usb: limit combined packets to 1 MiB (CVE-2021-3527)
[qemu/kevin.git] / hw / sparc / leon3.c
blob7e16eea9e6746b3426c4eb811a4279a8e31b2e78
1 /*
2 * QEMU Leon3 System Emulator
4 * Copyright (c) 2010-2019 AdaCore
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
25 #include "qemu/osdep.h"
26 #include "qemu/units.h"
27 #include "qemu/error-report.h"
28 #include "qapi/error.h"
29 #include "qemu-common.h"
30 #include "qemu/datadir.h"
31 #include "cpu.h"
32 #include "hw/irq.h"
33 #include "qemu/timer.h"
34 #include "hw/ptimer.h"
35 #include "hw/qdev-properties.h"
36 #include "sysemu/sysemu.h"
37 #include "sysemu/qtest.h"
38 #include "sysemu/reset.h"
39 #include "hw/boards.h"
40 #include "hw/loader.h"
41 #include "elf.h"
42 #include "trace.h"
43 #include "exec/address-spaces.h"
45 #include "hw/sparc/grlib.h"
46 #include "hw/misc/grlib_ahb_apb_pnp.h"
48 /* Default system clock. */
49 #define CPU_CLK (40 * 1000 * 1000)
51 #define LEON3_PROM_FILENAME "u-boot.bin"
52 #define LEON3_PROM_OFFSET (0x00000000)
53 #define LEON3_RAM_OFFSET (0x40000000)
55 #define LEON3_UART_OFFSET (0x80000100)
56 #define LEON3_UART_IRQ (3)
58 #define LEON3_IRQMP_OFFSET (0x80000200)
60 #define LEON3_TIMER_OFFSET (0x80000300)
61 #define LEON3_TIMER_IRQ (6)
62 #define LEON3_TIMER_COUNT (2)
64 #define LEON3_APB_PNP_OFFSET (0x800FF000)
65 #define LEON3_AHB_PNP_OFFSET (0xFFFFF000)
67 typedef struct ResetData {
68 SPARCCPU *cpu;
69 uint32_t entry; /* save kernel entry in case of reset */
70 target_ulong sp; /* initial stack pointer */
71 } ResetData;
73 static uint32_t *gen_store_u32(uint32_t *code, hwaddr addr, uint32_t val)
75 stl_p(code++, 0x82100000); /* mov %g0, %g1 */
76 stl_p(code++, 0x84100000); /* mov %g0, %g2 */
77 stl_p(code++, 0x03000000 +
78 extract32(addr, 10, 22));
79 /* sethi %hi(addr), %g1 */
80 stl_p(code++, 0x82106000 +
81 extract32(addr, 0, 10));
82 /* or %g1, addr, %g1 */
83 stl_p(code++, 0x05000000 +
84 extract32(val, 10, 22));
85 /* sethi %hi(val), %g2 */
86 stl_p(code++, 0x8410a000 +
87 extract32(val, 0, 10));
88 /* or %g2, val, %g2 */
89 stl_p(code++, 0xc4204000); /* st %g2, [ %g1 ] */
91 return code;
95 * When loading a kernel in RAM the machine is expected to be in a different
96 * state (eg: initialized by the bootloader). This little code reproduces
97 * this behavior.
99 static void write_bootloader(CPUSPARCState *env, uint8_t *base,
100 hwaddr kernel_addr)
102 uint32_t *p = (uint32_t *) base;
104 /* Initialize the UARTs */
105 /* *UART_CONTROL = UART_RECEIVE_ENABLE | UART_TRANSMIT_ENABLE; */
106 p = gen_store_u32(p, 0x80000108, 3);
108 /* Initialize the TIMER 0 */
109 /* *GPTIMER_SCALER_RELOAD = 40 - 1; */
110 p = gen_store_u32(p, 0x80000304, 39);
111 /* *GPTIMER0_COUNTER_RELOAD = 0xFFFE; */
112 p = gen_store_u32(p, 0x80000314, 0xFFFFFFFE);
113 /* *GPTIMER0_CONFIG = GPTIMER_ENABLE | GPTIMER_RESTART; */
114 p = gen_store_u32(p, 0x80000318, 3);
116 /* JUMP to the entry point */
117 stl_p(p++, 0x82100000); /* mov %g0, %g1 */
118 stl_p(p++, 0x03000000 + extract32(kernel_addr, 10, 22));
119 /* sethi %hi(kernel_addr), %g1 */
120 stl_p(p++, 0x82106000 + extract32(kernel_addr, 0, 10));
121 /* or kernel_addr, %g1 */
122 stl_p(p++, 0x81c04000); /* jmp %g1 */
123 stl_p(p++, 0x01000000); /* nop */
126 static void main_cpu_reset(void *opaque)
128 ResetData *s = (ResetData *)opaque;
129 CPUState *cpu = CPU(s->cpu);
130 CPUSPARCState *env = &s->cpu->env;
132 cpu_reset(cpu);
134 cpu->halted = 0;
135 env->pc = s->entry;
136 env->npc = s->entry + 4;
137 env->regbase[6] = s->sp;
140 void leon3_irq_ack(void *irq_manager, int intno)
142 grlib_irqmp_ack((DeviceState *)irq_manager, intno);
146 * This device assumes that the incoming 'level' value on the
147 * qemu_irq is the interrupt number, not just a simple 0/1 level.
149 static void leon3_set_pil_in(void *opaque, int n, int level)
151 CPUSPARCState *env = opaque;
152 uint32_t pil_in = level;
153 CPUState *cs;
155 assert(env != NULL);
157 env->pil_in = pil_in;
159 if (env->pil_in && (env->interrupt_index == 0 ||
160 (env->interrupt_index & ~15) == TT_EXTINT)) {
161 unsigned int i;
163 for (i = 15; i > 0; i--) {
164 if (env->pil_in & (1 << i)) {
165 int old_interrupt = env->interrupt_index;
167 env->interrupt_index = TT_EXTINT | i;
168 if (old_interrupt != env->interrupt_index) {
169 cs = env_cpu(env);
170 trace_leon3_set_irq(i);
171 cpu_interrupt(cs, CPU_INTERRUPT_HARD);
173 break;
176 } else if (!env->pil_in && (env->interrupt_index & ~15) == TT_EXTINT) {
177 cs = env_cpu(env);
178 trace_leon3_reset_irq(env->interrupt_index & 15);
179 env->interrupt_index = 0;
180 cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
184 static void leon3_generic_hw_init(MachineState *machine)
186 ram_addr_t ram_size = machine->ram_size;
187 const char *bios_name = machine->firmware ?: LEON3_PROM_FILENAME;
188 const char *kernel_filename = machine->kernel_filename;
189 SPARCCPU *cpu;
190 CPUSPARCState *env;
191 MemoryRegion *address_space_mem = get_system_memory();
192 MemoryRegion *prom = g_new(MemoryRegion, 1);
193 int ret;
194 char *filename;
195 int bios_size;
196 int prom_size;
197 ResetData *reset_info;
198 DeviceState *dev, *irqmpdev;
199 int i;
200 AHBPnp *ahb_pnp;
201 APBPnp *apb_pnp;
203 /* Init CPU */
204 cpu = SPARC_CPU(cpu_create(machine->cpu_type));
205 env = &cpu->env;
207 cpu_sparc_set_id(env, 0);
209 /* Reset data */
210 reset_info = g_malloc0(sizeof(ResetData));
211 reset_info->cpu = cpu;
212 reset_info->sp = LEON3_RAM_OFFSET + ram_size;
213 qemu_register_reset(main_cpu_reset, reset_info);
215 ahb_pnp = GRLIB_AHB_PNP(qdev_new(TYPE_GRLIB_AHB_PNP));
216 sysbus_realize_and_unref(SYS_BUS_DEVICE(ahb_pnp), &error_fatal);
217 sysbus_mmio_map(SYS_BUS_DEVICE(ahb_pnp), 0, LEON3_AHB_PNP_OFFSET);
218 grlib_ahb_pnp_add_entry(ahb_pnp, 0, 0, GRLIB_VENDOR_GAISLER,
219 GRLIB_LEON3_DEV, GRLIB_AHB_MASTER,
220 GRLIB_CPU_AREA);
222 apb_pnp = GRLIB_APB_PNP(qdev_new(TYPE_GRLIB_APB_PNP));
223 sysbus_realize_and_unref(SYS_BUS_DEVICE(apb_pnp), &error_fatal);
224 sysbus_mmio_map(SYS_BUS_DEVICE(apb_pnp), 0, LEON3_APB_PNP_OFFSET);
225 grlib_ahb_pnp_add_entry(ahb_pnp, LEON3_APB_PNP_OFFSET, 0xFFF,
226 GRLIB_VENDOR_GAISLER, GRLIB_APBMST_DEV,
227 GRLIB_AHB_SLAVE, GRLIB_AHBMEM_AREA);
229 /* Allocate IRQ manager */
230 irqmpdev = qdev_new(TYPE_GRLIB_IRQMP);
231 qdev_init_gpio_in_named_with_opaque(DEVICE(cpu), leon3_set_pil_in,
232 env, "pil", 1);
233 qdev_connect_gpio_out_named(irqmpdev, "grlib-irq", 0,
234 qdev_get_gpio_in_named(DEVICE(cpu), "pil", 0));
235 sysbus_realize_and_unref(SYS_BUS_DEVICE(irqmpdev), &error_fatal);
236 sysbus_mmio_map(SYS_BUS_DEVICE(irqmpdev), 0, LEON3_IRQMP_OFFSET);
237 env->irq_manager = irqmpdev;
238 env->qemu_irq_ack = leon3_irq_manager;
239 grlib_apb_pnp_add_entry(apb_pnp, LEON3_IRQMP_OFFSET, 0xFFF,
240 GRLIB_VENDOR_GAISLER, GRLIB_IRQMP_DEV,
241 2, 0, GRLIB_APBIO_AREA);
243 /* Allocate RAM */
244 if (ram_size > 1 * GiB) {
245 error_report("Too much memory for this machine: %" PRId64 "MB,"
246 " maximum 1G",
247 ram_size / MiB);
248 exit(1);
251 memory_region_add_subregion(address_space_mem, LEON3_RAM_OFFSET,
252 machine->ram);
254 /* Allocate BIOS */
255 prom_size = 8 * MiB;
256 memory_region_init_rom(prom, NULL, "Leon3.bios", prom_size, &error_fatal);
257 memory_region_add_subregion(address_space_mem, LEON3_PROM_OFFSET, prom);
259 /* Load boot prom */
260 filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
262 if (filename) {
263 bios_size = get_image_size(filename);
264 } else {
265 bios_size = -1;
268 if (bios_size > prom_size) {
269 error_report("could not load prom '%s': file too big", filename);
270 exit(1);
273 if (bios_size > 0) {
274 ret = load_image_targphys(filename, LEON3_PROM_OFFSET, bios_size);
275 if (ret < 0 || ret > prom_size) {
276 error_report("could not load prom '%s'", filename);
277 exit(1);
279 } else if (kernel_filename == NULL && !qtest_enabled()) {
280 error_report("Can't read bios image '%s'", filename
281 ? filename
282 : LEON3_PROM_FILENAME);
283 exit(1);
285 g_free(filename);
287 /* Can directly load an application. */
288 if (kernel_filename != NULL) {
289 long kernel_size;
290 uint64_t entry;
292 kernel_size = load_elf(kernel_filename, NULL, NULL, NULL,
293 &entry, NULL, NULL, NULL,
294 1 /* big endian */, EM_SPARC, 0, 0);
295 if (kernel_size < 0) {
296 kernel_size = load_uimage(kernel_filename, NULL, &entry,
297 NULL, NULL, NULL);
299 if (kernel_size < 0) {
300 error_report("could not load kernel '%s'", kernel_filename);
301 exit(1);
303 if (bios_size <= 0) {
305 * If there is no bios/monitor just start the application but put
306 * the machine in an initialized state through a little
307 * bootloader.
309 uint8_t *bootloader_entry;
311 bootloader_entry = memory_region_get_ram_ptr(prom);
312 write_bootloader(env, bootloader_entry, entry);
313 env->pc = LEON3_PROM_OFFSET;
314 env->npc = LEON3_PROM_OFFSET + 4;
315 reset_info->entry = LEON3_PROM_OFFSET;
319 /* Allocate timers */
320 dev = qdev_new(TYPE_GRLIB_GPTIMER);
321 qdev_prop_set_uint32(dev, "nr-timers", LEON3_TIMER_COUNT);
322 qdev_prop_set_uint32(dev, "frequency", CPU_CLK);
323 qdev_prop_set_uint32(dev, "irq-line", LEON3_TIMER_IRQ);
324 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
326 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, LEON3_TIMER_OFFSET);
327 for (i = 0; i < LEON3_TIMER_COUNT; i++) {
328 sysbus_connect_irq(SYS_BUS_DEVICE(dev), i,
329 qdev_get_gpio_in(irqmpdev, LEON3_TIMER_IRQ + i));
332 grlib_apb_pnp_add_entry(apb_pnp, LEON3_TIMER_OFFSET, 0xFFF,
333 GRLIB_VENDOR_GAISLER, GRLIB_GPTIMER_DEV,
334 0, LEON3_TIMER_IRQ, GRLIB_APBIO_AREA);
336 /* Allocate uart */
337 dev = qdev_new(TYPE_GRLIB_APB_UART);
338 qdev_prop_set_chr(dev, "chrdev", serial_hd(0));
339 sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
340 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, LEON3_UART_OFFSET);
341 sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
342 qdev_get_gpio_in(irqmpdev, LEON3_UART_IRQ));
343 grlib_apb_pnp_add_entry(apb_pnp, LEON3_UART_OFFSET, 0xFFF,
344 GRLIB_VENDOR_GAISLER, GRLIB_APBUART_DEV, 1,
345 LEON3_UART_IRQ, GRLIB_APBIO_AREA);
348 static void leon3_generic_machine_init(MachineClass *mc)
350 mc->desc = "Leon-3 generic";
351 mc->init = leon3_generic_hw_init;
352 mc->default_cpu_type = SPARC_CPU_TYPE_NAME("LEON3");
353 mc->default_ram_id = "leon3.ram";
356 DEFINE_MACHINE("leon3_generic", leon3_generic_machine_init)