Subzero. ARM32. Initial sandboxing code.

Makefile.standalone

@@ -404,7 +404,10 @@ check-xtest: $(OBJDIR)/pnacl-sz make_symlink runtime
           -e x8664,native,sse2,test_global \
           -i arm32,native,neon \
           -e arm32,native,neon,test_vector_ops \
-          -e arm32,native,neon,test_select
+          -e arm32,native,neon,test_select \
+          -i arm32,sandbox,neon \
+          -e arm32,sandbox,neon,test_vector_ops \
+          -e arm32,sandbox,neon,test_select
 	PNACL_BIN_PATH=$(PNACL_BIN_PATH) \
 	$(LLVM_SRC_PATH)/utils/lit/lit.py -sv crosstest/Output
 endif

pydir/crosstest.py

@@ -182,7 +182,7 @@ def main():
             ).format(root=nacl_root, sb='sb' if args.sandbox else 'native'))
     pure_c = os.path.splitext(args.driver)[1] == '.c'
 
-    # TargetX8664 is ilp32, but clang does not currently support such
+    # TargetX8664 is ilp32, but pnacl-clang does not currently support such
     # configuration. In order to run the crosstests we play nasty, dangerous
     # tricks with the stack pointer.
     needs_stack_hack = (args.target == 'x8664')
@@ -202,7 +202,7 @@ def main():
         bin=bindir, prefix='pnacl-' if args.sandbox else '',
         cc='clang' if pure_c else 'clang++')
     sb_native_args = (['-O0', '--pnacl-allow-native',
-                       '-arch', target_info.target,
+                       '-arch', target_info.compiler_arch,
                        '-Wn,-defsym=__Sz_AbsoluteZero=0']
                       if args.sandbox else
                       ['-g', '-target=' + triple,

pydir/crosstest_generator.py

@@ -67,7 +67,7 @@ def main():
   arch_flags = { 'x8632': [],
                  'x8664': [],
                  # ARM doesn't have an ELF writer yet.
-                 'arm32': ['--filetype=iasm'] }
+                 'arm32': ['--filetype=asm'] }
   # all_keys is only used in the help text.
   all_keys = '; '.join([' '.join(targets), ' '.join(sandboxing),
                         ' '.join(opt_levels), ' '.join(flat_attrs)])

pydir/run-pnacl-sz.py

@@ -11,14 +11,16 @@ import tempfile
 from utils import shellcmd
 
 
-def TargetAssemblerFlags(target):
+def TargetAssemblerFlags(target, sandboxed):
   # TODO(stichnot): -triple=i686-nacl should be used for a
   # sandboxing test.  This means there should be an args.sandbox
   # argument that also gets passed through to pnacl-sz.
   # TODO(reed kotler). Need to find out exactly we need to
   # add here for Mips32.
-  flags = { 'x8632': ['-triple=i686'],
-            'arm32': ['-triple=armv7a', '-mcpu=cortex-a9', '-mattr=+neon'],
+  flags = { 'x8632': ['-triple=%s' % ('i686' if not sandboxed else 'i686-nacl')],
+            'arm32': ['-triple=%s' % (
+                          'armv7a' if not sandboxed else 'armv7a-nacl'),
+                      '-mcpu=cortex-a9', '-mattr=+neon'],
             'mips32': ['-triple=mipsel' ] }
   return flags[target]
 
@@ -89,6 +91,8 @@ def main():
     argparser.add_argument('--args', '-a', nargs=argparse.REMAINDER,
                            default=[],
                            help='Remaining arguments are passed to pnacl-sz')
+    argparser.add_argument('--sandbox', required=False, action='store_true',
+                           help='Sanboxes the generated code.')
 
     args = argparser.parse_args()
     pnacl_bin_path = args.pnacl_bin_path
@@ -121,6 +125,8 @@ def main():
       cmd += [os.path.join(pnacl_bin_path, 'not')]
     cmd += [args.pnacl_sz]
     cmd += ['--target', args.target]
+    if args.sandbox:
+      cmd += ['-sandbox']
     if args.insts:
       # If the tests are based on '-verbose inst' output, force
       # single-threaded translation because dump output does not get
@@ -147,7 +153,7 @@ def main():
       asm_temp.close()
     if args.assemble and args.filetype != 'obj':
       cmd += (['|', os.path.join(pnacl_bin_path, 'llvm-mc')] +
-              TargetAssemblerFlags(args.target) +
+              TargetAssemblerFlags(args.target, args.sandbox) +
               ['-filetype=obj', '-o', asm_temp.name])
     elif asm_temp:
       cmd += ['-o', asm_temp.name]

pydir/szbuild.py

@@ -318,10 +318,14 @@ def ProcessPexe(args, pexe, exe):
 
     # Run the linker regardless of hybrid mode.
     if args.sandbox:
-        assert args.target in ['x8632'], \
+        assert args.target in ('x8632', 'arm32'), \
             '-sandbox is not available for %s' % args.target
+        target_lib_dir = {
+          'arm32': 'arm',
+          'x8632': 'x86-32',
+        }[args.target]
         linklib = ('{root}/toolchain/linux_x86/pnacl_newlib_raw/translator/' +
-                   'x86-32/lib').format(root=nacl_root)
+                   '{target_dir}/lib').format(root=nacl_root, target_dir=target_lib_dir)
         shellcmd((
             '{gold} -nostdlib --no-fix-cortex-a8 --eh-frame-hdr -z text ' +
             '--build-id --entry=__pnacl_start -static ' +

pydir/targets.py

@@ -17,22 +17,25 @@ def FindARMCrossInclude():
 
 
 TargetInfo = namedtuple('TargetInfo',
-                        ['target', 'triple', 'llc_flags', 'ld_emu',
-                         'cross_headers'])
+                        ['target', 'compiler_arch', 'triple', 'llc_flags',
+                         'ld_emu', 'cross_headers'])
 
 X8632Target = TargetInfo(target='x8632',
+                         compiler_arch='x8632',
                          triple='i686-none-linux',
                          llc_flags=['-mcpu=pentium4m'],
                          ld_emu='elf_i386_nacl',
                          cross_headers=[])
 
 X8664Target = TargetInfo(target='x8664',
+                         compiler_arch='x8664',
                          triple='x86_64-none-linux',
                          llc_flags=['-mcpu=x86-64'],
                          ld_emu='elf_x86_64_nacl',
                          cross_headers=[])
 
 ARM32Target = TargetInfo(target='arm32',
+                         compiler_arch='armv7',
                          triple='armv7a-none-linux-gnueabihf',
                          llc_flags=['-mcpu=cortex-a9',
                                     '-float-abi=hard',

src/IceTargetLoweringARM32.h

@@ -162,6 +162,18 @@ public:
         llvm::cast<ConstantInteger32>(Ctx->getConstantInt32(ShAmtImm & 0x1F)));
   }
 
+  OperandARM32FlexImm *indirectBranchBicMask() const {
+    constexpr uint32_t Imm8 = 0xFC; // 0xC000000F
+    constexpr uint32_t RotateAmt = 2;
+    return OperandARM32FlexImm::create(Func, IceType_i32, Imm8, RotateAmt);
+  }
+
+  OperandARM32FlexImm *memOpBicMask() const {
+    constexpr uint32_t Imm8 = 0x0C; // 0xC0000000
+    constexpr uint32_t RotateAmt = 2;
+    return OperandARM32FlexImm::create(Func, IceType_i32, Imm8, RotateAmt);
+  }
+
   GlobalContext *getCtx() const { return Ctx; }
 
 protected:
@@ -822,6 +834,115 @@ protected:
 
   void postLowerLegalization();
 
+  class AutoSandboxer {
+  public:
+    explicit AutoSandboxer(
+        TargetARM32 *Target,
+        InstBundleLock::Option BundleOption = InstBundleLock::Opt_None)
+        : Target(Target) {
+      if (Target->NeedSandboxing) {
+        Target->_bundle_lock(BundleOption);
+      }
+    }
+
+    void add_sp(Operand *AddAmount) {
+      Variable *SP = Target->getPhysicalRegister(RegARM32::Reg_sp);
+      Target->_add(SP, SP, AddAmount);
+      if (Target->NeedSandboxing) {
+        Target->_bic(SP, SP, Target->memOpBicMask());
+      }
+    }
+
+    void align_sp(size_t Alignment) {
+      Variable *SP = Target->getPhysicalRegister(RegARM32::Reg_sp);
+      Target->alignRegisterPow2(SP, Alignment);
+      if (Target->NeedSandboxing) {
+        Target->_bic(SP, SP, Target->memOpBicMask());
+      }
+    }
+
+    InstARM32Call *bl(Variable *ReturnReg, Operand *CallTarget) {
+      if (Target->NeedSandboxing) {
+        if (auto *CallTargetR = llvm::dyn_cast<Variable>(CallTarget)) {
+          Target->_bic(CallTargetR, CallTargetR,
+                       Target->indirectBranchBicMask());
+        }
+      }
+      auto *Call = InstARM32Call::create(Target->Func, ReturnReg, CallTarget);
+      Target->Context.insert(Call);
+      return Call;
+    }
+
+    void ldr(Variable *Dest, OperandARM32Mem *Mem, CondARM32::Cond Pred) {
+      if (Target->NeedSandboxing) {
+        assert(!Mem->isRegReg());
+        Variable *MemBase = Mem->getBase();
+        Target->_bic(MemBase, MemBase, Target->memOpBicMask(), Pred);
+      }
+      Target->_ldr(Dest, Mem, Pred);
+    }
+
+    void ldrex(Variable *Dest, OperandARM32Mem *Mem, CondARM32::Cond Pred) {
+      if (Target->NeedSandboxing) {
+        assert(!Mem->isRegReg());
+        Variable *MemBase = Mem->getBase();
+        Target->_bic(MemBase, MemBase, Target->memOpBicMask(), Pred);
+      }
+      Target->_ldrex(Dest, Mem, Pred);
+    }
+
+    void reset_sp(Variable *Src) {
+      Variable *SP = Target->getPhysicalRegister(RegARM32::Reg_sp);
+      Target->_mov_redefined(SP, Src);
+      if (Target->NeedSandboxing) {
+        Target->_bic(SP, SP, Target->memOpBicMask());
+      }
+    }
+
+    void ret(Variable *RetAddr, Variable *RetValue) {
+      if (Target->NeedSandboxing) {
+        Target->_bic(RetAddr, RetAddr, Target->indirectBranchBicMask());
+      }
+      Target->_ret(RetAddr, RetValue);
+    }
+
+    void str(Variable *Src, OperandARM32Mem *Mem, CondARM32::Cond Pred) {
+      if (Target->NeedSandboxing) {
+        assert(!Mem->isRegReg());
+        Variable *MemBase = Mem->getBase();
+        Target->_bic(MemBase, MemBase, Target->memOpBicMask(), Pred);
+      }
+      Target->_str(Src, Mem, Pred);
+    }
+
+    void strex(Variable *Dest, Variable *Src, OperandARM32Mem *Mem,
+               CondARM32::Cond Pred) {
+      if (Target->NeedSandboxing) {
+        assert(!Mem->isRegReg());
+        Variable *MemBase = Mem->getBase();
+        Target->_bic(MemBase, MemBase, Target->memOpBicMask(), Pred);
+      }
+      Target->_strex(Dest, Src, Mem, Pred);
+    }
+
+    void sub_sp(Operand *SubAmount) {
+      Variable *SP = Target->getPhysicalRegister(RegARM32::Reg_sp);
+      Target->_sub(SP, SP, SubAmount);
+      if (Target->NeedSandboxing) {
+        Target->_bic(SP, SP, Target->memOpBicMask());
+      }
+    }
+
+    ~AutoSandboxer() {
+      if (Target->NeedSandboxing) {
+        Target->_bundle_unlock();
+      }
+    }
+
+  private:
+    TargetARM32 *Target;
+  };
+
   class PostLoweringLegalizer {
     PostLoweringLegalizer() = delete;
     PostLoweringLegalizer(const PostLoweringLegalizer &) = delete;
@@ -878,6 +999,7 @@ protected:
     int32_t TempBaseOffset = 0;
   };
 
+  const bool NeedSandboxing;
   TargetARM32Features CPUFeatures;
   bool UsesFramePointer = false;
   bool NeedsStackAlignment = false;

tests_lit/assembler/arm32/sandboxing.ll

+; Tests basics and corner cases of x86-32 sandboxing, using -Om1 in
+; the hope that the output will remain stable.  When packing bundles,
+; we try to limit to a few instructions with well known sizes and
+; minimal use of registers and stack slots in the lowering sequence.
+
+; RUN: %p2i -i %s --sandbox --filetype=asm --target=arm32 --assemble \
+; RUN:   --disassemble --args -Om1 -allow-externally-defined-symbols \
+; RUN:   -ffunction-sections  | FileCheck %s
+
+declare void @call_target()
+@global_short = internal global [2 x i8] zeroinitializer
+
+; A direct call sequence uses the right mask and register-call sequence.
+define internal void @test_direct_call() {
+entry:
+  call void @call_target()
+  ret void
+}
+; CHECK-LABEL: test_direct_call
+; CHECK: nop
+; CHECK: c: {{.*}} bl {{.*}} call_target
+; CHECK-NEXT: 10:
+
+; An indirect call sequence uses the right mask and register-call sequence.
+define internal void @test_indirect_call(i32 %target) {
+entry:
+  %__1 = inttoptr i32 %target to void ()*
+  call void %__1()
+  ret void
+}
+; CHECK-LABEL: test_indirect_call
+; CHECK: ldr [[REG:.*]], [sp, 
+; CHECK-NEXT: nop
+; CHECK-NEXT: nop
+; CHECK: 18: {{.*}} bic [[REG]], [[REG]], {{.*}} 0xc000000f
+; CHECK-NEXT: blx [[REG]]
+; CHECk-NEXT: 20:
+
+; A return sequences uses the right pop / mask / jmp sequence.
+define internal void @test_ret() {
+entry:
+  ret void
+}
+; CHECK-LABEL: test_ret
+; CHECK: 0: {{.*}} bic lr, lr, {{.*}} 0xc000000f
+; CHECK-NEXT: bx lr
+
+; Bundle lock without padding.
+define internal void @bundle_lock_without_padding() {
+entry:
+  %addr_short = bitcast [2 x i8]* @global_short to i16*
+  store i16 0, i16* %addr_short, align 1
+  ret void
+}
+; CHECK-LABEL: bundle_lock_without_padding
+; CHECK: 0: {{.*}} movw
+; CHECK-NEXT: movt
+; CHECK-NEXT: movw
+; CHECK-NEXT: strh
+; CHECK-NEXT: bic lr, lr, {{.*}} 0xc000000f
+; CHECK-NEXT: {{.*}} bx lr
+
+; Bundle lock with padding.
+define internal void @bundle_lock_with_padding() {
+entry:
+  call void @call_target()
+  ; bundle boundary
+  store i16 0, i16* undef, align 1   ; 3 insts
+  store i16 0, i16* undef, align 1   ; 3 insts
+  store i16 0, i16* undef, align 1   ; 3 insts
+                                     ; SP adjustment + pop
+  ; nop
+  ; bundle boundary
+  ret void
+}
+; CHECK-LABEL: bundle_lock_with_padding
+; CHECK: 38: {{.*}} pop
+; CHECK-NEXT: nop
+; CHECK-NEXT: bic lr, lr, {{.*}} 0xc000000f
+; CHECK-NEXT: {{.*}} bx lr
+
+; Bundle lock align_to_end without any padding.
+define internal void @bundle_lock_align_to_end_padding_0() {
+entry:
+  call void @call_target()
+  ; bundle boundary
+  store i16 0, i16* undef, align 1
+  call void @call_target()
+  ; bundle boundary
+  ret void
+}
+; CHECK-LABEL: bundle_lock_align_to_end_padding_0
+; CHECK: c: {{.*}} bl {{.*}} call_target
+; CHECK-NEXT: movw
+; CHECK-NEXT: movw
+; CHECK-NEXT: strh
+; CHECK-NEXT: bl {{.*}} call_target
+; CHECK-NEXT: add
+; CHECK-NEXT: pop
+; CHECK-NEXT: bic lr, lr, {{.*}} 0xc000000f
+; CHECK-NEXT: {{.*}} bx lr
+
+; Bundle lock align_to_end with one bunch of padding.
+define internal void @bundle_lock_align_to_end_padding_1() {
+entry:
+  call void @call_target()
+  ; bundle boundary
+  store i16 0, i16* undef, align 1
+  store i16 0, i16* undef, align 1
+  ; bundle boundary
+  call void @call_target()
+  ; bundle boundary
+  ret void
+}
+; CHECK-LABEL: bundle_lock_align_to_end_padding_1
+; CHECK: c: {{.*}} bl {{.*}} call_target
+; CHECK-NEXT: movw
+; CHECK-NEXT: movw
+; CHECK-NEXT: strh
+; CHECK-NEXT: movw
+; CHECK-NEXT: movw
+; CHECK-NEXT: strh
+; CHECK-NEXT: nop
+; CHECK-NEXT: bl {{.*}} call_target
+; CHECK-NEXT: add
+; CHECK-NEXT: pop
+; CHECK-NEXT: bic lr, lr, {{.*}} 0xc000000f
+; CHECK-NEXT: {{.*}} bx lr
+
+; Bundle lock align_to_end with two bunches of padding.
+define internal void @bundle_lock_align_to_end_padding_2(i32 %target) {
+entry:
+  call void @call_target()
+  ; bundle boundary
+  %__1 = inttoptr i32 %target to void ()*
+  store i8 0, i8* undef, align 1
+  call void %__1()
+  ret void
+}
+; CHECK-LABEL: bundle_lock_align_to_end_padding_2
+; CHECK: c: {{.*}} bl {{.*}} call_target
+; CHECK-NEXT: movw
+; CHECK-NEXT: movw
+; CHECK-NEXT: strb
+; CHECK: 20: {{.*}} nop
+; CHECK-NEXT: nop
+; CHECK-NEXT: bic [[REG:r[0-9]+]], [[REG]], {{.*}} 0xc000000f
+; CHECK-NEXT: {{.*}} blx [[REG]]
+

tests_lit/assembler/x86/sandboxing.ll

@@ -3,9 +3,9 @@
 ; we try to limit to a few instructions with well known sizes and
 ; minimal use of registers and stack slots in the lowering sequence.
 
-; RUN: %p2i -i %s --filetype=obj --disassemble --args -Om1 \
+; RUN: %p2i -i %s --sandbox --filetype=obj --disassemble --args -Om1 \
 ; RUN:   -allow-externally-defined-symbols \
-; RUN:   -ffunction-sections -sandbox | FileCheck %s
+; RUN:   -ffunction-sections | FileCheck %s
 
 declare void @call_target()
 @global_byte = internal global [1 x i8] zeroinitializer