From 3b7a3359989abfb9ee0c821fdc0a8be33f7e996d Mon Sep 17 00:00:00 2001
From: Alexander Potapenko <glider@google.com>
Date: Wed, 14 Jan 2026 12:01:10 +0100
Subject: executor: sys/linux: SYZOS: add support for AMD Nested Event
 Injection

Implement SYZOS_API_NESTED_AMD_INJECT_EVENT to allow the L1 guest to
inject events (Interrupts, NMIs, Exceptions) into L2 via the VMCB EVENTINJ
field.

This primitive abstracts the VMCB bit-packing logic
(Vector, Type, Valid, Error Code) into a high-level API, enabling the fuzzer
to semantically mutate event injection parameters.

This targets KVM's nested event merging logic, specifically where L0 must
reconcile L1-injected events with Host-pending events.
---
 sys/linux/test/amd64-syz_kvm_nested_amd_inject | 37 ++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 sys/linux/test/amd64-syz_kvm_nested_amd_inject

(limited to 'sys/linux/test')

diff --git a/sys/linux/test/amd64-syz_kvm_nested_amd_inject b/sys/linux/test/amd64-syz_kvm_nested_amd_inject
new file mode 100644
index 000000000..f41b89489
--- /dev/null
+++ b/sys/linux/test/amd64-syz_kvm_nested_amd_inject
@@ -0,0 +1,37 @@
+#
+# requires: arch=amd64 -threaded
+#
+r0 = openat$kvm(0, &AUTO='/dev/kvm\x00', 0x0, 0x0)
+r1 = ioctl$KVM_CREATE_VM(r0, AUTO, 0x0)
+r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
+
+# Test AMD Nested Event Injection.
+#
+# 1. Setup nested environment (L1) and Create VM (L2).
+# 2. Inject an NMI (Vector 2, Type 2, Valid) into L2 via VMCB EVENTINJ.
+# 3. Launch L2.
+#    - This forces KVM L0 to parse EVENTINJ and handle the injection.
+#    - We expect L0 to succeed without crashing.
+#
+# Arguments for INJECT_EVENT:
+# vm_id=0
+# vector=2 (NMI)
+# type=2 (NMI)
+# error_code=0
+# flags=1 (Valid=1, EV=0)
+#
+r3 = syz_kvm_add_vcpu$x86(r2, &AUTO={0x0, &AUTO=[@enable_nested={AUTO, AUTO, 0x0}, @nested_create_vm={AUTO, AUTO, 0x0}, @nested_amd_inject_event={AUTO, AUTO, {0x0, 0x2, 0x2, 0x0, 0x1}}, @nested_vmlaunch={AUTO, AUTO, 0x0}, @uexit={AUTO, AUTO, 0xface}], AUTO})
+r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, AUTO)
+r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x1, r3, 0x0)
+
+# Run the VCPU.
+# The guest executes the injection and launch.
+# If KVM L0 processes the EVENTINJ correctly, the guest should eventually exit back to us.
+#
+ioctl$KVM_RUN(r3, AUTO, 0x0)
+syz_kvm_assert_syzos_uexit$x86(r5, 0xface)
+
+# Cleanup
+#
+ioctl$KVM_RUN(r3, AUTO, 0x0)
+syz_kvm_assert_syzos_uexit$x86(r5, 0xffffffff)
-- 
cgit mrf-deployment