Commit | Line | Data |
---|---|---|
97b58163 MD |
1 | /* |
2 | * lttng-filter-validator.c | |
3 | * | |
4 | * LTTng UST filter bytecode validator. | |
5 | * | |
6 | * Copyright (C) 2010-2012 Mathieu Desnoyers <mathieu.desnoyers@efficios.com> | |
7 | * | |
8 | * This library is free software; you can redistribute it and/or | |
9 | * modify it under the terms of the GNU Lesser General Public | |
10 | * License as published by the Free Software Foundation; only | |
11 | * version 2.1 of the License. | |
12 | * | |
13 | * This library is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
16 | * Lesser General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU Lesser General Public | |
19 | * License along with this library; if not, write to the Free Software | |
20 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA | |
21 | */ | |
22 | ||
bf956ec0 MD |
23 | #define _LGPL_SOURCE |
24 | #include <urcu-bp.h> | |
25 | #include <time.h> | |
97b58163 MD |
26 | #include "lttng-filter.h" |
27 | ||
bf956ec0 MD |
28 | #include <urcu/rculfhash.h> |
29 | #include "lttng-hash-helper.h" | |
30 | ||
31 | /* merge point table node */ | |
32 | struct lfht_mp_node { | |
33 | struct cds_lfht_node node; | |
34 | ||
35 | /* Context at merge point */ | |
36 | struct vreg reg[NR_REG]; | |
37 | unsigned long target_pc; | |
38 | }; | |
39 | ||
40 | static unsigned long lttng_hash_seed; | |
41 | static unsigned int lttng_hash_seed_ready; | |
42 | ||
43 | static | |
44 | int lttng_hash_match(struct cds_lfht_node *node, const void *key) | |
45 | { | |
46 | struct lfht_mp_node *mp_node = | |
47 | caa_container_of(node, struct lfht_mp_node, node); | |
48 | unsigned long key_pc = (unsigned long) key; | |
49 | ||
50 | if (mp_node->target_pc == key_pc) | |
51 | return 1; | |
52 | else | |
53 | return 0; | |
54 | } | |
55 | ||
56 | static | |
57 | int merge_point_add(struct cds_lfht *ht, unsigned long target_pc, | |
58 | const struct vreg reg[NR_REG]) | |
59 | { | |
60 | struct lfht_mp_node *node; | |
61 | unsigned long hash = lttng_hash_mix((const void *) target_pc, | |
62 | sizeof(target_pc), | |
63 | lttng_hash_seed); | |
64 | ||
65 | dbg_printf("Filter: adding merge point at offset %lu, hash %lu\n", | |
66 | target_pc, hash); | |
67 | node = zmalloc(sizeof(struct lfht_mp_node)); | |
68 | if (!node) | |
69 | return -ENOMEM; | |
70 | node->target_pc = target_pc; | |
71 | memcpy(node->reg, reg, sizeof(node->reg)); | |
72 | cds_lfht_add(ht, hash, &node->node); | |
73 | return 0; | |
74 | } | |
75 | ||
76 | /* | |
77 | * Number of merge points for hash table size. Hash table initialized to | |
78 | * that size, and we do not resize, because we do not want to trigger | |
79 | * RCU worker thread execution: fall-back on linear traversal if number | |
80 | * of merge points exceeds this value. | |
81 | */ | |
82 | #define DEFAULT_NR_MERGE_POINTS 128 | |
83 | #define MIN_NR_BUCKETS 128 | |
84 | #define MAX_NR_BUCKETS 128 | |
85 | ||
97b58163 | 86 | static |
bf956ec0 | 87 | int bin_op_compare_check(const struct vreg reg[NR_REG], const char *str) |
97b58163 MD |
88 | { |
89 | switch (reg[REG_R0].type) { | |
90 | default: | |
91 | goto error_unknown; | |
92 | ||
93 | case REG_STRING: | |
94 | switch (reg[REG_R1].type) { | |
95 | default: | |
96 | goto error_unknown; | |
97 | ||
98 | case REG_STRING: | |
99 | break; | |
100 | case REG_S64: | |
101 | case REG_DOUBLE: | |
102 | goto error_mismatch; | |
103 | } | |
104 | break; | |
105 | case REG_S64: | |
106 | case REG_DOUBLE: | |
107 | switch (reg[REG_R1].type) { | |
108 | default: | |
109 | goto error_unknown; | |
110 | ||
111 | case REG_STRING: | |
112 | goto error_mismatch; | |
113 | ||
114 | case REG_S64: | |
115 | case REG_DOUBLE: | |
116 | break; | |
117 | } | |
118 | break; | |
119 | } | |
120 | return 0; | |
121 | ||
122 | error_unknown: | |
123 | ||
124 | return -EINVAL; | |
125 | error_mismatch: | |
126 | ERR("type mismatch for '%s' binary operator\n", str); | |
127 | return -EINVAL; | |
128 | } | |
129 | ||
130 | /* | |
131 | * Validate bytecode range overflow within the validation pass. | |
132 | * Called for each instruction encountered. | |
133 | */ | |
134 | static | |
135 | int bytecode_validate_overflow(struct bytecode_runtime *bytecode, | |
bf956ec0 | 136 | void *start_pc, void *pc) |
97b58163 MD |
137 | { |
138 | int ret = 0; | |
139 | ||
140 | switch (*(filter_opcode_t *) pc) { | |
141 | case FILTER_OP_UNKNOWN: | |
142 | default: | |
143 | { | |
144 | ERR("unknown bytecode op %u\n", | |
145 | (unsigned int) *(filter_opcode_t *) pc); | |
146 | ret = -EINVAL; | |
147 | break; | |
148 | } | |
149 | ||
150 | case FILTER_OP_RETURN: | |
151 | { | |
152 | if (unlikely(pc + sizeof(struct return_op) | |
153 | > start_pc + bytecode->len)) { | |
154 | ret = -EINVAL; | |
155 | } | |
156 | break; | |
157 | } | |
158 | ||
159 | /* binary */ | |
160 | case FILTER_OP_MUL: | |
161 | case FILTER_OP_DIV: | |
162 | case FILTER_OP_MOD: | |
163 | case FILTER_OP_PLUS: | |
164 | case FILTER_OP_MINUS: | |
165 | case FILTER_OP_RSHIFT: | |
166 | case FILTER_OP_LSHIFT: | |
167 | case FILTER_OP_BIN_AND: | |
168 | case FILTER_OP_BIN_OR: | |
169 | case FILTER_OP_BIN_XOR: | |
170 | { | |
171 | ERR("unsupported bytecode op %u\n", | |
172 | (unsigned int) *(filter_opcode_t *) pc); | |
173 | ret = -EINVAL; | |
174 | break; | |
175 | } | |
176 | ||
177 | case FILTER_OP_EQ: | |
178 | case FILTER_OP_NE: | |
179 | case FILTER_OP_GT: | |
180 | case FILTER_OP_LT: | |
181 | case FILTER_OP_GE: | |
182 | case FILTER_OP_LE: | |
183 | case FILTER_OP_EQ_STRING: | |
184 | case FILTER_OP_NE_STRING: | |
185 | case FILTER_OP_GT_STRING: | |
186 | case FILTER_OP_LT_STRING: | |
187 | case FILTER_OP_GE_STRING: | |
188 | case FILTER_OP_LE_STRING: | |
189 | case FILTER_OP_EQ_S64: | |
190 | case FILTER_OP_NE_S64: | |
191 | case FILTER_OP_GT_S64: | |
192 | case FILTER_OP_LT_S64: | |
193 | case FILTER_OP_GE_S64: | |
194 | case FILTER_OP_LE_S64: | |
195 | case FILTER_OP_EQ_DOUBLE: | |
196 | case FILTER_OP_NE_DOUBLE: | |
197 | case FILTER_OP_GT_DOUBLE: | |
198 | case FILTER_OP_LT_DOUBLE: | |
199 | case FILTER_OP_GE_DOUBLE: | |
200 | case FILTER_OP_LE_DOUBLE: | |
201 | { | |
202 | if (unlikely(pc + sizeof(struct binary_op) | |
203 | > start_pc + bytecode->len)) { | |
204 | ret = -EINVAL; | |
205 | } | |
206 | break; | |
207 | } | |
208 | ||
209 | /* unary */ | |
210 | case FILTER_OP_UNARY_PLUS: | |
211 | case FILTER_OP_UNARY_MINUS: | |
212 | case FILTER_OP_UNARY_NOT: | |
213 | case FILTER_OP_UNARY_PLUS_S64: | |
214 | case FILTER_OP_UNARY_MINUS_S64: | |
215 | case FILTER_OP_UNARY_NOT_S64: | |
216 | case FILTER_OP_UNARY_PLUS_DOUBLE: | |
217 | case FILTER_OP_UNARY_MINUS_DOUBLE: | |
218 | case FILTER_OP_UNARY_NOT_DOUBLE: | |
219 | { | |
220 | if (unlikely(pc + sizeof(struct unary_op) | |
221 | > start_pc + bytecode->len)) { | |
222 | ret = -EINVAL; | |
223 | } | |
224 | break; | |
225 | } | |
226 | ||
227 | /* logical */ | |
228 | case FILTER_OP_AND: | |
229 | case FILTER_OP_OR: | |
230 | { | |
231 | if (unlikely(pc + sizeof(struct logical_op) | |
232 | > start_pc + bytecode->len)) { | |
233 | ret = -EINVAL; | |
234 | } | |
235 | break; | |
236 | } | |
237 | ||
238 | /* load */ | |
239 | case FILTER_OP_LOAD_FIELD_REF: | |
240 | { | |
241 | ERR("Unknown field ref type\n"); | |
242 | ret = -EINVAL; | |
243 | break; | |
244 | } | |
245 | case FILTER_OP_LOAD_FIELD_REF_STRING: | |
246 | case FILTER_OP_LOAD_FIELD_REF_SEQUENCE: | |
247 | case FILTER_OP_LOAD_FIELD_REF_S64: | |
248 | case FILTER_OP_LOAD_FIELD_REF_DOUBLE: | |
249 | { | |
250 | if (unlikely(pc + sizeof(struct load_op) + sizeof(struct field_ref) | |
251 | > start_pc + bytecode->len)) { | |
252 | ret = -EINVAL; | |
253 | } | |
254 | break; | |
255 | } | |
256 | ||
257 | case FILTER_OP_LOAD_STRING: | |
258 | { | |
259 | struct load_op *insn = (struct load_op *) pc; | |
260 | uint32_t str_len, maxlen; | |
261 | ||
262 | if (unlikely(pc + sizeof(struct load_op) | |
263 | > start_pc + bytecode->len)) { | |
264 | ret = -EINVAL; | |
265 | break; | |
266 | } | |
267 | ||
268 | maxlen = start_pc + bytecode->len - pc - sizeof(struct load_op); | |
269 | str_len = strnlen(insn->data, maxlen); | |
270 | if (unlikely(str_len >= maxlen)) { | |
271 | /* Final '\0' not found within range */ | |
272 | ret = -EINVAL; | |
273 | } | |
274 | break; | |
275 | } | |
276 | ||
277 | case FILTER_OP_LOAD_S64: | |
278 | { | |
279 | if (unlikely(pc + sizeof(struct load_op) + sizeof(struct literal_numeric) | |
280 | > start_pc + bytecode->len)) { | |
281 | ret = -EINVAL; | |
282 | } | |
283 | break; | |
284 | } | |
285 | ||
286 | case FILTER_OP_LOAD_DOUBLE: | |
287 | { | |
288 | if (unlikely(pc + sizeof(struct load_op) + sizeof(struct literal_double) | |
289 | > start_pc + bytecode->len)) { | |
290 | ret = -EINVAL; | |
291 | } | |
292 | break; | |
293 | } | |
294 | ||
295 | case FILTER_OP_CAST_TO_S64: | |
296 | case FILTER_OP_CAST_DOUBLE_TO_S64: | |
297 | case FILTER_OP_CAST_NOP: | |
298 | { | |
299 | if (unlikely(pc + sizeof(struct cast_op) | |
300 | > start_pc + bytecode->len)) { | |
301 | ret = -EINVAL; | |
302 | } | |
303 | break; | |
304 | } | |
305 | } | |
306 | ||
307 | return ret; | |
308 | } | |
309 | ||
bf956ec0 MD |
310 | static |
311 | unsigned long delete_all_nodes(struct cds_lfht *ht) | |
97b58163 | 312 | { |
bf956ec0 MD |
313 | struct cds_lfht_iter iter; |
314 | struct lfht_mp_node *node; | |
315 | unsigned long nr_nodes = 0; | |
97b58163 | 316 | |
bf956ec0 MD |
317 | cds_lfht_for_each_entry(ht, &iter, node, node) { |
318 | int ret; | |
319 | ||
320 | ret = cds_lfht_del(ht, cds_lfht_iter_get_node(&iter)); | |
321 | assert(!ret); | |
322 | /* note: this hash table is never used concurrently */ | |
323 | free(node); | |
324 | nr_nodes++; | |
97b58163 | 325 | } |
bf956ec0 MD |
326 | return nr_nodes; |
327 | } | |
97b58163 | 328 | |
bf956ec0 MD |
329 | /* |
330 | * Return value: | |
331 | * 0: success | |
332 | * <0: error | |
333 | */ | |
334 | static | |
335 | int validate_instruction_context(struct bytecode_runtime *bytecode, | |
336 | const struct vreg reg[NR_REG], | |
337 | void *start_pc, | |
338 | void *pc) | |
339 | { | |
340 | int ret = 0; | |
341 | ||
342 | switch (*(filter_opcode_t *) pc) { | |
343 | case FILTER_OP_UNKNOWN: | |
344 | default: | |
345 | { | |
346 | ERR("unknown bytecode op %u\n", | |
97b58163 | 347 | (unsigned int) *(filter_opcode_t *) pc); |
bf956ec0 MD |
348 | ret = -EINVAL; |
349 | goto end; | |
350 | } | |
351 | ||
352 | case FILTER_OP_RETURN: | |
353 | { | |
354 | goto end; | |
355 | } | |
356 | ||
357 | /* binary */ | |
358 | case FILTER_OP_MUL: | |
359 | case FILTER_OP_DIV: | |
360 | case FILTER_OP_MOD: | |
361 | case FILTER_OP_PLUS: | |
362 | case FILTER_OP_MINUS: | |
363 | case FILTER_OP_RSHIFT: | |
364 | case FILTER_OP_LSHIFT: | |
365 | case FILTER_OP_BIN_AND: | |
366 | case FILTER_OP_BIN_OR: | |
367 | case FILTER_OP_BIN_XOR: | |
368 | { | |
369 | ERR("unsupported bytecode op %u\n", | |
370 | (unsigned int) *(filter_opcode_t *) pc); | |
371 | ret = -EINVAL; | |
372 | goto end; | |
373 | } | |
97b58163 | 374 | |
bf956ec0 MD |
375 | case FILTER_OP_EQ: |
376 | { | |
377 | ret = bin_op_compare_check(reg, "=="); | |
378 | if (ret) | |
379 | goto end; | |
380 | break; | |
381 | } | |
382 | case FILTER_OP_NE: | |
383 | { | |
384 | ret = bin_op_compare_check(reg, "!="); | |
385 | if (ret) | |
386 | goto end; | |
387 | break; | |
388 | } | |
389 | case FILTER_OP_GT: | |
390 | { | |
391 | ret = bin_op_compare_check(reg, ">"); | |
392 | if (ret) | |
393 | goto end; | |
394 | break; | |
395 | } | |
396 | case FILTER_OP_LT: | |
397 | { | |
398 | ret = bin_op_compare_check(reg, "<"); | |
399 | if (ret) | |
400 | goto end; | |
401 | break; | |
402 | } | |
403 | case FILTER_OP_GE: | |
404 | { | |
405 | ret = bin_op_compare_check(reg, ">="); | |
406 | if (ret) | |
407 | goto end; | |
408 | break; | |
409 | } | |
410 | case FILTER_OP_LE: | |
411 | { | |
412 | ret = bin_op_compare_check(reg, "<="); | |
413 | if (ret) | |
97b58163 | 414 | goto end; |
bf956ec0 MD |
415 | break; |
416 | } | |
97b58163 | 417 | |
bf956ec0 MD |
418 | case FILTER_OP_EQ_STRING: |
419 | case FILTER_OP_NE_STRING: | |
420 | case FILTER_OP_GT_STRING: | |
421 | case FILTER_OP_LT_STRING: | |
422 | case FILTER_OP_GE_STRING: | |
423 | case FILTER_OP_LE_STRING: | |
424 | { | |
425 | if (reg[REG_R0].type != REG_STRING | |
426 | || reg[REG_R1].type != REG_STRING) { | |
427 | ERR("Unexpected register type for string comparator\n"); | |
97b58163 MD |
428 | ret = -EINVAL; |
429 | goto end; | |
97b58163 | 430 | } |
bf956ec0 MD |
431 | break; |
432 | } | |
97b58163 | 433 | |
bf956ec0 MD |
434 | case FILTER_OP_EQ_S64: |
435 | case FILTER_OP_NE_S64: | |
436 | case FILTER_OP_GT_S64: | |
437 | case FILTER_OP_LT_S64: | |
438 | case FILTER_OP_GE_S64: | |
439 | case FILTER_OP_LE_S64: | |
440 | { | |
441 | if (reg[REG_R0].type != REG_S64 | |
442 | || reg[REG_R1].type != REG_S64) { | |
443 | ERR("Unexpected register type for s64 comparator\n"); | |
444 | ret = -EINVAL; | |
445 | goto end; | |
97b58163 | 446 | } |
bf956ec0 MD |
447 | break; |
448 | } | |
97b58163 | 449 | |
bf956ec0 MD |
450 | case FILTER_OP_EQ_DOUBLE: |
451 | case FILTER_OP_NE_DOUBLE: | |
452 | case FILTER_OP_GT_DOUBLE: | |
453 | case FILTER_OP_LT_DOUBLE: | |
454 | case FILTER_OP_GE_DOUBLE: | |
455 | case FILTER_OP_LE_DOUBLE: | |
456 | { | |
457 | if ((reg[REG_R0].type != REG_DOUBLE && reg[REG_R0].type != REG_S64) | |
458 | || (reg[REG_R1].type != REG_DOUBLE && reg[REG_R1].type != REG_S64)) { | |
459 | ERR("Unexpected register type for double comparator\n"); | |
460 | ret = -EINVAL; | |
461 | goto end; | |
97b58163 | 462 | } |
bf956ec0 MD |
463 | if (reg[REG_R0].type != REG_DOUBLE && reg[REG_R1].type != REG_DOUBLE) { |
464 | ERR("Double operator should have at least one double register\n"); | |
465 | ret = -EINVAL; | |
466 | goto end; | |
97b58163 | 467 | } |
bf956ec0 MD |
468 | break; |
469 | } | |
97b58163 | 470 | |
bf956ec0 MD |
471 | /* unary */ |
472 | case FILTER_OP_UNARY_PLUS: | |
473 | case FILTER_OP_UNARY_MINUS: | |
474 | case FILTER_OP_UNARY_NOT: | |
475 | { | |
476 | struct unary_op *insn = (struct unary_op *) pc; | |
97b58163 | 477 | |
bf956ec0 MD |
478 | if (unlikely(insn->reg >= REG_ERROR)) { |
479 | ERR("invalid register %u\n", | |
480 | (unsigned int) insn->reg); | |
481 | ret = -EINVAL; | |
482 | goto end; | |
483 | } | |
484 | switch (reg[insn->reg].type) { | |
485 | default: | |
486 | ERR("unknown register type\n"); | |
487 | ret = -EINVAL; | |
488 | goto end; | |
97b58163 | 489 | |
bf956ec0 MD |
490 | case REG_STRING: |
491 | ERR("Unary op can only be applied to numeric or floating point registers\n"); | |
492 | ret = -EINVAL; | |
493 | goto end; | |
494 | case REG_S64: | |
495 | break; | |
496 | case REG_DOUBLE: | |
97b58163 MD |
497 | break; |
498 | } | |
bf956ec0 MD |
499 | break; |
500 | } | |
97b58163 | 501 | |
bf956ec0 MD |
502 | case FILTER_OP_UNARY_PLUS_S64: |
503 | case FILTER_OP_UNARY_MINUS_S64: | |
504 | case FILTER_OP_UNARY_NOT_S64: | |
505 | { | |
506 | struct unary_op *insn = (struct unary_op *) pc; | |
97b58163 | 507 | |
bf956ec0 MD |
508 | if (unlikely(insn->reg >= REG_ERROR)) { |
509 | ERR("invalid register %u\n", | |
510 | (unsigned int) insn->reg); | |
511 | ret = -EINVAL; | |
512 | goto end; | |
513 | } | |
514 | if (reg[insn->reg].type != REG_S64) { | |
515 | ERR("Invalid register type\n"); | |
516 | ret = -EINVAL; | |
517 | goto end; | |
97b58163 | 518 | } |
bf956ec0 MD |
519 | break; |
520 | } | |
97b58163 | 521 | |
bf956ec0 MD |
522 | case FILTER_OP_UNARY_PLUS_DOUBLE: |
523 | case FILTER_OP_UNARY_MINUS_DOUBLE: | |
524 | case FILTER_OP_UNARY_NOT_DOUBLE: | |
525 | { | |
526 | struct unary_op *insn = (struct unary_op *) pc; | |
97b58163 | 527 | |
bf956ec0 MD |
528 | if (unlikely(insn->reg >= REG_ERROR)) { |
529 | ERR("invalid register %u\n", | |
530 | (unsigned int) insn->reg); | |
531 | ret = -EINVAL; | |
532 | goto end; | |
97b58163 | 533 | } |
bf956ec0 MD |
534 | if (reg[insn->reg].type != REG_DOUBLE) { |
535 | ERR("Invalid register type\n"); | |
536 | ret = -EINVAL; | |
537 | goto end; | |
538 | } | |
539 | break; | |
540 | } | |
97b58163 | 541 | |
bf956ec0 MD |
542 | /* logical */ |
543 | case FILTER_OP_AND: | |
544 | case FILTER_OP_OR: | |
545 | { | |
546 | struct logical_op *insn = (struct logical_op *) pc; | |
97b58163 | 547 | |
bf956ec0 MD |
548 | if (reg[REG_R0].type != REG_S64) { |
549 | ERR("Logical comparator expects S64 register\n"); | |
550 | ret = -EINVAL; | |
551 | goto end; | |
97b58163 MD |
552 | } |
553 | ||
bf956ec0 MD |
554 | dbg_printf("Validate jumping to bytecode offset %u\n", |
555 | (unsigned int) insn->skip_offset); | |
556 | if (unlikely(start_pc + insn->skip_offset <= pc)) { | |
557 | ERR("Loops are not allowed in bytecode\n"); | |
97b58163 MD |
558 | ret = -EINVAL; |
559 | goto end; | |
560 | } | |
bf956ec0 MD |
561 | break; |
562 | } | |
97b58163 | 563 | |
bf956ec0 MD |
564 | /* load */ |
565 | case FILTER_OP_LOAD_FIELD_REF: | |
566 | { | |
567 | ERR("Unknown field ref type\n"); | |
568 | ret = -EINVAL; | |
569 | goto end; | |
570 | } | |
571 | case FILTER_OP_LOAD_FIELD_REF_STRING: | |
572 | case FILTER_OP_LOAD_FIELD_REF_SEQUENCE: | |
573 | { | |
574 | struct load_op *insn = (struct load_op *) pc; | |
575 | struct field_ref *ref = (struct field_ref *) insn->data; | |
576 | ||
577 | if (unlikely(insn->reg >= REG_ERROR)) { | |
578 | ERR("invalid register %u\n", | |
579 | (unsigned int) insn->reg); | |
580 | ret = -EINVAL; | |
581 | goto end; | |
97b58163 | 582 | } |
bf956ec0 MD |
583 | dbg_printf("Validate load field ref offset %u type string\n", |
584 | ref->offset); | |
585 | break; | |
586 | } | |
587 | case FILTER_OP_LOAD_FIELD_REF_S64: | |
588 | { | |
589 | struct load_op *insn = (struct load_op *) pc; | |
590 | struct field_ref *ref = (struct field_ref *) insn->data; | |
97b58163 | 591 | |
bf956ec0 MD |
592 | if (unlikely(insn->reg >= REG_ERROR)) { |
593 | ERR("invalid register %u\n", | |
594 | (unsigned int) insn->reg); | |
595 | ret = -EINVAL; | |
596 | goto end; | |
97b58163 | 597 | } |
bf956ec0 MD |
598 | dbg_printf("Validate load field ref offset %u type s64\n", |
599 | ref->offset); | |
600 | break; | |
601 | } | |
602 | case FILTER_OP_LOAD_FIELD_REF_DOUBLE: | |
603 | { | |
604 | struct load_op *insn = (struct load_op *) pc; | |
605 | struct field_ref *ref = (struct field_ref *) insn->data; | |
97b58163 | 606 | |
bf956ec0 MD |
607 | if (unlikely(insn->reg >= REG_ERROR)) { |
608 | ERR("invalid register %u\n", | |
609 | (unsigned int) insn->reg); | |
610 | ret = -EINVAL; | |
611 | goto end; | |
97b58163 | 612 | } |
bf956ec0 MD |
613 | dbg_printf("Validate load field ref offset %u type double\n", |
614 | ref->offset); | |
615 | break; | |
616 | } | |
97b58163 | 617 | |
bf956ec0 MD |
618 | case FILTER_OP_LOAD_STRING: |
619 | { | |
620 | struct load_op *insn = (struct load_op *) pc; | |
97b58163 | 621 | |
bf956ec0 MD |
622 | if (unlikely(insn->reg >= REG_ERROR)) { |
623 | ERR("invalid register %u\n", | |
624 | (unsigned int) insn->reg); | |
625 | ret = -EINVAL; | |
626 | goto end; | |
97b58163 | 627 | } |
bf956ec0 MD |
628 | break; |
629 | } | |
97b58163 | 630 | |
bf956ec0 MD |
631 | case FILTER_OP_LOAD_S64: |
632 | { | |
633 | struct load_op *insn = (struct load_op *) pc; | |
97b58163 | 634 | |
bf956ec0 MD |
635 | if (unlikely(insn->reg >= REG_ERROR)) { |
636 | ERR("invalid register %u\n", | |
637 | (unsigned int) insn->reg); | |
638 | ret = -EINVAL; | |
639 | goto end; | |
97b58163 | 640 | } |
bf956ec0 MD |
641 | break; |
642 | } | |
97b58163 | 643 | |
bf956ec0 MD |
644 | case FILTER_OP_LOAD_DOUBLE: |
645 | { | |
646 | struct load_op *insn = (struct load_op *) pc; | |
97b58163 | 647 | |
bf956ec0 MD |
648 | if (unlikely(insn->reg >= REG_ERROR)) { |
649 | ERR("invalid register %u\n", | |
650 | (unsigned int) insn->reg); | |
651 | ret = -EINVAL; | |
652 | goto end; | |
97b58163 | 653 | } |
bf956ec0 MD |
654 | break; |
655 | } | |
97b58163 | 656 | |
bf956ec0 MD |
657 | case FILTER_OP_CAST_TO_S64: |
658 | case FILTER_OP_CAST_DOUBLE_TO_S64: | |
659 | { | |
660 | struct cast_op *insn = (struct cast_op *) pc; | |
97b58163 | 661 | |
bf956ec0 MD |
662 | if (unlikely(insn->reg >= REG_ERROR)) { |
663 | ERR("invalid register %u\n", | |
664 | (unsigned int) insn->reg); | |
665 | ret = -EINVAL; | |
666 | goto end; | |
667 | } | |
668 | switch (reg[insn->reg].type) { | |
669 | default: | |
670 | ERR("unknown register type\n"); | |
671 | ret = -EINVAL; | |
672 | goto end; | |
97b58163 | 673 | |
bf956ec0 MD |
674 | case REG_STRING: |
675 | ERR("Cast op can only be applied to numeric or floating point registers\n"); | |
676 | ret = -EINVAL; | |
677 | goto end; | |
678 | case REG_S64: | |
679 | break; | |
680 | case REG_DOUBLE: | |
681 | break; | |
682 | } | |
683 | if (insn->op == FILTER_OP_CAST_DOUBLE_TO_S64) { | |
684 | if (reg[insn->reg].type != REG_DOUBLE) { | |
685 | ERR("Cast expects double\n"); | |
97b58163 MD |
686 | ret = -EINVAL; |
687 | goto end; | |
97b58163 | 688 | } |
97b58163 | 689 | } |
bf956ec0 MD |
690 | break; |
691 | } | |
692 | case FILTER_OP_CAST_NOP: | |
693 | { | |
694 | break; | |
695 | } | |
696 | ||
697 | } | |
698 | end: | |
699 | return ret; | |
700 | } | |
701 | ||
702 | /* | |
703 | * Return value: | |
704 | * 0: success | |
705 | * <0: error | |
706 | */ | |
707 | static | |
708 | int validate_instruction_all_contexts(struct bytecode_runtime *bytecode, | |
709 | struct cds_lfht *merge_points, | |
710 | const struct vreg reg[NR_REG], | |
711 | void *start_pc, | |
712 | void *pc) | |
713 | { | |
714 | int ret; | |
715 | unsigned long target_pc = pc - start_pc; | |
716 | struct cds_lfht_iter iter; | |
717 | struct cds_lfht_node *node; | |
718 | unsigned long hash; | |
719 | ||
720 | /* Validate the context resulting from the previous instruction */ | |
721 | ret = validate_instruction_context(bytecode, reg, start_pc, pc); | |
722 | if (ret) | |
723 | return ret; | |
724 | ||
725 | /* Validate merge points */ | |
726 | hash = lttng_hash_mix((const void *) target_pc, sizeof(target_pc), | |
727 | lttng_hash_seed); | |
728 | cds_lfht_for_each_duplicate(merge_points, hash, lttng_hash_match, | |
729 | (const void *) target_pc, &iter, node) { | |
730 | struct lfht_mp_node *mp_node = | |
731 | caa_container_of(node, struct lfht_mp_node, node); | |
732 | ||
733 | dbg_printf("Filter: validate merge point at offset %lu\n", | |
734 | target_pc); | |
735 | ret = validate_instruction_context(bytecode, mp_node->reg, | |
736 | start_pc, pc); | |
737 | if (ret) | |
738 | return ret; | |
739 | /* Once validated, we can remove the merge point */ | |
740 | dbg_printf("Filter: remove one merge point at offset %lu\n", | |
741 | target_pc); | |
742 | ret = cds_lfht_del(merge_points, node); | |
743 | assert(!ret); | |
744 | } | |
745 | return 0; | |
746 | } | |
747 | ||
748 | /* | |
749 | * Return value: | |
750 | * >0: going to next insn. | |
751 | * 0: success, stop iteration. | |
752 | * <0: error | |
753 | */ | |
754 | static | |
755 | int exec_insn(struct bytecode_runtime *bytecode, | |
756 | struct cds_lfht *merge_points, | |
757 | struct vreg reg[NR_REG], | |
758 | void **_next_pc, | |
759 | void *pc) | |
760 | { | |
761 | int ret = 1; | |
762 | void *next_pc = *_next_pc; | |
763 | ||
764 | switch (*(filter_opcode_t *) pc) { | |
765 | case FILTER_OP_UNKNOWN: | |
766 | default: | |
767 | { | |
768 | ERR("unknown bytecode op %u\n", | |
769 | (unsigned int) *(filter_opcode_t *) pc); | |
770 | ret = -EINVAL; | |
771 | goto end; | |
772 | } | |
773 | ||
774 | case FILTER_OP_RETURN: | |
775 | { | |
776 | ret = 0; | |
777 | goto end; | |
778 | } | |
779 | ||
780 | /* binary */ | |
781 | case FILTER_OP_MUL: | |
782 | case FILTER_OP_DIV: | |
783 | case FILTER_OP_MOD: | |
784 | case FILTER_OP_PLUS: | |
785 | case FILTER_OP_MINUS: | |
786 | case FILTER_OP_RSHIFT: | |
787 | case FILTER_OP_LSHIFT: | |
788 | case FILTER_OP_BIN_AND: | |
789 | case FILTER_OP_BIN_OR: | |
790 | case FILTER_OP_BIN_XOR: | |
791 | { | |
792 | ERR("unsupported bytecode op %u\n", | |
793 | (unsigned int) *(filter_opcode_t *) pc); | |
794 | ret = -EINVAL; | |
795 | goto end; | |
796 | } | |
797 | ||
798 | case FILTER_OP_EQ: | |
799 | case FILTER_OP_NE: | |
800 | case FILTER_OP_GT: | |
801 | case FILTER_OP_LT: | |
802 | case FILTER_OP_GE: | |
803 | case FILTER_OP_LE: | |
804 | case FILTER_OP_EQ_STRING: | |
805 | case FILTER_OP_NE_STRING: | |
806 | case FILTER_OP_GT_STRING: | |
807 | case FILTER_OP_LT_STRING: | |
808 | case FILTER_OP_GE_STRING: | |
809 | case FILTER_OP_LE_STRING: | |
810 | case FILTER_OP_EQ_S64: | |
811 | case FILTER_OP_NE_S64: | |
812 | case FILTER_OP_GT_S64: | |
813 | case FILTER_OP_LT_S64: | |
814 | case FILTER_OP_GE_S64: | |
815 | case FILTER_OP_LE_S64: | |
816 | { | |
817 | reg[REG_R0].type = REG_S64; | |
818 | next_pc += sizeof(struct binary_op); | |
819 | break; | |
820 | } | |
821 | ||
822 | case FILTER_OP_EQ_DOUBLE: | |
823 | case FILTER_OP_NE_DOUBLE: | |
824 | case FILTER_OP_GT_DOUBLE: | |
825 | case FILTER_OP_LT_DOUBLE: | |
826 | case FILTER_OP_GE_DOUBLE: | |
827 | case FILTER_OP_LE_DOUBLE: | |
828 | { | |
829 | reg[REG_R0].type = REG_DOUBLE; | |
830 | next_pc += sizeof(struct binary_op); | |
831 | break; | |
832 | } | |
833 | ||
834 | /* unary */ | |
835 | case FILTER_OP_UNARY_PLUS: | |
836 | case FILTER_OP_UNARY_MINUS: | |
837 | case FILTER_OP_UNARY_NOT: | |
838 | case FILTER_OP_UNARY_PLUS_S64: | |
839 | case FILTER_OP_UNARY_MINUS_S64: | |
840 | case FILTER_OP_UNARY_NOT_S64: | |
841 | { | |
842 | reg[REG_R0].type = REG_S64; | |
843 | next_pc += sizeof(struct unary_op); | |
844 | break; | |
845 | } | |
846 | ||
847 | case FILTER_OP_UNARY_PLUS_DOUBLE: | |
848 | case FILTER_OP_UNARY_MINUS_DOUBLE: | |
849 | case FILTER_OP_UNARY_NOT_DOUBLE: | |
850 | { | |
851 | reg[REG_R0].type = REG_DOUBLE; | |
852 | next_pc += sizeof(struct unary_op); | |
853 | break; | |
854 | } | |
855 | ||
856 | /* logical */ | |
857 | case FILTER_OP_AND: | |
858 | case FILTER_OP_OR: | |
859 | { | |
860 | struct logical_op *insn = (struct logical_op *) pc; | |
861 | int merge_ret; | |
862 | ||
863 | /* Add merge point to table */ | |
864 | merge_ret = merge_point_add(merge_points, insn->skip_offset, reg); | |
865 | if (merge_ret) { | |
866 | ret = merge_ret; | |
867 | goto end; | |
97b58163 | 868 | } |
bf956ec0 MD |
869 | /* Continue to next instruction */ |
870 | next_pc += sizeof(struct logical_op); | |
871 | break; | |
872 | } | |
873 | ||
874 | /* load */ | |
875 | case FILTER_OP_LOAD_FIELD_REF: | |
876 | { | |
877 | ERR("Unknown field ref type\n"); | |
878 | ret = -EINVAL; | |
879 | goto end; | |
880 | } | |
881 | case FILTER_OP_LOAD_FIELD_REF_STRING: | |
882 | case FILTER_OP_LOAD_FIELD_REF_SEQUENCE: | |
883 | { | |
884 | struct load_op *insn = (struct load_op *) pc; | |
885 | ||
886 | reg[insn->reg].type = REG_STRING; | |
887 | reg[insn->reg].literal = 0; | |
888 | next_pc += sizeof(struct load_op) + sizeof(struct field_ref); | |
889 | break; | |
890 | } | |
891 | case FILTER_OP_LOAD_FIELD_REF_S64: | |
892 | { | |
893 | struct load_op *insn = (struct load_op *) pc; | |
894 | ||
895 | reg[insn->reg].type = REG_S64; | |
896 | reg[insn->reg].literal = 0; | |
897 | next_pc += sizeof(struct load_op) + sizeof(struct field_ref); | |
898 | break; | |
899 | } | |
900 | case FILTER_OP_LOAD_FIELD_REF_DOUBLE: | |
901 | { | |
902 | struct load_op *insn = (struct load_op *) pc; | |
903 | ||
904 | reg[insn->reg].type = REG_DOUBLE; | |
905 | reg[insn->reg].literal = 0; | |
906 | next_pc += sizeof(struct load_op) + sizeof(struct field_ref); | |
907 | break; | |
908 | } | |
909 | ||
910 | case FILTER_OP_LOAD_STRING: | |
911 | { | |
912 | struct load_op *insn = (struct load_op *) pc; | |
913 | ||
914 | reg[insn->reg].type = REG_STRING; | |
915 | reg[insn->reg].literal = 1; | |
916 | next_pc += sizeof(struct load_op) + strlen(insn->data) + 1; | |
917 | break; | |
918 | } | |
919 | ||
920 | case FILTER_OP_LOAD_S64: | |
921 | { | |
922 | struct load_op *insn = (struct load_op *) pc; | |
923 | ||
924 | reg[insn->reg].type = REG_S64; | |
925 | reg[insn->reg].literal = 1; | |
926 | next_pc += sizeof(struct load_op) | |
927 | + sizeof(struct literal_numeric); | |
928 | break; | |
929 | } | |
930 | ||
931 | case FILTER_OP_LOAD_DOUBLE: | |
932 | { | |
933 | struct load_op *insn = (struct load_op *) pc; | |
934 | ||
935 | reg[insn->reg].type = REG_DOUBLE; | |
936 | reg[insn->reg].literal = 1; | |
937 | next_pc += sizeof(struct load_op) | |
938 | + sizeof(struct literal_double); | |
939 | break; | |
940 | } | |
941 | ||
942 | case FILTER_OP_CAST_TO_S64: | |
943 | case FILTER_OP_CAST_DOUBLE_TO_S64: | |
944 | { | |
945 | struct cast_op *insn = (struct cast_op *) pc; | |
946 | ||
947 | reg[insn->reg].type = REG_S64; | |
948 | next_pc += sizeof(struct cast_op); | |
949 | break; | |
950 | } | |
951 | case FILTER_OP_CAST_NOP: | |
952 | { | |
953 | next_pc += sizeof(struct cast_op); | |
954 | break; | |
955 | } | |
97b58163 | 956 | |
bf956ec0 MD |
957 | } |
958 | end: | |
959 | *_next_pc = next_pc; | |
960 | return ret; | |
961 | } | |
962 | ||
963 | /* | |
964 | * Never called concurrently (hash seed is shared). | |
965 | */ | |
966 | int lttng_filter_validate_bytecode(struct bytecode_runtime *bytecode) | |
967 | { | |
968 | struct cds_lfht *merge_points; | |
969 | void *pc, *next_pc, *start_pc; | |
970 | int ret = -EINVAL; | |
971 | struct vreg reg[NR_REG]; | |
972 | int i; | |
973 | ||
974 | for (i = 0; i < NR_REG; i++) { | |
975 | reg[i].type = REG_TYPE_UNKNOWN; | |
976 | reg[i].literal = 0; | |
977 | } | |
978 | ||
979 | if (!lttng_hash_seed_ready) { | |
980 | lttng_hash_seed = time(NULL); | |
981 | lttng_hash_seed_ready = 1; | |
982 | } | |
983 | /* | |
984 | * Note: merge_points hash table used by single thread, and | |
985 | * never concurrently resized. Therefore, we can use it without | |
986 | * holding RCU read-side lock and free nodes without using | |
987 | * call_rcu. | |
988 | */ | |
989 | merge_points = cds_lfht_new(DEFAULT_NR_MERGE_POINTS, | |
990 | MIN_NR_BUCKETS, MAX_NR_BUCKETS, | |
991 | 0, NULL); | |
992 | if (!merge_points) { | |
993 | ERR("Error allocating hash table for bytecode validation\n"); | |
994 | return -ENOMEM; | |
995 | } | |
996 | start_pc = &bytecode->data[0]; | |
997 | for (pc = next_pc = start_pc; pc - start_pc < bytecode->len; | |
998 | pc = next_pc) { | |
999 | if (bytecode_validate_overflow(bytecode, start_pc, pc) != 0) { | |
1000 | ERR("filter bytecode overflow\n"); | |
1001 | ret = -EINVAL; | |
1002 | goto end; | |
97b58163 | 1003 | } |
bf956ec0 MD |
1004 | dbg_printf("Validating op %s (%u)\n", |
1005 | print_op((unsigned int) *(filter_opcode_t *) pc), | |
1006 | (unsigned int) *(filter_opcode_t *) pc); | |
1007 | ||
1008 | /* | |
1009 | * For each instruction, validate the current context | |
1010 | * (traversal of entire execution flow), and validate | |
1011 | * all merge points targeting this instruction. | |
1012 | */ | |
1013 | ret = validate_instruction_all_contexts(bytecode, merge_points, | |
1014 | reg, start_pc, pc); | |
1015 | if (ret) | |
1016 | goto end; | |
1017 | ret = exec_insn(bytecode, merge_points, reg, &next_pc, pc); | |
1018 | if (ret <= 0) | |
1019 | goto end; | |
97b58163 MD |
1020 | } |
1021 | end: | |
bf956ec0 MD |
1022 | if (delete_all_nodes(merge_points)) { |
1023 | if (!ret) { | |
1024 | ERR("Unexpected merge points\n"); | |
1025 | ret = -EINVAL; | |
1026 | } | |
1027 | } | |
1028 | if (cds_lfht_destroy(merge_points, NULL)) { | |
1029 | ERR("Error destroying hash table\n"); | |
1030 | } | |
97b58163 MD |
1031 | return ret; |
1032 | } |