On 02/10/2018 18:35, Peter Maydell wrote:
> Add checks for breaches of the v8M stack limit when the
> stack pointer is decremented to push the exception frame
> for exception entry.
>
> Note that the exception-entry case is unique in that the
> stack pointer is updated to be the limit value if the limit
> is hit (per rule R_ZLZG).
>
> Signed-off-by: Peter Maydell <peter.mayd...@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <phi...@redhat.com>
> ---
> target/arm/helper.c | 54 ++++++++++++++++++++++++++++++++++++++-------
> 1 file changed, 46 insertions(+), 8 deletions(-)
>
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index ef8c244fb84..a10dff01a90 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -6839,6 +6839,8 @@ static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t
> lr, bool dotailchain,
> uint32_t frameptr;
> ARMMMUIdx mmu_idx;
> bool stacked_ok;
> + uint32_t limit;
> + bool want_psp;
>
> if (dotailchain) {
> bool mode = lr & R_V7M_EXCRET_MODE_MASK;
> @@ -6848,12 +6850,34 @@ static bool v7m_push_callee_stack(ARMCPU *cpu,
> uint32_t lr, bool dotailchain,
> mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
> frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,
> lr & R_V7M_EXCRET_SPSEL_MASK);
> + want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
> + if (want_psp) {
> + limit = env->v7m.psplim[M_REG_S];
> + } else {
> + limit = env->v7m.msplim[M_REG_S];
> + }
> } else {
> mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
> frame_sp_p = &env->regs[13];
> + limit = v7m_sp_limit(env);
> }
>
> frameptr = *frame_sp_p - 0x28;
> + if (frameptr < limit) {
> + /*
> + * Stack limit failure: set SP to the limit value, and generate
> + * STKOF UsageFault. Stack pushes below the limit must not be
> + * performed. It is IMPDEF whether pushes above the limit are
> + * performed; we choose not to.
> + */
> + qemu_log_mask(CPU_LOG_INT,
> + "...STKOF during callee-saves register stacking\n");
> + env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
> + armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
> + env->v7m.secure);
> + *frame_sp_p = limit;
> + return true;
> + }
>
> /* Write as much of the stack frame as we can. A write failure may
> * cause us to pend a derived exception.
> @@ -6877,10 +6901,7 @@ static bool v7m_push_callee_stack(ARMCPU *cpu,
> uint32_t lr, bool dotailchain,
> v7m_stack_write(cpu, frameptr + 0x24, env->regs[11], mmu_idx,
> ignore_faults);
>
> - /* Update SP regardless of whether any of the stack accesses failed.
> - * When we implement v8M stack limit checking then this attempt to
> - * update SP might also fail and result in a derived exception.
> - */
> + /* Update SP regardless of whether any of the stack accesses failed. */
> *frame_sp_p = frameptr;
>
> return !stacked_ok;
> @@ -7028,6 +7049,26 @@ static bool v7m_push_stack(ARMCPU *cpu)
>
> frameptr -= 0x20;
>
> + if (arm_feature(env, ARM_FEATURE_V8)) {
> + uint32_t limit = v7m_sp_limit(env);
> +
> + if (frameptr < limit) {
> + /*
> + * Stack limit failure: set SP to the limit value, and generate
> + * STKOF UsageFault. Stack pushes below the limit must not be
> + * performed. It is IMPDEF whether pushes above the limit are
> + * performed; we choose not to.
> + */
> + qemu_log_mask(CPU_LOG_INT,
> + "...STKOF during stacking\n");
> + env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_STKOF_MASK;
> + armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
> + env->v7m.secure);
> + env->regs[13] = limit;
> + return true;
> + }
> + }
> +
> /* Write as much of the stack frame as we can. If we fail a stack
> * write this will result in a derived exception being pended
> * (which may be taken in preference to the one we started with
> @@ -7043,10 +7084,7 @@ static bool v7m_push_stack(ARMCPU *cpu)
> v7m_stack_write(cpu, frameptr + 24, env->regs[15], mmu_idx, false) &&
> v7m_stack_write(cpu, frameptr + 28, xpsr, mmu_idx, false);
>
> - /* Update SP regardless of whether any of the stack accesses failed.
> - * When we implement v8M stack limit checking then this attempt to
> - * update SP might also fail and result in a derived exception.
> - */
> + /* Update SP regardless of whether any of the stack accesses failed. */
> env->regs[13] = frameptr;
>
> return !stacked_ok;
>
