[MIPS] Make validator allow only two load patterns via $t8

src/trusted/validator_mips/validator.cc

 /*
  * Copyright (c) 2012 The Native Client Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include <assert.h>
 #include "native_client/src/trusted/service_runtime/nacl_config.h"
 #include "native_client/src/trusted/validator_mips/validator.h"
 #include "native_client/src/include/nacl_macros.h"
@@ skipping 198 matching lines @@
       out->ReportProblem(second.addr(), second.safety(),
                          kProblemUnsafeLoadStore);
       return PATTERN_UNSAFE;
     }
   }
   return NO_MATCH;
 }
 
 
 /*
+ * A thread pointer access is only allowed by these two instructions:
+ * lw Rn, 0($t8)  ; load user thread pointer.
+ * lw Rn, 4($t8)  ; load IRT thread pointer.
+ */
+static PatternMatch CheckLoadThreadPointer(const SfiValidator &sfi,
+                                           const DecodedInstruction &instr,
+                                           ProblemSink *out) {
+  UNREFERENCED_PARAMETER(sfi);
+  if (!instr.IsLoadStore())
+    return NO_MATCH;
+
+  Register base_addr_reg = instr.BaseAddressRegister();
+  if (!base_addr_reg.Equals(Register::Tls()))
+    return NO_MATCH;
+
+  if (instr.IsLoadWord()) {
+    uint32_t offset = instr.GetImm();
+    if (offset == 0 || offset == 4)
+      return PATTERN_SAFE;
+  }
+
+  out->ReportProblem(instr.addr(), instr.safety(),
+                     kProblemUnsafeLoadStoreThreadPointer);
+  return PATTERN_UNSAFE;
+}
+
+/*
  * Checks if there is jump/branch in the delay slot.
  */
 static PatternMatch CheckBranchInDelaySlot(const SfiValidator &sfi,
                                    const DecodedInstruction &first,
                                    const DecodedInstruction &second,
                                    ProblemSink *out) {
   UNREFERENCED_PARAMETER(sfi);
   if (first.HasDelaySlot() && second.HasDelaySlot()) {
     out->ReportProblem(second.addr(), second.safety(),
                        kProblemBranchInDelaySlot);
@@ skipping 187 matching lines @@
 bool SfiValidator::ApplyPatterns(const DecodedInstruction &inst,
     ProblemSink *out) {
   //  Single-instruction patterns.
   typedef PatternMatch (*OneInstPattern)(const SfiValidator &,
                                          const DecodedInstruction &,
                                          ProblemSink *out);
   static const OneInstPattern one_inst_patterns[] = {
     &CheckSafety,
     &CheckReadOnly,
     &CheckCallPosition,
-    &CheckJumpDestAddr
+    &CheckJumpDestAddr,
+    &CheckLoadThreadPointer
   };
 
   bool complete_success = true;
 
   for (uint32_t i = 0; i < NACL_ARRAY_SIZE(one_inst_patterns); i++) {
     PatternMatch r = one_inst_patterns[i](*this, inst, out);
     switch (r) {
       case PATTERN_SAFE:
       case NO_MATCH:
         break;
@@ skipping 84 matching lines @@
 DecodedInstruction::DecodedInstruction(uint32_t vaddr,
                                        Instruction inst,
                                        const ClassDecoder &decoder)
     : vaddr_(vaddr),
       inst_(inst),
       decoder_(&decoder),
       safety_(decoder.safety(inst_))
 {}
 
 }  // namespace nacl_mips_val