Make validator require read sandboxing on ARM.

src/trusted/validator_arm/validator.cc

 /*
- * Copyright 2009 The Native Client Authors.  All rights reserved.
- * Use of this source code is governed by a BSD-style license that can
- * be found in the LICENSE file.
- * Copyright 2009, Google Inc.
+ * Copyright (c) 2011 The Native Client Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
  */
 
 #include "native_client/src/trusted/service_runtime/nacl_config.h"
 #include "native_client/src/trusted/validator_arm/validator.h"
 #include "native_client/src/include/nacl_macros.h"
 
 using nacl_arm_dec::Instruction;
 using nacl_arm_dec::ClassDecoder;
 using nacl_arm_dec::Register;
 using nacl_arm_dec::RegisterList;
@@ skipping 16 matching lines @@
 enum PatternMatch {
   // The pattern does not apply to the instructions it was given.
   NO_MATCH,
   // The pattern matches, and is safe; do not allow jumps to split it.
   PATTERN_SAFE,
   // The pattern matches, and has detected a problem.
   PATTERN_UNSAFE
 };
 
 /*
- * Ensures that all stores use a safe base address.  A base address is safe if
- * it
+ * Ensures that all loads/stores use a safe base address.  A base address is
+ * safe if it
  *     1. Has specific bits masked off by its immediate predecessor, or
  *     2. Is predicated on those bits being clear, as tested by its immediate
  *        predecessor, or
  *     3. Is in a register defined as always containing a safe address.
  *
  * This pattern concerns itself with case #1, early-exiting if it finds #2.
  */
-static PatternMatch check_store_mask(const SfiValidator &sfi,
-                                     const DecodedInstruction &first,
-                                     const DecodedInstruction &second,
-                                     ProblemSink *out) {
-  if (second.base_address_register() == kRegisterNone /* not a store */
+static PatternMatch check_loadstore_mask(const SfiValidator &sfi,
+                                         const DecodedInstruction &first,
+                                         const DecodedInstruction &second,
+                                         ProblemSink *out) {
+  if (second.base_address_register() == kRegisterNone /* not a load/store */
       || sfi.is_data_address_register(second.base_address_register())) {
     return NO_MATCH;
   }
 
+  if (second.base_address_register() == kRegisterPc
+      && second.offset_is_immediate()) {
+    /* PC + immediate addressing is always safe. */
+    return PATTERN_SAFE;
+  }
+
   if (first.defines(second.base_address_register())
       && first.clears_bits(sfi.data_address_mask())
       && first.always_precedes(second)) {
     return PATTERN_SAFE;
   }
 
   if (first.sets_Z_if_bits_clear(second.base_address_register(),
                                  sfi.data_address_mask())
       && second.is_conditional_on(first)) {
     return PATTERN_SAFE;
   }
 
-  out->report_problem(second.addr(), second.safety(), kProblemUnsafeStore);
+  out->report_problem(second.addr(), second.safety(), kProblemUnsafeLoadStore);
   return PATTERN_UNSAFE;
 }
 
 /*
  * Ensures that all indirect branches use a safe destination address.  A
  * destination address is safe if it has specific bits masked off by its
  * immediate predecessor.
  */
 static PatternMatch check_branch_mask(const SfiValidator &sfi,
                                       const DecodedInstruction &first,
@@ skipping 283 matching lines @@
 bool SfiValidator::apply_patterns(const DecodedInstruction &first,
     const DecodedInstruction &second, AddressSet *critical, ProblemSink *out) {
   // Type for two-instruction pattern functions
   typedef PatternMatch (*TwoInstPattern)(const SfiValidator &,
                                          const DecodedInstruction &first,
                                          const DecodedInstruction &second,
                                          ProblemSink *out);
 
   // The list of patterns -- defined in static functions up top.
   static const TwoInstPattern two_inst_patterns[] = {
-    &check_store_mask,
+    &check_loadstore_mask,
     &check_branch_mask,
     &check_data_register_update,
   };
 
   bool complete_success = true;
 
   for (uint32_t i = 0; i < NACL_ARRAY_SIZE(two_inst_patterns); i++) {
     PatternMatch r = two_inst_patterns[i](*this, first, second, out);
     switch (r) {
       case NO_MATCH: break;
@@ skipping 40 matching lines @@
                                        Instruction inst,
                                        const ClassDecoder &decoder)
     : vaddr_(vaddr),
       inst_(inst),
       decoder_(&decoder),
       safety_(decoder.safety(inst_)),
       defs_(decoder.defs(inst_))
 {}
 
 }  // namespace