aboutsummaryrefslogtreecommitdiffstats
path: root/vm
Commit message (Collapse)AuthorAgeFilesLines
* pkg/gce, vm/gce: create InstanceConfig struct used by CreateInstance methodPimyn Girgis7 days1-2/+10
|
* vm/qemu: add openbsd/amd64 supportJiaming Zhang2026-02-251-0/+6
|
* vm: test multiple Run() callsAleksandr Nogikh2026-02-172-4/+117
| | | | | Construct a more elaborate and close to real life test that ensures that multiple Instance.Run() calls successfully finish.
* pkg/instance: extract crash dumpsAleksandr Nogikh2026-02-171-0/+5
| | | | | | | | | If the crash dumps are enabled, collect one crash dump per each crash when fuzzing locally. Optionally also collect crash dumps in pkg/instance's Test(). Inspired by Chenxi Huang's downstream changes to syzkaller.
* vm/virtualbox: don't close uart in Run()Aleksandr Nogikh2026-02-171-13/+9
| | | | | It prevents multiple Run() calls per single liftime of a VM. Move its closure to the Close() method.
* vm/vmimpl: refactor Merger error processingAleksandr Nogikh2026-02-1710-66/+182
| | | | | Introduce an Error() method to avoid capturing the errors of already overridden decoders.
* vm/qemu: close the write pipe end after starting a subprocessAleksandr Nogikh2026-02-161-0/+1
| | | | Otherwise the "ssh-err" channel decoder never exits.
* vm/vmimpl: wait before killing the processAleksandr Nogikh2026-02-041-2/+30
| | | | | | | | | | The stdout and stderr streams may be closed before the program actually exits, which races with our attempt to kill the process. It results in Run() sometimes returning an error even though the command has actually succeeded. Let's give the process some more time to exit itself, and kill it only after the timeout.
* vm: split OutputCommand to OutputStderr and OutputStdoutAleksandr Nogikh2026-02-0213-25/+129
| | | | This will give an even better granularity for filtering out unwanted data.
* vm: preserve the origin of each output chunkAleksandr Nogikh2026-02-0219-112/+138
| | | | Remember if it was coming from a command output or from a serial port.
* vm/qemu: fix sshArgs passing user instead of keyYuan Tan2026-01-281-1/+1
| | | | | | | | | | | The sshArgs function was incorrectly passing inst.User (username) to vmimpl.SSHArgs instead of inst.Key (SSH key path). This bug was not discovered during normal fuzzing because sshArgs() is only called via ssh(), which is only used by the Diagnose() function for crash diagnosis. The main fuzzing operations (Copy and Run) construct their SSH arguments directly using vmimpl.SCPArgs and vmimpl.SSHArgsForward with the correct inst.Key parameter.
* all: fix context.Context usageTaras Madan2026-01-211-0/+1
|
* vm/adb: don't check for ret code on adb shell rebootSebastian Ene2026-01-201-1/+10
| | | | | | | | | Prevent the fuzzer from entering in an infinte loop of device reboots when the adb shell reboot command returns with an error code. Fixes: #6598 Signed-off-by: Sebastian Ene <sebastianene@google.com>
* vm/adb: use the correct path for debugfsSebastian Ene2026-01-191-1/+1
| | | | | | | | | | Probe for the debugfs rootdir instead of the kcov sub-path to prevent the fuzzer from entering in device reboot loop in case the android device doesn't support kcov. Fixes: #6600 Signed-off-by: Sebastian Ene <sebastianene@google.com>
* pkg/gce: vm/gce: allow specifying instance tags in manager configAlexander Potapenko2026-01-151-2/+3
| | | | | | | | | | | | GCE instance tags can be used for various purposes, such as applying network firewall rules or filtering VMs for scheduling onto specific hosts. To support these use cases, syzkaller needs the ability to set instance tags during VM creation. This patch introduces a new tags field to the gce VM configuration that allows users to specify a list of tags to be attached to GCE instances created by syz-manager.
* vm/starnix: update syntax for ffx target listLaura Peskin2026-01-071-2/+1
|
* all: remove unused nolint directivesDmitry Vyukov2026-01-023-13/+2
|
* all: use any instead of interface{}Dmitry Vyukov2025-12-222-8/+8
| | | | Any is the preferred over interface{} now in Go.
* vm/qemu: additional check for crashes only in DiagnoseBabak Huseynov2025-11-211-2/+33
|
* vm: implement the VM interface for VirtualBoxKuzey Arda Bulut2025-11-142-0/+320
| | | | | | | | | | This change adds VirtualBox support to syzkaller. It implements the VM interface for VirtualBox and provides: - full VM lifecycle operations (create, boot, stop, snapshot restore) - serial console hookup and integration with the output merger - proper boot wait logic similar to qemu, using SSH readiness - boot-time crash capture using collected console output
* vm: use error wrapping to detect ssh connection errorsAleksandr Nogikh2025-10-012-5/+6
| | | | This is a much cleaner logic than string matching.
* pkg/osutil: make VerboseError nest other errorsAleksandr Nogikh2025-10-012-2/+5
| | | | | After this change it fits more naturally into the Go's error functionality.
* vm/qemu: don't auto retry ssh connection timeout errorsAleksandr Nogikh2025-10-011-0/+7
| | | | | | In almost all cases these mean some boot time crash. It also doesn't make much sense to continue string matching since the boot output may contain the matched strings in benign contexts.
* vm: add context to Pool.Create()Aleksandr Nogikh2025-10-0117-31/+34
| | | | | | | | | | Enable external abortion of the instance creation process. This is especially useful for the qemu case where we retry the creation/boot up to 1000 times, which can take significant time (e.g. it timeouts syz-cluster pods on unstable kernels). The context can be further propagated to WaitForSSH, but that requires another quite significant vm/ refactoring.
* vm/starnix: switch to new ffx command for vm ssh addressLaura Peskin2025-08-281-1/+6
| | | | | | | | Instead of: ffx --target <target> target get-ssh-address Use: ffx --target <target> target list --format addresses
* vm: extract all the crashes from the logTaras Madan2025-08-282-51/+219
|
* pkg/gce: set GVNIC feature for Compute imagesAleksandr Nogikh2025-08-081-1/+1
| | | | | | Google Cloud cannot automatically infer it from our images, so we need to explicitly set it. The flag is required to create a GVNIC-based GCE instance (the only type for C4A machines).
* vm: refactoringTaras Madan2025-08-072-82/+98
| | | | | 1. func Run optionally accepts the opts. 2. Some refactoring, more comments.
* vm/dispatcher: simplify runInstance()Aleksandr Nogikh2025-08-061-12/+16
| | | | Move boot error reporting to a separate function.
* vm/dispatcher: don't block on the boot error chan on exitAleksandr Nogikh2025-08-062-2/+48
| | | | | | | React on the context cancellation even if the boot error channel is blocked. Add a test that verifies this behavior. Print a log message if the channel is full.
* vm/starnix: get path for ffx log binaryLaura Peskin2025-07-221-24/+36
| | | | | ffx log is now built separately from the main ffx binary.
* vm/starnix: copy sdk overrides to isolated ffx configLaura Peskin2025-07-221-27/+74
| | | | | | | ffx emu now needs to know the locations of some host tools. Copy these paths from the default ffx config into the configuration for the isolated ffx instance that syzkaller uses for most tasks.
* all: manual linter fixesTaras Madan2025-07-171-1/+1
| | | | | | | | 1. recover the removed comment 2. unnecessary leading newline 3. unnecessary brackets 4. restore dropped "..." 5. use bytes.Equal instead of conversion to string
* all: apply linter auto fixesTaras Madan2025-07-172-3/+3
| | | | ./tools/syz-env bin/golangci-lint run ./... --fix
* all/mocks: regenerate with mockery v3Taras Madan2025-07-012-187/+283
|
* vm/qemu: use virtio-net-ccw as virtual netdev on s390x archAlexander Egorenkov2025-07-011-2/+2
| | | | | | | | | | | | | | | | virtio-net-ccw is a preferred way to set up a virtual network interface on s390x at the moment because it is faster than virtio-net-pci (eventfd and irqfd is missing). This also allows disabling of zPCI in QEMU which was required only because virtio-net-pci was used as a network interface. PCI is special on s390x and, for instance, does not use MMIO or expose topology [1,2,3]. Furthermore, any features like PXE are not supported with virtio-net-pci on s390x. [1] https://people.redhat.com/~cohuck/2018/02/19/notes-on-pci-on-s390x.html [2] https://wiki.qemu.org/Documentation/Platforms/S390X#A_note_on_PCI_support [3] https://www.qemu.org/docs/master/system/s390x/pcidevices.html Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com>
* vm/vmimpl: show BBLog entries for all locked tcpcbsMichael Tuexen2025-06-141-1/+1
|
* vm/vmimpl: show BBLog entries for all locked tcpcbsMichael Tuexen2025-06-141-1/+1
|
* vm/vmimpl: show all locked tcpcbsMichael Tuexen2025-05-281-0/+1
| | | | | | | Add a command to show all locked TCP control blocked. If a panic is related to the TCP stack, most likely the affected TCP control block is locked. Therefore, this is show. This is much less noisy than showing all TCP control blocks.
* vm/gvisor: allow to set a number of cpu-sAndrei Vagin2025-05-221-3/+13
| | | | Signed-off-by: Andrei Vagin <avagin@google.com>
* vm: func Run accepts contextTaras Madan2025-05-1915-87/+57
| | | | It allows to use context as a single termination signal source.
* Revert "vm/qemu: use -machine virt and -cpu max for arm32"Aleksandr Nogikh2025-05-061-2/+2
| | | | This reverts commit 85a5a23f228f2de970f578bf3b452a23a222c09d.
* vm/vmimpl: explicitly indicate empty boot outputAleksandr Nogikh2025-05-051-0/+5
| | | | | | | | It will help distinguish the cases when the output was collected, but lost somewhere during the reporting pipeline, or it was empty in the first place, e.g. because qemu could not start at all. Cc #5986.
* vm/qemu: use -machine virt and -cpu max for arm32Aleksandr Nogikh2025-04-291-2/+2
| | | | | | | The previously used combination does not boot our buildroot image: [ 6.334727][ T1] Run /sbin/init as init process [ 6.668200][ T1] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000004
* vm/dispatcher: make pool.Run cancellableAleksandr Nogikh2025-04-232-13/+85
| | | | | | | | | | Make the pool.Run() function take a context.Context to be able to abort the callback passed to it or abort its scheduling if it's not yet running. Otherwise, if the callback is not yet started and the pool's Loop is aborted, we risk waiting for pool.Run() forever. It prevents the normal shutdown of repro.Run() and, consequently, the DiffFuzzer functionality.
* vm/adb: pass device|console info to scriptJiao, Joey2025-04-081-1/+1
|
* vm/adb: run script allows executing complex scriptJiao, Joey2025-04-081-7/+1
|
* vm/adb: change printk level to allow findConsoleJiao, Joey2025-04-031-0/+8
|
* vm/qemu: fix wrong arg usageTaras Madan2025-03-281-1/+1
| | | | Closes #5870.
* all/mocks: updateTaras Madan2025-03-282-0/+441
|
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-18 22:13:05 +0000