Skip to content

cranelift-assembler-x64: add Intel XED as a fuzzer disassembler oracle#13915

Open
jlb6740 wants to merge 1 commit into
bytecodealliance:mainfrom
jlb6740:xed-fuzz-support
Open

cranelift-assembler-x64: add Intel XED as a fuzzer disassembler oracle#13915
jlb6740 wants to merge 1 commit into
bytecodealliance:mainfrom
jlb6740:xed-fuzz-support

Conversation

@jlb6740

@jlb6740 jlb6740 commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

The roundtrip fuzzer compares assembled instructions against Capstone, which cannot decode newer encodings such as APX. Add Intel XED as an optional second oracle:

  • Refactor the roundtrip core into roundtrip_with(...) so the Capstone path and a new XED path share one implementation (Capstone logic is unchanged, just extracted).
  • Implement disassemble_xed and xed_matches (normalizing whitespace, immediates, SIB scale-of-1, and operand-size/vector-length suffixes).
  • Gate XED behind a new off-by-default fuzz-xed feature, since it builds XED from source, and add a matching roundtrip-xed libFuzzer target.
  • Add the smoke_xed test, #[ignore]d while normalization (e.g. condition-code aliases) is still a work in progress.
  • Vet: exempt xed-sys and its target-lexicon requirement.

@jlb6740
jlb6740 requested review from a team as code owners July 21, 2026 01:40
@jlb6740
jlb6740 requested review from alexcrichton and cfallin and removed request for a team July 21, 2026 01:40
@jlb6740

jlb6740 commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Hi, looking to restart work on this issue #12157 to enable APX. I am using the plan at the issue as reference but also just trying to enable an end to end example (assembler to file testing) of an APX instruction (#13916). W.r.t. fuzzing, capstone does not support APX but xed does. This patch allows an alternative oracle to capstone regardless of if APX is ever implemented, but is also necessary for APX fuzzing. The upstream xed sys crate needs to be updated as the APX spec has likely evolved for some corner cases not covered in the current spec, but before pursuing that I wanted to see if this plan is supported and if we can merge support for what is upstream today.

@github-actions github-actions Bot added the cranelift Issues related to the Cranelift code generator label Jul 21, 2026
@alexcrichton

Copy link
Copy Markdown
Member

Thanks! Could the xed paths be tested in CI? If you want them fuzzed as well they'll either need to be on-by-default or enabled explicitly in oss-fuzz. Also, there's a lot of updates to the lock file here -- could that be reset and then regenerated? (a stray cargo update probably caused lots of updates)

The roundtrip fuzzer compares assembled instructions against Capstone,
which cannot decode newer encodings such as APX. Add Intel XED as an
optional second oracle:

* Refactor the roundtrip core into `roundtrip_with(...)` so the Capstone
  path and a new XED path share one implementation (Capstone logic is
  unchanged, just extracted).
* Implement `disassemble_xed` and `xed_matches` (normalizing whitespace,
  immediates, SIB scale-of-1, and operand-size/vector-length suffixes).
* Gate XED behind a new off-by-default `fuzz-xed` feature, since it builds
  XED from source, and add a matching `roundtrip-xed` libFuzzer target.
* Add the `smoke_xed` test, `#[ignore]`d while normalization (e.g.
  condition-code aliases) is still a work in progress.
* Vet: exempt `xed-sys` and its `target-lexicon` requirement.
@jlb6740
jlb6740 force-pushed the xed-fuzz-support branch from fb75da1 to 3d467c6 Compare July 22, 2026 05:20

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In addition to the testing-on-CI concern, could this get folded into the misc fuzzer instead of making a new fuzzer?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cranelift Issues related to the Cranelift code generator

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants