Index: src/trusted/validator_ragel/unreviewed/validator_x86_32.rl |
=================================================================== |
--- src/trusted/validator_ragel/unreviewed/validator_x86_32.rl (revision 9911) |
+++ src/trusted/validator_ragel/unreviewed/validator_x86_32.rl (working copy) |
@@ -1,194 +0,0 @@ |
-/* |
- * Copyright (c) 2012 The Native Client Authors. All rights reserved. |
- * Use of this source code is governed by a BSD-style license that can be |
- * found in the LICENSE file. |
- */ |
- |
-#include <assert.h> |
-#include <errno.h> |
-#include <stddef.h> |
-#include <stdio.h> |
-#include <stdlib.h> |
-#include <string.h> |
- |
-#include "native_client/src/trusted/validator_ragel/unreviewed/validator_internal.h" |
- |
-/* Ignore this information: it's not used by security model in IA32 mode. */ |
-#undef GET_VEX_PREFIX3 |
-#define GET_VEX_PREFIX3 0 |
-#undef SET_VEX_PREFIX3 |
-#define SET_VEX_PREFIX3(P) |
- |
-%%{ |
- machine x86_32_validator; |
- alphtype unsigned char; |
- variable p current_position; |
- variable pe end_of_bundle; |
- variable eof end_of_bundle; |
- variable cs current_state; |
- |
- include byte_machine "byte_machines.rl"; |
- |
- include prefix_actions |
- "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; |
- include prefixes_parsing |
- "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; |
- include vex_actions_ia32 |
- "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; |
- include vex_parsing_ia32 |
- "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; |
- include displacement_fields_actions |
- "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; |
- include displacement_fields_parsing |
- "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; |
- include modrm_parsing_ia32_noactions |
- "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; |
- include immediate_fields_actions |
- "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; |
- include immediate_fields_parsing_ia32 |
- "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; |
- action rel8_operand { |
- rel8_operand(current_position + 1, data, jump_dests, size, |
- &instruction_info_collected); |
- } |
- action rel16_operand { |
- #error rel16_operand should never be used in nacl |
- } |
- action rel32_operand { |
- rel32_operand(current_position + 1, data, jump_dests, size, |
- &instruction_info_collected); |
- } |
- include relative_fields_parsing |
- "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; |
- include cpuid_actions |
- "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; |
- |
- action last_byte_is_not_immediate { |
- instruction_info_collected |= LAST_BYTE_IS_NOT_IMMEDIATE; |
- } |
- |
- include decode_x86_32 "validator_x86_32_instruction.rl"; |
- |
- special_instruction = |
- (0x83 0xe0 0xe0 0xff (0xd0|0xe0) | # naclcall/jmp %eax |
- 0x83 0xe1 0xe0 0xff (0xd1|0xe1) | # naclcall/jmp %ecx |
- 0x83 0xe2 0xe0 0xff (0xd2|0xe2) | # naclcall/jmp %edx |
- 0x83 0xe3 0xe0 0xff (0xd3|0xe3) | # naclcall/jmp %ebx |
- 0x83 0xe4 0xe0 0xff (0xd4|0xe4) | # naclcall/jmp %esp |
- 0x83 0xe5 0xe0 0xff (0xd5|0xe5) | # naclcall/jmp %ebp |
- 0x83 0xe6 0xe0 0xff (0xd6|0xe6) | # naclcall/jmp %esi |
- 0x83 0xe7 0xe0 0xff (0xd7|0xe7)) # naclcall/jmp %edi |
- @{ |
- BitmapClearBit(valid_targets, (current_position - data) - 1); |
- instruction_start -= 3; |
- instruction_info_collected |= SPECIAL_INSTRUCTION; |
- } | |
- (0x65 0xa1 (0x00|0x04) 0x00 0x00 0x00 | # mov %gs:0x0/0x4,%eax |
- 0x65 0x8b (0x05|0x0d|0x015|0x1d|0x25|0x2d|0x35|0x3d) |
- (0x00|0x04) 0x00 0x00 0x00); # mov %gs:0x0/0x4,%reg |
- |
- # Check if call is properly aligned |
- call_alignment = |
- ((one_instruction & |
- # Direct call |
- ((data16 0xe8 rel16) | |
- (0xe8 rel32))) | |
- (special_instruction & |
- # Indirect call |
- (any* data16? 0xff ((opcode_2 | opcode_3) any* & |
- (modrm_memory | modrm_registers))))) |
- @{ |
- if (((current_position - data) & kBundleMask) != kBundleMask) |
- instruction_info_collected |= BAD_CALL_ALIGNMENT; |
- }; |
- |
- main := ((call_alignment | one_instruction | special_instruction) |
- >{ |
- BitmapSetBit(valid_targets, current_position - data); |
- } |
- @{ |
- if ((instruction_info_collected & |
- (VALIDATION_ERRORS_MASK | BAD_CALL_ALIGNMENT)) || |
- (options & CALL_USER_CALLBACK_ON_EACH_INSTRUCTION)) { |
- result &= user_callback(instruction_start, current_position, |
- instruction_info_collected, callback_data); |
- } |
- /* On successful match the instruction start must point to the next byte |
- * to be able to report the new offset as the start of instruction |
- * causing error. */ |
- instruction_start = current_position + 1; |
- instruction_info_collected = 0; |
- })* |
- $err{ |
- result &= user_callback(instruction_start, current_position, |
- UNRECOGNIZED_INSTRUCTION, callback_data); |
- continue; |
- }; |
- |
-}%% |
- |
-%% write data; |
- |
- |
-Bool ValidateChunkIA32(const uint8_t *data, size_t size, |
- enum validation_options options, |
- const NaClCPUFeaturesX86 *cpu_features, |
- validation_callback_func user_callback, |
- void *callback_data) { |
- bitmap_word valid_targets_small; |
- bitmap_word jump_dests_small; |
- bitmap_word *valid_targets; |
- bitmap_word *jump_dests; |
- const uint8_t *current_position; |
- const uint8_t *end_of_bundle; |
- int result = TRUE; |
- |
- CHECK(sizeof valid_targets_small == sizeof jump_dests_small); |
- CHECK(size % kBundleSize == 0); |
- |
- /* For a very small sequence (one bundle) malloc is too expensive. */ |
- if (size <= sizeof valid_targets_small) { |
- valid_targets_small = 0; |
- valid_targets = &valid_targets_small; |
- jump_dests_small = 0; |
- jump_dests = &jump_dests_small; |
- } else { |
- valid_targets = BitmapAllocate(size); |
- jump_dests = BitmapAllocate(size); |
- if (!valid_targets || !jump_dests) { |
- free(jump_dests); |
- free(valid_targets); |
- errno = ENOMEM; |
- return FALSE; |
- } |
- } |
- |
- if (options & PROCESS_CHUNK_AS_A_CONTIGUOUS_STREAM) |
- end_of_bundle = data + size; |
- else |
- end_of_bundle = data + kBundleSize; |
- |
- for (current_position = data; |
- current_position < data + size; |
- current_position = end_of_bundle, |
- end_of_bundle = current_position + kBundleSize) { |
- /* Start of the instruction being processed. */ |
- const uint8_t *instruction_start = current_position; |
- uint32_t instruction_info_collected = 0; |
- int current_state; |
- |
- %% write init; |
- %% write exec; |
- } |
- |
- result &= ProcessInvalidJumpTargets(data, size, valid_targets, jump_dests, |
- user_callback, callback_data); |
- |
- /* We only use malloc for a large code sequences */ |
- if (size > sizeof valid_targets_small) { |
- free(jump_dests); |
- free(valid_targets); |
- } |
- if (!result) errno = EINVAL; |
- return result; |
-} |