11# Syscall description language
2+
23aka ` syzlang ` (` [siːzˈlæŋg] ` )
34
45Pseudo-formal grammar of syscall description:
@@ -290,6 +291,7 @@ arguments as well. Underlying types are currently restricted to integer types,
290291` ptr ` , ` ptr64 ` , ` const ` , ` flags ` and ` proc ` types.
291292
292293There are some builtin type aliases:
294+
293295```
294296type bool8 int8[0:1]
295297type bool16 int16[0:1]
@@ -307,6 +309,7 @@ type buffer[DIR] ptr[DIR, array[int8]]
307309## Type Templates
308310
309311Type templates can be declared as follows:
312+
310313```
311314type buffer[DIR] ptr[DIR, array[int8]]
312315type fileoff[BASE] BASE
@@ -318,11 +321,13 @@ type nlattr[TYPE, PAYLOAD] {
318321```
319322
320323and later used as follows:
324+
321325```
322326syscall(a buffer[in], b fileoff[int64], c ptr[in, nlattr[FOO, int32]])
323327```
324328
325329There is builtin type template ` optional ` defined as:
330+
326331```
327332type optional[T] [
328333 val T
@@ -453,23 +458,24 @@ In this example, the `packet` structure will include the field `integer` only
453458if ` header.haveInteger == 1 ` . In memory, ` packet ` will have the following
454459layout:
455460
456- | header_files.magic = 0xabcd | header_files.haveInteger = 0x1 | integer | body |
457- | - | - | - | - |
458-
461+ | header.magic = 0xabcd | header.haveInteger = 0x1 | integer | body |
462+ | --------------------- | ------------------------ | ------- | ---- |
459463
460464That corresponds to e.g. the following program:
465+
461466```
462467some_call(&AUTO={{AUTO, 0x1}, @value=0xabcd, []})
463468```
464469
465470If ` header.haveInteger ` is not ` 1 ` , syzkaller will just pretend that the field
466471` integer ` does not exist.
472+
467473```
468474some_call(&AUTO={{AUTO, 0x0}, @void, []})
469475```
470476
471- | header_files .magic = 0xabcd | header_files .haveInteger = 0x0 | body |
472- | - | - | - |
477+ | header .magic = 0xabcd | header .haveInteger = 0x0 | body |
478+ | --------------------- | ------------------------ | --- - |
473479
474480Every conditional field is assumed to be of variable length and so is the struct
475481to which this field belongs.
@@ -478,6 +484,7 @@ When a variable length field appears in the middle of a structure, the structure
478484must be marked with ` [packed]. `
479485
480486Conditions on bitfields are prohibited:
487+
481488```
482489struct {
483490 f0 int
@@ -486,6 +493,7 @@ struct {
486493```
487494
488495But you may reference bitfields in your conditions:
496+
489497```
490498struct {
491499 f0 int:1
@@ -516,6 +524,7 @@ some_call(a ptr[in, struct])
516524In this case, the union option will be selected depending on the value of the
517525` type ` field. For example, if ` type ` is ` 0x1 ` , then it can be either ` int ` or
518526` default ` :
527+
519528```
520529some_call(&AUTO={0x1, @int=0x123})
521530some_call(&AUTO={0x1, @default=0x123})
@@ -524,6 +533,7 @@ some_call(&AUTO={0x1, @default=0x123})
524533If ` type ` is ` 0x2 ` , it can be either ` arr ` or ` default ` .
525534
526535If ` type ` is neither ` 0x1 ` nor ` 0x2 ` , syzkaller may only select ` default ` :
536+
527537```
528538some_call(&AUTO={0x0, @default=0xabcd})
529539```
@@ -543,7 +553,6 @@ alternatives [
543553During prog mutation and generation syzkaller will select a random union field
544554whose condition is satisfied.
545555
546-
547556### Expression syntax
548557
549558Currently, only ` == ` , ` != ` , ` & ` and ` || ` operators are supported. However, the
@@ -587,6 +596,7 @@ struct {
587596```
588597
589598You may also reference constants in expressions:
599+
590600```
591601struct {
592602 f0 int
@@ -602,12 +612,14 @@ Description files can also contain `meta` directives that specify meta-informati
602612```
603613meta noextract
604614```
615+
605616Tells ` make extract ` to not extract constants for this file.
606617Though, ` syz-extract ` can still be invoked manually on this file.
607618
608619```
609620meta arches["arch1", "arch2"]
610621```
622+
611623Restricts this file only to the given set of architectures.
612624` make extract ` and ` make generate ` will not use it on other architectures.
613625
0 commit comments