Make validator require read sandboxing on ARM.

src/trusted/validator_arm/validator.cc

Index: src/trusted/validator_arm/validator.cc
===================================================================
--- src/trusted/validator_arm/validator.cc	(revision 6916)
+++ src/trusted/validator_arm/validator.cc	(working copy)
@@ -1,8 +1,7 @@
 /*
- * Copyright 2009 The Native Client Authors.  All rights reserved.
- * Use of this source code is governed by a BSD-style license that can
- * be found in the LICENSE file.
- * Copyright 2009, Google Inc.
+ * Copyright (c) 2011 The Native Client Authors. All rights reserved.
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
  */
 
 #include "native_client/src/trusted/service_runtime/nacl_config.h"
@@ -39,8 +38,8 @@
 };
 
 /*
- * Ensures that all stores use a safe base address.  A base address is safe if
- * it
+ * Ensures that all loads/stores use a safe base address.  A base address is
+ * safe if it
  *     1. Has specific bits masked off by its immediate predecessor, or
  *     2. Is predicated on those bits being clear, as tested by its immediate
  *        predecessor, or
@@ -48,15 +47,21 @@
  *
  * This pattern concerns itself with case #1, early-exiting if it finds #2.
  */
-static PatternMatch check_store_mask(const SfiValidator &sfi,
-                                     const DecodedInstruction &first,
-                                     const DecodedInstruction &second,
-                                     ProblemSink *out) {
-  if (second.base_address_register() == kRegisterNone /* not a store */
+static PatternMatch check_loadstore_mask(const SfiValidator &sfi,
+                                         const DecodedInstruction &first,
+                                         const DecodedInstruction &second,
+                                         ProblemSink *out) {
+  if (second.base_address_register() == kRegisterNone /* not a load/store */
       || sfi.is_data_address_register(second.base_address_register())) {
     return NO_MATCH;
   }
 
+  if (second.base_address_register() == kRegisterPc
+      && second.offset_is_immediate()) {
+    /* PC + immediate addressing is always safe. */
+    return PATTERN_SAFE;
+  }
+
   if (first.defines(second.base_address_register())
       && first.clears_bits(sfi.data_address_mask())
       && first.always_precedes(second)) {
@@ -69,7 +74,7 @@
     return PATTERN_SAFE;
   }
 
-  out->report_problem(second.addr(), second.safety(), kProblemUnsafeStore);
+  out->report_problem(second.addr(), second.safety(), kProblemUnsafeLoadStore);
   return PATTERN_UNSAFE;
 }
 
@@ -373,7 +378,7 @@
 
   // The list of patterns -- defined in static functions up top.
   static const TwoInstPattern two_inst_patterns[] = {
-    &check_store_mask,
+    &check_loadstore_mask,
     &check_branch_mask,
     &check_data_register_update,
   };