OLD | NEW |
| (Empty) |
1 /* | |
2 * Copyright (c) 2012 The Native Client Authors. All rights reserved. | |
3 * Use of this source code is governed by a BSD-style license that can be | |
4 * found in the LICENSE file. | |
5 */ | |
6 | |
7 #include <assert.h> | |
8 #include <errno.h> | |
9 #include <stddef.h> | |
10 #include <stdio.h> | |
11 #include <stdlib.h> | |
12 #include <string.h> | |
13 | |
14 #include "native_client/src/trusted/validator_ragel/unreviewed/validator_interna
l.h" | |
15 | |
16 /* Ignore this information: it's not used by security model in IA32 mode. */ | |
17 #undef GET_VEX_PREFIX3 | |
18 #define GET_VEX_PREFIX3 0 | |
19 #undef SET_VEX_PREFIX3 | |
20 #define SET_VEX_PREFIX3(P) | |
21 | |
22 %%{ | |
23 machine x86_32_validator; | |
24 alphtype unsigned char; | |
25 variable p current_position; | |
26 variable pe end_of_bundle; | |
27 variable eof end_of_bundle; | |
28 variable cs current_state; | |
29 | |
30 include byte_machine "byte_machines.rl"; | |
31 | |
32 include prefix_actions | |
33 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
34 include prefixes_parsing | |
35 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
36 include vex_actions_ia32 | |
37 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
38 include vex_parsing_ia32 | |
39 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
40 include displacement_fields_actions | |
41 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
42 include displacement_fields_parsing | |
43 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
44 include modrm_parsing_ia32_noactions | |
45 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
46 include immediate_fields_actions | |
47 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
48 include immediate_fields_parsing_ia32 | |
49 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
50 action rel8_operand { | |
51 rel8_operand(current_position + 1, data, jump_dests, size, | |
52 &instruction_info_collected); | |
53 } | |
54 action rel16_operand { | |
55 #error rel16_operand should never be used in nacl | |
56 } | |
57 action rel32_operand { | |
58 rel32_operand(current_position + 1, data, jump_dests, size, | |
59 &instruction_info_collected); | |
60 } | |
61 include relative_fields_parsing | |
62 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
63 include cpuid_actions | |
64 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
65 | |
66 action last_byte_is_not_immediate { | |
67 instruction_info_collected |= LAST_BYTE_IS_NOT_IMMEDIATE; | |
68 } | |
69 | |
70 include decode_x86_32 "validator_x86_32_instruction.rl"; | |
71 | |
72 special_instruction = | |
73 (0x83 0xe0 0xe0 0xff (0xd0|0xe0) | # naclcall/jmp %eax | |
74 0x83 0xe1 0xe0 0xff (0xd1|0xe1) | # naclcall/jmp %ecx | |
75 0x83 0xe2 0xe0 0xff (0xd2|0xe2) | # naclcall/jmp %edx | |
76 0x83 0xe3 0xe0 0xff (0xd3|0xe3) | # naclcall/jmp %ebx | |
77 0x83 0xe4 0xe0 0xff (0xd4|0xe4) | # naclcall/jmp %esp | |
78 0x83 0xe5 0xe0 0xff (0xd5|0xe5) | # naclcall/jmp %ebp | |
79 0x83 0xe6 0xe0 0xff (0xd6|0xe6) | # naclcall/jmp %esi | |
80 0x83 0xe7 0xe0 0xff (0xd7|0xe7)) # naclcall/jmp %edi | |
81 @{ | |
82 BitmapClearBit(valid_targets, (current_position - data) - 1); | |
83 instruction_start -= 3; | |
84 instruction_info_collected |= SPECIAL_INSTRUCTION; | |
85 } | | |
86 (0x65 0xa1 (0x00|0x04) 0x00 0x00 0x00 | # mov %gs:0x0/0x4,%eax | |
87 0x65 0x8b (0x05|0x0d|0x015|0x1d|0x25|0x2d|0x35|0x3d) | |
88 (0x00|0x04) 0x00 0x00 0x00); # mov %gs:0x0/0x4,%reg | |
89 | |
90 # Check if call is properly aligned | |
91 call_alignment = | |
92 ((one_instruction & | |
93 # Direct call | |
94 ((data16 0xe8 rel16) | | |
95 (0xe8 rel32))) | | |
96 (special_instruction & | |
97 # Indirect call | |
98 (any* data16? 0xff ((opcode_2 | opcode_3) any* & | |
99 (modrm_memory | modrm_registers))))) | |
100 @{ | |
101 if (((current_position - data) & kBundleMask) != kBundleMask) | |
102 instruction_info_collected |= BAD_CALL_ALIGNMENT; | |
103 }; | |
104 | |
105 main := ((call_alignment | one_instruction | special_instruction) | |
106 >{ | |
107 BitmapSetBit(valid_targets, current_position - data); | |
108 } | |
109 @{ | |
110 if ((instruction_info_collected & | |
111 (VALIDATION_ERRORS_MASK | BAD_CALL_ALIGNMENT)) || | |
112 (options & CALL_USER_CALLBACK_ON_EACH_INSTRUCTION)) { | |
113 result &= user_callback(instruction_start, current_position, | |
114 instruction_info_collected, callback_data); | |
115 } | |
116 /* On successful match the instruction start must point to the next byte | |
117 * to be able to report the new offset as the start of instruction | |
118 * causing error. */ | |
119 instruction_start = current_position + 1; | |
120 instruction_info_collected = 0; | |
121 })* | |
122 $err{ | |
123 result &= user_callback(instruction_start, current_position, | |
124 UNRECOGNIZED_INSTRUCTION, callback_data); | |
125 continue; | |
126 }; | |
127 | |
128 }%% | |
129 | |
130 %% write data; | |
131 | |
132 | |
133 Bool ValidateChunkIA32(const uint8_t *data, size_t size, | |
134 enum validation_options options, | |
135 const NaClCPUFeaturesX86 *cpu_features, | |
136 validation_callback_func user_callback, | |
137 void *callback_data) { | |
138 bitmap_word valid_targets_small; | |
139 bitmap_word jump_dests_small; | |
140 bitmap_word *valid_targets; | |
141 bitmap_word *jump_dests; | |
142 const uint8_t *current_position; | |
143 const uint8_t *end_of_bundle; | |
144 int result = TRUE; | |
145 | |
146 CHECK(sizeof valid_targets_small == sizeof jump_dests_small); | |
147 CHECK(size % kBundleSize == 0); | |
148 | |
149 /* For a very small sequence (one bundle) malloc is too expensive. */ | |
150 if (size <= sizeof valid_targets_small) { | |
151 valid_targets_small = 0; | |
152 valid_targets = &valid_targets_small; | |
153 jump_dests_small = 0; | |
154 jump_dests = &jump_dests_small; | |
155 } else { | |
156 valid_targets = BitmapAllocate(size); | |
157 jump_dests = BitmapAllocate(size); | |
158 if (!valid_targets || !jump_dests) { | |
159 free(jump_dests); | |
160 free(valid_targets); | |
161 errno = ENOMEM; | |
162 return FALSE; | |
163 } | |
164 } | |
165 | |
166 if (options & PROCESS_CHUNK_AS_A_CONTIGUOUS_STREAM) | |
167 end_of_bundle = data + size; | |
168 else | |
169 end_of_bundle = data + kBundleSize; | |
170 | |
171 for (current_position = data; | |
172 current_position < data + size; | |
173 current_position = end_of_bundle, | |
174 end_of_bundle = current_position + kBundleSize) { | |
175 /* Start of the instruction being processed. */ | |
176 const uint8_t *instruction_start = current_position; | |
177 uint32_t instruction_info_collected = 0; | |
178 int current_state; | |
179 | |
180 %% write init; | |
181 %% write exec; | |
182 } | |
183 | |
184 result &= ProcessInvalidJumpTargets(data, size, valid_targets, jump_dests, | |
185 user_callback, callback_data); | |
186 | |
187 /* We only use malloc for a large code sequences */ | |
188 if (size > sizeof valid_targets_small) { | |
189 free(jump_dests); | |
190 free(valid_targets); | |
191 } | |
192 if (!result) errno = EINVAL; | |
193 return result; | |
194 } | |
OLD | NEW |