aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux
Commit message (Collapse)AuthorAgeFilesLines
...
* sys/linux: improve BPF program attach typesPaul Chaignon2024-09-115-11/+89
| | | | | | | | Which attach types are available to a BPF program depends on its type. We can encode this using conditional fields to reduce the time syzkaller loses on unsupported combinations of (program type; attach type). Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: improve precision of BPF attach targetsPaul Chaignon2024-09-112-5/+45
| | | | | | | | | | | | | | | How the attach target field is interpreted depends on the program type [1], which itself depends on the attach type [2] (defined in attach_type_to_prog_type upstream). This commit encodes the same in syzkaller to make the attach target field more precise. Because attach_type_to_prog_type is a simple n to 1 mapping, we can encode it as defines. We can then use those defines in conditional fields for the different types of attach targets. 1 - https://elixir.bootlin.com/linux/v6.10.9/source/kernel/bpf/syscall.c#L4098 2 - https://elixir.bootlin.com/linux/v6.10.9/source/kernel/bpf/syscall.c#L3913 Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: replace id_or_fd with more precise versionPaul Chaignon2024-09-113-31/+39
| | | | | | | | | | | | | The id_or_fd union was introduced before we had conditional fields to represent IDs or fds for BPF programs or links. The union was overapproximating those specific types. With conditional fields, we can now use information from other fields to determine precisely which type from the union is expected. For example, with BPF_PROG_ATTACH, if BPF_F_ID is the only flag, then the relative_fd field should be interpreted as a program ID. Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: explain chain id restrictionsDavide Ornaghi2024-09-111-0/+1
| | | | | Restrict nft_chain_ids to 1:4 since they wouldn't match otherwise. Ideally we should keep track of used ids and only choose among them.
* sys/linux: update nft descriptionDavide Ornaghi2024-09-112-34/+137
| | | | | | | | Use the newer INET and NETDEV families. Improve some type definitions. Add missing flags. Implement nft_inner and nft_last exprs. Add all nft matches and targets for their respective exprs.
* sys/linux/dev_kvm.txt: pass flags to ioctl$KVM_IRQFDAlexander Potapenko2024-09-112-1/+5
| | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-irqfd for more details.
* sys/linux/dev_kvm.txt: minor flag changesAlexander Potapenko2024-09-112-3/+7
| | | | | - use specific flags in kvm_msi and kvm_irq_routing_entry - add KVM_IRQ_ROUTING_XEN_EVTCHN to kvm_irq_routing_entry_type
* sys/linux/dev_kvm.txt: pass clock IDs to KVM_GET_CLOCK/KVM_SET_CLOCKAlexander Potapenko2024-09-112-1/+6
| | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-get-clock for more info.
* sys/linux/dev_kvm.txt: declare the arg of KVM_IRQ_LINE_STATUS as inoutAlexander Potapenko2024-09-111-1/+1
| | | | KVM_IRQ_LINE_STATUS is declared as _IOWR(), so it should be able to return values.
* sys/linux/dev_kvm.txt: allow returning data via kvm_device_attrAlexander Potapenko2024-09-111-2/+2
| | | | | | Both kvm_device_attr_generic and kvm_device_attr_arm64 are passed to ioctl$KVM_SET_DEVICE_ATTR and ioctl$KVM_GET_DEVICE_ATTR as read-only, but the `addr` parameter should be marked as inout.
* sys/linux/dev_kvm.txt: declare ioctl$KVM_ARM_PREFERRED_TARGETAlexander Potapenko2024-09-112-0/+2
| | | | | | Despite it only reads data from the kernel, and CPU creation is anyway handled by syz_kvm_setup_cpu(), adding this ioctl will increase coverage and potentially trigger interactions with KVM_ARM_VCPU_INIT.
* sys/linux/dev_kvm.txt: declare ioctl$KVM_RESET_DIRTY_RINGSAlexander Potapenko2024-09-112-0/+2
| | | | | | This ioctl is mentioned at https://docs.kernel.org/virt/kvm/api.html#kvm-cap-dirty-log-ring-kvm-cap-dirty-log-ring-acq-rel, but doesn't have its own doc entry.
* sys/linux/dev_kvm.txt: declare ioctl$KVM_GET_XSAVE2Alexander Potapenko2024-09-112-0/+3
| | | | This is an x86-only ioctl: https://docs.kernel.org/virt/kvm/api.html#kvm-get-xsave2
* sys/linux/dev_kvm.txt: declare ioctl$KVM_SET_MEMORY_ATTRIBUTESAlexander Potapenko2024-09-112-0/+11
| | | | | According to https://docs.kernel.org/virt/kvm/api.html#kvm-set-memory-attributes, this is an x86-only ioctl.
* sys/linux/dev_kvm.txt: correctly pass ARM64 CPU featuresAlexander Potapenko2024-09-112-2/+22
| | | | | | Certain ioctls accept CPU features as numbers in the range 0..6 (aka KVM_ARM_VCPU_POWER_OFF..KVM_ARM_VCPU_SVE), whereas other ioctls accept them as a bit mask.
* sys/linux/dev_kvm.txt: add PSCI constants from uapi/linux/psci.hAlexander Potapenko2024-09-112-1/+35
|
* sys/linux/dev_kvm.txt: update KVM capabilitiesAlexander Potapenko2024-09-112-1/+72
| | | | | | | | Add the capabilities described in https://docs.kernel.org/virt/kvm/api.html, but previously missing from the descriptions. Most of these are VM capabilities for x86 and arm64, apart from KVM_CAP_SYNC_REGS, which is a VCPU capability. VM/VCPU attribution is poorly documented, so I referred to LXR to figure that out.
* sys/linux: add ARM64_ADDR_DIRTY_PAGES to kvm_guest_addrsAlexander Potapenko2024-09-111-1/+1
|
* sys/linux/dev_kvm.txt: declare ARM_SMCCC_ constants from arm-smccc.hAlexander Potapenko2024-09-102-1/+20
| | | | | | KVM provides a number of vendor-specific hypercall functions that are hard to discover without explicitly listing their IDs in the descriptions file.
* sys/linux/dev_kvm.txt: fix the description of kvm_coalesced_mmio_zoneAlexander Potapenko2024-09-091-3/+3
| | | | | | | | | According to https://elixir.bootlin.com/linux/v6.10.9/source/include/uapi/linux/kvm.h, the third member of `struct kvm_coalesced_mmio_zone` is a union of `__u32 pad` and `__u32 pio`, where `pio` can be 0 or 1, depending on whether the user wants to use KVM_MMIO_BUS or KVM_PIO_BUS (see also https://elixir.bootlin.com/linux/v6.10.9/source/virt/kvm/coalesced_mmio.c#L137)
* sys/linux: remove auto-manual descriptions and run syz-declextractPimyn Girgis2024-09-0922-2276/+2140
|
* pkg/mgrconfig, prog, sys/linux: add automatic_helper attributePimyn Girgis2024-09-095-12/+8
| | | | | Add automatic_helper attribute and enable it for system calls that are required to properly run automatically generated descriptions. Enable these system calls when descriptions_mode = `Auto`.
* sys/linux: cover BPF cookie in raw tracepoint programsPaul Chaignon2024-09-091-0/+2
| | | | | | | This field was added upstream in commit [1]. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=68ca5d4eebb8 Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: cover BPF tokensPaul Chaignon2024-09-098-15/+32
| | | | | | | | | | | | | | | | | | | The new BPF_TOKEN_CREATE bpf(2) command was introduced in commit [1] upstream. This command takes a BPF filesystem fd and returns a BPF token [2]. This token can then be passed to commands BPF_PROG_LOAD, BPF_MAP_CREATE, and BPF_BTF_LOAD and the kernel will use it to check if the operation is allowed. What operations a token allows is defined by the mount options of the BPF filesystem. No flags are currently supported for the BPF_TOKEN_CREATE command. The fd should point to the BPF filesystem, but we don't have a specific resource for this yet so just point to a generic fd. This command also doesn't add support for the new mount options. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=35f96de04127 2 - https://lwn.net/Articles/947173/ Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: cover value_type_btf_obj_fd field for BPF_MAP_CREATEPaul Chaignon2024-09-092-5/+8
| | | | | | | | | This new field for the bpf(2) command BPF_MAP_CREATE was introduced in [1] upstream. It is conditioned on both the map type and its flags (BPF_F_VTYPE_BTF_OBJ_FD). 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fcc2c1fb0651 Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux: update BPF constantsPaul Chaignon2024-09-092-4/+11
| | | | Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* sys/linux/dev_kvm.txt: declare ioctl$KVM_SET_USER_MEMORY_REGION2Alexander Potapenko2024-09-062-1/+16
| | | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-set-user-memory-region2 for more details
* sys/linux/dev_kvm.txt: declare ioctl$KVM_CREATE_GUEST_MEMFDAlexander Potapenko2024-09-062-0/+9
| | | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-create-guest-memfd for more details
* sys/linux/dev_kvm.txt: declare ioctl$KVM_PRE_FAULT_MEMORYAlexander Potapenko2024-09-062-0/+10
| | | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-pre-fault-memory for details
* sys/linux/dev_kvm.txt: declare ioctl$KVM_ARM_SET_COUNTER_OFFSETAlexander Potapenko2024-09-062-0/+9
| | | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-arm-set-counter-offset for more details.
* sys/linux/dev_kvm.txt: declare ioctl$KVM_ARM_VCPU_FINALIZE()Alexander Potapenko2024-09-062-0/+2
| | | | See https://docs.kernel.org/virt/kvm/api.html#kvm-arm-vcpu-finalize for details
* sys/linux: add missing constants for KVM_ARM_VCPU_INITAlexander Potapenko2024-09-062-1/+4
| | | | | Add KVM_ARM_VCPU_PTRAUTH_ADDRESS, KVM_ARM_VCPU_PTRAUTH_GENERIC, KVM_ARM_VCPU_SVE from https://docs.kernel.org/virt/kvm/api.html#kvm-arm-vcpu-init
* sys/linux/dev_kvm.txt: declare KVM_CLEAR_DIRTY_LOGAlexander Potapenko2024-09-062-0/+12
|
* sys/linux: update kvm_guest_debug_flagsAlexander Potapenko2024-09-062-1/+3
| | | | | Add KVM_GUESTDBG_EXIT_PENDING (s390) and KVM_GUESTDBG_BLOCKIRQ (x86) that were previously missing.
* sys/linux: declare arm64 version of kvm_vcpu_eventsAlexander Potapenko2024-09-061-1/+16
| | | | As per https://docs.kernel.org/virt/kvm/api.html#kvm-get-vcpu-events
* executor: sys/linux: arm64: implement SYZOS_API_MEMWRITEAlexander Potapenko2024-09-062-0/+24
| | | | | | | | The new API call will be used to write values to guest memory specified by base+offset. Writing to e.g. MMIO registers for VGIC (or any other MMIO ranges) may result in new coverage.
* sys/linux: update kvm_guest_addrsAlexander Potapenko2024-09-051-1/+1
| | | | Add addresses from executor/kvm.h used by guest code on ARM64 to kvm_guest_addrs.
* sys/linux: adjust the description of kvm_ioeventfdAlexander Potapenko2024-09-051-2/+2
| | | | | | According to https://docs.kernel.org/virt/kvm/api.html#kvm-ioeventfd, datam should be the optional expected data value written by the guest (we keep it random for now), whereas addr is the MMIO address.
* sys/linux: add ARM VGIC device groups/attributesAlexander Potapenko2024-09-032-3/+42
| | | | Do not specify the attribute input types for now.
* sys/linux: declare KVM_{SET,GET,HAS}_DEVICE_ATTR for VCPUsAlexander Potapenko2024-09-032-0/+82
| | | | | | According to https://docs.kernel.org/virt/kvm/devices/vcpu.html, VCPUs also have device attributes. Add descriptions for ioctls that manipulate those attributes.
* sys/linux: add a test for VGICv3Alexander Potapenko2024-09-031-0/+18
|
* executor: arm64: sys/linux: add SYZOS_API_IRQ_SETUPAlexander Potapenko2024-09-031-5/+11
| | | | | | | | Implement basic IRQ controller setup for VMs with a single CPU. SYZOS_API_IRQ_SETUP sets up the VGICv3 distributor/redistributor and enables the specified number of SPIs starting from 32. The default IRQ handler is set up to perform a uexit(-2).
* executor: pkg/vminfo: sys/linux: define syz_kvm_vgic_v3_setupAlexander Potapenko2024-09-031-0/+4
| | | | | The new pseudo-syscall sets up VGICv3 IRQ controller on the host. That still requires guest setup code, which will be submitted separately.
* sys/linux: result of running syz-declextractPimyn Girgis2024-09-0329-1240/+9147
| | | | Added the result of running syz-declextract. Added auto-manual.txt containing necessary manually written descriptions.
* sys/linux/filesystem: add mount flags for filesystemsViacheslav Sablin2024-08-271-50/+172
|
* sys/linux: result of running syz-declextract and syz-env make extract on the ↵Pimyn Girgis2024-08-229-122/+1883
| | | | default config of the Linux kernel
* tools/syz-declextract, sys/linux: generate descriptions with auto attribute ↵Pimyn Girgis2024-08-122-0/+844
| | | | | | | | | and filter syscalls based on architectures Start generating descriptions directly in syz-declextract. Automatically generated descriptions are marked with "auto" attribute and parameter names are changed if they use a reserved keyword. By default, all parameters are of type intptr; This is intended to change later. "run" now produces deterministic output and filters system calls to only allow ones supported by syzkaller supported architectures, and renames any system calls that need to be renamed.
* sys/linux/filesystem: add mount flags for some filesystemsViacheslav Sablin2024-08-121-6/+85
|
* sys/linux/filesystem: add mount flags for squashfsViacheslav Sablin2024-08-091-1/+9
|
* sys/linux/filesystem: add mount flags for ocfs2Viacheslav Sablin2024-08-091-1/+32
|
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 22:57:06 +0000