Commit | Line | Data |
---|---|---|
97b58163 MD |
1 | /* |
2 | * lttng-filter-validator.c | |
3 | * | |
4 | * LTTng UST filter bytecode validator. | |
5 | * | |
6 | * Copyright (C) 2010-2012 Mathieu Desnoyers <mathieu.desnoyers@efficios.com> | |
7 | * | |
8 | * This library is free software; you can redistribute it and/or | |
9 | * modify it under the terms of the GNU Lesser General Public | |
10 | * License as published by the Free Software Foundation; only | |
11 | * version 2.1 of the License. | |
12 | * | |
13 | * This library is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
16 | * Lesser General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU Lesser General Public | |
19 | * License along with this library; if not, write to the Free Software | |
20 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA | |
21 | */ | |
22 | ||
bf956ec0 MD |
23 | #define _LGPL_SOURCE |
24 | #include <urcu-bp.h> | |
25 | #include <time.h> | |
97b58163 MD |
26 | #include "lttng-filter.h" |
27 | ||
bf956ec0 MD |
28 | #include <urcu/rculfhash.h> |
29 | #include "lttng-hash-helper.h" | |
30 | ||
31 | /* merge point table node */ | |
32 | struct lfht_mp_node { | |
33 | struct cds_lfht_node node; | |
34 | ||
35 | /* Context at merge point */ | |
36 | struct vreg reg[NR_REG]; | |
37 | unsigned long target_pc; | |
38 | }; | |
39 | ||
40 | static unsigned long lttng_hash_seed; | |
41 | static unsigned int lttng_hash_seed_ready; | |
42 | ||
43 | static | |
44 | int lttng_hash_match(struct cds_lfht_node *node, const void *key) | |
45 | { | |
46 | struct lfht_mp_node *mp_node = | |
47 | caa_container_of(node, struct lfht_mp_node, node); | |
48 | unsigned long key_pc = (unsigned long) key; | |
49 | ||
50 | if (mp_node->target_pc == key_pc) | |
51 | return 1; | |
52 | else | |
53 | return 0; | |
54 | } | |
55 | ||
56 | static | |
57 | int merge_point_add(struct cds_lfht *ht, unsigned long target_pc, | |
58 | const struct vreg reg[NR_REG]) | |
59 | { | |
60 | struct lfht_mp_node *node; | |
61 | unsigned long hash = lttng_hash_mix((const void *) target_pc, | |
62 | sizeof(target_pc), | |
63 | lttng_hash_seed); | |
64 | ||
65 | dbg_printf("Filter: adding merge point at offset %lu, hash %lu\n", | |
66 | target_pc, hash); | |
67 | node = zmalloc(sizeof(struct lfht_mp_node)); | |
68 | if (!node) | |
69 | return -ENOMEM; | |
70 | node->target_pc = target_pc; | |
71 | memcpy(node->reg, reg, sizeof(node->reg)); | |
72 | cds_lfht_add(ht, hash, &node->node); | |
73 | return 0; | |
74 | } | |
75 | ||
76 | /* | |
77 | * Number of merge points for hash table size. Hash table initialized to | |
78 | * that size, and we do not resize, because we do not want to trigger | |
79 | * RCU worker thread execution: fall-back on linear traversal if number | |
80 | * of merge points exceeds this value. | |
81 | */ | |
82 | #define DEFAULT_NR_MERGE_POINTS 128 | |
83 | #define MIN_NR_BUCKETS 128 | |
84 | #define MAX_NR_BUCKETS 128 | |
85 | ||
97b58163 | 86 | static |
bf956ec0 | 87 | int bin_op_compare_check(const struct vreg reg[NR_REG], const char *str) |
97b58163 MD |
88 | { |
89 | switch (reg[REG_R0].type) { | |
90 | default: | |
91 | goto error_unknown; | |
92 | ||
93 | case REG_STRING: | |
94 | switch (reg[REG_R1].type) { | |
95 | default: | |
96 | goto error_unknown; | |
97 | ||
98 | case REG_STRING: | |
99 | break; | |
100 | case REG_S64: | |
101 | case REG_DOUBLE: | |
102 | goto error_mismatch; | |
103 | } | |
104 | break; | |
105 | case REG_S64: | |
106 | case REG_DOUBLE: | |
107 | switch (reg[REG_R1].type) { | |
108 | default: | |
109 | goto error_unknown; | |
110 | ||
111 | case REG_STRING: | |
112 | goto error_mismatch; | |
113 | ||
114 | case REG_S64: | |
115 | case REG_DOUBLE: | |
116 | break; | |
117 | } | |
118 | break; | |
119 | } | |
120 | return 0; | |
121 | ||
122 | error_unknown: | |
123 | ||
124 | return -EINVAL; | |
125 | error_mismatch: | |
126 | ERR("type mismatch for '%s' binary operator\n", str); | |
127 | return -EINVAL; | |
128 | } | |
129 | ||
130 | /* | |
131 | * Validate bytecode range overflow within the validation pass. | |
132 | * Called for each instruction encountered. | |
133 | */ | |
134 | static | |
135 | int bytecode_validate_overflow(struct bytecode_runtime *bytecode, | |
bf956ec0 | 136 | void *start_pc, void *pc) |
97b58163 MD |
137 | { |
138 | int ret = 0; | |
139 | ||
140 | switch (*(filter_opcode_t *) pc) { | |
141 | case FILTER_OP_UNKNOWN: | |
142 | default: | |
143 | { | |
144 | ERR("unknown bytecode op %u\n", | |
145 | (unsigned int) *(filter_opcode_t *) pc); | |
146 | ret = -EINVAL; | |
147 | break; | |
148 | } | |
149 | ||
150 | case FILTER_OP_RETURN: | |
151 | { | |
152 | if (unlikely(pc + sizeof(struct return_op) | |
153 | > start_pc + bytecode->len)) { | |
154 | ret = -EINVAL; | |
155 | } | |
156 | break; | |
157 | } | |
158 | ||
159 | /* binary */ | |
160 | case FILTER_OP_MUL: | |
161 | case FILTER_OP_DIV: | |
162 | case FILTER_OP_MOD: | |
163 | case FILTER_OP_PLUS: | |
164 | case FILTER_OP_MINUS: | |
165 | case FILTER_OP_RSHIFT: | |
166 | case FILTER_OP_LSHIFT: | |
167 | case FILTER_OP_BIN_AND: | |
168 | case FILTER_OP_BIN_OR: | |
169 | case FILTER_OP_BIN_XOR: | |
170 | { | |
171 | ERR("unsupported bytecode op %u\n", | |
172 | (unsigned int) *(filter_opcode_t *) pc); | |
173 | ret = -EINVAL; | |
174 | break; | |
175 | } | |
176 | ||
177 | case FILTER_OP_EQ: | |
178 | case FILTER_OP_NE: | |
179 | case FILTER_OP_GT: | |
180 | case FILTER_OP_LT: | |
181 | case FILTER_OP_GE: | |
182 | case FILTER_OP_LE: | |
183 | case FILTER_OP_EQ_STRING: | |
184 | case FILTER_OP_NE_STRING: | |
185 | case FILTER_OP_GT_STRING: | |
186 | case FILTER_OP_LT_STRING: | |
187 | case FILTER_OP_GE_STRING: | |
188 | case FILTER_OP_LE_STRING: | |
189 | case FILTER_OP_EQ_S64: | |
190 | case FILTER_OP_NE_S64: | |
191 | case FILTER_OP_GT_S64: | |
192 | case FILTER_OP_LT_S64: | |
193 | case FILTER_OP_GE_S64: | |
194 | case FILTER_OP_LE_S64: | |
195 | case FILTER_OP_EQ_DOUBLE: | |
196 | case FILTER_OP_NE_DOUBLE: | |
197 | case FILTER_OP_GT_DOUBLE: | |
198 | case FILTER_OP_LT_DOUBLE: | |
199 | case FILTER_OP_GE_DOUBLE: | |
200 | case FILTER_OP_LE_DOUBLE: | |
201 | { | |
202 | if (unlikely(pc + sizeof(struct binary_op) | |
203 | > start_pc + bytecode->len)) { | |
204 | ret = -EINVAL; | |
205 | } | |
206 | break; | |
207 | } | |
208 | ||
209 | /* unary */ | |
210 | case FILTER_OP_UNARY_PLUS: | |
211 | case FILTER_OP_UNARY_MINUS: | |
212 | case FILTER_OP_UNARY_NOT: | |
213 | case FILTER_OP_UNARY_PLUS_S64: | |
214 | case FILTER_OP_UNARY_MINUS_S64: | |
215 | case FILTER_OP_UNARY_NOT_S64: | |
216 | case FILTER_OP_UNARY_PLUS_DOUBLE: | |
217 | case FILTER_OP_UNARY_MINUS_DOUBLE: | |
218 | case FILTER_OP_UNARY_NOT_DOUBLE: | |
219 | { | |
220 | if (unlikely(pc + sizeof(struct unary_op) | |
221 | > start_pc + bytecode->len)) { | |
222 | ret = -EINVAL; | |
223 | } | |
224 | break; | |
225 | } | |
226 | ||
227 | /* logical */ | |
228 | case FILTER_OP_AND: | |
229 | case FILTER_OP_OR: | |
230 | { | |
231 | if (unlikely(pc + sizeof(struct logical_op) | |
232 | > start_pc + bytecode->len)) { | |
233 | ret = -EINVAL; | |
234 | } | |
235 | break; | |
236 | } | |
237 | ||
238 | /* load */ | |
239 | case FILTER_OP_LOAD_FIELD_REF: | |
240 | { | |
241 | ERR("Unknown field ref type\n"); | |
242 | ret = -EINVAL; | |
243 | break; | |
244 | } | |
245 | case FILTER_OP_LOAD_FIELD_REF_STRING: | |
246 | case FILTER_OP_LOAD_FIELD_REF_SEQUENCE: | |
247 | case FILTER_OP_LOAD_FIELD_REF_S64: | |
248 | case FILTER_OP_LOAD_FIELD_REF_DOUBLE: | |
249 | { | |
250 | if (unlikely(pc + sizeof(struct load_op) + sizeof(struct field_ref) | |
251 | > start_pc + bytecode->len)) { | |
252 | ret = -EINVAL; | |
253 | } | |
254 | break; | |
255 | } | |
256 | ||
257 | case FILTER_OP_LOAD_STRING: | |
258 | { | |
259 | struct load_op *insn = (struct load_op *) pc; | |
260 | uint32_t str_len, maxlen; | |
261 | ||
262 | if (unlikely(pc + sizeof(struct load_op) | |
263 | > start_pc + bytecode->len)) { | |
264 | ret = -EINVAL; | |
265 | break; | |
266 | } | |
267 | ||
268 | maxlen = start_pc + bytecode->len - pc - sizeof(struct load_op); | |
269 | str_len = strnlen(insn->data, maxlen); | |
270 | if (unlikely(str_len >= maxlen)) { | |
271 | /* Final '\0' not found within range */ | |
272 | ret = -EINVAL; | |
273 | } | |
274 | break; | |
275 | } | |
276 | ||
277 | case FILTER_OP_LOAD_S64: | |
278 | { | |
279 | if (unlikely(pc + sizeof(struct load_op) + sizeof(struct literal_numeric) | |
280 | > start_pc + bytecode->len)) { | |
281 | ret = -EINVAL; | |
282 | } | |
283 | break; | |
284 | } | |
285 | ||
286 | case FILTER_OP_LOAD_DOUBLE: | |
287 | { | |
288 | if (unlikely(pc + sizeof(struct load_op) + sizeof(struct literal_double) | |
289 | > start_pc + bytecode->len)) { | |
290 | ret = -EINVAL; | |
291 | } | |
292 | break; | |
293 | } | |
294 | ||
295 | case FILTER_OP_CAST_TO_S64: | |
296 | case FILTER_OP_CAST_DOUBLE_TO_S64: | |
297 | case FILTER_OP_CAST_NOP: | |
298 | { | |
299 | if (unlikely(pc + sizeof(struct cast_op) | |
300 | > start_pc + bytecode->len)) { | |
301 | ret = -EINVAL; | |
302 | } | |
303 | break; | |
304 | } | |
305 | } | |
306 | ||
307 | return ret; | |
308 | } | |
309 | ||
bf956ec0 MD |
310 | static |
311 | unsigned long delete_all_nodes(struct cds_lfht *ht) | |
97b58163 | 312 | { |
bf956ec0 MD |
313 | struct cds_lfht_iter iter; |
314 | struct lfht_mp_node *node; | |
315 | unsigned long nr_nodes = 0; | |
97b58163 | 316 | |
bf956ec0 MD |
317 | cds_lfht_for_each_entry(ht, &iter, node, node) { |
318 | int ret; | |
319 | ||
320 | ret = cds_lfht_del(ht, cds_lfht_iter_get_node(&iter)); | |
321 | assert(!ret); | |
322 | /* note: this hash table is never used concurrently */ | |
323 | free(node); | |
324 | nr_nodes++; | |
97b58163 | 325 | } |
bf956ec0 MD |
326 | return nr_nodes; |
327 | } | |
97b58163 | 328 | |
bf956ec0 MD |
329 | /* |
330 | * Return value: | |
331 | * 0: success | |
332 | * <0: error | |
333 | */ | |
334 | static | |
335 | int validate_instruction_context(struct bytecode_runtime *bytecode, | |
336 | const struct vreg reg[NR_REG], | |
337 | void *start_pc, | |
338 | void *pc) | |
339 | { | |
340 | int ret = 0; | |
341 | ||
342 | switch (*(filter_opcode_t *) pc) { | |
343 | case FILTER_OP_UNKNOWN: | |
344 | default: | |
345 | { | |
346 | ERR("unknown bytecode op %u\n", | |
97b58163 | 347 | (unsigned int) *(filter_opcode_t *) pc); |
bf956ec0 MD |
348 | ret = -EINVAL; |
349 | goto end; | |
350 | } | |
351 | ||
352 | case FILTER_OP_RETURN: | |
353 | { | |
354 | goto end; | |
355 | } | |
356 | ||
357 | /* binary */ | |
358 | case FILTER_OP_MUL: | |
359 | case FILTER_OP_DIV: | |
360 | case FILTER_OP_MOD: | |
361 | case FILTER_OP_PLUS: | |
362 | case FILTER_OP_MINUS: | |
363 | case FILTER_OP_RSHIFT: | |
364 | case FILTER_OP_LSHIFT: | |
365 | case FILTER_OP_BIN_AND: | |
366 | case FILTER_OP_BIN_OR: | |
367 | case FILTER_OP_BIN_XOR: | |
368 | { | |
369 | ERR("unsupported bytecode op %u\n", | |
370 | (unsigned int) *(filter_opcode_t *) pc); | |
371 | ret = -EINVAL; | |
372 | goto end; | |
373 | } | |
97b58163 | 374 | |
bf956ec0 MD |
375 | case FILTER_OP_EQ: |
376 | { | |
377 | ret = bin_op_compare_check(reg, "=="); | |
378 | if (ret) | |
379 | goto end; | |
380 | break; | |
381 | } | |
382 | case FILTER_OP_NE: | |
383 | { | |
384 | ret = bin_op_compare_check(reg, "!="); | |
385 | if (ret) | |
386 | goto end; | |
387 | break; | |
388 | } | |
389 | case FILTER_OP_GT: | |
390 | { | |
391 | ret = bin_op_compare_check(reg, ">"); | |
392 | if (ret) | |
393 | goto end; | |
394 | break; | |
395 | } | |
396 | case FILTER_OP_LT: | |
397 | { | |
398 | ret = bin_op_compare_check(reg, "<"); | |
399 | if (ret) | |
400 | goto end; | |
401 | break; | |
402 | } | |
403 | case FILTER_OP_GE: | |
404 | { | |
405 | ret = bin_op_compare_check(reg, ">="); | |
406 | if (ret) | |
407 | goto end; | |
408 | break; | |
409 | } | |
410 | case FILTER_OP_LE: | |
411 | { | |
412 | ret = bin_op_compare_check(reg, "<="); | |
413 | if (ret) | |
97b58163 | 414 | goto end; |
bf956ec0 MD |
415 | break; |
416 | } | |
97b58163 | 417 | |
bf956ec0 MD |
418 | case FILTER_OP_EQ_STRING: |
419 | case FILTER_OP_NE_STRING: | |
420 | case FILTER_OP_GT_STRING: | |
421 | case FILTER_OP_LT_STRING: | |
422 | case FILTER_OP_GE_STRING: | |
423 | case FILTER_OP_LE_STRING: | |
424 | { | |
425 | if (reg[REG_R0].type != REG_STRING | |
426 | || reg[REG_R1].type != REG_STRING) { | |
427 | ERR("Unexpected register type for string comparator\n"); | |
97b58163 MD |
428 | ret = -EINVAL; |
429 | goto end; | |
97b58163 | 430 | } |
bf956ec0 MD |
431 | break; |
432 | } | |
97b58163 | 433 | |
bf956ec0 MD |
434 | case FILTER_OP_EQ_S64: |
435 | case FILTER_OP_NE_S64: | |
436 | case FILTER_OP_GT_S64: | |
437 | case FILTER_OP_LT_S64: | |
438 | case FILTER_OP_GE_S64: | |
439 | case FILTER_OP_LE_S64: | |
440 | { | |
441 | if (reg[REG_R0].type != REG_S64 | |
442 | || reg[REG_R1].type != REG_S64) { | |
443 | ERR("Unexpected register type for s64 comparator\n"); | |
444 | ret = -EINVAL; | |
445 | goto end; | |
97b58163 | 446 | } |
bf956ec0 MD |
447 | break; |
448 | } | |
97b58163 | 449 | |
bf956ec0 MD |
450 | case FILTER_OP_EQ_DOUBLE: |
451 | case FILTER_OP_NE_DOUBLE: | |
452 | case FILTER_OP_GT_DOUBLE: | |
453 | case FILTER_OP_LT_DOUBLE: | |
454 | case FILTER_OP_GE_DOUBLE: | |
455 | case FILTER_OP_LE_DOUBLE: | |
456 | { | |
457 | if ((reg[REG_R0].type != REG_DOUBLE && reg[REG_R0].type != REG_S64) | |
458 | || (reg[REG_R1].type != REG_DOUBLE && reg[REG_R1].type != REG_S64)) { | |
459 | ERR("Unexpected register type for double comparator\n"); | |
460 | ret = -EINVAL; | |
461 | goto end; | |
97b58163 | 462 | } |
bf956ec0 MD |
463 | if (reg[REG_R0].type != REG_DOUBLE && reg[REG_R1].type != REG_DOUBLE) { |
464 | ERR("Double operator should have at least one double register\n"); | |
465 | ret = -EINVAL; | |
466 | goto end; | |
97b58163 | 467 | } |
bf956ec0 MD |
468 | break; |
469 | } | |
97b58163 | 470 | |
bf956ec0 MD |
471 | /* unary */ |
472 | case FILTER_OP_UNARY_PLUS: | |
473 | case FILTER_OP_UNARY_MINUS: | |
474 | case FILTER_OP_UNARY_NOT: | |
475 | { | |
476 | struct unary_op *insn = (struct unary_op *) pc; | |
97b58163 | 477 | |
bf956ec0 MD |
478 | if (unlikely(insn->reg >= REG_ERROR)) { |
479 | ERR("invalid register %u\n", | |
480 | (unsigned int) insn->reg); | |
481 | ret = -EINVAL; | |
482 | goto end; | |
483 | } | |
484 | switch (reg[insn->reg].type) { | |
485 | default: | |
486 | ERR("unknown register type\n"); | |
487 | ret = -EINVAL; | |
488 | goto end; | |
97b58163 | 489 | |
bf956ec0 MD |
490 | case REG_STRING: |
491 | ERR("Unary op can only be applied to numeric or floating point registers\n"); | |
492 | ret = -EINVAL; | |
493 | goto end; | |
494 | case REG_S64: | |
495 | break; | |
496 | case REG_DOUBLE: | |
97b58163 MD |
497 | break; |
498 | } | |
bf956ec0 MD |
499 | break; |
500 | } | |
97b58163 | 501 | |
bf956ec0 MD |
502 | case FILTER_OP_UNARY_PLUS_S64: |
503 | case FILTER_OP_UNARY_MINUS_S64: | |
504 | case FILTER_OP_UNARY_NOT_S64: | |
505 | { | |
506 | struct unary_op *insn = (struct unary_op *) pc; | |
97b58163 | 507 | |
bf956ec0 MD |
508 | if (unlikely(insn->reg >= REG_ERROR)) { |
509 | ERR("invalid register %u\n", | |
510 | (unsigned int) insn->reg); | |
511 | ret = -EINVAL; | |
512 | goto end; | |
513 | } | |
514 | if (reg[insn->reg].type != REG_S64) { | |
515 | ERR("Invalid register type\n"); | |
516 | ret = -EINVAL; | |
517 | goto end; | |
97b58163 | 518 | } |
bf956ec0 MD |
519 | break; |
520 | } | |
97b58163 | 521 | |
bf956ec0 MD |
522 | case FILTER_OP_UNARY_PLUS_DOUBLE: |
523 | case FILTER_OP_UNARY_MINUS_DOUBLE: | |
524 | case FILTER_OP_UNARY_NOT_DOUBLE: | |
525 | { | |
526 | struct unary_op *insn = (struct unary_op *) pc; | |
97b58163 | 527 | |
bf956ec0 MD |
528 | if (unlikely(insn->reg >= REG_ERROR)) { |
529 | ERR("invalid register %u\n", | |
530 | (unsigned int) insn->reg); | |
531 | ret = -EINVAL; | |
532 | goto end; | |
97b58163 | 533 | } |
bf956ec0 MD |
534 | if (reg[insn->reg].type != REG_DOUBLE) { |
535 | ERR("Invalid register type\n"); | |
536 | ret = -EINVAL; | |
537 | goto end; | |
538 | } | |
539 | break; | |
540 | } | |
97b58163 | 541 | |
bf956ec0 MD |
542 | /* logical */ |
543 | case FILTER_OP_AND: | |
544 | case FILTER_OP_OR: | |
545 | { | |
546 | struct logical_op *insn = (struct logical_op *) pc; | |
97b58163 | 547 | |
bf956ec0 MD |
548 | if (reg[REG_R0].type != REG_S64) { |
549 | ERR("Logical comparator expects S64 register\n"); | |
550 | ret = -EINVAL; | |
551 | goto end; | |
97b58163 MD |
552 | } |
553 | ||
bf956ec0 MD |
554 | dbg_printf("Validate jumping to bytecode offset %u\n", |
555 | (unsigned int) insn->skip_offset); | |
556 | if (unlikely(start_pc + insn->skip_offset <= pc)) { | |
557 | ERR("Loops are not allowed in bytecode\n"); | |
97b58163 MD |
558 | ret = -EINVAL; |
559 | goto end; | |
560 | } | |
bf956ec0 MD |
561 | break; |
562 | } | |
97b58163 | 563 | |
bf956ec0 MD |
564 | /* load */ |
565 | case FILTER_OP_LOAD_FIELD_REF: | |
566 | { | |
567 | ERR("Unknown field ref type\n"); | |
568 | ret = -EINVAL; | |
569 | goto end; | |
570 | } | |
571 | case FILTER_OP_LOAD_FIELD_REF_STRING: | |
572 | case FILTER_OP_LOAD_FIELD_REF_SEQUENCE: | |
573 | { | |
574 | struct load_op *insn = (struct load_op *) pc; | |
575 | struct field_ref *ref = (struct field_ref *) insn->data; | |
576 | ||
577 | if (unlikely(insn->reg >= REG_ERROR)) { | |
578 | ERR("invalid register %u\n", | |
579 | (unsigned int) insn->reg); | |
580 | ret = -EINVAL; | |
581 | goto end; | |
97b58163 | 582 | } |
bf956ec0 MD |
583 | dbg_printf("Validate load field ref offset %u type string\n", |
584 | ref->offset); | |
585 | break; | |
586 | } | |
587 | case FILTER_OP_LOAD_FIELD_REF_S64: | |
588 | { | |
589 | struct load_op *insn = (struct load_op *) pc; | |
590 | struct field_ref *ref = (struct field_ref *) insn->data; | |
97b58163 | 591 | |
bf956ec0 MD |
592 | if (unlikely(insn->reg >= REG_ERROR)) { |
593 | ERR("invalid register %u\n", | |
594 | (unsigned int) insn->reg); | |
595 | ret = -EINVAL; | |
596 | goto end; | |
97b58163 | 597 | } |
bf956ec0 MD |
598 | dbg_printf("Validate load field ref offset %u type s64\n", |
599 | ref->offset); | |
600 | break; | |
601 | } | |
602 | case FILTER_OP_LOAD_FIELD_REF_DOUBLE: | |
603 | { | |
604 | struct load_op *insn = (struct load_op *) pc; | |
605 | struct field_ref *ref = (struct field_ref *) insn->data; | |
97b58163 | 606 | |
bf956ec0 MD |
607 | if (unlikely(insn->reg >= REG_ERROR)) { |
608 | ERR("invalid register %u\n", | |
609 | (unsigned int) insn->reg); | |
610 | ret = -EINVAL; | |
611 | goto end; | |
97b58163 | 612 | } |
bf956ec0 MD |
613 | dbg_printf("Validate load field ref offset %u type double\n", |
614 | ref->offset); | |
615 | break; | |
616 | } | |
97b58163 | 617 | |
bf956ec0 MD |
618 | case FILTER_OP_LOAD_STRING: |
619 | { | |
620 | struct load_op *insn = (struct load_op *) pc; | |
97b58163 | 621 | |
bf956ec0 MD |
622 | if (unlikely(insn->reg >= REG_ERROR)) { |
623 | ERR("invalid register %u\n", | |
624 | (unsigned int) insn->reg); | |
625 | ret = -EINVAL; | |
626 | goto end; | |
97b58163 | 627 | } |
bf956ec0 MD |
628 | break; |
629 | } | |
97b58163 | 630 | |
bf956ec0 MD |
631 | case FILTER_OP_LOAD_S64: |
632 | { | |
633 | struct load_op *insn = (struct load_op *) pc; | |
97b58163 | 634 | |
bf956ec0 MD |
635 | if (unlikely(insn->reg >= REG_ERROR)) { |
636 | ERR("invalid register %u\n", | |
637 | (unsigned int) insn->reg); | |
638 | ret = -EINVAL; | |
639 | goto end; | |
97b58163 | 640 | } |
bf956ec0 MD |
641 | break; |
642 | } | |
97b58163 | 643 | |
bf956ec0 MD |
644 | case FILTER_OP_LOAD_DOUBLE: |
645 | { | |
646 | struct load_op *insn = (struct load_op *) pc; | |
97b58163 | 647 | |
bf956ec0 MD |
648 | if (unlikely(insn->reg >= REG_ERROR)) { |
649 | ERR("invalid register %u\n", | |
650 | (unsigned int) insn->reg); | |
651 | ret = -EINVAL; | |
652 | goto end; | |
97b58163 | 653 | } |
bf956ec0 MD |
654 | break; |
655 | } | |
97b58163 | 656 | |
bf956ec0 MD |
657 | case FILTER_OP_CAST_TO_S64: |
658 | case FILTER_OP_CAST_DOUBLE_TO_S64: | |
659 | { | |
660 | struct cast_op *insn = (struct cast_op *) pc; | |
97b58163 | 661 | |
bf956ec0 MD |
662 | if (unlikely(insn->reg >= REG_ERROR)) { |
663 | ERR("invalid register %u\n", | |
664 | (unsigned int) insn->reg); | |
665 | ret = -EINVAL; | |
666 | goto end; | |
667 | } | |
668 | switch (reg[insn->reg].type) { | |
669 | default: | |
670 | ERR("unknown register type\n"); | |
671 | ret = -EINVAL; | |
672 | goto end; | |
97b58163 | 673 | |
bf956ec0 MD |
674 | case REG_STRING: |
675 | ERR("Cast op can only be applied to numeric or floating point registers\n"); | |
676 | ret = -EINVAL; | |
677 | goto end; | |
678 | case REG_S64: | |
679 | break; | |
680 | case REG_DOUBLE: | |
681 | break; | |
682 | } | |
683 | if (insn->op == FILTER_OP_CAST_DOUBLE_TO_S64) { | |
684 | if (reg[insn->reg].type != REG_DOUBLE) { | |
685 | ERR("Cast expects double\n"); | |
97b58163 MD |
686 | ret = -EINVAL; |
687 | goto end; | |
97b58163 | 688 | } |
97b58163 | 689 | } |
bf956ec0 MD |
690 | break; |
691 | } | |
692 | case FILTER_OP_CAST_NOP: | |
693 | { | |
694 | break; | |
695 | } | |
696 | ||
697 | } | |
698 | end: | |
699 | return ret; | |
700 | } | |
701 | ||
702 | /* | |
703 | * Return value: | |
704 | * 0: success | |
705 | * <0: error | |
706 | */ | |
707 | static | |
708 | int validate_instruction_all_contexts(struct bytecode_runtime *bytecode, | |
709 | struct cds_lfht *merge_points, | |
710 | const struct vreg reg[NR_REG], | |
711 | void *start_pc, | |
712 | void *pc) | |
713 | { | |
714 | int ret; | |
715 | unsigned long target_pc = pc - start_pc; | |
716 | struct cds_lfht_iter iter; | |
717 | struct cds_lfht_node *node; | |
718 | unsigned long hash; | |
719 | ||
720 | /* Validate the context resulting from the previous instruction */ | |
721 | ret = validate_instruction_context(bytecode, reg, start_pc, pc); | |
722 | if (ret) | |
723 | return ret; | |
724 | ||
725 | /* Validate merge points */ | |
726 | hash = lttng_hash_mix((const void *) target_pc, sizeof(target_pc), | |
727 | lttng_hash_seed); | |
728 | cds_lfht_for_each_duplicate(merge_points, hash, lttng_hash_match, | |
729 | (const void *) target_pc, &iter, node) { | |
730 | struct lfht_mp_node *mp_node = | |
731 | caa_container_of(node, struct lfht_mp_node, node); | |
732 | ||
733 | dbg_printf("Filter: validate merge point at offset %lu\n", | |
734 | target_pc); | |
735 | ret = validate_instruction_context(bytecode, mp_node->reg, | |
736 | start_pc, pc); | |
737 | if (ret) | |
738 | return ret; | |
739 | /* Once validated, we can remove the merge point */ | |
740 | dbg_printf("Filter: remove one merge point at offset %lu\n", | |
741 | target_pc); | |
742 | ret = cds_lfht_del(merge_points, node); | |
743 | assert(!ret); | |
744 | } | |
745 | return 0; | |
746 | } | |
747 | ||
748 | /* | |
749 | * Return value: | |
750 | * >0: going to next insn. | |
751 | * 0: success, stop iteration. | |
752 | * <0: error | |
753 | */ | |
754 | static | |
755 | int exec_insn(struct bytecode_runtime *bytecode, | |
756 | struct cds_lfht *merge_points, | |
757 | struct vreg reg[NR_REG], | |
758 | void **_next_pc, | |
759 | void *pc) | |
760 | { | |
761 | int ret = 1; | |
762 | void *next_pc = *_next_pc; | |
763 | ||
764 | switch (*(filter_opcode_t *) pc) { | |
765 | case FILTER_OP_UNKNOWN: | |
766 | default: | |
767 | { | |
768 | ERR("unknown bytecode op %u\n", | |
769 | (unsigned int) *(filter_opcode_t *) pc); | |
770 | ret = -EINVAL; | |
771 | goto end; | |
772 | } | |
773 | ||
774 | case FILTER_OP_RETURN: | |
775 | { | |
776 | ret = 0; | |
777 | goto end; | |
778 | } | |
779 | ||
780 | /* binary */ | |
781 | case FILTER_OP_MUL: | |
782 | case FILTER_OP_DIV: | |
783 | case FILTER_OP_MOD: | |
784 | case FILTER_OP_PLUS: | |
785 | case FILTER_OP_MINUS: | |
786 | case FILTER_OP_RSHIFT: | |
787 | case FILTER_OP_LSHIFT: | |
788 | case FILTER_OP_BIN_AND: | |
789 | case FILTER_OP_BIN_OR: | |
790 | case FILTER_OP_BIN_XOR: | |
791 | { | |
792 | ERR("unsupported bytecode op %u\n", | |
793 | (unsigned int) *(filter_opcode_t *) pc); | |
794 | ret = -EINVAL; | |
795 | goto end; | |
796 | } | |
797 | ||
798 | case FILTER_OP_EQ: | |
799 | case FILTER_OP_NE: | |
800 | case FILTER_OP_GT: | |
801 | case FILTER_OP_LT: | |
802 | case FILTER_OP_GE: | |
803 | case FILTER_OP_LE: | |
804 | case FILTER_OP_EQ_STRING: | |
805 | case FILTER_OP_NE_STRING: | |
806 | case FILTER_OP_GT_STRING: | |
807 | case FILTER_OP_LT_STRING: | |
808 | case FILTER_OP_GE_STRING: | |
809 | case FILTER_OP_LE_STRING: | |
810 | case FILTER_OP_EQ_S64: | |
811 | case FILTER_OP_NE_S64: | |
812 | case FILTER_OP_GT_S64: | |
813 | case FILTER_OP_LT_S64: | |
814 | case FILTER_OP_GE_S64: | |
815 | case FILTER_OP_LE_S64: | |
bf956ec0 MD |
816 | case FILTER_OP_EQ_DOUBLE: |
817 | case FILTER_OP_NE_DOUBLE: | |
818 | case FILTER_OP_GT_DOUBLE: | |
819 | case FILTER_OP_LT_DOUBLE: | |
820 | case FILTER_OP_GE_DOUBLE: | |
821 | case FILTER_OP_LE_DOUBLE: | |
822 | { | |
dca09eab | 823 | reg[REG_R0].type = REG_S64; |
bf956ec0 MD |
824 | next_pc += sizeof(struct binary_op); |
825 | break; | |
826 | } | |
827 | ||
828 | /* unary */ | |
829 | case FILTER_OP_UNARY_PLUS: | |
830 | case FILTER_OP_UNARY_MINUS: | |
831 | case FILTER_OP_UNARY_NOT: | |
832 | case FILTER_OP_UNARY_PLUS_S64: | |
833 | case FILTER_OP_UNARY_MINUS_S64: | |
834 | case FILTER_OP_UNARY_NOT_S64: | |
835 | { | |
836 | reg[REG_R0].type = REG_S64; | |
837 | next_pc += sizeof(struct unary_op); | |
838 | break; | |
839 | } | |
840 | ||
841 | case FILTER_OP_UNARY_PLUS_DOUBLE: | |
842 | case FILTER_OP_UNARY_MINUS_DOUBLE: | |
843 | case FILTER_OP_UNARY_NOT_DOUBLE: | |
844 | { | |
845 | reg[REG_R0].type = REG_DOUBLE; | |
846 | next_pc += sizeof(struct unary_op); | |
847 | break; | |
848 | } | |
849 | ||
850 | /* logical */ | |
851 | case FILTER_OP_AND: | |
852 | case FILTER_OP_OR: | |
853 | { | |
854 | struct logical_op *insn = (struct logical_op *) pc; | |
855 | int merge_ret; | |
856 | ||
857 | /* Add merge point to table */ | |
858 | merge_ret = merge_point_add(merge_points, insn->skip_offset, reg); | |
859 | if (merge_ret) { | |
860 | ret = merge_ret; | |
861 | goto end; | |
97b58163 | 862 | } |
bf956ec0 MD |
863 | /* Continue to next instruction */ |
864 | next_pc += sizeof(struct logical_op); | |
865 | break; | |
866 | } | |
867 | ||
868 | /* load */ | |
869 | case FILTER_OP_LOAD_FIELD_REF: | |
870 | { | |
871 | ERR("Unknown field ref type\n"); | |
872 | ret = -EINVAL; | |
873 | goto end; | |
874 | } | |
875 | case FILTER_OP_LOAD_FIELD_REF_STRING: | |
876 | case FILTER_OP_LOAD_FIELD_REF_SEQUENCE: | |
877 | { | |
878 | struct load_op *insn = (struct load_op *) pc; | |
879 | ||
880 | reg[insn->reg].type = REG_STRING; | |
881 | reg[insn->reg].literal = 0; | |
882 | next_pc += sizeof(struct load_op) + sizeof(struct field_ref); | |
883 | break; | |
884 | } | |
885 | case FILTER_OP_LOAD_FIELD_REF_S64: | |
886 | { | |
887 | struct load_op *insn = (struct load_op *) pc; | |
888 | ||
889 | reg[insn->reg].type = REG_S64; | |
890 | reg[insn->reg].literal = 0; | |
891 | next_pc += sizeof(struct load_op) + sizeof(struct field_ref); | |
892 | break; | |
893 | } | |
894 | case FILTER_OP_LOAD_FIELD_REF_DOUBLE: | |
895 | { | |
896 | struct load_op *insn = (struct load_op *) pc; | |
897 | ||
898 | reg[insn->reg].type = REG_DOUBLE; | |
899 | reg[insn->reg].literal = 0; | |
900 | next_pc += sizeof(struct load_op) + sizeof(struct field_ref); | |
901 | break; | |
902 | } | |
903 | ||
904 | case FILTER_OP_LOAD_STRING: | |
905 | { | |
906 | struct load_op *insn = (struct load_op *) pc; | |
907 | ||
908 | reg[insn->reg].type = REG_STRING; | |
909 | reg[insn->reg].literal = 1; | |
910 | next_pc += sizeof(struct load_op) + strlen(insn->data) + 1; | |
911 | break; | |
912 | } | |
913 | ||
914 | case FILTER_OP_LOAD_S64: | |
915 | { | |
916 | struct load_op *insn = (struct load_op *) pc; | |
917 | ||
918 | reg[insn->reg].type = REG_S64; | |
919 | reg[insn->reg].literal = 1; | |
920 | next_pc += sizeof(struct load_op) | |
921 | + sizeof(struct literal_numeric); | |
922 | break; | |
923 | } | |
924 | ||
925 | case FILTER_OP_LOAD_DOUBLE: | |
926 | { | |
927 | struct load_op *insn = (struct load_op *) pc; | |
928 | ||
929 | reg[insn->reg].type = REG_DOUBLE; | |
930 | reg[insn->reg].literal = 1; | |
931 | next_pc += sizeof(struct load_op) | |
932 | + sizeof(struct literal_double); | |
933 | break; | |
934 | } | |
935 | ||
936 | case FILTER_OP_CAST_TO_S64: | |
937 | case FILTER_OP_CAST_DOUBLE_TO_S64: | |
938 | { | |
939 | struct cast_op *insn = (struct cast_op *) pc; | |
940 | ||
941 | reg[insn->reg].type = REG_S64; | |
942 | next_pc += sizeof(struct cast_op); | |
943 | break; | |
944 | } | |
945 | case FILTER_OP_CAST_NOP: | |
946 | { | |
947 | next_pc += sizeof(struct cast_op); | |
948 | break; | |
949 | } | |
97b58163 | 950 | |
bf956ec0 MD |
951 | } |
952 | end: | |
953 | *_next_pc = next_pc; | |
954 | return ret; | |
955 | } | |
956 | ||
957 | /* | |
958 | * Never called concurrently (hash seed is shared). | |
959 | */ | |
960 | int lttng_filter_validate_bytecode(struct bytecode_runtime *bytecode) | |
961 | { | |
962 | struct cds_lfht *merge_points; | |
963 | void *pc, *next_pc, *start_pc; | |
964 | int ret = -EINVAL; | |
965 | struct vreg reg[NR_REG]; | |
966 | int i; | |
967 | ||
968 | for (i = 0; i < NR_REG; i++) { | |
969 | reg[i].type = REG_TYPE_UNKNOWN; | |
970 | reg[i].literal = 0; | |
971 | } | |
972 | ||
973 | if (!lttng_hash_seed_ready) { | |
974 | lttng_hash_seed = time(NULL); | |
975 | lttng_hash_seed_ready = 1; | |
976 | } | |
977 | /* | |
978 | * Note: merge_points hash table used by single thread, and | |
979 | * never concurrently resized. Therefore, we can use it without | |
980 | * holding RCU read-side lock and free nodes without using | |
981 | * call_rcu. | |
982 | */ | |
983 | merge_points = cds_lfht_new(DEFAULT_NR_MERGE_POINTS, | |
984 | MIN_NR_BUCKETS, MAX_NR_BUCKETS, | |
985 | 0, NULL); | |
986 | if (!merge_points) { | |
987 | ERR("Error allocating hash table for bytecode validation\n"); | |
988 | return -ENOMEM; | |
989 | } | |
990 | start_pc = &bytecode->data[0]; | |
991 | for (pc = next_pc = start_pc; pc - start_pc < bytecode->len; | |
992 | pc = next_pc) { | |
993 | if (bytecode_validate_overflow(bytecode, start_pc, pc) != 0) { | |
994 | ERR("filter bytecode overflow\n"); | |
995 | ret = -EINVAL; | |
996 | goto end; | |
97b58163 | 997 | } |
bf956ec0 MD |
998 | dbg_printf("Validating op %s (%u)\n", |
999 | print_op((unsigned int) *(filter_opcode_t *) pc), | |
1000 | (unsigned int) *(filter_opcode_t *) pc); | |
1001 | ||
1002 | /* | |
1003 | * For each instruction, validate the current context | |
1004 | * (traversal of entire execution flow), and validate | |
1005 | * all merge points targeting this instruction. | |
1006 | */ | |
1007 | ret = validate_instruction_all_contexts(bytecode, merge_points, | |
1008 | reg, start_pc, pc); | |
1009 | if (ret) | |
1010 | goto end; | |
1011 | ret = exec_insn(bytecode, merge_points, reg, &next_pc, pc); | |
1012 | if (ret <= 0) | |
1013 | goto end; | |
97b58163 MD |
1014 | } |
1015 | end: | |
bf956ec0 MD |
1016 | if (delete_all_nodes(merge_points)) { |
1017 | if (!ret) { | |
1018 | ERR("Unexpected merge points\n"); | |
1019 | ret = -EINVAL; | |
1020 | } | |
1021 | } | |
1022 | if (cds_lfht_destroy(merge_points, NULL)) { | |
1023 | ERR("Error destroying hash table\n"); | |
1024 | } | |
97b58163 MD |
1025 | return ret; |
1026 | } |