| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | sys/syz-sysgen: from from sysgen | Dmitry Vyukov | 2017-06-17 | 2 | -990/+0 |
| | | |||||
| * | sys/sysparser: move from sysparser | Dmitry Vyukov | 2017-06-17 | 2 | -2/+2 |
| | | |||||
| * | executor: fix clang-tidy warnings | Dmitry Vyukov | 2017-06-13 | 1 | -1/+1 |
| | | | | | | A single check is enabled for now (misc-definitions-in-headers). But it's always fixable and found 2 bugs in csource. | ||||
| * | sys: check in generated files | Dmitry Vyukov | 2017-06-13 | 1 | -1/+7 |
| | | | | | | | | | | | | | | | | | | | We used to have all generated files checked in. Later we removed them (now users are supposed to run make to generate them). This causes several problems: - go get does not work as it tries to build everything straight away (go get -d works, but users are confused) - users don't run make and complain that build is broken - users don't re-run make after updates and complain that build is broken - hard to integrate into other build system (even if they support building Go, they don't support running sysgen out-of-the-box) Fixes #216 | ||||
| * | csource: don't generate execute_syscall calls | Andrey Konovalov | 2017-06-12 | 1 | -1/+5 |
| | | |||||
| * | sysgen: speed up | Dmitry Vyukov | 2017-05-29 | 1 | -9/+19 |
| | | | | | | Formatting generated sources takes tremendous amount of time (6s). Leave them unformatted. Reduces sysgen time to virtually 0. | ||||
| * | sysgen: don't touch output file if contents has not changed | Dmitry Vyukov | 2017-05-29 | 1 | -5/+45 |
| | | | | | Helps with build artifact caching. | ||||
| * | sys: generate arrays instead of maps | Dmitry Vyukov | 2017-05-29 | 1 | -29/+22 |
| | | | | | | | | | Compilation of large maps is super slow. Generate arrays instead and converet to maps at runtime. Reduces build time from ~40s to ~2s. Update #182 | ||||
| * | sys, executor: extract tcp sequence numbers from /dev/net/tun | Andrey Konovalov | 2017-05-26 | 1 | -7/+8 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds a new pseudo syscall syz_extract_tcp_res, that reads a packet from /dev/net/tun and extracts tcp sequence numbers to be used in subsequent packets. As a result this syzkaller program: mmap(&(0x7f0000000000/0x10000)=nil, (0x10000), 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000001000)={0x2, 0x0, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) listen(r0, 0x5) syz_emit_ethernet(0x36, &(0x7f0000002000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x0}, @random="4c6112cc15d8", [], {{0x800, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}, @local={0xac, 0x14, 0x0, 0xaa}, {[]}}, @tcp={{0x1, 0x0, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0x0, {[]}}, {""}}}}}}) syz_extract_tcp_res(&(0x7f0000003000)={<r1=>0x42424242, <r2=>0x42424242}, 0x1, 0x0) syz_emit_ethernet(0x38, &(0x7f0000004000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x0}, @remote={[0xbb, 0xbb, 0xbb, 0xbb, 0xbb], 0x0}, [], {{0x800, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x2a, 0x0, 0x0, 0x0, 0x6, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}, @local={0xac, 0x14, 0x0, 0xaa}, {[]}}, @tcp={{0x1, 0x0, r2, r1, 0x0, 0x0, 0x5, 0x10, 0x0, 0x0, 0x0, {[]}}, {"0c10"}}}}}}) r3 = accept$inet(r0, &(0x7f0000005000)={0x0, 0x0, @multicast1=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000006000)=0x10) established a TCP connection: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:20000 0.0.0.0:* LISTEN 5477/a.out tcp 2 0 172.20.0.170:20000 172.20.0.187:20001 ESTABLISHED 5477/a.out Similar program for IPv6: mmap(&(0x7f0000000000/0x10000)=nil, (0x10000), 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x1, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c) listen(r0, 0x5) syz_emit_ethernet(0x4a, &(0x7f0000001000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x0}, @random="de895db1468d", [], {{0x86dd, @ipv6={0x0, 0x6, "a228af", 0x14, 0x6, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, {[], @tcp={{0x0, 0x1, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0x0, {[]}}, {""}}}}}}}) syz_extract_tcp_res(&(0x7f0000002000)={<r1=>0x42424242, <r2=>0x42424242}, 0x1, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000003000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x0}, @random="de895db1468d", [], {{0x86dd, @ipv6={0x0, 0x6, "a228af", 0x14, 0x6, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, {[], @tcp={{0x0, 0x1, r2, r1, 0x0, 0x0, 0x5, 0x10, 0x0, 0x0, 0x0, {[]}}, {""}}}}}}}) r3 = accept$inet6(r0, &(0x7f0000004000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000005000)=0x1c) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp6 0 0 :::20001 :::* LISTEN 5527/a.out tcp6 0 0 fe80::aa:20001 fe80::bb:20000 ESTABLISHED 5527/a.out | ||||
| * | sysgen: always check dir when generating an argument | Andrey Konovalov | 2017-04-08 | 1 | -0/+1 |
| | | |||||
| * | prog, sys: add icmpv6 packet descriptions and checksums | Andrey Konovalov | 2017-02-08 | 1 | -9/+21 |
| | | | | | | | Also generalize checksums into the two kinds: inet and pseudo. Inet checksums is just the Internet checksum of a packet. Pseudo checksum is the Internet checksum of a packet with a pseudo header. | ||||
| * | prog, sys: add icmp descriptions and checksum | Andrey Konovalov | 2017-02-06 | 1 | -2/+2 |
| | | |||||
| * | prog, sys: add udp description and checksum | Andrey Konovalov | 2017-02-02 | 1 | -0/+2 |
| | | |||||
| * | prog, sys: add tcp packets descriptions | Andrey Konovalov | 2017-01-30 | 1 | -0/+2 |
| | | | | | Also embed tcp checksums into packets. | ||||
| * | sys: improve ipc descriptions | Dmitry Vyukov | 2017-01-28 | 1 | -2/+2 |
| | | |||||
| * | prog, sys: add csum type, embed checksums for ipv4 packets | Andrey Konovalov | 2017-01-25 | 1 | -0/+13 |
| | | | | | | | | This change adds a `csum[kind, type]` type. The only available kind right now is `ipv4`. Using `csum[ipv4, int16be]` in `ipv4_header` makes syzkaller calculate and embed correct checksums into ipv4 packets. | ||||
| * | prog: add FieldName to Type | Andrey Konovalov | 2017-01-23 | 1 | -7/+3 |
| | | | | | | FieldName() is the name of the struct field or union option with this type. TypeName() is now always the name of the type. | ||||
| * | prog: fix bytesizeN for nonarray fields | Andrey Konovalov | 2017-01-19 | 1 | -1/+1 |
| | | |||||
| * | prog, sys: fix padding varlen structs | Andrey Konovalov | 2017-01-19 | 1 | -1/+9 |
| | | |||||
| * | sys: don't imply pointer indirection for filename type | Dmitry Vyukov | 2017-01-18 | 1 | -5/+1 |
| | | | | | | | | | Change all 'filename' to 'ptr[in, filename]' and don't imply pointer indirection for filename type. This is necessary because in some bases we want to embed filename directly into a struct (e.g. unix sock addr). Similar change was already done for string type for similar reasons. Generally, we want to imply as less as possible. NOTE: IF YOU HAVE PRIVATE DESCRIPTIONS, YOU NEED TO DO THE SAME REPLACEMENT. | ||||
| * | prog: mutate sized strings with respect to size | Andrey Konovalov | 2017-01-18 | 1 | -2/+2 |
| | | |||||
| * | prog: fix Size() for unions args | Andrey Konovalov | 2017-01-18 | 1 | -1/+1 |
| | | |||||
| * | prog: add bitfields to templates | Andrey Konovalov | 2017-01-17 | 1 | -27/+57 |
| | | | | | | | Now it's possible to use `int32:18` to denote a bitfield of size 18 as a struct field. This fixes #72. | ||||
| * | sys, executor: more kvm improvements | Dmitry Vyukov | 2017-01-12 | 1 | -1/+1 |
| | | | | | | | | 1. Basic support for arm64 kvm testing. 2. Fix compiler warnings in x86 kvm code. 3. Test all pseudo syz calls in csource. 4. Fix handling of real code in x86. | ||||
| * | sys: extend kvm support | Dmitry Vyukov | 2017-01-09 | 2 | -0/+13 |
| | | | | | | | Add new pseudo syscall syz_kvm_setup_cpu that setups VCPU into interesting states for execution. KVM is too difficult to setup otherwise. Lots of improvements possible, but this is a starting point. | ||||
| * | sys: allow to specify number of pages for vma type | Dmitry Vyukov | 2017-01-09 | 1 | -3/+8 |
| | | | | | Allows to write vma[4] or vma[5-10] to specify desired number of pages. | ||||
| * | prog: add bytesizeN types | Andrey Konovalov | 2016-12-20 | 1 | -2/+19 |
| | | |||||
| * | executor: use different address for our network card | Dmitry Vyukov | 2016-12-06 | 1 | -1/+2 |
| | | | | | | IP addresses like 192.168.0.1/192.168.1.1 are often used for routing between VM and the host. Offset our IP addresses to start from 192.168.218.0 to reduce potential conflicts. | ||||
| * | executor: emit ethernet traffic | Andrey Konovalov | 2016-11-29 | 1 | -0/+1 |
| | | |||||
| * | sys: move sockaddr description to templates | Andrey Konovalov | 2016-11-29 | 1 | -5/+0 |
| | | |||||
| * | sys: move in_addr description to templates | Andrey Konovalov | 2016-11-29 | 1 | -5/+0 |
| | | |||||
| * | ipc, prog, sysgen: format code | Dmitry Vyukov | 2016-11-25 | 1 | -1/+1 |
| | | |||||
| * | sys: add proc type to denote per proccess integers | Andrey Konovalov | 2016-11-25 | 1 | -5/+38 |
| | | |||||
| * | sysgen: reduce compilation time and memory consumption | Dmitry Vyukov | 2016-11-15 | 1 | -2/+2 |
| | | | | | | | Go compiler does not seem to like long generated functions. This change reduces compilation time of sys_arch.go, reduces compiler memory consumption and fixes compiler crash on arm64. | ||||
| * | sys: allow to specify buffer size for strings | Dmitry Vyukov | 2016-11-11 | 1 | -6/+27 |
| | | | | | | | | | This allows to write: string[salg_type, 14] which will give a string buffer of size 14 regardless of actual string size. Convert salg_type/salg_name to this. | ||||
| * | sys: add string flags | Dmitry Vyukov | 2016-11-11 | 1 | -20/+19 |
| | | | | | | | | | | | Allow to define string flags in txt descriptions. E.g.: filesystem = "ext2", "ext3", "ext4" and then use it in string type: ptr[in, string[filesystem]] | ||||
| * | sys: don't imply pointer indirection for string arguments | Dmitry Vyukov | 2016-11-11 | 1 | -5/+1 |
| | | | | | | In preparation for extending string functionality and to make it less magical. | ||||
| * | sys: replace FileoffType with IntType{Kind: IntFileoff} | Dmitry Vyukov | 2016-11-11 | 1 | -4/+4 |
| | | | | | | FileoffType is effectively an int, no need for a separate type. Also remove fd option from fileoff as it is unused and use story is unclear. | ||||
| * | sys: replace FilenameType with BufferType{Kind: BufferFilename} | Dmitry Vyukov | 2016-11-11 | 1 | -1/+1 |
| | | | | | FilenameType is effectively a buffer, there is no need for a separate type. | ||||
| * | sys: attach Dir to all types | Dmitry Vyukov | 2016-11-11 | 1 | -38/+51 |
| | | | | | | | Dir is a static info, so we don't need to compute, propagate and attach it in prog whenever we generate/change programs. Attach Dir to all types. | ||||
| * | sys: always use pointers to types | Dmitry Vyukov | 2016-11-11 | 1 | -25/+25 |
| | | | | | | | | | Currently we store most types by value in sys.Type. This is somewhat counter-intuitive for C++ programmers, because one can't easily update the type object. Store pointers to type objects for all types. It also makes it easier to update types, e.g. adding paddings. | ||||
| * | Add big-endian ints | Andrey Konovalov | 2016-10-13 | 1 | -41/+58 |
| | | |||||
| * | Assign to structs correct type name | Andrey Konovalov | 2016-10-11 | 1 | -50/+72 |
| | | |||||
| * | Emit BufferBlob for array[int8] | Andrey Konovalov | 2016-10-04 | 1 | -11/+23 |
| | | |||||
| * | sys: add padding to structs again | Dmitry Vyukov | 2016-09-29 | 1 | -1/+1 |
| | | | | | | | | | Struct padding was accidentially lost after: 852e3d2eae98a913b7ec91822ba4dc61059a6955 Restore it. Now with tests. Fixes #78 | ||||
| * | sys, prog: add tests for description parsing and serialization | Dmitry Vyukov | 2016-09-28 | 1 | -4/+5 |
| | | | | | | | | | | | Add sys/test.txt file with description of syscalls for tests. These descriptions can be used to ensure that we can parse everything we clain we can parse. Use these descriptions to write several tests for exec serialization (one test shows that alignment handling is currently incorrect). These test descriptions can also be used to write e.g. mutation tests. Update #78 | ||||
| * | Allow range sized arrays | Andrey Konovalov | 2016-09-19 | 1 | -13/+15 |
| | | |||||
| * | sys: support recursive structs | Dmitry Vyukov | 2016-09-05 | 1 | -72/+111 |
| | | | | | | | A struct can have a pointer to itself directly or indirectly. Currently it leads to inifinite recursion when generating descriptions. Fix this. | ||||
| * | sysgen: check that structs are not passed as syscall arguments | Dmitry Vyukov | 2016-09-02 | 1 | -11/+27 |
| | | |||||
| * | sysgen: sort resources by name to avoid unnecessary diffs | Dmitry Vyukov | 2016-08-28 | 1 | -1/+13 |
| | | |||||
