Subzero. ARM32. Implements sandboxing.

src/IceTargetLoweringARM32.cpp

 //===- subzero/src/IceTargetLoweringARM32.cpp - ARM32 lowering ------------===//
 //
 //                        The Subzero Code Generator
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 ///
 /// \file
@@ skipping 143 matching lines @@
   if (Flags.getTargetInstructionSet() !=
       TargetInstructionSet::BaseInstructionSet) {
     InstructionSet = static_cast<ARM32InstructionSet>(
         (Flags.getTargetInstructionSet() -
          TargetInstructionSet::ARM32InstructionSet_Begin) +
         ARM32InstructionSet::Begin);
   }
 }
 
 TargetARM32::TargetARM32(Cfg *Func)
-    : TargetLowering(Func), CPUFeatures(Func->getContext()->getFlags()) {}
+    : TargetLowering(Func), NeedSandboxing(Ctx->getFlags().getUseSandboxing()),
+      CPUFeatures(Func->getContext()->getFlags()) {}
 
 void TargetARM32::staticInit() {
   // Limit this size (or do all bitsets need to be the same width)???
   llvm::SmallBitVector IntegerRegisters(RegARM32::Reg_NUM);
   llvm::SmallBitVector I64PairRegisters(RegARM32::Reg_NUM);
   llvm::SmallBitVector Float32Registers(RegARM32::Reg_NUM);
   llvm::SmallBitVector Float64Registers(RegARM32::Reg_NUM);
   llvm::SmallBitVector VectorRegisters(RegARM32::Reg_NUM);
   llvm::SmallBitVector InvalidRegisters(RegARM32::Reg_NUM);
   ScratchRegs.resize(RegARM32::Reg_NUM);
@@ skipping 362 matching lines @@
       auto *Call = InstCall::create(Func, MaxArgs, NoDest, TargetHelper,
                                     NoTailCall, IsTargetHelperCall);
       Call->addArg(IntrinsicCall->getArg(0));
       Call->addArg(ValExt);
       Call->addArg(IntrinsicCall->getArg(2));
       Context.insert(Call);
       Instr->setDeleted();
       return;
     }
     case Intrinsics::NaClReadTP: {
-      if (Ctx->getFlags().getUseSandboxing()) {
-        UnimplementedError(Func->getContext()->getFlags());
+      if (NeedSandboxing) {
         return;
       }
       static constexpr SizeT MaxArgs = 0;
       Operand *TargetHelper = Ctx->getConstantExternSym(H_call_read_tp);
       auto *Call = InstCall::create(Func, MaxArgs, Dest, TargetHelper,
                                     NoTailCall, IsTargetHelperCall);
       Context.insert(Call);
       Instr->setDeleted();
       return;
     }
@@ skipping 554 matching lines @@
     CalleeSaves[RegARM32::Reg_lr] = true;
     RegsUsed[RegARM32::Reg_lr] = true;
   }
   for (SizeT i = 0; i < CalleeSaves.size(); ++i) {
     if (RegARM32::isI64RegisterPair(i)) {
       // We don't save register pairs explicitly. Instead, we rely on the code
       // fake-defing/fake-using each register in the pair.
       continue;
     }
     if (CalleeSaves[i] && RegsUsed[i]) {
+      if (NeedSandboxing && i == RegARM32::Reg_r9) {
+        // r9 is never updated in sandboxed code.
+        continue;
+      }
       ++NumCallee;
       Variable *PhysicalRegister = getPhysicalRegister(i);
       PreservedRegsSizeBytes +=
           typeWidthInBytesOnStack(PhysicalRegister->getType());
       GPRsToPreserve.push_back(getPhysicalRegister(i));
     }
   }
   Ctx->statsUpdateRegistersSaved(NumCallee);
   if (!GPRsToPreserve.empty())
     _push(GPRsToPreserve);
@@ skipping 33 matching lines @@
   }
 
   // Combine fixed alloca with SpillAreaSize.
   SpillAreaSizeBytes += FixedAllocaSizeBytes;
 
   // Generate "sub sp, SpillAreaSizeBytes"
   if (SpillAreaSizeBytes) {
     // Use the scratch register if needed to legalize the immediate.
     Operand *SubAmount = legalize(Ctx->getConstantInt32(SpillAreaSizeBytes),
                                   Legal_Reg | Legal_Flex, getReservedTmpReg());
-    Variable *SP = getPhysicalRegister(RegARM32::Reg_sp);
-    _sub(SP, SP, SubAmount);
+    AutoSandboxer(this).sub_sp(SubAmount);
     if (FixedAllocaAlignBytes > ARM32_STACK_ALIGNMENT_BYTES) {
-      alignRegisterPow2(SP, FixedAllocaAlignBytes);
+      AutoSandboxer(this).align_sp(FixedAllocaAlignBytes);
     }
   }
 
   Ctx->statsUpdateFrameBytes(SpillAreaSizeBytes);
 
   // Fill in stack offsets for stack args, and copy args into registers for
   // those that were register-allocated. Args are pushed right to left, so
   // Arg[0] is closest to the stack/frame pointer.
   Variable *FramePtr = getPhysicalRegister(getFrameOrStackReg());
   size_t BasicFrameOffset = PreservedRegsSizeBytes;
@@ skipping 73 matching lines @@
   Context.init(Node);
   Context.setInsertPoint(InsertPoint);
 
   Variable *SP = getPhysicalRegister(RegARM32::Reg_sp);
   if (UsesFramePointer) {
     Variable *FP = getPhysicalRegister(RegARM32::Reg_fp);
     // For late-stage liveness analysis (e.g. asm-verbose mode), adding a fake
     // use of SP before the assignment of SP=FP keeps previous SP adjustments
     // from being dead-code eliminated.
     Context.insert(InstFakeUse::create(Func, SP));
-    _mov(SP, FP);
+    AutoSandboxer(this).reset_sp(FP);
   } else {
     // add SP, SpillAreaSizeBytes
     if (SpillAreaSizeBytes) {
       // Use the scratch register if needed to legalize the immediate.
       Operand *AddAmount =
           legalize(Ctx->getConstantInt32(SpillAreaSizeBytes),
                    Legal_Reg | Legal_Flex, getReservedTmpReg());
-      _add(SP, SP, AddAmount);
+      AutoSandboxer(this).add_sp(AddAmount);
     }
   }
 
   // Add pop instructions for preserved registers.
   llvm::SmallBitVector CalleeSaves =
       getRegisterSet(RegSet_CalleeSave, RegSet_None);
   VarList GPRsToRestore;
   GPRsToRestore.reserve(CalleeSaves.size());
   // Consider FP and LR as callee-save / used as needed.
   if (UsesFramePointer) {
     CalleeSaves[RegARM32::Reg_fp] = true;
   }
   if (!MaybeLeafFunc) {
     CalleeSaves[RegARM32::Reg_lr] = true;
   }
   // Pop registers in ascending order just like push (instead of in reverse
   // order).
   for (SizeT i = 0; i < CalleeSaves.size(); ++i) {
     if (RegARM32::isI64RegisterPair(i)) {
       continue;
     }
 
     if (CalleeSaves[i] && RegsUsed[i]) {
+      if (NeedSandboxing && i == RegARM32::Reg_r9) {
+        continue;
+      }
       GPRsToRestore.push_back(getPhysicalRegister(i));
     }
   }
   if (!GPRsToRestore.empty())
     _pop(GPRsToRestore);
 
   if (!Ctx->getFlags().getUseSandboxing())
     return;
 
   // Change the original ret instruction into a sandboxed return sequence.
   // bundle_lock
   // bic lr, #0xc000000f
   // bx lr
   // bundle_unlock
   // This isn't just aligning to the getBundleAlignLog2Bytes(). It needs to
   // restrict to the lower 1GB as well.
-  Operand *RetMask =
-      legalize(Ctx->getConstantInt32(0xc000000f), Legal_Reg | Legal_Flex);
-  Variable *LR = makeReg(IceType_i32, RegARM32::Reg_lr);
+  Variable *LR = getPhysicalRegister(RegARM32::Reg_lr);
   Variable *RetValue = nullptr;
   if (RI->getSrcSize())
     RetValue = llvm::cast<Variable>(RI->getSrc(0));
-  _bundle_lock();
-  _bic(LR, LR, RetMask);
-  _ret(LR, RetValue);
-  _bundle_unlock();
+
+  AutoSandboxer(this).ret(LR, RetValue);
+
   RI->setDeleted();
 }
 
 bool TargetARM32::isLegalMemOffset(Type Ty, int32_t Offset) const {
   constexpr bool ZeroExt = false;
   return OperandARM32Mem::canHoldOffset(Ty, ZeroExt, Offset);
 }
 
 Variable *TargetARM32::PostLoweringLegalizer::newBaseRegister(
     Variable *Base, int32_t Offset, int32_t ScratchRegNum) {
@@ skipping 30 matching lines @@
       TempBaseOffset = 0;
     }
   }
 
   return ScratchReg;
 }
 
 OperandARM32Mem *TargetARM32::PostLoweringLegalizer::createMemOperand(
     Type Ty, Variable *Base, int32_t Offset, bool AllowOffsets) {
   assert(!Base->isRematerializable());
-  if (AllowOffsets && Target->isLegalMemOffset(Ty, Offset)) {
+  if (Offset == 0 || (AllowOffsets && Target->isLegalMemOffset(Ty, Offset))) {
     return OperandARM32Mem::create(
         Target->Func, Ty, Base,
         llvm::cast<ConstantInteger32>(Target->Ctx->getConstantInt32(Offset)),
         OperandARM32Mem::Offset);
   }
 
   if (!AllowOffsets || TempBaseReg == nullptr) {
     newBaseRegister(Base, Offset, Target->getReservedTmpReg());
   }
 
@@ skipping 52 matching lines @@
   if (MovInstr->isMultiDest() || MovInstr->isMultiSource())
     return;
 
   bool Legalized = false;
   if (!Dest->hasReg()) {
     auto *SrcR = llvm::cast<Variable>(Src);
     assert(SrcR->hasReg());
     assert(!SrcR->isRematerializable());
     const int32_t Offset = Dest->getStackOffset();
     // This is a _mov(Mem(), Variable), i.e., a store.
-    Target->_str(SrcR, createMemOperand(DestTy, StackOrFrameReg, Offset),
-                 MovInstr->getPredicate());
+    TargetARM32::AutoSandboxer(Target)
+        .str(SrcR, createMemOperand(DestTy, StackOrFrameReg, Offset),
+             MovInstr->getPredicate());
     // _str() does not have a Dest, so we add a fake-def(Dest).
     Target->Context.insert(InstFakeDef::create(Target->Func, Dest));
     Legalized = true;
   } else if (auto *Var = llvm::dyn_cast<Variable>(Src)) {
     if (Var->isRematerializable()) {
       // This is equivalent to an x86 _lea(RematOffset(%esp/%ebp), Variable).
 
       // ExtraOffset is only needed for frame-pointer based frames as we have
       // to account for spill storage.
       const int32_t ExtraOffset =
           (static_cast<SizeT>(Var->getRegNum()) == Target->getFrameReg())
               ? Target->getFrameFixedAllocaOffset()
               : 0;
 
       const int32_t Offset = Var->getStackOffset() + ExtraOffset;
       Variable *Base = Target->getPhysicalRegister(Var->getRegNum());
       Variable *T = newBaseRegister(Base, Offset, Dest->getRegNum());
       Target->_mov(Dest, T);
       Legalized = true;
     } else {
       if (!Var->hasReg()) {
         // This is a _mov(Variable, Mem()), i.e., a load.
         const int32_t Offset = Var->getStackOffset();
-        Target->_ldr(Dest, createMemOperand(DestTy, StackOrFrameReg, Offset),
-                     MovInstr->getPredicate());
+        TargetARM32::AutoSandboxer(Target)
+            .ldr(Dest, createMemOperand(DestTy, StackOrFrameReg, Offset),
+                 MovInstr->getPredicate());
         Legalized = true;
       }
     }
   }
 
   if (Legalized) {
     if (MovInstr->isDestRedefined()) {
       Target->_set_dest_redefined();
     }
     MovInstr->setDeleted();
@@ skipping 44 matching lines @@
     const int32_t ExtraOffset =
         (static_cast<SizeT>(Base->getRegNum()) == Target->getFrameReg())
             ? Target->getFrameFixedAllocaOffset()
             : 0;
     Offset += Base->getStackOffset() + ExtraOffset;
     Base = Target->getPhysicalRegister(Base->getRegNum());
     assert(!Base->isRematerializable());
     Legalized = true;
   }
 
-  if (!Legalized) {
+  if (!Legalized && !Target->NeedSandboxing) {
     return nullptr;
   }
 
   if (!Mem->isRegReg()) {
     return createMemOperand(Mem->getType(), Base, Offset, AllowOffsets);
   }
 
+  if (Target->NeedSandboxing) {
+    llvm::report_fatal_error("Reg-Reg address mode is not allowed.");
+  }
+
   assert(MemTraits[Mem->getType()].CanHaveIndex);
 
   if (Offset != 0) {
     if (TempBaseReg == nullptr) {
       Base = newBaseRegister(Base, Offset, Target->getReservedTmpReg());
     } else {
       uint32_t Imm8, Rotate;
       const int32_t OffsetDiff = Offset - TempBaseOffset;
       if (OffsetDiff == 0) {
         Base = TempBaseReg;
@@ skipping 51 matching lines @@
       Inst *CurInstr = Context.getCur();
 
       // Check if the previous TempBaseReg is clobbered, and reset if needed.
       Legalizer.resetTempBaseIfClobberedBy(CurInstr);
 
       if (auto *MovInstr = llvm::dyn_cast<InstARM32Mov>(CurInstr)) {
         Legalizer.legalizeMov(MovInstr);
       } else if (auto *LdrInstr = llvm::dyn_cast<InstARM32Ldr>(CurInstr)) {
         if (OperandARM32Mem *LegalMem = Legalizer.legalizeMemOperand(
                 llvm::cast<OperandARM32Mem>(LdrInstr->getSrc(0)))) {
-          _ldr(CurInstr->getDest(), LegalMem, LdrInstr->getPredicate());
+          AutoSandboxer(this)
+              .ldr(CurInstr->getDest(), LegalMem, LdrInstr->getPredicate());
           CurInstr->setDeleted();
         }
       } else if (auto *LdrexInstr = llvm::dyn_cast<InstARM32Ldrex>(CurInstr)) {
         constexpr bool DisallowOffsetsBecauseLdrex = false;
         if (OperandARM32Mem *LegalMem = Legalizer.legalizeMemOperand(
                 llvm::cast<OperandARM32Mem>(LdrexInstr->getSrc(0)),
                 DisallowOffsetsBecauseLdrex)) {
-          _ldrex(CurInstr->getDest(), LegalMem, LdrexInstr->getPredicate());
+          AutoSandboxer(this)
+              .ldrex(CurInstr->getDest(), LegalMem, LdrexInstr->getPredicate());
           CurInstr->setDeleted();
         }
       } else if (auto *StrInstr = llvm::dyn_cast<InstARM32Str>(CurInstr)) {
+        AutoSandboxer Bundle(this);
         if (OperandARM32Mem *LegalMem = Legalizer.legalizeMemOperand(
                 llvm::cast<OperandARM32Mem>(StrInstr->getSrc(1)))) {
-          _str(llvm::cast<Variable>(CurInstr->getSrc(0)), LegalMem,
-               StrInstr->getPredicate());
+          AutoSandboxer(this).str(llvm::cast<Variable>(CurInstr->getSrc(0)),
+                                  LegalMem, StrInstr->getPredicate());
           CurInstr->setDeleted();
         }
       } else if (auto *StrexInstr = llvm::dyn_cast<InstARM32Strex>(CurInstr)) {
         constexpr bool DisallowOffsetsBecauseStrex = false;
         if (OperandARM32Mem *LegalMem = Legalizer.legalizeMemOperand(
                 llvm::cast<OperandARM32Mem>(StrexInstr->getSrc(1)),
                 DisallowOffsetsBecauseStrex)) {
-          _strex(CurInstr->getDest(), llvm::cast<Variable>(CurInstr->getSrc(0)),
-                 LegalMem, StrexInstr->getPredicate());
+          AutoSandboxer(this).strex(CurInstr->getDest(),
+                                    llvm::cast<Variable>(CurInstr->getSrc(0)),
+                                    LegalMem, StrexInstr->getPredicate());
           CurInstr->setDeleted();
         }
       }
 
       // Sanity-check: the Legalizer will either have no Temp, or it will be
       // bound to IP.
       Legalizer.assertNoTempOrAssignedToIP();
     }
   }
 }
@@ skipping 137 matching lines @@
   const bool OptM1 = Ctx->getFlags().getOptLevel() == Opt_m1;
   const bool AllocaWithKnownOffset = Inst->getKnownFrameOffset();
   const bool UseFramePointer =
       hasFramePointer() || OverAligned || !AllocaWithKnownOffset || OptM1;
 
   if (UseFramePointer)
     setHasFramePointer();
 
   Variable *SP = getPhysicalRegister(RegARM32::Reg_sp);
   if (OverAligned) {
-    alignRegisterPow2(SP, Alignment);
+    AutoSandboxer(this).align_sp(Alignment);
   }
 
   Variable *Dest = Inst->getDest();
   Operand *TotalSize = Inst->getSizeInBytes();
 
   if (const auto *ConstantTotalSize =
           llvm::dyn_cast<ConstantInteger32>(TotalSize)) {
     const uint32_t Value =
         Utils::applyAlignment(ConstantTotalSize->getValue(), Alignment);
     // Constant size alloca.
     if (!UseFramePointer) {
       // If we don't need a Frame Pointer, this alloca has a known offset to the
       // stack pointer. We don't need adjust the stack pointer, nor assign any
       // value to Dest, as Dest is rematerializable.
       assert(Dest->isRematerializable());
       FixedAllocaSizeBytes += Value;
       Context.insert(InstFakeDef::create(Func, Dest));
       return;
     }
 
     // If a frame pointer is required, then we need to store the alloca'd result
     // in Dest.
     Operand *SubAmountRF =
         legalize(Ctx->getConstantInt32(Value), Legal_Reg | Legal_Flex);
-    _sub(SP, SP, SubAmountRF);
+    AutoSandboxer(this).sub_sp(SubAmountRF);
   } else {
     // Non-constant sizes need to be adjusted to the next highest multiple of
     // the required alignment at runtime.
     TotalSize = legalize(TotalSize, Legal_Reg | Legal_Flex);
     Variable *T = makeReg(IceType_i32);
     _mov(T, TotalSize);
     Operand *AddAmount = legalize(Ctx->getConstantInt32(Alignment - 1));
     _add(T, T, AddAmount);
     alignRegisterPow2(T, Alignment);
-    _sub(SP, SP, T);
+    AutoSandboxer(this).sub_sp(T);
   }
 
   // Adds back a few bytes to SP to account for the out args area.
   Variable *T = SP;
   if (MaxOutArgsSizeBytes != 0) {
     T = makeReg(getPointerType());
     Operand *OutArgsSizeRF = legalize(
         Ctx->getConstantInt32(MaxOutArgsSizeBytes), Legal_Reg | Legal_Flex);
     _add(T, SP, OutArgsSizeRF);
   }
@@ skipping 1390 matching lines @@
     case IceType_v8i1:
     case IceType_v16i1:
     case IceType_v16i8:
     case IceType_v8i16:
     case IceType_v4i32:
     case IceType_v4f32:
       ReturnReg = makeReg(Dest->getType(), RegARM32::Reg_q0);
       break;
     }
   }
-  // TODO(jvoung): Handle sandboxing. const bool NeedSandboxing =
-  // Ctx->getFlags().getUseSandboxing();
 
   // Allow ConstantRelocatable to be left alone as a direct call, but force
   // other constants like ConstantInteger32 to be in a register and make it an
   // indirect call.
   if (!llvm::isa<ConstantRelocatable>(CallTarget)) {
     CallTarget = legalize(CallTarget, Legal_Reg);
   }
 
   // Copy arguments to be passed in registers to the appropriate registers.
   for (auto &FPArg : FPArgs) {
     Variable *Reg = legalizeToReg(FPArg.first, FPArg.second);
     Context.insert(InstFakeUse::create(Func, Reg));
   }
   for (auto &GPRArg : GPRArgs) {
     Variable *Reg = legalizeToReg(GPRArg.first, GPRArg.second);
     // Generate a FakeUse of register arguments so that they do not get dead
     // code eliminated as a result of the FakeKill of scratch registers after
     // the call.
     Context.insert(InstFakeUse::create(Func, Reg));
   }
-  Inst *NewCall = InstARM32Call::create(Func, ReturnReg, CallTarget);
-  Context.insert(NewCall);
+
+  InstARM32Call *NewCall = AutoSandboxer(this, InstBundleLock::Opt_AlignToEnd)
+                               .bl(ReturnReg, CallTarget);
+
   if (ReturnRegHi)
     Context.insert(InstFakeDef::create(Func, ReturnRegHi));
 
   // Insert a register-kill pseudo instruction.
   Context.insert(InstFakeKill::create(Func, NewCall));
 
   // Generate a FakeUse to keep the call live if necessary.
   if (Instr->hasSideEffects() && ReturnReg) {
     Inst *FakeUse = InstFakeUse::create(Func, ReturnReg);
     Context.insert(FakeUse);
@@ skipping 1319 matching lines @@
   case Intrinsics::Memcpy: {
     llvm::report_fatal_error("memcpy should have been prelowered.");
   }
   case Intrinsics::Memmove: {
     llvm::report_fatal_error("memmove should have been prelowered.");
   }
   case Intrinsics::Memset: {
     llvm::report_fatal_error("memmove should have been prelowered.");
   }
   case Intrinsics::NaClReadTP: {
-    llvm::report_fatal_error("nacl-read-tp should have been prelowered.");
+    if (!NeedSandboxing) {
+      llvm::report_fatal_error("nacl-read-tp should have been prelowered.");
+    }
+    Variable *TP = legalizeToReg(OperandARM32Mem::create(
+        Func, getPointerType(), getPhysicalRegister(RegARM32::Reg_r9),
+        llvm::cast<ConstantInteger32>(Ctx->getConstantZero(IceType_i32))));
+    _mov(Dest, TP);
+    return;
   }
   case Intrinsics::Setjmp: {
     llvm::report_fatal_error("setjmp should have been prelowered.");
   }
   case Intrinsics::Sqrt: {
     Variable *Src = legalizeToReg(Instr->getArg(0));
     Variable *T = makeReg(Dest->getType());
     _vsqrt(T, Src);
     _mov(Dest, T);
     return;
   }
   case Intrinsics::Stacksave: {
     Variable *SP = getPhysicalRegister(RegARM32::Reg_sp);
     _mov(Dest, SP);
     return;
   }
   case Intrinsics::Stackrestore: {
-    Variable *SP = getPhysicalRegister(RegARM32::Reg_sp);
-    Operand *Val = legalize(Instr->getArg(0), Legal_Reg | Legal_Flex);
-    _mov_redefined(SP, Val);
+    Variable *Val = legalizeToReg(Instr->getArg(0));
+    AutoSandboxer(this).reset_sp(Val);
     return;
   }
   case Intrinsics::Trap:
     _trap();
     return;
   case Intrinsics::UnknownIntrinsic:
     Func->setError("Should not be lowering UnknownIntrinsic");
     return;
   }
   return;
@@ skipping 334 matching lines @@
     // "[reg]" addressing mode (the other supported modes are write back.)
     return nullptr;
 
   auto *BaseVar = llvm::dyn_cast<Variable>(Base);
   if (BaseVar == nullptr)
     return nullptr;
 
   (void)MemTraitsSize;
   assert(Ty < MemTraitsSize);
   auto *TypeTraits = &MemTraits[Ty];
-  const bool CanHaveIndex = TypeTraits->CanHaveIndex;
-  const bool CanHaveShiftedIndex = TypeTraits->CanHaveShiftedIndex;
+  const bool CanHaveIndex = !NeedSandboxing && TypeTraits->CanHaveIndex;
+  const bool CanHaveShiftedIndex =
+      !NeedSandboxing && TypeTraits->CanHaveShiftedIndex;
   const bool CanHaveImm = TypeTraits->CanHaveImm;
   const int32_t ValidImmMask = TypeTraits->ValidImmMask;
   (void)ValidImmMask;
   assert(!CanHaveImm || ValidImmMask >= 0);
 
   const VariablesMetadata *VMetadata = Func->getVMetadata();
   const Inst *Reason = nullptr;
 
   do {
     if (Reason != nullptr) {
@@ skipping 150 matching lines @@
     } else {
       Operand *Src0F = legalize(Src0, Legal_Reg | Legal_Flex);
       Reg = makeReg(Src0F->getType(), RegARM32::Reg_r0);
       _mov(Reg, Src0F, CondARM32::AL);
     }
   }
   // Add a ret instruction even if sandboxing is enabled, because addEpilog
   // explicitly looks for a ret instruction as a marker for where to insert the
   // frame removal instructions. addEpilog is responsible for restoring the
   // "lr" register as needed prior to this ret instruction.
   _ret(getPhysicalRegister(RegARM32::Reg_lr), Reg);

[Karl, 2015/12/04 20:41:17]

Indentation wrong?

[John, 2015/12/05 16:20:11]

where, the _ret? seems fine to me (there's an underscore that is a leading
underscore that is hard to see in the diffs.)

+
   // Add a fake use of sp to make sure sp stays alive for the entire function.
   // Otherwise post-call sp adjustments get dead-code eliminated.
   // TODO: Are there more places where the fake use should be inserted? E.g.
   // "void f(int n){while(1) g(n);}" may not have a ret instruction.
   Variable *SP = getPhysicalRegister(RegARM32::Reg_sp);
   Context.insert(InstFakeUse::create(Func, SP));
 }
 
 void TargetARM32::lowerSelect(const InstSelect *Inst) {
   Variable *Dest = Inst->getDest();
@@ skipping 732 matching lines @@
 
     // Mark as "dead" rather than outright deleting. This is so that other
     // peephole style optimizations during or before lowering have access to
     // this instruction in undeleted form. See for example
     // tryOptimizedCmpxchgCmpBr().
     Iter->second.Instr->setDead();
     ++Iter;
   }
 }
 
+TargetARM32::AutoSandboxer::AutoSandboxer(TargetARM32 *Target,
+                                          InstBundleLock::Option BundleOption)
+    : Target(Target) {
+  if (Target->NeedSandboxing) {
+    Target->_bundle_lock(BundleOption);
+  }
+}
+
+TargetARM32::AutoSandboxer::~AutoSandboxer() {
+  if (Target->NeedSandboxing) {
+    Target->_bundle_unlock();
+  }
+}
+
+namespace {
+OperandARM32FlexImm *indirectBranchBicMask(Cfg *Func) {
+  constexpr uint32_t Imm8 = 0xFC; // 0xC000000F
+  constexpr uint32_t RotateAmt = 2;
+  return OperandARM32FlexImm::create(Func, IceType_i32, Imm8, RotateAmt);
+}
+
+OperandARM32FlexImm *memOpBicMask(Cfg *Func) {
+  constexpr uint32_t Imm8 = 0x0C; // 0xC0000000
+  constexpr uint32_t RotateAmt = 2;
+  return OperandARM32FlexImm::create(Func, IceType_i32, Imm8, RotateAmt);
+}

[Karl, 2015/12/04 20:41:17]

Add blank line?

[John, 2015/12/05 16:20:11]

Done.

+static bool baseNeedsBic(Variable *Base) {
+  return Base->getRegNum() != RegARM32::Reg_r9 &&
+         Base->getRegNum() != RegARM32::Reg_sp;
+}
+} // end of anonymous namespace
+
+void TargetARM32::AutoSandboxer::add_sp(Operand *AddAmount) {
+  Variable *SP = Target->getPhysicalRegister(RegARM32::Reg_sp);
+  Target->_add(SP, SP, AddAmount);
+  if (Target->NeedSandboxing) {
+    Target->_bic(SP, SP, memOpBicMask(Target->Func));
+  }
+}
+
+void TargetARM32::AutoSandboxer::align_sp(size_t Alignment) {
+  Variable *SP = Target->getPhysicalRegister(RegARM32::Reg_sp);
+  Target->alignRegisterPow2(SP, Alignment);
+  if (Target->NeedSandboxing) {
+    Target->_bic(SP, SP, memOpBicMask(Target->Func));
+  }
+}
+
+InstARM32Call *TargetARM32::AutoSandboxer::bl(Variable *ReturnReg,
+                                              Operand *CallTarget) {
+  if (Target->NeedSandboxing) {
+    if (auto *CallTargetR = llvm::dyn_cast<Variable>(CallTarget)) {
+      Target->_bic(CallTargetR, CallTargetR,
+                   indirectBranchBicMask(Target->Func));
+    }
+  }
+  auto *Call = InstARM32Call::create(Target->Func, ReturnReg, CallTarget);
+  Target->Context.insert(Call);
+  return Call;
+}
+
+void TargetARM32::AutoSandboxer::ldr(Variable *Dest, OperandARM32Mem *Mem,
+                                     CondARM32::Cond Pred) {
+  Variable *MemBase = Mem->getBase();
+  if (Target->NeedSandboxing && baseNeedsBic(MemBase)) {
+    assert(!Mem->isRegReg());
+    Target->_bic(MemBase, MemBase, memOpBicMask(Target->Func), Pred);
+  }
+  Target->_ldr(Dest, Mem, Pred);
+}
+
+void TargetARM32::AutoSandboxer::ldrex(Variable *Dest, OperandARM32Mem *Mem,
+                                       CondARM32::Cond Pred) {
+  Variable *MemBase = Mem->getBase();
+  if (Target->NeedSandboxing && baseNeedsBic(MemBase)) {
+    assert(!Mem->isRegReg());
+    Target->_bic(MemBase, MemBase, memOpBicMask(Target->Func), Pred);
+  }
+  Target->_ldrex(Dest, Mem, Pred);
+}
+
+void TargetARM32::AutoSandboxer::reset_sp(Variable *Src) {
+  Variable *SP = Target->getPhysicalRegister(RegARM32::Reg_sp);
+  Target->_mov_redefined(SP, Src);
+  if (Target->NeedSandboxing) {
+    Target->_bic(SP, SP, memOpBicMask(Target->Func));
+  }
+}
+
+void TargetARM32::AutoSandboxer::ret(Variable *RetAddr, Variable *RetValue) {
+  if (Target->NeedSandboxing) {
+    Target->_bic(RetAddr, RetAddr, indirectBranchBicMask(Target->Func));
+  }
+  Target->_ret(RetAddr, RetValue);
+}
+
+void TargetARM32::AutoSandboxer::str(Variable *Src, OperandARM32Mem *Mem,
+                                     CondARM32::Cond Pred) {
+  Variable *MemBase = Mem->getBase();
+  if (Target->NeedSandboxing && baseNeedsBic(MemBase)) {
+    assert(!Mem->isRegReg());
+    Target->_bic(MemBase, MemBase, memOpBicMask(Target->Func), Pred);
+  }
+  Target->_str(Src, Mem, Pred);
+}
+
+void TargetARM32::AutoSandboxer::strex(Variable *Dest, Variable *Src,
+                                       OperandARM32Mem *Mem,
+                                       CondARM32::Cond Pred) {
+  Variable *MemBase = Mem->getBase();
+  if (Target->NeedSandboxing && baseNeedsBic(MemBase)) {
+    assert(!Mem->isRegReg());
+    Target->_bic(MemBase, MemBase, memOpBicMask(Target->Func), Pred);
+  }
+  Target->_strex(Dest, Src, Mem, Pred);
+}
+
+void TargetARM32::AutoSandboxer::sub_sp(Operand *SubAmount) {
+  Variable *SP = Target->getPhysicalRegister(RegARM32::Reg_sp);
+  Target->_sub(SP, SP, SubAmount);
+  if (Target->NeedSandboxing) {
+    Target->_bic(SP, SP, memOpBicMask(Target->Func));
+  }
+}
+
 TargetDataARM32::TargetDataARM32(GlobalContext *Ctx)
     : TargetDataLowering(Ctx) {}
 
 void TargetDataARM32::lowerGlobals(const VariableDeclarationList &Vars,
                                    const IceString &SectionSuffix) {
   switch (Ctx->getFlags().getOutFileType()) {
   case FT_Elf: {
     ELFObjectWriter *Writer = Ctx->getObjectWriter();
     Writer->writeDataSection(Vars, llvm::ELF::R_ARM_ABS32, SectionSuffix);
   } break;
@@ skipping 175 matching lines @@
   // Technically R9 is used for TLS with Sandboxing, and we reserve it.
   // However, for compatibility with current NaCl LLVM, don't claim that.
   Str << ".eabi_attribute 14, 3   @ Tag_ABI_PCS_R9_use: Not used\n";
 }
 
 llvm::SmallBitVector TargetARM32::TypeToRegisterSet[IceType_NUM];
 llvm::SmallBitVector TargetARM32::RegisterAliases[RegARM32::Reg_NUM];
 llvm::SmallBitVector TargetARM32::ScratchRegs;
 
 } // end of namespace Ice