Make validator require read sandboxing on ARM.

src/trusted/validator_arm/testdata/test_loads.S

Index: src/trusted/validator_arm/testdata/test_loads.S
===================================================================
--- src/trusted/validator_arm/testdata/test_loads.S	(revision 0)
+++ src/trusted/validator_arm/testdata/test_loads.S	(revision 0)
@@ -0,0 +1,68 @@
+@ Copyright (c) 2011 The Native Client Authors. All rights reserved.
+@ Use of this source code is governed by a BSD-style license that can be
+@ found in the LICENSE file.
+
+@
+@ Tests both legal and illegal variations on loads -- both loads that
+@ require masking, and loads that are guaranteed sandboxed (i.e. through SP)
+@
+
+@ we restrict loads to the lower 1GB of the address space
+#define MASK 0xc0000000
+
+.globl _start
+_start:
+  .align 4
+
+bundle0:

[robertm, 2011/10/18 21:19:55]

maybe add some pc and sp loads

[sehr (please use chromium), 2011/10/18 22:44:11]

Done.

+  bic r1, r3, #MASK       @ Generating a confined address
+  ldr r0, [r1]            @ and storing to it is fine.
+
+  bic r1, r1, #MASK       @ Confining an address in place

[robertm, 2011/10/18 21:19:55]

not sure whether those are tested elsewhere but

ldr r0, [r1,r2] 
should also be covered 

[sehr (please use chromium), 2011/10/18 22:44:11]

Done.

+  ldr r0, [r1]            @ and storing to it is fine.
+
+bundle1:
+  mov r1, r3              @ Just poking at the address
+  ldr r0, [r1]            @ and storing to it is an ERROR.
+
+  bic r1, r3, #0          @ Even if we use BIC, if the mask is wrong,
+  ldr r0, [r1]            @ still an ERROR.
+
+bundle2:
+  nop
+  nop
+  nop
+  bic r1, r3, #MASK       @ If the BIC is in a different bundle...
+
+bundle3:
+  ldr r0, [r1]            @ ...then the loads is an ERROR.
+  nop
+
+  biceq r2, r2, #0xC0000000 @ Mask a register and
+  ldrexeq r0, [r2]        @ use it in a load-exclusive.  Should pass.
+
+bundle4:
+  bic r2, r2, #0          @ Mask incorrectly and
+  ldrex r0, [r2]          @ use it in a load-exclusive, for an ERROR.
+
+  nop
+  nop
+
+bundle5:
+  bic r0, r0, #0xC0000000 @ Mask a register, and
+  ldr r1, [r0], r2        @ use it in register post-index load: should pass.
+  nop                     @ Don't mask, and
+  ldr r1, [r0], r2        @ use it in register post-index load: ERROR.
+
+conditional_sandbox:
+  tst r0, #0xC0000000     @ Set Z if the top two bits are clear, and
+  ldreq r1, [r0]          @ load: should work.
+
+  tst r0, #0xC0000000     @ Set Z if the top two bits are clear, and
+  ldr r1, [r0]            @ load unconditionally: ERROR.
+
+  tst r0, #0xC0000000     @ Set Z if the top two bits are clear, and
+  ldrgt r1, [r0]          @ load using wrong predicate: ERROR.
+
+  tsteq r0, #0xC0000000   @ Conditionally set Z if the top two bits are clear,
+  ldrgt r1, [r0]          @ and load using wrong predicate: ERROR.