| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
|
|
|
|
|
| |
Large overhaul moves syscalls and arg types from sys to prog.
Sys package now depends on prog and contains only generated
descriptions of syscalls.
Introduce prog.Target type that encapsulates all targer properties,
like syscall list, ptr/page size, etc. Also moves OS-dependent pieces
like mmap call generation from prog to sys.
Update #191
|
| |
|
|
|
| |
In preparation for moving sys types to prog
to avoid confusion between sys.Call and prog.Call.
|
| | |
|
| |
|
|
|
|
|
|
| |
That's the condition we always want.
Currently we always check:
t.BitfieldOffset() == 0 || t.BitfieldLast()
now can check just:
!t.BitfieldMiddle()
|
| | |
|
| |
|
|
| |
This makes types constant during execution, everything is precomputed.
|
| | |
|
| |
|
|
|
| |
Use explicit size for vma.
This is the last use of hardcoded ptrSize in sys package.
|
| |
|
|
| |
This is required to support ptr64 type.
|
| |
|
|
|
|
| |
Move most of the logic from sysgen to pkg/compiler.
Update #217
|
| |
|
|
|
| |
Export struct/union attributes so that they can be filled in
by a different package.
|
| |
|
|
| |
Update #191
|
| |
|
|
|
|
|
| |
Not tested, but const extraction and build works.
Update #324
Update #191
|
| |
|
|
|
|
|
|
|
|
| |
We currently use uintptr for all values.
This won't work for 32-bit archs.
Moreover in some cases we use uintptr but assume
that it is always 64-bits (e.g. in encodingexec).
Switch everything to uint64.
Update #324
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
| |
Compilation of large maps is super slow.
Generate arrays instead and converet to maps at runtime.
Reduces build time from ~40s to ~2s.
Update #182
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Mark tests as parallel where makes sense.
Speed up sys.TransitivelyEnabledCalls.
Execution time is now:
ok github.com/google/syzkaller/config 0.172s
ok github.com/google/syzkaller/cover 0.060s
ok github.com/google/syzkaller/csource 3.081s
ok github.com/google/syzkaller/db 0.395s
ok github.com/google/syzkaller/executor 0.060s
ok github.com/google/syzkaller/fileutil 0.106s
ok github.com/google/syzkaller/host 1.530s
ok github.com/google/syzkaller/ifuzz 0.491s
ok github.com/google/syzkaller/ipc 1.374s
ok github.com/google/syzkaller/log 0.014s
ok github.com/google/syzkaller/prog 2.604s
ok github.com/google/syzkaller/report 0.045s
ok github.com/google/syzkaller/symbolizer 0.062s
ok github.com/google/syzkaller/sys 0.365s
ok github.com/google/syzkaller/syz-dash 0.014s
ok github.com/google/syzkaller/syz-hub/state 0.427s
ok github.com/google/syzkaller/vm 0.052s
However, main time is still taken by rebuilding sys package.
Fixes #182
|
| |
|
|
|
|
| |
Also generalize checksums into the two kinds: inet and pseudo.
Inet checksums is just the Internet checksum of a packet.
Pseudo checksum is the Internet checksum of a packet with a pseudo header.
|
| | |
|
| | |
|
| |
|
|
| |
Also embed tcp checksums into packets.
|
| |
|
|
|
|
|
|
|
|
|
| |
Currently syzkaller uses per-call basic block (BB) coverage.
This change implements edge (not-per-call) coverage.
Edge coverage is more detailed than BB coverage as it captures
not-taken branches, looping, etc. So it provides better feedback signal.
This coverage is now called "signal" throughout the code.
BB code coverage is also collected as it is required for visualisation.
Not doing per-call coverage reduces corpus ~6-7x (from ~35K to ~5K),
this has profound effect on fuzzing efficiency.
|
| |
|
|
|
|
|
| |
This change adds a `csum[kind, type]` type.
The only available kind right now is `ipv4`.
Using `csum[ipv4, int16be]` in `ipv4_header` makes syzkaller calculate
and embed correct checksums into ipv4 packets.
|
| |
|
|
|
| |
FieldName() is the name of the struct field or union option with this type.
TypeName() is now always the name of the type.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
Now it's possible to use `int32:18` to denote a bitfield of size 18 as a struct field.
This fixes #72.
|
| |
|
|
|
|
|
| |
1. Basic support for arm64 kvm testing.
2. Fix compiler warnings in x86 kvm code.
3. Test all pseudo syz calls in csource.
4. Fix handling of real code in x86.
|
| |
|
|
|
|
| |
Add new pseudo syscall syz_kvm_setup_cpu that setups VCPU into
interesting states for execution. KVM is too difficult to setup otherwise.
Lots of improvements possible, but this is a starting point.
|
| |
|
|
|
|
|
|
|
|
| |
Currently we always enable clock_gettime in config.
This is required since the call is needed for generation of timespec/timeval structs.
The negative side effect is that one gets clock_gettime even
if he wants to fuzz a small set of unrelated syscalls.
Don't enable clock_gettime by default.
Instead handle timeval/timespec as other resources.
|
| |
|
|
| |
Allows to write vma[4] or vma[5-10] to specify desired number of pages.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
| |
This allows to write:
string[salg_type, 14]
which will give a string buffer of size 14 regardless of actual string size.
Convert salg_type/salg_name to this.
|
| |
|
|
|
|
|
|
|
|
| |
Allow to define string flags in txt descriptions. E.g.:
filesystem = "ext2", "ext3", "ext4"
and then use it in string type:
ptr[in, string[filesystem]]
|
| |
|
|
|
| |
FileoffType is effectively an int, no need for a separate type.
Also remove fd option from fileoff as it is unused and use story is unclear.
|
| |
|
|
| |
FilenameType is effectively a buffer, there is no need for a separate type.
|
| |
|
|
|
| |
They are not necessary since we now always have types attached to args.
Also remove sys.Type.InnerType as it is not necessary now as well.
|
| |
|
|
|
|
| |
Dir is a static info, so we don't need to compute, propagate and
attach it in prog whenever we generate/change programs.
Attach Dir to all types.
|
| |
|
|
|
|
|
|
| |
Currently we store most types by value in sys.Type.
This is somewhat counter-intuitive for C++ programmers,
because one can't easily update the type object.
Store pointers to type objects for all types.
It also makes it easier to update types, e.g. adding paddings.
|
| |
|
|
|
|
|
|
|
|
| |
The current code is probably a leftover from times when
StrConstType itself implied an indirection (it was a pointer to the string).
Now strconst it is lowered to PtrType[StrConstType],
so its size is len of the string and align is 1.
It is not possible to test it now, as it is always used with indirection,
so static size and align do not affect struct layout.
|
| | |
|
| | |
|