seccomp-tools 1.6.2 → 1.7.0

data/lib/seccomp-tools/symbolic/state.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require 'seccomp-tools/symbolic/expr'
+
+module SeccompTools
+  module Symbolic
+    # A snapshot of the classic-BPF machine at one point along one path of the walk: the two
+    # registers (A and X), the 16 scratch-memory slots, and the path condition (the {Constraint}s
+    # that must hold to have reached here). The walk fills values in as it interprets
+    # instructions, starting from {.initial}.
+    #
+    # A {State} is treated as immutable - stepping an instruction produces a *new* state via {#with},
+    # so the many paths of the walk can safely share the parts they have in common.
+    class State
+      # @return [Expr] Register A (the accumulator).
+      attr_reader :a
+      # @return [Expr] Register X (the index register).
+      attr_reader :x
+      # @return [Array<Expr>] The 16 scratch-memory slots (+mem[0..15]+).
+      attr_reader :mem
+      # @return [Array<Constraint>] The path condition accumulated so far.
+      attr_reader :path
+
+      # The starting state, as the kernel sets it up: both registers zero (a classic BPF program is
+      # guaranteed +A = X = 0+ on entry - the cBPF-to-eBPF converter clears them first), the
+      # scratch slots unknown, and no facts assumed. The slots stay {Expr.opaque} because nothing
+      # can rely on them: the kernel rejects a filter that reads a slot before writing it.
+      # @return [State]
+      def self.initial
+        new(a: Expr.imm(0), x: Expr.imm(0), mem: Array.new(16, Expr.opaque), path: [])
+      end
+
+      # @param [Expr] a
+      # @param [Expr] x
+      # @param [Array<Expr>] mem
+      # @param [Array<Constraint>] path
+      def initialize(a:, x:, mem:, path:)
+        @a = a
+        @x = x
+        @mem = mem
+        @path = path
+      end
+
+      # Returns a copy with the given fields replaced; unreplaced fields are shared (the state is
+      # immutable).
+      # @return [State]
+      def with(a: @a, x: @x, mem: @mem, path: @path)
+        State.new(a:, x:, mem:, path:)
+      end
+
+      # A string that identifies this state exactly, joined from each part's {Expr#key} /
+      # {Constraint#key} (the same identity, one level up). The walk uses it to skip a
+      # +(line, state)+ pair it has already visited, which keeps merging control-flow from blowing
+      # up. Both {#==} and {#hash} are decided on it; see {Expr#key} for why the key is a string.
+      # The +;+ / +,+ separators appear in no part's key, so the join stays injective.
+      # @return [String]
+      def key
+        @key ||= "#{a.key};#{x.key};#{mem.map(&:key).join(',')};#{path.map(&:key).join(',')}"
+      end
+
+      # The constant the data word at byte +offset+ is pinned to on this path (by an +==+ fact), or
+      # +nil+ when it is not pinned.
+      # @param [Integer] offset
+      # @return [Integer?]
+      def pinned(offset)
+        path.find { |c| c.plain_data_eq?(offset) }&.rhs&.val
+      end
+
+      # @param [State] other
+      # @return [Boolean]
+      def ==(other)
+        other.is_a?(State) && key == other.key
+      end
+      alias eql? ==
+
+      # @return [Integer]
+      def hash
+        key.hash
+      end
+    end
+  end
+end

data/lib/seccomp-tools/syscall.rb

@@ -1,8 +1,10 @@
+# encoding: ascii-8bit
 # frozen_string_literal: true
 
 require 'os'
 
 require 'seccomp-tools/const'
+require 'seccomp-tools/util'
 require 'seccomp-tools/ptrace' if OS.linux?
 
 module SeccompTools
@@ -13,25 +15,32 @@ module SeccompTools
       amd64: { number: 120, args: [112, 104, 96, 56, 72, 44], ret: 80, SYS_prctl: 157, SYS_seccomp: 317 },
       i386: { number: 44, args: [0, 4, 8, 12, 16, 20], ret: 24, SYS_prctl: 172, SYS_seccomp: 354 },
       aarch64: { number: 64, args: [0, 8, 16, 24, 32, 40, 48], ret: 0, SYS_prctl: 167, SYS_seccomp: 277 },
+      riscv64: { number: 136, args: [80, 88, 96, 104, 112, 120], ret: 80, SYS_prctl: 167, SYS_seccomp: 277 },
       # Most software invokes syscalls through "svc 0", in which case the syscall number is in r1.
       # However, it's also possible to use "svc NR": this case is not handled here.
       s390x: { number: 24, args: [32, 40, 48, 56, 64, 72], ret: 32, SYS_prctl: 172, SYS_seccomp: 348 }
     }.freeze
 
-    # @return [Integer] Process id.
+    # @return [Integer] Id of the traced process.
     attr_reader :pid
-    # @return [{Symbol => Integer, Array<Integer>}] See {ABI}.
+    # @return [{Symbol => Integer, Array<Integer>}]
+    #   The {ABI} entry of this syscall's architecture.
     attr_reader :abi
     # @return [Integer] Syscall number.
     attr_reader :number
-    # @return [Integer] Syscall arguments.
+    # @return [Array<Integer>] Syscall arguments, in register order.
     attr_reader :args
     # @return [Integer] Syscall return value.
     attr_reader :ret
 
     # Instantiate a {Syscall} object.
-    # @param [String] pid
-    #   Process-id.
+    #
+    # Reads the syscall number, arguments and return value of +pid+ through ptrace, so the process
+    # must already be stopped and attached.
+    # @param [Integer] pid
+    #   Id of the traced process.
+    # @raise [ArgumentError]
+    #   If the architecture of +pid+ is not one of {ABI}'s keys.
     def initialize(pid)
       @pid = pid
       raise ArgumentError, "Only supports #{ABI.keys.join(', ')}" if ABI[arch].nil?
@@ -42,38 +51,80 @@ module SeccompTools
       @ret = peek(abi[:ret])
     end
 
-    # Is this a +seccomp(SECCOMP_MODE_FILTER, addr)+/+prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, addr)+ syscall?
+    # Is this a seccomp installation syscall?
     #
+    # Both +SECCOMP_MODE_FILTER+ and +SECCOMP_MODE_STRICT+ installations are recognized, invoked
+    # through either +seccomp+ or +prctl(PR_SET_SECCOMP, ...)+.
     # @return [Boolean]
-    #   +true+ for is a seccomp installation syscall.
+    #   +true+ if this is a seccomp installation syscall.
     def set_seccomp?
-      # TODO: handle SECCOMP_MODE_SET_STRICT / SECCOMP_MODE_STRICT
+      filter_mode? || strict_mode?
+    end
+
+    # Is this a +seccomp(SECCOMP_SET_MODE_FILTER, ..)+/+prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, ..)+ syscall?
+    #
+    # @return [Boolean]
+    def filter_mode?
       return true if number == abi[:SYS_seccomp] && args[0] == Const::BPF::SECCOMP_SET_MODE_FILTER
 
       number == abi[:SYS_prctl] && args[0] == Const::BPF::PR_SET_SECCOMP && args[1] == Const::BPF::SECCOMP_MODE_FILTER
     end
 
-    # Dump bpf byte from +args[2]+.
+    # Is this a +seccomp(SECCOMP_SET_MODE_STRICT, ..)+/+prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT)+ syscall?
+    #
+    # @return [Boolean]
+    def strict_mode?
+      return true if number == abi[:SYS_seccomp] && args[0] == Const::BPF::SECCOMP_SET_MODE_STRICT
+
+      number == abi[:SYS_prctl] && args[0] == Const::BPF::PR_SET_SECCOMP && args[1] == Const::BPF::SECCOMP_MODE_STRICT
+    end
+
+    # Constructs a BPF program equivalent to what +SECCOMP_MODE_STRICT+ enforces: only read, write,
+    # exit, and sigreturn are allowed, while any other syscall kills the thread.
+    #
+    # @param [Symbol] arch
+    #   Target architecture, one of {ABI}'s keys.
+    # @return [String]
+    #   Raw BPF bytes.
+    def self.strict_bpf(arch)
+      # Required lazily because the assembler's scanner refers to {ABI} at load time.
+      require 'seccomp-tools/asm/asm'
+
+      # The kernel checks sigreturn on architectures that have it and rt_sigreturn on the others.
+      sigreturn = Const::Syscall.const_get(arch.to_s.upcase)[:sigreturn] ? :sigreturn : :rt_sigreturn
+      Asm.asm(<<-EOS, arch: arch)
+        A = sys_number
+        A == read ? ok : next
+        A == write ? ok : next
+        A == exit ? ok : next
+        A == #{sigreturn} ? ok : next
+        return KILL
+        ok:
+        return ALLOW
+      EOS
+    end
+
+    # Dumps the BPF of the filter being installed.
+    #
+    # Only meaningful when {#set_seccomp?} is +true+. In filter mode +args[2]+ points to a
+    # +struct sock_fprog+ in the traced process, whose BPF bytes are read out. Strict mode installs
+    # no BPF, so an equivalent filter built by {.strict_bpf} is returned instead.
     # @return [String]
+    #   The raw BPF bytes of the filter being installed.
     def dump_bpf
+      return self.class.strict_bpf(arch) if strict_mode?
+
       addr = args[2]
       len = Ptrace.peekdata(pid, addr, 0) & 0xffff # len is unsigned short
       filter = Ptrace.peekdata(pid, addr + (bits / 8), 0) & ((1 << bits) - 1)
       Array.new(len) { |i| Ptrace.peekdata(pid, filter + (i * 8), 0) }.pack('Q*')
     end
 
-    # @return [Symbol]
-    #   Architecture of this syscall.
+    # Architecture of this syscall, i.e. of the traced process.
+    # @return [Symbol?]
+    #   See {SeccompTools::Util.process_arch}.
     def arch
-      @arch ||= File.open("/proc/#{pid}/exe", 'rb') do |f|
-        f.pos = 18
-        {
-          "\x03\x00" => :i386,
-          "\x3e\x00" => :amd64,
-          "\xb7\x00" => :aarch64,
-          "\x00\x16" => :s390x
-        }[f.read(2)]
-      end
+      @arch ||= Util.process_arch(pid)
     end
 
     private
@@ -83,6 +134,7 @@ module SeccompTools
         i386: 32,
         amd64: 64,
         aarch64: 64,
+        riscv64: 64,
         s390x: 64
       }[arch]
     end

data/lib/seccomp-tools/util.rb

@@ -1,13 +1,15 @@
 # frozen_string_literal: true
 
 module SeccompTools
-  # Define utility methods.
+  # Utility methods shared across the library: architecture detection and terminal colorizing.
   module Util
     module_function
 
     # Get currently supported architectures.
+    #
+    # Derived from the syscall tables shipped under +consts/sys_nr/+.
     # @return [Array<Symbol>]
-    #   Architectures.
+    #   Architecture names, sorted.
     def supported_archs
       @supported_archs ||= Dir.glob(File.join(__dir__, 'consts', 'sys_nr', '*.rb'))
                               .map { |f| File.basename(f, '.rb').to_sym }
@@ -16,23 +18,57 @@ module SeccompTools
 
     # Detect system architecture.
     # @return [Symbol]
+    #   One of {supported_archs}, or +:unknown+ if the host CPU is not supported.
     def system_arch
       case RbConfig::CONFIG['host_cpu']
       when /x86_64/ then :amd64
       when /i386/ then :i386
       when /aarch64/ then :aarch64
+      when /riscv64/ then :riscv64
       when /s390x/ then :s390x
       else :unknown
       end
     end
 
+    # ELF +e_machine+ values (the halfword at offset 18) of the architectures seccomp-tools supports,
+    # as they are laid out in the file - so the big-endian s390x reads the other way around. The keys
+    # are binary strings (+.b+) to match what is read off the file: this source is UTF-8, where a
+    # literal such as +"\xb7\x00"+ would never compare equal to those bytes.
+    ELF_MACHINE = {
+      "\x03\x00".b => :i386,
+      "\x3e\x00".b => :amd64,
+      "\xb7\x00".b => :aarch64,
+      "\xf3\x00".b => :riscv64,
+      "\x00\x16".b => :s390x
+    }.freeze
+
+    # The architecture a running process was built for, read from the ELF header of its executable.
+    #
+    # Filters dumped from another process are numbered for *its* architecture, so this is what makes
+    # the syscall names right when it differs from the host.
+    # @param [Integer] pid
+    #   Process identifier.
+    # @return [Symbol?]
+    #   One of {supported_archs}, or +nil+ when the executable cannot be read (no +/proc+, the
+    #   process is gone, permission denied) or its machine type is not one we know.
+    def process_arch(pid)
+      File.open("/proc/#{pid}/exe", 'rb') do |f|
+        f.pos = 18
+        ELF_MACHINE[f.read(2)]
+      end
+    rescue SystemCallError
+      nil
+    end
+
     # Enable colorize.
+    #
+    # Colors are still only emitted when the output is a tty, see {colorize_enabled?}.
     # @return [void]
     def enable_color!
       @disable_color = false
     end
 
-    # Disable colorize.
+    # Disable colorize, {colorize} becomes a no-op regardless of the output being a tty.
     # @return [void]
     def disable_color!
       @disable_color = true
@@ -40,28 +76,35 @@ module SeccompTools
 
     # Is colorize enabled?
     # @return [Boolean]
+    #   +true+ only if colors have not been disabled by {disable_color!} and +$stdout+ is a tty.
     def colorize_enabled?
       !@disable_color && $stdout.tty?
     end
 
     # color code of light yellow
     LIGHT_YELLOW = "\e[38;5;230m"
-    # Color codes for pretty print.
+    # Color codes for pretty print. +error+, +warn+ and +info+ are severities rather than parts of a
+    # filter, shading from alarming to quiet; {SeccompTools::Logger} colors its own levels by the
+    # same names.
     COLOR_CODE = {
       esc_m: "\e[0m",
       syscall: "\e[38;5;120m", # light green
       arch: LIGHT_YELLOW,
       args: LIGHT_YELLOW,
       gray: "\e[2m",
-      error: "\e[38;5;196m" # heavy red
+      error: "\e[38;5;196m", # heavy red
+      warn: LIGHT_YELLOW,
+      info: "\e[38;5;110m" # light blue
     }.freeze
-    # Wrapper color codes.
-    # @param [String] s
-    #   Contents to wrapper.
+    # Wrap contents with terminal color codes.
+    #
+    # Returns +s+ unchanged when {colorize_enabled?} is +false+.
+    # @param [#to_s] s
+    #   Contents to be wrapped.
     # @param [Symbol?] t
-    #   Specific which kind of color to use, valid symbols are defined in {Util.COLOR_CODE}.
+    #   Which kind of color to use, valid symbols are the keys of {Util::COLOR_CODE}.
     # @return [String]
-    #   Wrapper with color codes.
+    #   +s+ wrapped with color codes.
     def colorize(s, t: nil)
       s = s.to_s
       return s unless colorize_enabled?
@@ -71,13 +114,29 @@ module SeccompTools
       "#{color}#{s.sub(cc[:esc_m], cc[:esc_m] + color)}#{cc[:esc_m]}"
     end
 
+    # Does the file at +path+ start with the ELF magic bytes?
+    #
+    # Used to tell an executable apart from a raw BPF blob.
+    # @param [String] path
+    #   Path to the file to check.
+    # @return [Boolean]
+    #   +false+ when the file cannot be read.
+    def elf?(path)
+      File.binread(path, 4) == "\x7fELF".b
+    rescue SystemCallError
+      false
+    end
+
     # Get content of filename under directory templates/.
     #
     # @param [String] filename
-    #   The filename.
+    #   Basename of a file under +lib/seccomp-tools/templates/+.
     #
     # @return [String]
     #   Content of the file.
+    #
+    # @raise [Errno::ENOENT]
+    #   If no such template exists.
     def template(filename)
       File.binread(File.join(__dir__, 'templates', filename))
     end

data/lib/seccomp-tools/version.rb

@@ -2,5 +2,5 @@
 
 module SeccompTools
   # Gem version.
-  VERSION = '1.6.2'
+  VERSION = '1.7.0'
 end

data/lib/seccomp-tools.rb

@@ -2,7 +2,16 @@
 
 # @author david942j
 
-# Main module.
+# Toolkit for working with seccomp BPF filters.
+#
+# The library entry points are {Asm.asm} to compile assembly into raw BPF, {Disasm.disasm} to turn
+# raw BPF back into readable assembly, {Dumper.dump} to capture the filters a process installs, and
+# {Emulator} to run a filter against a hypothetical syscall.
+#
+# @example
+#   raw = SeccompTools::Asm.asm("return ALLOW\n", arch: :amd64)
+#   SeccompTools::Disasm.disasm(raw, arch: :amd64, display_bpf: false)
+#   #=> "0000: return ALLOW\n"
 module SeccompTools
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: seccomp-tools
 version: !ruby/object:Gem::Version
-  version: 1.6.2
+  version: 1.7.0
 platform: ruby
 authors:
 - david942j
@@ -85,14 +85,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.21'
+        version: '1.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.21'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: yard
   requirement: !ruby/object:Gem::Requirement
@@ -166,9 +166,13 @@ extensions:
 - ext/ptrace/extconf.rb
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - LICENSE
 - README.md
 - bin/seccomp-tools
+- completions/_seccomp-tools
+- completions/seccomp-tools.bash
+- completions/seccomp-tools.fish
 - ext/ptrace/extconf.rb
 - ext/ptrace/ptrace.c
 - lib/seccomp-tools.rb
@@ -180,24 +184,48 @@ files:
 - lib/seccomp-tools/asm/scanner.rb
 - lib/seccomp-tools/asm/statement.rb
 - lib/seccomp-tools/asm/token.rb
+- lib/seccomp-tools/audit.rb
+- lib/seccomp-tools/audit/catalog.rb
+- lib/seccomp-tools/audit/checks.rb
+- lib/seccomp-tools/audit/checks/arch_unchecked.rb
+- lib/seccomp-tools/audit/checks/dangerous_allow.rb
+- lib/seccomp-tools/audit/checks/orw_chain.rb
+- lib/seccomp-tools/audit/checks/permissive_default.rb
+- lib/seccomp-tools/audit/checks/syscall_alt_gap.rb
+- lib/seccomp-tools/audit/checks/x32_guard.rb
+- lib/seccomp-tools/audit/finding.rb
+- lib/seccomp-tools/audit/policy.rb
+- lib/seccomp-tools/audit/report.rb
 - lib/seccomp-tools/bpf.rb
 - lib/seccomp-tools/cli/asm.rb
+- lib/seccomp-tools/cli/audit.rb
 - lib/seccomp-tools/cli/base.rb
 - lib/seccomp-tools/cli/cli.rb
+- lib/seccomp-tools/cli/completion.rb
 - lib/seccomp-tools/cli/disasm.rb
 - lib/seccomp-tools/cli/dump.rb
+- lib/seccomp-tools/cli/dumpable.rb
 - lib/seccomp-tools/cli/emu.rb
+- lib/seccomp-tools/cli/explain.rb
+- lib/seccomp-tools/cli/filter_input.rb
 - lib/seccomp-tools/const.rb
 - lib/seccomp-tools/consts/sys_arg.rb
 - lib/seccomp-tools/consts/sys_nr/aarch64.rb
 - lib/seccomp-tools/consts/sys_nr/amd64.rb
 - lib/seccomp-tools/consts/sys_nr/i386.rb
+- lib/seccomp-tools/consts/sys_nr/riscv64.rb
 - lib/seccomp-tools/consts/sys_nr/s390x.rb
-- lib/seccomp-tools/disasm/context.rb
 - lib/seccomp-tools/disasm/disasm.rb
 - lib/seccomp-tools/dumper.rb
 - lib/seccomp-tools/emulator.rb
 - lib/seccomp-tools/error.rb
+- lib/seccomp-tools/explain.rb
+- lib/seccomp-tools/explain/analysis.rb
+- lib/seccomp-tools/explain/path_facts.rb
+- lib/seccomp-tools/explain/qword.rb
+- lib/seccomp-tools/explain/renderer.rb
+- lib/seccomp-tools/explain/summary.rb
+- lib/seccomp-tools/explain/verdict.rb
 - lib/seccomp-tools/instruction/alu.rb
 - lib/seccomp-tools/instruction/base.rb
 - lib/seccomp-tools/instruction/instruction.rb
@@ -209,6 +237,10 @@ files:
 - lib/seccomp-tools/instruction/st.rb
 - lib/seccomp-tools/instruction/stx.rb
 - lib/seccomp-tools/logger.rb
+- lib/seccomp-tools/symbolic/constraint.rb
+- lib/seccomp-tools/symbolic/executor.rb
+- lib/seccomp-tools/symbolic/expr.rb
+- lib/seccomp-tools/symbolic/state.rb
 - lib/seccomp-tools/syscall.rb
 - lib/seccomp-tools/templates/asm.amd64.asm
 - lib/seccomp-tools/templates/asm.c

data/lib/seccomp-tools/disasm/context.rb

@@ -1,171 +0,0 @@
-# frozen_string_literal: true
-
-module SeccompTools
-  module Disasm
-    # @private
-    #
-    # Context for disassembler to analyze.
-    #
-    # This class maintains:
-    # * if +reg/mem+ can be one of +data[*]+
-    # * if +data[0]+ (i.e. sys_number) is a known value
-    class Context
-      # @private
-      #
-      # Records the type and value.
-      class Value
-        attr_reader :val # @return [Integer]
-
-        # @param [:imm, :data, :mem] rel
-        # @param [Integer?] val
-        def initialize(rel: :imm, val: nil)
-          @rel = rel
-          @val = val
-        end
-
-        # @return [Boolean]
-        def data?
-          @rel == :data
-        end
-
-        # @return [Boolean]
-        def imm?
-          @rel == :imm && @val.is_a?(Integer)
-        end
-
-        # Defines hash function.
-        # @return [Integer]
-        def hash
-          [@rel, @val].hash
-        end
-
-        # Defines +eql?+.
-        #
-        # @param [Context::Value] other
-        # @return [Boolean]
-        def eql?(other)
-          @val == other.val && @rel == other.instance_variable_get(:@rel)
-        end
-      end
-
-      # @return [{Integer, Symbol => Context::Value}] Records reg and mem values.
-      attr_reader :values
-      # @return [Array<Integer?>] Records the known value of data.
-      attr_reader :known_data
-
-      # Instantiate a {Context} object.
-      # @param [{Integer, Symbol => Context::Value?}] values
-      #   Value to be set to +reg/mem+.
-      # @param [Array<Integer?>] known_data
-      #   Records which index of data is known.
-      #   It's used for tracking when the syscall number is known, which can be used to display argument names of the
-      #   syscall.
-      def initialize(values: {}, known_data: [])
-        @values = values
-        16.times { |i| @values[i] ||= Value.new(rel: :mem, val: i) } # make @values always has all keys
-        @values[:a] ||= Value.new
-        @values[:x] ||= Value.new
-        @known_data = known_data
-      end
-
-      # Is used for the ld/ldx instructions.
-      #
-      # @param [#downcase, :a, :x] reg
-      #   Register to be set
-      # @return [void]
-      def load(reg, rel: nil, val: nil)
-        reg = reg.downcase.to_sym
-        values[reg] = if rel == :mem
-                        values[val]
-                      else
-                        Value.new(rel:, val:)
-                      end
-      end
-
-      # Is used for the st/stx instructions.
-      #
-      # @param [Integer] idx
-      #   Index of +mem+ array.
-      # @param [#downcase, :a, :x] reg
-      #   Register.
-      #
-      # @return [void]
-      def store(idx, reg)
-        raise RangeError, "Expect 0 <= idx < 16, got #{idx}." unless idx.between?(0, 15)
-
-        values[idx] = values[reg.downcase.to_sym]
-      end
-
-      # Hints context that current value of register A equals to +val+.
-      #
-      # @param [Integer, :x] val
-      #   An immediate value or the symbol x.
-      # @return [self]
-      #   Returns the object itself.
-      def eql!(val)
-        tap do
-          # only cares when A is fetched from data
-          next unless a.data?
-          next known_data[a.val] = val if val.is_a?(Integer)
-          # A == X, we can handle these cases:
-          # * X is an immi
-          # * X is a known data
-          next unless x.data? || x.imm?
-          next known_data[a.val] = x.val if x.imm?
-
-          known_data[a.val] = known_data[x.val]
-        end
-      end
-
-      # Implements a deep dup.
-      # @return [Context]
-      def dup
-        Context.new(values: values.dup, known_data: known_data.dup)
-      end
-
-      # Register A.
-      # @return [Context::Value]
-      def a
-        values[:a]
-      end
-
-      # Register X.
-      # @return [Context::Value]
-      def x
-        values[:x]
-      end
-
-      # For conveniently get instance variable.
-      # @param [String, Symbol, Integer] key
-      # @return [Context::Value]
-      def [](key)
-        return values[key] if key.is_a?(Integer) # mem
-
-        values[key.downcase.to_sym]
-      end
-
-      # For conveniently set an instance variable.
-      # @param [#downcase, :a, :x] reg
-      #   Can be +'A', 'a', :a, 'X', 'x', :x+.
-      # @param [Value] val
-      #   Value to set.
-      # @return [void]
-      def []=(reg, val)
-        values[reg.downcase.to_sym] = val
-      end
-
-      # For +Set+ to compare two {Context} objects.
-      # @param [Context] other
-      # @return [Boolean]
-      def eql?(other)
-        values.eql?(other.values) && known_data.eql?(other.known_data)
-      end
-
-      # For +Set+ to get the hash value.
-      # @return [Integer]
-      def hash
-        [values, known_data].hash
-      end
-    end
-  end
-end