aboutsummaryrefslogtreecommitdiffstats
path: root/vm
Commit message (Collapse)AuthorAgeFilesLines
* vm/adb: don't check for ret code on adb shell rebootSebastian Ene2026-01-201-1/+10
| | | | | | | | | Prevent the fuzzer from entering in an infinte loop of device reboots when the adb shell reboot command returns with an error code. Fixes: #6598 Signed-off-by: Sebastian Ene <sebastianene@google.com>
* vm/adb: use the correct path for debugfsSebastian Ene2026-01-191-1/+1
| | | | | | | | | | Probe for the debugfs rootdir instead of the kcov sub-path to prevent the fuzzer from entering in device reboot loop in case the android device doesn't support kcov. Fixes: #6600 Signed-off-by: Sebastian Ene <sebastianene@google.com>
* pkg/gce: vm/gce: allow specifying instance tags in manager configAlexander Potapenko2026-01-151-2/+3
| | | | | | | | | | | | GCE instance tags can be used for various purposes, such as applying network firewall rules or filtering VMs for scheduling onto specific hosts. To support these use cases, syzkaller needs the ability to set instance tags during VM creation. This patch introduces a new tags field to the gce VM configuration that allows users to specify a list of tags to be attached to GCE instances created by syz-manager.
* vm/starnix: update syntax for ffx target listLaura Peskin2026-01-071-2/+1
|
* all: remove unused nolint directivesDmitry Vyukov2026-01-023-13/+2
|
* all: use any instead of interface{}Dmitry Vyukov2025-12-222-8/+8
| | | | Any is the preferred over interface{} now in Go.
* vm/qemu: additional check for crashes only in DiagnoseBabak Huseynov2025-11-211-2/+33
|
* vm: implement the VM interface for VirtualBoxKuzey Arda Bulut2025-11-142-0/+320
| | | | | | | | | | This change adds VirtualBox support to syzkaller. It implements the VM interface for VirtualBox and provides: - full VM lifecycle operations (create, boot, stop, snapshot restore) - serial console hookup and integration with the output merger - proper boot wait logic similar to qemu, using SSH readiness - boot-time crash capture using collected console output
* vm: use error wrapping to detect ssh connection errorsAleksandr Nogikh2025-10-012-5/+6
| | | | This is a much cleaner logic than string matching.
* pkg/osutil: make VerboseError nest other errorsAleksandr Nogikh2025-10-012-2/+5
| | | | | After this change it fits more naturally into the Go's error functionality.
* vm/qemu: don't auto retry ssh connection timeout errorsAleksandr Nogikh2025-10-011-0/+7
| | | | | | In almost all cases these mean some boot time crash. It also doesn't make much sense to continue string matching since the boot output may contain the matched strings in benign contexts.
* vm: add context to Pool.Create()Aleksandr Nogikh2025-10-0117-31/+34
| | | | | | | | | | Enable external abortion of the instance creation process. This is especially useful for the qemu case where we retry the creation/boot up to 1000 times, which can take significant time (e.g. it timeouts syz-cluster pods on unstable kernels). The context can be further propagated to WaitForSSH, but that requires another quite significant vm/ refactoring.
* vm/starnix: switch to new ffx command for vm ssh addressLaura Peskin2025-08-281-1/+6
| | | | | | | | Instead of: ffx --target <target> target get-ssh-address Use: ffx --target <target> target list --format addresses
* vm: extract all the crashes from the logTaras Madan2025-08-282-51/+219
|
* pkg/gce: set GVNIC feature for Compute imagesAleksandr Nogikh2025-08-081-1/+1
| | | | | | Google Cloud cannot automatically infer it from our images, so we need to explicitly set it. The flag is required to create a GVNIC-based GCE instance (the only type for C4A machines).
* vm: refactoringTaras Madan2025-08-072-82/+98
| | | | | 1. func Run optionally accepts the opts. 2. Some refactoring, more comments.
* vm/dispatcher: simplify runInstance()Aleksandr Nogikh2025-08-061-12/+16
| | | | Move boot error reporting to a separate function.
* vm/dispatcher: don't block on the boot error chan on exitAleksandr Nogikh2025-08-062-2/+48
| | | | | | | React on the context cancellation even if the boot error channel is blocked. Add a test that verifies this behavior. Print a log message if the channel is full.
* vm/starnix: get path for ffx log binaryLaura Peskin2025-07-221-24/+36
| | | | | ffx log is now built separately from the main ffx binary.
* vm/starnix: copy sdk overrides to isolated ffx configLaura Peskin2025-07-221-27/+74
| | | | | | | ffx emu now needs to know the locations of some host tools. Copy these paths from the default ffx config into the configuration for the isolated ffx instance that syzkaller uses for most tasks.
* all: manual linter fixesTaras Madan2025-07-171-1/+1
| | | | | | | | 1. recover the removed comment 2. unnecessary leading newline 3. unnecessary brackets 4. restore dropped "..." 5. use bytes.Equal instead of conversion to string
* all: apply linter auto fixesTaras Madan2025-07-172-3/+3
| | | | ./tools/syz-env bin/golangci-lint run ./... --fix
* all/mocks: regenerate with mockery v3Taras Madan2025-07-012-187/+283
|
* vm/qemu: use virtio-net-ccw as virtual netdev on s390x archAlexander Egorenkov2025-07-011-2/+2
| | | | | | | | | | | | | | | | virtio-net-ccw is a preferred way to set up a virtual network interface on s390x at the moment because it is faster than virtio-net-pci (eventfd and irqfd is missing). This also allows disabling of zPCI in QEMU which was required only because virtio-net-pci was used as a network interface. PCI is special on s390x and, for instance, does not use MMIO or expose topology [1,2,3]. Furthermore, any features like PXE are not supported with virtio-net-pci on s390x. [1] https://people.redhat.com/~cohuck/2018/02/19/notes-on-pci-on-s390x.html [2] https://wiki.qemu.org/Documentation/Platforms/S390X#A_note_on_PCI_support [3] https://www.qemu.org/docs/master/system/s390x/pcidevices.html Signed-off-by: Alexander Egorenkov <eaibmz@gmail.com>
* vm/vmimpl: show BBLog entries for all locked tcpcbsMichael Tuexen2025-06-141-1/+1
|
* vm/vmimpl: show BBLog entries for all locked tcpcbsMichael Tuexen2025-06-141-1/+1
|
* vm/vmimpl: show all locked tcpcbsMichael Tuexen2025-05-281-0/+1
| | | | | | | Add a command to show all locked TCP control blocked. If a panic is related to the TCP stack, most likely the affected TCP control block is locked. Therefore, this is show. This is much less noisy than showing all TCP control blocks.
* vm/gvisor: allow to set a number of cpu-sAndrei Vagin2025-05-221-3/+13
| | | | Signed-off-by: Andrei Vagin <avagin@google.com>
* vm: func Run accepts contextTaras Madan2025-05-1915-87/+57
| | | | It allows to use context as a single termination signal source.
* Revert "vm/qemu: use -machine virt and -cpu max for arm32"Aleksandr Nogikh2025-05-061-2/+2
| | | | This reverts commit 85a5a23f228f2de970f578bf3b452a23a222c09d.
* vm/vmimpl: explicitly indicate empty boot outputAleksandr Nogikh2025-05-051-0/+5
| | | | | | | | It will help distinguish the cases when the output was collected, but lost somewhere during the reporting pipeline, or it was empty in the first place, e.g. because qemu could not start at all. Cc #5986.
* vm/qemu: use -machine virt and -cpu max for arm32Aleksandr Nogikh2025-04-291-2/+2
| | | | | | | The previously used combination does not boot our buildroot image: [ 6.334727][ T1] Run /sbin/init as init process [ 6.668200][ T1] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000004
* vm/dispatcher: make pool.Run cancellableAleksandr Nogikh2025-04-232-13/+85
| | | | | | | | | | Make the pool.Run() function take a context.Context to be able to abort the callback passed to it or abort its scheduling if it's not yet running. Otherwise, if the callback is not yet started and the pool's Loop is aborted, we risk waiting for pool.Run() forever. It prevents the normal shutdown of repro.Run() and, consequently, the DiffFuzzer functionality.
* vm/adb: pass device|console info to scriptJiao, Joey2025-04-081-1/+1
|
* vm/adb: run script allows executing complex scriptJiao, Joey2025-04-081-7/+1
|
* vm/adb: change printk level to allow findConsoleJiao, Joey2025-04-031-0/+8
|
* vm/qemu: fix wrong arg usageTaras Madan2025-03-281-1/+1
| | | | Closes #5870.
* all/mocks: updateTaras Madan2025-03-282-0/+441
|
* all: use mockery config instead of go:generateTaras Madan2025-03-281-3/+0
|
* vm: use SSHOptions instead of 4 paramsTaras Madan2025-03-276-125/+132
| | | | It reduces WaitForSSH parameter count from 9 to 6.
* pkg/gcs: define Client interfaceTaras Madan2025-03-251-1/+1
| | | | | | Some functions are not the struct members now. Some functions deleted. Client mock generated.
* all: remove loop variables scopingTaras Madan2025-02-172-2/+0
|
* vm/qemu: run riscv64 kernel using 4-level page tableAlexandre Ghiti2025-02-131-1/+1
| | | | | Riscv is far from having a hw with a 5-level support, so let's focus on the 4-level.
* vm/qemu: retry on Address already in use errorsAleksandr Nogikh2025-02-131-0/+3
| | | | | | The chance of port collision is very low, but still not 0. There's no reason to report an error on the first ocurrence of the problem, let it first retry 100 times.
* vm: support console_cmd to run cmd to collect console logJoey Jiao2025-02-102-49/+52
| | | | | | | | - Sometimes we need customized cmd to get serial log, ex FTDI4232H chip gets serial log through usb directly, thus we need to call cmd like `pyterm.py ftdi://ftdi:4232:FT7JLD0U/1`. - There are seveval places in console implementation to call osutil.Command, move the command code into one function.
* go.mod: update mockeryTaras Madan2025-02-072-7/+7
|
* all: use min/max functionsDmitry Vyukov2025-01-172-15/+4
| | | | They are shorter, more readable, and don't require temp vars.
* vm: fix deadlock in UnusedTCPPortIvan Gulakov2025-01-131-0/+15
| | | | | | | | | | | | If localhost is not configured on a system, UnusedTCPPort will loop forever without producing any errors. By checking EADDRINUSE and ENOACC and then skipping only in these cases, we'd avoid at least the mentioned deadlock. On top of this, this change should catch other errors without locking, like other DNS errors and so on. Signed-off-by: Ivan Gulakov <gulakov@amazon.de>
* vm: use -cpu cortex-a15 for qemu/arm32Aleksandr Nogikh2024-12-031-2/+3
| | | | | | | | | The new qemu versions began to fail with the settings we previously used. It's probably not worth extensive debugging, so let's just do what qemu suggests. qemu-system-arm: Invalid CPU model: max The only valid type is: cortex-a15
* pkg/report: detect the lost connection crash typeAleksandr Nogikh2024-12-032-0/+14
|
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-11 15:56:28 +0000