syzkaller/sys/kvm.txt

# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <linux/kvm.h>
include <linux/kvm_host.h>

syz_open_dev$kvm(dev strconst["/dev/kvm"], id const[0], flags flags[open_flags]) fd[kvm]

ioctl$KVM_CREATE_VM(fd fd[kvm], cmd const[KVM_CREATE_VM], type const[0]) fd[kvmvm]
ioctl$KVM_GET_MSR_INDEX_LIST(fd fd[kvm], cmd const[KVM_GET_MSR_INDEX_LIST], arg ptr[in, kvm_msr_list])
ioctl$KVM_CHECK_EXTENSION(fd fd[kvm], cmd const[KVM_CHECK_EXTENSION], arg intptr)
ioctl$KVM_GET_VCPU_MMAP_SIZE(fd fd[kvm], cmd const[KVM_GET_VCPU_MMAP_SIZE])
ioctl$KVM_GET_SUPPORTED_CPUID(fd fd[kvm], cmd const[KVM_GET_SUPPORTED_CPUID], arg buffer[out])
ioctl$KVM_GET_EMULATED_CPUID(fd fd[kvmvm], cmd const[KVM_GET_EMULATED_CPUID], arg buffer[out])

ioctl$KVM_CREATE_VCPU(fd fd[kvmvm], cmd const[KVM_CREATE_VCPU], id intptr) fd[kvmcpu]
ioctl$KVM_CHECK_EXTENSION_VM(fd fd[kvmvm], cmd const[KVM_CHECK_EXTENSION], arg intptr)
ioctl$KVM_SET_MEMORY_REGION(fd fd[kvmvm], cmd const[KVM_SET_MEMORY_REGION], type ptr[in, kvm_memory_region])
ioctl$KVM_GET_DIRTY_LOG(fd fd[kvmvm], cmd const[KVM_GET_DIRTY_LOG], arg ptr[in, kvm_dirty_log])
ioctl$KVM_CREATE_IRQCHIP(fd fd[kvmvm], cmd const[KVM_CREATE_IRQCHIP])
ioctl$KVM_IRQ_LINE(fd fd[kvmvm], cmd const[KVM_IRQ_LINE], arg ptr[in, kvm_irq_level])
ioctl$KVM_GET_IRQCHIP(fd fd[kvmvm], cmd const[KVM_GET_IRQCHIP], arg buffer[out])
ioctl$KVM_SET_IRQCHIP(fd fd[kvmvm], cmd const[KVM_SET_IRQCHIP], arg buffer[in])
ioctl$KVM_XEN_HVM_CONFIG(fd fd[kvmvm], cmd const[KVM_XEN_HVM_CONFIG], arg ptr[in, kvm_xen_hvm_config])
ioctl$KVM_GET_CLOCK(fd fd[kvmvm], cmd const[KVM_GET_CLOCK], arg ptr[out, kvm_clock_data])
ioctl$KVM_SET_CLOCK(fd fd[kvmvm], cmd const[KVM_SET_CLOCK], arg ptr[in, kvm_clock_data])
ioctl$KVM_SET_USER_MEMORY_REGION(fd fd[kvmvm], cmd const[KVM_SET_USER_MEMORY_REGION], arg ptr[in, kvm_userspace_memory_region])
ioctl$KVM_SET_TSS_ADDR(fd fd[kvmvm], cmd const[KVM_SET_TSS_ADDR], arg ptr[in, int64])
ioctl$KVM_ENABLE_CAP(fd fd[kvmvm], cmd const[KVM_ENABLE_CAP], arg ptr[in, kvm_enable_cap])
ioctl$KVM_SET_IDENTITY_MAP_ADDR(fd fd[kvmvm], cmd const[KVM_SET_IDENTITY_MAP_ADDR], arg ptr[in, intptr])
ioctl$KVM_SET_BOOT_CPU_ID(fd fd[kvmvm], cmd const[KVM_SET_BOOT_CPU_ID], arg ptr[in, intptr])
ioctl$KVM_PPC_GET_PVINFO(fd fd[kvmvm], cmd const[KVM_PPC_GET_PVINFO], arg buffer[out])
ioctl$KVM_ASSIGN_PCI_DEVICE(fd fd[kvmvm], cmd const[KVM_ASSIGN_PCI_DEVICE], arg ptr[in, kvm_assigned_pci_dev])
ioctl$KVM_DEASSIGN_PCI_DEVICE(fd fd[kvmvm], cmd const[KVM_DEASSIGN_PCI_DEVICE], arg ptr[in, kvm_assigned_pci_dev])
ioctl$KVM_ASSIGN_DEV_IRQ(fd fd[kvmvm], cmd const[KVM_ASSIGN_DEV_IRQ], arg ptr[in, kvm_assigned_irq])
ioctl$KVM_DEASSIGN_DEV_IRQ(fd fd[kvmvm], cmd const[KVM_DEASSIGN_DEV_IRQ], arg ptr[in, kvm_assigned_irq])
ioctl$KVM_SET_GSI_ROUTING(fd fd[kvmvm], cmd const[KVM_SET_GSI_ROUTING], arg ptr[in, kvm_irq_routing])
ioctl$KVM_ASSIGN_SET_MSIX_NR(fd fd[kvmvm], cmd const[KVM_ASSIGN_SET_MSIX_NR], arg ptr[in, kvm_assigned_msix_nr])
ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(fd fd[kvmvm], cmd const[KVM_ASSIGN_SET_MSIX_ENTRY], arg ptr[in, kvm_assigned_msix_entry])
ioctl$KVM_IOEVENTFD(fd fd[kvmvm], cmd const[KVM_IOEVENTFD], arg ptr[in, kvm_ioeventfd])
ioctl$KVM_ASSIGN_SET_INTX_MASK(fd fd[kvmvm], cmd const[KVM_ASSIGN_SET_INTX_MASK], arg ptr[in, kvm_assigned_pci_dev])
ioctl$KVM_SIGNAL_MSI(fd fd[kvmvm], cmd const[KVM_SIGNAL_MSI], arg ptr[in, kvm_msi])
ioctl$KVM_CREATE_PIT2(fd fd[kvmvm], cmd const[KVM_CREATE_PIT2], arg ptr[in, kvm_pit_config])
ioctl$KVM_GET_PIT2(fd fd[kvmvm], cmd const[KVM_GET_PIT2], arg ptr[out, kvm_pit_state2])
ioctl$KVM_SET_PIT2(fd fd[kvmvm], cmd const[KVM_SET_PIT2], arg ptr[in, kvm_pit_state2])
ioctl$KVM_PPC_GET_SMMU_INFO(fd fd[kvmvm], cmd const[KVM_PPC_GET_SMMU_INFO], arg buffer[out])
ioctl$KVM_IRQFD(fd fd[kvmvm], cmd const[KVM_IRQFD], arg ptr[in, kvm_irqfd])
ioctl$KVM_PPC_ALLOCATE_HTAB(fd fd[kvmvm], cmd const[KVM_PPC_ALLOCATE_HTAB], arg ptr[in, int32])
ioctl$KVM_S390_INTERRUPT(fd fd[kvmvm], cmd const[KVM_S390_INTERRUPT], arg ptr[in, kvm_s390_interrupt])
ioctl$KVM_CREATE_DEVICE(fd fd[kvmvm], cmd const[KVM_CREATE_DEVICE], arg ptr[inout, kvm_create_device])
ioctl$KVM_SET_DEVICE_ATTR(fd fd[kvmvm], cmd const[KVM_SET_DEVICE_ATTR], arg ptr[in, kvm_device_attr])
ioctl$KVM_GET_DEVICE_ATTR(fd fd[kvmvm], cmd const[KVM_GET_DEVICE_ATTR], arg ptr[in, kvm_device_attr])
ioctl$KVM_HAS_DEVICE_ATTR(fd fd[kvmvm], cmd const[KVM_HAS_DEVICE_ATTR], arg ptr[in, kvm_device_attr])

ioctl$KVM_RUN(fd fd[kvmcpu], cmd const[KVM_RUN])
ioctl$KVM_GET_REGS(fd fd[kvmcpu], cmd const[KVM_GET_REGS], arg buffer[out])
ioctl$KVM_SET_REGS(fd fd[kvmcpu], cmd const[KVM_SET_REGS], arg buffer[in])
ioctl$KVM_GET_SREGS(fd fd[kvmcpu], cmd const[KVM_GET_SREGS], arg buffer[out])
ioctl$KVM_SET_SREGS(fd fd[kvmcpu], cmd const[KVM_SET_SREGS], arg buffer[in])
ioctl$KVM_TRANSLATE(fd fd[kvmcpu], cmd const[KVM_TRANSLATE], arg ptr[in, kvm_translation])
ioctl$KVM_INTERRUPT(fd fd[kvmcpu], cmd const[KVM_INTERRUPT], arg ptr[in, int32])
ioctl$KVM_GET_MSRS(fd fd[kvmcpu], cmd const[KVM_GET_MSRS], arg buffer[out])
ioctl$KVM_SET_MSRS(fd fd[kvmcpu], cmd const[KVM_SET_MSRS], arg buffer[in])
ioctl$KVM_SET_CPUID(fd fd[kvmcpu], cmd const[KVM_SET_CPUID], arg ptr[in, kvm_cpuid])
ioctl$KVM_SET_SIGNAL_MASK(fd fd[kvmcpu], cmd const[KVM_SET_SIGNAL_MASK], arg ptr[in, kvm_signal_mask])
ioctl$KVM_GET_FPU(fd fd[kvmcpu], cmd const[KVM_GET_FPU], arg buffer[out])
ioctl$KVM_SET_FPU(fd fd[kvmcpu], cmd const[KVM_SET_FPU], arg buffer[in])
ioctl$KVM_GET_VCPU_EVENTS(fd fd[kvmcpu], cmd const[KVM_GET_VCPU_EVENTS], arg ptr[out, kvm_vcpu_events])
ioctl$KVM_SET_VCPU_EVENTS(fd fd[kvmcpu], cmd const[KVM_SET_VCPU_EVENTS], arg ptr[in, kvm_vcpu_events])
ioctl$KVM_GET_DEBUGREGS(fd fd[kvmcpu], cmd const[KVM_GET_DEBUGREGS], arg buffer[out])
ioctl$KVM_SET_DEBUGREGS(fd fd[kvmcpu], cmd const[KVM_SET_DEBUGREGS], arg buffer[in])
ioctl$KVM_ENABLE_CAP_CPU(fd fd[kvmcpu], cmd const[KVM_ENABLE_CAP], arg ptr[in, kvm_enable_cap])
ioctl$KVM_GET_MP_STATE(fd fd[kvmcpu], cmd const[KVM_GET_MP_STATE], arg ptr[out, int32])
ioctl$KVM_SET_MP_STATE(fd fd[kvmcpu], cmd const[KVM_SET_MP_STATE], arg ptr[in, flags[kvm_mp_state, int32]])
ioctl$KVM_GET_XSAVE(fd fd[kvmcpu], cmd const[KVM_GET_XSAVE], arg ptr[out, kvm_xsave])
ioctl$KVM_SET_XSAVE(fd fd[kvmcpu], cmd const[KVM_SET_XSAVE], arg ptr[in, kvm_xsave])
ioctl$KVM_GET_XCRS(fd fd[kvmcpu], cmd const[KVM_GET_XCRS], arg ptr[in, kvm_xcrs])
ioctl$KVM_SET_XCRS(fd fd[kvmcpu], cmd const[KVM_SET_XCRS], arg ptr[in, kvm_xcrs])
ioctl$KVM_SET_TSC_KHZ(fd fd[kvmcpu], cmd const[KVM_SET_TSC_KHZ], arg intptr)
ioctl$KVM_GET_TSC_KHZ(fd fd[kvmcpu], cmd const[KVM_GET_TSC_KHZ])
ioctl$KVM_GET_LAPIC(fd fd[kvmcpu], cmd const[KVM_GET_LAPIC], arg ptr[in, kvm_lapic_state])
ioctl$KVM_SET_LAPIC(fd fd[kvmcpu], cmd const[KVM_SET_LAPIC], arg ptr[in, kvm_lapic_state])
ioctl$KVM_DIRTY_TLB(fd fd[kvmcpu], cmd const[KVM_DIRTY_TLB], arg ptr[in, kvm_dirty_tlb])
ioctl$KVM_NMI(fd fd[kvmcpu], cmd const[KVM_NMI])
ioctl$KVM_S390_UCAS_MAP(fd fd[kvmcpu], cmd const[KVM_S390_UCAS_MAP], arg ptr[in, kvm_s390_ucas_mapping])
ioctl$KVM_S390_UCAS_UNMAP(fd fd[kvmcpu], cmd const[KVM_S390_UCAS_UNMAP], arg ptr[in, kvm_s390_ucas_mapping])
ioctl$KVM_S390_VCPU_FAULT(fd fd[kvmcpu], cmd const[KVM_S390_VCPU_FAULT], arg ptr[in, int64])
ioctl$KVM_SET_ONE_REG(fd fd[kvmcpu], cmd const[KVM_SET_ONE_REG], arg ptr[in, kvm_one_reg])
ioctl$KVM_GET_ONE_REG(fd fd[kvmcpu], cmd const[KVM_GET_ONE_REG], arg ptr[in, kvm_one_reg])
ioctl$KVM_KVMCLOCK_CTRL(fd fd[kvmcpu], cmd const[KVM_KVMCLOCK_CTRL])
ioctl$KVM_S390_INTERRUPT_CPU(fd fd[kvmcpu], cmd const[KVM_S390_INTERRUPT], arg ptr[in, kvm_s390_interrupt])
ioctl$KVM_GET_REG_LIST(fd fd[kvmcpu], cmd const[KVM_GET_REG_LIST], arg ptr[in, kvm_reg_list])
ioctl$KVM_SET_GUEST_DEBUG(fd fd[kvmcpu], cmd const[KVM_SET_GUEST_DEBUG], arg ptr[in, kvm_guest_debug])
ioctl$KVM_SMI(fd fd[kvmcpu], cmd const[KVM_SMI])

# TODO: extend support (there are some ioctls)
open$xenevtchn(file strconst["/dev/xen/evtchn"], flags flags[open_flags], mode const[0]) fd

kvm_mem_region_flags = KVM_MEM_LOG_DIRTY_PAGES, KVM_MEM_READONLY, KVM_MEMSLOT_INVALID, KVM_MEMSLOT_INCOHERENT
kvm_mp_state = KVM_MP_STATE_RUNNABLE, KVM_MP_STATE_UNINITIALIZED, KVM_MP_STATE_INIT_RECEIVED, KVM_MP_STATE_HALTED, KVM_MP_STATE_SIPI_RECEIVED, KVM_MP_STATE_STOPPED, KVM_MP_STATE_CHECK_STOP, KVM_MP_STATE_OPERATING, KVM_MP_STATE_LOAD
kvm_assigned_irq_flags = KVM_DEV_IRQ_HOST_INTX, KVM_DEV_IRQ_HOST_MSI, KVM_DEV_IRQ_HOST_MSIX, KVM_DEV_IRQ_GUEST_INTX, KVM_DEV_IRQ_GUEST_MSI, KVM_DEV_IRQ_GUEST_MSIX
kvm_irq_routing_entry_type = KVM_IRQ_ROUTING_IRQCHIP, KVM_IRQ_ROUTING_MSI
kvm_ioeventfd_flags = KVM_IOEVENTFD_FLAG_DATAMATCH, KVM_IOEVENTFD_FLAG_PIO, KVM_IOEVENTFD_FLAG_DEASSIGN, KVM_IOEVENTFD_FLAG_VIRTIO_CCW_NOTIFY
kvm_ioeventfd_len = 1, 2, 4, 8
kvm_device_type = KVM_DEV_TYPE_FSL_MPIC_20, KVM_DEV_TYPE_FSL_MPIC_42, KVM_DEV_TYPE_XICS, KVM_DEV_TYPE_VFIO
kvm_guest_debug_flags = KVM_GUESTDBG_ENABLE, KVM_GUESTDBG_SINGLESTEP, KVM_GUESTDBG_USE_SW_BP, KVM_GUESTDBG_USE_HW_BP, KVM_GUESTDBG_INJECT_DB, KVM_GUESTDBG_INJECT_BP

kvm_guest_debug {
	ctrl	flags[kvm_guest_debug_flags, int32]
	pad	const[0, int32]
	reg	array[int64, 8]
}

kvm_arm_device_addr {
	id	int64
	addr	int64
}

kvm_reg_list {
	n	len[reg, int64]
	reg	array[int64]
}

kvm_device_attr {
	flags	const[0, int32]
	group	int32
	attr	int64
	addr	ptr[out, int64]
}

kvm_create_device {
	type	flags[kvm_device_type, int32]
	fd	fd
	flags	int32
}

kvm_s390_interrupt {
	type	int32
	parm	int32
	parm64	int64
}

kvm_irqfd {
	fd	fd[event]
	gsi	int32
	flags	int32
	rfd	fd[event]
	pad	array[const[0, int8], 16]
}

kvm_pit_state2 {
	chans	array[kvm_pit_channel_state, 3]
	flags	int32
	pad	array[const[0, int32], 9]
}

kvm_pit_channel_state {
	count	int32
	lcount	int16
	latched	int8
	lstatus	int8
	status	int8
	rstate	int8
	wstate	int8
	wlatch	int8
	rw	int8
	mode	int8
	bcd	int8
	gate	int8
	ltime	int64
}

kvm_pit_config {
	flags	int32
	pad	array[const[0, int32], 15]
}

kvm_msi {
	addrlo	int32
	addrhi	int32
	data	int32
	flags	int32
}

kvm_one_reg {
	id	int64
	addr	int64
}

kvm_s390_ucas_mapping {
	uaddr	int64
	vaddr	int64
	len	int64
}

kvm_dirty_tlb {
	bitmap	int64
	n	int32
}

kvm_ioeventfd {
	datam	int64
	addr	ptr[out, int64]
	len	flags[kvm_ioeventfd_len, int32]
	fd	fd[event]
	flags	flags[kvm_ioeventfd_flags, int32]
}

kvm_lapic_state {
	regs	array[int8, 1024]
}

kvm_assigned_msix_entry {
	devid	int32
	gsi	int32
	entry	int16
}

kvm_assigned_msix_nr {
	devid	int32
	entnr	int16
}

kvm_irq_routing {
	nr	len[entries, int32]
	flags	const[0, int32]
	entries	array[kvm_irq_routing_entry]
}

kvm_irq_routing_entry {
	gsi	int32
	type	flags[kvm_irq_routing_entry_type, int32]
	flags	const[0, int32]
	pad	const[0, int32]
	u	kvm_irq_routing_entry_u
}

kvm_irq_routing_entry_u [
	irqchip	kvm_irq_routing_irqchip
	msi	kvm_irq_routing_msi
	adapter	kvm_irq_routing_s390_adapter
]

kvm_irq_routing_irqchip {
	irqchip	int32
	pin	int32
}

kvm_irq_routing_msi {
	addrlo	int32
	addrhi	int32
	data	int32
}

kvm_irq_routing_s390_adapter {
	indaddr	int64
	saddr	int64
	indoff	int64
	soff	int32
	aid	int32
}

kvm_assigned_irq {
	devid	int32
	hirq	int32
	girq	int32
	flags	flags[kvm_assigned_irq_flags, int32]
}

kvm_assigned_pci_dev {
	devid	int32
	busnr	int32
	devfn	int32
	flags	int32
	segnr	int32
}

kvm_xcr {
	xcr	int32
	reserv	int32
	val	int64
}

kvm_xcrs {
	nr	len[xcrs, int32]
	flags	int32
	xcrs	array[kvm_xcr]
}

kvm_xsave {
	region	array[int8, 1024]
}

kvm_enable_cap {
	cap	int32
	flags	const[0, int32]
	args	array[int64, 4]
	pad	array[const[0, int8], 64]
}

kvm_userspace_memory_region {
	slot	int32
	flags	flags[kvm_mem_region_flags, int32]
	paddr	int64
	size	len[addr, int64]
	addr	vma
}

kvm_vcpu_events {
	exinjec	int8
	exnr	int8
	exhec	int8
	pad	const[0, int8]
	exec	int32

	ininjec	int8
	innr	int8
	insoft	int8
	inshad	int8

	nmiinj	int8
	nmipend	int8
	nmimask	int8
	pad	const[0, int8]

	sipi	int32
	flags	int32

	smismm	int8
	smipend	int8
	smiinsi	int8
	smilatc	int8
}

kvm_clock_data {
	clock	int64
	flags	int32
	pad	array[const[0, int32], 9]
}

kvm_xen_hvm_config {
	flags	int32
	msr	int32
	addr32	buffer[in]
	addr64	buffer[in]
	size32	len[addr32, int8]
	size64	len[addr64, int8]
	pad	array[const[0, int8], 30]
}

kvm_irq_level {
	irq	int32
	level	int32
}

kvm_signal_mask {
	len	len[sigset, int32]
	sigset	array[int8]
}

kvm_cpuid_entry {
	func	int32
	eax	int32
	ebx	int32
	ecx	int32
	edx	int32
	pad	const[0, int32]
}

kvm_cpuid {
	n	len[entries, int32]
	pad	const[0, int32]
	entries	array[kvm_cpuid_entry]
}

kvm_translation {
	laddr	int64
	paddr	int64
	valid	int8
	write	int8
	umode	int8
}

kvm_dirty_log {
	slot	int32
	pad	const[0, int32]
	bitmap	vma
}

kvm_memory_region {
	slot	int32
	flags	flags[kvm_mem_region_flags, int32]
	pa	int64
	size	int64
}

kvm_msr_list {
	n	len[indices, int32]
	indices	array[int32]
}