### Ktest Installation Instructions

Source: https://github.com/google/syzkaller/blob/master/docs/reproducing_crashes.md

Steps to clone, install, and set up the ktest framework. Ensure KTEST_PATH is exported and install the cargo package.

```bash
$ git clone git://evilpiepirate.org/ktest.git
$ cd ktest
$ export KTEST_PATH=$(pwd)
$ sudo ./root_image init
$ sudo ./root_image create
$ cargo install --path $KTEST_PATH
```

--------------------------------

### Boot macOS VM with QEMU on Darwin

Source: https://github.com/google/syzkaller/blob/master/docs/darwin/README.md

Use this command to start a macOS virtual machine with QEMU. Ensure you replace placeholders like `<YOUR_APPLE_SMC_HERE>` and the disk image path with your specific details. This setup includes essential devices for a functional VM.

```bash
qemu-system-x86_64 \
  -device isa-applesmc,osk="<YOUR_APPLE_SMC_HERE>" \
  -accel hvf -machine q35 -smp "2",cores="2",sockets="1" -m "4096" \
  -cpu Penryn,vendor=GenuineIntel,+invtsc,vmware-cpuid-freq=on,\"pcid,+ssse3,+sse4.2,+popcnt,+avx,+aes,+xsave,+xsaveopt,check\" \
  -drive if=pflash,format=raw,readonly=on,file="/usr/local/share/OVMF/OVMF_CODE.fd" \
  -drive if=pflash,format=raw,readonly=on,file="/usr/local/share/OVMF/OVMF_VARS.fd" \
  -device ich9-intel-hda -device hda-duplex -device ich9-ahci,id=sata \
  -device ide-hd,bus=sata.4,drive=MacHDD \
  -drive id=MacHDD,if=none,file="/Users/user/115/macos_11.5.qcow",format=qcow2 \
  -netdev user,id=net0,hostfwd=tcp::1042-:22, -device e1000-82545em,netdev=net0,id=net0 \
  -device usb-ehci,id=ehci -usb -device usb-kbd -device usb-tablet \
  -monitor stdio -vga vmware
```

--------------------------------

### Install VM Operating System

Source: https://github.com/google/syzkaller/blob/master/docs/openbsd/setup.md

Starts a new VM using vmctl, prompting for root password and SSH login configuration.

```sh
$ vmctl start -c -t syzkaller -b /bsd.rd -d "$VMIMG" syzkaller-1
```

--------------------------------

### Install QEMU Emulators for Multi-arch Docker Build

Source: https://github.com/google/syzkaller/blob/master/tools/docker/README.md

Installs QEMU emulators required for building multi-architecture Docker images. This is a one-time setup step.

```bash
# Install QEMU emulators for multi-arch support
docker run --privileged --rm tonistiigi/binfmt --install all
```

--------------------------------

### Run NetBSD VM with QEMU

Source: https://github.com/google/syzkaller/blob/master/docs/netbsd/README.md

Command to start a NetBSD virtual machine using QEMU. This setup includes network forwarding for SSH access.

```sh
qemu-system-x86_64 -m 1024 -smp 2 -nographic -enable-kvm \
	-netdev user,id=mynet0,hostfwd=tcp:127.0.0.1:10022-:22 \
	-device e1000,netdev=mynet0 -hda netbsd-image.raw
```

--------------------------------

### Syzkaller Configuration Example

Source: https://github.com/google/syzkaller/blob/master/docs/linux/setup_linux-host_isolated.md

A sample syzkaller configuration file for an isolated setup. Remember to update paths and target details.

```json
{
	"target": "linux/amd64",
	"http": "127.0.0.1:56741",
	"rpc": "127.0.0.1:0",
	"sshkey" : "/path/to/optional/sshkey",
	"workdir": "/syzkaller/workdir",
	"kernel_obj": "/linux-next",
	"syzkaller": "/go/src/github.com/google/syzkaller",
	"sandbox": "setuid",
	"type": "isolated",
	"vm": {
		"targets" : [ "10.0.0.1" ],
		"pstore": false,
		"target_dir" : "/home/user/tmp/syzkaller",
                "target_reboot" : false
	}
}
```

--------------------------------

### Syz-manager Output Example

Source: https://github.com/google/syzkaller/blob/master/docs/freebsd/README.md

Example output from syz-manager indicating successful startup and initial fuzzing progress.

```text
booting test machines...
wait for the connection from test machine...
machine check: 253 calls enabled, kcov=true, kleakcheck=false, faultinjection=false, comps=false
executed 3622, cover 1219, crashes 0, repro 0
executed 7921, cover 1239, crashes 0, repro 0
executed 32807, cover 1244, crashes 0, repro 0
executed 35803, cover 1248, crashes 0, repro 0
```

--------------------------------

### Install QEMU

Source: https://github.com/google/syzkaller/blob/master/docs/linux/setup_ubuntu-host_qemu-vm_x86-64-kernel.md

Installs the QEMU system emulator for x86-64 architecture, which is necessary for running the virtual machine.

```bash
sudo apt install qemu-system-x86
```

--------------------------------

### Install Prerequisites

Source: https://github.com/google/syzkaller/blob/master/docs/linux/setup_ubuntu-host_qemu-vm_x86-64-kernel.md

Installs necessary packages for building and fuzzing the kernel on an Ubuntu host.

```bash
sudo apt update
sudo apt install make gcc flex bison libncurses-dev libelf-dev libssl-dev
```

--------------------------------

### Install Prerequisites

Source: https://github.com/google/syzkaller/blob/master/docs/linux/setup_linux-host_android-virtual-device_x86-64-kernel.md

Installs necessary packages for building and running the Android environment on a Linux host.

```bash
apt update
apt install sudo git wget curl repo libncurses5 vim gcc make bison bc zip rsync language-pack-en-base
```

--------------------------------

### Start Syz-manager

Source: https://github.com/google/syzkaller/blob/master/docs/freebsd/README.md

Command to start the syz-manager process with the specified configuration file.

```console
$ bin/syz-manager -config freebsd.cfg
```

--------------------------------

### syz-crush configuration example

Source: https://github.com/google/syzkaller/blob/master/docs/syzbot_assets.md

Example configuration file for the syz-crush tool. Ensure 'syzkaller' and 'image' paths are updated to your specific locations.

```json
{
    "name": "test",
    "http": "0.0.0.0:0",
    "target": "linux/amd64",
    "image": "/tmp/disk-40f71e7c.raw",
    "syzkaller": "/tmp/syzkaller",
    "workdir": "/tmp/syzkaller/workdir",
    "type": "qemu",
    "procs": 6,
    "vm": {
      "count": 5,
      "cmdline": "root=/dev/sda1",
      "cpu": 2,
      "mem": 2048,
      "qemu_args": "-machine pc-q35-7.1 -enable-kvm"
    }
}
```

--------------------------------

### Start Local Spanner Emulator and Create Database

Source: https://github.com/google/syzkaller/blob/master/dashboard/app/README.md

Start the local Spanner emulator and create a new instance and database. This is a prerequisite for local dashboard deployment.

```bash
gcloud emulators spanner start
gcloud spanner instances create syzbot --config=emulator --nodes=1
gcloud spanner databases create ai --instance=syzbot
```

--------------------------------

### Start QEMU VM

Source: https://github.com/google/syzkaller/blob/master/docs/linux/troubleshooting.md

Use this command to verify that QEMU can successfully boot the virtual machine with the specified image and kernel.

```shell
qemu-system-x86_64 -hda $IMAGE -m 256 -net nic -net user,host=10.0.2.10,hostfwd=tcp::23505-:22 -enable-kvm -kernel $KERNEL -append root=/dev/sda
```

--------------------------------

### Run VM for C Reproducer

Source: https://github.com/google/syzkaller/blob/master/docs/reproducing_crashes.md

QEMU command to start a virtual machine with specified memory, CPU, and network settings, using a Buildroot-based disk image.

```bash
$ export DISK_IMAGE='buildroot_amd64_2024.09'
$ qemu-system-x86_64 -m 2G -smp 2,sockets=2,cores=1 -drive file=$DISK_IMAGE,format=raw -net nic,model=e1000 -net user,host=10.0.2.10,hostfwd=tcp::10022-:22 -enable-kvm -nographic -snapshot -machine pc-q35-7.1
```

--------------------------------

### io_setup$auto

Source: https://github.com/google/syzkaller/blob/master/sys/linux/auto.txt

Sets up an io_uring context.

```APIDOC
## io_setup$auto

### Description
Initializes and sets up an io_uring context for asynchronous I/O operations.

### Parameters
- **nr_events** (int32) - The number of events the ring should support.
- **ctxp** (ptr[inout, intptr]) - Pointer to store the created io_uring context ID.
```

--------------------------------

### Download and Boot VM with Disk Image

Source: https://github.com/google/syzkaller/blob/master/docs/syzbot_assets.md

Download the disk image, decompress it, and boot a virtual machine using QEMU. Ensure you have QEMU installed and configured.

```bash
$ wget 'https://storage.googleapis.com/syzbot-assets/073eea957569/disk-40f71e7c.raw.xz'
$ unxz disk-40f71e7c.raw.xz
$ qemu-system-x86_64 -m 2G -smp 2,sockets=2,cores=1 -drive file=./disk-40f71e7c.raw,format=raw -net nic,model=e1000 -net user,host=10.0.2.10,hostfwd=tcp::10022-:22 -enable-kvm -nographic -snapshot -machine pc-q35-7.1
```

--------------------------------

### Syzkaller Commit Message Format

Source: https://github.com/google/syzkaller/blob/master/GEMINI.md

Example of the required commit message format for Syzkaller. It follows a 'dir/path: description' structure with a lowercase starting letter for the description and no trailing dot.

```text
pkg/fuzzer: fix crash in minimization
```

--------------------------------

### io_setup

Source: https://github.com/google/syzkaller/blob/master/sys/linux/aio.txt

Initializes a context for asynchronous I/O operations. It allocates resources for a specified number of I/O contexts.

```APIDOC
## io_setup

### Description
Initializes a context for asynchronous I/O operations. It allocates resources for a specified number of I/O contexts.

### Method
`io_setup`

### Parameters
#### Path Parameters
- None

#### Query Parameters
- None

#### Request Body
- **n** (int32) - Required - The number of I/O contexts to set up.
- **ctx** (ptr[out, io_ctx]) - Required - A pointer to an io_ctx structure to be filled with the context information.
```

--------------------------------

### Start QEMU VM

Source: https://github.com/google/syzkaller/blob/master/docs/freebsd/README.md

Launches a QEMU virtual machine using the specified disk image, with network forwarding for SSH access.

```bash
$ qemu-system-x86_64 -hda $IMAGEFILE -nographic -net user,host=10.0.2.10,hostfwd=tcp::10022-:22 -net nic,model=e1000
```

--------------------------------

### kvm_sev_launch_start

Source: https://github.com/google/syzkaller/blob/master/sys/linux/dev_kvm_amd64.txt

Starts the SEV guest launch process.

```APIDOC
## kvm_sev_launch_start

### Description
Starts the SEV guest launch process. This structure is used to initiate the secure launch of a guest VM with SEV enabled.

### Parameters
- **handle** (sev_handle) - SEV handle for the guest (inout).
- **policy** (int32) - Launch policy for the guest.
- **dh_addr** (vma64[1:4]) - Address of the Diffie-Hellman public key data.
- **dh_len** (len[dh_addr, int32]) - Length of the Diffie-Hellman public key data.
- **pad0** (const[0, int32]) - Padding.
- **session_uaddr** (vma64[1:4]) - User-space address for the session data.
- **session_len** (len[session_uaddr, int32]) - Length of the session data.
- **pad1** (const[0, int32]) - Padding.
```

--------------------------------

### Install pycparser

Source: https://github.com/google/syzkaller/blob/master/docs/headerparser_usage.md

Install the pycparser dependency using pip.

```shell
pip install pycparser
```

--------------------------------

### iommu_vfio_ioas$GET

Source: https://github.com/google/syzkaller/blob/master/sys/linux/dev_iommu.txt

Gets an IOMMU VFIO IOAS handle.

```APIDOC
## iommu_vfio_ioas$GET

### Description
Gets an IOMMU VFIO IOAS handle.

### Parameters
#### Path Parameters
- None

#### Query Parameters
- None

#### Request Body
- **size** (int32) - Required - Length of the parent structure.
- **ioas_id** (ioas_handle) - Output - Handle for the I/O address space.
- **opt** (const[IOMMU_VFIO_IOAS_GET, int16]) - Required - The option for getting the IOAS handle.
- **__reserved** (const[0x0, int16]) - Reserved, must be 0.
```

--------------------------------

### Start Timer

Source: https://github.com/google/syzkaller/blob/master/sys/fuchsia/fuchsia_cobalt.syz.txt

Starts a timer for a specific metric and event.

```APIDOC
## Start Timer

### Description
Starts a timer for a specific metric and event. This is used in conjunction with `End Timer` to measure durations.

### Method
zx_channel_call

### Endpoint
fuchsia_cobalt_LoggerSimpleStartTimer

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **hdr** (fidl_message_header) - Required - Message header.
- **metric_id** (int32) - Required - The ID of the metric.
- **event_code** (int32) - Required - The code for the event.
- **componentInLine** (fidl_string) - Optional - Inline component information.
- **timer_idInLine** (fidl_string) - Required - The inline ID of the timer.
- **timestamp** (int64) - Required - The starting timestamp.
- **timeout_s** (int32) - Optional - Timeout in seconds.
- **componentOutOfLine** (fidl_aligned[stringnoz]) - Optional - Out-of-line component information.
- **timer_idOutOfLine** (fidl_aligned[stringnoz]) - Optional - Out-of-line timer ID.

### Request Example
```json
{
  "hdr": {"ordinal": 54321, "flags": 0},
  "metric_id": 6,
  "event_code": 60,
  "componentInLine": "task_manager",
  "timer_idInLine": "task_1",
  "timestamp": 1678886400,
  "timeout_s": 30
}
```

### Response
#### Success Response (0)
- **void** (void) - Indicates success.

#### Response Example
```json
{
  "void": null
}
```
```

--------------------------------

### io_uring_setup

Source: https://github.com/google/syzkaller/blob/master/sys/linux/io_uring.txt

Initializes an io_uring instance with a specified number of entries.

```APIDOC
## io_uring_setup

### Description
This system call initializes an io_uring instance. It allocates resources for the submission queue (SQ) and completion queue (CQ) and returns a file descriptor representing the io_uring instance.

### Parameters
- **entries** (int32[1:IORING_MAX_ENTRIES]) - The number of entries to allocate for the ring. This determines the capacity of both the SQ and CQ.
- **params** (ptr[inout, io_uring_params]) - A pointer to an `io_uring_params` structure. This structure can be used to pass configuration options and receive information about the created ring.

### Returns
- **fd_io_uring** - A file descriptor for the newly created io_uring instance. This file descriptor is used in subsequent operations.
```

--------------------------------

### Start Timer

Source: https://github.com/google/syzkaller/blob/master/sys/fuchsia/fuchsia_cobalt.syz.txt

Starts a timer for measuring the duration of an operation.

```APIDOC
## StartTimer

### Description
Starts a timer for measuring the duration of an operation.

### Method
`zx_channel_call`

### Endpoint
`fuchsia_cobalt_LoggerBaseStartTimer`

### Parameters
#### Request Body
- **metric_id** (int32) - Description not available
- **event_code** (int32) - Description not available
- **componentInLine** (fidl_string) - Description not available
- **timer_idInLine** (fidl_string) - Description not available
- **timestamp** (int64) - Description not available
- **timeout_s** (int32) - Description not available
- **componentOutOfLine** (fidl_aligned[stringnoz]) - Description not available
- **timer_idOutOfLine** (fidl_aligned[stringnoz]) - Description not available

### Request Example
```json
{
  "metric_id": 123,
  "event_code": 456,
  "componentInLine": "my_component",
  "timer_idInLine": "operation_timer",
  "timestamp": 1678886400000,
  "timeout_s": 60,
  "componentOutOfLine": "another_component",
  "timer_idOutOfLine": "long_running_task"
}
```

### Response
#### Success Response (200)
- Description not available
```

--------------------------------

### io_uring_setup

Source: https://github.com/google/syzkaller/blob/master/sys/linux/auto.txt

Initializes an io_uring instance with a specified number of entries and parameters.

```APIDOC
## io_uring_setup$auto

Initializes an io_uring instance.

### Parameters

- **entries** (int32) - The number of entries in the ring.
- **params** (ptr[inout, io_uring_params$auto]) - Pointer to io_uring parameters.

### Returns

- **fd** (fd) - A file descriptor for the initialized io_uring instance.
```

--------------------------------

### Start Timer

Source: https://github.com/google/syzkaller/blob/master/sys/fuchsia/fuchsia_cobalt.syz.txt

Starts a timer for a specific event associated with a metric.

```APIDOC
## zx_channel_call$fuchsia_cobalt_LoggerStartTimer

### Description
Starts a timer for a specific event associated with a metric. This function is part of the Fuchsia Cobalt logging interface.

### Method
`zx_channel_call`

### Endpoint
`fuchsia_cobalt_LoggerStartTimer`

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **args** (fidl_call_args[fuchsia_cobalt_LoggerStartTimerRequest, fuchsia_cobalt_LoggerStartTimerRequestHandles, array[int8, ZX_CHANNEL_MAX_MSG_BYTES], fuchsia_cobalt_LoggerStartTimerResponseHandles]) - Required - Arguments for the start timer call.

### Request Example
```json
{
  "example": "request body for StartTimer"
}
```

### Response
#### Success Response (200)
None explicitly defined in this signature, but `actual_bytes` and `actual_handles` indicate call outcome.

#### Response Example
```json
{
  "actual_bytes": "int32",
  "actual_handles": "int32"
}
```
```

--------------------------------

### Start Timer

Source: https://github.com/google/syzkaller/blob/master/sys/fuchsia/fuchsia_cobalt.syz.txt

Starts a timer for an event, used for measuring durations.

```APIDOC
## StartTimer

### Description
Starts a timer for a specific event, recording its start time and a timeout.

### Method
`zx_channel_call`

### Endpoint
`fuchsia_cobalt_LoggerStartTimer`

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **metric_id** (int32) - Description not provided.
- **event_code** (int32) - Description not provided.
- **componentInLine** (fidl_string) - Description not provided.
- **timer_idInLine** (fidl_string) - Description not provided.
- **timestamp** (int64) - The start timestamp of the timer.
- **timeout_s** (int32) - The timeout duration in seconds.
- **componentOutOfLine** (fidl_aligned[stringnoz]) - Description not provided.
- **timer_idOutOfLine** (fidl_aligned[stringnoz]) - Description not provided.

### Request Example
```json
{
  "metric_id": 141,
  "event_code": 516,
  "componentInLine": "timer_component",
  "timer_idInLine": "task_timer",
  "timestamp": 1678886400000000,
  "timeout_s": 30,
  "componentOutOfLine": "task_manager",
  "timer_idOutOfLine": "long_running_task"
}
```

### Response
#### Success Response (200)
- **void** (void) - Description not provided.

#### Response Example
```json
{
  "example": "Success response for StartTimer"
}
```
```

--------------------------------

### KVM Setup Flags

Source: https://github.com/google/syzkaller/blob/master/sys/linux/dev_kvm_amd64.txt

Defines flags used in KVM setup.

```APIDOC
## kvm_setup_flags

### Description
Defines various flags for KVM setup configuration.

### Flags
- **KVM_SETUP_PAGING**: (1<<0)
- **KVM_SETUP_PAE**: (1<<1)
- **KVM_SETUP_PROTECTED**: (1<<2)
- **KVM_SETUP_CPL3**: (1<<3)
- **KVM_SETUP_VIRT86**: (1<<4)
- **KVM_SETUP_SMM**: (1<<5)
- **KVM_SETUP_VM**: (1<<6)
```

--------------------------------

### Run syz-testbed with configuration

Source: https://github.com/google/syzkaller/blob/master/docs/syz_testbed.md

Execute syz-testbed by providing the path to your configuration file.

```bash
./syz-testbed -config config.json
```

--------------------------------

### syz_kvm_setup_cpu

Source: https://github.com/google/syzkaller/blob/master/sys/linux/dev_kvm_amd64.txt

Sets up a VCPU into a reasonable state for execution.

```APIDOC
## syz_kvm_setup_cpu$x86

### Description
Pseudo call that setups VCPU into a reasonable interesting state for execution. The interface is designed for extensibility so that addition of new options does not invalidate all existing programs.

### Method
N/A (syscall)

### Endpoint
N/A (syscall)

### Parameters
#### Path Parameters
N/A

#### Query Parameters
N/A

#### Request Body
- **fd_kvmvm** (fd) - Required - File descriptor for the KVM VM.
- **fd_kvmcpu** (fd) - Required - File descriptor for the VCPU.
- **vma** (usermem vma[24]) - Required - User memory area for CPU setup.
- **text** (ptr[in, array[kvm_text_x86, 1]]) - Required - Pointer to KVM text data.
- **ntext** (len[text]) - Required - Length of the KVM text data.
- **flags** (flags[kvm_setup_flags]) - Required - Flags for CPU setup.
- **opts** (ptr[in, array[kvm_setup_opt_x86, 0:2]]) - Optional - Pointer to setup options.
- **nopt** (len[opts]) - Optional - Number of setup options.
```

--------------------------------

### Get HID feature report

Source: https://github.com/google/syzkaller/blob/master/sys/linux/dev_hidraw.txt

Gets a feature report from the HID device.

```APIDOC
## ioctl$HIDIOCGFEATURE

### Description
Gets a feature report from the HID device associated with `fd`. The report number is specified in `arg.report_number`, and the retrieved report is stored in `arg.report`.

### Method
ioctl$HIDIOCGFEATURE

### Parameters
#### Path Parameters
- **fd** (fd_hidraw) - The file descriptor of the hidraw device.
- **cmd** (const[HIDIOCGFEATURE64]) - The ioctl command code.

#### Request Body
- **arg** (ptr[inout, hidraw_get_report_arg]) - A pointer to a `hidraw_get_report_arg` structure. `report_number` specifies which report to get, and `report` will be filled with the retrieved data.
```

--------------------------------

### Build Trusty OS

Source: https://github.com/google/syzkaller/blob/master/docs/trusty/README.md

Steps to initialize the Trusty manifest, sync repositories, and build Trusty for QEMU. This includes building Trusty and QEMU images.

```bash
mkdir trusty; cd trusty
repo init -u https://android.googlesource.com/trusty/manifest -b master
repo sync -j32
source trusty/vendor/google/aosp/scripts/envsetup.sh
make -j32 generic-arm64
# Build Trusty and qemu images:
trusty/vendor/google/aosp/scripts/build.py qemu-generic-arm64-test-debug
# Create qemu-comb.dtb:
KERNEL_DIR=$KERNEL build-root/build-qemu-generic-arm64-test-debug/run-qemu
```

--------------------------------

### Start syz-agent

Source: https://github.com/google/syzkaller/blob/master/docs/mcp.md

Command to start the syz-agent with the specified MCP configuration file.

```bash
bin/syz-agent -config mcp.config
```

--------------------------------

### Build syz-testbed tool

Source: https://github.com/google/syzkaller/blob/master/docs/syz_testbed.md

Navigate to the syz-testbed directory and build the tool using go build.

```bash
cd syzkaller/tools/syz-testbed/
go build
```

--------------------------------

### syz_kvm_setup_syzos_vm$arm64

Source: https://github.com/google/syzkaller/blob/master/sys/linux/dev_kvm_arm64.txt

Maps the given memory into the VM and sets up syzos.

```APIDOC
## syz_kvm_setup_syzos_vm$arm64

### Description
Maps the given memory into the VM and sets up syzos.

### Parameters
#### Path Parameters
- **fd_kvmvm** (fd_kvmvm) - Required - File descriptor for the KVM VM.
- **vma** (vma[1024]) - Required - User memory area to map.

### Return Value
- **kvm_syz_vm$arm64** - An opaque pointer representing the KVM VM.
```

--------------------------------

### Install debootstrap

Source: https://github.com/google/syzkaller/blob/master/docs/linux/setup_ubuntu-host_qemu-vm_x86-64-kernel.md

Installs the debootstrap package, which is required for creating Debian-based root file systems.

```bash
sudo apt install debootstrap
```

--------------------------------

### Install debootstrap

Source: https://github.com/google/syzkaller/blob/master/docs/linux/setup_ubuntu-host_vmware-vm_x86-64-kernel.md

Installs the debootstrap tool, which is used to create a Debian-based Linux user space.

```bash
sudo apt-get install debootstrap
```

--------------------------------

### Set up and Deploy Web Dashboard for Local Development

Source: https://github.com/google/syzkaller/blob/master/syz-cluster/dashboard/README.md

Run these commands to install development configurations and deploy the web dashboard for local access. Ensure kubectl is configured to access your cluster.

```bash
$ make install-dev-config
$ make deploy-web-dashboard-dev
$ kubectl port-forward service/web-dashboard-service --address 0.0.0.0 50123:80
```

--------------------------------

### Build QEMU for ARM64

Source: https://github.com/google/syzkaller/blob/master/docs/linux/setup_linux-host_qemu-vm_arm64-kernel.md

Steps to download, configure, and build QEMU for ARM64 emulation.

```bash
./configure
```

```bash
make -j40
```

--------------------------------

### Start Gemini CLI

Source: https://github.com/google/syzkaller/blob/master/docs/mcp.md

Command to start the Gemini CLI after configuring MCP server settings.

```bash
gemini
```

--------------------------------

### Syzbot Bug ID Example

Source: https://github.com/google/syzkaller/blob/master/docs/reproducing_crashes.md

Example of a syzbot bug ID extracted from a dashboard link.

```text
dashboard link: https://syzkaller.appspot.com/bug?extid=2159cbb522b02847c053
```

--------------------------------

### syz_kvm_setup_syzos_vm

Source: https://github.com/google/syzkaller/blob/master/sys/linux/dev_kvm_amd64.txt

Maps memory into the VM and sets up the syzos environment.

```APIDOC
## syz_kvm_setup_syzos_vm$x86

### Description
Maps the given memory into the VM and sets up syzos there.

### Method
N/A (syscall)

### Endpoint
N/A (syscall)

### Parameters
#### Path Parameters
N/A

#### Query Parameters
N/A

#### Request Body
- **fd_kvmvm** (fd) - Required - File descriptor for the KVM VM.
- **vma** (vma[1024]) - Required - User memory area for VM setup.
```

--------------------------------

### Build Fuchsia for qemu-x64

Source: https://github.com/google/syzkaller/blob/master/docs/starnix/README.md

Build the Fuchsia system for qemu-x64, including necessary tools and Starnix.

```bash
fx --dir "out/qemu-x64" set workstation_eng.qemu-x64 \
  --with "//bundles/tools" \
  --with "//src/proc/bin/starnix"
fx build
```

--------------------------------

### KVM Setup Options (x86)

Source: https://github.com/google/syzkaller/blob/master/sys/linux/dev_kvm_amd64.txt

Defines various options for configuring KVM setup on x86 architecture.

```APIDOC
## kvm_setup_opt_x86

### Description
Specifies configuration options for KVM setup on x86.

### Options
- **cr0**: kvm_setup_opt_cr0
- **cr4**: kvm_setup_opt_cr4
- **efer**: kvm_setup_opt_efer
- **flags**: kvm_setup_opt_flags
- **cstype0**: kvm_setup_opt_cstype0
- **cstype3**: kvm_setup_opt_cstype3
- **dstype0**: kvm_setup_opt_dstype0
- **dstype3**: kvm_setup_opt_dstype3
- **vmwrite**: kvm_setup_opt_vmwrite
```

```APIDOC
## kvm_setup_opt_cr0

### Description
Option to set the value of the CR0 control register.

### Fields
- **typ** (const[0, int64]): Type identifier for CR0.
- **val** (flags[kvm_x86_cr0, int64]): Flags for CR0 register.
```

```APIDOC
## kvm_setup_opt_cr4

### Description
Option to set the value of the CR4 control register.

### Fields
- **typ** (const[1, int64]): Type identifier for CR4.
- **val** (flags[kvm_x86_cr4, int64]): Flags for CR4 register.
```

```APIDOC
## kvm_setup_opt_efer

### Description
Option to set the value of the EFER MSR.

### Fields
- **typ** (const[2, int64]): Type identifier for EFER.
- **val** (flags[kvm_x86_efer, int64]): Flags for EFER register.
```

```APIDOC
## kvm_setup_opt_flags

### Description
Option to set RFLAGS register.

### Fields
- **typ** (const[3, int64]): Type identifier for RFLAGS.
- **val** (flags[kvm_x86_rflags, int64]): Flags for RFLAGS register.
```

```APIDOC
## kvm_setup_opt_cstype0

### Description
Option to set CS type for privilege level 0.

### Fields
- **typ** (const[4, int64]): Type identifier for CS type at PL0.
- **val** (int64[0:15]): Value for CS type.
```

```APIDOC
## kvm_setup_opt_cstype3

### Description
Option to set CS type for privilege level 3.

### Fields
- **typ** (const[5, int64]): Type identifier for CS type at PL3.
- **val** (int64[0:15]): Value for CS type.
```

```APIDOC
## kvm_setup_opt_dstype0

### Description
Option to set DS type for privilege level 0.

### Fields
- **typ** (const[6, int64]): Type identifier for DS type at PL0.
- **val** (int64[0:15]): Value for DS type.
```

```APIDOC
## kvm_setup_opt_dstype3

### Description
Option to set DS type for privilege level 3.

### Fields
- **typ** (const[7, int64]): Type identifier for DS type at PL3.
- **val** (int64[0:15]): Value for DS type.
```

```APIDOC
## kvm_setup_opt_vmwrite

### Description
Option to write a value to a specific VMCS field.

### Fields
- **typ** (const[8, int64]): Type identifier for VMWRITE.
- **sz** (const[0, int64:1]): Size of the field.
- **fld** (int64:5): Field index.
- **pad0** (const[0, int64:4]): Padding.
- **ftyp** (int64:2): Field type.
- **pad1** (const[0, int64:1]): Padding.
- **fsz** (int64:2): Field size.
- **pad2** (const[0, int64:1]): Padding.
- **val** (int64:48): Value to write.
```

--------------------------------

### Launch QEMU VM for Kernel Testing

Source: https://github.com/google/syzkaller/blob/master/docs/linux/setup_ubuntu-host_qemu-vm_x86-64-kernel.md

Launches a QEMU virtual machine with specific kernel and disk image configurations. Redirects output to a log file for later inspection. Ensure the kernel and image paths are correctly set.

```bash
qemu-system-x86_64 \
	-m 2G \
	-smp 2 \
	-kernel $KERNEL/arch/x86/boot/bzImage \
	-append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \
	-drive file=$IMAGE/trixie.img,format=raw \
	-net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \
	-net nic,model=e1000 \
	-enable-kvm \
	-nographic \
	-pidfile vm.pid \
	2>&1 | tee vm.log
```

--------------------------------

### Install dnsmasq for bhyve

Source: https://github.com/google/syzkaller/blob/master/docs/freebsd/README.md

Installs dnsmasq, a DHCP server required when using bhyve as the VM backend for syzkaller.

```console
# pkg install dnsmasq
```

--------------------------------

### Build and Run C Reproducer

Source: https://github.com/google/syzkaller/blob/master/docs/syzbot_assets.md

Download the C reproducer source code, compile it statically, copy it to the VM, and execute it. This requires the VM to be running and accessible via SSH.

```bash
$ wget -O 'repro.c' 'https://syzkaller.appspot.com/x/repro.c?x=13fd185b280000'
$ gcc repro.c -lpthread -static -o repro
$ scp -P 10022 -o UserKnownHostsFile=/dev/null  -o StrictHostKeyChecking=no -o IdentitiesOnly=yes ./repro root@127.0.0.1:/root/
$ ssh -p 10022 -o UserKnownHostsFile=/dev/null  -o StrictHostKeyChecking=no -o IdentitiesOnly=yes root@127.0.0.1 'chmod +x ./repro && ./repro'
```

--------------------------------

### Create Datastore Indexes

Source: https://github.com/google/syzkaller/blob/master/docs/setup_syzbot.md

Create the necessary Datastore indexes by deploying the index configuration file. This process may take a few minutes to complete.

```bash
gcloud datastore indexes create ./dashboard/app/index.yaml --project $PROJECT --quiet
```