Line data Source code
1 : #ifndef HEADER_fd_src_disco_pack_fd_pack_cost_h
2 : #define HEADER_fd_src_disco_pack_fd_pack_cost_h
3 :
4 : #include "../../ballet/fd_ballet_base.h"
5 : #include "fd_pack.h"
6 : #include "fd_compute_budget_program.h"
7 : #include "../../flamenco/runtime/fd_system_ids_pp.h"
8 : #include "../../ballet/txn/fd_txn.h"
9 : #include "../../ballet/txn/fd_txn_v1.h"
10 :
11 : /* The functions in this header implement the transaction cost model
12 : that is soon to be part of consensus.
13 : The cost model consists of several components:
14 : * per-signature cost: The costs associated with transaction
15 : signatures + signatures from precompiles (ED25519 + SECP256*)
16 : * per-write-lock cost: cost associated with acquiring write locks
17 : for writable accounts listed in the transaction.
18 : * instruction data length cost: The fixed cost for each instruction
19 : data byte in the transaction payload.
20 : * built-in execution cost: The fixed cost associated with "builtin"
21 : instructions. "What are builtins" is defined here:
22 : https://github.com/anza-xyz/agave/blob/1baa4033e0d2d4175373f07b73ddda2f3cc0a8d6/builtins-default-costs/src/lib.rs#L120-L200
23 : After SIMD 170, all builtins have a fixed cost of 3000 cus.
24 : * BPF execution cost: The costs associated with any instruction
25 : that is not a builtin. This value comes from the VM after
26 : transaction execution.
27 : * loaded accounts data cost: Costs associated with all the account
28 : data loaded from the chain. This value is known in the
29 : transaction loading stage, after accounts data is loaded.
30 : These are all summed to determine the total transaction cost. */
31 :
32 : /* Simple votes use the full transaction cost model. Pack recognizes
33 : them so it can use a tight execution-cost upper bound and maintain a
34 : separate vote reservation for scheduling. The reservation is not a
35 : runtime consensus limit. */
36 :
37 : /* To compute the built-in cost, we need to check a table. The table
38 : is known ahead of time though, so we can build a perfect hash
39 : table for performance.
40 : The values of the table are based on https://github.com/
41 : solana-labs/solana/blob/9fb105c801e2999a24f0773443d6164e30c9ff0c/
42 : runtime/src/block_cost_limits.rs#L34-L47 . */
43 :
44 :
45 :
46 : struct __attribute__((aligned(32))) fd_pack_builtin_prog_cost {
47 : uchar program_id[32];
48 : ulong cost_per_instr;
49 : };
50 : typedef struct fd_pack_builtin_prog_cost fd_pack_builtin_prog_cost_t;
51 :
52 : #define MAP_PERFECT_NAME fd_pack_builtin
53 : #define MAP_PERFECT_LG_TBL_SZ 4
54 : #define MAP_PERFECT_T fd_pack_builtin_prog_cost_t
55 : #define MAP_PERFECT_HASH_C 478U
56 : #define MAP_PERFECT_KEY program_id
57 : #define MAP_PERFECT_KEY_T fd_acct_addr_t const *
58 : #define MAP_PERFECT_ZERO_KEY (0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0)
59 : #define MAP_PERFECT_COMPLEX_KEY 1
60 0 : #define MAP_PERFECT_KEYS_EQUAL(k1,k2) (!memcmp( (k1), (k2), 32UL ))
61 :
62 0 : #define PERFECT_HASH( u ) (((478U*(u))>>28)&0xFU)
63 :
64 : #define MAP_PERFECT_HASH_PP( a00,a01,a02,a03,a04,a05,a06,a07,a08,a09,a10,a11,a12,a13,a14,a15, \
65 : a16,a17,a18,a19,a20,a21,a22,a23,a24,a25,a26,a27,a28,a29,a30,a31) \
66 : PERFECT_HASH( (a08 | (a09<<8) | (a10<<16) | (a11<<24)) )
67 0 : #define MAP_PERFECT_HASH_R( ptr ) PERFECT_HASH( fd_uint_load_4( (uchar const *)ptr->b + 8UL ) )
68 :
69 :
70 : /* The cost model estimates 200,000 CUs for builtin programs that were migrated to BPF */
71 : #define MAP_PERFECT_0 ( SYS_PROG_ID ), .cost_per_instr= FD_COMPUTE_BUDGET_MAX_BUILTIN_CU_LIMIT
72 : #define MAP_PERFECT_1 ( COMPUTE_BUDGET_PROG_ID ), .cost_per_instr= FD_COMPUTE_BUDGET_MAX_BUILTIN_CU_LIMIT
73 : #define MAP_PERFECT_2 ( BPF_UPGRADEABLE_PROG_ID ), .cost_per_instr= FD_COMPUTE_BUDGET_MAX_BUILTIN_CU_LIMIT
74 : #define MAP_PERFECT_3 ( BPF_LOADER_1_PROG_ID ), .cost_per_instr= FD_COMPUTE_BUDGET_MAX_BUILTIN_CU_LIMIT
75 : #define MAP_PERFECT_4 ( BPF_LOADER_2_PROG_ID ), .cost_per_instr= FD_COMPUTE_BUDGET_MAX_BUILTIN_CU_LIMIT
76 : #define MAP_PERFECT_5 ( LOADER_V4_PROG_ID ), .cost_per_instr= FD_COMPUTE_BUDGET_MAX_BUILTIN_CU_LIMIT
77 : #define MAP_PERFECT_6 ( KECCAK_SECP_PROG_ID ), .cost_per_instr= FD_COMPUTE_BUDGET_MAX_BUILTIN_CU_LIMIT
78 : #define MAP_PERFECT_7 ( ED25519_SV_PROG_ID ), .cost_per_instr= FD_COMPUTE_BUDGET_MAX_BUILTIN_CU_LIMIT
79 : #define MAP_PERFECT_8 ( SECP256R1_PROG_ID ), .cost_per_instr= 0UL /* Not officially a builtin */
80 :
81 : #include "../../util/tmpl/fd_map_perfect.c"
82 :
83 : /* Redefine it so we can use it below */
84 : #define MAP_PERFECT_HASH_PP( a00,a01,a02,a03,a04,a05,a06,a07,a08,a09,a10,a11,a12,a13,a14,a15, \
85 : a16,a17,a18,a19,a20,a21,a22,a23,a24,a25,a26,a27,a28,a29,a30,a31) \
86 0 : PERFECT_HASH( ((uint)a08 | ((uint)a09<<8) | ((uint)a10<<16) | ((uint)a11<<24)) )
87 :
88 7154 : #define FD_PACK_COST_PER_SIGNATURE ( 720U)
89 7154 : #define FD_PACK_COST_PER_ED25519_SIGNATURE ( 2400U)
90 7154 : #define FD_PACK_COST_PER_SECP256K1_SIGNATURE ( 6690U)
91 7154 : #define FD_PACK_COST_PER_SECP256R1_SIGNATURE ( 4800U)
92 0 : #define FD_PACK_COST_PER_WRITABLE_ACCT ( 300U)
93 7156 : #define FD_PACK_INV_COST_PER_INSTR_DATA_BYTE ( 4U)
94 :
95 : /* The computation here is similar to the computation for the max
96 : fd_txn_t size. There are various things a transaction can include
97 : that consume CUs, and they also consume some bytes of payload. It
98 : then becomes an integer linear programming problem. First, the best
99 : use of bytes is to request 1.4M CUs, which for a V1 transaction is
100 : done using the config value, consuming 4 bytes of payload. This is
101 : 350,000 CUs per byte, which is obviously the best move.
102 :
103 : Precompile signatures are not counted against CU limit, so the best
104 : use of bytes is precompiles, which consume <609 CUs per byte in the
105 : worst case: each secp256k1 signature consumes 6690 CUs and 11 bytes.
106 : Firedancer limits the number of precompile signatures to 16.
107 :
108 : With the 16 precompile signatures used, we can only continue to
109 : increase the cost by adding writable accounts or writable signer
110 : accounts. Writable signers consume 96 bytes use 1020 CUs. Writable
111 : non-signers consume 32 bytes and use 300 CUs. That's 10.6 CUs/byte
112 : and 9.4 CUs/byte, respectively, so in general, writable signers are
113 : more efficient and we want to add as many as we can, up to the
114 : limits of 12 signatures and 64 accounts.
115 :
116 : Finally, with any bytes that remain, we can add them to one of the
117 : instruction datas for 0.25 CUs/byte.
118 :
119 : Note that by default, 64MiB of data are assumed for the loaded
120 : accounts data size cost. This corresponds (currently) to 16384 CUs.
121 :
122 : This gives a transaction that looks like
123 : Field bytes consumed CUs used
124 : version byte 1 0
125 : sig cnt 1 0
126 : ro signed + ro unsigned 2 0
127 : config mask 4 0
128 : Recent blockhash 32 0
129 : instr cnt + acct addr cnt 2 0
130 : 12 signatures 768 8,640
131 : 64 writable pubkeys 2,048 19,200
132 : cu limit config value 4 1,400,000
133 : loaded data config value 4 16,384
134 : secp256k1 precompile header 4 0
135 : 16 secp256k1 sigs 177 107,040
136 : remaining bytes 1,049 0
137 : instr data cost 0 306
138 : + ---------------------------------------------------------------
139 : 4,096 1,551,570
140 :
141 : One of the main take-aways from this is that the cost of a
142 : transaction easily fits in a uint. */
143 : #define FD_PACK_MAX_TXN_COST (1551570UL)
144 : FD_STATIC_ASSERT( FD_PACK_MAX_TXN_COST < (ulong)UINT_MAX, fd_pack_max_cost );
145 :
146 : /* Every transaction has at least a fee payer, a writable signer. */
147 0 : #define FD_PACK_MIN_TXN_COST (FD_PACK_COST_PER_SIGNATURE+FD_PACK_COST_PER_WRITABLE_ACCT)
148 :
149 : /* The Solana protocol tries to impose a limit on the total amount of
150 : account data that can be allocated in a block (via the creation of
151 : new accounts and the growth of existing accounts). Unfortunately,
152 : the way this limit is specified by the protocol is buggy and means
153 : that it is neither an upper bound nor a lower bound for what it is
154 : supposed to measure. If USE_TRUE_ALLOC_BOUND is set to 1, this code
155 : will compute a true upper bound for the amount the transaction can
156 : allocate. If it is set to 0, it will compute the value in an
157 : Agave-compatible way, that is, a value that is normally identical to
158 : what Agave produces, but slightly higher in certain cases. */
159 : #define FD_PACK_COST_USE_TRUE_ALLOC_BOUND 0
160 :
161 : /* NOTE: THE FOLLOWING CONSTANTS ARE CONSENSUS CRITICAL AND CANNOT BE
162 : CHANGED WITHOUT COORDINATING WITH ANZA. */
163 :
164 : /* These are bounds on known limits. Upper bound values are used to
165 : calculate memory footprints while lower bounds are used for
166 : initializing consensus-dependent logic and invariant checking. As a
167 : leader, it is OK to produce blocks using limits smaller than the
168 : active on-chain limits. Replay should always use the correct
169 : chain-derived limits.
170 :
171 : The actual limits used by pack may be updated dynamically to some
172 : in-bounds value. If there is an anticipated feature activation that
173 : changes these limits, the upper bound should be the largest
174 : anticipated value while the lower bound should be the current active
175 : limit. */
176 0 : #define FD_PACK_MAX_COST_PER_BLOCK_LOWER_BOUND (30000000UL)
177 0 : #define FD_PACK_MAX_VOTE_COST_PER_BLOCK_LOWER_BOUND (36000000UL)
178 0 : #define FD_PACK_MAX_WRITE_COST_PER_ACCT_LOWER_BOUND (12000000UL)
179 :
180 : /* The 200ms slot params with raise_block_limits_to_100m (simd 0286,
181 : simd 0525). Clusters with a larger block cost limit are not
182 : supported. */
183 0 : #define FD_PACK_MAX_COST_PER_BLOCK_UPPER_BOUND ( 50000000UL)
184 0 : #define FD_PACK_MAX_VOTE_COST_PER_BLOCK_UPPER_BOUND ( 36000000UL)
185 0 : #define FD_PACK_MAX_WRITE_COST_PER_ACCT_UPPER_BOUND ( FD_PACK_MAX_COST_PER_BLOCK_UPPER_BOUND * 4UL / 10UL ) /* simd 0306 */
186 :
187 : /* https://github.com/anza-xyz/agave/blob/v4.0.0-beta.1/cost-model/src/block_cost_limits.rs#L39-L41 */
188 0 : #define FD_PACK_MAX_ALLOCATED_DATA_PER_BLOCK ( 100UL*1000UL*1000UL )
189 :
190 : FD_STATIC_ASSERT( FD_MAX_TXN_PER_SLOT_CU==(FD_PACK_MAX_COST_PER_BLOCK_UPPER_BOUND/FD_PACK_MIN_TXN_COST), max_txn_per_slot_cu );
191 :
192 : /* The txncache should at most store one entry for each transaction, so
193 : you would expect this value to be just FD_MAX_TXN_PER_SLOT. But
194 : there's a minor complication ... Agave inserts each transaction into
195 : the status cache twice, once with the signature as the key, and
196 : once with the message hash as the key. This is to support querying
197 : transactions by either signature or message hash. We load snapshots
198 : from Agave nodes which serve both entries, and there is no way to
199 : filter out the by signature entries which are useless to us, so
200 : initially the status cache needs twice as much space. */
201 0 : #define FD_PACK_MAX_TXNCACHE_TXN_PER_SLOT (2UL*FD_MAX_TXN_PER_SLOT)
202 :
203 :
204 : /* https://github.com/anza-xyz/agave/blob/v2.0.1/programs/vote/src/vote_processor.rs#L55 */
205 :
206 0 : #define FD_PACK_VOTE_DEFAULT_COMPUTE_UNITS (2100UL)
207 :
208 : /* SIMD-0387: BLS proof-of-possession verification cost charged by the
209 : vote program for authorize instructions.
210 :
211 : https://github.com/anza-xyz/agave/blob/v4.0.0-alpha.0/programs/vote/src/vote_processor.rs#L83 */
212 0 : #define FD_PACK_BLS_PROOF_OF_POSSESSION_VERIFICATION_COMPUTE_UNITS (34500UL)
213 :
214 : /* Upper bound on execution CUs used by vote instructions.
215 :
216 : The only vote instructions which use more than the default cost are
217 : the authorize instruction, which also charge the BLS
218 : proof-of-possession verification cost.
219 :
220 : IMPORTANT: if the vote program starts charging more CUs for any
221 : instructions, this constant will need to be updated.
222 : */
223 0 : #define FD_PACK_VOTE_MAX_COMPUTE_UNITS (FD_PACK_VOTE_DEFAULT_COMPUTE_UNITS + FD_PACK_BLS_PROOF_OF_POSSESSION_VERIFICATION_COMPUTE_UNITS)
224 :
225 : /* Max loaded account data size: FD_COMPUTE_BUDGET_MAX_LOADED_DATA_SZ
226 :
227 : Cost: ceil( FD_COMPUTE_BUDGET_MAX_LOADED_DATA_SZ / 32,768 ) * 8
228 : = ceil( 67,108,864 / 32,768 ) * 8
229 : = 2,048 * 8
230 : = 16,384 CUs */
231 : #define FD_PACK_VOTE_DEFAULT_LOADED_ACCOUNTS_DATA_COST (16384UL)
232 :
233 : /* Maximum instruction data cost for a simple vote transaction:
234 : - 1 signature
235 : - 2 transaction accounts
236 : - 0 instruction accounts
237 :
238 : Which results in a fixed overhead of:
239 : - Signature count: 1
240 : - 1 signature: 64
241 : - Message header: 3
242 : - Account count: 1
243 : - 2 account entries: 64
244 : - Recent blockhash: 32
245 : - Instruction count: 1
246 : - program_id: 1
247 : - Instruction account count: 1
248 : - Instruction data length: 1
249 : Total: 169 bytes
250 :
251 : Leaving (FD_TXN_MTU - 169) = 1063 bytes for the instruction data.
252 : This results in a cost of 1063 / 4 = 265 CUs.
253 : */
254 : #define FD_PACK_SIMPLE_VOTE_MAX_INSTR_DATA_COST (265UL)
255 :
256 : /* A simple vote transaction is any transaction that satisfies the
257 : following conditions:
258 : - Has 1 or 2 signatures
259 : - Is a legacy transaction
260 : - Has exactly one instruction
261 : - Must invoke the vote program
262 :
263 : Therefore the worst-case most expensive simple vote transaction has:
264 : - 2 signatures
265 : - 35 writable accounts (see FD_TXN_ACCT_ADDR_MAX)
266 : - The maximum amount of compute units for a vote program instruction
267 : - 1 instruction of the maximum instruction data size
268 : - The maximum amount of loaded accounts data
269 : = 65,189 CUs
270 : */
271 : static const ulong FD_PACK_MAX_SIMPLE_VOTE_COST = ( 2UL*FD_PACK_COST_PER_SIGNATURE + /* 1,440 */
272 : 35UL*FD_PACK_COST_PER_WRITABLE_ACCT + /* 10,500 */
273 : FD_PACK_VOTE_MAX_COMPUTE_UNITS + /* 36,600 */
274 : FD_PACK_VOTE_DEFAULT_LOADED_ACCOUNTS_DATA_COST + /* 16,384 */
275 : FD_PACK_SIMPLE_VOTE_MAX_INSTR_DATA_COST ); /* 265 */
276 :
277 : #undef FD_PACK_SIMPLE_VOTE_MAX_INSTR_DATA_COST
278 :
279 : /* Computes the total cost and a few related properties for the
280 : specified transaction. On success, returns the cost, which is in
281 : [1020, FD_PACK_MAX_TXN_COST] and sets or clears the
282 : FD_TXN_P_FLAG_IS_SIMPLE_VOTE bit of the value pointed to by flags to
283 : indicate whether the transaction is a simple vote or not.
284 :
285 : Additionally:
286 : If opt_execution_cost is non-null, on success it will contain the
287 : execution cost (BPF execution cost + built-in execution cost). This
288 : value is in [0, the returned value).
289 : If opt_fee is non-null, on success it will contain the priority fee,
290 : measured in lamports (i.e. the part of the fee that excludes the
291 : per-signature fee). This value is in [0, ULONG_MAX].
292 : If opt_precompile_sig_cnt is non-null, on success it will contain the
293 : total number of signatures in precompile instructions, namely Keccak
294 : and Ed25519 signature verification programs. This value is in [0,
295 : 256*64]. Note that this does not do full parsing of the precompile
296 : instruction, and it may be malformed.
297 : If opt_loaded_accounts_data_cost is non-null, on success it will
298 : contain the total requested cost due to loaded accounts data. This
299 : value is in [0, the returned value).
300 : If opt_allocated_data is non-null, on success it will contain a value
301 : that depends on FD_PACK_COST_USE_TRUE_ALLOC_BOUND (see above),
302 : relating to the amount of data (in bytes) this transaction can
303 : allocate. This value is in [0, 20MB].
304 :
305 : On failure, returns 0 and does not modify the value pointed to by
306 : flags, opt_execution_cost, opt_fee, or opt_precompile_sig_cnt. */
307 : static inline ulong
308 : fd_pack_compute_cost( fd_txn_t const * txn,
309 : uchar const * payload,
310 : uint * flags,
311 : ulong * opt_execution_cost,
312 : ulong * opt_fee,
313 : ulong * opt_precompile_sig_cnt,
314 : ulong * opt_loaded_accounts_data_cost,
315 0 : ulong * opt_allocated_data ) {
316 :
317 0 : #define ROW(x) fd_pack_builtin_tbl + MAP_PERFECT_HASH_PP( x )
318 0 : fd_pack_builtin_prog_cost_t const * compute_budget_row = ROW( COMPUTE_BUDGET_PROG_ID );
319 0 : fd_pack_builtin_prog_cost_t const * ed25519_precompile_row = ROW( ED25519_SV_PROG_ID );
320 0 : fd_pack_builtin_prog_cost_t const * secp256k1_precomp_row = ROW( KECCAK_SECP_PROG_ID );
321 0 : fd_pack_builtin_prog_cost_t const * secp256r1_precomp_row = ROW( SECP256R1_PROG_ID );
322 : /* The three programs that are able to allocate more than 10 kB per
323 : account */
324 0 : fd_pack_builtin_prog_cost_t const * system_program_row = ROW( SYS_PROG_ID );
325 : #if FD_PACK_COST_USE_TRUE_ALLOC_BOUND
326 : fd_pack_builtin_prog_cost_t const * upgradeable_loader_row = ROW( BPF_UPGRADEABLE_PROG_ID );
327 : fd_pack_builtin_prog_cost_t const * loader_v4_row = ROW( LOADER_V4_PROG_ID );
328 : #endif /* FD_PACK_COST_USE_TRUE_ALLOC_BOUND */
329 0 : #undef ROW
330 :
331 0 : int is_simple_vote = fd_txn_is_simple_vote_transaction( txn, payload );
332 0 : if( FD_UNLIKELY( is_simple_vote ) ) *flags |= FD_TXN_P_FLAGS_IS_SIMPLE_VOTE;
333 0 : else *flags &= ~FD_TXN_P_FLAGS_IS_SIMPLE_VOTE;
334 :
335 : /* We need to be mindful of overflow here, but it's not terrible.
336 : signature_cost < FD_TXN_ACCT_ADDR_MAX*720 + FD_TXN_INSTR_MAX * UCHAR_MAX * 6690,
337 : writable_cost <= FD_TXN_ACCT_ADDR_MAX*300 */
338 0 : ulong signature_cnt = fd_txn_account_cnt( txn, FD_TXN_ACCT_CAT_SIGNER );
339 0 : ulong signature_cost = FD_PACK_COST_PER_SIGNATURE * signature_cnt;
340 0 : ulong writable_cost = FD_PACK_COST_PER_WRITABLE_ACCT * fd_txn_account_cnt( txn, FD_TXN_ACCT_CAT_WRITABLE );
341 :
342 0 : ulong instr_data_sz = 0UL; /* < FD_TPU_MTU */
343 0 : ulong non_builtin_cnt = 0UL; /* <= FD_TXN_INSTR_MAX */
344 0 : ulong precompile_sig_cnt = 0UL; /* <= FD_TXN_INSTR_MAX * UCHAR_MAX */
345 0 : ulong allocated_data = 0UL; /* in bytes */
346 0 : fd_acct_addr_t const * addr_base = fd_txn_get_acct_addrs( txn, payload );
347 :
348 0 : fd_compute_budget_program_state_t cbp[1];
349 0 : fd_compute_budget_program_init( cbp );
350 :
351 0 : for( ulong i=0UL; i<txn->instr_cnt; i++ ) {
352 0 : ulong data_sz = txn->instr[i].data_sz;
353 0 : instr_data_sz += data_sz;
354 :
355 0 : ulong prog_id_idx = (ulong)txn->instr[i].program_id;
356 0 : fd_acct_addr_t const * prog_id = addr_base + prog_id_idx;
357 :
358 : /* Lookup prog_id in hash table */
359 :
360 0 : fd_pack_builtin_prog_cost_t null_row[1] = {{{ 0 }, 0UL }};
361 0 : fd_pack_builtin_prog_cost_t const * in_tbl = fd_pack_builtin_query( prog_id, null_row );
362 0 : non_builtin_cnt += !in_tbl->cost_per_instr; /* null row has 0 cost */
363 :
364 : /* If the transaction is not a V1 transaction, parse the compute budget instruction.
365 : Compute budget instructions are silently ignored for V1 transactions. */
366 0 : if( FD_UNLIKELY( txn->transaction_version!=FD_TXN_V1 && in_tbl==compute_budget_row ) ) {
367 0 : if( FD_UNLIKELY( 0==fd_compute_budget_program_parse( payload+txn->instr[i].data_off, data_sz, cbp ) ) )
368 0 : return 0UL;
369 0 : } else if( FD_UNLIKELY( (in_tbl==ed25519_precompile_row) ) ) {
370 : /* First byte is # of signatures. Branchless tail reading here is
371 : probably okay, but this seems safer. */
372 0 : ulong ed25519_signature_cnt = (data_sz>0) ? (ulong)payload[ txn->instr[i].data_off ] : 0UL;
373 0 : if( FD_UNLIKELY( data_sz<2UL+14UL*ed25519_signature_cnt ) ) return 0UL;
374 0 : precompile_sig_cnt += ed25519_signature_cnt;
375 0 : signature_cost += ed25519_signature_cnt * FD_PACK_COST_PER_ED25519_SIGNATURE;
376 0 : } else if( FD_UNLIKELY( (in_tbl==secp256k1_precomp_row) ) ) {
377 0 : ulong secp256k1_signature_cnt = (data_sz>0) ? (ulong)payload[ txn->instr[i].data_off ] : 0UL;
378 0 : if( FD_UNLIKELY( data_sz<1UL+11UL*secp256k1_signature_cnt ) ) return 0UL;
379 0 : precompile_sig_cnt += secp256k1_signature_cnt;
380 0 : signature_cost += secp256k1_signature_cnt * FD_PACK_COST_PER_SECP256K1_SIGNATURE;
381 0 : } else if( FD_UNLIKELY( (in_tbl==secp256r1_precomp_row) ) ) {
382 0 : ulong secp256r1_signature_cnt = (data_sz>0) ? (ulong)payload[ txn->instr[i].data_off ] : 0UL;
383 0 : if( FD_UNLIKELY( data_sz<2UL+14UL*secp256r1_signature_cnt ) ) return 0UL;
384 0 : precompile_sig_cnt += secp256r1_signature_cnt;
385 0 : signature_cost += secp256r1_signature_cnt * FD_PACK_COST_PER_SECP256R1_SIGNATURE;
386 0 : }
387 : /* BPF programs can allocate 10kB per account per instruction.
388 : The vote program (see below) and the address lookup table program
389 : (up to 56+32*256 bytes) do allocate, and several native programs
390 : can reduce the size of an account, but the only ones that can
391 : possibly allocate more than 10kB per account are below.
392 : Additionally, none of the above programs allocate at all.
393 :
394 : A normal vote does not allocate any data, but a simple vote may
395 : actually invoke one of the vote program instructions that does
396 : allocate FD_VOTE_STATE_V3_SZ or V4, which are both 3762 bytes.
397 : If it invokes the vote program but isn't a simple vote, it will
398 : be caught by the general case and overestimated at 10kB per
399 : account, which is fine.
400 :
401 : Note: This complexity here is pretty gross, but we need a better
402 : bound for allocated_data than 20MB, and this seems to be the best
403 : way. */
404 0 : #define MAX_ALLOC (20UL*1024UL*1024UL) /* mostly to prevent attacker-induced overflow */
405 0 : #define DEFAULT_ALLOC (10UL*1024UL) /* == MAX_PERMITTED_DATA_INCREASE */
406 0 : else if( FD_UNLIKELY( in_tbl==system_program_row ) ) {
407 0 : ulong discriminant = ULONG_MAX;
408 0 : uchar const * base = payload + txn->instr[i].data_off;
409 0 : if( FD_UNLIKELY( data_sz<12UL ) ) continue;
410 0 : discriminant = FD_LOAD( uint, base );
411 0 : base += sizeof(uint); data_sz -= sizeof(uint);
412 0 : ulong seed_len;
413 0 : switch( discriminant ) {
414 0 : case 0UL: /* FD_SYSTEM_PROGRAM_INSTR_CREATE_ACCOUNT */
415 0 : if( FD_UNLIKELY( data_sz<8UL+8UL ) ) break;
416 : /* Note: here (and below), Agave sets alloc to 0 if any of
417 : these instructions request more than 10 MB. We don't
418 : bother with that. If a transaction has an instruction that
419 : requests more than 10 MB and pays a sufficient fee for it,
420 : and then fails, that's not a big problem. We're always
421 : computing a conservative estimate. */
422 0 : allocated_data += fd_ulong_min( MAX_ALLOC, FD_LOAD( ulong, base+8UL ) );
423 0 : break;
424 0 : case 3UL: /* FD_SYSTEM_PROGRAM_INSTR_CREATE_ACCOUNT_WITH_SEED */
425 0 : if( FD_UNLIKELY( data_sz<32UL+8UL ) ) break;
426 0 : seed_len = FD_LOAD( ulong, base+32UL );
427 0 : base += 32UL+8UL; data_sz -= 32UL+8UL;
428 0 : if( FD_UNLIKELY( data_sz<seed_len ) ) break;
429 0 : base += seed_len; data_sz -= seed_len;
430 0 : if( FD_UNLIKELY( data_sz<(8UL+8UL) ) ) break;
431 0 : allocated_data += fd_ulong_min( MAX_ALLOC, FD_LOAD( ulong, base+8UL ) );
432 0 : break;
433 0 : case 8UL: /* FD_SYSTEM_PROGRAM_INSTR_ALLOCATE */
434 0 : if( FD_UNLIKELY( data_sz<8UL ) ) break;
435 0 : allocated_data += fd_ulong_min( MAX_ALLOC, FD_LOAD( ulong, base ) );
436 0 : break;
437 0 : case 9UL: /* FD_SYSTEM_PROGRAM_INSTR_ALLOCATE_WITH_SEED */
438 0 : if( FD_UNLIKELY( data_sz<32UL+8UL ) ) break;
439 0 : seed_len = FD_LOAD( ulong, base+32UL );
440 0 : base += 32UL+8UL; data_sz -= 32UL+8UL;
441 0 : if( FD_UNLIKELY( data_sz<seed_len ) ) break;
442 0 : base += seed_len; data_sz -= seed_len;
443 0 : if( FD_UNLIKELY( data_sz<8UL ) ) break;
444 0 : allocated_data += fd_ulong_min( MAX_ALLOC, FD_LOAD( ulong, base ) );
445 0 : break;
446 0 : case 13UL: /* create_account_allow_prefund */
447 : /* Agave returns 0 here until the feature gate has been
448 : activated. Rather than feature gate this, we just act
449 : conservatively. */
450 0 : if( FD_UNLIKELY( data_sz<8UL+8UL ) ) break;
451 0 : allocated_data += fd_ulong_min( MAX_ALLOC, FD_LOAD( ulong, base+8UL ) );
452 0 : break;
453 0 : default:
454 0 : break;
455 0 : }
456 : #if FD_PACK_COST_USE_TRUE_ALLOC_BOUND
457 : } else if( FD_UNLIKELY( in_tbl==upgradeable_loader_row ) ) {
458 : ulong discriminant = ULONG_MAX;
459 : uchar const * base = payload + txn->instr[i].data_off;
460 : if( FD_UNLIKELY( data_sz<8UL ) ) continue;
461 : discriminant = FD_LOAD( uint, base );
462 : base += sizeof(uint); data_sz -= sizeof(uint);
463 : switch( discriminant ) {
464 : case 6UL: /* fd_bpf_upgradeable_loader_program_instruction_enum_extend_program */
465 : case 9UL: /* fd_bpf_upgradeable_loader_program_instruction_enum_extend_program_checked */
466 : allocated_data += fd_ulong_min( MAX_ALLOC, FD_LOAD( uint, base ) );
467 : break;
468 : default:
469 : allocated_data += DEFAULT_ALLOC; /* Some other instructions may alloc a tiny bit */
470 : break;
471 : }
472 : } else if( FD_UNLIKELY( in_tbl==loader_v4_row ) ) {
473 : ulong discriminant = ULONG_MAX;
474 : uchar const * base = payload + txn->instr[i].data_off;
475 : if( FD_UNLIKELY( data_sz<8UL ) ) continue;
476 : discriminant = FD_LOAD( uint, base );
477 : base += sizeof(uint); data_sz -= sizeof(uint);
478 : switch( discriminant ) {
479 : case 2UL: /* fd_loader_v4_program_instruction_enum_set_program_length */
480 : allocated_data += fd_ulong_min( MAX_ALLOC, FD_LOAD( uint, base ) );
481 : break;
482 : default:
483 : break;
484 : }
485 : } else {
486 : /* This could be the writable accounts only, but this bound is
487 : much cheaper, and good enough. */
488 : allocated_data += DEFAULT_ALLOC * txn->instr[i].acct_cnt;
489 : #endif /* FD_PACK_COST_USE_TRUE_ALLOC_BOUND */
490 0 : }
491 0 : }
492 :
493 : /* Firedancer's block packer limits the total amount of precompile
494 : signatures in a transaction to 16. Anything beyond this is likely
495 : spam. */
496 0 : if( FD_UNLIKELY( precompile_sig_cnt>16UL ) ) return 0UL;
497 :
498 : /* E.g. a transaction can alloc a 10MB account, close it, and repeat
499 : many times. According to the spec, this would count as a 20MB
500 : allocation. See
501 : https://github.com/anza-xyz/agave/blob/2a61a3ecd417b0515c0b2f322d0128394f20626b/cost-model/src/cost_model.rs#L317-L318
502 : */
503 0 : allocated_data = fd_ulong_min( allocated_data, 20UL*1024UL*1024UL ); /* MAX_PERMITTED_ACCOUNTS_DATA_ALLOCATIONS_PER_TRANSACTION */
504 0 : #undef MAX_ALLOC
505 0 : #undef DEFAULT_ALLOC
506 :
507 0 : ulong instr_data_cost = instr_data_sz / FD_PACK_INV_COST_PER_INSTR_DATA_BYTE; /* < FD_TPU_MTU/FD_PACK_INV_COST_PER_INSTR_DATA_BYTE == 1024 */
508 :
509 0 : ulong fee[1];
510 0 : uint execution_cost[1];
511 0 : ulong loaded_account_data_cost[1];
512 :
513 : /* V1 transactions use the config mask, and silently ignore compute
514 : budget program instructions. */
515 0 : if( txn->transaction_version==FD_TXN_V1 ) {
516 0 : ulong v1_priority_fee, v1_cu_limit, v1_loaded, v1_heap;
517 0 : uint v1_config_mask = fd_uint_load_4( payload+4 );
518 0 : fd_txn_parse_v1_config( v1_config_mask, payload+txn->v1_txn_config_values_off,
519 0 : &v1_priority_fee, &v1_cu_limit, &v1_loaded, &v1_heap );
520 0 : *fee = v1_priority_fee;
521 0 : *execution_cost = (uint)fd_ulong_min( v1_cu_limit, FD_COMPUTE_BUDGET_MAX_CU_LIMIT );
522 0 : v1_loaded = fd_ulong_min( v1_loaded, FD_COMPUTE_BUDGET_MAX_LOADED_DATA_SZ );
523 :
524 : /* V1 transactions which request a loaded accounts data size limit
525 : of 0, or do not explicitly set this limit, are not thrown out.
526 :
527 : As of define_ltds_fee_only_semantics, which is activated on
528 : all networks, the loaded accounts data size for fee-only
529 : transactions that fail due to exceeding the requested loaded
530 : accounts data size limit is the requested loaded accounts data
531 : size limit.
532 : This means that advance nonce transactions that request a loaded
533 : accounts data size limit of 0 are still packed and the nonce
534 : still advances.
535 : https://github.com/anza-xyz/agave/blob/v4.2.0-beta.1/core/src/banking_stage/qos_service.rs#L68-L72
536 :
537 : V1 transactions which request a loaded account data
538 : size limit which is not a multiple of 32 KiB have the loaded
539 : account data cost rounded up to the nearest 32 KiB. This matches
540 : Agave's cost tracker behaviour.
541 : https://github.com/anza-xyz/agave/blob/v4.2.0-beta.1/cost-model/src/cost_model.rs#L188-L203 */
542 0 : *loaded_account_data_cost = FD_COMPUTE_BUDGET_HEAP_COST *
543 0 : ( ( v1_loaded + FD_COMPUTE_BUDGET_ACCOUNT_DATA_COST_PAGE_SIZE - 1UL )
544 0 : / FD_COMPUTE_BUDGET_ACCOUNT_DATA_COST_PAGE_SIZE );
545 0 : } else {
546 0 : fd_compute_budget_program_finalize( cbp, txn->instr_cnt, txn->instr_cnt-non_builtin_cnt, fee, execution_cost, loaded_account_data_cost );
547 0 : }
548 :
549 : /* As an optimization, for simple votes we can override execution cost
550 : with a known tighter upper bound. */
551 0 : if( FD_UNLIKELY( is_simple_vote ) ) *execution_cost = (uint)FD_PACK_VOTE_MAX_COMPUTE_UNITS;
552 :
553 0 : fd_ulong_store_if( !!opt_execution_cost, opt_execution_cost, (ulong)(*execution_cost) );
554 0 : fd_ulong_store_if( !!opt_fee, opt_fee, *fee );
555 0 : fd_ulong_store_if( !!opt_precompile_sig_cnt, opt_precompile_sig_cnt, precompile_sig_cnt );
556 0 : fd_ulong_store_if( !!opt_loaded_accounts_data_cost, opt_loaded_accounts_data_cost, *loaded_account_data_cost );
557 0 : fd_ulong_store_if( !!opt_allocated_data, opt_allocated_data, allocated_data );
558 :
559 : #if DETAILED_LOGGING
560 : FD_BASE58_ENCODE_64_BYTES( (const uchar *)fd_txn_get_signatures(txn, payload), signature_cstr );
561 : FD_LOG_NOTICE(( "TXN signature[%s] signature_cost[%lu] writable_cost[%lu] instr_data_cost[%lu] non_builtin_cnt[%lu] loaded_account_data_cost[%lu] precompile_sig_cnt[%lu] fee[%lu]",
562 : signature_cstr, signature_cost, writable_cost, instr_data_cost, non_builtin_cnt, *loaded_account_data_cost, precompile_sig_cnt, *fee));
563 : #endif
564 :
565 : /* <= FD_PACK_MAX_COST, so no overflow concerns */
566 0 : ulong total_cost = signature_cost + writable_cost + (ulong)(*execution_cost) + instr_data_cost + *loaded_account_data_cost;
567 :
568 0 : return total_cost;
569 0 : }
570 : #undef MAP_PERFECT_HASH_PP
571 : #undef PERFECT_HASH
572 :
573 : #endif /* HEADER_fd_src_disco_pack_fd_pack_cost_h */
|
