Subzero. ARM32. Implements sandboxing.

src/IceTargetLoweringARM32.h

 //===- subzero/src/IceTargetLoweringARM32.h - ARM32 lowering ----*- C++ -*-===//
 //
 //                        The Subzero Code Generator
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 ///
 /// \file
@@ skipping 804 matching lines @@
   // TODO(jpp): This could live in the Parser, if we provided a Target-specific
   // method that the Parser could call.
   void findMaxStackOutArgsSize();
 
   /// Returns true if the given Offset can be represented in a Load/Store Mem
   /// Operand.
   bool isLegalMemOffset(Type Ty, int32_t Offset) const;
 
   void postLowerLegalization();
 
+  /// Sandboxer defines methods for ensuring that "dangerous" operations are
+  /// masked during sandboxed code emission. For regular, non-sandboxed code
+  /// emission, its methods are simple pass-through methods.
+  ///
+  /// The Sandboxer also emits BundleLock/BundleUnlock pseudo-instructions
+  /// in the constructor/destructor during sandboxed code emission. Therefore,
+  /// it is a bad idea to create an object of this type and "keep it around."
+  /// The recommended usage is:
+  ///
+  /// AutoSandboxing(this).<<operation>>(...);
+  ///
+  /// This usage ensures that no other instructions are inadvertently added to
+  /// the bundle.
+  class Sandboxer {
+    Sandboxer() = delete;
+    Sandboxer(const Sandboxer &) = delete;
+    Sandboxer &operator=(const Sandboxer &) = delete;
+
+  public:
+    explicit Sandboxer(
+        TargetARM32 *Target,
+        InstBundleLock::Option BundleOption = InstBundleLock::Opt_None);
+    ~Sandboxer();
+
+    /// Increments sp:
+    ///
+    ///   add sp, sp, AddAmount
+    ///   bic sp, sp, 0xc0000000
+    ///
+    /// (for the rationale, see the ARM 32-bit Sandbox Specification.)
+    void add_sp(Operand *AddAmount);
+
+    /// Emits code to align sp to the specified alignment:
+    ///
+    ///   bic/and sp, sp, Alignment
+    ///   bic, sp, sp, 0xc0000000
+    void align_sp(size_t Alignment);
+
+    /// Emits a call instruction. If CallTarget is a Variable, it emits
+    ///
+    ///   bic CallTarget, CallTarget, 0xc000000f
+    ///   bl CallTarget
+    ///
+    /// Otherwise, it emits
+    ///
+    ///   bl CallTarget
+    ///
+    /// Note: in sandboxed code calls are always emitted in addresses 12 mod 16.
+    InstARM32Call *bl(Variable *ReturnReg, Operand *CallTarget);
+
+    /// Emits a load:
+    ///
+    ///   bic rBase, rBase, 0xc0000000
+    ///   ldr rDest, [rBase, #Offset]
+    ///
+    /// Exception: if rBase is r9 or sp, then the load is emitted as:
+    ///
+    ///   ldr rDest, [rBase, #Offset]
+    ///
+    /// because the NaCl ARM 32-bit Sandbox Specification guarantees they are
+    /// always valid.
+    void ldr(Variable *Dest, OperandARM32Mem *Mem, CondARM32::Cond Pred);
+
+    /// Emits a load exclusive:
+    ///
+    ///   bic rBase, rBase, 0xc0000000
+    ///   ldrex rDest, [rBase]
+    ///
+    /// Exception: if rBase is r9 or sp, then the load is emitted as:
+    ///
+    ///   ldrex rDest, [rBase]
+    ///
+    /// because the NaCl ARM 32-bit Sandbox Specification guarantees they are
+    /// always valid.
+    void ldrex(Variable *Dest, OperandARM32Mem *Mem, CondARM32::Cond Pred);
+
+    /// Resets sp to Src:
+    ///
+    ///   mov sp, Src
+    ///   bic sp, sp, 0xc0000000
+    void reset_sp(Variable *Src);
+
+    /// Emits code to return from a function:
+    ///
+    ///   bic lr, lr, 0xc000000f
+    ///   bx lr
+    void ret(Variable *RetAddr, Variable *RetValue);
+
+    /// Emits a store:
+    ///
+    ///   bic rBase, rBase, 0xc0000000
+    ///   str rSrc, [rBase, #Offset]
+    ///
+    /// Exception: if rBase is r9 or sp, then the store is emitted as:
+    ///
+    ///   str rDest, [rBase, #Offset]
+    ///
+    /// because the NaCl ARM 32-bit Sandbox Specification guarantees they are
+    /// always valid.
+    void str(Variable *Src, OperandARM32Mem *Mem, CondARM32::Cond Pred);
+
+    /// Emits a store exclusive:
+    ///
+    ///   bic rBase, rBase, 0xc0000000
+    ///   strex rDest, rSrc, [rBase]
+    ///
+    /// Exception: if rBase is r9 or sp, then the store is emitted as:
+    ///
+    ///   strex rDest, rSrc, [rBase]
+    ///
+    /// because the NaCl ARM 32-bit Sandbox Specification guarantees they are
+    /// always valid.
+    void strex(Variable *Dest, Variable *Src, OperandARM32Mem *Mem,
+               CondARM32::Cond Pred);
+
+    /// Decrements sp:
+    ///
+    ///   sub sp, sp, SubAmount
+    ///   bic sp, sp, 0xc0000000
+    void sub_sp(Operand *SubAmount);
+
+  private:
+    TargetARM32 *Target;
+  };
+
   class PostLoweringLegalizer {
     PostLoweringLegalizer() = delete;
     PostLoweringLegalizer(const PostLoweringLegalizer &) = delete;
     PostLoweringLegalizer &operator=(const PostLoweringLegalizer &) = delete;
 
   public:
     explicit PostLoweringLegalizer(TargetARM32 *Target)
         : Target(Target), StackOrFrameReg(Target->getPhysicalRegister(
                               Target->getFrameOrStackReg())) {}
 
@@ skipping 36 matching lines @@
     /// a new base register ip=Base+Offset is created, and the method returns a
     /// memory operand expressing [ip, #0].
     OperandARM32Mem *createMemOperand(Type Ty, Variable *Base, int32_t Offset,
                                       bool AllowOffsets = true);
     TargetARM32 *const Target;
     Variable *const StackOrFrameReg;
     Variable *TempBaseReg = nullptr;
     int32_t TempBaseOffset = 0;
   };
 
+  const bool NeedSandboxing;
   TargetARM32Features CPUFeatures;
   bool UsesFramePointer = false;
   bool NeedsStackAlignment = false;
   bool MaybeLeafFunc = true;
   size_t SpillAreaSizeBytes = 0;
   size_t FixedAllocaSizeBytes = 0;
   size_t FixedAllocaAlignBytes = 0;
   bool PrologEmitsFixedAllocas = false;
   uint32_t MaxOutArgsSizeBytes = 0;
   // TODO(jpp): std::array instead of array.
@@ skipping 185 matching lines @@
 
 private:
   ~TargetHeaderARM32() = default;
 
   TargetARM32Features CPUFeatures;
 };
 
 } // end of namespace Ice
 
 #endif // SUBZERO_SRC_ICETARGETLOWERINGARM32_H