OLD | NEW |
| (Empty) |
1 /* | |
2 * Copyright (c) 2012 The Native Client Authors. All rights reserved. | |
3 * Use of this source code is governed by a BSD-style license that can be | |
4 * found in the LICENSE file. | |
5 */ | |
6 | |
7 /* | |
8 * ncval_tests.c - simple unit tests for NaCl validator | |
9 */ | |
10 | |
11 #ifndef NACL_TRUSTED_BUT_NOT_TCB | |
12 #error("This file is not meant for use in the TCB") | |
13 #endif | |
14 | |
15 #include <assert.h> | |
16 #include <stdarg.h> | |
17 #include <stdio.h> | |
18 #include <stdlib.h> | |
19 #include <string.h> | |
20 #include "native_client/src/include/nacl_macros.h" | |
21 #include "native_client/src/include/portability.h" | |
22 #include "native_client/src/shared/gio/gio.h" | |
23 #include "native_client/src/shared/platform/nacl_check.h" | |
24 #include "native_client/src/shared/platform/nacl_log.h" | |
25 #include "native_client/src/trusted/validator/x86/ncval_seg_sfi/ncdecode_verbose
.h" | |
26 #include "native_client/src/trusted/validator/x86/ncval_seg_sfi/ncvalidate.h" | |
27 #include "native_client/src/trusted/validator/x86/ncval_seg_sfi/ncvalidate_inter
naltypes.h" | |
28 | |
29 /* Define the set of CPU features to use while validating. */ | |
30 static NaClCPUFeaturesX86 g_ncval_cpu_features; | |
31 | |
32 void Info(const char *fmt, ...) | |
33 { | |
34 va_list ap; | |
35 fprintf(stdout, "I: "); | |
36 va_start(ap, fmt); | |
37 vfprintf(stdout, fmt, ap); | |
38 va_end(ap); | |
39 } | |
40 | |
41 struct NCValTestCase { | |
42 char *name; | |
43 char *description; | |
44 | |
45 /* Expected results: */ | |
46 int sawfailure; /* Whether code is expected to fail validation */ | |
47 uint32_t illegalinst; /* Expected number of disallowed instructions */ | |
48 uint32_t instructions; /* Expected number of instructions (excluding final HLT
) */ | |
49 | |
50 /* Input to validator: */ | |
51 uint32_t vaddr; /* Load address (shouldn't matter) */ | |
52 const char *data_as_hex; | |
53 }; | |
54 | |
55 struct NCValTestCase NCValTests[] = { | |
56 /* NOTE: Many of these tests are now in the textual testing structure in | |
57 * native_client/src/trusted/validator_x86/testdata/32 using | |
58 * files "test-n.hex", "test-n.ndis", "test-n.nvals", and | |
59 * "test-n.nvals16". | |
60 */ | |
61 { | |
62 "test 1", | |
63 "a first very simple test with an illegal inst.", | |
64 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
65 /* instructions= */ 9, | |
66 /* vaddr= */ 0x80000000, | |
67 "55 \n" /* push %ebp */ | |
68 "89 e5 \n" /* mov %esp,%ebp */ | |
69 "83 ec 08 \n" /* sub $0x8,%esp */ | |
70 "e8 81 00 00 00 \n" /* call 0x86 */ | |
71 "e8 d3 00 00 00 \n" /* call 0xd8 */ | |
72 "e8 f3 04 00 00 \n" /* call 0x4f8 */ | |
73 "c9 \n" /* leave */ | |
74 "c3 \n" /* ret */ | |
75 "00 00 f4 \n" | |
76 }, | |
77 { | |
78 "test 6", | |
79 "test 6: 3c 25 cmp %al, $I", | |
80 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
81 /* instructions= */ 7, | |
82 /* vaddr= */ 0x80000000, | |
83 "3c 25 \n" /* cmp $0x25,%al */ | |
84 "90 90 90 90 90 90 f4 \n" | |
85 }, | |
86 { | |
87 "test 7", | |
88 "test 7: group2, three byte move", | |
89 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
90 /* instructions= */ 8, | |
91 /* vaddr= */ 0x80000000, | |
92 "c1 f9 1f 89 4d e4 \n" | |
93 "90 90 90 90 90 90 f4 \n" | |
94 }, | |
95 { | |
96 "test 8", | |
97 "test 8: five byte move", | |
98 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
99 /* instructions= */ 7, | |
100 /* vaddr= */ 0x80000000, | |
101 "c6 44 05 d6 00 \n" /* movb $0x0,-0x2a(%ebp,%eax,1) */ | |
102 "90 90 90 90 90 90 f4 \n" | |
103 }, | |
104 { | |
105 "test 9", | |
106 "test 9: seven byte control transfer, unprotected", | |
107 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
108 /* instructions= */ 7, | |
109 /* vaddr= */ 0x80000000, | |
110 "ff 24 95 c8 6e 05 08 \n" /* jmp *0x8056ec8(,%edx,4) */ | |
111 "90 90 90 90 90 90 f4 \n" | |
112 }, | |
113 { | |
114 "test 10", | |
115 "test 10: eight byte bts instruction", | |
116 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
117 /* instructions= */ 7, | |
118 /* vaddr= */ 0x80000000, | |
119 "0f ab 14 85 40 fb 27 08 \n" /* bts %edx,0x827fb40(,%eax,4) */ | |
120 "90 90 90 90 90 90 f4 \n" | |
121 }, | |
122 { | |
123 "test 11", | |
124 "test 11: four byte move", | |
125 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
126 /* instructions= */ 7, | |
127 /* vaddr= */ 0x80000000, | |
128 "66 bf 08 00 \n" /* mov $0x8,%di */ | |
129 "90 90 90 90 90 90 f4 \n" | |
130 }, | |
131 { | |
132 "test 12", | |
133 "test 12: five byte movsx", | |
134 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
135 /* instructions= */ 7, | |
136 /* vaddr= */ 0x80000000, | |
137 "66 0f be 04 10 \n" /* movsbw (%eax,%edx,1),%ax */ | |
138 "90 90 90 90 90 90 f4 \n" | |
139 }, | |
140 /* ldmxcsr, stmxcsr */ | |
141 { | |
142 "test 14", | |
143 "test 14: ldmxcsr, stmxcsr", | |
144 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
145 /* instructions= */ 10, | |
146 /* vaddr= */ 0x80000000, | |
147 "90 0f ae 10 90 0f ae 18 \n" | |
148 "90 90 90 90 90 90 f4 \n" | |
149 }, | |
150 /* invalid */ | |
151 { | |
152 "test 15", | |
153 "test 15: invalid instruction", | |
154 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
155 /* instructions= */ 8, | |
156 /* vaddr= */ 0x80000000, | |
157 "90 0f ae 21 \n" | |
158 "90 90 90 90 90 90 f4 \n" | |
159 }, | |
160 /* lfence */ | |
161 { | |
162 "test 16", | |
163 "test 16: lfence", | |
164 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
165 /* instructions= */ 8, | |
166 /* vaddr= */ 0x80000000, | |
167 "90 0f ae ef \n" | |
168 "90 90 90 90 90 90 f4 \n" | |
169 }, | |
170 { | |
171 "test 17", | |
172 "test 17: lock cmpxchg", | |
173 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
174 /* instructions= */ 4, | |
175 /* vaddr= */ 0x80000000, | |
176 "f0 0f b1 8f a8 01 00 00 \n" /* lock cmpxchg %ecx,0x1a8(%edi) */ | |
177 "90 90 90 f4 \n" | |
178 }, | |
179 { | |
180 "test 18", | |
181 "test 18: loop branch into overlapping instruction", | |
182 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
183 /* instructions= */ 3, | |
184 /* vaddr= */ 0x80000000, | |
185 "bb 90 40 cd 80 85 c0 e1 f8 f4 \n" | |
186 }, | |
187 { | |
188 "test 19", | |
189 "test 19: aad test", | |
190 /* sawfailure= */ 1, /* illegalinst= */ 2, | |
191 /* instructions= */ 5, | |
192 /* vaddr= */ 0x80000000, | |
193 "68 8a 80 04 08 d5 b0 c3 90 bb 90 40 cd 80 f4 \n" | |
194 }, | |
195 { | |
196 "test 20", | |
197 "test 20: addr16 lea", | |
198 /* sawfailure= */ 1, /* illegalinst= */ 2, | |
199 /* instructions= */ 5, | |
200 /* vaddr= */ 0x80000000, | |
201 "68 8e 80 04 08 66 67 8d 98 ff ff c3 90 bb 90 40 cd 80 f4 \n" | |
202 }, | |
203 { | |
204 "test 21", | |
205 "test 21: aam", | |
206 /* sawfailure= */ 1, /* illegalinst= */ 2, | |
207 /* instructions= */ 4, | |
208 /* vaddr= */ 0x80000000, | |
209 "68 89 80 04 08 \n" /* push $0x8048089 */ | |
210 "d4 b0 \n" /* aam $0xffffffb0 */ | |
211 "c3 \n" /* ret */ | |
212 "bb 90 40 cd f4 \n" /* mov $0xf4cd4090,%ebx */ | |
213 "f4 \n" /* hlt */ | |
214 }, | |
215 { | |
216 "test 22", | |
217 "test 22: pshufw", | |
218 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
219 /* instructions= */ 4, | |
220 /* vaddr= */ 0x80000000, | |
221 "68 8b 80 04 08 0f 70 ca b3 c3 bb 90 40 cd 80 f4 \n" | |
222 }, | |
223 { | |
224 "test 23", | |
225 "test 23: 14-byte nacljmp using eax", | |
226 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
227 /* instructions= */ 3, | |
228 /* vaddr= */ 0x80000000, | |
229 "81 e0 ff ff ff ff 81 c8 00 00 00 00 ff d0 f4 \n" | |
230 }, | |
231 { | |
232 "test 24", | |
233 "test 24: 5-byte nacljmp", | |
234 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
235 /* instructions= */ 2, | |
236 /* vaddr= */ 0x80000000, | |
237 "83 e0 e0 ff e0 f4 \n" | |
238 }, | |
239 { | |
240 "test 25", | |
241 "test 25: 0xe3 jmp", | |
242 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
243 /* instructions= */ 1, | |
244 /* vaddr= */ 0x80000000, | |
245 "e3 00 f4 \n" | |
246 }, | |
247 { | |
248 "test 26", | |
249 "test 26: 0xe9 jmp, nop", | |
250 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
251 /* instructions= */ 2, | |
252 /* vaddr= */ 0x80000000, | |
253 "e9 00 00 00 00 90 f4 \n" | |
254 }, | |
255 { | |
256 "test 27", | |
257 "test 27: 0xf0 0x80 jmp, nop", | |
258 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
259 /* instructions= */ 2, | |
260 /* vaddr= */ 0x80000000, | |
261 "0f 80 00 00 00 00 90 f4 \n" | |
262 }, | |
263 { | |
264 "test 28", | |
265 "test 28: 0xe9 jmp", | |
266 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
267 /* instructions= */ 1, | |
268 /* vaddr= */ 0x80000000, | |
269 "e9 00 00 00 00 f4 \n" | |
270 }, | |
271 { | |
272 "test 30", | |
273 "test 30: addr16 lea ret", | |
274 /* sawfailure= */ 1, /* illegalinst= */ 2, | |
275 /* instructions= */ 3, | |
276 /* vaddr= */ 0x80000000, | |
277 "67 8d b4 9a 40 c3 90 f4 \n" | |
278 }, | |
279 { | |
280 "test 31", | |
281 "test 31: repz movsbl", | |
282 /* sawfailure= */ 1, /* illegalinst= */ 2, | |
283 /* instructions= */ 3, | |
284 /* vaddr= */ 0x80000000, | |
285 "f3 0f be 40 d0 c3 90 f4 \n" | |
286 }, | |
287 { | |
288 "test 32", | |
289 "test 32: infinite loop", | |
290 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
291 /* instructions= */ 1, | |
292 /* vaddr= */ 0x80000000, | |
293 "7f fe f4 \n" | |
294 }, | |
295 { | |
296 "test 33", | |
297 "test 33: bad branch", | |
298 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
299 /* instructions= */ 1, | |
300 /* vaddr= */ 0x80000000, | |
301 "7f fd f4 \n" | |
302 }, | |
303 { | |
304 "test 34", | |
305 "test 34: bad branch", | |
306 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
307 /* instructions= */ 1, | |
308 /* vaddr= */ 0x80000000, | |
309 "7f ff f4 \n" | |
310 }, | |
311 { | |
312 "test 35", | |
313 "test 35: bad branch", | |
314 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
315 /* instructions= */ 1, | |
316 /* vaddr= */ 0x80000000, | |
317 "7f 00 f4 \n" | |
318 }, | |
319 { | |
320 "test 36", | |
321 "test 36: bad branch", | |
322 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
323 /* instructions= */ 1, | |
324 /* vaddr= */ 0x80000000, | |
325 "7f 01 f4 \n" | |
326 }, | |
327 { | |
328 "test 37", | |
329 "test 37: bad branch", | |
330 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
331 /* instructions= */ 1, | |
332 /* vaddr= */ 0x80000000, | |
333 "7f 02 f4 \n" | |
334 }, | |
335 { | |
336 "test 38", | |
337 "test 38: intc", | |
338 /* sawfailure= */ 1, /* illegalinst= */ 8, | |
339 /* instructions= */ 10, | |
340 /* vaddr= */ 0x80000000, | |
341 "66 eb 1b 31 51 3d ef cc 2f 36 48 6e 44 2e cc 14 f4 f4 \n" | |
342 }, | |
343 { | |
344 "test 39", | |
345 "test 39: bad branch", | |
346 /* sawfailure= */ 1, /* illegalinst= */ 2, | |
347 /* instructions= */ 7, | |
348 /* vaddr= */ 0x80000000, | |
349 "67 8d 1d 22 a0 05 e3 7b 9c db 08 04 b1 90 ed 12 f4 f4 \n" | |
350 }, | |
351 { | |
352 "test 40", | |
353 "test 40: more addr16 problems", | |
354 /* sawfailure= */ 1, /* illegalinst= */ 2, | |
355 /* instructions= */ 4, | |
356 /* vaddr= */ 0x80000000, | |
357 "67 a0 00 00 cd 80 90 90 f4 \n" | |
358 }, | |
359 { | |
360 "test 41", | |
361 "test 41: the latest non-bug from hcf", | |
362 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
363 /* instructions= */ 5, | |
364 /* vaddr= */ 0x80000000, | |
365 "84 d4 04 53 a0 04 6a 5a 20 cc b8 48 03 2b 96 11 f4 \n" | |
366 }, | |
367 { | |
368 "test 42", | |
369 "test 42: another case from hcf", | |
370 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
371 /* instructions= */ 7, | |
372 /* vaddr= */ 0x80000000, | |
373 "45 7f 89 58 94 04 24 1b c3 e2 6f 1a 94 87 8f 0b f4 \n" | |
374 }, | |
375 { | |
376 "test 43", | |
377 "test 43: too many prefix bytes", | |
378 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
379 /* instructions= */ 2, | |
380 /* vaddr= */ 0x80000000, | |
381 "66 66 66 66 00 00 90 f4 \n" | |
382 }, | |
383 { | |
384 "test 44", | |
385 "test 44: palignr (SSSE3)", | |
386 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
387 /* instructions= */ 2, | |
388 /* vaddr= */ 0x80000000, | |
389 "66 0f 3a 0f d0 c0 90 f4 \n" | |
390 }, | |
391 { | |
392 "test 45", | |
393 "test 45: undefined inst in 3-byte opcode space", | |
394 /* sawfailure= */ 1, /* illegalinst= */ 2, | |
395 /* instructions= */ 2, | |
396 /* vaddr= */ 0x80000000, | |
397 "66 0f 39 0f d0 c0 90 f4 \n" | |
398 }, | |
399 { | |
400 "test 46", | |
401 "test 46: SSE2x near miss", | |
402 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
403 /* instructions= */ 2, | |
404 /* vaddr= */ 0x80000000, | |
405 "66 0f 73 00 00 90 f4 \n" | |
406 }, | |
407 { | |
408 "test 47", | |
409 "test 47: SSE2x", | |
410 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
411 /* instructions= */ 2, | |
412 /* vaddr= */ 0x80000000, | |
413 "66 0f 73 ff 00 90 f4 \n" | |
414 }, | |
415 { | |
416 "test 48", | |
417 "test 48: SSE2x, missing required prefix byte", | |
418 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
419 /* instructions= */ 2, | |
420 /* vaddr= */ 0x80000000, | |
421 "0f 73 ff 00 90 f4 \n" | |
422 }, | |
423 { | |
424 "test 49", | |
425 "test 49: 3DNow example", | |
426 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
427 /* instructions= */ 2, | |
428 /* vaddr= */ 0x80000000, | |
429 "0f 0f 46 01 bf 90 f4 \n" | |
430 }, | |
431 { | |
432 "test 50", | |
433 "test 50: 3DNow error example 1", | |
434 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
435 /* instructions= */ 2, | |
436 /* vaddr= */ 0x80000000, | |
437 "0f 0f 46 01 00 90 f4 \n" | |
438 }, | |
439 { | |
440 "test 51", | |
441 "test 51: 3DNow error example 2", | |
442 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
443 /* instructions= */ 0, | |
444 /* vaddr= */ 0x80000000, | |
445 "0f 0f 46 01 f4 \n" | |
446 }, | |
447 { | |
448 "test 52", | |
449 "test 52: 3DNow error example 3", | |
450 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
451 /* instructions= */ 2, | |
452 /* vaddr= */ 0x80000000, | |
453 "0f 0f 46 01 be 90 f4 \n" | |
454 }, | |
455 { | |
456 "test 53", | |
457 "test 53: 3DNow error example 4", | |
458 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
459 /* instructions= */ 2, | |
460 /* vaddr= */ 0x80000000, | |
461 "0f 0f 46 01 af 90 f4 \n" | |
462 }, | |
463 { | |
464 "test 54", | |
465 "test 54: SSE4", | |
466 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
467 /* instructions= */ 2, | |
468 /* vaddr= */ 0x80000000, | |
469 "66 0f 3a 0e d0 c0 90 f4 \n" | |
470 }, | |
471 { | |
472 "test 55", | |
473 "test 55: SSE4", | |
474 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
475 /* instructions= */ 3, | |
476 /* vaddr= */ 0x80000000, | |
477 "66 0f 38 0a d0 90 90 f4 \n" | |
478 }, | |
479 { | |
480 "test 56", | |
481 "test 56: incb decb", | |
482 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
483 /* instructions= */ 3, | |
484 /* vaddr= */ 0x80000000, | |
485 "fe 85 4f fd ff ff fe 8d 73 fd ff ff 90 f4 \n" | |
486 }, | |
487 { | |
488 "test 57", | |
489 "test 57: lzcnt", | |
490 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
491 /* instructions= */ 2, | |
492 /* vaddr= */ 0x80000000, | |
493 "f3 0f bd 00 90 f4 \n" | |
494 }, | |
495 { | |
496 "test 58", | |
497 "test 58: fldz", | |
498 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
499 /* instructions= */ 2, | |
500 /* vaddr= */ 0x80000000, | |
501 "d9 ee 90 f4 \n" | |
502 }, | |
503 { | |
504 "test 59", | |
505 "test 59: x87", | |
506 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
507 /* instructions= */ 7, | |
508 /* vaddr= */ 0x80000000, | |
509 "dd 9c fd b0 fe ff ff \n" /* fstpl -0x150(%ebp,%edi,8) */ | |
510 "dd 9d 40 ff ff ff \n" /* fstpl -0xc0(%ebp) */ | |
511 "db 04 24 \n" /* fildl (%esp) */ | |
512 "dd 5d a0 \n" /* fstpl -0x60(%ebp) */ | |
513 "da e9 \n" /* fucompp */ | |
514 "df e0 \n" /* fnstsw %ax */ | |
515 "90 f4 \n" | |
516 }, | |
517 { | |
518 "test 60", | |
519 "test 60: x87 bad instructions", | |
520 /* sawfailure= */ 1, /* illegalinst= */ 9, | |
521 /* instructions= */ 19, | |
522 /* vaddr= */ 0x80000000, | |
523 "dd cc \n" /* (bad) */ | |
524 "dd c0 \n" /* ffree %st(0) */ | |
525 "dd c7 \n" /* ffree %st(7) */ | |
526 "dd c8 \n" /* (bad) */ | |
527 "dd cf \n" /* (bad) */ | |
528 "dd f0 \n" /* (bad) */ | |
529 "dd ff \n" /* (bad) */ | |
530 "dd fd \n" /* (bad) */ | |
531 "de d1 \n" /* (bad) */ | |
532 "de d9 \n" /* fcompp */ | |
533 "db 04 24 \n" /* fildl (%esp) */ | |
534 "dd 5d a0 \n" /* fstpl -0x60(%ebp) */ | |
535 "db e0 \n" /* feni(287 only) */ | |
536 "db ff \n" /* (bad) */ | |
537 "db e8 \n" /* fucomi %st(0),%st */ | |
538 "db f7 \n" /* fcomi %st(7),%st */ | |
539 "da e9 \n" /* fucompp */ | |
540 "df e0 \n" /* fnstsw %ax */ | |
541 "90 f4 \n" | |
542 }, | |
543 { | |
544 "test 61", | |
545 "test 61: 3DNow prefetch", | |
546 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
547 /* instructions= */ 2, | |
548 /* vaddr= */ 0x80000000, | |
549 "0f 0d 00 \n" /* prefetch (%eax) */ | |
550 "90 f4 \n" | |
551 }, | |
552 { | |
553 "test 61.1", | |
554 "test 61.1: F2 0F ...", | |
555 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
556 /* instructions= */ 3, | |
557 /* vaddr= */ 0x80000000, | |
558 "f2 0f 48 0f 48 a4 52 \n" | |
559 "f2 0f 10 c8 \n" /* movsd %xmm0,%xmm1 */ | |
560 "90 f4 \n" | |
561 }, | |
562 { | |
563 "test 62", | |
564 "test 62: f6/f7 test Ib/Iv ...", | |
565 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
566 /* instructions= */ 10, | |
567 /* vaddr= */ 0x80000000, | |
568 "f6 c1 ff \n" /* test $0xff,%cl */ | |
569 "f6 44 43 01 02 \n" /* testb $0x2,0x1(%ebx,%eax,2) */ | |
570 "f7 c6 03 00 00 00 \n" /* test $0x3,%esi */ | |
571 "90 90 90 90 90 \n" | |
572 "f7 45 18 00 00 00 20 \n" /* testl $0x20000000,0x18(%ebp) */ | |
573 "90 f4 \n" | |
574 }, | |
575 { | |
576 "test 63", | |
577 "test 63: addr16 corner cases ...", | |
578 /* sawfailure= */ 1, /* illegalinst= */ 4, | |
579 /* instructions= */ 5, | |
580 /* vaddr= */ 0x80000000, | |
581 "67 01 00 \n" /* addr16 add %eax,(%bx,%si) */ | |
582 "67 01 40 00 \n" /* addr16 add %eax,0x0(%bx,%si) */ | |
583 "67 01 80 00 90 \n" /* addr16 add %eax,-0x7000(%bx,%si) */ | |
584 "67 01 c0 \n" /* addr16 add %eax,%eax */ | |
585 "90 f4 \n" | |
586 }, | |
587 { | |
588 "test 64", | |
589 "test 64: text starts with indirect jmp ...", | |
590 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
591 /* instructions= */ 2, | |
592 /* vaddr= */ 0x80000000, | |
593 "ff d0 90 f4 \n" | |
594 }, | |
595 { | |
596 "test 65", | |
597 "test 65: nacljmp crosses 32-byte boundary ...", | |
598 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
599 /* instructions= */ 32, | |
600 /* vaddr= */ 0x80000000, | |
601 "90 90 90 90 90 90 90 90 \n" | |
602 "90 90 90 90 90 90 90 90 \n" | |
603 "90 90 90 90 90 90 90 90 \n" | |
604 "90 90 90 90 90 83 e0 ff \n" | |
605 "ff d0 90 f4 \n" | |
606 }, | |
607 { | |
608 /* I think this is currently NACLi_ILLEGAL */ | |
609 "test 65", | |
610 "test 65: fxsave", | |
611 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
612 /* instructions= */ 2, | |
613 /* vaddr= */ 0x80000000, | |
614 "0f ae 00 00 90 90 90 90 90 f4 \n" | |
615 }, | |
616 { | |
617 "test 66", | |
618 "test 66: NACLi_CMPXCHG8B", | |
619 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
620 /* instructions= */ 2, | |
621 /* vaddr= */ 0x80000000, | |
622 "f0 0f c7 08 90 f4 \n" | |
623 }, | |
624 { | |
625 "test 67", | |
626 "test 67: NACLi_FCMOV", | |
627 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
628 /* instructions= */ 7, | |
629 /* vaddr= */ 0x80000000, | |
630 "da c0 00 00 90 90 90 90 90 f4 \n" | |
631 }, | |
632 { | |
633 "test 68", | |
634 "test 68: NACLi_MMX", | |
635 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
636 /* instructions= */ 4, | |
637 /* vaddr= */ 0x80000000, | |
638 "0f 60 00 \n" /* punpcklbw (%eax),%mm0 */ | |
639 "90 90 90 f4 \n" | |
640 }, | |
641 { | |
642 "test 69", | |
643 "test 69: NACLi_SSE", | |
644 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
645 /* instructions= */ 2, | |
646 /* vaddr= */ 0x80000000, | |
647 "0f 5e 90 90 90 90 90 90 f4 \n" | |
648 }, | |
649 { | |
650 "test 70", | |
651 "test 70: NACLi_SSE2", | |
652 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
653 /* instructions= */ 4, | |
654 /* vaddr= */ 0x80000000, | |
655 "66 0f 60 00 90 90 90 f4 \n" | |
656 }, | |
657 { | |
658 "test 71", | |
659 "test 71: NACLi_SSE3", | |
660 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
661 /* instructions= */ 4, | |
662 /* vaddr= */ 0x80000000, | |
663 "66 0f 7d 00 90 90 90 f4 \n" | |
664 }, | |
665 { | |
666 "test 72", | |
667 "test 72: NACLi_SSE4A", | |
668 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
669 /* instructions= */ 4, | |
670 /* vaddr= */ 0x80000000, | |
671 "f2 0f 79 00 90 90 90 f4 \n" | |
672 }, | |
673 { | |
674 "test 73", | |
675 "test 73: NACLi_POPCNT", | |
676 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
677 /* instructions= */ 2, | |
678 /* vaddr= */ 0x80000000, | |
679 "f3 0f b8 00 90 f4 \n" | |
680 }, | |
681 { | |
682 "test 74", | |
683 "test 74: NACLi_E3DNOW", | |
684 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
685 /* instructions= */ 2, | |
686 /* vaddr= */ 0x80000000, | |
687 "0f 0f 46 01 bb 90 f4 \n" | |
688 }, | |
689 { | |
690 "test 75", | |
691 "test 75: NACLi_MMXSSE2", | |
692 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
693 /* instructions= */ 2, | |
694 /* vaddr= */ 0x80000000, | |
695 "66 0f 71 f6 00 90 f4 \n" | |
696 }, | |
697 { | |
698 "test 76", | |
699 "test 76: mov eax, ss", | |
700 /* sawfailure= */ 1, /* illegalinst= */ 4, | |
701 /* instructions= */ 4, | |
702 /* vaddr= */ 0x80000000, | |
703 "8e d0 8c d0 66 8c d0 90 f4 \n" | |
704 }, | |
705 { | |
706 "test 77", | |
707 "test 77: call esp", | |
708 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
709 /* instructions= */ 3, | |
710 /* vaddr= */ 0x80000000, | |
711 "83 e4 f0 ff d4 90 f4 \n" | |
712 }, | |
713 /* code.google.com issue 23 reported by defend.the.world on 11 Dec 2008 */ | |
714 { | |
715 "test 78", | |
716 "test 78: call (*edx)", | |
717 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
718 /* instructions= */ 30, | |
719 /* vaddr= */ 0x80000000, | |
720 "90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 \n" | |
721 "90 90 90 90 90 90 90 90 90 90 90 \n" | |
722 "83 e2 e0 \n" /* and */ | |
723 "ff 12 \n" /* call (*edx) */ | |
724 "90 f4 \n" /* nop halt */ | |
725 }, | |
726 { | |
727 "test 79", | |
728 "test 79: call *edx", | |
729 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
730 /* instructions= */ 30, | |
731 /* vaddr= */ 0x80000000, | |
732 "90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 \n" | |
733 "90 90 90 90 90 90 90 90 90 90 90 \n" | |
734 "83 e2 e0 \n" /* and */ | |
735 "ff d2 \n" /* call *edx */ | |
736 "90 f4 \n" /* nop halt */ | |
737 }, | |
738 { | |
739 "test 80", | |
740 "test 80: roundss", | |
741 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
742 /* instructions= */ 3, | |
743 /* vaddr= */ 0x80000000, | |
744 "66 0f 3a 0a c0 00 \n" /* roundss $0x0,%xmm0,%xmm0 */ | |
745 "90 90 \n" | |
746 "f4 \n" /* hlt */ | |
747 }, | |
748 { | |
749 "test 81", | |
750 "test 81: crc32", | |
751 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
752 /* instructions= */ 3, | |
753 /* vaddr= */ 0x80000000, | |
754 "f2 0f 38 f1 c8 \n" /* crc32l %eax,%ecx */ | |
755 "90 90 \n" | |
756 "f4 \n" /* hlt */ | |
757 }, | |
758 { | |
759 "test 82", | |
760 "test 82: SSE4 error 1", | |
761 /* sawfailure= */ 1, /* illegalinst= */ 2, | |
762 /* instructions= */ 4, | |
763 /* vaddr= */ 0x80000000, | |
764 "f3 0f 3a 0e d0 c0 90 f4 \n" | |
765 }, | |
766 { | |
767 "test 83", | |
768 "test 83: SSE4 error 2", | |
769 /* sawfailure= */ 1, /* illegalinst= */ 2, | |
770 /* instructions= */ 2, | |
771 /* vaddr= */ 0x80000000, | |
772 "f3 0f 38 0f d0 c0 90 f4 \n" | |
773 }, | |
774 { | |
775 "test 84", | |
776 "test 84: SSE4 error 3", | |
777 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
778 /* instructions= */ 3, | |
779 /* vaddr= */ 0x80000000, | |
780 "66 0f 38 0f d0 c0 90 f4 \n" | |
781 }, | |
782 { | |
783 "test 85", | |
784 "test 85: SSE4 error 4", | |
785 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
786 /* instructions= */ 3, | |
787 /* vaddr= */ 0x80000000, | |
788 "f2 66 0f 3a 0a c0 00 \n" | |
789 "90 90 \n" | |
790 "f4 \n" /* hlt */ | |
791 }, | |
792 { | |
793 "test 86", | |
794 "test 86: bad SSE4 crc32", | |
795 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
796 /* instructions= */ 3, | |
797 /* vaddr= */ 0x80000000, | |
798 "f2 f3 0f 38 f1 c8 \n" | |
799 "90 90 \n" | |
800 "f4 \n" /* hlt */ | |
801 }, | |
802 { | |
803 "test 87", | |
804 "test 87: bad NACLi_3BYTE instruction (SEGCS prefix)", | |
805 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
806 /* instructions= */ 3, | |
807 /* vaddr= */ 0x80000000, | |
808 /* Note: Fixed so that this is a legal instruction, | |
809 * except for the prefix! (karl) | |
810 */ | |
811 "2e 0f 3a 0f bb ab 00 00 00 00 \n" | |
812 "90 90 \n" | |
813 "f4 \n" /* hlt */ | |
814 }, | |
815 { | |
816 "test 87a", | |
817 "test 87a: bad NACLi_3BYTE instruction (not really an instruction)", | |
818 /* sawfailure= */ 1, /* illegalinst= */ 2, | |
819 /* instructions= */ 2, | |
820 /* vaddr= */ 0x80000000, | |
821 /* Note: Fixed so that this is a legal instruction, | |
822 * except for the prefix! (karl) | |
823 */ | |
824 "2e 0f 3a 7d bb ab 00 00 00 00 \n" | |
825 "90 90 \n" | |
826 "f4 \n" /* hlt */ | |
827 }, | |
828 { | |
829 "test 88", | |
830 "test 88: two-byte jump with prefix (bug reported by Mark Dowd)", | |
831 /* sawfailure= */ 1, /* illegalinst= */ 1, | |
832 /* instructions= */ 4, | |
833 /* vaddr= */ 0x80000000, | |
834 "66 0f 84 00 00 \n" /* data16 je 0x5 */ | |
835 "90 90 \n" | |
836 "f4 \n" /* hlt */ | |
837 }, | |
838 { | |
839 "test 89", | |
840 "test 89: sfence", | |
841 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
842 /* instructions= */ 8, | |
843 /* vaddr= */ 0x80000000, | |
844 "90 0f ae ff \n" | |
845 "90 90 90 90 90 90 f4 \n" | |
846 }, | |
847 { | |
848 "test 90", | |
849 "test 90: clflush", | |
850 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
851 /* instructions= */ 8, | |
852 /* vaddr= */ 0x80000000, | |
853 "90 0f ae 3f \n" | |
854 "90 90 90 90 90 90 f4 \n" | |
855 }, | |
856 { | |
857 "test 91", | |
858 "test 91: mfence", | |
859 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
860 /* instructions= */ 8, | |
861 /* vaddr= */ 0x80000000, | |
862 "90 0f ae f7 \n" | |
863 "90 90 90 90 90 90 f4 \n" | |
864 }, | |
865 { | |
866 "test 92", | |
867 "test 92: jump to zero should be allowed", | |
868 /* A jump/call to a zero address will be emitted for a jump/call | |
869 to a weak symbol that is undefined. */ | |
870 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
871 /* instructions= */ 1, | |
872 /* vaddr= */ 0x08049000, | |
873 "e9 fb 6f fb f7 \n" /* jmp 0 */ | |
874 "f4 \n" /* hlt */ | |
875 }, | |
876 { | |
877 "test 93", | |
878 "test 93: jump to bundle-aligned zero page address is currently allowed", | |
879 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
880 /* instructions= */ 1, | |
881 /* vaddr= */ 0x08049000, | |
882 "e9 fb 70 fb f7 \n" /* jmp 100 */ | |
883 "f4 \n" /* hlt */ | |
884 }, | |
885 { | |
886 "test 94", | |
887 "test 94: jump to syscall trampoline should be allowed", | |
888 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
889 /* instructions= */ 1, | |
890 /* vaddr= */ 0x08049000, | |
891 "e9 fb 6f fc f7 \n" /* jmp 10000 */ | |
892 "f4 \n" /* hlt */ | |
893 }, | |
894 { | |
895 "test 95", | |
896 "test 95: unaligned jump to trampoline area must be disallowed", | |
897 /* sawfailure= */ 1, /* illegalinst= */ 0, | |
898 /* instructions= */ 1, | |
899 /* vaddr= */ 0x08049000, | |
900 "e9 fc 6f fc f7 \n" /* jmp 10001 */ | |
901 "f4 \n" /* hlt */ | |
902 }, | |
903 { | |
904 "test 96", | |
905 "test 96: bundle-aligned jump to before the code chunk is allowed", | |
906 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
907 /* instructions= */ 1, | |
908 /* vaddr= */ 0x08049000, | |
909 "e9 fb 6f fb f8 \n" /* jmp 1000000 */ | |
910 "f4 \n" /* hlt */ | |
911 }, | |
912 { | |
913 "test 97", | |
914 "test 97: bundle-aligned jump to after the code chunk is allowed", | |
915 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
916 /* instructions= */ 1, | |
917 /* vaddr= */ 0x08049000, | |
918 "e9 fb 6f fb 07 \n" /* jmp 10000000 */ | |
919 "f4 \n" /* hlt */ | |
920 }, | |
921 }; | |
922 | |
923 static void DecodeHexString(const char *input, uint8_t **result_data, | |
924 size_t *result_size) { | |
925 size_t buf_size = strlen(input) / 2; /* Over-estimate size */ | |
926 uint8_t *output; | |
927 uint8_t *buf = malloc(buf_size); | |
928 assert(buf != NULL); | |
929 | |
930 output = buf; | |
931 while (*input != '\0') { | |
932 if (*input == ' ' || *input == '\n') { | |
933 input++; | |
934 } else { | |
935 char *end; | |
936 assert(output < buf + buf_size); | |
937 *output++ = (uint8_t) strtoul(input, &end, 16); | |
938 /* Expect 2 digits of hex. */ | |
939 assert(end == input + 2); | |
940 input = end; | |
941 } | |
942 } | |
943 *result_data = buf; | |
944 *result_size = output - buf; | |
945 } | |
946 | |
947 static void TestValidator(struct NCValTestCase *vtest, int didstubout) { | |
948 struct NCValidatorState *vstate; | |
949 uint8_t *byte0; | |
950 size_t data_size; | |
951 int rc; | |
952 | |
953 DecodeHexString(vtest->data_as_hex, &byte0, &data_size); | |
954 /* | |
955 * The validator used to require that code chunks end in HLT. We | |
956 * have left the HLTs in, but don't pass them to the validator. | |
957 * TODO(mseaborn): Remove the HLTs. | |
958 */ | |
959 assert(byte0[data_size - 1] == 0xf4 /* HLT */); | |
960 | |
961 vstate = NCValidateInit(vtest->vaddr, data_size - 1, | |
962 FALSE, &g_ncval_cpu_features); | |
963 assert (vstate != NULL); | |
964 NCValidateSetErrorReporter(vstate, &kNCVerboseErrorReporter); | |
965 NCValidateSegment(byte0, (uint32_t)vtest->vaddr, data_size - 1, vstate); | |
966 free(byte0); | |
967 rc = NCValidateFinish(vstate); | |
968 | |
969 do { | |
970 printf("vtest->sawfailure = %d, vstate->stats.sawfailure = %d\n", | |
971 vtest->sawfailure, vstate->stats.sawfailure); | |
972 NCStatsPrint(vstate); | |
973 if (vtest->sawfailure != rc) break; | |
974 if (vtest->sawfailure ^ vstate->stats.sawfailure) break; | |
975 if (didstubout != vstate->stats.didstubout) break; | |
976 if (vtest->instructions != vstate->stats.instructions) break; | |
977 if (vtest->illegalinst != vstate->stats.illegalinst) break; | |
978 Info("*** %s passed (%s)\n", vtest->name, vtest->description); | |
979 printf("\n"); | |
980 NCValidateFreeState(&vstate); | |
981 return; | |
982 } while (0); | |
983 NCStatsPrint(vstate); | |
984 NCValidateFreeState(&vstate); | |
985 Info("*** %s failed (%s)\n", vtest->name, vtest->description); | |
986 exit(-1); | |
987 } | |
988 | |
989 void test_fail_on_bad_alignment(void) { | |
990 struct NCValidatorState *vstate; | |
991 | |
992 printf("Running test_fail_on_bad_alignment...\n"); | |
993 | |
994 vstate = NCValidateInit(0x80000000, 0x1000, FALSE, &g_ncval_cpu_features); | |
995 CHECK(vstate != NULL); | |
996 NCValidateFreeState(&vstate); | |
997 | |
998 /* Unaligned start addresses are not allowed. */ | |
999 vstate = NCValidateInit(0x80000001, 0x1000, FALSE, &g_ncval_cpu_features); | |
1000 CHECK(vstate == NULL); | |
1001 } | |
1002 | |
1003 void test_stubout(void) { | |
1004 /* Similar to test 68 */ | |
1005 struct NCValTestCase test = { | |
1006 "test stubout", | |
1007 "test stubout: NACLi_MMX", | |
1008 /* sawfailure= */ 0, /* illegalinst= */ 0, | |
1009 /* instructions= */ 1, | |
1010 /* vaddr= */ 0x80000000, | |
1011 "0f 60 00 f4 \n" /* punpcklbw (%eax),%mm0 */ | |
1012 }; | |
1013 | |
1014 printf("Running test_stubout...\n"); | |
1015 | |
1016 /* If MMX instructions are not allowed, stubout will occur. */ | |
1017 NaClSetCPUFeatureX86(&g_ncval_cpu_features, NaClCPUFeatureX86_MMX, FALSE); | |
1018 TestValidator(&test, TRUE); | |
1019 NaClSetCPUFeatureX86(&g_ncval_cpu_features, NaClCPUFeatureX86_MMX, TRUE); | |
1020 } | |
1021 | |
1022 void ncvalidate_unittests(void) { | |
1023 size_t i; | |
1024 | |
1025 /* Default to stubbing out nothing. */ | |
1026 NaClSetAllCPUFeaturesX86((NaClCPUFeatures *) &g_ncval_cpu_features); | |
1027 | |
1028 for (i = 0; i < NACL_ARRAY_SIZE(NCValTests); i++) { | |
1029 TestValidator(&NCValTests[i], FALSE); | |
1030 } | |
1031 | |
1032 test_fail_on_bad_alignment(); | |
1033 test_stubout(); | |
1034 | |
1035 Info("\nAll tests passed.\n\n"); | |
1036 } | |
1037 | |
1038 | |
1039 int main(void) { | |
1040 struct GioFile gio_out_stream; | |
1041 struct Gio *gout = (struct Gio*) &gio_out_stream; | |
1042 if (!GioFileRefCtor(&gio_out_stream, stdout)) { | |
1043 fprintf(stderr, "Unable to create gio file for stdout!\n"); | |
1044 return 1; | |
1045 } | |
1046 | |
1047 NaClLogModuleInitExtended(LOG_INFO, gout); | |
1048 ncvalidate_unittests(); | |
1049 GioFileDtor(gout); | |
1050 return 0; | |
1051 } | |
OLD | NEW |