block/cloop: refuse images with bogus offsets (CVE-2014-0144)
[qemu.git] / target-cris / op_helper.c
blobbd9a583f9a1bb27bb70f572b23c5a442a45b2a6c
1 /*
2 * CRIS helper routines
4 * Copyright (c) 2007 AXIS Communications
5 * Written by Edgar E. Iglesias
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
21 #include "cpu.h"
22 #include "mmu.h"
23 #include "helper.h"
24 #include "qemu/host-utils.h"
26 //#define CRIS_OP_HELPER_DEBUG
29 #ifdef CRIS_OP_HELPER_DEBUG
30 #define D(x) x
31 #define D_LOG(...) qemu_log(__VA_ARGS__)
32 #else
33 #define D(x)
34 #define D_LOG(...) do { } while (0)
35 #endif
37 #if !defined(CONFIG_USER_ONLY)
38 #include "exec/softmmu_exec.h"
40 #define MMUSUFFIX _mmu
42 #define SHIFT 0
43 #include "exec/softmmu_template.h"
45 #define SHIFT 1
46 #include "exec/softmmu_template.h"
48 #define SHIFT 2
49 #include "exec/softmmu_template.h"
51 #define SHIFT 3
52 #include "exec/softmmu_template.h"
54 /* Try to fill the TLB and return an exception if error. If retaddr is
55 NULL, it means that the function was called in C code (i.e. not
56 from generated code or from helper.c) */
57 void tlb_fill(CPUState *cs, target_ulong addr, int is_write, int mmu_idx,
58 uintptr_t retaddr)
60 CRISCPU *cpu = CRIS_CPU(cs);
61 CPUCRISState *env = &cpu->env;
62 int ret;
64 D_LOG("%s pc=%x tpc=%x ra=%p\n", __func__,
65 env->pc, env->pregs[PR_EDA], (void *)retaddr);
66 ret = cris_cpu_handle_mmu_fault(cs, addr, is_write, mmu_idx);
67 if (unlikely(ret)) {
68 if (retaddr) {
69 /* now we have a real cpu fault */
70 if (cpu_restore_state(cs, retaddr)) {
71 /* Evaluate flags after retranslation. */
72 helper_top_evaluate_flags(env);
75 cpu_loop_exit(cs);
79 #endif
81 void helper_raise_exception(CPUCRISState *env, uint32_t index)
83 CPUState *cs = CPU(cris_env_get_cpu(env));
85 cs->exception_index = index;
86 cpu_loop_exit(cs);
89 void helper_tlb_flush_pid(CPUCRISState *env, uint32_t pid)
91 #if !defined(CONFIG_USER_ONLY)
92 pid &= 0xff;
93 if (pid != (env->pregs[PR_PID] & 0xff))
94 cris_mmu_flush_pid(env, env->pregs[PR_PID]);
95 #endif
98 void helper_spc_write(CPUCRISState *env, uint32_t new_spc)
100 #if !defined(CONFIG_USER_ONLY)
101 CRISCPU *cpu = cris_env_get_cpu(env);
102 CPUState *cs = CPU(cpu);
104 tlb_flush_page(cs, env->pregs[PR_SPC]);
105 tlb_flush_page(cs, new_spc);
106 #endif
109 void helper_dump(uint32_t a0, uint32_t a1, uint32_t a2)
111 qemu_log("%s: a0=%x a1=%x\n", __func__, a0, a1);
114 /* Used by the tlb decoder. */
115 #define EXTRACT_FIELD(src, start, end) \
116 (((src) >> start) & ((1 << (end - start + 1)) - 1))
118 void helper_movl_sreg_reg(CPUCRISState *env, uint32_t sreg, uint32_t reg)
120 #if !defined(CONFIG_USER_ONLY)
121 CRISCPU *cpu = cris_env_get_cpu(env);
122 #endif
123 uint32_t srs;
124 srs = env->pregs[PR_SRS];
125 srs &= 3;
126 env->sregs[srs][sreg] = env->regs[reg];
128 #if !defined(CONFIG_USER_ONLY)
129 if (srs == 1 || srs == 2) {
130 if (sreg == 6) {
131 /* Writes to tlb-hi write to mm_cause as a side
132 effect. */
133 env->sregs[SFR_RW_MM_TLB_HI] = env->regs[reg];
134 env->sregs[SFR_R_MM_CAUSE] = env->regs[reg];
136 else if (sreg == 5) {
137 uint32_t set;
138 uint32_t idx;
139 uint32_t lo, hi;
140 uint32_t vaddr;
141 int tlb_v;
143 idx = set = env->sregs[SFR_RW_MM_TLB_SEL];
144 set >>= 4;
145 set &= 3;
147 idx &= 15;
148 /* We've just made a write to tlb_lo. */
149 lo = env->sregs[SFR_RW_MM_TLB_LO];
150 /* Writes are done via r_mm_cause. */
151 hi = env->sregs[SFR_R_MM_CAUSE];
153 vaddr = EXTRACT_FIELD(env->tlbsets[srs-1][set][idx].hi,
154 13, 31);
155 vaddr <<= TARGET_PAGE_BITS;
156 tlb_v = EXTRACT_FIELD(env->tlbsets[srs-1][set][idx].lo,
157 3, 3);
158 env->tlbsets[srs - 1][set][idx].lo = lo;
159 env->tlbsets[srs - 1][set][idx].hi = hi;
161 D_LOG("tlb flush vaddr=%x v=%d pc=%x\n",
162 vaddr, tlb_v, env->pc);
163 if (tlb_v) {
164 tlb_flush_page(CPU(cpu), vaddr);
168 #endif
171 void helper_movl_reg_sreg(CPUCRISState *env, uint32_t reg, uint32_t sreg)
173 uint32_t srs;
174 env->pregs[PR_SRS] &= 3;
175 srs = env->pregs[PR_SRS];
177 #if !defined(CONFIG_USER_ONLY)
178 if (srs == 1 || srs == 2)
180 uint32_t set;
181 uint32_t idx;
182 uint32_t lo, hi;
184 idx = set = env->sregs[SFR_RW_MM_TLB_SEL];
185 set >>= 4;
186 set &= 3;
187 idx &= 15;
189 /* Update the mirror regs. */
190 hi = env->tlbsets[srs - 1][set][idx].hi;
191 lo = env->tlbsets[srs - 1][set][idx].lo;
192 env->sregs[SFR_RW_MM_TLB_HI] = hi;
193 env->sregs[SFR_RW_MM_TLB_LO] = lo;
195 #endif
196 env->regs[reg] = env->sregs[srs][sreg];
199 static void cris_ccs_rshift(CPUCRISState *env)
201 uint32_t ccs;
203 /* Apply the ccs shift. */
204 ccs = env->pregs[PR_CCS];
205 ccs = (ccs & 0xc0000000) | ((ccs & 0x0fffffff) >> 10);
206 if (ccs & U_FLAG)
208 /* Enter user mode. */
209 env->ksp = env->regs[R_SP];
210 env->regs[R_SP] = env->pregs[PR_USP];
213 env->pregs[PR_CCS] = ccs;
216 void helper_rfe(CPUCRISState *env)
218 int rflag = env->pregs[PR_CCS] & R_FLAG;
220 D_LOG("rfe: erp=%x pid=%x ccs=%x btarget=%x\n",
221 env->pregs[PR_ERP], env->pregs[PR_PID],
222 env->pregs[PR_CCS],
223 env->btarget);
225 cris_ccs_rshift(env);
227 /* RFE sets the P_FLAG only if the R_FLAG is not set. */
228 if (!rflag)
229 env->pregs[PR_CCS] |= P_FLAG;
232 void helper_rfn(CPUCRISState *env)
234 int rflag = env->pregs[PR_CCS] & R_FLAG;
236 D_LOG("rfn: erp=%x pid=%x ccs=%x btarget=%x\n",
237 env->pregs[PR_ERP], env->pregs[PR_PID],
238 env->pregs[PR_CCS],
239 env->btarget);
241 cris_ccs_rshift(env);
243 /* Set the P_FLAG only if the R_FLAG is not set. */
244 if (!rflag)
245 env->pregs[PR_CCS] |= P_FLAG;
247 /* Always set the M flag. */
248 env->pregs[PR_CCS] |= M_FLAG_V32;
251 uint32_t helper_lz(uint32_t t0)
253 return clz32(t0);
256 uint32_t helper_btst(CPUCRISState *env, uint32_t t0, uint32_t t1, uint32_t ccs)
258 /* FIXME: clean this up. */
260 /* des ref:
261 The N flag is set according to the selected bit in the dest reg.
262 The Z flag is set if the selected bit and all bits to the right are
263 zero.
264 The X flag is cleared.
265 Other flags are left untouched.
266 The destination reg is not affected.*/
267 unsigned int fz, sbit, bset, mask, masked_t0;
269 sbit = t1 & 31;
270 bset = !!(t0 & (1 << sbit));
271 mask = sbit == 31 ? -1 : (1 << (sbit + 1)) - 1;
272 masked_t0 = t0 & mask;
273 fz = !(masked_t0 | bset);
275 /* Clear the X, N and Z flags. */
276 ccs = ccs & ~(X_FLAG | N_FLAG | Z_FLAG);
277 if (env->pregs[PR_VR] < 32)
278 ccs &= ~(V_FLAG | C_FLAG);
279 /* Set the N and Z flags accordingly. */
280 ccs |= (bset << 3) | (fz << 2);
281 return ccs;
284 static inline uint32_t evaluate_flags_writeback(CPUCRISState *env,
285 uint32_t flags, uint32_t ccs)
287 unsigned int x, z, mask;
289 /* Extended arithmetics, leave the z flag alone. */
290 x = env->cc_x;
291 mask = env->cc_mask | X_FLAG;
292 if (x) {
293 z = flags & Z_FLAG;
294 mask = mask & ~z;
296 flags &= mask;
298 /* all insn clear the x-flag except setf or clrf. */
299 ccs &= ~mask;
300 ccs |= flags;
301 return ccs;
304 uint32_t helper_evaluate_flags_muls(CPUCRISState *env,
305 uint32_t ccs, uint32_t res, uint32_t mof)
307 uint32_t flags = 0;
308 int64_t tmp;
309 int dneg;
311 dneg = ((int32_t)res) < 0;
313 tmp = mof;
314 tmp <<= 32;
315 tmp |= res;
316 if (tmp == 0)
317 flags |= Z_FLAG;
318 else if (tmp < 0)
319 flags |= N_FLAG;
320 if ((dneg && mof != -1)
321 || (!dneg && mof != 0))
322 flags |= V_FLAG;
323 return evaluate_flags_writeback(env, flags, ccs);
326 uint32_t helper_evaluate_flags_mulu(CPUCRISState *env,
327 uint32_t ccs, uint32_t res, uint32_t mof)
329 uint32_t flags = 0;
330 uint64_t tmp;
332 tmp = mof;
333 tmp <<= 32;
334 tmp |= res;
335 if (tmp == 0)
336 flags |= Z_FLAG;
337 else if (tmp >> 63)
338 flags |= N_FLAG;
339 if (mof)
340 flags |= V_FLAG;
342 return evaluate_flags_writeback(env, flags, ccs);
345 uint32_t helper_evaluate_flags_mcp(CPUCRISState *env, uint32_t ccs,
346 uint32_t src, uint32_t dst, uint32_t res)
348 uint32_t flags = 0;
350 src = src & 0x80000000;
351 dst = dst & 0x80000000;
353 if ((res & 0x80000000L) != 0L)
355 flags |= N_FLAG;
356 if (!src && !dst)
357 flags |= V_FLAG;
358 else if (src & dst)
359 flags |= R_FLAG;
361 else
363 if (res == 0L)
364 flags |= Z_FLAG;
365 if (src & dst)
366 flags |= V_FLAG;
367 if (dst | src)
368 flags |= R_FLAG;
371 return evaluate_flags_writeback(env, flags, ccs);
374 uint32_t helper_evaluate_flags_alu_4(CPUCRISState *env, uint32_t ccs,
375 uint32_t src, uint32_t dst, uint32_t res)
377 uint32_t flags = 0;
379 src = src & 0x80000000;
380 dst = dst & 0x80000000;
382 if ((res & 0x80000000L) != 0L)
384 flags |= N_FLAG;
385 if (!src && !dst)
386 flags |= V_FLAG;
387 else if (src & dst)
388 flags |= C_FLAG;
390 else
392 if (res == 0L)
393 flags |= Z_FLAG;
394 if (src & dst)
395 flags |= V_FLAG;
396 if (dst | src)
397 flags |= C_FLAG;
400 return evaluate_flags_writeback(env, flags, ccs);
403 uint32_t helper_evaluate_flags_sub_4(CPUCRISState *env, uint32_t ccs,
404 uint32_t src, uint32_t dst, uint32_t res)
406 uint32_t flags = 0;
408 src = (~src) & 0x80000000;
409 dst = dst & 0x80000000;
411 if ((res & 0x80000000L) != 0L)
413 flags |= N_FLAG;
414 if (!src && !dst)
415 flags |= V_FLAG;
416 else if (src & dst)
417 flags |= C_FLAG;
419 else
421 if (res == 0L)
422 flags |= Z_FLAG;
423 if (src & dst)
424 flags |= V_FLAG;
425 if (dst | src)
426 flags |= C_FLAG;
429 flags ^= C_FLAG;
430 return evaluate_flags_writeback(env, flags, ccs);
433 uint32_t helper_evaluate_flags_move_4(CPUCRISState *env,
434 uint32_t ccs, uint32_t res)
436 uint32_t flags = 0;
438 if ((int32_t)res < 0)
439 flags |= N_FLAG;
440 else if (res == 0L)
441 flags |= Z_FLAG;
443 return evaluate_flags_writeback(env, flags, ccs);
445 uint32_t helper_evaluate_flags_move_2(CPUCRISState *env,
446 uint32_t ccs, uint32_t res)
448 uint32_t flags = 0;
450 if ((int16_t)res < 0L)
451 flags |= N_FLAG;
452 else if (res == 0)
453 flags |= Z_FLAG;
455 return evaluate_flags_writeback(env, flags, ccs);
458 /* TODO: This is expensive. We could split things up and only evaluate part of
459 CCR on a need to know basis. For now, we simply re-evaluate everything. */
460 void helper_evaluate_flags(CPUCRISState *env)
462 uint32_t src, dst, res;
463 uint32_t flags = 0;
465 src = env->cc_src;
466 dst = env->cc_dest;
467 res = env->cc_result;
469 if (env->cc_op == CC_OP_SUB || env->cc_op == CC_OP_CMP)
470 src = ~src;
472 /* Now, evaluate the flags. This stuff is based on
473 Per Zander's CRISv10 simulator. */
474 switch (env->cc_size)
476 case 1:
477 if ((res & 0x80L) != 0L)
479 flags |= N_FLAG;
480 if (((src & 0x80L) == 0L)
481 && ((dst & 0x80L) == 0L))
483 flags |= V_FLAG;
485 else if (((src & 0x80L) != 0L)
486 && ((dst & 0x80L) != 0L))
488 flags |= C_FLAG;
491 else
493 if ((res & 0xFFL) == 0L)
495 flags |= Z_FLAG;
497 if (((src & 0x80L) != 0L)
498 && ((dst & 0x80L) != 0L))
500 flags |= V_FLAG;
502 if ((dst & 0x80L) != 0L
503 || (src & 0x80L) != 0L)
505 flags |= C_FLAG;
508 break;
509 case 2:
510 if ((res & 0x8000L) != 0L)
512 flags |= N_FLAG;
513 if (((src & 0x8000L) == 0L)
514 && ((dst & 0x8000L) == 0L))
516 flags |= V_FLAG;
518 else if (((src & 0x8000L) != 0L)
519 && ((dst & 0x8000L) != 0L))
521 flags |= C_FLAG;
524 else
526 if ((res & 0xFFFFL) == 0L)
528 flags |= Z_FLAG;
530 if (((src & 0x8000L) != 0L)
531 && ((dst & 0x8000L) != 0L))
533 flags |= V_FLAG;
535 if ((dst & 0x8000L) != 0L
536 || (src & 0x8000L) != 0L)
538 flags |= C_FLAG;
541 break;
542 case 4:
543 if ((res & 0x80000000L) != 0L)
545 flags |= N_FLAG;
546 if (((src & 0x80000000L) == 0L)
547 && ((dst & 0x80000000L) == 0L))
549 flags |= V_FLAG;
551 else if (((src & 0x80000000L) != 0L) &&
552 ((dst & 0x80000000L) != 0L))
554 flags |= C_FLAG;
557 else
559 if (res == 0L)
560 flags |= Z_FLAG;
561 if (((src & 0x80000000L) != 0L)
562 && ((dst & 0x80000000L) != 0L))
563 flags |= V_FLAG;
564 if ((dst & 0x80000000L) != 0L
565 || (src & 0x80000000L) != 0L)
566 flags |= C_FLAG;
568 break;
569 default:
570 break;
573 if (env->cc_op == CC_OP_SUB || env->cc_op == CC_OP_CMP)
574 flags ^= C_FLAG;
576 env->pregs[PR_CCS] = evaluate_flags_writeback(env, flags,
577 env->pregs[PR_CCS]);
580 void helper_top_evaluate_flags(CPUCRISState *env)
582 switch (env->cc_op)
584 case CC_OP_MCP:
585 env->pregs[PR_CCS] = helper_evaluate_flags_mcp(env,
586 env->pregs[PR_CCS], env->cc_src,
587 env->cc_dest, env->cc_result);
588 break;
589 case CC_OP_MULS:
590 env->pregs[PR_CCS] = helper_evaluate_flags_muls(env,
591 env->pregs[PR_CCS], env->cc_result,
592 env->pregs[PR_MOF]);
593 break;
594 case CC_OP_MULU:
595 env->pregs[PR_CCS] = helper_evaluate_flags_mulu(env,
596 env->pregs[PR_CCS], env->cc_result,
597 env->pregs[PR_MOF]);
598 break;
599 case CC_OP_MOVE:
600 case CC_OP_AND:
601 case CC_OP_OR:
602 case CC_OP_XOR:
603 case CC_OP_ASR:
604 case CC_OP_LSR:
605 case CC_OP_LSL:
606 switch (env->cc_size)
608 case 4:
609 env->pregs[PR_CCS] =
610 helper_evaluate_flags_move_4(env,
611 env->pregs[PR_CCS],
612 env->cc_result);
613 break;
614 case 2:
615 env->pregs[PR_CCS] =
616 helper_evaluate_flags_move_2(env,
617 env->pregs[PR_CCS],
618 env->cc_result);
619 break;
620 default:
621 helper_evaluate_flags(env);
622 break;
624 break;
625 case CC_OP_FLAGS:
626 /* live. */
627 break;
628 case CC_OP_SUB:
629 case CC_OP_CMP:
630 if (env->cc_size == 4)
631 env->pregs[PR_CCS] =
632 helper_evaluate_flags_sub_4(env,
633 env->pregs[PR_CCS],
634 env->cc_src, env->cc_dest,
635 env->cc_result);
636 else
637 helper_evaluate_flags(env);
638 break;
639 default:
641 switch (env->cc_size)
643 case 4:
644 env->pregs[PR_CCS] =
645 helper_evaluate_flags_alu_4(env,
646 env->pregs[PR_CCS],
647 env->cc_src, env->cc_dest,
648 env->cc_result);
649 break;
650 default:
651 helper_evaluate_flags(env);
652 break;
655 break;