aboutsummaryrefslogtreecommitdiffstats
path: root/sys
Commit message (Collapse)AuthorAgeFilesLines
* executor: sys/linux: SYZOS: add AMD VMLOAD and VMSAVE primitivesAlexander Potapenko2026-01-202-0/+13
| | | | | | | | | | | | This patch introduces SYZOS_API_NESTED_AMD_VMLOAD and SYZOS_API_NESTED_AMD_VMSAVE. These primitives allow the L1 guest to execute the VMLOAD and VMSAVE instructions, which load/store additional guest state (FS, GS, TR, LDTR, etc.) to/from the VMCB specified by the 'vm_id' argument. This stresses the KVM L0 instruction emulator, which must validate the L1-provided physical address in RAX and perform the state transfer.
* executor, sys/linux, pkg: enable syz_kvm_setup_cpu for riscv646eanut2026-01-203-0/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch implements syz_kvm_setup_cpu for riscv64 architecture. The pseudo-syscall accepts VM fd, vCPU fd, host memory, and guest code as parameters. Additional parameters (ntext, flags, opts, nopt) are included for interface consistency with other architectures but are currently unused on riscv64. Implementation: - Set up guest memory via KVM_SET_USER_MEMORY_REGION - Copy guest code to guest memory - Initialize guest registers to enable code execution in S-mode - Return 0 on success, -1 on failure Testing: A test file syz_kvm_setup_cpu_riscv64 is included in sys/linux/test/ to verify basic functionality. Known limitations: - ifuzz is not yet compatible with riscv64. Temporary workaround: set text[riscv64] to TextTarget and return nil in createTargetIfuzzConfig for riscv64 to ensure generateText and mutateText work correctly. This patch also adds support for KVM_GET_ONE_REG ioctl.
* executor: sys/linux: SYZOS: add AMD SET_INTERCEPT primitiveAlexander Potapenko2026-01-192-0/+47
| | | | | | | | | | | | | | | This patch introduces SYZOS_API_NESTED_AMD_SET_INTERCEPT to SYZOS. This primitive enables the fuzzer to surgically modify intercept vectors in the AMD VMCB (Virtual Machine Control Block) Control Area. It implements a read-modify-write operation on 32-bit VMCB offsets, allowing the L1 hypervisor (SYZOS) to deterministically set or clear specific intercept bits (e.g., for RDTSC, HLT, or exceptions) for the L2 guest. This capability allows syzkaller to systematically explore KVM's nested SVM emulation logic by toggling intercepts on and off, rather than relying on static defaults or random memory corruption.
* sys/linux/test: update after syz_kvm_assert_syzos_uexit API changeAlexander Potapenko2026-01-1640-74/+74
| | | | | | | This patch updates all relevant regression tests in sys/linux/test/ to align with the API change introduced in syz_kvm_assert_syzos_uexit. The syz_kvm_assert_syzos_uexit syscall now requires the VCPU file descriptor as its first argument.
* executor: sys/linux: Add VCPU fd to `syz_kvm_assert_syzos_uexit`Alexander Potapenko2026-01-162-2/+2
| | | | | | | | Enhance the debugging capabilities of C reproducers by passing the VCPU file descriptor to the syz_kvm_assert_syzos_uexit function. With access to the VCPU fd, the function can now dump the VCPU's register state upon assertion failure, providing critical context for debugging guest execution issues.
* executor: sys/linux: SYZOS: add support for AMD Nested Event InjectionAlexander Potapenko2026-01-152-0/+46
| | | | | | | | | | | | | Implement SYZOS_API_NESTED_AMD_INJECT_EVENT to allow the L1 guest to inject events (Interrupts, NMIs, Exceptions) into L2 via the VMCB EVENTINJ field. This primitive abstracts the VMCB bit-packing logic (Vector, Type, Valid, Error Code) into a high-level API, enabling the fuzzer to semantically mutate event injection parameters. This targets KVM's nested event merging logic, specifically where L0 must reconcile L1-injected events with Host-pending events.
* executor: sys/linux: SYZOS: add support for AMD STGI and CLGI instructionsAlexander Potapenko2026-01-152-0/+49
| | | | | | | | | Implement the SYZOS_API_NESTED_AMD_STGI and SYZOS_API_NESTED_AMD_CLGI primitives to toggle the Global Interrupt Flag (GIF). These commands execute the stgi and clgi instructions respectively and require no arguments. Also add a test checking that CLGI correctly masks NMI injection from L0.
* executor: sys/linux: SYZOS: add support for AMD INVLPGA instructionAlexander Potapenko2026-01-142-0/+41
| | | | | | | | | | Implement the SYZOS_API_NESTED_AMD_INVLPGA primitive to execute the INVLPGA instruction in the L1 guest. This allows the fuzzer to target KVM's Shadow MMU and Nested Paging (NPT) logic by invalidating TLB entries for specific ASIDs. Also add a simple syzlang seed/regression test.
* sys/linux, executor: enable kvm fuzzing support for riscv646eanut2026-01-094-61/+79
|
* sys/linux: update flags in dev_video4linux.txtJiaming Zhang2026-01-082-6/+53
|
* all: remove unused nolint directivesDmitry Vyukov2026-01-021-1/+0
|
* sys/linux: add reboot/swapon/swapoff/sethostname/setdomainname syscallsDmitry Vyukov2026-01-022-13/+70
|
* sys/linux: fix up dev_video4linux.txtDmitry Vyukov2026-01-021-0/+6
| | | | | | | | | It seems that consts for the file were generated for a single file only, or manually written. I can't find any upstream/linux-next revision where all consts can be regenered. On next-20251111 where we last generated all consts, some of these MALI consts are not present yet. On newer revisions make extract is broken. Add manual defines so that descriptions can be at least re-generated on next-20251111.
* sys/linux: enable some disabled syscalls in snapshot modeDmitry Vyukov2026-01-026-12/+15
| | | | | | Enable some previously disabled syscalls in snapshot mode that look safe for snapshot mode. In snapshot mode we don't rely on the actual networking, and should be able to survive runner process kills, and disk shutdown.
* sys/linux: add v4l2_meta_formatJiaming Zhang2025-12-292-0/+33
|
* sys/linux: add Intel TDX descriptionsAlexander Potapenko2025-12-292-0/+103
| | | | | Initial support for Intel TDX as per https://docs.kernel.org/virt/kvm/x86/intel-tdx.html
* sys/linux: update kvm_sev_guest_statusAlexander Potapenko2025-12-291-1/+1
| | | | | | | | | | | According to arch/x86/include/uapi/asm/kvm.h, kvm_sev_guest_status is defined as follows: struct kvm_sev_guest_status { __u32 handle; __u32 policy; __u32 state; };
* all: use any instead of interface{}Dmitry Vyukov2025-12-221-2/+2
| | | | Any is the preferred over interface{} now in Go.
* all: replace egrep with grep -EAndrew Donnellan2025-12-102-2/+2
| | | | | | | | | | The egrep command has been deprecated in GNU Grep since 2007, and nowadays using egrep rather than grep -E will print a warning to the user, which is very annoying. Replace all usages of egrep with grep -E. Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
* sys/syz-sysgen: fix typomaoyixie2025-12-101-1/+1
|
* sys/linux/test: add landlock_fs_disconnectedMickaël Salaün2025-12-081-0/+56
| | | | | | | | | | | Test access through disconnected directory. This test should trigger a warning without this patch: https://lore.kernel.org/r/20251128172200.760753-2-mic@digikod.net The fix is in linux-next and should be merged in the master branch soon. Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: improve KVM_GET_NESTED_STATE/KVM_SET_NESTED_STATEAlexander Potapenko2025-12-032-14/+52
| | | | | | | Rewrite arch-specific definitions for the nested state to match the source and the documentation: - https://elixir.bootlin.com/linux/latest/source/arch/x86/include/uapi/asm/kvm.h - https://docs.kernel.org/virt/kvm/api.html#kvm-get-nested-state
* sys/linux: run make extractPimyn Girgis2025-12-0314-12/+19
| | | | Run make extract on next-20251111.
* sys/linux: update descriptionsPimyn Girgis2025-12-033-1/+4
| | | | | MSM_SUBMIT_SYNCOBJ_RESET was renamed to MSM_SYNCOBJ_RESET in the Linux kernel. Rename it in descriptions as well. Include necessary headers for dccp and dev_kvm.
* sys/syz-extract: add required compiler flagsPimyn Girgis2025-12-031-0/+4
| | | | | Add compiler flags to syz-extract to handle wide character constants and suppress implicit function declaration warnings in kernel headers.
* sys/linux: apply no_squash to certain KVM ioctlsAlexander Potapenko2025-11-242-5/+5
| | | | | | | | | | | | | | For the following KVM ioctls: - KVM_SET_GSI_ROUTING - KVM_SET_SIGNAL_MASK - KVM_SET_MSRS - KVM_SET_CPUID - KVM_SET_CPUID2 syzkaller is generating squashed blobs, which are less likely to provoke any interesting behaviors. Apply the no_squash attribute to these ioctls to have better understanding of these ioctls' inputs.
* sys/linux: update kvm_guest_addrs with addresses from executor/kvm.hAlexander Potapenko2025-11-241-1/+3
| | | | Make sure the fuzzer knows more about the SYZOS address space.
* sys/linux/test: rename amd64-syz_kvm_nested_vmwrite_maskAlexander Potapenko2025-11-211-0/+0
| | | | | | | Rename amd64-syz_kvm_nested_vmwrite_mask to amd64-syz_kvm_nested_intel_vmwrite_mask No functional change.
* executor: sys/linux: implement SYZOS_API_NESTED_AMD_VMCB_WRITE_MASKAlexander Potapenko2025-11-212-0/+59
| | | | | | | | | | | The new command allows mutation of AMD VMCB block with plain 64-bit writes. In addition to VM ID and VMCB offset, @nested_amd_vmcb_write_mask takes three 64-bit numbers: the set mask, the unset mask, and the flip mask. This allows to make bitwise modifications to VMCB without disturbing the execution too much. Also add sys/linux/test/amd64-syz_kvm_nested_amd_vmcb_write_mask to test the new command behavior.
* executor: sys/linux: implement SYZOS_API_NESTED_INTEL_VMWRITE_MASKAlexander Potapenko2025-11-212-15/+86
| | | | | | | | | | | | The new command allows mutation of Intel VMCS fields with the help of vmwrite instruction. In addition to VM ID and field ID, @nested_intel_vmwrite_mask takes three 64-bit numbers: the set mask, the unset mask, and the flip mask. This allows to make bitwise modifications to VMCS without disturbing the execution too much. Also add sys/linux/test/amd64-syz_kvm_nested_vmwrite_mask to test the new command behavior.
* executor: sys/linux/test: handle RDTSCP in L2Alexander Potapenko2025-11-211-0/+27
| | | | | | | Enable basic RDTSCP handling. Ensure that Intel hosts exit on RDTSCP in L2, and that both Intel and AMD can handle RDTSCP exits. Add amd64-syz_kvm_nested_vmresume-rdtscp to test that.
* executor: sys/linux/test: handle RDTSC in L2Alexander Potapenko2025-11-211-0/+27
| | | | | | | Enable basic RDTSC handling. Ensure that Intel hosts exit on RDTSC in L2, and that both Intel and AMD can handle RDTSC exits. Add amd64-syz_kvm_nested_vmresume-rdtsc to test that.
* executor: sys/linux/test: basic CPUID handling in L2Alexander Potapenko2025-11-211-0/+27
| | | | | Ensure L2 correctly exits to L1 on CPUID and resumes properly. Add a test.
* executor: sys/linux: implement SYZOS_API_NESTED_VMRESUMEAlexander Potapenko2025-11-202-0/+30
| | | | | | | | | | | | | | | Provide the SYZOS API command to resume L2 execution after a VM exit, using VMRESUME on Intel and VMRUN on AMD. For testing purpose, implement basic handling of the INVD instruction: - enable INVD interception on AMD (set all bits in VMCB 00Ch); - map EXIT_REASON_INVD and VMEXIT_INVD into SYZOS_NESTED_EXIT_REASON_INVD; - advance L2 RIP to skip to the next instruction. While at it, perform minor refactorings of L2 exit reason handling. sys/linux/test/amd64-syz_kvm_nested_vmresume tests the new command by executing two instructions, INVD and HLT, in the nested VM.
* sys/linux/test: add amd64-syz_kvm_nested_create_vm-hltAlexander Potapenko2025-11-201-0/+23
| | | | | Basic SYZOS test for NV that ensures an L2 VM is correctly created and executed.
* executor: sys/linux: implement SYZOS_API_NESTED_VMLAUNCHAlexander Potapenko2025-11-191-0/+1
| | | | | | | | | | | | Provide a SYZOS API command to launch the L2 VM using the VMLAUNCH (Intel) or VMRUN (AMD) instruction. For testing purposes, each L2->L1 exit is followed by a guest_uexit_l2() returning the exit code to L0. Common exit reasons (like HLT) will be mapped into a common exit code space (0xe2e20000 | reason), so that a single test can be used for both Intel and AMD. Vendor-specific exit codes will be returned using the 0xe2110000 mask for Intel and 0xe2aa0000 for AMD.
* executor: sys/linux: implement SYZOS_API_NESTED_LOAD_CODEAlexander Potapenko2025-11-191-0/+6
| | | | The new command loads an instruction blob into the specified L2 VM.
* executor: sys/linux: renumber SYZOS API IDsAlexander Potapenko2025-11-191-10/+11
| | | | | | | | Now that we are using volatiles in guest_main(), there is no particular need to base the numbers on primes (this didn't work well with Clang anyway). Instead, group the commands logically and leave some space between the groups for future updates.
* executor: x86: implement SYZOS_API_NESTED_CREATE_VMAlexander Potapenko2025-11-191-11/+14
| | | | | | Provide basic setup for registers, page tables, and segments to create Intel/AMD-based nested virtual machines. Note that the machines do not get started yet.
* executor: x86: implement SYZOS_API_ENABLE_NESTEDAlexander Potapenko2025-11-191-0/+1
| | | | | | Add vendor-specific code to turn on nested virtualization on Intel and AMD. Also provide get_cpu_vendor() to pick the correct implementation.
* sys/generated: don't do lazy initialization of all targetsDmitry Vyukov2025-11-171-1/+2
| | | | | Currently registration of targets calls targets.Get which does slow lazy initialization. This adds several seconds to start of every binary and test. Don't do that.
* executor: sys/linux: implement SYZOS_API_SET_IRQ_HANDLERAlexander Potapenko2025-10-172-9/+46
| | | | | | | | | | The new API call allows to initialize the handler with one of the three possible values: - NULL (should cause a page fault) - dummy_null_handler (should call iret) - uexit_irq_handler (should perform guest_uexit(UEXIT_IRQ)) Also add a test for uexit_irq_handler()
* sys/linux/test: fix amd64-syz_kvm_setup_syzos_vm-wr_drn-shutdownAlexander Potapenko2025-10-171-2/+3
| | | | | | Now that we handle interrupts in the guest code, this program does not shutdown anymore. Make sure it finishes correctly, and rename the test case to avoid confusion.
* sys/linux/test: add amd64-syz_kvm_setup_syzos_vm-default_irq_handlerAlexander Potapenko2025-10-171-0/+26
| | | | | Verify that the default IRQ handler correctly handles an injected interrupt.
* sys/linux: use the same device in the binder seedAleksandr Nogikh2025-09-231-1/+1
| | | | Otherwise the two instances can't communicate.
* prog: fix syz_kfuzztest_run allocation strategyEthan Graham2025-09-221-1/+1
| | | | | | | | | | | | | | | | | | | | Previously, the generated KFuzzTest programs were reusing the address of the top-level input struct. A problem could arise when the encoded blob is large and overflows into another allocated region - this certainly happens in the case where the input struct points to some large char buffer, for example. While this wasn't directly a problem, it could lead to racy behavior when running KFuzzTest targets concurrently. To fix this, we now introduce an additional buffer parameter into syz_kfuzztest_run that is as big as the maximum accepted input size in the KFuzzTest kernel code. When this buffer is allocated, we ensure that we have some allocated space in the program that can hold the entire encoded input. This works in practice, but has not been tested with concurrent KFuzzTest executions yet.
* kfuzztest: introduce syz_kfuzztest_run pseudo-syscallEthan Graham2025-09-221-0/+4
| | | | | | | | | | | | | Add syz_kfuzztest_run pseudo-syscall, KFuzzTest attribute, and encoding logic. KFuzzTest targets, which are invoked in the executor with the new syz_kfuzztest_run pseudo-syscall, require specialized encoding. To differentiate KFuzzTest calls from standard syzkaller calls, we introduce a new attribute called KFuzzTest or "kfuzz_test" in syzkaller descriptions that can be used to annotate calls. Signed-off-by: Ethan Graham <ethangraham@google.com>
* sys/linux: use SOL_TLS for TLS setsockopt callsAleksandr Nogikh2025-09-222-4/+5
| | | | This is the proper level for TLS_RX/TLS_TX opts.
* sys/linux: use stringnoz in setsockoptAleksandr Nogikh2025-09-221-4/+4
| | | | The syscall expects non-zero terminated strings.
* sys/linux/test: add amd64-syz_kvm_setup_syzos_vm-hltAlexander Potapenko2025-09-191-0/+17
| | | | | The new test validates that KVM exits with KVM_EXIT_HLT when encountering the x86 HLT instruction.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 17:34:37 +0000