ptrace_req_setopts], pid pid, ignored intptr, flags flags[ptrace_options]) (breaks_returns)
ptrace$getenv(req const[PTRACE_GETEVENTMSG], pid pid, ignored intptr, data ptr[out, intptr]) (breaks_returns)
ptrace$cont(req flags[ptrace_req_cont], pid pid, ignored intptr, data intptr) (breaks_returns)
ptrace$PTRACE_SECCOMP_GET_FILTER(req const[PTRACE_SECCOMP_GET_FILTER], pid pid, addr intptr, data ptr[out, array[int8]]) (breaks_returns)
ptrace$PTRACE_SECCOMP_GET_METADATA(req const[PTRACE_SECCOMP_GET_METADATA], pid pid, addr len[data], data ptr[in, seccomp_metadata]) (breaks_returns)
ptrace$PTRACE_SETSIGMASK(req const[PTRACE_SETSIGMASK], pid pid, size bytesize[data], data ptr[in, sigset_t]) (breaks_returns)
ptrace$PTRACE_GETSIGMASK(req const[PTRACE_GETSIGMASK], pid pid, size bytesize[data], data ptr[out, sigset_t]) (breaks_returns)
ptrace$ARCH_GET_FS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_GET_FS]) (breaks_returns)
ptrace$ARCH_GET_GS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_GET_GS]) (breaks_returns)
ptrace$ARCH_SET_GS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_SET_GS]) (breaks_returns)
ptrace$ARCH_GET_CPUID(req const[PTRACE_ARCH_PRCTL], pid pid, arg const[0], code const[ARCH_GET_CPUID]) (breaks_returns)
ptrace$ARCH_SET_CPUID(req const[PTRACE_ARCH_PRCTL], pid pid, arg boolptr, code const[ARCH_SET_CPUID]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_X32(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_X32]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_32(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_32]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_64(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_64]) (breaks_returns)
ptrace$ARCH_SHSTK_STATUS(req const[PTRACE_ARCH_PRCTL], pid pid, res ptr[out, intptr], cmd const[ARCH_SHSTK_STATUS]) (breaks_returns)
ptrace$ARCH_SHSTK_LOCK(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_LOCK]) (breaks_returns)
ptrace$ARCH_SHSTK_UNLOCK(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_UNLOCK]) (breaks_returns)
ptrace$ARCH_SHSTK_ENABLE(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_ENABLE]) (breaks_returns)
ptrace$ARCH_SHSTK_DISABLE(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_DISABLE]) (breaks_returns)
ptrace$ARCH_GET_UNTAG_MASK(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], cmd const[ARCH_GET_UNTAG_MASK]) (breaks_returns)
ptrace$ARCH_GET_MAX_TAG_BITS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], cmd const[ARCH_GET_MAX_TAG_BITS]) (breaks_returns)
ptrace$ARCH_ENABLE_TAGGED_ADDR(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr[1:6], cmd const[ARCH_ENABLE_TAGGED_ADDR]) (breaks_returns)
ptrace$ARCH_FORCE_TAGGED_SVA(req const[PTRACE_ARCH_PRCTL], pid pid, arg const[0], cmd const[ARCH_FORCE_TAGGED_SVA]) (breaks_returns)

map_shadow_stack(addr vma, size bytesize[addr], flags boolptr)

seccomp_metadata {
	filter_off	int64
	flags		const[0, int64]
}

ptrace_peeksiginfo_args {
	off	int64
	flags	flags[ptrace_peeksiginfo_flags, int32]
	nr	len[syscall:data, int32]
}

ptrace$peeksig(req const[PTRACE_PEEKSIGINFO], pid pid, args ptr[in, ptrace_peeksiginfo_args], data ptr[out, array[siginfo]])

capget(hdr ptr[in, cap_header], data ptr[in, cap_data])
capset(hdr ptr[in, cap_header], data ptr[in, cap_data])

resource fd_mq[fd]
mq_open(name ptr[in, string], flags flags[mq_open_flags], mode flags[open_mode], attr ptr[in, mq_attr]) fd_mq
mq_timedsend(mqd fd_mq, msg buffer[in], msglen len[msg], prio intptr, timeout ptr[in, timespec, opt])
mq_timedreceive(mqd fd_mq, msg buffer[out], msglen len[msg], prio intptr, timeout ptr[in, timespec, opt])
mq_notify(mqd fd_mq, notif ptr[in, sigevent])
mq_getsetattr(mqd fd_mq, attr ptr[in, mq_attr], oldattr ptr[out, mq_attr, opt])
mq_unlink(name ptr[in, string])

mknod(file ptr[in, filename], mode flags[mknod_mode], dev int32)
mknod$loop(file ptr[in, filename], mode flags[mknod_mode], dev proc[1792, 2])
mknodat$loop(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev proc[1792, 2])
mknodat$null(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev const[0x103])
mknodat(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev int32)
chmod(file ptr[in, filename], mode flags[open_mode])
fchmod(fd fd, mode flags[open_mode])
fchmodat(dirfd fd_dir, file ptr[in, filename], mode flags[open_mode])
chown(file ptr[in, filename], uid uid, gid gid)
lchown(file ptr[in, filename], uid uid, gid gid)
fchown(fd fd, uid uid, gid gid)
fchownat(dirfd fd_dir, file ptr[in, filename], uid uid, gid gid, flags flags[at_flags])
fallocate(fd fd, mode flags[fallocate_mode], off intptr, len intptr)
faccessat(dirfd fd_dir, pathname ptr[in, filename], mode flags[open_mode])
faccessat2(dirfd fd_dir, pathname ptr[in, filename], mode flags[open_mode], flags flags[faccessat_flags])
utime(filename ptr[in, filename], times ptr[in, utimbuf])
utimes(filename ptr[in, filename], times ptr[in, itimerval])
futimesat(dir fd_dir, pathname ptr[in, filename], times ptr[in, itimerval])
utimensat(dir fd_dir, pathname ptr[in, filename], times ptr[in, itimerval], flags flags[utimensat_flags])

# Small trick - syzkaller cannot give the proper stack pointer to clone(), but we can do it with the aid of pseudo syscalls.
syz_clone(flags flags[clone_flags], stack buffer[in], stack_len bytesize[stack], parentid ptr[out, int32], childtid ptr[out, int32], tls buffer[in]) pid (automatic_helper)

syz_clone3(args ptr[in, clone_args], size bytesize[args]) pid (automatic_helper)

# We need these disabled definitions to simplify the presence and the NR checking.
clone(flags flags[clone_flags], sp buffer[in], parentid ptr[out, int32], childtid ptr[out, int32], tls buffer[in]) (breaks_returns, disabled)
clone3(args ptr[in, clone_args], size bytesize[args]) pid (breaks_returns, disabled)

clone_args {
	flags		flags[clone3_flags, int64]
	pidfd		ptr64[out, fd_pidfd]
	child_tid	ptr64[out, pid]
	parent_tid	ptr64[out, pid]
	exit_signal	align64[signalno]
	stack		ptr64[out, array[int8]]
	stack_size	bytesize[stack, int64]
	tls		ptr64[out, array[int8]]
	set_tid		ptr64[in, array[pid]]
	set_tid_size	len[set_tid, int64]
	cgroup		align64[fd_cgroup]
}

resource pid[int32]: 0, -1
resource uid[int32]: 0, -1, 0xee00, 0xee01
resource gid[int32]: 0, -1, 0xee00, 0xee01

getgid() gid (automatic_helper)
getegid() gid (automatic_helper)
setuid(uid uid)
setgid(gid gid)
getuid() uid (automatic_helper)
geteuid() uid (automatic_helper)
setpgid(pid pid, pgid pid)
getpgid(pid pid) pid (automatic_helper)
getpgrp(pid pid) pid (automatic_helper)
getpid() pid (automatic_helper)
gettid() pid (automatic_helper)
setreuid(ruid uid, euid uid)
setregid(rgid gid, egid gid)
setresuid(ruid uid, euid uid, suid uid)
setresgid(rgid gid, egid gid, sgid gid)
getresuid(ruid ptr[out, uid], euid ptr[out, uid], suid ptr[out, uid])
getresgid(rgid ptr[out, gid], egid ptr[out, gid], sgid ptr[out, gid])
setfsuid(fsuid uid)
setfsgid(fsgid gid)
getgroups(size len[list], list ptr[inout, array[gid]])
setgroups(size len[list], list ptr[in, array[gid]])
personality(persona flags[personality_flags])
# Don't mess with parent (fuzzer). If we ptrace attach to it, it will hang.
# If we setrlimit for parent, it will misbehave. Killing - the same. Nothing good.
#getppid() pid
#getsid(pid pid) pid
#setsid() pid

link(old ptr[in, filename], new ptr[in, filename])
linkat(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename], flags flags[linkat_flags])
symlinkat(old ptr[in, filename], newfd fd_dir, new ptr[in, filename])
symlink(old ptr[in, filename], new ptr[in, filename])
unlink(path ptr[in, filename])
unlinkat(fd fd_dir, path ptr[in, filename], flags flags[unlinkat_flags])
readlink(path ptr[in, filename], buf buffer[out], siz len[buf])
readlinkat(fd fd_dir, path ptr[in, filename], buf buffer[out], siz len[buf])
rename(old ptr[in, filename], new ptr[in, filename])
renameat(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename])
renameat2(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename], flags flags[renameat2_flags])
mkdir(path ptr[in, filename], mode flags[open_mode])
mkdirat(fd fd_dir[opt], path ptr[in, filename], mode flags[open_mode])
rmdir(path ptr[in, filename])
truncate(file ptr[in, filename], len intptr)
ftruncate(fd fd, len intptr)
flock(fd fd, op flags[flock_op])
fsync(fd fd)
fdatasync(fd fd)
sync()
syncfs(fd fd)
sync_file_range(fd fd, off intptr, nbytes intptr, flags flags[sync_file_flags])
lookup_dcookie(cookie intptr, buf buffer[out], len len[buf])
getdents(fd fd_dir, ent buffer[out], count len[ent])
getdents64(fd fd_dir, ent buffer[out], count len[ent])
name_to_handle_at(fd fd_dir, file ptr[in, filename], handle ptr[in, file_handle], mnt ptr[out, int32], flags flags[name_to_handle_at_flags])
open_by_handle_at(mountdirfd fd, handle ptr[in, file_handle], flags flags[open_flags])
chroot(dir ptr[in, filename])
getcwd(buf buffer[out], size len[buf])
chdir(dir ptr[in, filename])
fchdir(fd fd)
pivot_root(new_root ptr[in, filename], put_old ptr[in, filename])

sysfs$1(option const[1], fsname ptr[in, string])
sysfs$2(option const[2], fsindex intptr, fsname buffer[out])
sysfs$3(option const[3])
statfs(path ptr[in, filename], buf buffer[out])
fstatfs(fd fd, buf buffer[out])

uselib(lib ptr_binfmt_file)
init_module(mod ptr[in, binfmt_elf64], len len[mod], args ptr[in, string])
finit_module(fd fd_binfmt, args ptr[in, string], flags flags[finit_module_flags])
delete_module(name ptr[in, string], flags flags[delete_module_flags])
kexec_load(entry intptr, nr_segments len[segments], segments ptr[in, array[kexec_segment]], flags flags[kexec_load_flags])
syslog(cmd flags[syslog_cmd], buf ptr[out, array[int8], opt], len len[buf])
uname(buf buffer[out])
sysinfo(info buffer[out])
ustat(dev intptr, buf ptr[out, ustat])
acct(filename ptr[in, filename, opt])

getrusage(who flags[rusage_who], usage ptr[out, rusage])
getrlimit(res flags[rlimit_type], rlim ptr[out, rlimit])
setrlimit(res flags[rlimit_type], rlim ptr[in, rlimit])
prlimit64(pid pid, res flags[rlimit_type], new ptr[in, rlimit, opt], old ptr[out, rlimit, opt])

iopl(level int8)
ioperm(from intptr, num intptr, on intptr)
ioprio_get$pid(which flags[ioprio_which_pid], who pid)
ioprio_get$uid(which flags[ioprio_which_uid], who uid)
ioprio_set$pid(which flags[ioprio_which_pid], who pid, ioprio flags[ioprio_priorities])
ioprio_set$uid(which flags[ioprio_which_uid], who uid, ioprio flags[ioprio_priorities])

# NEED: we can express the construction of integers using structs with flags
# and bitfields, which are normally obtained using a combination of bitwise
# operations with the help of macros. However, structs can't be directly passed
# as a syscall argument; therefore, such constructions can't be directly passed either.
# One example is ioprio argument for ioprio_set, where we could have expressed the
# construction less messy. For now, some subset of valid values are enumerated as
# in ioprio_priorities.

# ioprio priority values are obtained using IOPRIO_PRIO_VALUE(class, data) macro.
# the behaviour of the macro is mimicked below and some priority values are enumerated.
ioprio_priorities = IOPRIO_CLASS_NONE_PRIO, IOPRIO_CLASS_IDLE_PRIO, IOPRIO_CLASS_RT_HIGH_PRIO, IOPRIO_CLASS_BE_HIGH_PRIO, IOPRIO_CLASS_RT_MID_PRIO, IOPRIO_CLASS_BE_MID_PRIO, IOPRIO_CLASS_RT_LOW_PRIO, IOPRIO_CLASS_BE_LOW_PRIO

# The classes RT and BE take data values from the range [0:7]. Use a subset of the available
# values (0, 4, 7) to ease collisions, and to avoid redundancy. The classes NONE and IDLE
# have only one valid priority value each with data set to 0.
define IOPRIO_CLASS_NONE_PRIO	(IOPRIO_CLASS_NONE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_IDLE_PRIO	(IOPRIO_CLASS_IDLE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_RT_HIGH_PRIO	(IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_BE_HIGH_PRIO	(IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_RT_MID_PRIO	((IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT) + 4)
define IOPRIO_CLASS_BE_MID_PRIO	((IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT) + 4)
define IOPRIO_CLASS_RT_LOW_PRIO	((IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT) + 7)
define IOPRIO_CLASS_BE_LOW_PRIO	((IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT) + 7)

resource timerid[int32]
timer_create(id flags[clock_id], ev ptr[in, sigevent], timerid ptr[out, timerid])
timer_gettime(timerid timerid, setting ptr[out, itimerspec])
timer_getoverrun(timerid timerid)
timer_settime(timerid timerid, flags flags[timer_flags], new ptr[in, itimerspec], old ptr[out, itimerspec, opt])
timer_delete(timerid timerid)

time(t ptr[out, intptr])
clock_gettime(id flags[clock_id], tp ptr[out, timespec])
clock_settime(id flags[clock_id], tp ptr[in, timespec])
clock_adjtime(id flags[clock_id], tx ptr[in, timex])
clock_getres(id flags[clock_id], tp ptr[out, timespec])
clock_nanosleep(id flags[clock_id], flags flags[timer_flags], rqtp ptr[in, timespec], rmtp ptr[out, timespec, opt])
rt_sigaction(sig signalno, act ptr[in, sigaction], oact ptr[out, sigaction, opt], sigsetsize len[fake], fake ptr[out, sigset_t])
rt_sigprocmask(how flags[sigprocmask_how], nset ptr[in, sigset_t], oset ptr[out, sigset_t, opt], sigsetsize len[nset])
rt_sigreturn()
rt_sigpending(set ptr[out, sigset_t], sigsetsize len[set])
rt_sigtimedwait(these ptr[in, sigset_t], info ptr[out, siginfo, opt], ts ptr[in, timespec], sigsetsize len[these])
rt_sigsuspend(new ptr[in, sigset_t], sigsetsize len[new])
rt_sigqueueinfo(pid pid, sig signalno, info ptr[in, siginfo])
rt_tgsigqueueinfo(gid pid, tid pid, sig signalno, info ptr[in, siginfo])
sigaltstack(ss ptr[in, sigaltstack], oss ptr[out, sigaltstack, opt])
tgkill(gid pid, tid pid, sig signalno)
tkill(tid pid, sig signalno)
pause()
alarm(seconds intptr)
nanosleep(req ptr[in, timespec], rem ptr[out, timespec, opt])
getitimer(which flags[getitimer_which], cur ptr[out, itimerval])
setitimer(which flags[getitimer_which], new ptr[in, itimerval], old ptr[out, itimerval, opt])
exit(code intptr)
exit_group(code intptr)
waitid(which flags[waitid_which], pid pid, infop ptr[out, siginfo, opt], options flags[wait_options], ru ptr[out, rusage, opt])
waitid$P_PIDFD(which const[P_PIDFD], pidfd fd_pidfd, infop ptr[out, siginfo, opt], options flags[wait_options], ru ptr[out, rusage, opt])
wait4(pid pid, status ptr[out, int32, opt], options flags[wait_options], ru ptr[out, rusage, opt])
times(buf ptr[out, tms])
# Can send signals to all processes (pid=-1) so it's enabled only in snapshot mode.
kill(pid pid, sig signalno) (snapshot)

set_thread_area(info ptr[in, user_desc])
get_thread_area(info ptr[in, user_desc])
modify_ldt$read(func const[0], buf buffer[out], len len[buf])
modify_ldt$write(func const[1], buf ptr[in, user_desc], len len[buf])
modify_ldt$read_default(func const[2], buf buffer[out], len len[buf])
modify_ldt$write2(func const[17], buf ptr[in, user_desc], len len[buf])
process_vm_readv(pid pid, loc_vec ptr[in, array[iovec_out]], loc_vlen len[loc_vec], rem_vec ptr[in, array[iovec_out]], rem_vlen len[rem_vec], flags const[0])
process_vm_writev(pid pid, loc_vec ptr[in, array[iovec_out]], loc_vlen len[loc_vec], rem_vec ptr[in, array[iovec_out]], rem_vlen len[rem_vec], flags const[0])
set_tid_address(tidptr ptr[out, int32])
getpriority(which flags[priority_which], who pid)
setpriority(which flags[priority_which], who pid, prio intptr)
sched_getscheduler(pid pid)
sched_setscheduler(pid pid, policy flags[sched_policy], prio ptr[in, int32])
sched_rr_get_interval(pid pid, tp ptr[out, timespec])
sched_getparam(pid pid, prio ptr[out, int32])
sched_setparam(pid pid, prio ptr[in, int32])
sched_getaffinity(pid pid, cpusetsize len[mask], mask ptr[out, int64])
sched_setaffinity(pid pid, cpusetsize len[mask], mask ptr[in, int64])
sched_getattr(pid pid, attr ptr[out, sched_attr], size len[attr], flags const[0])
sched_setattr(pid pid, attr ptr[in, sched_attr], flags const[0])
sched_yield()
getrandom(buf buffer[out], len len[buf], flags flags[getrandom_flags])

reboot(magic1 const[LINUX_REBOOT_MAGIC1], magic2 const[LINUX_REBOOT_MAGIC2], cmd flags[reboot_commands], arg const[0]) (snapshot)

reboot_commands = LINUX_REBOOT_CMD_RESTART, LINUX_REBOOT_CMD_HALT, LINUX_REBOOT_CMD_CAD_ON, LINUX_REBOOT_CMD_CAD_OFF, LINUX_REBOOT_CMD_POWER_OFF, LINUX_REBOOT_CMD_RESTART2, LINUX_REBOOT_CMD_SW_SUSPEND, LINUX_REBOOT_CMD_KEXEC

swapon(specialfile ptr[in, filename], swap_flags flags[swap_flags]) (snapshot)
swapoff(specialfile ptr[in, filename]) (snapshot)

swap_flags = SWAP_FLAG_PRIO_MASK, SWAP_FLAG_PREFER, SWAP_FLAG_DISCARD, SWAP_FLAG_DISCARD_ONCE, SWAP_FLAG_DISCARD_PAGES

sethostname(name ptr[in, array[int8]], len bytesize[name]) (snapshot)
setdomainname(name ptr[in, array[int8]], len bytesize[name]) (snapshot)

gettimeofday(tv ptr[out, timeval], tz ptr[out, timezone])
settimeofday(tv ptr[out, timeval], tz ptr[out, timezone]) (snapshot)
adjtimex(txc_p ptr[in, __kernel_timex]) (snapshot)

timezone {
	tz_minuteswest	int32
	tz_dsttime	int32
}

__kernel_timex {
	modes		flags[adjtimex_modes, int32]
	pad0		const[0, int32]
	offset		int64
	freq		int64
	maxerror	int64
	esterror	int64
	status		int32
	pad1		const[0, int32]
	constant	int64
	precision	int64
	tolerance	int64
	int		timeval
	tick		int64
	ppsfreq		int64
	jitter		int64
	shift		int32
	pad2		const[0, int32]
	stabil		int64
	jitcnt		int64
	calcnt		int64
	errcnt		int64
	stbcnt		int64
	tai		int32
	pad3		array[const[0, int32], 11]
}

adjtimex_modes = ADJ_OFFSET, ADJ_FREQUENCY, ADJ_MAXERROR, ADJ_ESTERROR, ADJ_STATUS, ADJ_TIMECONST, ADJ_TAI, ADJ_SETOFFSET, ADJ_MICRO, ADJ_NANO, ADJ_TICK

membarrier(cmd flags[membarrier_cmd], flags const[0])

membarrier_cmd = MEMBARRIER_CMD_GLOBAL, MEMBARRIER_CMD_GLOBAL_EXPEDITED, MEMBARRIER_CMD_PRIVATE_EXPEDITED, MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED, MEMBARRIER_CMD_PRIVATE_EXPEDITED_SYNC_CORE, MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_SYNC_CORE, MEMBARRIER_CMD_QUERY, MEMBARRIER_CMD_REGISTER_GLOBAL_EXPEDITED, MEMBARRIER_CMD_SHARED

rseq(rseq ptr[in, rseq], rseq_len bytesize[rseq], flags boolptr, sig const[0])

rseq {
	cpu_id_start	const[0, int32]
	cpu_id		const[0, int32]
	rseq_cs		ptr64[in, rseq_cs, opt]
	flags		flags[rseq_cs_flags, int32]
} [align[32]]

rseq_cs {
	version			const[0, int32]
	flags			flags[rseq_cs_flags, int32]
	start_ip		int64
	post_commit_offset	int64
	abort_ip		int64
} [align[32]]

rseq_cs_flags = RSEQ_CS_FLAG_NO_RESTART_ON_PREEMPT, RSEQ_CS_FLAG_NO_RESTART_ON_SIGNAL, RSEQ_CS_FLAG_NO_RESTART_ON_MIGRATE

# start/end are unused for now, no definition of SYS_RISCV_FLUSH_ICACHE_LOCAL in uapi headers.
riscv_flush_icache(start const[0], end const[0], flags bool32)

syz_open_procfs(pid pid, file ptr[in, string[procfs_proc_file]]) fd

# TODO: some of net files are only available in the init namespace (e.g. bluetooth bnep and hci).
# We could find some way to open these files in the init namespace
# esp. taking into account that we create bluetooth sockets in init namespace.
procfs_proc_file = "auxv", "cmdline", "environ", "autogroup", "cgroup", "clear_refs", "comm", "coredump_filter", "cpuset", "gid_map", "io", "limits", "loginuid", "maps", "mountinfo", "mounts", "mountstats", "numa_maps", "oom_adj", "oom_score", "oom_score_adj", "pagemap", "personality", "projid_map", "sched", "schedstat", "sessionid", "setgroups", "smaps", "smaps_rollup", "totmaps", "stack", "stat", "statm", "status", "syscall", "timers", "uid_map", "wchan", "map_files", "attr", "attr/current", "attr/exec", "attr/fscreate", "attr/keycreate", "attr/prev", "attr/sockcreate", "ns", "children", "task", "fd", "fd/3", "fd/4", "fdinfo", "fdinfo/3", "fdinfo/4", "net", "net/anycast6", "net/arp", "net/bnep", "net/connector", "net/dev", "net/dev_mcast", "net/dev_snmp6", "net/fib_trie", "net/fib_triestat", "net/hci", "net/icmp", "net/icmp6", "net/if_inet6", "net/igmp", "net/igmp6", "net/ip6_flowlabel", "net/ip6_mr_cache", "net/ip6_mr_vif", "net/ip6_tables_matches", "net/ip6_tables_names", "net/ip6_tables_targets", "net/ip_mr_cache", "net/ip_mr_vif", "net/ip_tables_matches", "net/ip_tables_names", "net/ip_tables_targets", "net/ipv6_route", "net/l2cap", "net/llc/core", "net/llc/socket", "net/mcfilter", "net/mcfilter6", "net/netfilter", "net/netlink", "net/netstat", "net/nfsfs", "net/packet", "net/protocols", "net/psched", "net/ptype", "net/raw", "net/raw6", "net/rfcomm", "net/route", "net/rpc", "net/rt6_stats", "net/rt_acct", "net/rt_cache", "net/sco", "net/sctp", "net/snmp", "net/snmp6", "net/sockstat", "net/sockstat6", "net/softnet_stat", "net/stat", "net/tcp", "net/tcp6", "net/udp", "net/udp6", "net/udplite", "net/udplite6", "net/unix", "net/wireless", "net/xfrm_stat", "net/ip_vs", "net/ip_vs_stats", "net/ip_vs_stats_percpu", "net/nf_conntrack", "net/nf_conntrack_expect", "net/vlan/config", "net/vlan/vlan0", "net/vlan/vlan1", "net/kcm", "net/psched", "timerslack_ns"

openat$procfs(fd const[AT_FDCWD], file ptr[in, string[procfs_file]], flags const[O_RDONLY], mode const[0]) fd

procfs_file = "/proc/keys", "/proc/key-users", "/proc/crypto", "/proc/consoles", "/proc/cgroups", "/proc/zoneinfo", "/proc/vmstat", "/proc/vmallocinfo", "/proc/tty/drivers", "/proc/tty/ldiscs", "/proc/timer_list", "/proc/sysvipc/sem", "/proc/sysvipc/msg", "/proc/sysvipc/shm", "/proc/stat", "/proc/slabinfo", "/proc/schedstat", "/proc/partitions", "/proc/meminfo", "/proc/mdstat", "/proc/locks", "/proc/diskstats", "/proc/cpuinfo", "/proc/consoles", "/proc/bus/input/devices", "/proc/bus/input/handlers", "/proc/asound/seq/clients", "/proc/asound/seq/clients", "/proc/asound/seq/timer", "/proc/asound/timers"

resource fd_yama_ptrace_scope[fd]

# 0 - YAMA_SCOPE_DISABLED
# 1 - YAMA_SCOPE_RELATIONAL
# 2 - YAMA_SCOPE_CAPABILITY
# 3 - YAMA_SCOPE_NO_ATTACH
yama_modes = "0", "1", "2", "3"

openat$yama_ptrace_scope(fd const[AT_FDCWD], file ptr[in, string["/proc/sys/kernel/yama/ptrace_scope"]], flags const[O_RDWR], mode const[0]) fd_yama_ptrace_scope
write$yama_ptrace_scope(fd fd_yama_ptrace_scope, data ptr[in, string[yama_modes]], count len[data])

# Write into some interesting sysct's and sysfs/procfs files.
resource fd_sysctl[fd]

openat$sysctl(fd const[AT_FDCWD], file ptr[in, string[sysctl_file]], flags const[O_WRONLY], mode const[0]) fd_sysctl
write$sysctl(fd fd_sysctl, val ptr[in, string[sysctl_value]], len len[val])

sysctl_file = "/sys/kernel/mm/ksm/run", "/proc/sys/vm/compact_memory", "/proc/sys/vm/drop_caches", "/proc/sys/net/ipv4/tcp_timestamps", "/proc/sys/net/ipv4/tcp_sack", "/proc/sys/net/ipv4/tcp_dsack", "/proc/sys/net/ipv4/tcp_window_scaling", "/proc/sys/net/ipv4/tcp_syncookies", "/proc/sys/net/ipv4/tcp_recovery", "/proc/sys/net/ipv4/tcp_mtu_probing", "/proc/sys/net/ipv4/tcp_rfc1337", "/proc/self/clear_refs"
# Most of these values are suitable for all sysctl_file files.
sysctl_value = "0", "1", "2", "3", "4", "5", "6", "7"

# Write to this file triggers khugepaged scan.
# We don't want to write small values as we only want the explicitly triggered scan.
resource fd_khugepaged_scan[fd]

openat$khugepaged_scan(fd const[AT_FDCWD], file ptr[in, string["/sys/kernel/mm/transparent_hugepage/khugepaged/scan_sleep_millisecs"]], flags const[O_WRONLY], mode const[0]) fd_khugepaged_scan
write$khugepaged_scan(fd fd_khugepaged_scan, val ptr[in, string["1000000"]], len len[val])

resource fd_tcp_congestion[fd]

openat$tcp_congestion(fd const[AT_FDCWD], file ptr[in, string["/proc/sys/net/ipv4/tcp_congestion_control"]], flags const[O_WRONLY], mode const[0]) fd_tcp_congestion
write$tcp_congestion(fd fd_tcp_congestion, val ptr[in, string[tcp_congestion]], len len[val])

tcp_congestion = "reno", "bbr", "bic", "cdg", "cubic", "dctcp", "westwood", "highspeed", "hybla", "htcp", "vegas", "nv", "veno", "scalable", "lp", "yeah", "illinois"

resource fd_tcp_mem[fd]

openat$tcp_mem(fd const[AT_FDCWD], file ptr[in, string[tcp_mem_files]], flags const[O_WRONLY], mode const[0]) fd_tcp_mem
write$tcp_mem(fd fd_tcp_mem, val ptr[in, tcp_mem_values], len len[val])

tcp_mem_files = "/proc/sys/net/ipv4/tcp_rmem", "/proc/sys/net/ipv4/tcp_wmem"

tcp_mem_values {
	v0	fmt[oct, int64]
	sp0	const[' ', int8]
	v1	fmt[oct, int64]
	sp1	const[' ', int8]
	v2	fmt[oct, int64]
	z	const[0, int8]
} [packed]

# /proc/self/reclaim is ChromeOS-specific:
# https://chromium.googlesource.com/chromiumos/third_party/kernel/+/4c3ad28b9c913%5E%21/
resource fd_proc_reclaim[fd]

openat$proc_reclaim(fd const[AT_FDCWD], file ptr[in, string["/proc/self/reclaim"]], flags const[O_WRONLY], mode const[0]) fd_proc_reclaim
write$proc_reclaim(fd fd_proc_reclaim, val ptr[in, string[proc_reclaim_vals]], len len[val])

proc_reclaim_vals = "file", "anon", "all"

resource fd_pidfd[fd]

openat$pidfd(fd const[AT_FDCWD], file ptr[in, string["/proc/self"]], flags flags[open_flags], mode const[0]) fd_pidfd
openat$thread_pidfd(fd const[AT_FDCWD], file ptr[in, string["/proc/thread-self"]], flags flags[open_flags], mode const[0]) fd_pidfd
pidfd_send_signal(fd fd_pidfd, sig signalno, info ptr[in, siginfo], flags const[0])

# pidfd_open is dangerous, so we use syz_pidfd_open instead.
pidfd_open(pid pid, flags const[0]) fd_pidfd (disabled)
syz_pidfd_open(pid pid, flags const[0]) fd_pidfd
pidfd_getfd(pidfd fd_pidfd, fd fd, flags const[0]) fd

close_range(fd fd, max_fd fd, flags flags[close_range_flags])

# Uncomment on your own account.
#syz_open_dev$char(dev const[0xc], major intptr, minor intptr) fd
#syz_open_dev$block(dev const[0xb], major intptr, minor intptr) fd

# /dev/console known to cause problems on at least two different kernels.
# It can turn off all output or produce massive amounts of garbage on console.
# Disable it for now.
#syz_open_dev$console(dev ptr[in, string["/dev/console"]], id const[0], flags flags[open_flags]) fd

resource fd_autofs[fd]

# These devices are relatively safe (don't reboot and don't corrupt kernel memory).
# They need a more comprehensive support. But let at least open them for now,
# maybe fuzzer will be able to skrew them in a useful way.
# TODO: all these devices returning just fd need proper interface descriptions.
openat$vcs(fd const[AT_FDCWD], file ptr[in, string["/dev/vcs"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsn(dev ptr[in, string["/dev/vcs#"]], id intptr, flags flags[open_flags]) fd
openat$vcsa(fd const[AT_FDCWD], file ptr[in, string["/dev/vcsa"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsa(dev ptr[in, string["/dev/vcsa#"]], id intptr, flags flags[open_flags]) fd
openat$vcsu(fd const[AT_FDCWD], file ptr[in, string["/dev/vcsu"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsu(dev ptr[in, string["/dev/vcsu#"]], id intptr, flags flags[open_flags]) fd
syz_open_dev$ircomm(dev ptr[in, string["/dev/ircomm#"]], id intptr, flags flags[open_flags]) fd
syz_open_dev$audion(dev ptr[in, string["/dev/audio#"]], id intptr, flags flags[open_flags]) fd

openat$null(fd const[AT_FDCWD], file ptr[in, string["/dev/null"]], flags flags[open_flags], mode const[0]) fd
openat$zero(fd const[AT_FDCWD], file ptr[in, string["/dev/zero"]], flags flags[open_flags], mode const[0]) fd
openat$full(fd const[AT_FDCWD], file ptr[in, string["/dev/full"]], flags flags[open_flags], mode const[0]) fd
openat$irnet(fd const[AT_FDCWD], file ptr[in, string["/dev/irnet"]], flags flags[open_flags], mode const[0]) fd
openat$hwrng(fd const[AT_FDCWD], file ptr[in, string["/dev/hwrng"]], flags flags[open_flags], mode const[0]) fd
openat$hpet(fd const[AT_FDCWD], file ptr[in, string["/dev/hpet"]], flags flags[open_flags], mode const[0]) fd
openat$autofs(fd const[AT_FDCWD], file ptr[in, string["/dev/autofs"]], flags flags[open_flags], mode const[0]) fd_autofs
openat$keychord(fd const[AT_FDCWD], file ptr[in, string["/dev/keychord"]], flags flags[open_flags], mode const[0]) fd
openat$zygote(fd const[AT_FDCWD], file ptr[in, string["/dev/socket/zygote"]], flags flags[open_flags], mode const[0]) fd
openat$pktcdvd(fd const[AT_FDCWD], file ptr[in, string["/dev/pktcdvd/control"]], flags flags[open_flags], mode const[0]) fd
openat$lightnvm(fd const[AT_FDCWD], file ptr[in, string["/dev/lightnvm/control"]], flags flags[open_flags], mode const[0]) fd
openat$xenevtchn(fd const[AT_FDCWD], file ptr[in, string["/dev/xen/evtchn"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_control(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm-control"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_monitor(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm-monitor"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_plock(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm_plock"]], flags flags[open_flags], mode const[0]) fd
openat$btrfs_control(fd const[AT_FDCWD], file ptr[in, string["/dev/btrfs-control"]], flags flags[open_flags], mode const[0]) fd
openat$ubi_ctrl(fd const[AT_FDCWD], file ptr[in, string["/dev/ubi_ctrl"]], flags flags[open_flags], mode const[0]) fd
openat$cachefiles(fd const[AT_FDCWD], file ptr[in, string["/dev/cachefiles"]], flags flags[open_flags], mode const[0]) fd
openat$ndctl0(fd const[AT_FDCWD], file ptr[in, string["/dev/ndctl0"]], flags flags[open_flags], mode const[0]) fd
openat$nmem0(fd const[AT_FDCWD], file ptr[in, string["/dev/nmem0"]], flags flags[open_flags], mode const[0]) fd
openat$nvram(fd const[AT_FDCWD], file ptr[in, string["/dev/nvram"]], flags flags[open_flags], mode const[0]) fd
openat$ocfs2_control(fd const[AT_FDCWD], file ptr[in, string["/dev/ocfs2_control"]], flags flags[open_flags], mode const[0]) fd
openat$nvme_fabrics(fd const[AT_FDCWD], file ptr[in, string["/dev/nvme-fabrics"]], flags flags[open_flags], mode const[0]) fd

pipefd {
	rfd	fd
	wfd	fd
}

type iovec[DIR, T] {
	addr	ptr[DIR, T]
	len	len[addr, intptr]
}
type iovec_in iovec[in, array[int8]]
type iovec_out iovec[out, array[int8]]

stat {
	st_dev		intptr
	st_ino		intptr
	st_mode		int32
	st_nlink	int32
	st_uid		uid
	st_gid		gid
	st_rdev		intptr
	__pad1		const[0, intptr]
	st_size		intptr
	st_blksize	int32
	__pad2		const[0, int32]
	st_blocks	intptr
	st_atime	intptr
	st_atime_nsec	intptr
	st_mtime	intptr
	st_mtime_nsec	intptr
	st_ctime	intptr
	st_ctime_nsec	intptr
	__unused4	const[0, int32]
	__unused5	const[0, int32]
}

statx {
	mask		int32
	blksize		int32
	attributes	int64
	nlink		int32
	uid		uid
	gid		gid
	mode		int16
	__spare0	int16
	ino		int64
	size		int64
	blocks		int64
	__spare1	int64
	atime		statx_timestamp
	btime		statx_timestamp
	ctime		statx_timestamp
	mtime		statx_timestamp
	rdev_major	int32
	rdev_minor	int32
	dev_major	int32
	dev_minor	int32
	__spare2	array[int64, 14]
}

define STAT64_SIZE	sizeof(struct stat64)

type stat64 array[int8, STAT64_SIZE]

pollfd {
	fd	fd
	events	flags[pollfd_events, int16]
	revents	const[0, int16]
}

sigset_t {
	mask	array[intptr, _NSIG_WORDS]
}

sigset_size {
	ss	ptr[inout, sigset_t]
	len	len[ss, intptr]
}

resource time_sec[intptr]
resource time_nsec[intptr]
resource time_usec[intptr]

# prog knowns about this struct type
timespec {
	sec	time_sec
	nsec	time_nsec
}

# prog knowns about this struct type
timeval {
	sec	time_sec
	usec	time_usec
}

statx_timestamp {
	sec		int64
	nsec		int32
	__reserved	int32
}

itimerspec {
	interv	timespec
	value	timespec
}

itimerval {
	interv	timeval
	value	timeval
}

utimbuf {
	actime	intptr
	modtime	intptr
}

sigevent {
	val	const[0, intptr]
	signo	signalno
	notify	flags[sigev_notify, int32]
	u	sigevent_u
} [size[SIGEVENT_SIZE]]

sigevent_u [
	tid	pid
	thr	sigevent_thread
]

define SIGEVENT_SIZE	sizeof(struct sigevent)

sigevent_thread {
# NEED: this is function pointer and pthread_attr_t (?)
	func	buffer[in]
	attr	buffer[in]
}

cap_header {
	var	flags[cap_version, int32]
	pid	pid
}

cap_data {
	eff0	int32
	perm0	int32
	inher0	int32
	eff1	int32
	perm1	int32
	inher1	int32
}

epoll_event {
	ev	flags[epoll_ev, int32]
	data	const[0, int64]
# TODO: this packed only on amd64
} [packed]

# TODO: fd_set needs to be a separate type
fd_set {
	mask0	int64
	mask1	int64
	mask2	int64
	mask3	int64
	mask4	int64
	mask5	int64
	mask6	int64
	mask7	int64
}

sock_fprog {
	len	len[filter, int16]
	filter	ptr[in, array[sock_filter]]
}

sock_filter {
	code	int16
	jt	int8
	jf	int8
	k	int32
}

file_handle [
	raw				file_handle_raw
	shmem				file_handle_t[1, fid_shmem]
	fuse				file_handle_t[0x81, fid_fuse]
	fuse_with_parent		file_handle_t[0x82, fid_fuse_with_parent]
	nfs				file_handle_t[36, fid_nfs]
	FILEID_INO32_GEN		file_handle_t[FILEID_INO32_GEN, fid_FILEID_INO32_GEN]
	FILEID_INO32_GEN_PARENT		file_handle_t[FILEID_INO32_GEN_PARENT, fid_FILEID_INO32_GEN_PARENT]
	FILEID_UDF_WITHOUT_PARENT	file_handle_t[FILEID_UDF_WITHOUT_PARENT, fid_FILEID_UDF_WITHOUT_PARENT]
	FILEID_UDF_WITH_PARENT		file_handle_t[FILEID_UDF_WITH_PARENT, fid_FILEID_UDF_WITH_PARENT]
	FILEID_BTRFS_WITH_PARENT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	FILEID_BTRFS_WITH_PARENT_ROOT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	FILEID_BTRFS_WITHOUT_PARENT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	ceph_nfs_snapfh			file_handle_t[FILEID_BTRFS_WITH_PARENT, ceph_nfs_snapfh]
	ceph_nfs_fh			file_handle_t[FILEID_INO32_GEN, ceph_nfs_fh]
	ceph_nfs_confh			file_handle_t[FILEID_INO32_GEN_PARENT, ceph_nfs_confh]
	GFS2_SMALL_FH_SIZE		file_handle_t[GFS2_SMALL_FH_SIZE, fid_GFS2_SMALL_FH_SIZE]
	GFS2_LARGE_FH_SIZE		file_handle_t[GFS2_LARGE_FH_SIZE, fid_GFS2_LARGE_FH_SIZE]
	OVL_FILEID_V0			file_handle_t[OVL_FILEID_V0, ovl_fb]
	OVL_FILEID_V1			file_handle_t[OVL_FILEID_V1, ovl_fh]
	FILEID_NILFS_WITHOUT_PARENT	file_handle_t[FILEID_NILFS_WITHOUT_PARENT, nilfs_fid]
	FILEID_NILFS_WITH_PARENT	file_handle_t[FILEID_NILFS_WITH_PARENT, nilfs_fid]
	reiserfs_2			file_handle_t[2, fid_reiserfs_2]
	reiserfs_3			file_handle_t[3, fid_reiserfs_3]
	reiserfs_4			file_handle_t[4, fid_reiserfs_4]
	reiserfs_5			file_handle_t[5, fid_reiserfs_5]
	reiserfs_6			file_handle_t[6, fid_reiserfs_6]
	xfs				file_handle_t[0x81, xfs_fid64]
	xfs_parent			file_handle_t[0x82, xfs_fid64]
	orangefs			file_handle_t[1, fid_orangefs]
	orangefs_parent			file_handle_t[2, fid_orangefs_parent]
	isofs				file_handle_t[1, isofs_fid]
	isofs_parent			file_handle_t[2, isofs_fid]
	ocfs2				file_handle_t[1, fid_ocfs2]
	ocfs2_parent			file_handle_t[2, fid_ocfs2_parent]
] [varlen]

file_handle_raw {
	handle_bytes	bytesize[f_handle, int32]
	handle_type	flags[fid_type, int32]
	f_handle	align32[array[int8]]
}

type file_handle_t[TYPE, FID] {
	handle_bytes	bytesize[f_handle, int32]
	handle_type	const[TYPE, int32]
	f_handle	FID
}

fid_shmem {
	gen	int32
	ino	int64
} [packed]

fid_fuse {
	nodeid_hi	int32
	nodeid_lo	int32
	generation	int32
}

fid_fuse_with_parent {
	base		fid_fuse
	parent_fid	fid_fuse
} [packed]

fid_FILEID_INO32_GEN {
	ino	int32
	gen	int32
}

fid_FILEID_INO32_GEN_PARENT {
	base		fid_FILEID_INO32_GEN
	parent_ino	int32
	parent_gen	int32
}

fid_FILEID_UDF_WITHOUT_PARENT {
	block		int32
	partref		int16
	parent_partref	int16
	generation	int32
}

fid_FILEID_UDF_WITH_PARENT {
	base			fid_FILEID_UDF_WITHOUT_PARENT
	parent_block		int32
	parent_generation	int32
}

btrfs_fid {
	objectid		int64
	root_objectid		int64
	gen			int32
	parent_objectid		int64
	parent_gen		int32
	parent_root_objectid	int64
} [packed]

ceph_nfs_snapfh {
	ino		int64
	snapid		int64
	parent_ino	int64
	hash		int32
} [packed]

ceph_nfs_fh {
	ino	int64
}

ceph_nfs_confh {
	ino		int64
	parent_ino	int64
}

fid_GFS2_SMALL_FH_SIZE {
	no_formal_ino_hi	int32be
	no_formal_ino_lo	int32be
	no_addr_hi		int32be
	no_addr_lo		int32be
}

fid_GFS2_LARGE_FH_SIZE {
	base		fid_GFS2_SMALL_FH_SIZE
	parent_fid	fid_GFS2_SMALL_FH_SIZE
}

define GFS2_SMALL_FH_SIZE	4
define GFS2_LARGE_FH_SIZE	8

fid_nfs {
	fileid_hi	int32
	fileid_lo	int32
	type		int32
# The total size is encoded in file_handle.handle_type, so we make this const size.
	size		const[NFS_MAXFHSIZE, int16]
	data		array[int8, NFS_MAXFHSIZE]
} [align[4]]

fid_reiserfs_2 {
	objectid	int32
	dir_id		int32
}

fid_reiserfs_3 {
	objectid	int32
	dir_id		int32
	generation	int32
}

fid_reiserfs_4 {
	objectid	int32
	dir_id		int32
	parent_objectid	int32
	parent_dir_id	int32
}

fid_reiserfs_5 {
	objectid	int32
	dir_id		int32
	generation	int32
	parent_objectid	int32
	parent_dir_id	int32
}

fid_reiserfs_6 {
	objectid		int32
	dir_id			int32
	generation		int32
	parent_objectid		int32
	parent_dir_id		int32
	parent_generation	int32
}

xfs_fid64 {
	ino		int64
	gen		int32
	parent_ino	int64
	parent_gen	int32
} [align[4]]

fid_orangefs {
	khandle	array[int8, 16]
	fs_id	int32
}

fid_orangefs_parent {
	base		fid_orangefs
	parent_fid	fid_orangefs
}

nilfs_fid {
	cno		int64
	ino		int64
	gen		int32
	parent_gen	int32
	parent_ino	int64
} [packed]

isofs_fid {
	block			int32
	offset			int16
	parent_offset		int16
	generation		int32
	parent_block		int32
	parent_generation	int32
}

fid_ocfs2 {
	blkno_hi	int32
	blkno_lo	int32
	generation	int32
}

fid_ocfs2_parent {
	base		fid_ocfs2
	parent_fid	fid_ocfs2
}

fid_type = FILEID_ROOT, FILEID_INO32_GEN, FILEID_INO32_GEN_PARENT, FILEID_BTRFS_WITHOUT_PARENT, FILEID_BTRFS_WITH_PARENT, FILEID_BTRFS_WITH_PARENT_ROOT, FILEID_UDF_WITHOUT_PARENT, FILEID_UDF_WITH_PARENT, FILEID_NILFS_WITHOUT_PARENT, FILEID_NILFS_WITH_PARENT, FILEID_FAT_WITHOUT_PARENT, FILEID_FAT_WITH_PARENT, FILEID_LUSTRE, FILEID_KERNFS

mq_attr {
	mq_flags	intptr
	mq_maxmsg	intptr
	mq_msgsize	intptr
	mq_curmsgs	intptr
	__reserved	array[const[0, intptr], 4]
}

kexec_segment {
	buf	buffer[in]
	sz	len[buf, intptr]
# TODO: this is address in kernel
	mem	intptr
	memsz	intptr
}

rusage {
	utime	timeval
	stime	timeval
	maxrss	intptr
	ixrss	intptr
	idrss	intptr
	isrss	intptr
	minflt	intptr
	majflt	intptr
	nswap	intptr
	inblock	intptr
	oublock	intptr
	msgsnd	intptr
	msgrcv	intptr
	signals	intptr
	nvcsw	intptr
	nivcsw	intptr
}

rlimit {
	soft	intptr
	hard	intptr
}

sigaction {
	sa_handler	ptr[in, text[target]]
	sa_flags	flags[sigaction_flags, intptr]
	sa_restorer	ptr[in, text[target]]
	sa_mask		sigset_t
}

sigaltstack {
	ss_sp		ptr[out, array[int8]]
	ss_flags	flags[sigaltstack_flags, int32]
	ss_size		bytesize[ss_sp, intptr]
}

sigaltstack_flags = SS_ONSTACK, SS_DISABLE, SS_AUTODISARM

tms {
	utime	intptr
	stime	intptr
	cutime	intptr
	cstime	intptr
}

siginfo {
	signo	signalno
	errno	int32
	code	int32
} [size[SIGINFO_SIZE]]

define SIGINFO_SIZE	sizeof(struct siginfo)

timex {
	stuff0	intptr
	stuff1	intptr
	stuff2	intptr
	stuff3	intptr
	stuff4	intptr
	stuff5	intptr
	stuff6	intptr
	stuff7	intptr
	stuff8	intptr
	stuff9	intptr
	stuff10	intptr
	stuff11	intptr
	stuff12	intptr
	stuff13	intptr
	stuff14	intptr
	stuff15	intptr
	stuff16	intptr
	stuff17	intptr
	stuff18	intptr
	stuff19	intptr
	stuff20	intptr
	stuff21	intptr
	stuff22	intptr
	stuff23	intptr
	stuff24	intptr
	stuff25	intptr
}

ustat {
	f_tfree		int32
	f_tinode	intptr
	f_fname		array[int8, 6]
	f_fpack		array[int8, 6]
}

user_desc {
	entry_number	int32
# Base should be vma and limit should be len[base]
# But these fields are int32, so we can't use vma.
	base_addr	flags[user_desc_bases, int32]
	limit		flags[user_desc_limits, int32]
	seg_32bit	int32:1
	contents	int32:2
	read_exec_only	int32:1
	limit_in_pages	int32:1
	seg_not_present	int32:1
	useable		int32:1
	lm		int32:1
}

user_desc_bases = 0, 4096, 1048576, 536870912, 536872960, 536875008, -1
user_desc_limits = 0, 1024, 4096, 8192, 16384, -1

sched_attr {
	size		bytesize[parent, int32]
	sched_policy	flags[sched_policy, int32]
	sched_flags	flags[sched_attr_flags, int64]
	sched_nice	int32
	sched_priority	int32
	sched_runtime	int64
	sched_deadline	int64
	sched_period	int64
	sched_util_min	int32
	sched_util_max	int32
}

sched_policy = SCHED_NORMAL, SCHED_FIFO, SCHED_RR, SCHED_BATCH, SCHED_IDLE, SCHED_DEADLINE
sched_attr_flags = SCHED_FLAG_RESET_ON_FORK, SCHED_FLAG_RECLAIM, SCHED_FLAG_DL_OVERRUN, SCHED_FLAG_KEEP_POLICY, SCHED_FLAG_KEEP_PARAMS, SCHED_FLAG_UTIL_CLAMP_MIN, SCHED_FLAG_UTIL_CLAMP_MAX, SCHED_FLAG_SUGOV

flock {
	type	flags[flock_type, int16]
	whence	flags[seek_whence, int16]
	start	intptr
	len	intptr
	pid	pid
}

f_owner_ex {
	type	flags[f_owner_type, int32]
	pid	pid
}

ucred {
	pid	pid
	uid	uid
	gid	gid
}

kcmp_epoll_slot {
	efd	fd_epoll
	tfd	fd
	toff	int32
}

open_how {
	flags	flags[open_flags, int64]
	mode	flags[open_mode, int64]
	resolve	flags[resolve_flags, int64]
}

# Not providing O_WRONLY means O_RDONLY.
open_flags = O_WRONLY, O_RDWR, O_APPEND, FASYNC, O_CLOEXEC, O_CREAT, O_DIRECT, O_DIRECTORY, O_EXCL, O_LARGEFILE, O_NOATIME, O_NOCTTY, O_NOFOLLOW, O_NONBLOCK, O_PATH, O_SYNC, O_TRUNC, __O_TMPFILE
open_mode = S_IRUSR, S_IWUSR, S_IXUSR, S_IRGRP, S_IWGRP, S_IXGRP, S_IROTH, S_IWOTH, S_IXOTH
resolve_flags = RESOLVE_CACHED, RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV
madvise_flags = MADV_NORMAL, MADV_RANDOM, MADV_SEQUENTIAL, MADV_WILLNEED, MADV_DONTNEED, MADV_REMOVE, MADV_DONTFORK, MADV_DOFORK, MADV_HWPOISON, MADV_SOFT_OFFLINE, MADV_MERGEABLE, MADV_UNMERGEABLE, MADV_HUGEPAGE, MADV_NOHUGEPAGE, MADV_DONTDUMP, MADV_DODUMP, MADV_WIPEONFORK, MADV_KEEPONFORK, MADV_COLD, MADV_PAGEOUT, MADV_POPULATE_READ, MADV_POPULATE_WRITE, MADV_COLLAPSE
fadvise_flags = POSIX_FADV_NORMAL, POSIX_FADV_SEQUENTIAL, POSIX_FADV_RANDOM, POSIX_FADV_NOREUSE, POSIX_FADV_WILLNEED, POSIX_FADV_DONTNEED
move_pages_flags = MPOL_MF_MOVE, MPOL_MF_MOVE_ALL
msync_flags = MS_ASYNC, MS_SYNC, MS_INVALIDATE
mmap_prot = PROT_EXEC, PROT_READ, PROT_WRITE, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP
mmap_flags = MAP_SHARED, MAP_PRIVATE, MAP_32BIT, MAP_ANONYMOUS, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_FILE, MAP_FIXED, MAP_GROWSDOWN, MAP_HUGETLB, MAP_LOCKED, MAP_NONBLOCK, MAP_NORESERVE, MAP_POPULATE, MAP_STACK, MAP_UNINITIALIZED, MAP_SHARED_VALIDATE, MAP_SYNC, MAP_FIXED_NOREPLACE
mremap_flags = MREMAP_MAYMOVE, MREMAP_FIXED, MREMAP_DONTUNMAP
mbind_mode = MPOL_DEFAULT, MPOL_BIND, MPOL_INTERLEAVE, MPOL_PREFERRED, MPOL_F_STATIC_NODES, MPOL_F_RELATIVE_NODES
mbind_flags = MPOL_MF_STRICT, MPOL_MF_MOVE, MPOL_MF_MOVE_ALL
pipe_flags = O_NONBLOCK, O_CLOEXEC, O_DIRECT, O_NOTIFICATION_PIPE
mlock_flags = MLOCK_ONFAULT
mlockall_flags = MCL_CURRENT, MCL_FUTURE, MCL_ONFAULT
dup_flags = O_CLOEXEC
splice_flags = SPLICE_F_MOVE, SPLICE_F_NONBLOCK, SPLICE_F_MORE, SPLICE_F_GIFT
seek_whence = SEEK_SET, SEEK_CUR, SEEK_END, SEEK_DATA, SEEK_HOLE
signalfd_flags = SFD_NONBLOCK, SFD_CLOEXEC
eventfd_flags = EFD_CLOEXEC, EFD_NONBLOCK, EFD_SEMAPHORE
timerfd_create_flags = TFD_NONBLOCK, TFD_CLOEXEC
timerfd_settime_flags = TFD_TIMER_ABSTIME, TFD_TIMER_CANCEL_ON_SET
clock_type = CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_MONOTONIC_RAW, CLOCK_BOOTTIME, CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID, CLOCK_REALTIME_ALARM, CLOCK_BOOTTIME_ALARM
sigev_notify = SIGEV_NONE, SIGEV_SIGNAL, SIGEV_THREAD, SIGEV_THREAD_ID
cap_version = _LINUX_CAPABILITY_VERSION_1, _LINUX_CAPABILITY_VERSION_2, _LINUX_CAPABILITY_VERSION_3
epoll_flags = EPOLL_CLOEXEC
epoll_ev = POLLIN, POLLOUT, POLLRDHUP, POLLPRI, POLLERR, POLLHUP, EPOLLET, EPOLLONESHOT, EPOLLEXCLUSIVE, EPOLLWAKEUP
pollfd_events = POLLIN, POLLPRI, POLLOUT, POLLERR, POLLHUP, POLLNVAL, POLLRDNORM, POLLRDBAND, POLLWRNORM, POLLWRBAND, POLLMSG, POLLREMOVE, POLLRDHUP, POLLFREE, POLL_BUSY_LOOP
mknod_mode = S_IFREG, S_IFCHR, S_IFBLK, S_IFIFO, S_IFSOCK, S_ISUID, S_ISGID, S_ISVTX, open_mode
at_flags = AT_EMPTY_PATH, AT_SYMLINK_NOFOLLOW, AT_SYMLINK_FOLLOW, AT_NO_AUTOMOUNT, AT_EMPTY_PATH
fallocate_mode = FALLOC_FL_KEEP_SIZE, FALLOC_FL_PUNCH_HOLE, FALLOC_FL_COLLAPSE_RANGE, FALLOC_FL_ZERO_RANGE, FALLOC_FL_INSERT_RANGE, FALLOC_FL_UNSHARE_RANGE, FALLOC_FL_NO_HIDE_STALE
linkat_flags = AT_EMPTY_PATH, AT_SYMLINK_FOLLOW
unlinkat_flags = AT_REMOVEDIR
renameat2_flags = RENAME_EXCHANGE, RENAME_NOREPLACE, RENAME_WHITEOUT
flock_op = LOCK_SH, LOCK_EX, LOCK_UN, LOCK_NB
statx_flags = AT_SYMLINK_NOFOLLOW, AT_SYMLINK_FOLLOW, AT_NO_AUTOMOUNT, AT_EMPTY_PATH, AT_STATX_SYNC_TYPE, AT_STATX_SYNC_AS_STAT, AT_STATX_FORCE_SYNC, AT_STATX_DONT_SYNC
statx_mask = STATX_TYPE, STATX_MODE, STATX_NLINK, STATX_UID, STATX_GID, STATX_ATIME, STATX_MTIME, STATX_CTIME, STATX_INO, STATX_SIZE, STATX_BLOCKS, STATX_BASIC_STATS, STATX_BTIME
name_to_handle_at_flags = AT_EMPTY_PATH, AT_SYMLINK_FOLLOW, AT_HANDLE_FID
mq_open_flags = O_WRONLY, O_RDWR, O_NONBLOCK, O_CREAT, O_EXCL, O_CREAT
finit_module_flags = MODULE_INIT_IGNORE_MODVERSIONS, MODULE_INIT_IGNORE_VERMAGIC
delete_module_flags = O_NONBLOCK, O_TRUNC
kexec_load_flags = KEXEC_ON_CRASH, KEXEC_PRESERVE_CONTEXT, KEXEC_ARCH_386, KEXEC_ARCH_X86_64, KEXEC_ARCH_PPC, KEXEC_ARCH_PPC64, KEXEC_ARCH_IA_64, KEXEC_ARCH_ARM, KEXEC_ARCH_S390, KEXEC_ARCH_SH, KEXEC_ARCH_MIPS, KEXEC_ARCH_MIPS_LE, KEXEC_ARCH_DEFAULT
faccessat_flags = AT_EACCESS, AT_SYMLINK_NOFOLLOW, AT_EMPTY_PATH
sync_file_flags = SYNC_FILE_RANGE_WAIT_BEFORE, SYNC_FILE_RANGE_WRITE, SYNC_FILE_RANGE_WAIT_AFTER
kcmp_flags = KCMP_FILE, KCMP_FILES, KCMP_FS, KCMP_IO, KCMP_SIGHAND, KCMP_SYSVSEM, KCMP_VM
rusage_who = RUSAGE_SELF, RUSAGE_CHILDREN, RUSAGE_THREAD
rlimit_type = RLIMIT_AS, RLIMIT_CORE, RLIMIT_CPU, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_LOCKS, RLIMIT_MEMLOCK, RLIMIT_MSGQUEUE, RLIMIT_NICE, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_RTPRIO, RLIMIT_RTTIME, RLIMIT_SIGPENDING, RLIMIT_STACK
# The ones that disable console output are intentionally omitted.
syslog_cmd = SYSLOG_ACTION_CLOSE, SYSLOG_ACTION_OPEN, SYSLOG_ACTION_READ, SYSLOG_ACTION_READ_ALL, SYSLOG_ACTION_READ_CLEAR, SYSLOG_ACTION_SIZE_UNREAD, SYSLOG_ACTION_SIZE_BUFFER
ioprio_which_pid = IOPRIO_WHO_PROCESS, IOPRIO_WHO_PGRP
ioprio_which_uid = IOPRIO_WHO_USER
personality_flags = PER_LINUX, PER_SVR4, PER_SVR3, PER_OSR5, PER_WYSEV386, PER_ISCR4, PER_BSD, PER_XENIX, PER_LINUX32, PER_IRIX32, PER_IRIXN32, PER_IRIX64, PER_RISCOS, PER_SOLARIS, PER_UW7, PER_OSF4, PER_HPUX, ADDR_NO_RANDOMIZE, MMAP_PAGE_ZERO, ADDR_COMPAT_LAYOUT, READ_IMPLIES_EXEC, ADDR_LIMIT_32BIT, SHORT_INODE, WHOLE_SECONDS, STICKY_TIMEOUTS, ADDR_LIMIT_3GB
clock_id = CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_MONOTONIC_RAW, CLOCK_BOOTTIME, CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID
sigprocmask_how = SIG_BLOCK, SIG_UNBLOCK, SIG_SETMASK
getitimer_which = ITIMER_REAL, ITIMER_VIRTUAL, ITIMER_PROF
wait_options = WNOHANG, WUNTRACED, WCONTINUED, WEXITED, WSTOPPED, WCONTINUED, WNOHANG, WNOWAIT, __WCLONE, __WALL, __WNOTHREAD
waitid_which = P_PID, P_PGID, P_ALL
sigaction_flags = SA_NOCLDSTOP, SA_NOCLDWAIT, SA_NODEFER, SA_ONSTACK, SA_RESETHAND, SA_RESTART, SA_SIGINFO
timer_flags = TIMER_ABSTIME
utimensat_flags = AT_SYMLINK_NOFOLLOW
priority_which = PRIO_PROCESS, PRIO_PGRP, PRIO_USER
mempolicy_flags = MPOL_F_MEMS_ALLOWED, MPOL_F_ADDR, MPOL_F_NODE
ptrace_req = PTRACE_LISTEN, PTRACE_KILL, PTRACE_INTERRUPT, PTRACE_ATTACH, PTRACE_DETACH
ptrace_req_peek = PTRACE_PEEKTEXT, PTRACE_PEEKDATA
ptrace_req_poke = PTRACE_POKETEXT, PTRACE_POKEDATA
ptrace_req_getregs = PTRACE_GETREGS, PTRACE_GETFPREGS
ptrace_req_setregs = PTRACE_SETREGS, PTRACE_SETFPREGS
ptrace_req_setopts = PTRACE_SETOPTIONS, PTRACE_SEIZE
ptrace_req_cont = PTRACE_CONT, PTRACE_SYSCALL, PTRACE_SINGLESTEP, PTRACE_SYSEMU, PTRACE_SYSEMU_SINGLESTEP
pthread_regset = NT_PRSTATUS, NT_PRFPREG, NT_PRPSINFO, NT_TASKSTRUCT, NT_AUXV, NT_386_TLS, NT_386_IOPERM, NT_X86_XSTATE
ptrace_options = PTRACE_O_EXITKILL, PTRACE_O_TRACECLONE, PTRACE_O_TRACEEXEC, PTRACE_O_TRACEEXIT, PTRACE_O_TRACEFORK, PTRACE_O_TRACESYSGOOD, PTRACE_O_TRACEVFORK, PTRACE_O_TRACEVFORKDONE
fcntl_dupfd = F_DUPFD, F_DUPFD_CLOEXEC
fcntl_getflags = F_GETFD, F_GETFL, F_GETSIG, F_GETLEASE, F_GETPIPE_SZ, F_GET_SEALS
fcntl_lock = F_SETLK, F_SETLKW, F_GETLK, F_OFD_GETLK, F_OFD_SETLK, F_OFD_SETLKW
fcntl_flags = FD_CLOEXEC
fcntl_status = O_APPEND, FASYNC, O_DIRECT, O_NOATIME, O_NONBLOCK
flock_type = F_RDLCK, F_WRLCK, F_UNLCK
f_owner_type = F_OWNER_TID, F_OWNER_PID, F_OWNER_PGRP
fcntl_notify = DN_MULTISHOT, DN_ACCESS, DN_MODIFY, DN_CREATE, DN_DELETE, DN_RENAME, DN_ATTRIB
seal_types = F_SEAL_SEAL, F_SEAL_SHRINK, F_SEAL_GROW, F_SEAL_WRITE
ioctl_int_in = FIONBIO, FIOASYNC
ioctl_int_out = FIOQSIZE, FIGETBSZ
fcntl_rw_hint = RWF_WRITE_LIFE_NOT_SET, RWH_WRITE_LIFE_NONE, RWH_WRITE_LIFE_SHORT, RWH_WRITE_LIFE_MEDIUM, RWH_WRITE_LIFE_LONG, RWH_WRITE_LIFE_EXTREME
fiemap_flags = FIEMAP_FLAG_SYNC, FIEMAP_FLAG_XATTR, FIEMAP_FLAG_CACHE
fiemap_extent_flags = FIEMAP_EXTENT_LAST, FIEMAP_EXTENT_UNKNOWN, FIEMAP_EXTENT_DELALLOC, FIEMAP_EXTENT_ENCODED, FIEMAP_EXTENT_DATA_ENCRYPTED, FIEMAP_EXTENT_NOT_ALIGNED, FIEMAP_EXTENT_DATA_INLINE, FIEMAP_EXTENT_DATA_TAIL, FIEMAP_EXTENT_UNWRITTEN, FIEMAP_EXTENT_MERGED, FIEMAP_EXTENT_SHARED
getrandom_flags = GRND_NONBLOCK, GRND_RANDOM
clone_flags = CLONE_VM, CLONE_FS, CLONE_FILES, CLONE_SIGHAND, CLONE_PTRACE, CLONE_VFORK, CLONE_PARENT, CLONE_THREAD, CLONE_NEWNS, CLONE_SYSVSEM, CLONE_SETTLS, CLONE_PARENT_SETTID, CLONE_CHILD_CLEARTID, CLONE_UNTRACED, CLONE_CHILD_SETTID, CLONE_NEWCGROUP, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET, CLONE_IO, CLONE_PIDFD, CLONE_NEWTIME
clone3_flags = CLONE_CLEAR_SIGHAND, CLONE_INTO_CGROUP, clone_flags
ptrace_peeksiginfo_flags = PTRACE_PEEKSIGINFO_SHARED
close_range_flags = CLOSE_RANGE_UNSHARE

# Consts for target.SpecialFileLenghts.
_ = SMB_PATH_MAX, XT_CGROUP_PATH_MAX, XENSTORE_REL_PATH_MAX

# misc
_ = KCOV_INIT_TRACE, KCOV_ENABLE, KCOV_DISABLE, KCOV_TRACE_PC, KCOV_TRACE_CMP, PTRACE_TRACEME, SYSLOG_ACTION_CONSOLE_ON, SYSLOG_ACTION_CONSOLE_OFF, SYSLOG_ACTION_CONSOLE_LEVEL, SYSLOG_ACTION_CLEAR, __NR_mmap2

# Hardcode KCOV_REMOTE_ENABLE value for amd64 until new kcov patches reach mainline.
define KCOV_REMOTE_ENABLE	1075340134

# Not yet implemented syscalls:
# umask
# vhangup
# _sysctl
# nfsservctl
# getcpu

# Probably no sense in calling these.
# Also affect system-wide state, so not reproducible anyway.
# sched_get_priority_max
# sched_get_priority_min
]

gemini-3-pro-preview

							input: 110929
							output: 109
							thoughts: 202
						

**Debugging a System Call with String Arguments**

Okay, so I'm looking at this `openat` system call. The signature takes a file descriptor and then a file path, which is defined as a string. Right, so I thought I could just pass in a pointer to a string literal like `&AUTO="/dev/kmsg\x00"`.  That should be valid syntax, shouldn't it? Let's try it.

Hmm, that didn't work. The error message is... hold on, let me grab it... here:  "failed to parse identifier at pos 51". Okay, so it looks like it's complaining about the way I'm constructing the string argument. Specifically, let's look at the error:

```
failed to parse identifier at pos 51
line #1:51: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)="<<<!!ERROR!!>>>/dev/kmsg\x00", 0x2, 0x0)
```

It looks like the correct syntax is going to be `&(0x7f0000000000)='/dev/kmsg\x00'`. Okay, that's fine. It's expecting a specific pointer and content. But... hold on, I'm still getting the "failed to parse identifier" error. Something's not quite right.

Let me just simplify it and try the original plan. Since `AUTO` is already defined, let's use `&AUTO='/dev/kmsg\x00'`. That should get rid of any complications.

call #0 openat: escaping filename "/dev/kmsg\x00"

map[ReproSyz:r0 = openat(0xffffffffffffff9c, &AUTO='/dev/kmsg\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &AUTO='/dev/tty1\x00', 0x2, 0x0)
write(r0, &AUTO='A', 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 111639
							output: 91
							thoughts: 261
						

**My Analysis of the "Escaping Filename" Bug**

Okay, so "escaping filename" – that immediately screams sandbox escape! Syzkaller is pretty good at locking things down, so that means a file is getting opened outside the intended restricted environment. The target, `/dev/kmsg`, is a classic forbidden target. But wait... `openat$sysctl`... that's interesting. It opens `/sys/kernel/mm/ksm/run` and similar files. Maybe there's a workaround to write to `/dev/kmsg` indirectly. I need to see if the kernel allows writing to that file path in some other way.

Let me check `sys.txt` for any mentions of `kmsg`. Hmm, `TIOCL_SETKMSGREDIRECT` is linked to `tioclinux`. Could I use the `syslog` syscall to write to kmsg? No, it's primarily for reading. However, I noticed that `syslog` has `SYSLOG_ACTION_CONSOLE_ON`, `SYSLOG_ACTION_CONSOLE_OFF`, and `SYSLOG_ACTION_CONSOLE_LEVEL`. Could those options be used to trigger printk messages even without access to `/dev/kmsg`? Potentially flooding the console using `ioctl(TIOCLINUX)`. But what if the bug isn't even related to printk flooding? I need to stay open-minded here.

What if this is related to a completely different area... like `vt_ioctl(VT_RESIZE)`? I should try to reproduce the bug with `VT_RESIZE`. Gotta be methodical!

missing struct vt_sizes fields 2/3
line #2:48: ioctl$VT_RESIZE(r0, 0x5609, &AUTO={0x3e8, 0x3e8}<<<!!ERROR!!>>>)

map[ReproSyz:r0 = openat(0xffffffffffffff9c, &AUTO='/dev/tty1\x00', 0x2, 0x0)
ioctl$VT_RESIZE(r0, 0x5609, &AUTO={0x3e8, 0x3e8})
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 112409
							output: 18
							thoughts: 16
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and delivered in the first person:

**Analyzing the Potential for Resize Event Handling**

Right, so I'm looking at this problem, and my first instinct is to zero in on how resize events are being handled, or *could* be handled. The mention of `vt.txt` immediately signals that we're likely dealing with some kind of terminal interaction or virtual terminal context, possibly within a program or system. Since I'm likely concerned about a VT-compatible terminal that may be interacting with my program, `VT_RESIZE` is the key. My brain just jumped immediately to the idea of searching that file for any references to how the terminal, or our interaction with it, responds to terminal resize events. Is it defining some kind of action for resizing the terminal, or perhaps not? Is there a handler present?

Essentially, I'm trying to get a quick overview by checking that file. I want to see if this system is set up to *do* anything when the terminal window changes size. If so, I'll know how that resize is intended to be handled, or if not, I can move on to other areas to look for the error.

map[File:sys.txt]

map[Output:# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

# Description of syscall arguments. See README.md for details.

include <linux/socket.h>
include <linux/ptrace.h>
include <linux/resource.h>
include <linux/stat.h>
include <linux/mman.h>
include <linux/time.h>
include <linux/mount.h>
include <linux/fs.h>
include <linux/eventpoll.h>
include <linux/signalfd.h>
include <linux/eventfd.h>
include <linux/timerfd.h>
include <linux/personality.h>
include <linux/wait.h>
include <linux/user.h>
include <linux/un.h>
include <linux/ioctl.h>
include <linux/fadvise.h>
include <linux/falloc.h>
include <linux/kexec.h>
include <linux/elf.h>
include <linux/fiemap.h>
include <linux/kd.h>
include <linux/vt.h>
include <linux/if_alg.h>
include <linux/nfc.h>
include <linux/sockios.h>
include <linux/net_tstamp.h>
include <linux/termios.h>
include <linux/fcntl.h>
include <linux/sched.h>
include <linux/mqueue.h>
include <linux/mempolicy.h>
include <linux/in.h>
include <linux/ip.h>
include <linux/tcp.h>
include <linux/udp.h>
include <linux/kcmp.h>
include <linux/nfs.h>
include <linux/syslog.h>
include <linux/exportfs.h>
include <linux/splice.h>
include <linux/filelock.h>
include <fs/overlayfs/overlayfs.h>
include <uapi/linux/memfd.h>
include <uapi/linux/module.h>
include <linux/ioprio.h>
include <linux/membarrier.h>
include <uapi/linux/kcov.h>
include <uapi/linux/membarrier.h>
include <uapi/linux/capability.h>
include <uapi/linux/seccomp.h>
include <uapi/linux/wait.h>
include <uapi/linux/watch_queue.h>
include <kernel/sched/sched.h>
include <uapi/linux/close_range.h>
include <uapi/linux/netfilter/xt_cgroup.h>
include <fs/smb/client/cifsglob.h>
include <xen/interface/io/xs_wire.h>
include <uapi/linux/prctl.h>
include <asm/prctl.h>
include <linux/reboot.h>
include <linux/swap.h>

resource fd[int32]: -1
resource fd_dir[fd]: AT_FDCWD

# alignptr/align32/align64/padto64 can be used when ABI uses int64/intptr to hold a smaller type.
# E.g. pid/uid stored as intptr/int64.
type alignptr[T] {
	v	T
} [align[PTR_SIZE]]

type align32[T] {
	v	T
} [align[4]]

type align64[T] {
	v	T
} [align[8]]

type padto32[T] {
	v	T
} [size[4]]

type padto64[T] {
	v	T
} [size[8]]

type signalno int32[0:65]
type signalnoptr intptr[0:65]

# syz_execute_func caused multiple problems:
# 1. First it lead to corpus explosion. The program used existing values in registers
# to pollute output area. We tried to zero registers (though, not reliably).
# 2. It lead to explosion again. The exact mechanics are unknown, here is one sample:
# syz_execute_func(&(0x7f0000000440)="f2af91930f0124eda133fa20430fbafce842f66188d0d4
#	430fc7f314c1ab5bf9e2f9660f3a0fae5e090000ba023c1fb63ac4817d73d74ec482310d46f44
#	9f216c863fa438036a91bdbae95aaaa420f383c02c401405c6bfd49d768d768f833fefbab6464
#	660f38323c8f26dbc1a1fe5ff6f6df0804f4c4efa59c0f01c4288ba6452e000054c4431d5cc100")
# 3. The code can also execute syscalls (and it is know to), but it's not subject to
# target.SanitizeCall. As the result it can do things that programs are not supposed to do.
# 4. Besides linux, corpus explosion also happens on freebsd and is clearly attributable
# to syz_execute_func based on corpus contents. Mechanics are also not known.
# It also did not cause finding of any new bugs (at least not that I know of).
# So it's disabled on all OSes until we figure out how to resolve all these problems.
syz_execute_func(text ptr[in, text[target]]) (disabled)

# Exclude /sys/power/state as reported in https://lkml.org/lkml/2021/5/27/653
openat$sysfs(fd const[AT_FDCWD], dir ptr[in, glob["/sys/**/*:-/sys/power/state"]], flags flags[open_flags], mode flags[open_mode]) fd

open(file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd (automatic_helper)
# Just so that we have something that creates fd_dir resources.
open$dir(file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd_dir (automatic_helper)
openat$dir(fd const[AT_FDCWD], file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd_dir (automatic_helper)
openat(fd fd_dir[opt], file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd
openat2$dir(fd const[AT_FDCWD], file ptr[in, filename], how ptr[in, open_how], size bytesize[how]) fd_dir (automatic_helper)
openat2(fd fd_dir[opt], file ptr[in, filename], how ptr[in, open_how], size bytesize[how]) fd
creat(file ptr[in, filename], mode flags[open_mode]) fd
close(fd fd)
read(fd fd, buf buffer[out], count len[buf])
pread64(fd fd, buf buffer[out], count len[buf], pos fileoff)
readv(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec])
preadv(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec], off_low int32, off_high int32)
preadv2(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec], off_low int32, off_high int32, flags flags[rwf_flags])
write(fd fd, buf buffer[in], count len[buf])
pwrite64(fd fd, buf buffer[in], count len[buf], pos fileoff)
writev(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec])
pwritev(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], off_low int32, off_high int32)
pwritev2(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], off_low int32, off_high int32, flags flags[rwf_flags])
# lseek can return negative offsets when the file has FMODE_UNSIGNED_OFFSET flag:
# https://elixir.bootlin.com/linux/v6.11-rc7/source/fs/read_write.c#L56
# It's unclear how it's then even possible to distinguish error from valid offset, but it's not our problem.
# We just have to ignore return values of lseek.
lseek(fd fd, offset fileoff, whence flags[seek_whence]) (ignore_return)
copy_file_range(fd_in fd, off_in ptr[inout, fileoff[int64], opt], fd_out fd, off_out ptr[inout, fileoff[int64], opt], len intptr, flags flags[copy_file_range_flags])

rwf_flags = RWF_DSYNC, RWF_HIPRI, RWF_SYNC, RWF_NOWAIT, RWF_APPEND
copy_file_range_flags = 0

dup(oldfd fd) fd
dup2(oldfd fd, newfd fd) fd
dup3(oldfd fd, newfd fd, flags flags[dup_flags]) fd

pipe(pipefd ptr[out, pipefd])
pipe2(pipefd ptr[out, pipefd], flags flags[pipe_flags])

tee(fdin fd, fdout fd, len intptr, f flags[splice_flags])
splice(fdin fd, offin ptr[in, fileoff[int64]], fdout fd, offout ptr[in, fileoff[int64]], len intptr, f flags[splice_flags])
vmsplice(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], f flags[splice_flags])
sendfile(fdout fd, fdin fd, off ptr[inout, fileoff[intptr], opt], count intptr)
sendfile64(fdout fd, fdin fd, off ptr[inout, fileoff[int64], opt], count intptr)

cachestat_range {
	off	fileoff[int64]
	len	int64
}

cachestat {
	nr_cache		int64
	nr_dirty		int64
	nr_writeback		int64
	nr_evicted		int64
	nr_recently_evicted	int64
}

stat(file ptr[in, filename], statbuf ptr[out, stat])
lstat(file ptr[in, filename], statbuf ptr[out, stat])
fstat(fd fd, statbuf ptr[out, stat])
newfstatat(dfd const[AT_FDCWD], file ptr[in, filename], statbuf ptr[out, stat], flag flags[statx_flags])
stat64(file ptr[in, filename], statbuf ptr[out, stat64])
lstat64(file ptr[in, filename], statbuf ptr[out, stat64])
fstat64(fd fd, statbuf ptr[out, stat64])
fstatat64(dfd const[AT_FDCWD], file ptr[in, filename], statbuf ptr[out, stat64], flag flags[statx_flags])
statx(fd fd_dir, file ptr[in, filename], flags flags[statx_flags], mask flags[statx_mask], statxbuf ptr[out, statx])
cachestat(fd fd, cstat_range ptr[in, cachestat_range], cstat ptr[out, cachestat], flags const[0])

poll(fds ptr[in, array[pollfd]], nfds len[fds], timeout int32)
ppoll(fds ptr[in, array[pollfd]], nfds len[fds], tsp ptr[in, timespec], sigmask ptr[in, sigset_t], size len[sigmask])
select(n len[inp], inp ptr[inout, fd_set], outp ptr[inout, fd_set], exp ptr[inout, fd_set], tvp ptr[inout, timeval])
pselect6(n len[inp], inp ptr[inout, fd_set], outp ptr[inout, fd_set], exp ptr[inout, fd_set], tvp ptr[inout, timespec], sig ptr[in, sigset_size])

resource fd_epoll[fd]
epoll_create(size int32) fd_epoll
epoll_create1(flags flags[epoll_flags]) fd_epoll
epoll_ctl$EPOLL_CTL_ADD(epfd fd_epoll, op const[EPOLL_CTL_ADD], fd fd, ev ptr[in, epoll_event])
epoll_ctl$EPOLL_CTL_MOD(epfd fd_epoll, op const[EPOLL_CTL_MOD], fd fd, ev ptr[in, epoll_event])
epoll_ctl$EPOLL_CTL_DEL(epfd fd_epoll, op const[EPOLL_CTL_DEL], fd fd)
epoll_wait(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout int32)
epoll_pwait(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout int32, sigmask ptr[in, sigset_t], size bytesize[sigmask])
epoll_pwait2(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout ptr[in, timespec], sigmask ptr[in, sigset_t], size bytesize[sigmask])

resource fd_timer[fd]
signalfd(fd fd, mask ptr[in, sigset_t], size len[mask]) fd
signalfd4(fd fd, mask ptr[in, sigset_t], size len[mask], flags flags[signalfd_flags]) fd
timerfd_create(clockid flags[clock_type], flags flags[timerfd_create_flags]) fd_timer
timerfd_settime(fd fd_timer, flags flags[timerfd_settime_flags], new ptr[in, itimerspec], old ptr[out, itimerspec])
timerfd_gettime(fd fd_timer, cur ptr[out, itimerspec])
ioctl$TFD_IOC_SET_TICKS(fd fd_timer, cmd const[TFD_IOC_SET_TICKS], arg ptr[in, int64])

resource fd_event[fd]
eventfd(initval int32) fd_event
eventfd2(initval int32, flags flags[eventfd_flags]) fd_event
read$eventfd(fd fd_event, val ptr[out, int64], len len[val])
write$eventfd(fd fd_event, val ptr[in, int64], len len[val])

brk(brk intptr)
mmap(addr vma, len len[addr], prot flags[mmap_prot], flags flags[mmap_flags], fd fd, offset intptr[0:0xffffffff, 0x1000])
munmap(addr vma, len len[addr])
mremap(addr vma, len len[addr], newlen len[newaddr], flags flags[mremap_flags], newaddr vma)
remap_file_pages(addr vma, size len[addr], prot flags[mmap_prot], pgoff intptr, flags flags[mmap_flags])
mprotect(addr vma, len len[addr], prot flags[mmap_prot])
msync(addr vma, len len[addr], f flags[msync_flags])
madvise(addr vma, len len[addr], advice flags[madvise_flags])
process_madvise(pidfd fd_pidfd, vec ptr[in, array[iovec_in]], vlen len[vec], advice flags[madvise_flags], flags const[0])
process_mrelease(pidfd fd_pidfd, flags const[0])
fadvise64(fd fd, offset fileoff, len intptr, advice flags[fadvise_flags])
readahead(fd fd, off intptr, count intptr)
mbind(addr vma, len len[addr], mode flags[mbind_mode], nodemask ptr[in, int64], maxnode intptr, flags flags[mbind_flags])
move_pages(pid pid, nr len[pages], pages ptr[in, array[vma]], nodes ptr[in, array[int32], opt], status ptr[out, array[int32]], flags flags[move_pages_flags])
migrate_pages(pid pid, maxnode intptr, old ptr[in, int64], new ptr[in, int64])
set_mempolicy(mode flags[mbind_mode], nodemask ptr[in, int64], maxnode intptr)
get_mempolicy(mode ptr[out, int32], nodemask ptr[out, int64], maxnode intptr, addr vma, flags flags[mempolicy_flags])
set_mempolicy_home_node(addr vma, len len[addr], home_node intptr[0:3], flags const[0])
mincore(addr vma, size len[addr], vec buffer[out])
mlock(addr vma, size len[addr])
mlock2(addr vma, size len[addr], flags flags[mlock_flags])
munlock(addr vma, size len[addr])
mlockall(flags flags[mlockall_flags])
munlockall()
kcmp(pid1 pid, pid2 pid, type flags[kcmp_flags], fd1 fd, fd2 fd)
kcmp$KCMP_EPOLL_TFD(pid1 pid, pid2 pid, type const[KCMP_EPOLL_TFD], fd1 fd, idx2 ptr[in, kcmp_epoll_slot])

resource fd_memfd[fd]
memfd_create(name ptr[in, string], flags flags[memfd_flags]) fd_memfd
memfd_flags = MFD_CLOEXEC, MFD_ALLOW_SEALING, MFD_HUGETLB
_ = MFD_HUGE_SHIFT, MFD_HUGE_MASK, MFD_HUGE_64KB, MFD_HUGE_512KB, MFD_HUGE_1MB, MFD_HUGE_2MB, MFD_HUGE_8MB, MFD_HUGE_16MB

memfd_secret(flags flags[memfd_secret_flags]) fd
memfd_secret_flags = O_CLOEXEC

resource pkey[int32]: -1
pkey_alloc(flags const[0], val flags[pkey_flags]) pkey
pkey_free(key pkey)
pkey_mprotect(addr vma, len len[addr], prot flags[mmap_prot], key pkey)
syz_pkey_set(key pkey, val flags[pkey_flags])

pkey_flags = PKEY_DISABLE_ACCESS, PKEY_DISABLE_WRITE

restart_syscall()

# Almighty!
ioctl(fd fd, cmd int32, arg buffer[in])

ioctl$int_in(fd fd, cmd flags[ioctl_int_in], v ptr[in, int64])
ioctl$int_out(fd fd, cmd flags[ioctl_int_out], v ptr[out, intptr])

ioctl$FIOCLEX(fd fd, cmd const[FIOCLEX])
ioctl$FIONCLEX(fd fd, cmd const[FIONCLEX])
ioctl$FITHAW(fd fd, cmd const[FITHAW])

# FIFREEZE is enabled in sandbox mode only because it can easily kill the machine.
ioctl$FIFREEZE(fd fd, cmd const[FIFREEZE]) (snapshot)

fcntl$dupfd(fd fd, cmd flags[fcntl_dupfd], arg fd) fd
fcntl$getflags(fd fd, cmd flags[fcntl_getflags])
fcntl$setflags(fd fd, cmd const[F_SETFD], flags flags[fcntl_flags])
fcntl$setstatus(fd fd, cmd const[F_SETFL], flags flags[fcntl_status])
fcntl$lock(fd fd, cmd flags[fcntl_lock], lock ptr[in, flock])
fcntl$getown(fd fd, cmd const[F_GETOWN]) pid (automatic_helper)
fcntl$setown(fd fd, cmd const[F_SETOWN], pid pid)
fcntl$getownex(fd fd, cmd const[F_GETOWN_EX], arg ptr[out, f_owner_ex])
fcntl$setownex(fd fd, cmd const[F_SETOWN_EX], arg ptr[in, f_owner_ex])
fcntl$setsig(fd fd, cmd const[F_SETSIG], sig signalnoptr)
fcntl$setlease(fd fd, cmd const[F_SETLEASE], typ flags[flock_type])
fcntl$notify(fd fd, cmd const[F_NOTIFY], typ flags[fcntl_notify])
fcntl$setpipe(fd fd, cmd const[F_SETPIPE_SZ], sz intptr)
fcntl$addseals(fd fd, cmd const[F_ADD_SEALS], seals flags[seal_types])
fcntl$F_GET_RW_HINT(fd fd, cmd const[F_GET_RW_HINT], hint ptr[out, int64])
fcntl$F_GET_FILE_RW_HINT(fd fd, cmd const[F_GET_FILE_RW_HINT], hint ptr[out, int64])
fcntl$F_SET_RW_HINT(fd fd, cmd const[F_SET_RW_HINT], hint ptr[in, flags[fcntl_rw_hint, int64]])
fcntl$F_SET_FILE_RW_HINT(fd fd, cmd const[F_SET_FILE_RW_HINT], hint ptr[in, flags[fcntl_rw_hint, int64]])

# Only some commands break return values.
# When/if we have stricter enforcement of arguments, we may remove some of breaks_returns attributes.
ptrace(req flags[ptrace_req], pid pid) (breaks_returns)
ptrace$peek(req flags[ptrace_req_peek], pid pid, addr ptr[out, intptr]) (breaks_returns)
ptrace$poke(req flags[ptrace_req_poke], pid pid, addr ptr[out, intptr], data intptr) (breaks_returns)
ptrace$peekuser(req const[PTRACE_PEEKUSR], pid pid, addr intptr) (breaks_returns)
ptrace$pokeuser(req const[PTRACE_POKEUSR], pid pid, addr intptr, data intptr) (breaks_returns)
ptrace$getregs(req flags[ptrace_req_getregs], pid pid, ignored intptr, data buffer[out]) (breaks_returns)
ptrace$getregset(req const[PTRACE_GETREGSET], pid pid, what flags[pthread_regset], data ptr[in, iovec_out]) (breaks_returns)
ptrace$setregs(req flags[ptrace_req_setregs], pid pid, ignored intptr, data buffer[in]) (breaks_returns)
ptrace$setregset(req const[PTRACE_SETREGSET], pid pid, what flags[pthread_regset], data ptr[in, iovec_in]) (breaks_returns)
ptrace$getsig(req const[PTRACE_GETSIGINFO], pid pid, ignored intptr, data ptr[out, siginfo]) (breaks_returns)
ptrace$setsig(req const[PTRACE_SETSIGINFO], pid pid, ignored intptr, data ptr[in, siginfo]) (breaks_returns)
ptrace$setopts(req flags[ptrace_req_setopts], pid pid, ignored intptr, flags flags[ptrace_options]) (breaks_returns)
ptrace$getenv(req const[PTRACE_GETEVENTMSG], pid pid, ignored intptr, data ptr[out, intptr]) (breaks_returns)
ptrace$cont(req flags[ptrace_req_cont], pid pid, ignored intptr, data intptr) (breaks_returns)
ptrace$PTRACE_SECCOMP_GET_FILTER(req const[PTRACE_SECCOMP_GET_FILTER], pid pid, addr intptr, data ptr[out, array[int8]]) (breaks_returns)
ptrace$PTRACE_SECCOMP_GET_METADATA(req const[PTRACE_SECCOMP_GET_METADATA], pid pid, addr len[data], data ptr[in, seccomp_metadata]) (breaks_returns)
ptrace$PTRACE_SETSIGMASK(req const[PTRACE_SETSIGMASK], pid pid, size bytesize[data], data ptr[in, sigset_t]) (breaks_returns)
ptrace$PTRACE_GETSIGMASK(req const[PTRACE_GETSIGMASK], pid pid, size bytesize[data], data ptr[out, sigset_t]) (breaks_returns)
ptrace$ARCH_GET_FS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_GET_FS]) (breaks_returns)
ptrace$ARCH_GET_GS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_GET_GS]) (breaks_returns)
ptrace$ARCH_SET_GS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_SET_GS]) (breaks_returns)
ptrace$ARCH_GET_CPUID(req const[PTRACE_ARCH_PRCTL], pid pid, arg const[0], code const[ARCH_GET_CPUID]) (breaks_returns)
ptrace$ARCH_SET_CPUID(req const[PTRACE_ARCH_PRCTL], pid pid, arg boolptr, code const[ARCH_SET_CPUID]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_X32(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_X32]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_32(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_32]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_64(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_64]) (breaks_returns)
ptrace$ARCH_SHSTK_STATUS(req const[PTRACE_ARCH_PRCTL], pid pid, res ptr[out, intptr], cmd const[ARCH_SHSTK_STATUS]) (breaks_returns)
ptrace$ARCH_SHSTK_LOCK(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_LOCK]) (breaks_returns)
ptrace$ARCH_SHSTK_UNLOCK(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_UNLOCK]) (breaks_returns)
ptrace$ARCH_SHSTK_ENABLE(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_ENABLE]) (breaks_returns)
ptrace$ARCH_SHSTK_DISABLE(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_DISABLE]) (breaks_returns)
ptrace$ARCH_GET_UNTAG_MASK(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], cmd const[ARCH_GET_UNTAG_MASK]) (breaks_returns)
ptrace$ARCH_GET_MAX_TAG_BITS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], cmd const[ARCH_GET_MAX_TAG_BITS]) (breaks_returns)
ptrace$ARCH_ENABLE_TAGGED_ADDR(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr[1:6], cmd const[ARCH_ENABLE_TAGGED_ADDR]) (breaks_returns)
ptrace$ARCH_FORCE_TAGGED_SVA(req const[PTRACE_ARCH_PRCTL], pid pid, arg const[0], cmd const[ARCH_FORCE_TAGGED_SVA]) (breaks_returns)

map_shadow_stack(addr vma, size bytesize[addr], flags boolptr)

seccomp_metadata {
	filter_off	int64
	flags		const[0, int64]
}

ptrace_peeksiginfo_args {
	off	int64
	flags	flags[ptrace_peeksiginfo_flags, int32]
	nr	len[syscall:data, int32]
}

ptrace$peeksig(req const[PTRACE_PEEKSIGINFO], pid pid, args ptr[in, ptrace_peeksiginfo_args], data ptr[out, array[siginfo]])

capget(hdr ptr[in, cap_header], data ptr[in, cap_data])
capset(hdr ptr[in, cap_header], data ptr[in, cap_data])

resource fd_mq[fd]
mq_open(name ptr[in, string], flags flags[mq_open_flags], mode flags[open_mode], attr ptr[in, mq_attr]) fd_mq
mq_timedsend(mqd fd_mq, msg buffer[in], msglen len[msg], prio intptr, timeout ptr[in, timespec, opt])
mq_timedreceive(mqd fd_mq, msg buffer[out], msglen len[msg], prio intptr, timeout ptr[in, timespec, opt])
mq_notify(mqd fd_mq, notif ptr[in, sigevent])
mq_getsetattr(mqd fd_mq, attr ptr[in, mq_attr], oldattr ptr[out, mq_attr, opt])
mq_unlink(name ptr[in, string])

mknod(file ptr[in, filename], mode flags[mknod_mode], dev int32)
mknod$loop(file ptr[in, filename], mode flags[mknod_mode], dev proc[1792, 2])
mknodat$loop(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev proc[1792, 2])
mknodat$null(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev const[0x103])
mknodat(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev int32)
chmod(file ptr[in, filename], mode flags[open_mode])
fchmod(fd fd, mode flags[open_mode])
fchmodat(dirfd fd_dir, file ptr[in, filename], mode flags[open_mode])
chown(file ptr[in, filename], uid uid, gid gid)
lchown(file ptr[in, filename], uid uid, gid gid)
fchown(fd fd, uid uid, gid gid)
fchownat(dirfd fd_dir, file ptr[in, filename], uid uid, gid gid, flags flags[at_flags])
fallocate(fd fd, mode flags[fallocate_mode], off intptr, len intptr)
faccessat(dirfd fd_dir, pathname ptr[in, filename], mode flags[open_mode])
faccessat2(dirfd fd_dir, pathname ptr[in, filename], mode flags[open_mode], flags flags[faccessat_flags])
utime(filename ptr[in, filename], times ptr[in, utimbuf])
utimes(filename ptr[in, filename], times ptr[in, itimerval])
futimesat(dir fd_dir, pathname ptr[in, filename], times ptr[in, itimerval])
utimensat(dir fd_dir, pathname ptr[in, filename], times ptr[in, itimerval], flags flags[utimensat_flags])

# Small trick - syzkaller cannot give the proper stack pointer to clone(), but we can do it with the aid of pseudo syscalls.
syz_clone(flags flags[clone_flags], stack buffer[in], stack_len bytesize[stack], parentid ptr[out, int32], childtid ptr[out, int32], tls buffer[in]) pid (automatic_helper)

syz_clone3(args ptr[in, clone_args], size bytesize[args]) pid (automatic_helper)

# We need these disabled definitions to simplify the presence and the NR checking.
clone(flags flags[clone_flags], sp buffer[in], parentid ptr[out, int32], childtid ptr[out, int32], tls buffer[in]) (breaks_returns, disabled)
clone3(args ptr[in, clone_args], size bytesize[args]) pid (breaks_returns, disabled)

clone_args {
	flags		flags[clone3_flags, int64]
	pidfd		ptr64[out, fd_pidfd]
	child_tid	ptr64[out, pid]
	parent_tid	ptr64[out, pid]
	exit_signal	align64[signalno]
	stack		ptr64[out, array[int8]]
	stack_size	bytesize[stack, int64]
	tls		ptr64[out, array[int8]]
	set_tid		ptr64[in, array[pid]]
	set_tid_size	len[set_tid, int64]
	cgroup		align64[fd_cgroup]
}

resource pid[int32]: 0, -1
resource uid[int32]: 0, -1, 0xee00, 0xee01
resource gid[int32]: 0, -1, 0xee00, 0xee01

getgid() gid (automatic_helper)
getegid() gid (automatic_helper)
setuid(uid uid)
setgid(gid gid)
getuid() uid (automatic_helper)
geteuid() uid (automatic_helper)
setpgid(pid pid, pgid pid)
getpgid(pid pid) pid (automatic_helper)
getpgrp(pid pid) pid (automatic_helper)
getpid() pid (automatic_helper)
gettid() pid (automatic_helper)
setreuid(ruid uid, euid uid)
setregid(rgid gid, egid gid)
setresuid(ruid uid, euid uid, suid uid)
setresgid(rgid gid, egid gid, sgid gid)
getresuid(ruid ptr[out, uid], euid ptr[out, uid], suid ptr[out, uid])
getresgid(rgid ptr[out, gid], egid ptr[out, gid], sgid ptr[out, gid])
setfsuid(fsuid uid)
setfsgid(fsgid gid)
getgroups(size len[list], list ptr[inout, array[gid]])
setgroups(size len[list], list ptr[in, array[gid]])
personality(persona flags[personality_flags])
# Don't mess with parent (fuzzer). If we ptrace attach to it, it will hang.
# If we setrlimit for parent, it will misbehave. Killing - the same. Nothing good.
#getppid() pid
#getsid(pid pid) pid
#setsid() pid

link(old ptr[in, filename], new ptr[in, filename])
linkat(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename], flags flags[linkat_flags])
symlinkat(old ptr[in, filename], newfd fd_dir, new ptr[in, filename])
symlink(old ptr[in, filename], new ptr[in, filename])
unlink(path ptr[in, filename])
unlinkat(fd fd_dir, path ptr[in, filename], flags flags[unlinkat_flags])
readlink(path ptr[in, filename], buf buffer[out], siz len[buf])
readlinkat(fd fd_dir, path ptr[in, filename], buf buffer[out], siz len[buf])
rename(old ptr[in, filename], new ptr[in, filename])
renameat(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename])
renameat2(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename], flags flags[renameat2_flags])
mkdir(path ptr[in, filename], mode flags[open_mode])
mkdirat(fd fd_dir[opt], path ptr[in, filename], mode flags[open_mode])
rmdir(path ptr[in, filename])
truncate(file ptr[in, filename], len intptr)
ftruncate(fd fd, len intptr)
flock(fd fd, op flags[flock_op])
fsync(fd fd)
fdatasync(fd fd)
sync()
syncfs(fd fd)
sync_file_range(fd fd, off intptr, nbytes intptr, flags flags[sync_file_flags])
lookup_dcookie(cookie intptr, buf buffer[out], len len[buf])
getdents(fd fd_dir, ent buffer[out], count len[ent])
getdents64(fd fd_dir, ent buffer[out], count len[ent])
name_to_handle_at(fd fd_dir, file ptr[in, filename], handle ptr[in, file_handle], mnt ptr[out, int32], flags flags[name_to_handle_at_flags])
open_by_handle_at(mountdirfd fd, handle ptr[in, file_handle], flags flags[open_flags])
chroot(dir ptr[in, filename])
getcwd(buf buffer[out], size len[buf])
chdir(dir ptr[in, filename])
fchdir(fd fd)
pivot_root(new_root ptr[in, filename], put_old ptr[in, filename])

sysfs$1(option const[1], fsname ptr[in, string])
sysfs$2(option const[2], fsindex intptr, fsname buffer[out])
sysfs$3(option const[3])
statfs(path ptr[in, filename], buf buffer[out])
fstatfs(fd fd, buf buffer[out])

uselib(lib ptr_binfmt_file)
init_module(mod ptr[in, binfmt_elf64], len len[mod], args ptr[in, string])
finit_module(fd fd_binfmt, args ptr[in, string], flags flags[finit_module_flags])
delete_module(name ptr[in, string], flags flags[delete_module_flags])
kexec_load(entry intptr, nr_segments len[segments], segments ptr[in, array[kexec_segment]], flags flags[kexec_load_flags])
syslog(cmd flags[syslog_cmd], buf ptr[out, array[int8], opt], len len[buf])
uname(buf buffer[out])
sysinfo(info buffer[out])
ustat(dev intptr, buf ptr[out, ustat])
acct(filename ptr[in, filename, opt])

getrusage(who flags[rusage_who], usage ptr[out, rusage])
getrlimit(res flags[rlimit_type], rlim ptr[out, rlimit])
setrlimit(res flags[rlimit_type], rlim ptr[in, rlimit])
prlimit64(pid pid, res flags[rlimit_type], new ptr[in, rlimit, opt], old ptr[out, rlimit, opt])

iopl(level int8)
ioperm(from intptr, num intptr, on intptr)
ioprio_get$pid(which flags[ioprio_which_pid], who pid)
ioprio_get$uid(which flags[ioprio_which_uid], who uid)
ioprio_set$pid(which flags[ioprio_which_pid], who pid, ioprio flags[ioprio_priorities])
ioprio_set$uid(which flags[ioprio_which_uid], who uid, ioprio flags[ioprio_priorities])

# NEED: we can express the construction of integers using structs with flags
# and bitfields, which are normally obtained using a combination of bitwise
# operations with the help of macros. However, structs can't be directly passed
# as a syscall argument; therefore, such constructions can't be directly passed either.
# One example is ioprio argument for ioprio_set, where we could have expressed the
# construction less messy. For now, some subset of valid values are enumerated as
# in ioprio_priorities.

# ioprio priority values are obtained using IOPRIO_PRIO_VALUE(class, data) macro.
# the behaviour of the macro is mimicked below and some priority values are enumerated.
ioprio_priorities = IOPRIO_CLASS_NONE_PRIO, IOPRIO_CLASS_IDLE_PRIO, IOPRIO_CLASS_RT_HIGH_PRIO, IOPRIO_CLASS_BE_HIGH_PRIO, IOPRIO_CLASS_RT_MID_PRIO, IOPRIO_CLASS_BE_MID_PRIO, IOPRIO_CLASS_RT_LOW_PRIO, IOPRIO_CLASS_BE_LOW_PRIO

# The classes RT and BE take data values from the range [0:7]. Use a subset of the available
# values (0, 4, 7) to ease collisions, and to avoid redundancy. The classes NONE and IDLE
# have only one valid priority value each with data set to 0.
define IOPRIO_CLASS_NONE_PRIO	(IOPRIO_CLASS_NONE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_IDLE_PRIO	(IOPRIO_CLASS_IDLE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_RT_HIGH_PRIO	(IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_BE_HIGH_PRIO	(IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_RT_MID_PRIO	((IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT) + 4)
define IOPRIO_CLASS_BE_MID_PRIO	((IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT) + 4)
define IOPRIO_CLASS_RT_LOW_PRIO	((IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT) + 7)
define IOPRIO_CLASS_BE_LOW_PRIO	((IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT) + 7)

resource timerid[int32]
timer_create(id flags[clock_id], ev ptr[in, sigevent], timerid ptr[out, timerid])
timer_gettime(timerid timerid, setting ptr[out, itimerspec])
timer_getoverrun(timerid timerid)
timer_settime(timerid timerid, flags flags[timer_flags], new ptr[in, itimerspec], old ptr[out, itimerspec, opt])
timer_delete(timerid timerid)

time(t ptr[out, intptr])
clock_gettime(id flags[clock_id], tp ptr[out, timespec])
clock_settime(id flags[clock_id], tp ptr[in, timespec])
clock_adjtime(id flags[clock_id], tx ptr[in, timex])
clock_getres(id flags[clock_id], tp ptr[out, timespec])
clock_nanosleep(id flags[clock_id], flags flags[timer_flags], rqtp ptr[in, timespec], rmtp ptr[out, timespec, opt])
rt_sigaction(sig signalno, act ptr[in, sigaction], oact ptr[out, sigaction, opt], sigsetsize len[fake], fake ptr[out, sigset_t])
rt_sigprocmask(how flags[sigprocmask_how], nset ptr[in, sigset_t], oset ptr[out, sigset_t, opt], sigsetsize len[nset])
rt_sigreturn()
rt_sigpending(set ptr[out, sigset_t], sigsetsize len[set])
rt_sigtimedwait(these ptr[in, sigset_t], info ptr[out, siginfo, opt], ts ptr[in, timespec], sigsetsize len[these])
rt_sigsuspend(new ptr[in, sigset_t], sigsetsize len[new])
rt_sigqueueinfo(pid pid, sig signalno, info ptr[in, siginfo])
rt_tgsigqueueinfo(gid pid, tid pid, sig signalno, info ptr[in, siginfo])
sigaltstack(ss ptr[in, sigaltstack], oss ptr[out, sigaltstack, opt])
tgkill(gid pid, tid pid, sig signalno)
tkill(tid pid, sig signalno)
pause()
alarm(seconds intptr)
nanosleep(req ptr[in, timespec], rem ptr[out, timespec, opt])
getitimer(which flags[getitimer_which], cur ptr[out, itimerval])
setitimer(which flags[getitimer_which], new ptr[in, itimerval], old ptr[out, itimerval, opt])
exit(code intptr)
exit_group(code intptr)
waitid(which flags[waitid_which], pid pid, infop ptr[out, siginfo, opt], options flags[wait_options], ru ptr[out, rusage, opt])
waitid$P_PIDFD(which const[P_PIDFD], pidfd fd_pidfd, infop ptr[out, siginfo, opt], options flags[wait_options], ru ptr[out, rusage, opt])
wait4(pid pid, status ptr[out, int32, opt], options flags[wait_options], ru ptr[out, rusage, opt])
times(buf ptr[out, tms])
# Can send signals to all processes (pid=-1) so it's enabled only in snapshot mode.
kill(pid pid, sig signalno) (snapshot)

set_thread_area(info ptr[in, user_desc])
get_thread_area(info ptr[in, user_desc])
modify_ldt$read(func const[0], buf buffer[out], len len[buf])
modify_ldt$write(func const[1], buf ptr[in, user_desc], len len[buf])
modify_ldt$read_default(func const[2], buf buffer[out], len len[buf])
modify_ldt$write2(func const[17], buf ptr[in, user_desc], len len[buf])
process_vm_readv(pid pid, loc_vec ptr[in, array[iovec_out]], loc_vlen len[loc_vec], rem_vec ptr[in, array[iovec_out]], rem_vlen len[rem_vec], flags const[0])
process_vm_writev(pid pid, loc_vec ptr[in, array[iovec_out]], loc_vlen len[loc_vec], rem_vec ptr[in, array[iovec_out]], rem_vlen len[rem_vec], flags const[0])
set_tid_address(tidptr ptr[out, int32])
getpriority(which flags[priority_which], who pid)
setpriority(which flags[priority_which], who pid, prio intptr)
sched_getscheduler(pid pid)
sched_setscheduler(pid pid, policy flags[sched_policy], prio ptr[in, int32])
sched_rr_get_interval(pid pid, tp ptr[out, timespec])
sched_getparam(pid pid, prio ptr[out, int32])
sched_setparam(pid pid, prio ptr[in, int32])
sched_getaffinity(pid pid, cpusetsize len[mask], mask ptr[out, int64])
sched_setaffinity(pid pid, cpusetsize len[mask], mask ptr[in, int64])
sched_getattr(pid pid, attr ptr[out, sched_attr], size len[attr], flags const[0])
sched_setattr(pid pid, attr ptr[in, sched_attr], flags const[0])
sched_yield()
getrandom(buf buffer[out], len len[buf], flags flags[getrandom_flags])

reboot(magic1 const[LINUX_REBOOT_MAGIC1], magic2 const[LINUX_REBOOT_MAGIC2], cmd flags[reboot_commands], arg const[0]) (snapshot)

reboot_commands = LINUX_REBOOT_CMD_RESTART, LINUX_REBOOT_CMD_HALT, LINUX_REBOOT_CMD_CAD_ON, LINUX_REBOOT_CMD_CAD_OFF, LINUX_REBOOT_CMD_POWER_OFF, LINUX_REBOOT_CMD_RESTART2, LINUX_REBOOT_CMD_SW_SUSPEND, LINUX_REBOOT_CMD_KEXEC

swapon(specialfile ptr[in, filename], swap_flags flags[swap_flags]) (snapshot)
swapoff(specialfile ptr[in, filename]) (snapshot)

swap_flags = SWAP_FLAG_PRIO_MASK, SWAP_FLAG_PREFER, SWAP_FLAG_DISCARD, SWAP_FLAG_DISCARD_ONCE, SWAP_FLAG_DISCARD_PAGES

sethostname(name ptr[in, array[int8]], len bytesize[name]) (snapshot)
setdomainname(name ptr[in, array[int8]], len bytesize[name]) (snapshot)

gettimeofday(tv ptr[out, timeval], tz ptr[out, timezone])
settimeofday(tv ptr[out, timeval], tz ptr[out, timezone]) (snapshot)
adjtimex(txc_p ptr[in, __kernel_timex]) (snapshot)

timezone {
	tz_minuteswest	int32
	tz_dsttime	int32
}

__kernel_timex {
	modes		flags[adjtimex_modes, int32]
	pad0		const[0, int32]
	offset		int64
	freq		int64
	maxerror	int64
	esterror	int64
	status		int32
	pad1		const[0, int32]
	constant	int64
	precision	int64
	tolerance	int64
	int		timeval
	tick		int64
	ppsfreq		int64
	jitter		int64
	shift		int32
	pad2		const[0, int32]
	stabil		int64
	jitcnt		int64
	calcnt		int64
	errcnt		int64
	stbcnt		int64
	tai		int32
	pad3		array[const[0, int32], 11]
}

adjtimex_modes = ADJ_OFFSET, ADJ_FREQUENCY, ADJ_MAXERROR, ADJ_ESTERROR, ADJ_STATUS, ADJ_TIMECONST, ADJ_TAI, ADJ_SETOFFSET, ADJ_MICRO, ADJ_NANO, ADJ_TICK

membarrier(cmd flags[membarrier_cmd], flags const[0])

membarrier_cmd = MEMBARRIER_CMD_GLOBAL, MEMBARRIER_CMD_GLOBAL_EXPEDITED, MEMBARRIER_CMD_PRIVATE_EXPEDITED, MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED, MEMBARRIER_CMD_PRIVATE_EXPEDITED_SYNC_CORE, MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_SYNC_CORE, MEMBARRIER_CMD_QUERY, MEMBARRIER_CMD_REGISTER_GLOBAL_EXPEDITED, MEMBARRIER_CMD_SHARED

rseq(rseq ptr[in, rseq], rseq_len bytesize[rseq], flags boolptr, sig const[0])

rseq {
	cpu_id_start	const[0, int32]
	cpu_id		const[0, int32]
	rseq_cs		ptr64[in, rseq_cs, opt]
	flags		flags[rseq_cs_flags, int32]
} [align[32]]

rseq_cs {
	version			const[0, int32]
	flags			flags[rseq_cs_flags, int32]
	start_ip		int64
	post_commit_offset	int64
	abort_ip		int64
} [align[32]]

rseq_cs_flags = RSEQ_CS_FLAG_NO_RESTART_ON_PREEMPT, RSEQ_CS_FLAG_NO_RESTART_ON_SIGNAL, RSEQ_CS_FLAG_NO_RESTART_ON_MIGRATE

# start/end are unused for now, no definition of SYS_RISCV_FLUSH_ICACHE_LOCAL in uapi headers.
riscv_flush_icache(start const[0], end const[0], flags bool32)

syz_open_procfs(pid pid, file ptr[in, string[procfs_proc_file]]) fd

# TODO: some of net files are only available in the init namespace (e.g. bluetooth bnep and hci).
# We could find some way to open these files in the init namespace
# esp. taking into account that we create bluetooth sockets in init namespace.
procfs_proc_file = "auxv", "cmdline", "environ", "autogroup", "cgroup", "clear_refs", "comm", "coredump_filter", "cpuset", "gid_map", "io", "limits", "loginuid", "maps", "mountinfo", "mounts", "mountstats", "numa_maps", "oom_adj", "oom_score", "oom_score_adj", "pagemap", "personality", "projid_map", "sched", "schedstat", "sessionid", "setgroups", "smaps", "smaps_rollup", "totmaps", "stack", "stat", "statm", "status", "syscall", "timers", "uid_map", "wchan", "map_files", "attr", "attr/current", "attr/exec", "attr/fscreate", "attr/keycreate", "attr/prev", "attr/sockcreate", "ns", "children", "task", "fd", "fd/3", "fd/4", "fdinfo", "fdinfo/3", "fdinfo/4", "net", "net/anycast6", "net/arp", "net/bnep", "net/connector", "net/dev", "net/dev_mcast", "net/dev_snmp6", "net/fib_trie", "net/fib_triestat", "net/hci", "net/icmp", "net/icmp6", "net/if_inet6", "net/igmp", "net/igmp6", "net/ip6_flowlabel", "net/ip6_mr_cache", "net/ip6_mr_vif", "net/ip6_tables_matches", "net/ip6_tables_names", "net/ip6_tables_targets", "net/ip_mr_cache", "net/ip_mr_vif", "net/ip_tables_matches", "net/ip_tables_names", "net/ip_tables_targets", "net/ipv6_route", "net/l2cap", "net/llc/core", "net/llc/socket", "net/mcfilter", "net/mcfilter6", "net/netfilter", "net/netlink", "net/netstat", "net/nfsfs", "net/packet", "net/protocols", "net/psched", "net/ptype", "net/raw", "net/raw6", "net/rfcomm", "net/route", "net/rpc", "net/rt6_stats", "net/rt_acct", "net/rt_cache", "net/sco", "net/sctp", "net/snmp", "net/snmp6", "net/sockstat", "net/sockstat6", "net/softnet_stat", "net/stat", "net/tcp", "net/tcp6", "net/udp", "net/udp6", "net/udplite", "net/udplite6", "net/unix", "net/wireless", "net/xfrm_stat", "net/ip_vs", "net/ip_vs_stats", "net/ip_vs_stats_percpu", "net/nf_conntrack", "net/nf_conntrack_expect", "net/vlan/config", "net/vlan/vlan0", "net/vlan/vlan1", "net/kcm", "net/psched", "timerslack_ns"

openat$procfs(fd const[AT_FDCWD], file ptr[in, string[procfs_file]], flags const[O_RDONLY], mode const[0]) fd

procfs_file = "/proc/keys", "/proc/key-users", "/proc/crypto", "/proc/consoles", "/proc/cgroups", "/proc/zoneinfo", "/proc/vmstat", "/proc/vmallocinfo", "/proc/tty/drivers", "/proc/tty/ldiscs", "/proc/timer_list", "/proc/sysvipc/sem", "/proc/sysvipc/msg", "/proc/sysvipc/shm", "/proc/stat", "/proc/slabinfo", "/proc/schedstat", "/proc/partitions", "/proc/meminfo", "/proc/mdstat", "/proc/locks", "/proc/diskstats", "/proc/cpuinfo", "/proc/consoles", "/proc/bus/input/devices", "/proc/bus/input/handlers", "/proc/asound/seq/clients", "/proc/asound/seq/clients", "/proc/asound/seq/timer", "/proc/asound/timers"

resource fd_yama_ptrace_scope[fd]

# 0 - YAMA_SCOPE_DISABLED
# 1 - YAMA_SCOPE_RELATIONAL
# 2 - YAMA_SCOPE_CAPABILITY
# 3 - YAMA_SCOPE_NO_ATTACH
yama_modes = "0", "1", "2", "3"

openat$yama_ptrace_scope(fd const[AT_FDCWD], file ptr[in, string["/proc/sys/kernel/yama/ptrace_scope"]], flags const[O_RDWR], mode const[0]) fd_yama_ptrace_scope
write$yama_ptrace_scope(fd fd_yama_ptrace_scope, data ptr[in, string[yama_modes]], count len[data])

# Write into some interesting sysct's and sysfs/procfs files.
resource fd_sysctl[fd]

openat$sysctl(fd const[AT_FDCWD], file ptr[in, string[sysctl_file]], flags const[O_WRONLY], mode const[0]) fd_sysctl
write$sysctl(fd fd_sysctl, val ptr[in, string[sysctl_value]], len len[val])

sysctl_file = "/sys/kernel/mm/ksm/run", "/proc/sys/vm/compact_memory", "/proc/sys/vm/drop_caches", "/proc/sys/net/ipv4/tcp_timestamps", "/proc/sys/net/ipv4/tcp_sack", "/proc/sys/net/ipv4/tcp_dsack", "/proc/sys/net/ipv4/tcp_window_scaling", "/proc/sys/net/ipv4/tcp_syncookies", "/proc/sys/net/ipv4/tcp_recovery", "/proc/sys/net/ipv4/tcp_mtu_probing", "/proc/sys/net/ipv4/tcp_rfc1337", "/proc/self/clear_refs"
# Most of these values are suitable for all sysctl_file files.
sysctl_value = "0", "1", "2", "3", "4", "5", "6", "7"

# Write to this file triggers khugepaged scan.
# We don't want to write small values as we only want the explicitly triggered scan.
resource fd_khugepaged_scan[fd]

openat$khugepaged_scan(fd const[AT_FDCWD], file ptr[in, string["/sys/kernel/mm/transparent_hugepage/khugepaged/scan_sleep_millisecs"]], flags const[O_WRONLY], mode const[0]) fd_khugepaged_scan
write$khugepaged_scan(fd fd_khugepaged_scan, val ptr[in, string["1000000"]], len len[val])

resource fd_tcp_congestion[fd]

openat$tcp_congestion(fd const[AT_FDCWD], file ptr[in, string["/proc/sys/net/ipv4/tcp_congestion_control"]], flags const[O_WRONLY], mode const[0]) fd_tcp_congestion
write$tcp_congestion(fd fd_tcp_congestion, val ptr[in, string[tcp_congestion]], len len[val])

tcp_congestion = "reno", "bbr", "bic", "cdg", "cubic", "dctcp", "westwood", "highspeed", "hybla", "htcp", "vegas", "nv", "veno", "scalable", "lp", "yeah", "illinois"

resource fd_tcp_mem[fd]

openat$tcp_mem(fd const[AT_FDCWD], file ptr[in, string[tcp_mem_files]], flags const[O_WRONLY], mode const[0]) fd_tcp_mem
write$tcp_mem(fd fd_tcp_mem, val ptr[in, tcp_mem_values], len len[val])

tcp_mem_files = "/proc/sys/net/ipv4/tcp_rmem", "/proc/sys/net/ipv4/tcp_wmem"

tcp_mem_values {
	v0	fmt[oct, int64]
	sp0	const[' ', int8]
	v1	fmt[oct, int64]
	sp1	const[' ', int8]
	v2	fmt[oct, int64]
	z	const[0, int8]
} [packed]

# /proc/self/reclaim is ChromeOS-specific:
# https://chromium.googlesource.com/chromiumos/third_party/kernel/+/4c3ad28b9c913%5E%21/
resource fd_proc_reclaim[fd]

openat$proc_reclaim(fd const[AT_FDCWD], file ptr[in, string["/proc/self/reclaim"]], flags const[O_WRONLY], mode const[0]) fd_proc_reclaim
write$proc_reclaim(fd fd_proc_reclaim, val ptr[in, string[proc_reclaim_vals]], len len[val])

proc_reclaim_vals = "file", "anon", "all"

resource fd_pidfd[fd]

openat$pidfd(fd const[AT_FDCWD], file ptr[in, string["/proc/self"]], flags flags[open_flags], mode const[0]) fd_pidfd
openat$thread_pidfd(fd const[AT_FDCWD], file ptr[in, string["/proc/thread-self"]], flags flags[open_flags], mode const[0]) fd_pidfd
pidfd_send_signal(fd fd_pidfd, sig signalno, info ptr[in, siginfo], flags const[0])

# pidfd_open is dangerous, so we use syz_pidfd_open instead.
pidfd_open(pid pid, flags const[0]) fd_pidfd (disabled)
syz_pidfd_open(pid pid, flags const[0]) fd_pidfd
pidfd_getfd(pidfd fd_pidfd, fd fd, flags const[0]) fd

close_range(fd fd, max_fd fd, flags flags[close_range_flags])

# Uncomment on your own account.
#syz_open_dev$char(dev const[0xc], major intptr, minor intptr) fd
#syz_open_dev$block(dev const[0xb], major intptr, minor intptr) fd

# /dev/console known to cause problems on at least two different kernels.
# It can turn off all output or produce massive amounts of garbage on console.
# Disable it for now.
#syz_open_dev$console(dev ptr[in, string["/dev/console"]], id const[0], flags flags[open_flags]) fd

resource fd_autofs[fd]

# These devices are relatively safe (don't reboot and don't corrupt kernel memory).
# They need a more comprehensive support. But let at least open them for now,
# maybe fuzzer will be able to skrew them in a useful way.
# TODO: all these devices returning just fd need proper interface descriptions.
openat$vcs(fd const[AT_FDCWD], file ptr[in, string["/dev/vcs"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsn(dev ptr[in, string["/dev/vcs#"]], id intptr, flags flags[open_flags]) fd
openat$vcsa(fd const[AT_FDCWD], file ptr[in, string["/dev/vcsa"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsa(dev ptr[in, string["/dev/vcsa#"]], id intptr, flags flags[open_flags]) fd
openat$vcsu(fd const[AT_FDCWD], file ptr[in, string["/dev/vcsu"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsu(dev ptr[in, string["/dev/vcsu#"]], id intptr, flags flags[open_flags]) fd
syz_open_dev$ircomm(dev ptr[in, string["/dev/ircomm#"]], id intptr, flags flags[open_flags]) fd
syz_open_dev$audion(dev ptr[in, string["/dev/audio#"]], id intptr, flags flags[open_flags]) fd

openat$null(fd const[AT_FDCWD], file ptr[in, string["/dev/null"]], flags flags[open_flags], mode const[0]) fd
openat$zero(fd const[AT_FDCWD], file ptr[in, string["/dev/zero"]], flags flags[open_flags], mode const[0]) fd
openat$full(fd const[AT_FDCWD], file ptr[in, string["/dev/full"]], flags flags[open_flags], mode const[0]) fd
openat$irnet(fd const[AT_FDCWD], file ptr[in, string["/dev/irnet"]], flags flags[open_flags], mode const[0]) fd
openat$hwrng(fd const[AT_FDCWD], file ptr[in, string["/dev/hwrng"]], flags flags[open_flags], mode const[0]) fd
openat$hpet(fd const[AT_FDCWD], file ptr[in, string["/dev/hpet"]], flags flags[open_flags], mode const[0]) fd
openat$autofs(fd const[AT_FDCWD], file ptr[in, string["/dev/autofs"]], flags flags[open_flags], mode const[0]) fd_autofs
openat$keychord(fd const[AT_FDCWD], file ptr[in, string["/dev/keychord"]], flags flags[open_flags], mode const[0]) fd
openat$zygote(fd const[AT_FDCWD], file ptr[in, string["/dev/socket/zygote"]], flags flags[open_flags], mode const[0]) fd
openat$pktcdvd(fd const[AT_FDCWD], file ptr[in, string["/dev/pktcdvd/control"]], flags flags[open_flags], mode const[0]) fd
openat$lightnvm(fd const[AT_FDCWD], file ptr[in, string["/dev/lightnvm/control"]], flags flags[open_flags], mode const[0]) fd
openat$xenevtchn(fd const[AT_FDCWD], file ptr[in, string["/dev/xen/evtchn"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_control(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm-control"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_monitor(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm-monitor"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_plock(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm_plock"]], flags flags[open_flags], mode const[0]) fd
openat$btrfs_control(fd const[AT_FDCWD], file ptr[in, string["/dev/btrfs-control"]], flags flags[open_flags], mode const[0]) fd
openat$ubi_ctrl(fd const[AT_FDCWD], file ptr[in, string["/dev/ubi_ctrl"]], flags flags[open_flags], mode const[0]) fd
openat$cachefiles(fd const[AT_FDCWD], file ptr[in, string["/dev/cachefiles"]], flags flags[open_flags], mode const[0]) fd
openat$ndctl0(fd const[AT_FDCWD], file ptr[in, string["/dev/ndctl0"]], flags flags[open_flags], mode const[0]) fd
openat$nmem0(fd const[AT_FDCWD], file ptr[in, string["/dev/nmem0"]], flags flags[open_flags], mode const[0]) fd
openat$nvram(fd const[AT_FDCWD], file ptr[in, string["/dev/nvram"]], flags flags[open_flags], mode const[0]) fd
openat$ocfs2_control(fd const[AT_FDCWD], file ptr[in, string["/dev/ocfs2_control"]], flags flags[open_flags], mode const[0]) fd
openat$nvme_fabrics(fd const[AT_FDCWD], file ptr[in, string["/dev/nvme-fabrics"]], flags flags[open_flags], mode const[0]) fd

pipefd {
	rfd	fd
	wfd	fd
}

type iovec[DIR, T] {
	addr	ptr[DIR, T]
	len	len[addr, intptr]
}
type iovec_in iovec[in, array[int8]]
type iovec_out iovec[out, array[int8]]

stat {
	st_dev		intptr
	st_ino		intptr
	st_mode		int32
	st_nlink	int32
	st_uid		uid
	st_gid		gid
	st_rdev		intptr
	__pad1		const[0, intptr]
	st_size		intptr
	st_blksize	int32
	__pad2		const[0, int32]
	st_blocks	intptr
	st_atime	intptr
	st_atime_nsec	intptr
	st_mtime	intptr
	st_mtime_nsec	intptr
	st_ctime	intptr
	st_ctime_nsec	intptr
	__unused4	const[0, int32]
	__unused5	const[0, int32]
}

statx {
	mask		int32
	blksize		int32
	attributes	int64
	nlink		int32
	uid		uid
	gid		gid
	mode		int16
	__spare0	int16
	ino		int64
	size		int64
	blocks		int64
	__spare1	int64
	atime		statx_timestamp
	btime		statx_timestamp
	ctime		statx_timestamp
	mtime		statx_timestamp
	rdev_major	int32
	rdev_minor	int32
	dev_major	int32
	dev_minor	int32
	__spare2	array[int64, 14]
}

define STAT64_SIZE	sizeof(struct stat64)

type stat64 array[int8, STAT64_SIZE]

pollfd {
	fd	fd
	events	flags[pollfd_events, int16]
	revents	const[0, int16]
}

sigset_t {
	mask	array[intptr, _NSIG_WORDS]
}

sigset_size {
	ss	ptr[inout, sigset_t]
	len	len[ss, intptr]
}

resource time_sec[intptr]
resource time_nsec[intptr]
resource time_usec[intptr]

# prog knowns about this struct type
timespec {
	sec	time_sec
	nsec	time_nsec
}

# prog knowns about this struct type
timeval {
	sec	time_sec
	usec	time_usec
}

statx_timestamp {
	sec		int64
	nsec		int32
	__reserved	int32
}

itimerspec {
	interv	timespec
	value	timespec
}

itimerval {
	interv	timeval
	value	timeval
}

utimbuf {
	actime	intptr
	modtime	intptr
}

sigevent {
	val	const[0, intptr]
	signo	signalno
	notify	flags[sigev_notify, int32]
	u	sigevent_u
} [size[SIGEVENT_SIZE]]

sigevent_u [
	tid	pid
	thr	sigevent_thread
]

define SIGEVENT_SIZE	sizeof(struct sigevent)

sigevent_thread {
# NEED: this is function pointer and pthread_attr_t (?)
	func	buffer[in]
	attr	buffer[in]
}

cap_header {
	var	flags[cap_version, int32]
	pid	pid
}

cap_data {
	eff0	int32
	perm0	int32
	inher0	int32
	eff1	int32
	perm1	int32
	inher1	int32
}

epoll_event {
	ev	flags[epoll_ev, int32]
	data	const[0, int64]
# TODO: this packed only on amd64
} [packed]

# TODO: fd_set needs to be a separate type
fd_set {
	mask0	int64
	mask1	int64
	mask2	int64
	mask3	int64
	mask4	int64
	mask5	int64
	mask6	int64
	mask7	int64
}

sock_fprog {
	len	len[filter, int16]
	filter	ptr[in, array[sock_filter]]
}

sock_filter {
	code	int16
	jt	int8
	jf	int8
	k	int32
}

file_handle [
	raw				file_handle_raw
	shmem				file_handle_t[1, fid_shmem]
	fuse				file_handle_t[0x81, fid_fuse]
	fuse_with_parent		file_handle_t[0x82, fid_fuse_with_parent]
	nfs				file_handle_t[36, fid_nfs]
	FILEID_INO32_GEN		file_handle_t[FILEID_INO32_GEN, fid_FILEID_INO32_GEN]
	FILEID_INO32_GEN_PARENT		file_handle_t[FILEID_INO32_GEN_PARENT, fid_FILEID_INO32_GEN_PARENT]
	FILEID_UDF_WITHOUT_PARENT	file_handle_t[FILEID_UDF_WITHOUT_PARENT, fid_FILEID_UDF_WITHOUT_PARENT]
	FILEID_UDF_WITH_PARENT		file_handle_t[FILEID_UDF_WITH_PARENT, fid_FILEID_UDF_WITH_PARENT]
	FILEID_BTRFS_WITH_PARENT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	FILEID_BTRFS_WITH_PARENT_ROOT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	FILEID_BTRFS_WITHOUT_PARENT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	ceph_nfs_snapfh			file_handle_t[FILEID_BTRFS_WITH_PARENT, ceph_nfs_snapfh]
	ceph_nfs_fh			file_handle_t[FILEID_INO32_GEN, ceph_nfs_fh]
	ceph_nfs_confh			file_handle_t[FILEID_INO32_GEN_PARENT, ceph_nfs_confh]
	GFS2_SMALL_FH_SIZE		file_handle_t[GFS2_SMALL_FH_SIZE, fid_GFS2_SMALL_FH_SIZE]
	GFS2_LARGE_FH_SIZE		file_handle_t[GFS2_LARGE_FH_SIZE, fid_GFS2_LARGE_FH_SIZE]
	OVL_FILEID_V0			file_handle_t[OVL_FILEID_V0, ovl_fb]
	OVL_FILEID_V1			file_handle_t[OVL_FILEID_V1, ovl_fh]
	FILEID_NILFS_WITHOUT_PARENT	file_handle_t[FILEID_NILFS_WITHOUT_PARENT, nilfs_fid]
	FILEID_NILFS_WITH_PARENT	file_handle_t[FILEID_NILFS_WITH_PARENT, nilfs_fid]
	reiserfs_2			file_handle_t[2, fid_reiserfs_2]
	reiserfs_3			file_handle_t[3, fid_reiserfs_3]
	reiserfs_4			file_handle_t[4, fid_reiserfs_4]
	reiserfs_5			file_handle_t[5, fid_reiserfs_5]
	reiserfs_6			file_handle_t[6, fid_reiserfs_6]
	xfs				file_handle_t[0x81, xfs_fid64]
	xfs_parent			file_handle_t[0x82, xfs_fid64]
	orangefs			file_handle_t[1, fid_orangefs]
	orangefs_parent			file_handle_t[2, fid_orangefs_parent]
	isofs				file_handle_t[1, isofs_fid]
	isofs_parent			file_handle_t[2, isofs_fid]
	ocfs2				file_handle_t[1, fid_ocfs2]
	ocfs2_parent			file_handle_t[2, fid_ocfs2_parent]
] [varlen]

file_handle_raw {
	handle_bytes	bytesize[f_handle, int32]
	handle_type	flags[fid_type, int32]
	f_handle	align32[array[int8]]
}

type file_handle_t[TYPE, FID] {
	handle_bytes	bytesize[f_handle, int32]
	handle_type	const[TYPE, int32]
	f_handle	FID
}

fid_shmem {
	gen	int32
	ino	int64
} [packed]

fid_fuse {
	nodeid_hi	int32
	nodeid_lo	int32
	generation	int32
}

fid_fuse_with_parent {
	base		fid_fuse
	parent_fid	fid_fuse
} [packed]

fid_FILEID_INO32_GEN {
	ino	int32
	gen	int32
}

fid_FILEID_INO32_GEN_PARENT {
	base		fid_FILEID_INO32_GEN
	parent_ino	int32
	parent_gen	int32
}

fid_FILEID_UDF_WITHOUT_PARENT {
	block		int32
	partref		int16
	parent_partref	int16
	generation	int32
}

fid_FILEID_UDF_WITH_PARENT {
	base			fid_FILEID_UDF_WITHOUT_PARENT
	parent_block		int32
	parent_generation	int32
}

btrfs_fid {
	objectid		int64
	root_objectid		int64
	gen			int32
	parent_objectid		int64
	parent_gen		int32
	parent_root_objectid	int64
} [packed]

ceph_nfs_snapfh {
	ino		int64
	snapid		int64
	parent_ino	int64
	hash		int32
} [packed]

ceph_nfs_fh {
	ino	int64
}

ceph_nfs_confh {
	ino		int64
	parent_ino	int64
}

fid_GFS2_SMALL_FH_SIZE {
	no_formal_ino_hi	int32be
	no_formal_ino_lo	int32be
	no_addr_hi		int32be
	no_addr_lo		int32be
}

fid_GFS2_LARGE_FH_SIZE {
	base		fid_GFS2_SMALL_FH_SIZE
	parent_fid	fid_GFS2_SMALL_FH_SIZE
}

define GFS2_SMALL_FH_SIZE	4
define GFS2_LARGE_FH_SIZE	8

fid_nfs {
	fileid_hi	int32
	fileid_lo	int32
	type		int32
# The total size is encoded in file_handle.handle_type, so we make this const size.
	size		const[NFS_MAXFHSIZE, int16]
	data		array[int8, NFS_MAXFHSIZE]
} [align[4]]

fid_reiserfs_2 {
	objectid	int32
	dir_id		int32
}

fid_reiserfs_3 {
	objectid	int32
	dir_id		int32
	generation	int32
}

fid_reiserfs_4 {
	objectid	int32
	dir_id		int32
	parent_objectid	int32
	parent_dir_id	int32
}

fid_reiserfs_5 {
	objectid	int32
	dir_id		int32
	generation	int32
	parent_objectid	int32
	parent_dir_id	int32
}

fid_reiserfs_6 {
	objectid		int32
	dir_id			int32
	generation		int32
	parent_objectid		int32
	parent_dir_id		int32
	parent_generation	int32
}

xfs_fid64 {
	ino		int64
	gen		int32
	parent_ino	int64
	parent_gen	int32
} [align[4]]

fid_orangefs {
	khandle	array[int8, 16]
	fs_id	int32
}

fid_orangefs_parent {
	base		fid_orangefs
	parent_fid	fid_orangefs
}

nilfs_fid {
	cno		int64
	ino		int64
	gen		int32
	parent_gen	int32
	parent_ino	int64
} [packed]

isofs_fid {
	block			int32
	offset			int16
	parent_offset		int16
	generation		int32
	parent_block		int32
	parent_generation	int32
}

fid_ocfs2 {
	blkno_hi	int32
	blkno_lo	int32
	generation	int32
}

fid_ocfs2_parent {
	base		fid_ocfs2
	parent_fid	fid_ocfs2
}

fid_type = FILEID_ROOT, FILEID_INO32_GEN, FILEID_INO32_GEN_PARENT, FILEID_BTRFS_WITHOUT_PARENT, FILEID_BTRFS_WITH_PARENT, FILEID_BTRFS_WITH_PARENT_ROOT, FILEID_UDF_WITHOUT_PARENT, FILEID_UDF_WITH_PARENT, FILEID_NILFS_WITHOUT_PARENT, FILEID_NILFS_WITH_PARENT, FILEID_FAT_WITHOUT_PARENT, FILEID_FAT_WITH_PARENT, FILEID_LUSTRE, FILEID_KERNFS

mq_attr {
	mq_flags	intptr
	mq_maxmsg	intptr
	mq_msgsize	intptr
	mq_curmsgs	intptr
	__reserved	array[const[0, intptr], 4]
}

kexec_segment {
	buf	buffer[in]
	sz	len[buf, intptr]
# TODO: this is address in kernel
	mem	intptr
	memsz	intptr
}

rusage {
	utime	timeval
	stime	timeval
	maxrss	intptr
	ixrss	intptr
	idrss	intptr
	isrss	intptr
	minflt	intptr
	majflt	intptr
	nswap	intptr
	inblock	intptr
	oublock	intptr
	msgsnd	intptr
	msgrcv	intptr
	signals	intptr
	nvcsw	intptr
	nivcsw	intptr
}

rlimit {
	soft	intptr
	hard	intptr
}

sigaction {
	sa_handler	ptr[in, text[target]]
	sa_flags	flags[sigaction_flags, intptr]
	sa_restorer	ptr[in, text[target]]
	sa_mask		sigset_t
}

sigaltstack {
	ss_sp		ptr[out, array[int8]]
	ss_flags	flags[sigaltstack_flags, int32]
	ss_size		bytesize[ss_sp, intptr]
}

sigaltstack_flags = SS_ONSTACK, SS_DISABLE, SS_AUTODISARM

tms {
	utime	intptr
	stime	intptr
	cutime	intptr
	cstime	intptr
}

siginfo {
	signo	signalno
	errno	int32
	code	int32
} [size[SIGINFO_SIZE]]

define SIGINFO_SIZE	sizeof(struct siginfo)

timex {
	stuff0	intptr
	stuff1	intptr
	stuff2	intptr
	stuff3	intptr
	stuff4	intptr
	stuff5	intptr
	stuff6	intptr
	stuff7	intptr
	stuff8	intptr
	stuff9	intptr
	stuff10	intptr
	stuff11	intptr
	stuff12	intptr
	stuff13	intptr
	stuff14	intptr
	stuff15	intptr
	stuff16	intptr
	stuff17	intptr
	stuff18	intptr
	stuff19	intptr
	stuff20	intptr
	stuff21	intptr
	stuff22	intptr
	stuff23	intptr
	stuff24	intptr
	stuff25	intptr
}

ustat {
	f_tfree		int32
	f_tinode	intptr
	f_fname		array[int8, 6]
	f_fpack		array[int8, 6]
}

user_desc {
	entry_number	int32
# Base should be vma and limit should be len[base]
# But these fields are int32, so we can't use vma.
	base_addr	flags[user_desc_bases, int32]
	limit		flags[user_desc_limits, int32]
	seg_32bit	int32:1
	contents	int32:2
	read_exec_only	int32:1
	limit_in_pages	int32:1
	seg_not_present	int32:1
	useable		int32:1
	lm		int32:1
}

user_desc_bases = 0, 4096, 1048576, 536870912, 536872960, 536875008, -1
user_desc_limits = 0, 1024, 4096, 8192, 16384, -1

sched_attr {
	size		bytesize[parent, int32]
	sched_policy	flags[sched_policy, int32]
	sched_flags	flags[sched_attr_flags, int64]
	sched_nice	int32
	sched_priority	int32
	sched_runtime	int64
	sched_deadline	int64
	sched_period	int64
	sched_util_min	int32
	sched_util_max	int32
}

sched_policy = SCHED_NORMAL, SCHED_FIFO, SCHED_RR, SCHED_BATCH, SCHED_IDLE, SCHED_DEADLINE
sched_attr_flags = SCHED_FLAG_RESET_ON_FORK, SCHED_FLAG_RECLAIM, SCHED_FLAG_DL_OVERRUN, SCHED_FLAG_KEEP_POLICY, SCHED_FLAG_KEEP_PARAMS, SCHED_FLAG_UTIL_CLAMP_MIN, SCHED_FLAG_UTIL_CLAMP_MAX, SCHED_FLAG_SUGOV

flock {
	type	flags[flock_type, int16]
	whence	flags[seek_whence, int16]
	start	intptr
	len	intptr
	pid	pid
}

f_owner_ex {
	type	flags[f_owner_type, int32]
	pid	pid
}

ucred {
	pid	pid
	uid	uid
	gid	gid
}

kcmp_epoll_slot {
	efd	fd_epoll
	tfd	fd
	toff	int32
}

open_how {
	flags	flags[open_flags, int64]
	mode	flags[open_mode, int64]
	resolve	flags[resolve_flags, int64]
}

# Not providing O_WRONLY means O_RDONLY.
open_flags = O_WRONLY, O_RDWR, O_APPEND, FASYNC, O_CLOEXEC, O_CREAT, O_DIRECT, O_DIRECTORY, O_EXCL, O_LARGEFILE, O_NOATIME, O_NOCTTY, O_NOFOLLOW, O_NONBLOCK, O_PATH, O_SYNC, O_TRUNC, __O_TMPFILE
open_mode = S_IRUSR, S_IWUSR, S_IXUSR, S_IRGRP, S_IWGRP, S_IXGRP, S_IROTH, S_IWOTH, S_IXOTH
resolve_flags = RESOLVE_CACHED, RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV
madvise_flags = MADV_NORMAL, MADV_RANDOM, MADV_SEQUENTIAL, MADV_WILLNEED, MADV_DONTNEED, MADV_REMOVE, MADV_DONTFORK, MADV_DOFORK, MADV_HWPOISON, MADV_SOFT_OFFLINE, MADV_MERGEABLE, MADV_UNMERGEABLE, MADV_HUGEPAGE, MADV_NOHUGEPAGE, MADV_DONTDUMP, MADV_DODUMP, MADV_WIPEONFORK, MADV_KEEPONFORK, MADV_COLD, MADV_PAGEOUT, MADV_POPULATE_READ, MADV_POPULATE_WRITE, MADV_COLLAPSE
fadvise_flags = POSIX_FADV_NORMAL, POSIX_FADV_SEQUENTIAL, POSIX_FADV_RANDOM, POSIX_FADV_NOREUSE, POSIX_FADV_WILLNEED, POSIX_FADV_DONTNEED
move_pages_flags = MPOL_MF_MOVE, MPOL_MF_MOVE_ALL
msync_flags = MS_ASYNC, MS_SYNC, MS_INVALIDATE
mmap_prot = PROT_EXEC, PROT_READ, PROT_WRITE, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP
mmap_flags = MAP_SHARED, MAP_PRIVATE, MAP_32BIT, MAP_ANONYMOUS, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_FILE, MAP_FIXED, MAP_GROWSDOWN, MAP_HUGETLB, MAP_LOCKED, MAP_NONBLOCK, MAP_NORESERVE, MAP_POPULATE, MAP_STACK, MAP_UNINITIALIZED, MAP_SHARED_VALIDATE, MAP_SYNC, MAP_FIXED_NOREPLACE
mremap_flags = MREMAP_MAYMOVE, MREMAP_FIXED, MREMAP_DONTUNMAP
mbind_mode = MPOL_DEFAULT, MPOL_BIND, MPOL_INTERLEAVE, MPOL_PREFERRED, MPOL_F_STATIC_NODES, MPOL_F_RELATIVE_NODES
mbind_flags = MPOL_MF_STRICT, MPOL_MF_MOVE, MPOL_MF_MOVE_ALL
pipe_flags = O_NONBLOCK, O_CLOEXEC, O_DIRECT, O_NOTIFICATION_PIPE
mlock_flags = MLOCK_ONFAULT
mlockall_flags = MCL_CURRENT, MCL_FUTURE, MCL_ONFAULT
dup_flags = O_CLOEXEC
splice_flags = SPLICE_F_MOVE, SPLICE_F_NONBLOCK, SPLICE_F_MORE, SPLICE_F_GIFT
seek_whence = SEEK_SET, SEEK_CUR, SEEK_END, SEEK_DATA, SEEK_HOLE
signalfd_flags = SFD_NONBLOCK, SFD_CLOEXEC
eventfd_flags = EFD_CLOEXEC, EFD_NONBLOCK, EFD_SEMAPHORE
timerfd_create_flags = TFD_NONBLOCK, TFD_CLOEXEC
timerfd_settime_flags = TFD_TIMER_ABSTIME, TFD_TIMER_CANCEL_ON_SET
clock_type = CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_MONOTONIC_RAW, CLOCK_BOOTTIME, CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID, CLOCK_REALTIME_ALARM, CLOCK_BOOTTIME_ALARM
sigev_notify = SIGEV_NONE, SIGEV_SIGNAL, SIGEV_THREAD, SIGEV_THREAD_ID
cap_version = _LINUX_CAPABILITY_VERSION_1, _LINUX_CAPABILITY_VERSION_2, _LINUX_CAPABILITY_VERSION_3
epoll_flags = EPOLL_CLOEXEC
epoll_ev = POLLIN, POLLOUT, POLLRDHUP, POLLPRI, POLLERR, POLLHUP, EPOLLET, EPOLLONESHOT, EPOLLEXCLUSIVE, EPOLLWAKEUP
pollfd_events = POLLIN, POLLPRI, POLLOUT, POLLERR, POLLHUP, POLLNVAL, POLLRDNORM, POLLRDBAND, POLLWRNORM, POLLWRBAND, POLLMSG, POLLREMOVE, POLLRDHUP, POLLFREE, POLL_BUSY_LOOP
mknod_mode = S_IFREG, S_IFCHR, S_IFBLK, S_IFIFO, S_IFSOCK, S_ISUID, S_ISGID, S_ISVTX, open_mode
at_flags = AT_EMPTY_PATH, AT_SYMLINK_NOFOLLOW, AT_SYMLINK_FOLLOW, AT_NO_AUTOMOUNT, AT_EMPTY_PATH
fallocate_mode = FALLOC_FL_KEEP_SIZE, FALLOC_FL_PUNCH_HOLE, FALLOC_FL_COLLAPSE_RANGE, FALLOC_FL_ZERO_RANGE, FALLOC_FL_INSERT_RANGE, FALLOC_FL_UNSHARE_RANGE, FALLOC_FL_NO_HIDE_STALE
linkat_flags = AT_EMPTY_PATH, AT_SYMLINK_FOLLOW
unlinkat_flags = AT_REMOVEDIR
renameat2_flags = RENAME_EXCHANGE, RENAME_NOREPLACE, RENAME_WHITEOUT
flock_op = LOCK_SH, LOCK_EX, LOCK_UN, LOCK_NB
statx_flags = AT_SYMLINK_NOFOLLOW, AT_SYMLINK_FOLLOW, AT_NO_AUTOMOUNT, AT_EMPTY_PATH, AT_STATX_SYNC_TYPE, AT_STATX_SYNC_AS_STAT, AT_STATX_FORCE_SYNC, AT_STATX_DONT_SYNC
statx_mask = STATX_TYPE, STATX_MODE, STATX_NLINK, STATX_UID, STATX_GID, STATX_ATIME, STATX_MTIME, STATX_CTIME, STATX_INO, STATX_SIZE, STATX_BLOCKS, STATX_BASIC_STATS, STATX_BTIME
name_to_handle_at_flags = AT_EMPTY_PATH, AT_SYMLINK_FOLLOW, AT_HANDLE_FID
mq_open_flags = O_WRONLY, O_RDWR, O_NONBLOCK, O_CREAT, O_EXCL, O_CREAT
finit_module_flags = MODULE_INIT_IGNORE_MODVERSIONS, MODULE_INIT_IGNORE_VERMAGIC
delete_module_flags = O_NONBLOCK, O_TRUNC
kexec_load_flags = KEXEC_ON_CRASH, KEXEC_PRESERVE_CONTEXT, KEXEC_ARCH_386, KEXEC_ARCH_X86_64, KEXEC_ARCH_PPC, KEXEC_ARCH_PPC64, KEXEC_ARCH_IA_64, KEXEC_ARCH_ARM, KEXEC_ARCH_S390, KEXEC_ARCH_SH, KEXEC_ARCH_MIPS, KEXEC_ARCH_MIPS_LE, KEXEC_ARCH_DEFAULT
faccessat_flags = AT_EACCESS, AT_SYMLINK_NOFOLLOW, AT_EMPTY_PATH
sync_file_flags = SYNC_FILE_RANGE_WAIT_BEFORE, SYNC_FILE_RANGE_WRITE, SYNC_FILE_RANGE_WAIT_AFTER
kcmp_flags = KCMP_FILE, KCMP_FILES, KCMP_FS, KCMP_IO, KCMP_SIGHAND, KCMP_SYSVSEM, KCMP_VM
rusage_who = RUSAGE_SELF, RUSAGE_CHILDREN, RUSAGE_THREAD
rlimit_type = RLIMIT_AS, RLIMIT_CORE, RLIMIT_CPU, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_LOCKS, RLIMIT_MEMLOCK, RLIMIT_MSGQUEUE, RLIMIT_NICE, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_RTPRIO, RLIMIT_RTTIME, RLIMIT_SIGPENDING, RLIMIT_STACK
# The ones that disable console output are intentionally omitted.
syslog_cmd = SYSLOG_ACTION_CLOSE, SYSLOG_ACTION_OPEN, SYSLOG_ACTION_READ, SYSLOG_ACTION_READ_ALL, SYSLOG_ACTION_READ_CLEAR, SYSLOG_ACTION_SIZE_UNREAD, SYSLOG_ACTION_SIZE_BUFFER
ioprio_which_pid = IOPRIO_WHO_PROCESS, IOPRIO_WHO_PGRP
ioprio_which_uid = IOPRIO_WHO_USER
personality_flags = PER_LINUX, PER_SVR4, PER_SVR3, PER_OSR5, PER_WYSEV386, PER_ISCR4, PER_BSD, PER_XENIX, PER_LINUX32, PER_IRIX32, PER_IRIXN32, PER_IRIX64, PER_RISCOS, PER_SOLARIS, PER_UW7, PER_OSF4, PER_HPUX, ADDR_NO_RANDOMIZE, MMAP_PAGE_ZERO, ADDR_COMPAT_LAYOUT, READ_IMPLIES_EXEC, ADDR_LIMIT_32BIT, SHORT_INODE, WHOLE_SECONDS, STICKY_TIMEOUTS, ADDR_LIMIT_3GB
clock_id = CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_MONOTONIC_RAW, CLOCK_BOOTTIME, CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID
sigprocmask_how = SIG_BLOCK, SIG_UNBLOCK, SIG_SETMASK
getitimer_which = ITIMER_REAL, ITIMER_VIRTUAL, ITIMER_PROF
wait_options = WNOHANG, WUNTRACED, WCONTINUED, WEXITED, WSTOPPED, WCONTINUED, WNOHANG, WNOWAIT, __WCLONE, __WALL, __WNOTHREAD
waitid_which = P_PID, P_PGID, P_ALL
sigaction_flags = SA_NOCLDSTOP, SA_NOCLDWAIT, SA_NODEFER, SA_ONSTACK, SA_RESETHAND, SA_RESTART, SA_SIGINFO
timer_flags = TIMER_ABSTIME
utimensat_flags = AT_SYMLINK_NOFOLLOW
priority_which = PRIO_PROCESS, PRIO_PGRP, PRIO_USER
mempolicy_flags = MPOL_F_MEMS_ALLOWED, MPOL_F_ADDR, MPOL_F_NODE
ptrace_req = PTRACE_LISTEN, PTRACE_KILL, PTRACE_INTERRUPT, PTRACE_ATTACH, PTRACE_DETACH
ptrace_req_peek = PTRACE_PEEKTEXT, PTRACE_PEEKDATA
ptrace_req_poke = PTRACE_POKETEXT, PTRACE_POKEDATA
ptrace_req_getregs = PTRACE_GETREGS, PTRACE_GETFPREGS
ptrace_req_setregs = PTRACE_SETREGS, PTRACE_SETFPREGS
ptrace_req_setopts = PTRACE_SETOPTIONS, PTRACE_SEIZE
ptrace_req_cont = PTRACE_CONT, PTRACE_SYSCALL, PTRACE_SINGLESTEP, PTRACE_SYSEMU, PTRACE_SYSEMU_SINGLESTEP
pthread_regset = NT_PRSTATUS, NT_PRFPREG, NT_PRPSINFO, NT_TASKSTRUCT, NT_AUXV, NT_386_TLS, NT_386_IOPERM, NT_X86_XSTATE
ptrace_options = PTRACE_O_EXITKILL, PTRACE_O_TRACECLONE, PTRACE_O_TRACEEXEC, PTRACE_O_TRACEEXIT, PTRACE_O_TRACEFORK, PTRACE_O_TRACESYSGOOD, PTRACE_O_TRACEVFORK, PTRACE_O_TRACEVFORKDONE
fcntl_dupfd = F_DUPFD, F_DUPFD_CLOEXEC
fcntl_getflags = F_GETFD, F_GETFL, F_GETSIG, F_GETLEASE, F_GETPIPE_SZ, F_GET_SEALS
fcntl_lock = F_SETLK, F_SETLKW, F_GETLK, F_OFD_GETLK, F_OFD_SETLK, F_OFD_SETLKW
fcntl_flags = FD_CLOEXEC
fcntl_status = O_APPEND, FASYNC, O_DIRECT, O_NOATIME, O_NONBLOCK
flock_type = F_RDLCK, F_WRLCK, F_UNLCK
f_owner_type = F_OWNER_TID, F_OWNER_PID, F_OWNER_PGRP
fcntl_notify = DN_MULTISHOT, DN_ACCESS, DN_MODIFY, DN_CREATE, DN_DELETE, DN_RENAME, DN_ATTRIB
seal_types = F_SEAL_SEAL, F_SEAL_SHRINK, F_SEAL_GROW, F_SEAL_WRITE
ioctl_int_in = FIONBIO, FIOASYNC
ioctl_int_out = FIOQSIZE, FIGETBSZ
fcntl_rw_hint = RWF_WRITE_LIFE_NOT_SET, RWH_WRITE_LIFE_NONE, RWH_WRITE_LIFE_SHORT, RWH_WRITE_LIFE_MEDIUM, RWH_WRITE_LIFE_LONG, RWH_WRITE_LIFE_EXTREME
fiemap_flags = FIEMAP_FLAG_SYNC, FIEMAP_FLAG_XATTR, FIEMAP_FLAG_CACHE
fiemap_extent_flags = FIEMAP_EXTENT_LAST, FIEMAP_EXTENT_UNKNOWN, FIEMAP_EXTENT_DELALLOC, FIEMAP_EXTENT_ENCODED, FIEMAP_EXTENT_DATA_ENCRYPTED, FIEMAP_EXTENT_NOT_ALIGNED, FIEMAP_EXTENT_DATA_INLINE, FIEMAP_EXTENT_DATA_TAIL, FIEMAP_EXTENT_UNWRITTEN, FIEMAP_EXTENT_MERGED, FIEMAP_EXTENT_SHARED
getrandom_flags = GRND_NONBLOCK, GRND_RANDOM
clone_flags = CLONE_VM, CLONE_FS, CLONE_FILES, CLONE_SIGHAND, CLONE_PTRACE, CLONE_VFORK, CLONE_PARENT, CLONE_THREAD, CLONE_NEWNS, CLONE_SYSVSEM, CLONE_SETTLS, CLONE_PARENT_SETTID, CLONE_CHILD_CLEARTID, CLONE_UNTRACED, CLONE_CHILD_SETTID, CLONE_NEWCGROUP, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET, CLONE_IO, CLONE_PIDFD, CLONE_NEWTIME
clone3_flags = CLONE_CLEAR_SIGHAND, CLONE_INTO_CGROUP, clone_flags
ptrace_peeksiginfo_flags = PTRACE_PEEKSIGINFO_SHARED
close_range_flags = CLOSE_RANGE_UNSHARE

# Consts for target.SpecialFileLenghts.
_ = SMB_PATH_MAX, XT_CGROUP_PATH_MAX, XENSTORE_REL_PATH_MAX

# misc
_ = KCOV_INIT_TRACE, KCOV_ENABLE, KCOV_DISABLE, KCOV_TRACE_PC, KCOV_TRACE_CMP, PTRACE_TRACEME, SYSLOG_ACTION_CONSOLE_ON, SYSLOG_ACTION_CONSOLE_OFF, SYSLOG_ACTION_CONSOLE_LEVEL, SYSLOG_ACTION_CLEAR, __NR_mmap2

# Hardcode KCOV_REMOTE_ENABLE value for amd64 until new kcov patches reach mainline.
define KCOV_REMOTE_ENABLE	1075340134

# Not yet implemented syscalls:
# umask
# vhangup
# _sysctl
# nfsservctl
# getcpu

# Probably no sense in calling these.
# Also affect system-wide state, so not reproducible anyway.
# sched_get_priority_max
# sched_get_priority_min
]

gemini-3-pro-preview

							input: 138668
							output: 18
							thoughts: 24
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Analyzing the `VT_RESIZE` Context**

Okay, so the prompt mentions `VT_RESIZE` and points me toward `vt.txt`. My first move is clear: I need to immediately examine `vt.txt`. This implies that `vt.txt` is likely a crucial source of information related to the `VT_RESIZE` event. I need to understand its structure, content, and relationship to the resizing behavior I'm investigating. I will be looking for definitions, documentation, code snippets, or anything that illuminates how `VT_RESIZE` is handled within that specific `vt` context. It's a fundamental step; I can't proceed intelligently without this initial data gathering from the designated source.

failed to read file "vt.txt": open linux/vt.txt: file does not exist

map[File:vt.txt]

map[Output:]

gemini-3-pro-preview

							input: 138913
							output: 18
							thoughts: 681
						

**Navigating the Virtual Terminal Landscape**

Okay, so `vt.txt` isn't where I expected it to be. Time to try the more generic `dev_vt.txt` or `dev_tty.txt` approach. Wait, let me just double-check the available files. Huh, looking at that list, I don't see anything obvious that fits the bill. Definitely no `dev_vt.txt` there.

Hmm, this reminds me of how `VT_RESIZE` is handled. Now, where did I see that? Was it in `fs_ioctl.txt` or perhaps `sys.txt`? I'm pretty sure it's in one of those, right? Best to just use `grep` and search for "VT_RESIZE" within the descriptions to quickly find where it resides. It's the most efficient way to pinpoint the relevant file.

map[Expression:VT_RESIZE]

map[Output:drivers/tty/vt/vt_ioctl.c=727=int vt_ioctl(struct tty_struct *tty,
--
drivers/tty/vt/vt_ioctl.c-892-
drivers/tty/vt/vt_ioctl.c:893:	case VT_RESIZE:
drivers/tty/vt/vt_ioctl.c-894-	{
--
drivers/tty/vt/vt_ioctl.c-918-
drivers/tty/vt/vt_ioctl.c:919:	case VT_RESIZEX:
drivers/tty/vt/vt_ioctl.c-920-		if (!perm)
--
include/uapi/linux/vt.h=48=struct vt_sizes {
--
include/uapi/linux/vt.h-52-};
include/uapi/linux/vt.h:53:#define VT_RESIZE	0x5609	/* set kernel's idea of screensize */
include/uapi/linux/vt.h-54-
include/uapi/linux/vt.h=55=struct vt_consize {
--
include/uapi/linux/vt.h-62-};
include/uapi/linux/vt.h:63:#define VT_RESIZEX      0x560A  /* set kernel's idea of screensize + more */
include/uapi/linux/vt.h-64-#define VT_LOCKSWITCH   0x560B  /* disallow vt switching */
]

gemini-3-pro-preview

							input: 140179
							output: 21
							thoughts: 246
						

**Debugging the Hung Task**

Okay, so I'm looking at this hung task, and the initial thought is that it's related to `VT_RESIZE`. But hold on, the syzkaller descriptions don't explicitly mention `VT_RESIZE`.  That's a problem! If syzkaller isn't aware of `VT_RESIZE`, it shouldn't be able to directly trigger it.  The only way, then, is through a random `ioctl` call with some arbitrary arguments, right?  Something like `ioctl(fd, 0x5609, arg)`, in hopes it lands on `VT_RESIZE`.

But that seems like a long shot. The chances of hitting the specific code path that leads to a hung task with a random `ioctl` are pretty slim, I'd expect.  Unless... wait, is `VT_RESIZE` even *the* problem?  Could the hung task be caused by something else entirely? We can't immediately make that assumption.

Maybe it's `TIOCLINUX`? That's `0x541C`. Does syzkaller even have a description for `ioctl$TIOCLINUX`? Nope. That's not the answer, either, then. Hmm, what about the `dev_ptmx.txt` file? Okay, let's look further in that direction. 

map[File:dev_ptmx.txt]

map[Output:# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <asm/ioctls.h>
include <uapi/linux/kd.h>
include <uapi/linux/vt.h>
include <uapi/linux/fcntl.h>
include <uapi/linux/tty.h>
include <uapi/linux/serial.h>
include <uapi/linux/termios.h>
include <uapi/linux/tiocl.h>

resource fd_tty[fd]

# UNIX 98 pseudoterminal pairs (see man pts and man pty):
openat$ptmx(fd const[AT_FDCWD], file ptr[in, string["/dev/ptmx"]], flags flags[open_flags], mode const[0]) fd_tty
syz_open_pts(fd fd_tty, flags flags[open_flags]) fd_tty

# BSD pseudoterminal pair (see man pty):
syz_open_dev$ttys(dev const[0xc], major const[2], minor proc[20, 2]) fd_tty
syz_open_dev$ptys(dev const[0xc], major const[3], minor proc[20, 2]) fd_tty

# Some special tty devices.
# Note /dev/{tty,tty1,tty2,tty7} seem to be of different types.
openat$tty(fd const[AT_FDCWD], file ptr[in, string["/dev/tty"]], flags flags[open_flags], mode const[0]) fd_tty
syz_open_dev$tty1(dev const[0xc], major const[4], minor intptr[1:4]) fd_tty
syz_open_dev$tty20(dev const[0xc], major const[4], minor proc[20, 2]) fd_tty
openat$ttyS3(fd const[AT_FDCWD], file ptr[in, string["/dev/ttyS3"]], flags flags[open_flags], mode const[0]) fd_tty
openat$ttynull(fd const[AT_FDCWD], file ptr[in, string["/dev/ttynull"]], flags flags[open_flags], mode const[0]) fd_tty
openat$ttyprintk(fd const[AT_FDCWD], file ptr[in, string["/dev/ttyprintk"]], flags flags[open_flags], mode const[0]) fd_tty

ioctl$TCGETS(fd fd_tty, cmd const[TCGETS], arg ptr[out, termios])
ioctl$TCSETS(fd fd_tty, cmd const[TCSETS], arg ptr[in, termios])
ioctl$TCSETSW(fd fd_tty, cmd const[TCSETSW], arg ptr[in, termios])
ioctl$TCSETSF(fd fd_tty, cmd const[TCSETSF], arg ptr[in, termios])
ioctl$TCGETA(fd fd_tty, cmd const[TCGETA], arg ptr[out, termio])
ioctl$TCSETA(fd fd_tty, cmd const[TCSETA], arg ptr[in, termio])
ioctl$TCSETAW(fd fd_tty, cmd const[TCSETAW], arg ptr[in, termio])
ioctl$TCSETAF(fd fd_tty, cmd const[TCSETAF], arg ptr[in, termio])
ioctl$TIOCGLCKTRMIOS(fd fd_tty, cmd const[TIOCGLCKTRMIOS], arg ptr[in, termios])
ioctl$TIOCSLCKTRMIOS(fd fd_tty, cmd const[TIOCSLCKTRMIOS], arg ptr[out, termios])
ioctl$TIOCGWINSZ(fd fd_tty, cmd const[TIOCGWINSZ], arg ptr[out, winsize])
ioctl$TIOCSWINSZ(fd fd_tty, cmd const[TIOCSWINSZ], arg ptr[in, winsize])
ioctl$TCSBRK(fd fd_tty, cmd const[TCSBRK], arg intptr)
ioctl$TCSBRKP(fd fd_tty, cmd const[TCSBRKP], arg intptr)
ioctl$TIOCSBRK(fd fd_tty, cmd const[TIOCSBRK])
ioctl$TIOCCBRK(fd fd_tty, cmd const[TIOCCBRK])
ioctl$TCXONC(fd fd_tty, cmd const[TCXONC], arg flags[tcxonc_arg])
ioctl$FIONREAD(fd fd_tty, cmd const[FIONREAD], arg ptr[out, int32])
ioctl$TIOCOUTQ(fd fd_tty, cmd const[TIOCOUTQ], arg ptr[out, int32])
ioctl$TCFLSH(fd fd_tty, cmd const[TCFLSH], arg intptr[TCIFLUSH:TCIOFLUSH])
ioctl$TIOCGPTPEER(fd fd_tty, cmd const[TIOCGPTPEER], arg intptr) fd_tty
ioctl$TIOCSTI(fd fd_tty, cmd const[TIOCSTI], arg ptr[in, int8])
ioctl$TIOCCONS(fd fd_tty, cmd const[TIOCCONS])
ioctl$TIOCSCTTY(fd fd_tty, cmd const[TIOCSCTTY], arg intptr)
ioctl$TIOCNOTTY(fd fd_tty, cmd const[TIOCNOTTY])
ioctl$TIOCGPGRP(fd fd_tty, cmd const[TIOCGPGRP], arg ptr[out, pid])
ioctl$TIOCSPGRP(fd fd_tty, cmd const[TIOCSPGRP], arg ptr[in, pid])
ioctl$TIOCGSID(fd fd_tty, cmd const[TIOCGSID], arg ptr[out, pid])
ioctl$TIOCEXCL(fd fd_tty, cmd const[TIOCEXCL])
ioctl$TIOCNXCL(fd fd_tty, cmd const[TIOCNXCL])
ioctl$TIOCGETD(fd fd_tty, cmd const[TIOCGETD], arg ptr[out, int32])
ioctl$TIOCSETD(fd fd_tty, cmd const[TIOCSETD], arg ptr[in, int32[N_TTY:N_NULL]])
ioctl$TIOCPKT(fd fd_tty, cmd const[TIOCPKT], arg ptr[in, int32])
ioctl$TIOCMGET(fd fd_tty, cmd const[TIOCMGET], arg ptr[out, int32])
ioctl$TIOCMSET(fd fd_tty, cmd const[TIOCMSET], arg ptr[in, int32])
ioctl$TIOCMBIC(fd fd_tty, cmd const[TIOCMBIC], arg ptr[in, int32])
ioctl$TIOCMBIS(fd fd_tty, cmd const[TIOCMBIS], arg ptr[in, int32])
ioctl$TIOCGSOFTCAR(fd fd_tty, cmd const[TIOCGSOFTCAR], arg ptr[out, int32])
ioctl$TIOCSSOFTCAR(fd fd_tty, cmd const[TIOCSSOFTCAR], arg ptr[in, int32])

ioctl$KDGETLED(fd fd_tty, cmd const[KDGETLED], arg ptr[out, int8])
ioctl$KDSETLED(fd fd_tty, cmd const[KDSETLED], arg intptr)
ioctl$KDGKBLED(fd fd_tty, cmd const[KDGKBLED], arg ptr[out, int8])
ioctl$KDSKBLED(fd fd_tty, cmd const[KDSKBLED], arg intptr)
ioctl$KDGKBTYPE(fd fd_tty, cmd const[KDGKBTYPE], arg ptr[out, int8])
ioctl$KDADDIO(fd fd_tty, cmd const[KDADDIO], arg intptr)
ioctl$KDDELIO(fd fd_tty, cmd const[KDDELIO], arg intptr)
ioctl$KDENABIO(fd fd_tty, cmd const[KDENABIO])
ioctl$KDDISABIO(fd fd_tty, cmd const[KDDISABIO])
ioctl$KDSETMODE(fd fd_tty, cmd const[KDSETMODE], arg intptr[KD_TEXT:KD_GRAPHICS])
ioctl$KDGETMODE(fd fd_tty, cmd const[KDGETMODE], arg ptr[out, intptr])
ioctl$KDMKTONE(fd fd_tty, cmd const[KDMKTONE], arg intptr)
ioctl$KIOCSOUND(fd fd_tty, cmd const[KIOCSOUND], arg intptr)
ioctl$GIO_CMAP(fd fd_tty, cmd const[GIO_CMAP], arg ptr[out, io_cmap])
ioctl$PIO_CMAP(fd fd_tty, cmd const[PIO_CMAP], arg ptr[in, io_cmap])
ioctl$GIO_FONT(fd fd_tty, cmd const[GIO_FONT], arg buffer[out])
ioctl$GIO_FONTX(fd fd_tty, cmd const[GIO_FONTX], arg ptr[in, consolefontdesc[out]])
ioctl$PIO_FONT(fd fd_tty, cmd const[PIO_FONT], arg buffer[in])
ioctl$PIO_FONTX(fd fd_tty, cmd const[PIO_FONTX], arg ptr[in, consolefontdesc[in]])
ioctl$PIO_FONTRESET(fd fd_tty, cmd const[PIO_FONTRESET], arg const[0])
ioctl$KDFONTOP_SET(fd fd_tty, cmd const[KDFONTOP], arg ptr[in, console_font_op[KD_FONT_OP_SET, in]])
ioctl$KDFONTOP_GET(fd fd_tty, cmd const[KDFONTOP], arg ptr[in, console_font_op[KD_FONT_OP_GET, out]])
ioctl$KDFONTOP_SET_DEF(fd fd_tty, cmd const[KDFONTOP], arg ptr[in, console_font_op[KD_FONT_OP_SET_DEFAULT, in]])
ioctl$KDFONTOP_COPY(fd fd_tty, cmd const[KDFONTOP], arg ptr[in, console_font_op[KD_FONT_OP_COPY, out]])
ioctl$GIO_SCRNMAP(fd fd_tty, cmd const[GIO_SCRNMAP], arg buffer[out])
ioctl$GIO_UNISCRNMAP(fd fd_tty, cmd const[GIO_UNISCRNMAP], arg buffer[out])
ioctl$PIO_SCRNMAP(fd fd_tty, cmd const[PIO_SCRNMAP], arg buffer[in])
ioctl$PIO_UNISCRNMAP(fd fd_tty, cmd const[PIO_UNISCRNMAP], arg buffer[in])
ioctl$GIO_UNIMAP(fd fd_tty, cmd const[GIO_UNIMAP], arg ptr[in, unimapdesc_out])
ioctl$PIO_UNIMAP(fd fd_tty, cmd const[PIO_UNIMAP], arg ptr[in, unimapdesc_in])
ioctl$PIO_UNIMAPCLR(fd fd_tty, cmd const[PIO_UNIMAPCLR], arg ptr[in, unimapinit])
ioctl$KDGKBMODE(fd fd_tty, cmd const[KDGKBMODE], arg ptr[out, intptr])
ioctl$KDSKBMODE(fd fd_tty, cmd const[KDSKBMODE], arg ptr[in, intptr[K_RAW:K_OFF]])
ioctl$KDGKBMETA(fd fd_tty, cmd const[KDGKBMETA], arg ptr[out, intptr])
ioctl$KDSKBMETA(fd fd_tty, cmd const[KDSKBMETA], arg ptr[in, intptr[K_METABIT:K_ESCPREFIX]])
ioctl$KDGKBENT(fd fd_tty, cmd const[KDGKBENT], arg ptr[in, kbentry])
ioctl$KDSKBENT(fd fd_tty, cmd const[KDSKBENT], arg ptr[in, kbentry])
ioctl$KDGKBSENT(fd fd_tty, cmd const[KDGKBSENT], arg ptr[in, kbsentry])
ioctl$KDSKBSENT(fd fd_tty, cmd const[KDSKBSENT], arg ptr[in, kbsentry])
ioctl$KDGKBDIACR(fd fd_tty, cmd const[KDGKBDIACR], arg buffer[out])
ioctl$KDGETKEYCODE(fd fd_tty, cmd const[KDGETKEYCODE], arg ptr[in, kbkeycode])
ioctl$KDSETKEYCODE(fd fd_tty, cmd const[KDSETKEYCODE], arg ptr[in, kbkeycode])
ioctl$KDSIGACCEPT(fd fd_tty, cmd const[KDSIGACCEPT], arg signalnoptr)
ioctl$VT_OPENQRY(fd fd_tty, cmd const[VT_OPENQRY], arg ptr[out, int32])
ioctl$VT_GETMODE(fd fd_tty, cmd const[VT_GETMODE], arg ptr[out, vt_mode])
ioctl$VT_SETMODE(fd fd_tty, cmd const[VT_SETMODE], arg ptr[in, vt_mode])
ioctl$VT_GETSTATE(fd fd_tty, cmd const[VT_GETSTATE], arg ptr[in, vt_stat])
ioctl$VT_RELDISP(fd fd_tty, cmd const[VT_RELDISP])
ioctl$VT_ACTIVATE(fd fd_tty, cmd const[VT_ACTIVATE], arg intptr)
ioctl$VT_WAITACTIVE(fd fd_tty, cmd const[VT_WAITACTIVE])
ioctl$VT_DISALLOCATE(fd fd_tty, cmd const[VT_DISALLOCATE])
ioctl$VT_RESIZE(fd fd_tty, cmd const[VT_RESIZE], arg ptr[in, vt_sizes])
ioctl$VT_RESIZEX(fd fd_tty, cmd const[VT_RESIZEX], arg ptr[in, vt_consize])

# For the TIOCLINUX ioctl, see console_ioctl(4).
ioctl$TIOCL_SETSEL(fd fd_tty, cmd const[TIOCLINUX], arg ptr[in, tiocl_selection_arg])
ioctl$TIOCL_PASTESEL(fd fd_tty, cmd const[TIOCLINUX], arg ptr[in, const[TIOCL_PASTESEL, int8]])
ioctl$TIOCL_UNBLANKSCREEN(fd fd_tty, cmd const[TIOCLINUX], arg ptr[in, const[TIOCL_UNBLANKSCREEN, int8]])
ioctl$TIOCL_SELLOADLUT(fd fd_tty, cmd const[TIOCLINUX], arg ptr[in, loadlut])
ioctl$TIOCL_GETSHIFTSTATE(fd fd_tty, cmd const[TIOCLINUX], arg ptr[in, tiocl_shift_state])
ioctl$TIOCL_GETMOUSEREPORTING(fd fd_tty, cmd const[TIOCLINUX], arg ptr[in, const[TIOCL_GETMOUSEREPORTING, int8]])
ioctl$TIOCL_SETVESABLANK(fd fd_tty, cmd const[TIOCLINUX], arg ptr[in, const[TIOCL_SETVESABLANK, int8]])

ioctl$TIOCL_GETKMSGREDIRECT(fd fd_tty, cmd const[TIOCLINUX], arg ptr[in, const[TIOCL_GETKMSGREDIRECT, int8]])
ioctl$TIOCL_SCROLLCONSOLE(fd fd_tty, cmd const[TIOCLINUX], arg ptr[in, tioctl_scroll_console])
ioctl$TIOCL_BLANKSCREEN(fd fd_tty, cmd const[TIOCLINUX], arg ptr[in, const[TIOCL_BLANKSCREEN, int8]])

# TIOCSSERIAL can do nasty things under root, like causing writes to random memory
# pretty much like /dev/mem, but this is also working as intended.
# For details see:
# https://groups.google.com/g/syzkaller-bugs/c/1rVENJf9P4U/m/QtGpapRxAgAJ
# https://syzkaller.appspot.com/bug?extid=f4f1e871965064ae689e
# TODO: TIOCSSERIAL does some other things that are not dangerous
# and would be nice to test, if/when we can neutralize based on sandbox value
# we could prohibit it only under sandbox=none.
ioctl$TIOCSSERIAL(fd fd, cmd const[TIOCSSERIAL], arg ptr[in, serial_struct]) (disabled)

ioctl$TIOCGSERIAL(fd fd_tty, cmd const[TIOCGSERIAL], arg ptr[out, serial_struct])
ioctl$TCGETS2(fd fd_tty, cmd const[TCGETS2], arg ptr[out, termios2])
ioctl$TCSETS2(fd fd_tty, cmd const[TCSETS2], arg ptr[in, termios2])
ioctl$TCSETSF2(fd fd_tty, cmd const[TCSETSF2], arg ptr[in, termios2])
ioctl$TCSETSW2(fd fd_tty, cmd const[TCSETSW2], arg ptr[in, termios2])
ioctl$TIOCSERGETLSR(fd fd_tty, cmd const[TIOCSERGETLSR], arg ptr[out, int32])
ioctl$TIOCGRS485(fd fd_tty, cmd const[TIOCGRS485], arg ptr[out, serial_rs485])
ioctl$TIOCSRS485(fd fd_tty, cmd const[TIOCSRS485], arg ptr[in, serial_rs485])
ioctl$TIOCGISO7816(fd fd_tty, cmd const[TIOCGISO7816], arg ptr[out, serial_iso7816])
ioctl$TIOCSISO7816(fd fd_tty, cmd const[TIOCSISO7816], arg ptr[in, serial_iso7816])
ioctl$TIOCSPTLCK(fd fd_tty, cmd const[TIOCSPTLCK], arg ptr[in, bool32])
ioctl$TIOCGPTLCK(fd fd_tty, cmd const[TIOCGPTLCK], arg ptr[out, int32])
ioctl$TIOCGPKT(fd fd_tty, cmd const[TIOCGPKT], arg ptr[out, int32])
ioctl$TIOCSIG(fd fd_tty, cmd const[TIOCSIG], arg signalnoptr)
ioctl$TIOCVHANGUP(fd fd_tty, cmd const[TIOCVHANGUP], arg const[0])
ioctl$TIOCGDEV(fd fd_tty, cmd const[TIOCGDEV], arg ptr[out, int32])
ioctl$TIOCMIWAIT(fd fd_tty, cmd const[TIOCMIWAIT], arg const[0])
ioctl$TIOCGICOUNT(fd fd_tty, cmd const[TIOCGICOUNT], arg const[0])

# See tty_mode_ioctl.
ioctl$TIOCGETP(fd fd_tty, cmd const[TIOCGETP], arg ptr[out, sgttyb])
ioctl$TIOCSETP(fd fd_tty, cmd const[TIOCSETP], arg ptr[in, sgttyb])
ioctl$TIOCGETC(fd fd_tty, cmd const[TIOCGETC], arg ptr[out, array[int8]])
ioctl$TIOCSETC(fd fd_tty, cmd const[TIOCSETC], arg ptr[in, array[int8]])
ioctl$TIOCGLTC(fd fd_tty, cmd const[TIOCGLTC], arg ptr[out, array[int8]])
ioctl$TIOCSLTC(fd fd_tty, cmd const[TIOCSLTC], arg ptr[in, array[int8]])

sgttyb {
	sg_ispeed	int8
	sg_ospeed	int8
	sg_erase	int8
	sg_kill		int8
	sg_flags	int16
}

tcxonc_arg = TCOOFF, TCOON, TCIOFF, TCION

termios {
	c_iflag	int32
	c_oflag	int32
	c_cflag	int32
	c_lflag	int32
	c_line	int8[N_TTY:N_NULL]
	c_cc	array[int8, NCCS]
}

termios2 {
	c_iflag		int32
	c_oflag		int32
	c_cflag		int32
	c_lflag		int32
	c_line		int8
	c_cc		array[int8, NCCS]
	c_ispeed	int32
	c_ospeed	int32
}

termio {
	c_iflag	int16
	c_oflag	int16
	c_cflag	int16
	c_lflag	int16
	c_line	int8[N_TTY:N_NULL]
	c_cc	array[int8, NCC]
}

winsize {
	row	int16
	col	int16
	xpix	int16
	upix	int16
}

io_cmap {
	map0	int64
	map1	int64
	map2	int64
	map3	int64
	map4	int64
	map5	int64
}

unimapdesc_in {
	cnt	len[entries, int16]
	entries	ptr[in, array[unipair]]
}

unimapdesc_out {
	cnt	len[entries, int16]
	entries	ptr[out, array[unipair]]
}

unipair {
	unicode	int16
	fontpos	int16
}

unimapinit {
	size	int16
	step	int16
	level	int16
}

kbentry {
	table	int8
	index	int8
	value	int16
}

kbsentry {
	kb_func		int8
	kb_string	array[int8, 512]
}

kbkeycode {
	scan	int32
	key	int32
}

vt_mode {
	mode	int8
	waitv	int8
	relsig	int16
	acqsig	int16
	frsig	int16
}

vt_stat {
	active	int16
	signal	int16
	state	int16
}

vt_sizes {
	rows	int16
	cols	int16
	scroll	int16
}

vt_consize {
	rows	int16
	cols	int16
	vlin	int16
	clin	int16
	vcol	int16
	ccol	int16
}

tiocl_selection_arg {
	subcode	const[TIOCL_SETSEL, int8]
	data	tiocl_selection
} [packed]

tiocl_selection {
	subcode	const[TIOCL_SETSEL, int8]
	xs	int16
	ys	int16
	xe	int16
	ye	int16
	mode	flags[tiocl_selection_mode, int16]
} [packed]

tiocl_selection_mode = TIOCL_SELCHAR, TIOCL_SELWORD, TIOCL_SELLINE, TIOCL_SELPOINTER, TIOCL_SELCLEAR, TIOCL_SELMOUSEREPORT, TIOCL_SELBUTTONMASK

loadlut {
	submode	const[TIOCL_SELLOADLUT, int8]
	tab0	int64
	tab1	int64
	tab2	int64
	tab3	int64
} [packed]

tiocl_shift_state {
	subcode	const[TIOCL_GETSHIFTSTATE, int8]
	shift	int8
} [packed]

tioctl_scroll_console {
	subcode	const[TIOCL_SCROLLCONSOLE, int8]
	lines	int32
}

serial_struct {
	type		int32
	line		int32
	port		int32
	irq		int32
	flags		int32
	xmit_fifo_size	int32
	custom_divisor	int32
	baud_base	int32
	close_delay	int16
	io_type		int8
	reserved_char	int8
	hub6		int32
	closing_wait	int16
	closing_wait2	int16
	iomem_base	ptr[out, array[int8]]
	iomem_reg_shift	int16
	port_high	int32
	iomap_base	intptr
}

serial_rs485 {
	flags			int32
	delay_rts_before_send	int32
	delay_rts_after_send	int32
	padding			array[const[0, int32], 5]
}

serial_iso7816 {
	flags		int32
	tg		int32
	sc_fi		int32
	sc_di		int32
	clk		int32
	reserved	array[const[0, int32], 5]
}

type consolefontdesc[DIR] {
	charcount	int16[0:512]
	charheight	int16[0:32]
	chardata	ptr[DIR, array[int8, 1024]]
}

type console_font_op[OP, DIR] {
	op		const[OP, int32]
	flags		bool32
	width		int32[0:32]
	height		int32[0:32]
	charcount	int32[0:512]
	data		ptr[DIR, array[int8, 1024]]
}
]

gemini-3-pro-preview

							input: 146950
							output: 96
							thoughts: 252
						

**Reproducing the `VT_RESIZE` Bug**

Okay, so I've found `VT_RESIZE` documented in `dev_ptmx.txt`. Excellent! Let's see... the `ioctl` is defined as `ioctl$VT_RESIZE(fd fd_tty, cmd const[VT_RESIZE], arg ptr[in, vt_sizes])` and `vt_sizes` itself is a simple struct with `rows`, `cols`, and `scroll` members, all `int16`. So, yeah, `VT_RESIZE` is definitely supported.

Now, let's get to the fun part: Reproducing that bug. I know that if I send a ridiculously large size, like `32767` for both `rows` and `cols`, I'll get an `-EINVAL` error. But that's not the interesting part. What about more reasonable, but still large values, like `1000x1000`? I need to test those.

Hang on... I've got a hunch. If I'm calling `VT_RESIZE` repeatedly in a loop, it might be holding the `console_lock` for a significant amount of time. That could be the key!

So, the plan: I need to write a reproducer. It'll have one thread calling `VT_RESIZE` in a tight loop with those potentially troublesome dimensions. And then, another thread will try to `open("/dev/tty1")`. This should give me a good shot at exposing any locking issues. Let's see if this pans out...

call #0 openat: escaping filename "/dev/tty1\x00"

map[ReproSyz:r0 = openat(0xffffffffffffff9c, &AUTO='/dev/tty1\x00', 0x2, 0x0)
ioctl$VT_RESIZE(r0, 0x5609, &AUTO={0x3e8, 0x3e8, 0x0})
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 147676
							output: 86
							thoughts: 86
						

Okay, let me think this through.

**Analyzing the TTY Device Access**

Hmm, hold on. Accessing `/dev/tty1` directly via `openat` isn't permitted in this context. That's a key restriction. However, I see something interesting here: `syz_open_dev$tty1` is *allowed*. That's the loophole! This system call is specifically designed for tty1, so it seems like this is the correct path. It looks like the system call definition is:

```
syz_open_dev$tty1(dev const[0xc], major const[4], minor intptr[1:4]) fd_tty
```

Right, let's use `syz_open_dev$tty1` then. That's the way to go.

map[ReproSyz:r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$VT_RESIZE(r0, 0x5609, &AUTO={0x3e8, 0x3e8, 0x0})
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 148050
							output: 102
							thoughts: 88
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**A Quick Win & Some Exploration**

Whew, that's a relief, it didn't crash! That's always the first hurdle when playing with terminal resizing, especially with low-level stuff. Now, I'm thinking, since that initial attempt didn't blow up in our faces, maybe it's time to dig into a more sophisticated approach. Given the context, my mind immediately jumps to `VT_RESIZEX`. I'm going to pull up the struct definition to jog my memory:

```c
vt_consize {
	rows	int16
	cols	int16
	vlin	int16
	clin	int16
	vcol	int16
	ccol	int16
}
```

Okay, right, that looks familiar. This is the structure that defines the console size and cursor positions, or at least the sizes being communicated. Let's try leveraging `VT_RESIZEX`. This is a better place to get the terminal's reported size. I am hoping this method will offer a more robust or feature-rich approach. I am not seeing other options so I will try `VT_RESIZEX`.

map[ReproSyz:r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$VT_RESIZEX(r0, 0x560a, &AUTO={0x3e8, 0x3e8, 0x0, 0x0, 0x0, 0x0})
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 148542
							output: 41
							thoughts: 225
						

**My Line of Reasoning**

Okay, so it didn't crash – that's a good start. My mind immediately jumps to exploitation possibilities. I wonder... could I use `TIOCLINUX` to somehow flood the console? I recall the `ioctl` call:

```
ioctl$TIOCL_PASTESEL(fd fd_tty, cmd const[TIOCLINUX], arg ptr[in, const[TIOCL_PASTESEL, int8]])
```

Ah, right, `TIOCL_PASTESEL` is for pasting the selection. Clever. If I craft an enormous selection and then *paste* it, that should generate a significant amount of input.

But, hang on... I'm thinking about input, and my objective is to generate *output* via `printk`. Hmm. How can I get `printk` to fire? The answer comes to me... what about using `syz_open_dev$ttyprintk`?

```
openat$ttyprintk(fd const[AT_FDCWD], file ptr[in, string["/dev/ttyprintk"]], flags flags[open_flags], mode const[0]) fd_tty
```

Bingo! If I can open `/dev/ttyprintk` and then *write* to it, that directly calls `printk`. I should probably double-check that this is accurate and to be sure it is safe to proceed. I will cross reference this in `drivers/char/ttyprintk.c`. Now the real fun begins!

map[ContextFile:drivers/char/ttyprintk.c IncludeLines:true Name:tpk_write]

map[SourceCode: 103:	/*
 104:	 * TTY operations write function.
 105:	 */
 106:	static ssize_t tpk_write(struct tty_struct *tty, const u8 *buf, size_t count)
 107:	{
 108:		struct ttyprintk_port *tpkp = tty->driver_data;
 109:		unsigned long flags;
 110:		int ret;
 111:	
 112:		/* exclusive use of tpk_printk within this tty */
 113:		spin_lock_irqsave(&tpkp->spinlock, flags);
 114:		ret = tpk_printk(buf, count);
 115:		spin_unlock_irqrestore(&tpkp->spinlock, flags);
 116:	
 117:		return ret;
 118:	}
 SourceFile:drivers/char/ttyprintk.c]

gemini-3-pro-preview

							input: 149399
							output: 75
							thoughts: 41
						

Okay, here's my interpretation of that thought process, from an expert's perspective:

**Testing the Limits of `printk` Redirection**

Right, so `tpk_printk` is just a wrapper around `printk`. That much is clear. My immediate thought is, if I can trigger a flood of these `printk` calls, especially if directed to a specific device like `/dev/ttyprintk`, I should be able to induce a significant load. This opens up some interesting possibilities. I'm thinking about resource contention, potential for DoS scenarios (even if a localized one), and how the kernel handles this type of high-volume output. It'll be a good way to see how the printk buffering and logging mechanisms hold up under pressure. Essentially, I'm aiming for a controlled test to expose any potential bottlenecks or inefficiencies related to the printk subsystem. Let's see what happens if I hammer `/dev/ttyprintk` with a loop of `printk` calls. I can anticipate some interesting kernel behavior from this.

map[ReproSyz:r0 = openat$ttyprintk(0xffffffffffffff9c, &AUTO='/dev/ttyprintk\x00', 0x2, 0x0)
write(r0, &AUTO='A', 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 149757
							output: 346
							thoughts: 70
						

**Concurrently Writing to TTY Devices**

Okay, so I'm thinking, writing just a single byte isn't going to cut it. We need a more substantial test case, something that's going to exercise the system thoroughly. We're interested in concurrency here, so we need to see what happens when we're writing a considerable amount of data. And, importantly, we're doing this while also interacting with another TTY device, in this case `/dev/tty1`.

My approach is to create a reliable reproducer. The plan is this: I'll spin up one thread, and it will be dedicated to opening `/dev/ttyprintk` and then hammering it with writes, running in a loop to produce a reliable high rate of transactions. Concurrently, I will have another thread to open `/dev/tty1`. This setup should expose any potential issues arising from concurrent access and contention on TTY resources. This should give me a solid base to reproduce and analyze the underlying behaviour.

map[ReproSyz:r0 = openat$ttyprintk(0xffffffffffffff9c, &AUTO='/dev/ttyprintk\x00', 0x2, 0x0)
write(r0, &AUTO=""/4096, 0x1000) (async)
write(r0, &AUTO=""/4096, 0x1000) (async)
write(r0, &AUTO=""/4096, 0x1000) (async)
write(r0, &AUTO=""/4096, 0x1000) (async)
write(r0, &AUTO=""/4096, 0x1000) (async)
write(r0, &AUTO=""/4096, 0x1000) (async)
write(r0, &AUTO=""/4096, 0x1000) (async)
write(r0, &AUTO=""/4096, 0x1000) (async)
write(r0, &AUTO=""/4096, 0x1000) (async)
write(r0, &AUTO=""/4096, 0x1000) (async)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 150408
							output: 46
							thoughts: 3807
						

**Analyzing a Console Lockup**

Okay, so the system didn't crash, but something's definitely hung. My initial thought was printk flooding and `ttyprintk`, but the bug report doesn't seem to indicate that's the problem. Let's dig deeper. The `VT_RESIZE` ioctl looks interesting, especially the loop over consoles. My mind raced through the code, I realized that if `__vc_resize` returned an error within that loop, the whole thing would bail out immediately. If not, if the size parameters are too large, `KMALLOC_MAX_SIZE` limits the allocated size, but still if the size is `KMALLOC_MAX_SIZE`, which is 4MB, `kzalloc` is called with `GFP_USER`, and that can trigger memory reclaim. Is that what's causing the delay? But the task isn't blocked on `kzalloc`. Then I came to the conclusion, I need to check the bug report more carefully.

Aha! `syz.5.2008` is holding locks, but the information about which locks is unfortunately missing. Still, if it were blocked in `tty_open`, that would show up. Then I went to the NMI backtrace, it only contains `khungtaskd`, not the process holding the lock. The process must be spinning or running. If it's repeatedly doing `VT_RESIZE`, it's taking and releasing the `console_lock`, so that's not it. It has to be a single call holding `console_lock` for a very long time, 143 seconds in fact. So what can block for that long? `VT_RESIZEX` also calls `__vc_resize`, and it allows setting font sizes, which could trigger a long operation. But it still calls `__vc_resize` for each console. Could the combination of the two somehow be causing the problem? What if the `ioctl` is looping 63 times, which in turn calls `fbcon_resize`, which calls `fb_set_var`, but that's only called if the console is visible. What is `fb_set_var` itself is the cause? But it should be in `fb_set_var` if that's the problem.

The bug title is `INFO: task hung in con_install`, and `syz.8.2015` is the hung task! So if the task is holding the lock, and not in the blocked tasks list, it *must* be running. It has to be spinning somewhere in the kernel, and the most likely place is `console_unlock`!

Why `console_unlock`? Well, the problem could be some kind of printk flooding, but that wouldn't hold the lock for 143 seconds. Perhaps an interrupt handler is flooding `printk`? But that's not what the title says, it's not a warning message. That is unless the printk messages are not printed to the console due to `console_unlock` getting "stuck", so to speak. If this is the case, syzkaller wouldn't see any warnings, because the console is blocked, and there would be no output. Now let's try to find an alternative.

Going back to `VT_RESIZE`, let's check `__vc_resize`. There's a `while` loop that copies the screen contents. Corrupted values for `old_origin` and `end` could cause it to run forever, so let's check for those potential values. Overflow of `end` looks possible, if `old_row_size` is too large. However, I didn't see an overflow in the calculations. Now what if `old_row_size` is zero? Then the loop won't run. `new_row_size` is the new value, so the loop should terminate.
If not, then it must be some other loop. There is a loop in `vc_do_resize`, but I don't see anything suspicious there.
I would have to go deeper, let's look at `vc_uniscr_copy_area`.

map[ContextFile:drivers/tty/vt/vt.c IncludeLines:true Name:vc_uniscr_copy_area]

map[SourceCode: 450:	static void vc_uniscr_copy_area(u32 **dst_lines,
 451:					unsigned int dst_cols,
 452:					unsigned int dst_rows,
 453:					u32 **src_lines,
 454:					unsigned int src_cols,
 455:					unsigned int src_top_row,
 456:					unsigned int src_bot_row)
 457:	{
 458:		unsigned int dst_row = 0;
 459:	
 460:		if (!dst_lines)
 461:			return;
 462:	
 463:		while (src_top_row < src_bot_row) {
 464:			u32 *src_line = src_lines[src_top_row];
 465:			u32 *dst_line = dst_lines[dst_row];
 466:	
 467:			memcpy(dst_line, src_line, src_cols * sizeof(*src_line));
 468:			if (dst_cols - src_cols)
 469:				memset32(dst_line + src_cols, ' ', dst_cols - src_cols);
 470:			src_top_row++;
 471:			dst_row++;
 472:		}
 473:		while (dst_row < dst_rows) {
 474:			u32 *dst_line = dst_lines[dst_row];
 475:	
 476:			memset32(dst_line, ' ', dst_cols);
 477:			dst_row++;
 478:		}
 479:	}
 SourceFile:drivers/tty/vt/vt.c]

gemini-3-pro-preview

							input: 155633
							output: 284
							thoughts: 1813
						

**Analyzing the Hung Task and Console Lock Issue**

Okay, so I'm looking at this bug report. The tasks are hung, and the key seems to be `con_install` and a "softlockup" in `console_unlock`. The loops in question, bounded by `src_bot_row` and `dst_rows`, aren't the problem – they're bounded, so it's not a spin lock issue. `update_screen(vc)` looks safe, with the `fbcon_switch` call gated by `con_is_visible(vc)`. `notify_update(vc)`'s notifiers should be fast.

The core issue seems to hinge on what `syz.5.2008` is actually doing.  The bug title "INFO: task hung in con_install" suggests a potential issue in the console driver. If `fb_set_var` took 143 seconds, the hung task detector would have noticed. And a `D` state wouldn't be reported as hung, so it's in `R` state, spinning. It is likely spinning in `console_unlock`, which is a common place for softlockups. The "SOFTLOCKUP" report confirms this. So, why is it spinning?

My thinking goes to printk flooding.  `ttyprintk` seems like an obvious suspect, but my attempts didn't work. Is it even enabled? I looked for other printk triggers, like `TIOCLINUX` with `TIOCL_PASTESEL`, but that just writes to the console buffer, not `printk`. `bpf_trace_printk` is an option, but it's restricted by BPF limitations. Direct writes to `/dev/kmsg` are a natural thought, but are also tricky because of syzkaller restrictions on file paths.  I can't use `syz_open_dev$kmsg`. I checked `sys.txt`, but it seems like that's not supported. I can't open `/dev/kmsg` directly.

The next thought is to generate warnings, which will create backtraces. However, warnings (at least the ones that would cause a crash) will be reported by syzkaller. So, this route is likely a dead end. We must be generating non-error printk messages.

So, what about generating normal info messages? I need to find something that can be repeatedly triggered in a tight loop and generate printk output. The network interface creation/deletion is a promising avenue. Creating and deleting interfaces like `veth` would generate constant messages like `IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready` and `IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready`. I'll try generating lots of messages from multiple threads.  If I also open `/dev/tty1`, it should block in `con_install`. I need to craft a reproducer using a loop to create and delete `veth` interfaces, along with a call to `open("/dev/tty1")`. That's where I need to start.

unknown syscall sendmsg$RTM_NEWLINK

map[ReproSyz:r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$RTM_NEWLINK(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x10, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0}, 0x1c}, 0x0) (async)
sendmsg$RTM_DELLINK(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0}, 0x1c}, 0x0) (async)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 158428
							output: 41
							thoughts: 200
						

**Refining the Approach to Interface Creation**

Okay, so I was initially aiming for `sendmsg` with `RTM_NEWLINK`, but that feels overly complex. I think I'll pivot to something like `syz_genetlink_get_family_id` – much cleaner. Actually, the whole idea of manually creating `veth` interfaces might be unnecessary. Syzkaller has `syz_emit_ethernet`, and, better yet, we could just utilize `tun` devices.

Hang on... using `tun` for this purpose *does* generate a `printk` message on creation:

```
[  123.456] tun: Universal TUN/TAP device driver, 1.6
```

Hmm, that's just a single print, though. Not ideal, but potentially manageable. Let me explore another option. What about the `loop` device?

```
[  123.456] loop0: detected capacity change from 0 to 1024
```

Oh, *that's* a problem! Changing the capacity of a `loop` device in a loop generates a lot of `printk` output. That's a definite no-go. I need to understand why. Time to dive into `drivers/block/loop.c` and figure out what's causing that spam.

map[ContextFile:drivers/block/loop.c IncludeLines:true Name:loop_set_capacity]

map[SourceCode:1406:	static int loop_set_capacity(struct loop_device *lo)
1407:	{
1408:		loff_t size;
1409:	
1410:		if (unlikely(lo->lo_state != Lo_bound))
1411:			return -ENXIO;
1412:	
1413:		size = lo_calculate_size(lo, lo->lo_backing_file);
1414:		loop_set_size(lo, size);
1415:	
1416:		return 0;
1417:	}
 SourceFile:drivers/block/loop.c]

gemini-3-pro-preview

							input: 159151
							output: 264
							thoughts: 75
						

**Reproducing Excessive Capacity Change Notifications**

Okay, so I've been looking at this code, specifically how `loop_set_size` interacts with `set_capacity_and_notify`. It seems that every time `loop_set_size` triggers `set_capacity_and_notify`, we get that pesky print statement: "detected capacity change from X to Y". Now, the lightbulb moment: if we're repeatedly messing with the backing file size and then calling `LOOP_SET_CAPACITY` after each change, we're going to generate a ton of these messages. That's not ideal, and probably indicates a performance or logging issue we should investigate. Therefore, my immediate thought is, let's craft a reproducer. Let's write a small program or test case that deliberately forces this behavior to verify the excessive logging and pinpoint exactly where the problem lies. That’s the most direct route to understanding the severity and developing a fix, assuming, of course, that my intuition about this potential print spam is correct. We'll be able to see the effect directly, and quantify the problem quickly.

excessive syscall arguments
line #6:36: ioctl$LOOP_SET_CAPACITY(r0, 0x4c07, <<<!!ERROR!!>>>0x0)

map[ReproSyz:r0 = syz_open_dev$loop(0x7, 0x7, 0x0)
r1 = memfd_create(&AUTO='loop\x00', 0x0)
ftruncate(r1, 0x1000)
ioctl$LOOP_SET_FD(r0, 0x4c00, r1)
ftruncate(r1, 0x2000)
ioctl$LOOP_SET_CAPACITY(r0, 0x4c07, 0x0)
ftruncate(r1, 0x3000)
ioctl$LOOP_SET_CAPACITY(r0, 0x4c07, 0x0)
ftruncate(r1, 0x4000)
ioctl$LOOP_SET_CAPACITY(r0, 0x4c07, 0x0)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 159781
							output: 20
							thoughts: 35
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Investigating `ioctl$LOOP_SET_CAPACITY` in syzkaller**

Right, so I'm poking around the syzkaller code, and I see that `ioctl$LOOP_SET_CAPACITY` doesn't seem to be taking an argument, which strikes me as odd. I was under the impression that you generally *need* a size or capacity parameter for that ioctl to function correctly. Hmm, that's not what I expected.

My immediate response is to cross-reference with the loop device documentation, specifically `dev_loop.txt`, to confirm this behavior. I need to refresh my memory on the expected parameterization of that ioctl call in a low-level context. I'll see what the official documentation says and get back to this issue.

map[File:dev_loop.txt]

map[Output:# Copyright 2017 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <linux/fcntl.h>
include <linux/loop.h>

resource fd_loop[fd_block]
syz_open_dev$loop(dev ptr[in, string["/dev/loop#"]], id intptr, flags flags[open_flags]) fd_loop

ioctl$LOOP_SET_FD(fd fd_loop, cmd const[LOOP_SET_FD], arg fd)
ioctl$LOOP_CONFIGURE(fd fd_loop, cmd const[LOOP_CONFIGURE], arg ptr[in, loop_config])
ioctl$LOOP_CHANGE_FD(fd fd_loop, cmd const[LOOP_CHANGE_FD], arg fd)
ioctl$LOOP_CLR_FD(fd fd_loop, cmd const[LOOP_CLR_FD])
ioctl$LOOP_SET_STATUS(fd fd_loop, cmd const[LOOP_SET_STATUS], arg ptr[in, loop_info])
ioctl$LOOP_SET_STATUS64(fd fd_loop, cmd const[LOOP_SET_STATUS64], arg ptr[in, loop_info64])
ioctl$LOOP_GET_STATUS(fd fd_loop, cmd const[LOOP_GET_STATUS], arg ptr[out, loop_info])
ioctl$LOOP_GET_STATUS64(fd fd_loop, cmd const[LOOP_GET_STATUS64], arg ptr[out, loop_info64])
ioctl$LOOP_SET_CAPACITY(fd fd_loop, cmd const[LOOP_SET_CAPACITY])
ioctl$LOOP_SET_DIRECT_IO(fd fd_loop, cmd const[LOOP_SET_DIRECT_IO], arg intptr)
ioctl$LOOP_SET_BLOCK_SIZE(fd fd_loop, cmd const[LOOP_SET_BLOCK_SIZE], arg intptr)

resource fd_loop_ctrl[fd]
resource fd_loop_num[intptr]: 0, 1, 2, 10, 11, 12
openat$loop_ctrl(fd const[AT_FDCWD], file ptr[in, string["/dev/loop-control"]], flags flags[open_flags], mode const[0]) fd_loop_ctrl
ioctl$LOOP_CTL_GET_FREE(fd fd_loop_ctrl, cmd const[LOOP_CTL_GET_FREE]) fd_loop_num
ioctl$LOOP_CTL_ADD(fd fd_loop_ctrl, cmd const[LOOP_CTL_ADD], num fd_loop_num) fd_loop_num
ioctl$LOOP_CTL_REMOVE(fd fd_loop_ctrl, cmd const[LOOP_CTL_REMOVE], num fd_loop_num)

lo_encrypt_type = LO_CRYPT_NONE, LO_CRYPT_XOR, LO_CRYPT_DES, LO_CRYPT_FISH2, LO_CRYPT_BLOW, LO_CRYPT_CAST128, LO_CRYPT_IDEA, LO_CRYPT_DUMMY, LO_CRYPT_SKIPJACK, LO_CRYPT_CRYPTOAPI
lo_flags = LO_FLAGS_READ_ONLY, LO_FLAGS_AUTOCLEAR, LO_FLAGS_PARTSCAN, LO_FLAGS_DIRECT_IO

loop_config {
	fd		fd_loop
	block_size	int32
	info		loop_info64
	reserved	array[const[0, int64], 8]
}

loop_info {
	lo_number	const[0, int32]
# NEED: on amd64 lo_device/lo_rdevice (__kernel_old_dev_t) is long, on 386 it's short...
	lo_device	alignptr[const[0, int16]]
	lo_inode	const[0, intptr]
	lo_rdevice	alignptr[const[0, int16]]
	lo_offset	int32
	lo_enc_type	flags[lo_encrypt_type, int32]
	lo_enc_key_size	int32[0:LO_KEY_SIZE]
	lo_flags	flags[lo_flags, int32]
	lo_name		array[int8, LO_NAME_SIZE]
	lo_enc_key	array[int8, LO_KEY_SIZE]
	lo_init		array[intptr, 2]
	reserved	const[0, int32]
}

loop_info64 {
	lo_device	const[0, int64]
	lo_inode	const[0, int64]
	lo_rdevice	const[0, int64]
	lo_offset	int64
	lo_sizelimit	int64
	lo_number	const[0, int32]
	lo_enc_type	flags[lo_encrypt_type, int32]
	lo_enc_key_size	int32[0:LO_KEY_SIZE]
	lo_flags	flags[lo_flags, int32]
	lo_file_name	array[int8, LO_NAME_SIZE]
	lo_crypt_name	array[int8, LO_NAME_SIZE]
	lo_enc_key	array[int8, LO_KEY_SIZE]
	lo_init		array[int64, 2]
}
]

gemini-3-pro-preview

							input: 161276
							output: 284
							thoughts: 37
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Fixing the Reproducer: ioctl$LOOP_SET_CAPACITY**

Right, so we're looking at `ioctl$LOOP_SET_CAPACITY(fd fd_loop, cmd const[LOOP_SET_CAPACITY])`.  My immediate thought is, "Yes, we're definitely targeting that function."  This means we're dealing with adjusting the capacity of a loop device, which could be anything from resizing the backing file to handling a dynamic size setup. 

The focus now has to be on fixing the reproducer. This likely means tracking down *why* the bug is triggered when we call this ioctl. We need to dissect the arguments of `LOOP_SET_CAPACITY` and understand how the interaction with the loop device driver is breaking. We have to look at how we're setting `fd_loop`, how the `cmd` data is initialized and passed, and if any pre-conditions are met for this ioctl to work correctly. It could be an edge case with certain block sizes, partition layouts, or loop device configurations. 

Essentially, this is now a matter of debugging the reproducer.  We need to find out what specific sequence is causing the issue.  Time to get those tools out!

map[ReproSyz:r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0)
r1 = memfd_create(&(0x7f0000000040)='loop\x00', 0x0)
ftruncate(r1, 0x1000)
ioctl$LOOP_SET_FD(r0, 0x4c00, r1)
ftruncate(r1, 0x2000)
ioctl$LOOP_SET_CAPACITY(r0, 0x4c07)
ftruncate(r1, 0x3000)
ioctl$LOOP_SET_CAPACITY(r0, 0x4c07)
ftruncate(r1, 0x4000)
ioctl$LOOP_SET_CAPACITY(r0, 0x4c07)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 161901
							output: 500
							thoughts: 538
						

**My Current Train of Thought**

Okay, so the current setup didn't trigger the behavior we're after, no crash. Hmm, maybe a looping strategy is required. But wait, if we're just aiming for printk flooding, there's `ioctl$TIOCL_SETVESABLANK`, but that doesn't seem to generate any printk output. What about `ioctl$VT_RESIZE`?

Let's see, if I set `VT_RESIZE` with large values, like 1000x1000, it allocates 2MB. If I put that in a loop, it'll repeatedly allocate and free 2MB chunks. That doesn't look promising because it won't hold the `console_lock` for the extended period we saw before - 143 seconds. Okay, what if I max out the rows and columns with `VT_RESIZE`? Nope, that immediately returns an `-EINVAL` error. Alright, let's dial it back to 1024x1024. Then, `new_screen_size` is 2MB. In a loop, that's only 63 iterations. So, 63 * 2MB gives us 126MB allocated. That will take some time but not 143 seconds.

I wonder if we use multiple threads calling `VT_RESIZE`. They'll serialize on `console_lock`. Each thread grabs the lock briefly, releases it. If `syz.8.2015` is waiting on the lock, the FIFO nature of semaphores means it *should* get it when the threads release it. So, `syz.8.2015` won't be blocked for 143 seconds then.

Unless... unless one thread *never* releases `console_lock`! That would be it. A thread stuck in an infinite loop while holding the lock. Where could that happen? Ah, in `console_unlock`, that's the place. And why would it happen? Because of printk flooding! Bingo. But, how to trigger printk flooding? Is there another way to cause the printk flooding? What if I try `prctl(PR_SET_NAME, ...)` and then trigger a kernel warning? Maybe `syz_open_dev$ttyprintk` but that would mean we'd need to write to it in a tight loop from multiple threads.

data arg has bad value "A"

map[ReproSyz:r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyprintk\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)="A"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="A"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="A"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="A"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="A"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="A"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="A"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="A"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="A"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="A"/4096, 0x1000) (async)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 163490
							output: 510
							thoughts: 17
						

Okay, here's my summary, presented as a direct thought process:

**Decoding This Snippet**

Alright, let's break this down. Seeing `&AUTO="41"/4096` immediately triggers a mental context switch to... likely some sort of memory addressing, or data allocation scheme. The `&` suggests a reference or pointer – classic. "AUTO" could mean automatic allocation, which is interesting. The "41" is likely a starting offset, index or some sort of identifier. And finally the division by 4096... that seems awfully familiar. Is that a page size? Is it indicative of how this memory space is structured? Are we talking about virtual memory perhaps? A division suggests modular arithmetic too... could be a checksum. This all very much depends on the specific platform context. I'll need more information to be sure, but my initial impression is this is a method for pointing at a memory location, or at least setting some parameters for one. Interesting!

map[ReproSyz:r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyprintk\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)="41"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="41"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="41"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="41"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="41"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="41"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="41"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="41"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="41"/4096, 0x1000) (async)
write(r0, &(0x7f0000000040)="41"/4096, 0x1000) (async)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 164251
							output: 23
							thoughts: 4191
						

**Analyzing a Potential Deadlock in the TTY/Console Subsystem**

Okay, so the system didn't crash, which is a good starting point, meaning the `ttyprintk` isn't the issue. I'm wondering if a crafted `ioctl(VT_RESIZE)` call with specific arguments could trigger an infinite loop. I need to re-examine `vc_do_resize` and specifically, how it handles the loop condition. It's a bit of a head-scratcher. If `old_row_size` is zero or even negative, this could cause some unexpected behavior. What if the loop never terminates? The row/size values come from `vc->vc_rows` and `vc->vc_size_row` - could these values be corrupted? This seems like a memory corruption bug, although the bug report is simply about a task hang.

The task, `syz.5.2008`, is in `vt_ioctl`, and potentially blocked on `tty_mutex`. Then, there is the function `vc_do_resize` with the comment about taking the console semaphore. The question is: does `vc_do_resize` take `tty_mutex`? Nope, it doesn't. If `syz.5.2008` is blocked on `console_lock`, it should be in the blocked tasks list, right? But it's not. This means the process is still running. If it's running, it must be spinning *somewhere*. I wonder if it's spinning in `fbcon_resize`? No infinite loops are immediately visible there. `fb_find_best_mode` looks like it *could* loop forever if `head` is a corrupted list, but the system would probably crash.

What if the bug is caused by generating a lot of printk messages? Could it be a flooding attack with `TIOCLINUX`? Let's consider `TIOCL_SETSEL` and `TIOCL_PASTESEL` to flood a pty, but I don't see any obvious trigger, so no. What about the keyboard map with `KDSKBENT`? If the injected keyboard events translate to SysRq, it would generate a huge volume of printk messages. Injecting `SysRq + t` (show task states) repeatedly would lock `console_unlock` for a long time. Syzkaller can inject this but, how? We can use `uinput`, or, can we use `ioctl(TIOCSTI)` to inject characters into the tty? What about using `/proc/sysrq-trigger`? Yes, that's what I want! That seems likely! Let's check if syzkaller can use this trigger. No. There is no other easy way to trigger SysRq.

Can we trigger a lot of page faults? Yes, but syzkaller should already be doing this. No significant hang. What about using `bpf`? Attaching a kprobe to a frequently called function with `bpf_trace_printk`, this would generate a lot of messages, but it doesn't write to `dmesg`, unless `trace_printk` is configured to do so. No. What about `prctl(PR_SET_NAME)`? No, it's not useful. What about `ioctl(KDSIGACCEPT)`? No, the issue is not related to signals.

Now, let's rethink: why is `syz.8.2015` blocked in `con_install`? Because `console_lock` is held. Now, who holds `console_lock`? Is it the `VT_RESIZE` of `syz.5.2008`? If we use `PIO_FONTX` to set a huge font, and then `VT_RESIZE`, it does not set a large enough font to be significant. Perhaps `ioctl(FBIOPAN_DISPLAY)` of `syz.5.2008` is the issue? Or `ioctl(FBIOPUT_CON2FBMAP)` which calls `fbcon_set_con2fb_map_ioctl`? If we call it in a loop, it would acquire and release `console_lock`, but it's not a long time. What if `set_con2fb_map` is slow? It binds the console driver and takes time. But it's not 143 seconds.

Wait, is it a DEADLOCK? Yes!

If it's a deadlock, `syz.5.2008` holds `console_lock` and waits for `tty_mutex`. And `syz.8.2015` holds `tty_mutex` and waits for `console_lock`. That's an AB

map[Expression:mutex_lock\(&tty_mutex\)]

map[Output:drivers/tty/tty_io.c=1646=void tty_kclose(struct tty_struct *tty)
--
drivers/tty/tty_io.c-1660-	 */
drivers/tty/tty_io.c:1661:	mutex_lock(&tty_mutex);
drivers/tty/tty_io.c-1662-	tty_port_set_kopened(tty->port, 0);
--
drivers/tty/tty_io.c=1676=void tty_release_struct(struct tty_struct *tty, int idx)
--
drivers/tty/tty_io.c-1690-	 */
drivers/tty/tty_io.c:1691:	mutex_lock(&tty_mutex);
drivers/tty/tty_io.c-1692-	release_tty(tty, idx);
--
drivers/tty/tty_io.c=1944=static struct tty_struct *tty_kopen(dev_t device, int shared)
--
drivers/tty/tty_io.c-1949-
drivers/tty/tty_io.c:1950:	mutex_lock(&tty_mutex);
drivers/tty/tty_io.c-1951-	driver = tty_lookup_driver(device, NULL, &index);
--
drivers/tty/tty_io.c=2029=static struct tty_struct *tty_open_by_driver(dev_t device,
--
drivers/tty/tty_io.c-2036-
drivers/tty/tty_io.c:2037:	mutex_lock(&tty_mutex);
drivers/tty/tty_io.c-2038-	driver = tty_lookup_driver(device, filp, &index);
--
fs/proc/proc_tty.c=104=static void *t_start(struct seq_file *m, loff_t *pos)
fs/proc/proc_tty.c-105-{
fs/proc/proc_tty.c:106:	mutex_lock(&tty_mutex);
fs/proc/proc_tty.c-107-	return seq_list_start(&tty_drivers, *pos);
]

gemini-3-pro-preview

							input: 170054
							output: 25
							thoughts: 42
						

Okay, let's see...

**Analyzing `tty_mutex` Usage**

Alright, hold on. I'm seeing that `tty_mutex` is being grabbed within a `scoped_guard` as well. That's interesting, and potentially significant. I need to understand this `scoped_guard(mutex, &tty_mutex)` construct better in this context. Let me zoom in on that specific line of code and the surrounding logic to figure out how this mutex is being managed and when it's being acquired and released. Gotta make sure I'm following the correct locking strategy here, especially when multiple guards might be in use, and consider possible deadlocks. Time to dig in a bit deeper.

map[Expression:scoped_guard\(mutex, &tty_mutex\)]

map[Output:drivers/tty/pty.c=765=static int ptmx_open(struct inode *inode, struct file *filp)
--
drivers/tty/pty.c-797-	/* The tty returned here is locked so we can safely drop the mutex */
drivers/tty/pty.c:798:	scoped_guard(mutex, &tty_mutex)
drivers/tty/pty.c-799-		tty = tty_init_dev(ptm_driver, index);
--
drivers/tty/tty_io.c=3425=int tty_register_driver(struct tty_driver *driver)
--
drivers/tty/tty_io.c-3451-
drivers/tty/tty_io.c:3452:	scoped_guard(mutex, &tty_mutex)
drivers/tty/tty_io.c-3453-		list_add(&driver->tty_drivers, &tty_drivers);
--
drivers/tty/tty_io.c-3471-
drivers/tty/tty_io.c:3472:	scoped_guard(mutex, &tty_mutex)
drivers/tty/tty_io.c-3473-		list_del(&driver->tty_drivers);
--
drivers/tty/tty_io.c=3488=void tty_unregister_driver(struct tty_driver *driver)
--
drivers/tty/tty_io.c-3491-				driver->num);
drivers/tty/tty_io.c:3492:	scoped_guard(mutex, &tty_mutex)
drivers/tty/tty_io.c-3493-		list_del(&driver->tty_drivers);
]

gemini-3-pro-preview

							input: 170697
							output: 24
							thoughts: 12
						

Here's my attempt at summarizing that thought process, tailored for an expert audience:

**Analyzing that Mutex Guard**

Okay, so I see `guard(mutex)(&tty_mutex)`. My mind immediately jumps to the implication. `guard` is almost certainly a RAII-style guard – a crucial pattern for resource management and preventing deadlock. The syntax strongly suggests it's a wrapper around a mutex, likely a `std::mutex` equivalent if we're in C++ or a similar construct in another language. The ampersand before `tty_mutex` is a little interesting... It implies a *reference* to the mutex is being passed to the guard's constructor. This means the guard manages the *existing* `tty_mutex` object, rather than taking a copy or moving it. This is normal, but worth noting. The purpose is likely protecting the tty device, to manage its access for this section of code. I'm already anticipating how this guard will automatically release the mutex upon going out of scope. That's the whole point, isn't it? Avoiding those messy `unlock()` calls that can be so easily missed, especially in complex control flow. It's a clean, safe, and efficient way to handle locking, which is the cornerstone to handling concurrent operations.

map[Expression:guard\(mutex\)\(&tty_mutex\)]

map[Output:drivers/tty/tty_io.c=334=int tty_dev_name_to_number(const char *name, dev_t *number)
--
drivers/tty/tty_io.c-352-
drivers/tty/tty_io.c:353:	guard(mutex)(&tty_mutex);
drivers/tty/tty_io.c-354-
--
drivers/tty/tty_io.c=378=struct tty_driver *tty_find_polling_driver(char *name, int *line)
--
drivers/tty/tty_io.c-393-
drivers/tty/tty_io.c:394:	guard(mutex)(&tty_mutex);
drivers/tty/tty_io.c-395-
]

gemini-3-pro-preview

							input: 171205
							output: 15
							thoughts: 1335
						

**Analyzing a Softlockup in the Console Driver**

Okay, so the kernel's tainted with `G U L`, and `L` indicates a `SOFTLOCKUP`.  My first thought is, is it a deadlock? If it *were* a deadlock, `lockdep` would have flagged it!  The kernel usually has `lockdep` enabled in syzkaller.  And look here: the bug report includes lockdep output, showing that `lockdep` *is* enabled and *isn't* reporting a deadlock.  So, it *must* be a softlockup.

The lockdep output also shows `khungtaskd` is holding a `rcu_read_lock`.  A softlockup means a task is spinning while holding the `console_lock`. The softlockup detector likely fired, which resulted in this report, but the actual softlockup message itself might have been truncated. That means we need to *trigger* a softlockup in `console_unlock` or somewhere else when the `console_lock` is held.

How to do that? I need to generate a *lot* of `printk` messages.  What ioctl can I use to generate a flood of output?  Hmm, let's consider `ioctl(TIOCLINUX)` with `TIOCL_SETSEL` and `TIOCL_PASTESEL`. If I paste a huge selection, it goes into the tty input queue. If it's a PTY, the input goes to the PTY master. If it's a virtual console (`/dev/tty1`), it goes to the VT input queue. And if the VT is in echo mode, it would echo back to VT output. Would that call `vt_console_print` or `con_write`? `vt_console_print` is for `printk`. `con_write` writes to the screen buffer. So pasting into a VT won't give me the flood of `printk`s I need.

Okay, let's explore other ioctls. Let's look at `ioctl(KDSIGACCEPT)`. Nope, no `printk`. How about `ioctl(VT_RELDISP)`? No. `ioctl(VT_ACTIVATE)`? No. `ioctl(VT_WAITACTIVE)`? No. `ioctl(VT_DISALLOCATE)`? No. `ioctl(VT_RESIZE)`? No. `ioctl(VT_RESIZEX)`? No. `ioctl(PIO_FONT)`, `PIO_CMAP`, `PIO_SCRNMAP`, `PIO_UNIMAP`, `KDFONTOP`, `KDSETMODE`, `KDMKTONE`, `KIOCSOUND`, `KDADDIO`, `KDDELIO`, `KDENABIO`, `KDDISABIO`, `KDSETLED`, `KDSKBLED`, `KDSKBMODE`, `KDSKBMETA`, `KDSKBENT`, `KDSKBSENT`, and `KDSETKEYCODE`? Nope, none of these seem to use `printk`.

Wait... is there *any* ioctl that calls `printk`? I need to search the source code now. I'll search for `printk` within the `drivers/tty/vt/vt_ioctl.c` file. Let's see what we find...

map[Expression:printk]

map[Output:
Full output is too long, showing 500 out of 169284 lines.
Use more precise expression if possible.

[Documentation/.renames.txt=1144=x86/cpuinfo arch/x86/cpuinfo
 Documentation/.renames.txt:1145:x86/earlyprintk arch/x86/earlyprintk
 Documentation/.renames.txt-1146-x86/elf_auxvec arch/x86/elf_auxvec
 --
 Documentation/ABI/stable/sysfs-driver-dma-idxd=281=Description:	Shows the operation capability bits displayed in bitmap format
 Documentation/ABI/stable/sysfs-driver-dma-idxd:282:		presented by %*pb printk() output format specifier.
 Documentation/ABI/stable/sysfs-driver-dma-idxd-283-		The attribute can be configured when the WQ is disabled in
 --
 Documentation/ABI/testing/dev-kmsg=5=Description:	The /dev/kmsg character device node provides userspace access
 Documentation/ABI/testing/dev-kmsg:6:		to the kernel's printk buffer.
 Documentation/ABI/testing/dev-kmsg-7-
 --
 Documentation/ABI/testing/dev-kmsg-10-		Every write() to the opened device node places a log entry in
 Documentation/ABI/testing/dev-kmsg:11:		the kernel's printk buffer.
 Documentation/ABI/testing/dev-kmsg-12-
 --
 Documentation/ABI/testing/dev-kmsg-26-		Every read() from the opened device node receives one record
 Documentation/ABI/testing/dev-kmsg:27:		of the kernel's printk buffer.
 Documentation/ABI/testing/dev-kmsg-28-
 --
 Documentation/RCU/stallwarn.rst=18=warnings:
 --
 Documentation/RCU/stallwarn.rst-37-	RCU CPU stall warning messages.  Especially if you have added
 Documentation/RCU/stallwarn.rst:38:	debug printk()s.
 Documentation/RCU/stallwarn.rst-39-
 --
 Documentation/RCU/torture.rst=13=be loaded to run a torture test.  The test periodically outputs
 Documentation/RCU/torture.rst:14:status messages via printk(), which can be examined via the dmesg
 Documentation/RCU/torture.rst-15-command (perhaps grepping for "torture").  The test is started
 --
 Documentation/RCU/torture.rst=34=most systems.  On more esoteric configurations, it may be necessary to
 Documentation/RCU/torture.rst:35:use other commands to access the output of the printk()s used by
 Documentation/RCU/torture.rst:36:the RCU torture test.  The printk()s use KERN_ALERT, so they should
 Documentation/RCU/torture.rst-37-be evident.  ;-)
 --
 Documentation/RCU/torture.rst=151=checked for such errors.  The "rmmod" command forces a "SUCCESS",
 Documentation/RCU/torture.rst:152:"FAILURE", or "RCU_HOTPLUG" indication to be printk()ed.  The first
 Documentation/RCU/torture.rst-153-two are self-explanatory, while the last indicates that while there
 --
 Documentation/admin-guide/bootconfig.rst=300=each array's value, e.g.::
 --
 Documentation/admin-guide/bootconfig.rst-305-    xbc_array_for_each_value(vnode, value) {
 Documentation/admin-guide/bootconfig.rst:306:      printk("%s ", value);
 Documentation/admin-guide/bootconfig.rst-307-    }
 --
 Documentation/admin-guide/clearing-warn-once.rst=1=Clearing WARN_ONCE
 --
 Documentation/admin-guide/clearing-warn-once.rst-3-
 Documentation/admin-guide/clearing-warn-once.rst:4:WARN_ONCE / WARN_ON_ONCE / printk_once only emit a message once.
 Documentation/admin-guide/clearing-warn-once.rst-5-
 --
 Documentation/admin-guide/devices.txt-15-		 10 = /dev/aio		Asynchronous I/O notification interface
 Documentation/admin-guide/devices.txt:16:		 11 = /dev/kmsg		Writes to this come out as printk's, reads
 Documentation/admin-guide/devices.txt:17:					export the buffered printk records.
 Documentation/admin-guide/devices.txt-18-		 12 = /dev/oldmem	OBSOLETE - replaced by /proc/vmcore
 --
 Documentation/admin-guide/devices.txt-156-		  2 = /dev/ptmx		PTY master multiplex
 Documentation/admin-guide/devices.txt:157:		  3 = /dev/ttyprintk	User messages via printk TTY device
 Documentation/admin-guide/devices.txt-158-		 64 = /dev/cua0		Callout device for ttyS0
 --
 Documentation/admin-guide/kdump/gdbmacros.txt=289=define dmesg
 Documentation/admin-guide/kdump/gdbmacros.txt:290:	# definitions from kernel/printk/printk_ringbuffer.h
 Documentation/admin-guide/kdump/gdbmacros.txt-291-	set var $desc_committed = 1
 --
 Documentation/admin-guide/kdump/vmcoreinfo.rst=198=prb
 --
 Documentation/admin-guide/kdump/vmcoreinfo.rst-200-
 Documentation/admin-guide/kdump/vmcoreinfo.rst:201:A pointer to the printk ringbuffer (struct printk_ringbuffer). This
 Documentation/admin-guide/kdump/vmcoreinfo.rst-202-may be pointing to the static boot ringbuffer or the dynamically
 --
 Documentation/admin-guide/kdump/vmcoreinfo.rst=204=Used by user-space tools to read the active kernel log buffer.
 Documentation/admin-guide/kdump/vmcoreinfo.rst-205-
 Documentation/admin-guide/kdump/vmcoreinfo.rst:206:printk_rb_static
 Documentation/admin-guide/kdump/vmcoreinfo.rst-207-----------------
 Documentation/admin-guide/kdump/vmcoreinfo.rst-208-
 Documentation/admin-guide/kdump/vmcoreinfo.rst:209:A pointer to the static boot printk ringbuffer. If @prb has a
 Documentation/admin-guide/kdump/vmcoreinfo.rst-210-different value, this is useful for viewing the initial boot messages,
 --
 Documentation/admin-guide/kdump/vmcoreinfo.rst=214=clear_seq
 --
 Documentation/admin-guide/kdump/vmcoreinfo.rst-216-
 Documentation/admin-guide/kdump/vmcoreinfo.rst:217:The sequence number of the printk() record after the last clear
 Documentation/admin-guide/kdump/vmcoreinfo.rst-218-command. It indicates the first record after the last
 --
 Documentation/admin-guide/kdump/vmcoreinfo.rst=220=tools to dump a subset of the dmesg log.
 Documentation/admin-guide/kdump/vmcoreinfo.rst-221-
 Documentation/admin-guide/kdump/vmcoreinfo.rst:222:printk_ringbuffer
 Documentation/admin-guide/kdump/vmcoreinfo.rst-223------------------
 Documentation/admin-guide/kdump/vmcoreinfo.rst-224-
 Documentation/admin-guide/kdump/vmcoreinfo.rst:225:The size of a printk_ringbuffer structure. This structure contains all
 Documentation/admin-guide/kdump/vmcoreinfo.rst-226-information required for accessing the various components of the
 Documentation/admin-guide/kdump/vmcoreinfo.rst=227=kernel log buffer.
 Documentation/admin-guide/kdump/vmcoreinfo.rst-228-
 Documentation/admin-guide/kdump/vmcoreinfo.rst:229:(printk_ringbuffer, desc_ring|text_data_ring|dict_data_ring|fail)
 Documentation/admin-guide/kdump/vmcoreinfo.rst-230------------------------------------------------------------------
 Documentation/admin-guide/kdump/vmcoreinfo.rst-231-
 Documentation/admin-guide/kdump/vmcoreinfo.rst:232:Offsets for the various components of the printk ringbuffer. Used by
 Documentation/admin-guide/kdump/vmcoreinfo.rst-233-user-space tools to view the kernel log buffer without requiring the
 --
 Documentation/admin-guide/kdump/vmcoreinfo.rst=274=requiring the declaration of the structure.
 Documentation/admin-guide/kdump/vmcoreinfo.rst-275-
 Documentation/admin-guide/kdump/vmcoreinfo.rst:276:printk_info
 Documentation/admin-guide/kdump/vmcoreinfo.rst-277------------
 Documentation/admin-guide/kdump/vmcoreinfo.rst-278-
 Documentation/admin-guide/kdump/vmcoreinfo.rst:279:The size of the printk_info structure. This structure contains all
 Documentation/admin-guide/kdump/vmcoreinfo.rst-280-the meta-data for a record.
 Documentation/admin-guide/kdump/vmcoreinfo.rst-281-
 Documentation/admin-guide/kdump/vmcoreinfo.rst:282:(printk_info, seq|ts_nsec|text_len|dict_len|caller_id)
 Documentation/admin-guide/kdump/vmcoreinfo.rst-283-------------------------------------------------------
 --
 Documentation/admin-guide/kernel-parameters.txt=98=Kernel parameters
 --
 Documentation/admin-guide/kernel-parameters.txt-660-	boot_delay=	[KNL,EARLY]
 Documentation/admin-guide/kernel-parameters.txt:661:			Milliseconds to delay each printk during boot.
 Documentation/admin-guide/kernel-parameters.txt-662-			Only works if CONFIG_BOOT_PRINTK_DELAY is enabled,
 --
 Documentation/admin-guide/kernel-parameters.txt-1012-			printed, depending on CONFIG_PRINTK_TIME or
 Documentation/admin-guide/kernel-parameters.txt:1013:			`printk_time' param).
 Documentation/admin-guide/kernel-parameters.txt-1014-		syslog
 --
 Documentation/admin-guide/kernel-parameters.txt-1564-
 Documentation/admin-guide/kernel-parameters.txt:1565:	earlyprintk=	[X86,SH,ARM,M68k,S390,UM,EARLY]
 Documentation/admin-guide/kernel-parameters.txt:1566:			earlyprintk=vga
 Documentation/admin-guide/kernel-parameters.txt:1567:			earlyprintk=sclp
 Documentation/admin-guide/kernel-parameters.txt:1568:			earlyprintk=xen
 Documentation/admin-guide/kernel-parameters.txt:1569:			earlyprintk=serial[,ttySn[,baudrate]]
 Documentation/admin-guide/kernel-parameters.txt:1570:			earlyprintk=serial[,0x...[,baudrate]]
 Documentation/admin-guide/kernel-parameters.txt:1571:			earlyprintk=ttySn[,baudrate]
 Documentation/admin-guide/kernel-parameters.txt:1572:			earlyprintk=dbgp[debugController#]
 Documentation/admin-guide/kernel-parameters.txt:1573:			earlyprintk=mmio32,membase[,{nocfg|baudrate}]
 Documentation/admin-guide/kernel-parameters.txt:1574:			earlyprintk=pciserial[,force],bus:device.function[,{nocfg|baudrate}]
 Documentation/admin-guide/kernel-parameters.txt:1575:			earlyprintk=xdbc[xhciController#]
 Documentation/admin-guide/kernel-parameters.txt:1576:			earlyprintk=bios
 Documentation/admin-guide/kernel-parameters.txt-1577-
 Documentation/admin-guide/kernel-parameters.txt:1578:			earlyprintk is useful when the kernel crashes before
 Documentation/admin-guide/kernel-parameters.txt-1579-			the normal console is initialized. It is not enabled by
 --
 Documentation/admin-guide/kernel-parameters.txt-1594-			replacing ttySn with an I/O port address, like this:
 Documentation/admin-guide/kernel-parameters.txt:1595:				earlyprintk=serial,0x1008,115200
 Documentation/admin-guide/kernel-parameters.txt-1596-			You can find the port for a given device in
 --
 Documentation/admin-guide/kernel-parameters.txt-1667-			This is designed to be used in conjunction with
 Documentation/admin-guide/kernel-parameters.txt:1668:			the boot argument: earlyprintk=vga
 Documentation/admin-guide/kernel-parameters.txt-1669-
 --
 Documentation/admin-guide/kernel-parameters.txt-2324-			kernel messages to the console. Useful for debugging.
 Documentation/admin-guide/kernel-parameters.txt:2325:			We also add it as printk module parameter, so users
 Documentation/admin-guide/kernel-parameters.txt-2326-			could change it dynamically, usually by
 Documentation/admin-guide/kernel-parameters.txt:2327:			/sys/module/printk/parameters/ignore_loglevel.
 Documentation/admin-guide/kernel-parameters.txt-2328-
 --
 Documentation/admin-guide/kernel-parameters.txt-3652-	locktorture.stat_interval= [KNL]
 Documentation/admin-guide/kernel-parameters.txt:3653:			Time (s) between statistics printk()s.
 Documentation/admin-guide/kernel-parameters.txt-3654-
 --
 Documentation/admin-guide/kernel-parameters.txt-3665-	locktorture.verbose= [KNL]
 Documentation/admin-guide/kernel-parameters.txt:3666:			Enable additional printk() statements.
 Documentation/admin-guide/kernel-parameters.txt-3667-
 --
 Documentation/admin-guide/kernel-parameters.txt-3690-	log_buf_len=n[KMG] [KNL,EARLY]
 Documentation/admin-guide/kernel-parameters.txt:3691:			Sets the size of the printk ring buffer, in bytes.
 Documentation/admin-guide/kernel-parameters.txt-3692-			n must be a power of two and greater than the
 --
 Documentation/admin-guide/kernel-parameters.txt-4488-			To facilitate more flexible debugging, we also add
 Documentation/admin-guide/kernel-parameters.txt:4489:			console_suspend, a printk module parameter to control
 Documentation/admin-guide/kernel-parameters.txt-4490-			it. Users could use console_suspend (usually
 Documentation/admin-guide/kernel-parameters.txt:4491:			/sys/module/printk/parameters/console_suspend) to
 Documentation/admin-guide/kernel-parameters.txt-4492-			turn on/off it dynamically.
 --
 Documentation/admin-guide/kernel-parameters.txt-5488-
 Documentation/admin-guide/kernel-parameters.txt:5489:	printk.always_kmsg_dump=
 Documentation/admin-guide/kernel-parameters.txt-5490-			Trigger kmsg_dump for cases other than kernel oops or
 --
 Documentation/admin-guide/kernel-parameters.txt-5494-
 Documentation/admin-guide/kernel-parameters.txt:5495:	printk.console_no_auto_verbose=
 Documentation/admin-guide/kernel-parameters.txt-5496-			Disable console loglevel raise on oops, panic
 --
 Documentation/admin-guide/kernel-parameters.txt-5503-
 Documentation/admin-guide/kernel-parameters.txt:5504:	printk.debug_non_panic_cpus=
 Documentation/admin-guide/kernel-parameters.txt-5505-			Allows storing messages from non-panic CPUs into
 Documentation/admin-guide/kernel-parameters.txt:5506:			the printk log buffer during panic(). They are
 Documentation/admin-guide/kernel-parameters.txt-5507-			flushed to consoles by the panic-CPU on
 --
 Documentation/admin-guide/kernel-parameters.txt-5511-
 Documentation/admin-guide/kernel-parameters.txt:5512:	printk.devkmsg={on,off,ratelimit}
 Documentation/admin-guide/kernel-parameters.txt-5513-			Control writing to /dev/kmsg.
 --
 Documentation/admin-guide/kernel-parameters.txt-5518-
 Documentation/admin-guide/kernel-parameters.txt:5519:	printk.time=	Show timing data prefixed to each printk message line
 Documentation/admin-guide/kernel-parameters.txt-5520-			Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
 --
 Documentation/admin-guide/kernel-parameters.txt-5974-	rcuscale.verbose= [KNL]
 Documentation/admin-guide/kernel-parameters.txt:5975:			Enable additional printk() statements.
 Documentation/admin-guide/kernel-parameters.txt-5976-
 --
 Documentation/admin-guide/kernel-parameters.txt-6260-	rcutorture.stat_interval= [KNL]
 Documentation/admin-guide/kernel-parameters.txt:6261:			Time (s) between statistics printk()s.
 Documentation/admin-guide/kernel-parameters.txt-6262-
 --
 Documentation/admin-guide/kernel-parameters.txt-6292-	rcutorture.verbose= [KNL]
 Documentation/admin-guide/kernel-parameters.txt:6293:			Enable additional printk() statements.
 Documentation/admin-guide/kernel-parameters.txt-6294-
 --
 Documentation/admin-guide/kernel-parameters.txt-6569-	refscale.verbose= [KNL]
 Documentation/admin-guide/kernel-parameters.txt:6570:			Enable additional printk() statements.
 Documentation/admin-guide/kernel-parameters.txt-6571-
 Documentation/admin-guide/kernel-parameters.txt-6572-	refscale.verbose_batched= [KNL]
 Documentation/admin-guide/kernel-parameters.txt:6573:			Batch the additional printk() statements.  If zero
 Documentation/admin-guide/kernel-parameters.txt-6574-			(the default) or negative, print everything.  Otherwise,
 --
 Documentation/admin-guide/kernel-parameters.txt-6881-	scftorture.verbose= [KNL]
 Documentation/admin-guide/kernel-parameters.txt:6882:			Enable additional printk() statements.
 Documentation/admin-guide/kernel-parameters.txt-6883-
 --
 Documentation/admin-guide/kernel-parameters.txt-7631-	torture.verbose_sleep_frequency= [KNL]
 Documentation/admin-guide/kernel-parameters.txt:7632:			Specifies how many verbose printk()s should be
 Documentation/admin-guide/kernel-parameters.txt-7633-			emitted between each sleep.  The default of zero
 Documentation/admin-guide/kernel-parameters.txt:7634:			disables verbose-printk() sleeping.
 Documentation/admin-guide/kernel-parameters.txt-7635-
 Documentation/admin-guide/kernel-parameters.txt-7636-	torture.verbose_sleep_duration= [KNL]
 Documentation/admin-guide/kernel-parameters.txt:7637:			Duration of each verbose-printk() sleep in jiffies.
 Documentation/admin-guide/kernel-parameters.txt-7638-
 --
 Documentation/admin-guide/kernel-parameters.txt-7671-
 Documentation/admin-guide/kernel-parameters.txt:7672:	tp_printk	[FTRACE]
 Documentation/admin-guide/kernel-parameters.txt:7673:			Have the tracepoints sent to printk as well as the
 Documentation/admin-guide/kernel-parameters.txt-7674-			tracing ring buffer. This is useful for early boot up
 --
 Documentation/admin-guide/kernel-parameters.txt-7678-
 Documentation/admin-guide/kernel-parameters.txt:7679:			To turn off having tracepoints sent to printk,
 Documentation/admin-guide/kernel-parameters.txt:7680:			 echo 0 > /proc/sys/kernel/tracepoint_printk
 Documentation/admin-guide/kernel-parameters.txt-7681-			Note, echoing 1 into this file without the
 Documentation/admin-guide/kernel-parameters.txt:7682:			tp_printk kernel cmdline option has no effect.
 Documentation/admin-guide/kernel-parameters.txt-7683-
 Documentation/admin-guide/kernel-parameters.txt:7684:			The tp_printk_stop_on_boot (see below) can also be used
 Documentation/admin-guide/kernel-parameters.txt-7685-			to stop the printing of events to console at
 --
 Documentation/admin-guide/kernel-parameters.txt-7689-
 Documentation/admin-guide/kernel-parameters.txt:7690:			Having tracepoints sent to printk() and activating high
 Documentation/admin-guide/kernel-parameters.txt-7691-			frequency tracepoints such as irq or sched, can cause
 --
 Documentation/admin-guide/kernel-parameters.txt-7693-
 Documentation/admin-guide/kernel-parameters.txt:7694:	tp_printk_stop_on_boot [FTRACE]
 Documentation/admin-guide/kernel-parameters.txt:7695:			When tp_printk (above) is set, it can cause a lot of noise
 Documentation/admin-guide/kernel-parameters.txt-7696-			on the console. It may be useful to only include the
 --
 Documentation/admin-guide/kernel-parameters.txt-7767-			    traceoff	- Have the tracing instance tracing disabled after it is created.
 Documentation/admin-guide/kernel-parameters.txt:7768:			    traceprintk	- Have trace_printk() write into this trace instance
 Documentation/admin-guide/kernel-parameters.txt:7769:					  (note, "printk" and "trace_printk" can also be used)
 Documentation/admin-guide/kernel-parameters.txt-7770-
 Documentation/admin-guide/kernel-parameters.txt:7771:				trace_instance=foo^traceoff^traceprintk,sched,irq
 Documentation/admin-guide/kernel-parameters.txt-7772-
 --
 Documentation/admin-guide/kernel-parameters.txt-7801-
 Documentation/admin-guide/kernel-parameters.txt:7802:				reserve_mem=12M:4096:trace trace_instance=boot_map^traceoff^traceprintk@trace,sched,irq
 Documentation/admin-guide/kernel-parameters.txt-7803-
 --
 Documentation/admin-guide/media/visl.rst=29=Module parameters
 --
 Documentation/admin-guide/media/visl.rst-32-- visl_debug: Activates debug info, printing various debug messages through
 Documentation/admin-guide/media/visl.rst:33:  dprintk. Also controls whether per-frame debug info is shown. Defaults to off.
 Documentation/admin-guide/media/visl.rst-34-  Note that enabling this feature can result in slow performance through serial.
 --
 Documentation/admin-guide/media/visl.rst-38-
 Documentation/admin-guide/media/visl.rst:39:- visl_dprintk_frame_start, visl_dprintk_frame_nframes: Dictates a range of
 Documentation/admin-guide/media/visl.rst:40:  frames where dprintk is activated. This only controls the dprintk tracing on a
 Documentation/admin-guide/media/visl.rst-41-  per-frame basis. Note that printing a lot of data can be slow through serial.
 --
 Documentation/admin-guide/media/visl.rst-48-- bitstream_trace_frame_start, bitstream_trace_nframes: Similar to
 Documentation/admin-guide/media/visl.rst:49:  visl_dprintk_frame_start, visl_dprintk_nframes, but controls the dumping of
 Documentation/admin-guide/media/visl.rst-50-  buffer data through debugfs instead.
 --
 Documentation/admin-guide/pstore-blk.rst=146=the ``max_reason`` value, as defined in include/linux/kmsg_dump.h's
 --
 Documentation/admin-guide/pstore-blk.rst-150-(KMSG_DUMP_UNDEF), means the reason filtering will be controlled by the
 Documentation/admin-guide/pstore-blk.rst:151:``printk.always_kmsg_dump`` boot param: if unset, it'll be KMSG_DUMP_OOPS,
 Documentation/admin-guide/pstore-blk.rst-152-otherwise KMSG_DUMP_MAX.
 --
 Documentation/admin-guide/ramoops.rst=43=the ``max_reason`` value, as defined in include/linux/kmsg_dump.h's
 --
 Documentation/admin-guide/ramoops.rst-47-(KMSG_DUMP_UNDEF), means the reason filtering will be controlled by the
 Documentation/admin-guide/ramoops.rst:48:``printk.always_kmsg_dump`` boot param: if unset, it'll be KMSG_DUMP_OOPS,
 Documentation/admin-guide/ramoops.rst-49-otherwise KMSG_DUMP_MAX.
 --
 Documentation/admin-guide/ramoops.rst=62=Setting the ramoops parameters can be done in several different manners:
 --
 Documentation/admin-guide/ramoops.rst-118-  if (ret) {
 Documentation/admin-guide/ramoops.rst:119:	printk(KERN_ERR "unable to register platform device\n");
 Documentation/admin-guide/ramoops.rst-120-	return ret;
 --
 Documentation/admin-guide/sysctl/fs.rst=96=Attempts to allocate more file descriptors than ``file-max`` are
 Documentation/admin-guide/sysctl/fs.rst:97:reported with ``printk``, look for::
 Documentation/admin-guide/sysctl/fs.rst-98-
 --
 Documentation/admin-guide/sysctl/kernel.rst=1100=otherwise the 'doze' mode will be used.
 --
 Documentation/admin-guide/sysctl/kernel.rst-1104-
 Documentation/admin-guide/sysctl/kernel.rst:1105:printk
 Documentation/admin-guide/sysctl/kernel.rst-1106-======
 Documentation/admin-guide/sysctl/kernel.rst-1107-
 Documentation/admin-guide/sysctl/kernel.rst:1108:The four values in printk denote: ``console_loglevel``,
 Documentation/admin-guide/sysctl/kernel.rst-1109-``default_message_loglevel``, ``minimum_console_loglevel`` and
 --
 Documentation/admin-guide/sysctl/kernel.rst-1111-
 Documentation/admin-guide/sysctl/kernel.rst:1112:These values influence printk() behavior when printing or
 Documentation/admin-guide/sysctl/kernel.rst-1113-logging error messages. See '``man 2 syslog``' for more info on
 --
 Documentation/admin-guide/sysctl/kernel.rst=1123=default_console_loglevel default value for console_loglevel
 --
 Documentation/admin-guide/sysctl/kernel.rst-1126-
 Documentation/admin-guide/sysctl/kernel.rst:1127:printk_delay
 Documentation/admin-guide/sysctl/kernel.rst-1128-============
 Documentation/admin-guide/sysctl/kernel.rst-1129-
 Documentation/admin-guide/sysctl/kernel.rst:1130:Delay each printk message in ``printk_delay`` milliseconds
 Documentation/admin-guide/sysctl/kernel.rst-1131-
 Documentation/admin-guide/sysctl/kernel.rst=1132=Value from 0 - 10000 is allowed.
 --
 Documentation/admin-guide/sysctl/kernel.rst-1134-
 Documentation/admin-guide/sysctl/kernel.rst:1135:printk_ratelimit
 Documentation/admin-guide/sysctl/kernel.rst-1136-================
 Documentation/admin-guide/sysctl/kernel.rst-1137-
 Documentation/admin-guide/sysctl/kernel.rst:1138:Some warning messages are rate limited. ``printk_ratelimit`` specifies
 Documentation/admin-guide/sysctl/kernel.rst-1139-the minimum length of time between these messages (in seconds).
 --
 Documentation/admin-guide/sysctl/kernel.rst=1142=A value of 0 will disable rate limiting.
 --
 Documentation/admin-guide/sysctl/kernel.rst-1144-
 Documentation/admin-guide/sysctl/kernel.rst:1145:printk_ratelimit_burst
 Documentation/admin-guide/sysctl/kernel.rst-1146-======================
 Documentation/admin-guide/sysctl/kernel.rst-1147-
 Documentation/admin-guide/sysctl/kernel.rst:1148:While long term we enforce one message per `printk_ratelimit`_
 Documentation/admin-guide/sysctl/kernel.rst-1149-seconds, we do allow a burst of messages to pass through.
 Documentation/admin-guide/sysctl/kernel.rst:1150:``printk_ratelimit_burst`` specifies the number of messages we can
 Documentation/admin-guide/sysctl/kernel.rst:1151:send before ratelimiting kicks in.  After `printk_ratelimit`_ seconds
 Documentation/admin-guide/sysctl/kernel.rst-1152-have elapsed, another burst of messages may be sent.
 --
 Documentation/admin-guide/sysctl/kernel.rst=1154=The default value is 10 messages.
 --
 Documentation/admin-guide/sysctl/kernel.rst-1156-
 Documentation/admin-guide/sysctl/kernel.rst:1157:printk_devkmsg
 Documentation/admin-guide/sysctl/kernel.rst-1158-==============
 --
 Documentation/admin-guide/sysctl/kernel.rst=1165=off       logging to /dev/kmsg disabled
 --
 Documentation/admin-guide/sysctl/kernel.rst-1167-
 Documentation/admin-guide/sysctl/kernel.rst:1168:The kernel command line parameter ``printk.devkmsg=`` overrides this and is
 Documentation/admin-guide/sysctl/kernel.rst-1169-a one-time setting until next reboot: once set, it cannot be changed by
 --
 Documentation/admin-guide/sysctl/kernel.rst=1408=via the ``/proc/sys`` interface:
 --
 Documentation/admin-guide/sysctl/kernel.rst-1410-  ==   ======================================================================
 Documentation/admin-guide/sysctl/kernel.rst:1411:  -1   Legacy per-write sysctl value handling, with no printk warnings.
 Documentation/admin-guide/sysctl/kernel.rst-1412-       Each write syscall must fully contain the sysctl value to be
 --
 Documentation/admin-guide/sysctl/kernel.rst=1602=When set, disables tracing (see Documentation/trace/ftrace.rst) when a
 --
 Documentation/admin-guide/sysctl/kernel.rst-1605-
 Documentation/admin-guide/sysctl/kernel.rst:1606:tracepoint_printk
 Documentation/admin-guide/sysctl/kernel.rst-1607-=================
 Documentation/admin-guide/sysctl/kernel.rst-1608-
 Documentation/admin-guide/sysctl/kernel.rst:1609:When tracepoints are sent to printk() (enabled by the ``tp_printk``
 Documentation/admin-guide/sysctl/kernel.rst-1610-boot parameter), this entry provides runtime control::
 Documentation/admin-guide/sysctl/kernel.rst-1611-
 Documentation/admin-guide/sysctl/kernel.rst:1612:    echo 0 > /proc/sys/kernel/tracepoint_printk
 Documentation/admin-guide/sysctl/kernel.rst-1613-
 Documentation/admin-guide/sysctl/kernel.rst:1614:will stop tracepoints from being sent to printk(), and::
 Documentation/admin-guide/sysctl/kernel.rst-1615-
 Documentation/admin-guide/sysctl/kernel.rst:1616:    echo 1 > /proc/sys/kernel/tracepoint_printk
 Documentation/admin-guide/sysctl/kernel.rst-1617-
 Documentation/admin-guide/sysctl/kernel.rst:1618:will send them to printk() again.
 Documentation/admin-guide/sysctl/kernel.rst-1619-
 Documentation/admin-guide/sysctl/kernel.rst:1620:This only works if the kernel was booted with ``tp_printk`` enabled.
 Documentation/admin-guide/sysctl/kernel.rst-1621-
 --
 Documentation/admin-guide/sysrq.rst=214=frozen (probably root) filesystem via the FIFREEZE ioctl.
 --
 Documentation/admin-guide/sysrq.rst-216-``Replay logs(R)`` is useful to view the kernel log messages when system is hung
 Documentation/admin-guide/sysrq.rst:217:or you are not able to use dmesg command to view the messages in printk buffer.
 Documentation/admin-guide/sysrq.rst-218-User may have to press the key combination multiple times if console system is
 --
 Documentation/arch/arm/tcm.rst=104=Example code::
 --
 Documentation/arch/arm/tcm.rst-137-	hello_tcm();
 Documentation/arch/arm/tcm.rst:138:	printk("Hello TCM executed from ITCM RAM\n");
 Documentation/arch/arm/tcm.rst-139-
 Documentation/arch/arm/tcm.rst:140:	printk("TCM variable from testrun: %u @ %p\n", tcmvar, &tcmvar);
 Documentation/arch/arm/tcm.rst-141-	tcmvar = 0xDEADBEEFU;
 Documentation/arch/arm/tcm.rst:142:	printk("TCM variable: 0x%x @ %p\n", tcmvar, &tcmvar);
 Documentation/arch/arm/tcm.rst-143-
 Documentation/arch/arm/tcm.rst:144:	printk("TCM assigned variable: 0x%x @ %p\n", tcmassigned, &tcmassigned);
 Documentation/arch/arm/tcm.rst-145-
 Documentation/arch/arm/tcm.rst:146:	printk("TCM constant: 0x%x @ %p\n", tcmconst, &tcmconst);
 Documentation/arch/arm/tcm.rst-147-
 --
 Documentation/arch/arm/tcm.rst-150-	if (tcmem) {
 Documentation/arch/arm/tcm.rst:151:		printk("TCM Allocated 20 bytes of TCM @ %p\n", tcmem);
 Documentation/arch/arm/tcm.rst-152-		tcmem[0] = 0xDEADBEEFU;
 --
 Documentation/arch/arm/tcm.rst-157-		for (i = 0; i < 5; i++)
 Documentation/arch/arm/tcm.rst:158:			printk("TCM tcmem[%d] = %08x\n", i, tcmem[i]);
 Documentation/arch/arm/tcm.rst-159-		tcm_free(tcmem, 20);
 --
 Documentation/arch/x86/earlyprintk.rst=4=Early Printk
 --
 Documentation/arch/x86/earlyprintk.rst-6-
 Documentation/arch/x86/earlyprintk.rst:7:Mini-HOWTO for using the earlyprintk=dbgp boot option with a
 Documentation/arch/x86/earlyprintk.rst-8-USB2 Debug port key and a debug cable, on x86 systems.
 --
 Documentation/arch/x86/earlyprintk.rst=15=Hardware requirements
 --
 Documentation/arch/x86/earlyprintk.rst-58-     The EHCI debug controller is bound to a specific physical USB
 Documentation/arch/x86/earlyprintk.rst:59:     port and the NetChip device will only work as an early printk
 Documentation/arch/x86/earlyprintk.rst-60-     device in this port.  The EHCI host controllers are electrically
 --
 Documentation/arch/x86/earlyprintk.rst=81=Software requirements
 --
 Documentation/arch/x86/earlyprintk.rst-89-
 Documentation/arch/x86/earlyprintk.rst:90:    And you need to add the boot command line: "earlyprintk=dbgp".
 Documentation/arch/x86/earlyprintk.rst-91-
 --
 Documentation/arch/x86/earlyprintk.rst-104-    controller.  To use the second EHCI debug controller, you would
 Documentation/arch/x86/earlyprintk.rst:105:    use the command line: "earlyprintk=dbgp1"
 Documentation/arch/x86/earlyprintk.rst-106-
 Documentation/arch/x86/earlyprintk.rst-107-    .. note::
 Documentation/arch/x86/earlyprintk.rst:108:      normally earlyprintk console gets turned off once the
 Documentation/arch/x86/earlyprintk.rst:109:      regular console is alive - use "earlyprintk=dbgp,keep" to keep
 Documentation/arch/x86/earlyprintk.rst-110-      this channel open beyond early bootup. This can be useful for
 --
 Documentation/arch/x86/earlyprintk.rst=130=Testing
 --
 Documentation/arch/x86/earlyprintk.rst-132-
 Documentation/arch/x86/earlyprintk.rst:133:You can test the output by using earlyprintk=dbgp,keep and provoking
 Documentation/arch/x86/earlyprintk.rst-134-kernel messages on the host/target system. You can provoke a harmless
 --
 Documentation/arch/x86/index.rst=4=x86-specific Documentation
 --
 Documentation/arch/x86/index.rst-17-   entry_64
 Documentation/arch/x86/index.rst:18:   earlyprintk
 Documentation/arch/x86/index.rst-19-   orc-unwinder
 --
 Documentation/bpf/cpumasks.rst=49=For example:
 --
 Documentation/bpf/cpumasks.rst-105-                if (!bpf_cpumask_full(task->cpus_ptr))
 Documentation/bpf/cpumasks.rst:106:                        bpf_printk("task %s has CPU affinity", task->comm);
 Documentation/bpf/cpumasks.rst-107-
 --
 Documentation/bpf/cpumasks.rst=217=follows:
 --
 Documentation/bpf/cpumasks.rst-244-                if (bpf_cpumask_test_cpu(0, task->cpus_ptr))
 Documentation/bpf/cpumasks.rst:245:                        bpf_printk("task %s can use CPU %d", task->comm, 0);
 Documentation/bpf/cpumasks.rst-246-
 --
 Documentation/bpf/kfuncs.rst=603=embedded in a map value without having to acquire a reference:
 --
 Documentation/bpf/kfuncs.rst-626-			 */
 Documentation/bpf/kfuncs.rst:627:			bpf_printk("Global task %s is valid", local_copy->comm);
 Documentation/bpf/kfuncs.rst-628-		else
 Documentation/bpf/kfuncs.rst:629:			bpf_printk("No global task found");
 Documentation/bpf/kfuncs.rst-630-		bpf_rcu_read_unlock();
 --
 Documentation/bpf/kfuncs.rst=704=the verifier. bpf_cgroup_ancestor() can be used as follows:
 --
 Documentation/bpf/kfuncs.rst-721-
 Documentation/bpf/kfuncs.rst:722:		bpf_printk("Parent id is %d", parent->self.id);
 Documentation/bpf/kfuncs.rst-723-
 --
 Documentation/core-api/cpu_hotplug.rst=631=All registered states are enumerated in ``/sys/devices/system/cpu/hotplug/states`` ::
 --
 Documentation/core-api/cpu_hotplug.rst-640- 144: x86/mce:online
 Documentation/core-api/cpu_hotplug.rst:641: 145: printk:online
 Documentation/core-api/cpu_hotplug.rst-642- 168: sched:active
 --
 Documentation/core-api/debug-objects.rst=56=Each detected error is reported in the statistics and a limited number
 Documentation/core-api/debug-objects.rst:57:of errors are printk'ed including a full stack trace.
 Documentation/core-api/debug-objects.rst-58-
 --
 Documentation/core-api/debug-objects.rst=85=on the callers stack. If it is on the callers stack then a limited
 Documentation/core-api/debug-objects.rst:86:number of warnings including a full stack trace is printk'ed. The
 Documentation/core-api/debug-objects.rst-87-calling code must use debug_object_init_on_stack() and remove the
 --
 Documentation/core-api/debugging-via-ohci1394.rst=19=With that, it is possible to debug issues by reading interesting memory
 Documentation/core-api/debugging-via-ohci1394.rst:20:locations such as buffers like the printk buffer or the process table.
 Documentation/core-api/debugging-via-ohci1394.rst-21-
 --
 Documentation/core-api/debugging-via-ohci1394.rst=34=Together with a early initialization of the OHCI-1394 controller for debugging,
 Documentation/core-api/debugging-via-ohci1394.rst:35:this facility proved most useful for examining long debugs logs in the printk
 Documentation/core-api/debugging-via-ohci1394.rst-36-buffer on to debug early boot problems in areas like ACPI where the system
 --
 Documentation/core-api/debugging-via-ohci1394.rst=49=implemented for x86.  This routine runs long before console_init() can be
 Documentation/core-api/debugging-via-ohci1394.rst:50:called, i.e. before the printk buffer appears on the console.
 Documentation/core-api/debugging-via-ohci1394.rst-51-
 --
 Documentation/core-api/debugging-via-ohci1394.rst=60=it from PowerPC to x86 and x86_64 and added functionality, firescope can now
 Documentation/core-api/debugging-via-ohci1394.rst:61:be used to view the printk buffer of a remote machine, even with live update.
 Documentation/core-api/debugging-via-ohci1394.rst-62-
 --
 Documentation/core-api/debugging-via-ohci1394.rst=89=Step-by-step instructions for using firescope with early OHCI initialization:
 --
 Documentation/core-api/debugging-via-ohci1394.rst-159-
 Documentation/core-api/debugging-via-ohci1394.rst:160:5) Retrieving the printk buffer contents:
]
]

gemini-3-pro-preview

							input: 184294
							output: 234
							thoughts: 1372
						

**Unraveling the Console Lock Hang**

Okay, let's break this down. My initial thought was, could I leverage `bpf` to cause a `printk` flood? I was thinking about how `bpf_trace_printk` writes to the trace buffer, and whether that indirectly hits `dmesg`. I realized it's dependent on `tracepoint_printk` being enabled. Then I explored alternatives: could I trigger `syslog` with console actions, or directly write to `/dev/kmsg` using `write`? Nope, and the `openat` approach failed due to filename restrictions. I even considered `syz_open_dev$kmsg` and `openat$sysfs`, but they were dead ends. Finally, I tried `openat$ttyprintk`, but it didn't trigger anything conclusive, maybe due to kernel config.

So, back to the bug report. I see a task blocked for a long time. The key is, I need to figure out who's holding the `console_lock`. If the blocked task isn't the one holding the lock, then the lock-holder must be running, but spinning. I realized this is very likely a consequence of printk flooding, because it's the `console_unlock` that gets stuck when the flood occurs. But how could syzkaller be doing this? Perhaps by triggering warnings? But syzkaller filters out warnings like `WARNING:` and `INFO:`. The absence of such warnings in the bug title is a crucial clue.

If there were no warnings, what is it that might have caused the printk flooding? Maybe something that generates a lot of normal printk messages in a loop? I brainstormed some examples: `loop0` capacity changes, network interface events, or USB device events. Wait, syzkaller does a lot of USB fuzzing! I think I've got it - if it connects and disconnects USB devices in a tight loop, it would generate a huge amount of printk messages. Just look at those:

```
[  123.456] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[  123.457] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00
[  123.458] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  123.459] usb 1-1: USB disconnect, device number 2
```

If these messages happen rapidly enough, the `printk` buffer fills up, `console_unlock` gets stuck, and the bug report makes sense. This is very likely the root cause!

The reproducer should be straightforward - just use `syz_usb_connect` and `syz_usb_disconnect` in a loop! I should also try opening `/dev/tty1` to confirm the hang. Let's write that up and see.

map[ReproSyz:r0 = syz_usb_connect(0x0, 0x0, 0x0, 0x0) (async)
syz_usb_disconnect(r0) (async)
r1 = syz_usb_connect(0x0, 0x0, 0x0, 0x0) (async)
syz_usb_disconnect(r1) (async)
r2 = syz_usb_connect(0x0, 0x0, 0x0, 0x0) (async)
syz_usb_disconnect(r2) (async)
r3 = syz_usb_connect(0x0, 0x0, 0x0, 0x0) (async)
syz_usb_disconnect(r3) (async)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 186591
							output: 524
							thoughts: 150
						

**Debugging a Potential Kernel Crash**

Okay, so the program didn't crash this time. That's good, but it means I need to refine my understanding of the likely exploit vector. I suspect that `syz_usb_connect` might have some timing-related aspect, perhaps it needs a certain period to be active before it can trigger the vulnerability, so maybe it's not flooding the system fast enough. I need to find other methods to flood `printk`. Hmmm, what else is commonly used? Wait a minute, what about `ioctl(TUNSETIFF)`? I know that prints out that device information string initially, but it only happens once. That's not what I'm looking for. Okay, think, think, think... I've got it! What about `ioctl(SIOCSIFFLAGS)`? Specifically, manipulating the flags to set and clear promiscuous mode. I've seen that flood `printk` before! Remember those messages I saw in the logs:

```
[  123.456] device eth0 entered promiscuous mode
[  123.457] device eth0 left promiscuous mode
```

This should print quite frequently! Alright, let's try it and see if we can get a crash. I'll test it out!

unknown syscall ioctl$sock_SIOCSIFFLAGS

map[ReproSyz:r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x100}) (async)
ioctl$sock_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x0}) (async)
ioctl$sock_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x100}) (async)
ioctl$sock_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x0}) (async)
ioctl$sock_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x100}) (async)
ioctl$sock_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x0}) (async)
ioctl$sock_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x100}) (async)
ioctl$sock_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x0}) (async)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 187570
							output: 508
							thoughts: 14
						

Okay, here's the summary, expressed as though I'm the one thinking it:

**Decoding the `ioctl` Call**

Right, so I'm looking at this code and it's hitting an `ioctl` call. Okay, that's fine, `ioctl` is the catch-all for device-specific operations. Gotta figure out *which* operation it's doing. Hmmm, the arguments... and then it hits me! It's calling `ioctl` with the specific code `SIOCSIFFLAGS`. Aha! That immediately narrows things down. That's how we manipulate network interface flags. This is setting or clearing interface flags; probably something like up/down status, promiscuous mode, multicast... gotta delve further to see which flags, but at least I know the general direction the code is taking.

unknown syscall ioctl$SIOCSIFFLAGS

map[ReproSyz:r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x100}) (async)
ioctl$SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x0}) (async)
ioctl$SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x100}) (async)
ioctl$SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x0}) (async)
ioctl$SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x100}) (async)
ioctl$SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x0}) (async)
ioctl$SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x100}) (async)
ioctl$SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', 0x0}) (async)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 188291
							output: 18
							thoughts: 26
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Investigating `ioctl$sock_SIOCSIFFLAGS` Location**

Okay, so I'm thinking about where to find the definition for `ioctl$sock_SIOCSIFFLAGS`. Hmm, my initial hunch is that it's related to sockets, and therefore, it *should* be defined or at least documented within a file that has to do with socket programming in the kernel. Let's make sure it's *actually* in `socket.txt`.  A quick verification is necessary; it's a common area, but double-checking is prudent before assuming.

map[File:socket.txt]

map[Output:# Copyright 2017 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <asm/ioctls.h>
include <linux/if_tun.h>
include <linux/if_bridge.h>
include <linux/net.h>
include <linux/net_tstamp.h>
include <linux/route.h>
include <linux/socket.h>
include <uapi/linux/in.h>
include <uapi/linux/ethtool.h>
include <uapi/linux/if_ether.h>
include <uapi/linux/if_vlan.h>
include <uapi/asm-generic/socket.h>

resource sock[fd]
type sock_port int16be[20000:20004]

# TODO: describe socketcall syscall

socket(domain flags[socket_domain], type flags[socket_type], proto int32) sock (automatic_helper)
socketpair(domain flags[socket_domain], type flags[socket_type], proto int32, fds ptr[out, sock_pair])
bind(fd sock, addr ptr[in, sockaddr_storage], addrlen len[addr])
connect(fd sock, addr ptr[in, sockaddr_storage], addrlen len[addr])
accept(fd sock, peer ptr[out, sockaddr_storage, opt], peerlen ptr[inout, len[peer, int32]]) sock
accept4(fd sock, peer ptr[out, sockaddr_storage, opt], peerlen ptr[inout, len[peer, int32]], flags flags[accept_flags]) sock
sendto(fd sock, buf buffer[in], len len[buf], f flags[send_flags], addr ptr[in, sockaddr_storage, opt], addrlen len[addr])
recvfrom(fd sock, buf buffer[out], len len[buf], f flags[recv_flags], addr ptr[in, sockaddr_storage, opt], addrlen len[addr])
getsockname(fd sock, addr ptr[out, sockaddr_storage], addrlen ptr[inout, len[addr, int32]])
getpeername(fd sock, peer ptr[out, sockaddr_storage], peerlen ptr[inout, len[peer, int32]])

sendmsg(fd sock, msg ptr[in, send_msghdr], f flags[send_flags])
sendmmsg(fd sock, mmsg ptr[in, array[send_mmsghdr]], vlen len[mmsg], f flags[send_flags])
recvmsg(fd sock, msg ptr[inout, recv_msghdr], f flags[recv_flags])
recvmmsg(fd sock, mmsg ptr[in, array[recv_mmsghdr]], vlen len[mmsg], f flags[recv_flags], timeout ptr[in, timespec, opt])

listen(fd sock, backlog int32)
shutdown(fd sock, how flags[shutdown_flags])

getsockopt(fd sock, level int32, optname int32, optval buffer[out], optlen ptr[inout, len[optval, int32]])
setsockopt(fd sock, level int32, optname int32, optval buffer[in], optlen len[optval])

socket_domain = AF_UNIX, AF_INET, AF_INET6, AF_NETLINK, AF_X25, AF_AX25, AF_ATMPVC, AF_APPLETALK, AF_PACKET, AF_VSOCK, AF_XDP, AF_TIPC, AF_RXRPC, AF_PPPOX, AF_RDS, AF_ROSE, AF_PHONET, AF_NFC, AF_NETROM, AF_KEY, AF_KCM, AF_ISDN, AF_SMC, AF_CAN, AF_CAIF, AF_BLUETOOTH, AF_LLC, AF_ALG, AF_QIPCRTR
socket_type = SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_RDM, SOCK_SEQPACKET, SOCK_DCCP, SOCK_PACKET, SOCK_NONBLOCK, SOCK_CLOEXEC
accept_flags = SOCK_NONBLOCK, SOCK_CLOEXEC
shutdown_flags = SHUT_RD, SHUT_WR
send_flags = MSG_CONFIRM, MSG_DONTROUTE, MSG_DONTWAIT, MSG_EOR, MSG_MORE, MSG_NOSIGNAL, MSG_OOB, MSG_PROBE, MSG_BATCH, MSG_FASTOPEN, MSG_ZEROCOPY
recv_flags = MSG_CMSG_CLOEXEC, MSG_DONTWAIT, MSG_ERRQUEUE, MSG_OOB, MSG_PEEK, MSG_TRUNC, MSG_WAITALL, MSG_WAITFORONE
cmsg_levels = SOL_SOCKET, IPPROTO_ICMP, SOL_IP, SOL_TCP, SOL_UDP, SOL_IPV6, SOL_ICMPV6, SOL_SCTP, SOL_UDPLITE, SOL_RAW, SOL_AX25, SOL_ATALK, SOL_NETROM, SOL_ROSE, SOL_PACKET, SOL_ATM, SOL_AAL, SOL_IRDA, SOL_NETBEUI, SOL_LLC, SOL_DCCP, SOL_NETLINK, SOL_TIPC, SOL_RXRPC, SOL_PPPOL2TP, SOL_BLUETOOTH, SOL_PNPIPE, SOL_RDS, SOL_IUCV, SOL_CAIF, SOL_ALG, SOL_NFC, SOL_KCM

sock_pair {
	fd0	sock
	fd1	sock
}

# This sockaddr type corresponds to the struct sockaddr and is 16 bytes or less.
# TODO: add AF_APPLETALK, AF_ATMPVC, AF_ROSE, AF_ATMSVC, AF_IRDA, AF_IB, AF_IUCV
# Note: AF_UNIX, AF_INET6, AF_PACKET, AF_ALG, AF_PPPOX sockaddr is bigger than 16 bytes
# Note: AF_NETROM sockaddr is the same as AF_AX25
sockaddr [
	in		sockaddr_in
	ax25		sockaddr_ax25
	nl		sockaddr_nl
	llc		sockaddr_llc
	can		sockaddr_can
	sco		sockaddr_sco
	l2		sockaddr_l2
	hci		sockaddr_hci
	rc		sockaddr_rc
	nfc		sockaddr_nfc
	vsock		sockaddr_vm
	xdp		sockaddr_xdp
	tipc		sockaddr_tipc
	isdn		sockaddr_mISDN
	l2tp		sockaddr_l2tpip
	phonet		sockaddr_pn
	ethernet	sockaddr_ethernet
	qipcrtr		sockaddr_qrtr
	generic		sockaddr_generic
] [size[SOCKADDR_SIZE]]

# This sockaddr type corresponds to the sockaddr_storage type and is 128 bytes size.
sockaddr_storage [
	un		sockaddr_un
	in		sockaddr_in
	x25		sockaddr_x25
	ax25		full_sockaddr_ax25
	in6		sockaddr_in6
	nl		sockaddr_nl
	ll		sockaddr_ll
	pppoe		sockaddr_pppoe
	pppol2tp	sockaddr_pppol2tp
	pppol2tpin6	sockaddr_pppol2tpin6
	pppol2tpv3	sockaddr_pppol2tpv3
	pppol2tpv3in6	sockaddr_pppol2tpv3in6
	pptp		sockaddr_pptp
	l2tp		sockaddr_l2tpip
	l2tp6		sockaddr_l2tpip6
	llc		sockaddr_llc
	can		sockaddr_can
	sco		sockaddr_sco
	l2		sockaddr_l2
	hci		sockaddr_hci
	rc		sockaddr_rc
	alg		sockaddr_alg
	nfc		sockaddr_nfc
	nfc_llcp	sockaddr_nfc_llcp
	vsock		sockaddr_vm
	xdp		sockaddr_xdp
	tipc		sockaddr_tipc
	caif		sockaddr_caif
	isdn		sockaddr_mISDN
	rxrpc		sockaddr_rxrpc
	phonet		sockaddr_pn
	ethernet	sockaddr_ethernet
	qipcrtr		sockaddr_qrtr
	ieee802154	sockaddr_ieee802154
	generic		sockaddr_storage_generic
] [size[SOCKADDR_STORAGE_SIZE]]

define SOCKADDR_SIZE	sizeof(struct sockaddr)
define SOCKADDR_STORAGE_SIZE	sizeof(struct sockaddr_storage)

sockaddr_generic {
	sa_family	flags[socket_domain, int16]
	sa_data		array[int8, 14]
}

sockaddr_storage_generic {
	sa_family	flags[socket_domain, int16]
	sa_data		array[int8, 126]
}

send_msghdr {
	msg_name	ptr[in, sockaddr_storage, opt]
	msg_namelen	len[msg_name, int32]
	msg_iov		ptr[in, array[iovec_in]]
	msg_iovlen	len[msg_iov, intptr]
	msg_control	ptr[in, array[cmsghdr], opt]
	msg_controllen	bytesize[msg_control, intptr]
	msg_flags	const[0, int32]
}

msghdr_sock {
	msg_name	ptr[in, sockaddr_storage, opt]
	msg_namelen	len[msg_name, int32]
	msg_iov		ptr[in, array[iovec_in]]
	msg_iovlen	len[msg_iov, intptr]
	msg_control	ptr[in, array[cmsghdr_sock], opt]
	msg_controllen	bytesize[msg_control, intptr]
	msg_flags	const[0, int32]
}

send_mmsghdr {
	msg_hdr	send_msghdr
	msg_len	const[0, int32]
}

mmsghdr_sock {
	msg_hdr	msghdr_sock
	msg_len	const[0, int32]
}

recv_msghdr {
	msg_name	ptr[out, sockaddr_storage, opt]
	msg_namelen	len[msg_name, int32]
	msg_iov		ptr[in, array[iovec_out]]
	msg_iovlen	len[msg_iov, intptr]
	msg_control	ptr[out, array[int8], opt]
	msg_controllen	bytesize[msg_control, intptr]
	msg_flags	const[0, int32]
}

recv_mmsghdr {
	msg_hdr	recv_msghdr
	msg_len	int32
}

cmsghdr {
	cmsg_len	len[parent, intptr]
	cmsg_level	flags[cmsg_levels, int32]
	cmsg_type	int32
	data		array[int8]
} [align[PTR_SIZE]]

type cmsghdr_t[SOL, TYP, DATA] {
	unaligned	cmsghdr_unaligned[SOL, TYP, DATA]
} [align[PTR_SIZE]]

type cmsghdr_unaligned[SOL, TYP, DATA] {
	cmsg_len	len[parent, intptr]
	cmsg_level	const[SOL, int32]
	cmsg_type	const[TYP, int32]
	data		DATA
} [packed]

# For __sock_cmsg_send
cmsghdr_sock [
	mark		cmsghdr_t[SOL_SOCKET, SO_MARK, int32]
	timestamping	cmsghdr_t[SOL_SOCKET, SO_TIMESTAMPING_OLD, int32]
	txtime		cmsghdr_t[SOL_SOCKET, SCM_TXTIME, int64]
] [varlen]

# Socket options

# http://lxr.free-electrons.com/source/include/uapi/asm-generic/socket.h

setsockopt$sock_void(fd sock, level const[SOL_SOCKET], optname flags[sockopt_opt_sock_void], optval const[0], optlen const[0])
getsockopt$sock_int(fd sock, level const[SOL_SOCKET], optname flags[sockopt_opt_sock_int], optval ptr[out, int32], optlen ptr[inout, len[optval, int32]])
setsockopt$sock_int(fd sock, level const[SOL_SOCKET], optname flags[sockopt_opt_sock_int], optval ptr[in, int32], optlen len[optval])
getsockopt$sock_linger(fd sock, level const[SOL_SOCKET], optname const[SO_LINGER], optval ptr[out, linger], optlen ptr[inout, len[optval, int32]])
setsockopt$sock_linger(fd sock, level const[SOL_SOCKET], optname const[SO_LINGER], optval ptr[in, linger], optlen len[optval])
getsockopt$sock_cred(fd sock, level const[SOL_SOCKET], optname const[SO_PEERCRED], optval ptr[out, ucred], optlen ptr[inout, len[optval, int32]])
setsockopt$sock_cred(fd sock, level const[SOL_SOCKET], optname const[SO_PEERCRED], optval ptr[in, ucred], optlen len[optval])
getsockopt$sock_timeval(fd sock, level const[SOL_SOCKET], optname flags[sockopt_opt_sock_timeval], optval ptr[out, timeval], optlen ptr[inout, len[optval, int32]])
setsockopt$sock_timeval(fd sock, level const[SOL_SOCKET], optname flags[sockopt_opt_sock_timeval], optval ptr[in, timeval], optlen len[optval])
setsockopt$sock_attach_bpf(fd sock, level const[SOL_SOCKET], optname const[SO_ATTACH_BPF], optval ptr[in, fd_bpf_prog], optlen len[optval])
setsockopt$SO_TIMESTAMP(fd sock, level const[SOL_SOCKET], optname flags[sockopt_opt_sock_timestamp], optval ptr[in, int32], optlen len[optval])
getsockopt$SO_TIMESTAMP(fd sock, level const[SOL_SOCKET], optname flags[sockopt_opt_sock_timestamp], optval ptr[out, int32], optlen ptr[inout, len[optval, int32]])
setsockopt$SO_TIMESTAMPING(fd sock, level const[SOL_SOCKET], optname flags[sockopt_opt_sock_timestamping], optval ptr[in, flags[sockopt_so_timestamping, int32]], optlen len[optval])
getsockopt$SO_TIMESTAMPING(fd sock, level const[SOL_SOCKET], optname flags[sockopt_opt_sock_timestamping], optval ptr[out, int32], optlen ptr[inout, len[optval, int32]])
setsockopt$SO_ATTACH_FILTER(fd sock, level const[SOL_SOCKET], optname const[SO_ATTACH_FILTER], optval ptr[in, sock_fprog], optlen len[optval])
setsockopt$SO_BINDTODEVICE(fd sock, level const[SOL_SOCKET], optname const[SO_BINDTODEVICE], optval ptr[in, devname], optlen len[optval])
getsockopt$SO_BINDTODEVICE(fd sock, level const[SOL_SOCKET], optname const[SO_BINDTODEVICE], optval ptr[out, devname], optlen len[optval])
getsockopt$sock_buf(fd sock, level const[SOL_SOCKET], optname flags[sockopt_opt_sock_buf], optval buffer[out], optlen ptr[inout, len[optval, int32]])
getsockopt$SO_COOKIE(fd sock, level const[SOL_SOCKET], optname const[SO_COOKIE], optval ptr[out, int64], optlen ptr[inout, len[optval, int32]])

linger {
	onoff	bool32
	linger	int32
}

sockopt_opt_sock_void = SO_DETACH_FILTER, SO_MARK
sockopt_opt_sock_int = SO_ACCEPTCONN, SO_BROADCAST, SO_DEBUG, SO_DOMAIN, SO_ERROR, SO_DONTROUTE, SO_KEEPALIVE, SO_PEEK_OFF, SO_PRIORITY, SO_PROTOCOL, SO_RCVBUF, SO_RCVBUFFORCE, SO_RCVLOWAT, SO_SNDLOWAT, SO_REUSEADDR, SO_SNDBUF, SO_SNDBUFFORCE, SO_TIMESTAMP_OLD, SO_TYPE, SO_REUSEPORT, SO_OOBINLINE, SO_NO_CHECK, SO_PASSCRED, SO_TIMESTAMPNS_OLD, SO_LOCK_FILTER, SO_PASSSEC, SO_RXQ_OVFL, SO_WIFI_STATUS, SO_NOFCS, SO_SELECT_ERR_QUEUE, SO_BUSY_POLL, SO_MAX_PACING_RATE, SO_ZEROCOPY
sockopt_opt_sock_timeval = SO_RCVTIMEO_OLD, SO_RCVTIMEO_NEW, SO_SNDTIMEO_OLD, SO_SNDTIMEO_NEW
sockopt_opt_sock_timestamp = SO_TIMESTAMP_OLD, SO_TIMESTAMP_NEW, SO_TIMESTAMPNS_OLD, SO_TIMESTAMPNS_NEW
sockopt_opt_sock_timestamping = SO_TIMESTAMPING_OLD, SO_TIMESTAMPING_NEW
sockopt_opt_sock_buf = SO_PEERNAME, SO_PEERSEC, SO_GET_FILTER, SO_MEMINFO, SO_PEERGROUPS, SO_TXTIME
sockopt_so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE, SOF_TIMESTAMPING_TX_SOFTWARE, SOF_TIMESTAMPING_RX_HARDWARE, SOF_TIMESTAMPING_RX_SOFTWARE, SOF_TIMESTAMPING_SOFTWARE, SOF_TIMESTAMPING_SYS_HARDWARE, SOF_TIMESTAMPING_RAW_HARDWARE, SOF_TIMESTAMPING_OPT_ID, SOF_TIMESTAMPING_TX_SCHED, SOF_TIMESTAMPING_TX_ACK, SOF_TIMESTAMPING_OPT_CMSG, SOF_TIMESTAMPING_OPT_TSONLY, SOF_TIMESTAMPING_OPT_STATS, SOF_TIMESTAMPING_OPT_PKTINFO, SOF_TIMESTAMPING_OPT_TX_SWHW

# Socket ioctls

# Since some socket ioctls are forwarded to the network device, adding device ioctls here as well.

# http://lxr.free-electrons.com/linux/latest/source/include/uapi/linux/sockios.h

# http://lxr.free-electrons.com/linux/latest/source/include/uapi/asm-generic/sockios.h

ioctl$sock_SIOCADDRT(fd sock, cmd const[SIOCADDRT], arg ptr[inout, rtentry])
ioctl$sock_SIOCDELRT(fd sock, cmd const[SIOCDELRT], arg ptr[inout, rtentry])

ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(fd sock, cmd const[SIOCGIFVLAN], arg ptr[in, vlan_args[SET_VLAN_INGRESS_PRIORITY_CMD, int32]])
ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(fd sock, cmd const[SIOCGIFVLAN], arg ptr[in, vlan_args[SET_VLAN_EGRESS_PRIORITY_CMD, int32]])
ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(fd sock, cmd const[SIOCGIFVLAN], arg ptr[in, vlan_args[SET_VLAN_FLAG_CMD, int32]])
ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(fd sock, cmd const[SIOCGIFVLAN], arg ptr[in, vlan_args[SET_VLAN_NAME_TYPE_CMD, int32]])
ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(fd sock, cmd const[SIOCGIFVLAN], arg ptr[in, vlan_args[ADD_VLAN_CMD, int32[0:4]]])
ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(fd sock, cmd const[SIOCGIFVLAN], arg ptr[in, vlan_args[DEL_VLAN_CMD, const[0, int32]]])
ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(fd sock, cmd const[SIOCGIFVLAN], arg ptr[inout, vlan_args[GET_VLAN_REALDEV_NAME_CMD, string[devnames, 24]]])
ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(fd sock, cmd const[SIOCGIFVLAN], arg ptr[out, vlan_args[GET_VLAN_VID_CMD, int32]])
ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(fd sock, cmd const[SIOCGIFVLAN], arg ptr[out, vlan_args[GET_VLAN_INGRESS_PRIORITY_CMD, const[0, int32]]])
ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(fd sock, cmd const[SIOCGIFVLAN], arg ptr[out, vlan_args[GET_VLAN_EGRESS_PRIORITY_CMD, const[0, int32]]])

ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(fd sock, cmd const[SIOCSIFVLAN], arg ptr[in, vlan_args[SET_VLAN_INGRESS_PRIORITY_CMD, int32]])
ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(fd sock, cmd const[SIOCSIFVLAN], arg ptr[in, vlan_args[SET_VLAN_EGRESS_PRIORITY_CMD, int32]])
ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(fd sock, cmd const[SIOCSIFVLAN], arg ptr[in, vlan_args[SET_VLAN_FLAG_CMD, int32]])
ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(fd sock, cmd const[SIOCSIFVLAN], arg ptr[in, vlan_args[SET_VLAN_NAME_TYPE_CMD, int32]])
ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(fd sock, cmd const[SIOCSIFVLAN], arg ptr[in, vlan_args[ADD_VLAN_CMD, int32[0:4]]])
ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(fd sock, cmd const[SIOCSIFVLAN], arg ptr[in, vlan_args[DEL_VLAN_CMD, const[0, int32]]])
ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(fd sock, cmd const[SIOCSIFVLAN], arg ptr[inout, vlan_args[GET_VLAN_REALDEV_NAME_CMD, string[devnames, 24]]])
ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(fd sock, cmd const[SIOCSIFVLAN], arg ptr[out, vlan_args[GET_VLAN_VID_CMD, int32]])
ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(fd sock, cmd const[SIOCSIFVLAN], arg ptr[out, vlan_args[GET_VLAN_INGRESS_PRIORITY_CMD, const[0, int32]]])
ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(fd sock, cmd const[SIOCSIFVLAN], arg ptr[out, vlan_args[GET_VLAN_EGRESS_PRIORITY_CMD, const[0, int32]]])

ioctl$sock_SIOCETHTOOL(fd sock, cmd const[SIOCETHTOOL], arg ptr[inout, ifreq_t[ptr[inout, ethtool_cmd_u]]])

ioctl$sock_SIOCOUTQ(fd sock, cmd const[SIOCOUTQ], arg ptr[out, int32])
ioctl$sock_SIOCINQ(fd sock, cmd const[SIOCINQ], arg ptr[out, int32])

ioctl$sock_SIOCGIFCONF(fd sock, cmd const[SIOCGIFCONF], arg ptr[inout, ifconf])

ifreq_ioctls = SIOCGIFNAME, SIOCSIFLINK, SIOCGIFFLAGS, SIOCSIFFLAGS, SIOCGIFADDR, SIOCSIFADDR, SIOCGIFDSTADDR, SIOCSIFDSTADDR, SIOCGIFBRDADDR, SIOCSIFBRDADDR, SIOCGIFNETMASK, SIOCSIFNETMASK, SIOCGIFMETRIC, SIOCSIFMETRIC, SIOCGIFMEM, SIOCSIFMEM, SIOCGIFMTU, SIOCSIFMTU, SIOCSIFNAME, SIOCSIFHWADDR, SIOCGIFENCAP, SIOCSIFENCAP, SIOCGIFHWADDR, SIOCGIFSLAVE, SIOCSIFSLAVE, SIOCADDMULTI, SIOCDELMULTI, SIOCGIFINDEX, SIOCSIFPFLAGS, SIOCGIFPFLAGS, SIOCDIFADDR, SIOCSIFHWBROADCAST, SIOCGIFCOUNT, SIOCGIFTXQLEN, SIOCSIFTXQLEN, SIOCETHTOOL, SIOCGMIIPHY, SIOCGMIIREG, SIOCSMIIREG, SIOCWANDEV, SIOCGIFMAP, SIOCSIFMAP, SIOCBONDENSLAVE, SIOCBONDRELEASE, SIOCBONDSETHWADDR, SIOCBONDSLAVEINFOQUERY, SIOCBONDINFOQUERY, SIOCBONDCHANGEACTIVE, SIOCBRADDIF, SIOCBRDELIF, SIOCSHWTSTAMP, SIOCGHWTSTAMP

ioctl$sock_ifreq(fd sock, cmd flags[ifreq_ioctls], arg ptr[inout, ifreq])

ioctl$sock_SIOCGIFINDEX(fd sock, cmd const[SIOCGIFINDEX], arg ptr[out, ifreq_t[ifindex]]) (automatic_helper)

ioctl$sock_SIOCGIFBR(fd sock, cmd const[SIOCGIFBR], arg ptr[inout, brctl_arg])
ioctl$sock_SIOCSIFBR(fd sock, cmd const[SIOCSIFBR], arg ptr[inout, brctl_arg])

ioctl$sock_SIOCOUTQNSD(fd sock, cmd const[SIOCOUTQNSD], arg ptr[out, int32])

ioctl$sock_SIOCGSKNS(fd sock, cmd const[SIOCGSKNS], arg ptr[inout, int32])

ioctl$sock_SIOCADDDLCI(fd sock, cmd const[SIOCADDDLCI], arg ptr[inout, dlci_add])
ioctl$sock_SIOCDELDLCI(fd sock, cmd const[SIOCDELDLCI], arg ptr[in, dlci_add])

ioctl$sock_SIOCBRADDBR(fd sock, cmd const[SIOCBRADDBR], arg ptr[in, devname])
ioctl$sock_SIOCBRDELBR(fd sock, cmd const[SIOCBRDELBR], arg ptr[in, devname])

define SIOCDEVPRIVATE_BEG	(SIOCDEVPRIVATE)
define SIOCDEVPRIVATE_END	(SIOCDEVPRIVATE + 15)

define SIOCPROTOPRIVATE_BEG	(SIOCPROTOPRIVATE)
define SIOCPROTOPRIVATE_END	(SIOCPROTOPRIVATE + 15)

ioctl$sock_netdev_private(fd sock, cmd int32[SIOCDEVPRIVATE_BEG:SIOCDEVPRIVATE_END], arg ptr[in, array[int8]])
ioctl$sock_proto_private(fd sock, cmd int32[SIOCPROTOPRIVATE_BEG:SIOCPROTOPRIVATE_END], arg ptr[in, array[int8]])

ioctl$sock_FIOSETOWN(fd sock, cmd const[FIOSETOWN], arg ptr[in, pid])
ioctl$sock_SIOCSPGRP(fd sock, cmd const[SIOCSPGRP], arg ptr[in, pid])

ioctl$sock_FIOGETOWN(fd sock, cmd const[FIOGETOWN], arg ptr[out, pid])
ioctl$sock_SIOCGPGRP(fd sock, cmd const[SIOCGPGRP], arg ptr[out, pid])

ioctl$sock_TIOCOUTQ(fd sock, cmd const[TIOCOUTQ], arg ptr[out, int32])
ioctl$sock_TIOCINQ(fd sock, cmd const[TIOCINQ], arg ptr[out, int32])
ioctl$SIOCGSTAMP(fd sock, cmd const[SIOCGSTAMP], arg ptr[out, timeval])
ioctl$SIOCGSTAMPNS(fd sock, cmd const[SIOCGSTAMPNS], arg ptr[out, timespec])

# Socket sendmsg
sendmsg$sock(fd sock, msg ptr[in, msghdr_sock], f flags[send_flags])
sendmmsg$sock(fd sock, mmsg ptr[in, array[mmsghdr_sock]], vlen len[mmsg], f flags[send_flags])

resource ifindex[int32]

type ifreq_dev_t[DEVNAME, ELEM] {
	ifr_ifrn	string[DEVNAME, IFNAMSIZ]	(in)
	elem		ELEM
} [size[IFREQ_SIZE]]

type ifreq_t[ELEM] ifreq_dev_t[devnames, ELEM]

type ifreq ifreq_t[ifr_ifru]

ifr_ifru [
	ifru_addrs	sockaddr
	ifru_hwaddr	mac_addr
	ifru_flags	flags[ifru_flags, int16]
	ifru_ivalue	int32
	ifru_mtu	int32
	ifru_map	ifmap
	ifru_names	devname
	ifru_data	ptr[in, array[int8, 32]]
	ifru_settings	if_settings
]

define IFREQ_SIZE	sizeof(struct ifreq)

# https://elixir.bootlin.com/linux/v5.3.11/source/include/uapi/linux/if_vlan.h
type vlan_args[CMD, DATA] {
	cmd		const[CMD, int32]
	device1		string[devnames, 24]
	u		vlan_args_u[DATA]
	vlan_qos	int16
}

type vlan_args_u[DATA] {
	datadata	DATA
} [size[24]]

# https://elixir.bootlin.com/linux/v5.3.12/source/include/uapi/linux/route.h#L31
rtentry {
	rt_pad1		const[0, intptr]
	rt_dst		sockaddr
	rt_gateway	sockaddr
	rt_genmask	sockaddr
	rt_flags	int16
	rt_pad2		const[0, int16]
	rt_pad3		const[0, intptr]
	rt_pad4		const[0, intptr]
	rt_metric	int16
	rt_dev		ptr[in, devname, opt]
	rt_mtu		intptr
	rt_window	intptr
	rt_irtt		int16
}

# We could add "eth0" to this list as well, but this will affect the connection
# between fuzzer and manager and produce lots of "no output" crashes
# (actually, this is not true now since all testing is done in a separate
# network namespace, but we still don't mess with eth0).
# Note: lapb0, bpq0 and hwsim0 are only present in init namespace.
# Note: for roseN and nrN we should use proc type, but for simplicity we currently use N=0.
# Note: netdevsim0 and netpci0 are renamed in initialize_devlink_ports()
devnames = "", "lo", "tunl0", "gre0", "gretap0", "ip_vti0", "ip6_vti0", "sit0", "ip6tnl0", "ip6gre0", "ip6gretap0", "bond0", "dummy0", "nr0", "rose0", "erspan0", "vlan0", "bridge0", "vcan0", "team0", "syz_tun", "veth0", "veth1", "veth0_to_bridge", "veth1_to_bridge", "veth0_to_bond", "veth1_to_bond", "veth0_to_team", "veth1_to_team", "bridge_slave_0", "bridge_slave_1", "bond_slave_0", "bond_slave_1", "team_slave_0", "team_slave_1", "syzkaller0", "syzkaller1", "veth0_to_hsr", "veth1_to_hsr", "hsr0", "ip6erspan0", "vxcan1", "caif0", "batadv0", "veth0_to_batadv", "veth1_to_batadv", "batadv_slave_0", "batadv_slave_1", "netdevsim0", "netpci0", "nicvf0", "xfrm0", "veth0_virt_wifi", "veth1_virt_wifi", "virt_wifi0", "veth0_vlan", "veth1_vlan", "vlan0", "vlan1", "macvlan0", "macvlan1", "ipvlan0", "ipvlan1", "veth0_macvtap", "veth1_macvtap", "macvtap0", "macsec0", "geneve0", "geneve1", "wg0", "wg1", "wg2", "wlan0", "wlan1", "dvmrp0", "dvmrp1", "pimreg", "pimreg0", "pimreg1", "pim6reg", "pim6reg0", "pim6reg1"

type devname string[devnames, IFNAMSIZ]

devname_mask {
	lo	flags[devname_mask_values, int8]
} [size[IFNAMSIZ]]

devname_mask_values = 0, 0xff

ifru_flags = IFF_TUN, IFF_TAP, IFF_NO_PI, IFF_ONE_QUEUE, IFF_VNET_HDR, IFF_TUN_EXCL, IFF_MULTI_QUEUE, IFF_ATTACH_QUEUE, IFF_DETACH_QUEUE, IFF_PERSIST, IFF_NOFILTER

ifmap {
	mem_start	intptr
	mem_end		intptr
	base_addr	int16
	irq		int8
	dma		int8
	port		int8
}

if_settings {
	type		int32
	size		int32
	ifs_ifsu	ifs_ifsu
}

ifs_ifsu [
	raw_hdlc	ptr[in, raw_hdlc_proto]
	cisco		ptr[in, cisco_proto]
	fr		ptr[in, fr_proto]
	fr_pvc		ptr[in, fr_proto_pvc]
	fr_pvc_info	ptr[in, fr_proto_pvc_info]
	sync		ptr[in, sync_serial_settings]
	te1		ptr[in, te1_settings]
]

raw_hdlc_proto {
	encode	int16
	parity	int16
}

cisco_proto {
	val	int32
	timeout	int32
}

fr_proto {
	t391	int32
	t392	int32
	n391	int32
	n392	int32
	n393	int32
	lmi	int16
	dce	int16
}

fr_proto_pvc {
	dlcl	int32
}

fr_proto_pvc_info {
	dlci	int32
	master	devname
}

sync_serial_settings {
	rate	int32
	type	int32
	loop	int16
}

te1_settings {
	rate	int32
	type	int32
	loop	int16
	slot	int32
}

ifconf [
	req	ifconf_req
	buf	ifconf_buf
]

ifconf_buf {
	ifc_len		len[ifcu_buf, int32]
	ifcu_buf	ptr[inout, array[int8], opt]
}

ifconf_req {
	ifc_len		len[ifcu_req, int32]
	ifcu_req	ptr[inout, ifreq, opt]
}

brctl_cmds = BRCTL_GET_VERSION, BRCTL_GET_BRIDGES, BRCTL_ADD_BRIDGE, BRCTL_DEL_BRIDGE

brctl_arg [
	get	brctl_arg_get
	add_del	brctl_arg_add_del
	generic	brctl_arg_generic
]

brctl_arg_get {
	cmd	const[BRCTL_GET_BRIDGES, int64]
	buf	ptr[out, array[int8]]
	indices	int64
}

brctl_arg_add_del {
	cmd	const[BRCTL_ADD_BRIDGE, int64]
	devname	ptr[in, devname]
	pad	const[0, int64]
}

brctl_arg_generic {
	a0	flags[brctl_cmds, int64]
	a1	int64
	a2	int64
}

dlci_add {
	devname	devname
	dlci	int16
}

# ETHTOOL declaration part
# http://elixir.free-electrons.com/linux/latest/source/include/uapi/linux/ethtool.h

ethtool_cmd_u [
	ethtool_cmd		ethtool_cmd
	ethtool_drvinfo		ethtool_drvinfo
	ethtool_wolinfo		ethtool_wolinfo
	ethtool_regs		ethtool_regs
	ethtool_eeprom		ethtool_eeprom
	ethtool_eee		ethtool_eee
	ethtool_modinfo		ethtool_modinfo
	ethtool_coalesce	ethtool_coalesce
	ethtool_ringparam	ethtool_ringparam
	ethtool_channels	ethtool_channels
	ethtool_pauseparam	ethtool_pauseparam
	ethtool_gstrings	ethtool_gstrings
	ethtool_sset_info	ethtool_sset_info
	ethtool_test		ethtool_test
	ethtool_stats		ethtool_stats
	ethtool_perm_addr	ethtool_perm_addr
	ethtool_rxnfc		ethtool_rxnfc
	ethtool_rxfh_indir	ethtool_rxfh_indir
	ethtool_rxfh		ethtool_rxfh
	ethtool_rx_ntuple	ethtool_rx_ntuple
	ethtool_flash		ethtool_flash
	ethtool_dump		ethtool_dump
	ethtool_gfeatures	ethtool_gfeatures
	ethtool_sfeatures	ethtool_sfeatures
	ethtool_ts_info		ethtool_ts_info
	ethtool_per_queue_op	ethtool_per_queue_op
	ethtool_link_settings	ethtool_link_settings
] [varlen]

ethtool_cmd {
	cmd			flags[ethtool_cmd_flags, int32]
	supported		int32
	advertising		int32
	speed			int16
	duplex			int8
	port			int8
	phy_address		int8
	transceiver		int8
	autoneg			int8
	mdio_support		int8
	maxtxpkt		int32
	maxrxpkt		int32
	speed_hi		int16
	eth_tp_mdix		int8
	eth_tp_mdix_ctrl	int8
	lp_advertising		int32
	reserved		array[int32, 2]
}

ethtool_cmd_flags = ETHTOOL_GSET, ETHTOOL_SSET, ETHTOOL_GDRVINFO, ETHTOOL_GREGS, ETHTOOL_GWOL, ETHTOOL_SWOL, ETHTOOL_GMSGLVL, ETHTOOL_SMSGLVL, ETHTOOL_NWAY_RST, ETHTOOL_GLINK, ETHTOOL_GCOALESCE, ETHTOOL_SCOALESCE, ETHTOOL_GRINGPARAM, ETHTOOL_SRINGPARAM, ETHTOOL_GPAUSEPARAM, ETHTOOL_SPAUSEPARAM, ETHTOOL_GRXCSUM, ETHTOOL_SRXCSUM, ETHTOOL_GTXCSUM, ETHTOOL_STXCSUM, ETHTOOL_GSG, ETHTOOL_SSG, ETHTOOL_TEST, ETHTOOL_PHYS_ID, ETHTOOL_GSTATS, ETHTOOL_GTSO, ETHTOOL_STSO, ETHTOOL_GPERMADDR, ETHTOOL_GUFO, ETHTOOL_SUFO, ETHTOOL_GGSO, ETHTOOL_SGSO, ETHTOOL_GFLAGS, ETHTOOL_SFLAGS, ETHTOOL_GPFLAGS, ETHTOOL_SPFLAGS, ETHTOOL_GGRO, ETHTOOL_SGRO, ETHTOOL_RESET, ETHTOOL_SRXNTUPLE, ETHTOOL_GRXNTUPLE, ETHTOOL_GSSET_INFO, ETHTOOL_GRXFHINDIR, ETHTOOL_SRXFHINDIR, ETHTOOL_GFEATURES, ETHTOOL_SFEATURES, ETHTOOL_GCHANNELS, ETHTOOL_SCHANNELS, ETHTOOL_GET_TS_INFO, ETHTOOL_GEEE, ETHTOOL_SEEE, ETHTOOL_GRSSH, ETHTOOL_SRSSH, ETHTOOL_GTUNABLE, ETHTOOL_STUNABLE, ETHTOOL_GPHYSTATS, ETHTOOL_PERQUEUE, ETHTOOL_GLINKSETTINGS, ETHTOOL_SLINKSETTINGS, ETHTOOL_PHY_GTUNABLE, ETHTOOL_PHY_STUNABLE, ethtool_eeprom_cmd_flags, ethtool_rxnfc_cmd_flags, ethtool_dump_cmd_flags

ethtool_drvinfo {
	cmd		const[ETHTOOL_GDRVINFO, int32]
	driver		array[int8, 32]
	version		array[int8, 32]
	fw_version	array[int8, ETHTOOL_FWVERS_LEN]
	bus_info	array[int8, ETHTOOL_BUSINFO_LEN]
	erom_version	array[int8, ETHTOOL_EROMVERS_LEN]
	reserved2	array[int8, 12]
	n_priv_flags	int32
	n_stats		int32
	testinfo_len	int32
	eedump_len	int32
	regdump_len	int32
}

ethtool_wolinfo_cmd_flags = ETHTOOL_GWOL, ETHTOOL_SWOL

ethtool_wolinfo {
	cmd		flags[ethtool_wolinfo_cmd_flags, int32]
	supported	int32
	wolopts		int32
	sopass		array[int8, SOPASS_MAX]
}

ethtool_regs {
	cmd	const[ETHTOOL_GREGS, int32]
	version	int32
	len	len[data, int32]
	data	array[int8]
}

ethtool_eeprom_cmd_flags = ETHTOOL_GEEPROM, ETHTOOL_GMODULEEEPROM, ETHTOOL_SEEPROM

ethtool_eeprom {
	cmd	flags[ethtool_eeprom_cmd_flags, int32]
	magic	int32
	offset	int32
	len	len[data, int32]
	data	array[int8]
}

ethtool_eee_cmd_flags = ETHTOOL_GEEE, ETHTOOL_SEEE

ethtool_eee {
	cmd		flags[ethtool_eee_cmd_flags, int32]
	supported	int32
	advertised	int32
	lp_advertised	int32
	eee_active	int32
	eee_enabled	int32
	tx_lpi_enabled	int32
	tx_lpi_timer	int32
	reserved	array[int32, 2]
}

ethtool_modinfo {
	cmd		const[ETHTOOL_GMODULEINFO, int32]
	type		int32
	eeprom_len	int32
	reserved	array[const[0, int32], 8]
}

ethtool_coalesce_cmd_flags = ETHTOOL_GCOALESCE, ETHTOOL_SCOALESCE

ethtool_coalesce {
	cmd				flags[ethtool_coalesce_cmd_flags, int32]
	rx_coalesce_usecs		int32
	rx_max_coalesced_frames		int32
	rx_coalesce_usecs_irq		int32
	rx_max_coalesced_frames_irq	int32
	tx_coalesce_usecs		int32
	tx_max_coalesced_frames		int32
	tx_coalesce_usecs_irq		int32
	tx_max_coalesced_frames_irq	int32
	stats_block_coalesce_usecs	int32
	use_adaptive_rx_coalesce	int32
	use_adaptive_tx_coalesce	int32
	pkt_rate_low			int32
	rx_coalesce_usecs_low		int32
	rx_max_coalesced_frames_low	int32
	tx_coalesce_usecs_low		int32
	tx_max_coalesced_frames_low	int32
	pkt_rate_high			int32
	rx_coalesce_usecs_high		int32
	rx_max_coalesced_frames_high	int32
	tx_coalesce_usecs_high		int32
	tx_max_coalesced_frames_high	int32
	rate_sample_interval		int32
}

ethtool_ringparam_cmd_flags = ETHTOOL_GRINGPARAM, ETHTOOL_SRINGPARAM

ethtool_ringparam {
	cmd			flags[ethtool_ringparam_cmd_flags, int32]
	rx_max_pending		int32
	rx_mini_max_pending	int32
	rx_jumbo_max_pending	int32
	tx_max_pending		int32
	rx_pending		int32
	rx_mini_pending		int32
	rx_jumbo_pending	int32
	tx_pending		int32
}

ethtool_channels_cmd_flags = ETHTOOL_GCHANNELS, ETHTOOL_SCHANNELS

ethtool_channels {
	cmd		flags[ethtool_channels_cmd_flags, int32]
	max_rx		int32
	max_tx		int32
	max_other	int32
	max_combined	int32
	rx_count	int32
	tx_count	int32
	other_count	int32
	combined_count	int32
}

ethtool_pauseparam_cmd_flags = ETHTOOL_GPAUSEPARAM, ETHTOOL_SPAUSEPARAM

ethtool_pauseparam {
	cmd		flags[ethtool_pauseparam_cmd_flags, int32]
	autoneg		int32
	rx_pause	int32
	tx_pause	int32
}

ethtool_gstrings {
	cmd		const[ETHTOOL_GSTRINGS, int32]
	string_set	flags[ethtool_stringset, int32]
	len		len[data, int32]
	data		array[int8]
}

ethtool_stringset = ETH_SS_TEST, ETH_SS_STATS, ETH_SS_PRIV_FLAGS, ETH_SS_NTUPLE_FILTERS, ETH_SS_FEATURES, ETH_SS_RSS_HASH_FUNCS, ETH_SS_TUNABLES, ETH_SS_PHY_STATS, ETH_SS_PHY_TUNABLES

ethtool_sset_info {
	cmd		const[ETHTOOL_GSSET_INFO, int32]
	reserved	int32
	sset_mask	int64
	data		array[int32]
}

ethtool_test {
	cmd		const[ETHTOOL_TEST, int32]
	flags		int32
	reserved	int32
	len		len[data, int32]
	data		array[int64]
}

ethtool_stats {
	cmd	const[ETHTOOL_GSTATS, int32]
	n_stats	len[data, int32]
	data	array[int64]
}

ethtool_perm_addr {
	cmd	const[ETHTOOL_GPERMADDR, int32]
	size	len[data, int32]
	data	array[int8]
}

# http://elixir.free-electrons.com/linux/latest/source/include/uapi/linux/ethtool.h#L1565
traffic_flow_types = TCP_V4_FLOW, UDP_V4_FLOW, SCTP_V4_FLOW, AH_ESP_V4_FLOW, TCP_V6_FLOW, UDP_V6_FLOW, SCTP_V6_FLOW, AH_ESP_V6_FLOW, AH_V4_FLOW, ESP_V4_FLOW, AH_V6_FLOW, ESP_V6_FLOW, IPV4_USER_FLOW, IP_USER_FLOW, IPV6_USER_FLOW, IPV4_FLOW, IPV6_FLOW, ETHER_FLOW

ethtool_rxnfc_cmd_flags = ETHTOOL_GRXFH, ETHTOOL_SRXFH, ETHTOOL_GRXRINGS, ETHTOOL_GRXCLSRLCNT, ETHTOOL_GRXCLSRULE, ETHTOOL_GRXCLSRLALL, ETHTOOL_SRXCLSRLDEL, ETHTOOL_SRXCLSRLINS

ethtool_rxnfc {
	cmd		flags[ethtool_rxnfc_cmd_flags, int32]
	flow_type	flags[traffic_flow_types, int32]
	data		int64
	fs		ethtool_rx_flow_spec
	rule_cnt	len[rule_locs, int32]
	rule_locs	array[int32]
}

ethtool_rx_flow_spec {
	flow_type	flags[traffic_flow_types, int32]
	h_u		ethtool_flow_union
	h_ext		ethtool_flow_ext
	m_u		ethtool_flow_union
	m_ext		ethtool_flow_ext
	ring_cookie	int64
	location	int32
}

ethtool_flow_union [
	tcp_ip4_spec	ethtool_tcpip4_spec
	udp_ip4_spec	ethtool_tcpip4_spec
	sctp_ip4_spec	ethtool_tcpip4_spec
	ah_ip4_spec	ethtool_ah_espip4_spec
	esp_ip4_spec	ethtool_ah_espip4_spec
	usr_ip4_spec	ethtool_usrip4_spec
	tcp_ip6_spec	ethtool_tcpip6_spec
	udp_ip6_spec	ethtool_tcpip6_spec
	sctp_ip6_spec	ethtool_tcpip6_spec
	ah_ip6_spec	ethtool_ah_espip6_spec
	esp_ip6_spec	ethtool_ah_espip6_spec
	usr_ip6_spec	ethtool_usrip6_spec
	ether_spec	ethhdr
	hdata		array[int8, 52]
]

ethtool_flow_ext {
	padding		const[0, int16]
	h_dest		mac_addr
	vlan_etype	int16be
	vlan_tci	int16be
	data		array[int32be, 2]
}

ethtool_tcpip4_spec {
	ip4src	ipv4_addr
	ip4dst	ipv4_addr
	psrc	sock_port
	pdst	sock_port
	tos	int8
}

ethtool_ah_espip4_spec {
	ip4src	ipv4_addr
	ip4dst	ipv4_addr
	spi	int32be
	tos	int8
}

ethtool_usrip4_spec {
	ip4src		ipv4_addr
	ip4dst		ipv4_addr
	l4_4_bytes	int32be
	tos		int8
	ip_ver		const[ETH_RX_NFC_IP4, int8]
	proto		int8
}

ethtool_tcpip6_spec {
	ip6src	ipv6_addr
	ip6dst	ipv6_addr
	psrc	sock_port
	pdst	sock_port
	tclass	int8
}

ethtool_ah_espip6_spec {
	ip6src	ipv6_addr
	ip6dst	ipv6_addr
	spi	int32be
	tclass	int8
}

ethtool_usrip6_spec {
	ip6src		ipv6_addr
	ip6dst		ipv6_addr
	l4_4_bytes	int32be
	tclass		int8
	l4_proto	int8
}

ethhdr {
	h_dest		mac_addr
	h_source	mac_addr
	h_proto		int16be
} [packed]

ethtool_rxfh_indir_flags = ETHTOOL_GRXFHINDIR, ETHTOOL_SRXFHINDIR

ethtool_rxfh_indir {
	cmd		flags[ethtool_rxfh_indir_flags, int32]
	size		len[ring_index, int32]
	ring_index	array[int32]
}

ethtool_rxfh_cmd_flags = ETHTOOL_GRSSH, ETHTOOL_SRSSH

ethtool_rxfh {
	cmd		flags[ethtool_rxfh_cmd_flags, int32]
	rss_context	int32
	indir_size	int32
	key_size	int32
	hfunc		int8
	rsvd8		array[int8, 3]
	rsvd32		int32
	rss_config	array[int32]
}

ethtool_rx_ntuple {
	cmd	const[ETHTOOL_SRXNTUPLE, int32]
	fs	ethtool_rx_ntuple_flow_spec
}

ethtool_rx_ntuple_flow_spec_action_flags = ETHTOOL_RXNTUPLE_ACTION_DROP, ETHTOOL_RXNTUPLE_ACTION_CLEAR

ethtool_rx_ntuple_flow_spec {
	flow_type	flags[traffic_flow_types, int32]
	h_u		ethtool_rx_ntuple_flow_spec_union
	m_u		ethtool_rx_ntuple_flow_spec_union
	vlan_tag	int16
	vlan_tag_mask	int16
	data		int64
	data_mask	int64
	action		flags[ethtool_rx_ntuple_flow_spec_action_flags, int32]
}

ethtool_rx_ntuple_flow_spec_union [
	tcp_ip4_spec	ethtool_tcpip4_spec
	udp_ip4_spec	ethtool_tcpip4_spec
	sctp_ip4_spec	ethtool_tcpip4_spec
	ah_ip4_spec	ethtool_ah_espip4_spec
	esp_ip4_spec	ethtool_ah_espip4_spec
	usr_ip4_spec	ethtool_usrip4_spec
	ether_spec	ethhdr
	hdata		array[int8, 72]
]

ethtool_flash {
	cmd	const[ETHTOOL_FLASHDEV, int32]
	region	int32
	data	string[filename, ETHTOOL_FLASH_MAX_FILENAME]
}

ethtool_dump_cmd_flags = ETHTOOL_GET_DUMP_FLAG, ETHTOOL_GET_DUMP_DATA, ETHTOOL_SET_DUMP

ethtool_dump {
	cmd	flags[ethtool_dump_cmd_flags, int32]
	version	int32
	flag	int32
	len	len[data, int32]
	data	array[int8]
}

ethtool_gfeatures {
	cmd		const[ETHTOOL_GFEATURES, int32]
	size		len[features, int32]
	features	array[ethtool_get_features_block]
}

ethtool_get_features_block {
	available	const[0, int32]
	requested	const[0, int32]
	active		const[0, int32]
	never_changed	const[0, int32]
}

ethtool_sfeatures {
	cmd		const[ETHTOOL_SFEATURES, int32]
	size		len[features, int32]
	features	array[ethtool_set_features_block]
}

ethtool_set_features_block {
	valid		int32
	requested	int32
}

ethtool_ts_info {
	cmd		const[ETHTOOL_GET_TS_INFO, int32]
	so_timestamping	const[0, int32]
	phc_index	const[0, int32]
	tx_types	const[0, int32]
	tx_reserved	array[const[0, int32], 3]
	rx_filters	const[0, int32]
	rx_reserved	array[const[0, int32], 3]
}

ethtool_per_queue_op {
	cmd		const[ETHTOOL_PERQUEUE, int32]
	sub_command	flags[ethtool_per_queue_sub_cmd, int32]
	queue_mask	array[int32, ethtool_per_queue_op_size]
	data		array[int8]
}

ethtool_per_queue_sub_cmd = ETHTOOL_GCOALESCE, ETHTOOL_SCOALESCE

define ethtool_per_queue_op_size	__KERNEL_DIV_ROUND_UP(MAX_NUM_QUEUE, 32)

ethtool_link_settings_cmd_flags = ETHTOOL_GLINKSETTINGS, ETHTOOL_SLINKSETTINGS

ethtool_link_settings {
	cmd			flags[ethtool_link_settings_cmd_flags, int32]
	speed			int32
	duplex			int8
	port			int8
	phy_address		int8
	autoneg			int8
	mdio_support		int8
	eth_tp_mdix		int8
	eth_tp_mdix_ctrl	int8
	link_mode_masks_nwords	int8
	reserved		array[int32, 8]
	link_mode_masks		array[int32]
}
]

gemini-3-pro-preview

							input: 203262
							output: 540
							thoughts: 25
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Working with SIOCSIFFLAGS and ioctl$sock_ifreq**

Right, *ioctl$sock_ifreq*... that old friend. Specifically, I'm thinking about setting interface flags with *SIOCSIFFLAGS*. I've got a networking task in mind, probably something dealing with interface configuration or control. I'm likely dealing with socket-based interface manipulation, needing to toggle some operational characteristic. Maybe I want to bring an interface up or down, enable promiscuous mode, change its MTU, or something similar.

Given the context, I'm probably writing some kind of network utility, driver, or system management code. I’ve either encountered an issue, where an interface needs setting, or I'm starting an implementation. It’s a pretty standard approach, so the core of the implementation should be fairly straightforward - create the socket, populate the *ifreq* structure with the interface name and the bitmask of the flags to be set, call the ioctl, and handle any errors.

But, as always, it’s the details that matter. I need to be careful with the specifics of the flags being set (are they orthogonal?), the error handling (what if the interface is down?), and perhaps, any race conditions. I'll need to check the appropriate return values and potentially deal with errors specific to the operation. I'm going to start with a standard implementation and then refine it.

map[ReproSyz:r0 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', @ifru_flags=0x100}) (async)
ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', @ifru_flags=0x0}) (async)
ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', @ifru_flags=0x100}) (async)
ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', @ifru_flags=0x0}) (async)
ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', @ifru_flags=0x100}) (async)
ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', @ifru_flags=0x0}) (async)
ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', @ifru_flags=0x100}) (async)
ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000000)={'syz_tun\x00', @ifru_flags=0x0}) (async)
r1 = syz_open_dev$tty1(0xc, 0x4, 0x1)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 204178
							output: 15
							thoughts: 1735
						

**The Puzzle of the Console Lock**

Okay, so the initial panic didn't lead anywhere, so it's time to rethink this. It looks like `con_install` is hanging. The stack trace clearly shows a stall within the `console_lock` acquisition. Specifically, the trace is going through `__down_common` from `con_install`, waiting on the semaphore, which relies on the console lock. So, the question is, who's *holding* that lock?

If `syz.5.2008` is the culprit, what's it doing? Could it be stuck in `vt_ioctl` and blocked on *something else*? Hmmm, if it were truly blocked, I'd expect to see it in the blocked task list, but it's not. That's odd. Why would a task be blocked, but not listed as blocked? A spinlock! If it's spinning, it's in the `R` state, not `D`, thus it won't show up as blocked! And that would trigger a softlockup, which is consistent with the bug report. So, `syz.5.2008` is spinning on a spinlock while holding the `console_lock`.

Which spinlock is it? Let's trace through the locking that happens within `vt_ioctl`. I need to review what's potentially acquired while we hold `console_lock`. The candidate spinlocks within `vt_ioctl` are:

*   `vt_spawn_con.lock`
*   `printing_lock` (within `vt_console_print`)
*   `console_owner_lock` (within `console_unlock`)
*   `prb_lock` (within `console_unlock`)
*   `logbuf_lock` (legacy)
*   `fb_info->lock` (in `fb_set_var`?)
*   `tty->ctrl.lock`
*   `tty->termios_rwsem` (this is a rwsem, not a spinlock)
*   `tty_port->lock`
*   `vc->port.lock`
*   `file->f_lock` (within `vcs_poll_data_get`)
*   `vt_notifier_list` (rwsem, so not our problem)

Is there any spinlock that could be held by another task, leading to this spin? The other task holding the spinlock must be running on another CPU. If it's spinning on *another* spinlock, that would be a deadlock, but lockdep didn't report a deadlock.

What about `console_unlock`? Could `syz.5.2008` be spinning in `console_unlock` because it's waiting for `console_trylock_spinning`? That's plausible. `console_trylock_spinning` is a busy-wait for `console_owner` to release the lock. If `console_owner` is stuck on another CPU, `syz.5.2008` will spin forever! But `console_owner` is the current task printing to the console, but is it stuck? If it's writing to a slow console it could take a long time, but it's not truly *stuck*. Although, 143 seconds is a long time! Does `console_trylock_spinning` have a timeout? No, it spins until the owner gives up.

So, if `console_owner` is printing an enormous amount of messages, it will hold the lock a long time, and `syz.5.2008` will spin, triggering a softlockup. Meanwhile, `syz.8.2015` becomes blocked in `con_install`. That explains it perfectly:

*   `console_owner` is printing a huge number of messages. It's running, so it's not blocked.
*   `syz.5.2008` called `printk`, went into `console_trylock_spinning`, and is spinning, waiting for the owner. It's also running, thus no blocked task, and it triggers the softlockup.
*   `syz.8.2015` called `con_install`, entered `down(&console_sem)`, and is blocked, waiting for the semaphore. It's in state `D`, therefore, in the blocked list.
*   The hung task detector eventually fires for `syz.8.2015` after 143 seconds.

So, the root cause is, *still* printk flooding! The question is: how can we trigger this? We need to find something that generates a deluge of printk

map[Expression:WARN]

map[Output:
Full output is too long, showing 500 out of 194444 lines.
Use more precise expression if possible.

[Documentation/ABI/testing/sysfs-class-thermal=101=Description:
 --
 Documentation/ABI/testing/sysfs-class-thermal-113-
 Documentation/ABI/testing/sysfs-class-thermal:114:		WARNING:
 Documentation/ABI/testing/sysfs-class-thermal-115-		    Be careful while enabling this option on production systems,
 --
 Documentation/ABI/testing/sysfs-platform-mellanox-bootctl=83=Description:
 Documentation/ABI/testing/sysfs-platform-mellanox-bootctl-84-		The file used to write BlueField boot log with the format
 Documentation/ABI/testing/sysfs-platform-mellanox-bootctl:85:                "[INFO|WARN|ERR|ASSERT ]<msg>". Log level 'INFO' is used by
 Documentation/ABI/testing/sysfs-platform-mellanox-bootctl-86-                default if not specified.
 --
 Documentation/Kconfig=3=menu "Documentation"
 Documentation/Kconfig-4-
 Documentation/Kconfig:5:config WARN_MISSING_DOCUMENTS
 Documentation/Kconfig-6-	bool "Warn if there's a missing documentation file"
 --
 Documentation/Kconfig-14-
 Documentation/Kconfig:15:config WARN_ABI_ERRORS
 Documentation/Kconfig-16-	bool "Warn if there are errors at ABI files"
 --
 Documentation/Makefile=8=ifneq ($(MAKECMDGOALS),cleandocs)
 Documentation/Makefile-9-# Check for broken documentation file references
 Documentation/Makefile:10:ifeq ($(CONFIG_WARN_MISSING_DOCUMENTS),y)
 Documentation/Makefile-11-$(shell $(srctree)/tools/docs/documentation-file-ref-check --warn)
 Documentation/Makefile=12=endif
 --
 Documentation/Makefile-14-# Check for broken ABI files
 Documentation/Makefile:15:ifeq ($(CONFIG_WARN_ABI_ERRORS),y)
 Documentation/Makefile-16-$(shell $(srctree)/tools/docs/get_abi.py --dir $(srctree)/Documentation/ABI validate)
 --
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst=78=lock-acquisition and lock-release functions::
 --
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst-104-   25
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst:105:   26 WARN_ON(r1 == 0 && r2 == 0 && r3 == 0);
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst-106-
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst:107:The ``WARN_ON()`` is evaluated at "the end of time",
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst-108-after all changes have propagated throughout the system.
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst=109=Without the ``smp_mb__after_unlock_lock()`` provided by the
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst:110:acquisition functions, this ``WARN_ON()`` could trigger, for example
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst-111-on PowerPC.
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst=112=The ``smp_mb__after_unlock_lock()`` invocations prevent this
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst:113:``WARN_ON()`` from triggering.
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst-114-
 --
 Documentation/RCU/Design/Requirements/Requirements.rst=755=example illustrates this:
 --
 Documentation/RCU/Design/Requirements/Requirements.rst-765-       7     r2 = READ_ONCE(x);
 Documentation/RCU/Design/Requirements/Requirements.rst:766:       8     WARN_ON(!r2); /* BUG!!! */
 Documentation/RCU/Design/Requirements/Requirements.rst-767-       9   }
 --
 Documentation/RCU/Design/Requirements/Requirements.rst=779=If the thread0() function's rcu_read_lock() excluded the
 Documentation/RCU/Design/Requirements/Requirements.rst:780:thread1() function's update, the WARN_ON() could never fire. But
 Documentation/RCU/Design/Requirements/Requirements.rst-781-the fact is that rcu_read_lock() does not exclude much of anything
 Documentation/RCU/Design/Requirements/Requirements.rst=782=aside from subsequent grace periods, of which thread1() has none, so
 Documentation/RCU/Design/Requirements/Requirements.rst:783:the WARN_ON() can and does fire.
 Documentation/RCU/Design/Requirements/Requirements.rst-784-
 --
 Documentation/RCU/lockdep-splat.rst=21=has long since been fixed::
 --
 Documentation/RCU/lockdep-splat.rst-23-    =============================
 Documentation/RCU/lockdep-splat.rst:24:    WARNING: suspicious RCU usage
 Documentation/RCU/lockdep-splat.rst-25-    -----------------------------
 --
 Documentation/RCU/lockdep.rst=25=aren't certain (for example, if CONFIG_DEBUG_LOCK_ALLOC is not set).
 Documentation/RCU/lockdep.rst:26:This prevents things like WARN_ON(!rcu_read_lock_held()) from giving false
 Documentation/RCU/lockdep.rst-27-positives when lockdep is disabled.
 --
 Documentation/RCU/whatisRCU.rst=1237=All: lockdep-checked RCU utility APIs::
 Documentation/RCU/whatisRCU.rst-1238-
 Documentation/RCU/whatisRCU.rst:1239:	RCU_LOCKDEP_WARN
 Documentation/RCU/whatisRCU.rst-1240-	rcu_sleep_check
 --
 Documentation/admin-guide/LSM/ipe.rst=622=boot_verified
 --
 Documentation/admin-guide/LSM/ipe.rst-630-
 Documentation/admin-guide/LSM/ipe.rst:631:   .. WARNING::
 Documentation/admin-guide/LSM/ipe.rst-632-
 --
 Documentation/admin-guide/blockdev/zram.rst=33=Following shows a typical sequence of steps for using zram.
 Documentation/admin-guide/blockdev/zram.rst-34-
 Documentation/admin-guide/blockdev/zram.rst:35:WARNING
 Documentation/admin-guide/blockdev/zram.rst-36-=======
 --
 Documentation/admin-guide/bug-hunting.rst=4=Kernel bug reports often come with a stack dump like the one below::
 --
 Documentation/admin-guide/bug-hunting.rst-6-	------------[ cut here ]------------
 Documentation/admin-guide/bug-hunting.rst:7:	WARNING: CPU: 1 PID: 28102 at kernel/module.c:1108 module_put+0x57/0x70
 Documentation/admin-guide/bug-hunting.rst-8-	Modules linked in: dvb_usb_gp8psk(-) dvb_usb dvb_core nvidia_drm(PO) nvidia_modeset(PO) snd_hda_codec_hdmi snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd soundcore nvidia(PO) [last unloaded: rc_core]
 --
 Documentation/admin-guide/cgroup-v2.rst=1107=be exceeded by a CPU.
 Documentation/admin-guide/cgroup-v2.rst-1108-
 Documentation/admin-guide/cgroup-v2.rst:1109:WARNING: cgroup2 cpu controller doesn't yet support the (bandwidth) control of
 Documentation/admin-guide/cgroup-v2.rst-1110-realtime processes. For a kernel built with the CONFIG_RT_GROUP_SCHED option
 --
 Documentation/admin-guide/clearing-warn-once.rst:1:Clearing WARN_ONCE
 Documentation/admin-guide/clearing-warn-once.rst-2-------------------
 Documentation/admin-guide/clearing-warn-once.rst-3-
 Documentation/admin-guide/clearing-warn-once.rst:4:WARN_ONCE / WARN_ON_ONCE / printk_once only emit a message once.
 Documentation/admin-guide/clearing-warn-once.rst-5-
 --
 Documentation/admin-guide/device-mapper/dm-crypt.rst=101=allow_discards
 --
 Documentation/admin-guide/device-mapper/dm-crypt.rst-104-
 Documentation/admin-guide/device-mapper/dm-crypt.rst:105:    WARNING: Assess the specific security risks carefully before enabling this
 Documentation/admin-guide/device-mapper/dm-crypt.rst-106-    option.  For example, allowing discards on encrypted devices may lead to
 --
 Documentation/admin-guide/kdump/kdump.rst=552=Crash document can be found at:
 --
 Documentation/admin-guide/kdump/kdump.rst-554-
 Documentation/admin-guide/kdump/kdump.rst:555:Trigger Kdump on WARN()
 Documentation/admin-guide/kdump/kdump.rst-556-=======================
 Documentation/admin-guide/kdump/kdump.rst-557-
 Documentation/admin-guide/kdump/kdump.rst:558:The kernel parameter, panic_on_warn, calls panic() in all WARN() paths.  This
 Documentation/admin-guide/kdump/kdump.rst-559-will cause a kdump to occur at the panic() call.  In cases where a user wants
 --
 Documentation/admin-guide/kernel-parameters.txt=98=Kernel parameters
 --
 Documentation/admin-guide/kernel-parameters.txt-3684-			3 (KERN_ERR)		error conditions
 Documentation/admin-guide/kernel-parameters.txt:3685:			4 (KERN_WARNING)	warning conditions
 Documentation/admin-guide/kernel-parameters.txt-3686-			5 (KERN_NOTICE)		normal but significant condition
 --
 Documentation/admin-guide/kernel-parameters.txt-4206-			this means that duplicate request_module() calls will
 Documentation/admin-guide/kernel-parameters.txt:4207:			trigger a WARN_ON() instead of a pr_warn(). Note that
 Documentation/admin-guide/kernel-parameters.txt:4208:			if MODULE_DEBUG_AUTOLOAD_DUPS_TRACE is set, WARN_ON()s
 Documentation/admin-guide/kernel-parameters.txt-4209-			will always be issued and this option does nothing.
 --
 Documentation/admin-guide/kernel-parameters.txt-4881-
 Documentation/admin-guide/kernel-parameters.txt:4882:	panic_on_warn=1	panic() instead of WARN().  Useful to cause kdump
 Documentation/admin-guide/kernel-parameters.txt:4883:			on a WARN().
 Documentation/admin-guide/kernel-parameters.txt-4884-
 --
 Documentation/admin-guide/kernel-parameters.txt-5331-		force	Enable ASPM even on devices that claim not to support it.
 Documentation/admin-guide/kernel-parameters.txt:5332:			WARNING: Forcing ASPM on may cause system lockups.
 Documentation/admin-guide/kernel-parameters.txt-5333-
 --
 Documentation/admin-guide/kernel-parameters.txt-5837-			This wake_up() will be accompanied by a
 Documentation/admin-guide/kernel-parameters.txt:5838:			WARN_ONCE() splat and an ftrace_dump().
 Documentation/admin-guide/kernel-parameters.txt-5839-
 --
 Documentation/admin-guide/kernel-parameters.txt-7865-			This option is useful, as it disables the trace before
 Documentation/admin-guide/kernel-parameters.txt:7866:			the WARNING dump is called, which prevents the trace to
 Documentation/admin-guide/kernel-parameters.txt-7867-			be filled with content caused by the warning output.
 --
 Documentation/admin-guide/kernel-per-CPU-kthreads.rst=228=To reduce its OS jitter, do any of the following:
 --
 Documentation/admin-guide/kernel-per-CPU-kthreads.rst-255-
 Documentation/admin-guide/kernel-per-CPU-kthreads.rst:256:		WARNING:  Please check your CPU specifications to
 Documentation/admin-guide/kernel-per-CPU-kthreads.rst-257-		make sure that this is safe on your particular system.
 --
 Documentation/admin-guide/kernel-per-CPU-kthreads.rst-278-		due to the rtas_event_scan() function.
 Documentation/admin-guide/kernel-per-CPU-kthreads.rst:279:		WARNING:  Please check your CPU specifications to
 Documentation/admin-guide/kernel-per-CPU-kthreads.rst-280-		make sure that this is safe on your particular system.
 --
 Documentation/admin-guide/laptops/thinkpad-acpi.rst=1073=it there will be the following attributes:
 --
 Documentation/admin-guide/laptops/thinkpad-acpi.rst-1097-
 Documentation/admin-guide/laptops/thinkpad-acpi.rst:1098:WARNING:
 Documentation/admin-guide/laptops/thinkpad-acpi.rst-1099-
 --
 Documentation/admin-guide/laptops/thinkpad-acpi.rst=1253=while the EC is transitioning to the full-speed level.
 Documentation/admin-guide/laptops/thinkpad-acpi.rst-1254-
 Documentation/admin-guide/laptops/thinkpad-acpi.rst:1255:WARNING WARNING WARNING: do not leave the fan disabled unless you are
 Documentation/admin-guide/laptops/thinkpad-acpi.rst-1256-monitoring all of the temperature sensor readings and you are ready to
 --
 Documentation/admin-guide/md.rst=191=All md devices contain:
 --
 Documentation/admin-guide/md.rst-246-     LBS cannot exceed PAGE_SIZE before RAID supports folio.
 Documentation/admin-guide/md.rst:247:     WARNING: Arrays created on new kernel cannot be assembled at old
 Documentation/admin-guide/md.rst-248-     kernel due to padding check, Set module parameter 'check_new_feature'
 --
 Documentation/admin-guide/sysctl/kernel.rst=482=On architectures where unaligned accesses cause traps, and where this
 Documentation/admin-guide/sysctl/kernel.rst:483:feature is supported (``CONFIG_SYSCTL_ARCH_UNALIGN_NO_WARN``;
 Documentation/admin-guide/sysctl/kernel.rst-484-currently, ``arc``, ``parisc`` and ``loongarch``), controls whether all
 --
 Documentation/admin-guide/sysctl/kernel.rst=892=panic_on_warn
 --
 Documentation/admin-guide/sysctl/kernel.rst-894-
 Documentation/admin-guide/sysctl/kernel.rst:895:Calls panic() in the WARN() path when set to 1.  This is useful to avoid
 Documentation/admin-guide/sysctl/kernel.rst:896:a kernel rebuild when attempting to kdump at the location of a WARN().
 Documentation/admin-guide/sysctl/kernel.rst-897-
 Documentation/admin-guide/sysctl/kernel.rst-898-= ================================================
 Documentation/admin-guide/sysctl/kernel.rst:899:0 Only WARN(), default behaviour.
 Documentation/admin-guide/sysctl/kernel.rst:900:1 Call panic() after printing out WARN() location.
 Documentation/admin-guide/sysctl/kernel.rst-901-= ================================================
 --
 Documentation/admin-guide/sysctl/kernel.rst=1602=When set, disables tracing (see Documentation/trace/ftrace.rst) when a
 Documentation/admin-guide/sysctl/kernel.rst:1603:``WARN()`` is hit.
 Documentation/admin-guide/sysctl/kernel.rst-1604-
 --
 Documentation/arch/s390/3270.rst=45=running the configuration script (config3270.sh, in this directory).
 Documentation/arch/s390/3270.rst-46-
 Documentation/arch/s390/3270.rst:47:WARNING:  If you are using 3270 console support, you must rerun the
 Documentation/arch/s390/3270.rst-48-configuration script every time you change the console's address (perhaps
 --
 Documentation/arch/x86/sgx.rst=231=EPC leaks
 --
 Documentation/arch/x86/sgx.rst-233-
 Documentation/arch/x86/sgx.rst:234:When EPC page leaks happen, a WARNING like this is shown in dmesg:
 Documentation/arch/x86/sgx.rst-235-
 --
 Documentation/arch/xtensa/atomctl.rst=27=support the Internal Operation.
 Documentation/arch/xtensa/atomctl.rst-28-
 Documentation/arch/xtensa/atomctl.rst:29:CUSTOMER-WARNING:
 Documentation/arch/xtensa/atomctl.rst-30-   Virtually all customers buy their memory controllers from vendors that
 --
 Documentation/core-api/dma-api-howto.rst=248=This means that in the failure case, you have two options:
 --
 Documentation/core-api/dma-api-howto.rst-252-
 Documentation/core-api/dma-api-howto.rst:253:It is recommended that your driver print a kernel KERN_WARNING message when
 Documentation/core-api/dma-api-howto.rst-254-setting the DMA mask fails.  In this manner, if a user of your driver reports
 --
 Documentation/core-api/dma-api.rst=741=example warning message may look like this::
 Documentation/core-api/dma-api.rst-742-
 Documentation/core-api/dma-api.rst:743:	WARNING: at /data2/repos/linux-2.6-iommu/lib/dma-debug.c:448
 Documentation/core-api/dma-api.rst-744-		check_unmap+0x203/0x490()
 --
 Documentation/core-api/dma-attributes.rst=102=means that we won't try quite as hard to get them.
 --
 Documentation/core-api/dma-attributes.rst-106-
 Documentation/core-api/dma-attributes.rst:107:DMA_ATTR_NO_WARN
 Documentation/core-api/dma-attributes.rst-108-----------------
 --
 Documentation/core-api/dma-attributes.rst=110=This tells the DMA-mapping subsystem to suppress allocation failure reports
 Documentation/core-api/dma-attributes.rst:111:(similarly to __GFP_NOWARN).
 Documentation/core-api/dma-attributes.rst-112-
 --
 Documentation/core-api/dma-attributes.rst=120=where allocation failures are not a problem, and shouldn't bother the logs.
 Documentation/core-api/dma-attributes.rst-121-
 Documentation/core-api/dma-attributes.rst:122:.. note:: At the moment DMA_ATTR_NO_WARN is only implemented on PowerPC.
 Documentation/core-api/dma-attributes.rst-123-
 --
 Documentation/core-api/dma-isa-lpc.rst=45=allocate the memory during boot-up it's a good idea to also pass
 Documentation/core-api/dma-isa-lpc.rst:46:__GFP_RETRY_MAYFAIL and __GFP_NOWARN to make the allocator try a bit harder.
 Documentation/core-api/dma-isa-lpc.rst-47-
 --
 Documentation/core-api/printk-basics.rst=28=string, the log level is not a separate argument). The available log levels are:
 --
 Documentation/core-api/printk-basics.rst-40-+----------------+--------+-----------------------------------------------+
 Documentation/core-api/printk-basics.rst:41:| KERN_WARNING   | "4"    | pr_warn()                                     |
 Documentation/core-api/printk-basics.rst-42-+----------------+--------+-----------------------------------------------+
 --
 Documentation/core-api/printk-basics.rst=77=Another way, using ``dmesg``::
 --
 Documentation/core-api/printk-basics.rst-80-
 Documentation/core-api/printk-basics.rst:81:sets the console_loglevel to print KERN_WARNING (4) or more severe messages to
 Documentation/core-api/printk-basics.rst-82-console. See ``dmesg(1)`` for more information.
 --
 Documentation/core-api/printk-formats.rst=51=The kernel's printf does not support %n. Floating point formats (%e, %f,
 Documentation/core-api/printk-formats.rst-52-%g, %a) are also not recognized, for obvious reasons. Use of any
 Documentation/core-api/printk-formats.rst:53:unsupported specifier or length qualifier results in a WARN and early
 Documentation/core-api/printk-formats.rst-54-return from vsnprintf().
 --
 Documentation/core-api/printk-formats.rst=603=Flags bitfields such as page flags and gfp_flags
 --
 Documentation/core-api/printk-formats.rst-608-	%pGp	0x17ffffc0002036(referenced|uptodate|lru|active|private|node=0|zone=2|lastcpupid=0x1fffff)
 Documentation/core-api/printk-formats.rst:609:	%pGg	GFP_USER|GFP_DMA32|GFP_NOWARN
 Documentation/core-api/printk-formats.rst-610-	%pGv	read|exec|mayread|maywrite|mayexec|denywrite
 --
 Documentation/crypto/userspace-if.rst=311=requires more data, multiple calls to read()/recvmsg() must be made.
 Documentation/crypto/userspace-if.rst-312-
 Documentation/crypto/userspace-if.rst:313:WARNING: The user space caller may invoke the initially mentioned accept
 Documentation/crypto/userspace-if.rst-314-system call multiple times. In this case, the returned file descriptors
 --
 Documentation/dev-tools/checkpatch.rst=25=Available options:
 --
 Documentation/dev-tools/checkpatch.rst-132-   The message level is different for patch and file contexts.  For patches,
 Documentation/dev-tools/checkpatch.rst:133:   a WARNING is emitted.  While a milder CHECK is emitted for files.  So for
 Documentation/dev-tools/checkpatch.rst-134-   file contexts, the --strict flag must also be enabled.
 --
 Documentation/dev-tools/checkpatch.rst=217=in checkpatch denote the severity of the error. They are:
 --
 Documentation/dev-tools/checkpatch.rst-223-
 Documentation/dev-tools/checkpatch.rst:224: - WARNING
 Documentation/dev-tools/checkpatch.rst-225-
 Documentation/dev-tools/checkpatch.rst:226:   This is the next stricter level.  Messages of type WARNING requires a
 Documentation/dev-tools/checkpatch.rst-227-   more careful review.  But it is milder than an ERROR.
 --
 Documentation/dev-tools/checkpatch.rst=272=API usage
 --
 Documentation/dev-tools/checkpatch.rst-286-    BUG() or BUG_ON() should be avoided totally.
 Documentation/dev-tools/checkpatch.rst:287:    Use WARN() and WARN_ON() instead, and handle the "impossible"
 Documentation/dev-tools/checkpatch.rst-288-    error condition as gracefully as possible.
 --
 Documentation/dev-tools/checkpatch.rst=753=Macros, Attributes and Symbols
 --
 Documentation/dev-tools/checkpatch.rst-905-
 Documentation/dev-tools/checkpatch.rst:906:      WARNING: Argument 'a' is not used in function-like macro.
 Documentation/dev-tools/checkpatch.rst-907-
 --
 Documentation/dev-tools/context-analysis.rst=16=features. To enable for Clang, configure the kernel with::
 Documentation/dev-tools/context-analysis.rst-17-
 Documentation/dev-tools/context-analysis.rst:18:    CONFIG_WARN_CONTEXT_ANALYSIS=y
 Documentation/dev-tools/context-analysis.rst-19-
 --
 Documentation/dev-tools/context-analysis.rst=32=numerous false positive warnings currently and is *not* generally recommended::
 Documentation/dev-tools/context-analysis.rst-33-
 Documentation/dev-tools/context-analysis.rst:34:    CONFIG_WARN_CONTEXT_ANALYSIS_ALL=y
 Documentation/dev-tools/context-analysis.rst-35-
 --
 Documentation/devicetree/bindings/cpufreq/cpufreq-st.txt=49=cpu0_opp_table: opp_table {
 --
 Documentation/devicetree/bindings/cpufreq/cpufreq-st.txt-52-	/* ############################################################### */
 Documentation/devicetree/bindings/cpufreq/cpufreq-st.txt:53:	/* # WARNING: Do not attempt to copy/replicate these nodes,      # */
 Documentation/devicetree/bindings/cpufreq/cpufreq-st.txt-54-	/* #          they are only to be supplied by the bootloader !!! # */
 --
 Documentation/devicetree/bindings/mtd/gpmi-nand.yaml=18=properties:
 --
 Documentation/devicetree/bindings/mtd/gpmi-nand.yaml-85-      NOTE: this is only valid in conjunction with 'nand-on-flash-bbt'.
 Documentation/devicetree/bindings/mtd/gpmi-nand.yaml:86:      WARNING: on i.MX28 blockmark swapping cannot be disabled for the BootROM
 Documentation/devicetree/bindings/mtd/gpmi-nand.yaml-87-      in the FCB. Thus, partitions written from Linux with this feature turned
 --
 Documentation/devicetree/bindings/sound/cs35l36.txt=31=Optional properties:
 --
 Documentation/devicetree/bindings/sound/cs35l36.txt-79-  When the threshold is met, the overtemperature warning attenuation is applied
 Documentation/devicetree/bindings/sound/cs35l36.txt:80:  and the TEMP_WARN_EINT interrupt status bit is set.
 Documentation/devicetree/bindings/sound/cs35l36.txt:81:  If TEMP_WARN_MASK = 0, INTb is asserted.
 Documentation/devicetree/bindings/sound/cs35l36.txt-82-
 --
 Documentation/driver-api/80211/mac80211-advanced.rst=131=TX A-MPDU aggregation
 --
 Documentation/driver-api/80211/mac80211-advanced.rst-136-
 Documentation/driver-api/80211/mac80211-advanced.rst:137:.. WARNING: DOCPROC directive not supported: !Cnet/mac80211/agg-tx.c
 Documentation/driver-api/80211/mac80211-advanced.rst-138-
 Documentation/driver-api/80211/mac80211-advanced.rst=139=RX A-MPDU aggregation
 --
 Documentation/driver-api/80211/mac80211-advanced.rst-144-
 Documentation/driver-api/80211/mac80211-advanced.rst:145:.. WARNING: DOCPROC directive not supported: !Cnet/mac80211/agg-rx.c
 Documentation/driver-api/80211/mac80211-advanced.rst-146-
 --
 Documentation/driver-api/device_link.rst=239=If that constraint is violated, :c:func:`device_link_add()` will return
 Documentation/driver-api/device_link.rst:240:``NULL`` and a ``WARNING`` will be logged.
 Documentation/driver-api/device_link.rst-241-
 --
 Documentation/driver-api/media/v4l2-controls.rst=814=There can be only one notify function per control handler. Any attempt
 Documentation/driver-api/media/v4l2-controls.rst:815:to set another notify function will cause a WARN_ON.
 Documentation/driver-api/media/v4l2-controls.rst-816-
 --
 Documentation/driver-api/mtdnand.rst=272=unregisters the partitions in the MTD layer.
 --
 Documentation/driver-api/mtdnand.rst-279-        /* Unregister device */
 Documentation/driver-api/mtdnand.rst:280:        WARN_ON(mtd_device_unregister(board_mtd));
 Documentation/driver-api/mtdnand.rst-281-        /* Release resources */
 --
 Documentation/driver-api/thermal/nouveau_thermal.rst=29=temperature thresholds:
 --
 Documentation/driver-api/thermal/nouveau_thermal.rst-39-
 Documentation/driver-api/thermal/nouveau_thermal.rst:40:WARNING:
 Documentation/driver-api/thermal/nouveau_thermal.rst-41-	Some of these thresholds may not be used by Nouveau depending
 --
 Documentation/driver-api/usb/persist.rst=135=other device types, such as network interfaces.
 --
 Documentation/driver-api/usb/persist.rst-137-
 Documentation/driver-api/usb/persist.rst:138:WARNING: USB-persist can be dangerous!!
 Documentation/driver-api/usb/persist.rst-139-=======================================
 --
 Documentation/driver-api/usb/persist.rst=165=maybe fail because they may morph after reset.
 Documentation/driver-api/usb/persist.rst-166-
 Documentation/driver-api/usb/persist.rst:167:YOU HAVE BEEN WARNED!  USE AT YOUR OWN RISK!
 Documentation/driver-api/usb/persist.rst-168-
 --
 Documentation/filesystems/nfs/nfsd-maintainer-entry-profile.rst=128=NFSD employs several different mechanisms for observing operation,
 Documentation/filesystems/nfs/nfsd-maintainer-entry-profile.rst:129:including counters, printks, WARNings, and static trace points. Each
 Documentation/filesystems/nfs/nfsd-maintainer-entry-profile.rst-130-have their strengths and weaknesses. Contributors should select the
 Documentation/filesystems/nfs/nfsd-maintainer-entry-profile.rst=131=most appropriate tool for their task.
 --
 Documentation/filesystems/nfs/nfsd-maintainer-entry-profile.rst-135-
 Documentation/filesystems/nfs/nfsd-maintainer-entry-profile.rst:136:- WARN is appropriate only when a full stack trace is useful.
 Documentation/filesystems/nfs/nfsd-maintainer-entry-profile.rst-137-
 --
 Documentation/filesystems/porting.rst=815=just get rid of it.  Synchronous work (e.g. the stuff that can't
 Documentation/filesystems/porting.rst:816:be done from an RCU callback, or any WARN_ON() where we want the
 Documentation/filesystems/porting.rst-817-stack trace) *might* be movable to ->evict_inode(); however,
 --
 Documentation/filesystems/quota.rst=38=sent only in initial network namespace.
 Documentation/filesystems/quota.rst-39-
 Documentation/filesystems/quota.rst:40:Currently, the interface supports only one message type QUOTA_NL_C_WARNING.
 Documentation/filesystems/quota.rst-41-This command is used to send a notification about any of the above mentioned
 --
 Documentation/filesystems/quota.rst=43=in parentheses):
 --
 Documentation/filesystems/quota.rst-51-	  - UID of a user who caused the event
 Documentation/filesystems/quota.rst:52:        QUOTA_NL_A_WARNING (u32)
 Documentation/filesystems/quota.rst-53-	  - what kind of limit is exceeded:
 Documentation/filesystems/quota.rst-54-
 Documentation/filesystems/quota.rst:55:		QUOTA_NL_IHARDWARN
 Documentation/filesystems/quota.rst-56-		    inode hardlimit
 Documentation/filesystems/quota.rst:57:		QUOTA_NL_ISOFTLONGWARN
 Documentation/filesystems/quota.rst-58-		    inode softlimit is exceeded longer
 Documentation/filesystems/quota.rst-59-		    than given grace period
 Documentation/filesystems/quota.rst:60:		QUOTA_NL_ISOFTWARN
 Documentation/filesystems/quota.rst-61-		    inode softlimit
 Documentation/filesystems/quota.rst:62:		QUOTA_NL_BHARDWARN
 Documentation/filesystems/quota.rst-63-		    space (block) hardlimit
 Documentation/filesystems/quota.rst:64:		QUOTA_NL_BSOFTLONGWARN
 Documentation/filesystems/quota.rst-65-		    space (block) softlimit is exceeded
 Documentation/filesystems/quota.rst-66-		    longer than given grace period.
 Documentation/filesystems/quota.rst:67:		QUOTA_NL_BSOFTWARN
 Documentation/filesystems/quota.rst-68-		    space (block) softlimit
 --
 Documentation/filesystems/xfs/xfs-online-fsck-design.rst=1067=three decisions about the health of a metadata structure:
 --
 Documentation/filesystems/xfs/xfs-online-fsck-design.rst-1076-- Does the structure contain data that is not inconsistent but deserves review
 Documentation/filesystems/xfs/xfs-online-fsck-design.rst:1077:  by the system administrator (``XFS_SCRUB_OFLAG_WARNING``) ?
 Documentation/filesystems/xfs/xfs-online-fsck-design.rst-1078-
 --
 Documentation/gpu/introduction.rst=35=Instead locking should be check at runtime using e.g.
 Documentation/gpu/introduction.rst:36:``WARN_ON(!mutex_is_locked(...));``. Since it's much easier to ignore
 Documentation/gpu/introduction.rst-37-documentation than runtime noise this provides more value. And on top of
 --
 Documentation/gpu/todo.rst=153=interfaces to fix these issues:
 --
 Documentation/gpu/todo.rst-161-  Except for some driver code this is done. This task should be finished by
 Documentation/gpu/todo.rst:162:  adding WARN_ON(!drm_drv_uses_atomic_modeset) in drm_modeset_lock_all().
 Documentation/gpu/todo.rst-163-
 --
 Documentation/gpu/todo.rst=195=For drivers which could have multiple instances, it is necessary to
 Documentation/gpu/todo.rst:196:differentiate between which is which in the logs. Since DRM_INFO/WARN/ERROR
 Documentation/gpu/todo.rst-197-don't do this, drivers used dev_info/warn/err to make this differentiation. We
 --
 Documentation/gpu/todo.rst=453=double-calls prepare/enable/disable/unprepare. Eventually that should probably
 Documentation/gpu/todo.rst:454:be turned into a WARN_ON() or somehow made louder.
 Documentation/gpu/todo.rst-455-
 --
 Documentation/hwmon/max16064.rst=49=in[1-4]_input		Measured voltage. From READ_VOUT register.
 Documentation/hwmon/max16064.rst:50:in[1-4]_min		Minimum Voltage. From VOUT_UV_WARN_LIMIT register.
 Documentation/hwmon/max16064.rst:51:in[1-4]_max		Maximum voltage. From VOUT_OV_WARN_LIMIT register.
 Documentation/hwmon/max16064.rst-52-in[1-4]_lcrit		Critical minimum Voltage. VOUT_UV_FAULT_LIMIT register.
 Documentation/hwmon/max16064.rst=53=in[1-4]_crit		Critical maximum voltage. From VOUT_OV_FAULT_LIMIT
 Documentation/hwmon/max16064.rst-54-			register.
 Documentation/hwmon/max16064.rst:55:in[1-4]_min_alarm	Voltage low alarm. From VOLTAGE_UV_WARNING status.
 Documentation/hwmon/max16064.rst:56:in[1-4]_max_alarm	Voltage high alarm. From VOLTAGE_OV_WARNING status.
 Documentation/hwmon/max16064.rst-57-in[1-4]_lcrit_alarm	Voltage critical low alarm. From VOLTAGE_UV_FAULT
 --
 Documentation/hwmon/max16064.rst=64=temp1_input		Measured temperature. From READ_TEMPERATURE_1 register.
 Documentation/hwmon/max16064.rst:65:temp1_max		Maximum temperature. From OT_WARN_LIMIT register.
 Documentation/hwmon/max16064.rst-66-temp1_crit		Critical high temperature. From OT_FAULT_LIMIT register.
 Documentation/hwmon/max16064.rst=67=temp1_max_alarm		Chip temperature high alarm. Set by comparing
 Documentation/hwmon/max16064.rst:68:			READ_TEMPERATURE_1 with OT_WARN_LIMIT if TEMP_OT_WARNING
 Documentation/hwmon/max16064.rst-69-			status is set.
 --
 Documentation/hwmon/max16065.rst=83=details.
 Documentation/hwmon/max16065.rst-84-
 Documentation/hwmon/max16065.rst:85:WARNING: Do not access chip registers using the i2cdump command, and do not use
 Documentation/hwmon/max16065.rst-86-any of the i2ctools commands on a command register (0xa5 to 0xac). The chips
 --
 Documentation/hwmon/max34440.rst=132=in[1-6]_input		Measured voltage. From READ_VOUT register.
 Documentation/hwmon/max34440.rst:133:in[1-6]_min		Minimum Voltage. From VOUT_UV_WARN_LIMIT register.
 Documentation/hwmon/max34440.rst:134:in[1-6]_max		Maximum voltage. From VOUT_OV_WARN_LIMIT register.
 Documentation/hwmon/max34440.rst-135-in[1-6]_lcrit		Critical minimum Voltage. VOUT_UV_FAULT_LIMIT register.
 Documentation/hwmon/max34440.rst=136=in[1-6]_crit		Critical maximum voltage. From VOUT_OV_FAULT_LIMIT
 Documentation/hwmon/max34440.rst-137-			register.
 Documentation/hwmon/max34440.rst:138:in[1-6]_min_alarm	Voltage low alarm. From VOLTAGE_UV_WARNING status.
 Documentation/hwmon/max34440.rst:139:in[1-6]_max_alarm	Voltage high alarm. From VOLTAGE_OV_WARNING status.
 Documentation/hwmon/max34440.rst-140-in[1-6]_lcrit_alarm	Voltage critical low alarm. From VOLTAGE_UV_FAULT
 --
 Documentation/hwmon/max34440.rst=160=curr[1-6]_input		Measured current. From READ_IOUT register.
 Documentation/hwmon/max34440.rst:161:curr[1-6]_max		Maximum current. From IOUT_OC_WARN_LIMIT register.
 Documentation/hwmon/max34440.rst-162-curr[1-6]_crit		Critical maximum current. From IOUT_OC_FAULT_LIMIT
 Documentation/hwmon/max34440.rst-163-			register.
 Documentation/hwmon/max34440.rst:164:curr[1-6]_max_alarm	Current high alarm. From IOUT_OC_WARNING status.
 Documentation/hwmon/max34440.rst-165-curr[1-6]_crit_alarm	Current critical high alarm. From IOUT_OC_FAULT status.
 --
 Documentation/hwmon/max34440.rst=194=temp[1-8]_input		Measured temperatures. From READ_TEMPERATURE_1 register.
 --
 Documentation/hwmon/max34440.rst-198-			are remote I2C temperature sensors.
 Documentation/hwmon/max34440.rst:199:temp[1-8]_max		Maximum temperature. From OT_WARN_LIMIT register.
 Documentation/hwmon/max34440.rst-200-temp[1-8]_crit		Critical high temperature. From OT_FAULT_LIMIT register.
 --
 Documentation/hwmon/max8688.rst=49=in1_input		Measured voltage. From READ_VOUT register.
 Documentation/hwmon/max8688.rst:50:in1_min			Minimum Voltage. From VOUT_UV_WARN_LIMIT register.
 Documentation/hwmon/max8688.rst:51:in1_max			Maximum voltage. From VOUT_OV_WARN_LIMIT register.
 Documentation/hwmon/max8688.rst-52-in1_lcrit		Critical minimum Voltage. VOUT_UV_FAULT_LIMIT register.
 Documentation/hwmon/max8688.rst=53=in1_crit		Critical maximum voltage. From VOUT_OV_FAULT_LIMIT
 Documentation/hwmon/max8688.rst-54-			register.
 Documentation/hwmon/max8688.rst:55:in1_min_alarm		Voltage low alarm. From VOLTAGE_UV_WARNING status.
 Documentation/hwmon/max8688.rst:56:in1_max_alarm		Voltage high alarm. From VOLTAGE_OV_WARNING status.
 Documentation/hwmon/max8688.rst-57-in1_lcrit_alarm		Voltage critical low alarm. From VOLTAGE_UV_FAULT
 --
 Documentation/hwmon/max8688.rst=65=curr1_input		Measured current. From READ_IOUT register.
 Documentation/hwmon/max8688.rst:66:curr1_max		Maximum current. From IOUT_OC_WARN_LIMIT register.
 Documentation/hwmon/max8688.rst-67-curr1_crit		Critical maximum current. From IOUT_OC_FAULT_LIMIT
 Documentation/hwmon/max8688.rst-68-			register.
 Documentation/hwmon/max8688.rst:69:curr1_max_alarm		Current high alarm. From IOUT_OC_WARN_LIMIT register.
 Documentation/hwmon/max8688.rst-70-curr1_crit_alarm	Current critical high alarm. From IOUT_OC_FAULT status.
 --
 Documentation/hwmon/max8688.rst=74=temp1_input		Measured temperature. From READ_TEMPERATURE_1 register.
 Documentation/hwmon/max8688.rst:75:temp1_max		Maximum temperature. From OT_WARN_LIMIT register.
 Documentation/hwmon/max8688.rst-76-temp1_crit		Critical high temperature. From OT_FAULT_LIMIT register.
 Documentation/hwmon/max8688.rst=77=temp1_max_alarm		Chip temperature high alarm. Set by comparing
 Documentation/hwmon/max8688.rst:78:			READ_TEMPERATURE_1 with OT_WARN_LIMIT if TEMP_OT_WARNING
 Documentation/hwmon/max8688.rst-79-			status is set.
 --
 Documentation/hwmon/pmbus.rst=195=inX_min			Minimum Voltage.
 Documentation/hwmon/pmbus.rst:196:			From VIN_UV_WARN_LIMIT or VOUT_UV_WARN_LIMIT register.
 Documentation/hwmon/pmbus.rst-197-inX_max			Maximum voltage.
 Documentation/hwmon/pmbus.rst:198:			From VIN_OV_WARN_LIMIT or VOUT_OV_WARN_LIMIT register.
 Documentation/hwmon/pmbus.rst-199-inX_lcrit		Critical minimum Voltage.
 --
 Documentation/hwmon/pmbus.rst=201=inX_crit		Critical maximum voltage.
 Documentation/hwmon/pmbus.rst-202-			From VIN_OV_FAULT_LIMIT or VOUT_OV_FAULT_LIMIT register.
]
]

gemini-3-pro-preview

							input: 218314
							output: 17
							thoughts: 46
						

Okay, here's my interpretation of those thoughts, summarized from my perspective as someone familiar with kernel development:

**Investigating a Potentially Problematic `WARN` Usage**

Right, `WARN` is a pretty ubiquitous macro in the kernel, so it's probably not the most efficient search term to pinpoint a specific issue. Given the context, I suspect there's a particular warning I'm interested in tracing. Let's see... a much more specific search term I can use is `WARN_ON`. I'll focus my investigation within the terminal emulator subsystems, specifically `drivers/tty/vt/vt.c` and `drivers/tty/vt/vt_ioctl.c`. Hopefully, I can locate the warning condition I'm thinking of by searching in these key files for `WARN_ON`. This will likely give me much more granular results that I can evaluate.

map[Expression:WARN_ON]

map[Output:
Full output is too long, showing 500 out of 134671 lines.
Use more precise expression if possible.

[Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst=78=lock-acquisition and lock-release functions::
 --
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst-104-   25
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst:105:   26 WARN_ON(r1 == 0 && r2 == 0 && r3 == 0);
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst-106-
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst:107:The ``WARN_ON()`` is evaluated at "the end of time",
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst-108-after all changes have propagated throughout the system.
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst=109=Without the ``smp_mb__after_unlock_lock()`` provided by the
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst:110:acquisition functions, this ``WARN_ON()`` could trigger, for example
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst-111-on PowerPC.
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst=112=The ``smp_mb__after_unlock_lock()`` invocations prevent this
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst:113:``WARN_ON()`` from triggering.
 Documentation/RCU/Design/Memory-Ordering/Tree-RCU-Memory-Ordering.rst-114-
 --
 Documentation/RCU/Design/Requirements/Requirements.rst=755=example illustrates this:
 --
 Documentation/RCU/Design/Requirements/Requirements.rst-765-       7     r2 = READ_ONCE(x);
 Documentation/RCU/Design/Requirements/Requirements.rst:766:       8     WARN_ON(!r2); /* BUG!!! */
 Documentation/RCU/Design/Requirements/Requirements.rst-767-       9   }
 --
 Documentation/RCU/Design/Requirements/Requirements.rst=779=If the thread0() function's rcu_read_lock() excluded the
 Documentation/RCU/Design/Requirements/Requirements.rst:780:thread1() function's update, the WARN_ON() could never fire. But
 Documentation/RCU/Design/Requirements/Requirements.rst-781-the fact is that rcu_read_lock() does not exclude much of anything
 Documentation/RCU/Design/Requirements/Requirements.rst=782=aside from subsequent grace periods, of which thread1() has none, so
 Documentation/RCU/Design/Requirements/Requirements.rst:783:the WARN_ON() can and does fire.
 Documentation/RCU/Design/Requirements/Requirements.rst-784-
 --
 Documentation/RCU/lockdep.rst=25=aren't certain (for example, if CONFIG_DEBUG_LOCK_ALLOC is not set).
 Documentation/RCU/lockdep.rst:26:This prevents things like WARN_ON(!rcu_read_lock_held()) from giving false
 Documentation/RCU/lockdep.rst-27-positives when lockdep is disabled.
 --
 Documentation/admin-guide/clearing-warn-once.rst:1:Clearing WARN_ONCE
 Documentation/admin-guide/clearing-warn-once.rst-2-------------------
 Documentation/admin-guide/clearing-warn-once.rst-3-
 Documentation/admin-guide/clearing-warn-once.rst:4:WARN_ONCE / WARN_ON_ONCE / printk_once only emit a message once.
 Documentation/admin-guide/clearing-warn-once.rst-5-
 --
 Documentation/admin-guide/kernel-parameters.txt=98=Kernel parameters
 --
 Documentation/admin-guide/kernel-parameters.txt-4206-			this means that duplicate request_module() calls will
 Documentation/admin-guide/kernel-parameters.txt:4207:			trigger a WARN_ON() instead of a pr_warn(). Note that
 Documentation/admin-guide/kernel-parameters.txt:4208:			if MODULE_DEBUG_AUTOLOAD_DUPS_TRACE is set, WARN_ON()s
 Documentation/admin-guide/kernel-parameters.txt-4209-			will always be issued and this option does nothing.
 --
 Documentation/admin-guide/kernel-parameters.txt-5837-			This wake_up() will be accompanied by a
 Documentation/admin-guide/kernel-parameters.txt:5838:			WARN_ONCE() splat and an ftrace_dump().
 Documentation/admin-guide/kernel-parameters.txt-5839-
 --
 Documentation/dev-tools/checkpatch.rst=272=API usage
 --
 Documentation/dev-tools/checkpatch.rst-286-    BUG() or BUG_ON() should be avoided totally.
 Documentation/dev-tools/checkpatch.rst:287:    Use WARN() and WARN_ON() instead, and handle the "impossible"
 Documentation/dev-tools/checkpatch.rst-288-    error condition as gracefully as possible.
 --
 Documentation/driver-api/media/v4l2-controls.rst=814=There can be only one notify function per control handler. Any attempt
 Documentation/driver-api/media/v4l2-controls.rst:815:to set another notify function will cause a WARN_ON.
 Documentation/driver-api/media/v4l2-controls.rst-816-
 --
 Documentation/driver-api/mtdnand.rst=272=unregisters the partitions in the MTD layer.
 --
 Documentation/driver-api/mtdnand.rst-279-        /* Unregister device */
 Documentation/driver-api/mtdnand.rst:280:        WARN_ON(mtd_device_unregister(board_mtd));
 Documentation/driver-api/mtdnand.rst-281-        /* Release resources */
 --
 Documentation/filesystems/porting.rst=815=just get rid of it.  Synchronous work (e.g. the stuff that can't
 Documentation/filesystems/porting.rst:816:be done from an RCU callback, or any WARN_ON() where we want the
 Documentation/filesystems/porting.rst-817-stack trace) *might* be movable to ->evict_inode(); however,
 --
 Documentation/gpu/introduction.rst=35=Instead locking should be check at runtime using e.g.
 Documentation/gpu/introduction.rst:36:``WARN_ON(!mutex_is_locked(...));``. Since it's much easier to ignore
 Documentation/gpu/introduction.rst-37-documentation than runtime noise this provides more value. And on top of
 --
 Documentation/gpu/todo.rst=153=interfaces to fix these issues:
 --
 Documentation/gpu/todo.rst-161-  Except for some driver code this is done. This task should be finished by
 Documentation/gpu/todo.rst:162:  adding WARN_ON(!drm_drv_uses_atomic_modeset) in drm_modeset_lock_all().
 Documentation/gpu/todo.rst-163-
 --
 Documentation/gpu/todo.rst=453=double-calls prepare/enable/disable/unprepare. Eventually that should probably
 Documentation/gpu/todo.rst:454:be turned into a WARN_ON() or somehow made louder.
 Documentation/gpu/todo.rst-455-
 --
 Documentation/leds/leds-class.rst=147=led_classdev_notify_brightness_hw_changed on a classdev not registered with
 Documentation/leds/leds-class.rst:148:the LED_BRIGHT_HW_CHANGED flag is a bug and will trigger a WARN_ON.
 Documentation/leds/leds-class.rst-149-
 --
 Documentation/locking/lockdep-design.rst=340=Exceeding this number will trigger the following lockdep warning::
 Documentation/locking/lockdep-design.rst-341-
 Documentation/locking/lockdep-design.rst:342:	(DEBUG_LOCKS_WARN_ON(id >= MAX_LOCKDEP_KEYS))
 Documentation/locking/lockdep-design.rst-343-
 --
 Documentation/memory-barriers.txt=1558=of optimizations:
 --
 Documentation/memory-barriers.txt-1732-     interrupt handler returns with interrupts enabled, you will get a
 Documentation/memory-barriers.txt:1733:     WARN_ONCE() splat.)
 Documentation/memory-barriers.txt-1734-
 --
 Documentation/process/coding-style.rst=1229=BUG_ON(), or VM_BUG_ON(). Instead, use a WARN*() variant, preferably
 Documentation/process/coding-style.rst:1230:WARN_ON_ONCE(), and possibly with recovery code. Recovery code is not
 Documentation/process/coding-style.rst-1231-required if there is no reasonable way to at least partially recover.
 --
 Documentation/process/coding-style.rst=1235=good justification.
 Documentation/process/coding-style.rst-1236-
 Documentation/process/coding-style.rst:1237:Use WARN_ON_ONCE() rather than WARN() or WARN_ON()
 Documentation/process/coding-style.rst-1238-**************************************************
 Documentation/process/coding-style.rst-1239-
 Documentation/process/coding-style.rst:1240:WARN_ON_ONCE() is generally preferred over WARN() or WARN_ON(), because it
 Documentation/process/coding-style.rst-1241-is common for a given warning condition, if it occurs at all, to occur
 --
 Documentation/process/debugging/userspace_debugging_guide.rst=210=Kernel panic analysis tools
 --
 Documentation/process/debugging/userspace_debugging_guide.rst-243-     ae8:	f9418015 	ldr	x21, [x0, #768]
 Documentation/process/debugging/userspace_debugging_guide.rst:244:        if (WARN_ON(!desc))
 Documentation/process/debugging/userspace_debugging_guide.rst-245-     aec:	b4000654 	cbz	x20, bb4 <rkvdec_device_run+0xec>
 --
 Documentation/process/deprecated.rst=32=BUG() and BUG_ON()
 Documentation/process/deprecated.rst-33-------------------
 Documentation/process/deprecated.rst:34:Use WARN() and WARN_ON() instead, and handle the "impossible"
 Documentation/process/deprecated.rst-35-error condition as gracefully as possible. While the BUG()-family
 --
 Documentation/sound/kernel-api/writing-an-alsa-driver.rst=4040=When no debug flag is set, this macro is ignored.
 --
 Documentation/sound/kernel-api/writing-an-alsa-driver.rst-4045-:c:func:`snd_BUG_ON()` macro is similar with
 Documentation/sound/kernel-api/writing-an-alsa-driver.rst:4046::c:func:`WARN_ON()` macro. For example, snd_BUG_ON(!pointer); or
 Documentation/sound/kernel-api/writing-an-alsa-driver.rst-4047-it can be used as the condition, if (snd_BUG_ON(non_zero_is_bug))
 --
 Documentation/trace/boottime-trace.rst=43=kernel.traceoff_on_warning
 Documentation/trace/boottime-trace.rst:44:   Stop tracing if WARN_ON() occurs.
 Documentation/trace/boottime-trace.rst-45-
 --
 Documentation/translations/it_IT/locking/lockdep-design.rst=342=seguente avviso::
 Documentation/translations/it_IT/locking/lockdep-design.rst-343-
 Documentation/translations/it_IT/locking/lockdep-design.rst:344:	(DEBUG_LOCKS_WARN_ON(id >= MAX_LOCKDEP_KEYS))
 Documentation/translations/it_IT/locking/lockdep-design.rst-345-
 --
 Documentation/translations/it_IT/process/deprecated.rst=37=BUG() e BUG_ON()
 Documentation/translations/it_IT/process/deprecated.rst-38-----------------
 Documentation/translations/it_IT/process/deprecated.rst:39:Al loro posto usate WARN() e WARN_ON() per gestire le
 Documentation/translations/it_IT/process/deprecated.rst-40-condizioni "impossibili" e gestitele come se fosse possibile farlo.
 --
 Documentation/translations/sp_SP/memory-barriers.txt=1622=algunos ejemplos de tal tipo de optimizaciones:
 --
 Documentation/translations/sp_SP/memory-barriers.txt-1803-     hecho, si un controlador de interrupciones regresa con interrupciones
 Documentation/translations/sp_SP/memory-barriers.txt:1804:     habilitadas, obtendrá un WARN_ONCE().)
 Documentation/translations/sp_SP/memory-barriers.txt-1805-
 --
 Documentation/translations/sp_SP/process/coding-style.rst=1247=BUG(), BUG_ON() o VM_BUG_ON(). En su lugar, use una variante WARN*(),
 Documentation/translations/sp_SP/process/coding-style.rst:1248:preferiblemente WARN_ON_ONCE(), y posiblemente con código de recuperación.
 Documentation/translations/sp_SP/process/coding-style.rst-1249-El código de recuperación no es requerido si no hay una forma razonable de
 --
 Documentation/translations/sp_SP/process/coding-style.rst=1254=aún pueden usar BUG(), pero necesitan una buena justificación.
 Documentation/translations/sp_SP/process/coding-style.rst-1255-
 Documentation/translations/sp_SP/process/coding-style.rst:1256:Use WARN_ON_ONCE() en lugar de WARN() o WARN_ON()
 Documentation/translations/sp_SP/process/coding-style.rst-1257-*************************************************
 Documentation/translations/sp_SP/process/coding-style.rst-1258-
 Documentation/translations/sp_SP/process/coding-style.rst:1259:Generalmente, se prefiere WARN_ON_ONCE() a WARN() o WARN_ON(), porque es
 Documentation/translations/sp_SP/process/coding-style.rst-1260-común que una condición de advertencia dada, si ocurre, ocurra varias
 --
 Documentation/translations/sp_SP/process/deprecated.rst=35=BUG() y BUG_ON()
 Documentation/translations/sp_SP/process/deprecated.rst-36-----------------
 Documentation/translations/sp_SP/process/deprecated.rst:37:Use WARN() y WARN_ON() en su lugar, y gestione las condiciones de error
 Documentation/translations/sp_SP/process/deprecated.rst-38-"imposibles" tan elegantemente como se pueda. Mientras que la familia de
 --
 Documentation/translations/zh_CN/admin-guide/clearing-warn-once.rst:1:清除 WARN_ONCE
 Documentation/translations/zh_CN/admin-guide/clearing-warn-once.rst-2---------------
 Documentation/translations/zh_CN/admin-guide/clearing-warn-once.rst-3-
 Documentation/translations/zh_CN/admin-guide/clearing-warn-once.rst:4:WARN_ONCE / WARN_ON_ONCE / printk_once 仅仅打印一次消息.
 Documentation/translations/zh_CN/admin-guide/clearing-warn-once.rst-5-
 --
 Documentation/translations/zh_TW/admin-guide/clearing-warn-once.rst-6-
 Documentation/translations/zh_TW/admin-guide/clearing-warn-once.rst:7:清除 WARN_ONCE
 Documentation/translations/zh_TW/admin-guide/clearing-warn-once.rst-8---------------
 Documentation/translations/zh_TW/admin-guide/clearing-warn-once.rst-9-
 Documentation/translations/zh_TW/admin-guide/clearing-warn-once.rst:10:WARN_ONCE / WARN_ON_ONCE / printk_once 僅僅打印一次消息.
 Documentation/translations/zh_TW/admin-guide/clearing-warn-once.rst-11-
 --
 Makefile=829=ifeq ("$(origin UT)", "command line")
 Makefile:830:  WARN_ON_UNUSED_TRACEPOINTS := $(UT)
 Makefile-831-endif
 Makefile=832=endif # CONFIG_TRACEPOINTS
 Makefile-833-
 Makefile:834:export WARN_ON_UNUSED_TRACEPOINTS
 Makefile-835-
 --
 arch/alpha/kernel/perf_event.c=552=static void alpha_pmu_start(struct perf_event *event, int flags)
 --
 arch/alpha/kernel/perf_event.c-556-
 arch/alpha/kernel/perf_event.c:557:	if (WARN_ON_ONCE(!(hwc->state & PERF_HES_STOPPED)))
 arch/alpha/kernel/perf_event.c-558-		return;
 --
 arch/alpha/kernel/perf_event.c-560-	if (flags & PERF_EF_RELOAD) {
 arch/alpha/kernel/perf_event.c:561:		WARN_ON_ONCE(!(hwc->state & PERF_HES_UPTODATE));
 arch/alpha/kernel/perf_event.c-562-		alpha_perf_event_set_period(event, hwc, hwc->idx);
 --
 arch/arc/kernel/perf_event.c=451=static void arc_pmu_start(struct perf_event *event, int flags)
 --
 arch/arc/kernel/perf_event.c-455-
 arch/arc/kernel/perf_event.c:456:	if (WARN_ON_ONCE(idx == -1))
 arch/arc/kernel/perf_event.c-457-		return;
 --
 arch/arc/kernel/perf_event.c-459-	if (flags & PERF_EF_RELOAD)
 arch/arc/kernel/perf_event.c:460:		WARN_ON_ONCE(!(hwc->state & PERF_HES_UPTODATE));
 arch/arc/kernel/perf_event.c-461-
 --
 arch/arc/kernel/perf_event.c=562=static irqreturn_t arc_pmu_intr(int irq, void *dev)
 --
 arch/arc/kernel/perf_event.c-597-
 arch/arc/kernel/perf_event.c:598:		WARN_ON_ONCE(hwc->idx != idx);
 arch/arc/kernel/perf_event.c-599-
 --
 arch/arc/kernel/perf_event.c=721=static int arc_pmu_device_probe(struct platform_device *pdev)
 --
 arch/arc/kernel/perf_event.c-742-	BUILD_BUG_ON(ARC_PERF_MAX_COUNTERS > 32);
 arch/arc/kernel/perf_event.c:743:	if (WARN_ON(pct_bcr.c > ARC_PERF_MAX_COUNTERS))
 arch/arc/kernel/perf_event.c-744-		return -EINVAL;
 --
 arch/arc/kernel/process.c=46=SYSCALL_DEFINE3(arc_usr_cmpxchg, int __user *, uaddr, int, expected, int, new)
 --
 arch/arc/kernel/process.c-57-	 */
 arch/arc/kernel/process.c:58:	WARN_ON_ONCE(IS_ENABLED(CONFIG_SMP));
 arch/arc/kernel/process.c-59-
 --
 arch/arc/kernel/unwind.c=244=static void init_unwind_hdr(struct unwind_table *table,
 --
 arch/arc/kernel/unwind.c-333-	}
 arch/arc/kernel/unwind.c:334:	WARN_ON(n != header->fde_count);
 arch/arc/kernel/unwind.c-335-
 --
 arch/arm/common/bL_switcher.c=417=static int bL_switcher_halve_cpus(void)
 --
 arch/arm/common/bL_switcher.c-431-		}
 arch/arm/common/bL_switcher.c:432:		if (WARN_ON(cpu >= MAX_CPUS_PER_CLUSTER))
 arch/arm/common/bL_switcher.c-433-			return -EINVAL;
 --
 arch/arm/common/mcpm_entry.c=239=void mcpm_cpu_power_down(void)
 --
 arch/arm/common/mcpm_entry.c-248-	pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster);
 arch/arm/common/mcpm_entry.c:249:	if (WARN_ON_ONCE(!platform_ops))
 arch/arm/common/mcpm_entry.c-250-	       return;
 --
 arch/arm/common/mcpm_entry.c=308=int mcpm_wait_for_cpu_powerdown(unsigned int cpu, unsigned int cluster)
 --
 arch/arm/common/mcpm_entry.c-311-
 arch/arm/common/mcpm_entry.c:312:	if (WARN_ON_ONCE(!platform_ops || !platform_ops->wait_for_powerdown))
 arch/arm/common/mcpm_entry.c-313-		return -EUNATCH;
 --
 arch/arm/common/mcpm_entry.c=323=void mcpm_cpu_suspend(void)
 arch/arm/common/mcpm_entry.c-324-{
 arch/arm/common/mcpm_entry.c:325:	if (WARN_ON_ONCE(!platform_ops))
 arch/arm/common/mcpm_entry.c-326-		return;
 --
 arch/arm/configs/sama7_defconfig=232=CONFIG_CMA_ALIGNMENT=9
 arch/arm/configs/sama7_defconfig-233-# CONFIG_DEBUG_MISC is not set
 arch/arm/configs/sama7_defconfig:234:# CONFIG_SECTION_MISMATCH_WARN_ONLY is not set
 arch/arm/configs/sama7_defconfig-235-CONFIG_DEBUG_FS=y
 --
 arch/arm/include/asm/arch_gicv3.h=243=static inline void gic_pmr_mask_irqs(void)
 --
 arch/arm/include/asm/arch_gicv3.h-245-	/* Should not get called. */
 arch/arm/include/asm/arch_gicv3.h:246:	WARN_ON_ONCE(true);
 arch/arm/include/asm/arch_gicv3.h-247-}
 --
 arch/arm/include/asm/arch_gicv3.h=249=static inline void gic_arch_enable_irqs(void)
 --
 arch/arm/include/asm/arch_gicv3.h-251-	/* Should not get called. */
 arch/arm/include/asm/arch_gicv3.h:252:	WARN_ON_ONCE(true);
 arch/arm/include/asm/arch_gicv3.h-253-}
 --
 arch/arm/include/asm/cputype.h=118=struct proc_info_list *lookup_processor(u32 midr);
 --
 arch/arm/include/asm/cputype.h-152-	({								\
 arch/arm/include/asm/cputype.h:153:		WARN_ON_ONCE(1);					\
 arch/arm/include/asm/cputype.h-154-		0;							\
 --
 arch/arm/include/asm/cputype.h=157=static inline unsigned int __attribute_const__ read_cpuid_ext(unsigned offset)
 --
 arch/arm/include/asm/cputype.h-169-	({								\
 arch/arm/include/asm/cputype.h:170:		WARN_ON_ONCE(1);					\
 arch/arm/include/asm/cputype.h-171-		0;							\
 --
 arch/arm/include/asm/proc-fns.h=116=static inline void init_proc_vtable(const struct processor *p)
 --
 arch/arm/include/asm/proc-fns.h-119-	*cpu_vtable[cpu] = *p;
 arch/arm/include/asm/proc-fns.h:120:	WARN_ON_ONCE(cpu_vtable[cpu]->dcache_clean_area !=
 arch/arm/include/asm/proc-fns.h-121-		     cpu_vtable[0]->dcache_clean_area);
 arch/arm/include/asm/proc-fns.h:122:	WARN_ON_ONCE(cpu_vtable[cpu]->set_pte_ext !=
 arch/arm/include/asm/proc-fns.h-123-		     cpu_vtable[0]->set_pte_ext);
 --
 arch/arm/kernel/atags_proc.c=33=static int __init init_atags_procfs(void)
 --
 arch/arm/kernel/atags_proc.c-54-
 arch/arm/kernel/atags_proc.c:55:	WARN_ON(tag->hdr.tag != ATAG_NONE);
 arch/arm/kernel/atags_proc.c-56-
 --
 arch/arm/kernel/cacheinfo.c=34=static inline int cache_line_size_cp15(void)
 --
 arch/arm/kernel/cacheinfo.c-42-		return cwg ? 4 << cwg : ARCH_DMA_MINALIGN;
 arch/arm/kernel/cacheinfo.c:43:	} else if (WARN_ON_ONCE(format != CTR_FORMAT_ARMV6)) {
 arch/arm/kernel/cacheinfo.c-44-		return ARCH_DMA_MINALIGN;
 --
 arch/arm/kernel/hibernate.c=34=void notrace save_processor_state(void)
 arch/arm/kernel/hibernate.c-35-{
 arch/arm/kernel/hibernate.c:36:	WARN_ON(num_online_cpus() != 1);
 arch/arm/kernel/hibernate.c-37-	local_fiq_disable();
 --
 arch/arm/kernel/hw_breakpoint.c=1174=static int __init arch_hw_breakpoint_init(void)
 --
 arch/arm/kernel/hw_breakpoint.c-1223-	unregister_undef_hook(&debug_reg_hook);
 arch/arm/kernel/hw_breakpoint.c:1224:	if (WARN_ON(ret < 0) || !cpumask_empty(&debug_err_mask)) {
 arch/arm/kernel/hw_breakpoint.c-1225-		core_num_brps = 0;
 --
 arch/arm/kernel/insn.c=6=static unsigned long __arm_gen_branch_thumb2(unsigned long pc,
 --
 arch/arm/kernel/insn.c-15-	if (offset < -16777216 || offset > 16777214) {
 arch/arm/kernel/insn.c:16:		WARN_ON_ONCE(warn);
 arch/arm/kernel/insn.c-17-		return 0;
 --
 arch/arm/kernel/insn.c=37=static unsigned long __arm_gen_branch_arm(unsigned long pc, unsigned long addr,
 --
 arch/arm/kernel/insn.c-47-	if (unlikely(offset < -33554432 || offset > 33554428)) {
 arch/arm/kernel/insn.c:48:		WARN_ON_ONCE(warn);
 arch/arm/kernel/insn.c-49-		return 0;
 --
 arch/arm/kernel/irq.c=54=static void __init init_irq_stacks(void)
 --
 arch/arm/kernel/irq.c-67-
 arch/arm/kernel/irq.c:68:		if (WARN_ON(!stack))
 arch/arm/kernel/irq.c-69-			break;
 --
 arch/arm/kernel/perf_regs.c=11=u64 perf_reg_value(struct pt_regs *regs, int idx)
 arch/arm/kernel/perf_regs.c-12-{
 arch/arm/kernel/perf_regs.c:13:	if (WARN_ON_ONCE((u32)idx >= PERF_REG_ARM_MAX))
 arch/arm/kernel/perf_regs.c-14-		return 0;
 --
 arch/arm/kernel/smp.c=238=static void ipi_teardown(int cpu)
 --
 arch/arm/kernel/smp.c-241-
 arch/arm/kernel/smp.c:242:	if (WARN_ON_ONCE(!ipi_irq_base))
 arch/arm/kernel/smp.c-243-		return;
 --
 arch/arm/kernel/smp.c=713=static void ipi_setup(int cpu)
 --
 arch/arm/kernel/smp.c-716-
 arch/arm/kernel/smp.c:717:	if (WARN_ON_ONCE(!ipi_irq_base))
 arch/arm/kernel/smp.c-718-		return;
 --
 arch/arm/kernel/smp.c=724=void __init set_smp_ipi_range(int ipi_base, int n)
 --
 arch/arm/kernel/smp.c-727-
 arch/arm/kernel/smp.c:728:	WARN_ON(n < MAX_IPI);
 arch/arm/kernel/smp.c-729-	nr_ipi = min(n, MAX_IPI);
 --
 arch/arm/kernel/smp.c-735-					 "IPI", &irq_stat);
 arch/arm/kernel/smp.c:736:		WARN_ON(err);
 arch/arm/kernel/smp.c-737-
 --
 arch/arm/kernel/suspend.c=117=static int cpu_suspend_alloc_sp(void)
 --
 arch/arm/kernel/suspend.c-122-
 arch/arm/kernel/suspend.c:123:	if (WARN_ON(!ctx_ptr))
 arch/arm/kernel/suspend.c-124-		return -ENOMEM;
 --
 arch/arm/kernel/traps.c=906=static int __init allocate_overflow_stacks(void)
 --
 arch/arm/kernel/traps.c-912-		stack = (u8 *)__get_free_page(GFP_KERNEL);
 arch/arm/kernel/traps.c:913:		if (WARN_ON(!stack))
 arch/arm/kernel/traps.c-914-			return -ENOMEM;
 --
 arch/arm/mach-artpec/board-artpec6.c=45=static void artpec6_l2c310_write_sec(unsigned long val, unsigned reg)
 --
 arch/arm/mach-artpec/board-artpec6.c-51-
 arch/arm/mach-artpec/board-artpec6.c:52:	WARN_ON(res.a0);
 arch/arm/mach-artpec/board-artpec6.c-53-}
 --
 arch/arm/mach-at91/sam_secure.c=17=struct arm_smccc_res sam_smccc_call(u32 fn, u32 arg0, u32 arg1)
 --
 arch/arm/mach-at91/sam_secure.c-20-
 arch/arm/mach-at91/sam_secure.c:21:	if (WARN_ON(!optee_available))
 arch/arm/mach-at91/sam_secure.c-22-		return res;
 --
 arch/arm/mach-bcm/bcm63xx_pmb.c=124=int bcm63xx_pmb_power_on_cpu(struct device_node *dn)
 --
 arch/arm/mach-bcm/bcm63xx_pmb.c-136-	/* We would not know how to enable a third and greater CPU */
 arch/arm/mach-bcm/bcm63xx_pmb.c:137:	WARN_ON(cpu > 1);
 arch/arm/mach-bcm/bcm63xx_pmb.c-138-
 --
 arch/arm/mach-davinci/mux.c=31=int davinci_cfg_reg(const unsigned long index)
 --
 arch/arm/mach-davinci/mux.c-39-
 arch/arm/mach-davinci/mux.c:40:	if (WARN_ON(!soc_info->pinmux_pins))
 arch/arm/mach-davinci/mux.c-41-		return -ENODEV;
 --
 arch/arm/mach-davinci/mux.c-44-		pinmux_base = ioremap(soc_info->pinmux_base, SZ_4K);
 arch/arm/mach-davinci/mux.c:45:		if (WARN_ON(!pinmux_base))
 arch/arm/mach-davinci/mux.c-46-			return -ENOMEM;
 --
 arch/arm/mach-davinci/sram.c=49=static int __init sram_init(void)
 --
 arch/arm/mach-davinci/sram.c-72-
 arch/arm/mach-davinci/sram.c:73:	WARN_ON(status < 0);
 arch/arm/mach-davinci/sram.c-74-	return status;
 --
 arch/arm/mach-exynos/firmware.c=159=static void exynos_l2_write_sec(unsigned long val, unsigned reg)
 --
 arch/arm/mach-exynos/firmware.c-184-	default:
 arch/arm/mach-exynos/firmware.c:185:		WARN_ONCE(1, "%s: ignoring write to reg 0x%x\n", __func__, reg);
 arch/arm/mach-exynos/firmware.c-186-	}
 --
 arch/arm/mach-exynos/suspend.c=451=static void exynos5420_prepare_pm_resume(void)
 --
 arch/arm/mach-exynos/suspend.c-458-	if (IS_ENABLED(CONFIG_EXYNOS_MCPM))
 arch/arm/mach-exynos/suspend.c:459:		WARN_ON(mcpm_cpu_powered_up());
 arch/arm/mach-exynos/suspend.c-460-
 --
 arch/arm/mach-exynos/suspend.c=672=void __init exynos_pm_init(void)
 --
 arch/arm/mach-exynos/suspend.c-683-
 arch/arm/mach-exynos/suspend.c:684:	if (WARN_ON(!of_property_read_bool(np, "interrupt-controller"))) {
 arch/arm/mach-exynos/suspend.c-685-		pr_warn("Outdated DT detected, suspend/resume will NOT work\n");
 --
 arch/arm/mach-footbridge/dc21285.c=261=int __init dc21285_setup(int nr, struct pci_sys_data *sys)
 --
 arch/arm/mach-footbridge/dc21285.c-291-#define dc21285_request_irq(_a, _b, _c, _d, _e) \
 arch/arm/mach-footbridge/dc21285.c:292:	WARN_ON(request_irq(_a, _b, _c, _d, _e) < 0)
 arch/arm/mach-footbridge/dc21285.c-293-
 --
 arch/arm/mach-highbank/highbank.c=42=static void highbank_l2c310_write_sec(unsigned long val, unsigned reg)
 --
 arch/arm/mach-highbank/highbank.c-46-	else
 arch/arm/mach-highbank/highbank.c:47:		WARN_ONCE(1, "Highbank L2C310: ignoring write to reg 0x%x\n",
 arch/arm/mach-highbank/highbank.c-48-			  reg);
 --
 arch/arm/mach-highbank/highbank.c=137=static void __init highbank_init(void)
 --
 arch/arm/mach-highbank/highbank.c-143-	sregs_base = of_iomap(np, 0);
 arch/arm/mach-highbank/highbank.c:144:	WARN_ON(!sregs_base);
 arch/arm/mach-highbank/highbank.c-145-
 --
 arch/arm/mach-hisi/platsmp.c=152=static int hip01_boot_secondary(unsigned int cpu, struct task_struct *idle)
 --
 arch/arm/mach-hisi/platsmp.c-162-	node = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl");
 arch/arm/mach-hisi/platsmp.c:163:	if (WARN_ON(!node))
 arch/arm/mach-hisi/platsmp.c-164-		return -1;
 --
 arch/arm/mach-imx/anatop.c=94=void __init imx_init_revision_from_anatop(void)
 --
 arch/arm/mach-imx/anatop.c-104-	anatop_base = of_iomap(np, 0);
 arch/arm/mach-imx/anatop.c:105:	WARN_ON(!anatop_base);
 arch/arm/mach-imx/anatop.c-106-	if (of_device_is_compatible(np, "fsl,imx6sl-anatop"))
 --
 arch/arm/mach-imx/anatop.c-140-			of_node_put(src_np);
 arch/arm/mach-imx/anatop.c:141:			WARN_ON(!src_base);
 arch/arm/mach-imx/anatop.c-142-			sbmr2 = readl_relaxed(src_base + SRC_SBMR2);
 --
 arch/arm/mach-imx/avic.c=166=static void __init mxc_init_irq(void __iomem *irqbase)
 --
 arch/arm/mach-imx/avic.c-200-	irq_base = irq_alloc_descs(-1, 0, AVIC_NUM_IRQS, numa_node_id());
 arch/arm/mach-imx/avic.c:201:	WARN_ON(irq_base < 0);
 arch/arm/mach-imx/avic.c-202-
 --
 arch/arm/mach-imx/avic.c-205-					  &irq_domain_simple_ops, NULL);
 arch/arm/mach-imx/avic.c:206:	WARN_ON(!domain);
 arch/arm/mach-imx/avic.c-207-
 --
 arch/arm/mach-imx/cpu-imx5.c=23=static u32 imx5_read_srev_reg(const char *compat)
 --
 arch/arm/mach-imx/cpu-imx5.c-31-	of_node_put(np);
 arch/arm/mach-imx/cpu-imx5.c:32:	WARN_ON(!iim_base);
 arch/arm/mach-imx/cpu-imx5.c-33-
 --
 arch/arm/mach-imx/cpu.c=61=void __init imx_aips_allow_unprivileged_access(
 --
 arch/arm/mach-imx/cpu.c-68-		aips_base_addr = of_iomap(np, 0);
 arch/arm/mach-imx/cpu.c:69:		WARN_ON(!aips_base_addr);
 arch/arm/mach-imx/cpu.c-70-		imx_set_aips(aips_base_addr);
 --
 arch/arm/mach-imx/gpc.c=227=static int __init imx_gpc_init(struct device_node *node,
 --
 arch/arm/mach-imx/gpc.c-244-	gpc_base = of_iomap(node, 0);
 arch/arm/mach-imx/gpc.c:245:	if (WARN_ON(!gpc_base))
 arch/arm/mach-imx/gpc.c-246-	        return -ENOMEM;
 --
 arch/arm/mach-imx/gpc.c=269=void __init imx_gpc_check_dt(void)
 --
 arch/arm/mach-imx/gpc.c-273-	np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-gpc");
 arch/arm/mach-imx/gpc.c:274:	if (WARN_ON(!np))
 arch/arm/mach-imx/gpc.c-275-		return;
 arch/arm/mach-imx/gpc.c-276-
 arch/arm/mach-imx/gpc.c:277:	if (WARN_ON(!of_property_read_bool(np, "interrupt-controller"))) {
 arch/arm/mach-imx/gpc.c-278-		pr_warn("Outdated DT detected, suspend/resume will NOT work\n");
 --
 arch/arm/mach-imx/mach-imx51.c=27=static void __init imx51_ipu_mipi_setup(void)
 --
 arch/arm/mach-imx/mach-imx51.c-31-	hsc_addr = ioremap(MX51_MIPI_HSC_BASE, SZ_16K);
 arch/arm/mach-imx/mach-imx51.c:32:	WARN_ON(!hsc_addr);
 arch/arm/mach-imx/mach-imx51.c-33-
 --
 arch/arm/mach-imx/mach-vf610.c=20=static void __init vf610_detect_cpu(void)
 --
 arch/arm/mach-imx/mach-vf610.c-27-	np = of_find_compatible_node(NULL, NULL, "fsl,vf610-mscm-cpucfg");
]
]

gemini-3-pro-preview

Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. , Status: RESOURCE_EXHAUSTED, Details: [map[@type:type.googleapis.com/google.rpc.Help links:[map[description:Learn more about Gemini API quotas url:https://ai.google.dev/gemini-api/docs/rate-limits]]] map[@type:type.googleapis.com/google.rpc.DebugInfo detail:[ORIGINAL ERROR] generic::resource_exhausted: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit.  [google.rpc.error_details_ext] { message: "You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. " details { type_url: "type.googleapis.com/language_labs.genai.debug.GeminiApiDebugInfo" value: "R\212\001\n\207\001\nTgenerativelanguage.googleapis.com/generate_content_paid_tier_1_input_tokens_internal\022\022\n\010location\022\006global\022\027\n\005model\022\016gemini-3.1-pro\030\300\204=" } details { [type.googleapis.com/google.rpc.Help] { links { description: "Learn more about Gemini API quotas" url: "https://ai.google.dev/gemini-api/docs/rate-limits" } } } }]]