aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux
Commit message (Collapse)AuthorAgeFilesLines
* sys/linux: support per-map-type extra fields for MAP_CREATEPaul Chaignon2021-12-211-1/+24
| | | | | | | | | | | The structure used for BPF map creation now has an additional field, map_extra, introduced in [1] upstream. The definition of that field depends on the map type being created and is only used by bloom filter maps for now. For bloom filter maps, the 4 lower bits define the number of hash functions to use. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9330986c03006 Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: support BPF calls to kernel functionsPaul Chaignon2021-12-212-0/+10
| | | | | | | | | | | | | | | Commit [1] upstream introduced support for BPF calls to kernel functions, via a new call instruction BPF_PSEUDO_KFUNC_CALL. In this new instruction, the immediate value is the BTF ID of the function to call in the kernel. This commit introduces basic support for this new instruction in syzkaller. The immediate value will point to a BTF ID, but a fair amount of additional work would be required to ensure that BTF ID is actually pointing to a kernel function. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6ac2450d6dee Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: support callback BPF functionsPaul Chaignon2021-12-212-0/+15
| | | | | | | | | | | | | | | | | | Commit [1] upstream introduced a new BPF helper, bpf_for_each_map_elem, which comes with callback functions (BPF programs). The callback function's address is provided via a 64-bit IMM load instruction where the first 32-bit of the immediate value are the offset from the current instruction to the start of the callback function. The 64-bit value is then rewritten into the address of the callback function. Callback BPF functions are similar to BPF_PSEUDO_CALL functions, except the offset to the function is converted into an address to be passed to a BPF helper. The same workaround is thus used to encode the offset in syzkaller, given we can't currently limit the offset to the program size. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=69c087ba6225b Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: support map fd arraysPaul Chaignon2021-12-214-15/+48
| | | | | | | | | | | | | | | Commit [1] upstream introduced a new way to reference BPF maps in eBPF instructions. An array of BPF map fds is passed at program load time. Instructions can then reference fds in this array instead of carrying the fds directly. The goal is to allow BPF instructions to be immutable after compilation. Since we don't yet have a good way to reference indexes in an array, we define a new type map_fd_id for that purpose, with indexes between 0 and 16 only. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=387544bfa291 Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: update BPF constantsPaul Chaignon2021-12-212-4/+10
| | | | Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: add Damon descriptionshatoboar2021-12-202-0/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | * sys/linux/damon.txt: initial description description of DAMON's interface mounted in debugfs: target_ids, attrs, init_regions, monitor_on * sys/linux/damon.txt: additional damon interface description added added DAMON interface descriptions for schemes, kdamond_pid, mk_contexts, rm_contexts prefix of all the files with damon to avoid colliding naming * sys/linux/damon.txt: standard copyright statement added * sys/linux/damon.txt.const: const file of sys/linux/damon.txt added * sys/linux/damon.txt: type fix of pid to fmt * dashboard/config/linux/bits/subsystems.yml: damon configs added for Syzbot * dashboard/config/linux: generated kernel configs with added damon config * sys/linux/damon.txt: fmt type fix * sys/linux/damon.txt: read and close syscalls removed write and read mk_contexts summarized into one syscall some refining of syscall interfaces
* sys/linux: add new futex_waitv syscallMuhammad Usama Anjum2021-11-292-0/+20
| | | | | | Add description of the new syscall futex_waitv. Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
* sys/linux: neutralize ioctl for /dev/msrVikram Narayanan2021-11-182-2/+25
|
* sys/linux: add /dev/cpu/X/msr to dev_msr.txtVikram Narayanan2021-11-182-0/+22
|
* sys: remove confusing comments that fake directivesDmitry Vyukov2021-11-122-21/+19
| | | | | | | | | It's a somewhat common mistake to write comments instead of directives: #include <foo> #define FOO BAR because that's how it's done in C. In preparation for warning about such cases remove all existing comments that fake directives.
* sys/linux: fix and regenerate consts on the latest kenrelDmitry Vyukov2021-11-126-5/+6
| | | | Fix missed includes and renamed constants and regenerate const files on 89d714ab60.
* executor/common_linux: fuzz kvm_runAlexey Kardashevskiy2021-11-092-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | Syzkaller runs KVM until it exits and this is considered the end of the KVM_RUN syscall. We can do a bit more with a VM if the exit was legit (for example MMIO access or a hypercall). In such cases the userspace emulates the request and stores the result in the kvm_run struct (mmaped from vcpu_fd) which the next KVM_RUN checks. This defines specialized mmap and syz_memcpy_off to allow Syzkaller fuzz the kvm_run struct with focus on the part where the huge union is. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com> --- Changes: v4: * defined offset/size constants * re-autogenerated dev_kvm.txt.const v3: * fixed syz_memcpy_off's src size v2: * limited changes to dev_kvm.txt instead of defining all new syz_kvm_run.
* sys/linux: add CDROM_MEDIA_CHANGED ioctlDenis Efremov2021-11-082-0/+9
| | | | | | | Add description for: 67f1e027c270 drivers/cdrom: improved ioctl for media change detection Signed-off-by: Denis Efremov <efremov@linux.com>
* sys/linux: add O_ACCMODE to floppy's open flagsDenis Efremov2021-11-082-1/+19
| | | | | | | | | O_ACCMODE is used for ioctl-only opens in the floppy driver. Drop O_CREAT, O_DIRECTORY, O_EXCL, O_LARGEFILE, O_NOCTTY, O_NOFOLLOW, O_PATH and __O_TMPFILE flags. They aren't affecting /dev/fd0. Signed-off-by: Denis Efremov <efremov@linux.com>
* all: add binderfs fuzzing supportAleksandr Nogikh2021-10-294-7/+57
| | | | | | | | Create one instance of binderfs per process and add descriptions to enable syzkaller to create binderfs mounts and binder devices itself. Keep descriptions compatible with the legacy mode (when devices are created at boot time).
* sys/linux: add devlink rate management descriptionsAleksandr Nogikh2021-10-272-0/+33
|
* sys/linux: extend userfaultfd descriptionsDmitry Vyukov2021-10-212-4/+33
| | | | | 2 new ioctl's were added + some new flags: https://elixir.bootlin.com/linux/v5.15-rc6/source/include/uapi/linux/userfaultfd.h#L82
* sys/linux: extend tcp_zerocopy_receive structDmitry Vyukov2021-10-212-1/+13
| | | | | It has been extended in the kernel, see: https://elixir.bootlin.com/linux/v5.15-rc6/source/include/uapi/linux/tcp.h#L348
* sys/linux: add new futex/seccomp operationsDmitry Vyukov2021-10-214-6/+14
| | | | | See https://elixir.bootlin.com/linux/v5.15-rc6/source/include/uapi/linux/futex.h#L11 And https://elixir.bootlin.com/linux/v5.15-rc6/source/include/uapi/linux/seccomp.h#L118
* sys/linux: describe creation of batadv devicesDmitry Vyukov2021-10-212-0/+10
| | | | See: https://elixir.bootlin.com/linux/v5.15-rc6/source/include/uapi/linux/batman_adv.h#L692
* sys/linux: describe missing FAT ioctlsAleksandr Nogikh2021-10-212-0/+35
|
* sys/linux: add missing descriptions for autofs ioctlsAleksandr Nogikh2021-10-213-1/+165
|
* sys/linux: add descriptions of memfd_secret syscallDmitry Vyukov2021-10-212-0/+4
| | | | See: https://elixir.bootlin.com/linux/v5.15-rc6/source/mm/secretmem.c#L194
* sys/linux: add new binder ioctl'sDmitry Vyukov2021-10-212-1/+20
| | | | | | Add descriptions of the new BINDER_FREEZE, BINDER_GET_FROZEN_INFO and BINDER_ENABLE_ONEWAY_SPAM_DETECTION. See: https://elixir.bootlin.com/linux/v5.15-rc6/source/include/uapi/linux/android/binder.h#L249
* sys/linux: add descriptions of epoll_pwait2 syscallDmitry Vyukov2021-10-212-1/+3
| | | | See: https://elixir.bootlin.com/linux/v5.15-rc6/source/fs/eventpoll.c#L2279
* sys/linux: add descriptions of process_mrelease syscallDmitry Vyukov2021-10-212-0/+2
| | | | See: https://elixir.bootlin.com/linux/v5.15-rc6/source/mm/oom_kill.c#L1146
* sys/linux: extend KVM caps descriptionsDmitry Vyukov2021-10-132-15/+81
| | | | Add missing VM/CPU caps and specify type of arguments for each cap.
* sys/linux: enable controllers when mounting cgroupsDmitry Vyukov2021-10-132-1/+3
| | | | Cgroup mounts also accept a list of subsystem controllers.
* sys/linux: add prctl(PR_SCHED_CORE)Dmitry Vyukov2021-10-132-0/+11
|
* sys/linux: regenerate consts, remove ipxDmitry Vyukov2021-10-1312-141/+10
| | | | | | Regenerate const files on the latest upstream tree. Remove IPX support since it was removed from the kernel in 7a2e838d28 ("staging: ipx: delete it from the tree").
* sys/linux: add descriptions of cgroup/cgroup2 mountsDmitry Vyukov2021-10-121-0/+19
| | | | These may be interesting to test, esp since they are marked as FS_USERNS_MOUNT.
* sys/linux: add more cgroup controlsDmitry Vyukov2021-10-121-2/+17
| | | | Add new and missing cgroup controls.
* sys/linux: remove O_RDONLY from fanotify_eventsDenis Efremov2021-09-283-2/+3
| | | | | | O_RDONLY is not really a flag. Not providing O_WRONLY means O_RDONLY. Signed-off-by: Denis Efremov <efremov@linux.com>
* sys/linux: describe /dev/vtpmxDenis Efremov2021-09-282-0/+25
| | | | | | Describe virtual Trusted Platform Module (vTPM) proxy device driver. Signed-off-by: Denis Efremov <efremov@linux.com>
* all: introduce a prog.Call constructorAleksandr Nogikh2021-09-221-8/+4
| | | | | Create a constructor for the prog.Call type. It allows to reduce the duplication of code now and during further changes.
* sys/linux: extend MADV_ descriptionTaras Madan2021-09-202-1/+3
|
* sys/linux: regen .const files on v5.14Dmitry Vyukov2021-09-163-2/+4
|
* sys/linux: fix KVM definesDmitry Vyukov2021-09-162-5/+15
| | | | | | We don't support # comments at the end of defines. This never worked and .const file wasn't even re-generated (otherwise it would contain ???).
* sys/linux: update ext4 ioctlsDenis Efremov2021-09-102-0/+18
| | | | Signed-off-by: Denis Efremov <efremov@linux.com>
* sys/linux: add /dev/mali0 to dev_bitfrost.txtMax Spector2021-08-191-0/+2
| | | | Mali GPU is at /dev/mali0 on Android.
* sys/linux: update unix socket syscall descriptionsChristian Resell2021-07-291-4/+26
| | | | | | | Add recvmsg$unix() and recvmmsg$unix(). Update sendmmsg$unix to use the correct type, the old description was using an array of struct msghdr instead of struct mmsghdr. Set addr field of msghdr structs to optional.
* sys/linux: update constsZi Fan Tan2021-07-286-131/+24
| | | | | | | Update dev_vhci consts as they were updated to use inclusive language in commit 3d4f9c00492b and 6397729bb74d. Remove caif_hsi consts as they were removed in commit ca75bcf0a83b. Remove raw driver ioctls as they were removed in commit 603e4922f1c8.
* sys/linux: minor fix of random dev syscall descriptionCongyu Liu2021-07-261-1/+1
| | | | Syscall `openat$random` should open /dev/random device.
* executor/common_kvm_ppc64: run with enabled MMUAlexey Kardashevskiy2021-07-192-1/+13
| | | | | | | | | | | | | | | | | | | | | This sets up a page table to map the text in order to exercise more code paths in the KVM. This defines flags to control the MMU state. When enabled, this creates a simple page table at the 64K offset and maps all the RAM. The fuzzer code is placed right after the table. The flags are: IR - enables MMU for instruction fetches DR - enables MMU for data loads/stores PR - "problem state", i.e. userspace (implies DR and IR) PID1 - initializes a process table for PID>0 (PID#0 is used by the VM OS normally) This adds a simple "syz_kvm_setup_cpu_ppc64" syz-test with MSR=IR|DR|LE which is a typical Linux kernel mode. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor/common_kvm_ppc64: fix KVM supportAlexey Kardashevskiy2021-07-191-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Turns out the ifuzz on powerpc did not ever properly work. This fixes syz_kvm_setup_cpu$ppc64: Enable the PAPR KVM capability (otherwise KVM_RUN fails right away). Finish generated sequences with the software debug breakpoint as there is no x86's "hlt" variant on POWER and otherwise KVM won't exit. Add exception handlers, use the software debug breakpoint instruction to trigger immediate exit from KVM with the only exception of the decrementer interrupt handler (timer) to recharge the timer and continue. Define and use endianness selection flag (Big vs. Little endian). Define the code generator similar to kvm_gen.cc which for now contains 2 simple tests and the decrementer interrupt handler code. Add test cases to the executor so "bin/linux_ppc64le/syz-executor test" can run some sensible tests. The tests copy 0xbadc0de around similar to x86 and uses gpr[3] is a return value register (similar to EAX). Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* pkg: update generated files to go 1.17Alexey Kardashevskiy2021-07-071-0/+1
| | | | | | | | | | | "make generate" produces this diff when go 1.17 (go1.17-c95464f0ea3f==upstream) is used. Seems compatible with >=1.16. https://github.com/golang/go/commit/4d2d89ff42ca documents the syntax. https://github.com/golang/go/commit/eeadce2d8713 enforces "ignore" for unsatisfiable tags hence the pkg/csource/gen.go change. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* all: support exclude globs in descriptorJoey Jiao2021-06-021-1/+2
|
* pkg/compiler: add glob typeJoey Jiaojg2021-05-261-0/+2
| | | | | | | | | | | | | | | | | | | | * all: add new typename dirname The current way to check files under sysfs or proc is: - define a string to represent each file - open the file - pass the fd to write / read / close The issues above are: - Need to know what file present on target device - Need to write openat for each file With dirname added, which will open one file in the directory randomly and then pass the fd to write/read/close. * all: use typename glob to match filename Fixes #481
* sys/linux: add fq_pie description for netlink_route_schedMara Mihali2021-05-263-1/+29
|
* sys/linux: support syncobjs in dev_msm (#2552)Stephen Boyd2021-04-263-30/+99
| | | | | * sys/linux: support syncobjs in dev_msm * sys/linux: describe syncpoints and dma fences for dev_dri
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-20 07:40:38 +0000