OLD | NEW |
1 /* | 1 /* |
2 * Copyright (c) 2012 The Native Client Authors. All rights reserved. | 2 * Copyright (c) 2012 The Native Client Authors. All rights reserved. |
3 * Use of this source code is governed by a BSD-style license that can be | 3 * Use of this source code is governed by a BSD-style license that can be |
4 * found in the LICENSE file. | 4 * found in the LICENSE file. |
5 */ | 5 */ |
6 | 6 |
7 #include <assert.h> | 7 #include <assert.h> |
8 #include <errno.h> | 8 #include <errno.h> |
9 #include <stddef.h> | 9 #include <stddef.h> |
10 #include <stdio.h> | 10 #include <stdio.h> |
11 #include <stdlib.h> | 11 #include <stdlib.h> |
12 #include <string.h> | 12 #include <string.h> |
13 | 13 |
14 #include "native_client/src/trusted/validator_ragel/unreviewed/validator_interna
l.h" | 14 #include "native_client/src/trusted/validator_ragel/validator_internal.h" |
15 | 15 |
16 /* Ignore this information: it's not used by security model in IA32 mode. */ | 16 /* Ignore this information: it's not used by security model in IA32 mode. */ |
17 #undef GET_VEX_PREFIX3 | 17 #undef GET_VEX_PREFIX3 |
18 #define GET_VEX_PREFIX3 0 | 18 #define GET_VEX_PREFIX3 0 |
19 #undef SET_VEX_PREFIX3 | 19 #undef SET_VEX_PREFIX3 |
20 #define SET_VEX_PREFIX3(P) | 20 #define SET_VEX_PREFIX3(P) |
21 | 21 |
22 %%{ | 22 %%{ |
23 machine x86_32_validator; | 23 machine x86_32_validator; |
24 alphtype unsigned char; | 24 alphtype unsigned char; |
(...skipping 47 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
72 special_instruction = | 72 special_instruction = |
73 (0x83 0xe0 0xe0 0xff (0xd0|0xe0) | # naclcall/jmp %eax | 73 (0x83 0xe0 0xe0 0xff (0xd0|0xe0) | # naclcall/jmp %eax |
74 0x83 0xe1 0xe0 0xff (0xd1|0xe1) | # naclcall/jmp %ecx | 74 0x83 0xe1 0xe0 0xff (0xd1|0xe1) | # naclcall/jmp %ecx |
75 0x83 0xe2 0xe0 0xff (0xd2|0xe2) | # naclcall/jmp %edx | 75 0x83 0xe2 0xe0 0xff (0xd2|0xe2) | # naclcall/jmp %edx |
76 0x83 0xe3 0xe0 0xff (0xd3|0xe3) | # naclcall/jmp %ebx | 76 0x83 0xe3 0xe0 0xff (0xd3|0xe3) | # naclcall/jmp %ebx |
77 0x83 0xe4 0xe0 0xff (0xd4|0xe4) | # naclcall/jmp %esp | 77 0x83 0xe4 0xe0 0xff (0xd4|0xe4) | # naclcall/jmp %esp |
78 0x83 0xe5 0xe0 0xff (0xd5|0xe5) | # naclcall/jmp %ebp | 78 0x83 0xe5 0xe0 0xff (0xd5|0xe5) | # naclcall/jmp %ebp |
79 0x83 0xe6 0xe0 0xff (0xd6|0xe6) | # naclcall/jmp %esi | 79 0x83 0xe6 0xe0 0xff (0xd6|0xe6) | # naclcall/jmp %esi |
80 0x83 0xe7 0xe0 0xff (0xd7|0xe7)) # naclcall/jmp %edi | 80 0x83 0xe7 0xe0 0xff (0xd7|0xe7)) # naclcall/jmp %edi |
81 @{ | 81 @{ |
82 BitmapClearBit(valid_targets, (current_position - data) - 1); | 82 MakeJumpTargetInvalid((current_position - data) - 1, valid_targets); |
83 instruction_start -= 3; | 83 instruction_start -= 3; |
84 instruction_info_collected |= SPECIAL_INSTRUCTION; | 84 instruction_info_collected |= SPECIAL_INSTRUCTION; |
85 } | | 85 } | |
86 (0x65 0xa1 (0x00|0x04) 0x00 0x00 0x00 | # mov %gs:0x0/0x4,%eax | 86 (0x65 0xa1 (0x00|0x04) 0x00 0x00 0x00 | # mov %gs:0x0/0x4,%eax |
87 0x65 0x8b (0x05|0x0d|0x015|0x1d|0x25|0x2d|0x35|0x3d) | 87 0x65 0x8b (0x05|0x0d|0x015|0x1d|0x25|0x2d|0x35|0x3d) |
88 (0x00|0x04) 0x00 0x00 0x00); # mov %gs:0x0/0x4,%reg | 88 (0x00|0x04) 0x00 0x00 0x00); # mov %gs:0x0/0x4,%reg |
89 | 89 |
90 # Check if call is properly aligned | 90 # Check if call is properly aligned |
91 call_alignment = | 91 call_alignment = |
92 ((one_instruction & | 92 ((one_instruction & |
93 # Direct call | 93 # Direct call |
94 ((data16 0xe8 rel16) | | 94 ((data16 0xe8 rel16) | |
95 (0xe8 rel32))) | | 95 (0xe8 rel32))) | |
96 (special_instruction & | 96 (special_instruction & |
97 # Indirect call | 97 # Indirect call |
98 (any* data16? 0xff ((opcode_2 | opcode_3) any* & | 98 (any* data16? 0xff ((opcode_2 | opcode_3) any* & |
99 (modrm_memory | modrm_registers))))) | 99 (modrm_memory | modrm_registers))))) |
100 @{ | 100 @{ |
101 if (((current_position - data) & kBundleMask) != kBundleMask) | 101 if (((current_position - data) & kBundleMask) != kBundleMask) |
102 instruction_info_collected |= BAD_CALL_ALIGNMENT; | 102 instruction_info_collected |= BAD_CALL_ALIGNMENT; |
103 }; | 103 }; |
104 | 104 |
105 main := ((call_alignment | one_instruction | special_instruction) | 105 main := ((call_alignment | one_instruction | special_instruction) |
106 >{ | 106 >{ |
107 BitmapSetBit(valid_targets, current_position - data); | 107 MakeJumpTargetValid(current_position - data, valid_targets); |
108 } | 108 } |
109 @{ | 109 @{ |
110 if ((instruction_info_collected & | 110 if ((instruction_info_collected & |
111 (VALIDATION_ERRORS_MASK | BAD_CALL_ALIGNMENT)) || | 111 (VALIDATION_ERRORS_MASK | BAD_CALL_ALIGNMENT)) || |
112 (options & CALL_USER_CALLBACK_ON_EACH_INSTRUCTION)) { | 112 (options & CALL_USER_CALLBACK_ON_EACH_INSTRUCTION)) { |
113 result &= user_callback(instruction_start, current_position, | 113 result &= user_callback(instruction_start, current_position, |
114 instruction_info_collected, callback_data); | 114 instruction_info_collected, callback_data); |
115 } | 115 } |
116 /* On successful match the instruction start must point to the next byte | 116 /* On successful match the instruction start must point to the next byte |
117 * to be able to report the new offset as the start of instruction | 117 * to be able to report the new offset as the start of instruction |
118 * causing error. */ | 118 * causing error. */ |
119 instruction_start = current_position + 1; | 119 instruction_start = current_position + 1; |
120 instruction_info_collected = 0; | 120 instruction_info_collected = 0; |
121 })* | 121 })* |
122 $err{ | 122 $err{ |
123 result &= user_callback(instruction_start, current_position, | 123 result &= user_callback(instruction_start, current_position, |
124 UNRECOGNIZED_INSTRUCTION, callback_data); | 124 UNRECOGNIZED_INSTRUCTION, callback_data); |
125 continue; | 125 continue; |
126 }; | 126 }; |
127 | 127 |
128 }%% | 128 }%% |
129 | 129 |
130 %% write data; | 130 %% write data; |
131 | 131 |
132 | 132 |
133 Bool ValidateChunkIA32(const uint8_t *data, size_t size, | 133 Bool ValidateChunkIA32(const uint8_t *data, size_t size, |
134 enum validation_options options, | 134 enum validation_options options, |
135 const NaClCPUFeaturesX86 *cpu_features, | 135 const NaClCPUFeaturesX86 *cpu_features, |
136 validation_callback_func user_callback, | 136 ValidationCallbackFunc user_callback, |
137 void *callback_data) { | 137 void *callback_data) { |
138 bitmap_word valid_targets_small; | 138 bitmap_word valid_targets_small; |
139 bitmap_word jump_dests_small; | 139 bitmap_word jump_dests_small; |
140 bitmap_word *valid_targets; | 140 bitmap_word *valid_targets; |
141 bitmap_word *jump_dests; | 141 bitmap_word *jump_dests; |
142 const uint8_t *current_position; | 142 const uint8_t *current_position; |
143 const uint8_t *end_of_bundle; | 143 const uint8_t *end_of_bundle; |
144 int result = TRUE; | 144 int result = TRUE; |
145 | 145 |
146 CHECK(sizeof valid_targets_small == sizeof jump_dests_small); | 146 CHECK(sizeof valid_targets_small == sizeof jump_dests_small); |
(...skipping 38 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
185 user_callback, callback_data); | 185 user_callback, callback_data); |
186 | 186 |
187 /* We only use malloc for a large code sequences */ | 187 /* We only use malloc for a large code sequences */ |
188 if (size > sizeof valid_targets_small) { | 188 if (size > sizeof valid_targets_small) { |
189 free(jump_dests); | 189 free(jump_dests); |
190 free(valid_targets); | 190 free(valid_targets); |
191 } | 191 } |
192 if (!result) errno = EINVAL; | 192 if (!result) errno = EINVAL; |
193 return result; | 193 return result; |
194 } | 194 } |
OLD | NEW |