Defining Constants in Syzlang

Overview

Syzkaller needs to know the actual values of kernel constants (ioctl numbers, flags, etc.) to generate valid fuzzing programs. There are two ways to provide these values:

1. Manual .const file - Define constants directly in a companion file
2. syz-extract tool - Extract values from kernel source headers (requires kernel source)

Method 1: Manual Constants File (Recommended when no kernel source)

Create a .const file alongside your .txt file with the constant values:

File naming

• Syzlang description: sys/linux/dev_ppdev.txt
• Constants file: sys/linux/dev_ppdev.txt.const

Constants file format

# Constants for your syzlang descriptions
arches = 386, amd64, arm, arm64, mips64le, ppc64le, riscv64, s390x
PPCLAIM = 28811
PPRELEASE = 28812
IEEE1284_MODE_NIBBLE = 0
IEEE1284_MODE_BYTE = 1

The arches line declares which architectures these constants are valid for. For architecture-independent constants (like ioctls), list all architectures.

Calculating ioctl values

Linux ioctl numbers are encoded as:

• _IO(type, nr) = (type << 8) | nr
• _IOR(type, nr, size) = (2 << 30) | (size << 16) | (type << 8) | nr
• _IOW(type, nr, size) = (1 << 30) | (size << 16) | (type << 8) | nr
• _IOWR(type, nr, size) = (3 << 30) | (size << 16) | (type << 8) | nr

For ppdev (type='p'=0x70):

• PPCLAIM = _IO('p', 0x8b) = 0x708b = 28811

Method 2: Using syz-extract (Requires kernel source)