aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/vminfo
Commit message (Collapse)AuthorAgeFilesLines
* executor, sys/linux, pkg: enable syz_kvm_setup_cpu for riscv646eanut2026-01-201-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements syz_kvm_setup_cpu for riscv64 architecture. The pseudo-syscall accepts VM fd, vCPU fd, host memory, and guest code as parameters. Additional parameters (ntext, flags, opts, nopt) are included for interface consistency with other architectures but are currently unused on riscv64. Implementation: - Set up guest memory via KVM_SET_USER_MEMORY_REGION - Copy guest code to guest memory - Initialize guest registers to enable code execution in S-mode - Return 0 on success, -1 on failure Testing: A test file syz_kvm_setup_cpu_riscv64 is included in sys/linux/test/ to verify basic functionality. Known limitations: - ifuzz is not yet compatible with riscv64. Temporary workaround: set text[riscv64] to TextTarget and return nil in createTargetIfuzzConfig for riscv64 to ensure generateText and mutateText work correctly. This patch also adds support for KVM_GET_ONE_REG ioctl.
* kfuzztest: introduce syz_kfuzztest_run pseudo-syscallEthan Graham2025-09-221-0/+1
| | | | | | | | | | | | | Add syz_kfuzztest_run pseudo-syscall, KFuzzTest attribute, and encoding logic. KFuzzTest targets, which are invoked in the executor with the new syz_kfuzztest_run pseudo-syscall, require specialized encoding. To differentiate KFuzzTest calls from standard syzkaller calls, we introduce a new attribute called KFuzzTest or "kfuzz_test" in syzkaller descriptions that can be used to annotate calls. Signed-off-by: Ethan Graham <ethangraham@google.com>
* executor: sys/linux/: pkg/runtest: pkg/vminfo: add syz_kvm_assert_syzos_kvm_exitAlexander Potapenko2025-09-191-45/+47
| | | | Implement a pseudo-syscall to check the value of kvm_run.exit_reason
* pkg/flatrpc, pkg/vminfo, executor: introduce readonly coverageAlexander Potapenko2025-07-311-0/+2
| | | | | | | | | | | | | Add a new vminfo feature, FeatureKcovResetIoctl, that is true if the kernel supports ioctl(KCOV_RESET_TRACE) making it possible to reset the coverage buffer on the kernel side. This, in turn, allows us to map the coverage buffer read-only, which will prevent all sorts of userspace-generated corruptions at a cost of an extra syscall per program execution. The corresponding exec env flag, ExecEnv::ReadOnlyCoverage, turns on read-only coverage in the executor. It is enabled by default if FeatureKcovResetIoctl is on.
* pkg/vminfo: re-enable SYZOS for arm64Alexander Potapenko2025-05-081-2/+2
| | | | | | | | "executor/kvm: add x86-64 SYZOS fuzzer" accidentally disabled pseudo-syscalls that manipulate SYZOS VMs, by adding an empty case to a switch statement. Merge the two cases together to fix the problem.
* executor/kvm: add x86-64 SYZOS fuzzerMarios Pomonis2025-04-231-2/+7
| | | | | | This commit adds the actual SyzOS fuzzer for x86-64 and a small test. It also updates some necessary parts of the ARM version and adds some glue for i386.
* executor/kvm: set up X86-64 SYZOSMarios Pomonis2025-04-231-6/+6
| | | | | This commit prepares adding the X86-64 SYZOS by declaring the relevant functions, updating their ARM64 versions and adding placeholders.
* all: remove loop variables scopingTaras Madan2025-02-172-2/+0
|
* pkg/vminfo: gracefully handle context abortionAleksandr Nogikh2025-02-032-2/+11
| | | | | On context abortion, return a special error. On the pkg/rpcserver side, recognize and process it.
* pkg/vminfo: remove Context from the constructorAleksandr Nogikh2025-01-243-15/+16
| | | | | | | The context is assumed to be passed into the function doing the actual processing. Refactor vminfo to follow this approach. This will help refactor pkg/rpcserver later.
* pkg/fuzzer/queue: remove unnecessary Context usageAleksandr Nogikh2025-01-241-1/+1
|
* executor: pkg/vminfo: sys/linux: arm64: implement syz_kvm_assert_reg()Alexander Potapenko2024-12-181-0/+1
| | | | Add a pseudo-syscall to assert on register values.
* executor: query globs in the test program contextDmitry Vyukov2024-12-113-17/+49
| | | | | | | | | | | | | | | | | We query globs for 2 reasons: 1. Expand glob types in syscall descriptions. 2. Dynamic file probing for automatic descriptions generation. In both of these contexts are are interested in files that will be present during test program execution (rather than normal unsandboxed execution). For example, some files may not be accessible to test programs after pivot root. On the other hand, we create and link some additional files for the test program that don't normally exist. Add a new request type for querying of globs that are executed in the test program context.
* pkg/vminfo: sys/linux: executor: define syz_kvm_assert_syzos_uexit()Alexander Potapenko2024-12-111-0/+1
| | | | | The new pseudo-syscall will serve as a test assertion, checking the uexit return value. This is going to help us validate SyzOS code.
* pkg/vminfo: fix up _etext symbol parsingDmitry Vyukov2024-12-051-1/+4
| | | | | | _etext symbol points to the _next_ section, so it has type of the next section. It can be at least T, D, or R in some cases: https://groups.google.com/g/syzkaller/c/LSx6YIK_Eeo
* sys/linux: move some ARM-specific descriptions to a separate fileAlexander Potapenko2024-11-261-4/+0
| | | | | | | | | | | | | | This is done to solve a particular test failure running: $ tools/syz-env go test ./prog -run TestSpecialStructs , which failed on PPC64, because prog/rand.go instanciated a call to syz_kvm_setup_syzos_vm(), which requested too much memory (1024 pages) from the allocator (PPC64 uses 64k pages, so the number of available pages is lower). On the other hand, factoring out syzos-related descriptions is probably a nice thing to do anyway.
* pkg/vminfo: refactor few thingsDmitry Vyukov2024-11-254-55/+24
| | | | | | Use default nop implementation for most openbsd/netbsd methods. Move linux-specific vm type checks to linux code. Remove indirection for CheckFiles as we have for RequiredFiles.
* pkg/vminfo: use a single test function for all ARM64 pseudo-syscallsAlexander Potapenko2024-10-211-18/+4
| | | | Remove duplicate code, no functional change.
* executor: arm64: sys/linux: implement syz_kvm_setup_syzos_vm and ↵Alexander Potapenko2024-09-252-2/+22
| | | | | | | | | | | | | | | | | | | | | | | syz_kvm_add_vcpu The old syz_kvm_setup_cpu() API mixed together VM and VCPU setup, making it harder to create and fuzz two VCPUs in the same VM. Introduce two new pseudo-syscalls, syz_kvm_setup_syzos_vm() and syz_kvm_add_vcpu(), that will simplify this task. syz_kvm_setup_syzos_vm() takes a VM file descriptor, performs VM setup (allocates guest memory and installs SYZOS code into it) and returns a new kvm_syz_vm resource, which is in fact a pointer to `struct kvm_syz_vm` encapsulating VM-specific data in the C code. syz_kvm_add_vcpu() takes the VM ID denoted by kvm_syz_vm and creates a new VCPU within that VM with a proper CPU number. It then stores the fuzzer-supplied SYZOS API sequence into the corresponding part (indexed by CPU number) of the VM memory slot, and sets up the CPU registers to interpret that sequence. The new pseudo-syscall let the fuzzer create independent CPUs that run different code sequences without interfering with each other.
* sys/linux: add syz_create_resourceDmitry Vyukov2024-09-192-1/+2
| | | | | | | | syz_create_resource allows to turn any value into a resource. Improve binfmt descriptions using syz_create_resource: we need to pass the same file name to write syscalls and execve. Use syz_create_resource to improve binfmt descriptions.
* executor: pkg/vminfo: sys/linux: define syz_kvm_vgic_v3_setupAlexander Potapenko2024-09-032-0/+9
| | | | | The new pseudo-syscall sets up VGICv3 IRQ controller on the host. That still requires guest setup code, which will be submitted separately.
* pkg/mgrconfig, prog, tools: allow automatically generated or manually ↵Pimyn Girgis2024-08-122-6/+13
| | | | | | written descriptions or both Add "Auto" type and allow to choose descriptions mode in configurations. Defaults to using manual only.
* pkg/vminfo: don't parse modules for gvisor or starnixLaura Peskin2024-07-262-7/+8
|
* pkg/meminfo: move /proc/sentry-meminfo to the required files listAndrei Vagin2024-07-151-1/+1
| | | | | | | | /proc/sentry-meminfo is read in checker.MachineInfo which can be called when serv.checkDone is set. Reported-by: syzbot+d19f30cd6ec6da371b86@syzkaller.appspotmail.com Signed-off-by: Andrei Vagin <avagin@google.com>
* all: move KernelModule into vminfo packageJoey Jiao2024-07-105-14/+17
|
* pkg/vminfo: add more details to an execution errorAleksandr Nogikh2024-07-091-1/+1
| | | | Let's make it more clear why it might have failed.
* pkg/vminfo: accept context.ContextAleksandr Nogikh2024-07-083-5/+6
| | | | The object enables a graceful shutdown of machine checks.
* vm/gvisor: add gvisor presubmit testAndrei Vagin2024-07-081-0/+6
| | | | | | | Download the latest gvisor release and run the syz-manager smoke-test suite. Signed-off-by: Andrei Vagin <avagin@google.com>
* pkg/vminfo: add /proc/kallsyms to required filesJoey Jiao2024-07-031-0/+1
|
* all: fix larger module size in /proc/modulesJoey Jiao2024-07-031-1/+5
| | | | Module size from /proc/modules is bigger than that from .text size in elf.
* pkg/vminfo: parse linux core kernel to get Addr and .text SizeJoey Jiao2024-07-031-0/+36
|
* Revert "pkg/vminfo: make it possible to force coverage support"Dmitry Vyukov2024-06-282-2/+1
| | | | This reverts commit 62e12a69a0ef8fec1cc0648b1314428621f9a697.
* pkg/vminfo: make it possible to force coverage supportAleksandr Nogikh2024-06-282-1/+2
| | | | | | | | | We need this in pkg/runtest since not all TestOS targets natively support the coverage instrumentation. We used to achieve this by starting the RPC server with Coverage=false and then updating it to Coverage=true to suppress fallback the fallback signal, but it's better to avoid such runtime config changes.
* executor: add runner modeDmitry Vyukov2024-06-244-47/+88
| | | | | | | Move all syz-fuzzer logic into syz-executor and remove syz-fuzzer. Also restore syz-runtest functionality in the manager. Update #4917 (sets most signal handlers to SIG_IGN)
* pkg/vminfo: properly check existence of /dev/raw-gadgetDmitry Vyukov2024-06-242-4/+1
| | | | | | | | | | We don't have limitation of executing only one test program per syscall check, so do it properly. This also avoids priting the following warning on start: failed to read the following files in the VM: /dev/raw-gadget : Invalid argument
* all: always use KernelModule ptr to unify usageJoey Jiao2024-06-174-8/+8
|
* all: adapt all cover and sig to 64bitJoey Jiao2024-05-271-2/+2
| | | | | | | | | | | | | | | | | | Taken some arm64 devices for example: kaslr_offset is diff at bits 12-40, and kernel modules are loaded at 2GB space, so we have `ffffffd342e10000 T _stext` where uppper 32bit is ffffffd3. However, if we check modules range, the 1st module is loaded at 0xffffffd2eeb2a000, while the last module is loaded at 0xffffffd2f42c4000. We can see the upper 32bits are diff for core kernel and modules. If we use current 32bits for covered PC, we will get wrong module address recovered. So we need to move to 64bit cover and signal: - change cover/sig to 64bit to fit for syz-executor change - remove kernel upper base logic as kernel upper base is not a constant when kaslr enabled for core kernel and modules. - remove unused pcBase
* pkg/ipc: remove ExecOptsDmitry Vyukov2024-05-212-3/+2
| | | | Switch to flatrpc.ExecOpts.
* pkg/ipc: remove ProgInfoDmitry Vyukov2024-05-213-16/+14
| | | | | | Switch to flatrpc.ProgInfo. Note: this disables syz-runtest and syz-verifier.
* pkg/ipc: use flatrpc flagsDmitry Vyukov2024-05-172-19/+19
| | | | | | Flatrpc flags are passed in RPC execution requests, so to avoid conversions and duplicate set of flags use flatrpc flags in pkg/ipc directly.
* pkg/host: return slices of pointersDmitry Vyukov2024-05-175-13/+13
| | | | | Flatbuffers compiler generates slices of pointers for these types, so return slices of pointers to avoid converting the whole slice.
* pkg/fuzzer: manipulate ipc.ExecOptsAleksandr Nogikh2024-05-162-2/+2
| | | | There's no need in duplicating the signal, coverage, hints flags.
* pkg/fuzzer/queue: retry inputs from crashed VMsAleksandr Nogikh2024-05-161-1/+1
| | | | | | | | | | Mark some requests as Important. The Retry() layer will give them one more chance even if they were not executed due to a VM crash. For now, the only important requests are related to triage, candidates and pkg/vminfo tests. Add tests for retry.go.
* pkg/runtest: use queue.Request and queue.ResultAleksandr Nogikh2024-05-161-1/+4
| | | | There's no need to duplicate the execution mechanisms.
* pkg/vminfo: run programs interactivelyAleksandr Nogikh2024-05-165-203/+135
| | | | | | Use the same interfaces as the fuzzer. Now syz-manager no longer needs to treat machine check executions differently.
* pkg/vminfo: move feature checking to hostDmitry Vyukov2024-05-158-45/+366
| | | | | | | | | | | | | | | | | Feature checking procedure is split into 2 phases: 1. syz-fuzzer invokes "syz-executor setup feature" for each feature one-by-one, and checks if executor does not fail. Executor can also return a special "this feature does not need custom setup", this allows to not call setup of these features in each new VM. 2. pkg/vminfo runs a simple program with ipc.ExecOpts specific for a concrete feature, e.g. for wifi injection it will try to run a program with wifi feature enabled, if setup of the feature fails, executor should also exit with an error. For coverage features we also additionally check that we actually got coverage. Then pkg/vminfo combines results of these 2 checks into final result. syz-execprog now also uses vminfo package and mimics the same checking procedure. Update #1541
* pkg/vminfo: make TestLinuxSyscalls() more containedAleksandr Nogikh2024-05-101-9/+12
| | | | | | | The test becomes very restrictive in cases when custom descriptions are present. Let's only check for the filesystems we expect to see.
* pkg/vminfo: deduplicate syscall test programsDmitry Vyukov2024-05-073-17/+70
| | | | | Properly dedup syscall tests. This reduces number of test programs for linux from 4349 to 641.
* pkg/flatrpc: refactor namesDmitry Vyukov2024-05-064-8/+8
| | | | | | | | | | Remove T suffix from object API types. It seems that we will use these types thoughout the code, and the suffix looks alien in Go code. So it's better to remove it before we started using these names more widely. Also add few extensions we will need to move feature checking to the host.
* pkg/host: remove FileInfoDmitry Vyukov2024-05-034-11/+12
| | | | | | Switch to flatrpc.FileInfoT instead. In preparation for pkg/host removal and to avoid circular dependencies in future changes.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 23:59:19 +0000