From 739e89cbe6d0f416d9799e1c296d2d15d7fac4e5 Mon Sep 17 00:00:00 2001
From: Martin Erik Werner <martinerikwerner.aac@gmail.com>
Date: Thu, 27 Jun 2019 10:03:48 +0200
Subject: [PATCH] or1k: Avoid write outside setjmp buf & shrink buf

Update the offsets used to save registers into the stejmp jmp_buf
structure in order to:

* Avoid writing the supervision register outside the buffer and thus
  clobbering something on the stack. Previously the supervision register
  was written at offset 124 while the buffer was of length 124.

* Shrink the jmp_buf down to the size actually needed, by avoiding holes
  at the locations of omitted registers.
---
 newlib/libc/include/machine/setjmp.h |  5 ++-
 newlib/libc/machine/or1k/setjmp.S    | 56 ++++++++++++++--------------
 2 files changed, 32 insertions(+), 29 deletions(-)

diff --git a/newlib/libc/include/machine/setjmp.h b/newlib/libc/include/machine/setjmp.h
index 9212f840b..6b37bcce4 100644
--- a/newlib/libc/include/machine/setjmp.h
+++ b/newlib/libc/include/machine/setjmp.h
@@ -2,7 +2,10 @@
 _BEGIN_STD_C
 
 #if defined(__or1k__) || defined(__or1knd__)
-#define _JBLEN 31 /* 32 GPRs - r0 */
+/*
+ * r1, r2, r9, r14, r16 .. r30, SR.
+ */
+#define _JBLEN 13
 #define _JBTYPE unsigned long
 #endif
 
diff --git a/newlib/libc/machine/or1k/setjmp.S b/newlib/libc/machine/or1k/setjmp.S
index 0b93a0342..f0663f37c 100644
--- a/newlib/libc/machine/or1k/setjmp.S
+++ b/newlib/libc/machine/or1k/setjmp.S
@@ -29,25 +29,25 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .type   setjmp,@function
 setjmp:
 
-	l.sw	4(r3), r1
-	l.sw	8(r3), r2
+	l.sw	0(r3), r1
+	l.sw	4(r3), r2
 	/* Skip r3-r8 as they are not preserved across function calls */
-	l.sw	36(r3), r9
+	l.sw	8(r3), r9
 	/* Skip r10 as it's preserved to be used by TLS */ 
 	/* Skip r11, setjmp always set it to 0 */
 	/* The following set if registers are preserved across function calls */
-	l.sw	52(r3), r14
-	l.sw	60(r3), r16
-	l.sw	68(r3), r18
-	l.sw	76(r3), r20
-	l.sw	84(r3), r22
-	l.sw	92(r3), r24
-	l.sw	100(r3), r26
-	l.sw	108(r3), r28
-	l.sw	116(r3), r30
+	l.sw	12(r3), r14
+	l.sw	16(r3), r16
+	l.sw	20(r3), r18
+	l.sw	24(r3), r20
+	l.sw	28(r3), r22
+	l.sw	32(r3), r24
+	l.sw	36(r3), r26
+	l.sw	40(r3), r28
+	l.sw	44(r3), r30
 	/* Save Status Register */
 	l.mfspr	r13, r0, 17
-	l.sw	124(r3), r13
+	l.sw	48(r3), r13
 /* Set result register to 0 and jump */
 // Different cases for optional delay slot
 #if defined(__OR1K_NODELAY__)
@@ -77,32 +77,32 @@ longjmp:
 
   /* Load status register */
 1: 
-	l.lwz	r15, 124(r3)
+	l.lwz	r15, 48(r3)
 	l.mtspr	r0, r15, 17
 
-	l.lwz	r1, 4(r3)
-	l.lwz	r2, 8(r3)
+	l.lwz	r1, 0(r3)
+	l.lwz	r2, 4(r3)
 	/* Skip r3-r8 as they are not preserved across function calls */
-	l.lwz	r9, 36(r3)
+	l.lwz	r9, 8(r3)
 	/* Skip r11 as it's always set by longjmp */
-	l.lwz	r14, 52(r3)
-	l.lwz	r16, 60(r3)
-	l.lwz	r18, 68(r3)
-	l.lwz	r20, 76(r3)
-	l.lwz	r22, 84(r3)
-	l.lwz	r24, 92(r3)
-	l.lwz	r26, 100(r3)
-	l.lwz	r28, 108(r3)
+	l.lwz	r14, 12(r3)
+	l.lwz	r16, 16(r3)
+	l.lwz	r18, 20(r3)
+	l.lwz	r20, 24(r3)
+	l.lwz	r22, 28(r3)
+	l.lwz	r24, 32(r3)
+	l.lwz	r26, 36(r3)
+	l.lwz	r28, 40(r3)
 
 // Different cases for optional delay slot
 #if defined(__OR1K_NODELAY__)
-	l.lwz	r30, 116(r3)
+	l.lwz	r30, 44(r3)
 	l.jr	r9
 #elif defined(__OR1K_DELAY__)
 	l.jr	r9
-	l.lwz	r30, 116(r3)
+	l.lwz	r30, 44(r3)
 #else
-	l.lwz	r30, 116(r3)
+	l.lwz	r30, 44(r3)
 	l.jr	r9
 	l.nop
 #endif