prog: rework address allocation

1. mmap all memory always, without explicit mmap calls in the program.
This makes lots of things much easier and removes lots of code.
Makes mmap not a special syscall and allows to fuzz without mmap enabled.

2. Change address assignment algorithm.
Current algorithm allocates unmapped addresses too frequently
and allows collisions between arguments of a single syscall.
The new algorithm analyzes actual allocations in the program
and places new arguments at unused locations.

6 files changed, 15 insertions, 52 deletions

diff --git a/sys/linux/386.go b/sys/linux/386.go
index 8de78231f..8aa83b9ca 100644
--- a/sys/linux/386.go
+++ b/sys/linux/386.go
@@ -4,7 +4,7 @@ package linux
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "linux", Arch: "386", Revision: revision_386, PtrSize: 4, Syscalls: syscalls_386, Resources: resources_386, Structs: structDescs_386, Consts: consts_386}, initTarget)
+	RegisterTarget(&Target{OS: "linux", Arch: "386", Revision: revision_386, PtrSize: 4, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_386, Resources: resources_386, Structs: structDescs_386, Consts: consts_386}, initTarget)
 }
 
 var resources_386 = []*ResourceDesc{
@@ -24970,4 +24970,4 @@ var consts_386 = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_386 = "1d92abf94e3a94a587c23e34ff517226557eb39b"
+const revision_386 = "fdfb3bacd26e9af78ca89d10c2c2e06726f2b744"
diff --git a/sys/linux/amd64.go b/sys/linux/amd64.go
index 2f1b95a6a..ff9f6272f 100644
--- a/sys/linux/amd64.go
+++ b/sys/linux/amd64.go
@@ -4,7 +4,7 @@ package linux
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "linux", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
+	RegisterTarget(&Target{OS: "linux", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
 }
 
 var resources_amd64 = []*ResourceDesc{
@@ -25563,4 +25563,4 @@ var consts_amd64 = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_amd64 = "c063297cc1f7a742899148ea3e480a503975e1a3"
+const revision_amd64 = "3b495371d7017730eef962bb58f8674114796711"
diff --git a/sys/linux/arm.go b/sys/linux/arm.go
index 3830f25d3..de4cfc1a9 100644
--- a/sys/linux/arm.go
+++ b/sys/linux/arm.go
@@ -4,7 +4,7 @@ package linux
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "linux", Arch: "arm", Revision: revision_arm, PtrSize: 4, Syscalls: syscalls_arm, Resources: resources_arm, Structs: structDescs_arm, Consts: consts_arm}, initTarget)
+	RegisterTarget(&Target{OS: "linux", Arch: "arm", Revision: revision_arm, PtrSize: 4, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_arm, Resources: resources_arm, Structs: structDescs_arm, Consts: consts_arm}, initTarget)
 }
 
 var resources_arm = []*ResourceDesc{
@@ -24828,4 +24828,4 @@ var consts_arm = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_arm = "2a035864a56374d1ef4eafcffb968f43fd5b075c"
+const revision_arm = "1da52823d9d718efc3156b97b25ad96b0e8e7ea9"
diff --git a/sys/linux/arm64.go b/sys/linux/arm64.go
index 0b964d54f..367f34e3f 100644
--- a/sys/linux/arm64.go
+++ b/sys/linux/arm64.go
@@ -4,7 +4,7 @@ package linux
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "linux", Arch: "arm64", Revision: revision_arm64, PtrSize: 8, Syscalls: syscalls_arm64, Resources: resources_arm64, Structs: structDescs_arm64, Consts: consts_arm64}, initTarget)
+	RegisterTarget(&Target{OS: "linux", Arch: "arm64", Revision: revision_arm64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_arm64, Resources: resources_arm64, Structs: structDescs_arm64, Consts: consts_arm64}, initTarget)
 }
 
 var resources_arm64 = []*ResourceDesc{
@@ -24945,4 +24945,4 @@ var consts_arm64 = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_arm64 = "033a3d40f0ba2f8c5ebeb2a344a44e89db17e105"
+const revision_arm64 = "8747be63243fed6597fc673a88611c56b9be61ec"
diff --git a/sys/linux/init.go b/sys/linux/init.go
index 8f8fbfcc3..a411ed97b 100644
--- a/sys/linux/init.go
+++ b/sys/linux/init.go
@@ -34,11 +34,7 @@ func initTarget(target *prog.Target) {
 		CLOCK_REALTIME:            target.ConstMap["CLOCK_REALTIME"],
 	}
 
-	target.PageSize = pageSize
-	target.DataOffset = dataOffset
-	target.MmapSyscall = arch.mmapSyscall
 	target.MakeMmap = arch.makeMmap
-	target.AnalyzeMmap = arch.analyzeMmap
 	target.SanitizeCall = arch.sanitizeCall
 	target.SpecialTypes = map[string]func(g *prog.Gen, typ prog.Type, old prog.Arg) (
 		prog.Arg, []*prog.Call){
@@ -64,9 +60,7 @@ func initTarget(target *prog.Target) {
 }
 
 const (
-	pageSize   = 4 << 10
-	dataOffset = 512 << 20
-	invalidFD  = ^uint64(0)
+	invalidFD = ^uint64(0)
 )
 
 var (
@@ -108,14 +102,14 @@ type arch struct {
 	CLOCK_REALTIME            uint64
 }
 
-// createMmapCall creates a "normal" mmap call that maps [start, start+npages) page range.
-func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
+// createMmapCall creates a "normal" mmap call that maps [addr, addr+size) memory range.
+func (arch *arch) makeMmap(addr, size uint64) *prog.Call {
 	meta := arch.mmapSyscall
 	return &prog.Call{
 		Meta: meta,
 		Args: []prog.Arg{
-			prog.MakePointerArg(meta.Args[0], start, 0, npages, nil),
-			prog.MakeConstArg(meta.Args[1], npages*pageSize),
+			prog.MakeVmaPointerArg(meta.Args[0], addr, size),
+			prog.MakeConstArg(meta.Args[1], addr),
 			prog.MakeConstArg(meta.Args[2], arch.PROT_READ|arch.PROT_WRITE),
 			prog.MakeConstArg(meta.Args[3], arch.MAP_ANONYMOUS|arch.MAP_PRIVATE|arch.MAP_FIXED),
 			prog.MakeResultArg(meta.Args[4], nil, invalidFD),
@@ -125,37 +119,6 @@ func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
 	}
 }
 
-func (arch *arch) analyzeMmap(c *prog.Call) (start, npages uint64, mapped bool) {
-	switch c.Meta.Name {
-	case "mmap":
-		// Filter out only very wrong arguments.
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		if npages == 0 {
-			return
-		}
-		flags := c.Args[3].(*prog.ConstArg).Val
-		fd := c.Args[4].(*prog.ResultArg).Val
-		if flags&arch.MAP_ANONYMOUS == 0 && fd == invalidFD {
-			return
-		}
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		mapped = true
-		return
-	case "munmap":
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		mapped = false
-		return
-	case "mremap":
-		start = c.Args[4].(*prog.PointerArg).PageIndex
-		npages = c.Args[2].(*prog.ConstArg).Val / pageSize
-		mapped = true
-		return
-	default:
-		return
-	}
-}
-
 func (arch *arch) sanitizeCall(c *prog.Call) {
 	switch c.Meta.CallName {
 	case "mmap":
diff --git a/sys/linux/ppc64le.go b/sys/linux/ppc64le.go
index 47f3c096a..ab4b66c28 100644
--- a/sys/linux/ppc64le.go
+++ b/sys/linux/ppc64le.go
@@ -4,7 +4,7 @@ package linux
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "linux", Arch: "ppc64le", Revision: revision_ppc64le, PtrSize: 8, Syscalls: syscalls_ppc64le, Resources: resources_ppc64le, Structs: structDescs_ppc64le, Consts: consts_ppc64le}, initTarget)
+	RegisterTarget(&Target{OS: "linux", Arch: "ppc64le", Revision: revision_ppc64le, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_ppc64le, Resources: resources_ppc64le, Structs: structDescs_ppc64le, Consts: consts_ppc64le}, initTarget)
 }
 
 var resources_ppc64le = []*ResourceDesc{
@@ -24707,4 +24707,4 @@ var consts_ppc64le = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_ppc64le = "c996439d4a7c1dc76b269b6869f8bb2b505550b3"
+const revision_ppc64le = "1b0002aaf7519f39f849b6abcc3c35add0d6f112"