Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(751)

Side by Side Diff: src/trusted/validator_ragel/unreviewed/validator_x86_32.rl

Issue 11000033: Move validator_x86_XX.rl out of unreviewed. (Closed) Base URL: svn://svn.chromium.org/native_client/trunk/src/native_client/
Patch Set: Created 8 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
(Empty)
1 /*
2 * Copyright (c) 2012 The Native Client Authors. All rights reserved.
3 * Use of this source code is governed by a BSD-style license that can be
4 * found in the LICENSE file.
5 */
6
7 #include <assert.h>
8 #include <errno.h>
9 #include <stddef.h>
10 #include <stdio.h>
11 #include <stdlib.h>
12 #include <string.h>
13
14 #include "native_client/src/trusted/validator_ragel/unreviewed/validator_interna l.h"
15
16 /* Ignore this information: it's not used by security model in IA32 mode. */
17 #undef GET_VEX_PREFIX3
18 #define GET_VEX_PREFIX3 0
19 #undef SET_VEX_PREFIX3
20 #define SET_VEX_PREFIX3(P)
21
22 %%{
23 machine x86_32_validator;
24 alphtype unsigned char;
25 variable p current_position;
26 variable pe end_of_bundle;
27 variable eof end_of_bundle;
28 variable cs current_state;
29
30 include byte_machine "byte_machines.rl";
31
32 include prefix_actions
33 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl";
34 include prefixes_parsing
35 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl";
36 include vex_actions_ia32
37 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl";
38 include vex_parsing_ia32
39 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl";
40 include displacement_fields_actions
41 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl";
42 include displacement_fields_parsing
43 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl";
44 include modrm_parsing_ia32_noactions
45 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl";
46 include immediate_fields_actions
47 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl";
48 include immediate_fields_parsing_ia32
49 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl";
50 action rel8_operand {
51 rel8_operand(current_position + 1, data, jump_dests, size,
52 &instruction_info_collected);
53 }
54 action rel16_operand {
55 #error rel16_operand should never be used in nacl
56 }
57 action rel32_operand {
58 rel32_operand(current_position + 1, data, jump_dests, size,
59 &instruction_info_collected);
60 }
61 include relative_fields_parsing
62 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl";
63 include cpuid_actions
64 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl";
65
66 action last_byte_is_not_immediate {
67 instruction_info_collected |= LAST_BYTE_IS_NOT_IMMEDIATE;
68 }
69
70 include decode_x86_32 "validator_x86_32_instruction.rl";
71
72 special_instruction =
73 (0x83 0xe0 0xe0 0xff (0xd0|0xe0) | # naclcall/jmp %eax
74 0x83 0xe1 0xe0 0xff (0xd1|0xe1) | # naclcall/jmp %ecx
75 0x83 0xe2 0xe0 0xff (0xd2|0xe2) | # naclcall/jmp %edx
76 0x83 0xe3 0xe0 0xff (0xd3|0xe3) | # naclcall/jmp %ebx
77 0x83 0xe4 0xe0 0xff (0xd4|0xe4) | # naclcall/jmp %esp
78 0x83 0xe5 0xe0 0xff (0xd5|0xe5) | # naclcall/jmp %ebp
79 0x83 0xe6 0xe0 0xff (0xd6|0xe6) | # naclcall/jmp %esi
80 0x83 0xe7 0xe0 0xff (0xd7|0xe7)) # naclcall/jmp %edi
81 @{
82 BitmapClearBit(valid_targets, (current_position - data) - 1);
83 instruction_start -= 3;
84 instruction_info_collected |= SPECIAL_INSTRUCTION;
85 } |
86 (0x65 0xa1 (0x00|0x04) 0x00 0x00 0x00 | # mov %gs:0x0/0x4,%eax
87 0x65 0x8b (0x05|0x0d|0x015|0x1d|0x25|0x2d|0x35|0x3d)
88 (0x00|0x04) 0x00 0x00 0x00); # mov %gs:0x0/0x4,%reg
89
90 # Check if call is properly aligned
91 call_alignment =
92 ((one_instruction &
93 # Direct call
94 ((data16 0xe8 rel16) |
95 (0xe8 rel32))) |
96 (special_instruction &
97 # Indirect call
98 (any* data16? 0xff ((opcode_2 | opcode_3) any* &
99 (modrm_memory | modrm_registers)))))
100 @{
101 if (((current_position - data) & kBundleMask) != kBundleMask)
102 instruction_info_collected |= BAD_CALL_ALIGNMENT;
103 };
104
105 main := ((call_alignment | one_instruction | special_instruction)
106 >{
107 BitmapSetBit(valid_targets, current_position - data);
108 }
109 @{
110 if ((instruction_info_collected & VALIDATION_ERRORS_MASK) ||
111 (options & CALL_USER_CALLBACK_ON_EACH_INSTRUCTION)) {
112 result &= user_callback(instruction_start, current_position,
113 instruction_info_collected, callback_data);
114 }
115 /* On successful match the instruction start must point to the next byte
116 * to be able to report the new offset as the start of instruction
117 * causing error. */
118 instruction_start = current_position + 1;
119 instruction_info_collected = 0;
120 })*
121 $err{
122 result &= user_callback(instruction_start, current_position,
123 UNRECOGNIZED_INSTRUCTION, callback_data);
124 continue;
125 };
126
127 }%%
128
129 %% write data;
130
131
132 Bool ValidateChunkIA32(const uint8_t *data, size_t size,
133 enum ValidationOptions options,
134 const NaClCPUFeaturesX86 *cpu_features,
135 ValidationCallbackFunc user_callback,
136 void *callback_data) {
137 bitmap_word valid_targets_small;
138 bitmap_word jump_dests_small;
139 bitmap_word *valid_targets;
140 bitmap_word *jump_dests;
141 const uint8_t *current_position;
142 const uint8_t *end_of_bundle;
143 int result = TRUE;
144
145 CHECK(sizeof valid_targets_small == sizeof jump_dests_small);
146 CHECK(size % kBundleSize == 0);
147
148 /* For a very small sequence (one bundle) malloc is too expensive. */
149 if (size <= sizeof valid_targets_small) {
150 valid_targets_small = 0;
151 valid_targets = &valid_targets_small;
152 jump_dests_small = 0;
153 jump_dests = &jump_dests_small;
154 } else {
155 valid_targets = BitmapAllocate(size);
156 jump_dests = BitmapAllocate(size);
157 if (!valid_targets || !jump_dests) {
158 free(jump_dests);
159 free(valid_targets);
160 errno = ENOMEM;
161 return FALSE;
162 }
163 }
164
165 if (options & PROCESS_CHUNK_AS_A_CONTIGUOUS_STREAM)
166 end_of_bundle = data + size;
167 else
168 end_of_bundle = data + kBundleSize;
169
170 for (current_position = data;
171 current_position < data + size;
172 current_position = end_of_bundle,
173 end_of_bundle = current_position + kBundleSize) {
174 /* Start of the instruction being processed. */
175 const uint8_t *instruction_start = current_position;
176 uint32_t instruction_info_collected = 0;
177 int current_state;
178
179 %% write init;
180 %% write exec;
181 }
182
183 result &= ProcessInvalidJumpTargets(data, size, valid_targets, jump_dests,
184 user_callback, callback_data);
185
186 /* We only use malloc for a large code sequences */
187 if (size > sizeof valid_targets_small) {
188 free(jump_dests);
189 free(valid_targets);
190 }
191 if (!result) errno = EINVAL;
192 return result;
193 }
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698