scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952)
[qemu.git] / target-mips / gdbstub.c
1 /*
2 * MIPS gdb server stub
3 *
4 * Copyright (c) 2003-2005 Fabrice Bellard
5 * Copyright (c) 2013 SUSE LINUX Products GmbH
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19 */
20 #include "qemu/osdep.h"
21 #include "qemu-common.h"
22 #include "cpu.h"
23 #include "exec/gdbstub.h"
24
25 int mips_cpu_gdb_read_register(CPUState *cs, uint8_t *mem_buf, int n)
26 {
27 MIPSCPU *cpu = MIPS_CPU(cs);
28 CPUMIPSState *env = &cpu->env;
29
30 if (n < 32) {
31 return gdb_get_regl(mem_buf, env->active_tc.gpr[n]);
32 }
33 if (env->CP0_Config1 & (1 << CP0C1_FP) && n >= 38 && n < 72) {
34 switch (n) {
35 case 70:
36 return gdb_get_regl(mem_buf, (int32_t)env->active_fpu.fcr31);
37 case 71:
38 return gdb_get_regl(mem_buf, (int32_t)env->active_fpu.fcr0);
39 default:
40 if (env->CP0_Status & (1 << CP0St_FR)) {
41 return gdb_get_regl(mem_buf,
42 env->active_fpu.fpr[n - 38].d);
43 } else {
44 return gdb_get_regl(mem_buf,
45 env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX]);
46 }
47 }
48 }
49 switch (n) {
50 case 32:
51 return gdb_get_regl(mem_buf, (int32_t)env->CP0_Status);
52 case 33:
53 return gdb_get_regl(mem_buf, env->active_tc.LO[0]);
54 case 34:
55 return gdb_get_regl(mem_buf, env->active_tc.HI[0]);
56 case 35:
57 return gdb_get_regl(mem_buf, env->CP0_BadVAddr);
58 case 36:
59 return gdb_get_regl(mem_buf, (int32_t)env->CP0_Cause);
60 case 37:
61 return gdb_get_regl(mem_buf, env->active_tc.PC |
62 !!(env->hflags & MIPS_HFLAG_M16));
63 case 72:
64 return gdb_get_regl(mem_buf, 0); /* fp */
65 case 89:
66 return gdb_get_regl(mem_buf, (int32_t)env->CP0_PRid);
67 default:
68 if (n > 89) {
69 return 0;
70 }
71 /* 16 embedded regs. */
72 return gdb_get_regl(mem_buf, 0);
73 }
74
75 return 0;
76 }
77
78 int mips_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
79 {
80 MIPSCPU *cpu = MIPS_CPU(cs);
81 CPUMIPSState *env = &cpu->env;
82 target_ulong tmp;
83
84 tmp = ldtul_p(mem_buf);
85
86 if (n < 32) {
87 env->active_tc.gpr[n] = tmp;
88 return sizeof(target_ulong);
89 }
90 if (env->CP0_Config1 & (1 << CP0C1_FP) && n >= 38 && n < 72) {
91 switch (n) {
92 case 70:
93 env->active_fpu.fcr31 = tmp & 0xFF83FFFF;
94 /* set rounding mode */
95 restore_rounding_mode(env);
96 /* set flush-to-zero mode */
97 restore_flush_mode(env);
98 break;
99 case 71:
100 /* FIR is read-only. Ignore writes. */
101 break;
102 default:
103 if (env->CP0_Status & (1 << CP0St_FR)) {
104 env->active_fpu.fpr[n - 38].d = tmp;
105 } else {
106 env->active_fpu.fpr[n - 38].w[FP_ENDIAN_IDX] = tmp;
107 }
108 break;
109 }
110 return sizeof(target_ulong);
111 }
112 switch (n) {
113 case 32:
114 #ifndef CONFIG_USER_ONLY
115 cpu_mips_store_status(env, tmp);
116 #endif
117 break;
118 case 33:
119 env->active_tc.LO[0] = tmp;
120 break;
121 case 34:
122 env->active_tc.HI[0] = tmp;
123 break;
124 case 35:
125 env->CP0_BadVAddr = tmp;
126 break;
127 case 36:
128 #ifndef CONFIG_USER_ONLY
129 cpu_mips_store_cause(env, tmp);
130 #endif
131 break;
132 case 37:
133 env->active_tc.PC = tmp & ~(target_ulong)1;
134 if (tmp & 1) {
135 env->hflags |= MIPS_HFLAG_M16;
136 } else {
137 env->hflags &= ~(MIPS_HFLAG_M16);
138 }
139 break;
140 case 72: /* fp, ignored */
141 break;
142 default:
143 if (n > 89) {
144 return 0;
145 }
146 /* Other registers are readonly. Ignore writes. */
147 break;
148 }
149
150 return sizeof(target_ulong);
151 }