esp: check command buffer length before write(CVE-2016-4439)
[qemu/ar7.git] / target-lm32 / cpu.c
bloba783d461dd40efea1924e9004d211673bf830272
1 /*
2 * QEMU LatticeMico32 CPU
4 * Copyright (c) 2012 SUSE LINUX Products GmbH
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see
18 * <http://www.gnu.org/licenses/lgpl-2.1.html>
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "cpu.h"
24 #include "qemu-common.h"
25 #include "exec/exec-all.h"
28 static void lm32_cpu_set_pc(CPUState *cs, vaddr value)
30 LM32CPU *cpu = LM32_CPU(cs);
32 cpu->env.pc = value;
35 /* Sort alphabetically by type name. */
36 static gint lm32_cpu_list_compare(gconstpointer a, gconstpointer b)
38 ObjectClass *class_a = (ObjectClass *)a;
39 ObjectClass *class_b = (ObjectClass *)b;
40 const char *name_a, *name_b;
42 name_a = object_class_get_name(class_a);
43 name_b = object_class_get_name(class_b);
44 return strcmp(name_a, name_b);
47 static void lm32_cpu_list_entry(gpointer data, gpointer user_data)
49 ObjectClass *oc = data;
50 CPUListState *s = user_data;
51 const char *typename = object_class_get_name(oc);
52 char *name;
54 name = g_strndup(typename, strlen(typename) - strlen("-" TYPE_LM32_CPU));
55 (*s->cpu_fprintf)(s->file, " %s\n", name);
56 g_free(name);
60 void lm32_cpu_list(FILE *f, fprintf_function cpu_fprintf)
62 CPUListState s = {
63 .file = f,
64 .cpu_fprintf = cpu_fprintf,
66 GSList *list;
68 list = object_class_get_list(TYPE_LM32_CPU, false);
69 list = g_slist_sort(list, lm32_cpu_list_compare);
70 (*cpu_fprintf)(f, "Available CPUs:\n");
71 g_slist_foreach(list, lm32_cpu_list_entry, &s);
72 g_slist_free(list);
75 static void lm32_cpu_init_cfg_reg(LM32CPU *cpu)
77 CPULM32State *env = &cpu->env;
78 uint32_t cfg = 0;
80 if (cpu->features & LM32_FEATURE_MULTIPLY) {
81 cfg |= CFG_M;
84 if (cpu->features & LM32_FEATURE_DIVIDE) {
85 cfg |= CFG_D;
88 if (cpu->features & LM32_FEATURE_SHIFT) {
89 cfg |= CFG_S;
92 if (cpu->features & LM32_FEATURE_SIGN_EXTEND) {
93 cfg |= CFG_X;
96 if (cpu->features & LM32_FEATURE_I_CACHE) {
97 cfg |= CFG_IC;
100 if (cpu->features & LM32_FEATURE_D_CACHE) {
101 cfg |= CFG_DC;
104 if (cpu->features & LM32_FEATURE_CYCLE_COUNT) {
105 cfg |= CFG_CC;
108 cfg |= (cpu->num_interrupts << CFG_INT_SHIFT);
109 cfg |= (cpu->num_breakpoints << CFG_BP_SHIFT);
110 cfg |= (cpu->num_watchpoints << CFG_WP_SHIFT);
111 cfg |= (cpu->revision << CFG_REV_SHIFT);
113 env->cfg = cfg;
116 static bool lm32_cpu_has_work(CPUState *cs)
118 return cs->interrupt_request & CPU_INTERRUPT_HARD;
121 /* CPUClass::reset() */
122 static void lm32_cpu_reset(CPUState *s)
124 LM32CPU *cpu = LM32_CPU(s);
125 LM32CPUClass *lcc = LM32_CPU_GET_CLASS(cpu);
126 CPULM32State *env = &cpu->env;
128 lcc->parent_reset(s);
130 /* reset cpu state */
131 memset(env, 0, offsetof(CPULM32State, eba));
133 lm32_cpu_init_cfg_reg(cpu);
134 tlb_flush(s, 1);
137 static void lm32_cpu_disas_set_info(CPUState *cpu, disassemble_info *info)
139 info->mach = bfd_mach_lm32;
140 info->print_insn = print_insn_lm32;
143 static void lm32_cpu_realizefn(DeviceState *dev, Error **errp)
145 CPUState *cs = CPU(dev);
146 LM32CPUClass *lcc = LM32_CPU_GET_CLASS(dev);
148 cpu_reset(cs);
150 qemu_init_vcpu(cs);
152 lcc->parent_realize(dev, errp);
155 static void lm32_cpu_initfn(Object *obj)
157 CPUState *cs = CPU(obj);
158 LM32CPU *cpu = LM32_CPU(obj);
159 CPULM32State *env = &cpu->env;
160 static bool tcg_initialized;
162 cs->env_ptr = env;
163 cpu_exec_init(cs, &error_abort);
165 env->flags = 0;
167 if (tcg_enabled() && !tcg_initialized) {
168 tcg_initialized = true;
169 lm32_translate_init();
173 static void lm32_basic_cpu_initfn(Object *obj)
175 LM32CPU *cpu = LM32_CPU(obj);
177 cpu->revision = 3;
178 cpu->num_interrupts = 32;
179 cpu->num_breakpoints = 4;
180 cpu->num_watchpoints = 4;
181 cpu->features = LM32_FEATURE_SHIFT
182 | LM32_FEATURE_SIGN_EXTEND
183 | LM32_FEATURE_CYCLE_COUNT;
186 static void lm32_standard_cpu_initfn(Object *obj)
188 LM32CPU *cpu = LM32_CPU(obj);
190 cpu->revision = 3;
191 cpu->num_interrupts = 32;
192 cpu->num_breakpoints = 4;
193 cpu->num_watchpoints = 4;
194 cpu->features = LM32_FEATURE_MULTIPLY
195 | LM32_FEATURE_DIVIDE
196 | LM32_FEATURE_SHIFT
197 | LM32_FEATURE_SIGN_EXTEND
198 | LM32_FEATURE_I_CACHE
199 | LM32_FEATURE_CYCLE_COUNT;
202 static void lm32_full_cpu_initfn(Object *obj)
204 LM32CPU *cpu = LM32_CPU(obj);
206 cpu->revision = 3;
207 cpu->num_interrupts = 32;
208 cpu->num_breakpoints = 4;
209 cpu->num_watchpoints = 4;
210 cpu->features = LM32_FEATURE_MULTIPLY
211 | LM32_FEATURE_DIVIDE
212 | LM32_FEATURE_SHIFT
213 | LM32_FEATURE_SIGN_EXTEND
214 | LM32_FEATURE_I_CACHE
215 | LM32_FEATURE_D_CACHE
216 | LM32_FEATURE_CYCLE_COUNT;
219 typedef struct LM32CPUInfo {
220 const char *name;
221 void (*initfn)(Object *obj);
222 } LM32CPUInfo;
224 static const LM32CPUInfo lm32_cpus[] = {
226 .name = "lm32-basic",
227 .initfn = lm32_basic_cpu_initfn,
230 .name = "lm32-standard",
231 .initfn = lm32_standard_cpu_initfn,
234 .name = "lm32-full",
235 .initfn = lm32_full_cpu_initfn,
239 static ObjectClass *lm32_cpu_class_by_name(const char *cpu_model)
241 ObjectClass *oc;
242 char *typename;
244 if (cpu_model == NULL) {
245 return NULL;
248 typename = g_strdup_printf("%s-" TYPE_LM32_CPU, cpu_model);
249 oc = object_class_by_name(typename);
250 g_free(typename);
251 if (oc != NULL && (!object_class_dynamic_cast(oc, TYPE_LM32_CPU) ||
252 object_class_is_abstract(oc))) {
253 oc = NULL;
255 return oc;
258 static void lm32_cpu_class_init(ObjectClass *oc, void *data)
260 LM32CPUClass *lcc = LM32_CPU_CLASS(oc);
261 CPUClass *cc = CPU_CLASS(oc);
262 DeviceClass *dc = DEVICE_CLASS(oc);
264 lcc->parent_realize = dc->realize;
265 dc->realize = lm32_cpu_realizefn;
267 lcc->parent_reset = cc->reset;
268 cc->reset = lm32_cpu_reset;
270 cc->class_by_name = lm32_cpu_class_by_name;
271 cc->has_work = lm32_cpu_has_work;
272 cc->do_interrupt = lm32_cpu_do_interrupt;
273 cc->cpu_exec_interrupt = lm32_cpu_exec_interrupt;
274 cc->dump_state = lm32_cpu_dump_state;
275 cc->set_pc = lm32_cpu_set_pc;
276 cc->gdb_read_register = lm32_cpu_gdb_read_register;
277 cc->gdb_write_register = lm32_cpu_gdb_write_register;
278 #ifdef CONFIG_USER_ONLY
279 cc->handle_mmu_fault = lm32_cpu_handle_mmu_fault;
280 #else
281 cc->get_phys_page_debug = lm32_cpu_get_phys_page_debug;
282 cc->vmsd = &vmstate_lm32_cpu;
283 #endif
284 cc->gdb_num_core_regs = 32 + 7;
285 cc->gdb_stop_before_watchpoint = true;
286 cc->debug_excp_handler = lm32_debug_excp_handler;
287 cc->disas_set_info = lm32_cpu_disas_set_info;
290 * Reason: lm32_cpu_initfn() calls cpu_exec_init(), which saves
291 * the object in cpus -> dangling pointer after final
292 * object_unref().
294 dc->cannot_destroy_with_object_finalize_yet = true;
297 static void lm32_register_cpu_type(const LM32CPUInfo *info)
299 TypeInfo type_info = {
300 .parent = TYPE_LM32_CPU,
301 .instance_init = info->initfn,
304 type_info.name = g_strdup_printf("%s-" TYPE_LM32_CPU, info->name);
305 type_register(&type_info);
306 g_free((void *)type_info.name);
309 static const TypeInfo lm32_cpu_type_info = {
310 .name = TYPE_LM32_CPU,
311 .parent = TYPE_CPU,
312 .instance_size = sizeof(LM32CPU),
313 .instance_init = lm32_cpu_initfn,
314 .abstract = true,
315 .class_size = sizeof(LM32CPUClass),
316 .class_init = lm32_cpu_class_init,
319 static void lm32_cpu_register_types(void)
321 int i;
323 type_register_static(&lm32_cpu_type_info);
324 for (i = 0; i < ARRAY_SIZE(lm32_cpus); i++) {
325 lm32_register_cpu_type(&lm32_cpus[i]);
329 type_init(lm32_cpu_register_types)