1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351
//! Contains the code for the stack height limiter instrumentation.
use crate::utils::{
copy_locals,
translator::{DefaultTranslator, Translator},
ModuleInfo,
};
use alloc::vec::Vec;
use anyhow::{anyhow, Result};
use wasm_encoder::{
CodeSection, ConstExpr, Function, GlobalSection, GlobalType, SectionId, ValType,
};
use wasmparser::{CodeSectionReader, FunctionBody, GlobalSectionReader, Operator};
/// Macro to generate preamble and postamble.
macro_rules! instrument_call {
($callee_idx: expr, $callee_stack_cost: expr, $stack_height_global_idx: expr, $stack_limit: expr) => {{
use wasm_encoder::Instruction::*;
[
// stack_height += stack_cost(F)
GlobalGet($stack_height_global_idx),
I32Const($callee_stack_cost),
I32Add,
GlobalSet($stack_height_global_idx),
// if stack_counter > LIMIT: unreachable
GlobalGet($stack_height_global_idx),
I32Const($stack_limit as i32),
I32GtU,
If(wasm_encoder::BlockType::Empty),
Unreachable,
End,
// Original call
Call($callee_idx),
// stack_height -= stack_cost(F)
GlobalGet($stack_height_global_idx),
I32Const($callee_stack_cost),
I32Sub,
GlobalSet($stack_height_global_idx),
]
}};
}
mod max_height;
mod thunk;
struct Context {
stack_height_global_idx: u32,
func_stack_costs: Vec<u32>,
stack_limit: u32,
}
impl Context {
/// Returns index in a global index space of a stack_height global variable.
fn stack_height_global_idx(&self) -> u32 {
self.stack_height_global_idx
}
/// Returns `stack_cost` for `func_idx`.
fn stack_cost(&self, func_idx: u32) -> Option<u32> {
self.func_stack_costs.get(func_idx as usize).cloned()
}
/// Returns stack limit specified by the rules.
fn stack_limit(&self) -> u32 {
self.stack_limit
}
}
/// Inject the instumentation that makes stack overflows deterministic, by introducing
/// an upper bound of the stack size.
///
/// This pass introduces a global mutable variable to track stack height,
/// and instruments all calls with preamble and postamble.
///
/// Stack height is increased prior the call. Otherwise, the check would
/// be made after the stack frame is allocated.
///
/// The preamble is inserted before the call. It increments
/// the global stack height variable with statically determined "stack cost"
/// of the callee. If after the increment the stack height exceeds
/// the limit (specified by the `rules`) then execution traps.
/// Otherwise, the call is executed.
///
/// The postamble is inserted after the call. The purpose of the postamble is to decrease
/// the stack height by the "stack cost" of the callee function.
///
/// Note, that we can't instrument all possible ways to return from the function. The simplest
/// example would be a trap issued by the host function.
/// That means stack height global won't be equal to zero upon the next execution after such trap.
///
/// # Thunks
///
/// Because stack height is increased prior the call few problems arises:
///
/// - Stack height isn't increased upon an entry to the first function, i.e. exported function.
/// - Start function is executed externally (similar to exported functions).
/// - It is statically unknown what function will be invoked in an indirect call.
///
/// The solution for this problems is to generate a intermediate functions, called 'thunks', which
/// will increase before and decrease the stack height after the call to original function, and
/// then make exported function and table entries, start section to point to a corresponding thunks.
///
/// # Stack cost
///
/// Stack cost of the function is calculated as a sum of it's locals
/// and the maximal height of the value stack.
///
/// All values are treated equally, as they have the same size.
///
/// The rationale is that this makes it possible to use the following very naive wasm executor:
///
/// - values are implemented by a union, so each value takes a size equal to the size of the largest
/// possible value type this union can hold. (In MVP it is 8 bytes)
/// - each value from the value stack is placed on the native stack.
/// - each local variable and function argument is placed on the native stack.
/// - arguments pushed by the caller are copied into callee stack rather than shared between the
/// frames.
/// - upon entry into the function entire stack frame is allocated.
pub fn inject(raw_wasm: &[u8], stack_limit: u32) -> Result<Vec<u8>> {
let mut module_info = ModuleInfo::new(raw_wasm)?;
let mut ctx = Context {
stack_height_global_idx: generate_stack_height_global(&mut module_info)?,
func_stack_costs: compute_stack_costs(&module_info)?,
stack_limit,
};
instrument_functions(&mut ctx, &mut module_info)?;
thunk::generate_thunks(&mut ctx, &mut module_info)?;
Ok(module_info.bytes())
}
/// Generate a new global that will be used for tracking current stack height.
fn generate_stack_height_global(module: &mut ModuleInfo) -> Result<u32> {
let mut global_sec_builder = GlobalSection::new();
let index = if let Some(global_sec) = &module.raw_sections.get(&SectionId::Global.into()) {
let reader = GlobalSectionReader::new(&global_sec.data, 0)?;
let count = reader.get_count();
for global in reader {
DefaultTranslator.translate_global(global?, &mut global_sec_builder)?;
}
count
} else {
0
};
global_sec_builder.global(
GlobalType {
val_type: ValType::I32,
mutable: true,
},
&ConstExpr::i32_const(0),
);
module.replace_section(SectionId::Global.into(), &global_sec_builder)?;
Ok(index)
}
/// Calculate stack costs for all functions.
///
/// Returns a vector with a stack cost for each function, including imports.
fn compute_stack_costs(module: &ModuleInfo) -> Result<Vec<u32>> {
let func_imports = module.num_imported_functions();
// TODO: optimize!
(0..module.num_functions())
.map(|func_idx| {
if func_idx < func_imports {
// We can't calculate stack_cost of the import functions.
Ok(0)
} else {
compute_stack_cost(func_idx as u32, module)
}
})
.collect()
}
/// Stack cost of the given *defined* function is the sum of it's locals count (that is,
/// number of arguments plus number of local variables) and the maximal stack
/// height.
fn compute_stack_cost(func_idx: u32, module: &ModuleInfo) -> Result<u32> {
// To calculate the cost of a function we need to convert index from
// function index space to defined function spaces.
let func_imports = module.num_imported_functions();
let defined_func_idx = func_idx
.checked_sub(func_imports)
.ok_or_else(|| anyhow!("this should be a index of a defined function"))?;
let code_section_reader = CodeSectionReader::new(
&module
.raw_sections
.get(&SectionId::Code.into())
.ok_or_else(|| anyhow!("not find code section"))?
.data,
0,
)?;
let local_reader = code_section_reader
.into_iter()
.collect::<wasmparser::Result<Vec<FunctionBody>>>()?
.get(defined_func_idx as usize)
.ok_or_else(|| anyhow!("function body is out of bounds"))?
.get_locals_reader()?;
let locals_count: u32 = local_reader.get_count();
let max_stack_height = max_height::compute(defined_func_idx, module)?;
locals_count
.checked_add(max_stack_height)
.ok_or_else(|| anyhow!("overflow in adding locals_count and max_stack_height"))
}
fn instrument_functions(ctx: &mut Context, module: &mut ModuleInfo) -> Result<()> {
let mut code_builder = CodeSection::new();
if let Some(code_sec) = module.raw_sections.get(&SectionId::Code.into()) {
let function_sec_reader = CodeSectionReader::new(&code_sec.data, 0)?;
for body in function_sec_reader {
let body_encoder = instrument_function(ctx, body?)?;
code_builder.function(&body_encoder);
}
}
module.replace_section(SectionId::Code.into(), &code_builder)
}
/// This function searches `call` instructions and wrap each call
/// with preamble and postamble.
///
/// Before:
///
/// ```text
/// get_local 0
/// get_local 1
/// call 228
/// drop
/// ```
///
/// After:
///
/// ```text
/// get_local 0
/// get_local 1
///
/// < ... preamble ... >
///
/// call 228
///
/// < .. postamble ... >
///
/// drop
/// ```
#[allow(clippy::needless_collect)]
fn instrument_function(ctx: &mut Context, func: FunctionBody) -> Result<wasm_encoder::Function> {
struct InstrumentCall {
offset: usize,
callee: u32,
cost: u32,
}
let mut func_code_builder = Function::new(copy_locals(&func)?);
let reader = func.get_operators_reader()?;
let operators = reader
.into_iter()
.collect::<wasmparser::Result<Vec<Operator>>>()?;
let calls: Vec<_> = operators
.iter()
.enumerate()
.filter_map(|(offset, operator)| {
if let Operator::Call {
function_index: callee,
} = operator
{
//todo CallDirect
ctx.stack_cost(*callee).and_then(|cost| {
if cost > 0 {
Some(InstrumentCall {
callee: *callee,
offset,
cost,
})
} else {
None
}
})
} else {
None
}
})
.collect();
// The `instrumented_call!` contains the call itself. This is why we need to subtract one.
let mut call_peeker = calls.into_iter().peekable();
for (original_pos, instr) in operators.into_iter().enumerate() {
// whether there is some call instruction at this position that needs to be instrumented
let did_instrument = if let Some(call) = call_peeker.peek() {
if call.offset == original_pos {
instrument_call!(
call.callee,
call.cost as i32,
ctx.stack_height_global_idx(),
ctx.stack_limit()
)
.iter()
.for_each(|instr| {
func_code_builder.instruction(instr);
});
true
} else {
false
}
} else {
false
};
if did_instrument {
call_peeker.next();
} else {
func_code_builder.instruction(&DefaultTranslator.translate_op(&instr)?);
}
}
if call_peeker.next().is_some() {
return Err(anyhow!("not all calls were used"));
}
Ok(func_code_builder)
}
#[cfg(test)]
mod tests {
use super::*;
fn parse_wat(source: &str) -> ModuleInfo {
let module_bytes = wat::parse_str(source).unwrap();
ModuleInfo::new(&module_bytes).unwrap()
}
#[test]
fn test_with_params_and_result() {
let raw_wasm = parse_wat(
r#"(module
(func (export "i32.add") (param i32 i32) (result i32)
get_local 0
get_local 1
i32.add
)
)"#,
)
.bytes();
let inject_raw_wasm = inject(&raw_wasm, 1024).expect("Failed to inject stack counter");
wasmparser::validate(&inject_raw_wasm).expect("Invalid module");
}
}