prog: rework address allocation

1. mmap all memory always, without explicit mmap calls in the program.
This makes lots of things much easier and removes lots of code.
Makes mmap not a special syscall and allows to fuzz without mmap enabled.

2. Change address assignment algorithm.
Current algorithm allocates unmapped addresses too frequently
and allows collisions between arguments of a single syscall.
The new algorithm analyzes actual allocations in the program
and places new arguments at unused locations.

22 files changed, 104 insertions, 254 deletions

diff --git a/sys/akaros/amd64.go b/sys/akaros/amd64.go
index 3c966da58..098e47bae 100644
--- a/sys/akaros/amd64.go
+++ b/sys/akaros/amd64.go
@@ -4,7 +4,7 @@ package akaros
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "akaros", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
+	RegisterTarget(&Target{OS: "akaros", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
 }
 
 var resources_amd64 = []*ResourceDesc{
@@ -285,4 +285,4 @@ var consts_amd64 = []ConstValue{
 	{Name: "__O_TMPFILE", Value: 4259840},
 }
 
-const revision_amd64 = "0e5dbbd94e4838b9729df440c4c53e581768eaf8"
+const revision_amd64 = "43f665d2468516ae8ffc137aec39649a4a1dc7ce"
diff --git a/sys/akaros/init.go b/sys/akaros/init.go
index 02b9f09a6..3d525f95a 100644
--- a/sys/akaros/init.go
+++ b/sys/akaros/init.go
@@ -17,17 +17,11 @@ func initTarget(target *prog.Target) {
 		MAP_FIXED:     target.ConstMap["MAP_FIXED"],
 	}
 
-	target.PageSize = pageSize
-	target.DataOffset = dataOffset
-	target.MmapSyscall = arch.mmapSyscall
 	target.MakeMmap = arch.makeMmap
-	target.AnalyzeMmap = arch.analyzeMmap
 }
 
 const (
-	pageSize   = 4 << 10
-	dataOffset = 512 << 20
-	invalidFD  = ^uint64(0)
+	invalidFD = ^uint64(0)
 )
 
 type arch struct {
@@ -41,13 +35,13 @@ type arch struct {
 }
 
 // createMmapCall creates a "normal" mmap call that maps [start, start+npages) page range.
-func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
+func (arch *arch) makeMmap(addr, size uint64) *prog.Call {
 	meta := arch.mmapSyscall
 	return &prog.Call{
 		Meta: meta,
 		Args: []prog.Arg{
-			prog.MakePointerArg(meta.Args[0], start, 0, npages, nil),
-			prog.MakeConstArg(meta.Args[1], npages*pageSize),
+			prog.MakeVmaPointerArg(meta.Args[0], addr, size),
+			prog.MakeConstArg(meta.Args[1], size),
 			prog.MakeConstArg(meta.Args[2], arch.PROT_READ|arch.PROT_WRITE),
 			prog.MakeConstArg(meta.Args[3], arch.MAP_ANONYMOUS|arch.MAP_PRIVATE|arch.MAP_FIXED),
 			prog.MakeResultArg(meta.Args[4], nil, invalidFD),
@@ -56,19 +50,3 @@ func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
 		Ret: prog.MakeReturnArg(meta.Ret),
 	}
 }
-
-func (arch *arch) analyzeMmap(c *prog.Call) (start, npages uint64, mapped bool) {
-	switch c.Meta.Name {
-	case "mmap":
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		mapped = true
-		return
-	case "munmap":
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		mapped = false
-		return
-	default:
-		return
-	}
-}
diff --git a/sys/freebsd/amd64.go b/sys/freebsd/amd64.go
index 34236ab63..e6c41eaa6 100644
--- a/sys/freebsd/amd64.go
+++ b/sys/freebsd/amd64.go
@@ -4,7 +4,7 @@ package freebsd
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "freebsd", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
+	RegisterTarget(&Target{OS: "freebsd", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
 }
 
 var resources_amd64 = []*ResourceDesc{
@@ -2440,4 +2440,4 @@ var consts_amd64 = []ConstValue{
 	{Name: "WUNTRACED", Value: 2},
 }
 
-const revision_amd64 = "8faf3b6e65172d4a9e098d5eda39563a082f8078"
+const revision_amd64 = "b41d0c0723ec3704417120a5a63657cc522f14cf"
diff --git a/sys/freebsd/init.go b/sys/freebsd/init.go
index d1a1ffec5..ed02e712e 100644
--- a/sys/freebsd/init.go
+++ b/sys/freebsd/init.go
@@ -22,18 +22,12 @@ func initTarget(target *prog.Target) {
 		S_IFSOCK:    target.ConstMap["S_IFSOCK"],
 	}
 
-	target.PageSize = pageSize
-	target.DataOffset = dataOffset
-	target.MmapSyscall = arch.mmapSyscall
 	target.MakeMmap = arch.makeMmap
-	target.AnalyzeMmap = arch.analyzeMmap
 	target.SanitizeCall = arch.sanitizeCall
 }
 
 const (
-	pageSize   = 4 << 10
-	dataOffset = 512 << 20
-	invalidFD  = ^uint64(0)
+	invalidFD = ^uint64(0)
 )
 
 type arch struct {
@@ -52,14 +46,13 @@ type arch struct {
 	S_IFSOCK    uint64
 }
 
-// createMmapCall creates a "normal" mmap call that maps [start, start+npages) page range.
-func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
+func (arch *arch) makeMmap(addr, size uint64) *prog.Call {
 	meta := arch.mmapSyscall
 	return &prog.Call{
 		Meta: meta,
 		Args: []prog.Arg{
-			prog.MakePointerArg(meta.Args[0], start, 0, npages, nil),
-			prog.MakeConstArg(meta.Args[1], npages*pageSize),
+			prog.MakeVmaPointerArg(meta.Args[0], addr, size),
+			prog.MakeConstArg(meta.Args[1], size),
 			prog.MakeConstArg(meta.Args[2], arch.PROT_READ|arch.PROT_WRITE),
 			prog.MakeConstArg(meta.Args[3], arch.MAP_ANON|arch.MAP_PRIVATE|arch.MAP_FIXED),
 			prog.MakeResultArg(meta.Args[4], nil, invalidFD),
@@ -69,32 +62,6 @@ func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
 	}
 }
 
-func (arch *arch) analyzeMmap(c *prog.Call) (start, npages uint64, mapped bool) {
-	switch c.Meta.Name {
-	case "mmap":
-		// Filter out only very wrong arguments.
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		if npages == 0 {
-			return
-		}
-		flags := c.Args[3].(*prog.ConstArg).Val
-		fd := c.Args[4].(*prog.ResultArg).Val
-		if flags&arch.MAP_ANON == 0 && fd == invalidFD {
-			return
-		}
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		mapped = true
-		return
-	case "munmap":
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		mapped = false
-		return
-	default:
-		return
-	}
-}
-
 func (arch *arch) sanitizeCall(c *prog.Call) {
 	switch c.Meta.CallName {
 	case "mmap":
diff --git a/sys/fuchsia/amd64.go b/sys/fuchsia/amd64.go
index 9798e8eb3..aeb63b203 100644
--- a/sys/fuchsia/amd64.go
+++ b/sys/fuchsia/amd64.go
@@ -4,7 +4,7 @@ package fuchsia
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "fuchsia", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
+	RegisterTarget(&Target{OS: "fuchsia", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
 }
 
 var resources_amd64 = []*ResourceDesc{
@@ -1243,4 +1243,4 @@ var consts_amd64 = []ConstValue{
 	{Name: "ZX_WAIT_ASYNC_REPEATING", Value: 1},
 }
 
-const revision_amd64 = "16f8d2a14dffe8465559442d33e3ca296f7ea4bf"
+const revision_amd64 = "4eadf9151d47a3744fe9277b15a0447970eba0cb"
diff --git a/sys/fuchsia/arm64.go b/sys/fuchsia/arm64.go
index 826bfb44c..6f1e9b7e2 100644
--- a/sys/fuchsia/arm64.go
+++ b/sys/fuchsia/arm64.go
@@ -4,7 +4,7 @@ package fuchsia
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "fuchsia", Arch: "arm64", Revision: revision_arm64, PtrSize: 8, Syscalls: syscalls_arm64, Resources: resources_arm64, Structs: structDescs_arm64, Consts: consts_arm64}, initTarget)
+	RegisterTarget(&Target{OS: "fuchsia", Arch: "arm64", Revision: revision_arm64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_arm64, Resources: resources_arm64, Structs: structDescs_arm64, Consts: consts_arm64}, initTarget)
 }
 
 var resources_arm64 = []*ResourceDesc{
@@ -1243,4 +1243,4 @@ var consts_arm64 = []ConstValue{
 	{Name: "ZX_WAIT_ASYNC_REPEATING", Value: 1},
 }
 
-const revision_arm64 = "c04cb066cf7fc135f9f85388423f3e65aedc5028"
+const revision_arm64 = "bb0e27a08caeecf468bb53c76ebf97388e4d3c6d"
diff --git a/sys/fuchsia/init.go b/sys/fuchsia/init.go
index 12ee37daf..f3299e178 100644
--- a/sys/fuchsia/init.go
+++ b/sys/fuchsia/init.go
@@ -12,40 +12,21 @@ func initTarget(target *prog.Target) {
 		mmapSyscall: target.SyscallMap["syz_mmap"],
 	}
 
-	target.PageSize = pageSize
-	target.DataOffset = dataOffset
-	target.MmapSyscall = arch.mmapSyscall
 	target.MakeMmap = arch.makeMmap
-	target.AnalyzeMmap = arch.analyzeMmap
 }
 
-const (
-	pageSize   = 4 << 10
-	dataOffset = 512 << 20
-)
-
 type arch struct {
 	mmapSyscall *prog.Syscall
 }
 
-func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
+func (arch *arch) makeMmap(addr, size uint64) *prog.Call {
 	meta := arch.mmapSyscall
 	return &prog.Call{
 		Meta: meta,
 		Args: []prog.Arg{
-			prog.MakePointerArg(meta.Args[0], start, 0, npages, nil),
-			prog.MakeConstArg(meta.Args[1], npages*pageSize),
+			prog.MakeVmaPointerArg(meta.Args[0], addr, size),
+			prog.MakeConstArg(meta.Args[1], size),
 		},
 		Ret: prog.MakeReturnArg(meta.Ret),
 	}
 }
-
-func (arch *arch) analyzeMmap(c *prog.Call) (start, npages uint64, mapped bool) {
-	switch c.Meta.Name {
-	case "syz_mmap":
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		mapped = true
-	}
-	return
-}
diff --git a/sys/linux/386.go b/sys/linux/386.go
index 8de78231f..8aa83b9ca 100644
--- a/sys/linux/386.go
+++ b/sys/linux/386.go
@@ -4,7 +4,7 @@ package linux
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "linux", Arch: "386", Revision: revision_386, PtrSize: 4, Syscalls: syscalls_386, Resources: resources_386, Structs: structDescs_386, Consts: consts_386}, initTarget)
+	RegisterTarget(&Target{OS: "linux", Arch: "386", Revision: revision_386, PtrSize: 4, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_386, Resources: resources_386, Structs: structDescs_386, Consts: consts_386}, initTarget)
 }
 
 var resources_386 = []*ResourceDesc{
@@ -24970,4 +24970,4 @@ var consts_386 = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_386 = "1d92abf94e3a94a587c23e34ff517226557eb39b"
+const revision_386 = "fdfb3bacd26e9af78ca89d10c2c2e06726f2b744"
diff --git a/sys/linux/amd64.go b/sys/linux/amd64.go
index 2f1b95a6a..ff9f6272f 100644
--- a/sys/linux/amd64.go
+++ b/sys/linux/amd64.go
@@ -4,7 +4,7 @@ package linux
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "linux", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
+	RegisterTarget(&Target{OS: "linux", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
 }
 
 var resources_amd64 = []*ResourceDesc{
@@ -25563,4 +25563,4 @@ var consts_amd64 = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_amd64 = "c063297cc1f7a742899148ea3e480a503975e1a3"
+const revision_amd64 = "3b495371d7017730eef962bb58f8674114796711"
diff --git a/sys/linux/arm.go b/sys/linux/arm.go
index 3830f25d3..de4cfc1a9 100644
--- a/sys/linux/arm.go
+++ b/sys/linux/arm.go
@@ -4,7 +4,7 @@ package linux
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "linux", Arch: "arm", Revision: revision_arm, PtrSize: 4, Syscalls: syscalls_arm, Resources: resources_arm, Structs: structDescs_arm, Consts: consts_arm}, initTarget)
+	RegisterTarget(&Target{OS: "linux", Arch: "arm", Revision: revision_arm, PtrSize: 4, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_arm, Resources: resources_arm, Structs: structDescs_arm, Consts: consts_arm}, initTarget)
 }
 
 var resources_arm = []*ResourceDesc{
@@ -24828,4 +24828,4 @@ var consts_arm = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_arm = "2a035864a56374d1ef4eafcffb968f43fd5b075c"
+const revision_arm = "1da52823d9d718efc3156b97b25ad96b0e8e7ea9"
diff --git a/sys/linux/arm64.go b/sys/linux/arm64.go
index 0b964d54f..367f34e3f 100644
--- a/sys/linux/arm64.go
+++ b/sys/linux/arm64.go
@@ -4,7 +4,7 @@ package linux
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "linux", Arch: "arm64", Revision: revision_arm64, PtrSize: 8, Syscalls: syscalls_arm64, Resources: resources_arm64, Structs: structDescs_arm64, Consts: consts_arm64}, initTarget)
+	RegisterTarget(&Target{OS: "linux", Arch: "arm64", Revision: revision_arm64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_arm64, Resources: resources_arm64, Structs: structDescs_arm64, Consts: consts_arm64}, initTarget)
 }
 
 var resources_arm64 = []*ResourceDesc{
@@ -24945,4 +24945,4 @@ var consts_arm64 = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_arm64 = "033a3d40f0ba2f8c5ebeb2a344a44e89db17e105"
+const revision_arm64 = "8747be63243fed6597fc673a88611c56b9be61ec"
diff --git a/sys/linux/init.go b/sys/linux/init.go
index 8f8fbfcc3..a411ed97b 100644
--- a/sys/linux/init.go
+++ b/sys/linux/init.go
@@ -34,11 +34,7 @@ func initTarget(target *prog.Target) {
 		CLOCK_REALTIME:            target.ConstMap["CLOCK_REALTIME"],
 	}
 
-	target.PageSize = pageSize
-	target.DataOffset = dataOffset
-	target.MmapSyscall = arch.mmapSyscall
 	target.MakeMmap = arch.makeMmap
-	target.AnalyzeMmap = arch.analyzeMmap
 	target.SanitizeCall = arch.sanitizeCall
 	target.SpecialTypes = map[string]func(g *prog.Gen, typ prog.Type, old prog.Arg) (
 		prog.Arg, []*prog.Call){
@@ -64,9 +60,7 @@ func initTarget(target *prog.Target) {
 }
 
 const (
-	pageSize   = 4 << 10
-	dataOffset = 512 << 20
-	invalidFD  = ^uint64(0)
+	invalidFD = ^uint64(0)
 )
 
 var (
@@ -108,14 +102,14 @@ type arch struct {
 	CLOCK_REALTIME            uint64
 }
 
-// createMmapCall creates a "normal" mmap call that maps [start, start+npages) page range.
-func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
+// createMmapCall creates a "normal" mmap call that maps [addr, addr+size) memory range.
+func (arch *arch) makeMmap(addr, size uint64) *prog.Call {
 	meta := arch.mmapSyscall
 	return &prog.Call{
 		Meta: meta,
 		Args: []prog.Arg{
-			prog.MakePointerArg(meta.Args[0], start, 0, npages, nil),
-			prog.MakeConstArg(meta.Args[1], npages*pageSize),
+			prog.MakeVmaPointerArg(meta.Args[0], addr, size),
+			prog.MakeConstArg(meta.Args[1], addr),
 			prog.MakeConstArg(meta.Args[2], arch.PROT_READ|arch.PROT_WRITE),
 			prog.MakeConstArg(meta.Args[3], arch.MAP_ANONYMOUS|arch.MAP_PRIVATE|arch.MAP_FIXED),
 			prog.MakeResultArg(meta.Args[4], nil, invalidFD),
@@ -125,37 +119,6 @@ func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
 	}
 }
 
-func (arch *arch) analyzeMmap(c *prog.Call) (start, npages uint64, mapped bool) {
-	switch c.Meta.Name {
-	case "mmap":
-		// Filter out only very wrong arguments.
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		if npages == 0 {
-			return
-		}
-		flags := c.Args[3].(*prog.ConstArg).Val
-		fd := c.Args[4].(*prog.ResultArg).Val
-		if flags&arch.MAP_ANONYMOUS == 0 && fd == invalidFD {
-			return
-		}
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		mapped = true
-		return
-	case "munmap":
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		mapped = false
-		return
-	case "mremap":
-		start = c.Args[4].(*prog.PointerArg).PageIndex
-		npages = c.Args[2].(*prog.ConstArg).Val / pageSize
-		mapped = true
-		return
-	default:
-		return
-	}
-}
-
 func (arch *arch) sanitizeCall(c *prog.Call) {
 	switch c.Meta.CallName {
 	case "mmap":
diff --git a/sys/linux/ppc64le.go b/sys/linux/ppc64le.go
index 47f3c096a..ab4b66c28 100644
--- a/sys/linux/ppc64le.go
+++ b/sys/linux/ppc64le.go
@@ -4,7 +4,7 @@ package linux
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "linux", Arch: "ppc64le", Revision: revision_ppc64le, PtrSize: 8, Syscalls: syscalls_ppc64le, Resources: resources_ppc64le, Structs: structDescs_ppc64le, Consts: consts_ppc64le}, initTarget)
+	RegisterTarget(&Target{OS: "linux", Arch: "ppc64le", Revision: revision_ppc64le, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_ppc64le, Resources: resources_ppc64le, Structs: structDescs_ppc64le, Consts: consts_ppc64le}, initTarget)
 }
 
 var resources_ppc64le = []*ResourceDesc{
@@ -24707,4 +24707,4 @@ var consts_ppc64le = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_ppc64le = "c996439d4a7c1dc76b269b6869f8bb2b505550b3"
+const revision_ppc64le = "1b0002aaf7519f39f849b6abcc3c35add0d6f112"
diff --git a/sys/netbsd/amd64.go b/sys/netbsd/amd64.go
index 66abbe3cc..cff461cd4 100644
--- a/sys/netbsd/amd64.go
+++ b/sys/netbsd/amd64.go
@@ -4,7 +4,7 @@ package netbsd
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "netbsd", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
+	RegisterTarget(&Target{OS: "netbsd", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
 }
 
 var resources_amd64 = []*ResourceDesc{
@@ -1674,4 +1674,4 @@ var consts_amd64 = []ConstValue{
 	{Name: "WUNTRACED", Value: 2},
 }
 
-const revision_amd64 = "8a10b163677425b6f340b2e4e277358c7c1a4237"
+const revision_amd64 = "350c03f12de803ca8775df640249eae7e2425419"
diff --git a/sys/netbsd/init.go b/sys/netbsd/init.go
index f44753e82..3af3619b6 100644
--- a/sys/netbsd/init.go
+++ b/sys/netbsd/init.go
@@ -17,18 +17,12 @@ func initTarget(target *prog.Target) {
 		MAP_FIXED:     target.ConstMap["MAP_FIXED"],
 	}
 
-	target.PageSize = pageSize
-	target.DataOffset = dataOffset
-	target.MmapSyscall = arch.mmapSyscall
 	target.MakeMmap = arch.makeMmap
-	target.AnalyzeMmap = arch.analyzeMmap
 	target.SanitizeCall = arch.sanitizeCall
 }
 
 const (
-	pageSize   = 4 << 10
-	dataOffset = 512 << 20
-	invalidFD  = ^uint64(0)
+	invalidFD = ^uint64(0)
 )
 
 type arch struct {
@@ -42,14 +36,13 @@ type arch struct {
 	MAP_FIXED     uint64
 }
 
-// createMmapCall creates a "normal" mmap call that maps [start, start+npages) page range.
-func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
+func (arch *arch) makeMmap(addr, size uint64) *prog.Call {
 	meta := arch.mmapSyscall
 	return &prog.Call{
 		Meta: meta,
 		Args: []prog.Arg{
-			prog.MakePointerArg(meta.Args[0], start, 0, npages, nil),
-			prog.MakeConstArg(meta.Args[1], npages*pageSize),
+			prog.MakeVmaPointerArg(meta.Args[0], addr, size),
+			prog.MakeConstArg(meta.Args[1], size),
 			prog.MakeConstArg(meta.Args[2], arch.PROT_READ|arch.PROT_WRITE),
 			prog.MakeConstArg(meta.Args[3], arch.MAP_ANONYMOUS|arch.MAP_PRIVATE|arch.MAP_FIXED),
 			prog.MakeResultArg(meta.Args[4], nil, invalidFD),
@@ -60,32 +53,6 @@ func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
 	}
 }
 
-func (arch *arch) analyzeMmap(c *prog.Call) (start, npages uint64, mapped bool) {
-	switch c.Meta.Name {
-	case "mmap":
-		// Filter out only very wrong arguments.
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		if npages == 0 {
-			return
-		}
-		flags := c.Args[3].(*prog.ConstArg).Val
-		fd := c.Args[4].(*prog.ResultArg).Val
-		if flags&arch.MAP_ANONYMOUS == 0 && fd == invalidFD {
-			return
-		}
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		mapped = true
-		return
-	case "munmap":
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		mapped = false
-		return
-	default:
-		return
-	}
-}
-
 func (arch *arch) sanitizeCall(c *prog.Call) {
 	switch c.Meta.CallName {
 	case "mmap":
diff --git a/sys/syz-sysgen/sysgen.go b/sys/syz-sysgen/sysgen.go
index aafc44feb..d91970f59 100644
--- a/sys/syz-sysgen/sysgen.go
+++ b/sys/syz-sysgen/sysgen.go
@@ -135,10 +135,12 @@ func generate(target *targets.Target, prg *compiler.Prog, consts map[string]uint
 	fmt.Fprintf(out, "import . \"github.com/google/syzkaller/prog\"\n\n")
 
 	fmt.Fprintf(out, "func init() {\n")
-	fmt.Fprintf(out, "\tRegisterTarget(&Target{OS: %q, Arch: %q, Revision: revision_%v, PtrSize: %v,"+
-		"Syscalls: syscalls_%v, Resources: resources_%v, Structs: structDescs_%v, Consts: consts_%v}, "+
+	fmt.Fprintf(out, "\tRegisterTarget(&Target{OS: %q, Arch: %q, Revision: revision_%v, PtrSize: %v, "+
+		"PageSize: %v, NumPages: %v, DataOffset: %v, Syscalls: syscalls_%v, "+
+		"Resources: resources_%v, Structs: structDescs_%v, Consts: consts_%v}, "+
 		"initTarget)\n",
 		target.OS, target.Arch, target.Arch, target.PtrSize,
+		target.PageSize, target.NumPages, target.DataOffset,
 		target.Arch, target.Arch, target.Arch, target.Arch)
 	fmt.Fprintf(out, "}\n\n")
 
@@ -174,15 +176,21 @@ func generateExecutorSyscalls(target *targets.Target, syscalls []*prog.Syscall,
 		NeedCall bool
 	}
 	type ArchData struct {
-		Revision string
-		GOARCH   string
-		CARCH    []string
-		Calls    []SyscallData
+		Revision   string
+		GOARCH     string
+		CARCH      []string
+		PageSize   uint64
+		NumPages   uint64
+		DataOffset uint64
+		Calls      []SyscallData
 	}
 	data := ArchData{
-		Revision: rev,
-		GOARCH:   target.Arch,
-		CARCH:    target.CArch,
+		Revision:   rev,
+		GOARCH:     target.Arch,
+		CARCH:      target.CArch,
+		PageSize:   target.PageSize,
+		NumPages:   target.NumPages,
+		DataOffset: target.DataOffset,
 	}
 	for _, c := range syscalls {
 		data.Calls = append(data.Calls, SyscallData{
@@ -247,6 +255,9 @@ var archTempl = template.Must(template.New("").Parse(`
 #if {{range $cdef := $.CARCH}}defined({{$cdef}}) || {{end}}0
 #define GOARCH "{{.GOARCH}}"
 #define SYZ_REVISION "{{.Revision}}"
+#define SYZ_PAGE_SIZE {{.PageSize}}
+#define SYZ_NUM_PAGES {{.NumPages}}
+#define SYZ_DATA_OFFSET {{.DataOffset}}
 unsigned syscall_count = {{len $.Calls}};
 call_t syscalls[] = {
 {{range $c := $.Calls}}	{"{{$c.Name}}", {{$c.NR}}{{if $c.NeedCall}}, (syscall_t){{$c.CallName}}{{end}}},
diff --git a/sys/targets/targets.go b/sys/targets/targets.go
index bfd31df6c..a40121c47 100644
--- a/sys/targets/targets.go
+++ b/sys/targets/targets.go
@@ -8,6 +8,9 @@ type Target struct {
 	OS                 string
 	Arch               string
 	PtrSize            uint64
+	PageSize           uint64
+	NumPages           uint64
+	DataOffset         uint64
 	CArch              []string
 	CFlags             []string
 	CrossCFlags        []string
@@ -34,15 +37,18 @@ type os struct {
 var List = map[string]map[string]*Target{
 	"test": map[string]*Target{
 		"32": {
-			PtrSize: 4,
+			PtrSize:  4,
+			PageSize: 8 << 10,
 		},
 		"64": {
-			PtrSize: 8,
+			PtrSize:  8,
+			PageSize: 4 << 10,
 		},
 	},
 	"linux": map[string]*Target{
 		"amd64": {
 			PtrSize:          8,
+			PageSize:         4 << 10,
 			CArch:            []string{"__x86_64__"},
 			CFlags:           []string{"-m64"},
 			CrossCFlags:      []string{"-m64"},
@@ -57,6 +63,7 @@ var List = map[string]map[string]*Target{
 		},
 		"386": {
 			PtrSize:          4,
+			PageSize:         4 << 10,
 			CArch:            []string{"__i386__"},
 			CFlags:           []string{"-m32"},
 			CrossCFlags:      []string{"-m32"},
@@ -66,6 +73,7 @@ var List = map[string]map[string]*Target{
 		},
 		"arm64": {
 			PtrSize:          8,
+			PageSize:         4 << 10,
 			CArch:            []string{"__aarch64__"},
 			CCompilerPrefix:  "aarch64-linux-gnu-",
 			KernelArch:       "arm64",
@@ -73,6 +81,7 @@ var List = map[string]map[string]*Target{
 		},
 		"arm": {
 			PtrSize:          4,
+			PageSize:         4 << 10,
 			CArch:            []string{"__arm__"},
 			CFlags:           []string{"-D__LINUX_ARM_ARCH__=6", "-m32", "-D__ARM_EABI__"},
 			CrossCFlags:      []string{"-D__LINUX_ARM_ARCH__=6", "-march=armv6t2"},
@@ -82,6 +91,7 @@ var List = map[string]map[string]*Target{
 		},
 		"ppc64le": {
 			PtrSize:          8,
+			PageSize:         4 << 10,
 			CArch:            []string{"__ppc64__", "__PPC64__", "__powerpc64__"},
 			CFlags:           []string{"-D__powerpc64__"},
 			CrossCFlags:      []string{"-D__powerpc64__"},
@@ -92,37 +102,44 @@ var List = map[string]map[string]*Target{
 	},
 	"freebsd": map[string]*Target{
 		"amd64": {
-			PtrSize: 8,
-			CArch:   []string{"__x86_64__"},
-			CFlags:  []string{"-m64"},
+			PtrSize:  8,
+			PageSize: 4 << 10,
+			CArch:    []string{"__x86_64__"},
+			CFlags:   []string{"-m64"},
 		},
 	},
 	"netbsd": map[string]*Target{
 		"amd64": {
-			PtrSize: 8,
-			CArch:   []string{"__x86_64__"},
-			CFlags:  []string{"-m64"},
+			PtrSize:  8,
+			PageSize: 4 << 10,
+			CArch:    []string{"__x86_64__"},
+			CFlags:   []string{"-m64"},
 		},
 	},
 	"fuchsia": map[string]*Target{
 		"amd64": {
-			PtrSize: 8,
-			CArch:   []string{"__x86_64__"},
+			PtrSize:  8,
+			PageSize: 4 << 10,
+			CArch:    []string{"__x86_64__"},
 		},
 		"arm64": {
-			PtrSize: 8,
-			CArch:   []string{"__aarch64__"},
+			PtrSize:  8,
+			PageSize: 4 << 10,
+			CArch:    []string{"__aarch64__"},
 		},
 	},
 	"windows": map[string]*Target{
 		"amd64": {
 			PtrSize: 8,
-			CArch:   []string{"_M_X64"},
+			// TODO(dvyukov): what should we do about 4k vs 64k?
+			PageSize: 4 << 10,
+			CArch:    []string{"_M_X64"},
 		},
 	},
 	"akaros": map[string]*Target{
 		"amd64": {
 			PtrSize:           8,
+			PageSize:          4 << 10,
 			CArch:             []string{"__x86_64__"},
 			NeedSyscallDefine: dontNeedSyscallDefine,
 		},
@@ -175,6 +192,8 @@ func init() {
 			if target.NeedSyscallDefine == nil {
 				target.NeedSyscallDefine = needSyscallDefine
 			}
+			target.DataOffset = 512 << 20
+			target.NumPages = (16 << 20) / target.PageSize
 		}
 	}
 }
diff --git a/sys/test/32.go b/sys/test/32.go
index 7eb9ad351..0be1916c6 100644
--- a/sys/test/32.go
+++ b/sys/test/32.go
@@ -4,7 +4,7 @@ package test
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "test", Arch: "32", Revision: revision_32, PtrSize: 4, Syscalls: syscalls_32, Resources: resources_32, Structs: structDescs_32, Consts: consts_32}, initTarget)
+	RegisterTarget(&Target{OS: "test", Arch: "32", Revision: revision_32, PtrSize: 4, PageSize: 8192, NumPages: 2048, DataOffset: 536870912, Syscalls: syscalls_32, Resources: resources_32, Structs: structDescs_32, Consts: consts_32}, initTarget)
 }
 
 var resources_32 = []*ResourceDesc{
@@ -695,4 +695,4 @@ var consts_32 = []ConstValue{
 	{Name: "ONLY_32BITS_CONST", Value: 1},
 }
 
-const revision_32 = "229a33891b79d4c76384836d58be89caaab83684"
+const revision_32 = "6f7cae371c55b5afdfbc7f518e21c58894cfce5b"
diff --git a/sys/test/64.go b/sys/test/64.go
index 943bd9ee0..251f12a5f 100644
--- a/sys/test/64.go
+++ b/sys/test/64.go
@@ -4,7 +4,7 @@ package test
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "test", Arch: "64", Revision: revision_64, PtrSize: 8, Syscalls: syscalls_64, Resources: resources_64, Structs: structDescs_64, Consts: consts_64}, initTarget)
+	RegisterTarget(&Target{OS: "test", Arch: "64", Revision: revision_64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_64, Resources: resources_64, Structs: structDescs_64, Consts: consts_64}, initTarget)
 }
 
 var resources_64 = []*ResourceDesc{
@@ -693,4 +693,4 @@ var consts_64 = []ConstValue{
 	{Name: "IPPROTO_UDP", Value: 17},
 }
 
-const revision_64 = "72bf9b428d7ccdf1adbb2ef093b656ca3564ee14"
+const revision_64 = "e5ba3c9ee8fe997bfacae016e4bbebd8ecb2f573"
diff --git a/sys/test/init.go b/sys/test/init.go
index 860654878..5df5ba0b4 100644
--- a/sys/test/init.go
+++ b/sys/test/init.go
@@ -10,39 +10,23 @@ import (
 func initTarget(target *prog.Target) {
 	arch := &arch{
 		mmapSyscall: target.SyscallMap["mmap"],
-		pageSize:    (12 - target.PtrSize) << 10,
 	}
 
-	target.PageSize = arch.pageSize
-	target.DataOffset = 100 << 20
-	target.MmapSyscall = arch.mmapSyscall
 	target.MakeMmap = arch.makeMmap
-	target.AnalyzeMmap = arch.analyzeMmap
 }
 
 type arch struct {
 	mmapSyscall *prog.Syscall
-	pageSize    uint64
 }
 
-func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
+func (arch *arch) makeMmap(addr, size uint64) *prog.Call {
 	meta := arch.mmapSyscall
 	return &prog.Call{
 		Meta: meta,
 		Args: []prog.Arg{
-			prog.MakePointerArg(meta.Args[0], start, 0, npages, nil),
-			prog.MakeConstArg(meta.Args[1], npages*arch.pageSize),
+			prog.MakeVmaPointerArg(meta.Args[0], addr, size),
+			prog.MakeConstArg(meta.Args[1], size),
 		},
 		Ret: prog.MakeReturnArg(meta.Ret),
 	}
 }
-
-func (arch *arch) analyzeMmap(c *prog.Call) (start, npages uint64, mapped bool) {
-	switch c.Meta.Name {
-	case "mmap":
-		npages = c.Args[1].(*prog.ConstArg).Val / arch.pageSize
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		mapped = true
-	}
-	return
-}
diff --git a/sys/windows/amd64.go b/sys/windows/amd64.go
index d35f653a3..b3d2a4c16 100644
--- a/sys/windows/amd64.go
+++ b/sys/windows/amd64.go
@@ -4,7 +4,7 @@ package windows
 import . "github.com/google/syzkaller/prog"
 
 func init() {
-	RegisterTarget(&Target{OS: "windows", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
+	RegisterTarget(&Target{OS: "windows", Arch: "amd64", Revision: revision_amd64, PtrSize: 8, PageSize: 4096, NumPages: 4096, DataOffset: 536870912, Syscalls: syscalls_amd64, Resources: resources_amd64, Structs: structDescs_amd64, Consts: consts_amd64}, initTarget)
 }
 
 var resources_amd64 = []*ResourceDesc{
@@ -14612,4 +14612,4 @@ var consts_amd64 = []ConstValue{
 	{Name: "WRITE_OWNER", Value: 524288},
 }
 
-const revision_amd64 = "5d63c10c1e139f4a33dae8f94809285dae73a415"
+const revision_amd64 = "38e754fb8319bf26f8642703cab9d9acbcec5109"
diff --git a/sys/windows/init.go b/sys/windows/init.go
index 8e3761024..7729f3260 100644
--- a/sys/windows/init.go
+++ b/sys/windows/init.go
@@ -15,19 +15,9 @@ func initTarget(target *prog.Target) {
 		PAGE_EXECUTE_READWRITE: target.ConstMap["PAGE_EXECUTE_READWRITE"],
 	}
 
-	target.PageSize = pageSize
-	target.DataOffset = dataOffset
-	target.MmapSyscall = arch.virtualAllocSyscall
 	target.MakeMmap = arch.makeMmap
-	target.AnalyzeMmap = arch.analyzeMmap
 }
 
-const (
-	// TODO(dvyukov): what should we do about 4k vs 64k?
-	pageSize   = 4 << 10
-	dataOffset = 512 << 20
-)
-
 type arch struct {
 	virtualAllocSyscall *prog.Syscall
 
@@ -36,26 +26,16 @@ type arch struct {
 	PAGE_EXECUTE_READWRITE uint64
 }
 
-func (arch *arch) makeMmap(start, npages uint64) *prog.Call {
+func (arch *arch) makeMmap(addr, size uint64) *prog.Call {
 	meta := arch.virtualAllocSyscall
 	return &prog.Call{
 		Meta: meta,
 		Args: []prog.Arg{
-			prog.MakePointerArg(meta.Args[0], start, 0, npages, nil),
-			prog.MakeConstArg(meta.Args[1], npages*pageSize),
+			prog.MakeVmaPointerArg(meta.Args[0], addr, size),
+			prog.MakeConstArg(meta.Args[1], size),
 			prog.MakeConstArg(meta.Args[2], arch.MEM_COMMIT|arch.MEM_RESERVE),
 			prog.MakeConstArg(meta.Args[3], arch.PAGE_EXECUTE_READWRITE),
 		},
 		Ret: prog.MakeReturnArg(meta.Ret),
 	}
 }
-
-func (arch *arch) analyzeMmap(c *prog.Call) (start, npages uint64, mapped bool) {
-	switch c.Meta.Name {
-	case "VirtualAlloc":
-		npages = c.Args[1].(*prog.ConstArg).Val / pageSize
-		start = c.Args[0].(*prog.PointerArg).PageIndex
-		mapped = true
-	}
-	return
-}