Re: [Qemu-devel] [PATCH v4 07/10] s390x/sclp: properly guard pci-specific functions

[Cornelia Huck]

On Tue, 22 Aug 2017 15:24:34 +0200
Cornelia Huck <address@hidden> wrote:

> On Tue, 22 Aug 2017 14:58:37 +0200
> Halil Pasic <address@hidden> wrote:
> 
> > On 08/22/2017 11:39 AM, Cornelia Huck wrote:  
> > > On Tue, 22 Aug 2017 11:20:51 +0200
> > > Halil Pasic <address@hidden> wrote:

> > >> Well, the QEMU name of the command is misleading misleading. In the AR
> > >> it's called 'Configure I/O Adapter'. The PCI comes into the picture via
> > >> byte 8 of the SCCB, the so called adapter type. Valid values for the
> > >> adapter type are: 00-01 reserved; 02 PCI function; 03-FF reserved. So
> > >> at this point we only have PCI.   

OK, I need one more piece of information. 

We obviously need to check whether the sccb we got is long enough
before we try to access the command-specific field. How long is the
sccb supposed to be for configure I/O adapter? For pci, 16 bytes; in
general, I would guess that it needs to include at least atype and some
placeholder for the payload. What does the AR say?

Looking at the pci code, I also noted that it cheerfully uses the aid
field of the sccb before checking whether it is actually long enough...