コード例 #1
0
static Bool SerializeAllProcessors(void) {
    /*
     * We rely on the OS mprotect() call to issue interprocessor interrupts,
     * which will cause other processors to execute an IRET, which is
     * serializing.
     *
     * This code is based on two main considerations:
     * 1. Only switching the page from exec to non-exec state is guaranteed
     * to invalidate processors' instruction caches.
     * 2. It's bad to have a page that is both writeable and executable,
     * even if that happens not simultaneously.
     */

    int size = NACL_MAP_PAGESIZE;
    if (NULL == g_squashybuffer) {
        if ((0 != NaClPageAlloc(&g_squashybuffer, size)) ||
                (0 != NaClMprotect(g_squashybuffer, size, PROT_READ|PROT_WRITE))) {
            NaClLog(0,
                    ("SerializeAllProcessors: initial squashybuffer allocation"
                     " failed\n"));
            return FALSE;
        }

        NaClFillMemoryRegionWithHalt(g_squashybuffer, size);
        g_firstbyte = *(char *) g_squashybuffer;
        NaClLog(0, "SerializeAllProcessors: g_firstbyte is %d\n", g_firstbyte);
    }

    if ((0 != NaClMprotect(g_squashybuffer, size, PROT_READ|PROT_EXEC))) {
        NaClLog(0,
                ("SerializeAllProcessors: interprocessor interrupt"
                 " generation failed: could not reverse shield polarity (1)\n"));
        return FALSE;
    }
    /*
     * Make a read to ensure that the potential kernel laziness
     * would not affect this hack.
     */
    if (*(char *) g_squashybuffer != g_firstbyte) {
        NaClLog(0,
                ("SerializeAllProcessors: interprocessor interrupt"
                 " generation failed: could not reverse shield polarity (2)\n"));
        NaClLog(0, "SerializeAllProcessors: g_firstbyte is %d\n", g_firstbyte);
        NaClLog(0, "SerializeAllProcessors: *g_squashybuffer is %d\n",
                *(char *) g_squashybuffer);
        return FALSE;
    }
    /*
     * We would like to set the protection to PROT_NONE, but on Windows
     * there's an ugly hack in NaClMprotect where PROT_NONE can result
     * in MEM_DECOMMIT, causing the contents of the page(s) to be lost!
     */
    if (0 != NaClMprotect(g_squashybuffer, size, PROT_READ)) {
        NaClLog(0,
                ("SerializeAllProcessors: interprocessor interrupt"
                 " generation failed: could not reverse shield polarity (3)\n"));
        return FALSE;
    }
    return TRUE;
}
コード例 #2
0
static void MakeDynamicCodePagesVisible(struct NaClApp *nap,
                                        uint32_t page_index_min,
                                        uint32_t page_index_max,
                                        uint8_t *writable_addr) {
  void *user_addr;
  uint32_t index;
  size_t size = (page_index_max - page_index_min) * NACL_MAP_PAGESIZE;

  for (index = page_index_min; index < page_index_max; index++) {
    CHECK(!BitmapIsBitSet(nap->dynamic_page_bitmap, index));
    BitmapSetBit(nap->dynamic_page_bitmap, index);
  }
  user_addr = (void *) NaClUserToSys(nap, nap->dynamic_text_start
                                     + page_index_min * NACL_MAP_PAGESIZE);

#if NACL_WINDOWS
  NaClUntrustedThreadsSuspendAll(nap, /* save_registers= */ 0);

  /*
   * The VirtualAlloc() call here has two effects:
   *
   *  1) It commits the page in the shared memory (SHM) object,
   *     allocating swap space and making the page accessible.  This
   *     affects our writable mapping of the shared memory object too.
   *     Before the VirtualAlloc() call, dereferencing writable_addr
   *     would fault.
   *  2) It changes the page permissions of the mapping to
   *     read+execute.  Since this exposes the page in its unsafe,
   *     non-HLT-filled state, this must be done with untrusted
   *     threads suspended.
   */
  {
    uintptr_t offset;
    for (offset = 0; offset < size; offset += NACL_MAP_PAGESIZE) {
      void *user_page_addr = (char *) user_addr + offset;
      if (VirtualAlloc(user_page_addr, NACL_MAP_PAGESIZE,
                       MEM_COMMIT, PAGE_EXECUTE_READ) != user_page_addr) {
        NaClLog(LOG_FATAL, "MakeDynamicCodePagesVisible: "
                "VirtualAlloc() failed -- probably out of swap space\n");
      }
    }
  }
#endif

  /* Sanity check:  Ensure the page is not already in use. */
  CHECK(*writable_addr == 0);

  NaClFillMemoryRegionWithHalt(writable_addr, size);

#if NACL_WINDOWS
  NaClUntrustedThreadsResumeAll(nap);
#else
  if (NaClMprotect(user_addr, size, PROT_READ | PROT_EXEC) != 0) {
    NaClLog(LOG_FATAL, "MakeDynamicCodePageVisible: NaClMprotect() failed\n");
  }
#endif
}
コード例 #3
0
/*
 * Fill from static_text_end to end of that page with halt
 * instruction, which is at least NACL_HALT_LEN in size when no
 * dynamic text is present.  Does not touch dynamic text region, which
 * should be pre-filled with HLTs.
 *
 * By adding NACL_HALT_SLED_SIZE, we ensure that the code region ends
 * with HLTs, just in case the CPU has a bug in which it fails to
 * check for running off the end of the x86 code segment.
 */
void NaClFillEndOfTextRegion(struct NaClApp *nap) {
  size_t page_pad;

  /*
   * NOTE: make sure we are not silently overwriting data.  It is the
   * toolchain's responsibility to ensure that a NACL_HALT_SLED_SIZE
   * gap exists.
   */
  if (0 != nap->data_start &&
      nap->static_text_end + NACL_HALT_SLED_SIZE >
      NaClTruncAllocPage(nap->data_start)) {
    NaClLog(LOG_FATAL, "Missing gap between text and data for halt_sled\n");
  }
  if (0 != nap->rodata_start &&
      nap->static_text_end + NACL_HALT_SLED_SIZE > nap->rodata_start) {
    NaClLog(LOG_FATAL, "Missing gap between text and rodata for halt_sled\n");
  }

  if (NULL == nap->text_shm) {
    /*
     * No dynamic text exists.  Space for NACL_HALT_SLED_SIZE must
     * exist.
     */
    page_pad = (NaClRoundAllocPage(nap->static_text_end + NACL_HALT_SLED_SIZE)
                - nap->static_text_end);
    CHECK(page_pad >= NACL_HALT_SLED_SIZE);
    CHECK(page_pad < NACL_MAP_PAGESIZE + NACL_HALT_SLED_SIZE);
  } else {
    /*
     * Dynamic text exists; the halt sled resides in the dynamic text
     * region, so all we need to do here is to round out the last
     * static text page with HLT instructions.  It doesn't matter if
     * the size of this region is smaller than NACL_HALT_SLED_SIZE --
     * this is just to fully initialize the page, rather than (later)
     * decoding/validating zero-filled memory as instructions.
     */
    page_pad = NaClRoundAllocPage(nap->static_text_end) - nap->static_text_end;
  }

  NaClLog(4,
          "Filling with halts: %08"NACL_PRIxPTR", %08"NACL_PRIxS" bytes\n",
          nap->mem_start + nap->static_text_end,
          page_pad);

  NaClFillMemoryRegionWithHalt((void *)(nap->mem_start + nap->static_text_end),
                               page_pad);

  nap->static_text_end += page_pad;
}
コード例 #4
0
int NaClPatchWindowsExceptionDispatcherWithCheck(void) {
  uint8_t *ntdll_routine = NaClGetKiUserExceptionDispatcher();
  uint8_t *intercept_code;
  uint8_t *dest;
  uint32_t *reloc_addr;
  size_t template_size = (NaCl_exception_dispatcher_intercept_end -
                          NaCl_exception_dispatcher_intercept);
  DWORD old_prot;

  /*
   * We patch the start of KiUserExceptionDispatcher with a 32-bit
   * relative jump to our routine, so our routine needs to be
   * relocated to within +/-2GB of KiUserExceptionDispatcher's
   * address.  To avoid edge cases, we allocate within the smaller
   * range of +/-1.5GB.
   *
   * We use a 32-bit relative jump because it's short -- 5 bytes --
   * which minimises the amount of code we have to overwrite and
   * relocate.  If we did a 64-bit jump, we'd need to do something
   * like the following:
   *   50                              push %rax
   *   48 b8 XX XX XX XX XX XX XX XX   mov $0xXXXXXXXXXXXXXXXX, %rax
   *   ff e0                           jmpq *%rax
   * which is 13 bytes.
   */
  const size_t kMaxDistance = 1536 << 20;

  /*
   * Check for the instructions:
   *   fc                     cld
   *   48 8b 05 XX XX XX XX   mov XXXXXXXX(%rip), %rax
   *
   * Note that if you set a breakpoint on KiUserExceptionDispatcher
   * with WinDbg, this check will fail because the first byte will
   * have been replaced with int3.
   */
  size_t bytes_to_move = 8;
  size_t rip_relative_operand_offset = 4;
  if (ntdll_routine[0] == 0xfc &&
      ntdll_routine[1] == 0x48 &&
      ntdll_routine[2] == 0x8b &&
      ntdll_routine[3] == 0x05) {
    NaClLog(2, "NaClPatchWindowsExceptionDispatcherWithCheck: "
            "Got instructions expected for Windows Vista and Windows 7\n");
  } else {
    NaClLog(ERROR, "NaClPatchWindowsExceptionDispatcherWithCheck: "
            "Unexpected start instructions\n");
    return 0; /* Failure */
  }

  intercept_code = AllocatePageInRange(ntdll_routine - kMaxDistance,
                                       ntdll_routine + kMaxDistance);
  if (intercept_code == NULL) {
    NaClLog(LOG_FATAL, "NaClPatchWindowsExceptionDispatcherWithCheck: "
            "AllocatePageInRange() failed\n");
  }
  /* Fill the page with HLTs just in case. */
  NaClFillMemoryRegionWithHalt(intercept_code, NACL_MAP_PAGESIZE);
  dest = intercept_code;

  /* Copy template code and fill out a parameter in it. */
  memcpy(dest, NaCl_exception_dispatcher_intercept, template_size);
  reloc_addr =
    (uint32_t *) (dest + (NaCl_exception_dispatcher_intercept_tls_index -
                          NaCl_exception_dispatcher_intercept) + 1);
  CHECK(*reloc_addr == 0x12345678);
  *reloc_addr = _tls_index;
  dest += template_size;

  /*
   * Copy and relocate instructions from KiUserExceptionDispatcher
   * that we will be overwriting.
   */
  memcpy(dest, ntdll_routine, bytes_to_move);
  RelocateRipRelative(dest, ntdll_routine, rip_relative_operand_offset);
  dest += bytes_to_move;

  /*
   * Lastly, write a jump that returns to the unmodified portion of
   * KiUserExceptionDispatcher.
   */
  WriteJump32(dest, ntdll_routine + bytes_to_move);

  if (!VirtualProtect(intercept_code, NACL_MAP_PAGESIZE, PAGE_EXECUTE_READ,
                      &old_prot)) {
    NaClLog(LOG_FATAL,
            "NaClPatchWindowsExceptionDispatcherWithCheck: VirtualProtect() "
            "failed to make our intercept routine executable\n");
  }

  if (!VirtualProtect(ntdll_routine, kJump32Size + 1,
                      PAGE_EXECUTE_READWRITE, &old_prot)) {
    NaClLog(LOG_FATAL,
            "NaClPatchWindowsExceptionDispatcherWithCheck: "
            "VirtualProtect() failed to make the routine writable\n");
  }
  /*
   * We write the jump after the "cld" instruction so that, if you
   * want to set a breakpoint on KiUserExceptionDispatcher, you can
   * take out the checks for "cld" and this will still work.
   */
  CHECK(ntdll_routine[0] == 0xfc); /* "cld" instruction */
  WriteJump32(ntdll_routine + 1, intercept_code);
  if (!VirtualProtect(ntdll_routine, kJump32Size + 1, old_prot, &old_prot)) {
    NaClLog(LOG_FATAL,
            "NaClPatchWindowsExceptionDispatcherWithCheck: "
            "VirtualProtect() failed to restore page permissions\n");
  }
  return 1; /* Success */
}
コード例 #5
0
void NaClFillTrampolineRegion(struct NaClApp *nap) {
  NaClFillMemoryRegionWithHalt(
      (void *) (nap->mem_start + NACL_TRAMPOLINE_START),
      NACL_TRAMPOLINE_SIZE);
}
コード例 #6
0
ファイル: sel_ldr_x86_64.c プロジェクト: bortoq/zerovm
int NaClMakeDispatchThunk(struct NaClApp *nap) {
  int                   retval = 0;  /* fail */
  int                   error;
  void                  *thunk_addr = NULL;
  struct NaClPatchInfo  patch_info;
  struct NaClPatch      jmp_target;

  NaClLog(LOG_WARNING, "Entered NaClMakeDispatchThunk\n");
  if (0 != nap->dispatch_thunk) {
    NaClLog(LOG_ERROR, " dispatch_thunk already initialized!\n");
    return 1;
  }

  if (0 != (error = NaCl_page_alloc_randomized(&thunk_addr,
                                               NACL_MAP_PAGESIZE))) {
    NaClLog(LOG_INFO,
            "NaClMakeDispatchThunk::NaCl_page_alloc failed, errno %d\n",
            -error);
    retval = 0;
    goto cleanup;
  }
  NaClLog(LOG_INFO, "NaClMakeDispatchThunk: got addr 0x%"NACL_PRIxPTR"\n",
          (uintptr_t) thunk_addr);

  if (0 != (error = NaCl_mprotect(thunk_addr,
                                  NACL_MAP_PAGESIZE,
                                  PROT_READ | PROT_WRITE))) {
    NaClLog(LOG_INFO,
            "NaClMakeDispatchThunk::NaCl_mprotect r/w failed, errno %d\n",
            -error);
    retval = 0;
    goto cleanup;
  }
  NaClFillMemoryRegionWithHalt(thunk_addr, NACL_MAP_PAGESIZE);

  jmp_target.target = (((uintptr_t) &NaClDispatchThunk_jmp_target)
                       - sizeof(uintptr_t));
  jmp_target.value = (uintptr_t) NaClSyscallSeg;

  NaClPatchInfoCtor(&patch_info);
  patch_info.abs64 = &jmp_target;
  patch_info.num_abs64 = 1;

  patch_info.dst = (uintptr_t) thunk_addr;
  patch_info.src = (uintptr_t) &NaClDispatchThunk;
  patch_info.nbytes = ((uintptr_t) &NaClDispatchThunkEnd
                       - (uintptr_t) &NaClDispatchThunk);
  NaClApplyPatchToMemory(&patch_info);

  if (0 != (error = NaCl_mprotect(thunk_addr,
                                  NACL_MAP_PAGESIZE,
                                  PROT_EXEC|PROT_READ))) {
    NaClLog(LOG_INFO,
            "NaClMakeDispatchThunk::NaCl_mprotect r/x failed, errno %d\n",
            -error);
    retval = 0;
    goto cleanup;
  }
  retval = 1;
 cleanup:
  if (0 == retval) {
    if (NULL != thunk_addr) {
      NaCl_page_free(thunk_addr, NACL_MAP_PAGESIZE);
      thunk_addr = NULL;
    }
  } else {
    nap->dispatch_thunk = (uintptr_t) thunk_addr;
  }
  return retval;
}