| OLD | NEW |
| (Empty) |
| 1 /* | |
| 2 * Copyright (c) 2012 The Native Client Authors. All rights reserved. | |
| 3 * Use of this source code is governed by a BSD-style license that can be | |
| 4 * found in the LICENSE file. | |
| 5 */ | |
| 6 | |
| 7 #include <assert.h> | |
| 8 #include <errno.h> | |
| 9 #include <stddef.h> | |
| 10 #include <stdio.h> | |
| 11 #include <stdlib.h> | |
| 12 #include <string.h> | |
| 13 | |
| 14 #include "native_client/src/trusted/validator_ragel/unreviewed/validator_interna
l.h" | |
| 15 | |
| 16 /* Ignore this information: it's not used by security model in IA32 mode. */ | |
| 17 #undef GET_VEX_PREFIX3 | |
| 18 #define GET_VEX_PREFIX3 0 | |
| 19 #undef SET_VEX_PREFIX3 | |
| 20 #define SET_VEX_PREFIX3(P) | |
| 21 | |
| 22 %%{ | |
| 23 machine x86_32_validator; | |
| 24 alphtype unsigned char; | |
| 25 variable p current_position; | |
| 26 variable pe end_of_bundle; | |
| 27 variable eof end_of_bundle; | |
| 28 variable cs current_state; | |
| 29 | |
| 30 include byte_machine "byte_machines.rl"; | |
| 31 | |
| 32 include prefix_actions | |
| 33 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
| 34 include prefixes_parsing | |
| 35 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
| 36 include vex_actions_ia32 | |
| 37 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
| 38 include vex_parsing_ia32 | |
| 39 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
| 40 include displacement_fields_actions | |
| 41 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
| 42 include displacement_fields_parsing | |
| 43 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
| 44 include modrm_parsing_ia32_noactions | |
| 45 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
| 46 include immediate_fields_actions | |
| 47 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
| 48 include immediate_fields_parsing_ia32 | |
| 49 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
| 50 action rel8_operand { | |
| 51 rel8_operand(current_position + 1, data, jump_dests, size, | |
| 52 &instruction_info_collected); | |
| 53 } | |
| 54 action rel16_operand { | |
| 55 #error rel16_operand should never be used in nacl | |
| 56 } | |
| 57 action rel32_operand { | |
| 58 rel32_operand(current_position + 1, data, jump_dests, size, | |
| 59 &instruction_info_collected); | |
| 60 } | |
| 61 include relative_fields_parsing | |
| 62 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
| 63 include cpuid_actions | |
| 64 "native_client/src/trusted/validator_ragel/unreviewed/parse_instruction.rl"; | |
| 65 | |
| 66 action last_byte_is_not_immediate { | |
| 67 instruction_info_collected |= LAST_BYTE_IS_NOT_IMMEDIATE; | |
| 68 } | |
| 69 | |
| 70 include decode_x86_32 "validator_x86_32_instruction.rl"; | |
| 71 | |
| 72 special_instruction = | |
| 73 (0x83 0xe0 0xe0 0xff (0xd0|0xe0) | # naclcall/jmp %eax | |
| 74 0x83 0xe1 0xe0 0xff (0xd1|0xe1) | # naclcall/jmp %ecx | |
| 75 0x83 0xe2 0xe0 0xff (0xd2|0xe2) | # naclcall/jmp %edx | |
| 76 0x83 0xe3 0xe0 0xff (0xd3|0xe3) | # naclcall/jmp %ebx | |
| 77 0x83 0xe4 0xe0 0xff (0xd4|0xe4) | # naclcall/jmp %esp | |
| 78 0x83 0xe5 0xe0 0xff (0xd5|0xe5) | # naclcall/jmp %ebp | |
| 79 0x83 0xe6 0xe0 0xff (0xd6|0xe6) | # naclcall/jmp %esi | |
| 80 0x83 0xe7 0xe0 0xff (0xd7|0xe7)) # naclcall/jmp %edi | |
| 81 @{ | |
| 82 BitmapClearBit(valid_targets, (current_position - data) - 1); | |
| 83 instruction_start -= 3; | |
| 84 instruction_info_collected |= SPECIAL_INSTRUCTION; | |
| 85 } | | |
| 86 (0x65 0xa1 (0x00|0x04) 0x00 0x00 0x00 | # mov %gs:0x0/0x4,%eax | |
| 87 0x65 0x8b (0x05|0x0d|0x015|0x1d|0x25|0x2d|0x35|0x3d) | |
| 88 (0x00|0x04) 0x00 0x00 0x00); # mov %gs:0x0/0x4,%reg | |
| 89 | |
| 90 # Check if call is properly aligned | |
| 91 call_alignment = | |
| 92 ((one_instruction & | |
| 93 # Direct call | |
| 94 ((data16 0xe8 rel16) | | |
| 95 (0xe8 rel32))) | | |
| 96 (special_instruction & | |
| 97 # Indirect call | |
| 98 (any* data16? 0xff ((opcode_2 | opcode_3) any* & | |
| 99 (modrm_memory | modrm_registers))))) | |
| 100 @{ | |
| 101 if (((current_position - data) & kBundleMask) != kBundleMask) | |
| 102 instruction_info_collected |= BAD_CALL_ALIGNMENT; | |
| 103 }; | |
| 104 | |
| 105 main := ((call_alignment | one_instruction | special_instruction) | |
| 106 >{ | |
| 107 BitmapSetBit(valid_targets, current_position - data); | |
| 108 } | |
| 109 @{ | |
| 110 if ((instruction_info_collected & VALIDATION_ERRORS_MASK) || | |
| 111 (options & CALL_USER_CALLBACK_ON_EACH_INSTRUCTION)) { | |
| 112 result &= user_callback(instruction_start, current_position, | |
| 113 instruction_info_collected, callback_data); | |
| 114 } | |
| 115 /* On successful match the instruction start must point to the next byte | |
| 116 * to be able to report the new offset as the start of instruction | |
| 117 * causing error. */ | |
| 118 instruction_start = current_position + 1; | |
| 119 instruction_info_collected = 0; | |
| 120 })* | |
| 121 $err{ | |
| 122 result &= user_callback(instruction_start, current_position, | |
| 123 UNRECOGNIZED_INSTRUCTION, callback_data); | |
| 124 continue; | |
| 125 }; | |
| 126 | |
| 127 }%% | |
| 128 | |
| 129 %% write data; | |
| 130 | |
| 131 | |
| 132 Bool ValidateChunkIA32(const uint8_t *data, size_t size, | |
| 133 enum ValidationOptions options, | |
| 134 const NaClCPUFeaturesX86 *cpu_features, | |
| 135 ValidationCallbackFunc user_callback, | |
| 136 void *callback_data) { | |
| 137 bitmap_word valid_targets_small; | |
| 138 bitmap_word jump_dests_small; | |
| 139 bitmap_word *valid_targets; | |
| 140 bitmap_word *jump_dests; | |
| 141 const uint8_t *current_position; | |
| 142 const uint8_t *end_of_bundle; | |
| 143 int result = TRUE; | |
| 144 | |
| 145 CHECK(sizeof valid_targets_small == sizeof jump_dests_small); | |
| 146 CHECK(size % kBundleSize == 0); | |
| 147 | |
| 148 /* For a very small sequence (one bundle) malloc is too expensive. */ | |
| 149 if (size <= sizeof valid_targets_small) { | |
| 150 valid_targets_small = 0; | |
| 151 valid_targets = &valid_targets_small; | |
| 152 jump_dests_small = 0; | |
| 153 jump_dests = &jump_dests_small; | |
| 154 } else { | |
| 155 valid_targets = BitmapAllocate(size); | |
| 156 jump_dests = BitmapAllocate(size); | |
| 157 if (!valid_targets || !jump_dests) { | |
| 158 free(jump_dests); | |
| 159 free(valid_targets); | |
| 160 errno = ENOMEM; | |
| 161 return FALSE; | |
| 162 } | |
| 163 } | |
| 164 | |
| 165 if (options & PROCESS_CHUNK_AS_A_CONTIGUOUS_STREAM) | |
| 166 end_of_bundle = data + size; | |
| 167 else | |
| 168 end_of_bundle = data + kBundleSize; | |
| 169 | |
| 170 for (current_position = data; | |
| 171 current_position < data + size; | |
| 172 current_position = end_of_bundle, | |
| 173 end_of_bundle = current_position + kBundleSize) { | |
| 174 /* Start of the instruction being processed. */ | |
| 175 const uint8_t *instruction_start = current_position; | |
| 176 uint32_t instruction_info_collected = 0; | |
| 177 int current_state; | |
| 178 | |
| 179 %% write init; | |
| 180 %% write exec; | |
| 181 } | |
| 182 | |
| 183 result &= ProcessInvalidJumpTargets(data, size, valid_targets, jump_dests, | |
| 184 user_callback, callback_data); | |
| 185 | |
| 186 /* We only use malloc for a large code sequences */ | |
| 187 if (size > sizeof valid_targets_small) { | |
| 188 free(jump_dests); | |
| 189 free(valid_targets); | |
| 190 } | |
| 191 if (!result) errno = EINVAL; | |
| 192 return result; | |
| 193 } | |
| OLD | NEW |