OLD | NEW |
| (Empty) |
1 /* | |
2 * Copyright (c) 2012 The Native Client Authors. All rights reserved. | |
3 * Use of this source code is governed by a BSD-style license that can be | |
4 * found in the LICENSE file. | |
5 */ | |
6 | |
7 #include <assert.h> | |
8 #include <errno.h> | |
9 #include <stddef.h> | |
10 #include <stdio.h> | |
11 #include <stdlib.h> | |
12 #include <string.h> | |
13 | |
14 #include "native_client/src/trusted/validator_ragel/unreviewed/validator_interna
l.h" | |
15 | |
16 /* Ignore this information: it's not used by security model in IA32 mode. */ | |
17 #undef GET_VEX_PREFIX3 | |
18 #define GET_VEX_PREFIX3 0 | |
19 #undef SET_VEX_PREFIX3 | |
20 #define SET_VEX_PREFIX3(P) | |
21 | |
22 %%{ | |
23 machine x86_32_validator; | |
24 alphtype unsigned char; | |
25 variable p current_position; | |
26 variable pe end_of_bundle; | |
27 variable eof end_of_bundle; | |
28 variable cs current_state; | |
29 | |
30 include byte_machine "byte_machines.rl"; | |
31 | |
32 include prefix_actions | |
33 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
34 include prefixes_parsing | |
35 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
36 include vex_actions_ia32 | |
37 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
38 include vex_parsing_ia32 | |
39 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
40 include displacement_fields_actions | |
41 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
42 include displacement_fields_parsing | |
43 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
44 include modrm_parsing_ia32_noactions | |
45 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
46 include immediate_fields_actions | |
47 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
48 include immediate_fields_parsing_ia32 | |
49 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
50 action rel8_operand { | |
51 rel8_operand(current_position + 1, data, jump_dests, size, | |
52 &instruction_info_collected); | |
53 } | |
54 action rel16_operand { | |
55 #error rel16_operand should never be used in nacl | |
56 } | |
57 action rel32_operand { | |
58 rel32_operand(current_position + 1, data, jump_dests, size, | |
59 &instruction_info_collected); | |
60 } | |
61 include relative_fields_parsing | |
62 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
63 include cpuid_actions | |
64 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
65 | |
66 action last_byte_is_not_immediate { | |
67 instruction_info_collected |= LAST_BYTE_IS_NOT_IMMEDIATE; | |
68 } | |
69 | |
70 include decode_x86_32 "validator_x86_32_instruction.rl"; | |
71 | |
72 special_instruction = | |
73 (0x83 0xe0 0xe0 0xff (0xd0|0xe0) | # naclcall/jmp %eax | |
74 0x83 0xe1 0xe0 0xff (0xd1|0xe1) | # naclcall/jmp %ecx | |
75 0x83 0xe2 0xe0 0xff (0xd2|0xe2) | # naclcall/jmp %edx | |
76 0x83 0xe3 0xe0 0xff (0xd3|0xe3) | # naclcall/jmp %ebx | |
77 0x83 0xe4 0xe0 0xff (0xd4|0xe4) | # naclcall/jmp %esp | |
78 0x83 0xe5 0xe0 0xff (0xd5|0xe5) | # naclcall/jmp %ebp | |
79 0x83 0xe6 0xe0 0xff (0xd6|0xe6) | # naclcall/jmp %esi | |
80 0x83 0xe7 0xe0 0xff (0xd7|0xe7)) # naclcall/jmp %edi | |
81 @{ | |
82 BitmapClearBit(valid_targets, (current_position - data) - 1); | |
83 instruction_start -= 3; | |
84 instruction_info_collected |= SPECIAL_INSTRUCTION; | |
85 } | | |
86 (0x65 0xa1 (0x00|0x04) 0x00 0x00 0x00 | # mov %gs:0x0/0x4,%eax | |
87 0x65 0x8b (0x05|0x0d|0x015|0x1d|0x25|0x2d|0x35|0x3d) | |
88 (0x00|0x04) 0x00 0x00 0x00); # mov %gs:0x0/0x4,%reg | |
89 | |
90 # Check if call is properly aligned | |
91 call_alignment = | |
92 ((one_instruction & | |
93 # Direct call | |
94 ((data16 0xe8 rel16) | | |
95 (0xe8 rel32))) | | |
96 (special_instruction & | |
97 # Indirect call | |
98 (any* data16? 0xff ((opcode_2 | opcode_3) any* & | |
99 (modrm_memory | modrm_registers))))) | |
100 @{ | |
101 if (((current_position - data) & kBundleMask) != kBundleMask) | |
102 instruction_info_collected |= BAD_CALL_ALIGNMENT; | |
103 }; | |
104 | |
105 main := ((call_alignment | one_instruction | special_instruction) | |
106 >{ | |
107 BitmapSetBit(valid_targets, current_position - data); | |
108 } | |
109 @{ | |
110 if ((instruction_info_collected & VALIDATION_ERRORS_MASK) || | |
111 (options & CALL_USER_CALLBACK_ON_EACH_INSTRUCTION)) { | |
112 result &= user_callback(instruction_start, current_position, | |
113 instruction_info_collected, callback_data); | |
114 } | |
115 /* On successful match the instruction start must point to the next byte | |
116 * to be able to report the new offset as the start of instruction | |
117 * causing error. */ | |
118 instruction_start = current_position + 1; | |
119 instruction_info_collected = 0; | |
120 })* | |
121 $err{ | |
122 result &= user_callback(instruction_start, current_position, | |
123 UNRECOGNIZED_INSTRUCTION, callback_data); | |
124 continue; | |
125 }; | |
126 | |
127 }%% | |
128 | |
129 %% write data; | |
130 | |
131 | |
132 Bool ValidateChunkIA32(const uint8_t *data, size_t size, | |
133 enum ValidationOptions options, | |
134 const NaClCPUFeaturesX86 *cpu_features, | |
135 ValidationCallbackFunc user_callback, | |
136 void *callback_data) { | |
137 bitmap_word valid_targets_small; | |
138 bitmap_word jump_dests_small; | |
139 bitmap_word *valid_targets; | |
140 bitmap_word *jump_dests; | |
141 const uint8_t *current_position; | |
142 const uint8_t *end_of_bundle; | |
143 int result = TRUE; | |
144 | |
145 CHECK(sizeof valid_targets_small == sizeof jump_dests_small); | |
146 CHECK(size % kBundleSize == 0); | |
147 | |
148 /* For a very small sequence (one bundle) malloc is too expensive. */ | |
149 if (size <= sizeof valid_targets_small) { | |
150 valid_targets_small = 0; | |
151 valid_targets = &valid_targets_small; | |
152 jump_dests_small = 0; | |
153 jump_dests = &jump_dests_small; | |
154 } else { | |
155 valid_targets = BitmapAllocate(size); | |
156 jump_dests = BitmapAllocate(size); | |
157 if (!valid_targets || !jump_dests) { | |
158 free(jump_dests); | |
159 free(valid_targets); | |
160 errno = ENOMEM; | |
161 return FALSE; | |
162 } | |
163 } | |
164 | |
165 if (options & PROCESS_CHUNK_AS_A_CONTIGUOUS_STREAM) | |
166 end_of_bundle = data + size; | |
167 else | |
168 end_of_bundle = data + kBundleSize; | |
169 | |
170 for (current_position = data; | |
171 current_position < data + size; | |
172 current_position = end_of_bundle, | |
173 end_of_bundle = current_position + kBundleSize) { | |
174 /* Start of the instruction being processed. */ | |
175 const uint8_t *instruction_start = current_position; | |
176 uint32_t instruction_info_collected = 0; | |
177 int current_state; | |
178 | |
179 %% write init; | |
180 %% write exec; | |
181 } | |
182 | |
183 result &= ProcessInvalidJumpTargets(data, size, valid_targets, jump_dests, | |
184 user_callback, callback_data); | |
185 | |
186 /* We only use malloc for a large code sequences */ | |
187 if (size > sizeof valid_targets_small) { | |
188 free(jump_dests); | |
189 free(valid_targets); | |
190 } | |
191 if (!result) errno = EINVAL; | |
192 return result; | |
193 } | |
OLD | NEW |