From patchwork Fri Feb 28 09:30:53 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Borntraeger X-Patchwork-Id: 325091 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 8A9412C0097 for ; Fri, 28 Feb 2014 20:33:59 +1100 (EST) Received: from localhost ([::1]:49956 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WJJpN-000636-9q for incoming@patchwork.ozlabs.org; Fri, 28 Feb 2014 04:33:57 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51907) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WJJmi-0002Uv-90 for qemu-devel@nongnu.org; Fri, 28 Feb 2014 04:31:21 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WJJmR-0004l6-Bh for qemu-devel@nongnu.org; Fri, 28 Feb 2014 04:31:12 -0500 Received: from e06smtp12.uk.ibm.com ([195.75.94.108]:50450) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WJJmR-0004kh-2J for qemu-devel@nongnu.org; Fri, 28 Feb 2014 04:30:55 -0500 Received: from /spool/local by e06smtp12.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 28 Feb 2014 09:30:54 -0000 Received: from d06dlp03.portsmouth.uk.ibm.com (9.149.20.15) by e06smtp12.uk.ibm.com (192.168.101.142) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Fri, 28 Feb 2014 09:30:52 -0000 Received: from b06cxnps4074.portsmouth.uk.ibm.com (d06relay11.portsmouth.uk.ibm.com [9.149.109.196]) by d06dlp03.portsmouth.uk.ibm.com (Postfix) with ESMTP id 4B9861B0804B for ; Fri, 28 Feb 2014 09:30:33 +0000 (GMT) Received: from d06av09.portsmouth.uk.ibm.com (d06av09.portsmouth.uk.ibm.com [9.149.37.250]) by b06cxnps4074.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id s1S9UdPU56229972 for ; Fri, 28 Feb 2014 09:30:39 GMT Received: from d06av09.portsmouth.uk.ibm.com (localhost [127.0.0.1]) by d06av09.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id s1S9Uo0l032058 for ; Fri, 28 Feb 2014 02:30:51 -0700 Received: from tuxmaker.boeblingen.de.ibm.com (tuxmaker.boeblingen.de.ibm.com [9.152.85.9]) by d06av09.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id s1S9UnKg032043; Fri, 28 Feb 2014 02:30:50 -0700 Received: by tuxmaker.boeblingen.de.ibm.com (Postfix, from userid 25651) id 02973122444D; Fri, 28 Feb 2014 10:30:50 +0100 (CET) From: Christian Borntraeger To: qemu-devel , Anthony Liguori , Peter Maydell Date: Fri, 28 Feb 2014 10:30:53 +0100 Message-Id: <1393579866-43465-10-git-send-email-borntraeger@de.ibm.com> X-Mailer: git-send-email 1.8.4.2 In-Reply-To: <1393579866-43465-1-git-send-email-borntraeger@de.ibm.com> References: <1393579866-43465-1-git-send-email-borntraeger@de.ibm.com> X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 14022809-8372-0000-0000-000008D55CF1 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x-2.6.x [generic] X-Received-From: 195.75.94.108 Cc: Thomas Huth , Alexander Graf , Christian Borntraeger , Jens Freimann , Cornelia Huck , Richard Henderson Subject: [Qemu-devel] [PULL 09/22] s390x/sclp: Add missing checks to SCLP handler X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Thomas Huth If the 51 most significant bits of the SCCB address are zero or equal to the prefix, we should throw an specification exception, too. Also moved the check for privileged mode to sclp_service_call() to have all program checks in one place now. Signed-off-by: Thomas Huth Reviewed-by: Cornelia Huck Signed-off-by: Christian Borntraeger --- hw/s390x/sclp.c | 9 +++++++-- target-s390x/cpu.h | 2 +- target-s390x/kvm.c | 6 +----- target-s390x/misc_helper.c | 2 +- 4 files changed, 10 insertions(+), 9 deletions(-) diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c index 6134d4f..9880977 100644 --- a/hw/s390x/sclp.c +++ b/hw/s390x/sclp.c @@ -107,7 +107,7 @@ static void sclp_execute(SCCB *sccb, uint32_t code) } } -int sclp_service_call(uint64_t sccb, uint32_t code) +int sclp_service_call(CPUS390XState *env, uint64_t sccb, uint32_t code) { int r = 0; SCCB work_sccb; @@ -115,11 +115,16 @@ int sclp_service_call(uint64_t sccb, uint32_t code) hwaddr sccb_len = sizeof(SCCB); /* first some basic checks on program checks */ + if (env->psw.mask & PSW_MASK_PSTATE) { + r = -PGM_PRIVILEGED; + goto out; + } if (cpu_physical_memory_is_io(sccb)) { r = -PGM_ADDRESSING; goto out; } - if (sccb & ~0x7ffffff8ul) { + if ((sccb & ~0x1fffUL) == 0 || (sccb & ~0x1fffUL) == env->psa + || (sccb & ~0x7ffffff8UL) != 0) { r = -PGM_SPECIFICATION; goto out; } diff --git a/target-s390x/cpu.h b/target-s390x/cpu.h index 373c115..9673838 100644 --- a/target-s390x/cpu.h +++ b/target-s390x/cpu.h @@ -963,7 +963,7 @@ struct sysib_322 { void load_psw(CPUS390XState *env, uint64_t mask, uint64_t addr); int mmu_translate(CPUS390XState *env, target_ulong vaddr, int rw, uint64_t asc, target_ulong *raddr, int *flags); -int sclp_service_call(uint64_t sccb, uint32_t code); +int sclp_service_call(CPUS390XState *env, uint64_t sccb, uint32_t code); uint32_t calc_cc(CPUS390XState *env, uint32_t cc_op, uint64_t src, uint64_t dst, uint64_t vr); diff --git a/target-s390x/kvm.c b/target-s390x/kvm.c index 9e1083e..e7b3b13 100644 --- a/target-s390x/kvm.c +++ b/target-s390x/kvm.c @@ -445,14 +445,10 @@ static int kvm_sclp_service_call(S390CPU *cpu, struct kvm_run *run, int r = 0; cpu_synchronize_state(CPU(cpu)); - if (env->psw.mask & PSW_MASK_PSTATE) { - enter_pgmcheck(cpu, PGM_PRIVILEGED); - return 0; - } sccb = env->regs[ipbh0 & 0xf]; code = env->regs[(ipbh0 & 0xf0) >> 4]; - r = sclp_service_call(sccb, code); + r = sclp_service_call(env, sccb, code); if (r < 0) { enter_pgmcheck(cpu, -r); } diff --git a/target-s390x/misc_helper.c b/target-s390x/misc_helper.c index 10d0425..728456f 100644 --- a/target-s390x/misc_helper.c +++ b/target-s390x/misc_helper.c @@ -93,7 +93,7 @@ void program_interrupt(CPUS390XState *env, uint32_t code, int ilen) /* SCLP service call */ uint32_t HELPER(servc)(CPUS390XState *env, uint64_t r1, uint64_t r2) { - int r = sclp_service_call(r1, r2); + int r = sclp_service_call(env, r1, r2); if (r < 0) { program_interrupt(env, -r, 4); return 0;