cranelift-assembler-x64: add Intel XED as a fuzzer disassembler oracle#13915
cranelift-assembler-x64: add Intel XED as a fuzzer disassembler oracle#13915jlb6740 wants to merge 1 commit into
Conversation
|
Hi, looking to restart work on this issue #12157 to enable APX. I am using the plan at the issue as reference but also just trying to enable an end to end example (assembler to file testing) of an APX instruction (#13916). W.r.t. fuzzing, capstone does not support APX but xed does. This patch allows an alternative oracle to capstone regardless of if APX is ever implemented, but is also necessary for APX fuzzing. The upstream xed sys crate needs to be updated as the APX spec has likely evolved for some corner cases not covered in the current spec, but before pursuing that I wanted to see if this plan is supported and if we can merge support for what is upstream today. |
|
Thanks! Could the xed paths be tested in CI? If you want them fuzzed as well they'll either need to be on-by-default or enabled explicitly in oss-fuzz. Also, there's a lot of updates to the lock file here -- could that be reset and then regenerated? (a stray |
The roundtrip fuzzer compares assembled instructions against Capstone, which cannot decode newer encodings such as APX. Add Intel XED as an optional second oracle: * Refactor the roundtrip core into `roundtrip_with(...)` so the Capstone path and a new XED path share one implementation (Capstone logic is unchanged, just extracted). * Implement `disassemble_xed` and `xed_matches` (normalizing whitespace, immediates, SIB scale-of-1, and operand-size/vector-length suffixes). * Gate XED behind a new off-by-default `fuzz-xed` feature, since it builds XED from source, and add a matching `roundtrip-xed` libFuzzer target. * Add the `smoke_xed` test, `#[ignore]`d while normalization (e.g. condition-code aliases) is still a work in progress. * Vet: exempt `xed-sys` and its `target-lexicon` requirement.
fb75da1 to
3d467c6
Compare
There was a problem hiding this comment.
In addition to the testing-on-CI concern, could this get folded into the misc fuzzer instead of making a new fuzzer?
The roundtrip fuzzer compares assembled instructions against Capstone, which cannot decode newer encodings such as APX. Add Intel XED as an optional second oracle:
roundtrip_with(...)so the Capstone path and a new XED path share one implementation (Capstone logic is unchanged, just extracted).disassemble_xedandxed_matches(normalizing whitespace, immediates, SIB scale-of-1, and operand-size/vector-length suffixes).fuzz-xedfeature, since it builds XED from source, and add a matchingroundtrip-xedlibFuzzer target.smoke_xedtest,#[ignore]d while normalization (e.g. condition-code aliases) is still a work in progress.xed-sysand itstarget-lexiconrequirement.