diff options
| -rw-r--r-- | target-microblaze/cpu.h | 3 | ||||
| -rw-r--r-- | target-microblaze/helper.h | 1 | ||||
| -rw-r--r-- | target-microblaze/op_helper.c | 11 | ||||
| -rw-r--r-- | target-microblaze/translate.c | 33 |
4 files changed, 48 insertions, 0 deletions
diff --git a/target-microblaze/cpu.h b/target-microblaze/cpu.h index 1a307e312d..3ecaeee346 100644 --- a/target-microblaze/cpu.h +++ b/target-microblaze/cpu.h @@ -93,6 +93,7 @@ struct CPUMBState; #define ESR_EC_DIVZERO 5 #define ESR_EC_FPU 6 #define ESR_EC_PRIVINSN 7 +#define ESR_EC_STACKPROT 7 /* Same as PRIVINSN. */ #define ESR_EC_DATA_STORAGE 8 #define ESR_EC_INSN_STORAGE 9 #define ESR_EC_DATA_TLB 10 @@ -235,6 +236,8 @@ typedef struct CPUMBState { uint32_t regs[33]; uint32_t sregs[24]; float_status fp_status; + /* Stack protectors. Yes, it's a hw feature. */ + uint32_t slr, shr; /* Internal flags. */ #define IMM_FLAG 4 diff --git a/target-microblaze/helper.h b/target-microblaze/helper.h index a8d75c0bf0..9dcfb0f1d5 100644 --- a/target-microblaze/helper.h +++ b/target-microblaze/helper.h @@ -33,6 +33,7 @@ DEF_HELPER_2(mmu_write, void, i32, i32) #endif DEF_HELPER_4(memalign, void, i32, i32, i32, i32) +DEF_HELPER_1(stackprot, void, i32) DEF_HELPER_2(get, i32, i32, i32) DEF_HELPER_3(put, void, i32, i32, i32) diff --git a/target-microblaze/op_helper.c b/target-microblaze/op_helper.c index d99c564375..7232c71998 100644 --- a/target-microblaze/op_helper.c +++ b/target-microblaze/op_helper.c @@ -483,6 +483,17 @@ void helper_memalign(uint32_t addr, uint32_t dr, uint32_t wr, uint32_t mask) } } +void helper_stackprot(uint32_t addr) +{ + if (addr < env->slr || addr > env->shr) { + qemu_log("Stack protector violation at %x %x %x\n", + addr, env->slr, env->shr); + env->sregs[SR_EAR] = addr; + env->sregs[SR_ESR] = ESR_EC_STACKPROT; + helper_raise_exception(EXCP_HW_EXCP); + } +} + #if !defined(CONFIG_USER_ONLY) /* Writes/reads to the MMU's special regs end up here. */ uint32_t helper_mmu_read(uint32_t rn) diff --git a/target-microblaze/translate.c b/target-microblaze/translate.c index f4e6f3011b..180ac84f06 100644 --- a/target-microblaze/translate.c +++ b/target-microblaze/translate.c @@ -526,6 +526,12 @@ static void dec_msr(DisasContext *dc) case 0x7: tcg_gen_andi_tl(cpu_SR[SR_FSR], cpu_R[dc->ra], 31); break; + case 0x800: + tcg_gen_st_tl(cpu_R[dc->ra], cpu_env, offsetof(CPUState, slr)); + break; + case 0x802: + tcg_gen_st_tl(cpu_R[dc->ra], cpu_env, offsetof(CPUState, shr)); + break; default: cpu_abort(dc->env, "unknown mts reg %x\n", sr); break; @@ -552,6 +558,12 @@ static void dec_msr(DisasContext *dc) case 0xb: tcg_gen_mov_tl(cpu_R[dc->rd], cpu_SR[SR_BTR]); break; + case 0x800: + tcg_gen_ld_tl(cpu_R[dc->rd], cpu_env, offsetof(CPUState, slr)); + break; + case 0x802: + tcg_gen_ld_tl(cpu_R[dc->rd], cpu_env, offsetof(CPUState, shr)); + break; case 0x2000: case 0x2001: case 0x2002: @@ -864,6 +876,13 @@ static inline void gen_load(DisasContext *dc, TCGv dst, TCGv addr, static inline TCGv *compute_ldst_addr(DisasContext *dc, TCGv *t) { unsigned int extimm = dc->tb_flags & IMM_FLAG; + /* Should be set to one if r1 is used by loadstores. */ + int stackprot = 0; + + /* All load/stores use ra. */ + if (dc->ra == 1) { + stackprot = 1; + } /* Treat the common cases first. */ if (!dc->type_b) { @@ -874,8 +893,16 @@ static inline TCGv *compute_ldst_addr(DisasContext *dc, TCGv *t) return &cpu_R[dc->ra]; } + if (dc->rb == 1) { + stackprot = 1; + } + *t = tcg_temp_new(); tcg_gen_add_tl(*t, cpu_R[dc->ra], cpu_R[dc->rb]); + + if (stackprot) { + gen_helper_stackprot(*t); + } return t; } /* Immediate. */ @@ -891,6 +918,9 @@ static inline TCGv *compute_ldst_addr(DisasContext *dc, TCGv *t) tcg_gen_add_tl(*t, cpu_R[dc->ra], *(dec_alu_op_b(dc))); } + if (stackprot) { + gen_helper_stackprot(*t); + } return t; } @@ -1917,6 +1947,9 @@ void cpu_reset (CPUState *env) memset(env, 0, offsetof(CPUMBState, breakpoints)); tlb_flush(env, 1); + /* Disable stack protector. */ + env->shr = ~0; + env->pvr.regs[0] = PVR0_PVR_FULL_MASK \ | PVR0_USE_BARREL_MASK \ | PVR0_USE_DIV_MASK \ |