s390x/css: limit number of CHPIDs in description
virtio-ccw uses a single virtual CHPID for all devices and device-types, but vfio-ccw (passthrough) shares real CHPID information with the guest. A sufficiently large passthrough configuration would exceed the defined response payload. Fix this by limiting the number of CHPID descriptions that are returned based on the given response format. Cc: qemu-stable@nongnu.org Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Signed-off-by: Eric Farman <farman@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Message-ID: <20260707070728.147203-6-borntraeger@linux.ibm.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Eric Farman committed
Jul 7, 2026 at 09:07 UTC
22f2da06a8b291c975a7caf05dbd3b180c856741
1 file changed
+17
hw/s390x/css.c
+17
@@ -1872,6 +1872,7 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid,
1872
int i, desc_size;
1873
uint32_t words[8];
1874
uint32_t chpid_type_word;
1875
+ uint32_t max_chpids, chpid_count = 0;
1876
CssImage *css;
1877
1878
if (!m && !cssid) {
@@ -1882,9 +1883,25 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid,
1883
if (!css) {
1884
return 0;
1885
}
1886
+
1887
+ if (rfmt == 0) {
1888
+ max_chpids = 256;
1889
+ } else if (rfmt == 1) {
1890
+ max_chpids = 127;
1891
+ } else {
1892
+ /* Should be rejected by caller */
1893
+ return 0;
1894
+ }
1895
+
1896
desc_size = 0;
1897
for (i = f_chpid; i <= l_chpid; i++) {
1898
if (css->chpids[i].in_use) {
1899
+ /* Limit number of CHPIDs sent back */
1900
+ if (chpid_count == max_chpids) {
1901
+ break;
1902
+ }
1903
+
1904
+ chpid_count++;
1905
chpid_type_word = 0x80000000 | (css->chpids[i].type << 8) | i;
1906
if (rfmt == 0) {
1907
words[0] = cpu_to_be32(chpid_type_word);