Enhance the fault detection, correction of the fault reporting.
Signed-off-by: Pierre Morel
Reviewed-by: Yi Min Zhao
---
hw/s390x/s390-pci-inst.c | 27 ---
1 file changed, 16 insertions(+), 11 deletions(-)
diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index 4a2f996..62ebaa0 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -372,6 +372,11 @@ int pcilg_service_call(S390CPU *cpu, uint8_t r1, uint8_t
r2)
len = env->regs[r2] & 0xf;
offset = env->regs[r2 + 1];
+if (!(fh & FH_MASK_ENABLE)) {
+setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
+return 0;
+}
+
pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
if (!pbdev) {
DPRINTF("pcilg no pci dev\n");
@@ -380,12 +385,7 @@ int pcilg_service_call(S390CPU *cpu, uint8_t r1, uint8_t
r2)
}
switch (pbdev->state) {
-case ZPCI_FS_RESERVED:
-case ZPCI_FS_STANDBY:
-case ZPCI_FS_DISABLED:
case ZPCI_FS_PERMANENT_ERROR:
-setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
-return 0;
case ZPCI_FS_ERROR:
setcc(cpu, ZPCI_PCI_LS_ERR);
s390_set_status_code(env, r2, ZPCI_PCI_ST_BLOCKED);
@@ -394,8 +394,9 @@ int pcilg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2)
break;
}
-if (pcias < 6) {
-if ((8 - (offset & 0x7)) < len) {
+switch (pcias) {
+case 0 ... 5:
+if (!len || (len > (8 - (offset & 0x7 {
program_interrupt(env, PGM_OPERAND, 4);
return 0;
}
@@ -406,8 +407,9 @@ int pcilg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2)
program_interrupt(env, PGM_OPERAND, 4);
return 0;
}
-} else if (pcias == 15) {
-if ((4 - (offset & 0x3)) < len) {
+break;
+case 15:
+if (!len || (len > (4 - (offset & 0x3))) || len == 3) {
program_interrupt(env, PGM_OPERAND, 4);
return 0;
}
@@ -418,8 +420,11 @@ int pcilg_service_call(S390CPU *cpu, uint8_t r1, uint8_t
r2)
program_interrupt(env, PGM_OPERAND, 4);
return 0;
}
-} else {
-DPRINTF("invalid space\n");
+break;
+case PCI_ROM_SLOT:
+/* Fall through */
+default:
+DPRINTF("pcilg invalid space\n");
setcc(cpu, ZPCI_PCI_LS_ERR);
s390_set_status_code(env, r2, ZPCI_PCI_ST_INVAL_AS);
return 0;
--
2.7.4