diff options
| author | Alexander Potapenko <glider@google.com> | 2025-10-01 16:35:10 +0200 |
|---|---|---|
| committer | Alexander Potapenko <glider@google.com> | 2025-10-17 06:51:20 +0000 |
| commit | e69835fc40b5e00c0996ce3a85d8287eea57d162 (patch) | |
| tree | d935f0f54b202ec2402f74852f7d44735b567653 /sys/linux | |
| parent | b2cf58f4862666d3b14f051b1e8cddcde9f8186f (diff) | |
executor: sys/linux: implement SYZOS_API_SET_IRQ_HANDLER
The new API call allows to initialize the handler with one of the
three possible values:
- NULL (should cause a page fault)
- dummy_null_handler (should call iret)
- uexit_irq_handler (should perform guest_uexit(UEXIT_IRQ))
Also add a test for uexit_irq_handler()
Diffstat (limited to 'sys/linux')
| -rw-r--r-- | sys/linux/dev_kvm_amd64.txt | 24 | ||||
| -rw-r--r-- | sys/linux/test/amd64-syz_kvm_set_irq_handler | 31 |
2 files changed, 46 insertions, 9 deletions
diff --git a/sys/linux/dev_kvm_amd64.txt b/sys/linux/dev_kvm_amd64.txt index 43474f9f6..ed2880063 100644 --- a/sys/linux/dev_kvm_amd64.txt +++ b/sys/linux/dev_kvm_amd64.txt @@ -89,16 +89,22 @@ syzos_api_out_dx { arg_val int64 } +syzos_api_set_irq_handler { + arg_vector int64[0:255] + arg_handler_type int64[0:2] +} + syzos_api_call$x86 [ - uexit syzos_api$x86[0, intptr] - code syzos_api$x86[10, syzos_api_code$x86] - cpuid syzos_api$x86[20, syzos_api_cpuid] - wrmsr syzos_api$x86[30, syzos_api_wrmsr] - rdmsr syzos_api$x86[50, syzos_api_rdmsr] - wr_crn syzos_api$x86[70, syzos_api_wr_crn] - wr_drn syzos_api$x86[110, syzos_api_wr_drn] - in_dx syzos_api$x86[130, syzos_api_in_dx] - out_dx syzos_api$x86[170, syzos_api_out_dx] + uexit syzos_api$x86[0, intptr] + code syzos_api$x86[10, syzos_api_code$x86] + cpuid syzos_api$x86[20, syzos_api_cpuid] + wrmsr syzos_api$x86[30, syzos_api_wrmsr] + rdmsr syzos_api$x86[50, syzos_api_rdmsr] + wr_crn syzos_api$x86[70, syzos_api_wr_crn] + wr_drn syzos_api$x86[110, syzos_api_wr_drn] + in_dx syzos_api$x86[130, syzos_api_in_dx] + out_dx syzos_api$x86[170, syzos_api_out_dx] + set_irq_handler syzos_api$x86[190, syzos_api_set_irq_handler] ] [varlen] kvm_text_x86 [ diff --git a/sys/linux/test/amd64-syz_kvm_set_irq_handler b/sys/linux/test/amd64-syz_kvm_set_irq_handler new file mode 100644 index 000000000..ad2c9479a --- /dev/null +++ b/sys/linux/test/amd64-syz_kvm_set_irq_handler @@ -0,0 +1,31 @@ +# +# requires: arch=amd64 -threaded +# +r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0) +r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0) +r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) +# +# Set a non-dummy IRQ handler for vector 0x80. +# +r3 = syz_kvm_add_vcpu$x86(r2, &AUTO={0x0, &AUTO=[@set_irq_handler={AUTO, AUTO, {0x80, 0x2}}, @uexit={AUTO, AUTO, 0xaaaa}], AUTO}) +r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, AUTO) +r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x1, r3, 0x0) + +# Run till uexit(0xaaaa). +# +ioctl$KVM_RUN(r3, AUTO, 0x0) +syz_kvm_assert_syzos_uexit$x86(r5, 0xaaaa) + +# Inject interrupt 0x80. +# +ioctl$KVM_INTERRUPT(r3, AUTO, &AUTO=0x80) +ioctl$KVM_RUN(r3, AUTO, 0x0) + +# Ensure that the uexit code is UEXIT_IRQ. +# +syz_kvm_assert_syzos_uexit$x86(r5, 0xfffffffffffffffe) + +# Run till the end. +# +ioctl$KVM_RUN(r3, AUTO, 0x0) +syz_kvm_assert_syzos_uexit$x86(r5, 0xffffffffffffffff) |