aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux/dev_kvm.txt
Commit message (Collapse)AuthorAgeFilesLines
...
* sys/linux: declare KVM_{SET,GET,HAS}_DEVICE_ATTR for VMsAlexander Potapenko2024-08-071-0/+33
| | | | | | | In addition to device FDs, certain arches (s390 and ARM64) allow applying device attributes to VM FDs (https://docs.kernel.org/virt/kvm/devices/vm.html) Add descriptions for the corresponding ioctls on ARM64, including support for setting SMCCC filters via struct kvm_smccc_filter.
* executor: arm64: add SYZOS_API_MSRAlexander Potapenko2024-08-051-0/+8
| | | | | | | | | | | | | MSR is an ARM64 instruction that writes a value from a GP register to one of the system CPU registers. Exposing those registers to a fuzzer will let us trigger unexpected behavior in handling them on the kernel side. The SYZOS_API_MSR call has two int64 arguments, register ID and value. Register IDs are 64-bit values obtained from ARM64_SYS_REG() in the Linux asm/kvm.h UAPI header. Same register IDs are used by ioctl$KVM_GET_ONE_REG and ioctl$KVM_SET_ONE_REG. Also add sys/linux/test/syz_kvm_setup_cpu_arm64-msr
* sys/linux: add register constants to dev_kvm.txtAlexander Potapenko2024-08-051-2/+25
| | | | | | | Split the definition of kvm_one_reg into ARM-specific and non-ARM-specific parts. For the ARM-specific ones, use the result of go run tools/arm64/registers.go tools/arm64/msr_mrs.txt as the new list of constants.
* syz/linux: introduce vcpu_mmap_size for /dev/kvmAlexander Potapenko2024-07-291-2/+3
| | | | | Instead of guessing the size of the mmap area for struct vcpu_run, always obtain it from ioctl(KVM_GET_VCPU_MMAP_SIZE).
* executor: arm64: sys/linux: introduce syzos APIAlexander Potapenko2024-07-291-2/+22
| | | | | | | | | | | | | | | | | | | | | | Allow guest payload to call syzos API functions. The available calls are enumerated by SYZOS_API_* constants, and have a form of: struct api_call { uint64 call; uint64 struct_size; /* arbitrary call-related data here */ }; Complex instruction sequences are too easy to break, so most of the time fuzzer won't be able to efficiently mutate them. We replace kvm_text_arm64 with a sequence of `struct api_call`, making it possible to intermix assembly instructions (SYZOS_API_CODE) with higher-level constructs. Right now the supported calls are: - SYZOS_API_UEXIT - abort from KVM_RUN (1 argument: exit code, uint64) - SYZOS_API_CODE - execute an ARM64 assembly blob (1 argument: inline array of int32's)
* sys/linux/dev_kvm.txt: add new device typesAlexander Potapenko2024-05-151-1/+1
| | | | Update the list of device type flags to match that of Linux 6.9
* sys/linux: run make extractAlexander Potapenko2024-05-151-23/+0
| | | | | | | | | Make the following changes for extraction to succeed: - drop the KVM API constants for features removed in 6.9; - hardcode the three TUNNEL_*_OPT constants that cannot be extracted due to a header change; - hardcode the HCI_OP_* constants removed in 99fca36c8b412 ("Bluetooth: HCI: Remove HCI_AMP support"); - hardcode the L2CAP_* constants removed in e7b02296fb40 ("Bluetooth: Remove BT_HS"); - hardcode LANDLOCK_ACCESS_FS_IOCTL_DEV until it hits upstream.
* sys/linux: run make extractAleksandr Nogikh2024-01-301-0/+11
| | | | | Split out deprecated descriptions from socket_netlink_route_sched.txt. Adjust outdated descriptions.
* pkg/ast, pkg/compiler: support per-file metadataDmitry Vyukov2022-04-291-0/+2
| | | | | | | | | | | | | | | | | | | | | We have a bunch of hacks in syz-extract, syz-sysgen and syz-check with respect to description files unsupported on some arches, or that must not be part of make extract. Add 2 meta attribtues to files: meta noextract Tells `make extract` to not extract constants for this file. Though, `syz-extract` can still be invoked manually on this file. meta arches["arch1", "arch2"] Restricts this file only to the given set of architectures. `make extract` and ``make generate` will not use it on other architectures. Later we can potentially use meta attributes to specify git tree/commit that must be used for extraction. Maybe something else. Fixes #2754
* sys/linux: fix bugs pointed out by syz-checkDmitry Vyukov2022-01-131-3/+6
| | | | Update #590
* executor/common_linux: fuzz kvm_runAlexey Kardashevskiy2021-11-091-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | Syzkaller runs KVM until it exits and this is considered the end of the KVM_RUN syscall. We can do a bit more with a VM if the exit was legit (for example MMIO access or a hypercall). In such cases the userspace emulates the request and stores the result in the kvm_run struct (mmaped from vcpu_fd) which the next KVM_RUN checks. This defines specialized mmap and syz_memcpy_off to allow Syzkaller fuzz the kvm_run struct with focus on the part where the huge union is. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com> --- Changes: v4: * defined offset/size constants * re-autogenerated dev_kvm.txt.const v3: * fixed syz_memcpy_off's src size v2: * limited changes to dev_kvm.txt instead of defining all new syz_kvm_run.
* sys/linux: extend KVM caps descriptionsDmitry Vyukov2021-10-131-15/+43
| | | | Add missing VM/CPU caps and specify type of arguments for each cap.
* sys/linux: fix KVM definesDmitry Vyukov2021-09-161-5/+10
| | | | | | We don't support # comments at the end of defines. This never worked and .const file wasn't even re-generated (otherwise it would contain ???).
* executor/common_kvm_ppc64: run with enabled MMUAlexey Kardashevskiy2021-07-191-1/+5
| | | | | | | | | | | | | | | | | | | | | This sets up a page table to map the text in order to exercise more code paths in the KVM. This defines flags to control the MMU state. When enabled, this creates a simple page table at the 64K offset and maps all the RAM. The fuzzer code is placed right after the table. The flags are: IR - enables MMU for instruction fetches DR - enables MMU for data loads/stores PR - "problem state", i.e. userspace (implies DR and IR) PID1 - initializes a process table for PID>0 (PID#0 is used by the VM OS normally) This adds a simple "syz_kvm_setup_cpu_ppc64" syz-test with MSR=IR|DR|LE which is a typical Linux kernel mode. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor/common_kvm_ppc64: fix KVM supportAlexey Kardashevskiy2021-07-191-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Turns out the ifuzz on powerpc did not ever properly work. This fixes syz_kvm_setup_cpu$ppc64: Enable the PAPR KVM capability (otherwise KVM_RUN fails right away). Finish generated sequences with the software debug breakpoint as there is no x86's "hlt" variant on POWER and otherwise KVM won't exit. Add exception handlers, use the software debug breakpoint instruction to trigger immediate exit from KVM with the only exception of the decrementer interrupt handler (timer) to recharge the timer and continue. Define and use endianness selection flag (Big vs. Little endian). Define the code generator similar to kvm_gen.cc which for now contains 2 simple tests and the decrementer interrupt handler code. Add test cases to the executor so "bin/linux_ppc64le/syz-executor test" can run some sensible tests. The tests copy 0xbadc0de around similar to x86 and uses gpr[3] is a return value register (similar to EAX). Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* pkg/ifuzz/powerpc: add powerpc supportAlexey Kardashevskiy2020-11-201-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | This adds KVM's syz_kvm_setup_cpu pseudo syscall. This adds placeholder for options (none implemented yet). This adds instruction generator for ifuzz; this also adds a few pseudo instructions to simulate super/hyper/ultracalls (a PPC64/pseries platform thing). The insns.go is generated from PowerISA_public.v3.0B.pdf [1] by a horrendous python3 script on top of pdftotext. The ISA covers POWER9 which is the latest available POWER CPU at the moment. The next ISA for POWER10 is quite different and we will deal with it later. The // comment after every instruction is a fixed opcode list for verification purposes. This does not define DecodeExt as there is no obvious replacement of the Intel XED library for POWERPC (gapstone-capstone, later, may be). [1] https://openpowerfoundation.org/?resource_lib=power-isa-version-3-0 Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* sys/linux: use per-field directions in descriptionsNecip Fazil Yildiran2020-08-131-3/+3
|
* sys/linux: fix some warnings in descriptionsDmitry Vyukov2020-06-131-4/+6
| | | | | syz-check pointed to a new batch of bugs in descriptions. Fix them.
* sys/syz-extract: use -nostdinc on linuxDmitry Vyukov2020-05-111-1/+0
| | | | This makes the build completely hermetic.
* pkg/compiler: check that flags values fit into base typeDmitry Vyukov2020-03-171-1/+1
| | | | | | | | flags[foo, int8] foo = 0x12345678 is always an error, detect these cases. Found some bugs in mptcp, packet sockets, kvm.
* sys/linux: fix 32-bit warningsDmitry Vyukov2019-12-231-4/+4
| | | | | | | Lots of interesting findings... Especially 2 byte uid/gid/pid. Update #590
* sys/linux: fix 240 warnings in descriptionsDmitry Vyukov2019-12-201-11/+11
| | | | | | Sweeping fix of everything up to socket_netlink_route.txt. Update #590
* sys/linux: another batch of syz-check fixesDmitry Vyukov2019-12-181-37/+47
| | | | Update #590
* sys/linux: rename dev descriptions filesAndrey Konovalov2019-02-011-0/+805
Prefix file names of descriptions of /dev/* files with dev_. And give some of them more appropriate names.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 22:55:17 +0000