aboutsummaryrefslogtreecommitdiffstats
path: root/sysgen
Commit message (Collapse)AuthorAgeFilesLines
* sys/syz-sysgen: from from sysgenDmitry Vyukov2017-06-172-990/+0
|
* sys/sysparser: move from sysparserDmitry Vyukov2017-06-172-2/+2
|
* executor: fix clang-tidy warningsDmitry Vyukov2017-06-131-1/+1
| | | | | A single check is enabled for now (misc-definitions-in-headers). But it's always fixable and found 2 bugs in csource.
* sys: check in generated filesDmitry Vyukov2017-06-131-1/+7
| | | | | | | | | | | | | | | | | | We used to have all generated files checked in. Later we removed them (now users are supposed to run make to generate them). This causes several problems: - go get does not work as it tries to build everything straight away (go get -d works, but users are confused) - users don't run make and complain that build is broken - users don't re-run make after updates and complain that build is broken - hard to integrate into other build system (even if they support building Go, they don't support running sysgen out-of-the-box) Fixes #216
* csource: don't generate execute_syscall callsAndrey Konovalov2017-06-121-1/+5
|
* sysgen: speed upDmitry Vyukov2017-05-291-9/+19
| | | | | Formatting generated sources takes tremendous amount of time (6s). Leave them unformatted. Reduces sysgen time to virtually 0.
* sysgen: don't touch output file if contents has not changedDmitry Vyukov2017-05-291-5/+45
| | | | Helps with build artifact caching.
* sys: generate arrays instead of mapsDmitry Vyukov2017-05-291-29/+22
| | | | | | | | Compilation of large maps is super slow. Generate arrays instead and converet to maps at runtime. Reduces build time from ~40s to ~2s. Update #182
* sys, executor: extract tcp sequence numbers from /dev/net/tunAndrey Konovalov2017-05-261-7/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds a new pseudo syscall syz_extract_tcp_res, that reads a packet from /dev/net/tun and extracts tcp sequence numbers to be used in subsequent packets. As a result this syzkaller program: mmap(&(0x7f0000000000/0x10000)=nil, (0x10000), 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000001000)={0x2, 0x0, @empty=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10) listen(r0, 0x5) syz_emit_ethernet(0x36, &(0x7f0000002000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x0}, @random="4c6112cc15d8", [], {{0x800, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}, @local={0xac, 0x14, 0x0, 0xaa}, {[]}}, @tcp={{0x1, 0x0, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0x0, {[]}}, {""}}}}}}) syz_extract_tcp_res(&(0x7f0000003000)={<r1=>0x42424242, <r2=>0x42424242}, 0x1, 0x0) syz_emit_ethernet(0x38, &(0x7f0000004000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x0}, @remote={[0xbb, 0xbb, 0xbb, 0xbb, 0xbb], 0x0}, [], {{0x800, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x2a, 0x0, 0x0, 0x0, 0x6, 0x0, @remote={0xac, 0x14, 0x0, 0xbb}, @local={0xac, 0x14, 0x0, 0xaa}, {[]}}, @tcp={{0x1, 0x0, r2, r1, 0x0, 0x0, 0x5, 0x10, 0x0, 0x0, 0x0, {[]}}, {"0c10"}}}}}}) r3 = accept$inet(r0, &(0x7f0000005000)={0x0, 0x0, @multicast1=0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000006000)=0x10) established a TCP connection: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:20000 0.0.0.0:* LISTEN 5477/a.out tcp 2 0 172.20.0.170:20000 172.20.0.187:20001 ESTABLISHED 5477/a.out Similar program for IPv6: mmap(&(0x7f0000000000/0x10000)=nil, (0x10000), 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x1, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, 0x1c) listen(r0, 0x5) syz_emit_ethernet(0x4a, &(0x7f0000001000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x0}, @random="de895db1468d", [], {{0x86dd, @ipv6={0x0, 0x6, "a228af", 0x14, 0x6, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, {[], @tcp={{0x0, 0x1, 0x42424242, 0x42424242, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0x0, {[]}}, {""}}}}}}}) syz_extract_tcp_res(&(0x7f0000002000)={<r1=>0x42424242, <r2=>0x42424242}, 0x1, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000003000)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x0}, @random="de895db1468d", [], {{0x86dd, @ipv6={0x0, 0x6, "a228af", 0x14, 0x6, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa}, {[], @tcp={{0x0, 0x1, r2, r1, 0x0, 0x0, 0x5, 0x10, 0x0, 0x0, 0x0, {[]}}, {""}}}}}}}) r3 = accept$inet6(r0, &(0x7f0000004000)={0x0, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x0}, &(0x7f0000005000)=0x1c) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp6 0 0 :::20001 :::* LISTEN 5527/a.out tcp6 0 0 fe80::aa:20001 fe80::bb:20000 ESTABLISHED 5527/a.out
* sysgen: always check dir when generating an argumentAndrey Konovalov2017-04-081-0/+1
|
* prog, sys: add icmpv6 packet descriptions and checksumsAndrey Konovalov2017-02-081-9/+21
| | | | | | Also generalize checksums into the two kinds: inet and pseudo. Inet checksums is just the Internet checksum of a packet. Pseudo checksum is the Internet checksum of a packet with a pseudo header.
* prog, sys: add icmp descriptions and checksumAndrey Konovalov2017-02-061-2/+2
|
* prog, sys: add udp description and checksumAndrey Konovalov2017-02-021-0/+2
|
* prog, sys: add tcp packets descriptionsAndrey Konovalov2017-01-301-0/+2
| | | | Also embed tcp checksums into packets.
* sys: improve ipc descriptionsDmitry Vyukov2017-01-281-2/+2
|
* prog, sys: add csum type, embed checksums for ipv4 packetsAndrey Konovalov2017-01-251-0/+13
| | | | | | | This change adds a `csum[kind, type]` type. The only available kind right now is `ipv4`. Using `csum[ipv4, int16be]` in `ipv4_header` makes syzkaller calculate and embed correct checksums into ipv4 packets.
* prog: add FieldName to TypeAndrey Konovalov2017-01-231-7/+3
| | | | | FieldName() is the name of the struct field or union option with this type. TypeName() is now always the name of the type.
* prog: fix bytesizeN for nonarray fieldsAndrey Konovalov2017-01-191-1/+1
|
* prog, sys: fix padding varlen structsAndrey Konovalov2017-01-191-1/+9
|
* sys: don't imply pointer indirection for filename typeDmitry Vyukov2017-01-181-5/+1
| | | | | | | | Change all 'filename' to 'ptr[in, filename]' and don't imply pointer indirection for filename type. This is necessary because in some bases we want to embed filename directly into a struct (e.g. unix sock addr). Similar change was already done for string type for similar reasons. Generally, we want to imply as less as possible. NOTE: IF YOU HAVE PRIVATE DESCRIPTIONS, YOU NEED TO DO THE SAME REPLACEMENT.
* prog: mutate sized strings with respect to sizeAndrey Konovalov2017-01-181-2/+2
|
* prog: fix Size() for unions argsAndrey Konovalov2017-01-181-1/+1
|
* prog: add bitfields to templatesAndrey Konovalov2017-01-171-27/+57
| | | | | | Now it's possible to use `int32:18` to denote a bitfield of size 18 as a struct field. This fixes #72.
* sys, executor: more kvm improvementsDmitry Vyukov2017-01-121-1/+1
| | | | | | | 1. Basic support for arm64 kvm testing. 2. Fix compiler warnings in x86 kvm code. 3. Test all pseudo syz calls in csource. 4. Fix handling of real code in x86.
* sys: extend kvm supportDmitry Vyukov2017-01-092-0/+13
| | | | | | Add new pseudo syscall syz_kvm_setup_cpu that setups VCPU into interesting states for execution. KVM is too difficult to setup otherwise. Lots of improvements possible, but this is a starting point.
* sys: allow to specify number of pages for vma typeDmitry Vyukov2017-01-091-3/+8
| | | | Allows to write vma[4] or vma[5-10] to specify desired number of pages.
* prog: add bytesizeN typesAndrey Konovalov2016-12-201-2/+19
|
* executor: use different address for our network cardDmitry Vyukov2016-12-061-1/+2
| | | | | IP addresses like 192.168.0.1/192.168.1.1 are often used for routing between VM and the host. Offset our IP addresses to start from 192.168.218.0 to reduce potential conflicts.
* executor: emit ethernet trafficAndrey Konovalov2016-11-291-0/+1
|
* sys: move sockaddr description to templatesAndrey Konovalov2016-11-291-5/+0
|
* sys: move in_addr description to templatesAndrey Konovalov2016-11-291-5/+0
|
* ipc, prog, sysgen: format codeDmitry Vyukov2016-11-251-1/+1
|
* sys: add proc type to denote per proccess integersAndrey Konovalov2016-11-251-5/+38
|
* sysgen: reduce compilation time and memory consumptionDmitry Vyukov2016-11-151-2/+2
| | | | | | Go compiler does not seem to like long generated functions. This change reduces compilation time of sys_arch.go, reduces compiler memory consumption and fixes compiler crash on arm64.
* sys: allow to specify buffer size for stringsDmitry Vyukov2016-11-111-6/+27
| | | | | | | | This allows to write: string[salg_type, 14] which will give a string buffer of size 14 regardless of actual string size. Convert salg_type/salg_name to this.
* sys: add string flagsDmitry Vyukov2016-11-111-20/+19
| | | | | | | | | | Allow to define string flags in txt descriptions. E.g.: filesystem = "ext2", "ext3", "ext4" and then use it in string type: ptr[in, string[filesystem]]
* sys: don't imply pointer indirection for string argumentsDmitry Vyukov2016-11-111-5/+1
| | | | | In preparation for extending string functionality and to make it less magical.
* sys: replace FileoffType with IntType{Kind: IntFileoff}Dmitry Vyukov2016-11-111-4/+4
| | | | | FileoffType is effectively an int, no need for a separate type. Also remove fd option from fileoff as it is unused and use story is unclear.
* sys: replace FilenameType with BufferType{Kind: BufferFilename}Dmitry Vyukov2016-11-111-1/+1
| | | | FilenameType is effectively a buffer, there is no need for a separate type.
* sys: attach Dir to all typesDmitry Vyukov2016-11-111-38/+51
| | | | | | Dir is a static info, so we don't need to compute, propagate and attach it in prog whenever we generate/change programs. Attach Dir to all types.
* sys: always use pointers to typesDmitry Vyukov2016-11-111-25/+25
| | | | | | | | Currently we store most types by value in sys.Type. This is somewhat counter-intuitive for C++ programmers, because one can't easily update the type object. Store pointers to type objects for all types. It also makes it easier to update types, e.g. adding paddings.
* Add big-endian intsAndrey Konovalov2016-10-131-41/+58
|
* Assign to structs correct type nameAndrey Konovalov2016-10-111-50/+72
|
* Emit BufferBlob for array[int8]Andrey Konovalov2016-10-041-11/+23
|
* sys: add padding to structs againDmitry Vyukov2016-09-291-1/+1
| | | | | | | | Struct padding was accidentially lost after: 852e3d2eae98a913b7ec91822ba4dc61059a6955 Restore it. Now with tests. Fixes #78
* sys, prog: add tests for description parsing and serializationDmitry Vyukov2016-09-281-4/+5
| | | | | | | | | | Add sys/test.txt file with description of syscalls for tests. These descriptions can be used to ensure that we can parse everything we clain we can parse. Use these descriptions to write several tests for exec serialization (one test shows that alignment handling is currently incorrect). These test descriptions can also be used to write e.g. mutation tests. Update #78
* Allow range sized arraysAndrey Konovalov2016-09-191-13/+15
|
* sys: support recursive structsDmitry Vyukov2016-09-051-72/+111
| | | | | | A struct can have a pointer to itself directly or indirectly. Currently it leads to inifinite recursion when generating descriptions. Fix this.
* sysgen: check that structs are not passed as syscall argumentsDmitry Vyukov2016-09-021-11/+27
|
* sysgen: sort resources by name to avoid unnecessary diffsDmitry Vyukov2016-08-281-1/+13
|