script_core 0.0.6 → 0.1.0

data/ext/enterprise_script_service/libseccomp/src/db.h

@@ -43,8 +43,8 @@ struct db_api_arg {
 struct db_api_rule_list {
 	uint32_t action;
 	int syscall;
-	struct db_api_arg *args;
-	unsigned int args_cnt;
+	bool strict;
+	struct db_api_arg args[ARG_COUNT_MAX];
 
 	struct db_api_rule_list *prev, *next;
 };
@@ -52,14 +52,18 @@ struct db_api_rule_list {
 struct db_arg_chain_tree {
 	/* argument number (a0 = 0, a1 = 1, etc.) */
 	unsigned int arg;
+	/* true to indicate this is the high 32-bit word of a 64-bit value */
+	bool arg_h_flg;
 	/* argument bpf offset */
 	unsigned int arg_offset;
 
 	/* comparison operator */
 	enum scmp_compare op;
+	enum scmp_compare op_orig;
 	/* syscall argument value */
 	uint32_t mask;
 	uint32_t datum;
+	scmp_datum_t datum_full;
 
 	/* actions */
 	bool act_t_flg;
@@ -77,36 +81,6 @@ struct db_arg_chain_tree {
 	unsigned int refcnt;
 };
 #define ARG_MASK_MAX		((uint32_t)-1)
-#define db_chain_lt(x,y) \
-	(((x)->arg < (y)->arg) || \
-	 (((x)->arg == (y)->arg) && \
-	  (((x)->op < (y)->op) || (((x)->mask & (y)->mask) == (y)->mask))))
-#define db_chain_eq(x,y) \
-	(((x)->arg == (y)->arg) && \
-	 ((x)->op == (y)->op) && ((x)->datum == (y)->datum) && \
-	 ((x)->mask == (y)->mask))
-#define db_chain_gt(x,y) \
-	(((x)->arg > (y)->arg) || \
-	 (((x)->arg == (y)->arg) && \
-	  (((x)->op > (y)->op) || (((x)->mask & (y)->mask) != (y)->mask))))
-#define db_chain_action(x) \
-	(((x)->act_t_flg) || ((x)->act_f_flg))
-#define db_chain_zombie(x) \
-	((x)->nxt_t == NULL && !((x)->act_t_flg) && \
-	 (x)->nxt_f == NULL && !((x)->act_f_flg))
-#define db_chain_leaf(x) \
-	((x)->nxt_t == NULL && (x)->nxt_f == NULL)
-#define db_chain_eq_result(x,y) \
-	((((x)->nxt_t != NULL && (y)->nxt_t != NULL) || \
-	  ((x)->nxt_t == NULL && (y)->nxt_t == NULL)) && \
-	 (((x)->nxt_f != NULL && (y)->nxt_f != NULL) || \
-	  ((x)->nxt_f == NULL && (y)->nxt_f == NULL)) && \
-	 ((x)->act_t_flg == (y)->act_t_flg) && \
-	 ((x)->act_f_flg == (y)->act_f_flg) && \
-	 (((x)->act_t_flg && (x)->act_t == (y)->act_t) || \
-	  (!((x)->act_t_flg))) && \
-	 (((x)->act_f_flg && (x)->act_f == (y)->act_f) || \
-	  (!((x)->act_f_flg))))
 
 struct db_sys_list {
 	/* native syscall number */
@@ -138,6 +112,10 @@ struct db_filter_attr {
 	uint32_t nnp_enable;
 	/* SECCOMP_FILTER_FLAG_TSYNC related attributes */
 	uint32_t tsync_enable;
+	/* allow rules with a -1 syscall value */
+	uint32_t api_tskip;
+	/* SECCOMP_FILTER_FLAG_LOG related attributes */
+	uint32_t log_enable;
 };
 
 struct db_filter {
@@ -189,6 +167,8 @@ struct db_filter_col {
 
 int db_action_valid(uint32_t action);
 
+struct db_api_rule_list *db_rule_dup(const struct db_api_rule_list *src);
+
 struct db_filter_col *db_col_init(uint32_t def_action);
 int db_col_reset(struct db_filter_col *col, uint32_t def_action);
 void db_col_release(struct db_filter_col *col);

data/ext/enterprise_script_service/libseccomp/src/gen_bpf.c

@@ -39,6 +39,7 @@
 #include "db.h"
 #include "hash.h"
 #include "system.h"
+#include "helper.h"
 
 /* allocation increments */
 #define AINC_BLK			2
@@ -202,7 +203,7 @@ static struct bpf_blk *_hsh_find(const struct bpf_state *state, uint64_t h_val);
  * Convert the endianess of the supplied value and return it to the caller.
  *
  */
-uint16_t _htot16(const struct arch_def *arch, uint16_t val)
+static uint16_t _htot16(const struct arch_def *arch, uint16_t val)
 {
 	if (arch->endian == ARCH_ENDIAN_LITTLE)
 		return htole16(val);
@@ -218,7 +219,7 @@ uint16_t _htot16(const struct arch_def *arch, uint16_t val)
  * Convert the endianess of the supplied value and return it to the caller.
  *
  */
-uint32_t _htot32(const struct arch_def *arch, uint32_t val)
+static uint32_t _htot32(const struct arch_def *arch, uint32_t val)
 {
 	if (arch->endian == ARCH_ENDIAN_LITTLE)
 		return htole32(val);
@@ -314,11 +315,9 @@ static struct bpf_blk *_blk_alloc(void)
 {
 	struct bpf_blk *blk;
 
-	blk = malloc(sizeof(*blk));
+	blk = zmalloc(sizeof(*blk));
 	if (blk == NULL)
 		return NULL;
-
-	memset(blk, 0, sizeof(*blk));
 	blk->flag_unique = true;
 	blk->acc_start = _ACC_STATE_UNDEF;
 	blk->acc_end = _ACC_STATE_UNDEF;
@@ -477,9 +476,6 @@ static int _bpf_append_blk(struct bpf_program *prg, const struct bpf_blk *blk)
 			goto bpf_append_blk_failure;
 		}
 		switch (blk->blks[iter].k.type) {
-		case TGT_NONE:
-			i_iter->k = 0;
-			break;
 		case TGT_K:
 			i_iter->k = blk->blks[iter].k.tgt.imm_k;
 			break;
@@ -568,13 +564,12 @@ static int _hsh_add(struct bpf_state *state, struct bpf_blk **blk_p,
 	if (blk->flag_hash)
 		return 0;
 
-	h_new = malloc(sizeof(*h_new));
+	h_new = zmalloc(sizeof(*h_new));
 	if (h_new == NULL)
 		return -ENOMEM;
-	memset(h_new, 0, sizeof(*h_new));
 
 	/* generate the hash */
-	h_val = jhash(blk->blks, _BLK_MSZE(blk), 0);
+	h_val = hash(blk->blks, _BLK_MSZE(blk));
 	blk->hash = h_val;
 	blk->flag_hash = true;
 	blk->node = NULL;
@@ -859,6 +854,13 @@ static struct bpf_blk *_gen_bpf_node(struct bpf_state *state,
 			goto node_failure;
 	}
 
+	/* set the accumulator state at the end of the block */
+	/* NOTE: the accumulator end state is very critical when we are
+	 *       assembling the final state; we assume that however we leave
+	 *       this instruction block the accumulator state is represented
+	 *       by blk->acc_end, it must be kept correct */
+	blk->acc_end = *a_state;
+
 	/* check the accumulator against the datum */
 	switch (node->op) {
 	case SCMP_CMP_MASKED_EQ:
@@ -903,7 +905,6 @@ static struct bpf_blk *_gen_bpf_node(struct bpf_state *state,
 		goto node_failure;
 
 	blk->node = node;
-	blk->acc_end = *a_state;
 	return blk;
 
 node_failure:
@@ -958,7 +959,7 @@ static struct bpf_blk *_gen_bpf_chain_lvl_res(struct bpf_state *state,
 		case TGT_PTR_DB:
 			node = (struct db_arg_chain_tree *)i_iter->jt.tgt.db;
 			b_new = _gen_bpf_chain(state, sys, node,
-					       nxt_jump, &blk->acc_start);
+					       nxt_jump, &blk->acc_end);
 			if (b_new == NULL)
 				return NULL;
 			i_iter->jt = _BPF_JMP_HSH(b_new->hash);
@@ -984,7 +985,7 @@ static struct bpf_blk *_gen_bpf_chain_lvl_res(struct bpf_state *state,
 		case TGT_PTR_DB:
 			node = (struct db_arg_chain_tree *)i_iter->jf.tgt.db;
 			b_new = _gen_bpf_chain(state, sys, node,
-					       nxt_jump, &blk->acc_start);
+					       nxt_jump, &blk->acc_end);
 			if (b_new == NULL)
 				return NULL;
 			i_iter->jf = _BPF_JMP_HSH(b_new->hash);
@@ -1353,13 +1354,32 @@ static struct bpf_blk *_gen_bpf_arch(struct bpf_state *state,
 			/* filter out x32 */
 			_BPF_INSTR(instr,
 				   _BPF_OP(state->arch, BPF_JMP + BPF_JGE),
-				   _BPF_JMP_HSH(state->bad_arch_hsh),
+				   _BPF_JMP_NO,
 				   _BPF_JMP_NO,
 				   _BPF_K(state->arch, X32_SYSCALL_BIT));
 			if (b_head != NULL)
 				instr.jf = _BPF_JMP_HSH(b_head->hash);
 			else
 				instr.jf = _BPF_JMP_HSH(state->def_hsh);
+			b_new = _blk_append(state, b_new, &instr);
+			if (b_new == NULL)
+				goto arch_failure;
+			/* NOTE: starting with Linux v4.8 the seccomp filters
+			 *	 are processed both when the syscall is
+			 *	 initially executed as well as after any
+			 *	 tracing processes finish so we need to make
+			 *	 sure we don't trap the -1 syscall which
+			 *	 tracers can use to skip the syscall, see
+			 *	 seccomp(2) for more information */
+			_BPF_INSTR(instr,
+				   _BPF_OP(state->arch, BPF_JMP + BPF_JEQ),
+				   _BPF_JMP_NO,
+				   _BPF_JMP_HSH(state->bad_arch_hsh),
+				   _BPF_K(state->arch, -1));
+			if (b_head != NULL)
+				instr.jt = _BPF_JMP_HSH(b_head->hash);
+			else
+				instr.jt = _BPF_JMP_HSH(state->def_hsh);
 			blk_cnt++;
 		} else if (state->arch->token == SCMP_ARCH_X32) {
 			/* filter out x86_64 */
@@ -1928,23 +1948,22 @@ struct bpf_program *gen_bpf_generate(const struct db_filter_col *col)
 {
 	int rc;
 	struct bpf_state state;
+	struct bpf_program *prgm;
 
 	memset(&state, 0, sizeof(state));
 	state.attr = &col->attr;
 
-	state.bpf = malloc(sizeof(*(state.bpf)));
-	if (state.bpf == NULL)
+	prgm = zmalloc(sizeof(*(prgm)));
+	if (prgm == NULL)
 		return NULL;
-	memset(state.bpf, 0, sizeof(*(state.bpf)));
+	state.bpf = prgm;
 
 	rc = _gen_bpf_build_bpf(&state, col);
-	if (rc < 0)
-		goto bpf_generate_end;
+	if (rc == 0)
+		state.bpf = NULL;
+	_state_release(&state);
 
-bpf_generate_end:
-	if (rc < 0)
-		_state_release(&state);
-	return state.bpf;
+	return prgm;
 }
 
 /**

data/ext/enterprise_script_service/libseccomp/src/gen_pfc.c

@@ -34,6 +34,8 @@
 #include "arch.h"
 #include "db.h"
 #include "gen_pfc.h"
+#include "helper.h"
+#include "system.h"
 
 struct pfc_sys_list {
 	struct db_sys_list *sys;
@@ -71,6 +73,10 @@ static const char *_pfc_arch(const struct arch_def *arch)
 		return "mips64n32";
 	case SCMP_ARCH_MIPSEL64N32:
 		return "mipsel64n32";
+	case SCMP_ARCH_PARISC:
+		return "parisc";
+	case SCMP_ARCH_PARISC64:
+		return "parisc64";
 	case SCMP_ARCH_PPC64:
 		return "ppc64";
 	case SCMP_ARCH_PPC64LE:
@@ -112,8 +118,11 @@ static void _pfc_arg(FILE *fds,
  */
 static void _pfc_action(FILE *fds, uint32_t action)
 {
-	switch (action & 0xffff0000) {
-	case SCMP_ACT_KILL:
+	switch (action & SECCOMP_RET_ACTION_FULL) {
+	case SCMP_ACT_KILL_PROCESS:
+		fprintf(fds, "action KILL_PROCESS;\n");
+		break;
+	case SCMP_ACT_KILL_THREAD:
 		fprintf(fds, "action KILL;\n");
 		break;
 	case SCMP_ACT_TRAP:
@@ -125,6 +134,9 @@ static void _pfc_action(FILE *fds, uint32_t action)
 	case SCMP_ACT_TRACE(0):
 		fprintf(fds, "action TRACE(%u);\n", (action & 0x0000ffff));
 		break;
+	case SCMP_ACT_LOG:
+		fprintf(fds, "action LOG;\n");
+		break;
 	case SCMP_ACT_ALLOW:
 		fprintf(fds, "action ALLOW;\n");
 		break;
@@ -235,10 +247,10 @@ static void _gen_pfc_syscall(const struct arch_def *arch,
 	const char *sys_name = arch_syscall_resolve_num(arch, sys_num);
 
 	_indent(fds, 1);
-	fprintf(fds, "# filter for syscall \"%s\" (%d) [priority: %d]\n",
+	fprintf(fds, "# filter for syscall \"%s\" (%u) [priority: %d]\n",
 		(sys_name ? sys_name : "UNKNOWN"), sys_num, sys->priority);
 	_indent(fds, 1);
-	fprintf(fds, "if ($syscall == %d)\n", sys_num);
+	fprintf(fds, "if ($syscall == %u)\n", sys_num);
 	if (sys->chains == NULL) {
 		_indent(fds, 2);
 		_pfc_action(fds, sys->action);
@@ -266,12 +278,11 @@ static int _gen_pfc_arch(const struct db_filter_col *col,
 
 	/* sort the syscall list */
 	db_list_foreach(s_iter, db->syscalls) {
-		p_new = malloc(sizeof(*p_new));
+		p_new = zmalloc(sizeof(*p_new));
 		if (p_new == NULL) {
 			rc = -ENOMEM;
 			goto arch_return;
 		}
-		memset(p_new, 0, sizeof(*p_new));
 		p_new->sys = s_iter;
 
 		p_prev = NULL;
@@ -297,8 +308,10 @@ static int _gen_pfc_arch(const struct db_filter_col *col,
 	fprintf(fds, "if ($arch == %u)\n", db->arch->token_bpf);
 	p_iter = p_head;
 	while (p_iter != NULL) {
-		if (!p_iter->sys->valid)
+		if (!p_iter->sys->valid) {
+			p_iter = p_iter->next;
 			continue;
+		}
 		_gen_pfc_syscall(db->arch, p_iter->sys, fds);
 		p_iter = p_iter->next;
 	}

data/ext/enterprise_script_service/libseccomp/src/hash.c

@@ -1,674 +1,90 @@
 /**
  * Seccomp Library hash code
  *
- * Release under the Public Domain
- * Author: Bob Jenkins <bob_jenkins@burtleburtle.net>
  */
 
 /*
- * lookup3.c, by Bob Jenkins, May 2006, Public Domain.
+ * This code is based on MurmurHash3.cpp from Austin Appleby and is placed in
+ * the public domain.
  *
- * These are functions for producing 32-bit hashes for hash table lookup.
- * jhash_word(), jhash_le(), jhash_be(), mix(), and final() are externally useful
- * functions.  Routines to test the hash are included if SELF_TEST is defined.
- * You can use this free for any purpose.  It's in the public domain.  It has
- * no warranty.
+ * https://github.com/aappleby/smhasher
  *
- * You probably want to use jhash_le().  jhash_le() and jhash_be() hash byte
- * arrays.  jhash_le() is is faster than jhash_be() on little-endian machines.
- * Intel and AMD are little-endian machines.
- *
- * If you want to find a hash of, say, exactly 7 integers, do
- *   a = i1;  b = i2;  c = i3;
- *   mix(a,b,c);
- *   a += i4; b += i5; c += i6;
- *   mix(a,b,c);
- *   a += i7;
- *   final(a,b,c);
- *
- * then use c as the hash value.  If you have a variable length array of
- * 4-byte integers to hash, use jhash_word().  If you have a byte array (like
- * a character string), use jhash_le().  If you have several byte arrays, or
- * a mix of things, see the comments above jhash_le().
- *
- * Why is this so big?  I read 12 bytes at a time into 3 4-byte integers, then
- * mix those integers.  This is fast (you can do a lot more thorough mixing
- * with 12*3 instructions on 3 integers than you can with 3 instructions on 1
- * byte), but shoehorning those bytes into integers efficiently is messy.
  */
 
-#include <stdint.h>
+#include <stdlib.h>
+#include <inttypes.h>
 
-#include "arch.h"
 #include "hash.h"
 
-#define hashsize(n)	((uint32_t)1<<(n))
-#define hashmask(n)	(hashsize(n)-1)
-#define rot(x,k)	(((x)<<(k)) | ((x)>>(32-(k))))
-
-/**
- * Mix 3 32-bit values reversibly
- * @param a 32-bit value
- * @param b 32-bit value
- * @param c 32-bit value
- *
- * This is reversible, so any information in (a,b,c) before mix() is still
- * in (a,b,c) after mix().
- *
- * If four pairs of (a,b,c) inputs are run through mix(), or through mix() in
- * reverse, there are at least 32 bits of the output that are sometimes the
- * same for one pair and different for another pair.
- *
- * This was tested for:
- * - pairs that differed by one bit, by two bits, in any combination of top
- *   bits of (a,b,c), or in any combination of bottom bits of (a,b,c).
- * - "differ" is defined as +, -, ^, or ~^.  For + and -, I transformed the
- *   output delta to a Gray code (a^(a>>1)) so a string of 1's (as is commonly
- *   produced by subtraction) look like a single 1-bit difference.
- * - the base values were pseudorandom, all zero but one bit set, or all zero
- *   plus a counter that starts at zero.
- *
- * Some k values for my "a-=c; a^=rot(c,k); c+=b;" arrangement that
- * satisfy this are
- *     4  6  8 16 19  4
- *     9 15  3 18 27 15
- *    14  9  3  7 17  3
- *
- * Well, "9 15 3 18 27 15" didn't quite get 32 bits diffing for "differ"
- * defined as + with a one-bit base and a two-bit delta.  I used
- * http://burtleburtle.net/bob/hash/avalanche.html to choose the operations,
- * constants, and arrangements of the variables.
- *
- * This does not achieve avalanche.  There are input bits of (a,b,c) that fail
- * to affect some output bits of (a,b,c), especially of a.  The most thoroughly
- * mixed value is c, but it doesn't really even achieve avalanche in c.
- *
- * This allows some parallelism.  Read-after-writes are good at doubling the
- * number of bits affected, so the goal of mixing pulls in the opposite
- * direction as the goal of parallelism.  I did what I could.  Rotates seem to
- * cost as much as shifts on every machine I could lay my hands on, and rotates
- * are much kinder to the top and bottom bits, so I used rotates.
- *
- */
-#define mix(a,b,c) \
-	{ \
-		a -= c;  a ^= rot(c, 4);  c += b; \
-		b -= a;  b ^= rot(a, 6);  a += c; \
-		c -= b;  c ^= rot(b, 8);  b += a; \
-		a -= c;  a ^= rot(c,16);  c += b; \
-		b -= a;  b ^= rot(a,19);  a += c; \
-		c -= b;  c ^= rot(b, 4);  b += a; \
-	}
-
-/**
- * Final mixing of 3 32-bit values (a,b,c) into c
- * @param a 32-bit value
- * @param b 32-bit value
- * @param c 32-bit value
- *
- * Pairs of (a,b,c) values differing in only a few bits will usually produce
- * values of c that look totally different.  This was tested for:
- * - pairs that differed by one bit, by two bits, in any combination of top
- *   bits of (a,b,c), or in any combination of bottom bits of (a,b,c).
- * - "differ" is defined as +, -, ^, or ~^.  For + and -, I transformed the
- *   output delta to a Gray code (a^(a>>1)) so a string of 1's (as is commonly
- *   produced by subtraction) look like a single 1-bit difference.
- * - the base values were pseudorandom, all zero but one bit set, or all zero
- *   plus a counter that starts at zero.
- *
- * These constants passed:
- *  14 11 25 16 4 14 24
- *  12 14 25 16 4 14 24
- * and these came close:
- *   4  8 15 26 3 22 24
- *  10  8 15 26 3 22 24
- *  11  8 15 26 3 22 24
- *
- */
-#define final(a,b,c) \
-	{ \
-		c ^= b; c -= rot(b,14); \
-		a ^= c; a -= rot(c,11); \
-		b ^= a; b -= rot(a,25); \
-		c ^= b; c -= rot(b,16); \
-		a ^= c; a -= rot(c,4);  \
-		b ^= a; b -= rot(a,14); \
-		c ^= b; c -= rot(b,24); \
-	}
-
-/**
- * Hash an array of 32-bit values
- * @param k the key, an array of uint32_t values
- * @param length the number of array elements
- * @param initval the previous hash, or an arbitrary value
- *
- * This works on all machines.  To be useful, it requires:
- * - that the key be an array of uint32_t's, and
- * - that the length be the number of uint32_t's in the key
- *
- * The function jhash_word() is identical to jhash_le() on little-endian
- * machines, and identical to jhash_be() on big-endian machines, except that
- * the length has to be measured in uint32_ts rather than in bytes.  jhash_le()
- * is more complicated than jhash_word() only because jhash_le() has to dance
- * around fitting the key bytes into registers.
- *
- */
-static uint32_t jhash_word(const uint32_t *k, size_t length, uint32_t initval)
+static inline uint32_t getblock32(const uint32_t *p, int i)
 {
-	uint32_t a, b, c;
-
-	/* set up the internal state */
-	a = b = c = 0xdeadbeef + (((uint32_t)length) << 2) + initval;
-
-	/* handle most of the key */
-	while (length > 3) {
-		a += k[0];
-		b += k[1];
-		c += k[2];
-		mix(a, b, c);
-		length -= 3;
-		k += 3;
-	}
-
-	/* handle the last 3 uint32_t's */
-	switch(length) {
-	case 3 :
-		c += k[2];
-	case 2 :
-		b += k[1];
-	case 1 :
-		a += k[0];
-		final(a, b, c);
-	case 0:
-		/* nothing left to add */
-		break;
-	}
-
-	return c;
+	return p[i];
 }
 
-/**
- * Hash a variable-length key into a 32-bit value
- * @param key the key (the unaligned variable-length array of bytes)
- * @param length the length of the key, counting by bytes
- * @param initval can be any 4-byte value
- *
- * Returns a 32-bit value.  Every bit of the key affects every bit of the
- * return value.  Two keys differing by one or two bits will have totally
- * different hash values.
- *
- * The best hash table sizes are powers of 2.  There is no need to do mod a
- * prime (mod is sooo slow!).  If you need less than 32 bits, use a bitmask.
- * For example, if you need only 10 bits, do:
- *   h = (h & hashmask(10));
- * In which case, the hash table should have hashsize(10) elements.
- *
- * If you are hashing n strings (uint8_t **)k, do it like this:
- *   for (i=0, h=0; i<n; ++i) h = jhash_le( k[i], len[i], h);
- *
- */
-static uint32_t jhash_le(const void *key, size_t length, uint32_t initval)
+static inline uint32_t rotl32(uint32_t x, int8_t r)
 {
-	uint32_t a, b, c;
-	union {
-		const void *ptr;
-		size_t i;
-	} u;     /* needed for Mac Powerbook G4 */
-
-	/* set up the internal state */
-	a = b = c = 0xdeadbeef + ((uint32_t)length) + initval;
-
-	u.ptr = key;
-	if ((arch_def_native->endian == ARCH_ENDIAN_LITTLE) &&
-	    ((u.i & 0x3) == 0)) {
-		/* read 32-bit chunks */
-		const uint32_t *k = (const uint32_t *)key;
-
-		while (length > 12) {
-			a += k[0];
-			b += k[1];
-			c += k[2];
-			mix(a, b, c);
-			length -= 12;
-			k += 3;
-		}
-
-		/* "k[2]&0xffffff" actually reads beyond the end of the string,
-		 * but then masks off the part it's not allowed to read.
-		 * Because the string is aligned, the masked-off tail is in the
-		 * same word as the rest of the string.  Every machine with
-		 * memory protection I've seen does it on word boundaries, so
-		 * is OK with this.  But VALGRIND will still catch it and
-		 * complain.  The masking trick does make the hash noticably
-		 * faster for short strings (like English words). */
-#ifndef VALGRIND
-
-		switch(length) {
-		case 12:
-			c += k[2];
-			b += k[1];
-			a += k[0];
-			break;
-		case 11:
-			c += k[2] & 0xffffff;
-			b += k[1];
-			a += k[0];
-			break;
-		case 10:
-			c += k[2] & 0xffff;
-			b += k[1];
-			a += k[0];
-			break;
-		case 9 :
-			c += k[2] & 0xff;
-			b += k[1];
-			a += k[0];
-			break;
-		case 8 :
-			b += k[1];
-			a += k[0];
-			break;
-		case 7 :
-			b += k[1] & 0xffffff;
-			a += k[0];
-			break;
-		case 6 :
-			b += k[1] & 0xffff;
-			a += k[0];
-			break;
-		case 5 :
-			b += k[1] & 0xff;
-			a += k[0];
-			break;
-		case 4 :
-			a += k[0];
-			break;
-		case 3 :
-			a += k[0] & 0xffffff;
-			break;
-		case 2 :
-			a += k[0] & 0xffff;
-			break;
-		case 1 :
-			a += k[0] & 0xff;
-			break;
-		case 0 :
-			/* zero length strings require no mixing */
-			return c;
-		}
-
-#else /* make valgrind happy */
-
-		k8 = (const uint8_t *)k;
-		switch(length) {
-		case 12:
-			c += k[2];
-			b += k[1];
-			a += k[0];
-			break;
-		case 11:
-			c += ((uint32_t)k8[10]) << 16;
-		case 10:
-			c += ((uint32_t)k8[9]) << 8;
-		case 9 :
-			c += k8[8];
-		case 8 :
-			b += k[1];
-			a += k[0];
-			break;
-		case 7 :
-			b += ((uint32_t)k8[6]) << 16;
-		case 6 :
-			b += ((uint32_t)k8[5]) << 8;
-		case 5 :
-			b += k8[4];
-		case 4 :
-			a += k[0];
-			break;
-		case 3 :
-			a += ((uint32_t)k8[2]) << 16;
-		case 2 :
-			a += ((uint32_t)k8[1]) << 8;
-		case 1 :
-			a += k8[0];
-			break;
-		case 0 :
-			return c;
-		}
-
-#endif /* !valgrind */
-
-	} else if ((arch_def_native->endian == ARCH_ENDIAN_LITTLE) &&
-		   ((u.i & 0x1) == 0)) {
-		/* read 16-bit chunks */
-		const uint16_t *k = (const uint16_t *)key;
-		const uint8_t  *k8;
-
-		while (length > 12) {
-			a += k[0] + (((uint32_t)k[1]) << 16);
-			b += k[2] + (((uint32_t)k[3]) << 16);
-			c += k[4] + (((uint32_t)k[5]) << 16);
-			mix(a, b, c);
-			length -= 12;
-			k += 6;
-		}
-
-		k8 = (const uint8_t *)k;
-		switch(length) {
-		case 12:
-			c += k[4] + (((uint32_t)k[5]) << 16);
-			b += k[2] + (((uint32_t)k[3]) << 16);
-			a += k[0] + (((uint32_t)k[1]) << 16);
-			break;
-		case 11:
-			c += ((uint32_t)k8[10]) << 16;
-		case 10:
-			c += k[4];
-			b += k[2] + (((uint32_t)k[3]) << 16);
-			a += k[0] + (((uint32_t)k[1]) << 16);
-			break;
-		case 9 :
-			c += k8[8];
-		case 8 :
-			b += k[2] + (((uint32_t)k[3]) << 16);
-			a += k[0] + (((uint32_t)k[1]) << 16);
-			break;
-		case 7 :
-			b += ((uint32_t)k8[6]) << 16;
-		case 6 :
-			b += k[2];
-			a += k[0] + (((uint32_t)k[1]) << 16);
-			break;
-		case 5 :
-			b += k8[4];
-		case 4 :
-			a += k[0] + (((uint32_t)k[1]) << 16);
-			break;
-		case 3 :
-			a += ((uint32_t)k8[2]) << 16;
-		case 2 :
-			a += k[0];
-			break;
-		case 1 :
-			a += k8[0];
-			break;
-		case 0 :
-			/* zero length requires no mixing */
-			return c;
-		}
-
-	} else {
-		/* need to read the key one byte at a time */
-		const uint8_t *k = (const uint8_t *)key;
-
-		while (length > 12) {
-			a += k[0];
-			a += ((uint32_t)k[1]) << 8;
-			a += ((uint32_t)k[2]) << 16;
-			a += ((uint32_t)k[3]) << 24;
-			b += k[4];
-			b += ((uint32_t)k[5]) << 8;
-			b += ((uint32_t)k[6]) << 16;
-			b += ((uint32_t)k[7]) << 24;
-			c += k[8];
-			c += ((uint32_t)k[9]) << 8;
-			c += ((uint32_t)k[10]) << 16;
-			c += ((uint32_t)k[11]) << 24;
-			mix(a, b, c);
-			length -= 12;
-			k += 12;
-		}
-
-		switch(length) {
-		case 12:
-			c += ((uint32_t)k[11]) << 24;
-		case 11:
-			c += ((uint32_t)k[10]) << 16;
-		case 10:
-			c += ((uint32_t)k[9]) << 8;
-		case 9 :
-			c += k[8];
-		case 8 :
-			b += ((uint32_t)k[7]) << 24;
-		case 7 :
-			b += ((uint32_t)k[6]) << 16;
-		case 6 :
-			b += ((uint32_t)k[5]) << 8;
-		case 5 :
-			b += k[4];
-		case 4 :
-			a += ((uint32_t)k[3]) << 24;
-		case 3 :
-			a += ((uint32_t)k[2]) << 16;
-		case 2 :
-			a += ((uint32_t)k[1]) << 8;
-		case 1 :
-			a += k[0];
-			break;
-		case 0 :
-			return c;
-		}
-	}
-
-	final(a, b, c);
-	return c;
+	return (x << r) | (x >> (32 - r));
 }
 
-/**
- * Hash a variable-length key into a 32-bit value
- * @param key the key (the unaligned variable-length array of bytes)
- * @param length the length of the key, counting by bytes
- * @param initval can be any 4-byte value
- *
- * This is the same as jhash_word() on big-endian machines.  It is different
- * from jhash_le() on all machines.  jhash_be() takes advantage of big-endian
- * byte ordering.
- *
- */
-static uint32_t jhash_be( const void *key, size_t length, uint32_t initval)
+static inline uint32_t fmix32(uint32_t h)
 {
-	uint32_t a, b, c;
-	union {
-		const void *ptr;
-		size_t i;
-	} u; /* to cast key to (size_t) happily */
-
-	/* set up the internal state */
-	a = b = c = 0xdeadbeef + ((uint32_t)length) + initval;
-
-	u.ptr = key;
-	if ((arch_def_native->endian == ARCH_ENDIAN_BIG) &&
-	    ((u.i & 0x3) == 0)) {
-		/* read 32-bit chunks */
-		const uint32_t *k = (const uint32_t *)key;
-
-		while (length > 12) {
-			a += k[0];
-			b += k[1];
-			c += k[2];
-			mix(a, b, c);
-			length -= 12;
-			k += 3;
-		}
-
-		/* "k[2]<<8" actually reads beyond the end of the string, but
-		 * then shifts out the part it's not allowed to read.  Because
-		 * the string is aligned, the illegal read is in the same word
-		 * as the rest of the string.  Every machine with memory
-		 * protection I've seen does it on word boundaries, so is OK
-		 * with this.  But VALGRIND will still catch it and complain.
-		 * The masking trick does make the hash noticably faster for
-		 * short strings (like English words). */
-#ifndef VALGRIND
-
-		switch(length) {
-		case 12:
-			c += k[2];
-			b += k[1];
-			a += k[0];
-			break;
-		case 11:
-			c += k[2] & 0xffffff00;
-			b += k[1];
-			a += k[0];
-			break;
-		case 10:
-			c += k[2] & 0xffff0000;
-			b += k[1];
-			a += k[0];
-			break;
-		case 9 :
-			c += k[2] & 0xff000000;
-			b += k[1];
-			a += k[0];
-			break;
-		case 8 :
-			b += k[1];
-			a += k[0];
-			break;
-		case 7 :
-			b += k[1] & 0xffffff00;
-			a += k[0];
-			break;
-		case 6 :
-			b += k[1] & 0xffff0000;
-			a += k[0];
-			break;
-		case 5 :
-			b += k[1] & 0xff000000;
-			a += k[0];
-			break;
-		case 4 :
-			a += k[0];
-			break;
-		case 3 :
-			a += k[0] & 0xffffff00;
-			break;
-		case 2 :
-			a += k[0] & 0xffff0000;
-			break;
-		case 1 :
-			a += k[0] & 0xff000000;
-			break;
-		case 0 :
-			/* zero length strings require no mixing */
-			return c;
-		}
-
-#else  /* make valgrind happy */
-
-		k8 = (const uint8_t *)k;
-		switch(length) {
-		case 12:
-			c += k[2];
-			b += k[1];
-			a += k[0];
-			break;
-		case 11:
-			c += ((uint32_t)k8[10]) << 8;
-		case 10:
-			c += ((uint32_t)k8[9]) << 16;
-		case 9 :
-			c += ((uint32_t)k8[8]) << 24;
-		case 8 :
-			b += k[1];
-			a += k[0];
-			break;
-		case 7 :
-			b += ((uint32_t)k8[6]) << 8;
-		case 6 :
-			b += ((uint32_t)k8[5]) << 16;
-		case 5 :
-			b += ((uint32_t)k8[4]) << 24;
-		case 4 :
-			a += k[0];
-			break;
-		case 3 :
-			a += ((uint32_t)k8[2]) << 8;
-		case 2 :
-			a += ((uint32_t)k8[1]) << 16;
-		case 1 :
-			a += ((uint32_t)k8[0]) << 24;
-			break;
-		case 0 :
-			return c;
-		}
-
-#endif /* !VALGRIND */
-
-	} else {
-		/* need to read the key one byte at a time */
-		const uint8_t *k = (const uint8_t *)key;
+	h ^= h >> 16;
+	h *= 0x85ebca6b;
+	h ^= h >> 13;
+	h *= 0xc2b2ae35;
+	h ^= h >> 16;
 
-		while (length > 12) {
-			a += ((uint32_t)k[0]) << 24;
-			a += ((uint32_t)k[1]) << 16;
-			a += ((uint32_t)k[2]) << 8;
-			a += ((uint32_t)k[3]);
-			b += ((uint32_t)k[4]) << 24;
-			b += ((uint32_t)k[5]) << 16;
-			b += ((uint32_t)k[6]) << 8;
-			b += ((uint32_t)k[7]);
-			c += ((uint32_t)k[8]) << 24;
-			c += ((uint32_t)k[9]) << 16;
-			c += ((uint32_t)k[10]) << 8;
-			c += ((uint32_t)k[11]);
-			mix(a, b, c);
-			length -= 12;
-			k += 12;
-		}
-
-		switch(length) {
-		case 12:
-			c += k[11];
-		case 11:
-			c += ((uint32_t)k[10]) << 8;
-		case 10:
-			c += ((uint32_t)k[9]) << 16;
-		case 9 :
-			c += ((uint32_t)k[8]) << 24;
-		case 8 :
-			b += k[7];
-		case 7 :
-			b += ((uint32_t)k[6]) << 8;
-		case 6 :
-			b += ((uint32_t)k[5]) << 16;
-		case 5 :
-			b += ((uint32_t)k[4]) << 24;
-		case 4 :
-			a += k[3];
-		case 3 :
-			a += ((uint32_t)k[2]) << 8;
-		case 2 :
-			a += ((uint32_t)k[1]) << 16;
-		case 1 :
-			a += ((uint32_t)k[0]) << 24;
-			break;
-		case 0 :
-			return c;
-		}
-	}
-
-	final(a, b, c);
-	return c;
+	return h;
 }
 
-/**
- * Hash a variable-length key into a 32-bit value
- * @param key the key (the unaligned variable-length array of bytes)
- * @param length the length of the key, counting by bytes
- * @param initval can be any 4-byte value
- *
- * A small wrapper function that selects the proper hash function based on the
- * native machine's byte-ordering.
- *
- */
-uint32_t jhash(const void *key, size_t length, uint32_t initval)
+/* NOTE: this is an implementation of MurmurHash3_x86_32 */
+uint32_t hash(const void *key, size_t length)
 {
-	if (length % sizeof(uint32_t) == 0)
-		return jhash_word(key, (length / sizeof(uint32_t)), initval);
-	else if (arch_def_native->endian == ARCH_ENDIAN_BIG)
-		return jhash_be(key, length, initval);
-	else
-		return jhash_le(key, length, initval);
+	const uint8_t *data = (const uint8_t *)key;
+	const uint32_t *blocks;
+	const uint8_t *tail;
+	const int nblocks = length / 4;
+	const uint32_t c1 = 0xcc9e2d51;
+	const uint32_t c2 = 0x1b873593;
+	uint32_t k1;
+	uint32_t k2 = 0;
+	int i;
+
+	/* NOTE: we always force a seed of 0 */
+	uint32_t h1 = 0;
+
+	/* body */
+	blocks = (const uint32_t *)(data + nblocks * 4);
+	for(i = -nblocks; i; i++) {
+		k1 = getblock32(blocks, i);
+
+		k1 *= c1;
+		k1 = rotl32(k1, 15);
+		k1 *= c2;
+
+		h1 ^= k1;
+		h1 = rotl32(h1, 13);
+		h1 = h1 * 5 + 0xe6546b64;
+	}
+
+	/* tail */
+	tail = (const uint8_t *)(data + nblocks * 4);
+	switch(length & 3) {
+	case 3:
+		k2 ^= tail[2] << 16;
+	case 2:
+		k2 ^= tail[1] << 8;
+	case 1:
+		k2 ^= tail[0];
+		k2 *= c1;
+		k2 = rotl32(k2, 15);
+		k2 *= c2;
+		h1 ^= k2;
+	};
+
+	/* finalization */
+	h1 ^= length;
+	h1 = fmix32(h1);
+
+	return h1;
 }