| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
The PowerISA 3.1 architecture (POWER10 CPU) added new "prefixed"
instruction format so from now on instructions are either 4 or 8 bytes
long.
This adds those new prefixed instructions to the fuzzer.
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The existing instruction list is generated by a script which parsed
the output of pdftotext which produced less than a perfect result.
There is ongoing effort to have the instruction set specification in
a machine readable format (latex) which this uses to fix errors.
As the new spec is a newer PowerISA 3.1 (POWER10) which removed
transactional memory instructions and added some new instructions,
this change is reflected here.
This fixes randomization of paired paramemers (pair of registers
for quadword instructions) to not generate odd (==incorrect) numbers.
This includes the new conversion script.
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
| |
|
|
|
|
|
|
|
|
|
| |
This adds xxxOpcode helpers which produce valid opcodes for Encode()
(external ifuzz API) and enc() (pseudo instruction fuzzer) from
passed opcode/mask/bits. This is going to be needed for prefixes
in prefixed instruction (the following patch adds such support).
This should not cause behavioral change.
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Instruction descriptions use maps to describe instruction operands which
works fine but due to the Go's unordered map implementation,
the determination test fails as per
https://github.com/google/syzkaller/issues/2790
Since there is no appalling reason why it should be a map, this converts
maps to slices.
As this changes every single instruction, use the opportunity and sort
the instructions by mnemonic to make further updates easier to follow.
Neigher change should not cause any change in behavior.
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
| |
|
|
|
|
|
|
|
|
|
| |
There are only 2 instructions - tlbie and tlbiel (TLB invalidation) -
which are marked 64bit only and there is no obvious reason why they
would not work in the 32bit mode - they seem working but even if they
did not, making a special case just for these two is overkill.
This ditches the M64 flag.
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The PowerISA pdf parser made several wrong assumptions about the format
("copy"/"paste."/...) and missed that some fields are split and have
reverse order ("rldicr" and similar). Another problem with parsing
2 column page layout.
This makes powerpc.Insn.Fields value type from tuple to an array of
tuples and fixes encodeBits() accordingly.
This fixes powerisa30_to_syz to store all the bits and split "MB"/"ME"
in 2 halves sorted in the way encodeBits() loops.
This should not change the coverage dramatically but this improves
pseudo instructions as "rldicr" is used to preload registers although
no huge difference expected there either as the problem was with top
32bits and hypercall/rtastoken numbers are 16bit anyway.
While at this, this fixes powerisa30_to_syz to make "make generate" not
change insns.go. This also drops comments from the generated file as are
proven to be useless and just increase lengths of already long lines
(vim hates it).
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
| |
|
|
|
|
|
|
|
|
|
|
| |
The instructions are made of opcode (split in 1..3 groups of fields) and
parameters (immediate values, register numbers, flags). The insns.go is
expected to have all the bits covered but some bits might be missing which
this randomizes.
This adds preloading of "RS" for better fuzzing of "mtmsr(d)"
instructions ("Move To Machine State Register (Doubleword)").
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
RunTime Abstraction Services (RTAS) is an API used by the Linux
powerpc/pseries platform to talk to the hypervisor. Under KVM, this
is implemented as a custom hypercall (which we have support for) and
an in memory array of parameters. The hypercall is H_RTAS and its only
parameter is a pointer to the mentioned array. The vast majority of
RTAS calls are handled normally by QEMU and only a handful by KVM.
This adds fuzzing of 4 RTAS calls. This uses a chunk from main 256MB RAM
for parameters. The parameters are big endian hence "<<24" for the token.
To allow more targeted fuzzing, use iset.GenerateInt().
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
| |
|
|
|
|
|
|
|
| |
In order to keep all macro instruction helpers together, his moves
the "sc" helper to the instruction set next to ld64().
This should not cause any behavioral change.
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
GenerateInt() generates sort of random numbers for instruction fuzzer
with focus on corner cases, let's use it for POWERPC too.
Since we want memory access instruction to try these addresses, we preload
generated values in GPRs used by just generated instruction.
This in turn requires Insn::Encode() access for the instruction map to
encode load instructions so this moves ld64() from the generator to
insnSetMap and adds Insn::insnMap. This adds enc() to encode just
the instruction without any randomization.
This does not add additional instructions if cfg.MemRegions is empty so
the ifuzz_test.go test still passes.
Since EncodeParam() is not used by anything but Encode(), this open codes
it.
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
| |
|
|
|
|
|
| |
This is used in a few places already and more are coming, make it
a struct for better readability.
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
| |
|
|
|
|
|
|
|
| |
ifuzzimpl is too lenghty and too clumsy on my taste
(nm/vmimpl worked better b/c it's shorter and used less).
I've tried to come up with something shorter and nicer.
We could use "insn" as a common name for "instruction" in ifuzz,
but it's a commonly used name already so would cause lots of conflicts.
"iset" is somewhat descriptive, short and nice.
|
| |
|
|
|
| |
It's currently duplicated in x86 and powerpc.
Move to ifuzzimpl.
|
| |
|
|
| |
x86.InsnSetX86 is excessive. Everything in x86 package is x86-ish already.
|
| |
|
|
|
| |
We don't need GetMode, GetPriv, IsCompatible in Insn interface.
Replace GetName and GetPseudo with single Info method.
|
| |
|
|
|
|
|
|
|
| |
ifuzzimpl imports the public interface package ifuzz
and prog package needs to import ifuzzimpl (implementation guts that
nobody outside of ifuzz should care about). This is not right.
Invert everything so that prog package only needs to import ifuzz
and ifuzz imports ifuzzimpl.
|
|
|
This adds KVM's syz_kvm_setup_cpu pseudo syscall. This adds placeholder
for options (none implemented yet).
This adds instruction generator for ifuzz; this also adds a few pseudo
instructions to simulate super/hyper/ultracalls
(a PPC64/pseries platform thing).
The insns.go is generated from PowerISA_public.v3.0B.pdf [1] by
a horrendous python3 script on top of pdftotext. The ISA covers POWER9
which is the latest available POWER CPU at the moment. The next ISA
for POWER10 is quite different and we will deal with it later.
The // comment after every instruction is a fixed opcode list for
verification purposes.
This does not define DecodeExt as there is no obvious replacement of
the Intel XED library for POWERPC (gapstone-capstone, later, may be).
[1] https://openpowerfoundation.org/?resource_lib=power-isa-version-3-0
Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
|
