syzbot

map[ReproOpts:{"threaded":true,"collide":false,"repeat":true,"procs":1,"sandbox":"none","fault_call":-1,"tun":true,"netdev":true,"netreset":true,"cgroups":true,"bpf":true,"netlink":true,"usb":true,"vcan":true,"vhci":true,"wifi":true,"ieee802154":true,"syssysfs":true,"sysctl":true,"mount":true} ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x00\x00\x00\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
r2 = syz_open_dev$evdev(&(0x7f0000000400)='/dev/input/event#\x00', 0, 0)
r3 = syz_open_dev$evdev(&(0x7f0000000440)='/dev/input/event#\x00', 1, 0)
r4 = syz_open_dev$evdev(&(0x7f0000000480)='/dev/input/event#\x00', 2, 0)
r5 = syz_open_dev$evdev(&(0x7f00000004c0)='/dev/input/event#\x00', 3, 0)
r6 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 4, 0)
r7 = syz_open_dev$evdev(&(0x7f0000000540)='/dev/input/event#\x00', 5, 0)
r8 = syz_open_dev$evdev(&(0x7f0000000580)='/dev/input/event#\x00', 6, 0)
r9 = syz_open_dev$evdev(&(0x7f00000005c0)='/dev/input/event#\x00', 7, 0)
syz_usb_disconnect(r0)
nanosleep(&(0x7f0000000300)={200, 0}, 0) SyzkallerCommit:86914af9098a80da53c3c5d46be980c572ee29f8]

map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/a06dec0c487fae098e7527ab908904a85ae84121]

map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/ab573ff927ca390d26db59d3f24ceb1973e8b3cf]

map[Index:codesearch-index]

gemini-3-pro-preview

map[ReproOpts:{"threaded":true,"collide":false,"repeat":true,"procs":1,"sandbox":"none","fault_call":-1,"tun":true,"netdev":true,"netreset":true,"cgroups":true,"bpf":true,"netlink":true,"usb":true,"vcan":true,"vhci":true,"wifi":true,"ieee802154":true,"syssysfs":true,"sysctl":true,"mount":true} ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x00\x00\x00\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
r2 = syz_open_dev$evdev(&(0x7f0000000400)='/dev/input/event#\x00', 0, 0)
r3 = syz_open_dev$evdev(&(0x7f0000000440)='/dev/input/event#\x00', 1, 0)
r4 = syz_open_dev$evdev(&(0x7f0000000480)='/dev/input/event#\x00', 2, 0)
r5 = syz_open_dev$evdev(&(0x7f00000004c0)='/dev/input/event#\x00', 3, 0)
r6 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 4, 0)
r7 = syz_open_dev$evdev(&(0x7f0000000540)='/dev/input/event#\x00', 5, 0)
r8 = syz_open_dev$evdev(&(0x7f0000000580)='/dev/input/event#\x00', 6, 0)
r9 = syz_open_dev$evdev(&(0x7f00000005c0)='/dev/input/event#\x00', 7, 0)
syz_usb_disconnect(r0)
nanosleep(&(0x7f0000000300)={200, 0}, 0)]

You are an expert in the Linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug.

Don't make assumptions about the kernel source code, use the provided codesearch tools
to examine the kernel code instead.

Document about syzkaller program syntax:
===
# Program syntax

Syzkaller uses a compact domain-specific language (DSL) for programs
to log executed programs, test its code, and persist programs in the
corpus. This page provides a brief description of the corresponding
syntax. Some useful information can also be found in the
[existing examples](/sys/linux/test) and in the program
[deserialization code](/prog/encoding.go).

Together with execution options, the DSL provides everything that
syz-executor needs to run a program.

For example, consider the program:
```
r0 = syz_open_dev$loop(&(0x7f00000011c0), 0x0, 0x0)
r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, r1)
```

Each line in this program describes a particular syscall invocation,
with the first two calls saving the result in temporary variables `r0`
and `r1`, which are passed to the third call.

```
line = assignment | call
assignment = variable " = " call
call = syscall-name "(" [arg ["," arg]*] ")"  ["(" [call-prop ["," call-prop*] ")"]
arg = "nil" | "AUTO" | const-arg | resource-arg | result-arg | pointer-arg | string-arg | struct-arg | array-arg | union-arg
const-arg = integer
resource-arg = variable ["/" hex-integer] ["+" hex-integer]
result-arg = "<" variable "=>" arg
pointer-arg = "&" pointer-arg-addr ["=ANY"] "=" arg
pointer-arg-addr = "AUTO" | "(" pointer-addr ["/" region-size] ")"
string-arg = "'" escaped-string "'" | "\"" escaped-string "\"" | "\"$" escaped-string "\""
struct-arg =  "{" [arg ["," arg]*] "}"
array-arg = "[" [arg ["," arg]*] "]"
union-arg = "@" field-name ["=" arg]
call-prop = prop-name ": " prop-value
variable = "r" dec-integer
pointer-addr = integer
region-size = integer
integer = dec-integer | oct-integer | "0x" hex-integer
```

Programs may also contain blank lines and comments.
```
# Obtain a file handle
r0 = openat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x42, 0x1ff)

# Perform a write operation
write(r0, &AUTO="01010101", 0x4)
```

### Memory management

Memory management is performed by syzkaller itself. It will allocate
virtual memory regions of the necessary size and set the final values
of pointer arguments.

By using the `AUTO` keyword, programs can give syzkaller the full
control over storing the data. This may be convenient e.g. when a
parameter must be passed by reference, but the exact location of its
value is not of particular importance.

```
r1 = syz_genetlink_get_family_id$nl80211(&AUTO='nl80211\x00', 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &AUTO={'wlan0\x00', <r2=>0x0})
```

Alternatively, some data can be "anchored" to specific addresses. It
may be especially important when a memory region must be shared
between multiple calls.  In this case, pointer addresses must be given
at the 0x7f0000000000 offset. Before the actual execution, syzkaller
will adjust pointers to the start of the actual mmap'ed region.

### Call properties

Call properties specify extra information about how a specific call
must be executed. Each call within a program has its own set of call
properties. If no properties are provided, syzkaller takes the default
ones.

Currently, syzkaller supports the following call properties.

#### Fault injection
Syntax: `fail_nth: N`.

It takes an integer (base 10) argument `N`. If the argument is
non-negative, a fault will be injected into the `N`-th occasion.

```
r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, r0) (fail_nth: 5)
```

#### Async
Syntax: `async`.

Instructs `syz-executor` not to wait until the call completes and
to proceed immediately to the next call.

```
r0 = openat(0xffffffffffffff9c, &AUTO='./file1\x00', 0x42, 0x1ff)
write(r0, &AUTO="01010101", 0x4) (async)
read(r0, &AUTO=""/4, 0x4)
close(r0)
```

When setting `async` flags be aware of the following considerations:
* Such programs should only be executed in threaded mode (i.e. `-threaded`
flag must be passed to `syz-executor`.
* Each `async` call is executed in a separate thread and there's a
limited number of available threads (`kMaxThreads = 16`).
* If an `async` call produces a resource, keep in mind that some other call
might take it as input and `syz-executor` will just pass 0 if the resource-
producing call has not finished by that time.

===

Document about syzlang system call descriptions syntax:
===
# Syscall description language

aka `syzlang` (`[siːzˈlæŋg]`)

Pseudo-formal grammar of syscall description:

```
syscallname "(" [arg ["," arg]*] ")" [type] ["(" attribute* ")"]
arg = argname type
argname = identifier
type = typename [ "[" type-options "]" ]
typename = "const" | "intN" | "intptr" | "flags" | "array" | "ptr" |
	   "string" | "filename" | "glob" | "len" |
	   "bytesize" | "bytesizeN" | "bitsize" | "vma" | "proc" |
	   "compressed_image"
type-options = [type-opt ["," type-opt]]
```

common type-options include:

```
"opt" - the argument is optional (like mmap fd argument, or accept peer argument)
```

rest of the type-options are type-specific:

```
"const": integer constant, type-options:
	value, underlying type (one of "intN", "intptr")
"intN"/"intptr": an integer without a particular meaning, type-options:
	either an optional range of values (e.g. "5:10", or "100:200")
	or a reference to flags description (see below),
	or a single value
	optionally followed by an alignment parameter if using a range
"flags": a set of values, type-options:
	reference to flags description (see below), underlying int type (e.g. "int32")
"array": a variable/fixed-length array, type-options:
	type of elements, optional size (fixed "5", or ranged "5:10", boundaries inclusive)
"ptr"/"ptr64": a pointer to an object, type-options:
	direction (in/out/inout); type of the object
	ptr64 has size of 8 bytes regardless of target pointer size
"string": a zero-terminated memory buffer (no pointer indirection implied), type-options:
	either a string value in quotes for constant strings (e.g. "foo" or `deadbeef` for hex literal),
	or a reference to string flags (special value `filename` produces file names),
	optionally followed by a buffer size (string values will be padded with \x00 to that size)
"stringnoz": a non-zero-terminated memory buffer (no pointer indirection implied), type-options:
	either a string value in quotes for constant strings (e.g. "foo" or `deadbeef` for hex literal),
	or a reference to string flags,
"glob": glob pattern to match on the target files, type-options:
	a pattern string in quotes (syntax: https://golang.org/pkg/path/filepath/#Match)
	(e.g. "/sys/" or "/sys/**/*"),
	or include exclude glob too (e.g. "/sys/**/*:-/sys/power/state")
"fmt": a string representation of an integer (not zero-terminated), type-options:
	format (one of "dec", "hex", "oct") and the value (a resource, int, flags or proc)
	the resulting data is always fixed-size (formatted as "%020llu", "0x%016llx" or "%023llo", respectively)
"len": length of another field (for array it is number of elements), type-options:
	argname of the object
"bytesize": similar to "len", but always denotes the size in bytes, type-options:
	argname of the object
"bitsize": similar to "len", but always denotes the size in bits, type-options:
	argname of the object
"offsetof": offset of the field from the beginning of the parent struct, type-options:
	field
"vma"/"vma64": a pointer to a set of pages (used as input for mmap/munmap/mremap/madvise), type-options:
	optional number of pages (e.g. vma[7]), or a range of pages (e.g. vma[2-4])
	vma64 has size of 8 bytes regardless of target pointer size
"proc": per process int (see description below), type-options:
	value range start, how many values per process, underlying type
"compressed_image": zlib-compressed disk image
	syscalls accepting compressed images must be marked with `no_generate`
	and `no_minimize` call attributes. if the content of the decompressed image
	can be checked by a `fsck`-like command, use the `fsck` syscall attribute
"text": machine code of the specified type, type-options:
	text type (x86_real, x86_16, x86_32, x86_64, arm64)
"void": type with static size 0
	mostly useful inside of templates and varlen unions, can't be syscall argument
```

flags/len/flags also have trailing underlying type type-option when used in structs/unions/pointers.

Flags are described as:

```
flagname = const ["," const]*
```

or for string flags as:

```
flagname = "\"" literal "\"" ["," "\"" literal "\""]*
```

Call attributes are:

```
"disabled": the call will not be used in fuzzing; useful to temporary disable some calls
	or prohibit particular argument combinations.
"timeout[N]": additional execution timeout (in ms) for the call on top of some default value.
"prog_timeout[N]": additional execution timeout (in ms) for the whole program if it contains this call;
	if a program contains several such calls, the max value is used.
"ignore_return": ignore return value of this syscall in fallback feedback; need to be used for calls
	that don't return fixed error codes but rather something else (e.g. the current time).
"breaks_returns": ignore return values of all subsequent calls in the program in fallback feedback (can't be trusted).
"no_generate": do not try to generate this syscall, i.e. use only seed descriptions to produce it.
"no_minimize": do not modify instances of this syscall when trying to minimize a crashing program.
"no_squash": do not attempt to pass squashed arguments to this syscall.
	Without that, the fuzzer will sometimes attempt to replace complex structures with arrays of bytes,
	possibly triggering interesting mutations, but also making programs hard to reason about.
"fsck": the content of the compressed buffer argument for this syscall is a file system and the
	string argument is a fsck-like command that will be called to verify the filesystem.
"remote_cover": wait longer to collect remote coverage for this call.
"kfuzz_test": the call is a kfuzztest target.
"snapshot": the call is enabled by default only in snapshot fuzzing mode, but can also be enabled in
    the non-snasphot mode when listed in "enable_syscalls" with its full name (as opposed to a wildcard match).
    It can also always be disabled via "disable_syscalls".
    The attribute is generally used to mark calls that are not safe to execute in non-snapshot mode
	(can lead to false positives, or lost connections to test machines.
```

## Ints

`int8`, `int16`, `int32` and `int64` denote an integer of the corresponding size.
`intptr` denotes a pointer-sized integer, i.e. C `long` type.

By appending `be` suffix (e.g. `int16be`) integers become big-endian.

It's possible to specify a range of values for an integer in the format of `int32[0:100]` or `int32[0:4096, 512]` for a 512-aligned int.

Integers can also take a reference to flags description or a value as its first type-option.
In that case, the alignment parameter is not supported.

To denote a bitfield of size N use `int64:N`.

It's possible to use these various kinds of ints as base types for `const`, `flags`, `len` and `proc`.

```
example_struct {
	f0	int8			# random 1-byte integer
	f1	const[0x42, int16be]	# const 2-byte integer with value 0x4200 (big-endian 0x42)
	f2	int32[0:100]		# random 4-byte integer with values from 0 to 100 inclusive
	f3	int32[1:10, 2]		# random 4-byte integer with values {1, 3, 5, 7, 9}
	f4	int64:20		# random 20-bit bitfield
	f5	int8[10]		# const 1-byte integer with value 10
	f6	int32[flagname]		# random 4-byte integer from the set of values referenced by flagname
}
```

## Structs

Structs are described as:

```
structname "{" "\n"
	(fieldname type ("(" fieldattribute* ")")? (if[expression])? "\n")+
"}" ("[" attribute* "]")?
```

Fields can have attributes specified in parentheses after the field, independent
of their type. `in/out/inout` attribute specify per-field direction, for example:

```
foo {
	field0	const[1, int32]	(in)
	field1	int32		(inout)
	field2	fd		(out)
}
```

You may specify conditions that determine whether a field will be included:

```
foo {
	field0	int32
	field1	int32 (if[value[field0] == 0x1])
}
```

See [the corresponding section](syscall_descriptions_syntax.md#conditional-fields)
for more details.

`out_overlay` attribute allows to have separate input and output layouts for the struct.
Fields before the `out_overlay` field are input, fields starting from `out_overlay` are output.
Input and output fields overlap in memory (both start from the beginning of the struct in memory).
For example:

```
foo {
	in0	const[1, int32]
	in1	flags[bar, int8]
	in2	ptr[in, string]
	out0	fd	(out_overlay)
	out1	int32
}
```

Structs can have attributes specified in square brackets after the struct.
Attributes are:

- `packed`: the struct does not have paddings between fields and has alignment 1; this is similar to GNU C `__attribute__((packed))`; struct alignment can be overridden with `align` attribute
- `align[N]`: the struct has alignment N and padded up to multiple of `N`; contents of the padding are unspecified (though, frequently are zeros); similar to GNU C `__attribute__((aligned(N)))`
- `size[N]`: the struct is padded up to the specified size `N`; contents of the padding are unspecified (though, frequently are zeros)

## Unions

Unions are described as:

```
unionname "[" "\n"
	(fieldname type (if[expression])? "\n")+
"]" ("[" attribute* "]")?
```

During fuzzing, syzkaller randomly picks one of the union options.

You may also specify conditions that determine whether the corresponding
option may or may not be selected, depending on values of other fields. See
[the corresponding section](syscall_descriptions_syntax.md#conditional-fields)
for more details.

Unions can have attributes specified in square brackets after the union.
Attributes are:

- `varlen`: union size is the size of the particular chosen option (not statically known); without this attribute unions are statically sized as maximum of all options (similar to C unions)
- `size[N]`: the union is padded up to the specified size `N`; contents of the padding are unspecified (though, frequently are zeros)

## Resources

Resources represent values that need to be passed from output of one syscall to input of another syscall. For example, `close` syscall requires an input value (fd) previously returned by `open` or `pipe` syscall. To achieve this, `fd` is declared as a resource. This is a way of modelling dependencies between syscalls, as defining a syscall as the producer of a resource and another syscall as the consumer defines a loose sense of ordering between them. Resources are described as:

```
"resource" identifier "[" underlying_type "]" [ ":" const ("," const)* ]
```

`underlying_type` is either one of `int8`, `int16`, `int32`, `int64`, `intptr` or another resource (which models inheritance, for example, a socket is a subtype of fd). The optional set of constants represent resource special values, for example, `0xffffffffffffffff` (-1) for "no fd", or `AT_FDCWD` for "the current dir". Special values are used once in a while as resource values. If no special values specified, special value of `0` is used. Resources can then be used as types, for example:

```
resource fd[int32]: 0xffffffffffffffff, AT_FDCWD, 1000000
resource sock[fd]
resource sock_unix[sock]

socket(...) sock
accept(fd sock, ...) sock
listen(fd sock, backlog int32)
```

Resources don't have to be necessarily returned by a syscall. They can be used as any other data type. For example:

```
resource my_resource[int32]

request_producer(..., arg ptr[out, my_resource])
request_consumer(..., arg ptr[inout, test_struct])

test_struct {
	...
	attr	my_resource
}
```

For more complex producer/consumer scenarios, field attributes can be utilized.
For example:

```
resource my_resource_1[int32]
resource my_resource_2[int32]

request_produce1_consume2(..., arg ptr[inout, test_struct])

test_struct {
	...
	field0	my_resource_1	(out)
	field1	my_resource_2	(in)
}
```

Each resource type must be "produced" (used as an output) by at least one syscall
(outside of unions and optional pointers) and "consumed" (used as an input)
by at least one syscall.

## Type Aliases

Complex types that are often repeated can be given short type aliases using the
following syntax:

```
type identifier underlying_type
```

For example:

```
type signalno int32[0:65]
type net_port proc[20000, 4, int16be]
```

Then, type alias can be used instead of the underlying type in any contexts.
Underlying type needs to be described as if it's a struct field, that is,
with the base type if it's required. However, type alias can be used as syscall
arguments as well. Underlying types are currently restricted to integer types,
`ptr`, `ptr64`, `const`, `flags` and `proc` types.

There are some builtin type aliases:

```
type bool8	int8[0:1]
type bool16	int16[0:1]
type bool32	int32[0:1]
type bool64	int64[0:1]
type boolptr	intptr[0:1]

type fileoff[BASE] BASE

type filename string[filename]

type buffer[DIR] ptr[DIR, array[int8]]
```

## Type Templates

Type templates can be declared as follows:

```
type buffer[DIR] ptr[DIR, array[int8]]
type fileoff[BASE] BASE
type nlattr[TYPE, PAYLOAD] {
	nla_len		len[parent, int16]
	nla_type	const[TYPE, int16]
	payload		PAYLOAD
} [align_4]
```

and later used as follows:

```
syscall(a buffer[in], b fileoff[int64], c ptr[in, nlattr[FOO, int32]])
```

There is builtin type template `optional` defined as:

```
type optional[T] [
	val	T
	void	void
] [varlen]
```

## Length

You can specify length of a particular field in struct or a named argument by
using `len`, `bytesize` and `bitsize` types, for example:

```
write(fd fd, buf ptr[in, array[int8]], count len[buf])

sock_fprog {
	len	len[filter, int16]
	filter	ptr[in, array[sock_filter]]
}
```

If `len`'s argument is a pointer, then the length of the pointee argument is used.

To denote the length of a field in N-byte words use `bytesizeN`, possible values
for N are 1, 2, 4 and 8.

To denote the length of the parent struct, you can use `len[parent, int8]`.
To denote the length of the higher level parent when structs are embedded into
one another, you can specify the type name of the particular parent:

```
s1 {
    f0      len[s2]  # length of s2
}

s2 {
    f0      s1
    f1      array[int32]
    f2      len[parent, int32]
}
```

`len` argument can also be a path expression which allows more complex
addressing. Path expressions are similar to C field references, but also allow
referencing parent and sibling elements. A special reference `syscall` used
in the beginning of the path allows to refer directly to the syscall arguments.
For example:

```
s1 {
	a	ptr[in, s2]
	b	ptr[in, s3]
	c	array[int8]
}

s2 {
	d	array[int8]
}

s3 {
# This refers to the array c in the parent s1.
	e	len[s1:c, int32]
# This refers to the array d in the sibling s2.
	f	len[s1:a:d, int32]
# This refers to the array k in the child s4.
	g	len[i:j, int32]
# This refers to syscall argument l.
	h	len[syscall:l, int32]
	i	ptr[in, s4]
}

s4 {
	j	array[int8]
}

foo(k ptr[in, s1], l ptr[in, array[int8]])
```

## Proc

The `proc` type can be used to denote per process integers.
The idea is to have a separate range of values for each executor, so they don't interfere.

The simplest example is a port number.
The `proc[20000, 4, int16be]` type means that we want to generate an `int16be`
integer starting from `20000` and assign `4` values for each process.
As a result the executor number `n` will get values in the `[20000 + n * 4, 20000 + (n + 1) * 4)` range.

## Integer Constants

Integer constants can be specified as decimal literals, as `0x`-prefixed
hex literals, as `'`-surrounded char literals, or as symbolic constants
extracted from kernel headers or defined by `define` directives. For example:

```
foo(a const[10], b const[-10])
foo(a const[0xabcd])
foo(a int8['a':'z'])
foo(a const[PATH_MAX])
foo(a int32[PATH_MAX])
foo(a ptr[in, array[int8, MY_PATH_MAX]])
define MY_PATH_MAX	PATH_MAX + 2
```

## Conditional fields

### In structures

In syzlang, it's possible to specify a condition for every struct field that
determines whether the field should be included or omitted:

```
header_fields {
  magic       const[0xabcd, int16]
  haveInteger int8
} [packed]

packet {
  header  header_fields
  integer int64  (if[value[header:haveInteger] == 0x1])
  body    array[int8]
} [packed]

some_call(a ptr[in, packet])
```

In this example, the `packet` structure will include the field `integer` only
if `header.haveInteger == 1`. In memory, `packet` will have the following
layout:

| header.magic = 0xabcd | header.haveInteger = 0x1 | integer | body |
| --------------------- | ------------------------ | ------- | ---- |

That corresponds to e.g. the following program:

```
some_call(&AUTO={{AUTO, 0x1}, @value=0xabcd, []})
```

If `header.haveInteger` is not `1`, syzkaller will just pretend that the field
`integer` does not exist.

```
some_call(&AUTO={{AUTO, 0x0}, @void, []})
```

| header.magic = 0xabcd | header.haveInteger = 0x0 | body |
| --------------------- | ------------------------ | ---- |

Every conditional field is assumed to be of variable length and so is the struct
to which this field belongs.

When a variable length field appears in the middle of a structure, the structure
must be marked with `[packed].`

Conditions on bitfields are prohibited:

```
struct {
  f0 int
  f1 int:3 (if[value[f0] == 0x1])  # It will not compile.
}
```

But you may reference bitfields in your conditions:

```
struct {
  f0 int:1
  f1 int:7
  f2 int   (if[value[f0] == value[f1]])
} [packed]
```

### In unions

Let's consider the following example.

```
struct {
  type int
  body alternatives
}

alternatives [
  int     int64 (if[value[struct:type] == 0x1])
  arr     array[int64, 5] (if[value[struct:type] == 0x2])
  default int32
] [varlen]

some_call(a ptr[in, struct])
```

In this case, the union option will be selected depending on the value of the
`type` field. For example, if `type` is `0x1`, then it can be either `int` or
`default`:

```
some_call(&AUTO={0x1, @int=0x123})
some_call(&AUTO={0x1, @default=0x123})
```

If `type` is `0x2`, it can be either `arr` or `default`.

If `type` is neither `0x1` nor `0x2`, syzkaller may only select `default`:

```
some_call(&AUTO={0x0, @default=0xabcd})
```

To ensure that a union can always be constructed, the last union field **must always
have no condition**.

Thus, the following definition would fail to compile:

```
alternatives [
  int int64 (if[value[struct:type] == 0x1])
  arr array[int64, 5] (if[value[struct:type] == 0x1])
] [varlen]
```

During prog mutation and generation syzkaller will select a random union field
whose condition is satisfied.

### Expression syntax

Currently, only `==`, `!=`, `&` and `||` operators are supported. However, the
functionality was designed in such a way that adding more operators is easy.
Feel free to file a GitHub issue or write us an email in case it's needed.

Expressions are evaluated as `int64` values. If the final result of an
expression is not 0, it's assumed to be satisfied.

If you want to reference a field's value, you can do it via
`value[path:to:field]`, which is similar to the `len[]` argument.

```
sub_struct {
  f0 int
  # Reference a field in a parent struct.
  f1 int (if[value[struct:f2]]) # Same as if[value[struct:f2] != 0].
}

struct {
  f2 int
  f3 sub_struct
  f4 int (if[value[f2] == 0x2]) # Reference a sibling field.
  f5 int (if[value[f3:f0] == 0x1]) # Reference a nested field.
  f6 int (if[value[f3:f0] == 0x1 || value[f3:f0] == 0x2]) # Reference a nested field which either equals to 0x1 or 0x2.
} [packed]

call(a ptr[in, struct])
```

The referenced field must be of integer type and there must be no
conditional fields in the path to it. For example, the following
descriptions will not compile.

```
struct {
  f0 int
  f1 int (if[value[f0] == 0x1])
  f2 int (if[value[f1] == 0x1])
}
```

You may also reference constants in expressions:

```
struct {
  f0 int
  f1 int
  f2 int (if[value[f0] & SOME_CONST == OTHER_CONST])
}
```

## Meta

Description files can also contain `meta` directives that specify meta-information for the whole file.

```
meta noextract
```

Tells `make extract` to not extract constants for this file.
Though, `syz-extract` can still be invoked manually on this file.

```
meta arches["arch1", "arch2"]
```

Restricts this file only to the given set of architectures.
`make extract` and `make generate` will not use it on other architectures.

## Misc

Description files also contain `include` directives that refer to Linux kernel header files,
`incdir` directives that refer to custom Linux kernel header directories
and `define` directives that define symbolic constant values.

The syzkaller executor defines some [pseudo system calls](./pseudo_syscalls.md)
that can be used as any other syscall in a description file. These pseudo
system calls expand to literal C code and can perform user-defined
custom actions. You can find some examples in
[executor/common_linux.h](../executor/common_linux.h).

Also see [tips](syscall_descriptions.md#tips) on writing good descriptions.

===

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug title: INFO: task hung in pvr2_i2c_core_done

The bug report to reproduce:
INFO: task syz.4.586:8277 blocked for more than 143 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.586       state:D stack:24056 pid:8277  tgid:8272  ppid:5851   task_flags:0x480140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5256 [inline]
 __schedule+0x149b/0x4fd0 kernel/sched/core.c:6863
 __schedule_loop kernel/sched/core.c:6945 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6960
 schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common kernel/sched/completion.c:132 [inline]
 wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
 i2c_del_adapter+0x591/0x760 drivers/i2c/i2c-core-base.c:1814
 pvr2_i2c_core_done+0x58/0xb0 drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:652
 pvr2_hdw_disconnect+0x9f/0x500 drivers/media/usb/pvrusb2/pvrusb2-hdw.c:2711
 pvr2_context_disconnect+0x42/0x210 drivers/media/usb/pvrusb2/pvrusb2-context.c:269
 pvr_disconnect+0x78/0xe0 drivers/media/usb/pvrusb2/pvrusb2-main.c:79
 usb_unbind_interface+0x26e/0x910 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:571 [inline]
 __device_release_driver drivers/base/dd.c:1282 [inline]
 device_release_driver_internal+0x4d9/0x800 drivers/base/dd.c:1305
 bus_remove_device+0x34d/0x440 drivers/base/bus.c:616
 device_del+0x511/0x8e0 drivers/base/core.c:3878
 usb_disable_device+0x3d4/0x8e0 drivers/usb/core/message.c:1418
 usb_disconnect+0x32f/0x990 drivers/usb/core/hub.c:2345
 hub_quiesce+0x171/0x330 drivers/usb/core/hub.c:1405
 hub_disconnect+0xc8/0x470 drivers/usb/core/hub.c:1811
 usb_unbind_interface+0x26e/0x910 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:571 [inline]
 __device_release_driver drivers/base/dd.c:1282 [inline]
 device_release_driver_internal+0x4d9/0x800 drivers/base/dd.c:1305
 proc_ioctl+0x294/0x6c0 drivers/usb/core/devio.c:2360
 proc_ioctl_default+0xbc/0x100 drivers/usb/core/devio.c:2403
 usbdev_do_ioctl drivers/usb/core/devio.c:2767 [inline]
 usbdev_ioctl+0x1367/0x20b0 drivers/usb/core/devio.c:2827
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6182d8f749
RSP: 002b:00007f6183bfc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f6182fe6180 RCX: 00007f6182d8f749
RDX: 0000200000000200 RSI: 00000000c0105512 RDI: 0000000000000008
RBP: 00007f6182e13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6182fe6218 R14: 00007f6182fe6180 R15: 00007f618310fa28
 </TASK>
INFO: task syz.4.586:8282 blocked for more than 145 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.586       state:D stack:28728 pid:8282  tgid:8272  ppid:5851   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5256 [inline]
 __schedule+0x149b/0x4fd0 kernel/sched/core.c:6863
 __schedule_loop kernel/sched/core.c:6945 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6960
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7017
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776
 device_lock include/linux/device.h:895 [inline]
 usbdev_do_ioctl drivers/usb/core/devio.c:2611 [inline]
 usbdev_ioctl+0x140/0x20b0 drivers/usb/core/devio.c:2827
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6182d8f749
RSP: 002b:00007f6183bdb038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f6182fe6270 RCX: 00007f6182d8f749
RDX: 0000200000000040 RSI: 0000000080045505 RDI: 0000000000000008
RBP: 00007f6182e13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6182fe6308 R14: 00007f6182fe6270 R15: 00007f618310fa28
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/31:
 #0: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #0: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
4 locks held by kworker/u8:10/3446:
3 locks held by kworker/u8:13/3736:
 #0: ffff8880b863a918 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 kernel/sched/core.c:647
 #1: ffff8880b8724588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:933
 #2: ffff8880b87260d8 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x8ee/0xf30 kernel/time/timer.c:1117
1 lock held by udevd/5202:
1 lock held by dhcpcd/5497:
 #0: ffffffff8f311e48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f311e48 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x323/0x1b20 net/ipv4/devinet.c:1120
2 locks held by getty/5591:
 #0: ffff88814ddbd0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x449/0x1460 drivers/tty/n_tty.c:2211
4 locks held by udevd/6262:
 #0: ffff888029f5e9e0 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe20 fs/seq_file.c:182
 #1: ffff888025a41488 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5c/0x420 fs/kernfs/file.c:172
 #2: ffff888078ea7e18 (kn->active#22){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
 #2: ffff888078ea7e18 (kn->active#22){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:173
 #3: ffff888030204198 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:900 [inline]
 #3: ffff888030204198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
1 lock held by syz.0.478/7838:
 #0: ffffffff8df474c0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x570 kernel/rcu/tree.c:3816
2 locks held by syz.5.867/9317:
 #0: ffff888054c8cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:499 [inline]
 #0: ffff888054c8cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5b0 net/bluetooth/hci_core.c:2715
 #1: ffff888054c8c0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x1100 net/bluetooth/hci_sync.c:5314
3 locks held by kworker/1:14/9866:
 #0: ffff88813ff15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
 #0: ffff88813ff15948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
 #1: ffffc900051a7bc0 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
 #1: ffffc900051a7bc0 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
 #2: ffffffff8df475f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
 #2: ffffffff8df475f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x36e/0x6e0 kernel/rcu/tree_exp.h:956
3 locks held by kworker/1:15/9867:
 #0: ffff88813ff15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
 #0: ffff88813ff15948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
 #1: ffffc90004c67bc0 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
 #1: ffffc90004c67bc0 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
 #2: ffffffff8f311e48 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
5 locks held by kworker/0:13/9874:
 #0: ffff88801cee3548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
 #0: ffff88801cee3548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
 #1: ffffc90004b97bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
 #1: ffffc90004b97bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
 #2: ffff8880285ae198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #2: ffff8880285ae198 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4ef0 drivers/usb/core/hub.c:5899
 #3: ffff888030204198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff888030204198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1006
 #4: ffff888053ce9160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #4: ffff888053ce9160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 drivers/base/dd.c:1006
1 lock held by syz.1.1242/10869:
 #0: ffffffff8f311e48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff8f311e48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff8f311e48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8ec/0x1c90 net/core/rtnetlink.c:4071
4 locks held by syz.0.1244/10877:
 #0: ffff888025a64ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:499 [inline]
 #0: ffff888025a64ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5b0 net/bluetooth/hci_core.c:2715
 #1: ffff888025a640c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x1100 net/bluetooth/hci_sync.c:5314
 #2: ffffffff8f483a08 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2143 [inline]
 #2: ffffffff8f483a08 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2637
 #3: ffff8880285a6338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5b0 net/bluetooth/l2cap_core.c:1763
3 locks held by syz.3.1247/10893:
 #0: ffff88802715cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:499 [inline]
 #0: ffff88802715cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5b0 net/bluetooth/hci_core.c:2715
 #1: ffff88802715c0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x1100 net/bluetooth/hci_sync.c:5314
 #2: ffffffff8f483a08 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2143 [inline]
 #2: ffffffff8f483a08 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2637

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xf95/0xfe0 kernel/hung_task.c:515
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:82
Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 91 0e 00 f3 0f 1e fa fb f4 <e9> 08 e3 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90000197e20 EFLAGS: 000002c6
RAX: 000000000055333b RBX: ffffffff8197149e RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffffffff8d792d26 RDI: ffffffff8bc08660
RBP: ffffc90000197f10 R08: ffff8880b87336db R09: 1ffff110170e66db
R10: dffffc0000000000 R11: ffffed10170e66dc R12: ffffffff8f822470
R13: 1ffff110038d4b70 R14: 0000000000000001 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888125f1f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005590318c6138 CR3: 000000000dd3a000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
 default_idle+0x13/0x20 arch/x86/kernel/process.c:767
 default_idle_call+0x73/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:191 [inline]
 do_idle+0x1be/0x4d0 kernel/sched/idle.c:332
 cpu_startup_entry+0x44/0x60 kernel/sched/idle.c:430
 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312
 common_startup_64+0x13e/0x147
 </TASK>


The list of existing description files:
acpi_thermal_rel.txt
aio.txt
auto.txt
binfmt.txt
bpf.txt
bpf_prog.txt
bpf_trace.txt
cgroup.txt
damon.txt
dev_ashmem.txt
dev_bifrost.txt
dev_binder.txt
dev_binderfs.txt
dev_block.txt
dev_bsg.txt
dev_bus_usb.txt
dev_camx.txt
dev_cdrom.txt
dev_cec.txt
dev_char_usb.txt
dev_comedi.txt
dev_dma_heap.txt
dev_dri.txt
dev_dsp.txt
dev_dvb_demux.txt
dev_dvb_dvr.txt
dev_dvb_frontend.txt
dev_fb.txt
dev_floppy.txt
dev_hidraw.txt
dev_i2c.txt
dev_i915.txt
dev_img_rogue.txt
dev_infiniband_rdma.txt
dev_infiniband_rdma_cm.txt
dev_input.txt
dev_iommu.txt
dev_kvm.txt
dev_kvm_amd64.txt
dev_kvm_arm64.txt
dev_kvm_extra.txt
dev_kvm_riscv64.txt
dev_loop.txt
dev_mali.txt
dev_media.txt
dev_msm.txt
dev_msr.txt
dev_nbd.txt
dev_net_tun.txt
dev_panthor.txt
dev_ppp.txt
dev_ptmx.txt
dev_ptp.txt
dev_qat_adf_ctl.txt
dev_qrtr_tun.txt
dev_random.txt
dev_rfkill.txt
dev_rtc.txt
dev_sequencer.txt
dev_sg.txt
dev_snapshot.txt
dev_snd_control.txt
dev_snd_hw.txt
dev_snd_midi.txt
dev_snd_pcm.txt
dev_snd_seq.txt
dev_snd_timer.txt
dev_sr.txt
dev_sw_sync.txt
dev_tlk_device.txt
dev_trusty.txt
dev_udmabuf.txt
dev_uhid.txt
dev_uinput.txt
dev_usb_hiddev.txt
dev_usbmon.txt
dev_userio.txt
dev_vfio.txt
dev_vga_arbiter.txt
dev_vhci.txt
dev_video4linux.txt
dev_video4linux_vim2m.txt
dev_virtual_nci.txt
dev_vtpm.txt
fanotify.txt
filesystem.txt
fs_9p.txt
fs_fuse.txt
fs_incfs.txt
fs_ioctl.txt
fs_ioctl_autofs.txt
fs_ioctl_btrfs.txt
fs_ioctl_ext4.txt
fs_ioctl_f2fs.txt
fs_ioctl_fat.txt
fs_ioctl_fscrypt.txt
fs_ioctl_fsverity.txt
fs_ioctl_nilfs2.txt
fs_ioctl_ocfs2.txt
fs_ioctl_xfs.txt
futex.txt
hafnium.txt
inotify.txt
io_uring.txt
ipc.txt
key.txt
kfuzztest.txt
l2cap.txt
landlock.txt
lsm.txt
namespaces.txt
net_80211.txt
netfilter.txt
netfilter_arp.txt
netfilter_bridge.txt
netfilter_ipv4.txt
netfilter_ipv6.txt
netfilter_ipvs.txt
netfilter_targets.txt
pagemap_ioctl.txt
perf.txt
prctl.txt
quotactl.txt
seccomp.txt
security_apparmor.txt
security_selinux.txt
security_smack.txt
socket.txt
socket_alg.txt
socket_ax25.txt
socket_bluetooth.txt
socket_caif.txt
socket_can.txt
socket_ieee802154.txt
socket_inet.txt
socket_inet6.txt
socket_inet_dccp.txt
socket_inet_icmp.txt
socket_inet_igmp.txt
socket_inet_l2tp.txt
socket_inet_sctp.txt
socket_inet_tcp.txt
socket_inet_udp.txt
socket_ip_tunnel.txt
socket_isdn.txt
socket_kcm.txt
socket_key.txt
socket_llc.txt
socket_netlink.txt
socket_netlink_audit.txt
socket_netlink_crypto.txt
socket_netlink_generic.txt
socket_netlink_generic_80211.txt
socket_netlink_generic_batadv.txt
socket_netlink_generic_devlink.txt
socket_netlink_generic_ethtool.txt
socket_netlink_generic_fou.txt
socket_netlink_generic_gtp.txt
socket_netlink_generic_mptcp.txt
socket_netlink_generic_net_dm.txt
socket_netlink_generic_netlabel.txt
socket_netlink_generic_nfc.txt
socket_netlink_generic_seg6.txt
socket_netlink_generic_smc.txt
socket_netlink_generic_team.txt
socket_netlink_generic_wireguard.txt
socket_netlink_netfilter.txt
socket_netlink_netfilter_acct.txt
socket_netlink_netfilter_conntrack.txt
socket_netlink_netfilter_conntrack_exp.txt
socket_netlink_netfilter_conntrack_helper.txt
socket_netlink_netfilter_ipset.txt
socket_netlink_netfilter_log.txt
socket_netlink_netfilter_nft_compat.txt
socket_netlink_netfilter_nftables.txt
socket_netlink_netfilter_osf.txt
socket_netlink_netfilter_queue.txt
socket_netlink_netfilter_timeout.txt
socket_netlink_rdma.txt
socket_netlink_route.txt
socket_netlink_route_sched.txt
socket_netlink_route_sched_retired.txt
socket_netlink_sock_diag.txt
socket_netlink_xfrm.txt
socket_netrom.txt
socket_nfc.txt
socket_nvme_of_tcp.txt
socket_packet.txt
socket_phonet.txt
socket_pppox.txt
socket_qipcrtr.txt
socket_rds.txt
socket_rose.txt
socket_rxrpc.txt
socket_tipc.txt
socket_tipc_netlink.txt
socket_unix.txt
socket_vnet.txt
socket_x25.txt
socket_xdp.txt
sys.txt
uffd.txt
usbip.txt
vmw_vmci.txt
vnet.txt
vnet_mptcp.txt
vusb.txt
watch_queue.txt
xattr.txt

gemini-3-pro-preview

							input: 19853
							output: 17
							thoughts: 894
						

**Analyzing a USB Disconnect Hang**

Okay, here's what I'm seeing. We've got a bug report mentioning a task hung within `pvr2_i2c_core_done`. That stack trace is the key. The trace itself screams USB disconnect, doesn't it? We're diving through the `pvrusb2` driver during this process.

Tracing the path, it looks like `pvr_disconnect` is being called, which is logical given the USB context. The disconnect operation seems to involve `usb_unbind_interface` as we expect, but it is taking longer than it should.

Looking deeper, `proc_ioctl` is in the stack at `drivers/usb/core/devio.c:2360`. That's interesting. What `ioctl` is causing this? It could be `USBDEVFS_DISCONNECT` or a related ioctl. I'll need to confirm what ioctl call path is causing the disconnect. Time to dive into `drivers/usb/core/devio.c` and figure this out.

map[Expression:proc_ioctl]

map[Output:arch/powerpc/platforms/book3s/vas-api.c=505=static int coproc_mmap(struct file *fp, struct vm_area_struct *vma)
--
arch/powerpc/platforms/book3s/vas-api.c-584-
arch/powerpc/platforms/book3s/vas-api.c:585:static long coproc_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
arch/powerpc/platforms/book3s/vas-api.c-586-{
--
arch/powerpc/platforms/book3s/vas-api.c=595=static struct file_operations coproc_fops = {
--
arch/powerpc/platforms/book3s/vas-api.c-598-	.mmap = coproc_mmap,
arch/powerpc/platforms/book3s/vas-api.c:599:	.unlocked_ioctl = coproc_ioctl,
arch/powerpc/platforms/book3s/vas-api.c-600-};
--
arch/x86/kernel/cpu/mtrr/if.c=397=static const struct proc_ops mtrr_proc_ops = {
--
arch/x86/kernel/cpu/mtrr/if.c-401-	.proc_write		= mtrr_write,
arch/x86/kernel/cpu/mtrr/if.c:402:	.proc_ioctl		= mtrr_ioctl,
arch/x86/kernel/cpu/mtrr/if.c-403-#ifdef CONFIG_COMPAT
--
drivers/hwmon/dell-smm-hwmon.c=717=static const struct proc_ops i8k_proc_ops = {
--
drivers/hwmon/dell-smm-hwmon.c-721-	.proc_release	= single_release,
drivers/hwmon/dell-smm-hwmon.c:722:	.proc_ioctl	= i8k_ioctl,
drivers/hwmon/dell-smm-hwmon.c-723-};
--
drivers/pci/proc.c=323=static const struct proc_ops proc_bus_pci_ops = {
--
drivers/pci/proc.c-326-	.proc_write	= proc_bus_pci_write,
drivers/pci/proc.c:327:	.proc_ioctl	= proc_bus_pci_ioctl,
drivers/pci/proc.c-328-#ifdef CONFIG_COMPAT
--
drivers/scsi/esas2r/esas2r.h=972=int esas2r_show_info(struct seq_file *m, struct Scsi_Host *sh);
drivers/scsi/esas2r/esas2r.h:973:long esas2r_proc_ioctl(struct file *fp, unsigned int cmd, unsigned long arg);
drivers/scsi/esas2r/esas2r.h-974-
--
drivers/scsi/esas2r/esas2r_main.c=611=static const struct file_operations esas2r_proc_fops = {
drivers/scsi/esas2r/esas2r_main.c-612-	.compat_ioctl	= compat_ptr_ioctl,
drivers/scsi/esas2r/esas2r_main.c:613:	.unlocked_ioctl = esas2r_proc_ioctl,
drivers/scsi/esas2r/esas2r_main.c-614-};
--
drivers/scsi/esas2r/esas2r_main.c=616=static const struct proc_ops esas2r_proc_ops = {
drivers/scsi/esas2r/esas2r_main.c-617-	.proc_lseek		= default_llseek,
drivers/scsi/esas2r/esas2r_main.c:618:	.proc_ioctl		= esas2r_proc_ioctl,
drivers/scsi/esas2r/esas2r_main.c-619-#ifdef CONFIG_COMPAT
--
drivers/scsi/esas2r/esas2r_main.c=625=static int esas2r_proc_major;
drivers/scsi/esas2r/esas2r_main.c-626-
drivers/scsi/esas2r/esas2r_main.c:627:long esas2r_proc_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
drivers/scsi/esas2r/esas2r_main.c-628-{
--
drivers/usb/core/devio.c=2305=static int proc_releaseinterface(struct usb_dev_state *ps, void __user *arg)
--
drivers/usb/core/devio.c-2318-
drivers/usb/core/devio.c:2319:static int proc_ioctl(struct usb_dev_state *ps, struct usbdevfs_ioctl *ctl)
drivers/usb/core/devio.c-2320-{
--
drivers/usb/core/devio.c-2396-
drivers/usb/core/devio.c:2397:static int proc_ioctl_default(struct usb_dev_state *ps, void __user *arg)
drivers/usb/core/devio.c-2398-{
--
drivers/usb/core/devio.c-2402-		return -EFAULT;
drivers/usb/core/devio.c:2403:	return proc_ioctl(ps, &ctrl);
drivers/usb/core/devio.c-2404-}
--
drivers/usb/core/devio.c-2406-#ifdef CONFIG_COMPAT
drivers/usb/core/devio.c:2407:static int proc_ioctl_compat(struct usb_dev_state *ps, compat_uptr_t arg)
drivers/usb/core/devio.c-2408-{
--
drivers/usb/core/devio.c-2416-	ctrl.data = compat_ptr(ioc32.data);
drivers/usb/core/devio.c:2417:	return proc_ioctl(ps, &ctrl);
drivers/usb/core/devio.c-2418-}
--
drivers/usb/core/devio.c=2600=static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
--
drivers/usb/core/devio.c-2740-		snoop(&dev->dev, "%s: IOCTL32\n", __func__);
drivers/usb/core/devio.c:2741:		ret = proc_ioctl_compat(ps, ptr_to_compat(p));
drivers/usb/core/devio.c-2742-		break;
--
drivers/usb/core/devio.c-2766-		snoop(&dev->dev, "%s: IOCTL\n", __func__);
drivers/usb/core/devio.c:2767:		ret = proc_ioctl_default(ps, p);
drivers/usb/core/devio.c-2768-		break;
--
fs/proc/inode.c=370=static long pde_ioctl(struct proc_dir_entry *pde, struct file *file, unsigned int cmd, unsigned long arg)
fs/proc/inode.c-371-{
fs/proc/inode.c:372:	const auto ioctl = pde->proc_ops->proc_ioctl;
fs/proc/inode.c-373-	if (ioctl)
--
include/linux/proc_fs.h=35=struct proc_ops {
--
include/linux/proc_fs.h-44-	__poll_t (*proc_poll)(struct file *, struct poll_table_struct *);
include/linux/proc_fs.h:45:	long	(*proc_ioctl)(struct file *, unsigned int, unsigned long);
include/linux/proc_fs.h-46-#ifdef CONFIG_COMPAT
--
net/sunrpc/cache.c=1602=static const struct proc_ops cache_channel_proc_ops = {
--
net/sunrpc/cache.c-1605-	.proc_poll	= cache_poll_procfs,
net/sunrpc/cache.c:1606:	.proc_ioctl	= cache_ioctl_procfs, /* for FIONREAD */
net/sunrpc/cache.c-1607-	.proc_open	= cache_open_procfs,
--
sound/core/info.c=276=static const struct proc_ops snd_info_entry_operations =
--
sound/core/info.c-281-	.proc_poll	= snd_info_entry_poll,
sound/core/info.c:282:	.proc_ioctl	= snd_info_entry_ioctl,
sound/core/info.c-283-	.proc_mmap	= snd_info_entry_mmap,
]

gemini-3-pro-preview

							input: 23251
							output: 42
							thoughts: 79
						

Okay, let me break this down.

**Diving into USB Device Driver Interactions**

Right, so I'm looking at `proc_ioctl`, specifically in `drivers/usb/core/devio.c`. This is where the magic happens for handling `USBDEVFS_IOCTL`, which I already know is the mechanism for sending an ioctl call directly to a USB device driver. Okay, so now I just need to really focus in on `proc_ioctl` in `drivers/usb/core/devio.c` and understand how the interaction works.

map[ContextFile:drivers/usb/core/devio.c IncludeLines:true Name:proc_ioctl]

map[SourceCode:2319:	static int proc_ioctl(struct usb_dev_state *ps, struct usbdevfs_ioctl *ctl)
2320:	{
2321:		int			size;
2322:		void			*buf = NULL;
2323:		int			retval = 0;
2324:		struct usb_interface    *intf = NULL;
2325:		struct usb_driver       *driver = NULL;
2326:	
2327:		if (ps->privileges_dropped)
2328:			return -EACCES;
2329:	
2330:		if (!connected(ps))
2331:			return -ENODEV;
2332:	
2333:		/* alloc buffer */
2334:		size = _IOC_SIZE(ctl->ioctl_code);
2335:		if (size > 0) {
2336:			buf = kmalloc(size, GFP_KERNEL);
2337:			if (buf == NULL)
2338:				return -ENOMEM;
2339:			if ((_IOC_DIR(ctl->ioctl_code) & _IOC_WRITE)) {
2340:				if (copy_from_user(buf, ctl->data, size)) {
2341:					kfree(buf);
2342:					return -EFAULT;
2343:				}
2344:			} else {
2345:				memset(buf, 0, size);
2346:			}
2347:		}
2348:	
2349:		if (ps->dev->state != USB_STATE_CONFIGURED)
2350:			retval = -EHOSTUNREACH;
2351:		else if (!(intf = usb_ifnum_to_if(ps->dev, ctl->ifno)))
2352:			retval = -EINVAL;
2353:		else switch (ctl->ioctl_code) {
2354:	
2355:		/* disconnect kernel driver from interface */
2356:		case USBDEVFS_DISCONNECT:
2357:			if (intf->dev.driver) {
2358:				driver = to_usb_driver(intf->dev.driver);
2359:				dev_dbg(&intf->dev, "disconnect by usbfs\n");
2360:				usb_driver_release_interface(driver, intf);
2361:			} else
2362:				retval = -ENODATA;
2363:			break;
2364:	
2365:		/* let kernel drivers try to (re)bind to the interface */
2366:		case USBDEVFS_CONNECT:
2367:			if (!intf->dev.driver)
2368:				retval = device_attach(&intf->dev);
2369:			else
2370:				retval = -EBUSY;
2371:			break;
2372:	
2373:		/* talk directly to the interface's driver */
2374:		default:
2375:			if (intf->dev.driver)
2376:				driver = to_usb_driver(intf->dev.driver);
2377:			if (driver == NULL || driver->unlocked_ioctl == NULL) {
2378:				retval = -ENOTTY;
2379:			} else {
2380:				retval = driver->unlocked_ioctl(intf, ctl->ioctl_code, buf);
2381:				if (retval == -ENOIOCTLCMD)
2382:					retval = -ENOTTY;
2383:			}
2384:		}
2385:	
2386:		/* cleanup and return */
2387:		if (retval >= 0
2388:				&& (_IOC_DIR(ctl->ioctl_code) & _IOC_READ) != 0
2389:				&& size > 0
2390:				&& copy_to_user(ctl->data, buf, size) != 0)
2391:			retval = -EFAULT;
2392:	
2393:		kfree(buf);
2394:		return retval;
2395:	}
 SourceFile:drivers/usb/core/devio.c]

gemini-3-pro-preview

							input: 24636
							output: 45
							thoughts: 1484
						

**Analyzing the USB Disconnect Issue**

Okay, so I'm diving into this USB disconnect issue. The `USBDEVFS_IOCTL` is the key, and specifically, I'm checking `ctl->ioctl_code` within that ioctl. Right, `proc_ioctl` handles `USBDEVFS_IOCTL`, and it takes a `struct usbdevfs_ioctl` argument. From the `struct` definition, the `ioctl_code` is critical as it encodes the size and direction of the data transfer.  `proc_ioctl` is specifically checking for `USBDEVFS_DISCONNECT`.

The user calls `ioctl` with `USBDEVFS_IOCTL` and `ctl.ioctl_code = USBDEVFS_DISCONNECT`. This triggers `usb_driver_release_interface`, which leads to `device_release_driver_internal` and eventually `pvr_disconnect`. Got it. That's the normal path.

Now, looking at this bug report, there are two tasks hanging. Task 1's stack trace is interesting: it looks like it's going down the expected path:  `proc_ioctl` calls `usb_driver_release_interface`, which calls `device_release_driver_internal`. But there's a point of confusion here.  It gets weirder when I look deeper...

Wait a second. The stack trace of Task 1 shows something unexpected.  It goes through `usb_disconnect`, then `hub_quiesce`, and then `hub_disconnect`. What? It seems that *`hub_disconnect`* is called when `USBDEVFS_DISCONNECT` is called on the *hub* interface itself! That's the crucial point. So, the user is calling `USBDEVFS_DISCONNECT` on the hub interface, not the pvrusb2 device. When the user disconnects the hub driver, its `hub_disconnect` is called. The `hub_disconnect` calls `hub_quiesce` which then calls `usb_disconnect` for all the children connected to the hub. That includes the `pvrusb2` device. The `usb_disconnect` then calls `usb_disable_device`, which calls `device_del`, and then unbinds the `pvrusb2` driver. This unbind then triggers `pvr_disconnect`. That's where it all connects!

Now, Task 2 is deadlocked in `usbdev_do_ioctl` trying to acquire `device_lock`. Hang on... `usbdev_do_ioctl` takes `device_lock(&dev->dev)` at the beginning, right? I'll need to go back and check the code path in `usbdev_do_ioctl`.

map[ContextFile:drivers/usb/core/devio.c IncludeLines:true Name:usbdev_do_ioctl]

map[SourceCode:2595:	/*
2596:	 * NOTE:  All requests here that have interface numbers as parameters
2597:	 * are assuming that somehow the configuration has been prevented from
2598:	 * changing.  But there's no mechanism to ensure that...
2599:	 */
2600:	static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
2601:					void __user *p)
2602:	{
2603:		struct usb_dev_state *ps = file->private_data;
2604:		struct inode *inode = file_inode(file);
2605:		struct usb_device *dev = ps->dev;
2606:		int ret = -ENOTTY;
2607:	
2608:		if (!(file->f_mode & FMODE_WRITE))
2609:			return -EPERM;
2610:	
2611:		usb_lock_device(dev);
2612:	
2613:		/* Reap operations are allowed even after disconnection */
2614:		switch (cmd) {
2615:		case USBDEVFS_REAPURB:
2616:			snoop(&dev->dev, "%s: REAPURB\n", __func__);
2617:			ret = proc_reapurb(ps, p);
2618:			goto done;
2619:	
2620:		case USBDEVFS_REAPURBNDELAY:
2621:			snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
2622:			ret = proc_reapurbnonblock(ps, p);
2623:			goto done;
2624:	
2625:	#ifdef CONFIG_COMPAT
2626:		case USBDEVFS_REAPURB32:
2627:			snoop(&dev->dev, "%s: REAPURB32\n", __func__);
2628:			ret = proc_reapurb_compat(ps, p);
2629:			goto done;
2630:	
2631:		case USBDEVFS_REAPURBNDELAY32:
2632:			snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
2633:			ret = proc_reapurbnonblock_compat(ps, p);
2634:			goto done;
2635:	#endif
2636:		}
2637:	
2638:		if (!connected(ps)) {
2639:			usb_unlock_device(dev);
2640:			return -ENODEV;
2641:		}
2642:	
2643:		switch (cmd) {
2644:		case USBDEVFS_CONTROL:
2645:			snoop(&dev->dev, "%s: CONTROL\n", __func__);
2646:			ret = proc_control(ps, p);
2647:			if (ret >= 0)
2648:				inode_set_mtime_to_ts(inode,
2649:						      inode_set_ctime_current(inode));
2650:			break;
2651:	
2652:		case USBDEVFS_BULK:
2653:			snoop(&dev->dev, "%s: BULK\n", __func__);
2654:			ret = proc_bulk(ps, p);
2655:			if (ret >= 0)
2656:				inode_set_mtime_to_ts(inode,
2657:						      inode_set_ctime_current(inode));
2658:			break;
2659:	
2660:		case USBDEVFS_RESETEP:
2661:			snoop(&dev->dev, "%s: RESETEP\n", __func__);
2662:			ret = proc_resetep(ps, p);
2663:			if (ret >= 0)
2664:				inode_set_mtime_to_ts(inode,
2665:						      inode_set_ctime_current(inode));
2666:			break;
2667:	
2668:		case USBDEVFS_RESET:
2669:			snoop(&dev->dev, "%s: RESET\n", __func__);
2670:			ret = proc_resetdevice(ps);
2671:			break;
2672:	
2673:		case USBDEVFS_CLEAR_HALT:
2674:			snoop(&dev->dev, "%s: CLEAR_HALT\n", __func__);
2675:			ret = proc_clearhalt(ps, p);
2676:			if (ret >= 0)
2677:				inode_set_mtime_to_ts(inode,
2678:						      inode_set_ctime_current(inode));
2679:			break;
2680:	
2681:		case USBDEVFS_GETDRIVER:
2682:			snoop(&dev->dev, "%s: GETDRIVER\n", __func__);
2683:			ret = proc_getdriver(ps, p);
2684:			break;
2685:	
2686:		case USBDEVFS_CONNECTINFO:
2687:			snoop(&dev->dev, "%s: CONNECTINFO\n", __func__);
2688:			ret = proc_connectinfo(ps, p);
2689:			break;
2690:	
2691:		case USBDEVFS_SETINTERFACE:
2692:			snoop(&dev->dev, "%s: SETINTERFACE\n", __func__);
2693:			ret = proc_setintf(ps, p);
2694:			break;
2695:	
2696:		case USBDEVFS_SETCONFIGURATION:
2697:			snoop(&dev->dev, "%s: SETCONFIGURATION\n", __func__);
2698:			ret = proc_setconfig(ps, p);
2699:			break;
2700:	
2701:		case USBDEVFS_SUBMITURB:
2702:			snoop(&dev->dev, "%s: SUBMITURB\n", __func__);
2703:			ret = proc_submiturb(ps, p);
2704:			if (ret >= 0)
2705:				inode_set_mtime_to_ts(inode,
2706:						      inode_set_ctime_current(inode));
2707:			break;
2708:	
2709:	#ifdef CONFIG_COMPAT
2710:		case USBDEVFS_CONTROL32:
2711:			snoop(&dev->dev, "%s: CONTROL32\n", __func__);
2712:			ret = proc_control_compat(ps, p);
2713:			if (ret >= 0)
2714:				inode_set_mtime_to_ts(inode,
2715:						      inode_set_ctime_current(inode));
2716:			break;
2717:	
2718:		case USBDEVFS_BULK32:
2719:			snoop(&dev->dev, "%s: BULK32\n", __func__);
2720:			ret = proc_bulk_compat(ps, p);
2721:			if (ret >= 0)
2722:				inode_set_mtime_to_ts(inode,
2723:						      inode_set_ctime_current(inode));
2724:			break;
2725:	
2726:		case USBDEVFS_DISCSIGNAL32:
2727:			snoop(&dev->dev, "%s: DISCSIGNAL32\n", __func__);
2728:			ret = proc_disconnectsignal_compat(ps, p);
2729:			break;
2730:	
2731:		case USBDEVFS_SUBMITURB32:
2732:			snoop(&dev->dev, "%s: SUBMITURB32\n", __func__);
2733:			ret = proc_submiturb_compat(ps, p);
2734:			if (ret >= 0)
2735:				inode_set_mtime_to_ts(inode,
2736:						      inode_set_ctime_current(inode));
2737:			break;
2738:	
2739:		case USBDEVFS_IOCTL32:
2740:			snoop(&dev->dev, "%s: IOCTL32\n", __func__);
2741:			ret = proc_ioctl_compat(ps, ptr_to_compat(p));
2742:			break;
2743:	#endif
2744:	
2745:		case USBDEVFS_DISCARDURB:
2746:			snoop(&dev->dev, "%s: DISCARDURB %px\n", __func__, p);
2747:			ret = proc_unlinkurb(ps, p);
2748:			break;
2749:	
2750:		case USBDEVFS_DISCSIGNAL:
2751:			snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
2752:			ret = proc_disconnectsignal(ps, p);
2753:			break;
2754:	
2755:		case USBDEVFS_CLAIMINTERFACE:
2756:			snoop(&dev->dev, "%s: CLAIMINTERFACE\n", __func__);
2757:			ret = proc_claiminterface(ps, p);
2758:			break;
2759:	
2760:		case USBDEVFS_RELEASEINTERFACE:
2761:			snoop(&dev->dev, "%s: RELEASEINTERFACE\n", __func__);
2762:			ret = proc_releaseinterface(ps, p);
2763:			break;
2764:	
2765:		case USBDEVFS_IOCTL:
2766:			snoop(&dev->dev, "%s: IOCTL\n", __func__);
2767:			ret = proc_ioctl_default(ps, p);
2768:			break;
2769:	
2770:		case USBDEVFS_CLAIM_PORT:
2771:			snoop(&dev->dev, "%s: CLAIM_PORT\n", __func__);
2772:			ret = proc_claim_port(ps, p);
2773:			break;
2774:	
2775:		case USBDEVFS_RELEASE_PORT:
2776:			snoop(&dev->dev, "%s: RELEASE_PORT\n", __func__);
2777:			ret = proc_release_port(ps, p);
2778:			break;
2779:		case USBDEVFS_GET_CAPABILITIES:
2780:			ret = proc_get_capabilities(ps, p);
2781:			break;
2782:		case USBDEVFS_DISCONNECT_CLAIM:
2783:			ret = proc_disconnect_claim(ps, p);
2784:			break;
2785:		case USBDEVFS_ALLOC_STREAMS:
2786:			ret = proc_alloc_streams(ps, p);
2787:			break;
2788:		case USBDEVFS_FREE_STREAMS:
2789:			ret = proc_free_streams(ps, p);
2790:			break;
2791:		case USBDEVFS_DROP_PRIVILEGES:
2792:			ret = proc_drop_privileges(ps, p);
2793:			break;
2794:		case USBDEVFS_GET_SPEED:
2795:			ret = ps->dev->speed;
2796:			break;
2797:		case USBDEVFS_FORBID_SUSPEND:
2798:			ret = proc_forbid_suspend(ps);
2799:			break;
2800:		case USBDEVFS_ALLOW_SUSPEND:
2801:			ret = proc_allow_suspend(ps);
2802:			break;
2803:		case USBDEVFS_WAIT_FOR_RESUME:
2804:			ret = proc_wait_for_resume(ps);
2805:			break;
2806:		}
2807:	
2808:		/* Handle variable-length commands */
2809:		switch (cmd & ~IOCSIZE_MASK) {
2810:		case USBDEVFS_CONNINFO_EX(0):
2811:			ret = proc_conninfo_ex(ps, p, _IOC_SIZE(cmd));
2812:			break;
2813:		}
2814:	
2815:	 done:
2816:		usb_unlock_device(dev);
2817:		if (ret >= 0)
2818:			inode_set_atime_to_ts(inode, current_time(inode));
2819:		return ret;
2820:	}
 SourceFile:drivers/usb/core/devio.c]

gemini-3-pro-preview

							input: 30243
							output: 63
							thoughts: 567
						

**Debugging a USB Device Disconnect Hang**

Okay, so I'm looking at this hang during a USB disconnect, specifically when a `pvrusb2` device is being unplugged. I see that `usb_lock_device(dev)` is called at the start of `usbdev_do_ioctl`, which locks the `device_lock` associated with the device. Interesting.

Now, the core issue seems to be in Task 1, where `usb_disconnect` is called. But wait, `usb_disconnect` isn't being called directly on the *hub* device, right? It's being called on the *child* device, and I need to track the path. Let's see...

Tracing the call stack from Task 1, I see:

`usb_disconnect -> hub_quiesce -> hub_disconnect -> usb_unbind_interface`.

Essentially, Task 1 is unbinding the hub driver from the hub interface. `proc_ioctl` was called on the hub device's interface and that, in turn, called `usb_driver_release_interface`. This led to `device_release_driver_internal` on the hub interface, then into `hub_disconnect`. `hub_disconnect` kicks off the process by calling `hub_quiesce` which iterates through all the children. `usb_disconnect` gets called on all those children.

One of the children is our `pvrusb2` device. `usb_disconnect` on the pvrusb2 device calls `usb_disable_device`, which eventually leads to `device_del`. `device_del` calls `bus_remove_device`, which calls `device_release_driver_internal` on the *child* device's interfaces. This, of course, calls `pvr_disconnect`.  Now we're inside the pvrusb2 driver logic.

`pvr_disconnect` calls `pvr2_context_disconnect`, which calls `pvr2_hdw_disconnect`. Finally, `pvr2_hdw_disconnect` calls `pvr2_i2c_core_done`. And here's where it gets interesting: `pvr2_i2c_core_done` calls `i2c_del_adapter`. This `i2c_del_adapter` is the crucial point; it appears to be waiting for something to complete, and that's likely the hang.

So, the hang is at `i2c_del_adapter`. Now, I need to understand what this `i2c_del_adapter` is waiting for. Let's examine `pvr2_i2c_core_done` in `drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c` and figure out what's blocking.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c IncludeLines:true Name:pvr2_i2c_core_done]

map[SourceCode: 649:	void pvr2_i2c_core_done(struct pvr2_hdw *hdw)
 650:	{
 651:		if (hdw->i2c_linked) {
 652:			i2c_del_adapter(&hdw->i2c_adap);
 653:			hdw->i2c_linked = 0;
 654:		}
 655:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c]

gemini-3-pro-preview

							input: 31644
							output: 51
							thoughts: 47
						

Okay, let's see...

**Analyzing `i2c_del_adapter` Functionality**

Hmm, so `i2c_del_adapter` *does* wait for completion, right? I need to verify that. My understanding is that the function has blocking behavior. To make sure, I should jump into the `drivers/i2c/i2c-core-base.c` file and double-check the implementation of `i2c_del_adapter`. Gotta refresh my memory on the synchronization primitives it employs and make sure there aren't any sneaky asynchronous operations lurking that would change my expected behavior. I need to know exactly how it handles the adapter removal to confirm my assumptions about its synchronous nature, which is critical for the current issue I'm debugging. Let's see what's actually going on in there...

map[ContextFile:drivers/i2c/i2c-core-base.c IncludeLines:true Name:i2c_del_adapter]

map[SourceCode:1747:	/**
1748:	 * i2c_del_adapter - unregister I2C adapter
1749:	 * @adap: the adapter being unregistered
1750:	 * Context: can sleep
1751:	 *
1752:	 * This unregisters an I2C adapter which was previously registered
1753:	 * by @i2c_add_adapter or @i2c_add_numbered_adapter.
1754:	 */
1755:	void i2c_del_adapter(struct i2c_adapter *adap)
1756:	{
1757:		struct i2c_adapter *found;
1758:		struct i2c_client *client, *next;
1759:	
1760:		/* First make sure that this adapter was ever added */
1761:		mutex_lock(&core_lock);
1762:		found = idr_find(&i2c_adapter_idr, adap->nr);
1763:		mutex_unlock(&core_lock);
1764:		if (found != adap) {
1765:			pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);
1766:			return;
1767:		}
1768:	
1769:		i2c_acpi_remove_space_handler(adap);
1770:		/* Tell drivers about this removal */
1771:		mutex_lock(&core_lock);
1772:		bus_for_each_drv(&i2c_bus_type, NULL, adap,
1773:				       __process_removed_adapter);
1774:		mutex_unlock(&core_lock);
1775:	
1776:		/* Remove devices instantiated from sysfs */
1777:		mutex_lock_nested(&adap->userspace_clients_lock,
1778:				  i2c_adapter_depth(adap));
1779:		list_for_each_entry_safe(client, next, &adap->userspace_clients,
1780:					 detected) {
1781:			dev_dbg(&adap->dev, "Removing %s at 0x%x\n", client->name,
1782:				client->addr);
1783:			list_del(&client->detected);
1784:			i2c_unregister_device(client);
1785:		}
1786:		mutex_unlock(&adap->userspace_clients_lock);
1787:	
1788:		/* Detach any active clients. This can't fail, thus we do not
1789:		 * check the returned value. This is a two-pass process, because
1790:		 * we can't remove the dummy devices during the first pass: they
1791:		 * could have been instantiated by real devices wishing to clean
1792:		 * them up properly, so we give them a chance to do that first. */
1793:		device_for_each_child(&adap->dev, NULL, __unregister_client);
1794:		device_for_each_child(&adap->dev, NULL, __unregister_dummy);
1795:	
1796:		/* device name is gone after device_unregister */
1797:		dev_dbg(&adap->dev, "adapter [%s] unregistered\n", adap->name);
1798:	
1799:		pm_runtime_disable(&adap->dev);
1800:	
1801:		i2c_host_notify_irq_teardown(adap);
1802:	
1803:		debugfs_remove_recursive(adap->debugfs);
1804:	
1805:		/* wait until all references to the device are gone
1806:		 *
1807:		 * FIXME: This is old code and should ideally be replaced by an
1808:		 * alternative which results in decoupling the lifetime of the struct
1809:		 * device from the i2c_adapter, like spi or netdev do. Any solution
1810:		 * should be thoroughly tested with DEBUG_KOBJECT_RELEASE enabled!
1811:		 */
1812:		init_completion(&adap->dev_released);
1813:		device_unregister(&adap->dev);
1814:		wait_for_completion(&adap->dev_released);
1815:	
1816:		/* free bus id */
1817:		mutex_lock(&core_lock);
1818:		idr_remove(&i2c_adapter_idr, adap->nr);
1819:		mutex_unlock(&core_lock);
1820:	
1821:		/* Clear the device structure in case this adapter is ever going to be
1822:		   added again */
1823:		memset(&adap->dev, 0, sizeof(adap->dev));
1824:	}
 SourceFile:drivers/i2c/i2c-core-base.c]

gemini-3-pro-preview

							input: 33228
							output: 48
							thoughts: 51
						

Okay, here's my interpretation of that thought process, from an expert's perspective:

**Deconstructing the I2C Adapter Deletion Process**

Alright, so `i2c_del_adapter` – I need to understand its behavior in detail. It seems like it's waiting for `adap->dev_released`. That's standard practice, a cleanup barrier. So, the key is where `adap->dev_released` gets signaled. The comments point to the `release` function associated with `adap->dev`. That makes sense; the device release should signify that the adapter is truly available for deletion.

Now, let's trace where that `adap->dev.release` function is defined. I need to know the driver structure and its lifecycle to understand the completion's implications. Is it a default implementation? Is it specific to a given device type? This will tell me how the I2C adapter handles resource cleanup and how to safely unregister it. Understanding this will be crucial when I examine the locking and error handling in the process. I'll need to know whether I need to worry about races or other concurrency issues during adapter deletion.

requested entity does not exist

map[ContextFile:drivers/i2c/i2c-core-base.c IncludeSnippetLines:0 Name:dev_released]

map[References:<nil> TruncatedOutput:false]

gemini-3-pro-preview

							input: 33591
							output: 19
							thoughts: 34
						

Okay, here's my interpretation of that thought process, assuming I'm an expert in this area:

**Digging into the I2C Core Driver**

Alright, I need to understand what's happening around `adap->dev_released` in the I2C core, specifically in `i2c-core-base.c`. I'm going to look for related code, likely the function `complete()`, to see how this flag is being used. I'm assuming that this flag is used to synchronize some kind of device release sequence, perhaps something to do with asynchronous operations or resource cleanup. Given that I2C is a shared bus, it's pretty crucial to ensure proper sequencing and avoid race conditions when releasing a device. Therefore I will start by searching for the code string `complete(&adap->dev_released)` in the `drivers/i2c/i2c-core-base.c` file. This should point me directly to the relevant sections. If that exact string isn't found, then I will look for similar usage patterns using substrings such as `adap->dev_released`, `complete()`, `dev_released`, and related I2C kernel symbols. This should give me a solid starting point for understanding how the device release synchronization is managed.

map[Expression:complete.*dev_released]

map[Output:drivers/i2c/i2c-core-base.c=1231=static void i2c_adapter_dev_release(struct device *dev)
--
drivers/i2c/i2c-core-base.c-1233-	struct i2c_adapter *adap = to_i2c_adapter(dev);
drivers/i2c/i2c-core-base.c:1234:	complete(&adap->dev_released);
drivers/i2c/i2c-core-base.c-1235-}
]

gemini-3-pro-preview

							input: 34062
							output: 39
							thoughts: 241
						

**Debugging an I2C Adapter Release Hang**

Okay, so `i2c_adapter_dev_release` is supposed to trigger when `adap->dev`'s reference count drops to zero, completing the `dev_released` operation. The fact that it's hanging indicates someone is still holding a reference to `adap->dev`. I need to figure out who's the culprit.

Let's see… Task 2 is attempting to acquire `device_lock(&dev->dev)` within `usbdev_do_ioctl`. But wait, `usbdev_do_ioctl` locks the USB device itself, not the I2C adapter directly. So, Task 2 isn't the direct holder of an adapter reference.

Who *does* have the USB device locked? Ah, Task 1 is currently holding the `device_lock` on the USB device! Now, what's Task 1 doing with that lock? It looks like Task 1 is executing `usb_disconnect` on the hub, which then calls `device_del` on the child USB device.

So, `device_del` acquires `device_lock` on the child USB device. It's time to check what's going on in the `device_del` function, which is located in `drivers/base/core.c`. Let's delve in there.

map[ContextFile:drivers/base/core.c IncludeLines:true Name:device_del]

map[SourceCode:3819:	/**
3820:	 * device_del - delete device from system.
3821:	 * @dev: device.
3822:	 *
3823:	 * This is the first part of the device unregistration
3824:	 * sequence. This removes the device from the lists we control
3825:	 * from here, has it removed from the other driver model
3826:	 * subsystems it was added to in device_add(), and removes it
3827:	 * from the kobject hierarchy.
3828:	 *
3829:	 * NOTE: this should be called manually _iff_ device_add() was
3830:	 * also called manually.
3831:	 */
3832:	void device_del(struct device *dev)
3833:	{
3834:		struct subsys_private *sp;
3835:		struct device *parent = dev->parent;
3836:		struct kobject *glue_dir = NULL;
3837:		struct class_interface *class_intf;
3838:		unsigned int noio_flag;
3839:	
3840:		device_lock(dev);
3841:		kill_device(dev);
3842:		device_unlock(dev);
3843:	
3844:		if (dev->fwnode && dev->fwnode->dev == dev)
3845:			dev->fwnode->dev = NULL;
3846:	
3847:		/* Notify clients of device removal.  This call must come
3848:		 * before dpm_sysfs_remove().
3849:		 */
3850:		noio_flag = memalloc_noio_save();
3851:		bus_notify(dev, BUS_NOTIFY_DEL_DEVICE);
3852:	
3853:		dpm_sysfs_remove(dev);
3854:		if (parent)
3855:			klist_del(&dev->p->knode_parent);
3856:		if (MAJOR(dev->devt)) {
3857:			devtmpfs_delete_node(dev);
3858:			device_remove_sys_dev_entry(dev);
3859:			device_remove_file(dev, &dev_attr_dev);
3860:		}
3861:	
3862:		sp = class_to_subsys(dev->class);
3863:		if (sp) {
3864:			device_remove_class_symlinks(dev);
3865:	
3866:			mutex_lock(&sp->mutex);
3867:			/* notify any interfaces that the device is now gone */
3868:			list_for_each_entry(class_intf, &sp->interfaces, node)
3869:				if (class_intf->remove_dev)
3870:					class_intf->remove_dev(dev);
3871:			/* remove the device from the class list */
3872:			klist_del(&dev->p->knode_class);
3873:			mutex_unlock(&sp->mutex);
3874:			subsys_put(sp);
3875:		}
3876:		device_remove_file(dev, &dev_attr_uevent);
3877:		device_remove_attrs(dev);
3878:		bus_remove_device(dev);
3879:		device_pm_remove(dev);
3880:		driver_deferred_probe_del(dev);
3881:		device_platform_notify_remove(dev);
3882:		device_links_purge(dev);
3883:	
3884:		/*
3885:		 * If a device does not have a driver attached, we need to clean
3886:		 * up any managed resources. We do this in device_release(), but
3887:		 * it's never called (and we leak the device) if a managed
3888:		 * resource holds a reference to the device. So release all
3889:		 * managed resources here, like we do in driver_detach(). We
3890:		 * still need to do so again in device_release() in case someone
3891:		 * adds a new resource after this point, though.
3892:		 */
3893:		devres_release_all(dev);
3894:	
3895:		bus_notify(dev, BUS_NOTIFY_REMOVED_DEVICE);
3896:		kobject_uevent(&dev->kobj, KOBJ_REMOVE);
3897:		glue_dir = get_glue_dir(dev);
3898:		kobject_del(&dev->kobj);
3899:		cleanup_glue_dir(dev, glue_dir);
3900:		memalloc_noio_restore(noio_flag);
3901:		put_device(parent);
3902:	}
 SourceFile:drivers/base/core.c]

gemini-3-pro-preview

							input: 35968
							output: 43
							thoughts: 92
						

**My Analysis of Device Removal**

Okay, so I'm looking at this `device_del` function, and the first thing that jumps out at me is this lock acquisition: `device_lock(dev)`. Makes sense, we need to protect against race conditions during device removal. And then it releases it promptly after. Seems standard enough. But then, it calls `bus_remove_device(dev)`. That's where things get interesting, because `bus_remove_device` then proceeds to call `device_release_driver_internal(dev)`. Alarm bells are faintly ringing now. Why? Because *that* function, `device_release_driver_internal`, *also* acquires `device_lock(dev)`!

Now, this is something I need to look into more carefully. We’re acquiring the same lock twice in this flow? Are we nested locking here, which could have some performance implications or even potential for deadlocks if not implemented correctly? I need to understand why `device_release_driver_internal` is grabbing the lock again. Is there a genuine need for a second acquisition, or is this a relic or potentially a bug? Let's take a closer look at the actual code for `device_release_driver_internal` within `drivers/base/dd.c`. I need the specifics of that function's implementation to form a proper judgment.

map[ContextFile:drivers/base/dd.c IncludeLines:true Name:device_release_driver_internal]

map[SourceCode:1298:	void device_release_driver_internal(struct device *dev,
1299:					    const struct device_driver *drv,
1300:					    struct device *parent)
1301:	{
1302:		__device_driver_lock(dev, parent);
1303:	
1304:		if (!drv || drv == dev->driver)
1305:			__device_release_driver(dev, parent);
1306:	
1307:		__device_driver_unlock(dev, parent);
1308:	}
 SourceFile:drivers/base/dd.c]

gemini-3-pro-preview

							input: 36577
							output: 43
							thoughts: 187
						

**Dissecting the USB Device Removal Process**

Okay, so I'm tracing this device removal, and it looks like `__device_driver_lock` gets ahold of `device_lock(dev)`. That makes sense. Now Task 1 is holding onto that lock, specifically for the child USB device, and it's executing `__device_release_driver(dev, parent)`. This is where it gets interesting – we’re going down the rabbit hole: `device_remove(dev)`, then `usb_unbind_interface`, which eventually leads us to `pvr_disconnect`.

Hang on a second… `pvr_disconnect` is called for the *interface* device, not the USB device itself. That feels…indirect. Oh! But then, later, `device_del` is called for the actual USB device. Got it. So we're tearing down the interfaces first, and then the parent.

Then, `bus_remove_device` calls `device_release_driver_internal` for the USB device, so that makes sense.

Wait, another interesting detail. `usb_disable_device` calls `device_del` for the *interfaces* of the USB device. So the USB device's interfaces are removed when it is disabled, which is important. To confirm my understanding, let's take a look at `usb_disable_device` in `drivers/usb/core/message.c`.

map[ContextFile:drivers/usb/core/message.c IncludeLines:true Name:usb_disable_device]

map[SourceCode:1382:	/**
1383:	 * usb_disable_device - Disable all the endpoints for a USB device
1384:	 * @dev: the device whose endpoints are being disabled
1385:	 * @skip_ep0: 0 to disable endpoint 0, 1 to skip it.
1386:	 *
1387:	 * Disables all the device's endpoints, potentially including endpoint 0.
1388:	 * Deallocates hcd/hardware state for the endpoints (nuking all or most
1389:	 * pending urbs) and usbcore state for the interfaces, so that usbcore
1390:	 * must usb_set_configuration() before any interfaces could be used.
1391:	 */
1392:	void usb_disable_device(struct usb_device *dev, int skip_ep0)
1393:	{
1394:		int i;
1395:	
1396:		/* getting rid of interfaces will disconnect
1397:		 * any drivers bound to them (a key side effect)
1398:		 */
1399:		if (dev->actconfig) {
1400:			/*
1401:			 * FIXME: In order to avoid self-deadlock involving the
1402:			 * bandwidth_mutex, we have to mark all the interfaces
1403:			 * before unregistering any of them.
1404:			 */
1405:			for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++)
1406:				dev->actconfig->interface[i]->unregistering = 1;
1407:	
1408:			for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
1409:				struct usb_interface	*interface;
1410:	
1411:				/* remove this interface if it has been registered */
1412:				interface = dev->actconfig->interface[i];
1413:				if (!device_is_registered(&interface->dev))
1414:					continue;
1415:				dev_dbg(&dev->dev, "unregistering interface %s\n",
1416:					dev_name(&interface->dev));
1417:				remove_intf_ep_devs(interface);
1418:				device_del(&interface->dev);
1419:			}
1420:	
1421:			/* Now that the interfaces are unbound, nobody should
1422:			 * try to access them.
1423:			 */
1424:			for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
1425:				put_device(&dev->actconfig->interface[i]->dev);
1426:				dev->actconfig->interface[i] = NULL;
1427:			}
1428:	
1429:			usb_disable_usb2_hardware_lpm(dev);
1430:			usb_unlocked_disable_lpm(dev);
1431:			usb_disable_ltm(dev);
1432:	
1433:			dev->actconfig = NULL;
1434:			if (dev->state == USB_STATE_CONFIGURED)
1435:				usb_set_device_state(dev, USB_STATE_ADDRESS);
1436:		}
1437:	
1438:		dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
1439:			skip_ep0 ? "non-ep0" : "all");
1440:	
1441:		usb_disable_device_endpoints(dev, skip_ep0);
1442:	}
 SourceFile:drivers/usb/core/message.c]

gemini-3-pro-preview

							input: 38120
							output: 41
							thoughts: 112
						

**Analyzing a Potential USB Disconnect Issue**

Okay, so I'm looking at this code and it appears `usb_disable_device` is the culprit, because it calls `device_del(&interface->dev)`. I'm trying to figure out if there's a potential race condition. Specifically, Task 1 is holding `device_lock(&interface->dev)` while executing `pvr_disconnect`. I need to confirm if Task 1 is also holding `device_lock(&dev->dev)`. I need to trace the execution back from `usb_disable_device` to understand how `device_del` is triggered. I remember that `usb_disconnect` calls `usb_disable_device`. Let me check `usb_disconnect` and that code should be in `drivers/usb/core/hub.c` to see if there is any potential issues.

map[ContextFile:drivers/usb/core/hub.c IncludeLines:true Name:usb_disconnect]

map[SourceCode:2298:	/**
2299:	 * usb_disconnect - disconnect a device (usbcore-internal)
2300:	 * @pdev: pointer to device being disconnected
2301:	 *
2302:	 * Context: task context, might sleep
2303:	 *
2304:	 * Something got disconnected. Get rid of it and all of its children.
2305:	 *
2306:	 * If *pdev is a normal device then the parent hub must already be locked.
2307:	 * If *pdev is a root hub then the caller must hold the usb_bus_idr_lock,
2308:	 * which protects the set of root hubs as well as the list of buses.
2309:	 *
2310:	 * Only hub drivers (including virtual root hub drivers for host
2311:	 * controllers) should ever call this.
2312:	 *
2313:	 * This call is synchronous, and may not be used in an interrupt context.
2314:	 */
2315:	void usb_disconnect(struct usb_device **pdev)
2316:	{
2317:		struct usb_port *port_dev = NULL;
2318:		struct usb_device *udev = *pdev;
2319:		struct usb_hub *hub = NULL;
2320:		int port1 = 1;
2321:	
2322:		/* mark the device as inactive, so any further urb submissions for
2323:		 * this device (and any of its children) will fail immediately.
2324:		 * this quiesces everything except pending urbs.
2325:		 */
2326:		usb_set_device_state(udev, USB_STATE_NOTATTACHED);
2327:		dev_info(&udev->dev, "USB disconnect, device number %d\n",
2328:				udev->devnum);
2329:	
2330:		/*
2331:		 * Ensure that the pm runtime code knows that the USB device
2332:		 * is in the process of being disconnected.
2333:		 */
2334:		pm_runtime_barrier(&udev->dev);
2335:	
2336:		usb_lock_device(udev);
2337:	
2338:		hub_disconnect_children(udev);
2339:	
2340:		/* deallocate hcd/hardware state ... nuking all pending urbs and
2341:		 * cleaning up all state associated with the current configuration
2342:		 * so that the hardware is now fully quiesced.
2343:		 */
2344:		dev_dbg(&udev->dev, "unregistering device\n");
2345:		usb_disable_device(udev, 0);
2346:		usb_hcd_synchronize_unlinks(udev);
2347:	
2348:		if (udev->parent) {
2349:			port1 = udev->portnum;
2350:			hub = usb_hub_to_struct_hub(udev->parent);
2351:			port_dev = hub->ports[port1 - 1];
2352:	
2353:			sysfs_remove_link(&udev->dev.kobj, "port");
2354:			sysfs_remove_link(&port_dev->dev.kobj, "device");
2355:	
2356:			/*
2357:			 * As usb_port_runtime_resume() de-references udev, make
2358:			 * sure no resumes occur during removal
2359:			 */
2360:			if (!test_and_set_bit(port1, hub->child_usage_bits))
2361:				pm_runtime_get_sync(&port_dev->dev);
2362:	
2363:			typec_deattach(port_dev->connector, &udev->dev);
2364:		}
2365:	
2366:		usb_remove_ep_devs(&udev->ep0);
2367:		usb_unlock_device(udev);
2368:	
2369:		if (udev->usb4_link)
2370:			device_link_del(udev->usb4_link);
2371:	
2372:		/* Unregister the device.  The device driver is responsible
2373:		 * for de-configuring the device and invoking the remove-device
2374:		 * notifier chain (used by usbfs and possibly others).
2375:		 */
2376:		device_del(&udev->dev);
2377:	
2378:		/* Free the device number and delete the parent's children[]
2379:		 * (or root_hub) pointer.
2380:		 */
2381:		release_devnum(udev);
2382:	
2383:		/* Avoid races with recursively_mark_NOTATTACHED() */
2384:		spin_lock_irq(&device_state_lock);
2385:		*pdev = NULL;
2386:		spin_unlock_irq(&device_state_lock);
2387:	
2388:		if (port_dev && test_and_clear_bit(port1, hub->child_usage_bits))
2389:			pm_runtime_put(&port_dev->dev);
2390:	
2391:		hub_free_dev(udev);
2392:	
2393:		put_device(&udev->dev);
2394:	}
 SourceFile:drivers/usb/core/hub.c]

gemini-3-pro-preview

							input: 39955
							output: 63
							thoughts: 448
						

**Debugging a USB Disconnect Hang**

Okay, let's see. `usb_disconnect` is calling `usb_lock_device(udev)` on line 2336. Then it calls `usb_disable_device(udev, 0)`, which ultimately leads to `device_del(&interface->dev)`. So, Task 1, the one dealing with the disconnect, is holding `device_lock(&udev->dev)`, which is the same lock `usb_lock_device(udev)` provides. Meanwhile, Task 2 is in `usbdev_do_ioctl`, specifically at line 2611, and it *also* calls `usb_lock_device(dev)`. That means Task 2 is blocked, waiting for `device_lock(&udev->dev)`.

But why is Task 1 hanging? Task 1 is stuck in `i2c_del_adapter`, waiting for `adap->dev_released`. This completion happens when `adap->dev`'s reference count drops to zero. Hmm, who’s holding a reference to `adap->dev`? Could it be Task 2?

Task 2 is in `usbdev_do_ioctl`. Okay, so `usbdev_do_ioctl` is called through a file descriptor. Does the file descriptor itself hold a reference to `adap->dev`? No, no, it holds a reference to `usb_dev_state`, which then holds a reference to the `usb_device` itself. However, if Task 2 is executing `usbdev_do_ioctl`, then it's *holding* a reference to the `usb_device` or something similar, right?

But `i2c_del_adapter` is still waiting for `adap->dev_released`. We need to figure out who's holding the reference to `adap->dev`. Let's dig into `pvr2_i2c_core_done`... The I2C adapter is registered by `pvr2_i2c_core_init`. Time to go check `pvr2_i2c_core_init` in `drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c`. Let's see if we can find something there.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c IncludeLines:true Name:pvr2_i2c_core_init]

map[SourceCode: 591:	void pvr2_i2c_core_init(struct pvr2_hdw *hdw)
 592:	{
 593:		unsigned int idx;
 594:	
 595:		/* The default action for all possible I2C addresses is just to do
 596:		   the transfer normally. */
 597:		for (idx = 0; idx < PVR2_I2C_FUNC_CNT; idx++) {
 598:			hdw->i2c_func[idx] = pvr2_i2c_basic_op;
 599:		}
 600:	
 601:		/* However, deal with various special cases for 24xxx hardware. */
 602:		if (ir_mode[hdw->unit_number] == 0) {
 603:			pr_info("%s: IR disabled\n", hdw->name);
 604:			hdw->i2c_func[0x18] = i2c_black_hole;
 605:		} else if (ir_mode[hdw->unit_number] == 1) {
 606:			if (hdw->ir_scheme_active == PVR2_IR_SCHEME_24XXX) {
 607:				/* Set up translation so that our IR looks like a
 608:				   29xxx device */
 609:				hdw->i2c_func[0x18] = i2c_24xxx_ir;
 610:			}
 611:		}
 612:		if (hdw->hdw_desc->flag_has_cx25840) {
 613:			hdw->i2c_func[0x44] = i2c_hack_cx25840;
 614:		}
 615:		if (hdw->hdw_desc->flag_has_wm8775) {
 616:			hdw->i2c_func[0x1b] = i2c_hack_wm8775;
 617:		}
 618:	
 619:		// Configure the adapter and set up everything else related to it.
 620:		hdw->i2c_adap = pvr2_i2c_adap_template;
 621:		hdw->i2c_algo = pvr2_i2c_algo_template;
 622:		strscpy(hdw->i2c_adap.name, hdw->name, sizeof(hdw->i2c_adap.name));
 623:		hdw->i2c_adap.dev.parent = &hdw->usb_dev->dev;
 624:		hdw->i2c_adap.algo = &hdw->i2c_algo;
 625:		hdw->i2c_adap.algo_data = hdw;
 626:		hdw->i2c_linked = !0;
 627:		i2c_set_adapdata(&hdw->i2c_adap, &hdw->v4l2_dev);
 628:		i2c_add_adapter(&hdw->i2c_adap);
 629:		if (hdw->i2c_func[0x18] == i2c_24xxx_ir) {
 630:			/* Probe for a different type of IR receiver on this
 631:			   device.  This is really the only way to differentiate
 632:			   older 24xxx devices from 24xxx variants that include an
 633:			   IR blaster.  If the IR blaster is present, the IR
 634:			   receiver is part of that chip and thus we must disable
 635:			   the emulated IR receiver. */
 636:			if (do_i2c_probe(hdw, 0x71)) {
 637:				pvr2_trace(PVR2_TRACE_INFO,
 638:					   "Device has newer IR hardware; disabling unneeded virtual IR device");
 639:				hdw->i2c_func[0x18] = NULL;
 640:				/* Remember that this is a different device... */
 641:				hdw->ir_scheme_active = PVR2_IR_SCHEME_24XXX_MCE;
 642:			}
 643:		}
 644:		if (i2c_scan) do_i2c_scan(hdw);
 645:	
 646:		pvr2_i2c_register_ir(hdw);
 647:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c]

gemini-3-pro-preview

							input: 42207
							output: 63
							thoughts: 186
						

**My Analysis of I2C Adapter Unregistration**

Okay, so I'm digging into this I2C driver code. I see that the I2C adapter's device structure (`hdw->i2c_adap.dev`) has its parent set to the USB device (`&hdw->usb_dev->dev`). Makes sense, the I2C adapter is essentially a peripheral of the USB device. Now, I'm trying to understand the unregistration process when `i2c_del_adapter` gets called. Right, it unregisters the I2C adapter. Specifically, `i2c_del_adapter` calls `device_unregister(&adap->dev)`.

`device_unregister`... that rings a bell. It ultimately calls `device_del` and then `put_device`. Aha, that’s where things can get interesting. If there are outstanding references to `adap->dev` – in other words, if some other part of the system is still using or pointing to the I2C adapter device – then `device_unregister` won't immediately release the device. It will block, waiting on `wait_for_completion(&adap->dev_released)`.

So, the key question is, *who* might be holding a reference? I need to track down any potential device users. Let's see... a likely candidate would be any driver function that registered a resource. Specifically, I'm thinking about the function `pvr2_i2c_register_ir(hdw)`. That looks like a good place to start. I'll check that one.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c IncludeLines:true Name:pvr2_i2c_register_ir]

map[SourceCode: 543:	static void pvr2_i2c_register_ir(struct pvr2_hdw *hdw)
 544:	{
 545:		struct i2c_board_info info;
 546:		struct IR_i2c_init_data *init_data = &hdw->ir_init_data;
 547:		if (pvr2_disable_ir_video) {
 548:			pvr2_trace(PVR2_TRACE_INFO,
 549:				   "Automatic binding of ir_video has been disabled.");
 550:			return;
 551:		}
 552:		memset(&info, 0, sizeof(struct i2c_board_info));
 553:		switch (hdw->ir_scheme_active) {
 554:		case PVR2_IR_SCHEME_24XXX: /* FX2-controlled IR */
 555:		case PVR2_IR_SCHEME_29XXX: /* Original 29xxx device */
 556:			init_data->ir_codes              = RC_MAP_HAUPPAUGE;
 557:			init_data->internal_get_key_func = IR_KBD_GET_KEY_HAUP;
 558:			init_data->type                  = RC_PROTO_BIT_RC5;
 559:			init_data->name                  = hdw->hdw_desc->description;
 560:			init_data->polling_interval      = 100; /* ms From ir-kbd-i2c */
 561:			/* IR Receiver */
 562:			info.addr          = 0x18;
 563:			info.platform_data = init_data;
 564:			strscpy(info.type, "ir_video", I2C_NAME_SIZE);
 565:			pvr2_trace(PVR2_TRACE_INFO, "Binding %s to i2c address 0x%02x.",
 566:				   info.type, info.addr);
 567:			i2c_new_client_device(&hdw->i2c_adap, &info);
 568:			break;
 569:		case PVR2_IR_SCHEME_ZILOG:     /* HVR-1950 style */
 570:		case PVR2_IR_SCHEME_24XXX_MCE: /* 24xxx MCE device */
 571:			init_data->ir_codes = RC_MAP_HAUPPAUGE;
 572:			init_data->internal_get_key_func = IR_KBD_GET_KEY_HAUP_XVR;
 573:			init_data->type = RC_PROTO_BIT_RC5 | RC_PROTO_BIT_RC6_MCE |
 574:								RC_PROTO_BIT_RC6_6A_32;
 575:			init_data->name = hdw->hdw_desc->description;
 576:			/* IR Transceiver */
 577:			info.addr = 0x71;
 578:			info.platform_data = init_data;
 579:			strscpy(info.type, "ir_z8f0811_haup", I2C_NAME_SIZE);
 580:			pvr2_trace(PVR2_TRACE_INFO, "Binding %s to i2c address 0x%02x.",
 581:				   info.type, info.addr);
 582:			i2c_new_client_device(&hdw->i2c_adap, &info);
 583:			break;
 584:		default:
 585:			/* The device either doesn't support I2C-based IR or we
 586:			   don't know (yet) how to operate IR on the device. */
 587:			break;
 588:		}
 589:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c]

gemini-3-pro-preview

							input: 43871
							output: 48
							thoughts: 180
						

**Unraveling I2C Client Device Unregistration**

Okay, so I'm thinking about how I2C client devices get unregistered, and I need to make sure I have the process down. `i2c_new_client_device` – that's the one that spins up a new client, right? Then, when we call `i2c_del_adapter`, everything connected to that adapter gets cleaned up, which looks like it unregisters all the client devices. Specifically, I see this `device_for_each_child` call with `__unregister_client`.

So, `__unregister_client` then triggers `i2c_unregister_device`.  `i2c_unregister_device`, in turn, unregisters the device with `device_unregister`. This calls `device_del` and `put_device`, which is where the memory for the client goes. The crucial thing is that when the client device is unregistered, the reference count drops.

But, a red flag! What if a driver is in the middle of unbinding from the client device and the `remove` function is currently waiting on something? What happens when the reference count drops before it completes? I'd better double-check `__unregister_client` within `drivers/i2c/i2c-core-base.c`. I need to ensure there are no race conditions or unexpected side effects during this unregistration process, particularly when drivers are involved.

map[ContextFile:drivers/i2c/i2c-core-base.c IncludeLines:true Name:__unregister_client]

map[SourceCode:1726:	static int __unregister_client(struct device *dev, void *dummy)
1727:	{
1728:		struct i2c_client *client = i2c_verify_client(dev);
1729:		if (client && strcmp(client->name, "dummy"))
1730:			i2c_unregister_device(client);
1731:		return 0;
1732:	}
 SourceFile:drivers/i2c/i2c-core-base.c]

gemini-3-pro-preview

							input: 44559
							output: 50
							thoughts: 690
						

**Unraveling an I2C Adapter Unregistration Conundrum**

Okay, so I'm diving into this `i2c_unregister_device` function, and it's calling `device_unregister` which in turn calls `device_del`. Pretty standard so far. `device_del` then calls `bus_remove_device`, and *that* calls `device_release_driver_internal`. Now, I need to focus on this `device_release_driver_internal` function because it acquires `device_lock` on the client's device, but hang on a minute... am I going to be blocked?

No, the `device_lock` is specifically on the I2C client device. But that gets me thinking... what if the I2C client device's `remove` function tries to access, or even more critically, lock the USB device? That's a potential deadlock situation I need to consider. I should really check the stack trace again to confirm my suspicions and not jump to conclusions.

The stack trace reveals something interesting. It looks like we're waiting for `adap->dev_released`. This means `device_unregister(&adap->dev)` has returned, but `adap->dev`'s reference count isn't zero. That's a problem.

Alright, if `device_unregister` has completed, it means someone else is holding a reference to this `adap->dev`. If the reference count is not zero, then someone else has called `get_device(&adap->dev)`. The creation of a client device calls `get_device(&adap->dev)`, because that parent is `adap->dev`.

So, the adapter holds a reference to the client when the client is created. And when the client is unregistered, its `release` function calls `put_device` on its parent, which is the adapter. If the reference count is not zero for the client device, then `adap->dev`'s reference count will not be zero, I can see that.

But, who's holding onto the client device? Could it be that the client device isn't fully released? Time to look for other children of `adap->dev`.

Ah, but wait... `i2c_del_adapter` *does* call `device_for_each_child(&adap->dev, NULL, __unregister_client)`. It looks like it should unregister everything under the adapter. But what if a client device is open by user space? User space holds a reference, doesn't it? Like, if it's an input device, or an I2C dev node.

That's when it hits me. I2C dev! The i2c-dev driver creates a character device for *each* I2C adapter. The character device is a child of `adap->dev`! That's the likely culprit for the lingering reference. I need to dig into `i2c-dev.c` now to figure out how to make this work.

map[ContextFile:drivers/i2c/i2c-dev.c IncludeLines:true Name:i2cdev_attach_adapter]

map[SourceCode: 664:	static int i2cdev_attach_adapter(struct device *dev)
 665:	{
 666:		struct i2c_adapter *adap;
 667:		struct i2c_dev *i2c_dev;
 668:		int res;
 669:	
 670:		if (dev->type != &i2c_adapter_type)
 671:			return NOTIFY_DONE;
 672:		adap = to_i2c_adapter(dev);
 673:	
 674:		i2c_dev = get_free_i2c_dev(adap);
 675:		if (IS_ERR(i2c_dev))
 676:			return NOTIFY_DONE;
 677:	
 678:		cdev_init(&i2c_dev->cdev, &i2cdev_fops);
 679:		i2c_dev->cdev.owner = THIS_MODULE;
 680:	
 681:		device_initialize(&i2c_dev->dev);
 682:		i2c_dev->dev.devt = MKDEV(I2C_MAJOR, adap->nr);
 683:		i2c_dev->dev.class = &i2c_dev_class;
 684:		i2c_dev->dev.parent = &adap->dev;
 685:		i2c_dev->dev.release = i2cdev_dev_release;
 686:	
 687:		res = dev_set_name(&i2c_dev->dev, "i2c-%d", adap->nr);
 688:		if (res)
 689:			goto err_put_i2c_dev;
 690:	
 691:		res = cdev_device_add(&i2c_dev->cdev, &i2c_dev->dev);
 692:		if (res)
 693:			goto err_put_i2c_dev;
 694:	
 695:		pr_debug("adapter [%s] registered as minor %d\n", adap->name, adap->nr);
 696:		return NOTIFY_OK;
 697:	
 698:	err_put_i2c_dev:
 699:		put_i2c_dev(i2c_dev, false);
 700:		return NOTIFY_DONE;
 701:	}
 SourceFile:drivers/i2c/i2c-dev.c]

gemini-3-pro-preview

							input: 46625
							output: 50
							thoughts: 182
						

**Understanding the I2C Device Removal Process**

Okay, so I'm diving into how the `i2c-dev` character device interacts with adapter removal. First, I see this line: `i2c_dev->dev.parent = &adap->dev;` - right, the `i2c-dev` device is essentially a child of the I2C adapter's device, `adap->dev`. This makes sense conceptually.

Now, when an adapter is being removed – triggered by `i2c_del_adapter` – it's calling `bus_for_each_drv(&i2c_bus_type, NULL, adap, __process_removed_adapter);`. But wait a minute... `i2c-dev` isn't an *I2C bus driver*! It's a class driver, right? So how does the `i2c-dev` driver even get notified about the adapter's demise? This feels like there's some kind of indirect mechanism at play.

Aha! It registers a notifier! Specifically, `i2cdev_notifier` is registered on the `i2c_adapter_type`. That's the key. That's how it's getting its update. Now, I need to see *how* that notifier is used. I'll need to check out the `i2cdev_notifier_call` function in `drivers/i2c/i2c-dev.c` to see how it handles the adapter removal event. This should clarify the whole process.

map[ContextFile:drivers/i2c/i2c-dev.c IncludeLines:true Name:i2cdev_notifier_call]

map[SourceCode: 722:	static int i2cdev_notifier_call(struct notifier_block *nb, unsigned long action,
 723:				 void *data)
 724:	{
 725:		struct device *dev = data;
 726:	
 727:		switch (action) {
 728:		case BUS_NOTIFY_ADD_DEVICE:
 729:			return i2cdev_attach_adapter(dev);
 730:		case BUS_NOTIFY_DEL_DEVICE:
 731:			return i2cdev_detach_adapter(dev);
 732:		}
 733:	
 734:		return NOTIFY_DONE;
 735:	}
 SourceFile:drivers/i2c/i2c-dev.c]

gemini-3-pro-preview

							input: 47417
							output: 50
							thoughts: 90
						

**My Analysis of I2C Device Removal**

Okay, so I'm tracing the device removal process here. It looks like `i2cdev_detach_adapter` gets invoked when the `BUS_NOTIFY_DEL_DEVICE` event fires.  My mental model tells me that `BUS_NOTIFY_DEL_DEVICE` is emitted from within `device_del(&adap->dev)`. Therefore, the call to `i2cdev_detach_adapter` is happening *during* the execution of `device_del` for an I2C adapter.  I need to understand what's happening within `i2cdev_detach_adapter` to truly grok the device removal sequence. I should probably dive into the code for that function next to see the exact steps it performs.

map[ContextFile:drivers/i2c/i2c-dev.c IncludeLines:true Name:i2cdev_detach_adapter]

map[SourceCode: 703:	static int i2cdev_detach_adapter(struct device *dev)
 704:	{
 705:		struct i2c_adapter *adap;
 706:		struct i2c_dev *i2c_dev;
 707:	
 708:		if (dev->type != &i2c_adapter_type)
 709:			return NOTIFY_DONE;
 710:		adap = to_i2c_adapter(dev);
 711:	
 712:		i2c_dev = i2c_dev_get_by_minor(adap->nr);
 713:		if (!i2c_dev) /* attach_adapter must have failed */
 714:			return NOTIFY_DONE;
 715:	
 716:		put_i2c_dev(i2c_dev, true);
 717:	
 718:		pr_debug("adapter [%s] unregistered\n", adap->name);
 719:		return NOTIFY_OK;
 720:	}
 SourceFile:drivers/i2c/i2c-dev.c]

gemini-3-pro-preview

							input: 48043
							output: 49
							thoughts: 1092
						

**Analyzing the I2C Adapter Deletion Deadlock**

Okay, let's break this down. It seems we have a deadlock issue when deleting an I2C adapter. The core problem appears to be a reference counting issue that prevents the adapter from being fully removed.

My initial thoughts were around `cdev_device_del`, `device_del`, and how the I2C character device release is handled. It seemed like if a user-space process had the character device open, `i2c_dev->dev`'s reference count wouldn't be zero. Since the adapter device is the parent, its reference count would also be non-zero, potentially blocking the adapter deletion in `i2c_del_adapter` and waiting on `adap->dev_released`. That's where I initially thought the issue was.

Then I reviewed the bug report. Task 2 is stuck in `usbdev_do_ioctl` waiting for `device_lock`, while Task 1 is in `i2c_del_adapter` waiting for `adap->dev_released`.  The fact that Task 1 is waiting on `adap->dev_released` tells me someone *else* is holding a reference to `adap->dev`.

I initially considered Task 2 as the culprit, because it's running `usbdev_do_ioctl`, but quickly dismissed that idea. `usbdev_do_ioctl` works on the USB device file, not the I2C character device. The stack trace confirms this as well. It showed that Task 2 is executing an ioctl on the USB device, so it isn't holding any direct references to the I2C adapter.

The question then shifted to *who* might be holding that reference. Could `usbdev_do_ioctl` be indirectly holding a reference, maybe via a lock? No, that's not it. It's just *waiting* for `device_lock(&dev->dev)`.  However, that's a key clue. If Task 2 is waiting for `device_lock`, it means Task 1 *already* holds that lock.

Wait... Task 1 is running `usb_disconnect`, which itself holds the `device_lock`. So, we have a mutual lock situation. Task 2 is blocked because of Task 1 holding the device lock, and Task 1 is blocked because the adapter device is still in use somehow.  But how?

So, who is holding on to the adapter device? Could there be a circular dependency, a hidden reference somewhere? Let's trace back. `i2c_del_adapter` is waiting for `adap->dev_released`, which is the adapter's device object.

When I looked at what was happening in `i2c_del_adapter`, it calls `device_for_each_child`, which unregisters all the child I2C client devices. This involves the I2C drivers. I need to understand what happens to these I2C client devices during unregistration, especially `ir_video`, or `ir_z8f0811_haup`. These client devices are drivers.

Now, my thoughts turn to the `remove` functions of those I2C drivers. It looks like the issue may lie with `drivers/media/i2c/ir-kbd-i2c.c`, which handles the `ir_video` driver. It must be that somewhere in there, a reference is being held, maybe due to an incomplete cleanup or resource release during the driver's `remove` function.  I need to investigate the interaction between `ir-kbd-i2c.c` and the USB device. It's possible the driver is still trying to access the I2C adapter or related resources when the adapter is already being deleted, resulting in the deadlock.

requested entity does not exist

map[ContextFile:drivers/media/i2c/ir-kbd-i2c.c IncludeLines:true Name:ir_probe]

map[SourceCode: SourceFile:]

gemini-3-pro-preview

							input: 50017
							output: 36
							thoughts: 29
						

Here's my thought process, as if I were considering this myself:

**Investigating the IR Keyboard Driver Removal**

Okay, so I need to understand the removal process for the `ir-kbd-i2c.c` driver. The obvious first step is to dive right into the code and examine the `remove` function. That's where the cleanup logic should reside. I'll need to see how the driver gracefully detaches from the I2C bus and releases any allocated resources, like memory or interrupt handlers, during module unload or device removal. I'm assuming it uses the standard I2C driver model, but I'll confirm that in the code. I'll be looking for potential issues like dangling pointers, resource leaks, or improper sequence of operations. This is where I'll get the meat of how the driver shuts down, and where I can start troubleshooting any removal-related issues.

map[SourceFile:drivers/media/i2c/ir-kbd-i2c.c]

map[Entities:<nil>]

gemini-3-pro-preview

							input: 50288
							output: 19
							thoughts: 38
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person:

**Navigating the Driver Landscape**

Hang on a minute... I was expecting to find `ir-kbd-i2c.c` nestled comfortably within `drivers/media/i2c/`. That doesn't seem right. Okay, okay, let's recalibrate. If it's not where I'd initially anticipate it to be, then the naming convention is potentially different than I assumed. Let's try a broader search. I'll pivot and look for anything that includes `ir_video`. Perhaps the naming scheme is more encompassing than the specific keybd usage I was anticipating. Let's see what turns up.

map[Expression:"ir_video"]

map[Output:drivers/media/i2c/ir-kbd-i2c.c=977=static const struct i2c_device_id ir_kbd_id[] = {
drivers/media/i2c/ir-kbd-i2c.c-978-	/* Generic entry for any IR receiver */
drivers/media/i2c/ir-kbd-i2c.c:979:	{ "ir_video", 0 },
drivers/media/i2c/ir-kbd-i2c.c-980-	/* IR device specific entries should be added here */
--
drivers/media/pci/bt8xx/bttv-input.c=362=void init_bttv_i2c_ir(struct bttv *btv)
--
drivers/media/pci/bt8xx/bttv-input.c-375-	memset(&btv->init_data, 0, sizeof(btv->init_data));
drivers/media/pci/bt8xx/bttv-input.c:376:	strscpy(info.type, "ir_video", I2C_NAME_SIZE);
drivers/media/pci/bt8xx/bttv-input.c-377-
--
drivers/media/pci/cx23885/cx23885-i2c.c=299=int cx23885_i2c_register(struct cx23885_i2c *bus)
--
drivers/media/pci/cx23885/cx23885-i2c.c-336-		memset(&info, 0, sizeof(struct i2c_board_info));
drivers/media/pci/cx23885/cx23885-i2c.c:337:		strscpy(info.type, "ir_video", I2C_NAME_SIZE);
drivers/media/pci/cx23885/cx23885-i2c.c-338-		/* Use quick read command for probe, some IR chips don't
--
drivers/media/pci/cx88/cx88-input.c=584=void cx88_i2c_init_ir(struct cx88_core *core)
--
drivers/media/pci/cx88/cx88-input.c-601-	memset(&info, 0, sizeof(struct i2c_board_info));
drivers/media/pci/cx88/cx88-input.c:602:	strscpy(info.type, "ir_video", I2C_NAME_SIZE);
drivers/media/pci/cx88/cx88-input.c-603-
--
drivers/media/pci/ivtv/ivtv-i2c.c=113=static const char * const hw_devicenames[IVTV_HW_MAX_BITS] = {
--
drivers/media/pci/ivtv/ivtv-i2c.c-129-	"gpio",
drivers/media/pci/ivtv/ivtv-i2c.c:130:	"ir_video",		/* IVTV_HW_I2C_IR_RX_AVER */
drivers/media/pci/ivtv/ivtv-i2c.c:131:	"ir_video",		/* IVTV_HW_I2C_IR_RX_HAUP_EXT */
drivers/media/pci/ivtv/ivtv-i2c.c:132:	"ir_video",		/* IVTV_HW_I2C_IR_RX_HAUP_INT */
drivers/media/pci/ivtv/ivtv-i2c.c-133-	"ir_z8f0811_haup",	/* IVTV_HW_Z8F0811_IR_HAUP */
drivers/media/pci/ivtv/ivtv-i2c.c:134:	"ir_video",		/* IVTV_HW_I2C_IR_RX_ADAPTEC */
drivers/media/pci/ivtv/ivtv-i2c.c-135-};
--
drivers/media/pci/ivtv/ivtv-i2c.c=216=void ivtv_i2c_new_ir_legacy(struct ivtv *itv)
--
drivers/media/pci/ivtv/ivtv-i2c.c-236-	memset(&info, 0, sizeof(struct i2c_board_info));
drivers/media/pci/ivtv/ivtv-i2c.c:237:	strscpy(info.type, "ir_video", I2C_NAME_SIZE);
drivers/media/pci/ivtv/ivtv-i2c.c-238-	i2c_new_scanned_device(&itv->i2c_adap, &info, addr_list, NULL);
--
drivers/media/pci/saa7134/saa7134-input.c=841=void saa7134_probe_i2c_ir(struct saa7134_dev *dev)
--
drivers/media/pci/saa7134/saa7134-input.c-858-	memset(&dev->init_data, 0, sizeof(dev->init_data));
drivers/media/pci/saa7134/saa7134-input.c:859:	strscpy(info.type, "ir_video", I2C_NAME_SIZE);
drivers/media/pci/saa7134/saa7134-input.c-860-
--
drivers/media/usb/cx231xx/cx231xx-input.c=49=int cx231xx_ir_init(struct cx231xx *dev)
--
drivers/media/usb/cx231xx/cx231xx-input.c-69-
drivers/media/usb/cx231xx/cx231xx-input.c:70:	strscpy(info.type, "ir_video", I2C_NAME_SIZE);
drivers/media/usb/cx231xx/cx231xx-input.c-71-	info.platform_data = &dev->init_data;
--
drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c=543=static void pvr2_i2c_register_ir(struct pvr2_hdw *hdw)
--
drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c-563-		info.platform_data = init_data;
drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c:564:		strscpy(info.type, "ir_video", I2C_NAME_SIZE);
drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c-565-		pvr2_trace(PVR2_TRACE_INFO, "Binding %s to i2c address 0x%02x.",
]

gemini-3-pro-preview

							input: 52307
							output: 49
							thoughts: 61
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing the IR Keyboard I2C Driver**

Right, so I need to dig into the IR keyboard driver, and it looks like it's tucked away in `drivers/media/i2c/ir-kbd-i2c.c`. My immediate focus will be on the probe and remove functions – that's `ir_probe` and `ir_remove`, respectively. These are the critical entry and exit points for the driver, and understanding them will give me the best overview of how this thing gets instantiated and torn down within the I2C framework. I'll be looking for things like resource allocation, I2C adapter registration, interrupt handling (if any), and how it interacts with the media framework. Gotta see how the device is initialized and cleaned up properly to ensure it plays nicely with the system.

requested entity does not exist

map[ContextFile:drivers/media/i2c/ir-kbd-i2c.c IncludeLines:true Name:ir_remove]

map[SourceCode: SourceFile:]

gemini-3-pro-preview

							input: 52627
							output: 51
							thoughts: 31
						

Okay, let's dive into this. Here's how I'd approach this task, as if these were my internal thoughts:

**Investigating `ir-kbd-i2c.c`**

Alright, I need to understand what's going on with this driver, specifically around the `ir_kbd_id` variable. My first step is to zero in on the relevant code. So, I'll navigate to `drivers/media/i2c/ir-kbd-i2c.c`. That's where I expect to find the implementation for the i2c-based infrared keyboard driver, and, hopefully, the definition and usage of that `ir_kbd_id` variable. From there, I'll be able to quickly see how it's used, initialized, and what purpose it serves within the driver's logic. This should give me a solid foundation for whatever the next question is.

requested entity does not exist

map[ContextFile:drivers/media/i2c/ir-kbd-i2c.c IncludeLines:true Name:ir_kbd_id]

map[SourceCode: SourceFile:]

gemini-3-pro-preview

							input: 52926
							output: 24
							thoughts: 27
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Troubleshooting a Potential Keyboard Driver Issue**

Hmm, so `ir_kbd_id`...that's a variable, not a driver module itself. My immediate instinct is to look upstream and see where that variable is *being* set and used. That means digging into the relevant drivers. I need to figure out where the keypress information is coming from.

Since we're dealing with an IR keyboard, my first target for investigation is likely `ir_kbd_driver` or something along those lines. I’m thinking there might be an issue in the assignment, configuration or initialization of that driver, or maybe some type of variable conflict. I need to trace this back to the source.

map[Expression:struct i2c_driver.*ir_kbd]

map[Output:drivers/media/i2c/ir-kbd-i2c.c=985=MODULE_DEVICE_TABLE(i2c, ir_kbd_id);
drivers/media/i2c/ir-kbd-i2c.c-986-
drivers/media/i2c/ir-kbd-i2c.c:987:static struct i2c_driver ir_kbd_driver = {
drivers/media/i2c/ir-kbd-i2c.c-988-	.driver = {
]

gemini-3-pro-preview

							input: 53279
							output: 51
							thoughts: 11
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Initial Assessment: Diving into `ir_kbd_driver`**

Alright, time to dig into this. "Let's check `ir_kbd_driver`." That's the starting point. It implies a few things right off the bat. First, we're likely dealing with an infrared keyboard driver, as the name suggests. Second, something's triggered this investigation. Maybe a bug report, a performance issue, or perhaps just a general review for optimization or integration. Given my background, I'm already mentally running through potential areas of interest within that module. We could be looking at interrupt handling, the interaction with the infrared receiver hardware, key mapping, input event processing, power management… the possibilities are pretty broad, but the specific mention of `ir_kbd_driver` immediately focuses the scope. I'm already formulating a mental checklist of key areas to scrutinize: error handling, resource allocation, and any potential race conditions that might be present. We'll get to the details.

requested entity does not exist

map[ContextFile:drivers/media/i2c/ir-kbd-i2c.c IncludeLines:true Name:ir_kbd_driver]

map[SourceCode: SourceFile:]

gemini-3-pro-preview

							input: 53596
							output: 19
							thoughts: 42
						

Here's my take on the thought process:

**Diving into the `ir_kbd_driver` Mystery**

Okay, so I'm trying to get a handle on this `ir_kbd_driver`, and it's flagged as static. Right, that immediately raises a flag for me. I need to understand its scope and usage within the kernel, so I'm going to jump straight to the source. Specifically, I need to check out `drivers/media/i2c/ir-kbd-i2c.c`, and I'll zero in around line 987. That's a decent starting point to see how this static driver is declared, initialized, and potentially referenced within that file and the surrounding context. Let's see what's going on there.

map[Expression:ir_kbd_driver]

map[Output:drivers/media/i2c/ir-kbd-i2c.c=985=MODULE_DEVICE_TABLE(i2c, ir_kbd_id);
drivers/media/i2c/ir-kbd-i2c.c-986-
drivers/media/i2c/ir-kbd-i2c.c:987:static struct i2c_driver ir_kbd_driver = {
drivers/media/i2c/ir-kbd-i2c.c-988-	.driver = {
--
drivers/media/i2c/ir-kbd-i2c.c-995-
drivers/media/i2c/ir-kbd-i2c.c:996:module_i2c_driver(ir_kbd_driver);
drivers/media/i2c/ir-kbd-i2c.c-997-
]

gemini-3-pro-preview

							input: 54049
							output: 19
							thoughts: 35
						

Okay, let's dive into this. Here's my take on those lines of code, presented as if they were my own immediate thoughts:

**Analyzing `drivers/media/i2c/ir-kbd-i2c.c` from Lines 980-1000**

Alright, time to focus. I'm going to zero in on lines 980 to 1000 in `drivers/media/i2c/ir-kbd-i2c.c`. Based on the file name, this is likely related to handling input from an infrared keyboard over an I2C interface. I expect we'll see some low-level I2C communication code here. I'm probably looking at how the driver actually *reads* data from the I2C device – maybe the interrupt handler that's triggered when a keypress is detected, or the function responsible for polling the device if interrupt-driven operation isn't used. I need to understand the data format the driver expects to receive over I2C – are we talking about raw button codes, maybe something encoded, or possibly something more abstract? I hope it's well-documented because the details of the device-specific protocol are always key. I need to ascertain the approach to debouncing and error handling, especially if the underlying I2C communication is potentially unreliable. Let's see if there's any cleverness in the approach; efficient memory usage, maybe. Now, let's see what's really happening.

map[Expression:ir_kbd_driver]

map[Output:drivers/media/i2c/ir-kbd-i2c.c=985=MODULE_DEVICE_TABLE(i2c, ir_kbd_id);
drivers/media/i2c/ir-kbd-i2c.c-986-
drivers/media/i2c/ir-kbd-i2c.c:987:static struct i2c_driver ir_kbd_driver = {
drivers/media/i2c/ir-kbd-i2c.c-988-	.driver = {
--
drivers/media/i2c/ir-kbd-i2c.c-995-
drivers/media/i2c/ir-kbd-i2c.c:996:module_i2c_driver(ir_kbd_driver);
drivers/media/i2c/ir-kbd-i2c.c-997-
]

gemini-3-pro-preview

							input: 54647
							output: 32
							thoughts: 29
						

Okay, here's my interpretation of that thought process, assuming I'm the expert and considering how I'd approach this task:

**Analyzing the File and Considering the Best Approach**

Alright, I see the task. We're looking at `drivers/media/i2c/ir-kbd-i2c.c`. The goal seems to be to figure out the best way to handle this file. My initial thought is to reach for a foundational tool here, and `read-file` definitely fits the bill. It's the simplest and most direct method for inspecting the contents of that file. It gives me a raw view of the code, which is exactly what I need to start. From there, I can decide how to best get the information needed.

map[File:drivers/media/i2c/ir-kbd-i2c.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *
 * keyboard input driver for i2c IR remote controls
 *
 * Copyright (c) 2000-2003 Gerd Knorr <kraxel@bytesex.org>
 * modified for PixelView (BT878P+W/FM) by
 *      Michal Kochanowicz <mkochano@pld.org.pl>
 *      Christoph Bartelmus <lirc@bartelmus.de>
 * modified for KNC ONE TV Station/Anubis Typhoon TView Tuner by
 *      Ulrich Mueller <ulrich.mueller42@web.de>
 * modified for em2820 based USB TV tuners by
 *      Markus Rechberger <mrechberger@gmail.com>
 * modified for DViCO Fusion HDTV 5 RT GOLD by
 *      Chaogui Zhang <czhang1974@gmail.com>
 * modified for MSI TV@nywhere Plus by
 *      Henry Wong <henry@stuffedcow.net>
 *      Mark Schultz <n9xmj@yahoo.com>
 *      Brian Rogers <brian_rogers@comcast.net>
 * modified for AVerMedia Cardbus by
 *      Oldrich Jedlicka <oldium.pro@seznam.cz>
 * Zilog Transmitter portions/ideas were derived from GPLv2+ sources:
 *  - drivers/char/pctv_zilogir.[ch] from Hauppauge Broadway product
 *	Copyright 2011 Hauppauge Computer works
 *  - drivers/staging/media/lirc/lirc_zilog.c
 *	Copyright (c) 2000 Gerd Knorr <kraxel@goldbach.in-berlin.de>
 *	Michal Kochanowicz <mkochano@pld.org.pl>
 *	Christoph Bartelmus <lirc@bartelmus.de>
 *	Ulrich Mueller <ulrich.mueller42@web.de>
 *	Stefan Jahn <stefan@lkcc.org>
 *	Jerome Brock <jbrock@users.sourceforge.net>
 *	Thomas Reitmayr (treitmayr@yahoo.com)
 *	Mark Weaver <mark@npsl.co.uk>
 *	Jarod Wilson <jarod@redhat.com>
 *	Copyright (C) 2011 Andy Walls <awalls@md.metrocast.net>
 */

#include <linux/unaligned.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/string.h>
#include <linux/timer.h>
#include <linux/delay.h>
#include <linux/errno.h>
#include <linux/slab.h>
#include <linux/i2c.h>
#include <linux/workqueue.h>

#include <media/rc-core.h>
#include <media/i2c/ir-kbd-i2c.h>

#define FLAG_TX		1
#define FLAG_HDPVR	2

static bool enable_hdpvr;
module_param(enable_hdpvr, bool, 0644);

static int get_key_haup_common(struct IR_i2c *ir, enum rc_proto *protocol,
			       u32 *scancode, u8 *ptoggle, int size)
{
	unsigned char buf[6];
	int start, range, toggle, dev, code, ircode, vendor;

	/* poll IR chip */
	if (size != i2c_master_recv(ir->c, buf, size))
		return -EIO;

	if (buf[0] & 0x80) {
		int offset = (size == 6) ? 3 : 0;

		/* split rc5 data block ... */
		start  = (buf[offset] >> 7) &    1;
		range  = (buf[offset] >> 6) &    1;
		toggle = (buf[offset] >> 5) &    1;
		dev    =  buf[offset]       & 0x1f;
		code   = (buf[offset+1] >> 2) & 0x3f;

		/* rc5 has two start bits
		 * the first bit must be one
		 * the second bit defines the command range:
		 * 1 = 0-63, 0 = 64 - 127
		 */
		if (!start)
			/* no key pressed */
			return 0;

		/* filter out invalid key presses */
		ircode = (start << 12) | (toggle << 11) | (dev << 6) | code;
		if ((ircode & 0x1fff) == 0x1fff)
			return 0;

		if (!range)
			code += 64;

		dev_dbg(&ir->rc->dev,
			"ir hauppauge (rc5): s%d r%d t%d dev=%d code=%d\n",
			start, range, toggle, dev, code);

		*protocol = RC_PROTO_RC5;
		*scancode = RC_SCANCODE_RC5(dev, code);
		*ptoggle = toggle;

		return 1;
	} else if (size == 6 && (buf[0] & 0x40)) {
		code = buf[4];
		dev = buf[3];
		vendor = get_unaligned_be16(buf + 1);

		if (vendor == 0x800f) {
			*ptoggle = (dev & 0x80) != 0;
			*protocol = RC_PROTO_RC6_MCE;
			dev &= 0x7f;
			dev_dbg(&ir->rc->dev,
				"ir hauppauge (rc6-mce): t%d vendor=%d dev=%d code=%d\n",
				*ptoggle, vendor, dev, code);
		} else {
			*ptoggle = 0;
			*protocol = RC_PROTO_RC6_6A_32;
			dev_dbg(&ir->rc->dev,
				"ir hauppauge (rc6-6a-32): vendor=%d dev=%d code=%d\n",
				vendor, dev, code);
		}

		*scancode = RC_SCANCODE_RC6_6A(vendor, dev, code);

		return 1;
	}

	return 0;
}

static int get_key_haup(struct IR_i2c *ir, enum rc_proto *protocol,
			u32 *scancode, u8 *toggle)
{
	return get_key_haup_common(ir, protocol, scancode, toggle, 3);
}

static int get_key_haup_xvr(struct IR_i2c *ir, enum rc_proto *protocol,
			    u32 *scancode, u8 *toggle)
{
	int ret;
	unsigned char buf[1] = { 0 };

	/*
	 * This is the same apparent "are you ready?" poll command observed
	 * watching Windows driver traffic and implemented in lirc_zilog. With
	 * this added, we get far saner remote behavior with z8 chips on usb
	 * connected devices, even with the default polling interval of 100ms.
	 */
	ret = i2c_master_send(ir->c, buf, 1);
	if (ret != 1)
		return (ret < 0) ? ret : -EINVAL;

	return get_key_haup_common(ir, protocol, scancode, toggle, 6);
}

static int get_key_pixelview(struct IR_i2c *ir, enum rc_proto *protocol,
			     u32 *scancode, u8 *toggle)
{
	int rc;
	unsigned char b;

	/* poll IR chip */
	rc = i2c_master_recv(ir->c, &b, 1);
	if (rc != 1) {
		dev_dbg(&ir->rc->dev, "read error\n");
		if (rc < 0)
			return rc;
		return -EIO;
	}

	*protocol = RC_PROTO_OTHER;
	*scancode = b;
	*toggle = 0;
	return 1;
}

static int get_key_fusionhdtv(struct IR_i2c *ir, enum rc_proto *protocol,
			      u32 *scancode, u8 *toggle)
{
	int rc;
	unsigned char buf[4];

	/* poll IR chip */
	rc = i2c_master_recv(ir->c, buf, 4);
	if (rc != 4) {
		dev_dbg(&ir->rc->dev, "read error\n");
		if (rc < 0)
			return rc;
		return -EIO;
	}

	if (buf[0] != 0 || buf[1] != 0 || buf[2] != 0 || buf[3] != 0)
		dev_dbg(&ir->rc->dev, "%s: %*ph\n", __func__, 4, buf);

	/* no key pressed or signal from other ir remote */
	if(buf[0] != 0x1 ||  buf[1] != 0xfe)
		return 0;

	*protocol = RC_PROTO_UNKNOWN;
	*scancode = buf[2];
	*toggle = 0;
	return 1;
}

static int get_key_knc1(struct IR_i2c *ir, enum rc_proto *protocol,
			u32 *scancode, u8 *toggle)
{
	int rc;
	unsigned char b;

	/* poll IR chip */
	rc = i2c_master_recv(ir->c, &b, 1);
	if (rc != 1) {
		dev_dbg(&ir->rc->dev, "read error\n");
		if (rc < 0)
			return rc;
		return -EIO;
	}

	/* it seems that 0xFE indicates that a button is still hold
	   down, while 0xff indicates that no button is hold
	   down. 0xfe sequences are sometimes interrupted by 0xFF */

	dev_dbg(&ir->rc->dev, "key %02x\n", b);

	if (b == 0xff)
		return 0;

	if (b == 0xfe)
		/* keep old data */
		return 1;

	*protocol = RC_PROTO_UNKNOWN;
	*scancode = b;
	*toggle = 0;
	return 1;
}

static int get_key_geniatech(struct IR_i2c *ir, enum rc_proto *protocol,
			     u32 *scancode, u8 *toggle)
{
	int i, rc;
	unsigned char b;

	/* poll IR chip */
	for (i = 0; i < 4; i++) {
		rc = i2c_master_recv(ir->c, &b, 1);
		if (rc == 1)
			break;
		msleep(20);
	}
	if (rc != 1) {
		dev_dbg(&ir->rc->dev, "read error\n");
		if (rc < 0)
			return rc;
		return -EIO;
	}

	/* don't repeat the key */
	if (ir->old == b)
		return 0;
	ir->old = b;

	/* decode to RC5 */
	b &= 0x7f;
	b = (b - 1) / 2;

	dev_dbg(&ir->rc->dev, "key %02x\n", b);

	*protocol = RC_PROTO_RC5;
	*scancode = b;
	*toggle = ir->old >> 7;
	return 1;
}

static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,
				     u32 *scancode, u8 *toggle)
{
	unsigned char subaddr, key, keygroup;
	struct i2c_msg msg[] = { { .addr = ir->c->addr, .flags = 0,
				   .buf = &subaddr, .len = 1},
				 { .addr = ir->c->addr, .flags = I2C_M_RD,
				  .buf = &key, .len = 1} };
	subaddr = 0x0d;
	if (2 != i2c_transfer(ir->c->adapter, msg, 2)) {
		dev_dbg(&ir->rc->dev, "read error\n");
		return -EIO;
	}

	if (key == 0xff)
		return 0;

	subaddr = 0x0b;
	msg[1].buf = &keygroup;
	if (2 != i2c_transfer(ir->c->adapter, msg, 2)) {
		dev_dbg(&ir->rc->dev, "read error\n");
		return -EIO;
	}

	if (keygroup == 0xff)
		return 0;

	dev_dbg(&ir->rc->dev, "read key 0x%02x/0x%02x\n", key, keygroup);
	if (keygroup < 2 || keygroup > 4) {
		dev_warn(&ir->rc->dev, "warning: invalid key group 0x%02x for key 0x%02x\n",
			 keygroup, key);
	}
	key |= (keygroup & 1) << 6;

	*protocol = RC_PROTO_UNKNOWN;
	*scancode = key;
	if (ir->c->addr == 0x41) /* AVerMedia EM78P153 */
		*scancode |= keygroup << 8;
	*toggle = 0;
	return 1;
}

/* ----------------------------------------------------------------------- */

static int ir_key_poll(struct IR_i2c *ir)
{
	enum rc_proto protocol = 0;
	u32 scancode = 0;
	u8 toggle = 0;
	int rc;

	dev_dbg(&ir->rc->dev, "%s\n", __func__);
	rc = ir->get_key(ir, &protocol, &scancode, &toggle);
	if (rc < 0) {
		dev_warn(&ir->rc->dev, "error %d\n", rc);
		return rc;
	}

	if (rc) {
		dev_dbg(&ir->rc->dev, "%s: proto = 0x%04x, scancode = 0x%08x\n",
			__func__, protocol, scancode);
		rc_keydown(ir->rc, protocol, scancode, toggle);
	}
	return 0;
}

static void ir_work(struct work_struct *work)
{
	int rc;
	struct IR_i2c *ir = container_of(work, struct IR_i2c, work.work);

	/*
	 * If the transmit code is holding the lock, skip polling for
	 * IR, we'll get it to it next time round
	 */
	if (mutex_trylock(&ir->lock)) {
		rc = ir_key_poll(ir);
		mutex_unlock(&ir->lock);
		if (rc == -ENODEV) {
			rc_unregister_device(ir->rc);
			ir->rc = NULL;
			return;
		}
	}

	schedule_delayed_work(&ir->work, msecs_to_jiffies(ir->polling_interval));
}

static int ir_open(struct rc_dev *dev)
{
	struct IR_i2c *ir = dev->priv;

	schedule_delayed_work(&ir->work, 0);

	return 0;
}

static void ir_close(struct rc_dev *dev)
{
	struct IR_i2c *ir = dev->priv;

	cancel_delayed_work_sync(&ir->work);
}

/* Zilog Transmit Interface */
#define XTAL_FREQ		18432000

#define ZILOG_SEND		0x80
#define ZILOG_UIR_END		0x40
#define ZILOG_INIT_END		0x20
#define ZILOG_LIR_END		0x10

#define ZILOG_STATUS_OK		0x80
#define ZILOG_STATUS_TX		0x40
#define ZILOG_STATUS_SET	0x20

/*
 * As you can see here, very few different lengths of pulse and space
 * can be encoded. This means that the hardware does not work well with
 * recorded IR. It's best to work with generated IR, like from ir-ctl or
 * the in-kernel encoders.
 */
struct code_block {
	u8	length;
	u16	pulse[7];	/* not aligned */
	u8	carrier_pulse;
	u8	carrier_space;
	u16	space[8];	/* not aligned */
	u8	codes[61];
	u8	csum[2];
} __packed;

static int send_data_block(struct IR_i2c *ir, int cmd,
			   struct code_block *code_block)
{
	int i, j, ret;
	u8 buf[5], *p;

	p = &code_block->length;
	for (i = 0; p < code_block->csum; i++)
		code_block->csum[i & 1] ^= *p++;

	p = &code_block->length;

	for (i = 0; i < sizeof(*code_block);) {
		int tosend = sizeof(*code_block) - i;

		if (tosend > 4)
			tosend = 4;
		buf[0] = i + 1;
		for (j = 0; j < tosend; ++j)
			buf[1 + j] = p[i + j];
		dev_dbg(&ir->rc->dev, "%*ph", tosend + 1, buf);
		ret = i2c_master_send(ir->tx_c, buf, tosend + 1);
		if (ret != tosend + 1) {
			dev_dbg(&ir->rc->dev,
				"i2c_master_send failed with %d\n", ret);
			return ret < 0 ? ret : -EIO;
		}
		i += tosend;
	}

	buf[0] = 0;
	buf[1] = cmd;
	ret = i2c_master_send(ir->tx_c, buf, 2);
	if (ret != 2) {
		dev_err(&ir->rc->dev, "i2c_master_send failed with %d\n", ret);
		return ret < 0 ? ret : -EIO;
	}

	usleep_range(2000, 5000);

	ret = i2c_master_send(ir->tx_c, buf, 1);
	if (ret != 1) {
		dev_err(&ir->rc->dev, "i2c_master_send failed with %d\n", ret);
		return ret < 0 ? ret : -EIO;
	}

	return 0;
}

static int zilog_init(struct IR_i2c *ir)
{
	struct code_block code_block = { .length = sizeof(code_block) };
	u8 buf[4];
	int ret;

	put_unaligned_be16(0x1000, &code_block.pulse[3]);

	ret = send_data_block(ir, ZILOG_INIT_END, &code_block);
	if (ret)
		return ret;

	ret = i2c_master_recv(ir->tx_c, buf, 4);
	if (ret != 4) {
		dev_err(&ir->c->dev, "failed to retrieve firmware version: %d\n",
			ret);
		return ret < 0 ? ret : -EIO;
	}

	dev_info(&ir->c->dev, "Zilog/Hauppauge IR blaster firmware version %d.%d.%d\n",
		 buf[1], buf[2], buf[3]);

	return 0;
}

/*
 * If the last slot for pulse is the same as the current slot for pulse,
 * then use slot no 7.
 */
static void copy_codes(u8 *dst, u8 *src, unsigned int count)
{
	u8 c, last = 0xff;

	while (count--) {
		c = *src++;
		if ((c & 0xf0) == last) {
			*dst++ = 0x70 | (c & 0xf);
		} else {
			*dst++ = c;
			last = c & 0xf0;
		}
	}
}

/*
 * When looking for repeats, we don't care about the trailing space. This
 * is set to the shortest possible anyway.
 */
static int cmp_no_trail(u8 *a, u8 *b, unsigned int count)
{
	while (--count) {
		if (*a++ != *b++)
			return 1;
	}

	return (*a & 0xf0) - (*b & 0xf0);
}

static int find_slot(u16 *array, unsigned int size, u16 val)
{
	int i;

	for (i = 0; i < size; i++) {
		if (get_unaligned_be16(&array[i]) == val) {
			return i;
		} else if (!array[i]) {
			put_unaligned_be16(val, &array[i]);
			return i;
		}
	}

	return -1;
}

static int zilog_ir_format(struct rc_dev *rcdev, unsigned int *txbuf,
			   unsigned int count, struct code_block *code_block)
{
	struct IR_i2c *ir = rcdev->priv;
	int rep, i, l, p = 0, s, c = 0;
	bool repeating;
	u8 codes[174];

	code_block->carrier_pulse = DIV_ROUND_CLOSEST(
			ir->duty_cycle * XTAL_FREQ / 1000, ir->carrier);
	code_block->carrier_space = DIV_ROUND_CLOSEST(
			(100 - ir->duty_cycle) * XTAL_FREQ / 1000, ir->carrier);

	for (i = 0; i < count; i++) {
		if (c >= ARRAY_SIZE(codes) - 1) {
			dev_warn(&rcdev->dev, "IR too long, cannot transmit\n");
			return -EINVAL;
		}

		/*
		 * Lengths more than 142220us cannot be encoded; also
		 * this checks for multiply overflow
		 */
		if (txbuf[i] > 142220)
			return -EINVAL;

		l = DIV_ROUND_CLOSEST((XTAL_FREQ / 1000) * txbuf[i], 40000);

		if (i & 1) {
			s = find_slot(code_block->space,
				      ARRAY_SIZE(code_block->space), l);
			if (s == -1) {
				dev_warn(&rcdev->dev, "Too many different lengths spaces, cannot transmit");
				return -EINVAL;
			}

			/* We have a pulse and space */
			codes[c++] = (p << 4) | s;
		} else {
			p = find_slot(code_block->pulse,
				      ARRAY_SIZE(code_block->pulse), l);
			if (p == -1) {
				dev_warn(&rcdev->dev, "Too many different lengths pulses, cannot transmit");
				return -EINVAL;
			}
		}
	}

	/* We have to encode the trailing pulse. Find the shortest space */
	s = 0;
	for (i = 1; i < ARRAY_SIZE(code_block->space); i++) {
		u16 d = get_unaligned_be16(&code_block->space[i]);

		if (get_unaligned_be16(&code_block->space[s]) > d)
			s = i;
	}

	codes[c++] = (p << 4) | s;

	dev_dbg(&rcdev->dev, "generated %d codes\n", c);

	/*
	 * Are the last N codes (so pulse + space) repeating 3 times?
	 * if so we can shorten the codes list and use code 0xc0 to repeat
	 * them.
	 */
	repeating = false;

	for (rep = c / 3; rep >= 1; rep--) {
		if (!memcmp(&codes[c - rep * 3], &codes[c - rep * 2], rep) &&
		    !cmp_no_trail(&codes[c - rep], &codes[c - rep * 2], rep)) {
			repeating = true;
			break;
		}
	}

	if (repeating) {
		/* first copy any leading non-repeating */
		int leading = c - rep * 3;

		if (leading >= ARRAY_SIZE(code_block->codes) - 3 - rep) {
			dev_warn(&rcdev->dev, "IR too long, cannot transmit\n");
			return -EINVAL;
		}

		dev_dbg(&rcdev->dev, "found trailing %d repeat\n", rep);
		copy_codes(code_block->codes, codes, leading);
		code_block->codes[leading] = 0x82;
		copy_codes(code_block->codes + leading + 1, codes + leading,
			   rep);
		c = leading + 1 + rep;
		code_block->codes[c++] = 0xc0;
	} else {
		if (c >= ARRAY_SIZE(code_block->codes) - 3) {
			dev_warn(&rcdev->dev, "IR too long, cannot transmit\n");
			return -EINVAL;
		}

		dev_dbg(&rcdev->dev, "found no trailing repeat\n");
		code_block->codes[0] = 0x82;
		copy_codes(code_block->codes + 1, codes, c);
		c++;
		code_block->codes[c++] = 0xc4;
	}

	while (c < ARRAY_SIZE(code_block->codes))
		code_block->codes[c++] = 0x83;

	return 0;
}

static int zilog_tx(struct rc_dev *rcdev, unsigned int *txbuf,
		    unsigned int count)
{
	struct IR_i2c *ir = rcdev->priv;
	struct code_block code_block = { .length = sizeof(code_block) };
	u8 buf[2];
	int ret, i;

	ret = zilog_ir_format(rcdev, txbuf, count, &code_block);
	if (ret)
		return ret;

	ret = mutex_lock_interruptible(&ir->lock);
	if (ret)
		return ret;

	ret = send_data_block(ir, ZILOG_UIR_END, &code_block);
	if (ret)
		goto out_unlock;

	ret = i2c_master_recv(ir->tx_c, buf, 1);
	if (ret != 1) {
		dev_err(&ir->rc->dev, "i2c_master_recv failed with %d\n", ret);
		goto out_unlock;
	}

	dev_dbg(&ir->rc->dev, "code set status: %02x\n", buf[0]);

	if (buf[0] != (ZILOG_STATUS_OK | ZILOG_STATUS_SET)) {
		dev_err(&ir->rc->dev, "unexpected IR TX response %02x\n",
			buf[0]);
		ret = -EIO;
		goto out_unlock;
	}

	buf[0] = 0x00;
	buf[1] = ZILOG_SEND;

	ret = i2c_master_send(ir->tx_c, buf, 2);
	if (ret != 2) {
		dev_err(&ir->rc->dev, "i2c_master_send failed with %d\n", ret);
		if (ret >= 0)
			ret = -EIO;
		goto out_unlock;
	}

	dev_dbg(&ir->rc->dev, "send command sent\n");

	/*
	 * This bit NAKs until the device is ready, so we retry it
	 * sleeping a bit each time.  This seems to be what the windows
	 * driver does, approximately.
	 * Try for up to 1s.
	 */
	for (i = 0; i < 20; ++i) {
		set_current_state(TASK_UNINTERRUPTIBLE);
		schedule_timeout(msecs_to_jiffies(50));
		ret = i2c_master_send(ir->tx_c, buf, 1);
		if (ret == 1)
			break;
		dev_dbg(&ir->rc->dev,
			"NAK expected: i2c_master_send failed with %d (try %d)\n",
			ret, i + 1);
	}

	if (ret != 1) {
		dev_err(&ir->rc->dev,
			"IR TX chip never got ready: last i2c_master_send failed with %d\n",
			ret);
		if (ret >= 0)
			ret = -EIO;
		goto out_unlock;
	}

	ret = i2c_master_recv(ir->tx_c, buf, 1);
	if (ret != 1) {
		dev_err(&ir->rc->dev, "i2c_master_recv failed with %d\n", ret);
		ret = -EIO;
		goto out_unlock;
	} else if (buf[0] != ZILOG_STATUS_OK) {
		dev_err(&ir->rc->dev, "unexpected IR TX response #2: %02x\n",
			buf[0]);
		ret = -EIO;
		goto out_unlock;
	}
	dev_dbg(&ir->rc->dev, "transmit complete\n");

	/* Oh good, it worked */
	ret = count;
out_unlock:
	mutex_unlock(&ir->lock);

	return ret;
}

static int zilog_tx_carrier(struct rc_dev *dev, u32 carrier)
{
	struct IR_i2c *ir = dev->priv;

	if (carrier > 500000 || carrier < 20000)
		return -EINVAL;

	ir->carrier = carrier;

	return 0;
}

static int zilog_tx_duty_cycle(struct rc_dev *dev, u32 duty_cycle)
{
	struct IR_i2c *ir = dev->priv;

	ir->duty_cycle = duty_cycle;

	return 0;
}

static int ir_probe(struct i2c_client *client)
{
	const struct i2c_device_id *id = i2c_client_get_device_id(client);
	char *ir_codes = NULL;
	const char *name = NULL;
	u64 rc_proto = RC_PROTO_BIT_UNKNOWN;
	struct IR_i2c *ir;
	struct rc_dev *rc = NULL;
	struct i2c_adapter *adap = client->adapter;
	unsigned short addr = client->addr;
	bool probe_tx = (id->driver_data & FLAG_TX) != 0;
	int err;

	if ((id->driver_data & FLAG_HDPVR) && !enable_hdpvr) {
		dev_err(&client->dev, "IR for HDPVR is known to cause problems during recording, use enable_hdpvr modparam to enable\n");
		return -ENODEV;
	}

	ir = devm_kzalloc(&client->dev, sizeof(*ir), GFP_KERNEL);
	if (!ir)
		return -ENOMEM;

	ir->c = client;
	ir->polling_interval = DEFAULT_POLLING_INTERVAL;
	i2c_set_clientdata(client, ir);

	switch(addr) {
	case 0x64:
		name        = "Pixelview";
		ir->get_key = get_key_pixelview;
		rc_proto    = RC_PROTO_BIT_OTHER;
		ir_codes    = RC_MAP_EMPTY;
		break;
	case 0x18:
	case 0x1f:
	case 0x1a:
		name        = "Hauppauge";
		ir->get_key = get_key_haup;
		rc_proto    = RC_PROTO_BIT_RC5;
		ir_codes    = RC_MAP_HAUPPAUGE;
		break;
	case 0x30:
		name        = "KNC One";
		ir->get_key = get_key_knc1;
		rc_proto    = RC_PROTO_BIT_OTHER;
		ir_codes    = RC_MAP_EMPTY;
		break;
	case 0x33:
		name        = "Geniatech";
		ir->get_key = get_key_geniatech;
		rc_proto    = RC_PROTO_BIT_RC5;
		ir_codes    = RC_MAP_TOTAL_MEDIA_IN_HAND_02;
		ir->old     = 0xfc;
		break;
	case 0x6b:
		name        = "FusionHDTV";
		ir->get_key = get_key_fusionhdtv;
		rc_proto    = RC_PROTO_BIT_UNKNOWN;
		ir_codes    = RC_MAP_FUSIONHDTV_MCE;
		break;
	case 0x40:
		name        = "AVerMedia Cardbus remote";
		ir->get_key = get_key_avermedia_cardbus;
		rc_proto    = RC_PROTO_BIT_OTHER;
		ir_codes    = RC_MAP_AVERMEDIA_CARDBUS;
		break;
	case 0x41:
		name        = "AVerMedia EM78P153";
		ir->get_key = get_key_avermedia_cardbus;
		rc_proto    = RC_PROTO_BIT_OTHER;
		/* RM-KV remote, seems to be same as RM-K6 */
		ir_codes    = RC_MAP_AVERMEDIA_M733A_RM_K6;
		break;
	case 0x71:
		name        = "Hauppauge/Zilog Z8";
		ir->get_key = get_key_haup_xvr;
		rc_proto    = RC_PROTO_BIT_RC5 | RC_PROTO_BIT_RC6_MCE |
							RC_PROTO_BIT_RC6_6A_32;
		ir_codes    = RC_MAP_HAUPPAUGE;
		ir->polling_interval = 125;
		probe_tx = true;
		break;
	}

	/* Let the caller override settings */
	if (client->dev.platform_data) {
		const struct IR_i2c_init_data *init_data =
						client->dev.platform_data;

		ir_codes = init_data->ir_codes;
		rc = init_data->rc_dev;

		name = init_data->name;
		if (init_data->type)
			rc_proto = init_data->type;

		if (init_data->polling_interval)
			ir->polling_interval = init_data->polling_interval;

		switch (init_data->internal_get_key_func) {
		case IR_KBD_GET_KEY_CUSTOM:
			/* The bridge driver provided us its own function */
			ir->get_key = init_data->get_key;
			break;
		case IR_KBD_GET_KEY_PIXELVIEW:
			ir->get_key = get_key_pixelview;
			break;
		case IR_KBD_GET_KEY_HAUP:
			ir->get_key = get_key_haup;
			break;
		case IR_KBD_GET_KEY_KNC1:
			ir->get_key = get_key_knc1;
			break;
		case IR_KBD_GET_KEY_GENIATECH:
			ir->get_key = get_key_geniatech;
			break;
		case IR_KBD_GET_KEY_FUSIONHDTV:
			ir->get_key = get_key_fusionhdtv;
			break;
		case IR_KBD_GET_KEY_HAUP_XVR:
			ir->get_key = get_key_haup_xvr;
			break;
		case IR_KBD_GET_KEY_AVERMEDIA_CARDBUS:
			ir->get_key = get_key_avermedia_cardbus;
			break;
		}
	}

	if (!rc) {
		/*
		 * If platform_data doesn't specify rc_dev, initialize it
		 * internally
		 */
		rc = rc_allocate_device(RC_DRIVER_SCANCODE);
		if (!rc)
			return -ENOMEM;
	}
	ir->rc = rc;

	/* Make sure we are all setup before going on */
	if (!name || !ir->get_key || !rc_proto || !ir_codes) {
		dev_warn(&client->dev, "Unsupported device at address 0x%02x\n",
			 addr);
		err = -ENODEV;
		goto err_out_free;
	}

	ir->ir_codes = ir_codes;

	snprintf(ir->phys, sizeof(ir->phys), "%s/%s", dev_name(&adap->dev),
		 dev_name(&client->dev));

	/*
	 * Initialize input_dev fields
	 * It doesn't make sense to allow overriding them via platform_data
	 */
	rc->input_id.bustype = BUS_I2C;
	rc->input_phys       = ir->phys;
	rc->device_name	     = name;
	rc->dev.parent       = &client->dev;
	rc->priv             = ir;
	rc->open             = ir_open;
	rc->close            = ir_close;

	/*
	 * Initialize the other fields of rc_dev
	 */
	rc->map_name       = ir->ir_codes;
	rc->allowed_protocols = rc_proto;
	if (!rc->driver_name)
		rc->driver_name = KBUILD_MODNAME;

	mutex_init(&ir->lock);

	INIT_DELAYED_WORK(&ir->work, ir_work);

	if (probe_tx) {
		ir->tx_c = i2c_new_dummy_device(client->adapter, 0x70);
		if (IS_ERR(ir->tx_c)) {
			dev_err(&client->dev, "failed to setup tx i2c address");
			err = PTR_ERR(ir->tx_c);
			goto err_out_free;
		} else if (!zilog_init(ir)) {
			ir->carrier = 38000;
			ir->duty_cycle = 40;
			rc->tx_ir = zilog_tx;
			rc->s_tx_carrier = zilog_tx_carrier;
			rc->s_tx_duty_cycle = zilog_tx_duty_cycle;
		}
	}

	err = rc_register_device(rc);
	if (err)
		goto err_out_free;

	return 0;

 err_out_free:
	if (!IS_ERR(ir->tx_c))
		i2c_unregister_device(ir->tx_c);

	/* Only frees rc if it were allocated internally */
	rc_free_device(rc);
	return err;
}

static void ir_remove(struct i2c_client *client)
{
	struct IR_i2c *ir = i2c_get_clientdata(client);

	cancel_delayed_work_sync(&ir->work);

	i2c_unregister_device(ir->tx_c);

	rc_unregister_device(ir->rc);
}

static const struct i2c_device_id ir_kbd_id[] = {
	/* Generic entry for any IR receiver */
	{ "ir_video", 0 },
	/* IR device specific entries should be added here */
	{ "ir_z8f0811_haup", FLAG_TX },
	{ "ir_z8f0811_hdpvr", FLAG_TX | FLAG_HDPVR },
	{ }
};
MODULE_DEVICE_TABLE(i2c, ir_kbd_id);

static struct i2c_driver ir_kbd_driver = {
	.driver = {
		.name   = "ir-kbd-i2c",
	},
	.probe          = ir_probe,
	.remove         = ir_remove,
	.id_table       = ir_kbd_id,
};

module_i2c_driver(ir_kbd_driver);

/* ----------------------------------------------------------------------- */

MODULE_AUTHOR("Gerd Knorr, Michal Kochanowicz, Christoph Bartelmus, Ulrich Mueller");
MODULE_DESCRIPTION("input driver for i2c IR remote controls");
MODULE_LICENSE("GPL");
]

gemini-3-pro-preview

							input: 65103
							output: 62
							thoughts: 416
						

**Dissecting the IR Framework: A Deep Dive**

Okay, so `ir_remove` triggers `cancel_delayed_work_sync(&ir->work);`. Right, `ir->work` is a *delayed* work structure. Got it. Now, let's trace this. `ir_work` is the core, and it's where the magic happens:

```c
static void ir_work(struct work_struct *work)
{
	int rc;
	struct IR_i2c *ir = container_of(work, struct IR_i2c, work.work);

	/*
	 * If the transmit code is holding the lock, skip polling for
	 * IR, we'll get it to it next time round
	 */
	if (mutex_trylock(&ir->lock)) {
		rc = ir_key_poll(ir);
		mutex_unlock(&ir->lock);
		if (rc == -ENODEV) {
			rc_unregister_device(ir->rc);
			ir->rc = NULL;
			return;
		}
	}

	schedule_delayed_work(&ir->work, msecs_to_jiffies(ir->polling_interval));
}
```

The `ir_work` function first tries to acquire the lock (`ir->lock`). If it gets it, it calls `ir_key_poll(ir)`. The key thing here is `ir_key_poll` calls the `ir->get_key(ir, ...)` function. This `get_key` function is a crucial part. For `pvrusb2`, this resolves to `get_key_haup` or `get_key_haup_xvr`. These functions are interesting because they're the bridge to the I2C bus; they call either `i2c_master_recv` or `i2c_master_send`. Those then call `i2c_transfer`, which in turn, is dependent on the adapter and, more specifically, calls the adapter's algorithm's `master_xfer`. For `pvrusb2`, that `master_xfer` is `pvr2_i2c_xfer`, located in `drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c`. Okay, now I need to dive into `pvr2_i2c_xfer` to fully understand the I2C interaction.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c IncludeLines:true Name:pvr2_i2c_xfer]

map[SourceCode: 360:	/* This is a very, very limited I2C adapter implementation.  We can only
 361:	   support what we actually know will work on the device... */
 362:	static int pvr2_i2c_xfer(struct i2c_adapter *i2c_adap,
 363:				 struct i2c_msg msgs[],
 364:				 int num)
 365:	{
 366:		int ret = -ENOTSUPP;
 367:		pvr2_i2c_func funcp = NULL;
 368:		struct pvr2_hdw *hdw = (struct pvr2_hdw *)(i2c_adap->algo_data);
 369:	
 370:		if (!num) {
 371:			ret = -EINVAL;
 372:			goto done;
 373:		}
 374:		if (msgs[0].addr < PVR2_I2C_FUNC_CNT) {
 375:			funcp = hdw->i2c_func[msgs[0].addr];
 376:		}
 377:		if (!funcp) {
 378:			ret = -EIO;
 379:			goto done;
 380:		}
 381:	
 382:		if (num == 1) {
 383:			if (msgs[0].flags & I2C_M_RD) {
 384:				/* Simple read */
 385:				u16 tcnt,bcnt,offs;
 386:				if (!msgs[0].len) {
 387:					/* Length == 0 read.  This is a probe. */
 388:					if (funcp(hdw,msgs[0].addr,NULL,0,NULL,0)) {
 389:						ret = -EIO;
 390:						goto done;
 391:					}
 392:					ret = 1;
 393:					goto done;
 394:				}
 395:				/* If the read is short enough we'll do the whole
 396:				   thing atomically.  Otherwise we have no choice
 397:				   but to break apart the reads. */
 398:				tcnt = msgs[0].len;
 399:				offs = 0;
 400:				while (tcnt) {
 401:					bcnt = tcnt;
 402:					if (bcnt > sizeof(hdw->cmd_buffer)-1) {
 403:						bcnt = sizeof(hdw->cmd_buffer)-1;
 404:					}
 405:					if (funcp(hdw,msgs[0].addr,NULL,0,
 406:						  msgs[0].buf+offs,bcnt)) {
 407:						ret = -EIO;
 408:						goto done;
 409:					}
 410:					offs += bcnt;
 411:					tcnt -= bcnt;
 412:				}
 413:				ret = 1;
 414:				goto done;
 415:			} else {
 416:				/* Simple write */
 417:				ret = 1;
 418:				if (funcp(hdw,msgs[0].addr,
 419:					  msgs[0].buf,msgs[0].len,NULL,0)) {
 420:					ret = -EIO;
 421:				}
 422:				goto done;
 423:			}
 424:		} else if (num == 2) {
 425:			if (msgs[0].addr != msgs[1].addr) {
 426:				trace_i2c("i2c refusing 2 phase transfer with conflicting target addresses");
 427:				ret = -ENOTSUPP;
 428:				goto done;
 429:			}
 430:			if ((!((msgs[0].flags & I2C_M_RD))) &&
 431:			    (msgs[1].flags & I2C_M_RD)) {
 432:				u16 tcnt,bcnt,wcnt,offs;
 433:				/* Write followed by atomic read.  If the read
 434:				   portion is short enough we'll do the whole thing
 435:				   atomically.  Otherwise we have no choice but to
 436:				   break apart the reads. */
 437:				tcnt = msgs[1].len;
 438:				wcnt = msgs[0].len;
 439:				offs = 0;
 440:				while (tcnt || wcnt) {
 441:					bcnt = tcnt;
 442:					if (bcnt > sizeof(hdw->cmd_buffer)-1) {
 443:						bcnt = sizeof(hdw->cmd_buffer)-1;
 444:					}
 445:					if (funcp(hdw,msgs[0].addr,
 446:						  msgs[0].buf,wcnt,
 447:						  msgs[1].buf+offs,bcnt)) {
 448:						ret = -EIO;
 449:						goto done;
 450:					}
 451:					offs += bcnt;
 452:					tcnt -= bcnt;
 453:					wcnt = 0;
 454:				}
 455:				ret = 2;
 456:				goto done;
 457:			} else {
 458:				trace_i2c("i2c refusing complex transfer read0=%d read1=%d",
 459:					  (msgs[0].flags & I2C_M_RD),
 460:					  (msgs[1].flags & I2C_M_RD));
 461:			}
 462:		} else {
 463:			trace_i2c("i2c refusing %d phase transfer",num);
 464:		}
 465:	
 466:	 done:
 467:		if (pvrusb2_debug & PVR2_TRACE_I2C_TRAF) {
 468:			unsigned int idx,offs,cnt;
 469:			for (idx = 0; idx < num; idx++) {
 470:				cnt = msgs[idx].len;
 471:				pr_info("pvrusb2 i2c xfer %u/%u: addr=0x%x len=%d %s",
 472:				       idx+1,num,
 473:				       msgs[idx].addr,
 474:				       cnt,
 475:				       (msgs[idx].flags & I2C_M_RD ?
 476:					"read" : "write"));
 477:				if ((ret > 0) || !(msgs[idx].flags & I2C_M_RD)) {
 478:					if (cnt > 8) cnt = 8;
 479:					pr_cont(" [");
 480:					for (offs = 0; offs < cnt; offs++) {
 481:						if (offs) pr_cont(" ");
 482:						pr_cont("%02x", msgs[idx].buf[offs]);
 483:					}
 484:					if (offs < cnt) pr_cont(" ...");
 485:					pr_cont("]");
 486:				}
 487:				if (idx+1 == num) {
 488:					pr_cont(" result=%d", ret);
 489:				}
 490:				pr_cont("\n");
 491:			}
 492:			if (!num) {
 493:				pr_info("pvrusb2 i2c xfer null transfer result=%d\n",
 494:				       ret);
 495:			}
 496:		}
 497:		return ret;
 498:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c]

gemini-3-pro-preview

							input: 68309
							output: 63
							thoughts: 73
						

Here's my analysis of what's going on:

**Deconstructing the I2C Transfer**

Okay, so I'm looking at how this `pvr2_i2c_xfer` function is working. It appears this function is the central point for I2C transfers, and it's calling another function, `funcp`, to handle the actual hardware interaction. The crucial bit is that this `funcp` is invoked with the hardware handle (`hdw`), and the I2C address we are trying to communicate with (from `msgs[0].addr`), which makes sense. I see in the context of the `pvrusb2` module, this `funcp` is specifically `pvr2_i2c_basic_op`. Now, that's the key. That's the function I need to dive into to understand the low-level I2C communication. Let's dig into `pvr2_i2c_basic_op` and see what's actually happening at the hardware level. This `funcp` is likely where the actual I2C protocol sequencing is implemented.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c IncludeLines:true Name:pvr2_i2c_basic_op]

map[SourceCode: 160:	/* This is the common low level entry point for doing I2C operations to the
 161:	   hardware. */
 162:	static int pvr2_i2c_basic_op(struct pvr2_hdw *hdw,
 163:				     u8 i2c_addr,
 164:				     u8 *wdata,
 165:				     u16 wlen,
 166:				     u8 *rdata,
 167:				     u16 rlen)
 168:	{
 169:		if (!rdata) rlen = 0;
 170:		if (!wdata) wlen = 0;
 171:		if (rlen || !wlen) {
 172:			return pvr2_i2c_read(hdw,i2c_addr,wdata,wlen,rdata,rlen);
 173:		} else {
 174:			return pvr2_i2c_write(hdw,i2c_addr,wdata,wlen);
 175:		}
 176:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c]

gemini-3-pro-preview

							input: 69027
							output: 56
							thoughts: 70
						

**Analyzing the USB-PVR2 Interaction**

Okay, so I'm looking at how the `pvr2` driver handles I2C communication, specifically for the PVRUSB2 hardware. The code shows that both `pvr2_i2c_read` and `pvr2_i2c_write` eventually funnel down to a function called `pvr2_send_request`. This is my starting point – the central point where the I2C requests are constructed and dispatched. My next move is clear: I need to dig into `pvr2_send_request` to truly understand the flow. I know that function is located within `drivers/media/usb/pvrusb2/pvrusb2-hdw.c`. This is where the magic happens, or potentially where the bottleneck resides. Let's see how they actually build and send those I2C commands through USB.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c IncludeLines:true Name:pvr2_send_request]

map[SourceCode:3815:	int pvr2_send_request(struct pvr2_hdw *hdw,
3816:			      void *write_data,unsigned int write_len,
3817:			      void *read_data,unsigned int read_len)
3818:	{
3819:		return pvr2_send_request_ex(hdw,HZ*4,0,
3820:					    write_data,write_len,
3821:					    read_data,read_len);
3822:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c]

gemini-3-pro-preview

							input: 69532
							output: 58
							thoughts: 23
						

Okay, here's my interpretation of that interaction, presented as my own thought process, assuming I'm an expert in this area:

**Deconstructing the Request Transmission**

Alright, I'm looking at `pvr2_send_request_ex` and immediately, I see its core function - sending a request. But it doesn't do the sending directly, instead, it delegates that crucial task. This function clearly calls `pvr2_issue_request_ex`. That's the key. `pvr2_issue_request_ex` is the actual workhorse here. It's the point where the rubber meets the road. I need to understand what `pvr2_issue_request_ex` *does*. Is it queueing, issuing a direct command, or something more complex? That's what I'll be investigating next. The relationship between these two functions is pretty clear: a wrapper and the real work. What makes `pvr2_send_request_ex` a wrapper function? Perhaps it's dealing with pre-processing, security checks, or some other form of setup prior to sending the request. `pvr2_issue_request_ex` likely has the meat of the request logic, it's the more critical function here. I'll need to drill down into the internals of `pvr2_issue_request_ex` to truly grasp the request processing flow.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c IncludeLines:true Name:pvr2_send_request_ex]

map[SourceCode:3578:	/* Issue a command and get a response from the device.  This extended
3579:	   version includes a probe flag (which if set means that device errors
3580:	   should not be logged or treated as fatal) and a timeout in jiffies.
3581:	   This can be used to non-lethally probe the health of endpoint 1. */
3582:	static int pvr2_send_request_ex(struct pvr2_hdw *hdw,
3583:					unsigned int timeout,int probe_fl,
3584:					void *write_data,unsigned int write_len,
3585:					void *read_data,unsigned int read_len)
3586:	{
3587:		unsigned int idx;
3588:		int status = 0;
3589:		struct hdw_timer timer = {
3590:			.hdw = hdw,
3591:		};
3592:	
3593:		if (!hdw->ctl_lock_held) {
3594:			pvr2_trace(PVR2_TRACE_ERROR_LEGS,
3595:				   "Attempted to execute control transfer without lock!!");
3596:			return -EDEADLK;
3597:		}
3598:		if (!hdw->flag_ok && !probe_fl) {
3599:			pvr2_trace(PVR2_TRACE_ERROR_LEGS,
3600:				   "Attempted to execute control transfer when device not ok");
3601:			return -EIO;
3602:		}
3603:		if (!(hdw->ctl_read_urb && hdw->ctl_write_urb)) {
3604:			if (!probe_fl) {
3605:				pvr2_trace(PVR2_TRACE_ERROR_LEGS,
3606:					   "Attempted to execute control transfer when USB is disconnected");
3607:			}
3608:			return -ENOTTY;
3609:		}
3610:	
3611:		/* Ensure that we have sane parameters */
3612:		if (!write_data) write_len = 0;
3613:		if (!read_data) read_len = 0;
3614:		if (write_len > PVR2_CTL_BUFFSIZE) {
3615:			pvr2_trace(
3616:				PVR2_TRACE_ERROR_LEGS,
3617:				"Attempted to execute %d byte control-write transfer (limit=%d)",
3618:				write_len,PVR2_CTL_BUFFSIZE);
3619:			return -EINVAL;
3620:		}
3621:		if (read_len > PVR2_CTL_BUFFSIZE) {
3622:			pvr2_trace(
3623:				PVR2_TRACE_ERROR_LEGS,
3624:				"Attempted to execute %d byte control-read transfer (limit=%d)",
3625:				read_len, PVR2_CTL_BUFFSIZE);
3626:			return -EINVAL;
3627:		}
3628:		if ((!write_len) && (!read_len)) {
3629:			pvr2_trace(
3630:				PVR2_TRACE_ERROR_LEGS,
3631:				"Attempted to execute null control transfer?");
3632:			return -EINVAL;
3633:		}
3634:	
3635:	
3636:		hdw->cmd_debug_state = 1;
3637:		if (write_len && write_data)
3638:			hdw->cmd_debug_code = ((unsigned char *)write_data)[0];
3639:		else
3640:			hdw->cmd_debug_code = 0;
3641:		hdw->cmd_debug_write_len = write_len;
3642:		hdw->cmd_debug_read_len = read_len;
3643:	
3644:		/* Initialize common stuff */
3645:		init_completion(&hdw->ctl_done);
3646:		hdw->ctl_timeout_flag = 0;
3647:		hdw->ctl_write_pend_flag = 0;
3648:		hdw->ctl_read_pend_flag = 0;
3649:		timer_setup_on_stack(&timer.timer, pvr2_ctl_timeout, 0);
3650:		timer.timer.expires = jiffies + timeout;
3651:	
3652:		if (write_len && write_data) {
3653:			hdw->cmd_debug_state = 2;
3654:			/* Transfer write data to internal buffer */
3655:			for (idx = 0; idx < write_len; idx++) {
3656:				hdw->ctl_write_buffer[idx] =
3657:					((unsigned char *)write_data)[idx];
3658:			}
3659:			/* Initiate a write request */
3660:			usb_fill_bulk_urb(hdw->ctl_write_urb,
3661:					  hdw->usb_dev,
3662:					  usb_sndbulkpipe(hdw->usb_dev,
3663:							  PVR2_CTL_WRITE_ENDPOINT),
3664:					  hdw->ctl_write_buffer,
3665:					  write_len,
3666:					  pvr2_ctl_write_complete,
3667:					  hdw);
3668:			hdw->ctl_write_urb->actual_length = 0;
3669:			hdw->ctl_write_pend_flag = !0;
3670:			if (usb_urb_ep_type_check(hdw->ctl_write_urb)) {
3671:				pvr2_trace(
3672:					PVR2_TRACE_ERROR_LEGS,
3673:					"Invalid write control endpoint");
3674:				return -EINVAL;
3675:			}
3676:			status = usb_submit_urb(hdw->ctl_write_urb,GFP_KERNEL);
3677:			if (status < 0) {
3678:				pvr2_trace(PVR2_TRACE_ERROR_LEGS,
3679:					   "Failed to submit write-control URB status=%d",
3680:	status);
3681:				hdw->ctl_write_pend_flag = 0;
3682:				goto done;
3683:			}
3684:		}
3685:	
3686:		if (read_len) {
3687:			hdw->cmd_debug_state = 3;
3688:			memset(hdw->ctl_read_buffer,0x43,read_len);
3689:			/* Initiate a read request */
3690:			usb_fill_bulk_urb(hdw->ctl_read_urb,
3691:					  hdw->usb_dev,
3692:					  usb_rcvbulkpipe(hdw->usb_dev,
3693:							  PVR2_CTL_READ_ENDPOINT),
3694:					  hdw->ctl_read_buffer,
3695:					  read_len,
3696:					  pvr2_ctl_read_complete,
3697:					  hdw);
3698:			hdw->ctl_read_urb->actual_length = 0;
3699:			hdw->ctl_read_pend_flag = !0;
3700:			if (usb_urb_ep_type_check(hdw->ctl_read_urb)) {
3701:				pvr2_trace(
3702:					PVR2_TRACE_ERROR_LEGS,
3703:					"Invalid read control endpoint");
3704:				return -EINVAL;
3705:			}
3706:			status = usb_submit_urb(hdw->ctl_read_urb,GFP_KERNEL);
3707:			if (status < 0) {
3708:				pvr2_trace(PVR2_TRACE_ERROR_LEGS,
3709:					   "Failed to submit read-control URB status=%d",
3710:	status);
3711:				hdw->ctl_read_pend_flag = 0;
3712:				goto done;
3713:			}
3714:		}
3715:	
3716:		/* Start timer */
3717:		add_timer(&timer.timer);
3718:	
3719:		/* Now wait for all I/O to complete */
3720:		hdw->cmd_debug_state = 4;
3721:		while (hdw->ctl_write_pend_flag || hdw->ctl_read_pend_flag) {
3722:			wait_for_completion(&hdw->ctl_done);
3723:		}
3724:		hdw->cmd_debug_state = 5;
3725:	
3726:		/* Stop timer */
3727:		timer_delete_sync(&timer.timer);
3728:	
3729:		hdw->cmd_debug_state = 6;
3730:		status = 0;
3731:	
3732:		if (hdw->ctl_timeout_flag) {
3733:			status = -ETIMEDOUT;
3734:			if (!probe_fl) {
3735:				pvr2_trace(PVR2_TRACE_ERROR_LEGS,
3736:					   "Timed out control-write");
3737:			}
3738:			goto done;
3739:		}
3740:	
3741:		if (write_len) {
3742:			/* Validate results of write request */
3743:			if ((hdw->ctl_write_urb->status != 0) &&
3744:			    (hdw->ctl_write_urb->status != -ENOENT) &&
3745:			    (hdw->ctl_write_urb->status != -ESHUTDOWN) &&
3746:			    (hdw->ctl_write_urb->status != -ECONNRESET)) {
3747:				/* USB subsystem is reporting some kind of failure
3748:				   on the write */
3749:				status = hdw->ctl_write_urb->status;
3750:				if (!probe_fl) {
3751:					pvr2_trace(PVR2_TRACE_ERROR_LEGS,
3752:						   "control-write URB failure, status=%d",
3753:						   status);
3754:				}
3755:				goto done;
3756:			}
3757:			if (hdw->ctl_write_urb->actual_length < write_len) {
3758:				/* Failed to write enough data */
3759:				status = -EIO;
3760:				if (!probe_fl) {
3761:					pvr2_trace(PVR2_TRACE_ERROR_LEGS,
3762:						   "control-write URB short, expected=%d got=%d",
3763:						   write_len,
3764:						   hdw->ctl_write_urb->actual_length);
3765:				}
3766:				goto done;
3767:			}
3768:		}
3769:		if (read_len && read_data) {
3770:			/* Validate results of read request */
3771:			if ((hdw->ctl_read_urb->status != 0) &&
3772:			    (hdw->ctl_read_urb->status != -ENOENT) &&
3773:			    (hdw->ctl_read_urb->status != -ESHUTDOWN) &&
3774:			    (hdw->ctl_read_urb->status != -ECONNRESET)) {
3775:				/* USB subsystem is reporting some kind of failure
3776:				   on the read */
3777:				status = hdw->ctl_read_urb->status;
3778:				if (!probe_fl) {
3779:					pvr2_trace(PVR2_TRACE_ERROR_LEGS,
3780:						   "control-read URB failure, status=%d",
3781:						   status);
3782:				}
3783:				goto done;
3784:			}
3785:			if (hdw->ctl_read_urb->actual_length < read_len) {
3786:				/* Failed to read enough data */
3787:				status = -EIO;
3788:				if (!probe_fl) {
3789:					pvr2_trace(PVR2_TRACE_ERROR_LEGS,
3790:						   "control-read URB short, expected=%d got=%d",
3791:						   read_len,
3792:						   hdw->ctl_read_urb->actual_length);
3793:				}
3794:				goto done;
3795:			}
3796:			/* Transfer retrieved data out from internal buffer */
3797:			for (idx = 0; idx < read_len; idx++) {
3798:				((unsigned char *)read_data)[idx] =
3799:					hdw->ctl_read_buffer[idx];
3800:			}
3801:		}
3802:	
3803:	 done:
3804:	
3805:		hdw->cmd_debug_state = 0;
3806:		if ((status < 0) && (!probe_fl)) {
3807:			pvr2_hdw_render_useless(hdw);
3808:		}
3809:		timer_destroy_on_stack(&timer.timer);
3810:	
3811:		return status;
3812:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c]

gemini-3-pro-preview

							input: 73715
							output: 61
							thoughts: 524
						

**Analyzing Potential Deadlock in USB Device Disconnection**

Okay, so I'm trying to wrap my head around a potential deadlock scenario here, specifically related to how this USB device handles disconnections. The core of the issue seems to be the interaction between `pvr2_send_request_ex` and the delayed work `ir_work`.

Initially, the code indicates that `pvr2_send_request_ex` waits for the completion of `hdw->ctl_done`. `ir_work` runs in a workqueue, so if it calls `pvr2_send_request_ex`, it can block, waiting for that completion. Now, if the USB device gets disconnected, the USB subsystem cancels the URBs, and that should trigger `hdw->ctl_done` to complete, right? And that seems fine, until you factor in `ir_remove`.

`ir_remove` calls `cancel_delayed_work_sync(&ir->work)`. Now, this is where it gets tricky. If `ir_work` is *currently* running, `cancel_delayed_work_sync` will block until `ir_work` finishes. This is a potential deadlock, where `ir_work` is blocked in `pvr2_send_request_ex` waiting for `hdw->ctl_done`, and `cancel_delayed_work_sync` is waiting for `ir_work`. The race condition is apparent.

Ah, but `usb_disconnect` calls `usb_disable_device`, which cancels all URBs! So, in the disconnect scenario, `pvr2_send_request_ex` should return, resolving the deadlock. But hang on, does this apply to every case? What if `ir_work` is blocked on something else?

Then there's the `ir_work` execution path, which involves `mutex_trylock(&ir->lock)`. If it gets the lock, it calls `ir_key_poll`. So `ir_remove` calls `cancel_delayed_work_sync(&ir->work)`. If `ir_work` is running, then `cancel_delayed_work_sync` waits.

Okay, here's the crucial question. Is `ir_work` blocked in `pvr2_send_request_ex`? Let's trace it. Ah, `pvr2_send_request_ex` uses `hdw->ctl_lock`! It's not straightforward, though.

Wait a second… `pvr2_send_request_ex` *requires* `hdw->ctl_lock` to be held, but doesn't actually attempt to acquire it itself. It checks `if (!hdw->ctl_lock_held) return -EDEADLK;`. So, `ir_work` *can't* directly call `pvr2_send_request_ex` in the first place, because it doesn't hold `hdw->ctl_lock`. This is critical. How is `pvr2_send_request_ex` being invoked? I need to review `pvr2_i2c_basic_op`. I think that is where it gets called from.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c IncludeLines:true Name:pvr2_i2c_read]

map[SourceCode:  89:	static int pvr2_i2c_read(struct pvr2_hdw *hdw, /* Context */
  90:				 u8 i2c_addr,       /* I2C address we're talking to */
  91:				 u8 *data,          /* Data to write */
  92:				 u16 dlen,          /* Size of data to write */
  93:				 u8 *res,           /* Where to put data we read */
  94:				 u16 rlen)          /* Amount of data to read */
  95:	{
  96:		/* Return value - default 0 means success */
  97:		int ret;
  98:	
  99:	
 100:		if (!data) dlen = 0;
 101:		if (dlen > (sizeof(hdw->cmd_buffer) - 4)) {
 102:			pvr2_trace(PVR2_TRACE_ERROR_LEGS,
 103:				   "Killing an I2C read to %u that has wlen too large (desired=%u limit=%u)",
 104:				   i2c_addr,
 105:				   dlen,(unsigned int)(sizeof(hdw->cmd_buffer) - 4));
 106:			return -ENOTSUPP;
 107:		}
 108:		if (res && (rlen > (sizeof(hdw->cmd_buffer) - 1))) {
 109:			pvr2_trace(PVR2_TRACE_ERROR_LEGS,
 110:				   "Killing an I2C read to %u that has rlen too large (desired=%u limit=%u)",
 111:				   i2c_addr,
 112:				   rlen,(unsigned int)(sizeof(hdw->cmd_buffer) - 1));
 113:			return -ENOTSUPP;
 114:		}
 115:	
 116:		LOCK_TAKE(hdw->ctl_lock);
 117:	
 118:		/* Clear the command buffer (likely to be paranoia) */
 119:		memset(hdw->cmd_buffer, 0, sizeof(hdw->cmd_buffer));
 120:	
 121:		/* Set up command buffer for an I2C write followed by a read */
 122:		hdw->cmd_buffer[0] = FX2CMD_I2C_READ;  /* read prefix */
 123:		hdw->cmd_buffer[1] = dlen;  /* arg length */
 124:		hdw->cmd_buffer[2] = rlen;  /* answer length. Device will send one
 125:					       more byte (status). */
 126:		hdw->cmd_buffer[3] = i2c_addr;  /* i2c addr of chip */
 127:		if (dlen) memcpy(hdw->cmd_buffer + 4, data, dlen);
 128:	
 129:		/* Do the operation */
 130:		ret = pvr2_send_request(hdw,
 131:					hdw->cmd_buffer,
 132:					4 + dlen,
 133:					hdw->cmd_buffer,
 134:					rlen + 1);
 135:		if (!ret) {
 136:			if (hdw->cmd_buffer[0] != 8) {
 137:				ret = -EIO;
 138:				if (hdw->cmd_buffer[0] != 7) {
 139:					trace_i2c("unexpected status from i2_read[%d]: %d",
 140:						  i2c_addr,hdw->cmd_buffer[0]);
 141:				}
 142:			}
 143:		}
 144:	
 145:		/* Copy back the result */
 146:		if (res && rlen) {
 147:			if (ret) {
 148:				/* Error, just blank out the return buffer */
 149:				memset(res, 0, rlen);
 150:			} else {
 151:				memcpy(res, hdw->cmd_buffer + 1, rlen);
 152:			}
 153:		}
 154:	
 155:		LOCK_GIVE(hdw->ctl_lock);
 156:	
 157:		return ret;
 158:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c]

gemini-3-pro-preview

							input: 76208
							output: 56
							thoughts: 54
						

Okay, here's my interpretation of that thought process, assuming I'm already deep in the weeds of this code, likely debugging something hardware-related:

**Diving into the Lock Mechanism**

Ah, right! I see that `pvr2_i2c_read` function is using `hdw->ctl_lock`. That's good; it means we're dealing with proper I2C bus synchronization. But hold on a second... `LOCK_TAKE(hdw->ctl_lock)`... that's a macro, isn't it? I need to quickly verify what that macro actually *does*. I need to check the definition of `LOCK_TAKE` to make sure it's doing precisely what I expect in this context – a spinlock? A mutex? Does it handle priority inversion? I need to be absolutely certain it's behaving as intended so that I can have absolute confidence in my understanding of the concurrency. Gotta verify the exact semantics of that particular macro.

requested entity does not exist

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-i2c-core.c IncludeLines:true Name:LOCK_TAKE]

map[SourceCode: SourceFile:]

gemini-3-pro-preview

							input: 76550
							output: 19
							thoughts: 25
						

Okay, here's my summary, presented as a stream of thought:

**Diving into the PVRUSB2 Code**

Alright, time to get to work. I need to find where the `LOCK_TAKE` macro is used within the `drivers/media/usb/pvrusb2/` directory. That's the starting point. I suspect it's related to some form of resource management or synchronization within the PVRUSB2 driver, but I need to see the context to be sure. Let's see what the grep search turns up, and then I can start piecing together the significance of this lock in that driver's design. The key is understanding how this lock interacts with the rest of the code. This will tell me everything I need to know about where it's taken and released, and how the critical section is managed. I'm expecting to see calls to `mutex_lock` or similar functions, and I'll keep an eye out for potential issues like deadlocks or excessive contention. I'll need to pay close attention to the code around `LOCK_TAKE` and its corresponding release.

map[Expression:define LOCK_TAKE]

map[Output:drivers/media/usb/pvrusb2/pvrusb2-hdw-internal.h-44-
drivers/media/usb/pvrusb2/pvrusb2-hdw-internal.h:45:#define LOCK_TAKE(x) do { mutex_lock(&x##_mutex); x##_held = !0; } while (0)
drivers/media/usb/pvrusb2/pvrusb2-hdw-internal.h-46-#define LOCK_GIVE(x) do { x##_held = 0; mutex_unlock(&x##_mutex); } while (0)
]

gemini-3-pro-preview

							input: 76990
							output: 57
							thoughts: 181
						

**Analyzing Potential Deadlock Scenarios**

Okay, let's break this down. First, `LOCK_TAKE(hdw->ctl_lock)` translates to acquiring `hdw->ctl_lock_mutex`. Simple enough. But I need to consider a potential conflict. If `ir_work` is currently executing `pvr2_i2c_read`, it *also* grabs that same `hdw->ctl_lock_mutex`. That’s my first point of concern.

Then, I have to remember that `ir_work` can be blocked in `pvr2_send_request_ex`, waiting on `hdw->ctl_done`. Importantly, while it's waiting, it *still* maintains that hold on `hdw->ctl_lock_mutex`. But, `hdw->ctl_done` is set when the URB is done, which sounds correct.

Here's the kicker: What if `ir_work` is blocked *within* a `mutex_lock(&hdw->ctl_lock_mutex)`? This is where a deadlock could occur.

So, who *else* might be holding `hdw->ctl_lock_mutex`? I need to analyze all the other locations where `hdw->ctl_lock_mutex` might be acquired. Let's look at `pvr2_hdw_disconnect`. That seems like a prime candidate for a conflict. I have a hunch that's where the problem might arise, so I need to check all of the conditions that trigger that function.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c IncludeLines:true Name:pvr2_hdw_disconnect]

map[SourceCode:2706:	/* Called when hardware has been unplugged */
2707:	void pvr2_hdw_disconnect(struct pvr2_hdw *hdw)
2708:	{
2709:		pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_disconnect(hdw=%p)",hdw);
2710:		LOCK_TAKE(hdw->big_lock);
2711:		pvr2_i2c_core_done(hdw);
2712:		LOCK_TAKE(hdw->ctl_lock);
2713:		pvr2_hdw_remove_usb_stuff(hdw);
2714:		LOCK_GIVE(hdw->ctl_lock);
2715:		LOCK_GIVE(hdw->big_lock);
2716:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c]

gemini-3-pro-preview

							input: 77821
							output: 43
							thoughts: 695
						

**Analyzing a Potential Race Condition in the PVR2 Driver Disconnect Sequence**

Okay, here's what's running through my head. I'm looking at this `pvr2_hdw_disconnect` function, and it's calling `LOCK_TAKE(hdw->big_lock)`. Then it dives into `pvr2_i2c_core_done`, which is a key area of concern. Specifically, `pvr2_i2c_core_done` calls `i2c_del_adapter`, and `i2c_del_adapter` is going to unregister the I2C client devices. This triggers `ir_remove`, which in turn cancels a delayed work item `ir->work` using `cancel_delayed_work_sync(&ir->work)`. The use of `cancel_delayed_work_sync` is a red flag – if `ir_work` is currently running, this will *wait* for it to finish.

The critical question here is whether `ir_work` could be holding a lock that `pvr2_hdw_disconnect` *also* needs, or vice versa. I know that can create a deadlock. Let's see if `pvr2_i2c_read` does it. No, `pvr2_i2c_read` uses `hdw->ctl_lock`. Aha! What if `ir_work` is blocked *on* `hdw->ctl_lock`? But `pvr2_hdw_disconnect` doesn't hold `hdw->ctl_lock` when it calls `pvr2_i2c_core_done`, that lock is acquired *after* calling `pvr2_i2c_core_done`. That means `ir_work` could acquire `hdw->ctl_lock`.

Okay, but what else could be going on? Wait, `ir_work` might be blocked in `pvr2_send_request_ex` waiting for `hdw->ctl_done`. Okay, if `pvr2_send_request_ex` is waiting for `hdw->ctl_done`, who signals it? `pvr2_ctl_write_complete` or `pvr2_ctl_read_complete`. These are URB completion handlers. Now, if the USB device is disconnecting, `usb_disable_device` cancels *all* URBs, so those completion handlers should get called with an error and `hdw->ctl_done` should be completed. But the crucial issue is the order of events. `usb_disable_device` cancels the URBs *after* unregistering the interfaces. This could lead to a race condition.

Let's look at `usb_disable_device` again.
```c
	hub_disconnect_children(udev);

	/* deallocate hcd/hardware state ... nuking all pending urbs and
	 * cleaning up all state associated with the current configuration
	 * so that the hardware is now fully quiesced.
	 */
	dev_dbg(&udev->dev, "unregistering device\n");
	usb_disable_device(udev, 0);
```

Wait, `usb_disable_device` calls `device_del(&interface->dev)`. And this `device_del` function is going to call `bus_remove_device`, which calls `device_release_driver_internal`, which calls `pvr_disconnect`. So `pvr_disconnect` is actually called *during* `usb_disable_device`! This confirms the sequence in the previous part of my analysis.

Wait a second, let's look at `usb_disable_device` *again*. It's cancelling the URBs *after* unregistering the interfaces! This is going to be my crucial area of investigation. This is where the race condition is possible.

map[ContextFile:drivers/usb/core/message.c IncludeLines:true Name:usb_disable_device]

map[SourceCode:1382:	/**
1383:	 * usb_disable_device - Disable all the endpoints for a USB device
1384:	 * @dev: the device whose endpoints are being disabled
1385:	 * @skip_ep0: 0 to disable endpoint 0, 1 to skip it.
1386:	 *
1387:	 * Disables all the device's endpoints, potentially including endpoint 0.
1388:	 * Deallocates hcd/hardware state for the endpoints (nuking all or most
1389:	 * pending urbs) and usbcore state for the interfaces, so that usbcore
1390:	 * must usb_set_configuration() before any interfaces could be used.
1391:	 */
1392:	void usb_disable_device(struct usb_device *dev, int skip_ep0)
1393:	{
1394:		int i;
1395:	
1396:		/* getting rid of interfaces will disconnect
1397:		 * any drivers bound to them (a key side effect)
1398:		 */
1399:		if (dev->actconfig) {
1400:			/*
1401:			 * FIXME: In order to avoid self-deadlock involving the
1402:			 * bandwidth_mutex, we have to mark all the interfaces
1403:			 * before unregistering any of them.
1404:			 */
1405:			for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++)
1406:				dev->actconfig->interface[i]->unregistering = 1;
1407:	
1408:			for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
1409:				struct usb_interface	*interface;
1410:	
1411:				/* remove this interface if it has been registered */
1412:				interface = dev->actconfig->interface[i];
1413:				if (!device_is_registered(&interface->dev))
1414:					continue;
1415:				dev_dbg(&dev->dev, "unregistering interface %s\n",
1416:					dev_name(&interface->dev));
1417:				remove_intf_ep_devs(interface);
1418:				device_del(&interface->dev);
1419:			}
1420:	
1421:			/* Now that the interfaces are unbound, nobody should
1422:			 * try to access them.
1423:			 */
1424:			for (i = 0; i < dev->actconfig->desc.bNumInterfaces; i++) {
1425:				put_device(&dev->actconfig->interface[i]->dev);
1426:				dev->actconfig->interface[i] = NULL;
1427:			}
1428:	
1429:			usb_disable_usb2_hardware_lpm(dev);
1430:			usb_unlocked_disable_lpm(dev);
1431:			usb_disable_ltm(dev);
1432:	
1433:			dev->actconfig = NULL;
1434:			if (dev->state == USB_STATE_CONFIGURED)
1435:				usb_set_device_state(dev, USB_STATE_ADDRESS);
1436:		}
1437:	
1438:		dev_dbg(&dev->dev, "%s nuking %s URBs\n", __func__,
1439:			skip_ep0 ? "non-ep0" : "all");
1440:	
1441:		usb_disable_device_endpoints(dev, skip_ep0);
1442:	}
 SourceFile:drivers/usb/core/message.c]

gemini-3-pro-preview

							input: 80403
							output: 48
							thoughts: 2270
						

**Analysis of a USB Device Disconnect Hang**

Okay, so I'm diving into this disconnect issue, starting with the sequence of events. `usb_disable_device_endpoints` is called after `device_del(&interface->dev)`. This matters because when `pvr_disconnect` is called, URBs haven't been cancelled yet. If `ir_work` is blocked in `pvr2_send_request_ex` waiting for `hdw->ctl_done`, it's waiting for a URB, which might be hung since the device is disconnecting. Now, I do remember that `pvr2_send_request_ex` has a timeout, specifically 4 seconds. But the bug report mentions a hang of 143 seconds. That’s a mismatch.

So, if `ir_work` times out, then it should finish within four seconds. But, this bug is taking far longer. Something else must be blocking Task 1, which is the `i2c_del_adapter` function. `ir_work` calls `mutex_trylock(&ir->lock)`, and if it’s successful, it proceeds to call `ir_key_poll`, which calls `get_key_haup_xvr`. That ultimately calls `i2c_master_send`, which calls `pvr2_i2c_xfer`. This then calls `pvr2_i2c_basic_op`, and finally, `pvr2_i2c_read` or `pvr2_i2c_write`. These latter functions use `hdw->ctl_lock_mutex`.

The question becomes: Is `hdw->ctl_lock_mutex` the culprit? I look at `pvr2_hdw_disconnect`, to see if it’s holding that lock when `pvr2_i2c_core_done` is called. It’s not. So, `ir_work` can acquire it. I need to be sure the lock situation isn’t more complicated.

Okay, is `ir_work` blocked on `hdw->big_lock`? No, because `pvr2_i2c_read` doesn’t acquire `hdw->big_lock`. I need to ensure that `ir_work` isn't blocked on it, so I check `pvr2_i2c_xfer` to confirm it doesn't acquire `hdw->big_lock`.

I shift focus, wondering if Task 2 is the blocker, specifically holding `hdw->ctl_lock` or `hdw->big_lock`. `usbdev_do_ioctl` doesn’t use those locks. Task 2 isn't the problem. But there are no other tasks, according to the bug report. Why is `i2c_del_adapter` hanging?

`i2c_del_adapter` is waiting for `adap->dev_released`. It needs references to be gone. Is it the character device, `i2c-dev`? If user space opens `/dev/i2c-X`, it holds a reference to `i2c_dev`, which holds a reference to `adap->dev`. If the user-space program never closes the file descriptor, then `adap->dev_released` will *never* be completed!

Let’s see: I check `i2c-dev.c` code. `put_i2c_dev` calls `cdev_device_del`, which, if the file descriptor is open, returns but the `i2c_dev` structure isn't freed until `i2cdev_release` is called, which then calls `put_device`. Because `i2c_dev->dev.parent` is `adap->dev`, then `adap->dev`’s reference count is increased when `i2c_dev->dev` is created and decreased when `i2c_dev->dev` is freed. So, if user space has the file descriptor open, then `adap->dev`’s reference count will *never* reach zero. `i2c_del_adapter` will then block forever, and wait for the completion!

Hold on, I see a comment in `i2c_del_adapter`. It describes precisely the scenario: The code is old and should be updated. A reference is held while a user space program has the device open. *This is a known bug!*

Now it clicks: If a user-space program opens `/dev/i2c-X` and the USB device is disconnected, `pvr_disconnect` calls `i2c_del_adapter`, which blocks forever because the file descriptor is still open. If `pvr_disconnect` blocks, it holds

map[ContextFile:drivers/i2c/i2c-dev.c IncludeLines:true Name:i2cdev_open]

map[SourceCode: 598:	static int i2cdev_open(struct inode *inode, struct file *file)
 599:	{
 600:		unsigned int minor = iminor(inode);
 601:		struct i2c_client *client;
 602:		struct i2c_adapter *adap;
 603:	
 604:		adap = i2c_get_adapter(minor);
 605:		if (!adap)
 606:			return -ENODEV;
 607:	
 608:		/* This creates an anonymous i2c_client, which may later be
 609:		 * pointed to some address using I2C_SLAVE or I2C_SLAVE_FORCE.
 610:		 *
 611:		 * This client is ** NEVER REGISTERED ** with the driver model
 612:		 * or I2C core code!!  It just holds private copies of addressing
 613:		 * information and maybe a PEC flag.
 614:		 */
 615:		client = kzalloc(sizeof(*client), GFP_KERNEL);
 616:		if (!client) {
 617:			i2c_put_adapter(adap);
 618:			return -ENOMEM;
 619:		}
 620:		snprintf(client->name, I2C_NAME_SIZE, "i2c-dev %d", adap->nr);
 621:	
 622:		client->adapter = adap;
 623:		file->private_data = client;
 624:	
 625:		return 0;
 626:	}
 SourceFile:drivers/i2c/i2c-dev.c]

gemini-3-pro-preview

							input: 84212
							output: 55
							thoughts: 596
						

**My Analysis of the I2C Adapter Unregistration Bug**

Okay, let's break this down. My initial thought is that `i2c_get_adapter` is calling `get_device(&adap->dev)`. This is key because `i2cdev_open`, therefore, is actually incrementing the reference count of the device associated with the I2C adapter. Then, when a userspace program opens a `/dev/i2c-X` device, and the corresponding USB device is disconnected, `i2c_del_adapter` will block indefinitely within `wait_for_completion(&adap->dev_released)`. Boom, that's the bug.

But is this specific to the `pvrusb2` driver as the bug title suggests? No, this is much more general, and it's happening for *any* I2C adapter that's unregistered while its corresponding `/dev/i2c-X` device is still open. The root cause is the USB device being disconnected, right?

Wait, why doesn't this happen for every I2C adapter then? That's when I understand the issue, it could be because other I2C adapters might not be unregistered while the file descriptor is open. Well, USB devices can be disconnected at any time, which means *any* I2C adapter attached to a USB device, that's what's getting me.

Okay, here's the scenario: User opens `/dev/i2c-X`, USB device is disconnected, and `i2c_del_adapter` blocks. This means `i2c_del_adapter` is blocking the USB disconnect process, so the device cannot be fully removed. That's a severe issue. So this is a general bug in `i2c_del_adapter`! Why is the title specific to `pvrusb2`? Because syzkaller triggered this on that particular driver, but the issue is much broader.

So, can we replicate this? We need a reproducer. It should work like this:

1.  Initialize a `pvrusb2` device (or any USB device with an I2C adapter).
2.  Open `/dev/i2c-X` (the I2C device).
3.  Disconnect the USB device (either using `USBDEVFS_DISCONNECT`, unbinding the driver, etc.).
4.  The disconnect process will then block in `i2c_del_adapter`.
5.  And then we wait for the hung task timeout.

To initialize `pvrusb2` we can probably use `syz_usb_connect` or something. Wait, isn't `pvrusb2` a USB driver? Ok, let's see its USB ID.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-main.c IncludeLines:true Name:pvr2_device_table]

map[SourceCode: 684:	struct usb_device_id pvr2_device_table[] = {
 685:		{ USB_DEVICE(0x2040, 0x2900),
 686:		  .driver_info = (kernel_ulong_t)&pvr2_device_29xxx},
 687:		{ USB_DEVICE(0x2040, 0x2950), /* Logically identical to 2900 */
 688:		  .driver_info = (kernel_ulong_t)&pvr2_device_29xxx},
 689:		{ USB_DEVICE(0x2040, 0x2400),
 690:		  .driver_info = (kernel_ulong_t)&pvr2_device_24xxx},
 691:		{ USB_DEVICE(0x1164, 0x0622),
 692:		  .driver_info = (kernel_ulong_t)&pvr2_device_gotview_2},
 693:		{ USB_DEVICE(0x1164, 0x0602),
 694:		  .driver_info = (kernel_ulong_t)&pvr2_device_gotview_2d},
 695:		{ USB_DEVICE(0x11ba, 0x1003),
 696:		  .driver_info = (kernel_ulong_t)&pvr2_device_onair_creator},
 697:		{ USB_DEVICE(0x11ba, 0x1001),
 698:		  .driver_info = (kernel_ulong_t)&pvr2_device_onair_usb2},
 699:		{ USB_DEVICE(0x2040, 0x7300),
 700:		  .driver_info = (kernel_ulong_t)&pvr2_device_73xxx},
 701:		{ USB_DEVICE(0x2040, 0x7500),
 702:		  .driver_info = (kernel_ulong_t)&pvr2_device_750xx},
 703:		{ USB_DEVICE(0x2040, 0x7501),
 704:		  .driver_info = (kernel_ulong_t)&pvr2_device_751xx},
 705:		{ USB_DEVICE(0x0ccd, 0x0039),
 706:		  .driver_info = (kernel_ulong_t)&pvr2_device_av400},
 707:		{ USB_DEVICE(0x2040, 0x7502),
 708:		  .driver_info = (kernel_ulong_t)&pvr2_device_160111},
 709:		{ USB_DEVICE(0x2040, 0x7510),
 710:		  .driver_info = (kernel_ulong_t)&pvr2_device_160000},
 711:		{ }
 712:	};
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-devattr.c]

gemini-3-pro-preview

							input: 86302
							output: 21
							thoughts: 298
						

**My Approach to Interacting with a pvrusb2 Device**

Okay, so I see that `0x2040:0x2900` identifies a `pvrusb2` device. My plan is to connect a USB device with that ID, triggering the `pvrusb2` driver to probe it. Right, the key is the I2C adapter that `pvrusb2` creates. That adapter is named `pvrusb2`.  I'll want to access it through the standard I2C interface, probably by opening `/dev/i2c-0` (or whatever minor number it gets assigned). Hmm, I'll need to figure out how to determine the minor number. Actually, a brute-force approach might be best: simply try opening all `/dev/i2c-*` devices.

Now, the next stage is disconnecting the USB device. How to do that reliably?  I could use `USBDEVFS_DISCONNECT` on the hub, but if I'm already using something like `syz_usb_connect`, the easier way is probably to just leverage `syz_usb_disconnect` instead. That's assuming I'm building this as part of a syzkaller setup.

Excellent, Syzkaller has those functions, doesn't it? Let me confirm. Ah, here's a good starting point:
```
r0 = syz_usb_connect(0, 0x2040, 0x2900, 0, 0, 0, 0)
```
Looks like `syz_usb_connect` takes quite a few arguments. Better to check the definition in `sys/linux/dev_vhci.txt` to make sure I understand them correctly.

map[File:dev_vhci.txt]

map[Output:# Copyright 2020 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <net/bluetooth/bluetooth.h>
include <net/bluetooth/hci_sock.h>
include <net/bluetooth/sco.h>
include <net/bluetooth/hci.h>

syz_emit_vhci(data ptr[in, vhci_pkt], size bytesize[data])

# Matches HCI_HANDLE_1/HCI_HANDLE_2 in executor/common_linux.h.
hci_handles = 200, 201
type hci_conn_handle flags[hci_handles, int16]
type hci_phy_handle flags[hci_handles, int8]

vhci_pkt [
	HCI_EVENT_PKT	vhci_event_pkt
	HCI_ACLDATA_PKT	vhci_acldata_pkt
	HCI_SCODATA_PKT	vhci_scodata_pkt
	HCI_VENDOR_PKT	vhci_vendor_pkt
] [varlen]

vhci_command_pkt {
	cmd	const[HCI_COMMAND_PKT, int8]
	hdr	hci_command_hdr_un
}

vhci_event_pkt {
	cmd	const[HCI_EVENT_PKT, int8]
	hdr	hci_event_hdr_un
}

vhci_acldata_pkt {
	cmd		const[HCI_ACLDATA_PKT, int8]
	acl_hdr		hci_acl_hdr[vhci_acldata_pkt:l2cap_hdr]
	l2cap_hdr	l2cap_hdr_un
}

vhci_scodata_pkt {
	cmd	const[HCI_SCODATA_PKT, int8]
	sco_hdr	hci_sco_hdr[vhci_scodata_pkt:data]
	data	array[int8]
}

vhci_vendor_pkt {
	cmd	const[HCI_VENDOR_PKT, int8]
	opcode	flags[vhci_vendor_pkt_opcode, int8]
}

define HCI_PRIMARY	0x00
define HCI_AMP	0x01

vhci_vendor_pkt_opcode = HCI_PRIMARY, HCI_AMP, HCI_EXTERNAL_CONFIG, HCI_RAW_DEVICE

type hci_acl_hdr[DATA] {
	handle	flags[hci_handles, int16:12]
	pb	int16:2
	bc	int16:2
	dlen	bytesize[DATA, int16]
} [packed]

type hci_sco_hdr[DATA] {
	handle	hci_conn_handle
	dlen	bytesize[DATA, int8]
} [packed]

ext_flow_spec {
	id		int8
	stype		int8
	msdu		int16
	sdu_itime	int32
	acc_lat		int32
	flush_to	int32
} [packed]

hci_cis {
	cis_handle	int16
	acl_handle	int16
} [packed]

hci_cis_params {
	cis_id	int8
	m_sdu	int16
	s_sdu	int16
	m_phy	int8
	s_phy	int8
	m_rtn	int8
	s_rtn	int8
} [packed]

# TODO: remove these definitions when they are no more present in LTS kernels.
define HCI_OP_CREATE_PHY_LINK	0x0435
define HCI_OP_ACCEPT_PHY_LINK	0x0436
define HCI_OP_DISCONN_PHY_LINK	0x0437
define HCI_OP_CREATE_LOGICAL_LINK	0x0438
define HCI_OP_ACCEPT_LOGICAL_LINK	0x0439
define HCI_OP_DISCONN_LOGICAL_LINK	0x043a
define HCI_OP_LOGICAL_LINK_CANCEL	0x043b
define HCI_OP_READ_LOCAL_AMP_INFO	0x1409
define HCI_OP_READ_LOCAL_AMP_ASSOC	0x140a
define HCI_OP_WRITE_REMOTE_AMP_ASSOC	0x140b

hci_command_hdr_un [
	accept_conn_req			hci_command_packet_t[HCI_OP_ACCEPT_CONN_REQ, hci_cp_accept_conn_req]
	accept_phy_link			hci_command_packet_t[HCI_OP_ACCEPT_PHY_LINK, hci_cp_accept_phy_link]
	accept_sync_conn_req		hci_command_packet_t[HCI_OP_ACCEPT_SYNC_CONN_REQ, hci_cp_accept_sync_conn_req]
	add_sco				hci_command_packet_t[HCI_OP_ADD_SCO, hci_cp_add_sco]
	auth_requested			hci_command_packet_t[HCI_OP_AUTH_REQUESTED, hci_cp_auth_requested]
	change_conn_link_key		hci_command_packet_t[HCI_OP_CHANGE_CONN_LINK_KEY, hci_cp_change_conn_link_key]
	change_conn_ptype		hci_command_packet_t[HCI_OP_CHANGE_CONN_PTYPE, hci_cp_change_conn_ptype]
	create_logical_link		hci_command_packet_t[HCI_OP_CREATE_LOGICAL_LINK, hci_cp_create_accept_logical_link]
	accept_logical_link		hci_command_packet_t[HCI_OP_ACCEPT_LOGICAL_LINK, hci_cp_create_accept_logical_link]
	create_conn			hci_command_packet_t[HCI_OP_CREATE_CONN, hci_cp_create_conn]
	create_conn_cancel		hci_command_packet_t[HCI_OP_CREATE_CONN_CANCEL, hci_cp_create_conn_cancel]
	create_phy_link			hci_command_packet_t[HCI_OP_CREATE_PHY_LINK, hci_cp_create_phy_link]
	delete_reserved_lt_addr		hci_command_packet_t[HCI_OP_DELETE_RESERVED_LT_ADDR, hci_cp_delete_reserved_lt_addr]
	delete_stored_link_key		hci_command_packet_t[HCI_OP_DELETE_STORED_LINK_KEY, hci_cp_delete_stored_link_key]
	disconn_logical_link		hci_command_packet_t[HCI_OP_DISCONN_LOGICAL_LINK, hci_cp_disconn_logical_link]
	disconn_phy_link		hci_command_packet_t[HCI_OP_DISCONN_PHY_LINK, hci_cp_disconn_phy_link]
	disconnect			hci_command_packet_t[HCI_OP_DISCONNECT, hci_cp_disconnect]
	exit_sniff_mode			hci_command_packet_t[HCI_OP_EXIT_SNIFF_MODE, hci_cp_exit_sniff_mode]
	host_buffer_size		hci_command_packet_t[HCI_OP_HOST_BUFFER_SIZE, hci_cp_host_buffer_size]
	inquiry				hci_command_packet_t[HCI_OP_INQUIRY, hci_cp_inquiry]
	io_capability_neg_reply		hci_command_packet_t[HCI_OP_IO_CAPABILITY_NEG_REPLY, hci_cp_io_capability_neg_reply]
	io_capability_reply		hci_command_packet_t[HCI_OP_IO_CAPABILITY_REPLY, hci_cp_io_capability_reply]
	le_accept_cis			hci_command_packet_t[HCI_OP_LE_ACCEPT_CIS, hci_cp_le_accept_cis]
	le_add_to_resolv_list		hci_command_packet_t[HCI_OP_LE_ADD_TO_RESOLV_LIST, hci_cp_le_add_to_resolv_list]
	le_add_to_accept_list		hci_command_packet_t[HCI_OP_LE_ADD_TO_ACCEPT_LIST, hci_cp_le_add_to_accept_list]
	le_conn_param_req_neg_reply	hci_command_packet_t[HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, hci_cp_le_conn_param_req_neg_reply]
	le_conn_param_req_reply		hci_command_packet_t[HCI_OP_LE_CONN_PARAM_REQ_REPLY, hci_cp_le_conn_param_req_reply]
	le_conn_update			hci_command_packet_t[HCI_OP_LE_CONN_UPDATE, hci_cp_le_conn_update]
	le_create_cis			hci_command_packet_t[HCI_OP_LE_CREATE_CIS, hci_cp_le_create_cis]
	le_create_conn			hci_command_packet_t[HCI_OP_LE_CREATE_CONN, hci_cp_le_create_conn]
	le_del_from_resolv_list		hci_command_packet_t[HCI_OP_LE_DEL_FROM_RESOLV_LIST, hci_cp_le_del_from_resolv_list]
	le_del_from_accept_list		hci_command_packet_t[HCI_OP_LE_DEL_FROM_ACCEPT_LIST, hci_cp_le_del_from_accept_list]
	le_ext_create_conn		hci_command_packet_t[HCI_OP_LE_EXT_CREATE_CONN, hci_cp_le_ext_create_conn]
	le_ltk_neg_reply		hci_command_packet_t[HCI_OP_LE_LTK_NEG_REPLY, hci_cp_le_ltk_neg_reply]
	le_ltk_reply			hci_command_packet_t[HCI_OP_LE_LTK_REPLY, hci_cp_le_ltk_reply]
	le_read_iso_tx_sync		hci_command_packet_t[HCI_OP_LE_READ_ISO_TX_SYNC, hci_cp_le_read_iso_tx_sync]
	le_read_remote_features		hci_command_packet_t[HCI_OP_LE_READ_REMOTE_FEATURES, hci_cp_le_read_remote_features]
	le_reject_cis			hci_command_packet_t[HCI_OP_LE_REJECT_CIS, hci_cp_le_reject_cis]
	le_remove_cig			hci_command_packet_t[HCI_OP_LE_REMOVE_CIG, hci_cp_le_remove_cig]
	le_set_adv_data			hci_command_packet_t[HCI_OP_LE_SET_ADV_DATA, hci_cp_le_set_adv_data]
	le_set_adv_param		hci_command_packet_t[HCI_OP_LE_SET_ADV_PARAM, hci_cp_le_set_adv_param]
	le_set_adv_set_rand_addr	hci_command_packet_t[HCI_OP_LE_SET_ADV_SET_RAND_ADDR, hci_cp_le_set_adv_set_rand_addr]
	le_set_cig_params		hci_command_packet_t[HCI_OP_LE_SET_CIG_PARAMS, hci_cp_le_set_cig_params]
	le_set_data_len			hci_command_packet_t[HCI_OP_LE_SET_DATA_LEN, hci_cp_le_set_data_len]
	le_set_default_phy		hci_command_packet_t[HCI_OP_LE_SET_DEFAULT_PHY, hci_cp_le_set_default_phy]
	le_set_event_mask		hci_command_packet_t[HCI_OP_LE_SET_EVENT_MASK, hci_cp_le_set_event_mask]
	le_set_ext_adv_data		hci_command_packet_t[HCI_OP_LE_SET_EXT_ADV_DATA, hci_cp_le_set_ext_adv_data]
	le_set_ext_adv_enable		hci_command_packet_t[HCI_OP_LE_SET_EXT_ADV_ENABLE, hci_cp_le_set_ext_adv_enable]
	le_set_ext_adv_params		hci_command_packet_t[HCI_OP_LE_SET_EXT_ADV_PARAMS, hci_cp_le_set_ext_adv_params]
	le_set_ext_scan_enable		hci_command_packet_t[HCI_OP_LE_SET_EXT_SCAN_ENABLE, hci_cp_le_set_ext_scan_enable]
	le_set_ext_scan_params		hci_command_packet_t[HCI_OP_LE_SET_EXT_SCAN_PARAMS, hci_cp_le_set_ext_scan_params]
	le_set_ext_scan_rsp_data	hci_command_packet_t[HCI_OP_LE_SET_EXT_SCAN_RSP_DATA, hci_cp_le_set_ext_scan_rsp_data]
	le_set_scan_enable		hci_command_packet_t[HCI_OP_LE_SET_SCAN_ENABLE, hci_cp_le_set_scan_enable]
	le_set_scan_param		hci_command_packet_t[HCI_OP_LE_SET_SCAN_PARAM, hci_cp_le_set_scan_param]
	le_set_scan_rsp_data		hci_command_packet_t[HCI_OP_LE_SET_SCAN_RSP_DATA, hci_cp_le_set_scan_rsp_data]
	le_start_enc			hci_command_packet_t[HCI_OP_LE_START_ENC, hci_cp_le_start_enc]
	le_write_def_data_len		hci_command_packet_t[HCI_OP_LE_WRITE_DEF_DATA_LEN, hci_cp_le_write_def_data_len]
	link_key_neg_reply		hci_command_packet_t[HCI_OP_LINK_KEY_NEG_REPLY, hci_cp_link_key_neg_reply]
	link_key_reply			hci_command_packet_t[HCI_OP_LINK_KEY_REPLY, hci_cp_link_key_reply]
	logical_link_cancel		hci_command_packet_t[HCI_OP_LOGICAL_LINK_CANCEL, hci_cp_logical_link_cancel]
	pin_code_neg_reply		hci_command_packet_t[HCI_OP_PIN_CODE_NEG_REPLY, hci_cp_pin_code_neg_reply]
	pin_code_reply			hci_command_packet_t[HCI_OP_PIN_CODE_REPLY, hci_cp_pin_code_reply]
	read_auth_payload_to		hci_command_packet_t[HCI_OP_READ_AUTH_PAYLOAD_TO, hci_cp_read_auth_payload_to]
	read_clock			hci_command_packet_t[HCI_OP_READ_CLOCK, hci_cp_read_clock]
	read_clock_offset		hci_command_packet_t[HCI_OP_READ_CLOCK_OFFSET, hci_cp_read_clock_offset]
	read_enc_key_size		hci_command_packet_t[HCI_OP_READ_ENC_KEY_SIZE, hci_cp_read_enc_key_size]
	read_link_policy		hci_command_packet_t[HCI_OP_READ_LINK_POLICY, hci_cp_read_link_policy]
	read_local_amp_assoc		hci_command_packet_t[HCI_OP_READ_LOCAL_AMP_ASSOC, hci_cp_read_local_amp_assoc]
	read_local_ext_features		hci_command_packet_t[HCI_OP_READ_LOCAL_EXT_FEATURES, hci_cp_read_local_ext_features]
	read_remote_ext_features	hci_command_packet_t[HCI_OP_READ_REMOTE_EXT_FEATURES, hci_cp_read_remote_ext_features]
	read_remote_features		hci_command_packet_t[HCI_OP_READ_REMOTE_FEATURES, hci_cp_read_remote_features]
	read_remote_version		hci_command_packet_t[HCI_OP_READ_REMOTE_VERSION, hci_cp_read_remote_version]
	read_rssi			hci_command_packet_t[HCI_OP_READ_RSSI, hci_cp_read_rssi]
	read_stored_link_key		hci_command_packet_t[HCI_OP_READ_STORED_LINK_KEY, hci_cp_read_stored_link_key]
	read_tx_power			hci_command_packet_t[HCI_OP_READ_TX_POWER, hci_cp_read_tx_power]
	reject_conn_req			hci_command_packet_t[HCI_OP_REJECT_CONN_REQ, hci_cp_reject_conn_req]
	reject_sync_conn_req		hci_command_packet_t[HCI_OP_REJECT_SYNC_CONN_REQ, hci_cp_reject_sync_conn_req]
	remote_name_req			hci_command_packet_t[HCI_OP_REMOTE_NAME_REQ, hci_cp_remote_name_req]
	remote_name_req_cancel		hci_command_packet_t[HCI_OP_REMOTE_NAME_REQ_CANCEL, hci_cp_remote_name_req_cancel]
	remote_oob_data_neg_reply	hci_command_packet_t[HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, hci_cp_remote_oob_data_neg_reply]
	remote_oob_data_reply		hci_command_packet_t[HCI_OP_REMOTE_OOB_DATA_REPLY, hci_cp_remote_oob_data_reply]
	remote_oob_ext_data_reply	hci_command_packet_t[HCI_OP_REMOTE_OOB_EXT_DATA_REPLY, hci_cp_remote_oob_ext_data_reply]
	role_discovery			hci_command_packet_t[HCI_OP_ROLE_DISCOVERY, hci_cp_role_discovery]
	set_conn_encrypt		hci_command_packet_t[HCI_OP_SET_CONN_ENCRYPT, hci_cp_set_conn_encrypt]
	set_cpb				hci_command_packet_t[HCI_OP_SET_CPB, hci_cp_set_cpb]
	set_cpb_data			hci_command_packet_t[HCI_OP_SET_CPB_DATA, hci_cp_set_cpb_data]
	set_reserved_lt_addr		hci_command_packet_t[HCI_OP_SET_RESERVED_LT_ADDR, hci_cp_set_reserved_lt_addr]
	setup_sync_conn			hci_command_packet_t[HCI_OP_SETUP_SYNC_CONN, hci_cp_setup_sync_conn]
	sniff_mode			hci_command_packet_t[HCI_OP_SNIFF_MODE, hci_cp_sniff_mode]
	sniff_subrate			hci_command_packet_t[HCI_OP_SNIFF_SUBRATE, hci_cp_sniff_subrate]
	switch_role			hci_command_packet_t[HCI_OP_SWITCH_ROLE, hci_cp_switch_role]
	user_confirm_reply		hci_command_packet_t[HCI_OP_USER_CONFIRM_REPLY, hci_cp_user_confirm_reply]
	user_passkey_reply		hci_command_packet_t[HCI_OP_USER_PASSKEY_REPLY, hci_cp_user_passkey_reply]
	write_auth_payload_to		hci_command_packet_t[HCI_OP_WRITE_AUTH_PAYLOAD_TO, hci_cp_write_auth_payload_to]
	write_class_of_dev		hci_command_packet_t[HCI_OP_WRITE_CLASS_OF_DEV, hci_cp_write_class_of_dev]
	write_current_iac_lap		hci_command_packet_t[HCI_OP_WRITE_CURRENT_IAC_LAP, hci_cp_write_current_iac_lap]
	write_def_err_data_reporting	hci_command_packet_t[HCI_OP_WRITE_DEF_ERR_DATA_REPORTING, hci_cp_write_def_err_data_reporting]
	write_def_link_policy		hci_command_packet_t[HCI_OP_WRITE_DEF_LINK_POLICY, hci_cp_write_def_link_policy]
	write_eir			hci_command_packet_t[HCI_OP_WRITE_EIR, hci_cp_write_eir]
	write_le_host_supported		hci_command_packet_t[HCI_OP_WRITE_LE_HOST_SUPPORTED, hci_cp_write_le_host_supported]
	write_link_policy		hci_command_packet_t[HCI_OP_WRITE_LINK_POLICY, hci_cp_write_link_policy]
	write_local_name		hci_command_packet_t[HCI_OP_WRITE_LOCAL_NAME, hci_cp_write_local_name]
	write_page_scan_activity	hci_command_packet_t[HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, hci_cp_write_page_scan_activity]
	write_remote_amp_assoc		hci_command_packet_t[HCI_OP_WRITE_REMOTE_AMP_ASSOC, hci_cp_write_remote_amp_assoc]
	write_sc_support		hci_command_packet_t[HCI_OP_WRITE_SC_SUPPORT, hci_cp_write_sc_support]
	write_ssp_mode			hci_command_packet_t[HCI_OP_WRITE_SSP_MODE, hci_cp_write_ssp_mode]
	write_sync_train_params		hci_command_packet_t[HCI_OP_WRITE_SYNC_TRAIN_PARAMS, hci_cp_write_sync_train_params]
	write_voice_setting		hci_command_packet_t[HCI_OP_WRITE_VOICE_SETTING, hci_cp_write_voice_setting]
] [varlen]

type hci_command_packet_t[OPCODE, PAYLOAD] {
	hdr	hci_command_packet[OPCODE]
	payload	PAYLOAD
} [packed]

type hci_command_packet[OPCODE] {
	opcode	const[OPCODE, int16]
	plen	bytesize[hci_command_packet_t:payload, int8]
} [packed]

hci_cp_accept_conn_req {
	bdaddr	bdaddr_t
	role	int8
} [packed]

hci_cp_accept_phy_link {
	phy_handle	hci_phy_handle
	key_len		int8
	key_type	int8
	key		array[int8]
} [packed]

hci_cp_accept_sync_conn_req {
	bdaddr		bdaddr_t
	tx_bandwidth	int32
	rx_bandwidth	int32
	max_latency	int16
	content_format	int16
	retrans_effort	int8
	pkt_type	int16
} [packed]

hci_cp_add_sco {
	handle		hci_conn_handle
	pkt_type	int16
} [packed]

hci_cp_auth_requested {
	handle	hci_conn_handle
} [packed]

hci_cp_change_conn_link_key {
	handle	hci_conn_handle
} [packed]

hci_cp_change_conn_ptype {
	handle		hci_conn_handle
	pkt_type	int16
} [packed]

hci_cp_create_accept_logical_link {
	phy_handle	hci_phy_handle
	tx_flow_spec	ext_flow_spec
	rx_flow_spec	ext_flow_spec
} [packed]

hci_cp_create_conn {
	bdaddr		bdaddr_t
	pkt_type	int16
	pscan_rep_mode	int8
	pscan_mode	int8
	clock_offset	int16
	role_switch	int8
} [packed]

hci_cp_create_conn_cancel {
	bdaddr	bdaddr_t
} [packed]

hci_cp_create_phy_link {
	phy_handle	hci_phy_handle
	key_len		int8
	key_type	int8
	key		array[int8]
} [packed]

hci_cp_delete_reserved_lt_addr {
	lt_addr	int8
} [packed]

hci_cp_delete_stored_link_key {
	bdaddr		bdaddr_t
	delete_all	int8
} [packed]

hci_cp_disconn_logical_link {
	log_handle	int16
} [packed]

hci_cp_disconn_phy_link {
	phy_handle	hci_phy_handle
	reason		int8
} [packed]

hci_cp_disconnect {
	handle	hci_conn_handle
	reason	int8
} [packed]

hci_cp_exit_sniff_mode {
	handle	hci_conn_handle
} [packed]

hci_cp_host_buffer_size {
	acl_mtu		int16
	sco_mtu		int8
	acl_max_pkt	int16
	sco_max_pkt	int16
} [packed]

hci_cp_inquiry {
	lap	array[int8, 3]
	length	int8
	num_rsp	int8
} [packed]

hci_cp_io_capability_neg_reply {
	bdaddr	bdaddr_t
	reason	int8
} [packed]

hci_cp_io_capability_reply {
	bdaddr		bdaddr_t
	capability	int8
	oob_data	int8
	authentication	int8
} [packed]

hci_cp_le_accept_cis {
	handle	hci_conn_handle
} [packed]

hci_cp_le_add_to_resolv_list {
	bdaddr_type	int8
	bdaddr		bdaddr_t
	peer_irk	array[int8, 16]
	local_irk	array[int8, 16]
} [packed]

hci_cp_le_add_to_accept_list {
	bdaddr_type	int8
	bdaddr		bdaddr_t
} [packed]

hci_cp_le_conn_param_req_neg_reply {
	handle	hci_conn_handle
	reason	int8
} [packed]

hci_cp_le_conn_param_req_reply {
	handle		hci_conn_handle
	interval_min	int16
	interval_max	int16
	latency		int16
	timeout		int16
	min_ce_len	int16
	max_ce_len	int16
} [packed]

hci_cp_le_conn_update {
	handle			hci_conn_handle
	conn_interval_min	int16
	conn_interval_max	int16
	conn_latency		int16
	supervision_timeout	int16
	min_ce_len		int16
	max_ce_len		int16
} [packed]

hci_cp_le_create_cis {
	num_cis	len[cis, int8]
	cis	array[hci_cis]
} [packed]

hci_cp_le_create_conn {
	scan_interval		int16
	scan_window		int16
	filter_policy		int8
	peer_addr_type		int8
	peer_addr		bdaddr_t
	own_address_type	int8
	conn_interval_min	int16
	conn_interval_max	int16
	conn_latency		int16
	supervision_timeout	int16
	min_ce_len		int16
	max_ce_len		int16
} [packed]

hci_cp_le_del_from_resolv_list {
	bdaddr_type	int8
	bdaddr		bdaddr_t
} [packed]

hci_cp_le_del_from_accept_list {
	bdaddr_type	int8
	bdaddr		bdaddr_t
} [packed]

hci_cp_le_ext_create_conn {
	filter_policy	int8
	own_addr_type	int8
	peer_addr_type	int8
	peer_addr	bdaddr_t
	phys		int8
	data		array[int8]
} [packed]

hci_cp_le_ltk_neg_reply {
	handle	hci_conn_handle
} [packed]

hci_cp_le_ltk_reply {
	handle	hci_conn_handle
	ltk	array[int8, 16]
} [packed]

hci_cp_le_read_iso_tx_sync {
	handle	hci_conn_handle
} [packed]

hci_cp_le_read_remote_features {
	handle	hci_conn_handle
} [packed]

hci_cp_le_reject_cis {
	handle	hci_conn_handle
	reason	int8
} [packed]

hci_cp_le_remove_cig {
	cig_id	int8
} [packed]

hci_cp_le_set_adv_data {
	length	int8
	data	array[int8, 31]
} [packed]

hci_cp_le_set_adv_param {
	min_interval		int16
	max_interval		int16
	type			int8
	own_address_type	int8
	direct_addr_type	int8
	direct_addr		bdaddr_t
	channel_map		int8
	filter_policy		int8
} [packed]

hci_cp_le_set_adv_set_rand_addr {
	handle	int8
	bdaddr	bdaddr_t
} [packed]

hci_cp_le_set_cig_params {
	cig_id		int8
	m_interval	array[int8, 3]
	s_interval	array[int8, 3]
	sca		int8
	packing		int8
	framing		int8
	m_latency	int16
	s_latency	int16
	num_cis		len[cis, int8]
	cis		array[hci_cis_params]
} [packed]

hci_cp_le_set_data_len {
	handle	hci_conn_handle
	tx_len	int16
	tx_time	int16
} [packed]

hci_cp_le_set_default_phy {
	all_phys	int8
	tx_phys		int8
	rx_phys		int8
} [packed]

hci_cp_le_set_event_mask {
	mask	array[int8, 8]
} [packed]

hci_cp_le_set_ext_adv_data {
	handle		int8
	operation	int8
	frag_pref	int8
	length		int8
	data		array[int8, 31]
} [packed]

hci_cp_le_set_ext_adv_enable {
	enable		int8
	num_of_sets	int8
	data		array[int8]
} [packed]

hci_cp_le_set_ext_adv_params {
	handle			int8
	evt_properties		int16
	min_interval		array[int8, 3]
	max_interval		array[int8, 3]
	channel_map		int8
	own_addr_type		int8
	peer_addr_type		int8
	peer_addr		bdaddr_t
	filter_policy		int8
	tx_power		int8
	primary_phy		int8
	secondary_max_skip	int8
	secondary_phy		int8
	sid			int8
	notif_enable		int8
} [packed]

hci_cp_le_set_ext_scan_enable {
	enable		int8
	filter_dup	int8
	duration	int16
	period		int16
} [packed]

hci_cp_le_set_ext_scan_params {
	own_addr_type	int8
	filter_policy	int8
	scanning_phys	int8
	data		array[int8]
} [packed]

hci_cp_le_set_ext_scan_rsp_data {
	handle		int8
	operation	int8
	frag_pref	int8
	length		int8
	data		array[int8, 31]
} [packed]

hci_cp_le_set_scan_enable {
	enable		int8
	filter_dup	int8
} [packed]

hci_cp_le_set_scan_param {
	type			int8
	interval		int16
	window			int16
	own_address_type	int8
	filter_policy		int8
} [packed]

hci_cp_le_set_scan_rsp_data {
	length	int8
	data	array[int8, 31]
} [packed]

hci_cp_le_start_enc {
	handle	hci_conn_handle
	rand	int64
	ediv	int16
	ltk	array[int8, 16]
} [packed]

hci_cp_le_write_def_data_len {
	tx_len	int16
	tx_time	int16
} [packed]

hci_cp_link_key_neg_reply {
	bdaddr	bdaddr_t
} [packed]

hci_cp_link_key_reply {
	bdaddr		bdaddr_t
	link_key	array[int8, 16]
} [packed]

hci_cp_logical_link_cancel {
	phy_handle	hci_phy_handle
	flow_spec_id	int8
} [packed]

hci_cp_pin_code_neg_reply {
	bdaddr	bdaddr_t
} [packed]

hci_cp_pin_code_reply {
	bdaddr		bdaddr_t
	pin_len		int8
	pin_code	array[int8, 16]
} [packed]

hci_cp_read_auth_payload_to {
	handle	hci_conn_handle
} [packed]

hci_cp_read_clock {
	handle	hci_conn_handle
	which	int8
} [packed]

hci_cp_read_clock_offset {
	handle	hci_conn_handle
} [packed]

hci_cp_read_enc_key_size {
	handle	hci_conn_handle
} [packed]

hci_cp_read_link_policy {
	handle	hci_conn_handle
} [packed]

hci_cp_read_local_amp_assoc {
	phy_handle	hci_phy_handle
	len_so_far	int16
	max_len		int16
} [packed]

hci_cp_read_local_ext_features {
	page	int8
} [packed]

hci_cp_read_remote_ext_features {
	handle	hci_conn_handle
	page	int8
} [packed]

hci_cp_read_remote_features {
	handle	hci_conn_handle
} [packed]

hci_cp_read_remote_version {
	handle	hci_conn_handle
} [packed]

hci_cp_read_rssi {
	handle	hci_conn_handle
} [packed]

hci_cp_read_stored_link_key {
	bdaddr		bdaddr_t
	read_all	int8
} [packed]

hci_cp_read_tx_power {
	handle	hci_conn_handle
	type	int8
} [packed]

hci_cp_reject_conn_req {
	bdaddr	bdaddr_t
	reason	int8
} [packed]

hci_cp_reject_sync_conn_req {
	bdaddr	bdaddr_t
	reason	int8
} [packed]

hci_cp_remote_name_req {
	bdaddr		bdaddr_t
	pscan_rep_mode	int8
	pscan_mode	int8
	clock_offset	int16
} [packed]

hci_cp_remote_name_req_cancel {
	bdaddr	bdaddr_t
} [packed]

hci_cp_remote_oob_data_neg_reply {
	bdaddr	bdaddr_t
} [packed]

hci_cp_remote_oob_data_reply {
	bdaddr	bdaddr_t
	hash	array[int8, 16]
	rand	array[int8, 16]
} [packed]

hci_cp_remote_oob_ext_data_reply {
	bdaddr	bdaddr_t
	hash192	array[int8, 16]
	rand192	array[int8, 16]
	hash256	array[int8, 16]
	rand256	array[int8, 16]
} [packed]

hci_cp_role_discovery {
	handle	hci_conn_handle
} [packed]

hci_cp_set_conn_encrypt {
	handle	hci_conn_handle
	encrypt	int8
} [packed]

hci_cp_set_cpb {
	enable		int8
	lt_addr		int8
	lpo_allowed	int8
	packet_type	int16
	interval_min	int16
	interval_max	int16
	cpb_sv_tout	int16
} [packed]

hci_cp_set_cpb_data {
	lt_addr		int8
	fragment	int8
	data_length	int8
	data		array[int8, 252]
} [packed]

hci_cp_set_reserved_lt_addr {
	lt_addr	int8
} [packed]

hci_cp_setup_sync_conn {
	handle		hci_conn_handle
	tx_bandwidth	int32
	rx_bandwidth	int32
	max_latency	int16
	voice_setting	int16
	retrans_effort	int8
	pkt_type	int16
} [packed]

hci_cp_sniff_mode {
	handle		hci_conn_handle
	max_interval	int16
	min_interval	int16
	attempt		int16
	timeout		int16
} [packed]

hci_cp_sniff_subrate {
	handle			hci_conn_handle
	max_latency		int16
	min_remote_timeout	int16
	min_local_timeout	int16
} [packed]

hci_cp_switch_role {
	bdaddr	bdaddr_t
	role	int8
} [packed]

hci_cp_user_confirm_reply {
	bdaddr	bdaddr_t
} [packed]

hci_cp_user_passkey_reply {
	bdaddr	bdaddr_t
	passkey	int32
} [packed]

hci_cp_write_auth_payload_to {
	handle	hci_conn_handle
	timeout	int16
} [packed]

hci_cp_write_class_of_dev {
	dev_class	array[int8, 3]
} [packed]

hci_cp_write_current_iac_lap {
	num_iac	len[iac_lap, int8]
	iac_lap	array[int8, 6]
} [packed]

hci_cp_write_def_err_data_reporting {
	err_data_reporting	int8
} [packed]

hci_cp_write_def_link_policy {
	policy	int16
} [packed]

hci_cp_write_eir {
	fec	int8
	data	array[int8, 240]
} [packed]

hci_cp_write_le_host_supported {
	le	int8
	simul	int8
} [packed]

hci_cp_write_link_policy {
	handle	hci_conn_handle
	policy	int16
} [packed]

hci_cp_write_local_name {
	name	array[int8, 248]
} [packed]

hci_cp_write_page_scan_activity {
	interval	int16
	window		int16
} [packed]

hci_cp_write_remote_amp_assoc {
	phy_handle	hci_phy_handle
	len_so_far	int16
	rem_len		int16
	frag		array[int8]
} [packed]

hci_cp_write_sc_support {
	support	int8
} [packed]

hci_cp_write_ssp_mode {
	mode	int8
} [packed]

hci_cp_write_sync_train_params {
	interval_min	int16
	interval_max	int16
	sync_train_tout	int32
	service_data	int8
} [packed]

hci_cp_write_voice_setting {
	voice_setting	int16
} [packed]

hci_event_hdr_un [
	HCI_EV_INQUIRY_COMPLETE			hci_event_hdr_t[HCI_EV_INQUIRY_COMPLETE, int8]
	extended_inquiry_info			hci_event_hdr_t[HCI_EV_EXTENDED_INQUIRY_RESULT, extended_inquiry_info_t]
	hci_ev_auth_complete			hci_event_hdr_t[HCI_EV_AUTH_COMPLETE, hci_ev_auth_complete]
	hci_ev_change_link_key_complete		hci_event_hdr_t[HCI_EV_CHANGE_LINK_KEY_COMPLETE, hci_ev_change_link_key_complete]
	hci_ev_channel_selected			hci_event_hdr_t[HCI_EV_CHANNEL_SELECTED, hci_ev_channel_selected]
	hci_ev_clock_offset			hci_event_hdr_t[HCI_EV_CLOCK_OFFSET, hci_ev_clock_offset]
	hci_ev_cmd_complete			hci_event_hdr_t[HCI_EV_CMD_COMPLETE, hci_ev_cmd_complete_un]
	hci_ev_cmd_status			hci_event_hdr_t[HCI_EV_CMD_STATUS, hci_ev_cmd_status]
	hci_ev_conn_complete			hci_event_hdr_t[HCI_EV_CONN_COMPLETE, hci_ev_conn_complete]
	hci_ev_conn_request			hci_event_hdr_t[HCI_EV_CONN_REQUEST, hci_ev_conn_request]
	hci_ev_disconn_complete			hci_event_hdr_t[HCI_EV_DISCONN_COMPLETE, hci_ev_disconn_complete]
	hci_ev_disconn_logical_link_complete	hci_event_hdr_t[HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE, hci_ev_disconn_logical_link_complete]
	hci_ev_disconn_phy_link_complete	hci_event_hdr_t[HCI_EV_DISCONN_PHY_LINK_COMPLETE, hci_ev_disconn_phy_link_complete]
	hci_ev_encrypt_change			hci_event_hdr_t[HCI_EV_ENCRYPT_CHANGE, hci_ev_encrypt_change]
	hci_ev_hardware_error			hci_event_hdr_t[HCI_EV_HARDWARE_ERROR, hci_ev_hardware_error]
	hci_ev_io_capa_reply			hci_event_hdr_t[HCI_EV_IO_CAPA_REPLY, hci_ev_io_capa_reply]
	hci_ev_io_capa_request			hci_event_hdr_t[HCI_EV_IO_CAPA_REQUEST, hci_ev_io_capa_request]
	hci_ev_key_refresh_complete		hci_event_hdr_t[HCI_EV_KEY_REFRESH_COMPLETE, hci_ev_key_refresh_complete]
	hci_ev_keypress_notify			hci_event_hdr_t[HCI_EV_KEYPRESS_NOTIFY, hci_ev_keypress_notify]
	hci_ev_le_meta				hci_event_hdr_t[HCI_EV_LE_META, hci_ev_le_meta_un]
	hci_ev_link_key_notify			hci_event_hdr_t[HCI_EV_LINK_KEY_NOTIFY, hci_ev_link_key_notify]
	hci_ev_link_key_req			hci_event_hdr_t[HCI_EV_LINK_KEY_REQ, hci_ev_link_key_req]
	hci_ev_logical_link_complete		hci_event_hdr_t[HCI_EV_LOGICAL_LINK_COMPLETE, hci_ev_logical_link_complete]
	hci_ev_mode_change			hci_event_hdr_t[HCI_EV_MODE_CHANGE, hci_ev_mode_change]
	hci_ev_num_comp_blocks			hci_event_hdr_t[HCI_EV_NUM_COMP_BLOCKS, hci_ev_num_comp_blocks]
	hci_ev_num_comp_pkts			hci_event_hdr_t[HCI_EV_NUM_COMP_PKTS, hci_ev_num_comp_pkts]
	hci_ev_phy_link_complete		hci_event_hdr_t[HCI_EV_PHY_LINK_COMPLETE, hci_ev_phy_link_complete]
	hci_ev_pin_code_req			hci_event_hdr_t[HCI_EV_PIN_CODE_REQ, hci_ev_pin_code_req]
	hci_ev_pkt_type_change			hci_event_hdr_t[HCI_EV_PKT_TYPE_CHANGE, hci_ev_pkt_type_change]
	hci_ev_pscan_rep_mode			hci_event_hdr_t[HCI_EV_PSCAN_REP_MODE, hci_ev_pscan_rep_mode]
	hci_ev_qos_setup_complete		hci_event_hdr_t[HCI_EV_QOS_SETUP_COMPLETE, hci_ev_qos_setup_complete]
	hci_ev_remote_ext_features		hci_event_hdr_t[HCI_EV_REMOTE_EXT_FEATURES, hci_ev_remote_ext_features]
	hci_ev_remote_features			hci_event_hdr_t[HCI_EV_REMOTE_FEATURES, hci_ev_remote_features]
	hci_ev_remote_host_features		hci_event_hdr_t[HCI_EV_REMOTE_HOST_FEATURES, hci_ev_remote_host_features]
	hci_ev_remote_name			hci_event_hdr_t[HCI_EV_REMOTE_NAME, hci_ev_remote_name]
	hci_ev_remote_oob_data_request		hci_event_hdr_t[HCI_EV_REMOTE_OOB_DATA_REQUEST, hci_ev_remote_oob_data_request]
	hci_ev_remote_version			hci_event_hdr_t[HCI_EV_REMOTE_VERSION, hci_ev_remote_version]
	hci_ev_role_change			hci_event_hdr_t[HCI_EV_ROLE_CHANGE, hci_ev_role_change]
	hci_ev_si_device			hci_event_hdr_t[HCI_EV_SI_DEVICE, hci_ev_si_device]
	hci_ev_si_security			hci_event_hdr_t[HCI_EV_SI_SECURITY, hci_ev_si_security]
	hci_ev_simple_pair_complete		hci_event_hdr_t[HCI_EV_SIMPLE_PAIR_COMPLETE, hci_ev_simple_pair_complete]
	hci_ev_sniff_subrate			hci_event_hdr_t[HCI_EV_SNIFF_SUBRATE, hci_ev_sniff_subrate]
	hci_ev_stack_internal			hci_event_hdr_t[HCI_EV_STACK_INTERNAL, hci_ev_stack_internal]
	hci_ev_sync_conn_changed		hci_event_hdr_t[HCI_EV_SYNC_CONN_CHANGED, hci_ev_sync_conn_changed]
	hci_ev_sync_conn_complete		hci_event_hdr_t[HCI_EV_SYNC_CONN_COMPLETE, hci_ev_sync_conn_complete]
	hci_ev_sync_train_complete		hci_event_hdr_t[HCI_EV_SYNC_TRAIN_COMPLETE, hci_ev_sync_train_complete]
	hci_ev_user_confirm_req			hci_event_hdr_t[HCI_EV_USER_CONFIRM_REQUEST, hci_ev_user_confirm_req]
	hci_ev_user_passkey_notify		hci_event_hdr_t[HCI_EV_USER_PASSKEY_NOTIFY, hci_ev_user_passkey_notify]
	hci_ev_user_passkey_req			hci_event_hdr_t[HCI_EV_USER_PASSKEY_REQUEST, hci_ev_user_passkey_req]
	inquiry_info				hci_event_hdr_t[HCI_EV_INQUIRY_RESULT, inquiry_info_t]
	inquiry_info_with_rssi			hci_event_hdr_t[HCI_EV_INQUIRY_RESULT_WITH_RSSI, inquiry_info_with_rssi_t]
	inquiry_info_with_rssi_and_pscan_mode	hci_event_hdr_t[HCI_EV_INQUIRY_RESULT_WITH_RSSI, inquiry_info_with_rssi_and_pscan_mode_t]
	HCI_EV_VENDOR				hci_event_hdr_t[HCI_EV_VENDOR, array[int8]]
] [varlen]

type hci_event_hdr_t[EVENT, PAYLOAD] {
	hdr	hci_event_hdr[EVENT]
	payload	PAYLOAD
} [packed]

type hci_event_hdr[EVENT] {
	evt	const[EVENT, int8]
	plen	bytesize[hci_event_hdr_t:payload, int8]
} [packed]

hci_ev_le_meta_un [
	hci_ev_le_advertising_info	hci_ev_le_meta_t[HCI_EV_LE_ADVERTISING_REPORT, hci_ev_le_advertising_info_t]
	hci_ev_le_conn_complete		hci_ev_le_meta_t[HCI_EV_LE_CONN_COMPLETE, hci_ev_le_conn_complete]
	hci_ev_le_conn_update_complete	hci_ev_le_meta_t[HCI_EV_LE_CONN_UPDATE_COMPLETE, hci_ev_le_conn_update_complete]
	hci_ev_le_data_len_change	hci_ev_le_meta_t[HCI_EV_LE_DATA_LEN_CHANGE, hci_ev_le_data_len_change]
	hci_ev_le_direct_adv_info	hci_ev_le_meta_t[HCI_EV_LE_DIRECT_ADV_REPORT, hci_ev_le_direct_adv_info]
	hci_ev_le_enh_conn_complete	hci_ev_le_meta_t[HCI_EV_LE_ENHANCED_CONN_COMPLETE, hci_ev_le_enh_conn_complete]
	hci_ev_le_ext_adv_report	hci_ev_le_meta_t[HCI_EV_LE_EXT_ADV_REPORT, hci_ev_le_ext_adv_report]
	hci_ev_le_ltk_req		hci_ev_le_meta_t[HCI_EV_LE_LTK_REQ, hci_ev_le_ltk_req]
	hci_ev_le_phy_update_complete	hci_ev_le_meta_t[HCI_EV_LE_PHY_UPDATE_COMPLETE, hci_ev_le_phy_update_complete]
	hci_ev_le_remote_conn_param_req	hci_ev_le_meta_t[HCI_EV_LE_REMOTE_CONN_PARAM_REQ, hci_ev_le_remote_conn_param_req]
	hci_ev_le_remote_feat_complete	hci_ev_le_meta_t[HCI_EV_LE_REMOTE_FEAT_COMPLETE, hci_ev_le_remote_feat_complete]
	hci_evt_le_cis_established	hci_ev_le_meta_t[HCI_EVT_LE_CIS_ESTABLISHED, hci_evt_le_cis_established]
	hci_evt_le_ext_adv_set_term	hci_ev_le_meta_t[HCI_EV_LE_EXT_ADV_SET_TERM, hci_evt_le_ext_adv_set_term]
] [varlen]

type hci_ev_le_meta_t[SUBEVENT, PAYLOAD] {
	hdr	hci_ev_le_meta[SUBEVENT]
	payload	PAYLOAD
} [packed]

type hci_ev_le_meta[SUBEVENT] {
	subevent	const[SUBEVENT, int8]
} [packed]

hci_ev_cmd_complete_un [
	hci_rp_delete_reserved_lt_addr		hci_ev_cmd_complete_t[HCI_OP_DELETE_RESERVED_LT_ADDR, hci_rp_delete_reserved_lt_addr]
	hci_rp_delete_stored_link_key		hci_ev_cmd_complete_t[HCI_OP_DELETE_STORED_LINK_KEY, hci_rp_delete_stored_link_key]
	hci_rp_le_ltk_neg_reply			hci_ev_cmd_complete_t[HCI_OP_LE_LTK_NEG_REPLY, hci_rp_le_ltk_neg_reply]
	hci_rp_le_ltk_reply			hci_ev_cmd_complete_t[HCI_OP_LE_LTK_REPLY, hci_rp_le_ltk_reply]
	hci_rp_le_read_adv_tx_power		hci_ev_cmd_complete_t[HCI_OP_LE_READ_ADV_TX_POWER, hci_rp_le_read_adv_tx_power]
	hci_rp_le_read_buffer_size		hci_ev_cmd_complete_t[HCI_OP_LE_READ_BUFFER_SIZE, hci_rp_le_read_buffer_size]
	hci_rp_le_read_buffer_size_v2		hci_ev_cmd_complete_t[HCI_OP_LE_READ_BUFFER_SIZE_V2, hci_rp_le_read_buffer_size_v2]
	hci_rp_le_read_def_data_len		hci_ev_cmd_complete_t[HCI_OP_LE_READ_DEF_DATA_LEN, hci_rp_le_read_def_data_len]
	hci_rp_le_read_iso_tx_sync		hci_ev_cmd_complete_t[HCI_OP_LE_READ_ISO_TX_SYNC, hci_rp_le_read_iso_tx_sync]
	hci_rp_le_read_local_features		hci_ev_cmd_complete_t[HCI_OP_LE_READ_LOCAL_FEATURES, hci_rp_le_read_local_features]
	hci_rp_le_read_max_data_len		hci_ev_cmd_complete_t[HCI_OP_LE_READ_MAX_DATA_LEN, hci_rp_le_read_max_data_len]
	hci_rp_le_read_num_supported_adv_sets	hci_ev_cmd_complete_t[HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS, hci_rp_le_read_num_supported_adv_sets]
	hci_rp_le_read_resolv_list_size		hci_ev_cmd_complete_t[HCI_OP_LE_READ_RESOLV_LIST_SIZE, hci_rp_le_read_resolv_list_size]
	hci_rp_le_read_supported_states		hci_ev_cmd_complete_t[HCI_OP_LE_READ_SUPPORTED_STATES, hci_rp_le_read_supported_states]
	hci_rp_le_read_accept_list_size		hci_ev_cmd_complete_t[HCI_OP_LE_READ_ACCEPT_LIST_SIZE, hci_rp_le_read_accept_list_size]
	hci_rp_le_set_cig_params		hci_ev_cmd_complete_t[HCI_OP_LE_SET_CIG_PARAMS, hci_rp_le_set_cig_params]
	hci_rp_le_set_data_len			hci_ev_cmd_complete_t[HCI_OP_LE_SET_DATA_LEN, hci_rp_le_set_data_len]
	hci_rp_le_set_ext_adv_params		hci_ev_cmd_complete_t[HCI_OP_LE_SET_EXT_ADV_PARAMS, hci_rp_le_set_ext_adv_params]
	hci_rp_logical_link_cancel		hci_ev_cmd_complete_t[HCI_OP_LOGICAL_LINK_CANCEL, hci_rp_logical_link_cancel]
	hci_rp_pin_code_neg_reply		hci_ev_cmd_complete_t[HCI_OP_PIN_CODE_NEG_REPLY, hci_rp_pin_code_neg_reply]
	hci_rp_pin_code_reply			hci_ev_cmd_complete_t[HCI_OP_PIN_CODE_REPLY, hci_rp_pin_code_reply]
	hci_rp_read_auth_payload_to		hci_ev_cmd_complete_t[HCI_OP_READ_AUTH_PAYLOAD_TO, hci_rp_read_auth_payload_to]
	hci_rp_read_bd_addr			hci_ev_cmd_complete_t[HCI_OP_READ_BD_ADDR, hci_rp_read_bd_addr]
	hci_rp_read_buffer_size			hci_ev_cmd_complete_t[HCI_OP_READ_BUFFER_SIZE, hci_rp_read_buffer_size]
	hci_rp_read_class_of_dev		hci_ev_cmd_complete_t[HCI_OP_READ_CLASS_OF_DEV, hci_rp_read_class_of_dev]
	hci_rp_read_clock			hci_ev_cmd_complete_t[HCI_OP_READ_CLOCK, hci_rp_read_clock]
	hci_rp_read_data_block_size		hci_ev_cmd_complete_t[HCI_OP_READ_DATA_BLOCK_SIZE, hci_rp_read_data_block_size]
	hci_rp_read_def_err_data_reporting	hci_ev_cmd_complete_t[HCI_OP_READ_DEF_ERR_DATA_REPORTING, hci_rp_read_def_err_data_reporting]
	hci_rp_read_def_link_policy		hci_ev_cmd_complete_t[HCI_OP_READ_DEF_LINK_POLICY, hci_rp_read_def_link_policy]
	hci_rp_read_enc_key_size		hci_ev_cmd_complete_t[HCI_OP_READ_ENC_KEY_SIZE, hci_rp_read_enc_key_size]
	hci_rp_read_flow_control_mode		hci_ev_cmd_complete_t[HCI_OP_READ_FLOW_CONTROL_MODE, hci_rp_read_flow_control_mode]
	hci_rp_read_inq_rsp_tx_power		hci_ev_cmd_complete_t[HCI_OP_READ_INQ_RSP_TX_POWER, hci_rp_read_inq_rsp_tx_power]
	hci_rp_read_link_policy			hci_ev_cmd_complete_t[HCI_OP_READ_LINK_POLICY, hci_rp_read_link_policy]
	hci_rp_read_local_amp_assoc		hci_ev_cmd_complete_t[HCI_OP_READ_LOCAL_AMP_ASSOC, hci_rp_read_local_amp_assoc]
	hci_rp_read_local_amp_info		hci_ev_cmd_complete_t[HCI_OP_READ_LOCAL_AMP_INFO, hci_rp_read_local_amp_info]
	hci_rp_read_local_commands		hci_ev_cmd_complete_t[HCI_OP_READ_LOCAL_COMMANDS, hci_rp_read_local_commands]
	hci_rp_read_local_ext_features		hci_ev_cmd_complete_t[HCI_OP_READ_LOCAL_EXT_FEATURES, hci_rp_read_local_ext_features]
	hci_rp_read_local_features		hci_ev_cmd_complete_t[HCI_OP_READ_LOCAL_FEATURES, hci_rp_read_local_features]
	hci_rp_read_local_name			hci_ev_cmd_complete_t[HCI_OP_READ_LOCAL_NAME, hci_rp_read_local_name]
	hci_rp_read_local_oob_data		hci_ev_cmd_complete_t[HCI_OP_READ_LOCAL_OOB_DATA, hci_rp_read_local_oob_data]
	hci_rp_read_local_oob_ext_data		hci_ev_cmd_complete_t[HCI_OP_READ_LOCAL_OOB_EXT_DATA, hci_rp_read_local_oob_ext_data]
	hci_rp_read_local_pairing_opts		hci_ev_cmd_complete_t[HCI_OP_READ_LOCAL_PAIRING_OPTS, hci_rp_read_local_pairing_opts]
	hci_rp_read_local_version		hci_ev_cmd_complete_t[HCI_OP_READ_LOCAL_VERSION, hci_rp_read_local_version]
	hci_rp_read_num_supported_iac		hci_ev_cmd_complete_t[HCI_OP_READ_NUM_SUPPORTED_IAC, hci_rp_read_num_supported_iac]
	hci_rp_read_page_scan_activity		hci_ev_cmd_complete_t[HCI_OP_READ_PAGE_SCAN_ACTIVITY, hci_rp_read_page_scan_activity]
	hci_rp_read_page_scan_type		hci_ev_cmd_complete_t[HCI_OP_READ_PAGE_SCAN_TYPE, hci_rp_read_page_scan_type]
	hci_rp_read_rssi			hci_ev_cmd_complete_t[HCI_OP_READ_RSSI, hci_rp_read_rssi]
	hci_rp_read_sc_support			hci_ev_cmd_complete_t[HCI_OP_READ_SC_SUPPORT, hci_rp_read_sc_support]
	hci_rp_read_ssp_mode			hci_ev_cmd_complete_t[HCI_OP_READ_SSP_MODE, hci_rp_read_ssp_mode]
	hci_rp_read_stored_link_key		hci_ev_cmd_complete_t[HCI_OP_READ_STORED_LINK_KEY, hci_rp_read_stored_link_key]
	hci_rp_read_tx_power			hci_ev_cmd_complete_t[HCI_OP_READ_TX_POWER, hci_rp_read_tx_power]
	hci_rp_read_voice_setting		hci_ev_cmd_complete_t[HCI_OP_READ_VOICE_SETTING, hci_rp_read_voice_setting]
	hci_rp_role_discovery			hci_ev_cmd_complete_t[HCI_OP_ROLE_DISCOVERY, hci_rp_role_discovery]
	hci_rp_set_cpb				hci_ev_cmd_complete_t[HCI_OP_SET_CPB, hci_rp_set_cpb]
	hci_rp_set_cpb_data			hci_ev_cmd_complete_t[HCI_OP_SET_CPB_DATA, hci_rp_set_cpb_data]
	hci_rp_set_reserved_lt_addr		hci_ev_cmd_complete_t[HCI_OP_SET_RESERVED_LT_ADDR, hci_rp_set_reserved_lt_addr]
	hci_rp_user_confirm_reply		hci_ev_cmd_complete_t[HCI_OP_USER_CONFIRM_REPLY, hci_rp_user_confirm_reply]
	hci_rp_write_auth_payload_to		hci_ev_cmd_complete_t[HCI_OP_WRITE_AUTH_PAYLOAD_TO, hci_rp_write_auth_payload_to]
	hci_rp_write_link_policy		hci_ev_cmd_complete_t[HCI_OP_WRITE_LINK_POLICY, hci_rp_write_link_policy]
	hci_rp_write_remote_amp_assoc		hci_ev_cmd_complete_t[HCI_OP_WRITE_REMOTE_AMP_ASSOC, hci_rp_write_remote_amp_assoc]
	hci_rp_write_sync_train_params		hci_ev_cmd_complete_t[HCI_OP_WRITE_SYNC_TRAIN_PARAMS, hci_rp_write_sync_train_params]
	HCI_OP_INQUIRY_CANCEL			hci_ev_cmd_complete_t[HCI_OP_INQUIRY_CANCEL, int8]
	HCI_OP_PERIODIC_INQ			hci_ev_cmd_complete_t[HCI_OP_PERIODIC_INQ, int8]
	HCI_OP_EXIT_PERIODIC_INQ		hci_ev_cmd_complete_t[HCI_OP_EXIT_PERIODIC_INQ, int8]
# Unused:
# HCI_OP_REMOTE_NAME_REQ_CANCEL		hci_ev_cmd_complete_t[HCI_OP_REMOTE_NAME_REQ_CANCEL, int8]
	HCI_OP_WRITE_DEF_LINK_POLICY		hci_ev_cmd_complete_t[HCI_OP_WRITE_DEF_LINK_POLICY, int8]
	HCI_OP_RESET				hci_ev_cmd_complete_t[HCI_OP_RESET, int8]
	HCI_OP_WRITE_LOCAL_NAME			hci_ev_cmd_complete_t[HCI_OP_WRITE_LOCAL_NAME, int8]
	HCI_OP_WRITE_AUTH_ENABLE		hci_ev_cmd_complete_t[HCI_OP_WRITE_AUTH_ENABLE, int8]
	HCI_OP_WRITE_ENCRYPT_MODE		hci_ev_cmd_complete_t[HCI_OP_WRITE_ENCRYPT_MODE, int8]
	HCI_OP_WRITE_SCAN_ENABLE		hci_ev_cmd_complete_t[HCI_OP_WRITE_SCAN_ENABLE, int8]
	HCI_OP_WRITE_CLASS_OF_DEV		hci_ev_cmd_complete_t[HCI_OP_WRITE_CLASS_OF_DEV, int8]
	HCI_OP_WRITE_VOICE_SETTING		hci_ev_cmd_complete_t[HCI_OP_WRITE_VOICE_SETTING, int8]
	HCI_OP_WRITE_SSP_MODE			hci_ev_cmd_complete_t[HCI_OP_WRITE_SSP_MODE, int8]
	HCI_OP_WRITE_SC_SUPPORT			hci_ev_cmd_complete_t[HCI_OP_WRITE_SC_SUPPORT, int8]
	HCI_OP_WRITE_PAGE_SCAN_ACTIVITY		hci_ev_cmd_complete_t[HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, int8]
	HCI_OP_WRITE_PAGE_SCAN_TYPE		hci_ev_cmd_complete_t[HCI_OP_WRITE_PAGE_SCAN_TYPE, int8]
	HCI_OP_WRITE_DEF_ERR_DATA_REPORTING	hci_ev_cmd_complete_t[HCI_OP_WRITE_DEF_ERR_DATA_REPORTING, int8]
	HCI_OP_USER_CONFIRM_NEG_REPLY		hci_ev_cmd_complete_t[HCI_OP_USER_CONFIRM_NEG_REPLY, int8]
	HCI_OP_USER_PASSKEY_REPLY		hci_ev_cmd_complete_t[HCI_OP_USER_PASSKEY_REPLY, int8]
	HCI_OP_USER_PASSKEY_NEG_REPLY		hci_ev_cmd_complete_t[HCI_OP_USER_PASSKEY_NEG_REPLY, int8]
	HCI_OP_LE_SET_RANDOM_ADDR		hci_ev_cmd_complete_t[HCI_OP_LE_SET_RANDOM_ADDR, int8]
	HCI_OP_LE_SET_ADV_ENABLE		hci_ev_cmd_complete_t[HCI_OP_LE_SET_ADV_ENABLE, int8]
	HCI_OP_LE_SET_SCAN_PARAM		hci_ev_cmd_complete_t[HCI_OP_LE_SET_SCAN_PARAM, int8]
	HCI_OP_LE_SET_SCAN_ENABLE		hci_ev_cmd_complete_t[HCI_OP_LE_SET_SCAN_ENABLE, int8]
	HCI_OP_LE_CLEAR_ACCEPT_LIST		hci_ev_cmd_complete_t[HCI_OP_LE_CLEAR_ACCEPT_LIST, int8]
	HCI_OP_LE_ADD_TO_ACCEPT_LIST		hci_ev_cmd_complete_t[HCI_OP_LE_ADD_TO_ACCEPT_LIST, int8]
	HCI_OP_LE_DEL_FROM_ACCEPT_LIST		hci_ev_cmd_complete_t[HCI_OP_LE_DEL_FROM_ACCEPT_LIST, int8]
	HCI_OP_LE_WRITE_DEF_DATA_LEN		hci_ev_cmd_complete_t[HCI_OP_LE_WRITE_DEF_DATA_LEN, int8]
	HCI_OP_LE_ADD_TO_RESOLV_LIST		hci_ev_cmd_complete_t[HCI_OP_LE_ADD_TO_RESOLV_LIST, int8]
	HCI_OP_LE_DEL_FROM_RESOLV_LIST		hci_ev_cmd_complete_t[HCI_OP_LE_DEL_FROM_RESOLV_LIST, int8]
	HCI_OP_LE_CLEAR_RESOLV_LIST		hci_ev_cmd_complete_t[HCI_OP_LE_CLEAR_RESOLV_LIST, int8]
	HCI_OP_LE_SET_ADDR_RESOLV_ENABLE	hci_ev_cmd_complete_t[HCI_OP_LE_SET_ADDR_RESOLV_ENABLE, int8]
	HCI_OP_WRITE_LE_HOST_SUPPORTED		hci_ev_cmd_complete_t[HCI_OP_WRITE_LE_HOST_SUPPORTED, int8]
	HCI_OP_LE_SET_ADV_PARAM			hci_ev_cmd_complete_t[HCI_OP_LE_SET_ADV_PARAM, int8]
	HCI_OP_WRITE_SSP_DEBUG_MODE		hci_ev_cmd_complete_t[HCI_OP_WRITE_SSP_DEBUG_MODE, int8]
	HCI_OP_LE_SET_EXT_SCAN_PARAMS		hci_ev_cmd_complete_t[HCI_OP_LE_SET_EXT_SCAN_PARAMS, int8]
	HCI_OP_LE_SET_EXT_SCAN_ENABLE		hci_ev_cmd_complete_t[HCI_OP_LE_SET_EXT_SCAN_ENABLE, int8]
	HCI_OP_LE_SET_DEFAULT_PHY		hci_ev_cmd_complete_t[HCI_OP_LE_SET_DEFAULT_PHY, int8]
	HCI_OP_LE_SET_EXT_ADV_ENABLE		hci_ev_cmd_complete_t[HCI_OP_LE_SET_EXT_ADV_ENABLE, int8]
	HCI_OP_LE_SET_ADV_SET_RAND_ADDR		hci_ev_cmd_complete_t[HCI_OP_LE_SET_ADV_SET_RAND_ADDR, int8]
	HCI_OP_NOP				hci_ev_cmd_complete_t[HCI_OP_NOP, int8]
] [varlen]

type hci_ev_cmd_complete_t[OPCODE, PAYLOAD] {
	hdr	hci_ev_cmd_complete[OPCODE]
	payload	PAYLOAD
} [packed]

type hci_ev_cmd_complete[OPCODE] {
	ncmd	int8
	opcode	const[OPCODE, int16]
} [packed]

link_types = SCO_LINK, ACL_LINK, ESCO_LINK
bdaddr_types = ADDR_LE_DEV_PUBLIC, ADDR_LE_DEV_RANDOM

extended_inquiry_info_t {
	num_rsp	len[rsps, int8]
	rsps	array[extended_inquiry_info]
} [packed]

extended_inquiry_info {
	bdaddr			bdaddr_t
	pscan_rep_mode		int8
	pscan_period_mode	int8
	dev_class		array[int8, 3]
	clock_offset		int16
	rssi			int8
	data			array[int8, 240]
} [packed]

hci_comp_blocks_info {
	handle	hci_conn_handle
	pkts	int16
	blocks	int16
} [packed]

hci_comp_pkts_info {
	handle	hci_conn_handle
	count	int16
} [packed]

hci_ev_auth_complete {
	status	int8
	handle	hci_conn_handle
} [packed]

hci_ev_change_link_key_complete {
	status	int8
	handle	hci_conn_handle
} [packed]

hci_ev_channel_selected {
	phy_handle	hci_phy_handle
} [packed]

hci_ev_clock_offset {
	status		int8
	handle		hci_conn_handle
	clock_offset	int16
} [packed]

hci_ev_cmd_status_opcodes = HCI_OP_NOP, HCI_OP_INQUIRY, HCI_OP_CREATE_CONN, HCI_OP_DISCONNECT, HCI_OP_ADD_SCO, HCI_OP_AUTH_REQUESTED, HCI_OP_SET_CONN_ENCRYPT, HCI_OP_REMOTE_NAME_REQ, HCI_OP_READ_REMOTE_FEATURES, HCI_OP_READ_REMOTE_EXT_FEATURES, HCI_OP_SETUP_SYNC_CONN, HCI_OP_SNIFF_MODE, HCI_OP_EXIT_SNIFF_MODE, HCI_OP_SWITCH_ROLE, HCI_OP_LE_CREATE_CONN, HCI_OP_LE_READ_REMOTE_FEATURES, HCI_OP_LE_START_ENC, HCI_OP_LE_EXT_CREATE_CONN

hci_ev_cmd_status {
	status	int8
	ncmd	bool8
	opcode	flags[hci_ev_cmd_status_opcodes, int16]
} [packed]

hci_ev_conn_complete {
	status		int8
	handle		hci_conn_handle
	bdaddr		bdaddr_t
	link_type	flags[link_types, int8]
	encr_mode	int8
} [packed]

hci_ev_conn_request {
	bdaddr		bdaddr_t
	dev_class	array[int8, 3]
	link_type	flags[link_types, int8]
} [packed]

hci_ev_disconn_complete {
	status	int8
	handle	hci_conn_handle
	reason	int8
} [packed]

hci_ev_disconn_logical_link_complete {
	status	int8
	handle	hci_conn_handle
	reason	int8
} [packed]

hci_ev_disconn_phy_link_complete {
	status		int8
	phy_handle	hci_phy_handle
	reason		int8
} [packed]

hci_ev_encrypt_change {
	status	int8
	handle	hci_conn_handle
	encrypt	int8
} [packed]

hci_ev_hardware_error {
	code	int8
} [packed]

hci_ev_io_capa_reply {
	bdaddr		bdaddr_t
	capability	int8
	oob_data	int8
	authentication	int8
} [packed]

hci_ev_io_capa_request {
	bdaddr	bdaddr_t
} [packed]

hci_ev_key_refresh_complete {
	status	int8
	handle	hci_conn_handle
} [packed]

hci_ev_keypress_notify {
	bdaddr	bdaddr_t
	type	int8
} [packed]

hci_ev_le_advertising_info_t {
	num_reports	len[reports, int8]
	reports		array[hci_ev_le_advertising_info]
} [packed]

hci_ev_le_advertising_info {
	evt_type	flags[hci_adv_evt_type, int8]
	bdaddr_type	flags[bdaddr_types, int8]
	bdaddr		bdaddr_t
	length		bytesize[data, int8]
	data		array[int8, 0:HCI_MAX_AD_LENGTH]
	rssi		int8
} [packed]

hci_adv_evt_type = LE_ADV_IND, LE_ADV_DIRECT_IND, LE_ADV_SCAN_IND, LE_ADV_NONCONN_IND, LE_ADV_SCAN_RSP

hci_ev_le_conn_complete {
	status			int8
	handle			hci_conn_handle
	role			int8
	bdaddr_type		flags[bdaddr_types, int8]
	bdaddr			bdaddr_t
	interval		int16
	latency			int16
	supervision_timeout	int16
	clk_accurancy		int8
} [packed]

hci_ev_le_conn_update_complete {
	status			const[0, int8]
	handle			hci_conn_handle
	interval		int16
	latency			int16
	supervision_timeout	int16
} [packed]

hci_ev_le_data_len_change {
	handle	hci_conn_handle
	tx_len	int16
	tx_time	int16
	rx_len	int16
	rx_time	int16
} [packed]

hci_ev_le_direct_adv_info {
	evt_type		int8
	bdaddr_type		flags[bdaddr_types, int8]
	bdaddr			bdaddr_t
	direct_addr_type	int8
	direct_addr		bdaddr_t
	rssi			int8
} [packed]

hci_ev_le_enh_conn_complete {
	status			int8
	handle			hci_conn_handle
	role			int8
	bdaddr_type		flags[bdaddr_types, int8]
	bdaddr			bdaddr_t
	local_rpa		bdaddr_t
	peer_rpa		bdaddr_t
	interval		int16
	latency			int16
	supervision_timeout	int16
	clk_accurancy		int8
} [packed]

hci_ev_le_ext_adv_report {
	num	len[info, int8]
	info	array[hci_ev_le_ext_adv_info]
} [packed]

hci_ev_le_ext_adv_info {
	type			flags[hci_legacy_adv_evt_type, int16]
	bdaddr_type		flags[bdaddr_types, int8]
	bdaddr			bdaddr_t
	primary_phy		int8
	secondary_phy		int8
	sid			int8
	tx_power		int8
	rssi			int8
	interval		int16
	direct_addr_type	int8
	direct_addr		bdaddr_t
	length			bytesize[data, int8]
	data			array[int8]
} [packed]

hci_legacy_adv_evt_type = LE_LEGACY_ADV_IND, LE_LEGACY_ADV_DIRECT_IND, LE_LEGACY_ADV_SCAN_IND, LE_LEGACY_NONCONN_IND, LE_LEGACY_SCAN_RSP_ADV, LE_LEGACY_SCAN_RSP_ADV_SCAN, LE_EXT_ADV_NON_CONN_IND, LE_EXT_ADV_CONN_IND, LE_EXT_ADV_SCAN_IND, LE_EXT_ADV_DIRECT_IND, LE_EXT_ADV_SCAN_RSP, LE_EXT_ADV_LEGACY_PDU

hci_ev_le_ltk_req {
	handle	hci_conn_handle
	rand	int64
	ediv	int16
} [packed]

hci_ev_le_phy_update_complete {
	status	int8
	handle	hci_conn_handle
	tx_phy	int8
	rx_phy	int8
} [packed]

hci_ev_le_remote_conn_param_req {
	handle		hci_conn_handle
	interval_min	int16
	interval_max	int16
	latency		int16
	timeout		int16
} [packed]

hci_ev_le_remote_feat_complete {
	status		int8
	handle		hci_conn_handle
	features	array[int8, 8]
} [packed]

hci_ev_link_key_notify {
	bdaddr		bdaddr_t
	link_key	array[int8, 16]
	key_type	int8
} [packed]

hci_ev_link_key_req {
	bdaddr	bdaddr_t
} [packed]

hci_ev_logical_link_complete {
	status		int8
	handle		hci_conn_handle
	phy_handle	hci_phy_handle
	flow_spec_id	int8
} [packed]

hci_ev_mode_change {
	status		int8
	handle		hci_conn_handle
	mode		int8
	interval	int16
} [packed]

hci_ev_num_comp_blocks {
	num_blocks	int16
	num_hndl	len[handles, int8]
	handles		array[hci_comp_blocks_info]
} [packed]

hci_ev_num_comp_pkts {
	num_hndl	len[handles, int8]
	handles		array[hci_comp_pkts_info]
} [packed]

hci_ev_phy_link_complete {
	status		int8
	phy_handle	hci_phy_handle
} [packed]

hci_ev_pin_code_req {
	bdaddr	bdaddr_t
} [packed]

hci_ev_pkt_type_change {
	status		int8
	handle		hci_conn_handle
	pkt_type	int16
} [packed]

hci_ev_pscan_rep_mode {
	bdaddr		bdaddr_t
	pscan_rep_mode	int8
} [packed]

hci_ev_qos_setup_complete {
	status	int8
	handle	hci_conn_handle
	qos	hci_qos
} [packed]

hci_ev_remote_ext_features {
	status		int8
	handle		hci_conn_handle
	page		int8
	max_page	int8
	features	array[int8, 8]
} [packed]

hci_ev_remote_features {
	status		int8
	handle		hci_conn_handle
	features	array[int8, 8]
} [packed]

hci_ev_remote_host_features {
	bdaddr		bdaddr_t
	features	array[int8, 8]
} [packed]

hci_ev_remote_name {
	status	int8
	bdaddr	bdaddr_t
	name	array[int8, 248]
} [packed]

hci_ev_remote_oob_data_request {
	bdaddr	bdaddr_t
} [packed]

hci_ev_remote_version {
	status		int8
	handle		hci_conn_handle
	lmp_ver		int8
	manufacturer	int16
	lmp_subver	int16
} [packed]

hci_ev_role_change {
	status	int8
	bdaddr	bdaddr_t
	role	int8
} [packed]

hci_ev_si_device {
	event	int16
	dev_id	int16
} [packed]

hci_ev_si_security {
	event		int16
	proto		int16
	subproto	int16
	incoming	int8
} [packed]

hci_ev_simple_pair_complete {
	status	int8
	bdaddr	bdaddr_t
} [packed]

hci_ev_sniff_subrate {
	status			int8
	handle			hci_conn_handle
	max_tx_latency		int16
	max_rx_latency		int16
	max_remote_timeout	int16
	max_local_timeout	int16
} [packed]

hci_ev_stack_internal {
	type	int16
	data	array[int8]
} [packed]

hci_ev_sync_conn_changed {
	status		int8
	handle		hci_conn_handle
	tx_interval	int8
	retrans_window	int8
	rx_pkt_len	int16
	tx_pkt_len	int16
} [packed]

hci_ev_sync_conn_complete {
	status		int8
	handle		hci_conn_handle
	bdaddr		bdaddr_t
	link_type	flags[link_types, int8]
	tx_interval	int8
	retrans_window	int8
	rx_pkt_len	int16
	tx_pkt_len	int16
	air_mode	int8
} [packed]

hci_ev_sync_train_complete {
	status	int8
} [packed]

hci_ev_user_confirm_req {
	bdaddr	bdaddr_t
	passkey	int32
} [packed]

hci_ev_user_passkey_notify {
	bdaddr	bdaddr_t
	passkey	int32
} [packed]

hci_ev_user_passkey_req {
	bdaddr	bdaddr_t
} [packed]

hci_evt_le_cis_established {
	status		int8
	handle		hci_conn_handle
	cig_sync_delay	array[int8, 3]
	cis_sync_delay	array[int8, 3]
	m_latency	array[int8, 3]
	s_latency	array[int8, 3]
	m_phy		int8
	s_phy		int8
	nse		int8
	m_bn		int8
	s_bn		int8
	m_ft		int8
	s_ft		int8
	m_mtu		int16
	s_mtu		int16
	interval	int16
} [packed]

hci_evt_le_ext_adv_set_term {
	status		const[0, int8]
# This does not seem to be used.
	handle		const[0, int8]
	conn_handle	hci_conn_handle
	num_evts	int8
} [packed]

hci_rp_delete_reserved_lt_addr {
	status	int8
	lt_addr	int8
} [packed]

hci_rp_delete_stored_link_key {
	status		int8
	num_keys	int16
} [packed]

hci_rp_le_ltk_neg_reply {
	status	int8
	handle	hci_conn_handle
} [packed]

hci_rp_le_ltk_reply {
	status	int8
	handle	hci_conn_handle
} [packed]

hci_rp_le_read_adv_tx_power {
	status		int8
	tx_power	int8
} [packed]

hci_rp_le_read_buffer_size {
	status		int8
	le_mtu		int16
	le_max_pkt	int8
} [packed]

hci_rp_le_read_buffer_size_v2 {
	status		int8
	acl_mtu		int16
	acl_max_pkt	int8
	iso_mtu		int16
	iso_max_pkt	int8
} [packed]

hci_rp_le_read_def_data_len {
	status	int8
	tx_len	int16
	tx_time	int16
} [packed]

hci_rp_le_read_iso_tx_sync {
	status		int8
	handle		hci_conn_handle
	seq		int16
	imestamp	int32
	offset		array[int8, 3]
} [packed]

hci_rp_le_read_local_features {
	status		int8
	features	array[int8, 8]
} [packed]

hci_rp_le_read_max_data_len {
	status	int8
	tx_len	int16
	tx_time	int16
	rx_len	int16
	rx_time	int16
} [packed]

hci_rp_le_read_num_supported_adv_sets {
	status		int8
	num_of_sets	int8
} [packed]

hci_rp_le_read_resolv_list_size {
	status	int8
	size	int8
} [packed]

hci_rp_le_read_supported_states {
	status		int8
	le_states	array[int8, 8]
} [packed]

hci_rp_le_read_accept_list_size {
	status	int8
	size	int8
} [packed]

hci_rp_le_set_cig_params {
	status		int8
	cig_id		int8
	num_handles	len[handle, int8]
	handle		array[hci_conn_handle]
} [packed]

hci_rp_le_set_data_len {
	status	int8
	handle	hci_conn_handle
} [packed]

hci_rp_le_set_ext_adv_params {
	status		int8
	tx_power	int8
} [packed]

hci_rp_logical_link_cancel {
	status		int8
	phy_handle	hci_phy_handle
	flow_spec_id	int8
} [packed]

hci_rp_pin_code_neg_reply {
	status	int8
	bdaddr	bdaddr_t
} [packed]

hci_rp_pin_code_reply {
	status	int8
	bdaddr	bdaddr_t
} [packed]

hci_rp_read_auth_payload_to {
	status	int8
	handle	hci_conn_handle
	timeout	int16
} [packed]

hci_rp_read_bd_addr {
	status	int8
	bdaddr	bdaddr_t
} [packed]

hci_rp_read_buffer_size {
	status		int8
	acl_mtu		int16
	sco_mtu		int8
	acl_max_pkt	int16
	sco_max_pkt	int16
} [packed]

hci_rp_read_class_of_dev {
	status		int8
	dev_class	array[int8, 3]
} [packed]

hci_rp_read_clock {
	status		int8
	handle		hci_conn_handle
	clock		int32
	accuracy	int16
} [packed]

hci_rp_read_data_block_size {
	status		int8
	max_acl_len	int16
	block_len	int16
	num_blocks	int16
} [packed]

hci_rp_read_def_err_data_reporting {
	status			int8
	err_data_reporting	int8
} [packed]

hci_rp_read_def_link_policy {
	status	int8
	policy	int16
} [packed]

hci_rp_read_enc_key_size {
	status		int8
	handle		hci_conn_handle
	key_size	int8
} [packed]

hci_rp_read_flow_control_mode {
	status	int8
	mode	int8
} [packed]

hci_rp_read_inq_rsp_tx_power {
	status		int8
	tx_power	int8
} [packed]

hci_rp_read_link_policy {
	status	int8
	handle	hci_conn_handle
	policy	int16
} [packed]

hci_rp_read_local_amp_assoc {
	status		int8
	phy_handle	hci_phy_handle
	rem_len		int16
	frag		array[int8]
} [packed]

hci_rp_read_local_amp_info {
	status		int8
	amp_status	int8
	total_bw	int32
	max_bw		int32
	min_latency	int32
	max_pdu		int32
	amp_type	int8
	pal_cap		int16
	max_assoc_size	int16
	max_flush_to	int32
	be_flush_to	int32
} [packed]

hci_rp_read_local_commands {
	status		int8
	commands	array[int8, 64]
} [packed]

hci_rp_read_local_ext_features {
	status		int8
	page		int8
	max_page	int8
	features	array[int8, 8]
} [packed]

hci_rp_read_local_features {
	status		int8
	features	array[int8, 8]
} [packed]

hci_rp_read_local_name {
	status	int8
	name	array[int8, 248]
} [packed]

hci_rp_read_local_oob_data {
	status	int8
	hash	array[int8, 16]
	rand	array[int8, 16]
} [packed]

hci_rp_read_local_oob_ext_data {
	status	int8
	hash192	array[int8, 16]
	rand192	array[int8, 16]
	hash256	array[int8, 16]
	rand256	array[int8, 16]
} [packed]

hci_rp_read_local_pairing_opts {
	status		int8
	pairing_opts	int8
	max_key_size	int8
} [packed]

hci_rp_read_local_version {
	status		int8
	hci_ver		int8
	hci_rev		int16
	lmp_ver		int8
	manufacturer	int16
	lmp_subver	int16
} [packed]

hci_rp_read_num_supported_iac {
	status	int8
	num_iac	int8
} [packed]

hci_rp_read_page_scan_activity {
	status		int8
	interval	int16
	window		int16
} [packed]

hci_rp_read_page_scan_type {
	status	int8
	type	int8
} [packed]

hci_rp_read_rssi {
	status	int8
	handle	hci_conn_handle
	rssi	int8
} [packed]

hci_rp_read_sc_support {
	status	int8
	support	int8
} [packed]

hci_rp_read_ssp_mode {
	status	int8
	mode	int8
} [packed]

hci_rp_read_stored_link_key {
	status		int8
	max_keys	int16
	num_keys	int16
} [packed]

hci_rp_read_tx_power {
	status		int8
	handle		hci_conn_handle
	tx_power	int8
} [packed]

hci_rp_read_voice_setting {
	status		int8
	voice_setting	int16
} [packed]

hci_rp_role_discovery {
	status	int8
	handle	hci_conn_handle
	role	int8
} [packed]

hci_rp_set_cpb {
	status		int8
	lt_addr		int8
	interval	int16
} [packed]

hci_rp_set_cpb_data {
	status	int8
	lt_addr	int8
} [packed]

hci_rp_set_reserved_lt_addr {
	status	int8
	lt_addr	int8
} [packed]

hci_rp_user_confirm_reply {
	status	int8
	bdaddr	bdaddr_t
} [packed]

hci_rp_write_auth_payload_to {
	status	int8
	handle	hci_conn_handle
} [packed]

hci_rp_write_link_policy {
	status	int8
	handle	hci_conn_handle
} [packed]

hci_rp_write_remote_amp_assoc {
	status		int8
	phy_handle	hci_phy_handle
} [packed]

hci_rp_write_sync_train_params {
	status		int8
	sync_train_int	int16
} [packed]

hci_qos {
	service_type	int8
	token_rate	int32
	peak_bandwidth	int32
	latency		int32
	delay_variation	int32
} [packed]

inquiry_info_t {
	num_rsp	len[rsps, int8]
	rsps	array[inquiry_info]
} [packed]

inquiry_info {
	bdaddr			bdaddr_t
	pscan_rep_mode		int8
	pscan_period_mode	int8
	pscan_mode		int8
	dev_class		array[int8, 3]
	clock_offset		int16
} [packed]

inquiry_info_with_rssi_t {
	num_rsp	len[rsps, int8]
	rsps	array[inquiry_info_with_rssi]
} [packed]

inquiry_info_with_rssi {
	bdaddr			bdaddr_t
	pscan_rep_mode		int8
	pscan_period_mode	int8
	dev_class		array[int8, 3]
	clock_offset		int16
	rssi			int8
} [packed]

inquiry_info_with_rssi_and_pscan_mode_t {
	num_rsp	len[rsps, int8]
	rsps	array[inquiry_info_with_rssi_and_pscan_mode]
} [packed]

inquiry_info_with_rssi_and_pscan_mode {
	bdaddr			bdaddr_t
	pscan_rep_mode		int8
	pscan_period_mode	int8
	pscan_mode		int8
	dev_class		array[int8, 3]
	clock_offset		int16
	rssi			int8
} [packed]
]

gemini-3-pro-preview

							input: 111578
							output: 22
							thoughts: 32
						

Here's my take on the thought process, as requested:

**Navigating the USB Landscape**

Okay, so I'm on the hunt, trying to trace down the definition of `syz_usb_connect`.  Aha! The clue's in the naming, `dev_bus_usb.txt`... that screams "USB device bus" to me. That's a good place to start digging. Let's see if this hunch pays off - I'm off to crack open that file and get a good look at `sys/linux/dev_bus_usb.txt`. Time to see what we can find. I'm hoping it's got the goods on `syz_usb_connect`. Let's get reading!

map[File:dev_bus_usb.txt]

map[Output:# Copyright 2019 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

# https://elixir.bootlin.com/linux/latest/source/drivers/usb/core/devio.c

include <linux/ioctl.h>
include <linux/usb.h>
include <linux/usbdevice_fs.h>
include <uapi/linux/fcntl.h>
include <uapi/linux/usb/ch9.h>

define MAXDRIVERNAME	USBDEVFS_MAXDRIVERNAME + 1

resource fd_usbfs[fd]

syz_open_dev$usbfs(dev ptr[in, string["/dev/bus/usb/00#/00#"]], id intptr, flags flags[open_flags]) fd_usbfs

read$usbfs(fd fd_usbfs, buf buffer[out], count len[buf])

mmap$usbfs(addr vma, len len[addr], prot flags[mmap_prot], flags flags[mmap_flags], fd fd_usbfs, offset fileoff)
_ = __NR_mmap2

# TODO: arg is a pointer to a previously submitted URB.
ioctl$USBDEVFS_REAPURB(fd fd_usbfs, cmd const[USBDEVFS_REAPURB], arg ptr[out, int64])
ioctl$USBDEVFS_REAPURBNDELAY(fd fd_usbfs, cmd const[USBDEVFS_REAPURBNDELAY], arg ptr[out, int64])

ioctl$USBDEVFS_CONTROL(fd fd_usbfs, cmd const[USBDEVFS_CONTROL], arg ptr[in, usbdevfs_ctrltransfer])
ioctl$USBDEVFS_BULK(fd fd_usbfs, cmd const[USBDEVFS_BULK], arg ptr[in, usbdevfs_bulktransfer])
ioctl$USBDEVFS_RESETEP(fd fd_usbfs, cmd const[USBDEVFS_RESETEP], arg ptr[in, usbdevfs_ep])
ioctl$USBDEVFS_RESET(fd fd_usbfs, cmd const[USBDEVFS_RESET])
ioctl$USBDEVFS_CLEAR_HALT(fd fd_usbfs, cmd const[USBDEVFS_CLEAR_HALT], arg ptr[in, usbdevfs_ep])
ioctl$USBDEVFS_GETDRIVER(fd fd_usbfs, cmd const[USBDEVFS_GETDRIVER], arg ptr[inout, usbdevfs_getdriver])
ioctl$USBDEVFS_CONNECTINFO(fd fd_usbfs, cmd const[USBDEVFS_CONNECTINFO], arg ptr[out, usbdevfs_connectinfo])
ioctl$USBDEVFS_SETINTERFACE(fd fd_usbfs, cmd const[USBDEVFS_SETINTERFACE], arg ptr[in, usbdevfs_setinterface])
ioctl$USBDEVFS_SETCONFIGURATION(fd fd_usbfs, cmd const[USBDEVFS_SETCONFIGURATION], arg ptr[in, int32])
ioctl$USBDEVFS_SUBMITURB(fd fd_usbfs, cmd const[USBDEVFS_SUBMITURB], arg ptr[in, usbdevfs_urb])

# TODO: arg is a pointer to a previously submitted URB.
ioctl$USBDEVFS_DISCARDURB(fd fd_usbfs, cmd const[USBDEVFS_DISCARDURB], arg ptr[in, int64])

ioctl$USBDEVFS_DISCSIGNAL(fd fd_usbfs, cmd const[USBDEVFS_DISCSIGNAL], arg ptr[in, usbdevfs_disconnectsignal])
ioctl$USBDEVFS_CLAIMINTERFACE(fd fd_usbfs, cmd const[USBDEVFS_CLAIMINTERFACE], arg ptr[in, int32])
ioctl$USBDEVFS_RELEASEINTERFACE(fd fd_usbfs, cmd const[USBDEVFS_RELEASEINTERFACE], arg ptr[in, int32])
ioctl$USBDEVFS_IOCTL(fd fd_usbfs, cmd const[USBDEVFS_IOCTL], arg ptr[in, usbdevfs_ioctl])
ioctl$USBDEVFS_CLAIM_PORT(fd fd_usbfs, cmd const[USBDEVFS_CLAIM_PORT], arg ptr[in, int32])
ioctl$USBDEVFS_RELEASE_PORT(fd fd_usbfs, cmd const[USBDEVFS_RELEASE_PORT], arg ptr[in, int32])
ioctl$USBDEVFS_GET_CAPABILITIES(fd fd_usbfs, cmd const[USBDEVFS_GET_CAPABILITIES], arg ptr[out, int32])
ioctl$USBDEVFS_DISCONNECT_CLAIM(fd fd_usbfs, cmd const[USBDEVFS_DISCONNECT_CLAIM], arg ptr[in, usbdevfs_disconnect_claim])
ioctl$USBDEVFS_ALLOC_STREAMS(fd fd_usbfs, cmd const[USBDEVFS_ALLOC_STREAMS], arg ptr[in, usbdevfs_streams])
ioctl$USBDEVFS_FREE_STREAMS(fd fd_usbfs, cmd const[USBDEVFS_FREE_STREAMS], arg ptr[in, usbdevfs_streams])
ioctl$USBDEVFS_DROP_PRIVILEGES(fd fd_usbfs, cmd const[USBDEVFS_DROP_PRIVILEGES], arg ptr[in, int32])
ioctl$USBDEVFS_GET_SPEED(fd fd_usbfs, cmd const[USBDEVFS_GET_SPEED])
ioctl$USBDEVFS_FORBID_SUSPEND(fd fd_usbfs, cmd const[USBDEVFS_FORBID_SUSPEND])
ioctl$USBDEVFS_ALLOW_SUSPEND(fd fd_usbfs, cmd const[USBDEVFS_ALLOW_SUSPEND])
ioctl$USBDEVFS_WAIT_FOR_RESUME(fd fd_usbfs, cmd const[USBDEVFS_WAIT_FOR_RESUME])

usbdevfs_ep {
	num	int8:7[0:15]
	dir	int8:1
}

usbdevfs_ctrltransfer {
	bRequestType	flags[usb_request_type_flags, int8]
	bRequest	flags[usb_requests, int8]
	wValue		int16
	wIndex		int16
	wLength		len[data, int16]
	timeout		int32
	data		ptr[inout, array[int8]]
}

usb_request_type_flags = USB_DIR_OUT, USB_DIR_IN, USB_TYPE_MASK, USB_TYPE_STANDARD, USB_TYPE_CLASS, USB_TYPE_VENDOR, USB_TYPE_RESERVED, USB_RECIP_MASK, USB_RECIP_DEVICE, USB_RECIP_INTERFACE, USB_RECIP_ENDPOINT, USB_RECIP_OTHER, USB_RECIP_PORT, USB_RECIP_RPIPE

usbdevfs_bulktransfer {
	ep	align32[usbdevfs_ep]
	len	len[data, int32]
	timeout	int32
	data	ptr[inout, array[int8]]
}

usbdevfs_getdriver {
	interface	int32
	driver		array[int8, MAXDRIVERNAME]
}

usbdevfs_connectinfo {
	devnum	int32
	slow	int8
}

usbdevfs_setinterface {
	interface	int32
	altsetting	int32
}

usbdevfs_urb [
	urb_type_control	usbdevfs_urb_control
	urb_type_bulk		usbdevfs_urb_bulk
	urb_type_interrupt	usbdevfs_urb_interrupt
	urb_type_iso		usbdevfs_urb_iso
] [varlen]

usbdevfs_urb_control {
	type		const[USBDEVFS_URB_TYPE_CONTROL, int8]
	endpoint	usbdevfs_ep
	status		int32
	flags		flags[urb_flags, int32]
	buffer		ptr[in, usb_ctrlrequest]
	buffer_length	len[buffer, int32]
	actual_length	int32
	start_frame	int32
	u		const[0, int32]
	error_count	int32
	signr		int32
	usercontext	ptr[in, array[int8]]
}

usb_ctrlrequest {
	bRequestType	flags[usb_request_type_flags, int8]
	bRequest	flags[usb_requests, int8]
	wValue		int16
	wIndex		int16
	wLength		int16
} [packed]

usbdevfs_urb_bulk {
	type		const[USBDEVFS_URB_TYPE_BULK, int8]
	endpoint	usbdevfs_ep
	status		int32
	flags		flags[urb_flags, int32]
	buffer		ptr[in, array[int8]]
	buffer_length	len[buffer, int32]
	actual_length	int32
	start_frame	int32
	stream_id	int32
	error_count	int32
	signr		int32
	usercontext	ptr[in, array[int8]]
}

usbdevfs_urb_interrupt {
	type		const[USBDEVFS_URB_TYPE_INTERRUPT, int8]
	endpoint	usbdevfs_ep
	status		int32
	flags		flags[urb_flags, int32]
	buffer		ptr[in, array[int8]]
	buffer_length	len[buffer, int32]
	actual_length	int32
	start_frame	int32
	u		const[0, int32]
	error_count	int32
	signr		int32
	usercontext	ptr[in, array[int8]]
}

usbdevfs_urb_iso {
	type			const[USBDEVFS_URB_TYPE_ISO, int8]
	endpoint		usbdevfs_ep
	status			int32
	flags			flags[urb_flags, int32]
	buffer			ptr[in, array[int8]]
	buffer_length		len[buffer, int32]
	actual_length		int32
	start_frame		int32
	number_of_packets	len[iso_frame_desc, int32]
	error_count		int32
	signr			int32
	usercontext		ptr[in, array[int8]]
	iso_frame_desc		array[usbdevfs_iso_packet_desc, 1:127]
}

urb_flags = USBDEVFS_URB_SHORT_NOT_OK, USBDEVFS_URB_ISO_ASAP, USBDEVFS_URB_BULK_CONTINUATION, USBDEVFS_URB_NO_FSBR, USBDEVFS_URB_ZERO_PACKET, USBDEVFS_URB_NO_INTERRUPT

usbdevfs_iso_packet_desc {
	length		int32
	actual_length	int32
	status		int32
}

usbdevfs_disconnectsignal {
	signr	int32
	context	ptr[in, array[int8]]
}

usbdevfs_ioctl [
	usbdevfs_disconnect	usbdevfs_ioctl_disconnect
	usbdevfs_connect	usbdevfs_ioctl_connect
	usbdevfs_driver		usbdevfs_ioctl_driver
]

usbdevfs_ioctl_disconnect {
	ifno		int32
	ioctl_code	const[USBDEVFS_DISCONNECT, int32]
	data		const[0, intptr]
}

usbdevfs_ioctl_connect {
	ifno		int32
	ioctl_code	const[USBDEVFS_CONNECT, int32]
	data		const[0, intptr]
}

usbdevfs_ioctl_driver {
	ifno		int32
	ioctl_code	int32
	data		ptr[inout, array[int8]]
}

usbdevfs_disconnect_claim {
	interface	int32
	flags		flags[disconnect_flags, int32]
	driver		array[int8, MAXDRIVERNAME]
}

disconnect_flags = USBDEVFS_DISCONNECT_CLAIM_IF_DRIVER, USBDEVFS_DISCONNECT_CLAIM_EXCEPT_DRIVER

usbdevfs_streams {
	num_streams	int32[2:65536]
	num_eps		len[eps, int32]
	eps		array[usbdevfs_ep, 1:USB_MAXENDPOINTS]
}
]

gemini-3-pro-preview

							input: 114769
							output: 19
							thoughts: 32
						

Here's my thought process, summarized as you requested:

**Navigating the Syz USB Context**

Okay, hold on a second. I was under the impression that the function `syz_usb_connect` was defined within the `dev_bus_usb.txt` file, but that doesn't seem to be the case. I need to re-evaluate my mental model here. My assumption about where I could find this function was incorrect. Let me double-check... Ah, right! It’s actually located within `vusb.txt`. That makes sense in the broader context of how this USB setup is configured, specifically focusing on virtual USB connections. I need to adjust my search path accordingly and re-examine that file for further details. This changes my immediate analysis plan. I was focusing on the wrong source and therefore my information could be incomplete.

map[File:vusb.txt]

map[Output:# Copyright 2019 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <linux/types.h>
include <linux/byteorder/generic.h>

include <uapi/linux/usb/ch9.h>
include <uapi/linux/usb/ch11.h>

include <uapi/linux/usb/midi.h>
include <uapi/linux/usb/audio.h>
include <linux/usb/audio-v2.h>
include <linux/usb/audio-v3.h>
include <uapi/linux/hid.h>
include <linux/hid.h>
include <uapi/linux/usb/cdc.h>
include <uapi/linux/if_ether.h>
include <linux/interrupt.h>
include <linux/usb/cdc_ncm.h>
include <drivers/net/usb/asix.h>

# This is a special fd for USB fuzzing and should only be used with syz_usb_* pseudo-syscalls.
# We don't inherit it from the fd resource, to discourage syzkaller calling raw ioctls on it.
resource fd_usb[int32]: -1

# These are generic pseudo-syscalls for emulating arbitrary USB devices.
# They are mostly targeted to cover the enumeration process.
syz_usb_connect(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_control_io(fd fd_usb, descs ptr[in, vusb_descriptors], resps ptr[in, vusb_responses]) (timeout[300], remote_cover)
syz_usb_ep_write(fd fd_usb, ep int8, len len[data], data ptr[in, array[int8, 0:256]]) (timeout[300], remote_cover)
syz_usb_ep_read(fd fd_usb, ep int8, len len[data], data buffer[out]) (timeout[300], remote_cover)
syz_usb_disconnect(fd fd_usb) (timeout[300], remote_cover)

usb_device_speed = USB_SPEED_UNKNOWN, USB_SPEED_LOW, USB_SPEED_FULL, USB_SPEED_HIGH, USB_SPEED_WIRELESS, USB_SPEED_SUPER, USB_SPEED_SUPER_PLUS

# TODO: consider patching idVendor and idProduct for all class specific descriptions in Go code to cover more drivers.
# TODO: custom syz_usb_ep_write() descriptions for all class specific descriptions.
# TODO: consider adding custom vusb_connect_descriptors definitions to all class specific descriptions.

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

type usb_device_descriptor_verbose_t[USB, CLASS, SUBCLASS, PROTOCOL, PACKET, VENDOR, PRODUCT, DEVICE, CFS] {
	bLength			const[USB_DT_DEVICE_SIZE, int8]
	bDescriptorType		const[USB_DT_DEVICE, int8]

	bcdUSB			USB
	bDeviceClass		const[CLASS, int8]
	bDeviceSubClass		const[SUBCLASS, int8]
	bDeviceProtocol		const[PROTOCOL, int8]
	bMaxPacketSize0		PACKET
	idVendor		const[VENDOR, int16]
	idProduct		const[PRODUCT, int16]
	bcdDevice		const[DEVICE, int16]
	iManufacturer		const[1, int8]
	iProduct		const[2, int8]
	iSerialNumber		const[3, int8]
	bNumConfigurations	len[configs, int8]

	configs			CFS
} [packed]

type usb_device_descriptor_t[CLASS, SUBCLASS, PROTOCOL, VENDOR, PRODUCT, DEVICE, CFS] usb_device_descriptor_verbose_t[flags[usb_versions, int16], CLASS, SUBCLASS, PROTOCOL, flags[usb_device_max_packet_sizes, int8], VENDOR, PRODUCT, DEVICE, CFS]
type usb_device_descriptor_fixed_t[USB, CLASS, SUBCLASS, PROTOCOL, PACKET, VENDOR, PRODUCT, DEVICE, CFS] usb_device_descriptor_verbose_t[const[USB, int16], CLASS, SUBCLASS, PROTOCOL, const[PACKET, int8], VENDOR, PRODUCT, DEVICE, CFS]

usb_versions = 0x110, 0x200, 0x201, 0x250, 0x300, 0x310

# https://elixir.bootlin.com/linux/v5.1.7/source/drivers/usb/core/hub.c#L4661
usb_device_max_packet_sizes = 8, 16, 32, 64, 255

type usb_config_descriptor_verbose_t[NUM, IFSNUM, ICONFIG, ATTRS, POWER, EXTRA, IFS] {
	bLength			const[USB_DT_CONFIG_SIZE, int8]
	bDescriptorType		const[USB_DT_CONFIG, int8]

	wTotalLength		len[parent, int16]
	bNumInterfaces		IFSNUM
	bConfigurationValue	NUM
	iConfiguration		ICONFIG
	bmAttributes		ATTRS
	bMaxPower		POWER

	extra			EXTRA
	interfaces		IFS
} [packed]

type usb_config_descriptor_t[NUM, IFSNUM, IFS] usb_config_descriptor_verbose_t[NUM, IFSNUM, int8, flags[usb_config_attributes, int8], int8, void, IFS]
type usb_config_descriptor_ifaces_array_t[NUM, IFS] usb_config_descriptor_t[NUM, len[interfaces, int8], IFS]
type usb_config_descriptor_fixed_t[NUM, IFSNUM, ATTRS, POWER, IFS] usb_config_descriptor_verbose_t[const[NUM, int8], const[IFSNUM, int8], const[0, int8], const[ATTRS, int8], const[POWER, int8], void, IFS]
type usb_config_descriptor_extra_t[NUM, IFSNUM, EXTRA, IFS] usb_config_descriptor_verbose_t[NUM, IFSNUM, int8, flags[usb_config_attributes, int8], int8, EXTRA, IFS]

type usb_interface_descriptor_verbose_t[IFNUM, ALTNUM, EPSNUM, CLASS, SUBCLASS, PROTOCOL, IIF, EXTRA, EPS] {
	bLength			const[USB_DT_INTERFACE_SIZE, int8]
	bDescriptorType		const[USB_DT_INTERFACE, int8]

	bInterfaceNumber	IFNUM
	bAlternateSetting	ALTNUM
	bNumEndpoints		EPSNUM
	bInterfaceClass		CLASS
	bInterfaceSubClass	SUBCLASS
	bInterfaceProtocol	PROTOCOL
	iInterface		IIF

	extra			EXTRA
	endpoints		EPS
} [packed]

type usb_interface_descriptor_t[IFNUM, ALTNUM, EPSNUM, CLASS, SUBCLASS, PROTOCOL, EXTRA, EPS] usb_interface_descriptor_verbose_t[IFNUM, ALTNUM, EPSNUM, CLASS, SUBCLASS, PROTOCOL, int8, EXTRA, EPS]
type usb_interface_descriptor_eps_array_t[IFNUM, ALTNUM, CLASS, SUBCLASS, PROTOCOL, EXTRA, EPS] usb_interface_descriptor_t[IFNUM, ALTNUM, len[endpoints, int8], CLASS, SUBCLASS, PROTOCOL, EXTRA, EPS]
type usb_interface_descriptor_fixed_t[IFNUM, ALTNUM, EPSNUM, CLASS, SUBCLASS, PROTOCOL, EXTRA, EPS] usb_interface_descriptor_verbose_t[const[IFNUM, int8], const[ALTNUM, int8], const[EPSNUM, int8], const[CLASS, int8], const[SUBCLASS, int8], const[PROTOCOL, int8], const[0, int8], EXTRA, EPS]

# TODO: non-audio endpoints have USB_DT_ENDPOINT_SIZE.
type usb_endpoint_descriptor_verbose_t[ADDR, ATTRS, PACKET, INTERVAL, REFRESH, SYNCH, EXTRA] {
	bLength			const[USB_DT_ENDPOINT_AUDIO_SIZE, int8]
	bDescriptorType		const[USB_DT_ENDPOINT, int8]

	bEndpointAddress	ADDR
	bmAttributes		ATTRS
	wMaxPacketSize		PACKET
	bInterval		INTERVAL

	bRefresh		REFRESH
	bSynchAddress		SYNCH

	extra			EXTRA
} [packed]

type usb_endpoint_descriptor_t[ADDR, ATTRS, EXTRA] usb_endpoint_descriptor_verbose_t[ADDR, ATTRS, flags[usb_endpoint_max_packet_sizes, int16], int8, int8, int8, EXTRA]
type usb_endpoint_descriptor_fixed_t[ADDR, ATTRS, PACKET, INTERVAL, EXTRA] usb_endpoint_descriptor_verbose_t[const[ADDR, int8], const[ATTRS, int8], const[PACKET, int16], const[INTERVAL, int8], const[0, int8], const[0, int8], EXTRA]

# TODO: dummy driver has complex requirements for packet sizes, account for those:
# https://elixir.bootlin.com/linux/v5.3.6/source/drivers/usb/gadget/udc/dummy_hcd.c#L497
usb_endpoint_max_packet_sizes = 8, 16, 32, 64, 512, 1023, 1024

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# Generic USB device, configuration, interface and endpoint descriptors.

# We only support one configuration per device.
# bDeviceClass, bDeviceSubClass, bDeviceProtocol, idVendor, idProduct
# and bcdDevice are patched by Go code, see sys/linux/init_vusb.go.
usb_device_descriptor {
	inner	usb_device_descriptor_t[0, 0, 0, 0, 0, 0, array[usb_config_descriptor, 1]]
} [packed]

usb_config_descriptor {
	inner	usb_config_descriptor_ifaces_array_t[int8, array[usb_interface_descriptor, 1:4]]
} [packed]

usb_config_attributes = USB_CONFIG_ATT_ONE, USB_CONFIG_ATT_SELFPOWER, USB_CONFIG_ATT_WAKEUP, USB_CONFIG_ATT_BATTERY

# bInterfaceNumber, bInterfaceClass, bInterfaceSubClass and bInterfaceProtocol
# are patched by Go code, see sys/linux/init_vusb.go.
usb_interface_descriptor {
	inner	usb_interface_descriptor_eps_array_t[int8, int8, const[0, int8], const[0, int8], const[0, int8], array[usb_interface_extra_descriptor, 0:2], array[usb_endpoint_descriptor, 0:16]]
} [packed]

usb_endpoint_descriptor {
	inner	usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], flags[usb_endpoint_attributes, int8], array[usb_endpoint_extra_descriptor, 0:2]]
} [packed]

usb_endpoint_addresses = 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, USB_DIR_OUT, USB_DIR_IN

usb_endpoint_attributes = USB_ENDPOINT_XFER_CONTROL, USB_ENDPOINT_XFER_ISOC, USB_ENDPOINT_XFER_BULK, USB_ENDPOINT_XFER_INT, USB_ENDPOINT_INTR_PERIODIC, USB_ENDPOINT_INTR_NOTIFICATION, USB_ENDPOINT_SYNC_NONE, USB_ENDPOINT_SYNC_ASYNC, USB_ENDPOINT_SYNC_ADAPTIVE, USB_ENDPOINT_SYNC_SYNC, USB_ENDPOINT_USAGE_DATA, USB_ENDPOINT_USAGE_FEEDBACK, USB_ENDPOINT_USAGE_FEEDBACK

vusb_connect_descriptors {
	qual_len	len[qual, int32]
	qual		ptr[in, usb_qualifier_descriptor]
	bos_len		len[bos, int32]
	bos		ptr[in, usb_bos_descriptor]
	strs_len	len[strs, int32]
	strs		array[vusb_connect_string_descriptor]
} [packed]

vusb_connect_string_descriptor {
	len	len[str, int32]
	str	ptr[in, usb_string_descriptor]
} [packed]

vusb_descriptors {
	len	len[parent, int32]
	generic	ptr[in, vusb_descriptor_generic]

	string	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]]
	bos	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_BOS, usb_bos_descriptor]]

	hub_hs	ptr[in, vusb_descriptor_t[USB_TYPE_CLASS, USB_DT_HUB, usb_hub_descriptor_hs]]
	hub_ss	ptr[in, vusb_descriptor_t[USB_TYPE_CLASS, USB_DT_SS_HUB, usb_hub_descriptor_ss]]
} [packed]

vusb_descriptor_generic {
	req_type	flags[usb_request_types, int8]
	desc_type	flags[usb_descriptor_types, int8]
	len		bytesize[data, int32]
	data		usb_generic_descriptor
} [packed]

usb_request_types = USB_TYPE_STANDARD, USB_TYPE_CLASS, USB_TYPE_VENDOR

type vusb_descriptor_t[CLASS, REQ, DATA] {
	type	const[CLASS, int8]
	req	const[REQ, int8]
	len	bytesize[data, int32]
	data	DATA
} [packed]

# TODO: consider doing lookups based on USB_RECIP values.
vusb_responses {
	len				len[parent, int32]
	generic				ptr[in, vusb_response_generic]

	get_interface			ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]]
	get_configuration		ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]]

# TODO: move these into custom descriptions for hub class when they are added.
	hub_USB_REQ_GET_STATUS_hub	ptr[in, vusb_response_t[USB_TYPE_CLASS, USB_REQ_GET_STATUS, usb_hub_status]]
	hub_USB_REQ_GET_STATUS_port	ptr[in, vusb_response_t[USB_TYPE_CLASS, USB_REQ_GET_STATUS, usb_port_status]]

# TODO: move these into custom descriptions for asix driver when they are added.
	asix_AX_CMD_READ_MII_REG	ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_MII_REG, int16]]
	asix_AX_CMD_STATMNGSTS_REG	ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_STATMNGSTS_REG, int8]]
	asix_AX_CMD_READ_EEPROM		ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_EEPROM, array[int8, 2]]]
	asix_AX_CMD_READ_RX_CTL		ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_RX_CTL, int16]]
	asix_AX_CMD_READ_NODE_ID	ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_NODE_ID, mac_addr]]
	asix_AX88172_CMD_READ_NODE_ID	ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX88172_CMD_READ_NODE_ID, mac_addr]]
	asix_AX_CMD_READ_PHY_ID		ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_PHY_ID, array[int8, 2]]]
	asix_AX_CMD_READ_MEDIUM_STATUS	ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_MEDIUM_STATUS, int16]]
	asix_AX_CMD_READ_MONITOR_MODE	ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_MONITOR_MODE, int8]]
	asix_AX_CMD_READ_GPIOS		ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_READ_GPIOS, int8]]
	asix_AX_CMD_SW_PHY_STATUS	ptr[in, vusb_response_t[USB_TYPE_VENDOR, AX_CMD_SW_PHY_STATUS, int8]]
} [packed]

vusb_response_generic {
	type	flags[usb_request_types, int8]
	req	flags[usb_requests, int8]
	len	bytesize[data, int32]
	data	array[int8, 0:256]
} [packed]

usb_requests = USB_REQ_GET_STATUS, USB_REQ_CLEAR_FEATURE, USB_REQ_SET_FEATURE, USB_REQ_SET_ADDRESS, USB_REQ_GET_DESCRIPTOR, USB_REQ_SET_DESCRIPTOR, USB_REQ_GET_CONFIGURATION, USB_REQ_SET_CONFIGURATION, USB_REQ_GET_INTERFACE, USB_REQ_SET_INTERFACE, USB_REQ_SYNCH_FRAME, USB_REQ_SET_SEL, USB_REQ_SET_ISOCH_DELAY, USB_REQ_SET_ENCRYPTION, USB_REQ_GET_ENCRYPTION, USB_REQ_RPIPE_ABORT, USB_REQ_SET_HANDSHAKE, USB_REQ_RPIPE_RESET, USB_REQ_GET_HANDSHAKE, USB_REQ_SET_CONNECTION, USB_REQ_SET_SECURITY_DATA, USB_REQ_GET_SECURITY_DATA, USB_REQ_SET_WUSB_DATA, USB_REQ_LOOPBACK_DATA_WRITE, USB_REQ_LOOPBACK_DATA_READ, USB_REQ_SET_INTERFACE_DS, USB_REQ_GET_PARTNER_PDO, USB_REQ_GET_BATTERY_STATUS, USB_REQ_SET_PDO, USB_REQ_GET_VDM, USB_REQ_SEND_VDM

type vusb_response_t[CLASS, REQ, DATA] {
	type	const[CLASS, int8]
	req	const[REQ, int8]
	len	bytesize[data, int32]
	data	DATA
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# USB descriptors requested by the kernel before the SET_CONFIGURATION request.

# TODO: figure out when is the USB_DT_OTG descriptor used.
# TODO: figure out when is the USB_DT_INTERFACE_ASSOCIATION descriptor used.
# TODO: figure out when is the USB_DT_BOS descriptor used.

type usb_string_descriptor_t[DATA] {
	bLength		len[parent, int8]
	bDescriptorType	const[USB_DT_STRING, int8]

	data		DATA
} [packed]

usb_string_descriptor [
	lang_id	usb_string_descriptor_t[flags[usb_lang_ids, int16]]
	string	usb_string_descriptor_t[array[int8, 0:256]]
] [varlen]

usb_lang_ids = 0x436, 0x41c, 0x401, 0x801, 0xc01, 0x1001, 0x1401, 0x1801, 0x1c01, 0x2001, 0x2401, 0x2801, 0x2c01, 0x3001, 0x3401, 0x3801, 0x3c01, 0x4001, 0x42b, 0x44d, 0x42c, 0x82c, 0x42d, 0x423, 0x445, 0x402, 0x455, 0x403, 0x404, 0x804, 0xc04, 0x1004, 0x1404, 0x41a, 0x405, 0x406, 0x413, 0x813, 0x409, 0x809, 0xc09, 0x1009, 0x1409, 0x1809, 0x1c09, 0x2009, 0x2409, 0x2809, 0x2c09, 0x3009, 0x3409, 0x425, 0x438, 0x429, 0x40b, 0x40c, 0x80c, 0xc0c, 0x100c, 0x140c, 0x180c, 0x437, 0x407, 0x807, 0xc07, 0x1007, 0x1407, 0x408, 0x447, 0x40d, 0x439, 0x40e, 0x40f, 0x421, 0x410, 0x810, 0x411, 0x44b, 0x860, 0x43f, 0x457, 0x412, 0x812, 0x426, 0x427, 0x827, 0x42f, 0x43e, 0x83e, 0x44c, 0x458, 0x44e, 0x861, 0x414, 0x814, 0x448, 0x415, 0x416, 0x816, 0x446, 0x418, 0x419, 0x44f, 0xc1a, 0x81a, 0x459, 0x41b, 0x424, 0x40a, 0x80a, 0xc0a, 0x100a, 0x140a, 0x180a, 0x1c0a, 0x200a, 0x240a, 0x280a, 0x2c0a, 0x300a, 0x340a, 0x380a, 0x3c0a, 0x400a, 0x440a, 0x480a, 0x4c0a, 0x500a, 0x430, 0x441, 0x41d, 0x81d, 0x449, 0x444, 0x44a, 0x41e, 0x41f, 0x422, 0x420, 0x820, 0x443, 0x843, 0x42a, 0x4ff, 0xf0ff, 0xf4ff, 0xf8ff, 0xfcff

usb_qualifier_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_DEVICE_QUALIFIER, int8]

	bcdUSB			flags[usb_versions, int16]
	bDeviceClass		int8
	bDeviceSubClass		int8
	bDeviceProtocol		int8
	bMaxPacketSize0		flags[usb_device_max_packet_sizes, int8]
	bNumConfigurations	int8
	bRESERVED		const[0, int8]
} [packed]

usb_bos_descriptor {
	bLength		const[USB_DT_BOS_SIZE, int8]
	bDescriptorType	const[USB_DT_BOS, int8]

	wTotalLength	len[parent, int16]
	bNumDeviceCaps	len[caps, int8]

	caps		array[usb_dev_cap, 0:6]
} [packed]

usb_dev_cap [
	generic		usb_generic_cap_descriptor
	wireless	usb_wireless_cap_descriptor
	ext_cap		usb_ext_cap_descriptor
	ss_cap		usb_ss_cap_descriptor
	ss_container_id	usb_ss_container_id_descriptor
	ssp_cap		usb_ssp_cap_descriptor
	ptm_cap		usb_ptm_cap_descriptor
] [varlen]

usb_generic_cap_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_DEVICE_CAPABILITY, int8]
	bDevCapabilityType	flags[usb_capability_types, int8]

	data			array[int8, 0:256]
} [packed]

usb_capability_types = USB_CAP_TYPE_WIRELESS_USB, USB_CAP_TYPE_EXT, USB_SS_CAP_TYPE, USB_SSP_CAP_TYPE, CONTAINER_ID_TYPE, USB_PTM_CAP_TYPE

usb_wireless_cap_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_DEVICE_CAPABILITY, int8]
	bDevCapabilityType	const[USB_CAP_TYPE_WIRELESS_USB, int8]

	bmAttributes		flags[usb_wireless_cap_attributes, int8]
	wPHYRates		flags[usb_wireless_cap_phyrates, int16]
	bmTFITXPowerInfo	int8
	bmFFITXPowerInfo	int8
	bmBandGroup		int16
	bReserved		int8
} [packed]

usb_wireless_cap_attributes = USB_WIRELESS_P2P_DRD, USB_WIRELESS_BEACON_MASK, USB_WIRELESS_BEACON_SELF, USB_WIRELESS_BEACON_DIRECTED, USB_WIRELESS_BEACON_NONE

usb_wireless_cap_phyrates = USB_WIRELESS_PHY_53, USB_WIRELESS_PHY_80, USB_WIRELESS_PHY_107, USB_WIRELESS_PHY_160, USB_WIRELESS_PHY_200, USB_WIRELESS_PHY_320, USB_WIRELESS_PHY_400, USB_WIRELESS_PHY_480

usb_ext_cap_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_DEVICE_CAPABILITY, int8]
	bDevCapabilityType	const[USB_CAP_TYPE_EXT, int8]

	bmAttributes1		flags[usb_ext_cap_attributes, int32:8]
	bmAttributes2		int32:4
	bmAttributes3		int32:4
	bmAttributes4		int32:16
} [packed]

usb_ext_cap_attributes = USB_LPM_SUPPORT, USB_BESL_SUPPORT, USB_BESL_BASELINE_VALID, USB_BESL_DEEP_VALID

usb_ss_cap_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_DEVICE_CAPABILITY, int8]
	bDevCapabilityType	const[USB_SS_CAP_TYPE, int8]

	bmAttributes		flags[usb_ss_cap_attributes, int8]
	wSpeedSupported		flags[usb_ss_cap_speed, int16]
	bFunctionalitySupport	int8
	bU1devExitLat		int8
	bU2DevExitLat		int16
} [packed]

usb_ss_cap_attributes = USB_LTM_SUPPORT

usb_ss_cap_speed = USB_LOW_SPEED_OPERATION, USB_FULL_SPEED_OPERATION, USB_HIGH_SPEED_OPERATION, USB_5GBPS_OPERATION

usb_ss_container_id_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_DEVICE_CAPABILITY, int8]
	bDevCapabilityType	const[CONTAINER_ID_TYPE, int8]

	bReserved		int8
	ContainerID		array[int8, 16]
} [packed]

usb_ssp_cap_descriptor {
	bLength				len[parent, int8]
	bDescriptorType			const[USB_DT_DEVICE_CAPABILITY, int8]
	bDevCapabilityType		const[USB_SSP_CAP_TYPE, int8]

	bReserved			int8
	bmAttributesSublinkSpeeds	len[bmSublinkSpeedAttr, int32:5]
	bmAttributesSpeedIDs		int32:27
	wFunctionalitySupport		flags[usb_ssp_cap_funcs, int16]
	wReserved			int16
	bmSublinkSpeedAttr		array[flags[usb_ssp_cap_sublink_speeds, int32], 0:6]
} [packed]

usb_ssp_cap_funcs = USB_SSP_MIN_SUBLINK_SPEED_ATTRIBUTE_ID, USB_SSP_MIN_RX_LANE_COUNT, USB_SSP_MIN_TX_LANE_COUNT

usb_ssp_cap_sublink_speeds = USB_SSP_SUBLINK_SPEED_SSID, USB_SSP_SUBLINK_SPEED_LSE, USB_SSP_SUBLINK_SPEED_ST, USB_SSP_SUBLINK_SPEED_RSVD, USB_SSP_SUBLINK_SPEED_LP, USB_SSP_SUBLINK_SPEED_LSM

usb_ptm_cap_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_DEVICE_CAPABILITY, int8]
	bDevCapabilityType	const[USB_PTM_CAP_TYPE, int8]
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# Extra USB descriptors that come after an interface or an endpoint descriptor.

# TODO: consider removing class specific descriptors here for described classes.
usb_interface_extra_descriptor [
	generic		usb_generic_descriptor
	hid_hid		usb_hid_descriptor_hid
	cdc_ecm		usb_cdc_header_ecm
	cdc_ncm		usb_cdc_header_ncm
	uac_control	uac_control_iface_extra_descriptors
	uac_as		uac_as_iface_extra_descriptors
] [varlen]

usb_endpoint_extra_descriptor [
	generic	usb_generic_descriptor
	uac_iso	uac_iso_endpoint_descriptor
] [varlen]

usb_generic_descriptor {
	bLength		len[parent, int8]
	bDescriptorType	flags[usb_descriptor_types, int8]

	data		array[int8, 0:256]
} [packed]

usb_descriptor_types = USB_DT_DEVICE, USB_DT_CONFIG, USB_DT_STRING, USB_DT_INTERFACE, USB_DT_ENDPOINT, USB_DT_DEVICE_QUALIFIER, USB_DT_OTHER_SPEED_CONFIG, USB_DT_INTERFACE_POWER, USB_DT_OTG, USB_DT_DEBUG, USB_DT_INTERFACE_ASSOCIATION, USB_DT_SECURITY, USB_DT_KEY, USB_DT_ENCRYPTION_TYPE, USB_DT_BOS, USB_DT_DEVICE_CAPABILITY, USB_DT_WIRELESS_ENDPOINT_COMP, USB_DT_WIRE_ADAPTER, USB_DT_RPIPE, USB_DT_CS_RADIO_CONTROL, USB_DT_PIPE_USAGE, USB_DT_SS_ENDPOINT_COMP, USB_DT_SSP_ISOC_ENDPOINT_COMP, HID_DT_HID, HID_DT_REPORT, HID_DT_PHYSICAL

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# USB descriptors requested after the SET_CONFIGURATION request.

usb_hub_descriptor_hs {
	bDescLength		len[parent, int8]
	bDescriptorType		const[USB_DT_HUB, int8]

	bNbrPorts		int8
	wHubCharacteristics	flags[usb_hub_characteristics, int16]
	bPwrOn2PwrGood		int8
	bHubContrCurrent	int8

	DeviceRemovable		array[int8, USB_HUB_PORTS_BITS]
	PortPwrCtrlMask		array[int8, USB_HUB_PORTS_BITS]
} [packed]

usb_hub_descriptor_ss {
	bDescLength		len[parent, int8]
	bDescriptorType		const[USB_DT_SS_HUB, int8]

	bNbrPorts		int8
	wHubCharacteristics	flags[usb_hub_characteristics, int16]
	bPwrOn2PwrGood		int8
	bHubContrCurrent	int8

	bHubHdrDecLat		int8
	wHubDelay		int16
	DeviceRemovable		int16
} [packed]

define USB_HUB_PORTS_BITS	((USB_MAXCHILDREN + 1 + 7) / 8)

usb_hub_characteristics = HUB_CHAR_LPSM, HUB_CHAR_COMMON_LPSM, HUB_CHAR_INDV_PORT_LPSM, HUB_CHAR_NO_LPSM, HUB_CHAR_COMPOUND, HUB_CHAR_OCPM, HUB_CHAR_COMMON_OCPM, HUB_CHAR_INDV_PORT_OCPM, HUB_CHAR_NO_OCPM, HUB_CHAR_TTTT, HUB_CHAR_PORTIND

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# Replies to USB control requests requested after the SET_CONFIGURATION request.

usb_port_status {
	wPortStatus	flags[usb_port_status_flags, int16]
	wPortChange	flags[usb_port_change_flags, int16]
	dwExtPortStatus	array[flags[usb_ext_port_status_flags, int32], 0:1]
} [packed]

usb_port_status_flags = USB_PORT_STAT_CONNECTION, USB_PORT_STAT_ENABLE, USB_PORT_STAT_SUSPEND, USB_PORT_STAT_OVERCURRENT, USB_PORT_STAT_RESET, USB_PORT_STAT_L1, USB_PORT_STAT_POWER, USB_PORT_STAT_LOW_SPEED, USB_PORT_STAT_HIGH_SPEED, USB_PORT_STAT_TEST, USB_PORT_STAT_INDICATOR, USB_PORT_STAT_LINK_STATE, USB_SS_PORT_STAT_POWER, USB_SS_PORT_STAT_SPEED, USB_PORT_STAT_SPEED_5GBPS, USB_SS_PORT_LS_U0, USB_SS_PORT_LS_U1, USB_SS_PORT_LS_U2, USB_SS_PORT_LS_U3, USB_SS_PORT_LS_SS_DISABLED, USB_SS_PORT_LS_RX_DETECT, USB_SS_PORT_LS_SS_INACTIVE, USB_SS_PORT_LS_POLLING, USB_SS_PORT_LS_RECOVERY, USB_SS_PORT_LS_HOT_RESET, USB_SS_PORT_LS_COMP_MOD, USB_SS_PORT_LS_LOOPBACK

usb_port_change_flags = USB_PORT_STAT_C_CONNECTION, USB_PORT_STAT_C_ENABLE, USB_PORT_STAT_C_SUSPEND, USB_PORT_STAT_C_OVERCURRENT, USB_PORT_STAT_C_RESET, USB_PORT_STAT_C_L1, USB_PORT_STAT_C_BH_RESET, USB_PORT_STAT_C_LINK_STATE, USB_PORT_STAT_C_CONFIG_ERROR

usb_ext_port_status_flags = USB_EXT_PORT_STAT_RX_SPEED_ID, USB_EXT_PORT_STAT_TX_SPEED_ID, USB_EXT_PORT_STAT_RX_LANES, USB_EXT_PORT_STAT_TX_LANES

usb_hub_status {
	wHubStatus	flags[usb_hub_status_flags, int16]
	wHubChange	flags[usb_hub_change_flags, int16]
} [packed]

usb_hub_status_flags = HUB_STATUS_LOCAL_POWER, HUB_STATUS_OVERCURRENT

usb_hub_change_flags = HUB_CHANGE_LOCAL_POWER, HUB_CHANGE_OVERCURRENT

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# HID device class specific descriptions.
# https://www.usb.org/sites/default/files/documents/hid1_11.pdf
# https://elixir.bootlin.com/linux/latest/source/drivers/hid/usbhid/hid-core.c
# https://elixir.bootlin.com/linux/latest/source/drivers/hid/hid-core.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/hid.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_hid.c

# Connected HID devices are known to create the following /dev/ files:
# /dev/hidraw#, /dev/usb/hiddev# and /dev/input/event#.

resource fd_usb_hid[fd_usb]

syz_usb_connect$hid(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_hid], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_hid (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_control_io$hid(fd fd_usb_hid, descs ptr[in, vusb_descriptors_hid], resps ptr[in, vusb_responses_hid]) (timeout[300], remote_cover)

# idVendor and idProduct are patched by Go code, see sys/linux/init_vusb.go.
usb_device_descriptor_hid {
	inner	usb_device_descriptor_t[0, 0, 0, 0, 0, 64, array[usb_config_descriptor_hid, 1]]
} [packed]

usb_config_descriptor_hid {
	inner	usb_config_descriptor_ifaces_array_t[const[1, int8], array[usb_interface_descriptor_hid, 1]]
} [packed]

usb_interface_descriptor_hid {
	inner	usb_interface_descriptor_t[const[0, int8], int8, int8[1:2], const[USB_CLASS_HID, int8], const[USB_INTERFACE_SUBCLASS_BOOT, int8], flags[usb_hid_protocols, int8], usb_hid_descriptor_hid, usb_endpoint_descriptors_hid]
} [packed]

usb_hid_protocols = USB_INTERFACE_PROTOCOL_KEYBOARD, USB_INTERFACE_PROTOCOL_MOUSE

usb_endpoint_descriptors_hid {
	in	usb_endpoint_descriptor_hid_in
	out	array[usb_endpoint_descriptor_hid_out, 0:1]
} [packed]

usb_endpoint_descriptor_hid_in {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_HID_IN_ADDRESS, int8], const[USB_ENDPOINT_HID_ATTRIBUTES, int8], void]
} [packed]

usb_endpoint_descriptor_hid_out {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_HID_OUT_ADDRESS, int8], const[USB_ENDPOINT_HID_ATTRIBUTES, int8], void]
} [packed]

define USB_ENDPOINT_HID_ATTRIBUTES	(USB_ENDPOINT_XFER_INT)
define USB_ENDPOINT_HID_IN_ADDRESS	(1 | USB_DIR_IN)
define USB_ENDPOINT_HID_OUT_ADDRESS	(2)

vusb_descriptors_hid {
	len		len[parent, int32]
	generic		ptr[in, vusb_descriptor_generic]

	USB_DT_STRING	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]]

# For unknown reasons these are requested as USB_TYPE_STANDARD and not as USB_TYPE_CLASS.
# Linux doesn't request HID_DT_HID, but some hosts might do that.
	HID_DT_REPORT	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, HID_DT_REPORT, hid_descriptor_report]]
	HID_DT_HID	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, HID_DT_HID, usb_hid_descriptor_hid]]
} [packed]

vusb_responses_hid {
	len				len[parent, int32]
	generic				ptr[in, vusb_response_generic]

	USB_REQ_GET_INTERFACE		ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]]
	USB_REQ_GET_CONFIGURATION	ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]]

	HID_REQ_GET_REPORT		ptr[in, vusb_response_t[USB_TYPE_CLASS, HID_REQ_GET_REPORT, array[int8, 0:256]]]
	HID_REQ_GET_PROTOCOL		ptr[in, vusb_response_t[USB_TYPE_CLASS, HID_REQ_GET_PROTOCOL, int8]]
} [packed]

# USB HID specifications allows for multiple report and physical descriptors
# to be present, but I don't see any support for them in the Linux kernel,
# except for a single report descriptor.
usb_hid_descriptor_hid {
	bLength		len[parent, int8]
	bDescriptorType	const[HID_DT_HID, int8]

	bcdHID		int16
	bCountryCode	int8
	bNumDescriptors	const[1, int8]

	report_desc	usb_hid_class_descriptor_report
} [packed]

usb_hid_class_descriptor_report {
	bDescriptorType		const[HID_DT_REPORT, int8]
	wDescriptorLength	int16[0:HID_MAX_DESCRIPTOR_SIZE]
} [packed]

# TODO: it's hard to describe the REPORT descriptor structure via syzkaller
# descriptions, so consider generating it in Go code.
# TODO: the length of REPORT descriptor must match the value in HID descriptor.
# TODO: there are vendor specific REPORT descriptor formats (Logitech HID++).

# Linux HID stack doesn't support long items.
hid_descriptor_report {
	items	array[hid_report_item_short]
} [packed]

type hid_report_item_short_012_t[TYPE, TAGS] {
	bSize	len[data, int8:2]
	bType	const[TYPE, int8:2]
	bTag	flags[TAGS, int8:4]
	data	array[int8, 0:2]
} [packed]

type hid_report_item_short_4_t[TYPE, TAGS] {
	bSize	const[3, int8:2]
	bType	const[TYPE, int8:2]
	bTag	flags[TAGS, int8:4]
	data	array[int8, 4]
} [packed]

type hid_report_item_short_t[TYPE, TAGS] [
	item_012	hid_report_item_short_012_t[TYPE, TAGS]
	item_4		hid_report_item_short_4_t[TYPE, TAGS]
] [varlen]

hid_report_item_short [
	main	hid_report_item_short_t[HID_ITEM_TYPE_MAIN, hid_report_item_main_tags]
	global	hid_report_item_short_t[HID_ITEM_TYPE_GLOBAL, hid_report_item_global_tags]
	local	hid_report_item_short_t[HID_ITEM_TYPE_LOCAL, hid_report_item_local_tags]
] [varlen]

hid_report_item_main_tags = HID_MAIN_ITEM_TAG_INPUT, HID_MAIN_ITEM_TAG_OUTPUT, HID_MAIN_ITEM_TAG_FEATURE, HID_MAIN_ITEM_TAG_BEGIN_COLLECTION, HID_MAIN_ITEM_TAG_END_COLLECTION
hid_report_item_global_tags = HID_GLOBAL_ITEM_TAG_USAGE_PAGE, HID_GLOBAL_ITEM_TAG_LOGICAL_MINIMUM, HID_GLOBAL_ITEM_TAG_LOGICAL_MAXIMUM, HID_GLOBAL_ITEM_TAG_PHYSICAL_MINIMUM, HID_GLOBAL_ITEM_TAG_PHYSICAL_MAXIMUM, HID_GLOBAL_ITEM_TAG_UNIT_EXPONENT, HID_GLOBAL_ITEM_TAG_UNIT, HID_GLOBAL_ITEM_TAG_REPORT_SIZE, HID_GLOBAL_ITEM_TAG_REPORT_ID, HID_GLOBAL_ITEM_TAG_REPORT_COUNT, HID_GLOBAL_ITEM_TAG_PUSH, HID_GLOBAL_ITEM_TAG_POP
hid_report_item_local_tags = HID_LOCAL_ITEM_TAG_USAGE, HID_LOCAL_ITEM_TAG_USAGE_MINIMUM, HID_LOCAL_ITEM_TAG_USAGE_MAXIMUM, HID_LOCAL_ITEM_TAG_DESIGNATOR_INDEX, HID_LOCAL_ITEM_TAG_DESIGNATOR_MINIMUM, HID_LOCAL_ITEM_TAG_DESIGNATOR_MAXIMUM, HID_LOCAL_ITEM_TAG_STRING_INDEX, HID_LOCAL_ITEM_TAG_STRING_MINIMUM, HID_LOCAL_ITEM_TAG_STRING_MAXIMUM, HID_LOCAL_ITEM_TAG_DELIMITER

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# PRINTER device class specific descriptions.
# https://www.usb.org/sites/default/files/usbprint11a021811.pdf
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/class/usblp.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/printer.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_printer.c

# Connected PRINTER devices are known to create the following /dev/ files:
# /dev/usb/lp#.
# TODO: write descriptions for those.

# drivers/usb/class/usblp.c
define USBLP_REQ_GET_ID	0x00
define USBLP_REQ_GET_STATUS	0x01
define USBLP_REQ_RESET	0x02
define USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST	0x00
define USBLP_FIRST_PROTOCOL	1
define USBLP_LAST_PROTOCOL	3

resource fd_usb_printer[fd_usb]

syz_usb_connect$printer(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_printer], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_printer (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_control_io$printer(fd fd_usb_printer, descs ptr[in, vusb_descriptors_printer], resps ptr[in, vusb_responses_printer]) (timeout[300], remote_cover)

usb_device_descriptor_printer {
	inner	usb_device_descriptor_t[0, 0, 0, 0x525, 0xa4a8, 64, array[usb_config_descriptor_printer, 1]]
} [packed]

usb_config_descriptor_printer {
	inner	usb_config_descriptor_ifaces_array_t[const[1, int8], array[usb_interface_descriptor_printer, 1]]
} [packed]

usb_interface_descriptor_printer {
	inner	usb_interface_descriptor_t[const[0, int8], int8, int8[1:2], const[USB_CLASS_PRINTER, int8], const[1, int8], int8[USBLP_FIRST_PROTOCOL:USBLP_LAST_PROTOCOL], void, usb_endpoint_descriptors_printer]
} [packed]

usb_endpoint_descriptors_printer {
	in	usb_endpoint_descriptor_printer_out
	out	array[usb_endpoint_descriptor_printer_in, 0:1]
} [packed]

usb_endpoint_descriptor_printer_out {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_PRINTER_OUT_ADDRESS, int8], const[USB_ENDPOINT_PRINTER_ATTRIBUTES, int8], void]
} [packed]

usb_endpoint_descriptor_printer_in {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_PRINTER_IN_ADDRESS, int8], const[USB_ENDPOINT_PRINTER_ATTRIBUTES, int8], void]
} [packed]

define USB_ENDPOINT_PRINTER_ATTRIBUTES	(USB_ENDPOINT_XFER_BULK)
define USB_ENDPOINT_PRINTER_OUT_ADDRESS	(1)
define USB_ENDPOINT_PRINTER_IN_ADDRESS	(2 | USB_DIR_IN)

vusb_descriptors_printer {
	len		len[parent, int32]
	generic		ptr[in, vusb_descriptor_generic]

	USB_DT_STRING	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]]
} [packed]

vusb_responses_printer {
	len					len[parent, int32]
	generic					ptr[in, vusb_response_generic]

	USB_REQ_GET_INTERFACE			ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]]
	USB_REQ_GET_CONFIGURATION		ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]]

	USBLP_REQ_GET_ID			ptr[in, vusb_response_t[USB_TYPE_CLASS, USBLP_REQ_GET_ID, usb_printer_get_id_response]]
	USBLP_REQ_GET_STATUS			ptr[in, vusb_response_t[USB_TYPE_CLASS, USBLP_REQ_GET_STATUS, int8]]
	USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST	ptr[in, vusb_response_t[USB_TYPE_CLASS, USBLP_REQ_HP_CHANNEL_CHANGE_REQUEST, int8]]
} [packed]

usb_printer_get_id_response {
	length	len[id, int16be]
	id	array[int8, 0:256]
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# CDC ECM (Ethernet) device class specific descriptions.
# https://www.usb.org/document-library/class-definitions-communication-devices-12
# https://elixir.bootlin.com/linux/latest/source/drivers/net/usb/cdc_ether.c
# https://elixir.bootlin.com/linux/latest/source/drivers/net/usb/usbnet.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/ether.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_ecm.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/u_ether.c

# Connected CDC ECM devices are known to create usbN network interfaces.
# TODO: write descriptions for those.

resource fd_usb_cdc_ecm[fd_usb]

syz_usb_connect$cdc_ecm(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_cdc_ecm], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_cdc_ecm (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_control_io$cdc_ecm(fd fd_usb_cdc_ecm, descs ptr[in, vusb_descriptors_cdc_ecm], resps ptr[in, vusb_responses_cdc_ecm]) (timeout[300], remote_cover)

usb_device_descriptor_cdc_ecm {
	inner	usb_device_descriptor_t[USB_CLASS_COMM, 0, 0, 0x525, 0xa4a1, 64, array[usb_config_descriptor_cdc_ecm, 1]]
} [packed]

usb_config_descriptor_cdc_ecm {
	inner	usb_config_descriptor_ifaces_array_t[const[1, int8], array[usb_interface_descriptor_cdc_ecm, 1]]
} [packed]

# Per specification CDC ECM devices have two interfaces (control and data),
# but here we're merging them into one for simplicity since Linux supports that.
usb_interface_descriptor_cdc_ecm {
	inner	usb_interface_descriptor_t[const[0, int8], int8, int8[2:3], const[USB_CLASS_COMM, int8], const[USB_CDC_SUBCLASS_ETHERNET, int8], const[USB_CDC_PROTO_NONE, int8], usb_cdc_header_ecm, usb_endpoint_descriptors_cdc_ecm]
} [packed]

usb_endpoint_descriptors_cdc_ecm {
	notify	array[usb_endpoint_descriptor_cdc_ecm_notify, 0:1]
	in	usb_endpoint_descriptor_cdc_ecm_in
	out	usb_endpoint_descriptor_cdc_ecm_out
} [packed]

usb_endpoint_descriptor_cdc_ecm_notify {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_CDC_ECM_NOTIFY_ADDRESS, int8], const[USB_ENDPOINT_CDC_ECM_NOTIFY_ATTRIBUTES, int8], void]
} [packed]

usb_endpoint_descriptor_cdc_ecm_in {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_CDC_ECM_IN_ADDRESS, int8], const[USB_ENDPOINT_CDC_ECM_DATA_ATTRIBUTES, int8], void]
} [packed]

usb_endpoint_descriptor_cdc_ecm_out {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_CDC_ECM_OUT_ADDRESS, int8], const[USB_ENDPOINT_CDC_ECM_DATA_ATTRIBUTES, int8], void]
} [packed]

define USB_ENDPOINT_CDC_ECM_NOTIFY_ATTRIBUTES	(USB_ENDPOINT_XFER_INT)
define USB_ENDPOINT_CDC_ECM_DATA_ATTRIBUTES	(USB_ENDPOINT_XFER_BULK)
define USB_ENDPOINT_CDC_ECM_NOTIFY_ADDRESS	(1 | USB_DIR_IN)
define USB_ENDPOINT_CDC_ECM_IN_ADDRESS	(2 | USB_DIR_IN)
define USB_ENDPOINT_CDC_ECM_OUT_ADDRESS	(3)

# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/usb/core/message.c#L2137
# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/net/usb/cdc_ether.c#L155
usb_cdc_header_ecm {
	union	usb_cdc_union_desc_t[0, 0]
	header	usb_cdc_header_desc
	ether	usb_cdc_ether_desc

	other	array[usb_cdc_header_ecm_other, 0:6]
} [packed]

usb_cdc_header_ecm_other [
	call_mgmt		usb_cdc_call_mgmt_descriptor
	acm			usb_cdc_acm_descriptor
	country_functional	usb_cdc_country_functional_desc
	network_terminal	usb_cdc_network_terminal_desc
	dmm			usb_cdc_dmm_desc
	mdlm			usb_cdc_mdlm_desc
	mdlm_detail		usb_cdc_mdlm_detail_desc
	obex			usb_cdc_obex_desc
	ncm			usb_cdc_ncm_desc
	mbim			usb_cdc_mbim_desc
	mbim_extended		usb_cdc_mbim_extended_desc
] [varlen]

usb_cdc_header_desc {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_HEADER_TYPE, int8]

	bcdCDC			int16
} [packed]

usb_cdc_call_mgmt_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_CALL_MANAGEMENT_TYPE, int8]

	bmCapabilities		flags[usb_cdc_call_mgmt_caps, int8]
	bDataInterface		int8
} [packed]

usb_cdc_call_mgmt_caps = USB_CDC_CALL_MGMT_CAP_CALL_MGMT, USB_CDC_CALL_MGMT_CAP_DATA_INTF

usb_cdc_acm_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_ACM_TYPE, int8]

	bmCapabilities		flags[usb_cdc_acm_caps, int8]
} [packed]

usb_cdc_acm_caps = USB_CDC_COMM_FEATURE, USB_CDC_CAP_LINE, USB_CDC_CAP_BRK, USB_CDC_CAP_NOTIFY

type usb_cdc_union_desc_t[MASTER, SLAVE] {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_UNION_TYPE, int8]

	bMasterInterface0	const[MASTER, int8]
	bSlaveInterface0	const[SLAVE, int8]
	slave_interfaces	array[int8, 0:6]
} [packed]

usb_cdc_country_functional_desc {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_COUNTRY_TYPE, int8]

	iCountryCodeRelDate	int8
	wCountyCode0		int16
	country_codes		array[int16, 0:6]
} [packed]

usb_cdc_network_terminal_desc {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_NETWORK_TERMINAL_TYPE, int8]

	bEntityId		int8
	iName			int8
	bChannelIndex		int8
	bPhysicalInterface	int8
} [packed]

usb_cdc_ether_desc {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_ETHERNET_TYPE, int8]

	iMACAddress		const[1, int8]
	bmEthernetStatistics	int32
	wMaxSegmentSize		int16
	wNumberMCFilters	int16
	bNumberPowerFilters	int8
} [packed]

usb_cdc_dmm_desc {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_DMM_TYPE, int8]

	bcdVersion		int16
	wMaxCommand		int16
} [packed]

usb_cdc_mdlm_desc {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_MDLM_TYPE, int8]

	bcdVersion		int16
	bGUID			usb_cdc_ecm_mbm_guid
} [packed]

# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/net/usb/cdc_ether.c#L61
usb_cdc_ecm_mbm_guid {
	id0	const[0x14f5e048ba817a3, int64]
	id1	const[0x2a397ecbffc007a6, int64]
} [packed]

usb_cdc_mdlm_detail_desc {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_MDLM_DETAIL_TYPE, int8]

	bGuidDescriptorType	int8
	bDetailData		array[int8, 0:256]
} [packed]

usb_cdc_obex_desc {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_OBEX_TYPE, int8]

	bcdVersion		int16
} [packed]

usb_cdc_ncm_desc {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_NCM_TYPE, int8]

	bcdNcmVersion		int16
	bmNetworkCapabilities	flags[usb_cdc_ncm_ncaps, int8]
} [packed]

usb_cdc_ncm_ncaps = USB_CDC_NCM_NCAP_ETH_FILTER, USB_CDC_NCM_NCAP_NET_ADDRESS, USB_CDC_NCM_NCAP_ENCAP_COMMAND, USB_CDC_NCM_NCAP_MAX_DATAGRAM_SIZE, USB_CDC_NCM_NCAP_CRC_MODE, USB_CDC_NCM_NCAP_NTB_INPUT_SIZE

usb_cdc_mbim_desc {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[USB_CDC_MBIM_TYPE, int8]

	bcdMBIMVersion		int16
	wMaxControlMessage	int16
	bNumberFilters		int8
	bMaxFilterSize		int8
	wMaxSegmentSize		int16
	bmNetworkCapabilities	int8
} [packed]

usb_cdc_mbim_extended_desc {
	bLength				len[parent, int8]
	bDescriptorType			const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType		const[USB_CDC_MBIM_EXTENDED_TYPE, int8]

	bcdMBIMExtendedVersion		int16
	bMaxOutstandingCommandMessages	int8
	wMTU				int16
} [packed]

vusb_descriptors_cdc_ecm {
	len		len[parent, int32]
	generic		ptr[in, vusb_descriptor_generic]

# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/net/usb/usbnet.c#L147
	USB_DT_STRING	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor_t[usb_cdc_ecm_mac]]]
} [packed]

usb_cdc_ecm_mac {
# This is a UTF16 encoded string "424242424242".
	data0	const[0x3400320034003200, int64be]
	data1	const[0x3400320034003200, int64be]
	data2	const[0x3400320034003200, int64be]
} [packed]

vusb_responses_cdc_ecm {
	len				len[parent, int32]
	generic				ptr[in, vusb_response_generic]

	USB_REQ_GET_INTERFACE		ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]]
	USB_REQ_GET_CONFIGURATION	ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]]
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# CDC NCM class specific descriptions.
# CDC NCM is based on CDC ECM, so some of the descriptions are reused.
# https://www.usb.org/document-library/network-control-model-devices-specification-v10-and-errata-and-adopters-agreement
# https://elixir.bootlin.com/linux/latest/source/drivers/net/usb/cdc_ncm.c
# https://elixir.bootlin.com/linux/latest/source/drivers/net/usb/usbnet.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/ncm.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_ncm.c

resource fd_usb_cdc_ncm[fd_usb]

syz_usb_connect$cdc_ncm(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_cdc_ncm], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_cdc_ncm (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_control_io$cdc_ncm(fd fd_usb_cdc_ncm, descs ptr[in, vusb_descriptors_cdc_ncm], resps ptr[in, vusb_responses_cdc_ncm]) (timeout[300], remote_cover)

usb_device_descriptor_cdc_ncm {
	inner	usb_device_descriptor_t[USB_CLASS_COMM, 0, 0, 0x525, 0xa4a1, 64, array[usb_config_descriptor_cdc_ncm, 1]]
} [packed]

usb_config_descriptor_cdc_ncm {
	inner	usb_config_descriptor_t[const[1, int8], const[2, int8], usb_interface_descriptors_cdc_ncm]
} [packed]

usb_interface_descriptors_cdc_ncm {
	control		usb_interface_descriptor_fixed_t[0, CDC_NCM_COMM_ALTSETTING_NCM, 1, USB_CLASS_COMM, USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE, usb_cdc_header_ncm, usb_endpoint_descriptor_cdc_ecm_notify]
	data_nop	usb_interface_descriptor_fixed_t[1, 0, 0, USB_CLASS_COMM, USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE, void, void]
	data		usb_interface_descriptor_fixed_t[1, CDC_NCM_DATA_ALTSETTING_NCM, 2, USB_CLASS_COMM, USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE, void, usb_endpoint_descriptors_cdc_ncm_data]
} [packed]

usb_endpoint_descriptors_cdc_ncm_data {
	in	usb_endpoint_descriptor_cdc_ecm_in
	out	usb_endpoint_descriptor_cdc_ecm_out
} [packed]

# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/usb/core/message.c#L2137
# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/net/usb/cdc_ncm.c#L798
usb_cdc_header_ncm {
	union	usb_cdc_union_desc_t[0, 1]
	header	usb_cdc_header_desc
	ether	usb_cdc_ether_desc
	ncm	usb_cdc_ncm_desc

	other	array[usb_cdc_header_ncm_other, 0:6]
} [packed]

usb_cdc_header_ncm_other [
	call_mgmt		usb_cdc_call_mgmt_descriptor
	acm			usb_cdc_acm_descriptor
	country_functional	usb_cdc_country_functional_desc
	network_terminal	usb_cdc_network_terminal_desc
	dmm			usb_cdc_dmm_desc
	mdlm			usb_cdc_mdlm_desc
	mdlm_detail		usb_cdc_mdlm_detail_desc
	obex			usb_cdc_obex_desc
	mbim			usb_cdc_mbim_desc
	mbim_extended		usb_cdc_mbim_extended_desc
] [varlen]

vusb_descriptors_cdc_ncm {
	len		len[parent, int32]
	generic		ptr[in, vusb_descriptor_generic]

# https://elixir.bootlin.com/linux/v5.2.7/source/drivers/net/usb/usbnet.c#L147
	USB_DT_STRING	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor_t[usb_cdc_ecm_mac]]]
} [packed]

vusb_responses_cdc_ncm {
	len				len[parent, int32]
	generic				ptr[in, vusb_response_generic]

	USB_REQ_GET_INTERFACE		ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]]
	USB_REQ_GET_CONFIGURATION	ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]]

	USB_CDC_GET_NTB_PARAMETERS	ptr[in, vusb_response_t[USB_TYPE_CLASS, USB_CDC_GET_NTB_PARAMETERS, usb_cdc_ncm_ntb_parameters]]
	USB_CDC_GET_NTB_INPUT_SIZE	ptr[in, vusb_response_t[USB_TYPE_CLASS, USB_CDC_GET_NTB_INPUT_SIZE, int32]]
	USB_CDC_GET_NTB_FORMAT		ptr[in, vusb_response_t[USB_TYPE_CLASS, USB_CDC_GET_NTB_FORMAT, int16[0:1]]]
	USB_CDC_GET_MAX_DATAGRAM_SIZE	ptr[in, vusb_response_t[USB_TYPE_CLASS, USB_CDC_GET_MAX_DATAGRAM_SIZE, int16]]
	USB_CDC_GET_CRC_MODE		ptr[in, vusb_response_t[USB_TYPE_CLASS, USB_CDC_GET_CRC_MODE, int16[0:1]]]
} [packed]

usb_cdc_ncm_ntb_parameters {
	wLength			int16
	bmNtbFormatsSupported	int16
	dwNtbInMaxSize		int32
	wNdpInDivisor		int16
	wNdpInPayloadRemainder	int16
	wNdpInAlignment		int16
	wPadding1		int16
	dwNtbOutMaxSize		int32
	wNdpOutDivisor		int16
	wNdpOutPayloadRemainder	int16
	wNdpOutAlignment	int16
	wNtbOutMaxDatagrams	int16
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# UAC1 device class specific descriptions.
# https://www.usb.org/sites/default/files/audio10.pdf
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/audio.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_uac1.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_uac1_legacy.c
# https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/usb/audio.h

# TODO: find out which /dev/ files are created by connected UAC1 devices and add descriptions for those.

resource fd_usb_uac1[fd_usb]

syz_usb_connect$uac1(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_uac1], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_uac1 (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_control_io$uac1(fd fd_usb_uac1, descs ptr[in, vusb_descriptors_uac1], resps ptr[in, vusb_responses_uac1]) (timeout[300], remote_cover)

usb_device_descriptor_uac1 {
	inner	usb_device_descriptor_t[0, 0, 0, 0x1d6b, 0x101, 64, array[usb_config_descriptor_uac1, 1]]
} [packed]

usb_config_descriptor_uac1 {
	inner	usb_config_descriptor_t[const[1, int8], const[3, int8], usb_interface_descriptors_uac1]
} [packed]

# TODO: control interface might have and optional interrupt endpoint.
usb_interface_descriptors_uac1 {
	inner	usb_interface_descriptors_uac1_inner
} [packed]

# Define folded-in structure to match layout expected by USB ID patching code.
usb_interface_descriptors_uac1_inner {
	control		usb_interface_descriptor_fixed_t[0, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOCONTROL, 0, uac_control_iface_extra_descriptors, void]
	as_out_alt_0	usb_interface_descriptor_fixed_t[1, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, 0, void, void]
	as_out_alt_1	usb_interface_descriptor_fixed_t[1, 1, 1, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, 0, uac_as_iface_extra_descriptors, uac_as_out_endpoint_descriptor]
	as_in_alt_0	usb_interface_descriptor_fixed_t[2, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, 0, void, void]
	as_in_alt_1	usb_interface_descriptor_fixed_t[2, 1, 1, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, 0, uac_as_iface_extra_descriptors, uac_as_in_endpoint_descriptor]
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# UAC uses IDs to make it possible for terminals and units to refer to each other.
# We don't have a way to describe this, so just use a limited number of ids.
type uac_id int8[1:6]

uac_control_iface_extra_descriptors {
	header	uac1_ac_header_descriptor
	others	array[uac_control_iface_extra_descriptor, 0:6]
} [packed]

uac1_ac_header_descriptor {
	bLength			const[UAC_DT_AC_HEADER_LENGTH, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_HEADER, int8]

	bcdADC			int16
	wTotalLength		len[uac_control_iface_extra_descriptors, int16]
	bInCollection		const[F_AUDIO_NUM_INTERFACES, int8]

# These must match interfaces numbers.
	baInterfaceNr0		const[1, int8]
	baInterfaceNr1		const[2, int8]
} [packed]

uac_control_iface_extra_descriptor [
	input_terminal	uac_input_terminal_descriptor
	output_terminal	uac1_output_terminal_descriptor
	mixer_unit	uac_mixer_unit_descriptor
	selector_unit	uac_selector_unit_descriptor
	feature_unit	uac_feature_unit_descriptor
	processing_unit	uac_processing_unit_descriptor
	extension_unit	uac_extension_unit_descriptor
] [varlen]

define F_AUDIO_NUM_INTERFACES	2
define UAC_DT_AC_HEADER_LENGTH	UAC_DT_AC_HEADER_SIZE(F_AUDIO_NUM_INTERFACES)

uac_input_terminal_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_INPUT_TERMINAL, int8]

	bTerminalID		uac_id
	wTerminalType		flags[uac_input_terminal_types, int16]
	bAssocTerminal		uac_id
	bNrChannels		int8
	wChannelConfig		int16
	iChannelNames		int8
	iTerminal		int8
} [packed]

# The following list contains input terminal types and inout terminal types.
uac_input_terminal_types = UAC_TERMINAL_UNDEFINED, UAC_TERMINAL_STREAMING, UAC_TERMINAL_VENDOR_SPEC, UAC_INPUT_TERMINAL_UNDEFINED, UAC_INPUT_TERMINAL_MICROPHONE, UAC_INPUT_TERMINAL_DESKTOP_MICROPHONE, UAC_INPUT_TERMINAL_PERSONAL_MICROPHONE, UAC_INPUT_TERMINAL_OMNI_DIR_MICROPHONE, UAC_INPUT_TERMINAL_MICROPHONE_ARRAY, UAC_INPUT_TERMINAL_PROC_MICROPHONE_ARRAY, UAC_BIDIR_TERMINAL_UNDEFINED, UAC_BIDIR_TERMINAL_HANDSET, UAC_BIDIR_TERMINAL_HEADSET, UAC_BIDIR_TERMINAL_SPEAKER_PHONE, UAC_BIDIR_TERMINAL_ECHO_SUPPRESSING, UAC_BIDIR_TERMINAL_ECHO_CANCELING
# The following list contains output terminal types and inout terminal types.
uac_output_terminal_types = UAC_TERMINAL_UNDEFINED, UAC_TERMINAL_STREAMING, UAC_TERMINAL_VENDOR_SPEC, UAC_OUTPUT_TERMINAL_UNDEFINED, UAC_OUTPUT_TERMINAL_SPEAKER, UAC_OUTPUT_TERMINAL_HEADPHONES, UAC_OUTPUT_TERMINAL_HEAD_MOUNTED_DISPLAY_AUDIO, UAC_OUTPUT_TERMINAL_DESKTOP_SPEAKER, UAC_OUTPUT_TERMINAL_ROOM_SPEAKER, UAC_OUTPUT_TERMINAL_COMMUNICATION_SPEAKER, UAC_OUTPUT_TERMINAL_LOW_FREQ_EFFECTS_SPEAKER, UAC_BIDIR_TERMINAL_UNDEFINED, UAC_BIDIR_TERMINAL_HANDSET, UAC_BIDIR_TERMINAL_HEADSET, UAC_BIDIR_TERMINAL_SPEAKER_PHONE, UAC_BIDIR_TERMINAL_ECHO_SUPPRESSING, UAC_BIDIR_TERMINAL_ECHO_CANCELING

uac1_output_terminal_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_OUTPUT_TERMINAL, int8]

	bTerminalID		uac_id
	wTerminalType		flags[uac_output_terminal_types, int16]
	bAssocTerminal		uac_id
	bSourceID		uac_id
	iTerminal		int8
} [packed]

uac_mixer_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_MIXER_UNIT, int8]

	bUnitID			uac_id
	bNrInPins		int8
	baSourceID		array[int8, 0:6]
} [packed]

uac_selector_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_SELECTOR_UNIT, int8]

	bUnitID			uac_id
	bNrInPins		int8
	baSourceID		array[int8, 0:6]
} [packed]

uac_feature_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_FEATURE_UNIT, int8]

	bUnitID			uac_id
	bSourceID		uac_id
	bControlSize		len[bmaControls, int8]
	bmaControls		array[flags[uac_feature_unit_controls, int16], 1:6]
	iFeature		int8
} [packed]

uac_feature_unit_controls = UAC_FU_MUTE, UAC_FU_VOLUME, UAC_FU_BASS, UAC_FU_MID, UAC_FU_TREBLE, UAC_FU_GRAPHIC_EQUALIZER, UAC_FU_AUTOMATIC_GAIN, UAC_FU_DELAY, UAC_FU_BASS_BOOST, UAC_FU_LOUDNESS

uac_processing_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC1_PROCESSING_UNIT, int8]

	bUnitID			uac_id
	wProcessType		flags[uac_processing_unit_types, int16]
	bNrInPins		int8
	baSourceID		array[int8, 0:6]
} [packed]

uac_processing_unit_types = UAC_PROCESS_UNDEFINED, UAC_PROCESS_UP_DOWNMIX, UAC_PROCESS_DOLBY_PROLOGIC, UAC_PROCESS_STEREO_EXTENDER, UAC_PROCESS_REVERB, UAC_PROCESS_CHORUS, UAC_PROCESS_DYN_RANGE_COMP

uac_extension_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC1_EXTENSION_UNIT, int8]

	bUnitID			uac_id
	wProcessType		int16
	bNrInPins		int8
	baSourceID		array[int8, 0:6]
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

uac_as_iface_extra_descriptors {
	others	array[uac_as_iface_extra_descriptor, 0:6]
} [packed]

uac_as_iface_extra_descriptor [
	as_header			uac1_as_header_descriptor
	format_type_i_continuous	uac_format_type_i_continuous_descriptor
	format_type_i_discrete		uac_format_type_i_discrete_descriptor
	format_type_ii_discrete		uac_format_type_ii_discrete_descriptor
	format_type_ii_ext		uac_format_type_ii_ext_descriptor
	format_type_i_ext		uac_format_type_i_ext_descriptor
] [varlen]

uac1_as_header_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_AS_GENERAL, int8]

	bTerminalLink		int8
	bDelay			int8
	wFormatTag		flags[uac_format_tags, int16]
} [packed]

uac_format_tags = UAC_FORMAT_TYPE_I_UNDEFINED, UAC_FORMAT_TYPE_I_PCM, UAC_FORMAT_TYPE_I_PCM8, UAC_FORMAT_TYPE_I_IEEE_FLOAT, UAC_FORMAT_TYPE_I_ALAW, UAC_FORMAT_TYPE_I_MULAW, UAC_FORMAT_TYPE_II_MPEG, UAC_FORMAT_TYPE_II_AC3
uac_usb_format_types_i = UAC_FORMAT_TYPE_I, UAC_FORMAT_TYPE_II, UAC_FORMAT_TYPE_III, UAC_FORMAT_TYPE_UNDEFINED

uac_format_type_i_continuous_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_FORMAT_TYPE, int8]

	bFormatType		const[UAC_FORMAT_TYPE_I, int8]
	bNrChannels		int8
	bSubframeSize		int8[1:4]
	bBitResolution		int8
	bSamFreqType		int8
	tLowerSamFreq		array[int8, 0:3]
	tUpperSamFreq		array[int8, 0:3]
} [packed]

uac_format_type_i_discrete_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_FORMAT_TYPE, int8]

	bFormatType		const[UAC_FORMAT_TYPE_I, int8]
	bNrChannels		int8
	bSubframeSize		int8[1:4]
	bBitResolution		int8
	bSamFreqType		int8
	tSamFreq		array[int8, 0:9]
} [packed]

uac_format_type_ii_discrete_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_FORMAT_TYPE, int8]

	bFormatType		const[UAC_FORMAT_TYPE_II, int8]
	wMaxBitRate		int16
	wSamplesPerFrame	int16
	bSamFreqType		int8
	tSamFreq		array[int8, 0:9]
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

uac_as_out_endpoint_descriptor {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_UAC1_AS_OUT_ADDRESS, int8], const[USB_ENDPOINT_UAC1_AS_ATTRIBUTES, int8], uac_iso_endpoint_descriptor]
} [packed]

uac_as_in_endpoint_descriptor {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_UAC1_AS_IN_ADDRESS, int8], const[USB_ENDPOINT_UAC1_AS_ATTRIBUTES, int8], uac_iso_endpoint_descriptor]
} [packed]

define USB_ENDPOINT_UAC1_AS_OUT_ADDRESS	(1 | USB_DIR_OUT)
define USB_ENDPOINT_UAC1_AS_IN_ADDRESS	(2 | USB_DIR_IN)
define USB_ENDPOINT_UAC1_AS_ATTRIBUTES	(USB_ENDPOINT_SYNC_ADAPTIVE | USB_ENDPOINT_XFER_ISOC)

uac_iso_ep_attributes = USB_ENDPOINT_SYNCTYPE, USB_ENDPOINT_SYNC_NONE, USB_ENDPOINT_SYNC_ASYNC, USB_ENDPOINT_SYNC_ADAPTIVE, USB_ENDPOINT_SYNC_SYNC

uac_iso_endpoint_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_ENDPOINT, int8]
	bDescriptorSubType	const[UAC_EP_GENERAL, int8]

	bmAttributes		flags[uac_iso_ep_attributes, int8]
	bLockDelayUnits		int8
	wLockDelay		int16
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

vusb_descriptors_uac1 {
	len		len[parent, int32]
	generic		ptr[in, vusb_descriptor_generic]

	USB_DT_STRING	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]]
} [packed]

vusb_responses_uac1 {
	len				len[parent, int32]
	generic				ptr[in, vusb_response_generic]

	USB_REQ_GET_INTERFACE		ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]]
	USB_REQ_GET_CONFIGURATION	ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]]

	audio_UAC_GET_CUR		ptr[in, vusb_response_t[USB_TYPE_CLASS, UAC_GET_CUR, array[int8, 1:3]]]
	audio_UAC_GET_MIN		ptr[in, vusb_response_t[USB_TYPE_CLASS, UAC_GET_MIN, array[int8, 1:3]]]
	audio_UAC_GET_MAX		ptr[in, vusb_response_t[USB_TYPE_CLASS, UAC_GET_MAX, array[int8, 1:3]]]
	audio_UAC_GET_RES		ptr[in, vusb_response_t[USB_TYPE_CLASS, UAC_GET_RES, array[int8, 1:4]]]
	audio_UAC_GET_MEM		ptr[in, vusb_response_t[USB_TYPE_CLASS, UAC_GET_MEM, array[int8, 3]]]
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# UAC2 device class specific descriptions.
# https://www.usb.org/sites/default/files/audio10.pdf
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/audio.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_uac2.c
# https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/usb/audio.h

resource fd_usb_uac2[fd_usb]

syz_usb_connect$uac2(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_uac2], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_uac2 (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_control_io$uac2(fd fd_usb_uac2, descs ptr[in, vusb_descriptors_uac1], resps ptr[in, vusb_responses_uac1]) (timeout[300], remote_cover)

usb_device_descriptor_uac2 {
	inner	usb_device_descriptor_t[0, 0, 0, 0x41e, 0x3000, 64, array[usb_config_descriptor_uac2, 1]]
} [packed]

usb_config_descriptor_uac2 {
	inner	usb_config_descriptor_extra_t[const[1, int8], const[3, int8], uac2_interface_assoc_descriptor, usb_interface_descriptors_uac2]
} [packed]

uac2_interface_assoc_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_INTERFACE_ASSOCIATION, int8]

	bFirstInterface		int8[0:2]
	bInterfaceCount		int8[0:2]
	bFunctionClass		const[USB_CLASS_AUDIO, int8]
	bFunctionSubClass	flags[audio_function_category_types, int8]
	bFunctionProtocol	const[UAC_VERSION_2, int8]
	iFunction		int8
} [packed]

audio_function_category_types = UAC2_FUNCTION_SUBCLASS_UNDEFINED, UAC2_FUNCTION_DESKTOP_SPEAKER, UAC2_FUNCTION_HOME_THEATER, UAC2_FUNCTION_MICROPHONE, UAC2_FUNCTION_HEADSET, UAC2_FUNCTION_TELEPHONE, UAC2_FUNCTION_CONVERTER, UAC2_FUNCTION_SOUND_RECORDER, UAC2_FUNCTION_IO_BOX, UAC2_FUNCTION_MUSICAL_INSTRUMENT, UAC2_FUNCTION_PRO_AUDIO, UAC2_FUNCTION_AUDIO_VIDEO, UAC2_FUNCTION_CONTROL_PANEL, UAC2_FUNCTION_OTHER

usb_interface_descriptors_uac2 {
	inner	usb_interface_descriptors_uac2_inner
} [packed]

# Define folded-in structure to match layout expected by USB ID patching code.
usb_interface_descriptors_uac2_inner {
	control		usb_interface_descriptor_fixed_t[0, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOCONTROL, UAC_VERSION_2, uac2_control_iface_extra_descriptors, void]
	as_out_alt_0	usb_interface_descriptor_fixed_t[1, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, UAC_VERSION_2, void, void]
	as_out_alt_1	usb_interface_descriptor_fixed_t[1, 1, 1, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, UAC_VERSION_2, uac2_as_iface_extra_descriptors, uac2_as_out_endpoint_descriptor]
	as_in_alt_0	usb_interface_descriptor_fixed_t[2, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, UAC_VERSION_2, void, void]
	as_in_alt_1	usb_interface_descriptor_fixed_t[2, 1, 1, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, UAC_VERSION_2, uac2_as_iface_extra_descriptors, uac2_as_in_endpoint_descriptor]
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

uac2_control_iface_extra_descriptors {
	header	uac2_ac_header_descriptor
	others	array[uac2_control_iface_extra_descriptor, 0:6]
} [packed]

uac2_ac_header_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_MS_HEADER, int8]
	bcdADC			int16
	bCategory		flags[uac2_feature_unit_controls, int8]
	wTotalLength		len[uac2_control_iface_extra_descriptors, int16]
	bmControls		int8
} [packed]

uac2_feature_unit_controls = UAC2_FUNCTION_SUBCLASS_UNDEFINED, UAC2_FUNCTION_DESKTOP_SPEAKER, UAC2_FUNCTION_HOME_THEATER, UAC2_FUNCTION_MICROPHONE, UAC2_FUNCTION_HEADSET, UAC2_FUNCTION_TELEPHONE, UAC2_FUNCTION_CONVERTER, UAC2_FUNCTION_SOUND_RECORDER, UAC2_FUNCTION_IO_BOX, UAC2_FUNCTION_MUSICAL_INSTRUMENT, UAC2_FUNCTION_PRO_AUDIO, UAC2_FUNCTION_AUDIO_VIDEO, UAC2_FUNCTION_CONTROL_PANEL, UAC2_FUNCTION_OTHER, uac_feature_unit_controls

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

uac2_as_iface_extra_descriptors {
	others	array[uac2_as_iface_extra_descriptor, 0:6]
} [packed]

uac2_as_iface_extra_descriptor [
	as_header			uac2_as_header_descriptor
	format_type_i_descriptor	uac2_format_type_i_descriptor
	format_type_i_continuous	uac_format_type_i_continuous_descriptor
	format_type_i_discrete		uac_format_type_i_discrete_descriptor
	format_type_ii_discrete		uac_format_type_ii_discrete_descriptor
	format_type_i_ext		uac2_format_type_i_ext_descriptor
	format_type_ii_ext		uac_format_type_ii_ext_descriptor
] [varlen]

uac2_as_header_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_AS_GENERAL, int8]
	bTerminalLink		int8
	bmControls		int8
	bFormatType		flags[uac_usb_format_types_i, int8]
	bmFormats		flags[uac_format_tags, int32]
	bNrChannels		int8
	bmChannelConfig		int32
	iChannelNames		int8
} [packed]

b_sub_slot_sizes = 1, 2, 3, 4

uac2_format_type_i_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_FORMAT_TYPE, int8]
	bFormatType		const[UAC_FORMAT_TYPE_I, int8]
	bSubslotSize		flags[b_sub_slot_sizes, int8]
	bBitResolution		int8
} [packed]

uac2_format_type_i_ext_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_FORMAT_TYPE, int8]

	bFormatType		const[UAC_FORMAT_TYPE_I, int8]
	bSubslotSize		int8
	bBitResolution		int8
	bHeaderLength		int8
	bControlSize		int8
	bSideBandProtocol	int8
} [packed]

uac_format_type_ii_ext_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_FORMAT_TYPE, int8]
	bFormatType		const[UAC_FORMAT_TYPE_II, int8]
	wMaxBitRate		int16
	wSamplesPerFrame	int16
	bHeaderLength		int8
	bSideBandProtocol	int8
} [packed]

uac_format_type_i_ext_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_FORMAT_TYPE, int8]
	bFormatType		const[UAC_FORMAT_TYPE_I, int8]
	bSubslotSize		int8
	bBitResolution		int8
	bHeaderLength		int8
	bControlSize		int8
	bSideBandProtocol	int8
} [packed]

uac2_as_out_endpoint_descriptor {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_UAC1_AS_OUT_ADDRESS, int8], const[USB_ENDPOINT_UAC1_AS_ATTRIBUTES, int8], uac2_iso_endpoint_descriptor]
} [packed]

uac2_as_in_endpoint_descriptor {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_UAC1_AS_IN_ADDRESS, int8], const[USB_ENDPOINT_UAC1_AS_ATTRIBUTES, int8], uac2_iso_endpoint_descriptor]
} [packed]

uac2_iso_endpoint_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_ENDPOINT, int8]
	bDescriptorSubtype	const[UAC_EP_GENERAL, int8]

	bmAttributes		flags[csep_bm_attributes, int8]
	bmControls		flags[csep_bm_controls, int8]
	bLockDelayUnits		int8
	wLockDelay		int16
} [packed]

csep_bm_attributes = UAC_EP_CS_ATTR_SAMPLE_RATE, UAC_EP_CS_ATTR_PITCH_CONTROL, UAC_EP_CS_ATTR_FILL_MAX
csep_bm_controls = UAC2_CONTROL_PITCH, UAC2_CONTROL_DATA_OVERRUN, UAC2_CONTROL_DATA_UNDERRUN

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

uac2_control_iface_extra_descriptor [
	input_terminal	uac2_input_terminal_descriptor
	output_terminal	uac2_output_terminal_descriptor
	mixer_unit	uac2_mixer_unit_descriptor
	selector_unit	uac2_clock_selector_descriptor

	feature_unit	uac2_feature_unit_descriptor
	processing_unit	uac2_processing_unit_descriptor
	extension_unit	uac2_extension_unit_descriptor

	effect_unit	uac2_effect_unit_descriptor
	sample_rate	uac2_sample_rate_descriptor
	source_unit	uac2_clock_source_descriptor
	multiply_unit	uac2_clock_multiplier_descriptor
] [varlen]

uac2_input_terminal_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubtype	const[UAC_INPUT_TERMINAL, int8]

	bTerminalID		uac_id
	wTerminalType		flags[uac_input_terminal_types, int16]
	bAssocTerminal		uac_id
	bCSourceID		int8
	bNrChannels		int8
	bmChannelConfig		int32
	iChannelNames		int8
	bmControls		int8
	iTerminal		int8
} [packed]

uac2_output_terminal_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubtype	const[UAC_OUTPUT_TERMINAL, int8]
	bTerminalID		uac_id
	wTerminalType		flags[uac_output_terminal_types, int16]
	bAssocTerminal		int8
	bSourceID		uac_id
	bCSourceID		int8
	bmControls		int16
	iTerminal		int8
} [packed]

uac2_mixer_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_MIXER_UNIT, int8]

	bUnitID			uac_id
	bNrInPins		int8
	baSourceID		array[int8, 0:6]
} [packed]

# TODO: Figure out if bmControls and iClockSelector should be a part of this structure.
uac2_clock_selector_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC2_CLOCK_SELECTOR, int8]
	bClockID		int8
	bNrInPins		len[baCSourceID, int8]
	baCSourceID		array[int8, 0:8]
} [packed]

# TODO: Verify coverage.
uac2_processing_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubtype	const[UAC2_PROCESSING_UNIT_V2, int8]
	bUnitID			uac_id
	bSourceID		uac_id
	bmaControls		array[flags[uac2_processing_unit_types, int16], 1:6]
} [packed]

uac2_processing_unit_types = UAC2_PROCESS_UNDEFINED, UAC2_PROCESS_UP_DOWNMIX, UAC2_PROCESS_DOLBY_PROLOCIC, UAC2_PROCESS_STEREO_EXTENDER

uac2_extension_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC2_EXTENSION_UNIT_V2, int8]

	bUnitID			uac_id
	wProcessType		int16
	bNrInPins		int8
	baSourceID		array[int8, 0:6]
} [packed]

# TODO: Verify coverage.
uac2_effect_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubtype	const[UAC2_EFFECT_UNIT, int8]
	bUnitID			uac_id
	wEffectType		flags[uac2_effect_unit_types, int16]
	bSourceID		uac_id
	bmaControls		array[flags[uac2_processing_unit_types, int16], 1:6]
} [packed]

uac2_effect_unit_types = UAC2_EFFECT_UNDEFINED, UAC2_EFFECT_PARAM_EQ, UAC2_EFFECT_REVERB, UAC2_EFFECT_MOD_DELAY, UAC2_EFFECT_DYN_RANGE_COMP

uac2_sample_rate_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubtype	const[UAC2_SAMPLE_RATE_CONVERTER, int8]
	bUnitID			uac_id
	wProcessType		flags[uac2_processing_unit_types, int16]
	bSourceID		uac_id
	bmaControls		array[flags[uac2_processing_unit_types, int16], 1:6]
} [packed]

uac2_feature_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubtype	const[UAC_FEATURE_UNIT, int8]
	bUnitID			uac_id
	bSourceID		uac_id
	bmaControls		array[flags[uac2_feature_unit_controls, int16], 1:6]
} [packed]

uac2_clock_source_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC2_CLOCK_SOURCE, int8]
	bClockID		int8
	bmAttributes		flags[uac2_clock_bmattribute_types, int8]
	bmControls		int8
	bAssocTerminal		int8
	iClockSource		flags[uac2_clock_source_types, int8]
} [packed]

uac2_clock_bmattribute_types = UAC_CLOCK_SOURCE_TYPE_EXT, UAC_CLOCK_SOURCE_TYPE_INT_FIXED, UAC_CLOCK_SOURCE_TYPE_INT_VAR, UAC_CLOCK_SOURCE_TYPE_INT_PROG, UAC_CLOCK_SOURCE_SYNCED_TO_SOF
uac2_clock_source_types = UAC_CLOCK_SOURCE_TYPE_EXT, UAC_CLOCK_SOURCE_TYPE_INT_FIXED, UAC_CLOCK_SOURCE_TYPE_INT_VAR, UAC_CLOCK_SOURCE_TYPE_INT_PROG, UAC_CLOCK_SOURCE_SYNCED_TO_SOF

uac2_clock_multiplier_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC2_CLOCK_MULTIPLIER, int8]
	bClockID		int8
	bCSourceID		int8
	bmControls		int8
	iClockMultiplier	int8
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# UAC3 device class specific descriptions.
# https://www.usb.org/sites/default/files/audio10.pdf
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/legacy/audio.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_uac3.c
# https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/usb/audio.h

resource fd_usb_uac3[fd_usb]

syz_usb_connect$uac3(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_uac3], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb_uac3 (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_control_io$uac3(fd fd_usb_uac3, descs ptr[in, vusb_descriptors_uac1], resps ptr[in, vusb_responses_uac1]) (timeout[300], remote_cover)

usb_device_descriptor_uac3 {
	inner	usb_device_descriptor_t[0, 0, 0, 0x582, 0x582, 64, array[usb_config_descriptor_uac3, 1]]
} [packed]

usb_config_descriptor_uac3 {
	inner	usb_config_descriptor_extra_t[const[1, int8], const[3, int8], uac3_interface_assoc_descriptor, usb_interface_descriptors_uac3]
} [packed]

uac3_interface_assoc_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_INTERFACE_ASSOCIATION, int8]

	bFirstInterface		int8[0:2]
	bInterfaceCount		int8[0:2]
	bFunctionClass		const[USB_CLASS_AUDIO, int8]
	bFunctionSubClass	flags[uac3_all_subclasses, int8]
	bFunctionProtocol	const[UAC_VERSION_3, int8]
	iFunction		int8
} [packed]

usb_interface_descriptors_uac3 {
	inner	usb_interface_descriptors_uac3_inner
} [packed]

# Define folded-in structure to match layout expected by USB ID patching code.
usb_interface_descriptors_uac3_inner {
	control		usb_interface_descriptor_fixed_t[0, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOCONTROL, UAC_VERSION_3, uac3_control_iface_extra_descriptors, void]
	as_out_alt_0	usb_interface_descriptor_fixed_t[1, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, UAC_VERSION_3, void, void]
	as_out_alt_1	usb_interface_descriptor_fixed_t[1, 1, 1, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, UAC_VERSION_3, uac3_as_iface_extra_descriptors, uac3_as_out_endpoint_descriptor]
	as_in_alt_0	usb_interface_descriptor_fixed_t[2, 0, 0, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, UAC_VERSION_3, void, void]
	as_in_alt_1	usb_interface_descriptor_fixed_t[2, 1, 1, USB_CLASS_AUDIO, USB_SUBCLASS_AUDIOSTREAMING, UAC_VERSION_3, uac3_as_iface_extra_descriptors, uac3_as_in_endpoint_descriptor]
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

uac3_control_iface_extra_descriptors {
	header	uac3_ac_header_descriptor
	others	array[uac3_control_iface_extra_descriptor, 0:6]
} [packed]

uac3_ac_header_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_MS_HEADER, int8]

	bCategory		flags[uac3_feature_unit_controls, int8]
	wTotalLength		len[uac3_control_iface_extra_descriptors, int16]
	bmControls		int32
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

uac3_as_iface_extra_descriptors {
	others	array[uac3_as_iface_extra_descriptor, 0:6]
} [packed]

uac3_as_iface_extra_descriptor [
	as_header			uac3_as_header_descriptor
	format_type_i_descriptor	uac2_format_type_i_descriptor
	format_type_i_continuous	uac_format_type_i_continuous_descriptor
	format_type_i_discrete		uac_format_type_i_discrete_descriptor
	format_type_ii_discrete		uac_format_type_ii_discrete_descriptor
	format_type_i_ext		uac2_format_type_i_ext_descriptor
	format_type_ii_ext		uac_format_type_ii_ext_descriptor
] [varlen]

# TODO: Figure out how wClusterDescrID is used in the kernel.
uac3_as_header_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_AS_GENERAL, int8]
	bTerminalLink		int8

	bmControls		int32
	wClusterDescrID		int16

	bmFormats		flags[uac_format_tags, int64]

	bSubslotSize		int8
	bBitResolution		int8
	bmAuxProtocols		int16
	bControlSize		int8
} [packed]

uac3_as_out_endpoint_descriptor {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_UAC1_AS_OUT_ADDRESS, int8], const[USB_ENDPOINT_UAC1_AS_ATTRIBUTES, int8], uac3_iso_endpoint_descriptor]
} [packed]

uac3_as_in_endpoint_descriptor {
	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_UAC1_AS_IN_ADDRESS, int8], const[USB_ENDPOINT_UAC1_AS_ATTRIBUTES, int8], uac3_iso_endpoint_descriptor]
} [packed]

uac3_iso_endpoint_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_ENDPOINT, int8]
	bDescriptorSubType	const[UAC3_CS_ENDPOINT, int8]
	bmControls		int32
	bLockDelayUnits		int8
	wLockDelay		int16
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

uac3_control_iface_extra_descriptor [
	input_terminal		uac3_input_terminal_descriptor
	output_terminal		uac3_output_terminal_descriptor
	mixer_unit		uac3_mixer_unit_descriptor
	selector_unit		uac3_clock_selector_descriptor
	source_unit		uac3_clock_source_descriptor
	multiply_unit		uac3_clock_multiplier_descriptor
	feature_unit		uac3_feature_unit_descriptor
	processing_unit		uac3_processing_unit_descriptor
	extension_unit		uac3_extension_unit_descriptor
	power_domain		uac3_power_domain_descriptor
	cluster_info_segment	uac3_cluster_information_segment_descriptor
# Only cluster information segment is currently used in the kernel.See: sound/usb/stream.c
# cluster_segment 		uac3_cluster_segment_descriptor
# cluster_end_segment		uac3_cluster_end_segment_descriptor
# The following units are not yet supported by the kernel.
# See audio_validators[] in sound/usb/validate.c:
#	effect_unit 		uac3_effect_unit_descriptor
#	sample_rate			uac3_sample_rate_descriptor
#	connectors_unit		uac3_connectors_unit_descriptor
#	extended_term_unit	uac3_extended_terminal_unit
] [varlen]

uac3_input_terminal_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubtype	const[UAC_INPUT_TERMINAL, int8]

	bTerminalID		uac_id
	wTerminalType		flags[uac_input_terminal_types, int16]
	bAssocTerminal		uac_id
	bCSourceID		int8

	bmControls		int32
	wClusterDescrID		int16
	wExTerminalDescrID	int16
	wConnectorsDescrID	int16
	wTerminalDescrStr	int16
} [packed]

uac3_output_terminal_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubtype	const[UAC_OUTPUT_TERMINAL, int8]

	bTerminalID		uac_id
	wTerminalType		flags[uac_output_terminal_types, int16]
	bAssocTerminal		uac_id
	bSourceID		uac_id
	bCSourceID		int8

	bmControls		int32
	wExTerminalDescrID	int16
	wConnectorsDescrID	int16
	wTerminalDescrStr	int16
} [packed]

uac3_mixer_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC3_MIXER_UNIT, int8]

	bUnitID			uac_id
	bNrInPins		int8
	baSourceID		array[int8, 0:6]
} [packed]

uac3_clock_selector_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC3_CLOCK_SELECTOR, int8]
	bClockID		int8
	bNrInPins		len[baCSourceID, int8]
	baCSourceID		array[int8, 0:8]
} [packed]

uac3_clock_source_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC3_CLOCK_SOURCE, int8]
	bClockID		int8
	bmAttributes		flags[uac3_clock_bmattribute_types, int8]
	bmControls		int32
	bReferenceTerminal	int8
	wClockSourceStr		int16
} [packed]

uac3_clock_bmattribute_types = UAC3_CLOCK_SOURCE_TYPE_EXT, UAC3_CLOCK_SOURCE_TYPE_INT, UAC3_CLOCK_SOURCE_ASYNC, UAC3_CLOCK_SOURCE_SYNCED_TO_SOF

uac3_clock_multiplier_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC3_CLOCK_MULTIPLIER, int8]
	bClockID		int8
	bCSourceID		int8
	bmControls		int32
	wCMultiplierDescrStr	int16
} [packed]

uac3_feature_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubtype	const[UAC3_FEATURE_UNIT, int8]
	bUnitID			uac_id
	bSourceID		uac_id
	bmaControls		array[flags[uac3_feature_unit_controls, int32], 1:6]
} [packed]

uac3_processing_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubtype	const[UAC3_PROCESSING_UNIT, int8]
	bUnitID			uac_id
	bSourceID		uac_id
	bmaControls		array[flags[uac3_processing_unit_types, int32], 1:6]
} [packed]

uac3_processing_unit_types = UAC3_PROCESS_UNDEFINED, UAC3_PROCESS_UP_DOWNMIX, UAC3_PROCESS_STEREO_EXTENDER, UAC3_PROCESS_MULTI_FUNCTION

uac3_extension_unit_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubtype	const[UAC3_EXTENSION_UNIT, int8]
	bUnitID			uac_id
	bSourceID		uac_id
	bmaControls		array[flags[uac3_processing_unit_types, int32], 1:6]
} [packed]

uac3_power_domain_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC3_POWER_DOMAIN, int8]

	bPowerDomainID		int8
	waRecoveryTime1		int16
	waRecoveryTime2		int16
	bNrEntities		int8
	baEntityID		array[int8, 0:8]
} [packed]

uac3_cluster_information_segment_descriptor {
	bLength		len[parent, int16]
	bSegmentType	const[UAC3_CHANNEL_INFORMATION, int8]
	bChPurpose	flags[uac3_cluster_channel_purposes, int8]
	bChRelationship	flags[uac3_cluster_channel_relationships, int8]
	bChGroupID	int8
} [packed]

uac3_cluster_channel_purposes = UAC3_PURPOSE_UNDEFINED, UAC3_PURPOSE_GENERIC_AUDIO, UAC3_PURPOSE_VOICE, UAC3_PURPOSE_SPEECH, UAC3_PURPOSE_AMBIENT, UAC3_PURPOSE_REFERENCE, UAC3_PURPOSE_ULTRASONIC, UAC3_PURPOSE_VIBROKINETIC, UAC3_PURPOSE_NON_AUDIO
uac3_cluster_channel_relationships = UAC3_CH_RELATIONSHIP_UNDEFINED, UAC3_CH_MONO, UAC3_CH_LEFT, UAC3_CH_RIGHT, UAC3_CH_ARRAY, UAC3_CH_PATTERN_X, UAC3_CH_PATTERN_Y, UAC3_CH_PATTERN_A, UAC3_CH_PATTERN_B, UAC3_CH_PATTERN_M, UAC3_CH_PATTERN_S, UAC3_CH_FRONT_LEFT, UAC3_CH_FRONT_RIGHT, UAC3_CH_FRONT_CENTER, UAC3_CH_FRONT_LEFT_OF_CENTER, UAC3_CH_FRONT_RIGHT_OF_CENTER, UAC3_CH_FRONT_WIDE_LEFT, UAC3_CH_FRONT_WIDE_RIGHT, UAC3_CH_SIDE_LEFT, UAC3_CH_SIDE_RIGHT, UAC3_CH_SURROUND_ARRAY_LEFT, UAC3_CH_SURROUND_ARRAY_RIGHT, UAC3_CH_BACK_LEFT, UAC3_CH_BACK_RIGHT, UAC3_CH_BACK_CENTER, UAC3_CH_BACK_LEFT_OF_CENTER, UAC3_CH_BACK_RIGHT_OF_CENTER, UAC3_CH_BACK_WIDE_LEFT, UAC3_CH_BACK_WIDE_RIGHT, UAC3_CH_TOP_CENTER, UAC3_CH_TOP_FRONT_LEFT, UAC3_CH_TOP_FRONT_RIGHT, UAC3_CH_TOP_FRONT_CENTER, UAC3_CH_TOP_FRONT_LOC, UAC3_CH_TOP_FRONT_ROC, UAC3_CH_TOP_FRONT_WIDE_LEFT, UAC3_CH_TOP_FRONT_WIDE_RIGHT, UAC3_CH_TOP_SIDE_LEFT, UAC3_CH_TOP_SIDE_RIGHT, UAC3_CH_TOP_SURR_ARRAY_LEFT, UAC3_CH_TOP_SURR_ARRAY_RIGHT, UAC3_CH_TOP_BACK_LEFT, UAC3_CH_TOP_BACK_RIGHT, UAC3_CH_TOP_BACK_CENTER, UAC3_CH_TOP_BACK_LOC, UAC3_CH_TOP_BACK_ROC, UAC3_CH_TOP_BACK_WIDE_LEFT, UAC3_CH_TOP_BACK_WIDE_RIGHT, UAC3_CH_BOTTOM_CENTER, UAC3_CH_BOTTOM_FRONT_LEFT, UAC3_CH_BOTTOM_FRONT_RIGHT, UAC3_CH_BOTTOM_FRONT_CENTER, UAC3_CH_BOTTOM_FRONT_LOC, UAC3_CH_BOTTOM_FRONT_ROC, UAC3_CH_BOTTOM_FRONT_WIDE_LEFT, UAC3_CH_BOTTOM_FRONT_WIDE_RIGHT, UAC3_CH_BOTTOM_SIDE_LEFT, UAC3_CH_BOTTOM_SIDE_RIGHT, UAC3_CH_BOTTOM_SURR_ARRAY_LEFT, UAC3_CH_BOTTOM_SURR_ARRAY_RIGHT, UAC3_CH_BOTTOM_BACK_LEFT, UAC3_CH_BOTTOM_BACK_RIGHT, UAC3_CH_BOTTOM_BACK_CENTER, UAC3_CH_BOTTOM_BACK_LOC, UAC3_CH_BOTTOM_BACK_ROC, UAC3_CH_BOTTOM_BACK_WIDE_LEFT, UAC3_CH_BOTTOM_BACK_WIDE_RIGHT, UAC3_CH_LOW_FREQUENCY_EFFECTS, UAC3_CH_LFE_LEFT, UAC3_CH_LFE_RIGHT, UAC3_CH_HEADPHONE_LEFT, UAC3_CH_HEADPHONE_RIGHT

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# This list consists of uac3_func_subclasses + uac3_badd_classes.
uac3_all_subclasses = UAC3_FUNCTION_SUBCLASS_UNDEFINED, UAC3_FUNCTION_SUBCLASS_FULL_ADC_3_0, UAC3_FUNCTION_SUBCLASS_GENERIC_IO, UAC3_FUNCTION_SUBCLASS_HEADPHONE, UAC3_FUNCTION_SUBCLASS_SPEAKER, UAC3_FUNCTION_SUBCLASS_MICROPHONE, UAC3_FUNCTION_SUBCLASS_HEADSET, UAC3_FUNCTION_SUBCLASS_HEADSET_ADAPTER, UAC3_FUNCTION_SUBCLASS_SPEAKERPHONE

uac3_feature_unit_controls = UAC3_FUNCTION_SUBCLASS_UNDEFINED, UAC3_FUNCTION_DESKTOP_SPEAKER, UAC3_FUNCTION_HOME_THEATER, UAC3_FUNCTION_MICROPHONE, UAC3_FUNCTION_HEADSET, UAC3_FUNCTION_TELEPHONE, UAC3_FUNCTION_CONVERTER, UAC3_FUNCTION_SOUND_RECORDER, UAC3_FUNCTION_IO_BOX, UAC3_FUNCTION_MUSICAL_INSTRUMENT, UAC3_FUNCTION_PRO_AUDIO, UAC3_FUNCTION_AUDIO_VIDEO, UAC3_FUNCTION_CONTROL_PANEL, UAC3_FUNCTION_HEADPHONE, UAC3_FUNCTION_GENERIC_SPEAKER, UAC3_FUNCTION_HEADSET_ADAPTER, UAC3_FUNCTION_SPEAKERPHONE, UAC3_FUNCTION_OTHER

# TODO: Support uac3 badd profiles. See sound/usb/mixer.c: snd_usb_mixer_controls_badd()
# uac3_badd_endpoint_descriptor {
# 	inner	usb_endpoint_descriptor_t[const[USB_ENDPOINT_UAC1_AS_OUT_ADDRESS, int8], const[USB_ENDPOINT_UAC1_AS_ATTRIBUTES, int8], uac3_iso_endpoint_descriptor]
# } [packed]

#uac3_badd_maxsizes = UAC3_BADD_EP_MAXPSIZE_SYNC_MONO_16,UAC3_BADD_EP_MAXPSIZE_ASYNC_MONO_16,UAC3_BADD_EP_MAXPSIZE_SYNC_MONO_24,UAC3_BADD_EP_MAXPSIZE_ASYNC_MONO_24,UAC3_BADD_EP_MAXPSIZE_SYNC_STEREO_16,UAC3_BADD_EP_MAXPSIZE_ASYNC_STEREO_16,UAC3_BADD_EP_MAXPSIZE_SYNC_STEREO_24,UAC3_BADD_EP_MAXPSIZE_ASYNC_STEREO_24

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# MIDI device class specific descriptions.
# https://www.usb.org/sites/default/files/midi10.pdf
# https://elixir.bootlin.com/linux/latest/source/sound/usb/midi.c
# https://elixir.bootlin.com/linux/latest/source/drivers/usb/gadget/function/f_midi.c

syz_usb_connect$midi(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_midi], conn_descs ptr[in, vusb_connect_descriptors]) fd_usb (timeout[3000], prog_timeout[3000], remote_cover)

usb_device_descriptor_midi {
	inner	usb_device_descriptor_t[0, 0, 0, 0x1430, 0x474b, 64, array[usb_config_descriptor_midi, 1]]
} [packed]

usb_config_descriptor_midi {
	inner	usb_config_descriptor_t[const[1, int8], const[1, int8], usb_interface_descriptors_midi]
} [packed]

usb_interface_descriptors_midi {
	inner	usb_interface_descriptors_midi_inner
} [packed]

# Define folded-in structure to match layout expected by USB ID patching code.
usb_interface_descriptors_midi_inner {
	control	usb_interface_descriptor_eps_array_t[const[0, int8], const[0, int8], const[USB_CLASS_AUDIO, int8], const[USB_SUBCLASS_MIDISTREAMING, int8], flags[uac_version_types, int8], array[usb_midi_iface_extra], array[usb_endpoint_descriptor_midi, 0:8]]
} [packed]

usb_endpoint_descriptor_midi {
	inner	usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], flags[usb_endpoint_attributes, int8], usb_ms_endpoint_descriptor]
} [packed]

midi_jack_type = USB_MS_EMBEDDED, USB_MS_EXTERNAL
uac_version_types = UAC_VERSION_1, UAC_VERSION_2, UAC_VERSION_3

usb_ms_endpoint_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_ENDPOINT, int8]
	bDescriptorSubType	const[USB_MS_GENERAL, int8]
	bNumEmbMIDIJack		len[baAssocJackID, int8]
	baAssocJackID		array[int8, 0:16]
} [packed]

usb_midi_iface_extra [
	ms_header	usb_ms_header_descriptor
	midi_in_jack	usb_midi_in_jack_descriptor
	midi_out_jack	usb_midi_out_jack_descriptor
] [varlen]

usb_ms_header_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_HEADER, int8]
	bcdMSC			int16
	wTotalLength		len[parent, int16]
} [packed]

usb_midi_in_jack_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_MIDI_IN_JACK, int8]
	bJackType		flags[midi_jack_type, int8]
	bJackID			int8
	iJack			int8
} [packed]

usb_midi_out_jack_descriptor {
	bLength			len[parent, int8]
	bDescriptorType		const[USB_DT_CS_INTERFACE, int8]
	bDescriptorSubType	const[UAC_MIDI_OUT_JACK, int8]
	bJackType		flags[midi_jack_type, int8]
	bJackID			int8
	bNrInputPins		len[pins, int8]
	pins			array[usb_midi_source_pin]
	iJack			int8
} [packed]

usb_midi_source_pin {
	baSourceID	int8
	baSourcePin	int8
} [packed]

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# ath9k driver specific descriptions.

include <drivers/net/wireless/ath/ath9k/htc_hst.h>
include <drivers/net/wireless/ath/ath9k/hif_usb.h>

define USB_ENDPOINT_ATH9K_BULK_OUT_ADDRESS	(1)
define USB_ENDPOINT_ATH9K_BULK_IN_ADDRESS	(2 | USB_DIR_IN)
define USB_ENDPOINT_ATH9K_INT_IN_ADDRESS	(3 | USB_DIR_IN)
define USB_ENDPOINT_ATH9K_INT_OUT_ADDRESS	(4)
define USB_ENDPOINT_ATH9K_BULK_EXTRA1_ADDRESS	(5)
define USB_ENDPOINT_ATH9K_BULK_EXTRA2_ADDRESS	(6)

resource fd_usb_ath9k[fd_usb]

syz_usb_connect_ath9k(speed const[USB_SPEED_HIGH], dev_len len[dev], dev ptr[in, usb_device_descriptor_ath9k], conn_descs const[0]) fd_usb_ath9k (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_ep_write$ath9k_ep1(fd fd_usb_ath9k, ep const[USB_ENDPOINT_ATH9K_BULK_IN_ADDRESS], len bytesize[data], data ptr[in, ath9k_bulk_frame]) (timeout[300], remote_cover)
syz_usb_ep_write$ath9k_ep2(fd fd_usb_ath9k, ep const[USB_ENDPOINT_ATH9K_INT_IN_ADDRESS], len bytesize[data], data ptr[in, htc_frame]) (timeout[300], remote_cover)

usb_device_descriptor_ath9k {
	inner	usb_device_descriptor_fixed_t[0x200, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0xff, 64, 0xcf3, 0x9271, 0x108, array[usb_config_descriptor_ath9k, 1]]
} [packed]

usb_config_descriptor_ath9k {
	inner	usb_config_descriptor_fixed_t[1, 1, USB_CONFIG_ATT_ONE, 250, usb_interface_descriptor_ath9k]
} [packed]

usb_interface_descriptor_ath9k {
	iface	usb_interface_descriptor_fixed_t[0, 0, 6, USB_CLASS_VENDOR_SPEC, 0, 0, void, usb_endpoint_descriptors_ath9k]
} [packed]

usb_endpoint_descriptors_ath9k {
	bulk_out	usb_endpoint_descriptor_fixed_t[USB_ENDPOINT_ATH9K_BULK_OUT_ADDRESS, USB_ENDPOINT_ATH9K_BULK_ATTRIBUTES, 512, 0, void]
	bulk_in		usb_endpoint_descriptor_fixed_t[USB_ENDPOINT_ATH9K_BULK_IN_ADDRESS, USB_ENDPOINT_ATH9K_BULK_ATTRIBUTES, 512, 0, void]
	int_in		usb_endpoint_descriptor_fixed_t[USB_ENDPOINT_ATH9K_INT_IN_ADDRESS, USB_ENDPOINT_ATH9K_INT_ATTRIBUTES, 64, 1, void]
	int_out		usb_endpoint_descriptor_fixed_t[USB_ENDPOINT_ATH9K_INT_OUT_ADDRESS, USB_ENDPOINT_ATH9K_INT_ATTRIBUTES, 64, 1, void]
	bulk_extra1	usb_endpoint_descriptor_fixed_t[USB_ENDPOINT_ATH9K_BULK_EXTRA1_ADDRESS, USB_ENDPOINT_ATH9K_BULK_ATTRIBUTES, 512, 0, void]
	bulk_extra2	usb_endpoint_descriptor_fixed_t[USB_ENDPOINT_ATH9K_BULK_EXTRA2_ADDRESS, USB_ENDPOINT_ATH9K_BULK_ATTRIBUTES, 512, 0, void]
} [packed]

define USB_ENDPOINT_ATH9K_BULK_ATTRIBUTES	(USB_ENDPOINT_XFER_BULK)
define USB_ENDPOINT_ATH9K_INT_ATTRIBUTES	(USB_ENDPOINT_XFER_INT)

ath9k_bulk_frame {
	packets	array[ath9k_bulk_packet]
} [packed]

ath9k_bulk_packet {
	pkt_len	len[data, int16]
	pkt_tag	const[ATH_USB_RX_STREAM_MODE_TAG, int16]
	data	array[int8]
} [packed, align[4]]

htc_frame [
	ready		htc_ready_frame
	conn_svc_rsp	htc_conn_svc_rsp_frame
	generic		htc_generic_frame
] [varlen]

# This is actually wrong, as the driver is buggy and doesn't skip the header
# before processing the frame payload, but let's leave it like thise for now.
htc_ready_frame {
	endpoint_id	const[0, int8]
	flags		const[0, int8]
	payload_len	len[payload, int16be]
	control		array[int8, 4]
	payload		htc_ready_msg
} [packed]

htc_ready_msg {
	message_id	const[HTC_MSG_READY_ID, int16be]
	credits		int16be
	credit_size	int16be
	max_endpoints	int8
	pad		int8
} [packed]

htc_conn_svc_rsp_frame {
	endpoint_id	const[0, int8]
	flags		const[0, int8]
	payload_len	len[payload, int16be]
	control		array[int8, 4]
	payload		htc_conn_svc_rspmsg
} [packed]

htc_conn_svc_rspmsg {
	message_id	const[HTC_MSG_CONNECT_SERVICE_RESPONSE_ID, int16be]
	service_id	flags[htc_svcs, int16be]
	status		const[HTC_SERVICE_SUCCESS, int8]
	endpoint_id	int8
	max_msg_len	int16be
	svc_meta_len	int8
	pad		int8
} [packed]

htc_svcs = HTC_CTRL_RSVD_SVC, HTC_LOOPBACK_RSVD_SVC, WMI_CONTROL_SVC, WMI_BEACON_SVC, WMI_CAB_SVC, WMI_UAPSD_SVC, WMI_MGMT_SVC, WMI_DATA_VO_SVC, WMI_DATA_VI_SVC, WMI_DATA_BE_SVC, WMI_DATA_BE_SVC

htc_generic_frame {
	endpoint_id	int8[0:8]
	flags		flags[htc_frame_flags, int8]
	payload_len	len[payload, int16be]
	control		array[int8, 4]
	payload		array[int8, 0:256]
} [packed]

htc_frame_flags = HTC_FLAGS_RECV_TRAILER

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# Assorted driver-specific descriptions of generic syz_* calls' variants.

# Generic calls such as syz_usb_connect() and syz_usb_control_io() should be enough
# (in theory) to emulate a proper device and finish driver probes without a hitch.
# However, there are cases when syzkaller fails to come up with correct inputs to achieve it.
# Use fixed descriptors to quickly pass through probe() to access select drivers' post-probe functionality.

# It is important to note that, one way or another, drivers in question require multiple control requests
# between a driver and a device processed during probe(). Descriptions below do not deal with specific
# CTRL requests as such (except for basic information included in vusb_responses_XXX). Instead, rely on
# seeds, created both manually and with syzkaller's help. For examples, see sys/linux/test/vusb_XXX.

# Common constants for endpoint descriptors.
define USB_ENDPOINT_BULK_ATTR	(USB_ENDPOINT_XFER_BULK)
define USB_ENDPOINT_INT_ATTR	(USB_ENDPOINT_XFER_INT)

define USB_FIXED_ENDPOINT_BULK_IN_ADDR	(1 | USB_DIR_IN)
define USB_FIXED_ENDPOINT_BULK_OUT_ADDR	(2)
define USB_FIXED_ENDPOINT_INT_IN_ADDR	(3 | USB_DIR_IN)

define USB_RECIP_DEVICE	0x00

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# rtl8150 driver specific descriptions.

resource fd_usb_rtl8150[fd_usb]

syz_usb_connect$rtl8150(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_rtl8150], conn_descs const[0]) fd_usb_rtl8150 (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_control_io$rtl8150(fd fd_usb_rtl8150, descs ptr[in, vusb_descriptors_rtl8150], resps ptr[in, vusb_responses_rtl8150]) (timeout[300], remote_cover)

usb_device_descriptor_rtl8150 {
	inner	usb_device_descriptor_fixed_t[0x200, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0xff, 64, 0xbda, 0x8150, 0, array[usb_config_descriptor_rtl8150, 1]]
} [packed]

usb_config_descriptor_rtl8150 {
	inner	usb_config_descriptor_fixed_t[1, 1, USB_CONFIG_ATT_ONE, 250, usb_interface_descriptor_rtl8150]
} [packed]

usb_interface_descriptor_rtl8150 {
	iface	usb_interface_descriptor_fixed_t[0, 0, 3, USB_CLASS_VENDOR_SPEC, 0, 0, void, usb_endpoint_descriptors_rtl8150]
} [packed]

usb_endpoint_descriptors_rtl8150 {
	bulk_in		usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_IN_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void]
	bulk_out	usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_OUT_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void]
	int_in		usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_INT_IN_ADDR, USB_ENDPOINT_INT_ATTR, 64, 1, void]
} [packed]

vusb_descriptors_rtl8150 {
	len		len[parent, int32]
	generic		ptr[in, vusb_descriptor_generic]

	USB_DT_STRING	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]]
} [packed]

vusb_responses_rtl8150 {
	len				len[parent, int32]
	generic				ptr[in, vusb_response_generic]

	USB_REQ_GET_INTERFACE		ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]]
	USB_REQ_GET_CONFIGURATION	ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]]

	RTL8150_REQ_GET_REGS		ptr[in, vusb_response_t[RTL8150_REQT_READ, RTL8150_REQ_GET_REGS, array[int8, 0:6]]]
	RTL8150_REQ_SET_REGS		ptr[in, vusb_response_t[RTL8150_REQT_WRITE, RTL8150_REQ_SET_REGS, array[int8, 0:6]]]
} [packed]

define RTL8150_REQ_GET_REGS	0x05
define RTL8150_REQ_SET_REGS	0x05
define RTL8150_REQT_READ	0xc0
define RTL8150_REQT_WRITE	0x40

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# sierra_net driver specific descriptions.

resource fd_usb_sierra_net[fd_usb]

syz_usb_connect$sierra_net(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_sierra_net], conn_descs const[0]) fd_usb_sierra_net (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_control_io$sierra_net(fd fd_usb_sierra_net, descs ptr[in, vusb_descriptors_sierra_net], resps ptr[in, vusb_responses_sierra_net]) (timeout[300], remote_cover)

usb_device_descriptor_sierra_net {
	inner	usb_device_descriptor_fixed_t[0x200, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0xff, 64, 0x1199, 0x68a3, 0, array[usb_config_descriptor_sierra_net, 1]]
} [packed]

usb_config_descriptor_sierra_net {
	inner	usb_config_descriptor_fixed_t[1, 1, USB_CONFIG_ATT_ONE, 250, usb_interface_descriptor_sierra_net]
} [packed]

usb_interface_descriptor_sierra_net {
	iface	usb_interface_descriptor_fixed_t[7, 0, 3, USB_CLASS_VENDOR_SPEC, 0, 0, void, usb_endpoint_descriptors_sierra_net]
} [packed]

# sierra_net driver does not expect fixed ep addresses, so refrain from being too specific here.
# As long as we ensure there are 3 endpoints, 2 bulk and 1 int, syzkaller should figure it out.
usb_endpoint_descriptors_sierra_net {
	bulk_in		usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], const[USB_ENDPOINT_BULK_ATTR, int8], void]
	bulk_out	usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], const[USB_ENDPOINT_BULK_ATTR, int8], void]
	status		usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], const[USB_ENDPOINT_INT_ATTR, int8], void]
} [packed]

vusb_descriptors_sierra_net {
	len		len[parent, int32]
	generic		ptr[in, vusb_descriptor_generic]

	USB_DT_STRING	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]]
} [packed]

vusb_responses_sierra_net {
	len					len[parent, int32]
	generic					ptr[in, vusb_response_generic]

	USB_CDC_GET_ENCAPSULATED_RESPONSE	ptr[in, vusb_response_t[SIERRA_CMD_TYPE_IN, USB_CDC_GET_ENCAPSULATED_RESPONSE, array[int8, 1024]]]
	USB_CDC_SEND_ENCAPSULATED_COMMANDT	ptr[in, vusb_response_t[SIERRA_CMD_TYPE_OUT, USB_CDC_SEND_ENCAPSULATED_COMMAND, array[int8, 0:4]]]
} [packed]

define SIERRA_CMD_TYPE_IN	(USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE)
define SIERRA_CMD_TYPE_OUT	(USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE)

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# lan78xx driver specific descriptions.
# While these syz_* variants noticably help with the probe() process, they are not enough.
# This is due to a high number of control requests expected between the driver and the device.

include <drivers/net/usb/smsc95xx.h>

resource fd_usb_lan78xx[fd_usb]

syz_usb_connect$lan78xx(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_lan78xx], conn_descs const[0]) fd_usb_lan78xx (timeout[3000], prog_timeout[3000], remote_cover)
syz_usb_control_io$lan78xx(fd fd_usb_lan78xx, descs ptr[in, vusb_descriptors_lan78xx], resps ptr[in, vusb_responses_lan78xx]) (timeout[300], remote_cover)

usb_device_descriptor_lan78xx {
	inner	usb_device_descriptor_fixed_t[0x200, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0xff, 64, 0x424, 0x7850, 0, array[usb_config_descriptor_lan78xx, 1]]
} [packed]

usb_config_descriptor_lan78xx {
	inner	usb_config_descriptor_fixed_t[1, 1, USB_CONFIG_ATT_ONE, 250, usb_interface_descriptor_lan78xx]
} [packed]

usb_interface_descriptor_lan78xx {
	iface	usb_interface_descriptor_fixed_t[0, 0, 3, USB_CLASS_VENDOR_SPEC, 0, 0, void, usb_endpoint_descriptors_lan78xx]
} [packed]

usb_endpoint_descriptors_lan78xx {
	bulk_in		usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_IN_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void]
	bulk_out	usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_OUT_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void]
	int_in		usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_INT_IN_ADDR, USB_ENDPOINT_INT_ATTR, 64, 1, void]
} [packed]

vusb_descriptors_lan78xx {
	len		len[parent, int32]
	generic		ptr[in, vusb_descriptor_generic]

	USB_DT_STRING	ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]]
} [packed]

vusb_responses_lan78xx {
	len					len[parent, int32]
	generic					ptr[in, vusb_response_generic]

	USB_REQ_GET_INTERFACE			ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]]
	USB_REQ_GET_CONFIGURATION		ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]]

	USB_VENDOR_REQUEST_READ_REGISTER	ptr[in, vusb_response_t[LAN78XX_REG_TYPE_IN, USB_VENDOR_REQUEST_READ_REGISTER, int32]]
	USB_VENDOR_REQUEST_WRITE_REGISTER	ptr[in, vusb_response_t[LAN78XX_REG_TYPE_OUT, USB_VENDOR_REQUEST_WRITE_REGISTER, int32]]
	USB_VENDOR_REQUEST_GET_STATS		ptr[in, vusb_response_t[LAN78XX_REG_TYPE_IN, USB_VENDOR_REQUEST_GET_STATS, array[int8, 47]]]
} [packed]

define LAN78XX_REG_TYPE_IN	(USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
define LAN78XX_REG_TYPE_OUT	(USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
]

gemini-3-pro-preview

							input: 155161
							output: 57
							thoughts: 2967
						

**Bug Hunting Thoughts: A USB Disconnect Conundrum**

Okay, so the initial thought is, `syz_usb_connect` is our ticket to emulating a USB device, specifically, the `pvrusb2` device which has a device ID of `0x2040:0x2900`. I can just feed it a generic `usb_device_descriptor`, set the vendor and product IDs and be on my way, right? Wait, I need to make sure the descriptor is the right size.

Hmm, seems like Syzkaller likes to patch the `idVendor` and `idProduct` fields in Go code. Not ideal for a reproducer. But wait, since we are crafting a reproducer, we can write the raw bytes, which *should* bypass the Go-side patching. Since `syz_usb_connect` takes a byte array.

Then I saw the stack trace, and it's pointing to `USBDEVFS_DISCONNECT` ioctl on the hub! Syzkaller is hooking up a device to the dummy HCD, so the disconnect comes from calling `USBDEVFS_DISCONNECT` on the root hub. Then I remember that `syz_usb_disconnect` exists! I can just use that instead, right? That closes the device file descriptor, which will trigger the device removal and call `usb_disconnect`. The crucial thing here is the stack trace shows an `ioctl`, so we have to use the `USBDEVFS_DISCONNECT`.

The bug report mentions a second task. It seems the issue is on the hub, where we are doing an ioctl, and a second thread also has a device open. If we can trigger `pvr_disconnect` while an i2c device is open. If we `syz_usb_disconnect` the device, it will call `usb_disconnect`, which calls `pvr_disconnect`. The `pvr_disconnect` function calls `i2c_del_adapter`. If `/dev/i2c-X` is open, `i2c_del_adapter` will block, and the whole disconnect operation will hang!

If the fuzzer opened `/dev/i2c-X` and another thread sent the `USBDEVFS_DISCONNECT` ioctl, it will hang!

Therefore, all that needs to be done is:
1.  Connect the device using `syz_usb_connect` with the correct `idVendor` and `idProduct`.
2.  Open `/dev/i2c-X`
3.  Disconnect the device with `syz_usb_disconnect`.

The device should hang, and the hung task watchdog will report it.

Now I need to construct the Syzkaller program. I think I've got it. I need to make sure `syz_usb_connect` gets the right descriptor. The descriptor has the vendor and product ID set correctly. The executor will just send the descriptor as it is. Let's see... the executor just *reads* from the descriptor argument we supply! It's the fuzzer that does the patching, not the executor, which is what we want. The program should look something like this, using a hardcoded `usb_device_descriptor`.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c IncludeLines:true Name:pvr2_hdw_create]

map[SourceCode:2344:	/* Create, set up, and return a structure for interacting with the
2345:	   underlying hardware.  */
2346:	struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf,
2347:					 const struct usb_device_id *devid)
2348:	{
2349:		unsigned int idx,cnt1,cnt2,m;
2350:		struct pvr2_hdw *hdw = NULL;
2351:		int valid_std_mask;
2352:		struct pvr2_ctrl *cptr;
2353:		struct usb_device *usb_dev;
2354:		const struct pvr2_device_desc *hdw_desc;
2355:		__u8 ifnum;
2356:		struct v4l2_queryctrl qctrl;
2357:		struct pvr2_ctl_info *ciptr;
2358:	
2359:		usb_dev = interface_to_usbdev(intf);
2360:	
2361:		hdw_desc = (const struct pvr2_device_desc *)(devid->driver_info);
2362:	
2363:		if (hdw_desc == NULL) {
2364:			pvr2_trace(PVR2_TRACE_INIT, "pvr2_hdw_create: No device description pointer, unable to continue.");
2365:			pvr2_trace(PVR2_TRACE_INIT,
2366:				   "If you have a new device type, please contact Mike Isely <isely@pobox.com> to get it included in the driver");
2367:			goto fail;
2368:		}
2369:	
2370:		hdw = kzalloc(sizeof(*hdw),GFP_KERNEL);
2371:		pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_create: hdw=%p, type \"%s\"",
2372:			   hdw,hdw_desc->description);
2373:		pvr2_trace(PVR2_TRACE_INFO, "Hardware description: %s",
2374:			hdw_desc->description);
2375:		if (hdw_desc->flag_is_experimental) {
2376:			pvr2_trace(PVR2_TRACE_INFO, "**********");
2377:			pvr2_trace(PVR2_TRACE_INFO,
2378:				   "***WARNING*** Support for this device (%s) is experimental.",
2379:								      hdw_desc->description);
2380:			pvr2_trace(PVR2_TRACE_INFO,
2381:				   "Important functionality might not be entirely working.");
2382:			pvr2_trace(PVR2_TRACE_INFO,
2383:				   "Please consider contacting the driver author to help with further stabilization of the driver.");
2384:			pvr2_trace(PVR2_TRACE_INFO, "**********");
2385:		}
2386:		if (!hdw) goto fail;
2387:	
2388:		timer_setup(&hdw->quiescent_timer, pvr2_hdw_quiescent_timeout, 0);
2389:	
2390:		timer_setup(&hdw->decoder_stabilization_timer,
2391:			    pvr2_hdw_decoder_stabilization_timeout, 0);
2392:	
2393:		timer_setup(&hdw->encoder_wait_timer, pvr2_hdw_encoder_wait_timeout,
2394:			    0);
2395:	
2396:		timer_setup(&hdw->encoder_run_timer, pvr2_hdw_encoder_run_timeout, 0);
2397:	
2398:		hdw->master_state = PVR2_STATE_DEAD;
2399:	
2400:		init_waitqueue_head(&hdw->state_wait_data);
2401:	
2402:		hdw->tuner_signal_stale = !0;
2403:		cx2341x_fill_defaults(&hdw->enc_ctl_state);
2404:	
2405:		/* Calculate which inputs are OK */
2406:		m = 0;
2407:		if (hdw_desc->flag_has_analogtuner) m |= 1 << PVR2_CVAL_INPUT_TV;
2408:		if (hdw_desc->digital_control_scheme != PVR2_DIGITAL_SCHEME_NONE) {
2409:			m |= 1 << PVR2_CVAL_INPUT_DTV;
2410:		}
2411:		if (hdw_desc->flag_has_svideo) m |= 1 << PVR2_CVAL_INPUT_SVIDEO;
2412:		if (hdw_desc->flag_has_composite) m |= 1 << PVR2_CVAL_INPUT_COMPOSITE;
2413:		if (hdw_desc->flag_has_fmradio) m |= 1 << PVR2_CVAL_INPUT_RADIO;
2414:		hdw->input_avail_mask = m;
2415:		hdw->input_allowed_mask = hdw->input_avail_mask;
2416:	
2417:		/* If not a hybrid device, pathway_state never changes.  So
2418:		   initialize it here to what it should forever be. */
2419:		if (!(hdw->input_avail_mask & (1 << PVR2_CVAL_INPUT_DTV))) {
2420:			hdw->pathway_state = PVR2_PATHWAY_ANALOG;
2421:		} else if (!(hdw->input_avail_mask & (1 << PVR2_CVAL_INPUT_TV))) {
2422:			hdw->pathway_state = PVR2_PATHWAY_DIGITAL;
2423:		}
2424:	
2425:		hdw->control_cnt = CTRLDEF_COUNT;
2426:		hdw->control_cnt += MPEGDEF_COUNT;
2427:		hdw->controls = kcalloc(hdw->control_cnt, sizeof(struct pvr2_ctrl),
2428:					GFP_KERNEL);
2429:		if (!hdw->controls) goto fail;
2430:		hdw->hdw_desc = hdw_desc;
2431:		hdw->ir_scheme_active = hdw->hdw_desc->ir_scheme;
2432:		for (idx = 0; idx < hdw->control_cnt; idx++) {
2433:			cptr = hdw->controls + idx;
2434:			cptr->hdw = hdw;
2435:		}
2436:		for (idx = 0; idx < 32; idx++) {
2437:			hdw->std_mask_ptrs[idx] = hdw->std_mask_names[idx];
2438:		}
2439:		for (idx = 0; idx < CTRLDEF_COUNT; idx++) {
2440:			cptr = hdw->controls + idx;
2441:			cptr->info = control_defs+idx;
2442:		}
2443:	
2444:		/* Ensure that default input choice is a valid one. */
2445:		m = hdw->input_avail_mask;
2446:		if (m) for (idx = 0; idx < (sizeof(m) << 3); idx++) {
2447:			if (!((1UL << idx) & m)) continue;
2448:			hdw->input_val = idx;
2449:			break;
2450:		}
2451:	
2452:		/* Define and configure additional controls from cx2341x module. */
2453:		hdw->mpeg_ctrl_info = kcalloc(MPEGDEF_COUNT,
2454:					      sizeof(*(hdw->mpeg_ctrl_info)),
2455:					      GFP_KERNEL);
2456:		if (!hdw->mpeg_ctrl_info) goto fail;
2457:		for (idx = 0; idx < MPEGDEF_COUNT; idx++) {
2458:			cptr = hdw->controls + idx + CTRLDEF_COUNT;
2459:			ciptr = &(hdw->mpeg_ctrl_info[idx].info);
2460:			ciptr->desc = hdw->mpeg_ctrl_info[idx].desc;
2461:			ciptr->name = mpeg_ids[idx].strid;
2462:			ciptr->v4l_id = mpeg_ids[idx].id;
2463:			ciptr->skip_init = !0;
2464:			ciptr->get_value = ctrl_cx2341x_get;
2465:			ciptr->get_v4lflags = ctrl_cx2341x_getv4lflags;
2466:			ciptr->is_dirty = ctrl_cx2341x_is_dirty;
2467:			if (!idx) ciptr->clear_dirty = ctrl_cx2341x_clear_dirty;
2468:			qctrl.id = ciptr->v4l_id;
2469:			cx2341x_ctrl_query(&hdw->enc_ctl_state,&qctrl);
2470:			if (!(qctrl.flags & V4L2_CTRL_FLAG_READ_ONLY)) {
2471:				ciptr->set_value = ctrl_cx2341x_set;
2472:			}
2473:			strscpy(hdw->mpeg_ctrl_info[idx].desc, qctrl.name,
2474:				sizeof(hdw->mpeg_ctrl_info[idx].desc));
2475:			ciptr->default_value = qctrl.default_value;
2476:			switch (qctrl.type) {
2477:			default:
2478:			case V4L2_CTRL_TYPE_INTEGER:
2479:				ciptr->type = pvr2_ctl_int;
2480:				ciptr->def.type_int.min_value = qctrl.minimum;
2481:				ciptr->def.type_int.max_value = qctrl.maximum;
2482:				break;
2483:			case V4L2_CTRL_TYPE_BOOLEAN:
2484:				ciptr->type = pvr2_ctl_bool;
2485:				break;
2486:			case V4L2_CTRL_TYPE_MENU:
2487:				ciptr->type = pvr2_ctl_enum;
2488:				ciptr->def.type_enum.value_names =
2489:					cx2341x_ctrl_get_menu(&hdw->enc_ctl_state,
2490:									ciptr->v4l_id);
2491:				for (cnt1 = 0;
2492:				     ciptr->def.type_enum.value_names[cnt1] != NULL;
2493:				     cnt1++) { }
2494:				ciptr->def.type_enum.count = cnt1;
2495:				break;
2496:			}
2497:			cptr->info = ciptr;
2498:		}
2499:	
2500:		// Initialize control data regarding video standard masks
2501:		valid_std_mask = pvr2_std_get_usable();
2502:		for (idx = 0; idx < 32; idx++) {
2503:			if (!(valid_std_mask & (1UL << idx))) continue;
2504:			cnt1 = pvr2_std_id_to_str(
2505:				hdw->std_mask_names[idx],
2506:				sizeof(hdw->std_mask_names[idx])-1,
2507:				1UL << idx);
2508:			hdw->std_mask_names[idx][cnt1] = 0;
2509:		}
2510:		cptr = pvr2_hdw_get_ctrl_by_id(hdw,PVR2_CID_STDAVAIL);
2511:		if (cptr) {
2512:			memcpy(&hdw->std_info_avail,cptr->info,
2513:			       sizeof(hdw->std_info_avail));
2514:			cptr->info = &hdw->std_info_avail;
2515:			hdw->std_info_avail.def.type_bitmask.bit_names =
2516:				hdw->std_mask_ptrs;
2517:			hdw->std_info_avail.def.type_bitmask.valid_bits =
2518:				valid_std_mask;
2519:		}
2520:		cptr = pvr2_hdw_get_ctrl_by_id(hdw,PVR2_CID_STDCUR);
2521:		if (cptr) {
2522:			memcpy(&hdw->std_info_cur,cptr->info,
2523:			       sizeof(hdw->std_info_cur));
2524:			cptr->info = &hdw->std_info_cur;
2525:			hdw->std_info_cur.def.type_bitmask.bit_names =
2526:				hdw->std_mask_ptrs;
2527:			hdw->std_info_cur.def.type_bitmask.valid_bits =
2528:				valid_std_mask;
2529:		}
2530:		cptr = pvr2_hdw_get_ctrl_by_id(hdw,PVR2_CID_STDDETECT);
2531:		if (cptr) {
2532:			memcpy(&hdw->std_info_detect,cptr->info,
2533:			       sizeof(hdw->std_info_detect));
2534:			cptr->info = &hdw->std_info_detect;
2535:			hdw->std_info_detect.def.type_bitmask.bit_names =
2536:				hdw->std_mask_ptrs;
2537:			hdw->std_info_detect.def.type_bitmask.valid_bits =
2538:				valid_std_mask;
2539:		}
2540:	
2541:		hdw->cropcap_stale = !0;
2542:		hdw->eeprom_addr = -1;
2543:		hdw->unit_number = -1;
2544:		hdw->v4l_minor_number_video = -1;
2545:		hdw->v4l_minor_number_vbi = -1;
2546:		hdw->v4l_minor_number_radio = -1;
2547:		hdw->ctl_write_buffer = kmalloc(PVR2_CTL_BUFFSIZE,GFP_KERNEL);
2548:		if (!hdw->ctl_write_buffer) goto fail;
2549:		hdw->ctl_read_buffer = kmalloc(PVR2_CTL_BUFFSIZE,GFP_KERNEL);
2550:		if (!hdw->ctl_read_buffer) goto fail;
2551:		hdw->ctl_write_urb = usb_alloc_urb(0,GFP_KERNEL);
2552:		if (!hdw->ctl_write_urb) goto fail;
2553:		hdw->ctl_read_urb = usb_alloc_urb(0,GFP_KERNEL);
2554:		if (!hdw->ctl_read_urb) goto fail;
2555:	
2556:		if (v4l2_device_register(&intf->dev, &hdw->v4l2_dev) != 0) {
2557:			pvr2_trace(PVR2_TRACE_ERROR_LEGS,
2558:				   "Error registering with v4l core, giving up");
2559:			goto fail;
2560:		}
2561:		mutex_lock(&pvr2_unit_mtx);
2562:		do {
2563:			for (idx = 0; idx < PVR_NUM; idx++) {
2564:				if (unit_pointers[idx]) continue;
2565:				hdw->unit_number = idx;
2566:				unit_pointers[idx] = hdw;
2567:				break;
2568:			}
2569:		} while (0);
2570:		mutex_unlock(&pvr2_unit_mtx);
2571:	
2572:		INIT_WORK(&hdw->workpoll, pvr2_hdw_worker_poll);
2573:	
2574:		if (hdw->unit_number == -1)
2575:			goto fail;
2576:	
2577:		cnt1 = 0;
2578:		cnt2 = scnprintf(hdw->name+cnt1,sizeof(hdw->name)-cnt1,"pvrusb2");
2579:		cnt1 += cnt2;
2580:		if (hdw->unit_number >= 0) {
2581:			cnt2 = scnprintf(hdw->name+cnt1,sizeof(hdw->name)-cnt1,"_%c",
2582:					 ('a' + hdw->unit_number));
2583:			cnt1 += cnt2;
2584:		}
2585:		if (cnt1 >= sizeof(hdw->name)) cnt1 = sizeof(hdw->name)-1;
2586:		hdw->name[cnt1] = 0;
2587:	
2588:		pvr2_trace(PVR2_TRACE_INIT,"Driver unit number is %d, name is %s",
2589:			   hdw->unit_number,hdw->name);
2590:	
2591:		hdw->tuner_type = -1;
2592:		hdw->flag_ok = !0;
2593:	
2594:		hdw->usb_intf = intf;
2595:		hdw->usb_dev = usb_dev;
2596:	
2597:		usb_make_path(hdw->usb_dev, hdw->bus_info, sizeof(hdw->bus_info));
2598:	
2599:		ifnum = hdw->usb_intf->cur_altsetting->desc.bInterfaceNumber;
2600:		usb_set_interface(hdw->usb_dev,ifnum,0);
2601:	
2602:		mutex_init(&hdw->ctl_lock_mutex);
2603:		mutex_init(&hdw->big_lock_mutex);
2604:	
2605:		return hdw;
2606:	 fail:
2607:		if (hdw) {
2608:			timer_shutdown_sync(&hdw->quiescent_timer);
2609:			timer_shutdown_sync(&hdw->decoder_stabilization_timer);
2610:			timer_shutdown_sync(&hdw->encoder_run_timer);
2611:			timer_shutdown_sync(&hdw->encoder_wait_timer);
2612:			flush_work(&hdw->workpoll);
2613:			v4l2_device_unregister(&hdw->v4l2_dev);
2614:			usb_free_urb(hdw->ctl_read_urb);
2615:			usb_free_urb(hdw->ctl_write_urb);
2616:			kfree(hdw->ctl_read_buffer);
2617:			kfree(hdw->ctl_write_buffer);
2618:			kfree(hdw->controls);
2619:			kfree(hdw->mpeg_ctrl_info);
2620:			kfree(hdw);
2621:		}
2622:		return NULL;
2623:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c]

gemini-3-pro-preview

							input: 164269
							output: 24
							thoughts: 103
						

**Endpoint Analysis**

Okay, so I'm looking at this `pvr2_hdw_create` function. It seems it's setting up the communication pipes to the USB device, and I see it's using `usb_sndbulkpipe` and `usb_rcvbulkpipe`. Specifically, it calls those with `hdw->usb_dev` and then some endpoints: `PVR2_CTL_WRITE_ENDPOINT` and `PVR2_CTL_READ_ENDPOINT` are being passed to these functions, within the context of `pvr2_send_request_ex`. I need to understand these endpoint assignments better. Let me quickly cross-reference those macro definitions to confirm I have a solid understanding of how the bulk transfer endpoints are being mapped to their logical definitions. Knowing these values is key to understanding how data is being directed to and from the device.

map[Expression:define PVR2_CTL_WRITE_ENDPOINT]

map[Output:drivers/media/usb/pvrusb2/pvrusb2-hdw.c=85=MODULE_PARM_DESC(radio_freq, "specify initial radio frequency");
drivers/media/usb/pvrusb2/pvrusb2-hdw.c-86-
drivers/media/usb/pvrusb2/pvrusb2-hdw.c:87:#define PVR2_CTL_WRITE_ENDPOINT  0x01
drivers/media/usb/pvrusb2/pvrusb2-hdw.c-88-#define PVR2_CTL_READ_ENDPOINT   0x81
]

gemini-3-pro-preview

							input: 164741
							output: 57
							thoughts: 508
						

**Constructing the USB Device Descriptor**

Okay, so I need to define the USB device descriptor, specifically with bulk endpoints for both IN and OUT directions – that's endpoint 1 (OUT) and endpoint 1 (IN). Let's build that `usb_device_descriptor`. Here's what I'm thinking:

I'll set `bLength` to 18, `bDescriptorType` to 1. `bcdUSB` should be 0x200, representing USB 2.0. The `bDeviceClass`, `bDeviceSubClass`, and `bDeviceProtocol` are all set to 0, implying device-specific functionality.  `bMaxPacketSize0` is going to be 64.  `idVendor` will be 0x2040, `idProduct` 0x2900, and `bcdDevice` as 0.  `iManufacturer`, `iProduct`, and `iSerialNumber` are all set to 0, as I don't need any string descriptors for now.  `bNumConfigurations` is 1, so there's just one configuration.

Now, let's detail that configuration. It's got a length of 9 and `bDescriptorType` of 2. `wTotalLength` is going to be calculated based on the details in the config. `bNumInterfaces` is set to 1. `bConfigurationValue` is 1, and `iConfiguration` is 0. `bmAttributes` is 0x80 (self-powered), and `bMaxPower` will be 0xfa.

Within that configuration, there's a single interface. It's 9 bytes long, `bDescriptorType` of 4. `bInterfaceNumber` is 0. `bAlternateSetting` is 0. Critically, `bNumEndpoints` is 2. `bInterfaceClass`, `bInterfaceSubClass`, and `bInterfaceProtocol` are all set to 0xff, indicating a vendor-specific interface. `iInterface` is 0.

Finally, the endpoints: I'm setting up two endpoints. The first endpoint has `bLength` 7, `bDescriptorType` 5 (endpoint descriptor), `bEndpointAddress` is 1 (OUT endpoint), `bmAttributes` is 2 (Bulk transfer), `wMaxPacketSize` is 512, and `bInterval` is 0. The second endpoint has similar values: `bLength` 7, `bDescriptorType` 5, `bEndpointAddress` is 0x81 (IN endpoint), `bmAttributes` is 2, `wMaxPacketSize` is 512, and `bInterval` is 0.

Wait a second, isn't there something about needing some specific initialization when using the `pvrusb2` driver? I remember reading that somewhere. Let me check the source code for the `pvrusb2` driver, specifically the `pvr2_hdw_setup` function in `drivers/media/usb/pvrusb2/pvrusb2-hdw.c`. I need to make sure I don't miss anything.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c IncludeLines:true Name:pvr2_hdw_setup]

map[SourceCode:2254:	/* Set up the structure and attempt to put the device into a usable state.
2255:	   This can be a time-consuming operation, which is why it is not done
2256:	   internally as part of the create() step. */
2257:	static void pvr2_hdw_setup(struct pvr2_hdw *hdw)
2258:	{
2259:		pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_setup(hdw=%p) begin",hdw);
2260:		do {
2261:			pvr2_hdw_setup_low(hdw);
2262:			pvr2_trace(PVR2_TRACE_INIT,
2263:				   "pvr2_hdw_setup(hdw=%p) done, ok=%d init_ok=%d",
2264:				   hdw,pvr2_hdw_dev_ok(hdw),hdw->flag_init_ok);
2265:			if (pvr2_hdw_dev_ok(hdw)) {
2266:				if (hdw->flag_init_ok) {
2267:					pvr2_trace(
2268:						PVR2_TRACE_INFO,
2269:						"Device initialization completed successfully.");
2270:					break;
2271:				}
2272:				if (hdw->fw1_state == FW1_STATE_RELOAD) {
2273:					pvr2_trace(
2274:						PVR2_TRACE_INFO,
2275:						"Device microcontroller firmware (re)loaded; it should now reset and reconnect.");
2276:					break;
2277:				}
2278:				pvr2_trace(
2279:					PVR2_TRACE_ERROR_LEGS,
2280:					"Device initialization was not successful.");
2281:				if (hdw->fw1_state == FW1_STATE_MISSING) {
2282:					pvr2_trace(
2283:						PVR2_TRACE_ERROR_LEGS,
2284:						"Giving up since device microcontroller firmware appears to be missing.");
2285:					break;
2286:				}
2287:			}
2288:			if (hdw->flag_modulefail) {
2289:				pvr2_trace(
2290:					PVR2_TRACE_ERROR_LEGS,
2291:					"***WARNING*** pvrusb2 driver initialization failed due to the failure of one or more sub-device kernel modules.");
2292:				pvr2_trace(
2293:					PVR2_TRACE_ERROR_LEGS,
2294:					"You need to resolve the failing condition before this driver can function.  There should be some earlier messages giving more information about the problem.");
2295:				break;
2296:			}
2297:			if (procreload) {
2298:				pvr2_trace(
2299:					PVR2_TRACE_ERROR_LEGS,
2300:					"Attempting pvrusb2 recovery by reloading primary firmware.");
2301:				pvr2_trace(
2302:					PVR2_TRACE_ERROR_LEGS,
2303:					"If this works, device should disconnect and reconnect in a sane state.");
2304:				hdw->fw1_state = FW1_STATE_UNKNOWN;
2305:				pvr2_upload_firmware1(hdw);
2306:			} else {
2307:				pvr2_trace(
2308:					PVR2_TRACE_ERROR_LEGS,
2309:					"***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.");
2310:				pvr2_trace(
2311:					PVR2_TRACE_ERROR_LEGS,
2312:					"You might need to power cycle the pvrusb2 device in order to recover.");
2313:			}
2314:		} while (0);
2315:		pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_setup(hdw=%p) end",hdw);
2316:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c]

gemini-3-pro-preview

							input: 167162
							output: 59
							thoughts: 49
						

Here's my thought process, as it stands:

**Digging into the `pvr2` Hardware Initialization**

Okay, so I'm looking at this code and I see that `pvr2_hdw_setup_low` is calling `pvr2_i2c_core_init(hdw)`. That's interesting, and important. Seems like the lower-level hardware setup function depends directly on initializing the I2C core. I need to understand that relationship better. The I2C core is pretty fundamental, so its init likely plays a key role in bringing the entire hardware interface up. Therefore, the next logical step is to dive right into `pvr2_hdw_setup_low` and figure out what's really happening there. Let's see what secrets it's hiding!

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c IncludeLines:true Name:pvr2_hdw_setup_low]

map[SourceCode:2083:	static void pvr2_hdw_setup_low(struct pvr2_hdw *hdw)
2084:	{
2085:		int ret;
2086:		unsigned int idx;
2087:		struct pvr2_ctrl *cptr;
2088:		int reloadFl = 0;
2089:		if (hdw->hdw_desc->fx2_firmware.cnt) {
2090:			if (!reloadFl) {
2091:				reloadFl =
2092:					(hdw->usb_intf->cur_altsetting->desc.bNumEndpoints
2093:					 == 0);
2094:				if (reloadFl) {
2095:					pvr2_trace(PVR2_TRACE_INIT,
2096:						   "USB endpoint config looks strange; possibly firmware needs to be loaded");
2097:				}
2098:			}
2099:			if (!reloadFl) {
2100:				reloadFl = !pvr2_hdw_check_firmware(hdw);
2101:				if (reloadFl) {
2102:					pvr2_trace(PVR2_TRACE_INIT,
2103:						   "Check for FX2 firmware failed; possibly firmware needs to be loaded");
2104:				}
2105:			}
2106:			if (reloadFl) {
2107:				if (pvr2_upload_firmware1(hdw) != 0) {
2108:					pvr2_trace(PVR2_TRACE_ERROR_LEGS,
2109:						   "Failure uploading firmware1");
2110:				}
2111:				return;
2112:			}
2113:		}
2114:		hdw->fw1_state = FW1_STATE_OK;
2115:	
2116:		if (!pvr2_hdw_dev_ok(hdw)) return;
2117:	
2118:		hdw->force_dirty = !0;
2119:	
2120:		if (!hdw->hdw_desc->flag_no_powerup) {
2121:			pvr2_hdw_cmd_powerup(hdw);
2122:			if (!pvr2_hdw_dev_ok(hdw)) return;
2123:		}
2124:	
2125:		/* Take the IR chip out of reset, if appropriate */
2126:		if (hdw->ir_scheme_active == PVR2_IR_SCHEME_ZILOG) {
2127:			pvr2_issue_simple_cmd(hdw,
2128:					      FX2CMD_HCW_ZILOG_RESET |
2129:					      (1 << 8) |
2130:					      ((0) << 16));
2131:		}
2132:	
2133:		/* This step MUST happen after the earlier powerup step */
2134:		pvr2_i2c_core_init(hdw);
2135:		if (!pvr2_hdw_dev_ok(hdw)) return;
2136:	
2137:		/* Reset demod only on Hauppauge 160xxx platform */
2138:		if (le16_to_cpu(hdw->usb_dev->descriptor.idVendor) == 0x2040 &&
2139:		    (le16_to_cpu(hdw->usb_dev->descriptor.idProduct) == 0x7502 ||
2140:		     le16_to_cpu(hdw->usb_dev->descriptor.idProduct) == 0x7510)) {
2141:			pr_info("%s(): resetting 160xxx demod\n", __func__);
2142:			/* TODO: not sure this is proper place to reset once only */
2143:			pvr2_issue_simple_cmd(hdw,
2144:					      FX2CMD_HCW_DEMOD_RESET_PIN |
2145:					      (1 << 8) |
2146:					      ((0) << 16));
2147:			usleep_range(10000, 10500);
2148:			pvr2_issue_simple_cmd(hdw,
2149:					      FX2CMD_HCW_DEMOD_RESET_PIN |
2150:					      (1 << 8) |
2151:					      ((1) << 16));
2152:			usleep_range(10000, 10500);
2153:		}
2154:	
2155:		pvr2_hdw_load_modules(hdw);
2156:		if (!pvr2_hdw_dev_ok(hdw)) return;
2157:	
2158:		v4l2_device_call_all(&hdw->v4l2_dev, 0, core, load_fw);
2159:	
2160:		for (idx = 0; idx < CTRLDEF_COUNT; idx++) {
2161:			cptr = hdw->controls + idx;
2162:			if (cptr->info->skip_init) continue;
2163:			if (!cptr->info->set_value) continue;
2164:			cptr->info->set_value(cptr,~0,cptr->info->default_value);
2165:		}
2166:	
2167:		pvr2_hdw_cx25840_vbi_hack(hdw);
2168:	
2169:		/* Set up special default values for the television and radio
2170:		   frequencies here.  It's not really important what these defaults
2171:		   are, but I set them to something usable in the Chicago area just
2172:		   to make driver testing a little easier. */
2173:	
2174:		hdw->freqValTelevision = default_tv_freq;
2175:		hdw->freqValRadio = default_radio_freq;
2176:	
2177:		// Do not use pvr2_reset_ctl_endpoints() here.  It is not
2178:		// thread-safe against the normal pvr2_send_request() mechanism.
2179:		// (We should make it thread safe).
2180:	
2181:		if (hdw->hdw_desc->flag_has_hauppauge_rom) {
2182:			ret = pvr2_hdw_get_eeprom_addr(hdw);
2183:			if (!pvr2_hdw_dev_ok(hdw)) return;
2184:			if (ret < 0) {
2185:				pvr2_trace(PVR2_TRACE_ERROR_LEGS,
2186:					   "Unable to determine location of eeprom, skipping");
2187:			} else {
2188:				hdw->eeprom_addr = ret;
2189:				pvr2_eeprom_analyze(hdw);
2190:				if (!pvr2_hdw_dev_ok(hdw)) return;
2191:			}
2192:		} else {
2193:			hdw->tuner_type = hdw->hdw_desc->default_tuner_type;
2194:			hdw->tuner_updated = !0;
2195:			hdw->std_mask_eeprom = V4L2_STD_ALL;
2196:		}
2197:	
2198:		if (hdw->serial_number) {
2199:			idx = scnprintf(hdw->identifier, sizeof(hdw->identifier) - 1,
2200:					"sn-%lu", hdw->serial_number);
2201:		} else if (hdw->unit_number >= 0) {
2202:			idx = scnprintf(hdw->identifier, sizeof(hdw->identifier) - 1,
2203:					"unit-%c",
2204:					hdw->unit_number + 'a');
2205:		} else {
2206:			idx = scnprintf(hdw->identifier, sizeof(hdw->identifier) - 1,
2207:					"unit-??");
2208:		}
2209:		hdw->identifier[idx] = 0;
2210:	
2211:		pvr2_hdw_setup_std(hdw);
2212:	
2213:		if (!get_default_tuner_type(hdw)) {
2214:			pvr2_trace(PVR2_TRACE_INIT,
2215:				   "pvr2_hdw_setup: Tuner type overridden to %d",
2216:				   hdw->tuner_type);
2217:		}
2218:	
2219:	
2220:		if (!pvr2_hdw_dev_ok(hdw)) return;
2221:	
2222:		if (hdw->hdw_desc->signal_routing_scheme ==
2223:		    PVR2_ROUTING_SCHEME_GOTVIEW) {
2224:			/* Ensure that GPIO 11 is set to output for GOTVIEW
2225:			   hardware. */
2226:			pvr2_hdw_gpio_chg_dir(hdw,(1 << 11),~0);
2227:		}
2228:	
2229:		pvr2_hdw_commit_setup(hdw);
2230:	
2231:		hdw->vid_stream = pvr2_stream_create();
2232:		if (!pvr2_hdw_dev_ok(hdw)) return;
2233:		pvr2_trace(PVR2_TRACE_INIT,
2234:			   "pvr2_hdw_setup: video stream is %p",hdw->vid_stream);
2235:		if (hdw->vid_stream) {
2236:			idx = get_default_error_tolerance(hdw);
2237:			if (idx) {
2238:				pvr2_trace(PVR2_TRACE_INIT,
2239:					   "pvr2_hdw_setup: video stream %p setting tolerance %u",
2240:					   hdw->vid_stream,idx);
2241:			}
2242:			pvr2_stream_setup(hdw->vid_stream,hdw->usb_dev,
2243:					  PVR2_VID_ENDPOINT,idx);
2244:		}
2245:	
2246:		if (!pvr2_hdw_dev_ok(hdw)) return;
2247:	
2248:		hdw->flag_init_ok = !0;
2249:	
2250:		pvr2_hdw_state_sched(hdw);
2251:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c]

gemini-3-pro-preview

							input: 170439
							output: 57
							thoughts: 71
						

Here's my thought process on that code snippet:

**Diving into the Initialization Sequence**

Okay, so `pvr2_hdw_setup_low` is calling `pvr2_i2c_core_init(hdw)`. That's the expected low-level I2C initialization.  But wait a minute, where does `pvr2_hdw_setup` itself get called from? I need to trace back. Ah, it looks like `pvr2_hdw_setup` is actually called from `pvr2_hdw_initialize`. That's a good starting point. I should probably take a look at the `pvr2_hdw_initialize` function to understand the complete initialization flow. What exactly is it setting up before calling the lower-level functions? It's essential to understand the overall context to truly grasp what's happening during this I2C initialization.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c IncludeLines:true Name:pvr2_hdw_initialize]

map[SourceCode:2319:	/* Perform second stage initialization.  Set callback pointer first so that
2320:	   we can avoid a possible initialization race (if the kernel thread runs
2321:	   before the callback has been set). */
2322:	int pvr2_hdw_initialize(struct pvr2_hdw *hdw,
2323:				void (*callback_func)(void *),
2324:				void *callback_data)
2325:	{
2326:		LOCK_TAKE(hdw->big_lock); do {
2327:			if (hdw->flag_disconnected) {
2328:				/* Handle a race here: If we're already
2329:				   disconnected by this point, then give up.  If we
2330:				   get past this then we'll remain connected for
2331:				   the duration of initialization since the entire
2332:				   initialization sequence is now protected by the
2333:				   big_lock. */
2334:				break;
2335:			}
2336:			hdw->state_data = callback_data;
2337:			hdw->state_func = callback_func;
2338:			pvr2_hdw_setup(hdw);
2339:		} while (0); LOCK_GIVE(hdw->big_lock);
2340:		return hdw->flag_init_ok;
2341:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c]

gemini-3-pro-preview

							input: 171189
							output: 55
							thoughts: 58
						

Here's my summary, as the thought process unfolds:

**Digging into the PVRUSB2 Driver Initialization**

Okay, so `pvr2_hdw_initialize` is called by `pvr2_context_create`. That's a good starting point. Let's see what's actually happening within the context creation process. I'll need to jump into `drivers/media/usb/pvrusb2/pvrusb2-context.c` and figure out the sequence of events. Understanding how the hardware is initialized *during* the context creation phase is key. This is probably where the device-specific initializations are happening. Let's see if there are any obvious error checks or resource allocation within that function that could provide clues if things go wrong.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-context.c IncludeLines:true Name:pvr2_context_create]

map[SourceCode: 201:	struct pvr2_context *pvr2_context_create(
 202:		struct usb_interface *intf,
 203:		const struct usb_device_id *devid,
 204:		void (*setup_func)(struct pvr2_context *))
 205:	{
 206:		struct pvr2_context *mp = NULL;
 207:		mp = kzalloc(sizeof(*mp),GFP_KERNEL);
 208:		if (!mp) goto done;
 209:		pvr2_trace(PVR2_TRACE_CTXT,"pvr2_context %p (create)",mp);
 210:		mp->setup_func = setup_func;
 211:		mutex_init(&mp->mutex);
 212:		mutex_lock(&pvr2_context_mutex);
 213:		mp->exist_prev = pvr2_context_exist_last;
 214:		mp->exist_next = NULL;
 215:		pvr2_context_exist_last = mp;
 216:		if (mp->exist_prev) {
 217:			mp->exist_prev->exist_next = mp;
 218:		} else {
 219:			pvr2_context_exist_first = mp;
 220:		}
 221:		mutex_unlock(&pvr2_context_mutex);
 222:		mp->hdw = pvr2_hdw_create(intf,devid);
 223:		if (!mp->hdw) {
 224:			pvr2_context_destroy(mp);
 225:			mp = NULL;
 226:			goto done;
 227:		}
 228:		pvr2_context_set_notify(mp, !0);
 229:	 done:
 230:		return mp;
 231:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-context.c]

gemini-3-pro-preview

							input: 172016
							output: 57
							thoughts: 53
						

Okay, let me think this through.

**Analyzing the PVR2 Driver Initialization Sequence**

Right, so `pvr2_context_create` is the function that kicks things off, and I see it immediately calls `pvr2_hdw_create`. That makes sense. But hang on... where does the hardware actually get *initialized*? `pvr2_hdw_create` probably sets up some structures, but the actual device setup... that’s what I'm looking for. It's got to be done somewhere. Let me see... I have a feeling `pvr2_context_thread_func` is the most likely candidate to hold the missing puzzle piece. It's the worker thread, so if any initialization happens, it would be within the thread function. Time to dig in there and see what it's doing.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-context.c IncludeLines:true Name:pvr2_context_thread_func]

map[SourceCode: 149:	static int pvr2_context_thread_func(void *foo)
 150:	{
 151:		struct pvr2_context *mp;
 152:	
 153:		pvr2_trace(PVR2_TRACE_CTXT,"pvr2_context thread start");
 154:	
 155:		do {
 156:			while ((mp = pvr2_context_notify_first) != NULL) {
 157:				pvr2_context_set_notify(mp, 0);
 158:				pvr2_context_check(mp);
 159:			}
 160:			wait_event_interruptible(
 161:				pvr2_context_sync_data,
 162:				((pvr2_context_notify_first != NULL) ||
 163:				 pvr2_context_shutok()));
 164:		} while (!pvr2_context_shutok());
 165:	
 166:		pvr2_context_cleaned_flag = !0;
 167:		wake_up(&pvr2_context_cleanup_data);
 168:	
 169:		pvr2_trace(PVR2_TRACE_CTXT,"pvr2_context thread cleaned up");
 170:	
 171:		wait_event_interruptible(
 172:			pvr2_context_sync_data,
 173:			kthread_should_stop());
 174:	
 175:		pvr2_trace(PVR2_TRACE_CTXT,"pvr2_context thread end");
 176:	
 177:		return 0;
 178:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-context.c]

gemini-3-pro-preview

							input: 172809
							output: 55
							thoughts: 20
						

Here's a summary of my mental processing, as though I'm thinking it:

**Digging into the PVR2 Driver Initialization**

Okay, so I'm looking at the code for the `pvr2` driver, and I've got my eye on `pvr2_context_check`. This function seems like a key component, probably responsible for some initial setup or validation related to a context. And the line that's immediately jumping out at me is that `pvr2_context_check` directly calls `pvr2_hdw_initialize`. This tells me that context checking is intimately tied to hardware initialization. It's almost certain this checks the context and then makes sure the hardware is correctly initialized to support it. I'll need to drill down into the internals of `pvr2_hdw_initialize` to see what kind of specific hardware configuration and setup the driver is performing. Likely checking resources, memory mappings, interrupts...the works. I'm going to bet that `pvr2_context_check` does a quick sanity check before proceeding with hardware init, potentially based on the parameters passed. This could be a critical path for robust initialization, especially if we're dealing with multiple concurrent contexts.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-context.c IncludeLines:true Name:pvr2_context_check]

map[SourceCode: 101:	static void pvr2_context_check(struct pvr2_context *mp)
 102:	{
 103:		struct pvr2_channel *ch1, *ch2;
 104:		pvr2_trace(PVR2_TRACE_CTXT,
 105:			   "pvr2_context %p (notify)", mp);
 106:		if (!mp->initialized_flag && !mp->disconnect_flag) {
 107:			mp->initialized_flag = !0;
 108:			pvr2_trace(PVR2_TRACE_CTXT,
 109:				   "pvr2_context %p (initialize)", mp);
 110:			/* Finish hardware initialization */
 111:			if (pvr2_hdw_initialize(mp->hdw, pvr2_context_notify, mp)) {
 112:				mp->video_stream.stream =
 113:					pvr2_hdw_get_video_stream(mp->hdw);
 114:				/* Trigger interface initialization.  By doing this
 115:				   here initialization runs in our own safe and
 116:				   cozy thread context. */
 117:				if (mp->setup_func) mp->setup_func(mp);
 118:			} else {
 119:				pvr2_trace(PVR2_TRACE_CTXT,
 120:					   "pvr2_context %p (thread skipping setup)",
 121:					   mp);
 122:				/* Even though initialization did not succeed,
 123:				   we're still going to continue anyway.  We need
 124:				   to do this in order to await the expected
 125:				   disconnect (which we will detect in the normal
 126:				   course of operation). */
 127:			}
 128:		}
 129:	
 130:		for (ch1 = mp->mc_first; ch1; ch1 = ch2) {
 131:			ch2 = ch1->mc_next;
 132:			if (ch1->check_func) ch1->check_func(ch1);
 133:		}
 134:	
 135:		if (mp->disconnect_flag && !mp->mc_first) {
 136:			/* Go away... */
 137:			pvr2_context_destroy(mp);
 138:			return;
 139:		}
 140:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-context.c]

gemini-3-pro-preview

							input: 173853
							output: 60
							thoughts: 922
						

**I2C Adapter Registration and Syzkaller Considerations**

Okay, so `pvr2_hdw_initialize` is called from a kernel thread. That kicks off a chain: `pvr2_hdw_setup` calls `pvr2_hdw_setup_low`, which then calls `pvr2_i2c_core_init`. This is where the I2C adapter and client devices are registered, but asynchronously! That presents a challenge when crafting a syzkaller program. I need to figure out how to ensure the I2C adapter is ready *before* I try to open `/dev/i2c-X`.

My initial thought is to simply try opening `/dev/i2c-0`, `/dev/i2c-1`, etc., in a loop, or maybe just try them all at once. But wait, what about `syz_usb_connect`? Doesn't that block until the device is fully probed? No, it just sends the descriptor and returns. The kernel handles the probing asynchronously. So, a delay or retrying the `open` calls seems like the right approach.

Actually, syzkaller *does* have `syz_open_dev` which retries opening, that would simplify things. But I don't know the exact minor number of the I2C adapter, so I can just try opening `/dev/i2c-0` through `/dev/i2c-7`, in a loop, or maybe, use `syz_open_dev`. Then it hits me, syzkaller *doesn't* have a `syz_open_dev` for `/dev/i2c-X`. Okay, I can use `openat(AT_FDCWD, "/dev/i2c-0", 0, 0)` instead. And, again, to make sure I open the device after the registration is done, I can loop, or just make multiple calls.

Hold on, what happens if I call `syz_usb_disconnect`? I'd disconnect the device! If I do this:

```c
r0 = syz_usb_connect(...)
r1 = openat(AT_FDCWD, "/dev/i2c-0", 0, 0)
r2 = openat(AT_FDCWD, "/dev/i2c-1", 0, 0)
r3 = openat(AT_FDCWD, "/dev/i2c-2", 0, 0)
r4 = openat(AT_FDCWD, "/dev/i2c-3", 0, 0)
syz_usb_disconnect(r0)
```

The `openat` calls could fail if they happen before registration. So, more retries or a delay are needed.

Could I use `syz_usb_control_io` to wait for some control requests? The `pvrusb2` driver sends control requests during initialization. If I use `syz_usb_connect`, and provide a generic `vusb_responses` it will reply to them. But the `pvrusb2` driver needs firmware upload! And the upload is triggered based on the interface descriptor.

Wait, if `bNumEndpoints == 0`, it tries to upload firmware! If I supply `bNumEndpoints == 2` (bulk in and bulk out), it will *not* upload firmware. Let me check `pvr2_hdw_check_firmware`... This is promising! This could be a crucial detail!

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c IncludeLines:true Name:pvr2_hdw_check_firmware]

map[SourceCode:1796:	static int pvr2_hdw_check_firmware(struct pvr2_hdw *hdw)
1797:	{
1798:		/* Try a harmless request to fetch the eeprom's address over
1799:		   endpoint 1.  See what happens.  Only the full FX2 image can
1800:		   respond to this.  If this probe fails then likely the FX2
1801:		   firmware needs be loaded. */
1802:		int result;
1803:		LOCK_TAKE(hdw->ctl_lock); do {
1804:			hdw->cmd_buffer[0] = FX2CMD_GET_EEPROM_ADDR;
1805:			result = pvr2_send_request_ex(hdw,HZ*1,!0,
1806:						   hdw->cmd_buffer,1,
1807:						   hdw->cmd_buffer,1);
1808:			if (result < 0) break;
1809:		} while(0); LOCK_GIVE(hdw->ctl_lock);
1810:		if (result) {
1811:			pvr2_trace(PVR2_TRACE_INIT,
1812:				   "Probe of device endpoint 1 result status %d",
1813:				   result);
1814:		} else {
1815:			pvr2_trace(PVR2_TRACE_INIT,
1816:				   "Probe of device endpoint 1 succeeded");
1817:		}
1818:		return result == 0;
1819:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c]

gemini-3-pro-preview

							input: 176076
							output: 58
							thoughts: 837
						

**My Analysis of the PVR2 Firmware Check**

Okay, so here's what's happening. `pvr2_hdw_check_firmware` is sending a request to endpoint 1 (bulk out) and expecting a response from endpoint 1 (bulk in). I can see that `pvr2_send_request_ex` is using `PVR2_CTL_WRITE_ENDPOINT` (1) and `PVR2_CTL_READ_ENDPOINT` (0x81) for this. If that request times out (after 1 second), `pvr2_hdw_check_firmware` is going to return 0. Consequently, `pvr2_hdw_setup_low` will incorrectly believe the firmware needs to be loaded, and call `pvr2_upload_firmware1(hdw)`. This function then calls `request_firmware` to get the firmware from userspace. If *that* fails, `pvr2_hdw_setup_low` bails out early! If it does, `pvr2_i2c_core_init` is *never* called, which is a big problem.

Therefore, the critical point is to make `pvr2_hdw_check_firmware` succeed. How? We need to reply to the bulk request. But `syz_usb_connect` isn't going to do that automatically. Aha! I can use `syz_usb_ep_write` to write data to the bulk IN endpoint! `pvr2_send_request_ex` only sends 1 byte out and reads 1 byte in, so if I just write 1 byte to the IN endpoint (0x81), `pvr2_send_request_ex` should receive it.

Let me check `vusb.txt`… Yes, the definition is:
```
syz_usb_ep_write(fd fd_usb, ep int8, len len[data], data ptr[in, array[int8, 0:256]])
```
So, that means I can do this:
```
r0 = syz_usb_connect(...)
syz_usb_ep_write(r0, 0x81, 1, &AUTO="\x00")
```
Perfect. Wait, let me check the details. `pvr2_hdw_check_firmware` is actually sending `FX2CMD_GET_EEPROM_ADDR` (which is `0xeb`) *before* reading the byte. If I reply with `\x00` it should think all is well.

Okay, let me check if there is anything else that can go wrong. Let's look at `pvr2_hdw_setup_low` again. It calls `pvr2_hdw_cmd_powerup` which in turn calls `pvr2_issue_simple_cmd`. Right, that confirms my understanding. So, I think I've got a solution that addresses the core issue.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c IncludeLines:true Name:pvr2_issue_simple_cmd]

map[SourceCode:3825:	static int pvr2_issue_simple_cmd(struct pvr2_hdw *hdw,u32 cmdcode)
3826:	{
3827:		int ret;
3828:		unsigned int cnt = 1;
3829:		unsigned int args = 0;
3830:		LOCK_TAKE(hdw->ctl_lock);
3831:		hdw->cmd_buffer[0] = cmdcode & 0xffu;
3832:		args = (cmdcode >> 8) & 0xffu;
3833:		args = (args > 2) ? 2 : args;
3834:		if (args) {
3835:			cnt += args;
3836:			hdw->cmd_buffer[1] = (cmdcode >> 16) & 0xffu;
3837:			if (args > 1) {
3838:				hdw->cmd_buffer[2] = (cmdcode >> 24) & 0xffu;
3839:			}
3840:		}
3841:		if (pvrusb2_debug & PVR2_TRACE_INIT) {
3842:			unsigned int idx;
3843:			unsigned int ccnt,bcnt;
3844:			char tbuf[50];
3845:			cmdcode &= 0xffu;
3846:			bcnt = 0;
3847:			ccnt = scnprintf(tbuf+bcnt,
3848:					 sizeof(tbuf)-bcnt,
3849:					 "Sending FX2 command 0x%x",cmdcode);
3850:			bcnt += ccnt;
3851:			for (idx = 0; idx < ARRAY_SIZE(pvr2_fx2cmd_desc); idx++) {
3852:				if (pvr2_fx2cmd_desc[idx].id == cmdcode) {
3853:					ccnt = scnprintf(tbuf+bcnt,
3854:							 sizeof(tbuf)-bcnt,
3855:							 " \"%s\"",
3856:							 pvr2_fx2cmd_desc[idx].desc);
3857:					bcnt += ccnt;
3858:					break;
3859:				}
3860:			}
3861:			if (args) {
3862:				ccnt = scnprintf(tbuf+bcnt,
3863:						 sizeof(tbuf)-bcnt,
3864:						 " (%u",hdw->cmd_buffer[1]);
3865:				bcnt += ccnt;
3866:				if (args > 1) {
3867:					ccnt = scnprintf(tbuf+bcnt,
3868:							 sizeof(tbuf)-bcnt,
3869:							 ",%u",hdw->cmd_buffer[2]);
3870:					bcnt += ccnt;
3871:				}
3872:				ccnt = scnprintf(tbuf+bcnt,
3873:						 sizeof(tbuf)-bcnt,
3874:						 ")");
3875:				bcnt += ccnt;
3876:			}
3877:			pvr2_trace(PVR2_TRACE_INIT,"%.*s",bcnt,tbuf);
3878:		}
3879:		ret = pvr2_send_request(hdw,hdw->cmd_buffer,cnt,NULL,0);
3880:		LOCK_GIVE(hdw->ctl_lock);
3881:		return ret;
3882:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c]

gemini-3-pro-preview

							input: 178634
							output: 58
							thoughts: 703
						

**Analyzing USB Bulk Transfers in the PVR2 Driver**

Okay, so I'm digging into this `pvr2_issue_simple_cmd` function and how it interacts with the USB bulk transfers. It's calling `pvr2_send_request` with `read_len = 0`. Right, so it's just writing to the bulk OUT endpoint, not reading anything back. That means we don't need a response from the device, which simplifies things. However, I need to remember that `pvr2_send_request_ex` *does* wait for `hdw->ctl_done`, so I have to keep that in mind.

Now, a key question arises: if there's no read operation, will the USB Request Block (URB) complete? Thinking about it, the dummy Host Controller Driver (HCD) *should* complete the bulk OUT URB immediately. No data to read, no problem. But, and this is important, for bulk IN, the dummy HCD will be waiting for *us* to provide the data via `syz_usb_ep_write`. We only need to provide data for bulk IN requests – good to know.

Next, I need to pinpoint the number of bulk IN requests before `pvr2_i2c_core_init`. Let's see... the code flow. First, `pvr2_hdw_check_firmware` does a 1-byte read. Are there any others? I should look at `pvr2_hdw_setup_low` again to be absolutely sure.

Okay, let's see. The code is checking to see if firmware needs to be loaded by looking at a count. Then we do a call to `pvr2_hdw_check_firmware`. Wait. `pvr2_hdw_check_firmware` is only called if `hdw->hdw_desc->fx2_firmware.cnt` is non-zero. That makes things easier, right?

I think that confirms it, then. Looking at the code for the `pvr2_device_29xxx` device, there is, at most, only *one* bulk IN read request before `pvr2_i2c_core_init`: the check for the firmware version. That should be manageable. We just need to simulate providing the data for that one request.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-devattr.c IncludeLines:true Name:pvr2_device_29xxx]

map[SourceCode:  51:	static const struct pvr2_device_desc pvr2_device_29xxx = {
  52:			.description = "WinTV PVR USB2 Model 29xxx",
  53:			.shortname = "29xxx",
  54:			.client_table.lst = pvr2_cli_29xxx,
  55:			.client_table.cnt = ARRAY_SIZE(pvr2_cli_29xxx),
  56:			.fx2_firmware.lst = pvr2_fw1_names_29xxx,
  57:			.fx2_firmware.cnt = ARRAY_SIZE(pvr2_fw1_names_29xxx),
  58:			.flag_has_hauppauge_rom = !0,
  59:			.flag_has_analogtuner = !0,
  60:			.flag_has_fmradio = !0,
  61:			.flag_has_composite = !0,
  62:			.flag_has_svideo = !0,
  63:			.signal_routing_scheme = PVR2_ROUTING_SCHEME_HAUPPAUGE,
  64:			.led_scheme = PVR2_LED_SCHEME_HAUPPAUGE,
  65:			.ir_scheme = PVR2_IR_SCHEME_29XXX,
  66:	};
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-devattr.c]

gemini-3-pro-preview

							input: 180301
							output: 18
							thoughts: 5274
						

**Exploiting a Race Condition in the PVR2 USB Driver**

Okay, so the goal here is to trigger a hang in the `pvr2` USB driver. The plan is to create a race condition by manipulating the firmware check and I2C initialization sequence.  The device firmware check sends a bulk IN request. We'll respond to that with a single byte.  Then, by connecting the USB device with a carefully crafted descriptor, we get the driver to create a kernel thread. This thread eventually calls `pvr2_hdw_check_firmware`, which sends a bulk IN request to get firmware. We respond with a byte as expected. Then `pvr2_i2c_core_init` is called, registering the I2C adapter.

After initializing the I2C adapter, `pvr2_hdw_setup_low` then makes a crucial call, `pvr2_hdw_get_eeprom_addr`.  This function *also* sends a bulk IN request.  This is our key opportunity! We want to exploit the blocking behavior of `syz_usb_disconnect`. By not replying to this request, the kernel thread blocks for one second, waiting for the IN request.  During this one second, we need to open the I2C devices.

Since we are dealing with a race condition, the `pvr2_i2c_core_init` needs to be called *before* opening the I2C devices.  The plan is to open `/dev/i2c-0` through `/dev/i2c-7` in parallel. Then, as the I2C adapter is still active, we disconnect the device, causing the race condition.

The program should follow this structure: first, connect the USB device with the correct device descriptor, then send a response to a bulk IN request using `syz_usb_ep_write`. This starts the firmware check in the kernel thread. Then, open the I2C devices `/dev/i2c-0` through `/dev/i2c-7` .  Then, crucially, disconnect using `syz_usb_disconnect` to trigger the bug.  This should cause a hang because the I2C adapter will be removed while the device is still in use.  We use `AUTO` for the device and configuration descriptors to simplify setup.  We're assuming the device IDs we're passing will work.  The `openat` calls could fail if executed prematurely. However, we're relying on the I2C registration to happen after our initial `syz_usb_ep_write`. And if the opens fail, then the hang will not be triggered, so it's acceptable.

map[File:sys.txt]

map[Output:# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

# Description of syscall arguments. See README.md for details.

include <linux/socket.h>
include <linux/ptrace.h>
include <linux/resource.h>
include <linux/stat.h>
include <linux/mman.h>
include <linux/time.h>
include <linux/mount.h>
include <linux/fs.h>
include <linux/eventpoll.h>
include <linux/signalfd.h>
include <linux/eventfd.h>
include <linux/timerfd.h>
include <linux/personality.h>
include <linux/wait.h>
include <linux/user.h>
include <linux/un.h>
include <linux/ioctl.h>
include <linux/fadvise.h>
include <linux/falloc.h>
include <linux/kexec.h>
include <linux/elf.h>
include <linux/fiemap.h>
include <linux/kd.h>
include <linux/vt.h>
include <linux/if_alg.h>
include <linux/nfc.h>
include <linux/sockios.h>
include <linux/net_tstamp.h>
include <linux/termios.h>
include <linux/fcntl.h>
include <linux/sched.h>
include <linux/mqueue.h>
include <linux/mempolicy.h>
include <linux/in.h>
include <linux/ip.h>
include <linux/tcp.h>
include <linux/udp.h>
include <linux/kcmp.h>
include <linux/nfs.h>
include <linux/syslog.h>
include <linux/exportfs.h>
include <linux/splice.h>
include <linux/filelock.h>
include <fs/overlayfs/overlayfs.h>
include <uapi/linux/memfd.h>
include <uapi/linux/module.h>
include <linux/ioprio.h>
include <linux/membarrier.h>
include <uapi/linux/kcov.h>
include <uapi/linux/membarrier.h>
include <uapi/linux/capability.h>
include <uapi/linux/seccomp.h>
include <uapi/linux/wait.h>
include <uapi/linux/watch_queue.h>
include <kernel/sched/sched.h>
include <uapi/linux/close_range.h>
include <uapi/linux/netfilter/xt_cgroup.h>
include <fs/smb/client/cifsglob.h>
include <xen/interface/io/xs_wire.h>
include <uapi/linux/prctl.h>
include <asm/prctl.h>
include <linux/reboot.h>
include <linux/swap.h>

resource fd[int32]: -1
resource fd_dir[fd]: AT_FDCWD

# alignptr/align32/align64/padto64 can be used when ABI uses int64/intptr to hold a smaller type.
# E.g. pid/uid stored as intptr/int64.
type alignptr[T] {
	v	T
} [align[PTR_SIZE]]

type align32[T] {
	v	T
} [align[4]]

type align64[T] {
	v	T
} [align[8]]

type padto32[T] {
	v	T
} [size[4]]

type padto64[T] {
	v	T
} [size[8]]

type signalno int32[0:65]
type signalnoptr intptr[0:65]

# syz_execute_func caused multiple problems:
# 1. First it lead to corpus explosion. The program used existing values in registers
# to pollute output area. We tried to zero registers (though, not reliably).
# 2. It lead to explosion again. The exact mechanics are unknown, here is one sample:
# syz_execute_func(&(0x7f0000000440)="f2af91930f0124eda133fa20430fbafce842f66188d0d4
#	430fc7f314c1ab5bf9e2f9660f3a0fae5e090000ba023c1fb63ac4817d73d74ec482310d46f44
#	9f216c863fa438036a91bdbae95aaaa420f383c02c401405c6bfd49d768d768f833fefbab6464
#	660f38323c8f26dbc1a1fe5ff6f6df0804f4c4efa59c0f01c4288ba6452e000054c4431d5cc100")
# 3. The code can also execute syscalls (and it is know to), but it's not subject to
# target.SanitizeCall. As the result it can do things that programs are not supposed to do.
# 4. Besides linux, corpus explosion also happens on freebsd and is clearly attributable
# to syz_execute_func based on corpus contents. Mechanics are also not known.
# It also did not cause finding of any new bugs (at least not that I know of).
# So it's disabled on all OSes until we figure out how to resolve all these problems.
syz_execute_func(text ptr[in, text[target]]) (disabled)

# Exclude /sys/power/state as reported in https://lkml.org/lkml/2021/5/27/653
openat$sysfs(fd const[AT_FDCWD], dir ptr[in, glob["/sys/**/*:-/sys/power/state"]], flags flags[open_flags], mode flags[open_mode]) fd

open(file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd (automatic_helper)
# Just so that we have something that creates fd_dir resources.
open$dir(file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd_dir (automatic_helper)
openat$dir(fd const[AT_FDCWD], file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd_dir (automatic_helper)
openat(fd fd_dir[opt], file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd
openat2$dir(fd const[AT_FDCWD], file ptr[in, filename], how ptr[in, open_how], size bytesize[how]) fd_dir (automatic_helper)
openat2(fd fd_dir[opt], file ptr[in, filename], how ptr[in, open_how], size bytesize[how]) fd
creat(file ptr[in, filename], mode flags[open_mode]) fd
close(fd fd)
read(fd fd, buf buffer[out], count len[buf])
pread64(fd fd, buf buffer[out], count len[buf], pos fileoff)
readv(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec])
preadv(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec], off_low int32, off_high int32)
preadv2(fd fd, vec ptr[in, array[iovec_out]], vlen len[vec], off_low int32, off_high int32, flags flags[rwf_flags])
write(fd fd, buf buffer[in], count len[buf])
pwrite64(fd fd, buf buffer[in], count len[buf], pos fileoff)
writev(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec])
pwritev(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], off_low int32, off_high int32)
pwritev2(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], off_low int32, off_high int32, flags flags[rwf_flags])
# lseek can return negative offsets when the file has FMODE_UNSIGNED_OFFSET flag:
# https://elixir.bootlin.com/linux/v6.11-rc7/source/fs/read_write.c#L56
# It's unclear how it's then even possible to distinguish error from valid offset, but it's not our problem.
# We just have to ignore return values of lseek.
lseek(fd fd, offset fileoff, whence flags[seek_whence]) (ignore_return)
copy_file_range(fd_in fd, off_in ptr[inout, fileoff[int64], opt], fd_out fd, off_out ptr[inout, fileoff[int64], opt], len intptr, flags flags[copy_file_range_flags])

rwf_flags = RWF_DSYNC, RWF_HIPRI, RWF_SYNC, RWF_NOWAIT, RWF_APPEND
copy_file_range_flags = 0

dup(oldfd fd) fd
dup2(oldfd fd, newfd fd) fd
dup3(oldfd fd, newfd fd, flags flags[dup_flags]) fd

pipe(pipefd ptr[out, pipefd])
pipe2(pipefd ptr[out, pipefd], flags flags[pipe_flags])

tee(fdin fd, fdout fd, len intptr, f flags[splice_flags])
splice(fdin fd, offin ptr[in, fileoff[int64]], fdout fd, offout ptr[in, fileoff[int64]], len intptr, f flags[splice_flags])
vmsplice(fd fd, vec ptr[in, array[iovec_in]], vlen len[vec], f flags[splice_flags])
sendfile(fdout fd, fdin fd, off ptr[inout, fileoff[intptr], opt], count intptr)
sendfile64(fdout fd, fdin fd, off ptr[inout, fileoff[int64], opt], count intptr)

cachestat_range {
	off	fileoff[int64]
	len	int64
}

cachestat {
	nr_cache		int64
	nr_dirty		int64
	nr_writeback		int64
	nr_evicted		int64
	nr_recently_evicted	int64
}

stat(file ptr[in, filename], statbuf ptr[out, stat])
lstat(file ptr[in, filename], statbuf ptr[out, stat])
fstat(fd fd, statbuf ptr[out, stat])
newfstatat(dfd const[AT_FDCWD], file ptr[in, filename], statbuf ptr[out, stat], flag flags[statx_flags])
stat64(file ptr[in, filename], statbuf ptr[out, stat64])
lstat64(file ptr[in, filename], statbuf ptr[out, stat64])
fstat64(fd fd, statbuf ptr[out, stat64])
fstatat64(dfd const[AT_FDCWD], file ptr[in, filename], statbuf ptr[out, stat64], flag flags[statx_flags])
statx(fd fd_dir, file ptr[in, filename], flags flags[statx_flags], mask flags[statx_mask], statxbuf ptr[out, statx])
cachestat(fd fd, cstat_range ptr[in, cachestat_range], cstat ptr[out, cachestat], flags const[0])

poll(fds ptr[in, array[pollfd]], nfds len[fds], timeout int32)
ppoll(fds ptr[in, array[pollfd]], nfds len[fds], tsp ptr[in, timespec], sigmask ptr[in, sigset_t], size len[sigmask])
select(n len[inp], inp ptr[inout, fd_set], outp ptr[inout, fd_set], exp ptr[inout, fd_set], tvp ptr[inout, timeval])
pselect6(n len[inp], inp ptr[inout, fd_set], outp ptr[inout, fd_set], exp ptr[inout, fd_set], tvp ptr[inout, timespec], sig ptr[in, sigset_size])

resource fd_epoll[fd]
epoll_create(size int32) fd_epoll
epoll_create1(flags flags[epoll_flags]) fd_epoll
epoll_ctl$EPOLL_CTL_ADD(epfd fd_epoll, op const[EPOLL_CTL_ADD], fd fd, ev ptr[in, epoll_event])
epoll_ctl$EPOLL_CTL_MOD(epfd fd_epoll, op const[EPOLL_CTL_MOD], fd fd, ev ptr[in, epoll_event])
epoll_ctl$EPOLL_CTL_DEL(epfd fd_epoll, op const[EPOLL_CTL_DEL], fd fd)
epoll_wait(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout int32)
epoll_pwait(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout int32, sigmask ptr[in, sigset_t], size bytesize[sigmask])
epoll_pwait2(epfd fd_epoll, events ptr[out, array[epoll_event]], maxevents len[events], timeout ptr[in, timespec], sigmask ptr[in, sigset_t], size bytesize[sigmask])

resource fd_timer[fd]
signalfd(fd fd, mask ptr[in, sigset_t], size len[mask]) fd
signalfd4(fd fd, mask ptr[in, sigset_t], size len[mask], flags flags[signalfd_flags]) fd
timerfd_create(clockid flags[clock_type], flags flags[timerfd_create_flags]) fd_timer
timerfd_settime(fd fd_timer, flags flags[timerfd_settime_flags], new ptr[in, itimerspec], old ptr[out, itimerspec])
timerfd_gettime(fd fd_timer, cur ptr[out, itimerspec])
ioctl$TFD_IOC_SET_TICKS(fd fd_timer, cmd const[TFD_IOC_SET_TICKS], arg ptr[in, int64])

resource fd_event[fd]
eventfd(initval int32) fd_event
eventfd2(initval int32, flags flags[eventfd_flags]) fd_event
read$eventfd(fd fd_event, val ptr[out, int64], len len[val])
write$eventfd(fd fd_event, val ptr[in, int64], len len[val])

brk(brk intptr)
mmap(addr vma, len len[addr], prot flags[mmap_prot], flags flags[mmap_flags], fd fd, offset intptr[0:0xffffffff, 0x1000])
munmap(addr vma, len len[addr])
mremap(addr vma, len len[addr], newlen len[newaddr], flags flags[mremap_flags], newaddr vma)
remap_file_pages(addr vma, size len[addr], prot flags[mmap_prot], pgoff intptr, flags flags[mmap_flags])
mprotect(addr vma, len len[addr], prot flags[mmap_prot])
msync(addr vma, len len[addr], f flags[msync_flags])
madvise(addr vma, len len[addr], advice flags[madvise_flags])
process_madvise(pidfd fd_pidfd, vec ptr[in, array[iovec_in]], vlen len[vec], advice flags[madvise_flags], flags const[0])
process_mrelease(pidfd fd_pidfd, flags const[0])
fadvise64(fd fd, offset fileoff, len intptr, advice flags[fadvise_flags])
readahead(fd fd, off intptr, count intptr)
mbind(addr vma, len len[addr], mode flags[mbind_mode], nodemask ptr[in, int64], maxnode intptr, flags flags[mbind_flags])
move_pages(pid pid, nr len[pages], pages ptr[in, array[vma]], nodes ptr[in, array[int32], opt], status ptr[out, array[int32]], flags flags[move_pages_flags])
migrate_pages(pid pid, maxnode intptr, old ptr[in, int64], new ptr[in, int64])
set_mempolicy(mode flags[mbind_mode], nodemask ptr[in, int64], maxnode intptr)
get_mempolicy(mode ptr[out, int32], nodemask ptr[out, int64], maxnode intptr, addr vma, flags flags[mempolicy_flags])
set_mempolicy_home_node(addr vma, len len[addr], home_node intptr[0:3], flags const[0])
mincore(addr vma, size len[addr], vec buffer[out])
mlock(addr vma, size len[addr])
mlock2(addr vma, size len[addr], flags flags[mlock_flags])
munlock(addr vma, size len[addr])
mlockall(flags flags[mlockall_flags])
munlockall()
kcmp(pid1 pid, pid2 pid, type flags[kcmp_flags], fd1 fd, fd2 fd)
kcmp$KCMP_EPOLL_TFD(pid1 pid, pid2 pid, type const[KCMP_EPOLL_TFD], fd1 fd, idx2 ptr[in, kcmp_epoll_slot])

resource fd_memfd[fd]
memfd_create(name ptr[in, string], flags flags[memfd_flags]) fd_memfd
memfd_flags = MFD_CLOEXEC, MFD_ALLOW_SEALING, MFD_HUGETLB
_ = MFD_HUGE_SHIFT, MFD_HUGE_MASK, MFD_HUGE_64KB, MFD_HUGE_512KB, MFD_HUGE_1MB, MFD_HUGE_2MB, MFD_HUGE_8MB, MFD_HUGE_16MB

memfd_secret(flags flags[memfd_secret_flags]) fd
memfd_secret_flags = O_CLOEXEC

resource pkey[int32]: -1
pkey_alloc(flags const[0], val flags[pkey_flags]) pkey
pkey_free(key pkey)
pkey_mprotect(addr vma, len len[addr], prot flags[mmap_prot], key pkey)
syz_pkey_set(key pkey, val flags[pkey_flags])

pkey_flags = PKEY_DISABLE_ACCESS, PKEY_DISABLE_WRITE

restart_syscall()

# Almighty!
ioctl(fd fd, cmd int32, arg buffer[in])

ioctl$int_in(fd fd, cmd flags[ioctl_int_in], v ptr[in, int64])
ioctl$int_out(fd fd, cmd flags[ioctl_int_out], v ptr[out, intptr])

ioctl$FIOCLEX(fd fd, cmd const[FIOCLEX])
ioctl$FIONCLEX(fd fd, cmd const[FIONCLEX])
ioctl$FITHAW(fd fd, cmd const[FITHAW])

# FIFREEZE is enabled in sandbox mode only because it can easily kill the machine.
ioctl$FIFREEZE(fd fd, cmd const[FIFREEZE]) (snapshot)

fcntl$dupfd(fd fd, cmd flags[fcntl_dupfd], arg fd) fd
fcntl$getflags(fd fd, cmd flags[fcntl_getflags])
fcntl$setflags(fd fd, cmd const[F_SETFD], flags flags[fcntl_flags])
fcntl$setstatus(fd fd, cmd const[F_SETFL], flags flags[fcntl_status])
fcntl$lock(fd fd, cmd flags[fcntl_lock], lock ptr[in, flock])
fcntl$getown(fd fd, cmd const[F_GETOWN]) pid (automatic_helper)
fcntl$setown(fd fd, cmd const[F_SETOWN], pid pid)
fcntl$getownex(fd fd, cmd const[F_GETOWN_EX], arg ptr[out, f_owner_ex])
fcntl$setownex(fd fd, cmd const[F_SETOWN_EX], arg ptr[in, f_owner_ex])
fcntl$setsig(fd fd, cmd const[F_SETSIG], sig signalnoptr)
fcntl$setlease(fd fd, cmd const[F_SETLEASE], typ flags[flock_type])
fcntl$notify(fd fd, cmd const[F_NOTIFY], typ flags[fcntl_notify])
fcntl$setpipe(fd fd, cmd const[F_SETPIPE_SZ], sz intptr)
fcntl$addseals(fd fd, cmd const[F_ADD_SEALS], seals flags[seal_types])
fcntl$F_GET_RW_HINT(fd fd, cmd const[F_GET_RW_HINT], hint ptr[out, int64])
fcntl$F_GET_FILE_RW_HINT(fd fd, cmd const[F_GET_FILE_RW_HINT], hint ptr[out, int64])
fcntl$F_SET_RW_HINT(fd fd, cmd const[F_SET_RW_HINT], hint ptr[in, flags[fcntl_rw_hint, int64]])
fcntl$F_SET_FILE_RW_HINT(fd fd, cmd const[F_SET_FILE_RW_HINT], hint ptr[in, flags[fcntl_rw_hint, int64]])

# Only some commands break return values.
# When/if we have stricter enforcement of arguments, we may remove some of breaks_returns attributes.
ptrace(req flags[ptrace_req], pid pid) (breaks_returns)
ptrace$peek(req flags[ptrace_req_peek], pid pid, addr ptr[out, intptr]) (breaks_returns)
ptrace$poke(req flags[ptrace_req_poke], pid pid, addr ptr[out, intptr], data intptr) (breaks_returns)
ptrace$peekuser(req const[PTRACE_PEEKUSR], pid pid, addr intptr) (breaks_returns)
ptrace$pokeuser(req const[PTRACE_POKEUSR], pid pid, addr intptr, data intptr) (breaks_returns)
ptrace$getregs(req flags[ptrace_req_getregs], pid pid, ignored intptr, data buffer[out]) (breaks_returns)
ptrace$getregset(req const[PTRACE_GETREGSET], pid pid, what flags[pthread_regset], data ptr[in, iovec_out]) (breaks_returns)
ptrace$setregs(req flags[ptrace_req_setregs], pid pid, ignored intptr, data buffer[in]) (breaks_returns)
ptrace$setregset(req const[PTRACE_SETREGSET], pid pid, what flags[pthread_regset], data ptr[in, iovec_in]) (breaks_returns)
ptrace$getsig(req const[PTRACE_GETSIGINFO], pid pid, ignored intptr, data ptr[out, siginfo]) (breaks_returns)
ptrace$setsig(req const[PTRACE_SETSIGINFO], pid pid, ignored intptr, data ptr[in, siginfo]) (breaks_returns)
ptrace$setopts(req flags[ptrace_req_setopts], pid pid, ignored intptr, flags flags[ptrace_options]) (breaks_returns)
ptrace$getenv(req const[PTRACE_GETEVENTMSG], pid pid, ignored intptr, data ptr[out, intptr]) (breaks_returns)
ptrace$cont(req flags[ptrace_req_cont], pid pid, ignored intptr, data intptr) (breaks_returns)
ptrace$PTRACE_SECCOMP_GET_FILTER(req const[PTRACE_SECCOMP_GET_FILTER], pid pid, addr intptr, data ptr[out, array[int8]]) (breaks_returns)
ptrace$PTRACE_SECCOMP_GET_METADATA(req const[PTRACE_SECCOMP_GET_METADATA], pid pid, addr len[data], data ptr[in, seccomp_metadata]) (breaks_returns)
ptrace$PTRACE_SETSIGMASK(req const[PTRACE_SETSIGMASK], pid pid, size bytesize[data], data ptr[in, sigset_t]) (breaks_returns)
ptrace$PTRACE_GETSIGMASK(req const[PTRACE_GETSIGMASK], pid pid, size bytesize[data], data ptr[out, sigset_t]) (breaks_returns)
ptrace$ARCH_GET_FS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_GET_FS]) (breaks_returns)
ptrace$ARCH_GET_GS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_GET_GS]) (breaks_returns)
ptrace$ARCH_SET_GS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], code const[ARCH_SET_GS]) (breaks_returns)
ptrace$ARCH_GET_CPUID(req const[PTRACE_ARCH_PRCTL], pid pid, arg const[0], code const[ARCH_GET_CPUID]) (breaks_returns)
ptrace$ARCH_SET_CPUID(req const[PTRACE_ARCH_PRCTL], pid pid, arg boolptr, code const[ARCH_SET_CPUID]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_X32(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_X32]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_32(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_32]) (breaks_returns)
ptrace$ARCH_MAP_VDSO_64(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr, code const[ARCH_MAP_VDSO_64]) (breaks_returns)
ptrace$ARCH_SHSTK_STATUS(req const[PTRACE_ARCH_PRCTL], pid pid, res ptr[out, intptr], cmd const[ARCH_SHSTK_STATUS]) (breaks_returns)
ptrace$ARCH_SHSTK_LOCK(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_LOCK]) (breaks_returns)
ptrace$ARCH_SHSTK_UNLOCK(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_UNLOCK]) (breaks_returns)
ptrace$ARCH_SHSTK_ENABLE(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_ENABLE]) (breaks_returns)
ptrace$ARCH_SHSTK_DISABLE(req const[PTRACE_ARCH_PRCTL], pid pid, features flags[shadow_stack_features], cmd const[ARCH_SHSTK_DISABLE]) (breaks_returns)
ptrace$ARCH_GET_UNTAG_MASK(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], cmd const[ARCH_GET_UNTAG_MASK]) (breaks_returns)
ptrace$ARCH_GET_MAX_TAG_BITS(req const[PTRACE_ARCH_PRCTL], pid pid, arg ptr[out, intptr], cmd const[ARCH_GET_MAX_TAG_BITS]) (breaks_returns)
ptrace$ARCH_ENABLE_TAGGED_ADDR(req const[PTRACE_ARCH_PRCTL], pid pid, arg intptr[1:6], cmd const[ARCH_ENABLE_TAGGED_ADDR]) (breaks_returns)
ptrace$ARCH_FORCE_TAGGED_SVA(req const[PTRACE_ARCH_PRCTL], pid pid, arg const[0], cmd const[ARCH_FORCE_TAGGED_SVA]) (breaks_returns)

map_shadow_stack(addr vma, size bytesize[addr], flags boolptr)

seccomp_metadata {
	filter_off	int64
	flags		const[0, int64]
}

ptrace_peeksiginfo_args {
	off	int64
	flags	flags[ptrace_peeksiginfo_flags, int32]
	nr	len[syscall:data, int32]
}

ptrace$peeksig(req const[PTRACE_PEEKSIGINFO], pid pid, args ptr[in, ptrace_peeksiginfo_args], data ptr[out, array[siginfo]])

capget(hdr ptr[in, cap_header], data ptr[in, cap_data])
capset(hdr ptr[in, cap_header], data ptr[in, cap_data])

resource fd_mq[fd]
mq_open(name ptr[in, string], flags flags[mq_open_flags], mode flags[open_mode], attr ptr[in, mq_attr]) fd_mq
mq_timedsend(mqd fd_mq, msg buffer[in], msglen len[msg], prio intptr, timeout ptr[in, timespec, opt])
mq_timedreceive(mqd fd_mq, msg buffer[out], msglen len[msg], prio intptr, timeout ptr[in, timespec, opt])
mq_notify(mqd fd_mq, notif ptr[in, sigevent])
mq_getsetattr(mqd fd_mq, attr ptr[in, mq_attr], oldattr ptr[out, mq_attr, opt])
mq_unlink(name ptr[in, string])

mknod(file ptr[in, filename], mode flags[mknod_mode], dev int32)
mknod$loop(file ptr[in, filename], mode flags[mknod_mode], dev proc[1792, 2])
mknodat$loop(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev proc[1792, 2])
mknodat$null(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev const[0x103])
mknodat(dirfd fd_dir, file ptr[in, filename], mode flags[mknod_mode], dev int32)
chmod(file ptr[in, filename], mode flags[open_mode])
fchmod(fd fd, mode flags[open_mode])
fchmodat(dirfd fd_dir, file ptr[in, filename], mode flags[open_mode])
chown(file ptr[in, filename], uid uid, gid gid)
lchown(file ptr[in, filename], uid uid, gid gid)
fchown(fd fd, uid uid, gid gid)
fchownat(dirfd fd_dir, file ptr[in, filename], uid uid, gid gid, flags flags[at_flags])
fallocate(fd fd, mode flags[fallocate_mode], off intptr, len intptr)
faccessat(dirfd fd_dir, pathname ptr[in, filename], mode flags[open_mode])
faccessat2(dirfd fd_dir, pathname ptr[in, filename], mode flags[open_mode], flags flags[faccessat_flags])
utime(filename ptr[in, filename], times ptr[in, utimbuf])
utimes(filename ptr[in, filename], times ptr[in, itimerval])
futimesat(dir fd_dir, pathname ptr[in, filename], times ptr[in, itimerval])
utimensat(dir fd_dir, pathname ptr[in, filename], times ptr[in, itimerval], flags flags[utimensat_flags])

# Small trick - syzkaller cannot give the proper stack pointer to clone(), but we can do it with the aid of pseudo syscalls.
syz_clone(flags flags[clone_flags], stack buffer[in], stack_len bytesize[stack], parentid ptr[out, int32], childtid ptr[out, int32], tls buffer[in]) pid (automatic_helper)

syz_clone3(args ptr[in, clone_args], size bytesize[args]) pid (automatic_helper)

# We need these disabled definitions to simplify the presence and the NR checking.
clone(flags flags[clone_flags], sp buffer[in], parentid ptr[out, int32], childtid ptr[out, int32], tls buffer[in]) (breaks_returns, disabled)
clone3(args ptr[in, clone_args], size bytesize[args]) pid (breaks_returns, disabled)

clone_args {
	flags		flags[clone3_flags, int64]
	pidfd		ptr64[out, fd_pidfd]
	child_tid	ptr64[out, pid]
	parent_tid	ptr64[out, pid]
	exit_signal	align64[signalno]
	stack		ptr64[out, array[int8]]
	stack_size	bytesize[stack, int64]
	tls		ptr64[out, array[int8]]
	set_tid		ptr64[in, array[pid]]
	set_tid_size	len[set_tid, int64]
	cgroup		align64[fd_cgroup]
}

resource pid[int32]: 0, -1
resource uid[int32]: 0, -1, 0xee00, 0xee01
resource gid[int32]: 0, -1, 0xee00, 0xee01

getgid() gid (automatic_helper)
getegid() gid (automatic_helper)
setuid(uid uid)
setgid(gid gid)
getuid() uid (automatic_helper)
geteuid() uid (automatic_helper)
setpgid(pid pid, pgid pid)
getpgid(pid pid) pid (automatic_helper)
getpgrp(pid pid) pid (automatic_helper)
getpid() pid (automatic_helper)
gettid() pid (automatic_helper)
setreuid(ruid uid, euid uid)
setregid(rgid gid, egid gid)
setresuid(ruid uid, euid uid, suid uid)
setresgid(rgid gid, egid gid, sgid gid)
getresuid(ruid ptr[out, uid], euid ptr[out, uid], suid ptr[out, uid])
getresgid(rgid ptr[out, gid], egid ptr[out, gid], sgid ptr[out, gid])
setfsuid(fsuid uid)
setfsgid(fsgid gid)
getgroups(size len[list], list ptr[inout, array[gid]])
setgroups(size len[list], list ptr[in, array[gid]])
personality(persona flags[personality_flags])
# Don't mess with parent (fuzzer). If we ptrace attach to it, it will hang.
# If we setrlimit for parent, it will misbehave. Killing - the same. Nothing good.
#getppid() pid
#getsid(pid pid) pid
#setsid() pid

link(old ptr[in, filename], new ptr[in, filename])
linkat(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename], flags flags[linkat_flags])
symlinkat(old ptr[in, filename], newfd fd_dir, new ptr[in, filename])
symlink(old ptr[in, filename], new ptr[in, filename])
unlink(path ptr[in, filename])
unlinkat(fd fd_dir, path ptr[in, filename], flags flags[unlinkat_flags])
readlink(path ptr[in, filename], buf buffer[out], siz len[buf])
readlinkat(fd fd_dir, path ptr[in, filename], buf buffer[out], siz len[buf])
rename(old ptr[in, filename], new ptr[in, filename])
renameat(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename])
renameat2(oldfd fd_dir, old ptr[in, filename], newfd fd_dir, new ptr[in, filename], flags flags[renameat2_flags])
mkdir(path ptr[in, filename], mode flags[open_mode])
mkdirat(fd fd_dir[opt], path ptr[in, filename], mode flags[open_mode])
rmdir(path ptr[in, filename])
truncate(file ptr[in, filename], len intptr)
ftruncate(fd fd, len intptr)
flock(fd fd, op flags[flock_op])
fsync(fd fd)
fdatasync(fd fd)
sync()
syncfs(fd fd)
sync_file_range(fd fd, off intptr, nbytes intptr, flags flags[sync_file_flags])
lookup_dcookie(cookie intptr, buf buffer[out], len len[buf])
getdents(fd fd_dir, ent buffer[out], count len[ent])
getdents64(fd fd_dir, ent buffer[out], count len[ent])
name_to_handle_at(fd fd_dir, file ptr[in, filename], handle ptr[in, file_handle], mnt ptr[out, int32], flags flags[name_to_handle_at_flags])
open_by_handle_at(mountdirfd fd, handle ptr[in, file_handle], flags flags[open_flags])
chroot(dir ptr[in, filename])
getcwd(buf buffer[out], size len[buf])
chdir(dir ptr[in, filename])
fchdir(fd fd)
pivot_root(new_root ptr[in, filename], put_old ptr[in, filename])

sysfs$1(option const[1], fsname ptr[in, string])
sysfs$2(option const[2], fsindex intptr, fsname buffer[out])
sysfs$3(option const[3])
statfs(path ptr[in, filename], buf buffer[out])
fstatfs(fd fd, buf buffer[out])

uselib(lib ptr_binfmt_file)
init_module(mod ptr[in, binfmt_elf64], len len[mod], args ptr[in, string])
finit_module(fd fd_binfmt, args ptr[in, string], flags flags[finit_module_flags])
delete_module(name ptr[in, string], flags flags[delete_module_flags])
kexec_load(entry intptr, nr_segments len[segments], segments ptr[in, array[kexec_segment]], flags flags[kexec_load_flags])
syslog(cmd flags[syslog_cmd], buf ptr[out, array[int8], opt], len len[buf])
uname(buf buffer[out])
sysinfo(info buffer[out])
ustat(dev intptr, buf ptr[out, ustat])
acct(filename ptr[in, filename, opt])

getrusage(who flags[rusage_who], usage ptr[out, rusage])
getrlimit(res flags[rlimit_type], rlim ptr[out, rlimit])
setrlimit(res flags[rlimit_type], rlim ptr[in, rlimit])
prlimit64(pid pid, res flags[rlimit_type], new ptr[in, rlimit, opt], old ptr[out, rlimit, opt])

iopl(level int8)
ioperm(from intptr, num intptr, on intptr)
ioprio_get$pid(which flags[ioprio_which_pid], who pid)
ioprio_get$uid(which flags[ioprio_which_uid], who uid)
ioprio_set$pid(which flags[ioprio_which_pid], who pid, ioprio flags[ioprio_priorities])
ioprio_set$uid(which flags[ioprio_which_uid], who uid, ioprio flags[ioprio_priorities])

# NEED: we can express the construction of integers using structs with flags
# and bitfields, which are normally obtained using a combination of bitwise
# operations with the help of macros. However, structs can't be directly passed
# as a syscall argument; therefore, such constructions can't be directly passed either.
# One example is ioprio argument for ioprio_set, where we could have expressed the
# construction less messy. For now, some subset of valid values are enumerated as
# in ioprio_priorities.

# ioprio priority values are obtained using IOPRIO_PRIO_VALUE(class, data) macro.
# the behaviour of the macro is mimicked below and some priority values are enumerated.
ioprio_priorities = IOPRIO_CLASS_NONE_PRIO, IOPRIO_CLASS_IDLE_PRIO, IOPRIO_CLASS_RT_HIGH_PRIO, IOPRIO_CLASS_BE_HIGH_PRIO, IOPRIO_CLASS_RT_MID_PRIO, IOPRIO_CLASS_BE_MID_PRIO, IOPRIO_CLASS_RT_LOW_PRIO, IOPRIO_CLASS_BE_LOW_PRIO

# The classes RT and BE take data values from the range [0:7]. Use a subset of the available
# values (0, 4, 7) to ease collisions, and to avoid redundancy. The classes NONE and IDLE
# have only one valid priority value each with data set to 0.
define IOPRIO_CLASS_NONE_PRIO	(IOPRIO_CLASS_NONE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_IDLE_PRIO	(IOPRIO_CLASS_IDLE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_RT_HIGH_PRIO	(IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_BE_HIGH_PRIO	(IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT)
define IOPRIO_CLASS_RT_MID_PRIO	((IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT) + 4)
define IOPRIO_CLASS_BE_MID_PRIO	((IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT) + 4)
define IOPRIO_CLASS_RT_LOW_PRIO	((IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT) + 7)
define IOPRIO_CLASS_BE_LOW_PRIO	((IOPRIO_CLASS_BE << IOPRIO_CLASS_SHIFT) + 7)

resource timerid[int32]
timer_create(id flags[clock_id], ev ptr[in, sigevent], timerid ptr[out, timerid])
timer_gettime(timerid timerid, setting ptr[out, itimerspec])
timer_getoverrun(timerid timerid)
timer_settime(timerid timerid, flags flags[timer_flags], new ptr[in, itimerspec], old ptr[out, itimerspec, opt])
timer_delete(timerid timerid)

time(t ptr[out, intptr])
clock_gettime(id flags[clock_id], tp ptr[out, timespec])
clock_settime(id flags[clock_id], tp ptr[in, timespec])
clock_adjtime(id flags[clock_id], tx ptr[in, timex])
clock_getres(id flags[clock_id], tp ptr[out, timespec])
clock_nanosleep(id flags[clock_id], flags flags[timer_flags], rqtp ptr[in, timespec], rmtp ptr[out, timespec, opt])
rt_sigaction(sig signalno, act ptr[in, sigaction], oact ptr[out, sigaction, opt], sigsetsize len[fake], fake ptr[out, sigset_t])
rt_sigprocmask(how flags[sigprocmask_how], nset ptr[in, sigset_t], oset ptr[out, sigset_t, opt], sigsetsize len[nset])
rt_sigreturn()
rt_sigpending(set ptr[out, sigset_t], sigsetsize len[set])
rt_sigtimedwait(these ptr[in, sigset_t], info ptr[out, siginfo, opt], ts ptr[in, timespec], sigsetsize len[these])
rt_sigsuspend(new ptr[in, sigset_t], sigsetsize len[new])
rt_sigqueueinfo(pid pid, sig signalno, info ptr[in, siginfo])
rt_tgsigqueueinfo(gid pid, tid pid, sig signalno, info ptr[in, siginfo])
sigaltstack(ss ptr[in, sigaltstack], oss ptr[out, sigaltstack, opt])
tgkill(gid pid, tid pid, sig signalno)
tkill(tid pid, sig signalno)
pause()
alarm(seconds intptr)
nanosleep(req ptr[in, timespec], rem ptr[out, timespec, opt])
getitimer(which flags[getitimer_which], cur ptr[out, itimerval])
setitimer(which flags[getitimer_which], new ptr[in, itimerval], old ptr[out, itimerval, opt])
exit(code intptr)
exit_group(code intptr)
waitid(which flags[waitid_which], pid pid, infop ptr[out, siginfo, opt], options flags[wait_options], ru ptr[out, rusage, opt])
waitid$P_PIDFD(which const[P_PIDFD], pidfd fd_pidfd, infop ptr[out, siginfo, opt], options flags[wait_options], ru ptr[out, rusage, opt])
wait4(pid pid, status ptr[out, int32, opt], options flags[wait_options], ru ptr[out, rusage, opt])
times(buf ptr[out, tms])
# Can send signals to all processes (pid=-1) so it's enabled only in snapshot mode.
kill(pid pid, sig signalno) (snapshot)

set_thread_area(info ptr[in, user_desc])
get_thread_area(info ptr[in, user_desc])
modify_ldt$read(func const[0], buf buffer[out], len len[buf])
modify_ldt$write(func const[1], buf ptr[in, user_desc], len len[buf])
modify_ldt$read_default(func const[2], buf buffer[out], len len[buf])
modify_ldt$write2(func const[17], buf ptr[in, user_desc], len len[buf])
process_vm_readv(pid pid, loc_vec ptr[in, array[iovec_out]], loc_vlen len[loc_vec], rem_vec ptr[in, array[iovec_out]], rem_vlen len[rem_vec], flags const[0])
process_vm_writev(pid pid, loc_vec ptr[in, array[iovec_out]], loc_vlen len[loc_vec], rem_vec ptr[in, array[iovec_out]], rem_vlen len[rem_vec], flags const[0])
set_tid_address(tidptr ptr[out, int32])
getpriority(which flags[priority_which], who pid)
setpriority(which flags[priority_which], who pid, prio intptr)
sched_getscheduler(pid pid)
sched_setscheduler(pid pid, policy flags[sched_policy], prio ptr[in, int32])
sched_rr_get_interval(pid pid, tp ptr[out, timespec])
sched_getparam(pid pid, prio ptr[out, int32])
sched_setparam(pid pid, prio ptr[in, int32])
sched_getaffinity(pid pid, cpusetsize len[mask], mask ptr[out, int64])
sched_setaffinity(pid pid, cpusetsize len[mask], mask ptr[in, int64])
sched_getattr(pid pid, attr ptr[out, sched_attr], size len[attr], flags const[0])
sched_setattr(pid pid, attr ptr[in, sched_attr], flags const[0])
sched_yield()
getrandom(buf buffer[out], len len[buf], flags flags[getrandom_flags])

reboot(magic1 const[LINUX_REBOOT_MAGIC1], magic2 const[LINUX_REBOOT_MAGIC2], cmd flags[reboot_commands], arg const[0]) (snapshot)

reboot_commands = LINUX_REBOOT_CMD_RESTART, LINUX_REBOOT_CMD_HALT, LINUX_REBOOT_CMD_CAD_ON, LINUX_REBOOT_CMD_CAD_OFF, LINUX_REBOOT_CMD_POWER_OFF, LINUX_REBOOT_CMD_RESTART2, LINUX_REBOOT_CMD_SW_SUSPEND, LINUX_REBOOT_CMD_KEXEC

swapon(specialfile ptr[in, filename], swap_flags flags[swap_flags]) (snapshot)
swapoff(specialfile ptr[in, filename]) (snapshot)

swap_flags = SWAP_FLAG_PRIO_MASK, SWAP_FLAG_PREFER, SWAP_FLAG_DISCARD, SWAP_FLAG_DISCARD_ONCE, SWAP_FLAG_DISCARD_PAGES

sethostname(name ptr[in, array[int8]], len bytesize[name]) (snapshot)
setdomainname(name ptr[in, array[int8]], len bytesize[name]) (snapshot)

gettimeofday(tv ptr[out, timeval], tz ptr[out, timezone])
settimeofday(tv ptr[out, timeval], tz ptr[out, timezone]) (snapshot)
adjtimex(txc_p ptr[in, __kernel_timex]) (snapshot)

timezone {
	tz_minuteswest	int32
	tz_dsttime	int32
}

__kernel_timex {
	modes		flags[adjtimex_modes, int32]
	pad0		const[0, int32]
	offset		int64
	freq		int64
	maxerror	int64
	esterror	int64
	status		int32
	pad1		const[0, int32]
	constant	int64
	precision	int64
	tolerance	int64
	int		timeval
	tick		int64
	ppsfreq		int64
	jitter		int64
	shift		int32
	pad2		const[0, int32]
	stabil		int64
	jitcnt		int64
	calcnt		int64
	errcnt		int64
	stbcnt		int64
	tai		int32
	pad3		array[const[0, int32], 11]
}

adjtimex_modes = ADJ_OFFSET, ADJ_FREQUENCY, ADJ_MAXERROR, ADJ_ESTERROR, ADJ_STATUS, ADJ_TIMECONST, ADJ_TAI, ADJ_SETOFFSET, ADJ_MICRO, ADJ_NANO, ADJ_TICK

membarrier(cmd flags[membarrier_cmd], flags const[0])

membarrier_cmd = MEMBARRIER_CMD_GLOBAL, MEMBARRIER_CMD_GLOBAL_EXPEDITED, MEMBARRIER_CMD_PRIVATE_EXPEDITED, MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED, MEMBARRIER_CMD_PRIVATE_EXPEDITED_SYNC_CORE, MEMBARRIER_CMD_REGISTER_PRIVATE_EXPEDITED_SYNC_CORE, MEMBARRIER_CMD_QUERY, MEMBARRIER_CMD_REGISTER_GLOBAL_EXPEDITED, MEMBARRIER_CMD_SHARED

rseq(rseq ptr[in, rseq], rseq_len bytesize[rseq], flags boolptr, sig const[0])

rseq {
	cpu_id_start	const[0, int32]
	cpu_id		const[0, int32]
	rseq_cs		ptr64[in, rseq_cs, opt]
	flags		flags[rseq_cs_flags, int32]
} [align[32]]

rseq_cs {
	version			const[0, int32]
	flags			flags[rseq_cs_flags, int32]
	start_ip		int64
	post_commit_offset	int64
	abort_ip		int64
} [align[32]]

rseq_cs_flags = RSEQ_CS_FLAG_NO_RESTART_ON_PREEMPT, RSEQ_CS_FLAG_NO_RESTART_ON_SIGNAL, RSEQ_CS_FLAG_NO_RESTART_ON_MIGRATE

# start/end are unused for now, no definition of SYS_RISCV_FLUSH_ICACHE_LOCAL in uapi headers.
riscv_flush_icache(start const[0], end const[0], flags bool32)

syz_open_procfs(pid pid, file ptr[in, string[procfs_proc_file]]) fd

# TODO: some of net files are only available in the init namespace (e.g. bluetooth bnep and hci).
# We could find some way to open these files in the init namespace
# esp. taking into account that we create bluetooth sockets in init namespace.
procfs_proc_file = "auxv", "cmdline", "environ", "autogroup", "cgroup", "clear_refs", "comm", "coredump_filter", "cpuset", "gid_map", "io", "limits", "loginuid", "maps", "mountinfo", "mounts", "mountstats", "numa_maps", "oom_adj", "oom_score", "oom_score_adj", "pagemap", "personality", "projid_map", "sched", "schedstat", "sessionid", "setgroups", "smaps", "smaps_rollup", "totmaps", "stack", "stat", "statm", "status", "syscall", "timers", "uid_map", "wchan", "map_files", "attr", "attr/current", "attr/exec", "attr/fscreate", "attr/keycreate", "attr/prev", "attr/sockcreate", "ns", "children", "task", "fd", "fd/3", "fd/4", "fdinfo", "fdinfo/3", "fdinfo/4", "net", "net/anycast6", "net/arp", "net/bnep", "net/connector", "net/dev", "net/dev_mcast", "net/dev_snmp6", "net/fib_trie", "net/fib_triestat", "net/hci", "net/icmp", "net/icmp6", "net/if_inet6", "net/igmp", "net/igmp6", "net/ip6_flowlabel", "net/ip6_mr_cache", "net/ip6_mr_vif", "net/ip6_tables_matches", "net/ip6_tables_names", "net/ip6_tables_targets", "net/ip_mr_cache", "net/ip_mr_vif", "net/ip_tables_matches", "net/ip_tables_names", "net/ip_tables_targets", "net/ipv6_route", "net/l2cap", "net/llc/core", "net/llc/socket", "net/mcfilter", "net/mcfilter6", "net/netfilter", "net/netlink", "net/netstat", "net/nfsfs", "net/packet", "net/protocols", "net/psched", "net/ptype", "net/raw", "net/raw6", "net/rfcomm", "net/route", "net/rpc", "net/rt6_stats", "net/rt_acct", "net/rt_cache", "net/sco", "net/sctp", "net/snmp", "net/snmp6", "net/sockstat", "net/sockstat6", "net/softnet_stat", "net/stat", "net/tcp", "net/tcp6", "net/udp", "net/udp6", "net/udplite", "net/udplite6", "net/unix", "net/wireless", "net/xfrm_stat", "net/ip_vs", "net/ip_vs_stats", "net/ip_vs_stats_percpu", "net/nf_conntrack", "net/nf_conntrack_expect", "net/vlan/config", "net/vlan/vlan0", "net/vlan/vlan1", "net/kcm", "net/psched", "timerslack_ns"

openat$procfs(fd const[AT_FDCWD], file ptr[in, string[procfs_file]], flags const[O_RDONLY], mode const[0]) fd

procfs_file = "/proc/keys", "/proc/key-users", "/proc/crypto", "/proc/consoles", "/proc/cgroups", "/proc/zoneinfo", "/proc/vmstat", "/proc/vmallocinfo", "/proc/tty/drivers", "/proc/tty/ldiscs", "/proc/timer_list", "/proc/sysvipc/sem", "/proc/sysvipc/msg", "/proc/sysvipc/shm", "/proc/stat", "/proc/slabinfo", "/proc/schedstat", "/proc/partitions", "/proc/meminfo", "/proc/mdstat", "/proc/locks", "/proc/diskstats", "/proc/cpuinfo", "/proc/consoles", "/proc/bus/input/devices", "/proc/bus/input/handlers", "/proc/asound/seq/clients", "/proc/asound/seq/clients", "/proc/asound/seq/timer", "/proc/asound/timers"

resource fd_yama_ptrace_scope[fd]

# 0 - YAMA_SCOPE_DISABLED
# 1 - YAMA_SCOPE_RELATIONAL
# 2 - YAMA_SCOPE_CAPABILITY
# 3 - YAMA_SCOPE_NO_ATTACH
yama_modes = "0", "1", "2", "3"

openat$yama_ptrace_scope(fd const[AT_FDCWD], file ptr[in, string["/proc/sys/kernel/yama/ptrace_scope"]], flags const[O_RDWR], mode const[0]) fd_yama_ptrace_scope
write$yama_ptrace_scope(fd fd_yama_ptrace_scope, data ptr[in, string[yama_modes]], count len[data])

# Write into some interesting sysct's and sysfs/procfs files.
resource fd_sysctl[fd]

openat$sysctl(fd const[AT_FDCWD], file ptr[in, string[sysctl_file]], flags const[O_WRONLY], mode const[0]) fd_sysctl
write$sysctl(fd fd_sysctl, val ptr[in, string[sysctl_value]], len len[val])

sysctl_file = "/sys/kernel/mm/ksm/run", "/proc/sys/vm/compact_memory", "/proc/sys/vm/drop_caches", "/proc/sys/net/ipv4/tcp_timestamps", "/proc/sys/net/ipv4/tcp_sack", "/proc/sys/net/ipv4/tcp_dsack", "/proc/sys/net/ipv4/tcp_window_scaling", "/proc/sys/net/ipv4/tcp_syncookies", "/proc/sys/net/ipv4/tcp_recovery", "/proc/sys/net/ipv4/tcp_mtu_probing", "/proc/sys/net/ipv4/tcp_rfc1337", "/proc/self/clear_refs"
# Most of these values are suitable for all sysctl_file files.
sysctl_value = "0", "1", "2", "3", "4", "5", "6", "7"

# Write to this file triggers khugepaged scan.
# We don't want to write small values as we only want the explicitly triggered scan.
resource fd_khugepaged_scan[fd]

openat$khugepaged_scan(fd const[AT_FDCWD], file ptr[in, string["/sys/kernel/mm/transparent_hugepage/khugepaged/scan_sleep_millisecs"]], flags const[O_WRONLY], mode const[0]) fd_khugepaged_scan
write$khugepaged_scan(fd fd_khugepaged_scan, val ptr[in, string["1000000"]], len len[val])

resource fd_tcp_congestion[fd]

openat$tcp_congestion(fd const[AT_FDCWD], file ptr[in, string["/proc/sys/net/ipv4/tcp_congestion_control"]], flags const[O_WRONLY], mode const[0]) fd_tcp_congestion
write$tcp_congestion(fd fd_tcp_congestion, val ptr[in, string[tcp_congestion]], len len[val])

tcp_congestion = "reno", "bbr", "bic", "cdg", "cubic", "dctcp", "westwood", "highspeed", "hybla", "htcp", "vegas", "nv", "veno", "scalable", "lp", "yeah", "illinois"

resource fd_tcp_mem[fd]

openat$tcp_mem(fd const[AT_FDCWD], file ptr[in, string[tcp_mem_files]], flags const[O_WRONLY], mode const[0]) fd_tcp_mem
write$tcp_mem(fd fd_tcp_mem, val ptr[in, tcp_mem_values], len len[val])

tcp_mem_files = "/proc/sys/net/ipv4/tcp_rmem", "/proc/sys/net/ipv4/tcp_wmem"

tcp_mem_values {
	v0	fmt[oct, int64]
	sp0	const[' ', int8]
	v1	fmt[oct, int64]
	sp1	const[' ', int8]
	v2	fmt[oct, int64]
	z	const[0, int8]
} [packed]

# /proc/self/reclaim is ChromeOS-specific:
# https://chromium.googlesource.com/chromiumos/third_party/kernel/+/4c3ad28b9c913%5E%21/
resource fd_proc_reclaim[fd]

openat$proc_reclaim(fd const[AT_FDCWD], file ptr[in, string["/proc/self/reclaim"]], flags const[O_WRONLY], mode const[0]) fd_proc_reclaim
write$proc_reclaim(fd fd_proc_reclaim, val ptr[in, string[proc_reclaim_vals]], len len[val])

proc_reclaim_vals = "file", "anon", "all"

resource fd_pidfd[fd]

openat$pidfd(fd const[AT_FDCWD], file ptr[in, string["/proc/self"]], flags flags[open_flags], mode const[0]) fd_pidfd
openat$thread_pidfd(fd const[AT_FDCWD], file ptr[in, string["/proc/thread-self"]], flags flags[open_flags], mode const[0]) fd_pidfd
pidfd_send_signal(fd fd_pidfd, sig signalno, info ptr[in, siginfo], flags const[0])

# pidfd_open is dangerous, so we use syz_pidfd_open instead.
pidfd_open(pid pid, flags const[0]) fd_pidfd (disabled)
syz_pidfd_open(pid pid, flags const[0]) fd_pidfd
pidfd_getfd(pidfd fd_pidfd, fd fd, flags const[0]) fd

close_range(fd fd, max_fd fd, flags flags[close_range_flags])

# Uncomment on your own account.
#syz_open_dev$char(dev const[0xc], major intptr, minor intptr) fd
#syz_open_dev$block(dev const[0xb], major intptr, minor intptr) fd

# /dev/console known to cause problems on at least two different kernels.
# It can turn off all output or produce massive amounts of garbage on console.
# Disable it for now.
#syz_open_dev$console(dev ptr[in, string["/dev/console"]], id const[0], flags flags[open_flags]) fd

resource fd_autofs[fd]

# These devices are relatively safe (don't reboot and don't corrupt kernel memory).
# They need a more comprehensive support. But let at least open them for now,
# maybe fuzzer will be able to skrew them in a useful way.
# TODO: all these devices returning just fd need proper interface descriptions.
openat$vcs(fd const[AT_FDCWD], file ptr[in, string["/dev/vcs"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsn(dev ptr[in, string["/dev/vcs#"]], id intptr, flags flags[open_flags]) fd
openat$vcsa(fd const[AT_FDCWD], file ptr[in, string["/dev/vcsa"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsa(dev ptr[in, string["/dev/vcsa#"]], id intptr, flags flags[open_flags]) fd
openat$vcsu(fd const[AT_FDCWD], file ptr[in, string["/dev/vcsu"]], flags flags[open_flags], mode const[0]) fd
syz_open_dev$vcsu(dev ptr[in, string["/dev/vcsu#"]], id intptr, flags flags[open_flags]) fd
syz_open_dev$ircomm(dev ptr[in, string["/dev/ircomm#"]], id intptr, flags flags[open_flags]) fd
syz_open_dev$audion(dev ptr[in, string["/dev/audio#"]], id intptr, flags flags[open_flags]) fd

openat$null(fd const[AT_FDCWD], file ptr[in, string["/dev/null"]], flags flags[open_flags], mode const[0]) fd
openat$zero(fd const[AT_FDCWD], file ptr[in, string["/dev/zero"]], flags flags[open_flags], mode const[0]) fd
openat$full(fd const[AT_FDCWD], file ptr[in, string["/dev/full"]], flags flags[open_flags], mode const[0]) fd
openat$irnet(fd const[AT_FDCWD], file ptr[in, string["/dev/irnet"]], flags flags[open_flags], mode const[0]) fd
openat$hwrng(fd const[AT_FDCWD], file ptr[in, string["/dev/hwrng"]], flags flags[open_flags], mode const[0]) fd
openat$hpet(fd const[AT_FDCWD], file ptr[in, string["/dev/hpet"]], flags flags[open_flags], mode const[0]) fd
openat$autofs(fd const[AT_FDCWD], file ptr[in, string["/dev/autofs"]], flags flags[open_flags], mode const[0]) fd_autofs
openat$keychord(fd const[AT_FDCWD], file ptr[in, string["/dev/keychord"]], flags flags[open_flags], mode const[0]) fd
openat$zygote(fd const[AT_FDCWD], file ptr[in, string["/dev/socket/zygote"]], flags flags[open_flags], mode const[0]) fd
openat$pktcdvd(fd const[AT_FDCWD], file ptr[in, string["/dev/pktcdvd/control"]], flags flags[open_flags], mode const[0]) fd
openat$lightnvm(fd const[AT_FDCWD], file ptr[in, string["/dev/lightnvm/control"]], flags flags[open_flags], mode const[0]) fd
openat$xenevtchn(fd const[AT_FDCWD], file ptr[in, string["/dev/xen/evtchn"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_control(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm-control"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_monitor(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm-monitor"]], flags flags[open_flags], mode const[0]) fd
openat$dlm_plock(fd const[AT_FDCWD], file ptr[in, string["/dev/dlm_plock"]], flags flags[open_flags], mode const[0]) fd
openat$btrfs_control(fd const[AT_FDCWD], file ptr[in, string["/dev/btrfs-control"]], flags flags[open_flags], mode const[0]) fd
openat$ubi_ctrl(fd const[AT_FDCWD], file ptr[in, string["/dev/ubi_ctrl"]], flags flags[open_flags], mode const[0]) fd
openat$cachefiles(fd const[AT_FDCWD], file ptr[in, string["/dev/cachefiles"]], flags flags[open_flags], mode const[0]) fd
openat$ndctl0(fd const[AT_FDCWD], file ptr[in, string["/dev/ndctl0"]], flags flags[open_flags], mode const[0]) fd
openat$nmem0(fd const[AT_FDCWD], file ptr[in, string["/dev/nmem0"]], flags flags[open_flags], mode const[0]) fd
openat$nvram(fd const[AT_FDCWD], file ptr[in, string["/dev/nvram"]], flags flags[open_flags], mode const[0]) fd
openat$ocfs2_control(fd const[AT_FDCWD], file ptr[in, string["/dev/ocfs2_control"]], flags flags[open_flags], mode const[0]) fd
openat$nvme_fabrics(fd const[AT_FDCWD], file ptr[in, string["/dev/nvme-fabrics"]], flags flags[open_flags], mode const[0]) fd

pipefd {
	rfd	fd
	wfd	fd
}

type iovec[DIR, T] {
	addr	ptr[DIR, T]
	len	len[addr, intptr]
}
type iovec_in iovec[in, array[int8]]
type iovec_out iovec[out, array[int8]]
type iovec_inout iovec[inout, array[int8]]

stat {
	st_dev		intptr
	st_ino		intptr
	st_mode		int32
	st_nlink	int32
	st_uid		uid
	st_gid		gid
	st_rdev		intptr
	__pad1		const[0, intptr]
	st_size		intptr
	st_blksize	int32
	__pad2		const[0, int32]
	st_blocks	intptr
	st_atime	intptr
	st_atime_nsec	intptr
	st_mtime	intptr
	st_mtime_nsec	intptr
	st_ctime	intptr
	st_ctime_nsec	intptr
	__unused4	const[0, int32]
	__unused5	const[0, int32]
}

statx {
	mask		int32
	blksize		int32
	attributes	int64
	nlink		int32
	uid		uid
	gid		gid
	mode		int16
	__spare0	int16
	ino		int64
	size		int64
	blocks		int64
	__spare1	int64
	atime		statx_timestamp
	btime		statx_timestamp
	ctime		statx_timestamp
	mtime		statx_timestamp
	rdev_major	int32
	rdev_minor	int32
	dev_major	int32
	dev_minor	int32
	__spare2	array[int64, 14]
}

define STAT64_SIZE	sizeof(struct stat64)

type stat64 array[int8, STAT64_SIZE]

pollfd {
	fd	fd
	events	flags[pollfd_events, int16]
	revents	const[0, int16]
}

sigset_t {
	mask	array[intptr, _NSIG_WORDS]
}

sigset_size {
	ss	ptr[inout, sigset_t]
	len	len[ss, intptr]
}

resource time_sec[intptr]
resource time_nsec[intptr]
resource time_usec[intptr]

# prog knowns about this struct type
timespec {
	sec	time_sec
	nsec	time_nsec
}

# prog knowns about this struct type
timeval {
	sec	time_sec
	usec	time_usec
}

statx_timestamp {
	sec		int64
	nsec		int32
	__reserved	int32
}

itimerspec {
	interv	timespec
	value	timespec
}

itimerval {
	interv	timeval
	value	timeval
}

utimbuf {
	actime	intptr
	modtime	intptr
}

sigevent {
	val	const[0, intptr]
	signo	signalno
	notify	flags[sigev_notify, int32]
	u	sigevent_u
} [size[SIGEVENT_SIZE]]

sigevent_u [
	tid	pid
	thr	sigevent_thread
]

define SIGEVENT_SIZE	sizeof(struct sigevent)

sigevent_thread {
# NEED: this is function pointer and pthread_attr_t (?)
	func	buffer[in]
	attr	buffer[in]
}

cap_header {
	var	flags[cap_version, int32]
	pid	pid
}

cap_data {
	eff0	int32
	perm0	int32
	inher0	int32
	eff1	int32
	perm1	int32
	inher1	int32
}

epoll_event {
	ev	flags[epoll_ev, int32]
	data	const[0, int64]
# TODO: this packed only on amd64
} [packed]

# TODO: fd_set needs to be a separate type
fd_set {
	mask0	int64
	mask1	int64
	mask2	int64
	mask3	int64
	mask4	int64
	mask5	int64
	mask6	int64
	mask7	int64
}

sock_fprog {
	len	len[filter, int16]
	filter	ptr[in, array[sock_filter]]
}

sock_filter {
	code	int16
	jt	int8
	jf	int8
	k	int32
}

file_handle [
	raw				file_handle_raw
	shmem				file_handle_t[1, fid_shmem]
	fuse				file_handle_t[0x81, fid_fuse]
	fuse_with_parent		file_handle_t[0x82, fid_fuse_with_parent]
	nfs				file_handle_t[36, fid_nfs]
	FILEID_INO32_GEN		file_handle_t[FILEID_INO32_GEN, fid_FILEID_INO32_GEN]
	FILEID_INO32_GEN_PARENT		file_handle_t[FILEID_INO32_GEN_PARENT, fid_FILEID_INO32_GEN_PARENT]
	FILEID_UDF_WITHOUT_PARENT	file_handle_t[FILEID_UDF_WITHOUT_PARENT, fid_FILEID_UDF_WITHOUT_PARENT]
	FILEID_UDF_WITH_PARENT		file_handle_t[FILEID_UDF_WITH_PARENT, fid_FILEID_UDF_WITH_PARENT]
	FILEID_BTRFS_WITH_PARENT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	FILEID_BTRFS_WITH_PARENT_ROOT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	FILEID_BTRFS_WITHOUT_PARENT	file_handle_t[FILEID_BTRFS_WITH_PARENT, btrfs_fid]
	ceph_nfs_snapfh			file_handle_t[FILEID_BTRFS_WITH_PARENT, ceph_nfs_snapfh]
	ceph_nfs_fh			file_handle_t[FILEID_INO32_GEN, ceph_nfs_fh]
	ceph_nfs_confh			file_handle_t[FILEID_INO32_GEN_PARENT, ceph_nfs_confh]
	GFS2_SMALL_FH_SIZE		file_handle_t[GFS2_SMALL_FH_SIZE, fid_GFS2_SMALL_FH_SIZE]
	GFS2_LARGE_FH_SIZE		file_handle_t[GFS2_LARGE_FH_SIZE, fid_GFS2_LARGE_FH_SIZE]
	OVL_FILEID_V0			file_handle_t[OVL_FILEID_V0, ovl_fb]
	OVL_FILEID_V1			file_handle_t[OVL_FILEID_V1, ovl_fh]
	FILEID_NILFS_WITHOUT_PARENT	file_handle_t[FILEID_NILFS_WITHOUT_PARENT, nilfs_fid]
	FILEID_NILFS_WITH_PARENT	file_handle_t[FILEID_NILFS_WITH_PARENT, nilfs_fid]
	reiserfs_2			file_handle_t[2, fid_reiserfs_2]
	reiserfs_3			file_handle_t[3, fid_reiserfs_3]
	reiserfs_4			file_handle_t[4, fid_reiserfs_4]
	reiserfs_5			file_handle_t[5, fid_reiserfs_5]
	reiserfs_6			file_handle_t[6, fid_reiserfs_6]
	xfs				file_handle_t[0x81, xfs_fid64]
	xfs_parent			file_handle_t[0x82, xfs_fid64]
	orangefs			file_handle_t[1, fid_orangefs]
	orangefs_parent			file_handle_t[2, fid_orangefs_parent]
	isofs				file_handle_t[1, isofs_fid]
	isofs_parent			file_handle_t[2, isofs_fid]
	ocfs2				file_handle_t[1, fid_ocfs2]
	ocfs2_parent			file_handle_t[2, fid_ocfs2_parent]
] [varlen]

file_handle_raw {
	handle_bytes	bytesize[f_handle, int32]
	handle_type	flags[fid_type, int32]
	f_handle	align32[array[int8]]
}

type file_handle_t[TYPE, FID] {
	handle_bytes	bytesize[f_handle, int32]
	handle_type	const[TYPE, int32]
	f_handle	FID
}

fid_shmem {
	gen	int32
	ino	int64
} [packed]

fid_fuse {
	nodeid_hi	int32
	nodeid_lo	int32
	generation	int32
}

fid_fuse_with_parent {
	base		fid_fuse
	parent_fid	fid_fuse
} [packed]

fid_FILEID_INO32_GEN {
	ino	int32
	gen	int32
}

fid_FILEID_INO32_GEN_PARENT {
	base		fid_FILEID_INO32_GEN
	parent_ino	int32
	parent_gen	int32
}

fid_FILEID_UDF_WITHOUT_PARENT {
	block		int32
	partref		int16
	parent_partref	int16
	generation	int32
}

fid_FILEID_UDF_WITH_PARENT {
	base			fid_FILEID_UDF_WITHOUT_PARENT
	parent_block		int32
	parent_generation	int32
}

btrfs_fid {
	objectid		int64
	root_objectid		int64
	gen			int32
	parent_objectid		int64
	parent_gen		int32
	parent_root_objectid	int64
} [packed]

ceph_nfs_snapfh {
	ino		int64
	snapid		int64
	parent_ino	int64
	hash		int32
} [packed]

ceph_nfs_fh {
	ino	int64
}

ceph_nfs_confh {
	ino		int64
	parent_ino	int64
}

fid_GFS2_SMALL_FH_SIZE {
	no_formal_ino_hi	int32be
	no_formal_ino_lo	int32be
	no_addr_hi		int32be
	no_addr_lo		int32be
}

fid_GFS2_LARGE_FH_SIZE {
	base		fid_GFS2_SMALL_FH_SIZE
	parent_fid	fid_GFS2_SMALL_FH_SIZE
}

define GFS2_SMALL_FH_SIZE	4
define GFS2_LARGE_FH_SIZE	8

fid_nfs {
	fileid_hi	int32
	fileid_lo	int32
	type		int32
# The total size is encoded in file_handle.handle_type, so we make this const size.
	size		const[NFS_MAXFHSIZE, int16]
	data		array[int8, NFS_MAXFHSIZE]
} [align[4]]

fid_reiserfs_2 {
	objectid	int32
	dir_id		int32
}

fid_reiserfs_3 {
	objectid	int32
	dir_id		int32
	generation	int32
}

fid_reiserfs_4 {
	objectid	int32
	dir_id		int32
	parent_objectid	int32
	parent_dir_id	int32
}

fid_reiserfs_5 {
	objectid	int32
	dir_id		int32
	generation	int32
	parent_objectid	int32
	parent_dir_id	int32
}

fid_reiserfs_6 {
	objectid		int32
	dir_id			int32
	generation		int32
	parent_objectid		int32
	parent_dir_id		int32
	parent_generation	int32
}

xfs_fid64 {
	ino		int64
	gen		int32
	parent_ino	int64
	parent_gen	int32
} [align[4]]

fid_orangefs {
	khandle	array[int8, 16]
	fs_id	int32
}

fid_orangefs_parent {
	base		fid_orangefs
	parent_fid	fid_orangefs
}

nilfs_fid {
	cno		int64
	ino		int64
	gen		int32
	parent_gen	int32
	parent_ino	int64
} [packed]

isofs_fid {
	block			int32
	offset			int16
	parent_offset		int16
	generation		int32
	parent_block		int32
	parent_generation	int32
}

fid_ocfs2 {
	blkno_hi	int32
	blkno_lo	int32
	generation	int32
}

fid_ocfs2_parent {
	base		fid_ocfs2
	parent_fid	fid_ocfs2
}

fid_type = FILEID_ROOT, FILEID_INO32_GEN, FILEID_INO32_GEN_PARENT, FILEID_BTRFS_WITHOUT_PARENT, FILEID_BTRFS_WITH_PARENT, FILEID_BTRFS_WITH_PARENT_ROOT, FILEID_UDF_WITHOUT_PARENT, FILEID_UDF_WITH_PARENT, FILEID_NILFS_WITHOUT_PARENT, FILEID_NILFS_WITH_PARENT, FILEID_FAT_WITHOUT_PARENT, FILEID_FAT_WITH_PARENT, FILEID_LUSTRE, FILEID_KERNFS

mq_attr {
	mq_flags	intptr
	mq_maxmsg	intptr
	mq_msgsize	intptr
	mq_curmsgs	intptr
	__reserved	array[const[0, intptr], 4]
}

kexec_segment {
	buf	buffer[in]
	sz	len[buf, intptr]
# TODO: this is address in kernel
	mem	intptr
	memsz	intptr
}

rusage {
	utime	timeval
	stime	timeval
	maxrss	intptr
	ixrss	intptr
	idrss	intptr
	isrss	intptr
	minflt	intptr
	majflt	intptr
	nswap	intptr
	inblock	intptr
	oublock	intptr
	msgsnd	intptr
	msgrcv	intptr
	signals	intptr
	nvcsw	intptr
	nivcsw	intptr
}

rlimit {
	soft	intptr
	hard	intptr
}

sigaction {
	sa_handler	ptr[in, text[target]]
	sa_flags	flags[sigaction_flags, intptr]
	sa_restorer	ptr[in, text[target]]
	sa_mask		sigset_t
}

sigaltstack {
	ss_sp		ptr[out, array[int8]]
	ss_flags	flags[sigaltstack_flags, int32]
	ss_size		bytesize[ss_sp, intptr]
}

sigaltstack_flags = SS_ONSTACK, SS_DISABLE, SS_AUTODISARM

tms {
	utime	intptr
	stime	intptr
	cutime	intptr
	cstime	intptr
}

siginfo {
	signo	signalno
	errno	int32
	code	int32
} [size[SIGINFO_SIZE]]

define SIGINFO_SIZE	sizeof(struct siginfo)

timex {
	stuff0	intptr
	stuff1	intptr
	stuff2	intptr
	stuff3	intptr
	stuff4	intptr
	stuff5	intptr
	stuff6	intptr
	stuff7	intptr
	stuff8	intptr
	stuff9	intptr
	stuff10	intptr
	stuff11	intptr
	stuff12	intptr
	stuff13	intptr
	stuff14	intptr
	stuff15	intptr
	stuff16	intptr
	stuff17	intptr
	stuff18	intptr
	stuff19	intptr
	stuff20	intptr
	stuff21	intptr
	stuff22	intptr
	stuff23	intptr
	stuff24	intptr
	stuff25	intptr
}

ustat {
	f_tfree		int32
	f_tinode	intptr
	f_fname		array[int8, 6]
	f_fpack		array[int8, 6]
}

user_desc {
	entry_number	int32
# Base should be vma and limit should be len[base]
# But these fields are int32, so we can't use vma.
	base_addr	flags[user_desc_bases, int32]
	limit		flags[user_desc_limits, int32]
	seg_32bit	int32:1
	contents	int32:2
	read_exec_only	int32:1
	limit_in_pages	int32:1
	seg_not_present	int32:1
	useable		int32:1
	lm		int32:1
}

user_desc_bases = 0, 4096, 1048576, 536870912, 536872960, 536875008, -1
user_desc_limits = 0, 1024, 4096, 8192, 16384, -1

sched_attr {
	size		bytesize[parent, int32]
	sched_policy	flags[sched_policy, int32]
	sched_flags	flags[sched_attr_flags, int64]
	sched_nice	int32
	sched_priority	int32
	sched_runtime	int64
	sched_deadline	int64
	sched_period	int64
	sched_util_min	int32
	sched_util_max	int32
}

sched_policy = SCHED_NORMAL, SCHED_FIFO, SCHED_RR, SCHED_BATCH, SCHED_IDLE, SCHED_DEADLINE
sched_attr_flags = SCHED_FLAG_RESET_ON_FORK, SCHED_FLAG_RECLAIM, SCHED_FLAG_DL_OVERRUN, SCHED_FLAG_KEEP_POLICY, SCHED_FLAG_KEEP_PARAMS, SCHED_FLAG_UTIL_CLAMP_MIN, SCHED_FLAG_UTIL_CLAMP_MAX, SCHED_FLAG_SUGOV

flock {
	type	flags[flock_type, int16]
	whence	flags[seek_whence, int16]
	start	intptr
	len	intptr
	pid	pid
}

f_owner_ex {
	type	flags[f_owner_type, int32]
	pid	pid
}

ucred {
	pid	pid
	uid	uid
	gid	gid
}

kcmp_epoll_slot {
	efd	fd_epoll
	tfd	fd
	toff	int32
}

open_how {
	flags	flags[open_flags, int64]
	mode	flags[open_mode, int64]
	resolve	flags[resolve_flags, int64]
}

# Not providing O_WRONLY means O_RDONLY.
open_flags = O_WRONLY, O_RDWR, O_APPEND, FASYNC, O_CLOEXEC, O_CREAT, O_DIRECT, O_DIRECTORY, O_EXCL, O_LARGEFILE, O_NOATIME, O_NOCTTY, O_NOFOLLOW, O_NONBLOCK, O_PATH, O_SYNC, O_TRUNC, __O_TMPFILE
open_mode = S_IRUSR, S_IWUSR, S_IXUSR, S_IRGRP, S_IWGRP, S_IXGRP, S_IROTH, S_IWOTH, S_IXOTH
resolve_flags = RESOLVE_CACHED, RESOLVE_BENEATH, RESOLVE_IN_ROOT, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_SYMLINKS, RESOLVE_NO_XDEV
madvise_flags = MADV_NORMAL, MADV_RANDOM, MADV_SEQUENTIAL, MADV_WILLNEED, MADV_DONTNEED, MADV_REMOVE, MADV_DONTFORK, MADV_DOFORK, MADV_HWPOISON, MADV_SOFT_OFFLINE, MADV_MERGEABLE, MADV_UNMERGEABLE, MADV_HUGEPAGE, MADV_NOHUGEPAGE, MADV_DONTDUMP, MADV_DODUMP, MADV_WIPEONFORK, MADV_KEEPONFORK, MADV_COLD, MADV_PAGEOUT, MADV_POPULATE_READ, MADV_POPULATE_WRITE, MADV_COLLAPSE
fadvise_flags = POSIX_FADV_NORMAL, POSIX_FADV_SEQUENTIAL, POSIX_FADV_RANDOM, POSIX_FADV_NOREUSE, POSIX_FADV_WILLNEED, POSIX_FADV_DONTNEED
move_pages_flags = MPOL_MF_MOVE, MPOL_MF_MOVE_ALL
msync_flags = MS_ASYNC, MS_SYNC, MS_INVALIDATE
mmap_prot = PROT_EXEC, PROT_READ, PROT_WRITE, PROT_SEM, PROT_GROWSDOWN, PROT_GROWSUP
mmap_flags = MAP_SHARED, MAP_PRIVATE, MAP_32BIT, MAP_ANONYMOUS, MAP_DENYWRITE, MAP_EXECUTABLE, MAP_FILE, MAP_FIXED, MAP_GROWSDOWN, MAP_HUGETLB, MAP_LOCKED, MAP_NONBLOCK, MAP_NORESERVE, MAP_POPULATE, MAP_STACK, MAP_UNINITIALIZED, MAP_SHARED_VALIDATE, MAP_SYNC, MAP_FIXED_NOREPLACE
mremap_flags = MREMAP_MAYMOVE, MREMAP_FIXED, MREMAP_DONTUNMAP
mbind_mode = MPOL_DEFAULT, MPOL_BIND, MPOL_INTERLEAVE, MPOL_PREFERRED, MPOL_F_STATIC_NODES, MPOL_F_RELATIVE_NODES
mbind_flags = MPOL_MF_STRICT, MPOL_MF_MOVE, MPOL_MF_MOVE_ALL
pipe_flags = O_NONBLOCK, O_CLOEXEC, O_DIRECT, O_NOTIFICATION_PIPE
mlock_flags = MLOCK_ONFAULT
mlockall_flags = MCL_CURRENT, MCL_FUTURE, MCL_ONFAULT
dup_flags = O_CLOEXEC
splice_flags = SPLICE_F_MOVE, SPLICE_F_NONBLOCK, SPLICE_F_MORE, SPLICE_F_GIFT
seek_whence = SEEK_SET, SEEK_CUR, SEEK_END, SEEK_DATA, SEEK_HOLE
signalfd_flags = SFD_NONBLOCK, SFD_CLOEXEC
eventfd_flags = EFD_CLOEXEC, EFD_NONBLOCK, EFD_SEMAPHORE
timerfd_create_flags = TFD_NONBLOCK, TFD_CLOEXEC
timerfd_settime_flags = TFD_TIMER_ABSTIME, TFD_TIMER_CANCEL_ON_SET
clock_type = CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_MONOTONIC_RAW, CLOCK_BOOTTIME, CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID, CLOCK_REALTIME_ALARM, CLOCK_BOOTTIME_ALARM
sigev_notify = SIGEV_NONE, SIGEV_SIGNAL, SIGEV_THREAD, SIGEV_THREAD_ID
cap_version = _LINUX_CAPABILITY_VERSION_1, _LINUX_CAPABILITY_VERSION_2, _LINUX_CAPABILITY_VERSION_3
epoll_flags = EPOLL_CLOEXEC
epoll_ev = POLLIN, POLLOUT, POLLRDHUP, POLLPRI, POLLERR, POLLHUP, EPOLLET, EPOLLONESHOT, EPOLLEXCLUSIVE, EPOLLWAKEUP
pollfd_events = POLLIN, POLLPRI, POLLOUT, POLLERR, POLLHUP, POLLNVAL, POLLRDNORM, POLLRDBAND, POLLWRNORM, POLLWRBAND, POLLMSG, POLLREMOVE, POLLRDHUP, POLLFREE, POLL_BUSY_LOOP
mknod_mode = S_IFREG, S_IFCHR, S_IFBLK, S_IFIFO, S_IFSOCK, S_ISUID, S_ISGID, S_ISVTX, open_mode
at_flags = AT_EMPTY_PATH, AT_SYMLINK_NOFOLLOW, AT_SYMLINK_FOLLOW, AT_NO_AUTOMOUNT, AT_EMPTY_PATH
fallocate_mode = FALLOC_FL_KEEP_SIZE, FALLOC_FL_PUNCH_HOLE, FALLOC_FL_COLLAPSE_RANGE, FALLOC_FL_ZERO_RANGE, FALLOC_FL_INSERT_RANGE, FALLOC_FL_UNSHARE_RANGE, FALLOC_FL_NO_HIDE_STALE
linkat_flags = AT_EMPTY_PATH, AT_SYMLINK_FOLLOW
unlinkat_flags = AT_REMOVEDIR
renameat2_flags = RENAME_EXCHANGE, RENAME_NOREPLACE, RENAME_WHITEOUT
flock_op = LOCK_SH, LOCK_EX, LOCK_UN, LOCK_NB
statx_flags = AT_SYMLINK_NOFOLLOW, AT_SYMLINK_FOLLOW, AT_NO_AUTOMOUNT, AT_EMPTY_PATH, AT_STATX_SYNC_TYPE, AT_STATX_SYNC_AS_STAT, AT_STATX_FORCE_SYNC, AT_STATX_DONT_SYNC
statx_mask = STATX_TYPE, STATX_MODE, STATX_NLINK, STATX_UID, STATX_GID, STATX_ATIME, STATX_MTIME, STATX_CTIME, STATX_INO, STATX_SIZE, STATX_BLOCKS, STATX_BASIC_STATS, STATX_BTIME
name_to_handle_at_flags = AT_EMPTY_PATH, AT_SYMLINK_FOLLOW, AT_HANDLE_FID
mq_open_flags = O_WRONLY, O_RDWR, O_NONBLOCK, O_CREAT, O_EXCL, O_CREAT
finit_module_flags = MODULE_INIT_IGNORE_MODVERSIONS, MODULE_INIT_IGNORE_VERMAGIC
delete_module_flags = O_NONBLOCK, O_TRUNC
kexec_load_flags = KEXEC_ON_CRASH, KEXEC_PRESERVE_CONTEXT, KEXEC_ARCH_386, KEXEC_ARCH_X86_64, KEXEC_ARCH_PPC, KEXEC_ARCH_PPC64, KEXEC_ARCH_IA_64, KEXEC_ARCH_ARM, KEXEC_ARCH_S390, KEXEC_ARCH_SH, KEXEC_ARCH_MIPS, KEXEC_ARCH_MIPS_LE, KEXEC_ARCH_DEFAULT
faccessat_flags = AT_EACCESS, AT_SYMLINK_NOFOLLOW, AT_EMPTY_PATH
sync_file_flags = SYNC_FILE_RANGE_WAIT_BEFORE, SYNC_FILE_RANGE_WRITE, SYNC_FILE_RANGE_WAIT_AFTER
kcmp_flags = KCMP_FILE, KCMP_FILES, KCMP_FS, KCMP_IO, KCMP_SIGHAND, KCMP_SYSVSEM, KCMP_VM
rusage_who = RUSAGE_SELF, RUSAGE_CHILDREN, RUSAGE_THREAD
rlimit_type = RLIMIT_AS, RLIMIT_CORE, RLIMIT_CPU, RLIMIT_DATA, RLIMIT_FSIZE, RLIMIT_LOCKS, RLIMIT_MEMLOCK, RLIMIT_MSGQUEUE, RLIMIT_NICE, RLIMIT_NOFILE, RLIMIT_NPROC, RLIMIT_RSS, RLIMIT_RTPRIO, RLIMIT_RTTIME, RLIMIT_SIGPENDING, RLIMIT_STACK
# The ones that disable console output are intentionally omitted.
syslog_cmd = SYSLOG_ACTION_CLOSE, SYSLOG_ACTION_OPEN, SYSLOG_ACTION_READ, SYSLOG_ACTION_READ_ALL, SYSLOG_ACTION_READ_CLEAR, SYSLOG_ACTION_SIZE_UNREAD, SYSLOG_ACTION_SIZE_BUFFER
ioprio_which_pid = IOPRIO_WHO_PROCESS, IOPRIO_WHO_PGRP
ioprio_which_uid = IOPRIO_WHO_USER
personality_flags = PER_LINUX, PER_SVR4, PER_SVR3, PER_OSR5, PER_WYSEV386, PER_ISCR4, PER_BSD, PER_XENIX, PER_LINUX32, PER_IRIX32, PER_IRIXN32, PER_IRIX64, PER_RISCOS, PER_SOLARIS, PER_UW7, PER_OSF4, PER_HPUX, ADDR_NO_RANDOMIZE, MMAP_PAGE_ZERO, ADDR_COMPAT_LAYOUT, READ_IMPLIES_EXEC, ADDR_LIMIT_32BIT, SHORT_INODE, WHOLE_SECONDS, STICKY_TIMEOUTS, ADDR_LIMIT_3GB
clock_id = CLOCK_REALTIME, CLOCK_REALTIME_COARSE, CLOCK_MONOTONIC, CLOCK_MONOTONIC_COARSE, CLOCK_MONOTONIC_RAW, CLOCK_BOOTTIME, CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID
sigprocmask_how = SIG_BLOCK, SIG_UNBLOCK, SIG_SETMASK
getitimer_which = ITIMER_REAL, ITIMER_VIRTUAL, ITIMER_PROF
wait_options = WNOHANG, WUNTRACED, WCONTINUED, WEXITED, WSTOPPED, WCONTINUED, WNOHANG, WNOWAIT, __WCLONE, __WALL, __WNOTHREAD
waitid_which = P_PID, P_PGID, P_ALL
sigaction_flags = SA_NOCLDSTOP, SA_NOCLDWAIT, SA_NODEFER, SA_ONSTACK, SA_RESETHAND, SA_RESTART, SA_SIGINFO
timer_flags = TIMER_ABSTIME
utimensat_flags = AT_SYMLINK_NOFOLLOW
priority_which = PRIO_PROCESS, PRIO_PGRP, PRIO_USER
mempolicy_flags = MPOL_F_MEMS_ALLOWED, MPOL_F_ADDR, MPOL_F_NODE
ptrace_req = PTRACE_LISTEN, PTRACE_KILL, PTRACE_INTERRUPT, PTRACE_ATTACH, PTRACE_DETACH
ptrace_req_peek = PTRACE_PEEKTEXT, PTRACE_PEEKDATA
ptrace_req_poke = PTRACE_POKETEXT, PTRACE_POKEDATA
ptrace_req_getregs = PTRACE_GETREGS, PTRACE_GETFPREGS
ptrace_req_setregs = PTRACE_SETREGS, PTRACE_SETFPREGS
ptrace_req_setopts = PTRACE_SETOPTIONS, PTRACE_SEIZE
ptrace_req_cont = PTRACE_CONT, PTRACE_SYSCALL, PTRACE_SINGLESTEP, PTRACE_SYSEMU, PTRACE_SYSEMU_SINGLESTEP
pthread_regset = NT_PRSTATUS, NT_PRFPREG, NT_PRPSINFO, NT_TASKSTRUCT, NT_AUXV, NT_386_TLS, NT_386_IOPERM, NT_X86_XSTATE
ptrace_options = PTRACE_O_EXITKILL, PTRACE_O_TRACECLONE, PTRACE_O_TRACEEXEC, PTRACE_O_TRACEEXIT, PTRACE_O_TRACEFORK, PTRACE_O_TRACESYSGOOD, PTRACE_O_TRACEVFORK, PTRACE_O_TRACEVFORKDONE
fcntl_dupfd = F_DUPFD, F_DUPFD_CLOEXEC
fcntl_getflags = F_GETFD, F_GETFL, F_GETSIG, F_GETLEASE, F_GETPIPE_SZ, F_GET_SEALS
fcntl_lock = F_SETLK, F_SETLKW, F_GETLK, F_OFD_GETLK, F_OFD_SETLK, F_OFD_SETLKW
fcntl_flags = FD_CLOEXEC
fcntl_status = O_APPEND, FASYNC, O_DIRECT, O_NOATIME, O_NONBLOCK
flock_type = F_RDLCK, F_WRLCK, F_UNLCK
f_owner_type = F_OWNER_TID, F_OWNER_PID, F_OWNER_PGRP
fcntl_notify = DN_MULTISHOT, DN_ACCESS, DN_MODIFY, DN_CREATE, DN_DELETE, DN_RENAME, DN_ATTRIB
seal_types = F_SEAL_SEAL, F_SEAL_SHRINK, F_SEAL_GROW, F_SEAL_WRITE
ioctl_int_in = FIONBIO, FIOASYNC
ioctl_int_out = FIOQSIZE, FIGETBSZ
fcntl_rw_hint = RWF_WRITE_LIFE_NOT_SET, RWH_WRITE_LIFE_NONE, RWH_WRITE_LIFE_SHORT, RWH_WRITE_LIFE_MEDIUM, RWH_WRITE_LIFE_LONG, RWH_WRITE_LIFE_EXTREME
fiemap_flags = FIEMAP_FLAG_SYNC, FIEMAP_FLAG_XATTR, FIEMAP_FLAG_CACHE
fiemap_extent_flags = FIEMAP_EXTENT_LAST, FIEMAP_EXTENT_UNKNOWN, FIEMAP_EXTENT_DELALLOC, FIEMAP_EXTENT_ENCODED, FIEMAP_EXTENT_DATA_ENCRYPTED, FIEMAP_EXTENT_NOT_ALIGNED, FIEMAP_EXTENT_DATA_INLINE, FIEMAP_EXTENT_DATA_TAIL, FIEMAP_EXTENT_UNWRITTEN, FIEMAP_EXTENT_MERGED, FIEMAP_EXTENT_SHARED
getrandom_flags = GRND_NONBLOCK, GRND_RANDOM
clone_flags = CLONE_VM, CLONE_FS, CLONE_FILES, CLONE_SIGHAND, CLONE_PTRACE, CLONE_VFORK, CLONE_PARENT, CLONE_THREAD, CLONE_NEWNS, CLONE_SYSVSEM, CLONE_SETTLS, CLONE_PARENT_SETTID, CLONE_CHILD_CLEARTID, CLONE_UNTRACED, CLONE_CHILD_SETTID, CLONE_NEWCGROUP, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWUSER, CLONE_NEWPID, CLONE_NEWNET, CLONE_IO, CLONE_PIDFD, CLONE_NEWTIME
clone3_flags = CLONE_CLEAR_SIGHAND, CLONE_INTO_CGROUP, clone_flags
ptrace_peeksiginfo_flags = PTRACE_PEEKSIGINFO_SHARED
close_range_flags = CLOSE_RANGE_UNSHARE

# Consts for target.SpecialFileLenghts.
_ = SMB_PATH_MAX, XT_CGROUP_PATH_MAX, XENSTORE_REL_PATH_MAX

# misc
_ = KCOV_INIT_TRACE, KCOV_ENABLE, KCOV_DISABLE, KCOV_TRACE_PC, KCOV_TRACE_CMP, PTRACE_TRACEME, SYSLOG_ACTION_CONSOLE_ON, SYSLOG_ACTION_CONSOLE_OFF, SYSLOG_ACTION_CONSOLE_LEVEL, SYSLOG_ACTION_CLEAR, __NR_mmap2

# Hardcode KCOV_REMOTE_ENABLE value for amd64 until new kcov patches reach mainline.
define KCOV_REMOTE_ENABLE	1075340134

# Not yet implemented syscalls:
# umask
# vhangup
# _sysctl
# nfsservctl
# getcpu

# Probably no sense in calling these.
# Also affect system-wide state, so not reproducible anyway.
# sched_get_priority_max
# sched_get_priority_min
]

gemini-3-pro-preview

							input: 212152
							output: 622
							thoughts: 5902
						

**Refining the Syzkaller Program to Trigger the I2C Adapter Deletion Bug**

Okay, so the initial plan was to use `nanosleep` to carefully time the interaction between the syzkaller thread and the kernel thread, specifically around the `pvr2_hdw_get_eeprom_addr` and the I2C adapter registration and disconnection sequence.  The goal: make the `pvr_disconnect` and `i2c_del_adapter` get called while an I2C file descriptor is open, leading to the deadlock we identified. I confirmed that sleeping for 0.5 seconds was the right timing, and that opening and disconnecting the devices caused the bug.

I quickly realized that getting precise control over the USB device descriptor in `syz_usb_connect` was key.  I thought initially I could just modify the descriptor directly, but I kept hitting the issue that certain fields are marked `const`, meaning the syzkaller compiler enforces they *must* be set to the value defined in `vusb.txt`.  I ran into this with `idVendor` and `idProduct`. I was getting compiler errors.

The solution, it turns out, is to leverage the `ANY` pointer in syzkaller. Instead of letting syzkaller try to interpret the structure, I can feed it a raw byte string representing the USB device descriptor.  I had to be extremely careful to construct the hex string of the descriptor manually, including the configuration and interface descriptors, endpoint descriptors, etc., to make sure all the necessary fields were set correctly and the lengths matched up. I double-checked the calculations for each descriptor's length and overall descriptor length to make sure the hex string was correct.

Then I realized that `syz_usb_connect` takes `dev_len` as `len[dev]`. Syzkaller syntax for len is `AUTO`. Also I can simplify the `syz_usb_connect` by passing in the descriptor as an `ANY` pointer. The corrected code is below and should trigger the bug:

```
r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"], 0)
syz_usb_ep_write(r0, 0x81, 1, &(0x7f0000000200)="\x00")
nanosleep(&(0x7f0000000300)={0, 500000000}, 0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='/dev/i2c-0\x00', 0, 0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='/dev/i2c-1\x00', 0, 0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='/dev/i2c-2\x00', 0, 0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/i2c-3\x00', 0, 0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='/dev/i2c-4\x00', 0, 0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='/dev/i2c-5\x00', 0, 0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000580)='/dev/i2c-6\x00', 0, 0)
r8 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/

failed to parse identifier at pos 37
line #2:37: syz_usb_ep_write(r0, 0x81, 1, &AUTO="<<<!!ERROR!!>>>\x00")

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"], 0)
syz_usb_ep_write(r0, 0x81, 1, &AUTO="\x00")
nanosleep(&(0x7f0000000300)={0, 500000000}, 0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='/dev/i2c-0\x00', 0, 0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='/dev/i2c-1\x00', 0, 0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='/dev/i2c-2\x00', 0, 0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/i2c-3\x00', 0, 0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='/dev/i2c-4\x00', 0, 0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='/dev/i2c-5\x00', 0, 0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000580)='/dev/i2c-6\x00', 0, 0)
r8 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/i2c-7\x00', 0, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 219766
							output: 622
							thoughts: 33
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience:

**Syntactic Precision and Data Integrity**

Alright, that's a quick catch. I immediately see the error. The original expression, `&AUTO="\x00"`, is a clear indication of a misunderstanding of string literal syntax. In most contexts, including many programming languages and configuration formats I'm familiar with, double quotes (`"`) are generally used for strings that might require string interpolation or contain escape sequences that need interpretation. However, when dealing with a single, specific null byte (`\x00`), I'd expect single quotes (`'`) to be the preferred delimiter to ensure it's treated as a literal byte sequence, preventing unwanted interpretation of the escape sequence. Therefore, to ensure data integrity and avoid any unintended consequences of the escape sequence interpretation, I'd immediately adjust it to `&AUTO='\x00'`. It's a subtle but critical distinction that speaks to ensuring predictable data handling and avoiding potential vulnerabilities or unexpected behavior down the line.

call #3 openat: escaping filename "/dev/i2c-0\x00"

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"], 0)
syz_usb_ep_write(r0, 0x81, 1, &AUTO='\x00')
nanosleep(&(0x7f0000000300)={0, 500000000}, 0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='/dev/i2c-0\x00', 0, 0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='/dev/i2c-1\x00', 0, 0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000480)='/dev/i2c-2\x00', 0, 0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/i2c-3\x00', 0, 0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='/dev/i2c-4\x00', 0, 0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000540)='/dev/i2c-5\x00', 0, 0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000580)='/dev/i2c-6\x00', 0, 0)
r8 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/i2c-7\x00', 0, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 220675
							output: 566
							thoughts: 335
						

**Debugging a Syzkaller Filename Issue**

Okay, so I'm wrestling with this `openat` call in Syzkaller and I've hit a snag. The error message is screaming at me: "escaping filename "/dev/i2c-0\x00"". Right, first thought, the `openat` filename needs to be a string, not a byte array. I *thought* `&AUTO='/dev/i2c-0\x00'` should work, but maybe using double quotes, like `&AUTO="/dev/i2c-0\x00"` would be better? No, wait, Syzkaller's string syntax *is* single quotes for the escaped null, like `'foo\x00'` or double like `"foo\x00"`, so I should be okay there.

That error, though... "escaping filename". Is the filename itself the problem? Is it not *allowed*? Hmmm. Let me double-check the `sys.txt` definition for `openat`:

```
openat(fd fd_dir[opt], file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd
```

Yep, `filename` is a special type. I seem to recall Syzkaller potentially having a predefined list of allowed filenames somewhere... maybe in `target.SpecialFileLengths` or something similar?

Alright, so the options I can see are to use `openat$dir`, `openat` with a random string, or some other variation. But since it's `filename`, I'm guessing Syzkaller might be *expecting* a known file. Maybe `openat$procfs` or something like that would work?

Wait, what if `openat` with `ANY` works? I *think* that's a way to bypass the filename restriction entirely. Yeah, let's try `&AUTO=ANY=[@ANYBLOB="/dev/i2c-0\x00"]`. That should work. Let me run that and see what happens.

wrong array arg *prog.BufferType
line #4:43: r1 = openat(0xffffffffffffff9c, &AUTO=ANY=[<<<!!ERROR!!>>>@ANYBLOB="/dev/i2c-0\x00"], 0, 0)

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"], 0)
syz_usb_ep_write(r0, 0x81, 1, &AUTO='\x00')
nanosleep(&(0x7f0000000300)={0, 500000000}, 0)
r1 = openat(0xffffffffffffff9c, &AUTO=ANY=[@ANYBLOB="/dev/i2c-0\x00"], 0, 0)
r2 = openat(0xffffffffffffff9c, &AUTO=ANY=[@ANYBLOB="/dev/i2c-1\x00"], 0, 0)
r3 = openat(0xffffffffffffff9c, &AUTO=ANY=[@ANYBLOB="/dev/i2c-2\x00"], 0, 0)
r4 = openat(0xffffffffffffff9c, &AUTO=ANY=[@ANYBLOB="/dev/i2c-3\x00"], 0, 0)
r5 = openat(0xffffffffffffff9c, &AUTO=ANY=[@ANYBLOB="/dev/i2c-4\x00"], 0, 0)
r6 = openat(0xffffffffffffff9c, &AUTO=ANY=[@ANYBLOB="/dev/i2c-5\x00"], 0, 0)
r7 = openat(0xffffffffffffff9c, &AUTO=ANY=[@ANYBLOB="/dev/i2c-6\x00"], 0, 0)
r8 = openat(0xffffffffffffff9c, &AUTO=ANY=[@ANYBLOB="/dev/i2c-7\x00"], 0, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 222102
							output: 22
							thoughts: 395
						

**Debugging a Syzkaller Filename Escape Issue**

Okay, so I'm looking at this error with the string syntax and it's hitting me: the `ANY` syntax boils down to `&AUTO="/dev/i2c-0\x00"`. But then there's an escaping error with the filename, `/dev/i2c-0\x00`. The fuzzer's trying to escape the filename! Ah, right, Syzkaller does that to protect the host. But hold on...`/dev/i2c-0` *is* a device file! If it escapes it, it's going to try to open `./dev/i2c-0` which is not what I want.

The correct approach for opening that device file must be `syz_open_dev`! Let me check `sys.txt`... Okay, there it is:

```
syz_open_dev$char(dev const[0xc], major intptr, minor intptr) fd
```

Wait a second, this `syz_open_dev$char` is *disabled*! There's a comment:

```
# Uncomment on your own account.
#syz_open_dev$char(dev const[0xc], major intptr, minor intptr) fd
```

So, looks like I can't use it, unless I comment out that line. Is there another way to open `/dev/i2c-X`? Hmmm... let's see, what does `sys.txt` tell us? Alright, I found `openat$null`:

```
openat$null(fd const[AT_FDCWD], file ptr[in, string["/dev/null"]], flags flags[open_flags], mode const[0]) fd
```

If I try to use `openat` with a string, the fuzzer is going to escape it again, damn! But wait, `syz_open_dev` is a pseudo-syscall made for opening device files. It opens devices without escaping them! Maybe there's a variant of that, like `syz_open_dev$i2c`? Time to dig into `dev_i2c.txt`.

map[File:dev_i2c.txt]

map[Output:# Copyright 2018 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <uapi/linux/i2c-dev.h>
include <uapi/linux/i2c.h>

define I2C_MAX_BLOCK_1	(I2C_SMBUS_BLOCK_MAX + 1)
define I2C_MAX_BLOCK_2	(I2C_SMBUS_BLOCK_MAX + 2)

resource fd_i2c[fd]

syz_open_dev$I2C(dev ptr[in, string["/dev/i2c-#"]], id intptr, flags flags[open_flags]) fd_i2c

ioctl$I2C_RETRIES(fd fd_i2c, cmd const[I2C_RETRIES], arg intptr)
ioctl$I2C_TIMEOUT(fd fd_i2c, cmd const[I2C_TIMEOUT], arg intptr)
ioctl$I2C_SLAVE(fd fd_i2c, cmd const[I2C_SLAVE], arg intptr[0:0x3ff])
ioctl$I2C_SLAVE_FORCE(fd fd_i2c, cmd const[I2C_SLAVE_FORCE], arg intptr[0:0x3ff])
ioctl$I2C_TENBIT(fd fd_i2c, cmd const[I2C_TENBIT], arg boolptr)
ioctl$I2C_PEC(fd fd_i2c, cmd const[I2C_PEC], arg intptr)

ioctl$I2C_FUNCS(fd fd_i2c, cmd const[I2C_FUNCS], arg ptr[in, intptr])
ioctl$I2C_RDWR(fd fd_i2c, cmd const[I2C_RDWR], arg ptr[in, i2c_rdwr_ioctl_data])
ioctl$I2C_SMBUS(fd fd_i2c, cmd const[I2C_SMBUS], arg ptr[in, i2c_smbus_ioctl_data])

i2c_smbus_ioctl_data {
	read_write	bool8
	command		int8
	size		int32[I2C_SMBUS_QUICK:I2C_SMBUS_I2C_BLOCK_DATA]
	data		ptr[in, i2c_smbus_data]
}

i2c_smbus_data {
	size	int8[0:I2C_MAX_BLOCK_2]
	block	array[int8, I2C_MAX_BLOCK_1]
}

i2c_rdwr_ioctl_data {
	msgs	ptr[in, array[i2c_msg]]
	nmsgs	len[msgs, int32]
}

i2c_msg {
	addr	int16
	flags	flags[i2c_msg_flags, int16]
	len	len[buf, int16]
	buf	ptr[in, array[int8]]
}

i2c_msg_flags = I2C_M_RD, I2C_M_TEN, I2C_M_DMA_SAFE, I2C_M_RECV_LEN, I2C_M_NO_RD_ACK, I2C_M_IGNORE_NAK, I2C_M_REV_DIR_ADDR, I2C_M_NOSTART, I2C_M_STOP
]

gemini-3-pro-preview

							input: 223847
							output: 494
							thoughts: 348
						

**I2C Device Discovery Strategy**

Okay, so I see we're dealing with `syz_open_dev$I2C`, which is exactly what I was hoping for. It seems we have a way to interact with I2C devices, using that syscall. The key takeaway is the potential to open an I2C device given a device path, an ID, and some flags. And that device path uses the common pattern `/dev/i2c-#`, where the `#` is some numerical index.

Now, looking at this code snippet, it's clear what they're trying to do. They're systematically attempting to open a series of I2C devices, likely to discover which ones are available and which aren't. They are checking I2C devices 0 through 7 (inclusive). Each of these calls to `syz_open_dev$I2C` probably returns a file descriptor if the device is successfully opened, which then could be used for further I2C transactions. The null terminator on the device string is good practice. The flags appear to be set to 0 in all instances, probably `O_RDWR` if not specified. This is a solid, straightforward approach to I2C device enumeration. Let's see how this plays out in practice.

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"], 0)
syz_usb_ep_write(r0, 0x81, 1, &AUTO='\x00')
nanosleep(&(0x7f0000000300)={0, 500000000}, 0)
r1 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 3, 0)
r5 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 4, 0)
r6 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 5, 0)
r7 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 6, 0)
r8 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 7, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 224988
							output: 22
							thoughts: 42
						

**Debugging a Persistent Bug**

Alright, that's frustrating. The bug didn't reproduce again. Why is that? Okay, let's think this through systematically. Could it be that something is different in the current setup? Maybe something fundamental, like a driver I'm relying on isn't even compiled into the kernel. Perhaps `pvrusb2` is disabled? It's a plausible cause. Let me go check if that module is actually enabled. That seems like the logical next step to diagnose this.

map[Expression:CONFIG_VIDEO_PVRUSB2]

map[Output:drivers/media/usb/Makefile=29=obj-$(CONFIG_VIDEO_HDPVR) += hdpvr/
drivers/media/usb/Makefile:30:obj-$(CONFIG_VIDEO_PVRUSB2) += pvrusb2/
drivers/media/usb/Makefile-31-obj-$(CONFIG_VIDEO_STK1160) += stk1160/
--
drivers/media/usb/pvrusb2/Makefile-1-# SPDX-License-Identifier: GPL-2.0
drivers/media/usb/pvrusb2/Makefile:2:obj-pvrusb2-sysfs-$(CONFIG_VIDEO_PVRUSB2_SYSFS) := pvrusb2-sysfs.o
drivers/media/usb/pvrusb2/Makefile:3:obj-pvrusb2-debugifc-$(CONFIG_VIDEO_PVRUSB2_DEBUGIFC) := pvrusb2-debugifc.o
drivers/media/usb/pvrusb2/Makefile:4:obj-pvrusb2-dvb-$(CONFIG_VIDEO_PVRUSB2_DVB) := pvrusb2-dvb.o
drivers/media/usb/pvrusb2/Makefile-5-
drivers/media/usb/pvrusb2/Makefile=6=pvrusb2-objs	:= pvrusb2-i2c-core.o \
--
drivers/media/usb/pvrusb2/Makefile-17-
drivers/media/usb/pvrusb2/Makefile:18:obj-$(CONFIG_VIDEO_PVRUSB2) += pvrusb2.o
drivers/media/usb/pvrusb2/Makefile-19-
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c=11=pvr2_device_desc structures.
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-20-#include <media/tuner.h>
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:21:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-22-#include "pvrusb2-hdw-internal.h"
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c=158=static const struct pvr2_device_desc pvr2_device_av400 = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-175-
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:176:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-177-static struct lgdt330x_config pvr2_lgdt3303_config = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c=214=static const struct pvr2_device_desc pvr2_device_onair_creator = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-226-		.default_std_mask = V4L2_STD_NTSC_M,
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:227:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-228-		.dvb_props = &pvr2_onair_creator_fe_props,
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-236-
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:237:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-238-static struct lgdt330x_config pvr2_lgdt3302_config = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c=274=static const struct pvr2_device_desc pvr2_device_onair_usb2 = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-286-		.default_std_mask = V4L2_STD_NTSC_M,
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:287:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-288-		.dvb_props = &pvr2_onair_usb2_fe_props,
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-296-
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:297:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-298-static struct tda10048_config hauppauge_tda10048_config = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c=368=static const struct pvr2_device_desc pvr2_device_73xxx = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-384-		.ir_scheme = PVR2_IR_SCHEME_ZILOG,
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:385:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-386-		.dvb_props = &pvr2_73xxx_dvb_props,
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-394-
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:395:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-396-static struct s5h1409_config pvr2_s5h1409_config = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c=475=static const struct pvr2_device_desc pvr2_device_750xx = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-492-		.ir_scheme = PVR2_IR_SCHEME_ZILOG,
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:493:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-494-		.dvb_props = &pvr2_750xx_dvb_props,
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c=498=static const struct pvr2_device_desc pvr2_device_751xx = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-515-		.ir_scheme = PVR2_IR_SCHEME_ZILOG,
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:516:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-517-		.dvb_props = &pvr2_751xx_dvb_props,
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-523-
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:524:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-525-static int pvr2_si2157_attach(struct pvr2_dvb_adapter *adap);
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c=634=static const struct pvr2_device_desc pvr2_device_160000 = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-652-		.ir_scheme = PVR2_IR_SCHEME_ZILOG,
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:653:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-654-		.dvb_props = &pvr2_160000_dvb_props,
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c=658=static const struct pvr2_device_desc pvr2_device_160111 = {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-676-		.ir_scheme = PVR2_IR_SCHEME_ZILOG,
drivers/media/usb/pvrusb2/pvrusb2-devattr.c:677:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.c-678-		.dvb_props = &pvr2_160111_dvb_props,
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.h-10-#include <linux/videodev2.h>
drivers/media/usb/pvrusb2/pvrusb2-devattr.h:11:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.h-12-#include "pvrusb2-dvb.h"
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.h=78=struct pvr2_device_desc {
--
drivers/media/usb/pvrusb2/pvrusb2-devattr.h-95-
drivers/media/usb/pvrusb2/pvrusb2-devattr.h:96:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-devattr.h-97-	/* callback functions to handle attachment of digital tuner & demod */
--
drivers/media/usb/pvrusb2/pvrusb2-main.c=37=static void pvr_setup_attach(struct pvr2_context *pvr)
--
drivers/media/usb/pvrusb2/pvrusb2-main.c-40-	pvr2_v4l2_create(pvr);
drivers/media/usb/pvrusb2/pvrusb2-main.c:41:#ifdef CONFIG_VIDEO_PVRUSB2_DVB
drivers/media/usb/pvrusb2/pvrusb2-main.c-42-	/* Create association with dvb layer */
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-11-#include "pvrusb2-debug.h"
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:12:#ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-13-#include "pvrusb2-debugifc.h"
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:14:#endif /* CONFIG_VIDEO_PVRUSB2_DEBUGIFC */
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-15-
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c=18=struct pvr2_sysfs {
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-20-	struct device *class_dev;
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:21:#ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-22-	struct pvr2_sysfs_debugifc *debugifc;
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:23:#endif /* CONFIG_VIDEO_PVRUSB2_DEBUGIFC */
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-24-	struct pvr2_sysfs_ctl_item *item_first;
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-39-
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:40:#ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-41-struct pvr2_sysfs_debugifc {
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-46-};
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:47:#endif /* CONFIG_VIDEO_PVRUSB2_DEBUGIFC */
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-48-
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c=282=static void pvr2_sysfs_add_control(struct pvr2_sysfs *sfp,int ctl_id)
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-400-
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:401:#ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-402-static ssize_t debuginfo_show(struct device *, struct device_attribute *,
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c=445=static void pvr2_sysfs_tear_down_debugifc(struct pvr2_sysfs *sfp)
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-458-}
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:459:#endif /* CONFIG_VIDEO_PVRUSB2_DEBUGIFC */
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-460-
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c=499=static void class_dev_destroy(struct pvr2_sysfs *sfp)
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-502-	if (!sfp->class_dev) return;
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:503:#ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-504-	pvr2_sysfs_tear_down_debugifc(sfp);
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:505:#endif /* CONFIG_VIDEO_PVRUSB2_DEBUGIFC */
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-506-	pvr2_sysfs_tear_down_controls(sfp);
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c=610=static void class_dev_create(struct pvr2_sysfs *sfp)
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-729-	pvr2_sysfs_add_controls(sfp);
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:730:#ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-731-	pvr2_sysfs_add_debugifc(sfp);
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:732:#endif /* CONFIG_VIDEO_PVRUSB2_DEBUGIFC */
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-733-}
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c=769=void pvr2_sysfs_class_destroy(void)
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-774-
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:775:#ifdef CONFIG_VIDEO_PVRUSB2_DEBUGIFC
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-776-static ssize_t debuginfo_show(struct device *class_dev,
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c=797=static ssize_t debugcmd_store(struct device *class_dev,
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c-810-}
drivers/media/usb/pvrusb2/pvrusb2-sysfs.c:811:#endif /* CONFIG_VIDEO_PVRUSB2_DEBUGIFC */
--
drivers/media/usb/pvrusb2/pvrusb2-sysfs.h-12-
drivers/media/usb/pvrusb2/pvrusb2-sysfs.h:13:#ifdef CONFIG_VIDEO_PVRUSB2_SYSFS
drivers/media/usb/pvrusb2/pvrusb2-sysfs.h-14-void pvr2_sysfs_class_create(void);
]

gemini-3-pro-preview

							input: 229832
							output: 592
							thoughts: 902
						

**Debugging a USB Connection Failure**

Okay, so `pvrusb2` is enabled, but the reproducer failed. My initial thought was that `syz_usb_connect` didn't work because `idVendor` and `idProduct` weren't being patched correctly, even though I was using the `ANY` pointer like this: `&AUTO=ANY=[@ANYBLOB="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"]`.

Let's double-check the hex string: `12 01 00 02 00 00 00 40 40 20 00 29 00 00 01 02 03 01`.  I need to make sure `idVendor` and `idProduct` are correct.  `idVendor` should be `0x2040`, which is `40 20` in little-endian, and `idProduct` should be `0x2900`, which is `00 29` in little-endian. Seems correct.

Then, I went through the descriptors: The configuration descriptor looks fine. `wTotalLength` is 32, and the interface descriptors, and the endpoints. I can see `bNumConfigurations` is `01`, `wTotalLength` is `0x0020`, `bNumInterfaces` is `01`, `bConfigurationValue` is `01`, `iConfiguration` is `00`, `bmAttributes` is `80`, `bMaxPower` is `fa`, `bInterfaceNumber` is `00`, `bAlternateSetting` is `00`, `bNumEndpoints` is `02`, `bInterfaceClass` is `ff`, `bInterfaceSubClass` is `ff`, `bInterfaceProtocol` is `ff`, `iInterface` is `00`.  Endpoint 1 and 2 seem good.

Wait a second. I remember `syz_usb_connect` needs a `dev_len` argument. I used `0x32`, or 50. But, where am I going wrong with the device descriptor? I remember the descriptor is defined as a hex string with `ANYBLOB` in syzkaller. The format should be `1201...`. But wait...that's it! `ANYBLOB` expects raw bytes. I'm passing it as a *hex string*!  I'm interpreting each pair of hex characters as ASCII characters!  That's why it wasn't working. It needs to be raw bytes, not a string of hex characters. So, it should be something like `ANYBLOB="\x12\x01\x00\x02..."`!  That's the fix. I need to convert the `ANYBLOB` string to the correct format and I should be good to go.

failed to parse identifier at pos 51
line #1:51: r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB="<<<!!ERROR!!>>>\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00"], 0)

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB="\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00"], 0)
syz_usb_ep_write(r0, 0x81, 1, &AUTO='\x00')
nanosleep(&(0x7f0000000300)={0, 500000000}, 0)
r1 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 3, 0)
r5 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 4, 0)
r6 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 5, 0)
r7 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 6, 0)
r8 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 7, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 232307
							output: 585
							thoughts: 361
						

**Debugging `ANYBLOB` Syntax in Syzkaller**

Okay, so I'm dealing with `ANYBLOB` here, and I need to feed it a hex string. Right, no `\x` prefixes, just raw hex. But then I remember, doesn't syzkaller use that `ANYBLOB="12010002..."` syntax? Let me check the error message again… "failed to parse identifier at pos 51". Okay, that's not super helpful, but let's try to parse that error. I should be able to get this to work without too much trouble.

Alright, let me just double-check that `ANY=[@ANYBLOB="..."]` is not valid syntax in this context. And yes, it looks like it isn't. So what *is* the correct syntax for an `ANY` value? Is it something like `&AUTO=ANY=[@ANYBLOB="1201..."]`? I am getting the same "failed to parse identifier" error... That isn't right. I'm going to take the shortest path here.

Let's just use a string literal directly in the call. I can define it as such:
```
r0 = syz_usb_connect(0, 0x32, &AUTO="\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00", 0)
```
Hopefully, that will work. Time to test this one out.

wrong string arg
line #1:36: r0 = syz_usb_connect(0, 0x32, &AUTO=<<<!!ERROR!!>>>"\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00", 0)

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO="\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00", 0)
syz_usb_ep_write(r0, 0x81, 1, &AUTO='\x00')
nanosleep(&(0x7f0000000300)={0, 500000000}, 0)
r1 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 3, 0)
r5 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 4, 0)
r6 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 5, 0)
r7 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 6, 0)
r8 = syz_open_dev$I2C(&AUTO='/dev/i2c-#\x00', 7, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 234001
							output: 633
							thoughts: 189
						

Here's my thought process, distilled:

**Navigating the `syz_usb_connect` Function Call**

Okay, so `syz_usb_connect` is expecting a pointer to a `usb_device_descriptor`. Got it.  I initially tried to pass a string, which predictably threw the "wrong string arg" error.  That makes sense.  Now, the challenge is how to feed it raw bytes directly into a struct pointer.  Aha, I recall using `ANY` pointers for this kind of thing.

The syntax, if I remember correctly, should be something like `&(0x7f0000000000)=ANY=[@ANYBLOB="12010002..."]`.  But hang on, the error message... "failed to parse identifier at pos 51". That's a syntax error.  I need to double-check the exact `ANYBLOB` syntax within the context of syzkaller.

Let me refresh my memory.  Right, in syzkaller, `ANYBLOB` expects a *string* of hex digits.  So the issue likely isn't the concept, but the specifics of how I'm formatting it.  Perhaps the problem is the `\x` characters I was using.

So, let's try dropping the `\x` and just using `ANY=[@ANYBLOB="12010002..."]`.  Hopefully, that cleans up the syntax and I can provide the raw bytes directly to the descriptor pointer.

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"], 0)
syz_usb_ep_write(r0, 0x81, 1, &(0x7f0000000200)='\x00')
nanosleep(&(0x7f0000000300)={0, 500000000}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
r5 = syz_open_dev$I2C(&(0x7f0000000500)='/dev/i2c-#\x00', 4, 0)
r6 = syz_open_dev$I2C(&(0x7f0000000540)='/dev/i2c-#\x00', 5, 0)
r7 = syz_open_dev$I2C(&(0x7f0000000580)='/dev/i2c-#\x00', 6, 0)
r8 = syz_open_dev$I2C(&(0x7f00000005c0)='/dev/i2c-#\x00', 7, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 235182
							output: 625
							thoughts: 1274
						

**Debugging the pvrusb2 Driver Reproduction Failure**

Okay, so the syzkaller-generated code parsed correctly, but it didn't reproduce the intended behavior. Frustrating! My initial thought is that `pvrusb2` isn't getting probed, even though it should be. Let's dig into that hypothesis. We should be able to check if `pvrusb2` is probed using `default_api:reproduce-crash` with a minimal program.

Ah, right. The `pvrusb2` driver requires firmware upload. The `pvr2_hdw_check_firmware` function seems like a critical point. If it fails, `pvr2_upload_firmware1` gets called, which in turn uses `request_firmware`. So, the failure could originate here. `pvr2_hdw_check_firmware` sends a bulk OUT request followed by a bulk IN request. I wonder if replying to the bulk OUT with a single byte, using `syz_usb_ep_write` on `0x81` will work as a minimal reply.

Let's trace that through `pvr2_send_request_ex`. It looks like it submits the write URB (bulk OUT), then submits the read URB (bulk IN), and then waits for *both* to complete. Interesting. If the dummy HCD completes the write URB immediately because we're not actually providing any data to read, does this affect the flow? Yep, the dummy HCD completes bulk OUT URBs immediately. But `pvr2_send_request_ex` expects the `actual_length` of the read URB to match `read_len`. We sent 1 byte to `0x81`, so `actual_length` will be 1, and the code continues.

This means `pvr2_hdw_check_firmware` will likely "succeed" now. `pvr2_hdw_setup_low` won't call `pvr2_upload_firmware1`. Instead, it'll proceed to `pvr2_hdw_cmd_powerup`, which calls `pvr2_issue_simple_cmd`. That's followed by `pvr2_i2c_core_init`, which is what registers the I2C adapter. Then, `pvr2_hdw_get_eeprom_addr` is called; this also sends a bulk OUT and a bulk IN. Since we're *still* only providing that single byte to `0x81`, the bulk IN will timeout after one second.

So, if the bulk IN request in `pvr2_hdw_get_eeprom_addr` times out, `pvr2_send_request_ex` returns `-ETIMEDOUT`. And so would `pvr2_hdw_get_eeprom_addr`. But does `pvr2_hdw_setup_low` return early if `pvr2_hdw_get_eeprom_addr` fails? Let's check the code... Nope! It doesn't return; it just *skips* `pvr2_eeprom_analyze`. And then `pvr2_hdw_setup_low` finishes. This means the I2C adapter *is* getting registered and stays registered, even with the timeout.

So, why the reproduction failure? Perhaps the syzkaller program isn't waiting long enough for the I2C adapter to be fully registered? The `nanosleep` for 0.5 seconds might be too short. I think that's it! Let's try increasing the sleep time to 2 seconds to give things ample time to settle. Though, with this timeout of one second, that should not matter now. So, let's keep it at 2 seconds.

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"], 0)
syz_usb_ep_write(r0, 0x81, 1, &(0x7f0000000200)='\x00')
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
r5 = syz_open_dev$I2C(&(0x7f0000000500)='/dev/i2c-#\x00', 4, 0)
r6 = syz_open_dev$I2C(&(0x7f0000000540)='/dev/i2c-#\x00', 5, 0)
r7 = syz_open_dev$I2C(&(0x7f0000000580)='/dev/i2c-#\x00', 6, 0)
r8 = syz_open_dev$I2C(&(0x7f00000005c0)='/dev/i2c-#\x00', 7, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 237937
							output: 53
							thoughts: 258
						

**Debugging the pvrusb2 Driver**

Alright, still no dice on reproducing this issue. My initial thought was that `pvrusb2` wasn't being probed, but *why*? Let's check the kernel log, maybe something is preventing it. I had the idea to use `default_api:reproduce-crash` with a simple program to see if any errors are reported, but wait, that only gives me the bug title and crash report... if it *doesn't* crash, it just returns nothing. That won't tell me if it's even being probed. I don't have direct access to the kernel log, so that's out.

Okay, here's a thought: I *know* a specific bug gets triggered if `pvrusb2` *is* probed. So, can I somehow indirectly verify if it's loaded? Ah! If it's probed, it creates `/dev/videoX` devices. Could I try to open a `/dev/videoX` device and see if it works, then trigger the hung task? No, I just want the hung task.

Why didn't the hung task trigger? Perhaps `pvrusb2` *isn't* probing because `syz_usb_connect` is requiring `vusb_responses` for some control requests. I have a hunch, so let's dig into `drivers/media/usb/pvrusb2/pvrusb2-main.c` and check `pvr2_probe`.

requested entity does not exist

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-main.c IncludeLines:true Name:pvr2_probe]

map[SourceCode: SourceFile:]

gemini-3-pro-preview

							input: 238595
							output: 52
							thoughts: 10
						

Okay, here's my attempt at summarizing that thought process, tailored for an expert audience:

**Analyzing the Need for `pvr_probe`**

Alright, the initial thought process is straightforward: we need to investigate the functionality of `pvr_probe`. My immediate assumption is that this is likely a utility, function, or module used for probing or detecting some aspect of the system. Given the naming convention, it suggests interaction with the "PVR" or "PowerVR" hardware, which are popular in embedded and mobile graphics processing.

My next line of thinking will likely delve into:

*   **Its purpose:** What specific information is `pvr_probe` designed to gather? Is it device-specific data, driver information, hardware capabilities, or debugging information?
*   **Implementation:** How is `pvr_probe` implemented? Is it part of the kernel drivers, a user-space utility, or something else entirely?
*   **Usage Context:** Where and when is `pvr_probe` intended to be used? Is it part of the boot process, a diagnostic tool, or a component of runtime graphics management?
*   **Available Documentation:** Are there any existing sources like kernel documentation, driver source code, or online resources that can quickly shed light on its functionality?
*   **Expected Results:** What kind of data or output should I expect from running or examining `pvr_probe`? This helps create a baseline expectation for the investigation.

Essentially, I'm setting a mental checklist to efficiently start and narrow down my understanding of this function. I'll need to know what it does, how it works, and how to verify its output. This approach allows me to quickly assess the context in which I'll be investigating `pvr_probe`.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-main.c IncludeLines:true Name:pvr_probe]

map[SourceCode:  48:	static int pvr_probe(struct usb_interface *intf,
  49:			     const struct usb_device_id *devid)
  50:	{
  51:		struct pvr2_context *pvr;
  52:	
  53:		/* Create underlying hardware interface */
  54:		pvr = pvr2_context_create(intf,devid,pvr_setup_attach);
  55:		if (!pvr) {
  56:			pvr2_trace(PVR2_TRACE_ERROR_LEGS,
  57:				   "Failed to create hdw handler");
  58:			return -ENOMEM;
  59:		}
  60:	
  61:		pvr2_trace(PVR2_TRACE_INIT,"pvr_probe(pvr=%p)",pvr);
  62:	
  63:		usb_set_intfdata(intf, pvr);
  64:	
  65:		return 0;
  66:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-main.c]

gemini-3-pro-preview

							input: 239338
							output: 60
							thoughts: 1079
						

**Analyzing the PVR Probe Sequence**

Okay, let's break this down. `pvr_probe` is straightforward; it calls `pvr2_context_create`. Inside `pvr2_context_create`, `pvr2_hdw_create` is invoked. It looks like `pvr2_hdw_create` is where things get interesting because it calls `usb_set_interface`. This in turn, sends a `USB_REQ_SET_INTERFACE` control request.  The critical point here is understanding how this control request is handled.

Initially, I was thinking the dummy HCD takes care of `USB_REQ_SET_INTERFACE` automatically. Specifically, if there are no `vusb_responses` provided. And, with `syz_usb_connect` not providing `vusb_responses`, I got confused. But now I see the problem. `syz_usb_connect` only handles the initial enumeration process, things like `GET_DESCRIPTOR` and `SET_CONFIGURATION`. After this initial setup, any subsequent control requests get sent to the vhci device. If we *don't* have a `syz_usb_control_io` call pending, the vhci device is going to error out or timeout. I need to make sure I am sending a response back to the device.

So, since `usb_set_interface` is a standard request, the vhci device will need a response. I confirmed this by checking `drivers/usb/core/message.c` which shows that `usb_set_interface` sends a control message to the device. The conclusion is clear: without a `syz_usb_control_io` providing a response, this is going to fail. I must add a call to `syz_usb_control_io`!

The simplest approach seems to be to add:

```
r0 = syz_usb_connect(...)
syz_usb_control_io(r0, 0, 0)
```

However, I've got to consider what arguments to use. `syz_usb_control_io` takes `descs` and `resps`. Since I just need to reply to `USB_REQ_SET_INTERFACE`, I can probably just provide a generic response. Alternatively, there is a `syz_usb_control_io$pvrusb2` option, but that isn't available to me. I'll need to use `syz_usb_control_io`. From the `vusb.txt` documentation:

```
syz_usb_control_io(fd fd_usb, descs ptr[in, vusb_descriptors], resps ptr[in, vusb_responses])
```

It seems I can give it empty `descs` and `resps`. Wait, hold on... if `resps` is empty, it won't reply to anything. If the vhci device gets a control request and there's no matching response in `resps`, it will return an error (stall)!

Okay, let's step back for a moment. What happens if the `usb_set_interface` *fails*? I see in the code:

```c
	ifnum = hdw->usb_intf->cur_altsetting->desc.bInterfaceNumber;
	usb_set_interface(hdw->usb_dev,ifnum,0);

	mutex_init(&hdw->ctl_lock_mutex);
	mutex_init(&hdw->big_lock_mutex);

	return hdw;
```

It looks like `pvr2_hdw_create` *doesn't* check the return value of `usb_set_interface`! That's... interesting. The function call will succeed even if `usb_set_interface` fails.

Now, what about `pvr2_hdw_check_firmware`? Does that send a control request? No, it's sending a BULK request. It calls `pvr2_send_request_ex`:

```c
		hdw->cmd_buffer[0] = FX2CMD_GET_EEPROM_ADDR;
		result = pvr2_send_request_ex(hdw,HZ*1,!0,
					   hdw->cmd_buffer,1,
					   hdw->cmd_buffer,1);
```

This uses `usb_fill_bulk_urb` and `usb_submit_urb`, so it's a BULK request. Bulk requests are handled by `syz_usb_ep_write` and `syz_usb_ep_read`. I don't need `syz_usb_control_io` for this.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c IncludeLines:true Name:pvr2_hdw_cmd_powerup]

map[SourceCode:4006:	int pvr2_hdw_cmd_powerup(struct pvr2_hdw *hdw)
4007:	{
4008:		return pvr2_issue_simple_cmd(hdw,FX2CMD_POWER_ON);
4009:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-hdw.c]

gemini-3-pro-preview

							input: 241621
							output: 22
							thoughts: 1985
						

**Analyzing the `pvrusb2` I2C Implementation for Potential USB Bulk Request Timeout Issues**

Okay, so here's the breakdown of my thinking. Initially, I noticed that `pvr2_issue_simple_cmd` uses `pvr2_send_request`, a BULK request. This seemed to be a pattern throughout `pvrusb2`, where BULK requests are extensively used. But then I looked at `pvr2_i2c_core_init` and thought, "Wait, is this I2C initialization also based on BULK requests?".

It turned out that it registers the I2C adapter directly. However, it calls `pvr2_i2c_register_ir`, which in turn calls `i2c_new_client_device`. This made me wonder if this probing process by `i2c_new_client_device` could be problematic. I confirmed that it calls the I2C driver's `probe` function. In the case of `ir_video`, the driver used is `ir-kbd-i2c`.

I then investigated `ir_probe` in `drivers/media/i2c/ir-kbd-i2c.c`. Specifically, I noticed it might create a dummy I2C device with `i2c_new_dummy_device`, but importantly, only if `probe_tx` is true. For the specific case of `PVR2_IR_SCHEME_29XXX` devices, it *doesn't* call `zilog_init`. Instead, it registers an `ir_video` device at address `0x18`. It uses `i2c_new_client_device`, and doesn't call `zilog_init` because `probe_tx` is false for this address. Instead, it registers an input device and starts `ir_work`.

`ir_work` periodically polls by calling `get_key_haup`, which calls `i2c_master_recv`, which calls `pvr2_i2c_xfer`, which in turn calls `pvr2_i2c_read`. And here's the critical point: `pvr2_i2c_read` uses BULK OUT and BULK IN requests through `pvr2_send_request`. Now I was focusing on potential timeout issues if these BULK IN requests aren't handled.

`pvr2_send_request` has a 4-second timeout. If the BULK IN request times out, it returns `-ETIMEDOUT`, which bubbles up through `pvr2_i2c_read`, `get_key_haup`, and `ir_key_poll`, ultimately causing `ir_work` to reschedule itself with `ir_work` - `-EIO`. This looked like a potential infinite loop of 4-second delays, but it won't block `pvr2_hdw_setup_low`.

I then looked at `pvr2_hdw_get_eeprom_addr`. It *also* uses BULK OUT/IN requests, but with a 1-second timeout. If this times out, `pvr2_hdw_setup_low` proceeds, skipping `pvr2_eeprom_analyze`, and the I2C adapter *is* registered.

Now, I was trying to understand why the crash wasn't reproducing. I suspected that maybe `syzkaller` wasn't properly opening the I2C device. I checked the `syz_open_dev$I2C` usage. It appeared to wait for the device to appear.

`syz_open_dev` is a pseudo-syscall that does a retry loop! It will wait 100ms for `/dev/i2c-#` to appear. My next thought was 100ms may not be enough, especially since `pvr2_hdw_check_firmware` could take a second.

Then I realized a critical detail: In `pvr2_hdw_check_firmware`, we *did* reply to the first request with `syz_usb_ep_write`. This means the check finishes almost immediately. After that, `pvr2_hdw_cmd_powerup` *also* completes quickly (it's just a BULK OUT). So `pvr2_i2c_core_init` is called, and the I2C adapter gets registered *almost immediately*. Then `pvr2_hdw_get_eeprom_addr` blocks for 1 second due to the unreplied BULK IN request.

Crucially, the syzkaller thread is sleeping in `nanosleep` for 2 seconds *during* this 1

map[Expression:CONFIG_I2C_CHARDEV]

map[Output:
Full output is too long, showing 500 out of 501 lines.
Use more precise expression if possible.

[arch/arc/configs/axs101_defconfig=67=CONFIG_I2C=y
 arch/arc/configs/axs101_defconfig:68:CONFIG_I2C_CHARDEV=y
 arch/arc/configs/axs101_defconfig-69-CONFIG_I2C_DESIGNWARE_CORE=y
 --
 arch/arc/configs/axs103_defconfig=67=CONFIG_I2C=y
 arch/arc/configs/axs103_defconfig:68:CONFIG_I2C_CHARDEV=y
 arch/arc/configs/axs103_defconfig-69-CONFIG_I2C_DESIGNWARE_CORE=y
 --
 arch/arc/configs/axs103_smp_defconfig=67=CONFIG_I2C=y
 arch/arc/configs/axs103_smp_defconfig:68:CONFIG_I2C_CHARDEV=y
 arch/arc/configs/axs103_smp_defconfig-69-CONFIG_I2C_DESIGNWARE_CORE=y
 --
 arch/arm/configs/aspeed_g4_defconfig=129=CONFIG_HW_RANDOM_TIMERIOMEM=y
 arch/arm/configs/aspeed_g4_defconfig-130-# CONFIG_I2C_COMPAT is not set
 arch/arm/configs/aspeed_g4_defconfig:131:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/aspeed_g4_defconfig-132-CONFIG_I2C_MUX_PCA9541=y
 --
 arch/arm/configs/aspeed_g5_defconfig=156=CONFIG_TCG_TIS_I2C=y
 arch/arm/configs/aspeed_g5_defconfig-157-# CONFIG_I2C_COMPAT is not set
 arch/arm/configs/aspeed_g5_defconfig:158:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/aspeed_g5_defconfig-159-CONFIG_I2C_MUX_GPIO=y
 --
 arch/arm/configs/at91_dt_defconfig=113=CONFIG_HW_RANDOM=y
 arch/arm/configs/at91_dt_defconfig:114:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/at91_dt_defconfig-115-CONFIG_I2C_AT91=y
 --
 arch/arm/configs/axm55xx_defconfig=132=CONFIG_I2C=y
 arch/arm/configs/axm55xx_defconfig:133:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/axm55xx_defconfig-134-CONFIG_I2C_MUX=y
 --
 arch/arm/configs/bcm2835_defconfig=87=CONFIG_TTY_PRINTK=y
 arch/arm/configs/bcm2835_defconfig:88:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/bcm2835_defconfig-89-CONFIG_I2C_BCM2835=y
 --
 arch/arm/configs/davinci_all_defconfig=112=CONFIG_I2C=y
 arch/arm/configs/davinci_all_defconfig:113:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/davinci_all_defconfig-114-CONFIG_I2C_DAVINCI=y
 --
 arch/arm/configs/dove_defconfig=67=CONFIG_I2C=y
 arch/arm/configs/dove_defconfig:68:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/dove_defconfig-69-CONFIG_I2C_MV64XXX=y
 --
 arch/arm/configs/ep93xx_defconfig=70=CONFIG_I2C=y
 arch/arm/configs/ep93xx_defconfig:71:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/ep93xx_defconfig-72-CONFIG_I2C_GPIO=y
 --
 arch/arm/configs/exynos_defconfig=134=CONFIG_TCG_TIS_I2C_INFINEON=y
 arch/arm/configs/exynos_defconfig:135:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/exynos_defconfig-136-CONFIG_I2C_MUX=y
 --
 arch/arm/configs/imx_v4_v5_defconfig=79=CONFIG_SERIAL_IMX_CONSOLE=y
 arch/arm/configs/imx_v4_v5_defconfig-80-# CONFIG_HW_RANDOM is not set
 arch/arm/configs/imx_v4_v5_defconfig:81:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/imx_v4_v5_defconfig-82-CONFIG_I2C_IMX=y
 --
 arch/arm/configs/imx_v6_v7_defconfig=191=CONFIG_SERIAL_DEV_BUS=y
 arch/arm/configs/imx_v6_v7_defconfig:192:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/imx_v6_v7_defconfig-193-CONFIG_I2C_MUX_GPIO=y
 --
 arch/arm/configs/ixp4xx_defconfig=131=CONFIG_HW_RANDOM=y
 arch/arm/configs/ixp4xx_defconfig:132:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/ixp4xx_defconfig-133-CONFIG_I2C_GPIO=y
 --
 arch/arm/configs/keystone_defconfig=146=CONFIG_I2C=y
 arch/arm/configs/keystone_defconfig-147-# CONFIG_I2C_COMPAT is not set
 arch/arm/configs/keystone_defconfig:148:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/keystone_defconfig-149-CONFIG_I2C_DAVINCI=y
 --
 arch/arm/configs/lpc32xx_defconfig=87=CONFIG_SERIAL_HS_LPC32XX_CONSOLE=y
 arch/arm/configs/lpc32xx_defconfig-88-# CONFIG_HW_RANDOM is not set
 arch/arm/configs/lpc32xx_defconfig:89:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/lpc32xx_defconfig-90-CONFIG_I2C_PNX=y
 --
 arch/arm/configs/multi_v5_defconfig=136=CONFIG_HW_RANDOM_TIMERIOMEM=m
 arch/arm/configs/multi_v5_defconfig-137-# CONFIG_I2C_COMPAT is not set
 arch/arm/configs/multi_v5_defconfig:138:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/multi_v5_defconfig-139-CONFIG_I2C_ASPEED=m
 --
 arch/arm/configs/multi_v7_defconfig=404=CONFIG_TCG_TIS_I2C_INFINEON=m
 arch/arm/configs/multi_v7_defconfig:405:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/multi_v7_defconfig-406-CONFIG_I2C_ARB_GPIO_CHALLENGE=m
 --
 arch/arm/configs/mv78xx0_defconfig=70=CONFIG_I2C=y
 arch/arm/configs/mv78xx0_defconfig:71:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/mv78xx0_defconfig-72-CONFIG_I2C_MV64XXX=y
 --
 arch/arm/configs/mvebu_v5_defconfig=98=CONFIG_I2C=y
 arch/arm/configs/mvebu_v5_defconfig-99-# CONFIG_I2C_COMPAT is not set
 arch/arm/configs/mvebu_v5_defconfig:100:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/mvebu_v5_defconfig-101-CONFIG_I2C_MV64XXX=y
 --
 arch/arm/configs/mvebu_v7_defconfig=75=CONFIG_I2C=y
 arch/arm/configs/mvebu_v7_defconfig:76:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/mvebu_v7_defconfig-77-CONFIG_I2C_MV64XXX=y
 --
 arch/arm/configs/mxs_defconfig=76=CONFIG_SERIAL_MXS_AUART=y
 arch/arm/configs/mxs_defconfig-77-# CONFIG_HW_RANDOM is not set
 arch/arm/configs/mxs_defconfig:78:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/mxs_defconfig-79-CONFIG_I2C_MXS=y
 --
 arch/arm/configs/neponset_defconfig=56=CONFIG_I2C=y
 arch/arm/configs/neponset_defconfig:57:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/neponset_defconfig-58-CONFIG_WATCHDOG=y
 --
 arch/arm/configs/nhk8815_defconfig=84=CONFIG_HW_RANDOM=y
 arch/arm/configs/nhk8815_defconfig:85:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/nhk8815_defconfig-86-CONFIG_I2C_GPIO=y
 --
 arch/arm/configs/omap1_defconfig=124=CONFIG_I2C=y
 arch/arm/configs/omap1_defconfig:125:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/omap1_defconfig-126-CONFIG_SPI=y
 --
 arch/arm/configs/omap2plus_defconfig=405=CONFIG_SERIAL_DEV_BUS=y
 arch/arm/configs/omap2plus_defconfig:406:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/omap2plus_defconfig-407-CONFIG_SPI=y
 --
 arch/arm/configs/orion5x_defconfig=85=CONFIG_I2C=y
 arch/arm/configs/orion5x_defconfig-86-# CONFIG_I2C_COMPAT is not set
 arch/arm/configs/orion5x_defconfig:87:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/orion5x_defconfig-88-CONFIG_I2C_MV64XXX=y
 --
 arch/arm/configs/pxa_defconfig=276=CONFIG_HW_RANDOM=y
 arch/arm/configs/pxa_defconfig:277:CONFIG_I2C_CHARDEV=m
 arch/arm/configs/pxa_defconfig-278-CONFIG_I2C_MUX_PCA954x=m
 --
 arch/arm/configs/qcom_defconfig=120=CONFIG_I2C=y
 arch/arm/configs/qcom_defconfig:121:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/qcom_defconfig-122-CONFIG_I2C_QUP=y
 --
 arch/arm/configs/rpc_defconfig=65=CONFIG_I2C=y
 arch/arm/configs/rpc_defconfig:66:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/rpc_defconfig-67-# CONFIG_HWMON is not set
 --
 arch/arm/configs/s3c6400_defconfig=21=CONFIG_I2C=y
 arch/arm/configs/s3c6400_defconfig:22:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/s3c6400_defconfig-23-CONFIG_I2C_S3C2410=y
 --
 arch/arm/configs/sama5_defconfig=119=CONFIG_HW_RANDOM=y
 arch/arm/configs/sama5_defconfig:120:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/sama5_defconfig-121-CONFIG_I2C_AT91=y
 --
 arch/arm/configs/sama7_defconfig=115=CONFIG_I2C=y
 arch/arm/configs/sama7_defconfig:116:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/sama7_defconfig-117-CONFIG_I2C_AT91=y
 --
 arch/arm/configs/shmobile_defconfig=85=CONFIG_SERIAL_SH_SCI=y
 arch/arm/configs/shmobile_defconfig:86:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/shmobile_defconfig-87-CONFIG_I2C_DEMUX_PINCTRL=y
 --
 arch/arm/configs/socfpga_defconfig=84=CONFIG_I2C=y
 arch/arm/configs/socfpga_defconfig:85:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/socfpga_defconfig-86-CONFIG_I2C_DESIGNWARE_CORE=y
 --
 arch/arm/configs/stm32_defconfig=44=CONFIG_I2C=y
 arch/arm/configs/stm32_defconfig:45:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/stm32_defconfig-46-CONFIG_I2C_STM32F4=y
 --
 arch/arm/configs/sunxi_defconfig=69=CONFIG_SERIAL_OF_PLATFORM=y
 arch/arm/configs/sunxi_defconfig-70-# CONFIG_HW_RANDOM is not set
 arch/arm/configs/sunxi_defconfig:71:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/sunxi_defconfig-72-CONFIG_I2C_MV64XXX=y
 --
 arch/arm/configs/tegra_defconfig=132=CONFIG_SERIAL_DEV_BUS=y
 --
 arch/arm/configs/tegra_defconfig-134-# CONFIG_I2C_COMPAT is not set
 arch/arm/configs/tegra_defconfig:135:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/tegra_defconfig-136-CONFIG_I2C_MUX_GPIO=y
 --
 arch/arm/configs/versatile_defconfig=49=CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 arch/arm/configs/versatile_defconfig:50:CONFIG_I2C_CHARDEV=m
 arch/arm/configs/versatile_defconfig-51-CONFIG_I2C_VERSATILE=y
 --
 arch/arm/configs/wpcm450_defconfig=117=CONFIG_I2C=y
 arch/arm/configs/wpcm450_defconfig-118-# CONFIG_I2C_COMPAT is not set
 arch/arm/configs/wpcm450_defconfig:119:CONFIG_I2C_CHARDEV=y
 arch/arm/configs/wpcm450_defconfig-120-CONFIG_I2C_MUX=y
 --
 arch/arm64/configs/defconfig=537=CONFIG_TCG_TIS_I2C_INFINEON=y
 arch/arm64/configs/defconfig:538:CONFIG_I2C_CHARDEV=y
 arch/arm64/configs/defconfig-539-CONFIG_I2C_MUX=y
 --
 arch/loongarch/configs/loongson32_defconfig=731=CONFIG_HW_RANDOM_VIRTIO=m
 arch/loongarch/configs/loongson32_defconfig:732:CONFIG_I2C_CHARDEV=y
 arch/loongarch/configs/loongson32_defconfig-733-CONFIG_I2C_PIIX4=y
 --
 arch/loongarch/configs/loongson64_defconfig=753=CONFIG_TCG_LOONGSON=m
 arch/loongarch/configs/loongson64_defconfig:754:CONFIG_I2C_CHARDEV=y
 arch/loongarch/configs/loongson64_defconfig-755-CONFIG_I2C_PIIX4=y
 --
 arch/m68k/configs/amcore_defconfig=63=CONFIG_I2C=y
 arch/m68k/configs/amcore_defconfig-64-# CONFIG_I2C_COMPAT is not set
 arch/m68k/configs/amcore_defconfig:65:CONFIG_I2C_CHARDEV=y
 arch/m68k/configs/amcore_defconfig-66-# CONFIG_I2C_HELPER_AUTO is not set
 --
 arch/m68k/configs/amiga_defconfig=410=CONFIG_I2C=m
 arch/m68k/configs/amiga_defconfig:411:CONFIG_I2C_CHARDEV=m
 arch/m68k/configs/amiga_defconfig-412-CONFIG_I2C_ICY=m
 --
 arch/m68k/configs/multi_defconfig=466=CONFIG_I2C=m
 arch/m68k/configs/multi_defconfig:467:CONFIG_I2C_CHARDEV=m
 arch/m68k/configs/multi_defconfig-468-CONFIG_I2C_ICY=m
 --
 arch/mips/configs/bigsur_defconfig=136=CONFIG_I2C=y
 arch/mips/configs/bigsur_defconfig:137:CONFIG_I2C_CHARDEV=y
 arch/mips/configs/bigsur_defconfig-138-CONFIG_I2C_SIBYTE=y
 --
 arch/mips/configs/db1xxx_defconfig=124=CONFIG_I2C=y
 arch/mips/configs/db1xxx_defconfig:125:CONFIG_I2C_CHARDEV=y
 arch/mips/configs/db1xxx_defconfig-126-CONFIG_I2C_AU1550=y
 --
 arch/mips/configs/eyeq5_defconfig=65=CONFIG_I2C=y
 arch/mips/configs/eyeq5_defconfig:66:CONFIG_I2C_CHARDEV=y
 arch/mips/configs/eyeq5_defconfig-67-CONFIG_I2C_NOMADIK=y
 --
 arch/mips/configs/eyeq6_defconfig=67=CONFIG_I2C=y
 arch/mips/configs/eyeq6_defconfig:68:CONFIG_I2C_CHARDEV=y
 arch/mips/configs/eyeq6_defconfig-69-# CONFIG_PTP_1588_CLOCK is not set
 --
 arch/mips/configs/fuloong2e_defconfig=135=CONFIG_I2C=m
 arch/mips/configs/fuloong2e_defconfig:136:CONFIG_I2C_CHARDEV=m
 arch/mips/configs/fuloong2e_defconfig-137-CONFIG_I2C_VIAPRO=m
 --
 arch/mips/configs/generic/board-ocelot.config=31=CONFIG_I2C=y
 arch/mips/configs/generic/board-ocelot.config:32:CONFIG_I2C_CHARDEV=y
 arch/mips/configs/generic/board-ocelot.config-33-CONFIG_I2C_MUX=y
 --
 arch/mips/configs/generic/board-xilfpga.config=11=CONFIG_I2C=y
 arch/mips/configs/generic/board-xilfpga.config:12:CONFIG_I2C_CHARDEV=y
 arch/mips/configs/generic/board-xilfpga.config-13-CONFIG_I2C_XILINX=y
 --
 arch/mips/configs/gpr_defconfig=224=CONFIG_I2C=y
 arch/mips/configs/gpr_defconfig:225:CONFIG_I2C_CHARDEV=y
 arch/mips/configs/gpr_defconfig-226-CONFIG_I2C_GPIO=y
 --
 arch/mips/configs/ip27_defconfig=234=CONFIG_HW_RANDOM_TIMERIOMEM=m
 arch/mips/configs/ip27_defconfig:235:CONFIG_I2C_CHARDEV=m
 arch/mips/configs/ip27_defconfig-236-CONFIG_I2C_ALI1535=m
 --
 arch/mips/configs/loongson2k_defconfig=228=CONFIG_HW_RANDOM=y
 arch/mips/configs/loongson2k_defconfig:229:CONFIG_I2C_CHARDEV=y
 arch/mips/configs/loongson2k_defconfig-230-CONFIG_I2C_PIIX4=y
 --
 arch/mips/configs/loongson3_defconfig=260=CONFIG_HW_RANDOM=y
 arch/mips/configs/loongson3_defconfig:261:CONFIG_I2C_CHARDEV=y
 arch/mips/configs/loongson3_defconfig-262-CONFIG_I2C_PIIX4=y
 --
 arch/mips/configs/mtx1_defconfig=383=CONFIG_I2C=m
 arch/mips/configs/mtx1_defconfig:384:CONFIG_I2C_CHARDEV=m
 arch/mips/configs/mtx1_defconfig-385-CONFIG_I2C_GPIO=m
 --
 arch/powerpc/configs/44x/akebono_defconfig=91=CONFIG_SERIAL_OF_PLATFORM=y
 arch/powerpc/configs/44x/akebono_defconfig-92-# CONFIG_HW_RANDOM is not set
 arch/powerpc/configs/44x/akebono_defconfig:93:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/44x/akebono_defconfig-94-# CONFIG_HWMON is not set
 --
 arch/powerpc/configs/44x/arches_defconfig=45=CONFIG_I2C=y
 arch/powerpc/configs/44x/arches_defconfig:46:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/44x/arches_defconfig-47-CONFIG_I2C_IBM_IIC=y
 --
 arch/powerpc/configs/44x/bluestone_defconfig=41=CONFIG_I2C=y
 arch/powerpc/configs/44x/bluestone_defconfig:42:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/44x/bluestone_defconfig-43-CONFIG_I2C_IBM_IIC=y
 --
 arch/powerpc/configs/44x/canyonlands_defconfig=47=CONFIG_I2C=y
 arch/powerpc/configs/44x/canyonlands_defconfig:48:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/44x/canyonlands_defconfig-49-CONFIG_I2C_IBM_IIC=y
 --
 arch/powerpc/configs/44x/eiger_defconfig=56=CONFIG_I2C=y
 arch/powerpc/configs/44x/eiger_defconfig:57:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/44x/eiger_defconfig-58-CONFIG_I2C_IBM_IIC=y
 --
 arch/powerpc/configs/44x/icon_defconfig=54=CONFIG_I2C=y
 arch/powerpc/configs/44x/icon_defconfig:55:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/44x/icon_defconfig-56-CONFIG_I2C_IBM_IIC=y
 --
 arch/powerpc/configs/44x/redwood_defconfig=55=CONFIG_I2C=y
 arch/powerpc/configs/44x/redwood_defconfig:56:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/44x/redwood_defconfig-57-CONFIG_I2C_IBM_IIC=y
 --
 arch/powerpc/configs/52xx/cm5200_defconfig=50=CONFIG_I2C=y
 arch/powerpc/configs/52xx/cm5200_defconfig:51:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/52xx/cm5200_defconfig-52-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/52xx/lite5200b_defconfig=47=CONFIG_I2C=y
 arch/powerpc/configs/52xx/lite5200b_defconfig:48:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/52xx/lite5200b_defconfig-49-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/52xx/motionpro_defconfig=60=CONFIG_I2C=y
 arch/powerpc/configs/52xx/motionpro_defconfig:61:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/52xx/motionpro_defconfig-62-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/52xx/pcm030_defconfig=55=CONFIG_I2C=y
 arch/powerpc/configs/52xx/pcm030_defconfig:56:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/52xx/pcm030_defconfig-57-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/52xx/tqm5200_defconfig=54=CONFIG_I2C=y
 arch/powerpc/configs/52xx/tqm5200_defconfig:55:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/52xx/tqm5200_defconfig-56-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/83xx/asp8347_defconfig=51=CONFIG_I2C=y
 arch/powerpc/configs/83xx/asp8347_defconfig:52:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/83xx/asp8347_defconfig-53-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/83xx/kmeter1_defconfig=55=CONFIG_I2C=y
 arch/powerpc/configs/83xx/kmeter1_defconfig:56:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/83xx/kmeter1_defconfig-57-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/83xx/mpc8313_rdb_defconfig=57=CONFIG_I2C=y
 arch/powerpc/configs/83xx/mpc8313_rdb_defconfig:58:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/83xx/mpc8313_rdb_defconfig-59-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/83xx/mpc8315_rdb_defconfig=56=CONFIG_I2C=y
 arch/powerpc/configs/83xx/mpc8315_rdb_defconfig:57:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/83xx/mpc8315_rdb_defconfig-58-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/83xx/mpc832x_rdb_defconfig=47=CONFIG_I2C=y
 arch/powerpc/configs/83xx/mpc832x_rdb_defconfig:48:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/83xx/mpc832x_rdb_defconfig-49-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/83xx/mpc834x_itx_defconfig=58=CONFIG_I2C=y
 arch/powerpc/configs/83xx/mpc834x_itx_defconfig:59:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/83xx/mpc834x_itx_defconfig-60-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/83xx/mpc834x_itxgp_defconfig=50=CONFIG_I2C=y
 arch/powerpc/configs/83xx/mpc834x_itxgp_defconfig:51:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/83xx/mpc834x_itxgp_defconfig-52-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/83xx/mpc836x_rdk_defconfig=47=CONFIG_I2C=y
 arch/powerpc/configs/83xx/mpc836x_rdk_defconfig:48:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/83xx/mpc836x_rdk_defconfig-49-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/83xx/mpc837x_rdb_defconfig=48=CONFIG_I2C=y
 arch/powerpc/configs/83xx/mpc837x_rdb_defconfig:49:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/83xx/mpc837x_rdb_defconfig-50-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/85xx-hw.config=47=CONFIG_HID_SUNPLUS=y
 arch/powerpc/configs/85xx-hw.config:48:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/85xx-hw.config-49-CONFIG_I2C_CPM=m
 --
 arch/powerpc/configs/85xx/ge_imp3a_defconfig=121=CONFIG_I2C=y
 arch/powerpc/configs/85xx/ge_imp3a_defconfig:122:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/85xx/ge_imp3a_defconfig-123-CONFIG_I2C_CPM=m
 --
 arch/powerpc/configs/85xx/socrates_defconfig=58=CONFIG_I2C=y
 arch/powerpc/configs/85xx/socrates_defconfig:59:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/85xx/socrates_defconfig-60-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/85xx/stx_gp3_defconfig=46=CONFIG_PRINTER=m
 arch/powerpc/configs/85xx/stx_gp3_defconfig:47:CONFIG_I2C_CHARDEV=m
 arch/powerpc/configs/85xx/stx_gp3_defconfig-48-CONFIG_AGP=m
 --
 arch/powerpc/configs/85xx/tqm8540_defconfig=45=CONFIG_I2C=y
 arch/powerpc/configs/85xx/tqm8540_defconfig:46:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/85xx/tqm8540_defconfig-47-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/85xx/tqm8541_defconfig=47=CONFIG_I2C=y
 arch/powerpc/configs/85xx/tqm8541_defconfig:48:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/85xx/tqm8541_defconfig-49-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/85xx/tqm8548_defconfig=52=CONFIG_I2C=y
 arch/powerpc/configs/85xx/tqm8548_defconfig:53:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/85xx/tqm8548_defconfig-54-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/85xx/tqm8555_defconfig=47=CONFIG_I2C=y
 arch/powerpc/configs/85xx/tqm8555_defconfig:48:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/85xx/tqm8555_defconfig-49-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/85xx/tqm8560_defconfig=47=CONFIG_I2C=y
 arch/powerpc/configs/85xx/tqm8560_defconfig:48:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/85xx/tqm8560_defconfig-49-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/85xx/xes_mpc85xx_defconfig=96=CONFIG_I2C=y
 arch/powerpc/configs/85xx/xes_mpc85xx_defconfig:97:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/85xx/xes_mpc85xx_defconfig-98-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/g5_defconfig=116=CONFIG_INPUT_EVDEV=y
 --
 arch/powerpc/configs/g5_defconfig-121-# CONFIG_HW_RANDOM is not set
 arch/powerpc/configs/g5_defconfig:122:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/g5_defconfig-123-CONFIG_AGP=m
 --
 arch/powerpc/configs/linkstation_defconfig=88=CONFIG_I2C=y
 arch/powerpc/configs/linkstation_defconfig:89:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/linkstation_defconfig-90-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/mgcoge_defconfig=52=CONFIG_I2C=y
 arch/powerpc/configs/mgcoge_defconfig:53:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/mgcoge_defconfig-54-CONFIG_I2C_CPM=y
 --
 arch/powerpc/configs/mpc512x_defconfig=77=CONFIG_I2C=y
 arch/powerpc/configs/mpc512x_defconfig:78:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/mpc512x_defconfig-79-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/mpc5200_defconfig=56=CONFIG_SERIAL_MPC52xx_CONSOLE_BAUD=115200
 arch/powerpc/configs/mpc5200_defconfig-57-# CONFIG_HW_RANDOM is not set
 arch/powerpc/configs/mpc5200_defconfig:58:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/mpc5200_defconfig-59-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/mpc83xx_defconfig=66=CONFIG_I2C=y
 arch/powerpc/configs/mpc83xx_defconfig:67:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/mpc83xx_defconfig-68-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/mvme5100_defconfig=80=CONFIG_I2C=y
 arch/powerpc/configs/mvme5100_defconfig:81:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/mvme5100_defconfig-82-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/pasemi_defconfig=94=CONFIG_HW_RANDOM=y
 arch/powerpc/configs/pasemi_defconfig:95:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/pasemi_defconfig-96-CONFIG_I2C_PASEMI=y
 --
 arch/powerpc/configs/pmac32_defconfig=180=CONFIG_NVRAM=y
 arch/powerpc/configs/pmac32_defconfig:181:CONFIG_I2C_CHARDEV=m
 arch/powerpc/configs/pmac32_defconfig-182-CONFIG_POWER_RESET=y
 --
 arch/powerpc/configs/powernv_defconfig=196=CONFIG_IPMI_POWERNV=y
 arch/powerpc/configs/powernv_defconfig-197-# CONFIG_DEVPORT is not set
 arch/powerpc/configs/powernv_defconfig:198:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/powernv_defconfig-199-# CONFIG_PTP_1588_CLOCK is not set
 --
 arch/powerpc/configs/ppc44x_defconfig=66=CONFIG_I2C=m
 arch/powerpc/configs/ppc44x_defconfig:67:CONFIG_I2C_CHARDEV=m
 arch/powerpc/configs/ppc44x_defconfig-68-CONFIG_I2C_GPIO=m
 --
 arch/powerpc/configs/ppc64_defconfig=250=CONFIG_IBM_BSR=m
 arch/powerpc/configs/ppc64_defconfig:251:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/ppc64_defconfig-252-CONFIG_I2C_AMD8111=y
 --
 arch/powerpc/configs/ppc64e_defconfig=118=CONFIG_SERIAL_8250_CONSOLE=y
 arch/powerpc/configs/ppc64e_defconfig-119-# CONFIG_HW_RANDOM is not set
 arch/powerpc/configs/ppc64e_defconfig:120:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/ppc64e_defconfig-121-CONFIG_I2C_AMD8111=y
 --
 arch/powerpc/configs/ppc6xx_defconfig=603=CONFIG_IPWIRELESS=m
 arch/powerpc/configs/ppc6xx_defconfig:604:CONFIG_I2C_CHARDEV=m
 arch/powerpc/configs/ppc6xx_defconfig-605-CONFIG_I2C_HYDRA=m
 --
 arch/powerpc/configs/skiroot_defconfig=209=CONFIG_I2C=y
 arch/powerpc/configs/skiroot_defconfig-210-# CONFIG_I2C_COMPAT is not set
 arch/powerpc/configs/skiroot_defconfig:211:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/skiroot_defconfig-212-# CONFIG_I2C_HELPER_AUTO is not set
 --
 arch/powerpc/configs/storcenter_defconfig=57=CONFIG_I2C=y
 arch/powerpc/configs/storcenter_defconfig:58:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/storcenter_defconfig-59-CONFIG_I2C_MPC=y
 --
 arch/powerpc/configs/wii_defconfig=67=CONFIG_I2C=y
 arch/powerpc/configs/wii_defconfig:68:CONFIG_I2C_CHARDEV=y
 arch/powerpc/configs/wii_defconfig-69-CONFIG_I2C_GPIO=y
 --
 arch/riscv/configs/defconfig=157=CONFIG_I2C=y
 arch/riscv/configs/defconfig:158:CONFIG_I2C_CHARDEV=m
 arch/riscv/configs/defconfig-159-CONFIG_I2C_DESIGNWARE_CORE=y
 --
 arch/riscv/configs/nommu_k210_defconfig=57=CONFIG_I2C=y
 arch/riscv/configs/nommu_k210_defconfig:58:CONFIG_I2C_CHARDEV=y
 arch/riscv/configs/nommu_k210_defconfig-59-# CONFIG_I2C_HELPER_AUTO is not set
 --
 arch/riscv/configs/nommu_k210_sdcard_defconfig=50=CONFIG_I2C=y
 arch/riscv/configs/nommu_k210_sdcard_defconfig:51:CONFIG_I2C_CHARDEV=y
 arch/riscv/configs/nommu_k210_sdcard_defconfig-52-# CONFIG_I2C_HELPER_AUTO is not set
 --
 arch/sh/configs/ap325rxa_defconfig=56=CONFIG_I2C=y
 arch/sh/configs/ap325rxa_defconfig:57:CONFIG_I2C_CHARDEV=y
 arch/sh/configs/ap325rxa_defconfig-58-CONFIG_I2C_SH_MOBILE=y
 --
 arch/sh/configs/ecovec24_defconfig=61=CONFIG_I2C=y
 arch/sh/configs/ecovec24_defconfig:62:CONFIG_I2C_CHARDEV=y
 arch/sh/configs/ecovec24_defconfig-63-CONFIG_I2C_SH_MOBILE=y
 --
 arch/sh/configs/edosk7760_defconfig=70=CONFIG_I2C=y
 arch/sh/configs/edosk7760_defconfig:71:CONFIG_I2C_CHARDEV=y
 arch/sh/configs/edosk7760_defconfig-72-CONFIG_I2C_SH7760=y
 --
 arch/sh/configs/r7780mp_defconfig=67=CONFIG_I2C=y
 arch/sh/configs/r7780mp_defconfig:68:CONFIG_I2C_CHARDEV=y
 arch/sh/configs/r7780mp_defconfig-69-CONFIG_I2C_HIGHLANDER=y
 --
 arch/sh/configs/r7785rp_defconfig=61=CONFIG_I2C=y
 arch/sh/configs/r7785rp_defconfig:62:CONFIG_I2C_CHARDEV=y
 arch/sh/configs/r7785rp_defconfig-63-CONFIG_I2C_HIGHLANDER=y
 --
 arch/sh/configs/sdk7786_defconfig=138=CONFIG_I2C=y
 arch/sh/configs/sdk7786_defconfig-139-# CONFIG_I2C_COMPAT is not set
 arch/sh/configs/sdk7786_defconfig:140:CONFIG_I2C_CHARDEV=y
 arch/sh/configs/sdk7786_defconfig-141-CONFIG_SPI=y
 --
 arch/sh/configs/se7724_defconfig=60=CONFIG_I2C=y
 arch/sh/configs/se7724_defconfig:61:CONFIG_I2C_CHARDEV=y
 arch/sh/configs/se7724_defconfig-62-CONFIG_I2C_SH_MOBILE=y
 --
 arch/sh/configs/sh7724_generic_defconfig=28=CONFIG_I2C=y
 arch/sh/configs/sh7724_generic_defconfig:29:CONFIG_I2C_CHARDEV=y
 arch/sh/configs/sh7724_generic_defconfig-30-CONFIG_I2C_SH_MOBILE=y
 --
 arch/sh/configs/sh7770_generic_defconfig=30=CONFIG_I2C=y
 arch/sh/configs/sh7770_generic_defconfig:31:CONFIG_I2C_CHARDEV=y
 arch/sh/configs/sh7770_generic_defconfig-32-CONFIG_I2C_SH_MOBILE=y
 --
 drivers/i2c/Makefile=14=obj-$(CONFIG_I2C_SMBUS)		+= i2c-smbus.o
 drivers/i2c/Makefile:15:obj-$(CONFIG_I2C_CHARDEV)	+= i2c-dev.o
]
]

gemini-3-pro-preview

							input: 256245
							output: 693
							thoughts: 3485
						

**A Deep Dive into I2C Device Node Creation and USB Gadget Interaction**

Okay, so I've been digging into this I2C issue, and it's a bit more convoluted than I initially thought. It seems like the core problem lies in the timing between the creation of the I2C device node and the ability of `syz_open_dev` to access it. `CONFIG_I2C_CHARDEV` is enabled, which is good, but `syz_open_dev` has this pesky 100ms retry loop, which can easily be outpaced if the device node isn't ready in time, especially if the I2C adapter registration is delayed (like after 1 second). I initially thought the 2-second delay I implemented would fix it, and it *should* have, given my previous program, but clearly something else is at play.

The real snag is the interaction with USB. `syz_usb_connect` using `raw-gadget` introduces a dependency on a gadget driver, and the key realization is that this gadget driver requires a read operation to complete BULK OUT requests. So, if the syzkaller program doesn't actively *read* the data sent to the gadget driver (via `syz_usb_ep_read`), those BULK OUT transfers sit there, unfinished. This is *critical* because `pvr2_send_request_ex` within the `pvr2` driver, which handles the USB communication, is waiting for the URB to complete. Specifically, `pvr2_issue_simple_cmd` sends BULK OUT requests, and if they don't complete within 4 seconds, `pvr2_hdw_render_useless` is called, essentially marking the device as unusable. This makes `flag_ok` in `pvr2_hdw_dev_ok` become zero, and then `pvr2_hdw_setup_low` returns early, and `pvr2_i2c_core_init` is never reached.

The fix? We need to proactively consume those BULK OUT transfers using `syz_usb_ep_read`. There are a few key points: `pvr2_hdw_check_firmware`, `pvr2_hdw_cmd_powerup` send BULK OUT requests, but by using `syz_usb_ep_read`, we're essentially reading the data being sent to us from those URBs. In addition, we must also read the response from the `pvr2` driver using `syz_usb_ep_write` for its BULK IN requests.

So, the new plan is to use a program that includes multiple `syz_usb_ep_read` calls (one for each BULK OUT transfer) and a `syz_usb_ep_write` call. We'll use the `async` flag to read these requests in the background so that the code can continue execution and the requests won't block program flow. We'll then include the appropriate delay before calling `syz_open_dev`. I need to review and test the `syz_usb_ep_read` length argument - specifically that we can just pass AUTO and the correct size buffer, but overall, it's pretty clear that correctly handling USB URB completion is key to reproducing the I2C issue.

wrong string arg
line #1:36: r0 = syz_usb_connect(0, 0x32, &AUTO=<<<!!ERROR!!>>>"\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00", 0)

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO="\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00", 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 261395
							output: 753
							thoughts: 797
						

**Debugging `syz_usb_connect` with `ANY` Pointer**

Okay, so `syz_usb_connect` is still giving me trouble, specifically the "wrong string arg" error. I need to make sure I'm using the `ANY` pointer correctly. Let me quickly check the syzkaller documentation to refresh my memory on the proper syntax. Ah, right, I *thought* I could just use `&AUTO=ANY=[@ANYBLOB="..."]`, but I clearly need to nail the exact syntax.

I figured maybe using the correct syntax could look like `&AUTO=ANY=[@ANYBLOB="12010002..."]`. Let's try that. Hmm, wait. That didn't work. The error message is now saying "failed to parse identifier at pos 51". Okay, let me pinpoint exactly where that is in my call:

`r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"], 0)`
123456789012345678901234567890123456789012345678901

Yes, position 51 is the quote! So maybe `ANYBLOB` *doesn't* take a string within quotes? Maybe it's more like `ANYBLOB=12010002...`? No, that also won't work. Alright, let's try the struct syntax as I recall from previous attempts. I'll construct it like so:

```
&(0x7f0000000100)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x2040, 0x2900, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x20, 0x1, 0x1, 0x0, 0x80, 0xfa, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, 0xff, 0x0, [], [{{0x7, 0x5, 0x1, 0x2, 0x200, 0x0, []}}, {{0x7, 0x5, 0x81, 0x2, 0x200, 0x0, []}}]}}]}}]}}
```

Hmm, I think that might be the correct representation of the USB descriptor, but if I use the struct syntax, it will likely complain about the `idVendor` field not being 0. Rather than spending more time debating it, let's test it out to see the *exact* error that's returned. That'll provide the best clue on how to proceed.

wrong array arg *prog.BufferType
line #1:177: r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x2040, 0x2900, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x20, 0x1, 0x1, 0x0, 0x80, 0xfa, [<<<!!ERROR!!>>>{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, 0xff, 0x0, [], [{{0x7, 0x5, 0x1, 0x2, 0x200, 0x0, []}}, {{0x7, 0x5, 0x81, 0x2, 0x200, 0x0, []}}]}}]}}]}}, 0)

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x2040, 0x2900, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x20, 0x1, 0x1, 0x0, 0x80, 0xfa, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, 0xff, 0x0, [], [{{0x7, 0x5, 0x1, 0x2, 0x200, 0x0, []}}, {{0x7, 0x5, 0x81, 0x2, 0x200, 0x0, []}}]}}]}}]}}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 264054
							output: 634
							thoughts: 1699
						

**Debugging USB Descriptor Initialization**

Okay, here's the breakdown of what I'm thinking. I've encountered a `wrong array arg` error, specifically related to `*prog.BufferType`, while working with a USB configuration descriptor. The key is in understanding how the descriptor is defined, and ensuring the struct literal I'm providing matches the expected structure.

First, I realized that the `usb_config_descriptor` has an `interfaces` field, which is an array, as shown in `vusb.txt`. This immediately shifts my focus to the `usb_config_descriptor_ifaces_array_t` type, which expands into `usb_config_descriptor_t` and further to `usb_config_descriptor_verbose_t`.  Looking at `usb_config_descriptor_verbose_t`, I see the relevant fields: `bLength`, `bDescriptorType`, `wTotalLength`, `bNumInterfaces`, `bConfigurationValue`, `iConfiguration`, `bmAttributes`, `bMaxPower`, `extra`, and `interfaces`. Importantly, I also see that `extra` is defined as `void`, which means that it takes no space in the struct, and should be omitted in the struct literal.

Now, I analyze my existing struct literal: `{{0x9, 0x2, 0x20, 0x1, 0x1, 0x0, 0x80, 0xfa, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, 0xff, 0x0, [], [{{0x7, 0x5, 0x1, 0x2, 0x200, 0x0, []}}, {{0x7, 0x5, 0x81, 0x2, 0x200, 0x0, []}}]}}]}}`. I counted 9 fields, which aligns with the number of significant fields for `usb_config_descriptor_t` after accounting for the omitted `void extra`. So, the error isn't at the top level, suggesting it might be within the `interfaces` array.

Delving into the `interfaces` array, which is an array of `usb_interface_descriptor`, I notice this struct is defined with the single field `inner`. So the correct structure should use a nested struct, `{{...}}`.  The `inner` expands to `usb_interface_descriptor_eps_array_t` which further expands to `usb_interface_descriptor_t` then `usb_interface_descriptor_verbose_t`. Reviewing `usb_interface_descriptor_verbose_t`, I again count the fields which are: `bLength`, `bDescriptorType`, `bInterfaceNumber`, `bAlternateSetting`, `bNumEndpoints`, `bInterfaceClass`, `bInterfaceSubClass`, `bInterfaceProtocol`, `iInterface`, `extra`, and `endpoints`.  The struct should contain 11 fields. Now I see that the interface array has the correct syntax `{{...}}` but I have to carefully consider what each field is.

I then check my struct literal which shows `{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0xff, 0xff, 0x0, [], [...]}}`. This correctly provides 11 fields!

The array `[]` is likely the source of the issue. Looking at the definition, `extra` is `array[usb_interface_extra_descriptor, 0:2]`. Since `usb_interface_extra_descriptor` is a union, an empty array `[]` might be problematic because the parser is expecting a buffer, or a union. An array of unions should be represented as `@generic={...}, @hid_hid={...}`.

As a quick fix, I should just use `AUTO` for all fields and let the syzkaller fuzzing tool infer everything. I propose this syzkaller call: `r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)={{AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, 0x2040, 0x2900, AUTO, AUTO, AUTO, AUTO, AUTO, [{{AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, [{{AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, [], [{{AUTO, AUTO, 0x1, AUTO, AUTO, AUTO, []}}, {{AUTO, AUTO,

wrong type *prog.FlagsType for AUTO

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)={{AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, 0x2040, 0x2900, AUTO, AUTO, AUTO, AUTO, AUTO, [{{AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, [{{AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, [], [{{AUTO, AUTO, 0x1, AUTO, AUTO, AUTO, []}}, {{AUTO, AUTO, 0x81, AUTO, AUTO, AUTO, []}}]}}]}}]}}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 267435
							output: 653
							thoughts: 381
						

**My Current USB Configuration Thoughts**

Okay, so I'm working with these USB structures, and I've got a bit of a wrinkle here. I need to define these `flags` types, and I've just remembered that `AUTO` *cannot* be used with `flags`. Right, that's crucial. I'm looking at `bcdUSB` which is a `flags[usb_versions, int16]`, `bMaxPacketSize0` as `flags[usb_device_max_packet_sizes, int8]`, `bmAttributes` (device configuration) as `flags[usb_config_attributes, int8]`, `bEndpointAddress` as `flags[usb_endpoint_addresses, int8]`, another `bmAttributes` (endpoint) as `flags[usb_endpoint_attributes, int8]`, and finally, `wMaxPacketSize` as `flags[usb_endpoint_max_packet_sizes, int16]`. I need to figure out appropriate values for these.

I've got this call here:

```
r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)={{AUTO, AUTO, 0x200, AUTO, AUTO, AUTO, 64, 0x2040, 0x2900, AUTO, AUTO, AUTO, AUTO, AUTO, [{{AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, 0x80, AUTO, [{{AUTO, AUTO, 0x1, 2, 512, AUTO, []}}, {{AUTO, AUTO, 0x81, 2, 512, AUTO, []}}]}}]}}]}}, 0)
```

Now, I'm thinking about the integer fields. Wait a second, the `bMaxPower` field is an `int8`, and I *can* use `AUTO` there. Same goes for `bConfigurationValue` which is also an `int8`. I think I can refine this now. This will make my next attempt at this more correct, and I am ready to iterate.

wrong type *prog.IntType for AUTO

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)={{AUTO, AUTO, 0x200, AUTO, AUTO, AUTO, 64, 0x2040, 0x2900, AUTO, AUTO, AUTO, AUTO, AUTO, [{{AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, 0x80, AUTO, [{{AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, AUTO, [], [{{AUTO, AUTO, 0x1, 2, 512, AUTO, []}}, {{AUTO, AUTO, 0x81, 2, 512, AUTO, []}}]}}]}}]}}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 268963
							output: 663
							thoughts: 482
						

**My Thoughts on USB Device Descriptor Configuration**

Okay, so I'm working on configuring this `usb_device_descriptor_verbose_t` struct, and I've hit a slight snag. I was hoping to use `AUTO` for a lot of these fields to let the compiler handle the sizes and types, but it looks like `AUTO` is *not* going to cut it for `int8` or `int16` types. It's really only useful for `const` and `len` types, which is good to know. So, I need to go through and manually fill in all the values.

I'm making sure I understand this. So `bLength` and `bDescriptorType`, being `const` types, can use `AUTO`. But everything else I need to work through individually. And now I see that `idVendor` is defined as `const[VENDOR, int16]`. Hmm. If I just slap an `AUTO` in there, it's going to resolve to `VENDOR`. And what is the value of `VENDOR`? Right, I see the `usb_device_descriptor` definition, and `VENDOR` is assigned 0. So, `AUTO` for `idVendor` means `0`.

And what happens if I try setting it to something other than zero? For example, if I try and set `idVendor` to `0x2040`, syzkaller will throw a fit and complain with "const field idVendor has value 0x2040, expected 0". Okay, I think I need to verify this assumption.

wrong array arg *prog.BufferType
line #1:183: r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)={{AUTO, AUTO, 0x200, AUTO, AUTO, AUTO, 64, 0x2040, 0x2900, AUTO, AUTO, AUTO, AUTO, AUTO, [{{AUTO, AUTO, AUTO, AUTO, 1, 0, 0x80, 0xfa, [<<<!!ERROR!!>>>{{AUTO, AUTO, 0, 0, AUTO, AUTO, AUTO, AUTO, 0, [], [{{AUTO, AUTO, 0x1, 2, 512, 0, []}}, {{AUTO, AUTO, 0x81, 2, 512, 0, []}}]}}]}}]}}, 0)

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)={{AUTO, AUTO, 0x200, AUTO, AUTO, AUTO, 64, 0x2040, 0x2900, AUTO, AUTO, AUTO, AUTO, AUTO, [{{AUTO, AUTO, AUTO, AUTO, 1, 0, 0x80, 0xfa, [{{AUTO, AUTO, 0, 0, AUTO, AUTO, AUTO, AUTO, 0, [], [{{AUTO, AUTO, 0x1, 2, 512, 0, []}}, {{AUTO, AUTO, 0x81, 2, 512, 0, []}}]}}]}}]}}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 270673
							output: 597
							thoughts: 656
						

**Debugging a Syzkaller Descriptor**

Okay, here we go again with this `wrong array arg *prog.BufferType` error. Let's see... the `extra` field is defined as an `array[usb_interface_extra_descriptor, 0:2]`. If I just give it an empty array, it throws the same error. Right, `usb_interface_extra_descriptor` is a union, so maybe using an `ANY` pointer would work for the whole descriptor?

The syntax for an `ANY` pointer is supposed to be something like `ANY=[@ANYBLOB="1201..."]`. But I got a "failed to parse identifier at pos 51" error earlier. I should double-check the exact `ANY` pointer syntax in syzkaller documentation. Ah, here's an example:

```
&AUTO=ANY=[@ANYBLOB="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"]
```

Wait, it looks like `ANYBLOB` is a string of hex digits? Now, I should try this: `&AUTO=ANY=[@ANYBLOB="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"]`.

Okay, the error still persisted. Ah, pos 51 is that quote! That's not the correct syntax. Wait, in syzkaller, isn't `ANYBLOB` a byte array? Isn't the syntax for byte arrays something like `"1234"` or `'1234'`? Hmm, but `ANYBLOB` is a field *name* within the `ANY` union, right? So the syntax *should* be `@ANYBLOB="1201..."`. Wait a second... it's still saying "failed to parse identifier". Maybe `ANY` *isn't* a union, it's just a raw pointer in syzkaller.

Right, so in syzkaller, the `ANY` pointer is just `ANY="..."`. Let me try `&AUTO=ANY="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200"`.

wrong string arg
line #1:40: r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=<<<!!ERROR!!>>>"1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200", 0)

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY="1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200", 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 272774
							output: 671
							thoughts: 600
						

**Debugging a Syzkaller USB Descriptor Issue**

Okay, so I'm hitting a snag with this `usb_interface_descriptor` and trying to get a valid USB connection setup in Syzkaller. My initial thought was that using `ANY` as a type modifier for a string was the problem, but that quickly proved to be a dead end. Then I tried passing a raw string with `&AUTO="\x12\x01..."`, but that just resulted in a "wrong string arg" error. It clicked that the argument type expects a `ptr[in, usb_device_descriptor]`, meaning I absolutely can't directly pass a string to a struct pointer; it needs to be a struct. I need to fix how the struct is being constructed.

The error message pointed to `wrong array arg *prog.BufferType` for the `extra` field. I knew that the `extra` field is defined as `array[usb_interface_extra_descriptor, 0:2]`. Then it hits me, `usb_interface_extra_descriptor` is a union! Maybe an empty array is represented as `[]` in Syzkaller? Nope, that didn't work. The debugger was still giving me grief with the array. I then considered whether `[]` might be parsed as a buffer. In Syzkaller, an empty array of unions *is* represented by `[]`. That sent me back to the drawing board, thinking maybe the `extra` field isn't even meant to be an array at all.

So, I had to double-check `vusb.txt` to confirm the definition. Here's what I saw:

```
usb_interface_descriptor {
	inner	usb_interface_descriptor_eps_array_t[int8, int8, const[0, int8], const[0, int8], const[0, int8], array[usb_interface_extra_descriptor, 0:2], array[usb_endpoint_descriptor, 0:16]]
} [packed]
```

Yep, confirmed! It's indeed an `array[usb_interface_extra_descriptor, 0:2]`. The next thing that came to mind was if providing one element in the array might work, so I tried a construct like this: `[ @generic={AUTO, AUTO, ""} ]`. The test harness has revealed that this is the best path to take. Let's try to feed this and see if it goes through.

```
r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)={{AUTO, AUTO, 0x200, AUTO, AUTO, AUTO, 64, 0x2040, 0x2900, AUTO, AUTO, AUTO, AUTO, AUTO, [{{AUTO, AUTO, AUTO, AUTO, 1, 0, 0x80, 0xfa, [{{AUTO, AUTO, 0, 0, AUTO, AUTO, AUTO, AUTO, 0, [@generic={AUTO, AUTO, ""}], [{{AUTO, AUTO, 0x1, 2, 512, 0, []}}, {{AUTO, AUTO, 0x81, 2, 512, 0, []}}]}}]}}]}}, 0)
```

Now let's see if *this* works. Crossing my fingers.

wrong array arg *prog.BufferType
line #1:183: r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)={{AUTO, AUTO, 0x200, AUTO, AUTO, AUTO, 64, 0x2040, 0x2900, AUTO, AUTO, AUTO, AUTO, AUTO, [{{AUTO, AUTO, AUTO, AUTO, 1, 0, 0x80, 0xfa, [<<<!!ERROR!!>>>{{AUTO, AUTO, 0, 0, AUTO, AUTO, AUTO, AUTO, 0, [@generic={AUTO, AUTO, ""}], [{{AUTO, AUTO, 0x1, 2, 512, 0, []}}, {{AUTO, AUTO, 0x81, 2, 512, 0, []}}]}}]}}]}}, 0)

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)={{AUTO, AUTO, 0x200, AUTO, AUTO, AUTO, 64, 0x2040, 0x2900, AUTO, AUTO, AUTO, AUTO, AUTO, [{{AUTO, AUTO, AUTO, AUTO, 1, 0, 0x80, 0xfa, [{{AUTO, AUTO, 0, 0, AUTO, AUTO, AUTO, AUTO, 0, [@generic={AUTO, AUTO, ""}], [{{AUTO, AUTO, 0x1, 2, 512, 0, []}}, {{AUTO, AUTO, 0x81, 2, 512, 0, []}}]}}]}}]}}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 275024
							output: 515
							thoughts: 4929
						

**Debugging the USB Descriptor**

Okay, here's the deal. I'm stuck trying to get this USB device properly described in syzkaller to trigger a specific bug related to I2C adapters. The main issue is the `usb_config_descriptor_t` and `usb_config_descriptor_verbose_t` structures, and how the `interfaces` array is defined.  I initially thought there was a problem with the array's size being inferred incorrectly. The error message kept pointing to the `interfaces` array and it seemed like the sizes weren't matching. I went through the structs and their fields, like `bLength`, `bDescriptorType`, `wTotalLength`, and `bNumInterfaces`, step by step, making sure the calculations were sound.  I confirmed that the `interfaces` field is indeed the 9th field, which is where my array definition was.  Then I realized `wTotalLength` is `len[parent, int16]` and `bNumInterfaces` is `IFSNUM`, which is `len[interfaces, int8]`, and they'd resolve to `AUTO`, so that was fine. I got as far as understanding all the fields of the struct and the `interfaces` array was correct, but I was still getting the error.

It then became clear that the problem was the type of `usb_interface_descriptor`.  It's a struct with one field `inner`, which is actually `usb_interface_descriptor_eps_array_t`. It's really just a struct containing another struct, where the outer struct is the array.

My challenge shifted to configuring the device, particularly with `bInterfaceClass` which needs to be `0xff` for the target device, but because of how `usb_interface_descriptor` is defined, this is not possible as `CLASS` is `const[0, int8]`.

I then realized that the USB core matching (in the kernel) is done via `idVendor` and `idProduct`, not the interface class. So even if the interface class is 0 (as in my case), it should work.

The next realization was that the syzkaller fuzzer was using `syz_usb_connect` with `AUTO` values, and that the syzkaller `init_vusb.go` script patches `idVendor` and `idProduct` with random values from a list of known devices.

I thought if I could force these `idVendor` and `idProduct` to be the ones for the target device ( `0x2040:0x2900` ), I could make this specific device reproducible, but found that I could not modify the `const` fields directly.

I considered variants of `syz_usb_connect` like `$printer`, but none matched the needed device IDs. I explored the idea of using `ANY` pointers to bypass the type checker, and directly feed in a raw descriptor, but syntax problems with `ANYBLOB` or string formatting thwarted that effort.

Ultimately, I realized that I couldn't specify the vendor/product IDs directly. Since the fuzzer found the bug using `syz_usb_connect(0, AUTO, &AUTO, 0)`, I should reproduce it by *exactly* using the same call. I tried using the fuzzer configuration, but it was difficult.

My final thought was this: I might be able to craft an `ANY` pointer pointing to a buffer containing the raw descriptor data, even though syzkaller *expects* `usb_device_descriptor`. The idea is that the executor reads the descriptor from that buffer.

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)=ANY=[], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 281264
							output: 615
							thoughts: 334
						

**Debugging a Syzkaller USB Crash**

Okay, so the parser didn't choke, which is good! But frustratingly, the crash didn't reproduce. Hmm... I remember that `ANY=[]` translates to an empty buffer, which means `syz_usb_connect` is getting passed an empty descriptor. That's clearly not what we want.

The question then is, how do I actually feed data into `ANY=[]`? I need to use `@ANYBLOB` for that, right? So something like `ANY=[@ANYBLOB="1201..."]`. Let's give that a shot with some actual descriptor data: `ANY=[@ANYBLOB='1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200']`.

Wait a minute, the earlier parse failure was at position 51, and that's *right* where the quote is! Could the issue be the quote type? Let's change the quotes to single quotes: `ANY=[@ANYBLOB='1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200']`. That's the next logical step to try.

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB='1201000200000040402000290000010203010902200001010080fa0904000002ffffff000705010200020007058102000200'], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 282642
							output: 713
							thoughts: 307
						

**Debugging a Parsing Discrepancy**

Okay, so the parser handled that input correctly, which is a good sign. But it didn't trigger the expected crash. Hmm, why? My initial thought is that the way I'm using `ANYBLOB` with a hex string might be the issue. I need to make sure I'm treating hex strings correctly. Now wait, I'm inputting that data as a regular string, using `'1201...'`. Those are ASCII characters, not a proper hex representation! That's it!

In syzkaller, a proper hex string is represented as something like `"\x12\x01..."` or `'\x12\x01...'`. The system needs the byte values, not the string representation. Alright, let's try this again, but this time I'll make sure the `ANYBLOB` field receives the correct hex representation. I'll construct the input as `ANY=[@ANYBLOB="\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00"]`. Hopefully that will fix the problem.

failed to parse identifier at pos 63
line #1:63: r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="<<<!!ERROR!!>>>\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00"], 0)

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00"], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 284350
							output: 812
							thoughts: 669
						

**Decoding the `ANYBLOB` Dilemma in Syzkaller**

Okay, so I'm wrestling with how to correctly represent a hex string, specifically using `ANYBLOB` within syzkaller. My initial assumption was that `ANYBLOB` wanted a plain hex string, sans the `\x` prefix. But that's not quite right. Using something like `'1201...'` seems to parse, but it's interpreted as ASCII, which is definitely not what I want.

Aha, syzkaller itself treats `'1201...'` as a string, which makes sense, but doesn't give me the byte-level control I need. My next logical leap was to try `ANYBLOB="1201..."` – a raw hex string within quotes. However, that immediately failed, choking on the double quote itself. The error message, 'failed to parse identifier at pos 51', pinpointed the problematic quote. This had me second-guessing: is `ANYBLOB` even a valid field name?

Time to consult the source. Let's look at the definition of syzkaller's `ANY` union, and its fields. Yup, `ANYBLOB` is there, defined as an `array[int8]`. Right, so this confirms it's an array of bytes. That means I should be using `[...]` or a string to provide it. The string route again gives me ASCII interpretation. This presents a problem: how do I insert non-printable bytes?

The answer became clear: if it's an array of integers, I can directly specify the byte values! I can provide the hex values as integers. So I'll just use a direct array, specifying each byte's hex representation, for example: `ANY=[@ANYBLOB=[0x12, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x40, 0x40, 0x20, 0x00, 0x29, 0x00, 0x00, 0x01, 0x02, 0x03, 0x01, 0x09, 0x02, 0x20, 0x00, 0x01, 0x01, 0x00, 0x80, 0xfa, 0x09, 0x04, 0x00, 0x00, 0x02, 0xff, 0xff, 0xff, 0x00, 0x07, 0x05, 0x01, 0x02, 0x00, 0x02, 0x00, 0x07, 0x05, 0x81, 0x02, 0x00, 0x02, 0x00]]`. Let's give that a shot!

wrong array arg *prog.BufferType
line #1:63: r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB=[<<<!!ERROR!!>>>0x12, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x40, 0x40, 0x20, 0x00, 0x29, 0x00, 0x00, 0x01, 0x02, 0x03, 0x01, 0x09, 0x02, 0x20, 0x00, 0x01, 0x01, 0x00, 0x80, 0xfa, 0x09, 0x04, 0x00, 0x00, 0x02, 0xff, 0xff, 0xff, 0x00, 0x07, 0x05, 0x01, 0x02, 0x00, 0x02, 0x00, 0x07, 0x05, 0x81, 0x02, 0x00, 0x02, 0x00]], 0)

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB=[0x12, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x40, 0x40, 0x20, 0x00, 0x29, 0x00, 0x00, 0x01, 0x02, 0x03, 0x01, 0x09, 0x02, 0x20, 0x00, 0x01, 0x01, 0x00, 0x80, 0xfa, 0x09, 0x04, 0x00, 0x00, 0x02, 0xff, 0xff, 0xff, 0x00, 0x07, 0x05, 0x01, 0x02, 0x00, 0x02, 0x00, 0x07, 0x05, 0x81, 0x02, 0x00, 0x02, 0x00]], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 286889
							output: 713
							thoughts: 664
						

**Debugging Syzkaller's `ANYBLOB` Representation**

Okay, so I'm tackling this `ANYBLOB` issue in syzkaller. The initial thought was, "Aha! `ANYBLOB` is actually an `array[int8]`, but in this tool, it's represented as a string, which makes sense for flexibility." But then the question became, "How do I inject non-printable characters when it's treated like a string?" The obvious thought was to use the `\x` escape sequence, like so `\x12\x01...`.

I tried implementing this with `ANY=[@ANYBLOB="\x12\x01..."]`, but immediately hit a parsing error: "failed to parse identifier at pos 63". Looking at the error more closely reveals that the issue is at the quote. This suggests that the format isn't what I originally thought.

The problem, it clicked, is that union fields themselves are *not* strings in syzkaller. However, `ANYBLOB` is a string! So perhaps it's a syntax issue. I tried `ANY=[@ANYBLOB='...']` to see if single quotes are preferred. The test `ANY=[@ANYBLOB='1201...']` parsed correctly! So single quotes seem to work. The parser didn't complain. But wait! The parsed output now is treated as an ASCII string.

The next thing to verify, and my current attempt, is to see if I can use `\x` escape sequences *within* those single quotes. I'm going to try it now. I'll test `ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00']`. That should provide the correct bytes.

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 288855
							output: 1165
							thoughts: 6325
						

**The USB Device Conundrum: A Syzkaller Journey**

Okay, so I've been wrestling with this crash, and here's the thought process to this point. The issue seems to be that the `pvrusb2` driver isn't properly initializing, even though the device descriptor looks correct on the surface. It parsed, but isn't crashing as expected. My initial thought was that the device wasn't probed, but why?

First, I examined the `pvrusb2` driver and specifically `pvr2_hdw_setup_low`. This function calls a series of setup commands, including `pvr2_hdw_cmd_powerup`. That function calls `pvr2_issue_simple_cmd` which calls `pvr2_send_request`. This function sends a BULK OUT request. My first thought was maybe the host wasn't sending a read. It passes read_len = 0, so no reply is expected. I realized, though, that `pvr2_send_request_ex` submits the write and waits for it to complete. The "dummy" HCD would complete immediately if there's a read.

So I added a `syz_usb_ep_read` call. Several, actually. Each should correspond to a BULK OUT request. There are several calls within pvr2_hdw_setup_low and the drivers that send BULK OUT requests, so I figured, if there is a pending read, I should be safe.

I thought maybe the problem was at `pvr2_hdw_check_firmware`, which sends a BULK OUT, then BULK IN. So I added `syz_usb_ep_write` to match this, writing a null byte. I confirmed that the endpoint directions, and the `0x81` value in `syz_usb_ep_write` calls was the correct BULK IN endpoint. Also, I confirmed that `0x01` in the calls to `syz_usb_ep_read` was the correct endpoint for the BULK OUT requests.

I double-checked the device descriptor to see if the vendor and product IDs matched what the driver was expecting. They did. No problems there.

Next, I wondered if `syz_usb_connect` was the problem. Could the descriptor I passed be the issue? I tried different ways to specify the device, and the hex string looked correct, with the total length also validated.

I was suspicious of the interface descriptor fields - number of interfaces and endpoints. After some digging, I realized that the driver has some checks regarding the number of interfaces and endpoints, which are 1 and 2 respectively. My setup had both. If the number of endpoints were zero, it would attempt to load firmware, which is no good, but the descriptor had 2. I need those read calls for the firmware check too. Specifically, I'm now understanding that if `bNumEndpoints == 0`, it tries to load firmware, however, if we don't reply to a BULK IN request, the firmware check fails. The driver tries a call to `request_firmware` and early returns. So providing a reply to these, by use of the `syz_usb_ep_read` and `syz_usb_ep_write` calls is CRITICAL.

I went through other functions in the driver to check if it has firmware checks, and other calls that would require BULK IN reads. The driver sends a BULK OUT and then BULK IN, and these must be completed.

I revisited the `syz_usb_ep_read` calls, wondering if they might be failing due to a timeout. The timeout is 300ms. I wondered if that was happening before the host even sent the data! The I2C init function might take a while, and the read would time out before the BULK IN even arrived from the device. I added multiple `syz_usb_ep_read` calls, and I was going to add a delay, but then I had a brainwave!

If the calls are async, which I am making them, they will block, waiting for the URB. I decided to check raw-gadget to check how it handles these scenarios. It turns out that if no call is waiting, the URB hangs in the queue forever. So I *must* provide them to unblock the host. And it turned out, if `syz_usb_ep_read` times out, the URB is still in the queue. 

Then I thought that what if the BULK IN requires a specific value? However, it is just checking for success, so returning 0 is acceptable.

What about `pvr2_hdw_get_eeprom_addr`? If it

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={0, 500000000}, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r4 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r5 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
r6 = syz_open_dev$I2C(&(0x7f0000000500)='/dev/i2c-#\x00', 4, 0)
r7 = syz_open_dev$I2C(&(0x7f0000000540)='/dev/i2c-#\x00', 5, 0)
r8 = syz_open_dev$I2C(&(0x7f0000000580)='/dev/i2c-#\x00', 6, 0)
r9 = syz_open_dev$I2C(&(0x7f00000005c0)='/dev/i2c-#\x00', 7, 0)
syz_usb_disconnect(r1)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 297395
							output: 55
							thoughts: 993
						

**Debugging the I2C Device Initialization**

Okay, still no reproduction, which means I need to re-examine my assumptions about the I2C device setup. It's possible `syz_open_dev$I2C` isn't functioning as expected. I'm passing a correct device path to it - `&(0x7f0000000400)='/dev/i2c-#\x00'`, so the problem must lie elsewhere.

A potential issue might be that the I2C adapter isn't created correctly. Going back to `pvr2_hdw_setup_low`, I see the IR chip is taken out of reset based on `ir_scheme`. However, since this is the `pvr2_device_29xxx` variant where `ir_scheme = PVR2_IR_SCHEME_29XXX`, the ZILOG reset isn't happening. This means the initialization sequence prior to `pvr2_i2c_core_init` involves only a couple of bulk OUT and one bulk IN USB transfers. My current fuzzing sequence, with `syz_usb_ep_read` and `syz_usb_ep_write`, should be sufficient.

But what if `pvr2_i2c_core_init` *itself* is failing? Looking at the function, it appears to call `i2c_add_adapter`, then potentially probes the I2C bus, and then registers the IR device using `pvr2_i2c_register_ir`. I don't see anything immediately wrong here. `i2c_add_adapter` should register the adapter properly and `pvr2_i2c_register_ir` shouldn't fail.

Perhaps the hung task is not triggered by the `syz_usb_disconnect` system call not blocking. `syz_usb_disconnect` closes the USB file descriptor, which in turn calls a series of functions culminating in `pvr2_context_disconnect`. However, I need to check how `pvr2_context_disconnect` interacts with the hardware. It looks like it sets a `disconnect_flag` and wakes up the thread. Importantly, `pvr2_context_disconnect` *doesn't* call `pvr2_hdw_disconnect` directly. This is crucial; I should examine the function more closely to understand the disconnection mechanism.

map[ContextFile:drivers/media/usb/pvrusb2/pvrusb2-context.c IncludeLines:true Name:pvr2_context_disconnect]

map[SourceCode: 267:	void pvr2_context_disconnect(struct pvr2_context *mp)
 268:	{
 269:		pvr2_hdw_disconnect(mp->hdw);
 270:		if (!pvr2_context_shutok())
 271:			pvr2_context_notify(mp);
 272:		mp->disconnect_flag = !0;
 273:	}
 SourceFile:drivers/media/usb/pvrusb2/pvrusb2-context.c]

gemini-3-pro-preview

							input: 299120
							output: 729
							thoughts: 5064
						

**Analyzing the pvrusb2 USB Disconnect Hang**

Okay, so the code clearly shows that `pvr2_hdw_disconnect` calls `pvr2_i2c_core_done`, and that in turn calls `i2c_del_adapter`. This is where the blocking happens. But why doesn't it *always* hang? The key must be in how the I2C device and its related file descriptors are handled. Syzkaller's behavior of executing a program and then exiting gives us a clue: the file descriptor from `syz_open_dev$I2C` is only kept open until the process exits. When the process exits, it's closed and the reference counts drop allowing `i2c_del_adapter` to complete. The whole trick is preventing this exit, which lets the issue show!

The initial approach with `nanosleep` at the end won't work because `syz_usb_disconnect` will block within the kernel, and the `nanosleep` would never be reached, and the executor process *will* exit! The issue isn't blocking, but rather a race condition or a timeout. The default 5-second timeout in syzkaller is key.  If `i2c_del_adapter` blocks, the process gets killed and the cleanup is interrupted, potentially leaving things in a bad state, and the watchdog will trip, but the test won't hang for 143 seconds. That led me to consider that the `syz_usb_disconnect` call might itself not be blocking due to the child process being killed by syzkaller.

I had to figure out how to force this hang by preventing the process from exiting naturally *after* the blocking call to `i2c_del_adapter` (or `pvr2_hdw_disconnect`). The most promising approach seemed to be to open a file descriptor to a device, like `/dev/i2c-X` or `/dev/video0`, so the process does not exit, and `pvrusb2` is loaded!

To get to that point, I need to make sure the I2C adapter *is* registered. That means the driver needs to load successfully.  I need to ensure the `syz_open_dev$I2C` syscall doesn't fail. So I need to add a longer `nanosleep` before `syz_open_dev$I2C` to give the module time to load and register the I2C adapter. The I2C file descriptor needs to be correct. The `ANYBLOB` format needs to be properly constructed and parsed by syzkaller.  I confirmed the syntax using single quotes and it does indeed handle the escaped hex bytes.

After careful consideration of the driver's internals, the `pvr2_hdw_check_firmware` and related calls, the firmware upload process *should* be properly handled, and `pvrusb2` *should* load. I looked at USB descriptors to see if there were specific requirements for endpoint addresses or other settings.

Next, after trying `syz_usb_connect` using `usb_device_descriptor`, I considered that `USBDEVFS_DISCONNECT` might be the problem. Looking at the callstack, it's clear the issue lies within `pvrusb2`.  The stack points to `USBDEVFS_DISCONNECT`, but also `syz_usb_disconnect` which should trigger the same cleanup path, so both should trigger the bug!  But `USBDEVFS_DISCONNECT` requires opening the USB device first, which means knowing its bus and device number, so `syz_usb_disconnect` seems much simpler.

I'm now focusing on a more reliable setup by properly timing calls to `syz_usb_ep_read` after the `pvrusb2` module has loaded. The `nanosleep` call should ensure the module's URBs are processed after the load and registration.

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 305791
							output: 922
							thoughts: 702
						

**Debugging USB Reproduction Attempts**

Okay, so I'm still not reproducing the issue. Time to dig deeper. My initial hypothesis that the module loads within a second might be wrong. Let's extend the delay before the `syz_usb_ep_read` calls. I'll increase the wait time to 3 seconds initially and see if that makes a difference. And, since we can't create loops here, I'll need to call `syz_usb_ep_read` multiple times, with varying delays to cover the potential issue. I will increase the number of calls to 4, each delayed by one second.

Wait a second… thinking about it, using `nanosleep` in the way I was previously doing it in the main thread is going to block the execution of the subsequent function calls. Let's try leveraging the `async` keyword for these calls. If I call the `syz_usb_ep_read` functions as `async`, they should run in parallel, which is what I want. This way, the `nanosleep` will only affect the main thread.

So, I'll structure it like this: I'll initiate a `syz_usb_connect` call, then immediately call `syz_usb_ep_read` and `syz_usb_ep_write` asynchronously. I'll follow that by a `nanosleep` for one second, and then call those functions again, repeating this sequence for a total of four iterations. This will ensure we cover a total of 4 seconds of time, with concurrent reads and writes.

Finally, after the read/write operations and the appropriate delays, I'll add the necessary `syz_open_dev$I2C` and `syz_usb_disconnect` calls. Let's try this. This revised approach should provide a more robust test.

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
r1 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r4 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 307839
							output: 1187
							thoughts: 2596
						

**Debugging the USB Device Probe**

Okay, so I'm still hitting a wall with this device not reproducing the issue. Let's walk through my thought process. Initially, I suspected a timing issue with `usb_set_interface` potentially blocking the probe. The code ignores the return of that function, which initially raised a flag. It calls a control request, and if it times out, that's a 5-second delay! This meant the syzkaller program, only running for 4 seconds, would terminate before the probe completes, thus the probe would never be completed. However, a quick dive into `executor/common_usb.h` showed `USB_REQ_SET_INTERFACE` is handled automatically, returning `true` - it shouldn't be timing out.

Next, I looked at other potential causes of failure during the probe. I went back to the code, and remembered that `pvr2_hdw_create` is called *before* a kernel thread is created, meaning the device could be blocked and never initialized properly. I then considered if the device wasn't being probed.

I had `bNumEndpoints = 2`. The code checks if  `bNumEndpoints == 0`, and I realized this code path would work fine and progress to the bulk endpoint calls. With that understanding, I checked the firmware initialization to send commands. The call checks urb statuses, using  `FX2CMD_GET_EEPROM_ADDR`, and sends it to the bulk endpoint. This means my endpoint calls with `syz_usb_ep_write` should work.

I then considered what if power-up or the i2c initialization fails? Looking closer, I realised that those commands return 0 on success. The code doesn't check the data, just the successful completion.

I also then considered if `pvrusb2` had been loaded by udev. My program didn't trigger a module load, and there would be a race condition, so I added the load trigger.

The plan now is to connect the device, disconnect, then reconnect it. That way, the module should be loaded, ready to go. Now, my syzkaller code should work as expected. Let's test this change.

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
r2 = syz_open_dev$I2C(&(0x7f0000000400)='/dev/i2c-#\x00', 0, 0)
r3 = syz_open_dev$I2C(&(0x7f0000000440)='/dev/i2c-#\x00', 1, 0)
r4 = syz_open_dev$I2C(&(0x7f0000000480)='/dev/i2c-#\x00', 2, 0)
r5 = syz_open_dev$I2C(&(0x7f00000004c0)='/dev/i2c-#\x00', 3, 0)
syz_usb_disconnect(r1)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 312119
							output: 20
							thoughts: 4176
						

**The USB Mystery Unravelled**

Okay, so I'm back at this pvrusb2 problem. Still no reproduction, and I'm chasing my tail. I *thought* maybe I needed `syz_usb_control_io` for `USB_REQ_SET_INTERFACE`, but then I remembered `executor/common_usb.h` handles that already. But what if it's sending *other* control requests? Time to re-examine `pvr2_hdw_create`... Yep, it calls `usb_set_interface`, then things cascade through `pvr2_hdw_setup_low` to `pvr2_hdw_cmd_powerup`, and eventually, a BULK OUT request through `pvr2_send_request`.

Aha! What if the *device descriptor* is the culprit? Maybe something's missing? Let's grab the descriptor from a real Hauppauge PVR-USB2. Okay, got it. Vendor ID, Product ID... everything *looks* normal at first glance.

Wait! The OUT endpoint in the real descriptor is `0x02`. But `pvrusb2-hdw.c` defines `PVR2_CTL_WRITE_ENDPOINT` as `0x01`! So, the code tries to write to endpoint 1, but if that endpoint doesn't exist, it will fail when using `usb_urb_ep_type_check`! And looking deeper into the source, I see `usb_fill_bulk_urb` will attempt to write to `PVR2_CTL_WRITE_ENDPOINT`, which is defined as `0x01` in the driver, the check will be made when calling `usb_submit_urb`, so it will fail when using the device descriptor.

So if I define a device descriptor with `0x01` it will pass, I've already tried that, but it didn't reproduce. Let's make sure that pvrusb2 is enabled in the syzkaller kernel. I checked the configs and they are enabled, I saw the hang in the bug report, so I can assume it is enabled.

Maybe `syz_usb_disconnect` isn't triggering it because the I2C device isn't *kept* open? I had been using `syz_open_dev$I2C`, but the program finishes, and the file descriptor is closed, so no. Wait, I added `nanosleep`? Nope! No `nanosleep`. If there is no sleep, the program exits IMMEDIATELY after `syz_usb_disconnect`! That closes all file descriptors! No hang!

I *need* to add a long `nanosleep` AFTER `syz_usb_disconnect`! But `syz_usb_disconnect` is *blocking*! The program won't reach the sleep. But Syzkaller kills the program after 5 seconds! If it gets killed, the process exits, and the file descriptors close before the hang! How did the fuzzer get a 143-second hang?

Aha! D state! If a process is in D state (Uninterruptible Sleep), it CANNOT be killed by `SIGKILL`! Syzkaller's `SIGKILL` won't save us. The process stays in D, the file descriptors are NOT closed, and it hangs for 143 seconds! This is consistent.

But, why didn't it reproduce? Could `syz_open_dev$I2C` have failed? Why? Maybe the `/dev/i2c-X` node isn't created? In Syzkaller, `udev` isn't running, it uses `devtmpfs`. But... `i2c-dev` uses `class_register` and `device_create`. Those *should* create the node. The node *should* be there!

Wait, what if `i2c-dev` is NOT loaded? If `CONFIG_I2C_CHARDEV=m` and there is no `udev`, it will *never* load. So `/dev/i2c-X` would not be created! Then `syz_open_dev$I2C` will fail. Is it a module? Bug report doesn't mention `i2c-dev`. But, if `i2c-dev` isn't loaded, who *holds* the reference to `adap->dev`?

It can't be `i2c-dev`, there would be no `/dev/i2c-X`! Could it be `ir_video`? I2C client device. `i2c_del_adapter` unregisters all client devices. It calls `device_del

map[File:dev_input.txt]

map[Output:# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <linux/input.h>

resource fd_evdev[fd]

# There seems to be nothing special we can do with this fd.
syz_open_dev$mouse(dev ptr[in, string["/dev/input/mouse#"]], id intptr, flags flags[open_flags]) fd
openat$mice(fd const[AT_FDCWD], file ptr[in, string["/dev/input/mice"]], flags flags[open_flags]) fd

syz_open_dev$evdev(dev ptr[in, string["/dev/input/event#"]], id intptr, flags flags[open_flags]) fd_evdev

write$evdev(fd fd_evdev, data ptr[in, array[input_event]], len bytesize[data])

ioctl$EVIOCGVERSION(fd fd_evdev, cmd const[EVIOCGVERSION], arg buffer[out])
ioctl$EVIOCGID(fd fd_evdev, cmd const[EVIOCGID], arg buffer[out])
ioctl$EVIOCGREP(fd fd_evdev, cmd const[EVIOCGREP], arg buffer[out])
ioctl$EVIOCGKEYCODE(fd fd_evdev, cmd const[EVIOCGKEYCODE], arg buffer[out])
ioctl$EVIOCGKEYCODE_V2(fd fd_evdev, cmd const[EVIOCGKEYCODE_V2], arg buffer[out])
ioctl$EVIOCGEFFECTS(fd fd_evdev, cmd const[EVIOCGEFFECTS], arg buffer[out])
ioctl$EVIOCGMASK(fd fd_evdev, cmd const[EVIOCGMASK], arg ptr[in, input_mask])
ioctl$EVIOCGNAME(fd fd_evdev, cmd const[EVIOCGNAME64], arg buffer[out])
ioctl$EVIOCGPHYS(fd fd_evdev, cmd const[EVIOCGPHYS64], arg buffer[out])
ioctl$EVIOCGUNIQ(fd fd_evdev, cmd const[EVIOCGUNIQ64], arg buffer[out])
ioctl$EVIOCGPROP(fd fd_evdev, cmd const[EVIOCGPROP64], arg buffer[out])
ioctl$EVIOCGMTSLOTS(fd fd_evdev, cmd const[EVIOCGMTSLOTS64], arg buffer[out])
ioctl$EVIOCGKEY(fd fd_evdev, cmd const[EVIOCGKEY64], arg buffer[out])
ioctl$EVIOCGLED(fd fd_evdev, cmd const[EVIOCGLED64], arg buffer[out])
ioctl$EVIOCGSND(fd fd_evdev, cmd const[EVIOCGSND64], arg buffer[out])
ioctl$EVIOCGSW(fd fd_evdev, cmd const[EVIOCGSW64], arg buffer[out])
ioctl$EVIOCGBITKEY(fd fd_evdev, cmd const[EVIOCGBITKEY64], arg buffer[out])
ioctl$EVIOCGBITSND(fd fd_evdev, cmd const[EVIOCGBITSND64], arg buffer[out])
ioctl$EVIOCGBITSW(fd fd_evdev, cmd const[EVIOCGBITSW64], arg buffer[out])
ioctl$EVIOCGABS0(fd fd_evdev, cmd const[EVIOCGABS0], arg buffer[out])
ioctl$EVIOCGABS20(fd fd_evdev, cmd const[EVIOCGABS20], arg buffer[out])
ioctl$EVIOCGABS2F(fd fd_evdev, cmd const[EVIOCGABS2F], arg buffer[out])
ioctl$EVIOCGABS3F(fd fd_evdev, cmd const[EVIOCGABS3F], arg buffer[out])

ioctl$EVIOCSREP(fd fd_evdev, cmd const[EVIOCSREP], arg ptr[in, array[int32, 2]])
ioctl$EVIOCSKEYCODE(fd fd_evdev, cmd const[EVIOCSKEYCODE], arg ptr[in, array[int32, 2]])
ioctl$EVIOCSKEYCODE_V2(fd fd_evdev, cmd const[EVIOCSKEYCODE_V2], arg ptr[in, input_keymap_entry])
ioctl$EVIOCSFF(fd fd_evdev, cmd const[EVIOCSFF], arg ptr[in, ff_effect])
ioctl$EVIOCRMFF(fd fd_evdev, cmd const[EVIOCRMFF], arg ptr[in, int32])
ioctl$EVIOCGRAB(fd fd_evdev, cmd const[EVIOCGRAB], arg ptr[in, int32])
ioctl$EVIOCREVOKE(fd fd_evdev, cmd const[EVIOCREVOKE], arg ptr[in, int32])
ioctl$EVIOCSMASK(fd fd_evdev, cmd const[EVIOCSMASK], arg ptr[in, input_mask])
ioctl$EVIOCSCLOCKID(fd fd_evdev, cmd const[EVIOCSCLOCKID], arg ptr[in, int32])
ioctl$EVIOCSABS0(fd fd_evdev, cmd const[EVIOCSABS0], arg ptr[in, input_absinfo])
ioctl$EVIOCSABS20(fd fd_evdev, cmd const[EVIOCSABS20], arg ptr[in, input_absinfo])
ioctl$EVIOCSABS2F(fd fd_evdev, cmd const[EVIOCSABS2F], arg ptr[in, input_absinfo])
ioctl$EVIOCSABS3F(fd fd_evdev, cmd const[EVIOCSABS3F], arg ptr[in, input_absinfo])

ff_effect_type = FF_PERIODIC, FF_CONSTANT, FF_SPRING, FF_FRICTION, FF_DAMPER, FF_INERTIA, FF_RAMP
ff_periodic_effect_wave = FF_SQUARE, FF_TRIANGLE, FF_SINE, FF_SAW_UP, FF_SAW_DOWN, FF_CUSTOM
input_codes = EV_SYN, EV_KEY, EV_REL, EV_ABS, EV_MSC, EV_SW, EV_LED, EV_SND, EV_REP, EV_FF, EV_PWR, EV_FF_STATUS, EV_MAX

input_event {
	time	timeval
	type	flags[input_codes, int16]
	code	int16
	val	int32
}

input_keymap_entry {
	flags	int8
	len	int8[0:32]
	index	int16
	keycode	int32
	scancod	array[int8, 32]
}

ff_effect {
	type	flags[ff_effect_type, int16]
	id	int16
	dir	int16
	trigger	ff_trigger
	replay	ff_replay
	u	ff_effect_u
}

ff_effect_u [
	const	ff_constant_effect
	ramp	ff_ramp_effect
	period	ff_periodic_effect
	cond	array[ff_condition_effect, 2]
	rumble	ff_rumble_effect
]

ff_trigger {
	button	int16
	interv	int16
}

ff_replay {
	len	int16
	delay	int16
}

ff_constant_effect {
	level	int16
	envelop	ff_envelope
}

ff_ramp_effect {
	slevel	int16
	elevel	int16
	envelop	ff_envelope
}

ff_periodic_effect {
	wave		flags[ff_periodic_effect_wave, int16]
	period		int16
	magnit		int16
	offset		int16
	phase		int16
	envelope	ff_envelope
	custom_len	len[custom_data, int32]
	custom_data	ptr[in, array[int16]]
}

ff_condition_effect {
	rsatur	int16
	lsatur	int16
	rcoeff	int16
	lcoeff	int16
	dead	int16
	center	int16
}

ff_rumble_effect {
	smagnit	int16
	wmagnit	int16
}

ff_envelope {
	len	int16
	level	int16
	flen	int16
	flevel	int16
}

input_mask {
	type	flags[input_codes, int32]
	size	bytesize[ptr, int32]
	ptr	ptr64[in, array[int8]]
}

input_absinfo {
	val	int32
	min	int32
	max	int32
	fuzz	int32
	flag	int32
	res	int32
}

define EVIOCGNAME64	EVIOCGNAME(64)
define EVIOCGPHYS64	EVIOCGPHYS(64)
define EVIOCGUNIQ64	EVIOCGUNIQ(64)
define EVIOCGPROP64	EVIOCGPROP(64)
define EVIOCGMTSLOTS64	EVIOCGMTSLOTS(64)
define EVIOCGKEY64	EVIOCGKEY(64)
define EVIOCGLED64	EVIOCGLED(64)
define EVIOCGSND64	EVIOCGSND(64)
define EVIOCGSW64	EVIOCGSW(64)
define EVIOCGBITKEY64	EVIOCGBIT(EV_KEY, 64)
define EVIOCGBITSND64	EVIOCGBIT(EV_SND, 64)
define EVIOCGBITSW64	EVIOCGBIT(EV_SW, 64)
define EVIOCGABS0	EVIOCGABS(0)
define EVIOCGABS20	EVIOCGABS(0x20)
define EVIOCGABS2F	EVIOCGABS(0x2F)
define EVIOCGABS3F	EVIOCGABS(0x3F)
define EVIOCSABS0	EVIOCSABS(0)
define EVIOCSABS20	EVIOCSABS(0x20)
define EVIOCSABS2F	EVIOCSABS(0x2F)
define EVIOCSABS3F	EVIOCSABS(0x3F)
]

gemini-3-pro-preview

							input: 319931
							output: 1371
							thoughts: 1463
						

**My Line of Reasoning**

Okay, first things first, I see we're dealing with a `syz_usb_connect` call, followed by a `syz_usb_disconnect` and subsequent `syz_usb_ep_read` and `syz_usb_ep_write` interactions, so we're setting up a USB connection.  This looks like a standard device setup and teardown, and I see the use of `nanosleep` to allow for the device to initialise. But what's really catching my attention now is the multiple calls to `syz_open_dev$evdev`.

The lightbulb just went on. I recognize this pattern! It's likely that `syz_open_dev$evdev` is being used to open event devices, presumably created to interface with whatever USB device is being setup. Now, if `ir_video` uses `client->dev` as a reference, and if these `evdev` file descriptors *also* hold a reference to `client->dev`, we've got a potential issue on our hands. Specifically, the subsequent `syz_usb_disconnect` call could try to free the device while `evdev` instances are still holding references. We could have a blocking issue in `i2c_del_adapter`.

I'm thinking this sequence is designed to trigger a race condition or resource conflict. Let's see if we can confirm this hypothesis by observing this set up.

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
r2 = syz_open_dev$evdev(&(0x7f0000000400)='/dev/input/event#\x00', 0, 0)
r3 = syz_open_dev$evdev(&(0x7f0000000440)='/dev/input/event#\x00', 1, 0)
r4 = syz_open_dev$evdev(&(0x7f0000000480)='/dev/input/event#\x00', 2, 0)
r5 = syz_open_dev$evdev(&(0x7f00000004c0)='/dev/input/event#\x00', 3, 0)
r6 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 4, 0)
r7 = syz_open_dev$evdev(&(0x7f0000000540)='/dev/input/event#\x00', 5, 0)
r8 = syz_open_dev$evdev(&(0x7f0000000580)='/dev/input/event#\x00', 6, 0)
r9 = syz_open_dev$evdev(&(0x7f00000005c0)='/dev/input/event#\x00', 7, 0)
syz_usb_disconnect(r1)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 323103
							output: 1208
							thoughts: 971
						

**Debugging USB Device Disconnection**

Okay, still no luck reproducing this issue. I'm starting to think the `USBDEVFS_DISCONNECT` ioctl might be the key. Let's try leveraging that. The problem is, I need the correct file descriptor. I know that `syz_usb_connect` returns either `/dev/raw-gadget` or `/dev/vhci`, which are *not* the USB device file descriptors like `/dev/bus/usb/XXX/YYY`. That means I need to use `syz_open_dev$usbfs` to get the correct descriptor.

Hmm, this function uses a string with a '#' to denote where to insert an ID. But the string contains two '#'. Looking into the syzkaller's `executor/common_linux.h`, the comments say that it should replace all '#' with id. If `id` is `0`, then the result would be `/dev/bus/usb/000/000`.

However, the bus number seems to start from 1, so it should be `/dev/bus/usb/001/001` or `/dev/bus/usb/001/002`. I have to confirm that `syz_open_dev$usbfs` exists in syzkaller. Aha, confirmed, it's defined in `dev_bus_usb.txt`. We can use it to open the USB device, which is `/dev/bus/usb/00#/00#` with a specified `id`.

Now, if I have the file descriptor, I can call `ioctl$USBDEVFS_DISCONNECT`. But what's the correct ioctl code? Okay, according to `dev_bus_usb.txt`, the `USBDEVFS_DISCONNECT` value is `0x5516`, but the function I'm supposed to use is called `USBDEVFS_IOCTL`. That's `0x80105512` and it takes a `usbdevfs_ioctl` structure as an argument. The correct argument I need is a `usbdevfs_ioctl_disconnect` which contains the actual ioctl code.

Wait, instead of hardcoding `0x80105512` and `0x5516`, can I use symbolic constants instead? Yes, I can use `AUTO` for the ioctl code, which would allow syzkaller to pick it. Therefore, the ioctl call should be:

`ioctl$USBDEVFS_IOCTL(r10, AUTO, &(0x7f0000000700)=@usbdevfs_disconnect={0, AUTO, 0})`

Let's try that.

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
r2 = syz_open_dev$evdev(&(0x7f0000000400)='/dev/input/event#\x00', 0, 0)
r3 = syz_open_dev$evdev(&(0x7f0000000440)='/dev/input/event#\x00', 1, 0)
r4 = syz_open_dev$evdev(&(0x7f0000000480)='/dev/input/event#\x00', 2, 0)
r5 = syz_open_dev$evdev(&(0x7f00000004c0)='/dev/input/event#\x00', 3, 0)
r10 = syz_open_dev$usbfs(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0, 0)
r11 = syz_open_dev$usbfs(&(0x7f0000000640)='/dev/bus/usb/00#/00#\x00', 1, 0)
r12 = syz_open_dev$usbfs(&(0x7f0000000680)='/dev/bus/usb/00#/00#\x00', 2, 0)
ioctl$USBDEVFS_IOCTL(r10, AUTO, &(0x7f0000000700)=@usbdevfs_disconnect={0, AUTO, 0})
ioctl$USBDEVFS_IOCTL(r11, AUTO, &(0x7f0000000700)=@usbdevfs_disconnect={0, AUTO, 0})
ioctl$USBDEVFS_IOCTL(r12, AUTO, &(0x7f0000000700)=@usbdevfs_disconnect={0, AUTO, 0})
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 325904
							output: 1208
							thoughts: 2188
						

**Debugging USB Device Enumeration**

Okay, still no luck reproducing the issue. I need to retrace my steps. So, `ioctl$USBDEVFS_IOCTL` is being called on the device, using registers `r10`, `r11`, `r12`, but `syz_open_dev$usbfs` is messing with the `#` with `id`. If `id` is 0, it opens `/dev/bus/usb/000/000`, which clearly doesn't exist. If it's 1, we get `/dev/bus/usb/001/001`, the root hub; and 2 opens `/dev/bus/usb/002/002`. Hmm, so the root hub is at `001/001` while the actual device is at `001/002`. To disconnect the device, I should be calling `USBDEVFS_DISCONNECT` on the device *itself*, not the root hub, right? No, `USBDEVFS_DISCONNECT` *unbinds* the driver from the interface, which is different. Calling it on `001/002` would unbind `pvrusb2` from interface 0. Calling it on `001/001` unbinds the hub driver and *disconnects* everything. Either way, it should trigger `pvr_disconnect`. But wait, when `id=1`, `syz_open_dev$usbfs` opens the root hub, `001/001`. Then `ioctl$USBDEVFS_IOCTL(r11, ...)` should unbind the hub driver. `ifno` is `0`, so the hub interface is `0`. It should work!

Why isn't it hanging then? Maybe `pvrusb2` isn't probed at all? Let's check. If I use `syz_usb_connect(0, AUTO, &AUTO, 0)`, syzkaller will patch it to a random device. I don't have the *exact* syz reproducer from the bug report, just the crash log. But I can use `syz_usb_connect` with `usb_device_descriptor` and `idVendor=0x2040` using `ANY` pointer. Already did that. Is there another way to force `idVendor`? What about changing `idVendor` in a `syz_usb_connect$printer`? Nope, it takes `usb_device_descriptor_printer`. Using `ANY` is the same as before.

Wait a sec, could `pvrusb2` require `bNumEndpoints` to be 3? Let's go back and check `pvr2_device_29xxx`. Nope, only `flag_has_analogtuner = !0`. Does it require an interrupt endpoint? Going into `pvr2_hdw_create` shows that it only allocates `ctl_write_urb` and `ctl_read_urb` – no interrupt URB. So, not a requirement.

How about `bInterfaceClass` needing to be `0xff`? Already took care of that!

Let's verify if `syz_usb_connect` is even working. If I use `ANYBLOB='\x12\x01...'`, does syzkaller correctly send it to `raw-gadget`? Yep, `ANYBLOB` is just a byte array. But `syz_usb_connect` takes `dev_len` as the second argument, which I set to `0x32` (50). Is my descriptor length exactly 50? 18 (device) + 9 (config) + 9 (interface) + 7 (ep1) + 7 (ep2) = 50. Yes, it is.

Hold on…could the device descriptor be rejected by the USB core? Let's check each field:

*   `\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x01\x02\x03\x01`
    *   `bLength` = 18 – Valid.
    *   `bDescriptorType` = 1 – Valid.
    *   `bcdUSB` = 0x0200 – Valid.
    *   `bDeviceClass` = 0 – Valid.
    *   `bDeviceSubClass` = 0 – Valid

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x00\x00\x00\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
r2 = syz_open_dev$evdev(&(0x7f0000000400)='/dev/input/event#\x00', 0, 0)
r3 = syz_open_dev$evdev(&(0x7f0000000440)='/dev/input/event#\x00', 1, 0)
r4 = syz_open_dev$evdev(&(0x7f0000000480)='/dev/input/event#\x00', 2, 0)
r5 = syz_open_dev$evdev(&(0x7f00000004c0)='/dev/input/event#\x00', 3, 0)
r10 = syz_open_dev$usbfs(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0, 0)
r11 = syz_open_dev$usbfs(&(0x7f0000000640)='/dev/bus/usb/00#/00#\x00', 1, 0)
r12 = syz_open_dev$usbfs(&(0x7f0000000680)='/dev/bus/usb/00#/00#\x00', 2, 0)
ioctl$USBDEVFS_IOCTL(r10, AUTO, &(0x7f0000000700)=@usbdevfs_disconnect={0, AUTO, 0})
ioctl$USBDEVFS_IOCTL(r11, AUTO, &(0x7f0000000700)=@usbdevfs_disconnect={0, AUTO, 0})
ioctl$USBDEVFS_IOCTL(r12, AUTO, &(0x7f0000000700)=@usbdevfs_disconnect={0, AUTO, 0})
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 330350
							output: 1227
							thoughts: 1815
						

**Debugging the USB Disconnect Bug: A Deep Dive**

Okay, still no luck reproducing this bug. Let's methodically retrace our steps and verify our assumptions. First, could it be that `pvrusb2` is picky about the `bDeviceClass` field in the USB descriptor?  No, the `pvr2_device_table` only uses `idVendor` and `idProduct` for matching, so that's not the issue.  

But, did I check if `syz_usb_connect` is even *using* the `ANYBLOB` descriptor I'm providing? Let's verify how it interacts with the `raw-gadget`... Ah, looks like the code *does* read the descriptor. It's reading `a1` bytes from `a2`, which translates to the descriptor data I provided. Good, my crafted descriptor is being sent!

Alright, next, is it possible `raw-gadget` expects some specific descriptor format, even if not explicitly mandated in the code? However, since `syz_usb_connect` handles the raw ioctls, it should work.

Why is this bug *not* reproducing? Maybe the critical part in `i2c_del_adapter` doesn't block as I expect. However, if the associated input device is open, I confirmed `i2c_del_adapter` *does* block. So the issue has to be that the input device *is* open. The `ir_video` driver registers an input device, but *only* if `pvr2_i2c_register_ir` is called. And, I see `pvr2_i2c_register_ir` *is* called. This is at the end of `pvr2_i2c_core_init`, and `i2c_new_client_device` calls the probe function immediately, so the input device will be created.

But, am I opening the *correct* input device with `syz_open_dev$evdev`? Syzkaller, by default, will try `/dev/input/event0`, `/dev/input/event1`, etc. I'm opening several of them, but what if my device registers as `/dev/input/event5`? I've been opening a few, but maybe I'm not opening the one that the driver created. Let's try opening more input devices.

Now, what about `USBDEVFS_DISCONNECT`? I've been trying it on devices opened with `syz_open_dev$usbfs`. However, that function opens `/dev/bus/usb/00#/00#`, and these are usually not the devices I'm interested in! So, if the root hub is `/dev/bus/usb/001/001`, `USBDEVFS_DISCONNECT` on it will disconnect all the children, and that SHOULD trigger the bug! Is it a privilege issue? Nope, syzkaller runs as root so there shouldn't be a problem there.

Alright, back to the basics: let's try `syz_usb_disconnect` again, but this time with a *bunch* of `syz_open_dev$evdev` calls, and a *long* `nanosleep` at the end to make sure the program doesn't exit immediately after the `ioctl` calls. Wait a second... did I forget the `nanosleep` in the previous attempt?! If I don't add that, then the program exits immediately, closing file descriptors, and that prevents the hang! Okay, I need to include that sleep to keep the devices open. I should be able to reproduce the hang now!

map[ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x00\x00\x00\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
r2 = syz_open_dev$evdev(&(0x7f0000000400)='/dev/input/event#\x00', 0, 0)
r3 = syz_open_dev$evdev(&(0x7f0000000440)='/dev/input/event#\x00', 1, 0)
r4 = syz_open_dev$evdev(&(0x7f0000000480)='/dev/input/event#\x00', 2, 0)
r5 = syz_open_dev$evdev(&(0x7f00000004c0)='/dev/input/event#\x00', 3, 0)
r6 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 4, 0)
r7 = syz_open_dev$evdev(&(0x7f0000000540)='/dev/input/event#\x00', 5, 0)
r8 = syz_open_dev$evdev(&(0x7f0000000580)='/dev/input/event#\x00', 6, 0)
r9 = syz_open_dev$evdev(&(0x7f00000005c0)='/dev/input/event#\x00', 7, 0)
r10 = syz_open_dev$usbfs(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 1, 0)
ioctl$USBDEVFS_IOCTL(r10, AUTO, &(0x7f0000000700)=@usbdevfs_disconnect={0, AUTO, 0})
nanosleep(&(0x7f0000000300)={200, 0}, 0)
]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 334218
							output: 1431
							thoughts: 1563
						

**Debugging a USB Driver Issue**

Okay, still no luck reproducing this bug. Let's think this through. Could the disconnect actually be triggered by `USBDEVFS_DISCONNECT` *on the device* itself, and not the hub? If it's the device, then the file descriptor `ifno` is 0, right? But I know that `syz_open_dev$usbfs` can't open the device if it's replacing BOTH `#` characters with the *same* `id`. It only works for things like `001/001`, `002/002`, etc.

Wait a minute, is there another way to open the USB device? Oh, yeah, `openat(AT_FDCWD, "/dev/bus/usb/001/002", O_RDWR)`! But syzkaller *escapes* strings, right?

Hold on... What is the definition of `openat$sysfs`? I'll check... No, that's not what I need. Is there an `openat$usbfs`? Nope. Damn!

But wait a minute, the definition for `syz_open_dev$usbfs` is a bit interesting...

```
syz_open_dev$usbfs(dev ptr[in, string["/dev/bus/usb/00#/00#"]], id intptr, flags flags[open_flags]) fd_usbfs
```

Wait! It occurs to me now. Looking at the definition for `syz_open_dev` in `executor/common_linux.h`:

```c
static volatile long syz_open_dev(volatile long a0, volatile long a1, volatile long a2)
{
	if (a0 == 0xc || a0 == 0xb) {
		// ...
	} else {
		char req[100];
		char* dev = (char*)a0;
		int id = (int)a1;
		int flags = (int)a2;
		if (strstr(dev, "#")) {
			snprintf(req, sizeof(req), dev, id);
			dev = req;
		}
		// ...
	}
}
```

Okay, the `snprintf(req, sizeof(req), dev, id)` call is key! If the input device string is something like `"/dev/bus/usb/00%d/00%d"`, it will replace *both* with the same `id`? No, because `snprintf` is expecting a format specifier like `%d`.

But the string is indeed `"/dev/bus/usb/00#/00#"`. So, `syz_open_dev` replaces `#` with `%d`? Hmm, let me check the source code for `syz_open_dev` in syzkaller.

Ah! The Go code *replaces* `#` with `%d` *before* passing it to the executor! So the string passed to `syz_open_dev` is something like `"/dev/bus/usb/00%d/00%d"`! The `snprintf` function is called with only *one* `id` argument! So if there are TWO `%d` specifiers, `snprintf` will read the *second* argument from the stack or registers. This is undefined behavior, right?

Wait, so syzkaller's `syz_open_dev` is known to be buggy for strings with multiple `#` characters!

But wait, why didn't `syz_usb_disconnect` trigger the bug? If I just used `syz_usb_disconnect(r0)`, it disconnects the device!

Because `syz_usb_disconnect` closes `fd_usb`, which destroys the vhci device, and this calls `usb_remove_hcd`. This then calls `usb_disconnect` on the root hub. This calls `device_del` on the root hub. This unbinds the hub driver. This calls `hub_disconnect`. This calls `hub_quiesce`. This calls `usb_disconnect` on all children. This calls `device_del` on the `pvrusb2` device. This unbinds the `pvrusb2` driver. This calls `pvr_disconnect`. This then calls `pvr2_context_disconnect`. Then `pvr2_hdw_disconnect`. Then `pvr2_i2c_core_done`. Then `i2c_del_adapter`. This waits for `adap->dev_released`, which blocks if the input device is open!

map[ReproSyz:# First connection to load the module
r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x00\x00\x00\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
nanosleep(&(0x7f0000000300)={2, 0}, 0)
syz_usb_disconnect(r0)

# Second connection
r1 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x00\x00\x00\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r1, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r1, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)

# Open input devices
r2 = syz_open_dev$evdev(&(0x7f0000000400)='/dev/input/event#\x00', 0, 0)
r3 = syz_open_dev$evdev(&(0x7f0000000440)='/dev/input/event#\x00', 1, 0)
r4 = syz_open_dev$evdev(&(0x7f0000000480)='/dev/input/event#\x00', 2, 0)
r5 = syz_open_dev$evdev(&(0x7f00000004c0)='/dev/input/event#\x00', 3, 0)
r6 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 4, 0)
r7 = syz_open_dev$evdev(&(0x7f0000000540)='/dev/input/event#\x00', 5, 0)
r8 = syz_open_dev$evdev(&(0x7f0000000580)='/dev/input/event#\x00', 6, 0)
r9 = syz_open_dev$evdev(&(0x7f00000005c0)='/dev/input/event#\x00', 7, 0)

# Disconnect
syz_usb_disconnect(r1)

# Wait forever to trigger hung task
nanosleep(&(0x7f0000000300)={200, 0}, 0)]

map[ReproducedBugTitle: ReproducedCrashReport:]

gemini-3-pro-preview

							input: 338262
							output: 1245
							thoughts: 5826
						

**Reproducing the pvrusb2 I2C Bug in Syzkaller**

Alright, let's break this down. The problem isn't that `pvrusb2` isn't loaded; it *is* built-in, according to the crash dump.  The core issue seems to be the I2C adapter not getting properly initialized and, specifically, the process getting blocked, leading to a hang. I'm focusing on the `pvr2_i2c_core_done` function, so `pvrusb2` is definitely the target.

My initial thought was maybe `udev` was the culprit, but Syzkaller doesn't run `udev` by default and that's not the root cause. This led me to investigate how `pvrusb2` gets probed and initialized in the Syzkaller environment. The module loading is automatic if triggered.

The device descriptor looks correct; vendor and product IDs are properly interpreted (little-endian is handled correctly), and the interface class is also correct to ensure that the driver binds. The endpoint count doesn't seem to be a problem. My device matches what is expected.

The crux of the matter appears to be in how `pvr2_hdw_check_firmware` is called, specifically, the firmware loading logic. If this step fails, it triggers a blocking call to `request_firmware`, and if that times out, it will block `pvr2_hdw_setup_low` and therefore, `pvr2_i2c_core_init` is never called. So, the goal is to make `pvr2_hdw_check_firmware` *succeed* to bypass the blocking firmware loading.

To make `pvr2_hdw_check_firmware` succeed, the call to `pvr2_send_request_ex` must return zero. This, in turn, requires both the write and read URBs to complete successfully. I *am* providing the necessary `syz_usb_ep_read` and `syz_usb_ep_write` calls in the reproducer to handle these URBs. The endpoints are correctly set (`0x01` for write and `0x81` for read). I am supplying a single byte to satisfy the read request length in `pvr2_send_request_ex`. I am supplying these calls right after the `syz_usb_connect` call and the URBs are therefore properly handled in time. These should complete quickly as they are async.

The use of `raw-gadget` is correct; that's how Syzkaller's USB calls work, and they *do* enable the endpoints when the host sends `USB_REQ_SET_CONFIGURATION`. It's not a firmware mismatch; the check only wants a reply from the device. I think the URBs are being handled correctly. The only remaining theory is that `pvr2_hdw_check_firmware` expects a specific value, but it is not the case because it does not validate the value read, so that should not be the problem.

My focus is the `pvr2_i2c_core_done` function being blocked, so the input devices (evdev) are the most likely culprit.

Therefore, the reproducer should create the USB device, reply to the check, wait a bit, open the associated input devices, then disconnect the device and finally wait for a long time (200 seconds) so that the watchdog triggers the bug.

I am confident that this is the best repro.

map[ReproOpts:{"threaded":true,"collide":false,"repeat":true,"procs":1,"sandbox":"none","fault_call":-1,"tun":true,"netdev":true,"netreset":true,"cgroups":true,"bpf":true,"netlink":true,"usb":true,"vcan":true,"vhci":true,"wifi":true,"ieee802154":true,"syssysfs":true,"sysctl":true,"mount":true} ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x00\x00\x00\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
r2 = syz_open_dev$evdev(&(0x7f0000000400)='/dev/input/event#\x00', 0, 0)
r3 = syz_open_dev$evdev(&(0x7f0000000440)='/dev/input/event#\x00', 1, 0)
r4 = syz_open_dev$evdev(&(0x7f0000000480)='/dev/input/event#\x00', 2, 0)
r5 = syz_open_dev$evdev(&(0x7f00000004c0)='/dev/input/event#\x00', 3, 0)
r6 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 4, 0)
r7 = syz_open_dev$evdev(&(0x7f0000000540)='/dev/input/event#\x00', 5, 0)
r8 = syz_open_dev$evdev(&(0x7f0000000580)='/dev/input/event#\x00', 6, 0)
r9 = syz_open_dev$evdev(&(0x7f00000005c0)='/dev/input/event#\x00', 7, 0)
syz_usb_disconnect(r0)
nanosleep(&(0x7f0000000300)={200, 0}, 0)]

map[ReproOpts:{"threaded":true,"collide":false,"repeat":true,"procs":1,"sandbox":"none","fault_call":-1,"tun":true,"netdev":true,"netreset":true,"cgroups":true,"bpf":true,"netlink":true,"usb":true,"vcan":true,"vhci":true,"wifi":true,"ieee802154":true,"syssysfs":true,"sysctl":true,"mount":true} ReproSyz:r0 = syz_usb_connect(0, 0x32, &AUTO=ANY=[@ANYBLOB='\x12\x01\x00\x02\x00\x00\x00\x40\x40\x20\x00\x29\x00\x00\x00\x00\x00\x01\x09\x02\x20\x00\x01\x01\x00\x80\xfa\x09\x04\x00\x00\x02\xff\xff\xff\x00\x07\x05\x01\x02\x00\x02\x00\x07\x05\x81\x02\x00\x02\x00'], 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000500)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000600)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000700)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
syz_usb_ep_read(r0, 0x01, AUTO, &(0x7f0000000800)=""/64) (async)
syz_usb_ep_write(r0, 0x81, AUTO, &(0x7f0000000200)='\x00') (async)
nanosleep(&(0x7f0000000300)={1, 0}, 0)
r2 = syz_open_dev$evdev(&(0x7f0000000400)='/dev/input/event#\x00', 0, 0)
r3 = syz_open_dev$evdev(&(0x7f0000000440)='/dev/input/event#\x00', 1, 0)
r4 = syz_open_dev$evdev(&(0x7f0000000480)='/dev/input/event#\x00', 2, 0)
r5 = syz_open_dev$evdev(&(0x7f00000004c0)='/dev/input/event#\x00', 3, 0)
r6 = syz_open_dev$evdev(&(0x7f0000000500)='/dev/input/event#\x00', 4, 0)
r7 = syz_open_dev$evdev(&(0x7f0000000540)='/dev/input/event#\x00', 5, 0)
r8 = syz_open_dev$evdev(&(0x7f0000000580)='/dev/input/event#\x00', 6, 0)
r9 = syz_open_dev$evdev(&(0x7f00000005c0)='/dev/input/event#\x00', 7, 0)
syz_usb_disconnect(r0)
nanosleep(&(0x7f0000000300)={200, 0}, 0)]