feat: add maximum uarch cycle to prevent overflow in collect APIs

Author: edubart

src/clua-cartesi.cpp

@@ -213,6 +213,7 @@ CM_API int luaopen_cartesi(lua_State *L) {
     clua_setintegerfield(L, CM_VERSION_PATCH, "VERSION_PATCH", -1);
     clua_setintegerfield(L, CM_HASH_SIZE, "HASH_SIZE", -1);
     clua_setintegerfield(L, CM_MCYCLE_MAX, "MCYCLE_MAX", -1);
+    clua_setintegerfield(L, CM_UARCH_CYCLE_MAX, "UARCH_CYCLE_MAX", -1);
     clua_setintegerfield(L, CM_TREE_LOG2_WORD_SIZE, "TREE_LOG2_WORD_SIZE", -1);
     clua_setintegerfield(L, CM_TREE_LOG2_PAGE_SIZE, "TREE_LOG2_PAGE_SIZE", -1);
     clua_setintegerfield(L, CM_TREE_LOG2_ROOT_SIZE, "TREE_LOG2_ROOT_SIZE", -1);
@@ -224,6 +225,7 @@ CM_API int luaopen_cartesi(lua_State *L) {
     clua_setintegerfield(L, CM_BREAK_REASON_REACHED_TARGET_MCYCLE, "BREAK_REASON_REACHED_TARGET_MCYCLE", -1);
     clua_setintegerfield(L, CM_UARCH_BREAK_REASON_REACHED_TARGET_CYCLE, "UARCH_BREAK_REASON_REACHED_TARGET_CYCLE", -1);
     clua_setintegerfield(L, CM_UARCH_BREAK_REASON_UARCH_HALTED, "UARCH_BREAK_REASON_UARCH_HALTED", -1);
+    clua_setintegerfield(L, CM_UARCH_BREAK_REASON_CYCLE_OVERFLOW, "UARCH_BREAK_REASON_CYCLE_OVERFLOW", -1);
     clua_setintegerfield(L, CM_ACCESS_LOG_TYPE_ANNOTATIONS, "ACCESS_LOG_TYPE_ANNOTATIONS", -1);
     clua_setintegerfield(L, CM_ACCESS_LOG_TYPE_LARGE_DATA, "ACCESS_LOG_TYPE_LARGE_DATA", -1);
     clua_setintegerfield(L, CM_CMIO_YIELD_COMMAND_AUTOMATIC, "CMIO_YIELD_COMMAND_AUTOMATIC", -1);

src/json-util.cpp

@@ -570,6 +570,8 @@ static std::string uarch_interpreter_break_reason_to_name(uarch_interpreter_brea
             return "uarch_halted";
         case R::reached_target_cycle:
             return "reached_target_cycle";
+        case R::cycle_overflow:
+            return "cycle_overflow";
     }
     throw std::domain_error{"invalid uarch interpreter break reason"};
 }
@@ -607,13 +609,14 @@ static interpreter_break_reason interpreter_break_reason_from_name(const std::st
 
 static uarch_interpreter_break_reason uarch_interpreter_break_reason_from_name(const std::string &name) {
     using uibr = uarch_interpreter_break_reason;
-    if (name == "reached_target_cycle") {
-        return uibr::reached_target_cycle;
+    const static std::unordered_map<std::string, uibr> g_uibr_name = {
+        {"reached_target_cycle", uibr::reached_target_cycle}, {"uarch_halted", uibr::uarch_halted},
+        {"cycle_overflow", uibr::cycle_overflow}};
+    auto got = g_uibr_name.find(name);
+    if (got == g_uibr_name.end()) {
+        throw std::domain_error{"invalid uarch interpreter break reason"};
     }
-    if (name == "uarch_halted") {
-        return uibr::uarch_halted;
-    }
-    throw std::domain_error{"invalid uarch interpreter break reason"};
+    return got->second;
 }
 
 static hash_function_type hash_function_from_name(const std::string &name) {

src/jsonrpc-discover.json

@@ -1975,7 +1975,7 @@
       },
       "UarchInterpreterBreakReason": {
         "title": "UarchInterpreterBreakReason",
-        "enum": ["reached_target_cycle", "uarch_halted"]
+        "enum": ["reached_target_cycle", "uarch_halted", "cycle_overflow"]
       },
       "Base64String": {
         "title": "Base64String",

src/machine-c-api.h

@@ -37,6 +37,7 @@ extern "C" {
 #endif
 
 #define CM_MCYCLE_MAX UINT64_MAX
+#define CM_UARCH_CYCLE_MAX UINT64_C(1048576)
 
 // -----------------------------------------------------------------------------
 // API enums and structures
@@ -101,6 +102,7 @@ typedef enum cm_break_reason {
 typedef enum cm_uarch_break_reason {
     CM_UARCH_BREAK_REASON_REACHED_TARGET_CYCLE,
     CM_UARCH_BREAK_REASON_UARCH_HALTED,
+    CM_UARCH_BREAK_REASON_CYCLE_OVERFLOW,
     CM_UARCH_BREAK_REASON_FAILED,
 } cm_uarch_break_reason;
 

src/machine.cpp

@@ -21,6 +21,7 @@
 
 #include "address-range-constants.h"
 #include "address-range-defines.h"
+#include "machine-c-api.h"
 #include "uarch-defines.h"
 
 namespace cartesi {
@@ -40,7 +41,9 @@ enum uarch_state_constants : uint64_t {
     UARCH_STATE_ALIGN_MASK = (UINT64_C(1) << UARCH_STATE_LOG2_SIZE) - 1,     ///< Mask for uarch state alignment
     UARCH_STATE_MASK = ~UARCH_STATE_ALIGN_MASK,                              ///< Mask for uarch state address space
     UARCH_STATE_CHILD_ALIGN_MASK =
-        (UINT64_C(1) << UARCH_STATE_CHILD_LOG2_SIZE) - 1 ///< Mask for uarch state child alignment
+        (UINT64_C(1) << UARCH_STATE_CHILD_LOG2_SIZE) - 1, ///< Mask for uarch state child alignment
+    UARCH_LOG2_MAX_CYCLE = EXPAND_UINT64_C(UARCH_LOG2_MAX_CYCLE_DEF),
+    UARCH_MAX_CYCLE = (UINT64_C(1) << UARCH_LOG2_MAX_CYCLE),
 };
 
 static_assert((UARCH_STATE_START_ADDRESS & UARCH_STATE_ALIGN_MASK) == 0,
@@ -61,6 +64,7 @@ static_assert(UARCH_SHADOW_START_ADDRESS < UARCH_RAM_START_ADDRESS,
     "UARCH_SHADOW_START_ADDRESS must be smaller than UARCH_RAN_START_ADDRESS");
 static_assert((UARCH_SHADOW_LENGTH & (AR_PAGE_SIZE - 1)) == 0, "UARCH_SHADOW_LENGTH must be multiple of AR_PAGE_SIZE");
 static_assert((UARCH_RAM_LENGTH & (AR_PAGE_SIZE - 1)) == 0, "UARCH_RAM_LENGTH must be multiple of AR_PAGE_SIZE");
+static_assert(UARCH_MAX_CYCLE == CM_UARCH_CYCLE_MAX, "CM_UARCH_CYCLE_MAX must be equal to UARCH_MAX_CYCLE");
 
 /// \brief ecall function codes
 enum uarch_ecall_functions : uint64_t {

src/uarch-constants.h

@@ -25,6 +25,9 @@
 /// \brief Log2 size of the entire uarch memory range: shadow and ram
 #define UARCH_STATE_LOG2_SIZE_DEF 22
 
+/// \brief Log2 of the expected maximum uarch cycle
+#define UARCH_LOG2_MAX_CYCLE_DEF 20
+
 // microarchitecture ecall function codes
 #define UARCH_ECALL_FN_HALT_DEF 1            // halt uarch
 #define UARCH_ECALL_FN_PUTCHAR_DEF 2         // putchar

src/uarch-defines.h

@@ -38,11 +38,8 @@ uarch_interpreter_break_reason uarch_interpret(const STATE_ACCESS a, uint64_t cy
                 break;
             case UArchStepStatus::UArchHalted:
                 return uarch_interpreter_break_reason::uarch_halted;
-            // LCOV_EXCL_START
             case UArchStepStatus::CycleOverflow:
-                // Prior condition ensures that this case is unreachable. but linter may complain about missing it
-                return uarch_interpreter_break_reason::reached_target_cycle;
-                // LCOV_EXCL_STOP
+                return uarch_interpreter_break_reason::cycle_overflow;
         }
     }
     return uarch_interpreter_break_reason::reached_target_cycle;

src/uarch-interpret.cpp

@@ -21,7 +21,7 @@
 
 namespace cartesi {
 
-enum class uarch_interpreter_break_reason : int { reached_target_cycle, uarch_halted };
+enum class uarch_interpreter_break_reason : int { reached_target_cycle, uarch_halted, cycle_overflow };
 
 // Run the microarchitecture interpreter until cycle hits a target or a fixed point is reached
 template <typename STATE_ACCESS>

src/uarch-interpret.h

@@ -1098,7 +1098,7 @@ UArchStepStatus uarch_step(const UarchState a) {
     // This must be the first read in order to match the first log access in machine::verify_step_uarch
     uint64 cycle = readCycle(a);
     // do not advance if cycle will overflow
-    if (cycle == UINT64_MAX) {
+    if (cycle >= UARCH_MAX_CYCLE) {
         return UArchStepStatus::CycleOverflow;
     }
     // do not advance if machine is halted