| Message ID | 20240331181730.150860-2-pbonzini@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | lsi53c895a: detect invalid Block Move instruction | expand |
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c index eb9828dd5ef..1e18d88983b 100644 --- a/hw/scsi/lsi53c895a.c +++ b/hw/scsi/lsi53c895a.c @@ -1205,6 +1205,15 @@ again: break; } s->dbc = insn & 0xffffff; + if (!s->dbc) { + /* + * If the instruction is a Block Move and a value of 0x000000 is + * loaded into the DBC register, an illegal instruction interrupt + * occurs if the LSI53C895A is not in target mode, Command phase. + */ + lsi_script_dma_interrupt(s, LSI_DSTAT_IID); + break; + } s->rbc = s->dbc; /* ??? Set ESA. */ s->ia = s->dsp - 8;
The spec for the lsi53c895a says: "If the instruction is a Block Move and a value of 0x000000 is loaded into the DBC register, an illegal instruction interrupt occurs if the LSI53C895A is not in target mode, Command phase". Because QEMU only operates in initiator mode, generate the interrupt unconditionally if the low 24 bits are 0x000000. Reported-by: Chuhong Yuan <hslester96@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> --- hw/scsi/lsi53c895a.c | 9 +++++++++ 1 file changed, 9 insertions(+)