Add syz_kfuzztest_run pseudo-syscall, KFuzzTest attribute, and encoding
logic.

KFuzzTest targets, which are invoked in the executor with the new
syz_kfuzztest_run pseudo-syscall, require specialized encoding. To
differentiate KFuzzTest calls from standard syzkaller calls, we
introduce a new attribute called KFuzzTest or "kfuzz_test" in syzkaller
descriptions that can be used to annotate calls.

Signed-off-by: Ethan Graham <ethangraham@google.com>

As KFuzzTest targets are discovered at boot, we need a mechanism for
adding these to the array of enabled system calls. This is implemented
by the new Extend method, which performs this setup.

Signed-off-by: Ethan Graham <ethangraham@google.com>

All non-base variants of syz_kfuzztest_run (i.e., those that are
discovered dynamically) are encoded so that they map onto the base
variant which is defined in kfuzztest.txt, and known by the executor.

We add a function for fetching this, that is wrapped in a sync.once
block to avoid repeated iteration over the target's array of syscalls.

Signed-off-by: Ethan Graham <ethangraham@google.com>

Add a new package, pkg/kfuzztest, that implements dynamic discovery of
KFuzzTest targets by parsing a vmlinux kernel binary.

Signed-off-by: Ethan Graham <ethangraham@google.com>

Internal kernel functions (and as a result KFuzzTest) have stricter
contracts than system calls. For this reason, we must avoid mutating
the following cases:
- Length arguments not matching the length of the related buffer.
- Strings not being null-terminated.

Add special cases for KFuzzTest calls that avoids these situations.

Signed-off-by: Ethan Graham <ethangraham@google.com>

Add logic for dynamic KFuzzTest target discovery in syz-manager. By
default, all KFuzzTest targets are enabled when the enable_kfuzztest
config option is set to true.

Signed-off-by: Ethan Graham <ethangraham@google.com>

syz-kfuzztest is a new standalone designed for fuzzing KFuzzTest on a
live kernel VM (e.g., inside QEMU). It has no dependencies on the
executor program, instead directly writing into a KFuzzTest target's
debugfs entry.

Signed-off-by: Ethan Graham <ethangraham@google.com>

Add a tool for generating a syscaller description for every KFuzzTest
target discovered in a vmlinux binary and outputting it to stdout.

Signed-off-by: Ethan Graham <ethangraham@google.com>

Add documentation for syzkaller's KFuzzTest integration, and a separate
documentation file for the syz-kfuzztest program.

Signed-off-by: Ethan Graham <ethangraham@google.com>

Introduce a KFuzzTest mode for the fuzzer so that a smaller number of
recommended calls can be used if we are fuzzing KFuzzTest targets.

Signed-off-by: Ethan Graham <ethangraham@google.com>

If vmlinux is specified as a flag, we perform a setup stage where we
parse vmlinux for KFuzzTest targets.

Signed-off-by: Ethan Graham <ethangraham@google.com>