List of things we need descriptions for (dynamically updated). Note : some of these things might be very hard to test, while other are easy.

Before starting work on a subsystem, grep existing descriptions if the subsystem is already [partially] described. This list may be outdated or imply extending existing basic descriptions.

Besides this list, new things are constantly added to the kernel. kernelnewbies.org lists new things in each release. Also queries along the following lines can be used to check for features added in each release:

git diff -U0 v5.17 v5.18 include/uapi/*.h | grep "+++"
git diff -U0 v5.17 HEAD include/uapi/*.h | egrep "^\+.*\s_IO" | less
git diff -U0 v5.17 HEAD include/uapi/*.h | egrep -v "^(index|diff|---|@|-|\+$|\+/\*|\+ \*)" | less

For introduction to Linux kernel syscalls see these 0xax.gitbooks.io articles: part 1, part 4, part 5. Bootlin code search is very useful for browsing kernel sources.

Assorted devices:

• /dev/vfio
• stub video/media devices (CONFIG_VIDEO_VIMC, CONFIG_VIDEO_VIM2M, CONFIG_VIDEO_VIVID, CONFIG_VIDEO_VICODEC) /dev/video*, /dev/media*, /dev/v4l* allow to test large generic parts of media stack; there are some descriptions in sys/linux/dev_video4linux.txt but they need to be double checked
• CONFIG_VIDEO_MEM2MEM_DEINTERLACE
• CONFIG_VIRTIO_MEM (figure out how to enable it in qemu)
• drivers/mtd/ubi
• /dev/dma_heap/system

Assorted:

• CONFIG_BLK_DEV_UBLK
• quotactl_fd
• fsinfo and fchmodat4
• NOTIFY_MOUNT, watch_sb, KEYCTL_WATCH_KEY
• blkzoned (lots of descriptions are in place, but syzkaller does not seem to actually reach the code)
• SK_DIAG_BPF_STORAGE_REQ_MAP_FD
• perf trace filters (parse something insanely complex: kernel/trace/trace_events_filter.c)
• filesystem-specific ioctl's on files and dir (e.g. ext4 and btrfs have a few, also see sys: filesystem image fuzzing #1020)
• binderfs (see also this discussion)
• loopfs (if it lands at least in linux-next)
• squashfs
• ubifs
• dmcrypt, dmverity, fs-verify
• more netlink descriptions (in particular, netlink/generic subsystems)
• set breakpoints/watchpoints on own process using ptrace/perf_event_open
• create interesting frames for rt_sigreturn to restore (in particular FP state)

Sound:

• /proc/asound/*
• sound/core/compress_offload.c (figure out how to enable it in qemu)
• SNDRV_CTL_ELEM_TYPE_*

Network:

• better conntrack coverage
• NS_GET_INIT_PID
• XFRM_ESPINTCP
• BRIDGE_MRP
• TCA_FLOWER_KEY_MPLS_OPTS
• packet scheduler (include/uapi/linux/pkt_sched.h)
• mac80211/ETH_P_PREAUTH
• VLANs (can be created with "ip add -type vlan" on top of veth)
• jumbo frames (not sure what's the current coverage, specifically inject huge packets?)
• gate control action (TCA_GATE_ENTRY_INDEX)

USB (docs):

• USB/IP client and server
• /sys/kernel/debug/usb/devices
• Legacy gadget drivers (g_hid.ko, etc.)
• ConfigFS gadget functions

External USB (sys/linux/vusb.txt):

• CONFIG_USB_STORAGE
• CONFIG_SND_USB
• CONFIG_USB_RTL8150
• CONFIG_USB_RTL8152
• CONFIG_USB_NET_AX88179_178A
• CONFIG_USB_NET_AX8817X
• Probably many others

External network (sys/linux/vnet.txt):

• SCTP
• Probably many others

Bluetooth (sys/linux/socket_bluetooth.txt):

• What is covered? What isn't yet?

GPIO: the following configs create some test devices in VMs (GPIOLIB, GPIO_AGGREGATOR, GPIO_VIRTIO, GPIO_MOCKUP, GPIO_SIM)

HDMI (#3725)

CONFIG_CACHESTAT_SYSCALL