esp: check dma length before reading scsi command(CVE-2016-4441)
[qemu/ar7.git] / hw / ppc / spapr_rtc.c
blob3a17ac42e44be65cd2710cc05d7513af62f4fc8e
1 /*
2 * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
4 * RTAS Real Time Clock
6 * Copyright (c) 2010-2011 David Gibson, IBM Corporation.
7 * Copyright 2014 David Gibson, Red Hat.
9 * Permission is hereby granted, free of charge, to any person obtaining a copy
10 * of this software and associated documentation files (the "Software"), to deal
11 * in the Software without restriction, including without limitation the rights
12 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
13 * copies of the Software, and to permit persons to whom the Software is
14 * furnished to do so, subject to the following conditions:
16 * The above copyright notice and this permission notice shall be included in
17 * all copies or substantial portions of the Software.
19 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
20 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
21 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
22 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
23 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
24 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 * THE SOFTWARE.
28 #include "qemu/osdep.h"
29 #include "cpu.h"
30 #include "qemu/timer.h"
31 #include "sysemu/sysemu.h"
32 #include "hw/ppc/spapr.h"
33 #include "qapi-event.h"
34 #include "qemu/cutils.h"
36 #define SPAPR_RTC(obj) \
37 OBJECT_CHECK(sPAPRRTCState, (obj), TYPE_SPAPR_RTC)
39 typedef struct sPAPRRTCState sPAPRRTCState;
40 struct sPAPRRTCState {
41 /*< private >*/
42 SysBusDevice parent_obj;
43 int64_t ns_offset;
46 void spapr_rtc_read(DeviceState *dev, struct tm *tm, uint32_t *ns)
48 sPAPRRTCState *rtc = SPAPR_RTC(dev);
49 int64_t host_ns = qemu_clock_get_ns(rtc_clock);
50 int64_t guest_ns;
51 time_t guest_s;
53 assert(rtc);
55 guest_ns = host_ns + rtc->ns_offset;
56 guest_s = guest_ns / NANOSECONDS_PER_SECOND;
58 if (tm) {
59 gmtime_r(&guest_s, tm);
61 if (ns) {
62 *ns = guest_ns;
66 int spapr_rtc_import_offset(DeviceState *dev, int64_t legacy_offset)
68 sPAPRRTCState *rtc;
70 if (!dev) {
71 return -ENODEV;
74 rtc = SPAPR_RTC(dev);
76 rtc->ns_offset = legacy_offset * NANOSECONDS_PER_SECOND;
78 return 0;
81 static void rtas_get_time_of_day(PowerPCCPU *cpu, sPAPRMachineState *spapr,
82 uint32_t token, uint32_t nargs,
83 target_ulong args,
84 uint32_t nret, target_ulong rets)
86 struct tm tm;
87 uint32_t ns;
89 if ((nargs != 0) || (nret != 8)) {
90 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
91 return;
94 if (!spapr->rtc) {
95 rtas_st(rets, 0, RTAS_OUT_HW_ERROR);
96 return;
99 spapr_rtc_read(spapr->rtc, &tm, &ns);
101 rtas_st(rets, 0, RTAS_OUT_SUCCESS);
102 rtas_st(rets, 1, tm.tm_year + 1900);
103 rtas_st(rets, 2, tm.tm_mon + 1);
104 rtas_st(rets, 3, tm.tm_mday);
105 rtas_st(rets, 4, tm.tm_hour);
106 rtas_st(rets, 5, tm.tm_min);
107 rtas_st(rets, 6, tm.tm_sec);
108 rtas_st(rets, 7, ns);
111 static void rtas_set_time_of_day(PowerPCCPU *cpu, sPAPRMachineState *spapr,
112 uint32_t token, uint32_t nargs,
113 target_ulong args,
114 uint32_t nret, target_ulong rets)
116 sPAPRRTCState *rtc;
117 struct tm tm;
118 time_t new_s;
119 int64_t host_ns;
121 if ((nargs != 7) || (nret != 1)) {
122 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
123 return;
126 if (!spapr->rtc) {
127 rtas_st(rets, 0, RTAS_OUT_HW_ERROR);
128 return;
131 tm.tm_year = rtas_ld(args, 0) - 1900;
132 tm.tm_mon = rtas_ld(args, 1) - 1;
133 tm.tm_mday = rtas_ld(args, 2);
134 tm.tm_hour = rtas_ld(args, 3);
135 tm.tm_min = rtas_ld(args, 4);
136 tm.tm_sec = rtas_ld(args, 5);
138 new_s = mktimegm(&tm);
139 if (new_s == -1) {
140 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
141 return;
144 /* Generate a monitor event for the change */
145 qapi_event_send_rtc_change(qemu_timedate_diff(&tm), &error_abort);
147 rtc = SPAPR_RTC(spapr->rtc);
149 host_ns = qemu_clock_get_ns(rtc_clock);
151 rtc->ns_offset = (new_s * NANOSECONDS_PER_SECOND) - host_ns;
153 rtas_st(rets, 0, RTAS_OUT_SUCCESS);
156 static void spapr_rtc_qom_date(Object *obj, struct tm *current_tm, Error **errp)
158 spapr_rtc_read(DEVICE(obj), current_tm, NULL);
161 static void spapr_rtc_realize(DeviceState *dev, Error **errp)
163 sPAPRRTCState *rtc = SPAPR_RTC(dev);
164 struct tm tm;
165 time_t host_s;
166 int64_t rtc_ns;
168 /* Initialize the RTAS RTC from host time */
170 qemu_get_timedate(&tm, 0);
171 host_s = mktimegm(&tm);
172 rtc_ns = qemu_clock_get_ns(rtc_clock);
173 rtc->ns_offset = host_s * NANOSECONDS_PER_SECOND - rtc_ns;
175 object_property_add_tm(OBJECT(rtc), "date", spapr_rtc_qom_date, NULL);
178 static const VMStateDescription vmstate_spapr_rtc = {
179 .name = "spapr/rtc",
180 .version_id = 1,
181 .minimum_version_id = 1,
182 .fields = (VMStateField[]) {
183 VMSTATE_INT64(ns_offset, sPAPRRTCState),
184 VMSTATE_END_OF_LIST()
188 static void spapr_rtc_class_init(ObjectClass *oc, void *data)
190 DeviceClass *dc = DEVICE_CLASS(oc);
192 dc->realize = spapr_rtc_realize;
193 dc->vmsd = &vmstate_spapr_rtc;
195 spapr_rtas_register(RTAS_GET_TIME_OF_DAY, "get-time-of-day",
196 rtas_get_time_of_day);
197 spapr_rtas_register(RTAS_SET_TIME_OF_DAY, "set-time-of-day",
198 rtas_set_time_of_day);
201 static const TypeInfo spapr_rtc_info = {
202 .name = TYPE_SPAPR_RTC,
203 .parent = TYPE_SYS_BUS_DEVICE,
204 .instance_size = sizeof(sPAPRRTCState),
205 .class_init = spapr_rtc_class_init,
208 static void spapr_rtc_register_types(void)
210 type_register_static(&spapr_rtc_info);
212 type_init(spapr_rtc_register_types)