aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux
Commit message (Collapse)AuthorAgeFilesLines
...
* tools/syz-declextract: extract ioctls declared with enumsDmitry Vyukov2025-04-152-15/+270
| | | | | Some ioctls are declared inconsistently using enums rather than macros. Extract these as well.
* tools/syz-declextract: export info about file ops interfacesDmitry Vyukov2025-04-111-22/+2533
|
* tools/syz-declextract: add interface coverage infoDmitry Vyukov2025-04-102-1593/+1593
| | | | | | Add coverage percent for kernel interfaces. The current data is generated with Mar coverage report on kernel commit 1e7857b28020ba57ca7fdafae7ac855ba326c697.
* pkg/declextract: export syscall variants as separate interfacesDmitry Vyukov2025-04-103-973/+1637
| | | | | | Export each syscall variant (e.g. fcnt$*) as a separate interface. Effectively these are separate syscalls. We will want this for ioctl as well (it's not 1 interface).
* tools/syz-declextract: refine arg types for syscall variantsDmitry Vyukov2025-04-091-305/+305
| | | | | | Use scope-based dataflow analysis for syscall variants (including ioctls). As the result we only consider code that relates to a partiuclar command/ioctl, and can infer arguments/return types for each command/ioctl independently.
* sys/linux: update auto descriptions and constsDmitry Vyukov2025-04-095-311/+486
| | | | Update auto.txt and consts on v6.15-rc1.
* sys/linux: fix error defined attributesLin Ma2025-04-073-6/+11
| | | | | | | | | | | | Definitions for attribute `NBD_ATTR_SOCKETS`, `NL80211_ATTR_BSS_SELECT`, `NL80211_ATTR_PEER_MEASUREMENTS`, and `NL80211_ATTR_SCHED_SCAN_MATCH` have some errors. Fix them carefully, Check related parse functions: nbd_genl_reconfigure, parse_bss_select, nl80211_pmsr_start and nl80211_parse_sched_scan for details. Signed-off-by: Lin Ma <linma@zju.edu.cn>
* sys/linux: update and remove obsolete constsMarios Pomonis2025-04-038-29/+28
| | | | | | | This commit removes CRYPTO_ALG_TYPE_COMPRESS from socket_alg.txt since it was recently removed from the kernel source tree (fce8b8d crypto: remove obsolete 'comp' compression API). It also updates a number of other consts that make extract detected.
* sys/linux: add Landlock syscall flagsMickaël Salaün2025-03-212-2/+11
| | | | | | | | | | | | Add the new LANDLOCK_RESTRICT_SELF_LOG_SAME_EXEC_OFF, LANDLOCK_RESTRICT_SELF_LOG_NEW_EXEC_ON, and LANDLOCK_RESTRICT_SELF_LOG_SUBDOMAINS_ON flags for landlock_restrict_self(2) from Linux 6.15 (audit support for Landlock). Also add the LANDLOCK_CREATE_RULESET_VERSION and LANDLOCK_CREATE_RULESET_ERRATA flags for landlock_create_ruleset(2). Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add seeds that exercise WFE[T]Marios Pomonis2025-01-292-0/+42
| | | | | | Add sys/linux/test/arm64-syz_kvm_setup_syzos_vm-wfe and sys/linux/test/arm64-syz_kvm_setup_syzos_vm-wfet, two seeds that exercise the WFxT path in KVM.
* sys/syz-sysgen: serialize descriptions as gob and embedDmitry Vyukov2025-01-232-7/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of generating Go files with descriptions serialize them as gob and compress with flate. This significantly reduces build time, go vet time, and solves scalability problems with some static analysis tools. Reference times (all after rm -rf ~/.cache/go-build) before: TIME="%e %P %M" time go install ./syz-manager 48.29 577% 4824820 TIME="%e %P %M" time go test -c ./prog 56.28 380% 6973292 After: TIME="%e %P %M" time go install ./syz-manager 22.81 865% 859788 TIME="%e %P %M" time go test -c ./prog 12.74 565% 267760 syz-manager size before/after: 194712597 -> 83418407 -57% even provided we now embed all descriptions instead of just a single arch. Deflate/decoding time for a single Linux arch is ~330ms. Fixes #5542
* pkg/declextract: infer syscall commandsDmitry Vyukov2025-01-222-4/+1119
| | | | | | | | Use function scope information extracted in the previous commit to infer multiplexed syscalls (fcntl, prctl, ...) and infer their arguments. Descriptions generated on Linux commit c4b9570cfb63501.
* tools/syz-declextract: support function scopesDmitry Vyukov2025-01-223-1106/+4239
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Extract info about function scopes formed by switch'es on function arguments. For example if we have: void foo(..., int cmd, ...) { ... switch (cmd) { case FOO: ... block 1 ... case BAR: ... block 2 ... } ... } We record that any data flow within block 1 is only relevant when foo's arg cmd has value FOO, similarly for block 2 and BAR. This allows to do 3 things: 1. Locate ioctl commands that are switched on within transitively called functions. 2. Infer return value for each ioctl command. 3. Infer argument type when it's not specified in _IO macro. This will also allow to infer other multiplexed syscalls. Descriptions generated on Linux commit c4b9570cfb63501.
* pkg/declextract: remove unused includes and definesDmitry Vyukov2025-01-172-197/+2
| | | | | | | | | | This is nice on its own, but this will also help to prevent lots of problems when we export more info from the clang tool in future. The clang tool does not know what will end up in the final descriptions, so it exports info about all consts that it encounters. As the result we pull in lots of includes/defines, and lots of kernel includes/defines are broken or create problems. So the fewer we have, the better.
* sys/linux/test: add seeds that exercise WFI[T]Marios Pomonis2025-01-162-0/+42
| | | | | | Add sys/linux/test/arm64-syz_kvm_setup_syzos_vm-wfi and sys/linux/test/arm64-syz_kvm_setup_syzos_vm-wfit, two seeds that exercise the WFxT path in KVM.
* sys/linux/test: add tests for ARM QEMU emulationMarios Pomonis2025-01-168-0/+333
| | | | | | | When using QEMU full emulation mode, the majority of the system registers (as defined in sys/linux/dev_kvm.txt:kvm_regs_arm64_sys) are not accessible (i.e. only 77/592 trigger kvm_handle_sys_reg()). This series of tests perform MSR accesses to the accessible registers.
* executor: arm64: add SYZOS_API_MRSMarios Pomonis2025-01-144-0/+47
| | | | Add support for the MRS instruction in a similar manner to MSR.
* sys/linux: improve iouring interfaceSablin Viacheslav2024-12-262-7/+65
|
* sys/linux: add descriptions for Mali Driverp0-tato2024-12-192-2/+26
| | | | | | | | | | | | sys/linux: run make extract sys/linux: add Descriptions for Mali GPU Driver sys/linux: add Descriptions for Mali GPU Driver sys/linux: add descriptions for Mali Driver sys/linux: add descriptions for Mali Driver
* sys/linux/test: add a seed enabling PMUAlexander Potapenko2024-12-181-0/+26
| | | | | | | | | | Add sys/linux/test/arm64-syz_kvm_setup_syzos_vm-enable-pmu, a seed that enables PMU and touches PMEVCNTR0_EL0. It was inspired by https://github.com/google/syzkaller/pull/5582 and led to a notable (+500) coverage increase, as the fuzzer couldn't previously guess that it should pass KVM_ARM_VCPU_PMU_V3 when creating the vCPU and set the KVM_ARM_VCPU_PMU_V3_INIT attribute at the same time.
* sys/linux/test: use syz_kvm_assert_reg() in arm64-syz_kvm_setup_syzos_vm-msrAlexander Potapenko2024-12-181-1/+1
| | | | Make sure SyzOS test correctly set the value of VBAR_EL1.
* executor: pkg/vminfo: sys/linux: arm64: implement syz_kvm_assert_reg()Alexander Potapenko2024-12-181-0/+2
| | | | Add a pseudo-syscall to assert on register values.
* tools/syz-declextract: infer argument/field typesDmitry Vyukov2024-12-171-94/+99
| | | | | | Use data flow analysis to infer syscall argument, return value, and struct field types. See the comment in pkg/declextract/typing.go for more details.
* pkg/declextract: fix static function handlingDmitry Vyukov2024-12-161-426/+426
| | | | | The check did not actually match any header files. Fix the check.
* sys/linux: tools/arm64: remove redundant registers from kvm_regs_arm64_extraAlexander Potapenko2024-12-131-2/+1
| | | | Remove constants that are already covered by arm64_bitmap and arm64_fw in kvm_one_reg.
* pkg/declextract: change auto_todo type to int8Dmitry Vyukov2024-12-131-1/+1
| | | | | | We use auto_todo type as an element of array for void*. array[int8] is lowered to the buffer type, which is much better handled by the fuzzer engine + closer resembles real blobs.
* sys/linux: update auto-generated interfaces with LOC infoDmitry Vyukov2024-12-132-982/+982
|
* sys/linux: tools/arm64: more ARM64 register IDs for dev_kvm.txtAlexander Potapenko2024-12-131-7/+21
| | | | | | Declare register classes for Bitmap, FW, SVE registers. Also move generation of CCSIDR, FP and core registers from registers.go to the text description.
* sys/linux: mark nci syscalls as automatic_helperDmitry Vyukov2024-12-111-2/+2
| | | | | This is a side-effect of making auto descriptions use sockaddr (it contains nfc_dev_id).
* pkg/declextract: generated single openat for all related filesDmitry Vyukov2024-12-111-1026/+24
|
* pkg/declextract: restore use of ipv6_addrDmitry Vyukov2024-12-111-2/+2
|
* tools/syz-declextract: generate file_operations descriptionsDmitry Vyukov2024-12-112-0/+4112
| | | | | | | | Emit descriptions for special files in /dev, /sys, /proc, and ./. pkg/declextract combines file_operations info produced by the clang tool with the dynamic probing info produced by pkg/ifaceprobe in order to produce complete descriptions for special files.
* pkg/declextract: emit more netlink familiesDmitry Vyukov2024-12-113-0/+59
| | | | Emit families w/o policy, emit duplicate commands.
* pkg/declextract: refine more networking typesDmitry Vyukov2024-12-111-73/+35
|
* pkg/declextract: refactor netlink generationDmitry Vyukov2024-12-111-2062/+2148
| | | | | | | Emit all information related to a single netlink family close to each other. Previously we emitted them scattered and grouped by info type. That was both inconvinient to emit and inconvinient to read. NFC.
* pkg/declextract: rename generated names for consistencyDmitry Vyukov2024-12-111-1258/+1258
| | | | | | Currently we append "$auto", or "$auto_record", or prepend "auto_", or insert "auto" somewhere in the middle. Use more consistent naming: always append "$auto".
* tools/syz-declextract: rewriteDmitry Vyukov2024-12-113-142/+432
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | syz-declextract accumulated a bunch of code health problems so that now it's hard to change/extend it, lots of new features can only be added in in hacky ways and cause lots of code duplication. It's also completly untested. Rewrite the tool to: - move as much code as possible to Go (working with the clang tool is painful for a number of reasons) - allow testing and add unit tests (first layer of tests test what information is produced by the clang tool, second layer of tests test how that information is transformed to descriptions) - allow extending the clang tool output to export arbitrary info in non-hacky way (now it produces arbitrary JSON instead of a mix of incomplete descriptions and interfaces) - remove code duplication in the clang tool and provide common infrastructure to add new analysis w/o causing more duplication - provide more convinient primitives in the clang tool - improve code style consistency and stick to the LLVM code style (in particular, variable names must start with a capital letter, single-statement blocks are not surrounded with {}) - remove intermixing of code that works on different levels (currently we have AST analysis + busness logic + printfs all intermixed with each other) - provide several helper Go packages for better code structuring (e.g. pkg/clangtool just runs the tool on source files in parallel and returns results, this already separates a bunch of low-level logic from the rest of the code under a simple abstraction) I've tried to make the output match the current output as much as possible so that the diff is managable (in some cases at the cost of code quality, this should be fixed in future commits). There are still some differences, but hopefully they are managable for review (more includes/defines, reordered some netlink attributes). Fixed minor bugs are fixed along the way, but mostly NFC: 1. Some unions were incorrectly emitted as [varlen] (C unions are never varlen). 2. Only a of [packed], [align[N]] attributes was emitted for struct (both couldn't be emitted).
* pkg/compiler: add automatic metaDmitry Vyukov2024-12-111-928/+930
| | | | | | Mark the whole file with "meta automatic" instead of marking each syscall. This reduces size of descriptions + allows to do special things with the whole file (e.g. we already treat auto consts specially).
* sys/linux/test: add syz_kvm_assert_syzos_uexit to existing testsAlexander Potapenko2024-12-119-1/+63
|
* pkg/vminfo: sys/linux: executor: define syz_kvm_assert_syzos_uexit()Alexander Potapenko2024-12-111-0/+2
| | | | | The new pseudo-syscall will serve as a test assertion, checking the uexit return value. This is going to help us validate SyzOS code.
* prog: annotate image assets with fsck logsFlorent Revest2024-12-091-14/+14
| | | | | | | | | | | | | | | | | | Syscall attributes are extended with a fsck command field which lets file system mount definitions specify a fsck-like command to run. This is required because all file systems have a custom fsck command invokation style. When uploading a compressed image asset to the dashboard, syz-manager also runs the fsck command and logs its output over the dashapi. The dashboard logs these fsck logs into the database. This has been requested by fs maintainer Ted Tso who would like to quickly understand whether a filesystem is corrupted or not before looking at a reproducer in more details. Ultimately, this could be used as an early triage sign to determine whether a bug is obviously critical.
* sys/linux/tests: add a seed that unrolls syz_kvm_vgic_v3_setup()Alexander Potapenko2024-12-061-0/+23
| | | | | Provide a test case that replaces syz_kvm_vgic_v3_setup() with a sequence of 5 KVM ioctls.
* sys/linux/test: add seeds for known KVM bugsAlexander Potapenko2024-12-069-0/+119
|
* sys/linux/test: disable threading in syzos testsAlexander Potapenko2024-12-068-8/+8
| | | | | Syscalls that initialize KVM and set up syzos have to be executed in the particular order, there's no point in running them concurrently.
* sys/linux: updated fuse fs specificationsSablin Viacheslav2024-11-296-10/+114
|
* sys/linux/dev_kvm_arm64.txt: remove the unneeded definesAlexander Potapenko2024-11-261-80/+0
| | | | Now that we include linux/irqchip/arm-gic-v3.h, we don't need them anymore.
* sys/linux/dev_kvm_arm64.txt: add ITS registers to syzos_api_memwriteAlexander Potapenko2024-11-262-0/+31
| | | | Hint syzkaller that it can write to ITS registers.
* sys/linux: move some ARM-specific descriptions to a separate fileAlexander Potapenko2024-11-264-408/+432
| | | | | | | | | | | | | | This is done to solve a particular test failure running: $ tools/syz-env go test ./prog -run TestSpecialStructs , which failed on PPC64, because prog/rand.go instanciated a call to syz_kvm_setup_syzos_vm(), which requested too much memory (1024 pages) from the allocator (PPC64 uses 64k pages, so the number of available pages is lower). On the other hand, factoring out syzos-related descriptions is probably a nice thing to do anyway.
* sys/linux/test: add a test for SYZOS_API_ITS_SEND_CMDAlexander Potapenko2024-11-261-0/+32
|
* sys/linux/test: invoke SYZOS ITS setup in ↵Alexander Potapenko2024-11-261-9/+11
| | | | | | arm64-syz_kvm_setup_syzos_vm-vgicv3-its Make sure the test actually performs guest-side ITS setup and invokes an LPI.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 04:46:41 +0000