prog: rework address allocation

1. mmap all memory always, without explicit mmap calls in the program.
This makes lots of things much easier and removes lots of code.
Makes mmap not a special syscall and allows to fuzz without mmap enabled.

2. Change address assignment algorithm.
Current algorithm allocates unmapped addresses too frequently
and allows collisions between arguments of a single syscall.
The new algorithm analyzes actual allocations in the program
and places new arguments at unused locations.

3 files changed, 7 insertions, 26 deletions

diff --git a/sys/fuchsia/amd64.go b/sys/fuchsia/amd64.go
index 9798e8eb3..aeb63b203 100644
--- a/sys/fuchsia/amd64.go
+++ b/sys/fuchsia/amd64.go
@@ -4,7 +4,7 @@ package fuchsia
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "fuchsia", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
+	RegisterTarget(&Target{OS: "fuchsia", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
 }
 
 var resources_amd64 = []*ResourceDesc{
@@ -1243,4 +1243,4 @@ var consts_amd64 = []ConstValue{
 	{Name: "ZX_WAIT_ASYNC_REPEATING", Value: 1},
 }
 
-const revision_amd64 = "16f8d2a14dffe8465559442d33e3ca296f7ea4bf"
+const revision_amd64 = "4eadf9151d47a3744fe9277b15a0447970eba0cb"
diff --git a/sys/fuchsia/arm64.go b/sys/fuchsia/arm64.go
index 826bfb44c..6f1e9b7e2 100644
--- a/sys/fuchsia/arm64.go
+++ b/sys/fuchsia/arm64.go
@@ -4,7 +4,7 @@ package fuchsia
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "fuchsia", Arch: "arm64", Revision: revision_arm64, PtrSize: 8, Syscalls: syscalls_arm64, Resources: resources_arm64, Structs: structDescs_arm64, Consts: consts_arm64}, initTarget)
+	RegisterTarget(&Target{OS: "fuchsia", Arch: "arm64", Revision: revision_arm64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_arm64, Resources: resources_arm64, Structs: structDescs_arm64, Consts: consts_arm64}, initTarget)
 }
 
 var resources_arm64 = []*ResourceDesc{
@@ -1243,4 +1243,4 @@ var consts_arm64 = []ConstValue{
 	{Name: "ZX_WAIT_ASYNC_REPEATING", Value: 1},
 }
 
-const revision_arm64 = "c04cb066cf7fc135f9f85388423f3e65aedc5028"
+const revision_arm64 = "bb0e27a08caeecf468bb53c76ebf97388e4d3c6d"
diff --git a/sys/fuchsia/init.go b/sys/fuchsia/init.go
index 12ee37daf..f3299e178 100644
--- a/sys/fuchsia/init.go
+++ b/sys/fuchsia/init.go
@@ -12,40 +12,21 @@ func initTarget(target *prog.Target) {
 		mmapSyscall: target.SyscallMap["syz_mmap"],
 	}
 
-	target.PageSize = pageSize
-	target.DataOffset = dataOffset
-	target.MmapSyscall = arch.mmapSyscall
 	target.MakeMmap = arch.makeMmap
-	target.AnalyzeMmap = arch.analyzeMmap
 }
 
-const (
-	pageSize   = 4 << 10
-	dataOffset = 512 << 20
-)
-
 type arch struct {
 	mmapSyscall *prog.Syscall
 }
 
-func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
+func (arch *arch) makeMmap(addr, size uint64) *prog.Call {
 	meta := arch.mmapSyscall
 	return &prog.Call{
 		Meta: meta,
 		Args: []prog.Arg{
-			prog.MakePointerArg(meta.Args[0], start, 0, npages, nil),
-			prog.MakeConstArg(meta.Args[1], npages*pageSize),
+			prog.MakeVmaPointerArg(meta.Args[0], addr, size),
+			prog.MakeConstArg(meta.Args[1], size),
 		},
 		Ret: prog.MakeReturnArg(meta.Ret),
 	}
 }
-
-func (arch *arch) analyzeMmap(c *prog.Call) (start, npages uint64, mapped bool) {
-	switch c.Meta.Name {
-	case "syz_mmap":
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		mapped = true
-	}
-	return
-}