aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux/dev_kvm_amd64.txt
Commit message (Collapse)AuthorAgeFilesLines
* executor: sys/linux: SYZOS: add AMD VMLOAD and VMSAVE primitivesAlexander Potapenko2026-01-201-0/+2
| | | | | | | | | | | | This patch introduces SYZOS_API_NESTED_AMD_VMLOAD and SYZOS_API_NESTED_AMD_VMSAVE. These primitives allow the L1 guest to execute the VMLOAD and VMSAVE instructions, which load/store additional guest state (FS, GS, TR, LDTR, etc.) to/from the VMCB specified by the 'vm_id' argument. This stresses the KVM L0 instruction emulator, which must validate the L1-provided physical address in RAX and perform the state transfer.
* executor: sys/linux: SYZOS: add AMD SET_INTERCEPT primitiveAlexander Potapenko2026-01-191-0/+8
| | | | | | | | | | | | | | | This patch introduces SYZOS_API_NESTED_AMD_SET_INTERCEPT to SYZOS. This primitive enables the fuzzer to surgically modify intercept vectors in the AMD VMCB (Virtual Machine Control Block) Control Area. It implements a read-modify-write operation on 32-bit VMCB offsets, allowing the L1 hypervisor (SYZOS) to deterministically set or clear specific intercept bits (e.g., for RDTSC, HLT, or exceptions) for the L2 guest. This capability allows syzkaller to systematically explore KVM's nested SVM emulation logic by toggling intercepts on and off, rather than relying on static defaults or random memory corruption.
* executor: sys/linux: Add VCPU fd to `syz_kvm_assert_syzos_uexit`Alexander Potapenko2026-01-161-1/+1
| | | | | | | | Enhance the debugging capabilities of C reproducers by passing the VCPU file descriptor to the syz_kvm_assert_syzos_uexit function. With access to the VCPU fd, the function can now dump the VCPU's register state upon assertion failure, providing critical context for debugging guest execution issues.
* executor: sys/linux: SYZOS: add support for AMD Nested Event InjectionAlexander Potapenko2026-01-151-0/+9
| | | | | | | | | | | | | Implement SYZOS_API_NESTED_AMD_INJECT_EVENT to allow the L1 guest to inject events (Interrupts, NMIs, Exceptions) into L2 via the VMCB EVENTINJ field. This primitive abstracts the VMCB bit-packing logic (Vector, Type, Valid, Error Code) into a high-level API, enabling the fuzzer to semantically mutate event injection parameters. This targets KVM's nested event merging logic, specifically where L0 must reconcile L1-injected events with Host-pending events.
* executor: sys/linux: SYZOS: add support for AMD STGI and CLGI instructionsAlexander Potapenko2026-01-151-0/+2
| | | | | | | | | Implement the SYZOS_API_NESTED_AMD_STGI and SYZOS_API_NESTED_AMD_CLGI primitives to toggle the Global Interrupt Flag (GIF). These commands execute the stgi and clgi instructions respectively and require no arguments. Also add a test checking that CLGI correctly masks NMI injection from L0.
* executor: sys/linux: SYZOS: add support for AMD INVLPGA instructionAlexander Potapenko2026-01-141-0/+6
| | | | | | | | | | Implement the SYZOS_API_NESTED_AMD_INVLPGA primitive to execute the INVLPGA instruction in the L1 guest. This allows the fuzzer to target KVM's Shadow MMU and Nested Paging (NPT) logic by invalidating TLB entries for specific ASIDs. Also add a simple syzlang seed/regression test.
* sys/linux: add Intel TDX descriptionsAlexander Potapenko2025-12-291-0/+70
| | | | | Initial support for Intel TDX as per https://docs.kernel.org/virt/kvm/x86/intel-tdx.html
* sys/linux: update kvm_sev_guest_statusAlexander Potapenko2025-12-291-1/+1
| | | | | | | | | | | According to arch/x86/include/uapi/asm/kvm.h, kvm_sev_guest_status is defined as follows: struct kvm_sev_guest_status { __u32 handle; __u32 policy; __u32 state; };
* sys/linux: improve KVM_GET_NESTED_STATE/KVM_SET_NESTED_STATEAlexander Potapenko2025-12-031-13/+46
| | | | | | | Rewrite arch-specific definitions for the nested state to match the source and the documentation: - https://elixir.bootlin.com/linux/latest/source/arch/x86/include/uapi/asm/kvm.h - https://docs.kernel.org/virt/kvm/api.html#kvm-get-nested-state
* sys/linux: apply no_squash to certain KVM ioctlsAlexander Potapenko2025-11-241-3/+3
| | | | | | | | | | | | | | For the following KVM ioctls: - KVM_SET_GSI_ROUTING - KVM_SET_SIGNAL_MASK - KVM_SET_MSRS - KVM_SET_CPUID - KVM_SET_CPUID2 syzkaller is generating squashed blobs, which are less likely to provoke any interesting behaviors. Apply the no_squash attribute to these ioctls to have better understanding of these ioctls' inputs.
* executor: sys/linux: implement SYZOS_API_NESTED_AMD_VMCB_WRITE_MASKAlexander Potapenko2025-11-211-0/+16
| | | | | | | | | | | The new command allows mutation of AMD VMCB block with plain 64-bit writes. In addition to VM ID and VMCB offset, @nested_amd_vmcb_write_mask takes three 64-bit numbers: the set mask, the unset mask, and the flip mask. This allows to make bitwise modifications to VMCB without disturbing the execution too much. Also add sys/linux/test/amd64-syz_kvm_nested_amd_vmcb_write_mask to test the new command behavior.
* executor: sys/linux: implement SYZOS_API_NESTED_INTEL_VMWRITE_MASKAlexander Potapenko2025-11-211-15/+46
| | | | | | | | | | | | The new command allows mutation of Intel VMCS fields with the help of vmwrite instruction. In addition to VM ID and field ID, @nested_intel_vmwrite_mask takes three 64-bit numbers: the set mask, the unset mask, and the flip mask. This allows to make bitwise modifications to VMCS without disturbing the execution too much. Also add sys/linux/test/amd64-syz_kvm_nested_vmwrite_mask to test the new command behavior.
* executor: sys/linux: implement SYZOS_API_NESTED_VMRESUMEAlexander Potapenko2025-11-201-0/+1
| | | | | | | | | | | | | | | Provide the SYZOS API command to resume L2 execution after a VM exit, using VMRESUME on Intel and VMRUN on AMD. For testing purpose, implement basic handling of the INVD instruction: - enable INVD interception on AMD (set all bits in VMCB 00Ch); - map EXIT_REASON_INVD and VMEXIT_INVD into SYZOS_NESTED_EXIT_REASON_INVD; - advance L2 RIP to skip to the next instruction. While at it, perform minor refactorings of L2 exit reason handling. sys/linux/test/amd64-syz_kvm_nested_vmresume tests the new command by executing two instructions, INVD and HLT, in the nested VM.
* executor: sys/linux: implement SYZOS_API_NESTED_VMLAUNCHAlexander Potapenko2025-11-191-0/+1
| | | | | | | | | | | | Provide a SYZOS API command to launch the L2 VM using the VMLAUNCH (Intel) or VMRUN (AMD) instruction. For testing purposes, each L2->L1 exit is followed by a guest_uexit_l2() returning the exit code to L0. Common exit reasons (like HLT) will be mapped into a common exit code space (0xe2e20000 | reason), so that a single test can be used for both Intel and AMD. Vendor-specific exit codes will be returned using the 0xe2110000 mask for Intel and 0xe2aa0000 for AMD.
* executor: sys/linux: implement SYZOS_API_NESTED_LOAD_CODEAlexander Potapenko2025-11-191-0/+6
| | | | The new command loads an instruction blob into the specified L2 VM.
* executor: sys/linux: renumber SYZOS API IDsAlexander Potapenko2025-11-191-10/+11
| | | | | | | | Now that we are using volatiles in guest_main(), there is no particular need to base the numbers on primes (this didn't work well with Clang anyway). Instead, group the commands logically and leave some space between the groups for future updates.
* executor: x86: implement SYZOS_API_NESTED_CREATE_VMAlexander Potapenko2025-11-191-11/+14
| | | | | | Provide basic setup for registers, page tables, and segments to create Intel/AMD-based nested virtual machines. Note that the machines do not get started yet.
* executor: x86: implement SYZOS_API_ENABLE_NESTEDAlexander Potapenko2025-11-191-0/+1
| | | | | | Add vendor-specific code to turn on nested virtualization on Intel and AMD. Also provide get_cpu_vendor() to pick the correct implementation.
* executor: sys/linux: implement SYZOS_API_SET_IRQ_HANDLERAlexander Potapenko2025-10-171-9/+15
| | | | | | | | | | The new API call allows to initialize the handler with one of the three possible values: - NULL (should cause a page fault) - dummy_null_handler (should call iret) - uexit_irq_handler (should perform guest_uexit(UEXIT_IRQ)) Also add a test for uexit_irq_handler()
* sys/linux: rework ioctl$KVM_SET_GUEST_DEBUGAlexander Potapenko2025-09-191-0/+5
| | | | | | | | | | This ioctl accepts an arch-specific struct as an argument, so better split it into several arch-specific ioctls. To avoid compilation errors on exotic arches like MIPS, this patch also adds sys/linux/dev_kvm_extra.txt that takes care of them. While at it, also define KVM_GUESTDBG_USE_HW.
* sys/linux: executor: add IN_DX and OUT_DX to SYZOS x86 APIAlexander Potapenko2025-09-191-0/+16
| | | | | | | | Add SYZOS calls that correspond to the IN and OUT x86 instructions that perform port I/O. These instructions have different variants, for now we just implement the one that takes the port number from DX instead of encoding it in the opcode.
* sys/linux: executor: implement SYZOS_API_WR_DRN on x86Alexander Potapenko2025-09-191-0/+7
| | | | | Add a SYZOS call to write to one of the debug registers (DR0-DR7).
* executor: sys/linux/: pkg/runtest: pkg/vminfo: add syz_kvm_assert_syzos_kvm_exitAlexander Potapenko2025-09-191-0/+1
| | | | Implement a pseudo-syscall to check the value of kvm_run.exit_reason
* sys/linux: apply no_squash to syz_kvm_add_vcpuAlexander Potapenko2025-09-091-1/+2
| | | | | | Not passing flattened arguments to syz_kvm_add_vcpu() serves two purposes: - makes it easier to reason about the SYZOS program contents; - prevents nonsensial mutations of them.
* sys/linux: executor: implement SYZOS_API_WR_CRN on x86Alexander Potapenko2025-07-241-0/+9
| | | | | Add a SYZOS call to write to one of the system registers (CR0, CR2, CR3, CR4, CR8).
* executor: sys/linux/dev_kvm_amd64.txt: implement rdmsr/wrmsrAlexander Potapenko2025-07-241-0/+11
| | | | Let SYZOS execute RDMSR and WRMSR on x86.
* executor: sys/linux: use sparse IDs for SYZOS APIAlexander Potapenko2025-07-241-2/+2
| | | | | | Like we already do on ARM, use prime numbers multiplied by 10 for SYZOS API IDs to prevent the compiler from emitting a jump table in guest_main().
* sys/linux/dev_kvm_amd64.txt: fix KVM_X86_GET_MCE_CAP_SUPPORTEDAlexander Potapenko2025-07-211-1/+1
| | | | This is a system ioctl
* sys/linux/dev_kvm_amd64.txt: fix KVM_GET_LAPICAlexander Potapenko2025-07-211-2/+2
| | | | | | | Use output parameter instead of an input one. Use a KVM constant for array size. See https://docs.kernel.org/virt/kvm/api.html#kvm-get-lapic
* sys/linux/dev_kvm_amd64.txt: fix KVM_GET_XCRSAlexander Potapenko2025-07-211-3/+4
| | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-get-xcrs
* sys/linux/dev_kvm_amd64.txt: fix KVM_GET_MSRSAlexander Potapenko2025-07-211-1/+3
| | | | KVM_GET_MSRS can be both a system and a vcpu ioctl
* sys/linux/dev_kvm_amd64.txt: fix KVM_SET_TSC_KHZ and KVM_GET_TSC_KHZAlexander Potapenko2025-07-211-2/+5
| | | | Both KVM_SET_TSC_KHZ and KVM_GET_TSC_KHZ are vcpu and vm ioctls.
* sys/linux/dev_kvm_amd64.txt: define KVM_GET_SREGS2 and KVM_SET_SREGS2Alexander Potapenko2025-07-181-0/+30
| | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-get-sregs2
* sys/linux/dev_kvm_amd64.txt: define KVM_MEMORY_ENCRYPT_REG_REGION and ↵Alexander Potapenko2025-07-181-2/+12
| | | | | | KVM_MEMORY_ENCRYPT_UNREG_REGION See https://docs.kernel.org/virt/kvm/api.html#kvm-memory-encrypt-reg-region
* sys/linux/dev_kvm_amd64.txt: define KVM_X86_SET_MSR_FILTERAlexander Potapenko2025-07-181-0/+19
| | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-x86-set-msr-filter
* sys/linux: fix inout parameters for certain KVM ioctlsAlexander Potapenko2025-07-181-7/+11
| | | | | | | | For certain ioctls https://www.kernel.org/doc/Documentation/virt/kvm/api.txt lists their parameters as "in/out". Change their descriptions to reflect that. Also define KVM_GET_MSR_FEATURE_INDEX_LIST and KVM_GET_SUPPORTED_HV_CPUID
* sys/linux/dev_kvm_amd64.txt: minor fixes for SEVAlexander Potapenko2025-07-181-5/+6
| | | | make sev_handle a resource
* sys/linux: add support for KVM_MEMORY_ENCRYPT_OPMarios Pomonis2025-07-161-0/+190
| | | | | This patch adds the necessary descriptions for KVM_MEMORY_ENCRYPT_OP that currently is not supported.
* sys/linux/dev_kvm_amd64.txt: define KVM_MAX_IRQ_ROUTESAlexander Potapenko2025-06-131-0/+2
| | | | | Somehow syz-extract is unable to infer KVM_MAX_IRQ_ROUTES on x86, hardcode it.
* executor/kvm: add SYZOS support for CPUIDMarios Pomonis2025-05-191-0/+6
| | | | | This commit adds support for CPUID instructions on AMD64. It also adds a relevant test.
* executor/kvm: add x86-64 SYZOS fuzzerMarios Pomonis2025-04-231-12/+13
| | | | | | This commit adds the actual SyzOS fuzzer for x86-64 and a small test. It also updates some necessary parts of the ARM version and adds some glue for i386.
* executor/kvm: separate x86(-64) descriptionsMarios Pomonis2025-04-231-1/+497
| | | | | | This commit moves the various x86/amd64 ioctl descriptions and their relevant structs/flags to the architecture-specific file and updates the corresponding const files.
* executor/kvm: set up X86-64 SYZOSMarios Pomonis2025-04-231-0/+40
This commit prepares adding the X86-64 SYZOS by declaring the relevant functions, updating their ARM64 versions and adding placeholders.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 02:13:41 +0000