SC: Sync call entry point validation for eosvm, eosvm-jit, and eosvmoc

libraries/chain/CMakeLists.txt

@@ -100,6 +100,7 @@ add_library( eosio_chain
              chain_config.cpp
              chain_id_type.cpp
              genesis_state.cpp
+             code_object.cpp
              ${CMAKE_CURRENT_BINARY_DIR}/genesis_state_root_key.cpp
 
               wast_to_wasm.cpp

libraries/chain/code_object.cpp

@@ -0,0 +1,11 @@
+#include <eosio/chain/code_object.hpp>
+#include <eosio/chain/wasm_interface.hpp>
+
+namespace eosio { namespace chain {
+
+void code_object::reflector_init()
+{
+   sync_call_supported = wasm_interface::is_sync_call_supported(code.data(), code.size());
+}
+
+}}

libraries/chain/eosio_contract.cpp

@@ -15,6 +15,7 @@
 #include <eosio/chain/global_property_object.hpp>
 #include <eosio/chain/contract_types.hpp>
 
+#include <eosio/chain/webassembly/eos-vm.hpp>
 #include <eosio/chain/wasm_interface.hpp>
 #include <eosio/chain/abi_serializer.hpp>
 
@@ -138,11 +139,13 @@ void apply_eosio_setcode(apply_context& context) {
 
    fc::sha256 code_hash; /// default is the all zeros hash
 
+   bool sync_call_supported = false;
    int64_t code_size = (int64_t)act.code.size();
 
    if( code_size > 0 ) {
      code_hash = fc::sha256::hash( act.code.data(), (uint32_t)act.code.size() );
-     wasm_interface::validate(context.control, act.code);
+     auto result = wasm_interface::validate(context.control, act.code);
+     sync_call_supported = result.sync_call_supported;
    }
 
    const auto& account = db.get<account_metadata_object,by_name>(act.account);
@@ -184,6 +187,7 @@ void apply_eosio_setcode(apply_context& context) {
             o.first_block_used = context.control.head().block_num() + 1;
             o.vm_type = act.vmtype;
             o.vm_version = act.vmversion;
+            o.sync_call_supported = sync_call_supported;
          });
       }
    }

libraries/chain/host_context.cpp

@@ -101,6 +101,11 @@ int64_t host_context::execute_sync_call(name call_receiver, uint64_t flags, std:
             return handle_call_failure();
          }
 
+         const code_object* const codeobject = db.find<code_object, by_code_hash>(boost::make_tuple(receiver_account->code_hash, receiver_account->vm_type, receiver_account->vm_version));
+         if (!codeobject || !codeobject->sync_call_supported) {
+            return handle_call_failure();
+         }
+
          // use a new sync_call_context for next sync call
          sync_call_context call_ctx(control, trx_context, ordinal, get_current_action_trace(), get_sync_call_sender(), call_receiver, receiver_account->is_privileged(), depth, is_next_call_read_only, data);
 

libraries/chain/include/eosio/chain/code_object.hpp

@@ -6,7 +6,7 @@
 
 namespace eosio { namespace chain {
 
-   class code_object : public chainbase::object<code_object_type, code_object> {
+   class code_object : public chainbase::object<code_object_type, code_object>, fc::reflect_init {
       OBJECT_CTOR(code_object, (code))
 
       id_type      id;
@@ -16,6 +16,9 @@ namespace eosio { namespace chain {
       uint32_t     first_block_used;
       uint8_t      vm_type = 0; //< vm_type should not be changed within a chainbase modifier lambda
       uint8_t      vm_version = 0; //< vm_version should not be changed within a chainbase modifier lambda
+      bool         sync_call_supported = false; //< true if code contains a valid sync_call entry point
+
+      void reflector_init();
    };
 
    struct by_code_hash;

libraries/chain/include/eosio/chain/wasm_interface.hpp

@@ -13,6 +13,7 @@ namespace eosio { namespace chain {
    class wasm_runtime_interface;
    class controller;
    namespace eosvmoc { struct config; }
+   namespace webassembly { namespace eos_vm_runtime { struct validate_result; }}
 
    struct wasm_exit {
       int32_t code = 0;
@@ -69,7 +70,10 @@ namespace eosio { namespace chain {
          void indicate_shutting_down();
 
          //validates code -- does a WASM validation pass and checks the wasm against EOSIO specific constraints
-         static void validate(const controller& control, const bytes& code);
+         static webassembly::eos_vm_runtime::validate_result validate(const controller& control, const bytes& code);
+
+         //returns true if the code contains a valid sync_call entry point
+         static bool is_sync_call_supported(const char* code_bytes, size_t code_size);
 
          //indicate that a particular code probably won't be used after given block_num
          void code_block_num_last_used(const digest_type& code_hash, uint8_t vm_type, uint8_t vm_version,

libraries/chain/include/eosio/chain/webassembly/eos-vm.hpp

@@ -29,9 +29,13 @@ namespace webassembly { namespace eos_vm_runtime {
 using namespace fc;
 using namespace eosio::vm;
 
-void validate(const bytes& code, const whitelisted_intrinsics_type& intrinsics );
+struct validate_result {
+   bool sync_call_supported = false;
+};
 
-void validate(const controller& control, const bytes& code, const wasm_config& cfg, const whitelisted_intrinsics_type& intrinsics );
+validate_result validate(const bytes& code, const whitelisted_intrinsics_type& intrinsics);
+validate_result validate(const controller& control, const bytes& code, const wasm_config& cfg, const whitelisted_intrinsics_type& intrinsics);
+bool is_sync_call_supported(const char* code_bytes, size_t code_size);
 
 struct apply_options;
 

libraries/chain/wasm_interface.cpp

@@ -67,13 +67,12 @@ namespace eosio { namespace chain {
    }
 #endif
 
-   void wasm_interface::validate(const controller& control, const bytes& code) {
+   webassembly::eos_vm_runtime::validate_result wasm_interface::validate(const controller& control, const bytes& code) {
       const auto& pso = control.db().get<protocol_state_object>();
 
       if (control.is_builtin_activated(builtin_protocol_feature_t::configurable_wasm_limits)) {
          const auto& gpo = control.get_global_properties();
-         webassembly::eos_vm_runtime::validate( control, code, gpo.wasm_configuration, pso.whitelisted_intrinsics );
-         return;
+         return webassembly::eos_vm_runtime::validate( control, code, gpo.wasm_configuration, pso.whitelisted_intrinsics );
       }
       Module module;
       try {
@@ -88,13 +87,17 @@ namespace eosio { namespace chain {
       wasm_validations::wasm_binary_validation validator(control, module);
       validator.validate();
 
-      webassembly::eos_vm_runtime::validate( code, pso.whitelisted_intrinsics );
+      return webassembly::eos_vm_runtime::validate( code, pso.whitelisted_intrinsics );
 
       //there are a couple opportunties for improvement here--
       //Easy: Cache the Module created here so it can be reused for instantiaion
       //Hard: Kick off instantiation in a separate thread at this location
    }
 
+   bool wasm_interface::is_sync_call_supported(const char* code_bytes, size_t code_size) {
+      return webassembly::eos_vm_runtime::is_sync_call_supported(code_bytes, code_size);
+   }
+
    void wasm_interface::code_block_num_last_used(const digest_type& code_hash, uint8_t vm_type, uint8_t vm_version,
                                                  block_num_type first_used_block_num, block_num_type block_num_last_used)
    {

libraries/chain/webassembly/runtimes/eos-vm.cpp

@@ -65,7 +65,20 @@ struct setcode_options {
    static constexpr bool allow_zero_blocktype = true;
 };
 
-void validate(const bytes& code, const whitelisted_intrinsics_type& intrinsics) {
+static bool module_has_valid_sync_call(module& mod) {
+   bool supported = false;
+   const uint32_t i = mod.get_exported_function("sync_call");
+   if (i < std::numeric_limits<uint32_t>::max()) {
+      const vm::func_type& function_type = mod.get_function_type(i);
+      if (function_type == vm::host_function{{vm::i64, vm::i64, vm::i32}, {}}) {
+         supported = true;
+      }
+   }
+   return supported;
+}
+
+validate_result validate(const bytes& code, const whitelisted_intrinsics_type& intrinsics) {
+   bool sync_call_supported = false;
    wasm_code_ptr code_ptr((uint8_t*)code.data(), code.size());
    try {
       eos_vm_null_backend_t<setcode_options> bkend(code_ptr, code.size(), nullptr);
@@ -80,13 +93,20 @@ void validate(const bytes& code, const whitelisted_intrinsics_type& intrinsics)
                     ("module", std::string((char*)imports[i].module_str.raw(), imports[i].module_str.size()))
                     ("fn", std::string((char*)imports[i].field_str.raw(), imports[i].field_str.size())));
       }
+
+      sync_call_supported = module_has_valid_sync_call(bkend.get_module());
    } catch(vm::exception& e) {
       EOS_THROW(wasm_serialization_error, e.detail());
    }
+
+   return validate_result {
+      .sync_call_supported = sync_call_supported
+   };
 }
 
-void validate( const controller& control, const bytes& code, const wasm_config& cfg, const whitelisted_intrinsics_type& intrinsics ) {
+validate_result validate( const controller& control, const bytes& code, const wasm_config& cfg, const whitelisted_intrinsics_type& intrinsics ) {
    EOS_ASSERT(code.size() <= cfg.max_module_bytes, wasm_serialization_error, "Code too large");
+   bool sync_call_supported = false;
    wasm_code_ptr code_ptr((uint8_t*)code.data(), code.size());
    try {
       eos_vm_null_backend_t<wasm_config> bkend(code_ptr, code.size(), nullptr, cfg);
@@ -106,9 +126,33 @@ void validate( const controller& control, const bytes& code, const wasm_config&
       EOS_ASSERT(apply_idx < std::numeric_limits<uint32_t>::max(), wasm_serialization_error, "apply not exported");
       const vm::func_type& apply_type = bkend.get_module().get_function_type(apply_idx);
       EOS_ASSERT((apply_type == vm::host_function{{vm::i64, vm::i64, vm::i64}, {}}), wasm_serialization_error, "apply has wrong type");
+
+      sync_call_supported = module_has_valid_sync_call(bkend.get_module());
+   } catch(vm::exception& e) {
+      EOS_THROW(wasm_serialization_error, e.detail());
+   }
+
+   return validate_result {
+      .sync_call_supported = sync_call_supported
+   };
+}
+
+bool is_sync_call_supported(const char* code_bytes, size_t code_size) {
+   wasm_code_ptr code_ptr((uint8_t*)code_bytes, code_size);
+   bool supported = false;
+   try {
+      // NOTE: if we ever relax WASM validation via some protocol feature in the future,
+      // we cannot simply create a backend using the default `setcode_options`.
+      // The caller of `is_sync_call_supported()` (`code_object::reflector_init()`)
+      // needs to pass in `controller` so we know what protocol features are enabled
+      // to decide what kind of backend to create. Or `code_object::sync_call_supported`
+      // needs to be populated explicitly when snapshot is read.
+      eos_vm_null_backend_t<setcode_options> bkend(code_ptr, code_size, nullptr);
+      supported = module_has_valid_sync_call(bkend.get_module());
    } catch(vm::exception& e) {
       EOS_THROW(wasm_serialization_error, e.detail());
    }
+   return supported;
 }
 
 // Be permissive on apply.

unittests/sync_call_tests.cpp

@@ -1097,9 +1097,6 @@ static const char no_sync_call_entry_point_wast[] = R"=====(
 BOOST_AUTO_TEST_CASE(no_sync_call_entry_point_test)  { try {
    validating_tester t;
 
-   // disable temporarily
-   return;
-
    create_accounts_and_set_code(entry_point_validation_caller_wast, no_sync_call_entry_point_wast, t);
 
    BOOST_REQUIRE_NO_THROW(t.push_action("caller"_n, "doit"_n, "caller"_n, {})); // entry_point_validation_caller_wast will throw if `call` does not return -1
@@ -1121,14 +1118,30 @@ static const char invalid_entry_point_wast[] = R"=====(
 BOOST_AUTO_TEST_CASE(invalid_sync_call_entry_point_test)  { try {
    validating_tester t;
 
-   // disable temporarily
-   return;
-
    create_accounts_and_set_code(entry_point_validation_caller_wast, invalid_entry_point_wast, t);
 
    BOOST_REQUIRE_NO_THROW(t.push_action("caller"_n, "doit"_n, "caller"_n, {})); // entry_point_validation_caller_wast will throw if `call` does not return -1
 } FC_LOG_AND_RETHROW() }
 
+// Number of parameters are mismatched
+static const char entry_point_num_parms_mismatched_wast[] = R"=====(
+(module
+   (export "sync_call" (func $sync_call))
+   (func $sync_call (param $sender i64) (param $receiver i64)) ;; data_size is missing
+
+   (export "apply" (func $apply))
+   (func $apply (param $receiver i64) (param $account i64) (param $action_name i64))
+)
+)=====";
+
+// Verify sync call return -1 if sync call entry point signature is invalid
+BOOST_AUTO_TEST_CASE(entry_point_num_parms_mismatched_test)  { try {
+   call_tester t({ {"caller"_n, entry_point_validation_caller_wast},
+                   {"callee"_n, entry_point_num_parms_mismatched_wast} });
+
+   BOOST_REQUIRE_NO_THROW(t.push_action("caller"_n, "doit"_n, "caller"_n, {})); // entry_point_validation_caller_wast will throw if `call` does not return -1
+} FC_LOG_AND_RETHROW() }
+
 // The last LSB is set
 static const char valid_flags_wast[] = R"=====(
 (module