1 | ; $Id: stack-vcc.asm 95916 2022-07-28 14:29:03Z vboxsync $
|
---|
2 | ;; @file
|
---|
3 | ; IPRT - Stack related Visual C++ support routines.
|
---|
4 | ;
|
---|
5 |
|
---|
6 | ;
|
---|
7 | ; Copyright (C) 2022 Oracle Corporation
|
---|
8 | ;
|
---|
9 | ; This file is part of VirtualBox Open Source Edition (OSE), as
|
---|
10 | ; available from http://www.alldomusa.eu.org. This file is free software;
|
---|
11 | ; you can redistribute it and/or modify it under the terms of the GNU
|
---|
12 | ; General Public License (GPL) as published by the Free Software
|
---|
13 | ; Foundation, in version 2 as it comes in the "COPYING" file of the
|
---|
14 | ; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
|
---|
15 | ; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
|
---|
16 | ;
|
---|
17 | ; The contents of this file may alternatively be used under the terms
|
---|
18 | ; of the Common Development and Distribution License Version 1.0
|
---|
19 | ; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
|
---|
20 | ; VirtualBox OSE distribution, in which case the provisions of the
|
---|
21 | ; CDDL are applicable instead of those of the GPL.
|
---|
22 | ;
|
---|
23 | ; You may elect to license modified versions of this file under the
|
---|
24 | ; terms and conditions of either the GPL or the CDDL or both.
|
---|
25 | ;
|
---|
26 |
|
---|
27 |
|
---|
28 |
|
---|
29 | ;*********************************************************************************************************************************
|
---|
30 | ;* Header Files *
|
---|
31 | ;*********************************************************************************************************************************
|
---|
32 | %include "iprt/asmdefs.mac"
|
---|
33 | %include "iprt/x86.mac"
|
---|
34 |
|
---|
35 |
|
---|
36 | ;*********************************************************************************************************************************
|
---|
37 | ;* Structures and Typedefs *
|
---|
38 | ;*********************************************************************************************************************************
|
---|
39 |
|
---|
40 | ;; Variable descriptor.
|
---|
41 | struc RTC_VAR_DESC_T
|
---|
42 | .offFrame resd 1
|
---|
43 | .cbVar resd 1
|
---|
44 | alignb RTCCPTR_CB
|
---|
45 | .pszName RTCCPTR_RES 1
|
---|
46 | endstruc
|
---|
47 |
|
---|
48 | ;; Frame descriptor.
|
---|
49 | struc RTC_FRAME_DESC_T
|
---|
50 | .cVars resd 1
|
---|
51 | alignb RTCCPTR_CB
|
---|
52 | .paVars RTCCPTR_RES 1 ; Array of RTC_VAR_DESC_T.
|
---|
53 | endstruc
|
---|
54 |
|
---|
55 | ;; An alloca allocation.
|
---|
56 | struc RTC_ALLOCA_ENTRY_T
|
---|
57 | .uGuard1 resd 1
|
---|
58 | .pNext RTCCPTR_RES 1 ; Misaligned.
|
---|
59 | %if ARCH_BITS == 32
|
---|
60 | .pNextPad resd 1
|
---|
61 | %endif
|
---|
62 | .cb RTCCPTR_RES 1 ; Misaligned.
|
---|
63 | %if ARCH_BITS == 32
|
---|
64 | .cbPad resd 1
|
---|
65 | %endif
|
---|
66 | .auGuard2 resd 3
|
---|
67 | endstruc
|
---|
68 |
|
---|
69 | %ifdef RT_ARCH_X86
|
---|
70 | %define FASTCALL_NAME(a_Name, a_cbArgs) @ %+ a_Name %+ @ %+ a_cbArgs
|
---|
71 | %else
|
---|
72 | %define FASTCALL_NAME(a_Name, a_cbArgs) NAME(a_Name)
|
---|
73 | %endif
|
---|
74 |
|
---|
75 |
|
---|
76 | ;*********************************************************************************************************************************
|
---|
77 | ;* Defined Constants And Macros *
|
---|
78 | ;*********************************************************************************************************************************
|
---|
79 | %define VARIABLE_MARKER_PRE 0xcccccccc
|
---|
80 | %define VARIABLE_MARKER_POST 0xcccccccc
|
---|
81 |
|
---|
82 | %define ALLOCA_FILLER_BYTE 0xcc
|
---|
83 | %define ALLOCA_FILLER_32 0xcccccccc
|
---|
84 |
|
---|
85 |
|
---|
86 | ;*********************************************************************************************************************************
|
---|
87 | ;* Global Variables *
|
---|
88 | ;*********************************************************************************************************************************
|
---|
89 | BEGINDATA
|
---|
90 | GLOBALNAME __security_cookie
|
---|
91 | dd 0xdeadbeef
|
---|
92 | dd 0x0c00ffe0
|
---|
93 |
|
---|
94 |
|
---|
95 | ;*********************************************************************************************************************************
|
---|
96 | ;* External Symbols *
|
---|
97 | ;*********************************************************************************************************************************
|
---|
98 | BEGINCODE
|
---|
99 | extern NAME(_RTC_StackVarCorrupted)
|
---|
100 | extern NAME(_RTC_SecurityCookieMismatch)
|
---|
101 |
|
---|
102 |
|
---|
103 | BEGINPROC __GSHandlerCheck
|
---|
104 | int3
|
---|
105 | ENDPROC __GSHandlerCheck
|
---|
106 |
|
---|
107 | ;;
|
---|
108 | ; Probe stack to trigger guard faults.
|
---|
109 | ;
|
---|
110 | ; @param eax Frame size.
|
---|
111 | ; @uses Nothing (because we don't quite now the convention).
|
---|
112 | ;
|
---|
113 | ALIGNCODE(32)
|
---|
114 | BEGINPROC __chkstk
|
---|
115 | push xBP
|
---|
116 | mov xBP, xSP
|
---|
117 | pushf
|
---|
118 | push xAX
|
---|
119 | push xBX
|
---|
120 |
|
---|
121 | xor ebx, ebx
|
---|
122 | .again:
|
---|
123 | sub xBX, PAGE_SIZE
|
---|
124 | mov [xBP + xBX], bl
|
---|
125 | sub eax, PAGE_SIZE
|
---|
126 | jnl .again
|
---|
127 |
|
---|
128 | pop xBX
|
---|
129 | pop xAX
|
---|
130 | popf
|
---|
131 | leave
|
---|
132 | ret
|
---|
133 | ENDPROC __chkstk
|
---|
134 |
|
---|
135 |
|
---|
136 | ;;
|
---|
137 | ; This just initializes a global and calls _RTC_SetErrorFuncW to NULL, and
|
---|
138 | ; since we don't have either of those we have nothing to do here.
|
---|
139 | BEGINPROC _RTC_InitBase
|
---|
140 | ret
|
---|
141 | ENDPROC _RTC_InitBase
|
---|
142 |
|
---|
143 |
|
---|
144 | ;;
|
---|
145 | ; Nothing to do here.
|
---|
146 | BEGINPROC _RTC_Shutdown
|
---|
147 | ret
|
---|
148 | ENDPROC _RTC_Shutdown
|
---|
149 |
|
---|
150 |
|
---|
151 |
|
---|
152 |
|
---|
153 | ;;
|
---|
154 | ; Checks stack variable markers.
|
---|
155 | ;
|
---|
156 | ; This seems to be a regular C function in the CRT, but x86 is conveniently
|
---|
157 | ; using the fastcall convention which makes it very similar to amd64.
|
---|
158 | ;
|
---|
159 | ; We try make this as sleek as possible, leaving all the trouble for when we
|
---|
160 | ; find a corrupted stack variable and need to call a C function to complain.
|
---|
161 | ;
|
---|
162 | ; @param pStackFrame The caller RSP/ESP. [RCX/ECX]
|
---|
163 | ; @param pFrameDesc Frame descriptor. [RDX/EDX]
|
---|
164 | ;
|
---|
165 | ALIGNCODE(64)
|
---|
166 | BEGINPROC FASTCALL_NAME(_RTC_CheckStackVars, 8)
|
---|
167 | push xBP
|
---|
168 |
|
---|
169 | ;
|
---|
170 | ; Load the variable count into eax and check that it's not zero.
|
---|
171 | ;
|
---|
172 | mov eax, [xDX + RTC_FRAME_DESC_T.cVars]
|
---|
173 | test eax, eax
|
---|
174 | jz .return
|
---|
175 |
|
---|
176 | ;
|
---|
177 | ; Make edx/rdx point to the current variable and xBP be the frame pointer.
|
---|
178 | ; The latter frees up xCX for scratch use and incidentally make stack access
|
---|
179 | ; go via SS instead of DS (mostly irrlevant in 64-bit and 32-bit mode).
|
---|
180 | ;
|
---|
181 | mov xDX, [xDX + RTC_FRAME_DESC_T.paVars]
|
---|
182 | mov xBP, xCX
|
---|
183 |
|
---|
184 | ;
|
---|
185 | ; Loop thru the variables and check that their markers/fences haven't be
|
---|
186 | ; trampled over.
|
---|
187 | ;
|
---|
188 | .next_var:
|
---|
189 | ; Marker before the variable.
|
---|
190 | %if ARCH_BITS == 64
|
---|
191 | movsxd rcx, dword [xDX + RTC_VAR_DESC_T.offFrame]
|
---|
192 | %else
|
---|
193 | mov xCX, dword [xDX + RTC_VAR_DESC_T.offFrame]
|
---|
194 | %endif
|
---|
195 | cmp dword [xBP + xCX - 4], VARIABLE_MARKER_PRE
|
---|
196 | jne .corrupted
|
---|
197 |
|
---|
198 | ; Marker after the variable.
|
---|
199 | add ecx, dword [xDX + RTC_VAR_DESC_T.cbVar]
|
---|
200 | %if ARCH_BITS == 64
|
---|
201 | movsxd rcx, ecx
|
---|
202 | %endif
|
---|
203 | cmp dword [xBP + xCX], VARIABLE_MARKER_POST
|
---|
204 | jne .corrupted
|
---|
205 |
|
---|
206 | ;
|
---|
207 | ; Advance to the next variable.
|
---|
208 | ;
|
---|
209 | .advance:
|
---|
210 | add xDX, RTC_VAR_DESC_T_size
|
---|
211 | dec eax
|
---|
212 | jnz .next_var
|
---|
213 |
|
---|
214 | ;
|
---|
215 | ; Return.
|
---|
216 | ;
|
---|
217 | .return:
|
---|
218 | pop xBP
|
---|
219 | ret
|
---|
220 |
|
---|
221 | ;
|
---|
222 | ; Complain about corrupt variable.
|
---|
223 | ;
|
---|
224 | .corrupted:
|
---|
225 | push xAX
|
---|
226 | push xDX
|
---|
227 | %ifdef RT_ARCH_AMD64
|
---|
228 | sub xSP, 28h
|
---|
229 | mov xCX, xBP ; frame pointer + variable descriptor.
|
---|
230 | %else
|
---|
231 | push xBP ; save EBP
|
---|
232 | push xDX ; parameter 2 - variable descriptor
|
---|
233 | push xBP ; parameter 1 - frame pointer.
|
---|
234 | lea xBP, [xSP + 3*xCB] ; turn it into a frame pointer during the call for better unwind.
|
---|
235 | %endif
|
---|
236 |
|
---|
237 | call NAME(_RTC_StackVarCorrupted)
|
---|
238 |
|
---|
239 | %ifdef RT_ARCH_AMD64
|
---|
240 | add xSP, 28h
|
---|
241 | %else
|
---|
242 | add xSP, xCB * 4 ; parameters
|
---|
243 | pop xBP
|
---|
244 | %endif
|
---|
245 | pop xDX
|
---|
246 | pop xAX
|
---|
247 | jmp .advance
|
---|
248 | ENDPROC FASTCALL_NAME(_RTC_CheckStackVars, 8)
|
---|
249 |
|
---|
250 |
|
---|
251 | ;;
|
---|
252 | ; Initialize an alloca allocation list entry and add it to it.
|
---|
253 | ;
|
---|
254 | ; When this is call, presumably _RTC_CheckStackVars2 is used to verify the frame.
|
---|
255 | ;
|
---|
256 | ; @param pNewEntry Pointer to the new entry. [RCX/ECX]
|
---|
257 | ; @param cbEntry The entry size, including header. [RDX/EDX]
|
---|
258 | ; @param ppHead Pointer to the list head pointer. [R8/stack]
|
---|
259 | ;
|
---|
260 | ALIGNCODE(64)
|
---|
261 | BEGINPROC FASTCALL_NAME(_RTC_AllocaHelper, 12)
|
---|
262 | ;
|
---|
263 | ; Check that input isn't NULL or the size isn't zero.
|
---|
264 | ;
|
---|
265 | test xCX, xCX
|
---|
266 | jz .return
|
---|
267 | test xDX, xDX
|
---|
268 | jz .return
|
---|
269 | %if ARCH_BITS == 64
|
---|
270 | test r8, r8
|
---|
271 | %else
|
---|
272 | cmp dword [xSP + xCB], 0
|
---|
273 | %endif
|
---|
274 | jz .return
|
---|
275 |
|
---|
276 | ;
|
---|
277 | ; Memset the memory to ALLOCA_FILLER
|
---|
278 | ;
|
---|
279 | %if ARCH_BITS == 64
|
---|
280 | mov r10, rdi ; save rdi
|
---|
281 | mov r11, rcx ; save pNewEntry
|
---|
282 | %else
|
---|
283 | push xDI
|
---|
284 | push xCX
|
---|
285 | cld ; paranoia
|
---|
286 | %endif
|
---|
287 |
|
---|
288 | mov al, ALLOCA_FILLER_BYTE
|
---|
289 | mov xDI, xCX ; entry pointer
|
---|
290 | mov xCX, xDX ; entry size (in bytes)
|
---|
291 | rep stosb
|
---|
292 |
|
---|
293 | %if ARCH_BITS == 64
|
---|
294 | mov rdi, r10
|
---|
295 | %else
|
---|
296 | pop xCX
|
---|
297 | pop xDI
|
---|
298 | %endif
|
---|
299 |
|
---|
300 | ;
|
---|
301 | ; Fill in the entry and link it as onto the head of the chain.
|
---|
302 | ;
|
---|
303 | %if ARCH_BITS == 64
|
---|
304 | mov [r11 + RTC_ALLOCA_ENTRY_T.cb], xDX
|
---|
305 | mov xAX, [r8]
|
---|
306 | mov [r11 + RTC_ALLOCA_ENTRY_T.pNext], xAX
|
---|
307 | mov [r8], r11
|
---|
308 | %else
|
---|
309 | mov [xCX + RTC_ALLOCA_ENTRY_T.cb], xDX
|
---|
310 | mov xAX, [xSP + xCB] ; ppHead
|
---|
311 | mov xDX, [xAX]
|
---|
312 | mov [xCX + RTC_ALLOCA_ENTRY_T.pNext], xDX
|
---|
313 | mov [xAX], xCX
|
---|
314 | %endif
|
---|
315 |
|
---|
316 | .return:
|
---|
317 | %if ARCH_BITS == 64
|
---|
318 | ret
|
---|
319 | %else
|
---|
320 | ret 4
|
---|
321 | %endif
|
---|
322 | ENDPROC FASTCALL_NAME(_RTC_AllocaHelper, 12)
|
---|
323 |
|
---|
324 |
|
---|
325 | ;;
|
---|
326 | ; Checks if the secuity cookie ok, complaining and terminating if it isn't.
|
---|
327 | ;
|
---|
328 | ALIGNCODE(16)
|
---|
329 | BEGINPROC FASTCALL_NAME(__security_check_cookie, 4)
|
---|
330 | cmp xCX, [NAME(__security_cookie) xWrtRIP]
|
---|
331 | jne .corrupted
|
---|
332 | ;; amd64 version checks if the top 16 bits are zero, we skip that for now.
|
---|
333 | ret
|
---|
334 |
|
---|
335 | .corrupted:
|
---|
336 | %ifdef RT_ARCH_AMD64
|
---|
337 | jmp NAME(_RTC_SecurityCookieMismatch)
|
---|
338 | %else
|
---|
339 | push ebp
|
---|
340 | mov ebp, esp
|
---|
341 | push ecx
|
---|
342 | call NAME(_RTC_SecurityCookieMismatch)
|
---|
343 | pop ecx
|
---|
344 | leave
|
---|
345 | ret
|
---|
346 | %endif
|
---|
347 | ENDPROC FASTCALL_NAME(__security_check_cookie, 4)
|
---|
348 |
|
---|
349 |
|
---|
350 |
|
---|
351 | ; Not stack related stubs.
|
---|
352 | BEGINPROC __C_specific_handler
|
---|
353 | int3
|
---|
354 | ENDPROC __C_specific_handler
|
---|
355 |
|
---|
356 |
|
---|
357 | BEGINPROC __report_rangecheckfailure
|
---|
358 | int3
|
---|
359 | ENDPROC __report_rangecheckfailure
|
---|
360 |
|
---|