| OLD | NEW |
| (Empty) |
| 1 This directory contains the code for the native client register based | |
| 2 (R15) solution for x86-64 validation. R15 is used to convert 32-bit | |
| 3 addresses to the corresponding 64-bit address for memory accesses. | |
| 4 | |
| 5 Note: Although the current builds generate 32-bit versions, they do | |
| 6 not make any sense, since pointers are 32-bits in x86-32. | |
| 7 | |
| 8 | |
| 9 nc_cpu_checks.{c,h} | |
| 10 | |
| 11 Defines code that checks if the CPUID allows each | |
| 12 instruction. If not, it replaces the instruction with HALTs | |
| 13 during validation. | |
| 14 | |
| 15 nc_illegal.{c,h} | |
| 16 | |
| 17 Defines code that checks each instruction to see if it meets | |
| 18 basic requirements for native client. This includes the | |
| 19 following checks: | |
| 20 | |
| 21 - More than one (non-REX) prefix byte is not specified (we do | |
| 22 allow lock (f0) and DATA 16 (66) prefixes if the instruction | |
| 23 has been specified to accept both). | |
| 24 | |
| 25 - The instruction has not been marked as illegal (see "Modeled | |
| 26 Instructions" below). | |
| 27 | |
| 28 - The prefix/opcode sequence of the instruction has not been | |
| 29 marked as invalid (see "Modeled Instructions" below). | |
| 30 | |
| 31 - The is not marked as a system instruction (see "Modeled | |
| 32 Instructions" below). | |
| 33 | |
| 34 - Segment prefixes (except those used for jump prediction on | |
| 35 conditional jumps) are not allowed. | |
| 36 | |
| 37 - The ADDR 16 (67) prefix has been used for the instruction, | |
| 38 but native client doesn't allow it (see "Modeled | |
| 39 Instructions" below). | |
| 40 | |
| 41 - No more than one REX prefix has been specified for the | |
| 42 instruction. | |
| 43 | |
| 44 - The REP (f3) prefix is not allowed for the instruction (see | |
| 45 "Modeled Instructions" below). | |
| 46 | |
| 47 - The REPNE (f2) prefix is not allowed for the instruction | |
| 48 (see "Modeled Instructions" below). | |
| 49 | |
| 50 - The DATA 16 (66) prefix is not allowed for the instruction | |
| 51 (see "Modeled Instructions" below). | |
| 52 | |
| 53 - A prefix byte was not duplicated (we allow 66 to be | |
| 54 duplicated for special cases of the NOP instructions that | |
| 55 are commonly generated by compilers, see "Modeled | |
| 56 Instructions" for more information on these hard-coded | |
| 57 cases). | |
| 58 | |
| 59 - Multiple, ambigious segment prefixes are not allowed for an | |
| 60 instruction. | |
| 61 | |
| 62 - The REX prefix does not appear last in the sequence of | |
| 63 prefixes. | |
| 64 | |
| 65 nc_jumps.{c,h} | |
| 66 | |
| 67 Defines code to check jump instructions. In general, explicit | |
| 68 jumps must jump to an instruction in the same segment if it is | |
| 69 explicitly specified using a constant. All other jumps should | |
| 70 be indirect and use a pre-approved pattern that adds R15 to a | |
| 71 corresponding 32-bit address. | |
| 72 | |
| 73 nc_memory_protect.{c,h} | |
| 74 | |
| 75 Checks that memory references use an appropriate pattern that | |
| 76 converts a 32-bit data address (using R15) to a corresponding | |
| 77 64-bit memory reference. | |
| 78 | |
| 79 nc_opcode_histogram.{c,h} | |
| 80 | |
| 81 Simple histogram tracker of the frequency that each opcode is | |
| 82 used. Not needed to validate but provides useful test | |
| 83 information. | |
| 84 | |
| 85 nc_protect_base.{c,h} | |
| 86 | |
| 87 Checks that the instruction doesn't improperly modify one of | |
| 88 the base registers RSP, RBP, and R15. Also checks LEA | |
| 89 instructions to see if they calculate an address of the form | |
| 90 | |
| 91 [%reg+R15*1] | |
| 92 | |
| 93 and put the results into an appropriate 32-bit register. | |
| 94 | |
| 95 ncvalidate_iter.c | |
| 96 | |
| 97 Defines an iterator that iterates over the instructions in a | |
| 98 memory segment. Keeps track of the previous 2 instructions | |
| 99 during this iteration so that one can check multiple | |
| 100 instruction patterns. It also define | |
| 101 | |
| 102 ncvalidate_iter.h | |
| 103 | |
| 104 Defines the API to the iterator defined in ncvalidate_iter.c. | |
| 105 | |
| 106 ncvalidate_iter_internal.h | |
| 107 | |
| 108 Defines internal methods and data structures used to implement | |
| 109 the iterator defined in ncvalidate_iter.c | |
| 110 | |
| 111 ncvalidate_iter_verbose.c | |
| 112 | |
| 113 Defines a verbose error reporter that works for the | |
| 114 instructions iterated over using the API methods in | |
| 115 ncvalidate_iter.h | |
| 116 | |
| 117 ncvalidate_utils.{c,h} | |
| 118 | |
| 119 Defines various common checking routines for instructions. | |
| 120 | |
| 121 ncvalidate_registry.{c,h} | |
| 122 | |
| 123 Defines a registry of validator checking methods, that get | |
| 124 applied to validate instruction. | |
| 125 | |
| 126 Modeled Instructions | |
| 127 -------------------- | |
| 128 | |
| 129 Textual version(s) of the instructions understood by the validator can | |
| 130 be found in the following files. | |
| 131 | |
| 132 native_client/src/trusted/validator_x86/testdata/64/modeled_insts.txt | |
| 133 | |
| 134 Defines the set of instructions understood by the (full) | |
| 135 decoder. This is the most human readable form of the generated | |
| 136 decoder tables used by the validator. | |
| 137 | |
| 138 native_client/src/trusted/validator_x86/testdata/64/ncval_reg_sfi_modeled_ins
ts.txt | |
| 139 | |
| 140 Defines the set of (partial) isntructions understood by the | |
| 141 validator decoder. This file is the same as modeled_insts.txt | |
| 142 above except that it shows how the modeled instructions have | |
| 143 been simplified, based on the needs of the validator in this | |
| 144 directory. In particular, most instruction mnemonics are | |
| 145 simplified to a "don't care" name since the mnemonic name is not | |
| 146 needed by the validator. In addition, most implicit arguments of | |
| 147 the instruction are made explicit, and arguments that can't be | |
| 148 used to compute memory addresses have been removed. | |
| 149 | |
| 150 For more information on the contents of these files, see | |
| 151 | |
| 152 native_client/src/trusted/validator/x86/decoder/README | |
| 153 | |
| 154 Pre/Post condition testing | |
| 155 -------------------------- | |
| 156 | |
| 157 The code in this directory is set up to allow instructions to be | |
| 158 validated individually. When run in this mode, pre/post conditions | |
| 159 are generated rather than looking accross instructions to verify the | |
| 160 conditions. This is intentional, and is intended for testing multiple | |
| 161 validators. In such contexts, the pre/post conditions define what must | |
| 162 be checked by a compatible validator. | |
| 163 | |
| 164 To generate these condition tests, one must compile the source using | |
| 165 the scons command: | |
| 166 | |
| 167 .> ./scons --mode=opt-linux platform=x86-64 ncval_testing=1 | |
| 168 | |
| 169 Note: --mode=opt-linux is not necessary. Any applicable mode will | |
| 170 work. | |
| 171 | |
| 172 When native_client/src/trusted/validator_x86/ncval.c is compiled with | |
| 173 the above scons command, the corresponding executable will generate | |
| 174 pre/post conditions. | |
| 175 | |
| 176 Code to generate pre/post conditions is conditionalized in the source | |
| 177 (under '#ifdef NCVAL_TESTING') so that it is only added when scons | |
| 178 option ncval_testing=1 is defined. | |
| 179 | |
| 180 The default error reportor is used by the validator. This is done so | |
| 181 that only pre/post conditions will be printed. Hence, if you are to | |
| 182 add debugging code within NCVAL_TESTING, be sure to not redirect the | |
| 183 output to the validator's error reporter. Rather, redirect using calls | |
| 184 to NaClLog or printf. To override this presumption and see other | |
| 185 debugging messages, change the line | |
| 186 | |
| 187 #define DEBUGGING 0 | |
| 188 | |
| 189 in native_client/src/trusted/validator_x86/ncval.c to be | |
| 190 | |
| 191 #define DEBUGGING 1 | |
| 192 | |
| 193 This will cause the validator to use the verbose error reporter within | |
| 194 ncval. | |
| 195 | |
| 196 To run unit tests for the pre/post conditions, run the following scons | |
| 197 build command: | |
| 198 | |
| 199 .> ./scons --mode=opt-linux platform=x86-64 ncval_testing=1 \ | |
| 200 ncval_testing | |
| 201 | |
| 202 Note: To see how to test scons builds with ncval_testing=1, see | |
| 203 native_client/src/trusted/validator_x86/build.scons and look for the | |
| 204 text 'test_env.Bit('ncval_testing')'. | |
| 205 | |
| 206 Debugging | |
| 207 --------- | |
| 208 | |
| 209 Many of the source files contain #define DEBUGGING flags. When | |
| 210 DEBUGGING is set to 1, additional debugging print messages are | |
| 211 compiled into the code. Unfortunately, by default, these message | |
| 212 frequently call routines that are not compiled into corresponding | |
| 213 executables (such as ncval and ncdis). To add the additional routines, | |
| 214 edit file | |
| 215 | |
| 216 native_client/site_scons/site_tools/library_deps.py | |
| 217 | |
| 218 For x86-32, edit lines | |
| 219 | |
| 220 # When turning on the DEBUGGING flag in the x86-32 validator | |
| 221 # or decoder, add the following: | |
| 222 #'nc_opcode_modeling_verbose_x86_32', | |
| 223 | |
| 224 to | |
| 225 | |
| 226 # When turning on the DEBUGGING flag in the x86-32 validator | |
| 227 # or decoder, add the following: | |
| 228 'nc_opcode_modeling_verbose_x86_32', | |
| 229 | |
| 230 For x86-64, edit lines | |
| 231 | |
| 232 # When turning on the DEBUGGING flag in the x86-64 validator | |
| 233 # or decoder, add the following: | |
| 234 # 'nc_opcode_modeling_verbose_x86_64', | |
| 235 | |
| 236 to | |
| 237 | |
| 238 # When turning on the DEBUGGING flag in the x86-64 validator | |
| 239 # or decoder, add the following: | |
| 240 'nc_opcode_modeling_verbose_x86_64', | |
| 241 | |
| 242 These changes will make sure that the corresponding print routines are | |
| 243 added to the executables during link time. | |
| OLD | NEW |