A mechanism to identify/forbid/"rewrite" non-temporal instructions (and other)

src/trusted/validator_ragel/dfa_validate_common.c

Index: src/trusted/validator_ragel/dfa_validate_common.c
diff --git a/src/trusted/validator_ragel/dfa_validate_common.c b/src/trusted/validator_ragel/dfa_validate_common.c
index 330a0ce2c44fc128ff1f7736740f2da3b9f0d80a..5358a65a4197644fc574da92956f6527a0e2f90c 100644
--- a/src/trusted/validator_ragel/dfa_validate_common.c
+++ b/src/trusted/validator_ragel/dfa_validate_common.c
@@ -33,16 +33,26 @@ Bool NaClDfaProcessValidationError(const uint8_t *begin, const uint8_t *end,
   return FALSE;
 }
 
-Bool NaClDfaStubOutCPUUnsupportedInstruction(const uint8_t *begin,
-                                             const uint8_t *end,
-                                             uint32_t info,
-                                             void *callback_data) {
+Bool NaClDfaStubOutUnsupportedInstruction(const uint8_t *begin,
+                                          const uint8_t *end,
+                                          uint32_t info,
+                                          void *callback_data) {
+  struct StubOutCallbackData *data = callback_data;
   /* Stub-out instructions unsupported on this CPU, but valid on other CPUs.  */
   if ((info & VALIDATION_ERRORS_MASK) == CPUID_UNSUPPORTED_INSTRUCTION) {
-    int *did_stubout = callback_data;
-    *did_stubout = 1;
+    data->did_rewrite = 1;
     memset((uint8_t *)begin, NACL_HALT_OPCODE, end - begin);
     return TRUE;
+  } else if ((info & VALIDATION_ERRORS_MASK) == UNSUPPORTED_INSTRUCTION) {
+    if (data->flags == DISABLE_UNSUPPORTED)
+      return FALSE;
+    else {
+      /* TODO(ruiq): rewrite instruction. For now, we keep the original
+       * instruction and indicate validation success, which is consistent
+       * with current validation results. */
+      data->did_rewrite = 0;
+      return TRUE;
+    }
   } else {
     return FALSE;
   }