From nobody Sun Jul 26 11:05:45 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783408184; cv=none; d=zohomail.com; s=zohoarc; b=hp/He0OMtsXdOH0dfcJm9MoBKIVUpk0tUO4YgimVQ2vTSAPXPtHajkGoJY3sX73dEFXI8/oDMIZxtWkNzpYzn7HELx7gWy67sM3ysA7jlxnVKMLBhtL5zl+8ik0texyy0yrI61p4PDCtJseO4mE8m9iJiGatLaANA0iCm/h/8T0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783408184; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=p+oSp2HbiAUlmJAhJiY0sfUSzkHpsawgB2KNKxdktzI=; b=bPpnEmOBNrdbHdwAFBasf6ptj09XKL+5B4kLBgURK7uBeYEzmtJtX443gX06BExSvqIg4OFSok5YRORHuJWCpbwcrE4FD+ktpbBjuKqpz8GXnxtB7DfJPwhuhzoLrEKJbc2iLcvSAf0JHMZlWoH3MTsZp8qQZbyFabUHKM5AejQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783408184832867.8449216008239; Tue, 7 Jul 2026 00:09:44 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgzuO-0005mp-9V; Tue, 07 Jul 2026 03:07:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgzuB-0005jA-KP; Tue, 07 Jul 2026 03:07:44 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgzuA-00034k-2q; Tue, 07 Jul 2026 03:07:43 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6674IV1f2286517; Tue, 7 Jul 2026 07:07:37 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6sw4nmq2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2026 07:07:37 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66774bao024237; Tue, 7 Jul 2026 07:07:36 GMT Received: from smtprelay04.dal12v.mail.ibm.com ([172.16.1.6]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4f7cvw1kne-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2026 07:07:36 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay04.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66777ZO027918996 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Jul 2026 07:07:35 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 067BF58061; Tue, 7 Jul 2026 07:07:35 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D39FE5805D; Tue, 7 Jul 2026 07:07:32 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Tue, 7 Jul 2026 07:07:32 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=pp1; bh=p+oSp2 HbiAUlmJAhJiY0sfUSzkHpsawgB2KNKxdktzI=; b=LLlpRY8JtO4Qk89tvd2bO3 4cTCvKpEHJDAyc27l0+jv9dMrunrv48OW1lnJXaS+BTZ6SHHhRTCYhN8QUuZqkT3 R2hw/Gl+Guxstbil9JSMb+gGPKxn8GYshAM23q67FhNAv3/RanonQM0maPlq+4SZ re2sa9j3ok+4iP3G/LTbt6Mh9htoYl9FX3wFhRJc1kOxumfG6dDywcAbio9jVPTd FTP3u6ZnOKCZv2W8qhqiZnacj4PkeHIawZMX30nJelcqqxLUqs8mhUOEoi0IuhkG i883SVM8EkB+eye5wI3yhCvVYR0fowF9SX/oV+122PIBy6ziv8JXPVPFoDTFpXmg == From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , qemu-stable@nongnu.org, =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [PATCH v2 1/5] s390x/sclp: reject invalid write event data headers Date: Tue, 7 Jul 2026 09:07:24 +0200 Message-ID: <20260707070728.147203-2-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260707070728.147203-1-borntraeger@linux.ibm.com> References: <20260707070728.147203-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: 70NRucl6e665AmSEwHyYIATwulmQDTBb X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA3MDA2NCBTYWx0ZWRfXwIkIkIXQx+fl hRUdAbREQLJViBlD9oKgEsYO0emDeeNgEVZQy8+DWZNWIKcKmDBOXTb8nyXBKTW9ZKC27xQOpQM zKg51wDP6MrQQXKVGjq/Exv4EBRq5mUuS6FsT7XDFRgmQ/Rr8AWwaHZ9kjMz1UdaqWus+jPc7kf n66GY0GIEmU/0JBMaTvWdhpWVKpeM4LZGAEh7FKP920rHqFF3iK2bDrIPzbBxtbjdeU3LWimRLc Hkg26k3TABfPWwMaJBXFFFcsu0rjhsMMru/mdibvaUOLF78K23uDV/8KuBwjJ+NA2XKh9945/7C Vme5M0+C5lGR17BdPAQiYX2jVe2X7chq7VA4dYGzYEu3GTFP9f2IAAFG5Ra3kswxtkZni1GG45k qC3G190OL0esi4h6Cm1PXTlStc8kGx00V4LKgdsNDhl445x6b6ss9KiXp3rczLdluShkShZfVkU /0NJApY8YyV8Tk6aNRQ== X-Proofpoint-ORIG-GUID: 70NRucl6e665AmSEwHyYIATwulmQDTBb X-Authority-Analysis: v=2.4 cv=FqQ1OWrq c=1 sm=1 tr=0 ts=6a4ca5b9 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=69wJf7TsAAAA:8 a=VnNF1IyMAAAA:8 a=EUspDBNiAAAA:8 a=MqXzq3hS93HRDXXrek4A:9 a=3ZKOabzyN94A:10 a=QEXdDO2ut3YA:10 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA3MDA2NCBTYWx0ZWRfX3ZWfa1pgdrJ2 rMGIfl2LHgmOS56APOJokZrkajVS4FDB1f9oQdSAh6duDQeVnBPX3amDAMS2xA6sOAbWFoG0YrY nVYUyPOT2S9MJ1tzZwi1uBkZ3Tfxfk8= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-07_01,2026-07-06_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 clxscore=1011 malwarescore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607070064 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=borntraeger@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783408185394158500 If a guest submits an sccb with a tiny header length but a large number of event mask entries, the write_event_mask handler will 1. return the wrong RC (ok instead of error) 2. write to memory after the allocated sccb in qemu host memory. Add the necessary checks. Cc: qemu-stable@nongnu.org Reviewed-by: Hendrik Brueckner Reviewed-by: Matthew Rosato Reviewed-by: Eric Farman Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Christian Borntraeger --- hw/s390x/event-facility.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c index fee286ea63..184c469bd3 100644 --- a/hw/s390x/event-facility.c +++ b/hw/s390x/event-facility.c @@ -286,6 +286,7 @@ static void read_event_data(SCLPEventFacility *ef, SCCB= *sccb) static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb) { WriteEventMask *we_mask =3D (WriteEventMask *) sccb; + uint16_t sccb_length =3D be16_to_cpu(sccb->h.length); uint16_t mask_length =3D be16_to_cpu(we_mask->mask_length); sccb_mask_t tmp_mask; =20 @@ -294,6 +295,11 @@ static void write_event_mask(SCLPEventFacility *ef, SC= CB *sccb) return; } =20 + if (sccb_length < sizeof(WriteEventMask) + 4 * mask_length) { + sccb->h.response_code =3D cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LE= NGTH); + return; + } + /* * Note: We currently only support masks up to 8 byte length; * the remainder is filled up with zeroes. Older Linux --=20 2.53.0 From nobody Sun Jul 26 11:05:45 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783408159; cv=none; d=zohomail.com; s=zohoarc; b=NsBS1l5Oj+I2paySSvSaWU1bzg7KpC4Xt6b/jSHJ9CTJ0xBhMn0bGFGOlQZv4P/NE1rAaJcU4aglhpo3fpF1BrsVnbGP33j5ogsEEKgB8K/zJWELHKaPBKIx5fb1D2F0S4/UkapX2c4xDp9PA1tE1Y/lwKMt/gXYfynyqMmos3A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783408159; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=VCNQc5yPgk/JWRoUpJHqi3LfZXwhuksR+bEhTHaAwzM=; b=mK36i8i1vj03oIYA9Pb9yk3flIeyvNNsh0SbTfidwI10XDSt4g/5HbXbKnuY/3L9QLQ/shU+cL+Sdcc+yGJzy4k9A1k4C/txGWfRVE1f2PuPl3qk8FbETqd597vD3QBK4ijckfjwd1Q4aMBkLZPq/U1p6lS/pkrnxYzZrdRnYkY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783408159258116.89546804371503; Tue, 7 Jul 2026 00:09:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgzuQ-0005pM-RZ; Tue, 07 Jul 2026 03:07:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgzuE-0005jo-UZ; Tue, 07 Jul 2026 03:07:47 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgzuC-000354-2Z; Tue, 07 Jul 2026 03:07:46 -0400 Received: from pps.filterd (m0356516.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6674IgGw2519653; Tue, 7 Jul 2026 07:07:40 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6qkndjgu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2026 07:07:40 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6676ngZW023410; Tue, 7 Jul 2026 07:07:39 GMT Received: from smtprelay03.wdc07v.mail.ibm.com ([172.16.1.70]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f7cgq1n7a-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2026 07:07:39 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay03.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 667773O530737102 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Jul 2026 07:07:03 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6E81F58059; Tue, 7 Jul 2026 07:07:37 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 47CD058057; Tue, 7 Jul 2026 07:07:35 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Tue, 7 Jul 2026 07:07:35 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=VCNQc5yPgk/JWRoUp JHqi3LfZXwhuksR+bEhTHaAwzM=; b=P6Z1CwTaE0g0gAs80M9TRfCy5RChEhmv0 hIZljyGazvI/lCfDWom4hXNOyVLmh++B1hoffHIhPDkvk9ud/1B+CVY1q0dGqdhQ ftZGIpHBVHjB04Eblh2ym1ZW66w60thZdr7cx6zkT5DH2ioNm66BCGFA0Jdlf961 lapLQ55AN9KzyaCpJq7VTl6EHX6xq7+ijrOQGIZfLWCddlAToHgDHQCdX1r3+t95 nYce9WCqergownFjBRdeqXb8OBxQDozub1W0qGau4owzxAKIK96Hl5+RkiYZpcOP zYvHDy+0aQ4yodMEVGr+ZyHwUP6dTbY+e2P1ixul+bhHWgjuMJfZg== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , qemu-stable@nongnu.org, Farhan Ali Subject: [PATCH v2 2/5] s390x/pci: Tighten region detection for BAR read/write Date: Tue, 7 Jul 2026 09:07:25 +0200 Message-ID: <20260707070728.147203-3-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260707070728.147203-1-borntraeger@linux.ibm.com> References: <20260707070728.147203-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=Q/XiJY2a c=1 sm=1 tr=0 ts=6a4ca5bc cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=Y2IxJ9c9Rs8Kov3niI8_:22 a=VnNF1IyMAAAA:8 a=69wJf7TsAAAA:8 a=1miPxOOkSzPv5N0FEC4A:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-GUID: 4Nc5DBQkR0t-V6mWrW_pdquq5cpYDqhz X-Proofpoint-ORIG-GUID: 4Nc5DBQkR0t-V6mWrW_pdquq5cpYDqhz X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA3MDA2NCBTYWx0ZWRfXw3jEFQEEH/Ej 82z6WFr6KIa0YpqOK2WNCVAfr72uEP11T8im5GAks4XT0zHfkzjMOeKWziCGb64npfv9yOptHYf sCYOUyFdt6f45rTTiUJfgip7Rq1lcBA= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA3MDA2NCBTYWx0ZWRfX8vsT44yk6xOl s0xM3tWQtO3JgKC2eVHs9+WUKqlxy34bP+YmP6Lg51w2HoyJYEI0Ej61JJRuRj006WehVlqExWe 1lCY/HhdbI2ZEdatI/JHVd+8PngkQUOyS/xYvX5u+QSx76tJdEuLeen8K04cokJ12eU4cJ72CEg VLnHBS/YAnRqT/Q1XSPum0890WaM++M67QezH5TnT70iBUoSpq4LVidsjmOnGvGhwjV8i3Y+dVa caCFnaRufC77stFJO+WMMELSMyPwvwfxbXdh9C1d4peasTlCYSzZ/IawmeyG2rcEw1lIIw2ueJY BL1LHG6CgOjfWPB1kYrLTAnpMbIHql//0U0iD1uBVwNVztlCejV7dUx+/7G9Y7vdgEjljUWmTOD yIWQfbb85D66/OjmyJqyMnjg+0ctB1M9HDRzMOmmueNosGpPew0PagdOYEJ/fKmHinfr5kHzGFq n92okv0bUAMUmqjdFZA== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-07_01,2026-07-06_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 spamscore=0 phishscore=0 priorityscore=1501 bulkscore=0 clxscore=1015 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607070064 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=borntraeger@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783408161293158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato For PCISTG/PCISTB/PCILG instruction emulation, ensure that the offset and length provided by the guest does not overflow, and only return a memory region when the specified offset+length combination matches an existing subregion or the parent region. Cc: qemu-stable@nongnu.org Fixes: 4f6482bfe3 ("s390x/pci: search for subregion inside the BARs") Signed-off-by: Matthew Rosato Reviewed-by: Christian Borntraeger Reviewed-by: Farhan Ali Signed-off-by: Christian Borntraeger --- hw/s390x/s390-pci-inst.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index 10066ca618..ef20f7645e 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -392,13 +392,22 @@ static int zpci_endian_swap(uint64_t *ptr, uint8_t le= n) static MemoryRegion *s390_get_subregion(MemoryRegion *mr, uint64_t offset, uint8_t len) { + uint64_t last =3D offset + len; MemoryRegion *subregion; uint64_t subregion_size; =20 + /* + * Ensure the region is valid, the calculated address cannot wrap and = that + * it falls within this region. + */ + if (!mr || offset > last || last > memory_region_size(mr)) { + return NULL; + } + QTAILQ_FOREACH(subregion, &mr->subregions, subregions_link) { subregion_size =3D memory_region_size(subregion); if ((offset >=3D subregion->addr) && - (offset + len) <=3D (subregion->addr + subregion_size)) { + (last) <=3D (subregion->addr + subregion_size)) { mr =3D subregion; break; } @@ -413,6 +422,10 @@ static MemTxResult zpci_read_bar(S390PCIBusDevice *pbd= ev, uint8_t pcias, =20 mr =3D pbdev->pdev->io_regions[pcias].memory; mr =3D s390_get_subregion(mr, offset, len); + if (!mr) { + return MEMTX_ERROR; + } + offset -=3D mr->addr; return memory_region_dispatch_read(mr, offset, data, size_memop(len) | MO_BE, @@ -513,6 +526,10 @@ static MemTxResult zpci_write_bar(S390PCIBusDevice *pb= dev, uint8_t pcias, =20 mr =3D pbdev->pdev->io_regions[pcias].memory; mr =3D s390_get_subregion(mr, offset, len); + if (!mr) { + return MEMTX_ERROR; + } + offset -=3D mr->addr; return memory_region_dispatch_write(mr, offset, data, size_memop(len) | MO_BE, @@ -900,6 +917,11 @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint= 8_t r3, uint64_t gaddr, =20 mr =3D pbdev->pdev->io_regions[pcias].memory; mr =3D s390_get_subregion(mr, offset, len); + if (!mr) { + s390_program_interrupt(env, PGM_OPERAND, ra); + return 0; + } + offset -=3D mr->addr; =20 for (i =3D 0; i < len; i +=3D 8) { --=20 2.53.0 From nobody Sun Jul 26 11:05:45 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783408172; cv=none; d=zohomail.com; s=zohoarc; b=GeKYg3RtQhGW9QKnYXj3Ex7GFv26cvjJU6tCP7rOSncVTc7wR+cRZQZ0VTv6B0FP6KSG7XWCBFheYIM1U4xajBzgxf0K7sZwDTVSb+K96UD/DjrFzwHdVdBy/+kjQEnj+xQt/zPG6OBvLHrlltBJvj+BQsx3IuYYjS/ZbCc0u5E= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783408172; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Gvf5up2rYOcM5IMrCSMMJWwnrv6csRfNEoXe1bb9Qtg=; b=jqYWiCpaHTyIwktxEEKam/VEYLPSZHA5c6oHm5LCs83VaOgBkiNM8+xJ+a8F9u54g2STeRHXiZS/fJ5vLy2e1EWtjLwhclLehzljLS6k+aDqDdhyDDDvEzjzQhu6tT/LLrMqL0I9Z6IY0zFs5mFBx1hpD3KG5Brkzn5+vzN4Vsc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178340817255483.86193533739595; Tue, 7 Jul 2026 00:09:32 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgzuU-0005qL-0U; Tue, 07 Jul 2026 03:08:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgzuH-0005mi-6R; Tue, 07 Jul 2026 03:07:49 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgzuF-00035N-Az; Tue, 07 Jul 2026 03:07:48 -0400 Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6674IN9s1630176; Tue, 7 Jul 2026 07:07:42 GMT Received: from ppma11.dal12v.mail.ibm.com (db.9e.1632.ip4.static.sl-reverse.com [50.22.158.219]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6stsp2sw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2026 07:07:42 +0000 (GMT) Received: from pps.filterd (ppma11.dal12v.mail.ibm.com [127.0.0.1]) by ppma11.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66774cIK014719; Tue, 7 Jul 2026 07:07:41 GMT Received: from smtprelay05.wdc07v.mail.ibm.com ([172.16.1.72]) by ppma11.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f7f6y14dy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2026 07:07:41 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay05.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66777dmB19333854 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Jul 2026 07:07:40 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id D5E8858057; Tue, 7 Jul 2026 07:07:39 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id AFA1158058; Tue, 7 Jul 2026 07:07:37 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Tue, 7 Jul 2026 07:07:37 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Gvf5up2rYOcM5IMrC SMMJWwnrv6csRfNEoXe1bb9Qtg=; b=HdiNIpinQ5Xf8gR6+4Z3Rmwfp5DG69Ct1 Vaed9IlK+9TN3fBQRZTXGamLQ+aZIYFcN8z0ceq/iN9w+i85UHlcq3I2ZHh7+zoe Ear91UewO1ESCUMWf1EWtA8w4VPUjeli0odV6ZEXbBLmBedQTzC34HsbQcd7Wz4v 0fuXluYUGjImhfIK+I7BfCSYwzWGkljLog+RPJ+qcbdoKUPl2tDXW72oY/F4e+2w wc5WDsN+tcjOEJXrxq/v8DYx+Jcf/FEdbqWk8VmFYjo/HLyZXczsY+6mYsQvPOdr UJZ20WBViJtoD1+/Q/ZS79gZEpkLnM9l9VJL5EjW5+iWnlcsfzZCQ== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , qemu-stable@nongnu.org, Farhan Ali Subject: [PATCH v2 3/5] s390x/pci: Shrink RPCIT ranges to registered window Date: Tue, 7 Jul 2026 09:07:26 +0200 Message-ID: <20260707070728.147203-4-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260707070728.147203-1-borntraeger@linux.ibm.com> References: <20260707070728.147203-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: aTClR1suHPujT_gVhEYEZQ9nczXXnwxa X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA3MDA2NCBTYWx0ZWRfXycBXi0UqBClg RHxP8LlD/Ytb/5MYuw7Wz/2l8JxbOr1EKVG1KgB7MKIY7CjdKBik+K36zjNCsPjwAj5tHBDqSJj KvZi19YBmUpwOtM/ak9zIsjUa784IOA= X-Authority-Analysis: v=2.4 cv=DKW/JSNb c=1 sm=1 tr=0 ts=6a4ca5be cx=c_pps a=aDMHemPKRhS1OARIsFnwRA==:117 a=aDMHemPKRhS1OARIsFnwRA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=RzCfie-kr_QcCd8fBx8p:22 a=VnNF1IyMAAAA:8 a=69wJf7TsAAAA:8 a=-R_Z6E-YhPHALp1CgG0A:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-GUID: aTClR1suHPujT_gVhEYEZQ9nczXXnwxa X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA3MDA2NCBTYWx0ZWRfX1+aM9COZBeJ2 ugTNYhfvNwd2TiTfAPQFyn8hdzWHAlJqCJEMDemYin9RS4pQjaKjZNW0paFsD2f48z+KNthBGPz o2eRmE2Ly6bjv/i/bQDCsVNAoGiE8qHSfKX86UETD8bt2wIcZBHRN7R9+bpXxPj2Lh+gdHkSU1l 3o9wPHjCPfRFq9nYJoZWdu/6B5IQmerS23QmtRuKRbPeJ/GUZ9BPuAPC474FkKvb7cwr6c+Q+v0 bsk1+t5bNv/qhMn3brSVQd4PH1CX70eKhKi3aq+pegkWEBAJKf1rxtPIyXOCY6z4oXghvB1iifz s9jWycd2hN6wN44/clI2Focz5h2eP/8EBV1AqgTWzVs+7xqRasQZpkDmDsy4ERKsJa4jjQZ3iIN H5i4XOYof9D9RGVOrMN+4z8Cauw9KuvWbBRmvMtzCefbNHyUrRgDlDkNLjcd9rnrvrucHExRQwm wxl/0QfMA+pMF+YjNdg== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-07_01,2026-07-06_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 clxscore=1015 phishscore=0 impostorscore=0 priorityscore=1501 adultscore=0 lowpriorityscore=0 suspectscore=0 malwarescore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607070064 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.158.5; envelope-from=borntraeger@linux.ibm.com; helo=mx0b-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783408173295158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato Today, if a RPCIT instruction is presented from the guest whose range exceeds the previously-registered IOAT, QEMU will process the range so long as 1) the specified range at least partially overlaps with what was previously registered and 2) the guest has valid IOAT entries in its table. If the entries are not present (invalid), then the RPCIT will unnecessarily spend time reporting the invalid region/segment entries. Optimize this path by exiting immediately if the requested range falls completely outside of the previously-registered range or if the requested range ends before it starts (which would only occur if the guest-specified address + length would overflow a u64). Otherwise, clamp the request to only the portion of the range that overlaps with what was previously registered, effectively ignoring the portion outside of the registered range. Cc: qemu-stable@nongnu.org Fixes: 5d1abf2344 ("s390x/pci: enforce zPCI state checking") Reviewed-by: Christian Borntraeger Reviewed-by: Farhan Ali Signed-off-by: Matthew Rosato Signed-off-by: Christian Borntraeger --- hw/s390x/s390-pci-inst.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c index ef20f7645e..b7de23c7d2 100644 --- a/hw/s390x/s390-pci-inst.c +++ b/hw/s390x/s390-pci-inst.c @@ -770,10 +770,16 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint= 8_t r2, uintptr_t ra) goto err; } =20 - if (end < iommu->pba || start > iommu->pal) { + if (end < start || end < iommu->pba || start > iommu->pal) { error =3D ERR_EVENT_OORANGE; goto err; } + /* + * If the specified range at least partially overlaps the registered + * aperture, clamp the request to the aperture and ignore the rest. + */ + sstart =3D MAX(start, iommu->pba); + end =3D MIN(end, iommu->pal + 1); =20 retry: start =3D sstart; --=20 2.53.0 From nobody Sun Jul 26 11:05:45 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783408162; cv=none; d=zohomail.com; s=zohoarc; b=Te7gL0kvtss3mtw/Axo54nczPHucW7uyYNT/CGYLDciGjSJbqnUVGtkILuPrwP9H3Y+/KPkujY24G2wysVnqYyVdxP5MC7oYikqpYfdcvGA6/IWeHPOTzQacHv2VvuPkzy5gYhuf9wV2Ev5U6A6jE5RNSTbQ7yqg7dQXlegEit4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783408162; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=BSZw2cQng3/0+qs7b+ZmdDiN/bOLGUp2n3/lnDj30b8=; b=Mz4VFVJN2ZDkoz5KPKUdRgqdboSLX3d2WcuUtmU1hhpP9ZT0GOKgFQfZYoaVf3rCSOSKHhrj/YidJO9p60AQkUUSHg91PvlTnHdhUNT2hARiVL0isnvoaNbXA/40XmxTuJlA7sbNgU+TyGIode28wkiMI4O12cPRi6trnyfWbmc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783408162913439.171952120093; Tue, 7 Jul 2026 00:09:22 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgzuR-0005pY-48; Tue, 07 Jul 2026 03:07:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgzuI-0005ms-KJ; Tue, 07 Jul 2026 03:07:50 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgzuF-00035W-R7; Tue, 07 Jul 2026 03:07:49 -0400 Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6674IGji2725500; Tue, 7 Jul 2026 07:07:44 GMT Received: from ppma13.dal12v.mail.ibm.com (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6suqnend-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2026 07:07:44 +0000 (GMT) Received: from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1]) by ppma13.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 66774ZAM006779; Tue, 7 Jul 2026 07:07:43 GMT Received: from smtprelay06.dal12v.mail.ibm.com ([172.16.1.8]) by ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f7eqg17bn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2026 07:07:43 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay06.dal12v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66777gga29164126 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Jul 2026 07:07:42 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 522E658057; Tue, 7 Jul 2026 07:07:42 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 236AD58058; Tue, 7 Jul 2026 07:07:40 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Tue, 7 Jul 2026 07:07:39 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=BSZw2cQng3/0+qs7b +ZmdDiN/bOLGUp2n3/lnDj30b8=; b=f/sEIkOtBr6EDx/WAmMAkeF9XyVtaqApX TLor3LRw1zLLIM6Q0+spQA0zw5TD6goZ3OXvtRcy9OkIRvVKB6SvF9CjuNUSJo9q dLMs8MQEwvwGjIjf2awWMZtIxL/I113+9q51KPG6axAuXuF4ajgSfwhTrviSq4Ht hUwYJlpIHQhIr384/yp/hYT8Fd7/RVlRoU0xpIlCQf2Ry5gCeZ8nxQWsrysy+ACz JUz0ox/ptCs4NVW+yvRYP5TPR4ZQgLvPPytxq10Jl2VxlOCUr60nLQFkVhjXIawe f5Mtz3fBkdnwzyLhNmQg58LPEMXIwwlxTfI3RJuSm4drI3ccOPSDg== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , qemu-stable@nongnu.org, Farhan Ali Subject: [PATCH v2 4/5] s390x/ioinst: Require strict length and format for SEI CHSC handler Date: Tue, 7 Jul 2026 09:07:27 +0200 Message-ID: <20260707070728.147203-5-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260707070728.147203-1-borntraeger@linux.ibm.com> References: <20260707070728.147203-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA3MDA2NCBTYWx0ZWRfX36MaLTek/+xI XGnLujTHwXA9YzAFcR2ZvXsRz3nQpVOjLCisAm1QOMI6wjY/9pmmL4xWGB/2EhwAn1HtsGwN6v+ XZ+QQLYXNlJp0A3stmV1GnZ/9ETfPBw= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA3MDA2NCBTYWx0ZWRfX1OjzBkwjRqhz CKilNP930PMMA6wN8pOwSTxugMTGsrbxc+iRFTFiJWahTt3QwlPvOnsHtdpkKNru8NL60rdWA8t Mpe9lAg2FKZ0WDWUKCc+ZhaEvxw/Vw0gtcC2iUt3OkfyIgaFyrlc4jmJkUi/4W7rlP6oUWHxcHy IFoasYG2sjnbgK7sGCC1kHuJlbySFCN1fuKvqp3QmorSUcZt9dleRHi7fkwiZpXr8Rf8yomGy88 idY1CNzA+GNRNDiTcKE1i+hUk1sMCWrR11O7o0v4Wua6TacKp1dL5fl6ePm2tIf6uaPGAaHN1c6 X9a4HbChs5Od6PKSujvXvE1HbMcD1tDIb94bjWfp/P/BNzFiGWZb365U0l7aiKRg7R1pUGEO0Np wlg6HzXv0VeERD/quy4Qay8oBNxpXhENK5fzzAAvekkeh4cc42XQSdreC66B6xJUdZoizqHbnkM agJZKaivj78CqrE+QKA== X-Proofpoint-GUID: QBoGxaAh8M8m45nW6HMXywgWIm8qcBdS X-Authority-Analysis: v=2.4 cv=Oot/DS/t c=1 sm=1 tr=0 ts=6a4ca5c0 cx=c_pps a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=uAbxVGIbfxUO_5tXvNgY:22 a=VnNF1IyMAAAA:8 a=69wJf7TsAAAA:8 a=VZH3qDeYady0DpGU8aQA:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-ORIG-GUID: QBoGxaAh8M8m45nW6HMXywgWIm8qcBdS X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-07_01,2026-07-06_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 lowpriorityscore=0 clxscore=1015 impostorscore=0 phishscore=0 malwarescore=0 suspectscore=0 spamscore=0 adultscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607070064 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=borntraeger@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783408163231158500 Content-Type: text/plain; charset="utf-8" From: Matthew Rosato Ensure SEI commands that are received are of the appropriate length and format before handling. Cc: qemu-stable@nongnu.org Fixes: 8cba80c3a0 ("s390: Add PCI bus support") Reviewed-by: Christian Borntraeger Reviewed-by: Farhan Ali Reviewed-by: Eric Farman Signed-off-by: Matthew Rosato Signed-off-by: Christian Borntraeger --- target/s390x/ioinst.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/target/s390x/ioinst.c b/target/s390x/ioinst.c index 2320dd4c12..94619f9215 100644 --- a/target/s390x/ioinst.c +++ b/target/s390x/ioinst.c @@ -609,13 +609,27 @@ static int chsc_sei_nt2_have_event(void) =20 #define CHSC_SEI_NT0 (1ULL << 63) #define CHSC_SEI_NT2 (1ULL << 61) +#define CHSC_SEI_0_FMT 0x0f000000 static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res) { uint64_t selection_mask =3D ldq_be_p(&req->param1); + uint32_t param0 =3D be32_to_cpu(req->param0); uint8_t *res_flags =3D (uint8_t *)res->data; + uint16_t len =3D be16_to_cpu(req->len); + uint16_t resp_code; int have_event =3D 0; int have_more =3D 0; =20 + if (len !=3D 0x0010) { + resp_code =3D 0x0003; + goto out_err; + } + + if (param0 & CHSC_SEI_0_FMT) { + resp_code =3D 0x0007; + goto out_err; + } + /* regarding architecture nt0 can not be masked */ have_event =3D !chsc_sei_nt0_get_event(res); have_more =3D chsc_sei_nt0_have_event(); @@ -642,6 +656,12 @@ static void ioinst_handle_chsc_sei(ChscReq *req, ChscR= esp *res) res->code =3D cpu_to_be16(0x0005); res->len =3D cpu_to_be16(CHSC_MIN_RESP_LEN); } + return; + + out_err: + res->code =3D cpu_to_be16(resp_code); + res->len =3D cpu_to_be16(CHSC_MIN_RESP_LEN); + res->param =3D 0; } =20 static void ioinst_handle_chsc_unimplemented(ChscResp *res) --=20 2.53.0 From nobody Sun Jul 26 11:05:45 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=reject dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1783408166; cv=none; d=zohomail.com; s=zohoarc; b=KGMDPQqPPEEy1bwJS6ZdEIXbCMkOcM8UD4FhnCgZDrTVBusRQpxz/hWuiHxsduTzMarkQOu8R2krg85FjAmNDqLpSuth9cX703/MtePIyxLZmxbgZTiEIm0oP+IPJGjzepQ0/7DmEt9kQO/muJDk3kXDUfZ+Xf/Z/rYRra2riPM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783408166; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=szF7+mE2K02OxmaLp/mCwxJxwZ9PE/MDUnbYH8Ju7Eo=; b=UonNchVXDmZhib7O6XghPt4tYwYPGJZrURdPseN68AWv5s+GGPop0A/s/nLGxPku1K3+AJ6KloykMBTkccQmgSzcyhIJaA8YYAS8Pj9amjba3mnOHV/+QdDzapwToPgsiE3vyNskXIubgojEYQqPGRUKLPi2q/EWr8V20HfVAIQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783408166154880.5467532592252; Tue, 7 Jul 2026 00:09:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wgzuU-0005qU-0X; Tue, 07 Jul 2026 03:08:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgzuM-0005nx-7i; Tue, 07 Jul 2026 03:07:56 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wgzuJ-00035w-00; Tue, 07 Jul 2026 03:07:53 -0400 Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 6674IM382286321; Tue, 7 Jul 2026 07:07:47 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4f6sw4nmr0-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2026 07:07:47 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.7/8.18.1.7) with ESMTP id 6676ngZb023410; Tue, 7 Jul 2026 07:07:46 GMT Received: from smtprelay01.wdc07v.mail.ibm.com ([172.16.1.68]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4f7cgq1n7y-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 07 Jul 2026 07:07:46 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (smtpav01.dal12v.mail.ibm.com [10.241.53.100]) by smtprelay01.wdc07v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 66777iZv34931030 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 7 Jul 2026 07:07:45 GMT Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9972D58067; Tue, 7 Jul 2026 07:07:44 +0000 (GMT) Received: from smtpav01.dal12v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 934EE58059; Tue, 7 Jul 2026 07:07:42 +0000 (GMT) Received: from b35lp69.lnxne.boe (unknown [9.87.84.240]) by smtpav01.dal12v.mail.ibm.com (Postfix) with ESMTP; Tue, 7 Jul 2026 07:07:42 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=szF7+mE2K02OxmaLp /mCwxJxwZ9PE/MDUnbYH8Ju7Eo=; b=r9zN8u+h9pyj87HNME5MDG7M3jYuvkD1H aC8LWBv4XAzTCOGX3i1/WL7QQIrreAKj9EL9TWxtSRMkbKWe12HhCxoPdTHBJC/Z zp4TZGyS9oEy3SREzxwKmw9p0iRGg4jVclb+mbYpSsFaUoaVnZtdHM63MC7vSIYO 7tIeLxKdLLnxud9XBj2WN9ufQKwrYols36KNd74JNmNU1dBwM2heAO7itz2T2vig eitclNjQASTTBeZv3M/Faciw7Oj4mNI/LTZDRPVHyUMe3wr624I0MoZ5OudT8rob UqB9FyTuUK4whI+oKuYWyUSuP7Vnc7xsY2CeE/WiTlyQYhh6ZLNmw== From: Christian Borntraeger To: Cornelia Huck Cc: qemu-devel , qemu-s390x , Halil Pasic , Matthew Rosato , Eric Farman , Christian Borntraeger , Jason Herne , Richard Henderson , Ilya Leoshkevich , David Hildenbrand , Hendrik Brueckner , qemu-stable@nongnu.org Subject: [PATCH v2 5/5] s390x/css: limit number of CHPIDs in description Date: Tue, 7 Jul 2026 09:07:28 +0200 Message-ID: <20260707070728.147203-6-borntraeger@linux.ibm.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260707070728.147203-1-borntraeger@linux.ibm.com> References: <20260707070728.147203-1-borntraeger@linux.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: bw1fs36K11gCNMeVrDh5rHV_QayoZx_R X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzA3MDA2NCBTYWx0ZWRfX+unsccazNZ2q eFdrk/BaM3Bp8MPPv/s5Etj1hQG5JKluWMVQWl1FlApQ8FsfLRq2F+fDubqb/+rz+mOguSCne40 TIExOm18RJt4ng/P4VbBx3ID+Nao+wyfD3IJzuHikU+aBOVs6mC7VfMfO5HLdqzCsSGOHKaTiAg 4n0++WEAc3qMmuEHOm1mb0w1Nq0N1VAFZ+x9RK/YqxlDhuMzEfrrOzT4RL/z8A2R5NeTPcvGzoR 81tO5JqzuYnSjOaz7v0Ww9aTi9QrkyAt1of+b7BuUS/nMHxp7sDr6BK2UvjX1SV50IKAp19ljAl 1Ihz9Fx6zcHhMd5fFPAeyVizXFQamSlDfJju5FHTGA7J5GpWZSIIe4yqo+oSjVBAdIokXgWLkF0 mOIFip2zV1xvM+qu+e7w5kx6HzvrijRrPmVkpbyxV6xzTCnlQGZO8yPAGCGBRMS3fXMVD0o91mN r7M+yv2aUM6Ij0tLpjA== X-Proofpoint-ORIG-GUID: bw1fs36K11gCNMeVrDh5rHV_QayoZx_R X-Authority-Analysis: v=2.4 cv=FqQ1OWrq c=1 sm=1 tr=0 ts=6a4ca5c3 cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=RAioF0-LDSMA:10 a=VkNPw1HP01LnGYTKEx00:22 a=RnoormkPH1_aCDwRdu11:22 a=U7nrCbtTmkRpXpFmAIza:22 a=VnNF1IyMAAAA:8 a=69wJf7TsAAAA:8 a=taQyAogG0pZaN8zP0A4A:9 a=Fg1AiH1G6rFz08G2ETeA:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzA3MDA2NCBTYWx0ZWRfX2dI0E8hNXT7r IL6i7k9x6tYvaViHK8TXl8sO2W/Zstc3wo9Pa/0MBqVkN0CbFD1xjskMQZ83kX8ZgkG/JlTqanG bh80FtKyOoP/Dyjb6kzUo/q+tVFBHrs= X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-07_01,2026-07-06_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 lowpriorityscore=0 priorityscore=1501 bulkscore=0 suspectscore=0 spamscore=0 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607070064 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=148.163.156.1; envelope-from=borntraeger@linux.ibm.com; helo=mx0a-001b2d01.pphosted.com X-Spam_score_int: -26 X-Spam_score: -2.7 X-Spam_bar: -- X-Spam_report: (-2.7 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ibm.com) X-ZM-MESSAGEID: 1783408167450158500 Content-Type: text/plain; charset="utf-8" From: Eric Farman virtio-ccw uses a single virtual CHPID for all devices and device-types, but vfio-ccw (passthrough) shares real CHPID information with the guest. A sufficiently large passthrough configuration would exceed the defined response payload. Fix this by limiting the number of CHPID descriptions that are returned based on the given response format. Cc: qemu-stable@nongnu.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Eric Farman Signed-off-by: Christian Borntraeger --- hw/s390x/css.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/hw/s390x/css.c b/hw/s390x/css.c index 96d5378f3c..29ba39f79e 100644 --- a/hw/s390x/css.c +++ b/hw/s390x/css.c @@ -1872,6 +1872,7 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8_= t f_chpid, uint8_t l_chpid, int i, desc_size; uint32_t words[8]; uint32_t chpid_type_word; + uint32_t max_chpids, chpid_count =3D 0; CssImage *css; =20 if (!m && !cssid) { @@ -1882,9 +1883,25 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8= _t f_chpid, uint8_t l_chpid, if (!css) { return 0; } + + if (rfmt =3D=3D 0) { + max_chpids =3D 256; + } else if (rfmt =3D=3D 1) { + max_chpids =3D 127; + } else { + /* Should be rejected by caller */ + return 0; + } + desc_size =3D 0; for (i =3D f_chpid; i <=3D l_chpid; i++) { if (css->chpids[i].in_use) { + /* Limit number of CHPIDs sent back */ + if (chpid_count =3D=3D max_chpids) { + break; + } + + chpid_count++; chpid_type_word =3D 0x80000000 | (css->chpids[i].type << 8) | = i; if (rfmt =3D=3D 0) { words[0] =3D cpu_to_be32(chpid_type_word); --=20 2.53.0