| // Copyright 2015 syzkaller project authors. All rights reserved. |
| // Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. |
| |
| package prog |
| |
| import ( |
| "fmt" |
| ) |
| |
| type Prog struct { |
| Target *Target |
| Calls []*Call |
| Comments []string |
| } |
| |
| type Call struct { |
| Meta *Syscall |
| Args []Arg |
| Ret *ResultArg |
| Comment string |
| } |
| |
| type Arg interface { |
| Type() Type |
| Size() uint64 |
| |
| validate(ctx *validCtx) error |
| serialize(ctx *serializer) |
| } |
| |
| type ArgCommon struct { |
| typ Type |
| } |
| |
| func (arg *ArgCommon) Type() Type { |
| return arg.typ |
| } |
| |
| // Used for ConstType, IntType, FlagsType, LenType, ProcType and CsumType. |
| type ConstArg struct { |
| ArgCommon |
| Val uint64 |
| } |
| |
| func MakeConstArg(t Type, v uint64) *ConstArg { |
| return &ConstArg{ArgCommon: ArgCommon{typ: t}, Val: v} |
| } |
| |
| func (arg *ConstArg) Size() uint64 { |
| return arg.typ.Size() |
| } |
| |
| // Value returns value, pid stride and endianness. |
| func (arg *ConstArg) Value() (uint64, uint64) { |
| switch typ := (*arg).Type().(type) { |
| case *IntType: |
| return arg.Val, 0 |
| case *ConstType: |
| return arg.Val, 0 |
| case *FlagsType: |
| return arg.Val, 0 |
| case *LenType: |
| return arg.Val, 0 |
| case *ResourceType: |
| return arg.Val, 0 |
| case *CsumType: |
| // Checksums are computed dynamically in executor. |
| return 0, 0 |
| case *ProcType: |
| if arg.Val == procDefaultValue { |
| return 0, 0 |
| } |
| return typ.ValuesStart + arg.Val, typ.ValuesPerProc |
| default: |
| panic(fmt.Sprintf("unknown ConstArg type %#v", typ)) |
| } |
| } |
| |
| // Used for PtrType and VmaType. |
| type PointerArg struct { |
| ArgCommon |
| Address uint64 |
| VmaSize uint64 // size of the referenced region for vma args |
| Res Arg // pointee (nil for vma) |
| } |
| |
| func MakePointerArg(t Type, addr uint64, data Arg) *PointerArg { |
| if data == nil { |
| panic("nil pointer data arg") |
| } |
| return &PointerArg{ |
| ArgCommon: ArgCommon{typ: t}, |
| Address: addr, |
| Res: data, |
| } |
| } |
| |
| func MakeVmaPointerArg(t Type, addr, size uint64) *PointerArg { |
| if addr%1024 != 0 { |
| panic("unaligned vma address") |
| } |
| return &PointerArg{ |
| ArgCommon: ArgCommon{typ: t}, |
| Address: addr, |
| VmaSize: size, |
| } |
| } |
| |
| func MakeSpecialPointerArg(t Type, index uint64) *PointerArg { |
| if index >= maxSpecialPointers { |
| panic("bad special pointer index") |
| } |
| return &PointerArg{ |
| ArgCommon: ArgCommon{typ: t}, |
| Address: -index, |
| } |
| } |
| |
| func (arg *PointerArg) Size() uint64 { |
| return arg.typ.Size() |
| } |
| |
| func (arg *PointerArg) IsSpecial() bool { |
| return arg.VmaSize == 0 && arg.Res == nil && -arg.Address < maxSpecialPointers |
| } |
| |
| func (target *Target) PhysicalAddr(arg *PointerArg) uint64 { |
| if arg.IsSpecial() { |
| return target.SpecialPointers[-arg.Address] |
| } |
| return target.DataOffset + arg.Address |
| } |
| |
| // Used for BufferType. |
| type DataArg struct { |
| ArgCommon |
| data []byte // for in/inout args |
| size uint64 // for out Args |
| } |
| |
| func MakeDataArg(t Type, data []byte) *DataArg { |
| if t.Dir() == DirOut { |
| panic("non-empty output data arg") |
| } |
| return &DataArg{ArgCommon: ArgCommon{typ: t}, data: append([]byte{}, data...)} |
| } |
| |
| func MakeOutDataArg(t Type, size uint64) *DataArg { |
| if t.Dir() != DirOut { |
| panic("empty input data arg") |
| } |
| return &DataArg{ArgCommon: ArgCommon{typ: t}, size: size} |
| } |
| |
| func (arg *DataArg) Size() uint64 { |
| if len(arg.data) != 0 { |
| return uint64(len(arg.data)) |
| } |
| return arg.size |
| } |
| |
| func (arg *DataArg) Data() []byte { |
| if arg.Type().Dir() == DirOut { |
| panic("getting data of output data arg") |
| } |
| return arg.data |
| } |
| |
| func (arg *DataArg) SetData(data []byte) { |
| if arg.Type().Dir() == DirOut { |
| panic("setting data of output data arg") |
| } |
| arg.data = append([]byte{}, data...) |
| } |
| |
| // Used for StructType and ArrayType. |
| // Logical group of args (struct or array). |
| type GroupArg struct { |
| ArgCommon |
| Inner []Arg |
| } |
| |
| func MakeGroupArg(t Type, inner []Arg) *GroupArg { |
| return &GroupArg{ArgCommon: ArgCommon{typ: t}, Inner: inner} |
| } |
| |
| func (arg *GroupArg) Size() uint64 { |
| typ0 := arg.Type() |
| if !typ0.Varlen() { |
| return typ0.Size() |
| } |
| switch typ := typ0.(type) { |
| case *StructType: |
| var size uint64 |
| for _, fld := range arg.Inner { |
| if !fld.Type().BitfieldMiddle() { |
| size += fld.Size() |
| } |
| } |
| if typ.AlignAttr != 0 && size%typ.AlignAttr != 0 { |
| size += typ.AlignAttr - size%typ.AlignAttr |
| } |
| return size |
| case *ArrayType: |
| var size uint64 |
| for _, elem := range arg.Inner { |
| size += elem.Size() |
| } |
| return size |
| default: |
| panic(fmt.Sprintf("bad group arg type %v", typ)) |
| } |
| } |
| |
| func (arg *GroupArg) fixedInnerSize() bool { |
| switch typ := arg.Type().(type) { |
| case *StructType: |
| return true |
| case *ArrayType: |
| return typ.Kind == ArrayRangeLen && typ.RangeBegin == typ.RangeEnd |
| default: |
| panic(fmt.Sprintf("bad group arg type %v", typ)) |
| } |
| } |
| |
| // Used for UnionType. |
| type UnionArg struct { |
| ArgCommon |
| Option Arg |
| } |
| |
| func MakeUnionArg(t Type, opt Arg) *UnionArg { |
| return &UnionArg{ArgCommon: ArgCommon{typ: t}, Option: opt} |
| } |
| |
| func (arg *UnionArg) Size() uint64 { |
| if !arg.Type().Varlen() { |
| return arg.Type().Size() |
| } |
| return arg.Option.Size() |
| } |
| |
| // Used for ResourceType. |
| // This is the only argument that can be used as syscall return value. |
| // Either holds constant value or reference another ResultArg. |
| type ResultArg struct { |
| ArgCommon |
| Res *ResultArg // reference to arg which we use |
| OpDiv uint64 // divide result (executed before OpAdd) |
| OpAdd uint64 // add to result |
| Val uint64 // value used if Res is nil |
| uses map[*ResultArg]bool // ArgResult args that use this arg |
| } |
| |
| func MakeResultArg(t Type, r *ResultArg, v uint64) *ResultArg { |
| arg := &ResultArg{ArgCommon: ArgCommon{typ: t}, Res: r, Val: v} |
| if r == nil { |
| return arg |
| } |
| if r.uses == nil { |
| r.uses = make(map[*ResultArg]bool) |
| } |
| r.uses[arg] = true |
| return arg |
| } |
| |
| func MakeReturnArg(t Type) *ResultArg { |
| if t == nil { |
| return nil |
| } |
| if t.Dir() != DirOut { |
| panic("return arg is not out") |
| } |
| return &ResultArg{ArgCommon: ArgCommon{typ: t}} |
| } |
| |
| func (arg *ResultArg) Size() uint64 { |
| return arg.typ.Size() |
| } |
| |
| // Returns inner arg for pointer args. |
| func InnerArg(arg Arg) Arg { |
| if _, ok := arg.Type().(*PtrType); ok { |
| res := arg.(*PointerArg).Res |
| if res == nil { |
| return nil |
| } |
| return InnerArg(res) |
| } |
| return arg // Not a pointer. |
| } |
| |
| func isDefault(arg Arg) bool { |
| return arg.Type().isDefaultArg(arg) |
| } |
| |
| func (p *Prog) insertBefore(c *Call, calls []*Call) { |
| idx := 0 |
| for ; idx < len(p.Calls); idx++ { |
| if p.Calls[idx] == c { |
| break |
| } |
| } |
| var newCalls []*Call |
| newCalls = append(newCalls, p.Calls[:idx]...) |
| newCalls = append(newCalls, calls...) |
| if idx < len(p.Calls) { |
| newCalls = append(newCalls, p.Calls[idx]) |
| newCalls = append(newCalls, p.Calls[idx+1:]...) |
| } |
| p.Calls = newCalls |
| } |
| |
| // replaceArg replaces arg with arg1 in a program. |
| func replaceArg(arg, arg1 Arg) { |
| switch a := arg.(type) { |
| case *ConstArg: |
| *a = *arg1.(*ConstArg) |
| case *ResultArg: |
| replaceResultArg(a, arg1.(*ResultArg)) |
| case *PointerArg: |
| *a = *arg1.(*PointerArg) |
| case *UnionArg: |
| *a = *arg1.(*UnionArg) |
| case *DataArg: |
| *a = *arg1.(*DataArg) |
| case *GroupArg: |
| a1 := arg1.(*GroupArg) |
| if len(a.Inner) != len(a1.Inner) { |
| panic(fmt.Sprintf("replaceArg: group fields don't match: %v/%v", |
| len(a.Inner), len(a1.Inner))) |
| } |
| a.ArgCommon = a1.ArgCommon |
| for i := range a.Inner { |
| replaceArg(a.Inner[i], a1.Inner[i]) |
| } |
| default: |
| panic(fmt.Sprintf("replaceArg: bad arg kind %#v", arg)) |
| } |
| } |
| |
| func replaceResultArg(arg, arg1 *ResultArg) { |
| // Remove link from `a.Res` to `arg`. |
| if arg.Res != nil { |
| delete(arg.Res.uses, arg) |
| } |
| // Copy all fields from `arg1` to `arg` except for the list of args that use `arg`. |
| uses := arg.uses |
| *arg = *arg1 |
| arg.uses = uses |
| // Make the link in `arg.Res` (which is now `Res` of `arg1`) to point to `arg` instead of `arg1`. |
| if arg.Res != nil { |
| resUses := arg.Res.uses |
| delete(resUses, arg1) |
| resUses[arg] = true |
| } |
| } |
| |
| // removeArg removes all references to/from arg0 from a program. |
| func removeArg(arg0 Arg) { |
| ForeachSubArg(arg0, func(arg Arg, ctx *ArgCtx) { |
| a, ok := arg.(*ResultArg) |
| if !ok { |
| return |
| } |
| if a.Res != nil { |
| uses := a.Res.uses |
| if !uses[a] { |
| panic("broken tree") |
| } |
| delete(uses, a) |
| } |
| for arg1 := range a.uses { |
| arg2 := arg1.Type().DefaultArg().(*ResultArg) |
| replaceResultArg(arg1, arg2) |
| } |
| }) |
| } |
| |
| // removeCall removes call idx from p. |
| func (p *Prog) removeCall(idx int) { |
| c := p.Calls[idx] |
| for _, arg := range c.Args { |
| removeArg(arg) |
| } |
| if c.Ret != nil { |
| removeArg(c.Ret) |
| } |
| copy(p.Calls[idx:], p.Calls[idx+1:]) |
| p.Calls = p.Calls[:len(p.Calls)-1] |
| } |