Subzero, MIPS32: Sandbox initial patch

src/IceTargetLoweringMIPS32.cpp

 //
 //                        The Subzero Code Generator
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 ///
 /// \file
 /// \brief Implements the TargetLoweringMIPS32 class, which consists almost
@@ skipping 91 matching lines @@
 }
 
 // Value is in bytes. Return Value adjusted to the next highest multiple of the
 // stack alignment.
 uint32_t applyStackAlignment(uint32_t Value) {
   return Utils::applyAlignment(Value, MIPS32_STACK_ALIGNMENT_BYTES);
 }
 
 } // end of anonymous namespace
 
-TargetMIPS32::TargetMIPS32(Cfg *Func) : TargetLowering(Func) {}
+TargetMIPS32::TargetMIPS32(Cfg *Func)
+    : TargetLowering(Func), NeedSandboxing(SandboxingType == ST_NaCl) {}
 
 void TargetMIPS32::assignVarStackSlots(VarList &SortedSpilledVariables,
                                        size_t SpillAreaPaddingBytes,
                                        size_t SpillAreaSizeBytes,
                                        size_t GlobalsAndSubsequentPaddingSize) {
   const VariablesMetadata *VMetadata = Func->getVMetadata();
   size_t GlobalsSpaceUsed = SpillAreaPaddingBytes;
   size_t NextStackOffset = SpillAreaPaddingBytes;
   CfgVector<size_t> LocalsSize(Func->getNumNodes());
   const bool SimpleCoalescing = !callsReturnsTwice();
@@ skipping 1372 matching lines @@
   }
 
   // Combine fixed alloca with SpillAreaSize.
   SpillAreaSizeBytes += FixedAllocaSizeBytes;
 
   TotalStackSizeBytes = PreservedRegsSizeBytes + SpillAreaSizeBytes;
 
   // Generate "addiu sp, sp, -TotalStackSizeBytes"
   if (TotalStackSizeBytes) {
     // Use the scratch register if needed to legalize the immediate.
-    Variable *SP = getPhysicalRegister(RegMIPS32::Reg_SP);
-    _addiu(SP, SP, -(TotalStackSizeBytes));
+    Sandboxer(this).addiu_sp(-TotalStackSizeBytes);
   }
 
   Ctx->statsUpdateFrameBytes(TotalStackSizeBytes);
 
   if (!PreservedGPRs.empty()) {
     uint32_t StackOffset = TotalStackSizeBytes;
     for (Variable *Var : *PreservedRegsInClass) {
       Variable *PhysicalRegister = getPhysicalRegister(Var->getRegNum());
       StackOffset -= typeWidthInBytesOnStack(PhysicalRegister->getType());
       Variable *SP = getPhysicalRegister(RegMIPS32::Reg_SP);
       OperandMIPS32Mem *MemoryLocation = OperandMIPS32Mem::create(
           Func, IceType_i32, SP,
           llvm::cast<ConstantInteger32>(Ctx->getConstantInt32(StackOffset)));
-      _sw(PhysicalRegister, MemoryLocation);
+      Sandboxer(this).sw(PhysicalRegister, MemoryLocation);
     }
   }
 
   Variable *FP = getPhysicalRegister(RegMIPS32::Reg_FP);
 
   // Generate "mov FP, SP" if needed.
   if (UsesFramePointer) {
     Variable *SP = getPhysicalRegister(RegMIPS32::Reg_SP);
     _mov(FP, SP);
     // Keep FP live for late-stage liveness analysis (e.g. asm-verbose mode).
@@ skipping 83 matching lines @@
   Context.init(Node);
   Context.setInsertPoint(InsertPoint);
 
   Variable *SP = getPhysicalRegister(RegMIPS32::Reg_SP);
   if (UsesFramePointer) {
     Variable *FP = getPhysicalRegister(RegMIPS32::Reg_FP);
     // For late-stage liveness analysis (e.g. asm-verbose mode), adding a fake
     // use of SP before the assignment of SP=FP keeps previous SP adjustments
     // from being dead-code eliminated.
     Context.insert<InstFakeUse>(SP);
-    _mov(SP, FP);
+    Sandboxer(this).reset_sp(FP);
   }
 
   VarList::reverse_iterator RIter, END;
 
   if (!PreservedGPRs.empty()) {
     uint32_t StackOffset = TotalStackSizeBytes - PreservedRegsSizeBytes;
     for (RIter = PreservedGPRs.rbegin(), END = PreservedGPRs.rend();
          RIter != END; ++RIter) {
       Variable *PhysicalRegister = getPhysicalRegister((*RIter)->getRegNum());
       Variable *SP = getPhysicalRegister(RegMIPS32::Reg_SP);
       OperandMIPS32Mem *MemoryLocation = OperandMIPS32Mem::create(
           Func, IceType_i32, SP,
           llvm::cast<ConstantInteger32>(Ctx->getConstantInt32(StackOffset)));
       _lw(PhysicalRegister, MemoryLocation);
       StackOffset += typeWidthInBytesOnStack(PhysicalRegister->getType());
     }
   }
 
   if (TotalStackSizeBytes) {
-    _addiu(SP, SP, TotalStackSizeBytes);
+    Sandboxer(this).addiu_sp(TotalStackSizeBytes);
   }
+  if (!getFlags().getUseSandboxing())
+    return;
 
-  return;
+  Variable *RA = getPhysicalRegister(RegMIPS32::Reg_RA);
+  Variable *RetValue = nullptr;
+  if (RI->getSrcSize())
+    RetValue = llvm::cast<Variable>(RI->getSrc(0));
+
+  Sandboxer(this).ret(RA, RetValue);
+
+  RI->setDeleted();
 }
 
 Variable *TargetMIPS32::PostLoweringLegalizer::newBaseRegister(
     Variable *Base, int32_t Offset, RegNumT ScratchRegNum) {
   // Legalize will likely need a lui/ori combination, but if the top bits are
   // all 0 from negating the offset and subtracting, we could use that instead.
   const bool ShouldSub = Offset != 0 && (-Offset & 0xFFFF0000) == 0;
   Variable *ScratchReg = Target->makeReg(IceType_i32, ScratchRegNum);
   if (ShouldSub) {
     Target->_addi(ScratchReg, Base, -Offset);
@@ skipping 133 matching lines @@
             Target->Ctx->getConstantInt32(Offset + 4)));
     OperandMIPS32Mem *Addr = legalizeMemOperand(TAddr);
 
     // FP arguments are passed in GP reg if first argument is in GP. In this
     // case type of the SrcR is still FP thus we need to explicitly generate sw
     // instead of swc1.
     const RegNumT RegNum = SrcR->getRegNum();
     const bool IsSrcGPReg = RegMIPS32::isGPRReg(SrcR->getRegNum());
     if (SrcTy == IceType_f32 && IsSrcGPReg) {
       Variable *SrcGPR = Target->makeReg(IceType_i32, RegNum);
-      Target->_sw(SrcGPR, Addr);
+      Sandboxer(Target).sw(SrcGPR, Addr);
     } else if (SrcTy == IceType_f64 && IsSrcGPReg) {
       Variable *SrcGPRHi =
           Target->makeReg(IceType_i32, RegMIPS32::get64PairFirstRegNum(RegNum));
       Variable *SrcGPRLo = Target->makeReg(
           IceType_i32, RegMIPS32::get64PairSecondRegNum(RegNum));
-      Target->_sw(SrcGPRHi, Addr);
+      Sandboxer(Target).sw(SrcGPRHi, Addr);
       OperandMIPS32Mem *AddrHi = legalizeMemOperand(TAddrHi);
-      Target->_sw(SrcGPRLo, AddrHi);
+      Sandboxer(Target).sw(SrcGPRLo, AddrHi);
     } else if (DestTy == IceType_f64 && IsSrcGPReg) {
       const auto FirstReg =
           (llvm::cast<Variable>(MovInstr->getSrc(0)))->getRegNum();
       const auto SecondReg =
           (llvm::cast<Variable>(MovInstr->getSrc(1)))->getRegNum();
       Variable *SrcGPRHi = Target->makeReg(IceType_i32, FirstReg);
       Variable *SrcGPRLo = Target->makeReg(IceType_i32, SecondReg);
-      Target->_sw(SrcGPRLo, Addr);
+      Sandboxer(Target).sw(SrcGPRLo, Addr);
       OperandMIPS32Mem *AddrHi = legalizeMemOperand(TAddrHi);
-      Target->_sw(SrcGPRHi, AddrHi);
+      Sandboxer(Target).sw(SrcGPRHi, AddrHi);
     } else {
-      Target->_sw(SrcR, Addr);
+      Sandboxer(Target).sw(SrcR, Addr);
     }
 
     Target->Context.insert<InstFakeDef>(Dest);
     Legalized = true;
   } else if (auto *Var = llvm::dyn_cast<Variable>(Src)) {
     if (Var->isRematerializable()) {
       // This is equivalent to an x86 _lea(RematOffset(%esp/%ebp), Variable).
 
       // ExtraOffset is only needed for stack-pointer based frames as we have
       // to account for spill storage.
@@ skipping 26 matching lines @@
           Variable *DestHi = Target->makeReg(
               IceType_f32, RegMIPS32::get64PairSecondRegNum(RegNum));
           OperandMIPS32Mem *AddrLo = OperandMIPS32Mem::create(
               Target->Func, IceType_i32, Base,
               llvm::cast<ConstantInteger32>(
                   Target->Ctx->getConstantInt32(Offset)));
           OperandMIPS32Mem *AddrHi = OperandMIPS32Mem::create(
               Target->Func, IceType_i32, Base,
               llvm::cast<ConstantInteger32>(
                   Target->Ctx->getConstantInt32(Offset + 4)));
-          Target->_lw(Reg, AddrLo);
+          Sandboxer(Target).lw(Reg, AddrLo);
           Target->_mov(DestLo, Reg);
-          Target->_lw(Reg, AddrHi);
+          Sandboxer(Target).lw(Reg, AddrHi);
           Target->_mov(DestHi, Reg);
         } else {
           OperandMIPS32Mem *TAddr = OperandMIPS32Mem::create(
               Target->Func, DestTy, Base,
               llvm::cast<ConstantInteger32>(
                   Target->Ctx->getConstantInt32(Offset)));
           OperandMIPS32Mem *Addr = legalizeMemOperand(TAddr);
           OperandMIPS32Mem *TAddrHi = OperandMIPS32Mem::create(
               Target->Func, DestTy, Base,
               llvm::cast<ConstantInteger32>(
                   Target->Ctx->getConstantInt32(Offset + 4)));
           // FP arguments are passed in GP reg if first argument is in GP.
           // In this case type of the Dest is still FP thus we need to
           // explicitly generate lw instead of lwc1.
           if (DestTy == IceType_f32 && IsDstGPReg) {
             Variable *DstGPR = Target->makeReg(IceType_i32, RegNum);
-            Target->_lw(DstGPR, Addr);
+            Sandboxer(Target).lw(DstGPR, Addr);
           } else if (DestTy == IceType_f64 && IsDstGPReg) {
             Variable *DstGPRHi = Target->makeReg(
                 IceType_i32, RegMIPS32::get64PairFirstRegNum(RegNum));
             Variable *DstGPRLo = Target->makeReg(
                 IceType_i32, RegMIPS32::get64PairSecondRegNum(RegNum));
-            Target->_lw(DstGPRHi, Addr);
+            Sandboxer(Target).lw(DstGPRHi, Addr);
             OperandMIPS32Mem *AddrHi = legalizeMemOperand(TAddrHi);
-            Target->_lw(DstGPRLo, AddrHi);
+            Sandboxer(Target).lw(DstGPRLo, AddrHi);
           } else if (DestTy == IceType_f64 && IsDstGPReg) {
             const auto FirstReg =
                 (llvm::cast<Variable>(MovInstr->getSrc(0)))->getRegNum();
             const auto SecondReg =
                 (llvm::cast<Variable>(MovInstr->getSrc(1)))->getRegNum();
             Variable *DstGPRHi = Target->makeReg(IceType_i32, FirstReg);
             Variable *DstGPRLo = Target->makeReg(IceType_i32, SecondReg);
-            Target->_lw(DstGPRLo, Addr);
+            Sandboxer(Target).lw(DstGPRLo, Addr);
             OperandMIPS32Mem *AddrHi = legalizeMemOperand(TAddrHi);
-            Target->_lw(DstGPRHi, AddrHi);
+            Sandboxer(Target).lw(DstGPRHi, AddrHi);
           } else {
-            Target->_lw(Dest, Addr);
+            Sandboxer(Target).lw(Dest, Addr);
           }
         }
         Legalized = true;
       }
     }
   }
 
   if (Legalized) {
     if (MovInstr->isDestRedefined()) {
       Target->_set_dest_redefined();
@@ skipping 64 matching lines @@
       auto *Src0V = llvm::dyn_cast_or_null<Variable>(Src0);
       auto *Src0M = llvm::dyn_cast_or_null<OperandMIPS32Mem>(Src0);
       auto *Src1M = llvm::dyn_cast_or_null<OperandMIPS32Mem>(Src1);
       Variable *Dst = CurInstr->getDest();
       if (auto *MovInstr = llvm::dyn_cast<InstMIPS32Mov>(CurInstr)) {
         Legalizer.legalizeMov(MovInstr);
         continue;
       }
       if (llvm::isa<InstMIPS32Sw>(CurInstr)) {
         if (auto *LegalMem = Legalizer.legalizeMemOperand(Src1M)) {
-          _sw(Src0V, LegalMem);
+          Sandboxer(this).sw(Src0V, LegalMem);
           CurInstr->setDeleted();
         }
         continue;
       }
       if (llvm::isa<InstMIPS32Swc1>(CurInstr)) {
         if (auto *LegalMem = Legalizer.legalizeMemOperand(Src1M)) {
           _swc1(Src0V, LegalMem);
           CurInstr->setDeleted();
         }
         continue;
       }
       if (llvm::isa<InstMIPS32Sdc1>(CurInstr)) {
         if (auto *LegalMem = Legalizer.legalizeMemOperand(Src1M)) {
           _sdc1(Src0V, LegalMem);
           CurInstr->setDeleted();
         }
         continue;
       }
       if (llvm::isa<InstMIPS32Lw>(CurInstr)) {
         if (auto *LegalMem = Legalizer.legalizeMemOperand(Src0M)) {
-          _lw(Dst, LegalMem);
+          Sandboxer(this).lw(Dst, LegalMem);
           CurInstr->setDeleted();
         }
         continue;
       }
       if (llvm::isa<InstMIPS32Lwc1>(CurInstr)) {
         if (auto *LegalMem = Legalizer.legalizeMemOperand(Src0M)) {
           _lwc1(Dst, LegalMem);
           CurInstr->setDeleted();
         }
         continue;
@@ skipping 133 matching lines @@
     Registers[RegMIPS32::val] = false;                                         \
   if (stackptr && (Exclude & RegSet_StackPointer))                             \
     Registers[RegMIPS32::val] = false;                                         \
   if (frameptr && (Exclude & RegSet_FramePointer))                             \
     Registers[RegMIPS32::val] = false;
 
   REGMIPS32_TABLE
 
 #undef X
 
+  if (NeedSandboxing) {
+    Registers[RegMIPS32::Reg_T6] = false;
+    Registers[RegMIPS32::Reg_T7] = false;
+    Registers[RegMIPS32::Reg_T8] = false;
+  }
   return Registers;
 }
 
 void TargetMIPS32::lowerAlloca(const InstAlloca *Instr) {
   // Conservatively require the stack to be aligned. Some stack adjustment
   // operations implemented below assume that the stack is aligned before the
   // alloca. All the alloca code ensures that the stack alignment is preserved
   // after the alloca. The stack alignment restriction can be relaxed in some
   // cases.
   NeedsStackAlignment = true;
@@ skipping 64 matching lines @@
     _and(T3, T1, T2);
     _subu(T4, SP, T3);
     if (Instr->getAlignInBytes()) {
       AlignAmount =
           legalizeToReg(Ctx->getConstantInt32(-AlignmentParam), Legal_Reg);
       _and(T5, T4, AlignAmount);
       _mov(Dest, T5);
     } else {
       _mov(Dest, T4);
     }
-    _mov(SP, Dest);
+    if (OptM1)
+      _mov(SP, Dest);
+    else
+      Sandboxer(this).reset_sp(Dest);
     return;
   }
 }
 
 void TargetMIPS32::lowerInt64Arithmetic(const InstArithmetic *Instr,
                                         Variable *Dest, Operand *Src0,
                                         Operand *Src1) {
   InstArithmetic::OpKind Op = Instr->getOp();
   auto *DestLo = llvm::cast<Variable>(loOperand(Dest));
   auto *DestHi = llvm::cast<Variable>(hiOperand(Dest));
@@ skipping 984 matching lines @@
   // eliminated as a result of the FakeKill of scratch registers after the call.
   // These fake-uses need to be placed here to avoid argument registers from
   // being used during the legalizeToReg() calls above.
   for (auto *RegArg : RegArgs) {
     Context.insert<InstFakeUse>(RegArg);
   }
 
   // If variable alloca is used the extra 16 bytes for argument build area
   // will be allocated on stack before a call.
   if (VariableAllocaUsed)
-    _addiu(SP, SP, -MaxOutArgsSizeBytes);
+    Sandboxer(this).addiu_sp(-MaxOutArgsSizeBytes);
 
   Inst *NewCall;
 
   // We don't need to define the return register if it is a vector.
   // We have inserted fake defs of it just after the call.
   if (ReturnReg && isVectorIntegerType(ReturnReg->getType())) {
     Variable *RetReg = nullptr;
     NewCall = InstMIPS32Call::create(Func, RetReg, CallTarget);
+    Context.insert(NewCall);
   } else {
-    NewCall = InstMIPS32Call::create(Func, ReturnReg, CallTarget);
+    NewCall = Sandboxer(this, InstBundleLock::Opt_AlignToEnd)
+                  .jal(ReturnReg, CallTarget);
   }
-  Context.insert(NewCall);
 
   if (VariableAllocaUsed)
-    _addiu(SP, SP, MaxOutArgsSizeBytes);
+    Sandboxer(this).addiu_sp(MaxOutArgsSizeBytes);
 
   // Insert a fake use of stack pointer to avoid dead code elimination of addiu
   // instruction.
   Context.insert<InstFakeUse>(SP);
 
   if (ReturnRegHi)
     Context.insert(InstFakeDef::create(Func, ReturnRegHi));
 
   if (ReturnReg) {
     if (auto *RetVec = llvm::dyn_cast<VariableVecOn32>(ReturnReg)) {
@@ skipping 1218 matching lines @@
       UnimplementedLoweringError(this, Instr); // Not required for PNaCl
     }
     return;
   }
   case Intrinsics::Stacksave: {
     Variable *SP = getPhysicalRegister(RegMIPS32::Reg_SP);
     _mov(Dest, SP);
     return;
   }
   case Intrinsics::Stackrestore: {
-    if (getFlags().getUseSandboxing()) {
-      UnimplementedLoweringError(this, Instr);
-      return;
-    }
     Variable *Val = legalizeToReg(Instr->getArg(0));
-    Variable *SP = getPhysicalRegister(RegMIPS32::Reg_SP);
-    _mov_redefined(SP, Val);
+    Sandboxer(this).reset_sp(Val);
     return;
   }
   case Intrinsics::Trap: {
     const uint32_t TrapCodeZero = 0;
     _teq(getZero(), getZero(), TrapCodeZero);
     return;
   }
   case Intrinsics::LoadSubVector: {
     UnimplementedLoweringError(this, Instr); // Not required for PNaCl
     return;
@@ skipping 780 matching lines @@
         Context.insert<InstFakeDef>(TReg);
         _mov(TReg, getZero());
       } else {
         // Load floats/doubles from literal pool.
         Constant *Offset = Ctx->getConstantSym(0, CFrom->getLabelName());
         Variable *TReg1 = makeReg(getPointerType());
         _lui(TReg1, Offset, RO_Hi);
         OperandMIPS32Mem *Addr =
             OperandMIPS32Mem::create(Func, Ty, TReg1, Offset);
         if (Ty == IceType_f32)
-          _lwc1(TReg, Addr, RO_Lo);
+          Sandboxer(this).lwc1(TReg, Addr, RO_Lo);
         else
-          _ldc1(TReg, Addr, RO_Lo);
+          Sandboxer(this).ldc1(TReg, Addr, RO_Lo);
       }
       return copyToReg(TReg, RegNum);
     }
   }
 
   if (auto *Var = llvm::dyn_cast<Variable>(From)) {
     if (Var->isRematerializable()) {
       if (Allowed & Legal_Rematerializable) {
         return From;
       }
@@ skipping 96 matching lines @@
   Str << "\t.set\t"
       << "nomips16\n";
   Str << "\t.set\t"
       << "noat\n";
 }
 
 SmallBitVector TargetMIPS32::TypeToRegisterSet[RCMIPS32_NUM];
 SmallBitVector TargetMIPS32::TypeToRegisterSetUnfiltered[RCMIPS32_NUM];
 SmallBitVector TargetMIPS32::RegisterAliases[RegMIPS32::Reg_NUM];
 
+TargetMIPS32::Sandboxer::Sandboxer(TargetMIPS32 *Target,
+                                   InstBundleLock::Option BundleOption)
+    : Target(Target), BundleOption(BundleOption) {}
+
+TargetMIPS32::Sandboxer::~Sandboxer() {}
+
+void TargetMIPS32::Sandboxer::createAutoBundle() {
+  Bundler = makeUnique<AutoBundle>(Target, BundleOption);
+}
+
+void TargetMIPS32::Sandboxer::addiu_sp(uint32_t StackOffset) {
+  Variable *SP = Target->getPhysicalRegister(RegMIPS32::Reg_SP);
+  if (!Target->NeedSandboxing) {
+    Target->_addiu(SP, SP, StackOffset);
+    return;
+  }
+  Variable *T7 = Target->getPhysicalRegister(RegMIPS32::Reg_T7);
+  createAutoBundle();
+  Target->_addiu(SP, SP, StackOffset);
+  Target->_and(SP, SP, T7);
+}
+
+void TargetMIPS32::Sandboxer::lw(Variable *Dest, OperandMIPS32Mem *Mem) {
+  Variable *Base = Mem->getBase();
+  Variable *T7 = Target->getPhysicalRegister(RegMIPS32::Reg_T7);
+  if (Target->NeedSandboxing && (Target->getStackReg() != Base->getRegNum())) {
+    createAutoBundle();
+    Target->_and(Base, Base, T7);
+  }
+  Target->_lw(Dest, Mem);
+  if (Target->NeedSandboxing && (Dest->getRegNum() == Target->getStackReg()))
+    Target->_and(Dest, Dest, T7);
+}
+
+void TargetMIPS32::Sandboxer::sw(Variable *Dest, OperandMIPS32Mem *Mem) {
+  Variable *Base = Mem->getBase();
+  Variable *T7 = Target->getPhysicalRegister(RegMIPS32::Reg_T7);
+  if (Target->NeedSandboxing && (Target->getStackReg() != Base->getRegNum())) {
+    createAutoBundle();
+    Target->_and(Base, Base, T7);
+  }
+  Target->_sw(Dest, Mem);
+}
+
+void TargetMIPS32::Sandboxer::lwc1(Variable *Dest, OperandMIPS32Mem *Mem,
+                                   RelocOp Reloc) {
+  Variable *Base = Mem->getBase();
+  Variable *T7 = Target->getPhysicalRegister(RegMIPS32::Reg_T7);
+  if (Target->NeedSandboxing && (Target->getStackReg() != Base->getRegNum())) {
+    createAutoBundle();
+    Target->_and(Base, Base, T7);
+  }
+  Target->_lwc1(Dest, Mem, Reloc);
+  if (Target->NeedSandboxing && (Dest->getRegNum() == Target->getStackReg()))
+    Target->_and(Dest, Dest, T7);
+}
+
+void TargetMIPS32::Sandboxer::ldc1(Variable *Dest, OperandMIPS32Mem *Mem,
+                                   RelocOp Reloc) {
+  Variable *Base = Mem->getBase();
+  Variable *T7 = Target->getPhysicalRegister(RegMIPS32::Reg_T7);
+  if (Target->NeedSandboxing && (Target->getStackReg() != Base->getRegNum())) {
+    createAutoBundle();
+    Target->_and(Base, Base, T7);
+  }
+  Target->_ldc1(Dest, Mem, Reloc);
+  if (Target->NeedSandboxing && (Dest->getRegNum() == Target->getStackReg()))
+    Target->_and(Dest, Dest, T7);
+}
+
+void TargetMIPS32::Sandboxer::ret(Variable *RetAddr, Variable *RetValue) {
+  if (!Target->NeedSandboxing) {
+    Target->_ret(RetAddr, RetValue);
+  }
+  Variable *T6 = Target->getPhysicalRegister(RegMIPS32::Reg_T6);
+  createAutoBundle();
+  Target->_and(RetAddr, RetAddr, T6);
+  Target->_ret(RetAddr, RetValue);
+}
+
+void TargetMIPS32::Sandboxer::reset_sp(Variable *Src) {
+  Variable *SP = Target->getPhysicalRegister(RegMIPS32::Reg_SP);
+  if (!Target->NeedSandboxing) {
+    Target->_mov(SP, Src);
+    return;
+  }
+  Variable *T7 = Target->getPhysicalRegister(RegMIPS32::Reg_T7);
+  createAutoBundle();
+  Target->_mov(SP, Src);
+  Target->_and(SP, SP, T7);
+}
+
+InstMIPS32Call *TargetMIPS32::Sandboxer::jal(Variable *ReturnReg,
+                                             Operand *CallTarget) {
+  if (Target->NeedSandboxing)
+    createAutoBundle();
+  return Target->Context.insert<InstMIPS32Call>(ReturnReg, CallTarget);
+}
+
 } // end of namespace MIPS32
 } // end of namespace Ice