aboutsummaryrefslogtreecommitdiffstats
path: root/docs/syscall_descriptions_syntax.md
Commit message (Collapse)AuthorAgeFilesLines
* prog: support snapshot-only callsDmitry Vyukov2026-01-021-3/+7
| | | | Update #5308
* kfuzztest: introduce syz_kfuzztest_run pseudo-syscallEthan Graham2025-09-221-0/+1
| | | | | | | | | | | | | Add syz_kfuzztest_run pseudo-syscall, KFuzzTest attribute, and encoding logic. KFuzzTest targets, which are invoked in the executor with the new syz_kfuzztest_run pseudo-syscall, require specialized encoding. To differentiate KFuzzTest calls from standard syzkaller calls, we introduce a new attribute called KFuzzTest or "kfuzz_test" in syzkaller descriptions that can be used to annotate calls. Signed-off-by: Ethan Graham <ethangraham@google.com>
* prog: pkg/compiler: docs: introduce the `no_squash` attributeAlexander Potapenko2025-09-091-0/+3
| | | | | | | | | | | | | | | | | The `no_squash` per-syscall attribute prevents the fuzzer from generating squashed arguments to a particular syscall. This is particularly helpful for pseudo-syscalls with elaborate arguments that are hard to reason about when they are squashed - e.g. for syz_kvm_add_vcpu() that takes a SYZOS program as an input. I've considered an alternative solution that prohibits ANY for all pseudo-syscalls. But there is a bunch of existing programs (both the tests and the repros) for syscalls like syz_mount_image() for which the benefit of not passing ANY is not immediately obvious. I therefore decided to go with an explicit attribute that can later be enforced for every pseudo-syscall at compile time.
* docs: fix misspellingsTaras Madan2025-08-191-1/+1
| | | | Gemini CLI experiments side effect.
* docs/syscall_descriptions_syntax.md: short change description许佳凯2025-03-051-6/+18
|
* prog: annotate image assets with fsck logsFlorent Revest2024-12-091-1/+4
| | | | | | | | | | | | | | | | | | Syscall attributes are extended with a fsck command field which lets file system mount definitions specify a fsck-like command to run. This is required because all file systems have a custom fsck command invokation style. When uploading a compressed image asset to the dashboard, syz-manager also runs the fsck command and logs its output over the dashapi. The dashboard logs these fsck logs into the database. This has been requested by fs maintainer Ted Tso who would like to quickly understand whether a filesystem is corrupted or not before looking at a reproducer in more details. Ultimately, this could be used as an early triage sign to determine whether a bug is obviously critical.
* all: support || operator in syzlang if conditionJiao, Joey2024-11-131-1/+2
| | | | | | | | | | | ex. f3 field has logic or operator in if condition: conditional_struct { mask int32 f1 field1 (if[value[mask] & FIELD_FLAG1]) f2 int64 (if[value[mask] & FIELD_FLAG2]) f3 int64 (if[value[mask] == FIELD_FLAG1 || value[mask] == FIELD_FLAG2]) } [packed]
* docs: fix 'fmt' description regarding 'const' typeIgor Chervatyuk2024-07-081-1/+1
| | | | Fixed 'fmt' documentation description at docs/syscall_descriptions_syntax.md.
* docs/syscall_descriptions_syntax.md: remove a redundant square bracketQGrain2024-06-171-1/+1
| | | | Remove a redundant square bracket in section "Expression syntax".
* docs: remove mentions of strconstDmitry Vyukov2024-06-111-1/+1
| | | | strconst["foo"] was replaced by ptr[in, string["foo"]].
* prog: introduce a remote_cover call attributeAleksandr Nogikh2024-05-271-0/+1
| | | | | | Update the descriptions to mark calls that cause remote coverage collection. Remote some hacky code from the executor.
* docs: describe conditional fieldsAleksandr Nogikh2024-02-191-3/+188
|
* docs: update syntax for new int type-optionsPaul Chaignon2023-11-281-2/+10
| | | | Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
* prog, pkg/compiler: add `BufferCompressed` buffer type & `compressed_image` ↵Hrutvik Kanabar2022-11-211-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | builtin Create the `BufferCompressed` kind of `BufferType`, which will be used to represent compressed data. Create the corresponding `compressed_image` syzlang builtin, which is backed by `BufferCompressed`. For now, no syscalls use this feature - this will be introduced in future commits. We have to be careful to decompress the data before mutating, and re-compress before storing. We make sure that any deserialised `BufferCompressed` data is valid too. `BufferCompressed` arguments are mutated using a generic heatmap. In future, we could add variants of `BufferCompressed` or populate the `BufferType` sub-kind, using it to choose different kinds of heatmap for different uncompressed data formats. Various operations on compressed data must be forbidden, so we check for `BufferCompressed` in key places. We also have to ensure `compressed_image` can only be used in syscalls that are marked `no_{generate,minimize}`. Therefore, we add a generic compiler check which allows type descriptions to require attributes on the syscalls which use them.
* prog: add an attribute for syscalls which should not be minimizedHrutvik Kanabar2022-09-221-0/+1
| | | | | | | | | | Create a `no_minimize` attribute to be used with syscalls that `syzkaller` should not try to modify when minimizing a program that produces a bug. The intention is to use this with syscalls that are expensive to minimize, such as `syz_mount_image`. Currently there are no `no_minimize` syscalls, but the next commit will add some.
* prog: add an attribute for syscalls which should not be generatedHrutvik Kanabar2022-09-221-0/+1
| | | | | | | | | | | | | | Create a `no_generate` attribute to be used with syscalls that `syzkaller` should not try to generate from scratch. In other words, `syzkaller` will only use seeds of this call. This will be useful for syscalls which are unlikely to be correctly generated. In particular, prevent these syscalls from being included in the choice table or from being considered as possible resource constructors. Also add a test which will attempt to generate programs with a bias towards `no_generate` syscalls, and flag up any that make it into result programs. Currently there are no `no_generate` syscalls, but the next commit will add some.
* docs: fix syntaxyuawn2022-08-171-1/+1
|
* pkg/ast, pkg/compiler: support per-file metadataDmitry Vyukov2022-04-291-0/+16
| | | | | | | | | | | | | | | | | | | | | We have a bunch of hacks in syz-extract, syz-sysgen and syz-check with respect to description files unsupported on some arches, or that must not be part of make extract. Add 2 meta attribtues to files: meta noextract Tells `make extract` to not extract constants for this file. Though, `syz-extract` can still be invoked manually on this file. meta arches["arch1", "arch2"] Restricts this file only to the given set of architectures. `make extract` and ``make generate` will not use it on other architectures. Later we can potentially use meta attributes to specify git tree/commit that must be used for extraction. Maybe something else. Fixes #2754
* pkg/compiler: require stricter resource constructorsDmitry Vyukov2022-01-111-0/+4
| | | | | | | | | | | | | Don't consider syscalls that return resources in unions/arrays as constructors. Unions and arrays are problematic because we don't have directed generation in prog.randGen.createResource() and can fail to generate a syscall that returns a particular resource (generate a wrong union option that does not contain the necessary resource). This leads to the following panics: panic: failed to create a resource ifindex with ioctl$sock_SIOCGIFCONF Require each resource to have a constructor syscall that returns the resource outside of unions/arrays.
* pkg/compiler: prohibit use of direction attribute on union fieldsDmitry Vyukov2022-01-111-3/+1
| | | | | | Direction attributes on unions work in a confusing way and don't do what users may think they do. Now we have out_overlay attribute for structs that allows to have overlapping input and output fields.
* pkg/compiler: add out_overlay field attributeDmitry Vyukov2022-01-111-2/+25
|
* all: support exclude globs in descriptorJoey Jiao2021-06-021-1/+2
|
* all: minor glob fixesDmitry Vyukov2021-05-261-2/+3
|
* pkg/compiler: add glob typeJoey Jiaojg2021-05-261-1/+3
| | | | | | | | | | | | | | | | | | | | * all: add new typename dirname The current way to check files under sysfs or proc is: - define a string to represent each file - open the file - pass the fd to write / read / close The issues above are: - Need to know what file present on target device - Need to write openat for each file With dirname added, which will open one file in the directory randomly and then pass the fd to write/read/close. * all: use typename glob to match filename Fixes #481
* tools/check-whitespace.sh: check for trailing whitespacesDmitry Vyukov2020-09-141-1/+1
| | | | | | File types that we don't format automatically can end up with such basic untidiness as trailing whitespaces. Check for these. Remove all existing precedents.
* pkg, prog: add per-field direction attributeNecip Fazil Yildiran2020-08-131-2/+24
|
* docs: add explanation of flags typeDmitry Vyukov2020-07-091-1/+3
| | | | | * docs: add explanation of flags type * Apply suggestions from code review Co-authored-by: Marco Elver <marco.elver@gmail.com>
* Update syscall_descriptions_syntax.mdAndrey Konovalov2020-06-101-4/+4
|
* docs: suggested changes for pull-request 1797Ricardo Cañuelo2020-06-081-19/+8
| | | | https://github.com/google/syzkaller/pull/1797
* docs: more info about resources and the "enable_sysaclls" config optionRicardo Cañuelo2020-06-081-1/+32
| | | | | | | - Give some extra clarifications and examples about resources in syscall descriptions. - More details about how to use the "enable_syscalls" option. - Mention pseudo-syscalls in the general syscall description doc file.
* docs: clarify struct/union attributes in syzlangDmitry Vyukov2020-04-281-9/+5
|
* prog: add ignore_return and breaks_returns call attribtuesDmitry Vyukov2020-04-191-2/+6
| | | | | We had these hard-coded for fuchsia and linux accordingly. Replace with call attributes.
* sys/linux: add timeout call attributesDmitry Vyukov2020-04-191-1/+10
| | | | | | | Move additional call/prog timeouts to descriptions. Due to this logic duplication executor used 50ms for syz_mount_image, while pkg/csource used 100ms.
* pkg/compiler: refactor attribute handlingDmitry Vyukov2020-04-191-3/+3
| | | | | | | | | | | | Introduce common infrastructure for describing and parsing attribute instead of custom per-attribute code scattered across several locations. Change align attribute syntax from the weird align_N to align[N]. This also allows to use literal constants as N. Introduce notion of builtin constants. Currently we have only PTR_SIZE, which is needed to replace align_ptr with align[PTR_SIZE].
* docs: minor formatting in syscall_descriptions_syntax.mdDmitry Vyukov2020-02-161-1/+2
|
* pkg/ast: introduce hex-encoded string literalsDmitry Vyukov2020-02-101-4/+2
| | | | | | | | | | | | | The stringnozescapes does not make sense with filename, also we may need similar escaping for string flags. Handle escaped strings on ast level instead. This avoids introducing new type and works seamleassly with flags. As alternative I've also tried using strconv.Quote/Unquote but it leads to ugly half-escaped strings: "\xb0\x80s\xe8\xd4N\x91\xe3ڒ,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn" Make hex-encoded strings a separate string format instead.
* pkg/compiler: allow for escaped stringsJason A. Donenfeld2020-02-101-0/+2
| | | | | This adds stringnozescapes to allow parsing of escape sequences in strings.
* README: add proper syzkaller pronunciationDmitry Vyukov2020-02-011-1/+1
| | | | On popular request...
* docs: give syscall description language a nameDmitry Vyukov2020-02-011-1/+1
| | | | | | It is a real language. We have a real compiler. It deserves a name. Also useful for shorter references. I hereby give it a name: syzlang.
* pkg/compiler: define fileoff templatePaul Chaignon2019-11-011-1/+2
| | | | Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
* prog, pkg/compiler: alignment for integer rangesPaul Chaignon2019-10-251-3/+5
| | | | | | | | | Enables the syntax intN[start:end, alignment] for integer ranges. For instance, int32[0:10, 2] represents even 32-bit numbers between 0 and 10 included. With this change, two NEED tags in syscall descriptions can be addressed. Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
* docs: fix description of ptr typeDmitry Vyukov2019-07-221-2/+2
| | | | ptr has direction as the first argument.
* pkg/compiler: add offsetof typeDmitry Vyukov2019-05-161-0/+2
| | | | | | Similar to C offsetof gives offset of a field from the beginning of the parent struct. We have several TODOs in descriptions asking for this.
* pkg/compiler: allow to refer to syscall arguments in len pathsDmitry Vyukov2019-05-141-4/+10
| | | | This allows to use len[syscall:arg] expressions.
* pkg/compiler: support complex len targetsDmitry Vyukov2019-05-141-7/+40
| | | | | | | | | | This change adds compiler support for complex path expressions in len targets. E.g. it allows to refer to a sibling field as len[parent_struct:field:another_field]. See the docs change for details. This is just a compiler change. The feature is not yet supported by the prog package.
* Fixed a tiny typo (#1114)Yu Hao2019-04-051-1/+1
|
* pkg/compiler: make buffer alias to ptr[array[int8]]Dmitry Vyukov2019-04-011-3/+3
| | | | | | | | | | | Ptr type has special handling of direction (pointers are always input). But buffer type missed this special case all the time. Make buffer less special by aliasing to the ptr[array[int8]] type. As the result buffer type can't have optional trailing "opt" attribute because we don't have such support for templates yet. Change such cases to use ptr type directly. Fixes #1097
* docs/syscall_descriptions_syntax.md: update syntax about unionhoujingyi2019-01-171-6/+8
| | | | | | | | * Update syscall_descriptions_syntax.md * Update syscall_descriptions_syntax.md * Update syscall_descriptions_syntax.md
* Fixed a tiny typoSergey Koulikov2018-11-201-1/+1
|
* pkg/compiler: add vma64 typeDmitry Vyukov2018-11-171-1/+2
| | | | 8-byte vma is needed in several places in linux descriptions.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 00:24:56 +0000