diff options
| author | Matthew Rosato <mjrosato@linux.ibm.com> | 2020-12-17 17:16:36 -0500 |
|---|---|---|
| committer | Cornelia Huck <cohuck@redhat.com> | 2020-12-21 18:11:33 +0100 |
| commit | 704d7a2304d890a570b722e20bd66e5e6303b7d9 (patch) | |
| tree | 26e95c94d7b67d389e3287fc28cfc6ed3abef653 | |
| parent | d986bc4a1c2de68dbb056b1b761a863dc47313ee (diff) | |
| download | qemu-704d7a2304d890a570b722e20bd66e5e6303b7d9.zip qemu-704d7a2304d890a570b722e20bd66e5e6303b7d9.tar.gz qemu-704d7a2304d890a570b722e20bd66e5e6303b7d9.tar.bz2 | |
s390x/pci: fix pcistb length
In pcistb_service_call, we are grabbing 8 bits from a guest register to
indicate the length of the store operation -- but per the architecture
the length is actually defined by 13 bits of the guest register.
Fixes: 863f6f52b7 ("s390: implement pci instructions")
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Message-Id: <1608243397-29428-2-git-send-email-mjrosato@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
| -rw-r--r-- | hw/s390x/s390-pci-inst.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index d9e1e29..e230293 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -755,7 +755,7 @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr, int i; uint32_t fh; uint8_t pcias; - uint8_t len; + uint16_t len; uint8_t buffer[128]; if (env->psw.mask & PSW_MASK_PSTATE) { @@ -765,7 +765,7 @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr, fh = env->regs[r1] >> 32; pcias = (env->regs[r1] >> 16) & 0xf; - len = env->regs[r1] & 0xff; + len = env->regs[r1] & 0x1fff; offset = env->regs[r3]; if (!(fh & FH_MASK_ENABLE)) { |