scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952)
[qemu.git] / target-mips / cpu.c
1 /*
2 * QEMU MIPS CPU
3 *
4 * Copyright (c) 2012 SUSE LINUX Products GmbH
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see
18 * <http://www.gnu.org/licenses/lgpl-2.1.html>
19 */
20
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "cpu.h"
24 #include "kvm_mips.h"
25 #include "qemu-common.h"
26 #include "sysemu/kvm.h"
27 #include "exec/exec-all.h"
28
29
30 static void mips_cpu_set_pc(CPUState *cs, vaddr value)
31 {
32 MIPSCPU *cpu = MIPS_CPU(cs);
33 CPUMIPSState *env = &cpu->env;
34
35 env->active_tc.PC = value & ~(target_ulong)1;
36 if (value & 1) {
37 env->hflags |= MIPS_HFLAG_M16;
38 } else {
39 env->hflags &= ~(MIPS_HFLAG_M16);
40 }
41 }
42
43 static void mips_cpu_synchronize_from_tb(CPUState *cs, TranslationBlock *tb)
44 {
45 MIPSCPU *cpu = MIPS_CPU(cs);
46 CPUMIPSState *env = &cpu->env;
47
48 env->active_tc.PC = tb->pc;
49 env->hflags &= ~MIPS_HFLAG_BMASK;
50 env->hflags |= tb->flags & MIPS_HFLAG_BMASK;
51 }
52
53 static bool mips_cpu_has_work(CPUState *cs)
54 {
55 MIPSCPU *cpu = MIPS_CPU(cs);
56 CPUMIPSState *env = &cpu->env;
57 bool has_work = false;
58
59 /* Prior to MIPS Release 6 it is implementation dependent if non-enabled
60 interrupts wake-up the CPU, however most of the implementations only
61 check for interrupts that can be taken. */
62 if ((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
63 cpu_mips_hw_interrupts_pending(env)) {
64 if (cpu_mips_hw_interrupts_enabled(env) ||
65 (env->insn_flags & ISA_MIPS32R6)) {
66 has_work = true;
67 }
68 }
69
70 /* MIPS-MT has the ability to halt the CPU. */
71 if (env->CP0_Config3 & (1 << CP0C3_MT)) {
72 /* The QEMU model will issue an _WAKE request whenever the CPUs
73 should be woken up. */
74 if (cs->interrupt_request & CPU_INTERRUPT_WAKE) {
75 has_work = true;
76 }
77
78 if (!mips_vpe_active(env)) {
79 has_work = false;
80 }
81 }
82 /* MIPS Release 6 has the ability to halt the CPU. */
83 if (env->CP0_Config5 & (1 << CP0C5_VP)) {
84 if (cs->interrupt_request & CPU_INTERRUPT_WAKE) {
85 has_work = true;
86 }
87 if (!mips_vp_active(env)) {
88 has_work = false;
89 }
90 }
91 return has_work;
92 }
93
94 /* CPUClass::reset() */
95 static void mips_cpu_reset(CPUState *s)
96 {
97 MIPSCPU *cpu = MIPS_CPU(s);
98 MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(cpu);
99 CPUMIPSState *env = &cpu->env;
100
101 mcc->parent_reset(s);
102
103 memset(env, 0, offsetof(CPUMIPSState, mvp));
104 tlb_flush(s, 1);
105
106 cpu_state_reset(env);
107
108 #ifndef CONFIG_USER_ONLY
109 if (kvm_enabled()) {
110 kvm_mips_reset_vcpu(cpu);
111 }
112 #endif
113 }
114
115 static void mips_cpu_disas_set_info(CPUState *s, disassemble_info *info) {
116 #ifdef TARGET_WORDS_BIGENDIAN
117 info->print_insn = print_insn_big_mips;
118 #else
119 info->print_insn = print_insn_little_mips;
120 #endif
121 }
122
123 static void mips_cpu_realizefn(DeviceState *dev, Error **errp)
124 {
125 CPUState *cs = CPU(dev);
126 MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(dev);
127
128 cpu_reset(cs);
129 qemu_init_vcpu(cs);
130
131 mcc->parent_realize(dev, errp);
132 }
133
134 static void mips_cpu_initfn(Object *obj)
135 {
136 CPUState *cs = CPU(obj);
137 MIPSCPU *cpu = MIPS_CPU(obj);
138 CPUMIPSState *env = &cpu->env;
139
140 cs->env_ptr = env;
141 cpu_exec_init(cs, &error_abort);
142
143 if (tcg_enabled()) {
144 mips_tcg_init();
145 }
146 }
147
148 static void mips_cpu_class_init(ObjectClass *c, void *data)
149 {
150 MIPSCPUClass *mcc = MIPS_CPU_CLASS(c);
151 CPUClass *cc = CPU_CLASS(c);
152 DeviceClass *dc = DEVICE_CLASS(c);
153
154 mcc->parent_realize = dc->realize;
155 dc->realize = mips_cpu_realizefn;
156
157 mcc->parent_reset = cc->reset;
158 cc->reset = mips_cpu_reset;
159
160 cc->has_work = mips_cpu_has_work;
161 cc->do_interrupt = mips_cpu_do_interrupt;
162 cc->cpu_exec_interrupt = mips_cpu_exec_interrupt;
163 cc->dump_state = mips_cpu_dump_state;
164 cc->set_pc = mips_cpu_set_pc;
165 cc->synchronize_from_tb = mips_cpu_synchronize_from_tb;
166 cc->gdb_read_register = mips_cpu_gdb_read_register;
167 cc->gdb_write_register = mips_cpu_gdb_write_register;
168 #ifdef CONFIG_USER_ONLY
169 cc->handle_mmu_fault = mips_cpu_handle_mmu_fault;
170 #else
171 cc->do_unassigned_access = mips_cpu_unassigned_access;
172 cc->do_unaligned_access = mips_cpu_do_unaligned_access;
173 cc->get_phys_page_debug = mips_cpu_get_phys_page_debug;
174 cc->vmsd = &vmstate_mips_cpu;
175 #endif
176 cc->disas_set_info = mips_cpu_disas_set_info;
177
178 cc->gdb_num_core_regs = 73;
179 cc->gdb_stop_before_watchpoint = true;
180
181 /*
182 * Reason: mips_cpu_initfn() calls cpu_exec_init(), which saves
183 * the object in cpus -> dangling pointer after final
184 * object_unref().
185 */
186 dc->cannot_destroy_with_object_finalize_yet = true;
187 }
188
189 static const TypeInfo mips_cpu_type_info = {
190 .name = TYPE_MIPS_CPU,
191 .parent = TYPE_CPU,
192 .instance_size = sizeof(MIPSCPU),
193 .instance_init = mips_cpu_initfn,
194 .abstract = false,
195 .class_size = sizeof(MIPSCPUClass),
196 .class_init = mips_cpu_class_init,
197 };
198
199 static void mips_cpu_register_types(void)
200 {
201 type_register_static(&mips_cpu_type_info);
202 }
203
204 type_init(mips_cpu_register_types)