aboutsummaryrefslogtreecommitdiffstats
path: root/executor
Commit message (Collapse)AuthorAgeFilesLines
* executor: common_kvm.h: fix compilationAlexander Potapenko2025-10-171-1/+1
| | | | | | Add #if checks to define executor_fn_guest_addr() for __NR_syz_kvm_setup_cpu and __NR_syz_kvm_setup_syzos_vm. This fixes a compilation error spotted by csource_test.go
* executor: common_kvm_ppc64.h: drop kvm_ppc_mmuv3_cfgAlexander Potapenko2025-10-171-6/+0
| | | | | | struct kvm_ppc_mmuv3_cfg seems to be defined in /usr/powerpc64le-linux-gnu/include/asm/kvm.h, remove the duplicate definition.
* executor: s/true/1 in common_kvm_ppc64.hAlexander Potapenko2025-10-171-1/+1
| | | | Fix a compilation error spotted by csource_test.go
* executor: introduce __addrspace_guestAlexander Potapenko2025-10-176-64/+63
| | | | | | | | | | | | Apply __addrspace_guest to every guest function and use a C++ template to statically validate that host functions are not passed to executor_fn_guest_addr(). This only works in Clang builds of syz-executor, because GCC does not support address spaces, and C reproducers cannot use templates. The static check allows us to drop the dynamic checks in DEFINE_GUEST_FN_TO_GPA_FN(). While at it, replace DEFINE_GUEST_FN_TO_GPA_FN() with explicit declarations of host_fn_guest_addr() and guest_fn_guest_addr().
* executor: unify ARM64_ADDR_EXECUTOR_CODE and X86_SYZOS_ADDR_EXECUTOR_CODEAlexander Potapenko2025-10-173-5/+13
| | | | | Use SYZOS_ADDR_EXECUTOR_CODE instead of both. Also put platform-specific definitions under #if GOARCH_xxx.
* executor: amd64: remove the switch from guest_main()Alexander Potapenko2025-10-171-31/+35
| | | | Somehow Clang still manages to emit a jump table for it.
* executor: fix setup_cpuid() declarationAlexander Potapenko2025-10-171-0/+2
| | | | Make sure setup_cpuid() is only declared together with install_user_code()
* executor: sys/linux: implement SYZOS_API_SET_IRQ_HANDLERAlexander Potapenko2025-10-172-13/+70
| | | | | | | | | | The new API call allows to initialize the handler with one of the three possible values: - NULL (should cause a page fault) - dummy_null_handler (should call iret) - uexit_irq_handler (should perform guest_uexit(UEXIT_IRQ)) Also add a test for uexit_irq_handler()
* executor: use dynamic page table allocation for guestAlexander Potapenko2025-10-172-63/+38
| | | | | | | | Use a pool of 32 pages to allocate PT and PE entries for the guest page tables. This eliminates the need for manually assigned page table entries that are brittle and may break when someone changes the memory layout.
* executor: refactor x86 SYZOS setupAlexander Potapenko2025-10-172-65/+67
| | | | | Pass around struct kvm_syzos_vm instead of one-off pointers to various guest memory ranges.
* executor: rework GDT setup for SYZOSAlexander Potapenko2025-10-173-54/+109
| | | | | Untangle SYZOS GDT setup from the legacy one. Drop LDT and TSS for now.
* executor: fix the definition of struct tss64Alexander Potapenko2025-10-171-2/+2
| | | | | Per https://wiki.osdev.org/Task_State_Segment#Long_Mode, io_bitmap and reserved3 should be 16-bit.
* executor: use a list of memory regions to set up SYZOS guestAlexander Potapenko2025-10-171-35/+44
| | | | | Instead of open-coding every memory region in several places, use a single array to configure their creation.
* executor: more robust x86 page table creation in SYZOSAlexander Potapenko2025-10-172-16/+117
| | | | | | Provide map_4k_region() to ease page table creation for different regions. While at it, also move the stack from 0x0 to 0x90000.
* executor: introduce DEFINE_GUEST_FN_TO_GPA_FN()Alexander Potapenko2025-10-173-2/+39
| | | | | DEFINE_GUEST_FN_TO_GPA_FN() allows to define helper functions to calculate guest addresses in the host/guest code.
* executor: rename SYZOS-related address definitionsAlexander Potapenko2025-10-173-21/+25
| | | | | | | To distinguish SYZOS addresses from other x86 definitions, change them to start with X86_SYZOS_ADDR_ No functional change.
* prog: fix syz_kfuzztest_run allocation strategyEthan Graham2025-09-221-4/+4
| | | | | | | | | | | | | | | | | | | | Previously, the generated KFuzzTest programs were reusing the address of the top-level input struct. A problem could arise when the encoded blob is large and overflows into another allocated region - this certainly happens in the case where the input struct points to some large char buffer, for example. While this wasn't directly a problem, it could lead to racy behavior when running KFuzzTest targets concurrently. To fix this, we now introduce an additional buffer parameter into syz_kfuzztest_run that is as big as the maximum accepted input size in the KFuzzTest kernel code. When this buffer is allocated, we ensure that we have some allocated space in the program that can hold the entire encoded input. This works in practice, but has not been tested with concurrent KFuzzTest executions yet.
* kfuzztest: introduce syz_kfuzztest_run pseudo-syscallEthan Graham2025-09-221-0/+54
| | | | | | | | | | | | | Add syz_kfuzztest_run pseudo-syscall, KFuzzTest attribute, and encoding logic. KFuzzTest targets, which are invoked in the executor with the new syz_kfuzztest_run pseudo-syscall, require specialized encoding. To differentiate KFuzzTest calls from standard syzkaller calls, we introduce a new attribute called KFuzzTest or "kfuzz_test" in syzkaller descriptions that can be used to annotate calls. Signed-off-by: Ethan Graham <ethangraham@google.com>
* sys/linux: executor: add IN_DX and OUT_DX to SYZOS x86 APIAlexander Potapenko2025-09-191-0/+67
| | | | | | | | Add SYZOS calls that correspond to the IN and OUT x86 instructions that perform port I/O. These instructions have different variants, for now we just implement the one that takes the port number from DX instead of encoding it in the opcode.
* sys/linux: executor: implement SYZOS_API_WR_DRN on x86Alexander Potapenko2025-09-191-0/+45
| | | | | Add a SYZOS call to write to one of the debug registers (DR0-DR7).
* executor: sys/linux/: pkg/runtest: pkg/vminfo: add syz_kvm_assert_syzos_kvm_exitAlexander Potapenko2025-09-195-1/+35
| | | | Implement a pseudo-syscall to check the value of kvm_run.exit_reason
* executor: introduce __no_stack_protector and use it for guest codeAlexander Potapenko2025-09-113-23/+37
| | | | | | | | | | | When compiling the executor in syz-env-old, -fstack-protector may kick in and introduce global accesses that tools/check-syzos.sh reports. To prevent this, introduce the __no_stack_protector macro attribute that disable stack protection for the function in question, and use it for guest code. While at it, factor out some common definitions into common_kvm_syzos.h
* executor: x86: fix check-syzos errorAlexander Potapenko2025-09-111-14/+16
| | | | | Replace the switch statement in guest_handle_wr_crn() with a series of if statements.
* executor: refactor execute_req parsing to use names for IPC flagsJann Horn2025-09-021-5/+5
| | | | | | This makes it easier to figure out where the flags go by grepping for them by name. No functional change intended.
* executor: move proc opts to a separate structAleksandr Nogikh2025-08-211-36/+41
| | | | This will reduce code duplication and simplify adding new fields.
* executor: arm64: syzos: add flush_cache_range()Alexander Potapenko2025-08-081-3/+32
| | | | | | | | ARMv8-A architecture mandates how caches should be flushed when writing self-modifying code. Although it would be nice to catch some bugs caused by omitting this synchronization, we want it to happen in most cases, so that our code actually works.
* executor: arm64: syzos: fix the constraints in gicv3_cpu_init()Alexander Potapenko2025-08-081-2/+1
| | | | | | Somehow we were using an input constraint instead of an output one in the assembly code performing a read of ICC_SRE_EL1 into a GP register.
* executor: arm64: syzos: delete clobbers from one_irq_handler_fn()Alexander Potapenko2025-08-081-3/+1
| | | | | In fact this function does not clobber any registers, they all are restored. Therefore, just delete the registers from the clobber list.
* executor: keep output area base address on reallocationAleksandr Nogikh2025-08-061-0/+7
| | | | | | Output area may be remapped from several different processes (i.e. after forking), so we should not assume that the suggested base address will be the same.
* executor: change input/output area mapping rulesAleksandr Nogikh2025-08-061-26/+62
| | | | | | | | | | | For ASAN builds, assume that the executable is dynamically linked and that the addresses in HighMem may be occupied by the libraries. Otherwise, use fixed addresses both for the input and the output area. Before, input area was mapped at an arbitrary location and the default output area location for ASAN builds was sometimes overlapping with it. Use MAP_FIXED_NOREPLACE to prevent such overlappings in the first place.
* Revert "executor: change input/output area mapping rules"Aleksandr Nogikh2025-08-051-62/+26
| | | | This reverts commit dce63a35b1bfe856335d8334bcd75f5412157309.
* executor: introduce cover_close()Alexander Potapenko2025-08-052-2/+19
| | | | | | | | | Right now closing a kcov fd on Linux won't disable coverage, so further attempts to open an fd and enable coverage on the same thread will not work. Add cover_close() which will disable the coverage if necessary, and close the file descriptor.
* executor: close the dangling file descriptor in setup_kcov_reset_ioctl()Alexander Potapenko2025-08-051-0/+2
|
* executor: decouple kcov memory allocation from the traceAlexander Potapenko2025-08-055-37/+52
| | | | | | | | | | | | On different platforms and in different coverage collection modes the pointer to the beginning of kcov buffer may or may not differ from the pointer to the region that mmap() returned. Decouple these two pointers, so that the memory is always allocated and deallocated with cov->mmap_alloc_ptr and cov->mmap_alloc_size, and the buffer is accessed via cov->data and cov->data_size. I tried my best to not break Darwin and BSD, but I did not test them.
* executor: change input/output area mapping rulesAleksandr Nogikh2025-08-051-26/+62
| | | | | | | | | | | For ASAN builds, assume that the executable is dynamically linked and that the addresses in HighMem may be occupied by the libraries. Otherwise, use fixed addresses both for the input and the output area. Before, input area was mapped at an arbitrary location and the default output area location for ASAN builds was sometimes overlapping with it. Use MAP_FIXED_NOREPLACE to prevent such overlappings in the first place.
* pkg/flatrpc, pkg/vminfo, executor: introduce readonly coverageAlexander Potapenko2025-07-312-5/+48
| | | | | | | | | | | | | Add a new vminfo feature, FeatureKcovResetIoctl, that is true if the kernel supports ioctl(KCOV_RESET_TRACE) making it possible to reset the coverage buffer on the kernel side. This, in turn, allows us to map the coverage buffer read-only, which will prevent all sorts of userspace-generated corruptions at a cost of an extra syscall per program execution. The corresponding exec env flag, ExecEnv::ReadOnlyCoverage, turns on read-only coverage in the executor. It is enabled by default if FeatureKcovResetIoctl is on.
* sys/linux: executor: implement SYZOS_API_WR_CRN on x86Alexander Potapenko2025-07-241-0/+37
| | | | | Add a SYZOS call to write to one of the system registers (CR0, CR2, CR3, CR4, CR8).
* executor/common_kvm_amd64_syzos.h: add _handle_ to function namesAlexander Potapenko2025-07-241-9/+9
| | | | | | Let's try to stick to the convention of naming every SYZOS API handler syzos_handle_something(). No functional change.
* executor: sys/linux/dev_kvm_amd64.txt: implement rdmsr/wrmsrAlexander Potapenko2025-07-241-0/+54
| | | | Let SYZOS execute RDMSR and WRMSR on x86.
* executor/common_kvm_amd64_syzos.h: add a missing breakAlexander Potapenko2025-07-241-0/+1
|
* executor: sys/linux: use sparse IDs for SYZOS APIAlexander Potapenko2025-07-241-3/+7
| | | | | | Like we already do on ARM, use prime numbers multiplied by 10 for SYZOS API IDs to prevent the compiler from emitting a jump table in guest_main().
* executor: neutralize errors=panic for gfs2 mountsAleksandr Nogikh2025-07-171-0/+3
| | | | | | | Append errors=withdraw to the mount options so that gfs2 withdrawals don't lead to kernel panics. Closes #6189.
* executor: handle zero length in syz_compare_zlibAleksandr Nogikh2025-07-141-3/+7
| | | | | | It used to fail because we cannot mmap 0 bytes. Closes #6148.
* executor: arm64: syzos: add SYZOS_API_ERET, SYZOS_API_SVCAlexander Potapenko2025-06-131-0/+41
| | | | We expect these commands to reach some NV coverage
* executor: linux: make syz_open_dev comment more correctFlorent Revest2025-06-041-1/+1
| | | | | | The logic in that branch of the code relies on replacing # characters with numbers. There's a comment in the code which shows a clarifying example but it misses the # which I found mildly confusing.
* executor: linux: fix syz_open_dev virtual file names rangeFlorent Revest2025-06-041-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | We noticed that syzkaller left some files with fairly unusual file names under /dev. Eg: ---------- 1 root root 0 May 30 14:42 vcs- ---------- 1 root root 0 May 30 14:48 vcs. ---------- 1 root root 136317631 May 30 14:42 vcs' ---------- 1 root root 0 May 30 14:48 vcs( ---------- 1 root root 0 May 30 14:43 vcs) ---------- 1 root root 0 May 30 14:43 vcs* ---------- 1 root root 136317633 May 30 14:46 vcs+ Funnily enough the characters after "vcs" are always within the '0'-10 to '0' ASCII range. We noticed that the syz_open_dev logic uses a modulo 10 on a signed number (the volatile long a1 argument) and in C the modulo of a negative number stays negative, so the result of this operation is in the '0'-10 to '0'+10 range. This is in turn casted to a char which is also signed and doesn't fix the glitch. By casting a1 to an unsigned long first, this keeps the result of the modulo operation signed and therefore the virtual file name suffix a number.
* executor/kvm: add SYZOS support for CPUIDMarios Pomonis2025-05-191-0/+21
| | | | | This commit adds support for CPUID instructions on AMD64. It also adds a relevant test.
* executor: arm64: syzos: prevent jump table emissionAlexander Potapenko2025-05-121-10/+14
| | | | | | | | | When compiling SYZOS into the executor binary, the compiler often attempts to emit a jump table, putting it into the data section of the executor. SYZOS is unable to access that data and crashes. Use primes multiplied by 10 to defeat the compiler's heuristics for jump table emission.
* all: adjust to the new clang tidy checksAleksandr Nogikh2025-04-241-0/+2
| | | | | | | | | clang-tidy-20 generates many more failures, many of which are in the flartrpc library. Let's disable clang-analyzer-optin.core.EnumCastOutOfRange for now. It also complained about PROT_EXEC in the executor, but that is necessary to support syz_execute_func().
* all: format with clang-format-20Aleksandr Nogikh2025-04-243-131/+128
| | | | The tests began to fail after pushing the new env container.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-19 06:35:29 +0000