]> git.proxmox.com Git - mirror_qemu.git/blame - target-cris/helper.c
target-cris/translate.c: fix out of bounds read
[mirror_qemu.git] / target-cris / helper.c
CommitLineData
81fdc5f8
TS
1/*
2 * CRIS helper routines.
3 *
4 * Copyright (c) 2007 AXIS Communications AB
5 * Written by Edgar E. Iglesias.
6 *
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public
9 * License as published by the Free Software Foundation; either
10 * version 2 of the License, or (at your option) any later version.
11 *
12 * This library is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
16 *
17 * You should have received a copy of the GNU Lesser General Public
8167ee88 18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
81fdc5f8
TS
19 */
20
81fdc5f8
TS
21#include "cpu.h"
22#include "mmu.h"
1de7afc9 23#include "qemu/host-utils.h"
f08b6170 24#include "exec/cpu_ldst.h"
81fdc5f8 25
d12d51d5
AL
26
27//#define CRIS_HELPER_DEBUG
28
29
30#ifdef CRIS_HELPER_DEBUG
31#define D(x) x
3f668b6c 32#define D_LOG(...) qemu_log(__VA_ARGS__)
d12d51d5 33#else
e62b5b13 34#define D(x)
d12d51d5
AL
35#define D_LOG(...) do { } while (0)
36#endif
e62b5b13 37
81fdc5f8
TS
38#if defined(CONFIG_USER_ONLY)
39
97a8ea5a 40void cris_cpu_do_interrupt(CPUState *cs)
81fdc5f8 41{
97a8ea5a
AF
42 CRISCPU *cpu = CRIS_CPU(cs);
43 CPUCRISState *env = &cpu->env;
44
27103424 45 cs->exception_index = -1;
21317bc2 46 env->pregs[PR_ERP] = env->pc;
81fdc5f8
TS
47}
48
b21bfeea
AF
49void crisv10_cpu_do_interrupt(CPUState *cs)
50{
51 cris_cpu_do_interrupt(cs);
52}
53
7510454e 54int cris_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int rw,
97b348e7 55 int mmu_idx)
81fdc5f8 56{
7510454e 57 CRISCPU *cpu = CRIS_CPU(cs);
878096ee 58
27103424 59 cs->exception_index = 0xaa;
7510454e
AF
60 cpu->env.pregs[PR_EDA] = address;
61 cpu_dump_state(cs, stderr, fprintf, 0);
21317bc2 62 return 1;
81fdc5f8
TS
63}
64
81fdc5f8
TS
65#else /* !CONFIG_USER_ONLY */
66
e62b5b13 67
a1170bfd 68static void cris_shift_ccs(CPUCRISState *env)
e62b5b13 69{
21317bc2
AF
70 uint32_t ccs;
71 /* Apply the ccs shift. */
72 ccs = env->pregs[PR_CCS];
73 ccs = ((ccs & 0xc0000000) | ((ccs << 12) >> 2)) & ~0x3ff;
74 env->pregs[PR_CCS] = ccs;
e62b5b13
EI
75}
76
7510454e 77int cris_cpu_handle_mmu_fault(CPUState *cs, vaddr address, int rw,
21317bc2 78 int mmu_idx)
81fdc5f8 79{
7510454e
AF
80 CRISCPU *cpu = CRIS_CPU(cs);
81 CPUCRISState *env = &cpu->env;
21317bc2
AF
82 struct cris_mmu_result res;
83 int prot, miss;
84 int r = -1;
85 target_ulong phy;
86
7510454e
AF
87 D(printf("%s addr=%" VADDR_PRIx " pc=%x rw=%x\n",
88 __func__, address, env->pc, rw));
21317bc2
AF
89 miss = cris_mmu_translate(&res, env, address & TARGET_PAGE_MASK,
90 rw, mmu_idx, 0);
91 if (miss) {
27103424 92 if (cs->exception_index == EXCP_BUSFAULT) {
a47dddd7 93 cpu_abort(cs,
21317bc2 94 "CRIS: Illegal recursive bus fault."
7510454e 95 "addr=%" VADDR_PRIx " rw=%d\n",
21317bc2
AF
96 address, rw);
97 }
98
99 env->pregs[PR_EDA] = address;
27103424 100 cs->exception_index = EXCP_BUSFAULT;
21317bc2
AF
101 env->fault_vector = res.bf_vec;
102 r = 1;
103 } else {
104 /*
105 * Mask off the cache selection bit. The ETRAX busses do not
106 * see the top bit.
107 */
108 phy = res.phy & ~0x80000000;
109 prot = res.prot;
0c591eb0 110 tlb_set_page(cs, address & TARGET_PAGE_MASK, phy,
21317bc2
AF
111 prot, mmu_idx, TARGET_PAGE_SIZE);
112 r = 0;
113 }
114 if (r > 0) {
7510454e
AF
115 D_LOG("%s returns %d irqreq=%x addr=%" VADDR_PRIx " phy=%x vec=%x"
116 " pc=%x\n", __func__, r, cs->interrupt_request, address, res.phy,
21317bc2
AF
117 res.bf_vec, env->pc);
118 }
119 return r;
81fdc5f8
TS
120}
121
b21bfeea 122void crisv10_cpu_do_interrupt(CPUState *cs)
7a977356 123{
b21bfeea
AF
124 CRISCPU *cpu = CRIS_CPU(cs);
125 CPUCRISState *env = &cpu->env;
21317bc2
AF
126 int ex_vec = -1;
127
128 D_LOG("exception index=%d interrupt_req=%d\n",
27103424 129 cs->exception_index,
259186a7 130 cs->interrupt_request);
21317bc2 131
d66433ff
EI
132 if (env->dslot) {
133 /* CRISv10 never takes interrupts while in a delay-slot. */
a47dddd7 134 cpu_abort(cs, "CRIS: Interrupt on delay-slot\n");
d66433ff
EI
135 }
136
21317bc2 137 assert(!(env->pregs[PR_CCS] & PFIX_FLAG));
27103424 138 switch (cs->exception_index) {
21317bc2
AF
139 case EXCP_BREAK:
140 /* These exceptions are genereated by the core itself.
141 ERP should point to the insn following the brk. */
142 ex_vec = env->trap_vector;
143 env->pregs[PRV10_BRP] = env->pc;
144 break;
145
146 case EXCP_NMI:
147 /* NMI is hardwired to vector zero. */
148 ex_vec = 0;
149 env->pregs[PR_CCS] &= ~M_FLAG_V10;
150 env->pregs[PRV10_BRP] = env->pc;
151 break;
152
153 case EXCP_BUSFAULT:
a47dddd7 154 cpu_abort(cs, "Unhandled busfault");
21317bc2
AF
155 break;
156
157 default:
158 /* The interrupt controller gives us the vector. */
159 ex_vec = env->interrupt_vector;
160 /* Normal interrupts are taken between
161 TB's. env->pc is valid here. */
162 env->pregs[PR_ERP] = env->pc;
163 break;
164 }
165
166 if (env->pregs[PR_CCS] & U_FLAG) {
167 /* Swap stack pointers. */
168 env->pregs[PR_USP] = env->regs[R_SP];
169 env->regs[R_SP] = env->ksp;
170 }
171
172 /* Now that we are in kernel mode, load the handlers address. */
173 env->pc = cpu_ldl_code(env, env->pregs[PR_EBP] + ex_vec * 4);
174 env->locked_irq = 1;
175 env->pregs[PR_CCS] |= F_FLAG_V10; /* set F. */
176
177 qemu_log_mask(CPU_LOG_INT, "%s isr=%x vec=%x ccs=%x pid=%d erp=%x\n",
178 __func__, env->pc, ex_vec,
179 env->pregs[PR_CCS],
180 env->pregs[PR_PID],
181 env->pregs[PR_ERP]);
7a977356
EI
182}
183
97a8ea5a 184void cris_cpu_do_interrupt(CPUState *cs)
81fdc5f8 185{
97a8ea5a
AF
186 CRISCPU *cpu = CRIS_CPU(cs);
187 CPUCRISState *env = &cpu->env;
21317bc2
AF
188 int ex_vec = -1;
189
21317bc2 190 D_LOG("exception index=%d interrupt_req=%d\n",
27103424 191 cs->exception_index,
259186a7 192 cs->interrupt_request);
21317bc2 193
27103424 194 switch (cs->exception_index) {
21317bc2
AF
195 case EXCP_BREAK:
196 /* These exceptions are genereated by the core itself.
197 ERP should point to the insn following the brk. */
198 ex_vec = env->trap_vector;
199 env->pregs[PR_ERP] = env->pc;
200 break;
201
202 case EXCP_NMI:
203 /* NMI is hardwired to vector zero. */
204 ex_vec = 0;
205 env->pregs[PR_CCS] &= ~M_FLAG_V32;
206 env->pregs[PR_NRP] = env->pc;
207 break;
208
209 case EXCP_BUSFAULT:
210 ex_vec = env->fault_vector;
211 env->pregs[PR_ERP] = env->pc;
212 break;
213
214 default:
215 /* The interrupt controller gives us the vector. */
216 ex_vec = env->interrupt_vector;
217 /* Normal interrupts are taken between
218 TB's. env->pc is valid here. */
219 env->pregs[PR_ERP] = env->pc;
220 break;
221 }
222
223 /* Fill in the IDX field. */
224 env->pregs[PR_EXS] = (ex_vec & 0xff) << 8;
225
226 if (env->dslot) {
227 D_LOG("excp isr=%x PC=%x ds=%d SP=%x"
228 " ERP=%x pid=%x ccs=%x cc=%d %x\n",
229 ex_vec, env->pc, env->dslot,
230 env->regs[R_SP],
231 env->pregs[PR_ERP], env->pregs[PR_PID],
232 env->pregs[PR_CCS],
233 env->cc_op, env->cc_mask);
234 /* We loose the btarget, btaken state here so rexec the
235 branch. */
236 env->pregs[PR_ERP] -= env->dslot;
237 /* Exception starts with dslot cleared. */
238 env->dslot = 0;
239 }
b41f7df0 240
21317bc2
AF
241 if (env->pregs[PR_CCS] & U_FLAG) {
242 /* Swap stack pointers. */
243 env->pregs[PR_USP] = env->regs[R_SP];
244 env->regs[R_SP] = env->ksp;
245 }
246
247 /* Apply the CRIS CCS shift. Clears U if set. */
248 cris_shift_ccs(env);
249
250 /* Now that we are in kernel mode, load the handlers address.
251 This load may not fault, real hw leaves that behaviour as
252 undefined. */
253 env->pc = cpu_ldl_code(env, env->pregs[PR_EBP] + ex_vec * 4);
254
255 /* Clear the excption_index to avoid spurios hw_aborts for recursive
256 bus faults. */
27103424 257 cs->exception_index = -1;
21317bc2
AF
258
259 D_LOG("%s isr=%x vec=%x ccs=%x pid=%d erp=%x\n",
260 __func__, env->pc, ex_vec,
261 env->pregs[PR_CCS],
262 env->pregs[PR_PID],
263 env->pregs[PR_ERP]);
81fdc5f8
TS
264}
265
00b941e5 266hwaddr cris_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
81fdc5f8 267{
00b941e5 268 CRISCPU *cpu = CRIS_CPU(cs);
21317bc2
AF
269 uint32_t phy = addr;
270 struct cris_mmu_result res;
271 int miss;
272
00b941e5 273 miss = cris_mmu_translate(&res, &cpu->env, addr, 0, 0, 1);
21317bc2
AF
274 /* If D TLB misses, try I TLB. */
275 if (miss) {
00b941e5 276 miss = cris_mmu_translate(&res, &cpu->env, addr, 2, 0, 1);
21317bc2
AF
277 }
278
279 if (!miss) {
280 phy = res.phy;
281 }
282 D(fprintf(stderr, "%s %x -> %x\n", __func__, addr, phy));
283 return phy;
81fdc5f8
TS
284}
285#endif
5a1f7f44
RH
286
287bool cris_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
288{
289 CPUClass *cc = CPU_GET_CLASS(cs);
290 CRISCPU *cpu = CRIS_CPU(cs);
291 CPUCRISState *env = &cpu->env;
292 bool ret = false;
293
294 if (interrupt_request & CPU_INTERRUPT_HARD
295 && (env->pregs[PR_CCS] & I_FLAG)
296 && !env->locked_irq) {
297 cs->exception_index = EXCP_IRQ;
298 cc->do_interrupt(cs);
299 ret = true;
300 }
301 if (interrupt_request & CPU_INTERRUPT_NMI) {
302 unsigned int m_flag_archval;
303 if (env->pregs[PR_VR] < 32) {
304 m_flag_archval = M_FLAG_V10;
305 } else {
306 m_flag_archval = M_FLAG_V32;
307 }
308 if ((env->pregs[PR_CCS] & m_flag_archval)) {
309 cs->exception_index = EXCP_NMI;
310 cc->do_interrupt(cs);
311 ret = true;
312 }
313 }
314
315 return ret;
316}