Skip to content

Commit cbc795b

Browse files
committed
update syscall_descriptions_syntax.md
1 parent c390174 commit cbc795b

File tree

1 file changed

+18
-6
lines changed

1 file changed

+18
-6
lines changed

docs/syscall_descriptions_syntax.md

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# Syscall description language
2+
23
aka `syzlang` (`[siːzˈlæŋg]`)
34

45
Pseudo-formal grammar of syscall description:
@@ -290,6 +291,7 @@ arguments as well. Underlying types are currently restricted to integer types,
290291
`ptr`, `ptr64`, `const`, `flags` and `proc` types.
291292

292293
There are some builtin type aliases:
294+
293295
```
294296
type bool8 int8[0:1]
295297
type bool16 int16[0:1]
@@ -307,6 +309,7 @@ type buffer[DIR] ptr[DIR, array[int8]]
307309
## Type Templates
308310

309311
Type templates can be declared as follows:
312+
310313
```
311314
type buffer[DIR] ptr[DIR, array[int8]]
312315
type fileoff[BASE] BASE
@@ -318,11 +321,13 @@ type nlattr[TYPE, PAYLOAD] {
318321
```
319322

320323
and later used as follows:
324+
321325
```
322326
syscall(a buffer[in], b fileoff[int64], c ptr[in, nlattr[FOO, int32]])
323327
```
324328

325329
There is builtin type template `optional` defined as:
330+
326331
```
327332
type optional[T] [
328333
val T
@@ -453,23 +458,24 @@ In this example, the `packet` structure will include the field `integer` only
453458
if `header.haveInteger == 1`. In memory, `packet` will have the following
454459
layout:
455460

456-
| header_files.magic = 0xabcd | header_files.haveInteger = 0x1 | integer | body |
457-
| - | - | - | - |
458-
461+
| header.magic = 0xabcd | header.haveInteger = 0x1 | integer | body |
462+
| --------------------- | ------------------------ | ------- | ---- |
459463

460464
That corresponds to e.g. the following program:
465+
461466
```
462467
some_call(&AUTO={{AUTO, 0x1}, @value=0xabcd, []})
463468
```
464469

465470
If `header.haveInteger` is not `1`, syzkaller will just pretend that the field
466471
`integer` does not exist.
472+
467473
```
468474
some_call(&AUTO={{AUTO, 0x0}, @void, []})
469475
```
470476

471-
| header_files.magic = 0xabcd | header_files.haveInteger = 0x0 | body |
472-
| - | - | - |
477+
| header.magic = 0xabcd | header.haveInteger = 0x0 | body |
478+
| --------------------- | ------------------------ | ---- |
473479

474480
Every conditional field is assumed to be of variable length and so is the struct
475481
to which this field belongs.
@@ -478,6 +484,7 @@ When a variable length field appears in the middle of a structure, the structure
478484
must be marked with `[packed].`
479485

480486
Conditions on bitfields are prohibited:
487+
481488
```
482489
struct {
483490
f0 int
@@ -486,6 +493,7 @@ struct {
486493
```
487494

488495
But you may reference bitfields in your conditions:
496+
489497
```
490498
struct {
491499
f0 int:1
@@ -516,6 +524,7 @@ some_call(a ptr[in, struct])
516524
In this case, the union option will be selected depending on the value of the
517525
`type` field. For example, if `type` is `0x1`, then it can be either `int` or
518526
`default`:
527+
519528
```
520529
some_call(&AUTO={0x1, @int=0x123})
521530
some_call(&AUTO={0x1, @default=0x123})
@@ -524,6 +533,7 @@ some_call(&AUTO={0x1, @default=0x123})
524533
If `type` is `0x2`, it can be either `arr` or `default`.
525534

526535
If `type` is neither `0x1` nor `0x2`, syzkaller may only select `default`:
536+
527537
```
528538
some_call(&AUTO={0x0, @default=0xabcd})
529539
```
@@ -543,7 +553,6 @@ alternatives [
543553
During prog mutation and generation syzkaller will select a random union field
544554
whose condition is satisfied.
545555

546-
547556
### Expression syntax
548557

549558
Currently, only `==`, `!=`, `&` and `||` operators are supported. However, the
@@ -587,6 +596,7 @@ struct {
587596
```
588597

589598
You may also reference constants in expressions:
599+
590600
```
591601
struct {
592602
f0 int
@@ -602,12 +612,14 @@ Description files can also contain `meta` directives that specify meta-informati
602612
```
603613
meta noextract
604614
```
615+
605616
Tells `make extract` to not extract constants for this file.
606617
Though, `syz-extract` can still be invoked manually on this file.
607618

608619
```
609620
meta arches["arch1", "arch2"]
610621
```
622+
611623
Restricts this file only to the given set of architectures.
612624
`make extract` and `make generate` will not use it on other architectures.
613625

0 commit comments

Comments
 (0)