aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux/dev_kvm.txt
Commit message (Collapse)AuthorAgeFilesLines
* executor, sys/linux, pkg: enable syz_kvm_setup_cpu for riscv646eanut2026-01-201-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements syz_kvm_setup_cpu for riscv64 architecture. The pseudo-syscall accepts VM fd, vCPU fd, host memory, and guest code as parameters. Additional parameters (ntext, flags, opts, nopt) are included for interface consistency with other architectures but are currently unused on riscv64. Implementation: - Set up guest memory via KVM_SET_USER_MEMORY_REGION - Copy guest code to guest memory - Initialize guest registers to enable code execution in S-mode - Return 0 on success, -1 on failure Testing: A test file syz_kvm_setup_cpu_riscv64 is included in sys/linux/test/ to verify basic functionality. Known limitations: - ifuzz is not yet compatible with riscv64. Temporary workaround: set text[riscv64] to TextTarget and return nil in createTargetIfuzzConfig for riscv64 to ensure generateText and mutateText work correctly. This patch also adds support for KVM_GET_ONE_REG ioctl.
* sys/linux, executor: enable kvm fuzzing support for riscv646eanut2026-01-091-1/+1
|
* sys/linux: apply no_squash to certain KVM ioctlsAlexander Potapenko2025-11-241-2/+2
| | | | | | | | | | | | | | For the following KVM ioctls: - KVM_SET_GSI_ROUTING - KVM_SET_SIGNAL_MASK - KVM_SET_MSRS - KVM_SET_CPUID - KVM_SET_CPUID2 syzkaller is generating squashed blobs, which are less likely to provoke any interesting behaviors. Apply the no_squash attribute to these ioctls to have better understanding of these ioctls' inputs.
* sys/linux: rework ioctl$KVM_SET_GUEST_DEBUGAlexander Potapenko2025-09-191-5/+3
| | | | | | | | | | This ioctl accepts an arch-specific struct as an argument, so better split it into several arch-specific ioctls. To avoid compilation errors on exotic arches like MIPS, this patch also adds sys/linux/dev_kvm_extra.txt that takes care of them. While at it, also define KVM_GUESTDBG_USE_HW.
* sys/linux/dev_kvm.txt: define KVM_GET_STATS_FDAlexander Potapenko2025-07-211-0/+2
| | | | | This is mostly for the sake of completeness, other KVM ioctls do not interact with the created FD anyway.
* sys/linux: fix inout parameters for certain KVM ioctlsAlexander Potapenko2025-07-181-2/+2
| | | | | | | | For certain ioctls https://www.kernel.org/doc/Documentation/virt/kvm/api.txt lists their parameters as "in/out". Change their descriptions to reflect that. Also define KVM_GET_MSR_FEATURE_INDEX_LIST and KVM_GET_SUPPORTED_HV_CPUID
* sys/linux/dev_kvm.txt: allow passing VM type to KVM_CREATE_VMAlexander Potapenko2025-07-181-1/+3
| | | | This should increase SEV coverage on AMD, also reach some dusty corners on ARM.
* executor/kvm: add x86-64 SYZOS fuzzerMarios Pomonis2025-04-231-1/+0
| | | | | | This commit adds the actual SyzOS fuzzer for x86-64 and a small test. It also updates some necessary parts of the ARM version and adds some glue for i386.
* executor/kvm: separate x86(-64) descriptionsMarios Pomonis2025-04-231-486/+1
| | | | | | This commit moves the various x86/amd64 ioctl descriptions and their relevant structs/flags to the architecture-specific file and updates the corresponding const files.
* sys/linux: tools/arm64: remove redundant registers from kvm_regs_arm64_extraAlexander Potapenko2024-12-131-2/+1
| | | | Remove constants that are already covered by arm64_bitmap and arm64_fw in kvm_one_reg.
* sys/linux: tools/arm64: more ARM64 register IDs for dev_kvm.txtAlexander Potapenko2024-12-131-7/+21
| | | | | | Declare register classes for Bitmap, FW, SVE registers. Also move generation of CCSIDR, FP and core registers from registers.go to the text description.
* sys/linux: move some ARM-specific descriptions to a separate fileAlexander Potapenko2024-11-261-255/+0
| | | | | | | | | | | | | | This is done to solve a particular test failure running: $ tools/syz-env go test ./prog -run TestSpecialStructs , which failed on PPC64, because prog/rand.go instanciated a call to syz_kvm_setup_syzos_vm(), which requested too much memory (1024 pages) from the allocator (PPC64 uses 64k pages, so the number of available pages is lower). On the other hand, factoring out syzos-related descriptions is probably a nice thing to do anyway.
* executor: arm64: sys/linux: allocate 1024 pages for guest address spaceAlexander Potapenko2024-11-261-2/+2
| | | | | | | Pass 1024 pages of memory to both syz_kvm_setup_syzos_vm() and syz_kvm_setup_cpu$arm64() to make sure that: - there is enough memory for guest allocations (e.g. ITS pages) - host can tamper with that memory, provoking more bugs
* sys/linux/dev_kvm.txt: support SYZOS_API_ITS_SEND_CMDAlexander Potapenko2024-11-261-0/+28
|
* sys/linux/dev_kvm.txt: describe SYZOS_API_ITS_SETUPAlexander Potapenko2024-11-261-0/+7
|
* sys/linux/dev_kvm.txt: syz_kvm_vgic_v3_setup() should return fd_kvmdevAlexander Potapenko2024-10-211-1/+1
|
* sys/linux: use GICD/GICR register offsets in SYZOS_API_MEMWRITEAlexander Potapenko2024-09-271-1/+92
| | | | | In addition to random offsets passed to SYZOS_API_MEMWRITE, use VGICv3 distributor/redistributor base and offsets of the corresponding registers.
* executor: arm64: sys/linux: implement syz_kvm_setup_syzos_vm and ↵Alexander Potapenko2024-09-251-0/+3
| | | | | | | | | | | | | | | | | | | | | | | syz_kvm_add_vcpu The old syz_kvm_setup_cpu() API mixed together VM and VCPU setup, making it harder to create and fuzz two VCPUs in the same VM. Introduce two new pseudo-syscalls, syz_kvm_setup_syzos_vm() and syz_kvm_add_vcpu(), that will simplify this task. syz_kvm_setup_syzos_vm() takes a VM file descriptor, performs VM setup (allocates guest memory and installs SYZOS code into it) and returns a new kvm_syz_vm resource, which is in fact a pointer to `struct kvm_syz_vm` encapsulating VM-specific data in the C code. syz_kvm_add_vcpu() takes the VM ID denoted by kvm_syz_vm and creates a new VCPU within that VM with a proper CPU number. It then stores the fuzzer-supplied SYZOS API sequence into the corresponding part (indexed by CPU number) of the VM memory slot, and sets up the CPU registers to interpret that sequence. The new pseudo-syscall let the fuzzer create independent CPUs that run different code sequences without interfering with each other.
* sys/linux/dev_kvm.txt: pass flags to ioctl$KVM_IRQFDAlexander Potapenko2024-09-111-1/+3
| | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-irqfd for more details.
* sys/linux/dev_kvm.txt: minor flag changesAlexander Potapenko2024-09-111-3/+5
| | | | | - use specific flags in kvm_msi and kvm_irq_routing_entry - add KVM_IRQ_ROUTING_XEN_EVTCHN to kvm_irq_routing_entry_type
* sys/linux/dev_kvm.txt: pass clock IDs to KVM_GET_CLOCK/KVM_SET_CLOCKAlexander Potapenko2024-09-111-1/+3
| | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-get-clock for more info.
* sys/linux/dev_kvm.txt: declare the arg of KVM_IRQ_LINE_STATUS as inoutAlexander Potapenko2024-09-111-1/+1
| | | | KVM_IRQ_LINE_STATUS is declared as _IOWR(), so it should be able to return values.
* sys/linux/dev_kvm.txt: allow returning data via kvm_device_attrAlexander Potapenko2024-09-111-2/+2
| | | | | | Both kvm_device_attr_generic and kvm_device_attr_arm64 are passed to ioctl$KVM_SET_DEVICE_ATTR and ioctl$KVM_GET_DEVICE_ATTR as read-only, but the `addr` parameter should be marked as inout.
* sys/linux/dev_kvm.txt: declare ioctl$KVM_ARM_PREFERRED_TARGETAlexander Potapenko2024-09-111-0/+1
| | | | | | Despite it only reads data from the kernel, and CPU creation is anyway handled by syz_kvm_setup_cpu(), adding this ioctl will increase coverage and potentially trigger interactions with KVM_ARM_VCPU_INIT.
* sys/linux/dev_kvm.txt: declare ioctl$KVM_RESET_DIRTY_RINGSAlexander Potapenko2024-09-111-0/+1
| | | | | | This ioctl is mentioned at https://docs.kernel.org/virt/kvm/api.html#kvm-cap-dirty-log-ring-kvm-cap-dirty-log-ring-acq-rel, but doesn't have its own doc entry.
* sys/linux/dev_kvm.txt: declare ioctl$KVM_GET_XSAVE2Alexander Potapenko2024-09-111-0/+2
| | | | This is an x86-only ioctl: https://docs.kernel.org/virt/kvm/api.html#kvm-get-xsave2
* sys/linux/dev_kvm.txt: declare ioctl$KVM_SET_MEMORY_ATTRIBUTESAlexander Potapenko2024-09-111-0/+9
| | | | | According to https://docs.kernel.org/virt/kvm/api.html#kvm-set-memory-attributes, this is an x86-only ioctl.
* sys/linux/dev_kvm.txt: correctly pass ARM64 CPU featuresAlexander Potapenko2024-09-111-2/+15
| | | | | | Certain ioctls accept CPU features as numbers in the range 0..6 (aka KVM_ARM_VCPU_POWER_OFF..KVM_ARM_VCPU_SVE), whereas other ioctls accept them as a bit mask.
* sys/linux/dev_kvm.txt: add PSCI constants from uapi/linux/psci.hAlexander Potapenko2024-09-111-1/+2
|
* sys/linux/dev_kvm.txt: update KVM capabilitiesAlexander Potapenko2024-09-111-1/+35
| | | | | | | | Add the capabilities described in https://docs.kernel.org/virt/kvm/api.html, but previously missing from the descriptions. Most of these are VM capabilities for x86 and arm64, apart from KVM_CAP_SYNC_REGS, which is a VCPU capability. VM/VCPU attribution is poorly documented, so I referred to LXR to figure that out.
* sys/linux/dev_kvm.txt: declare ARM_SMCCC_ constants from arm-smccc.hAlexander Potapenko2024-09-101-1/+4
| | | | | | KVM provides a number of vendor-specific hypercall functions that are hard to discover without explicitly listing their IDs in the descriptions file.
* sys/linux/dev_kvm.txt: fix the description of kvm_coalesced_mmio_zoneAlexander Potapenko2024-09-091-3/+3
| | | | | | | | | According to https://elixir.bootlin.com/linux/v6.10.9/source/include/uapi/linux/kvm.h, the third member of `struct kvm_coalesced_mmio_zone` is a union of `__u32 pad` and `__u32 pio`, where `pio` can be 0 or 1, depending on whether the user wants to use KVM_MMIO_BUS or KVM_PIO_BUS (see also https://elixir.bootlin.com/linux/v6.10.9/source/virt/kvm/coalesced_mmio.c#L137)
* sys/linux/dev_kvm.txt: declare ioctl$KVM_SET_USER_MEMORY_REGION2Alexander Potapenko2024-09-061-1/+14
| | | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-set-user-memory-region2 for more details
* sys/linux/dev_kvm.txt: declare ioctl$KVM_CREATE_GUEST_MEMFDAlexander Potapenko2024-09-061-0/+8
| | | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-create-guest-memfd for more details
* sys/linux/dev_kvm.txt: declare ioctl$KVM_PRE_FAULT_MEMORYAlexander Potapenko2024-09-061-0/+9
| | | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-pre-fault-memory for details
* sys/linux/dev_kvm.txt: declare ioctl$KVM_ARM_SET_COUNTER_OFFSETAlexander Potapenko2024-09-061-0/+8
| | | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-arm-set-counter-offset for more details.
* sys/linux/dev_kvm.txt: declare ioctl$KVM_ARM_VCPU_FINALIZE()Alexander Potapenko2024-09-061-0/+1
| | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-arm-vcpu-finalize for details
* sys/linux: add missing constants for KVM_ARM_VCPU_INITAlexander Potapenko2024-09-061-1/+1
| | | | | Add KVM_ARM_VCPU_PTRAUTH_ADDRESS, KVM_ARM_VCPU_PTRAUTH_GENERIC, KVM_ARM_VCPU_SVE from https://docs.kernel.org/virt/kvm/api.html#kvm-arm-vcpu-init
* sys/linux/dev_kvm.txt: declare KVM_CLEAR_DIRTY_LOGAlexander Potapenko2024-09-061-0/+11
|
* sys/linux: update kvm_guest_debug_flagsAlexander Potapenko2024-09-061-1/+1
| | | | | Add KVM_GUESTDBG_EXIT_PENDING (s390) and KVM_GUESTDBG_BLOCKIRQ (x86) that were previously missing.
* sys/linux: declare arm64 version of kvm_vcpu_eventsAlexander Potapenko2024-09-061-1/+16
| | | | As per https://docs.kernel.org/virt/kvm/api.html#kvm-get-vcpu-events
* executor: sys/linux: arm64: implement SYZOS_API_MEMWRITEAlexander Potapenko2024-09-061-0/+10
| | | | | | | | The new API call will be used to write values to guest memory specified by base+offset. Writing to e.g. MMIO registers for VGIC (or any other MMIO ranges) may result in new coverage.
* sys/linux: adjust the description of kvm_ioeventfdAlexander Potapenko2024-09-051-2/+2
| | | | | | According to https://docs.kernel.org/virt/kvm/api.html#kvm-ioeventfd, datam should be the optional expected data value written by the guest (we keep it random for now), whereas addr is the MMIO address.
* sys/linux: add ARM VGIC device groups/attributesAlexander Potapenko2024-09-031-3/+22
| | | | Do not specify the attribute input types for now.
* sys/linux: declare KVM_{SET,GET,HAS}_DEVICE_ATTR for VCPUsAlexander Potapenko2024-09-031-0/+70
| | | | | | According to https://docs.kernel.org/virt/kvm/devices/vcpu.html, VCPUs also have device attributes. Add descriptions for ioctls that manipulate those attributes.
* executor: arm64: sys/linux: add SYZOS_API_IRQ_SETUPAlexander Potapenko2024-09-031-5/+11
| | | | | | | | Implement basic IRQ controller setup for VMs with a single CPU. SYZOS_API_IRQ_SETUP sets up the VGICv3 distributor/redistributor and enables the specified number of SPIs starting from 32. The default IRQ handler is set up to perform a uexit(-2).
* executor: pkg/vminfo: sys/linux: define syz_kvm_vgic_v3_setupAlexander Potapenko2024-09-031-0/+4
| | | | | The new pseudo-syscall sets up VGICv3 IRQ controller on the host. That still requires guest setup code, which will be submitted separately.
* executor: arm64: add SYZOS_API_HVCAlexander Potapenko2024-08-071-4/+5
| | | | | Make the necessary changes to support HVC in addition to SMC. These two may subtly differ, so they are handled separately.
* sys/linux: refactor syzos_api_callAlexander Potapenko2024-08-071-16/+10
| | | | | As suggested by Dmitry, use a template to avoid duplication in various syzos types. Also adjust the existing tests.
* executor: arm64: add SYZOS_API_SMCAlexander Potapenko2024-08-071-0/+17
| | | | | | | | Provide an API call to invoke the ARM64 Secure Monitor Call instruction with user-supplied function id and 5 parameters passed in registers x1-x5. For now only `smc #0` is invoked, although in the future we may want to pass other (reserved) immediate values to SMC.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 00:23:50 +0000