[Qemu-devel] [PATCH] microblaze: Emulate the hw stackprotector

["Edgar E. Iglesias" <edgar.iglesias@gmail.com>]

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
---
 target-microblaze/cpu.h       |    3 +++
 target-microblaze/helper.h    |    1 +
 target-microblaze/op_helper.c |   11 +++++++++++
 target-microblaze/translate.c |   33 +++++++++++++++++++++++++++++++++
 4 files changed, 48 insertions(+), 0 deletions(-)

diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h
index 1a307e3..3ecaeee 100644
--- a/target-microblaze/cpu.h
+++ b/target-microblaze/cpu.h
@@ -93,6 +93,7 @@ struct CPUMBState;
 #define          ESR_EC_DIVZERO         5
 #define          ESR_EC_FPU             6
 #define          ESR_EC_PRIVINSN        7
+#define          ESR_EC_STACKPROT       7  /* Same as PRIVINSN.  */
 #define          ESR_EC_DATA_STORAGE    8
 #define          ESR_EC_INSN_STORAGE    9
 #define          ESR_EC_DATA_TLB        10
@@ -235,6 +236,8 @@ typedef struct CPUMBState {
     uint32_t regs[33];
     uint32_t sregs[24];
     float_status fp_status;
+    /* Stack protectors. Yes, it's a hw feature.  */
+    uint32_t slr, shr;
 
     /* Internal flags.  */
 #define IMM_FLAG	4
diff --git a/target-microblaze/helper.h b/target-microblaze/helper.h
index 420ff3b..2205d5a 100644
--- a/target-microblaze/helper.h
+++ b/target-microblaze/helper.h
@@ -33,6 +33,7 @@ DEF_HELPER_2(mmu_write, void, i32, i32)
 #endif
 
 DEF_HELPER_4(memalign, void, i32, i32, i32, i32)
+DEF_HELPER_1(stackprot, void, i32)
 
 DEF_HELPER_2(get, i32, i32, i32)
 DEF_HELPER_3(put, void, i32, i32, i32)
diff --git a/target-microblaze/op_helper.c b/target-microblaze/op_helper.c
index fe38b7b..5fd7906 100644
--- a/target-microblaze/op_helper.c
+++ b/target-microblaze/op_helper.c
@@ -489,6 +489,17 @@ void helper_memalign(uint32_t addr, uint32_t dr, uint32_t wr, uint32_t mask)
     }
 }
 
+void helper_stackprot(uint32_t addr)
+{
+    if (addr < env->slr || addr > env->shr) {
+            qemu_log("Stack protector violation at %x %x %x\n",
+                     addr, env->slr, env->shr);
+            env->sregs[SR_EAR] = addr;
+            env->sregs[SR_ESR] = ESR_EC_STACKPROT;
+            helper_raise_exception(EXCP_HW_EXCP);
+    }
+}
+
 #if !defined(CONFIG_USER_ONLY)
 /* Writes/reads to the MMU's special regs end up here.  */
 uint32_t helper_mmu_read(uint32_t rn)
diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c
index f4e6f30..180ac84 100644
--- a/target-microblaze/translate.c
+++ b/target-microblaze/translate.c
@@ -526,6 +526,12 @@ static void dec_msr(DisasContext *dc)
             case 0x7:
                 tcg_gen_andi_tl(cpu_SR[SR_FSR], cpu_R[dc->ra], 31);
                 break;
+            case 0x800:
+                tcg_gen_st_tl(cpu_R[dc->ra], cpu_env, offsetof(CPUState, slr));
+                break;
+            case 0x802:
+                tcg_gen_st_tl(cpu_R[dc->ra], cpu_env, offsetof(CPUState, shr));
+                break;
             default:
                 cpu_abort(dc->env, "unknown mts reg %x\n", sr);
                 break;
@@ -552,6 +558,12 @@ static void dec_msr(DisasContext *dc)
             case 0xb:
                 tcg_gen_mov_tl(cpu_R[dc->rd], cpu_SR[SR_BTR]);
                 break;
+            case 0x800:
+                tcg_gen_ld_tl(cpu_R[dc->rd], cpu_env, offsetof(CPUState, slr));
+                break;
+            case 0x802:
+                tcg_gen_ld_tl(cpu_R[dc->rd], cpu_env, offsetof(CPUState, shr));
+                break;
             case 0x2000:
             case 0x2001:
             case 0x2002:
@@ -864,6 +876,13 @@ static inline void gen_load(DisasContext *dc, TCGv dst, TCGv addr,
 static inline TCGv *compute_ldst_addr(DisasContext *dc, TCGv *t)
 {
     unsigned int extimm = dc->tb_flags & IMM_FLAG;
+    /* Should be set to one if r1 is used by loadstores.  */
+    int stackprot = 0;
+
+    /* All load/stores use ra.  */
+    if (dc->ra == 1) {
+        stackprot = 1;
+    }
 
     /* Treat the common cases first.  */
     if (!dc->type_b) {
@@ -874,8 +893,16 @@ static inline TCGv *compute_ldst_addr(DisasContext *dc, TCGv *t)
             return &cpu_R[dc->ra];
         }
 
+        if (dc->rb == 1) {
+            stackprot = 1;
+        }
+
         *t = tcg_temp_new();
         tcg_gen_add_tl(*t, cpu_R[dc->ra], cpu_R[dc->rb]);
+
+        if (stackprot) {
+            gen_helper_stackprot(*t);
+        }
         return t;
     }
     /* Immediate.  */
@@ -891,6 +918,9 @@ static inline TCGv *compute_ldst_addr(DisasContext *dc, TCGv *t)
         tcg_gen_add_tl(*t, cpu_R[dc->ra], *(dec_alu_op_b(dc)));
     }
 
+    if (stackprot) {
+        gen_helper_stackprot(*t);
+    }
     return t;
 }
 
@@ -1917,6 +1947,9 @@ void cpu_reset (CPUState *env)
     memset(env, 0, offsetof(CPUMBState, breakpoints));
     tlb_flush(env, 1);
 
+    /* Disable stack protector.  */
+    env->shr = ~0;
+
     env->pvr.regs[0] = PVR0_PVR_FULL_MASK \
                        | PVR0_USE_BARREL_MASK \
                        | PVR0_USE_DIV_MASK \
-- 
1.7.3.4