[PATCH 0/5] s390x: interface hardening fixes

[PATCH 0/5] s390x: interface hardening fixes

[Christian Borntraeger]

Several fixes that improve the guest->host error handling.

Christian Borntraeger (1):
  s390x/sclp: reject invalid write event data headers

Eric Farman (1):
  s390x/css: limit number of CHPIDs in description

Matthew Rosato (3):
  s390x/pci: Tighten region detection for BAR read/write
  s390x/pci: Shrink RPCIT ranges to registered window
  s390x/ioinst: Require strict length and format for SEI CHSC handler

 hw/s390x/css.c            | 17 +++++++++++++++++
 hw/s390x/event-facility.c |  6 ++++++
 hw/s390x/s390-pci-inst.c  | 32 ++++++++++++++++++++++++++++++--
 target/s390x/ioinst.c     | 20 ++++++++++++++++++++
 4 files changed, 73 insertions(+), 2 deletions(-)

-- 
2.53.0

[PATCH 1/5] s390x/sclp: reject invalid write event data headers

[Christian Borntraeger]

If a guest submits an sccb with a tiny header length but a large number
of event mask entries, the write_event_mask handler will
1. return the wrong RC (ok instead of error)
2. write to memory after the allocated sccb in qemu host memory.

Add the necessary checks.

Cc: qemu-stable@nongnu.org
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
---
 hw/s390x/event-facility.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c
index fee286ea63..184c469bd3 100644
--- a/hw/s390x/event-facility.c
+++ b/hw/s390x/event-facility.c
@@ -286,6 +286,7 @@ static void read_event_data(SCLPEventFacility *ef, SCCB *sccb)
 static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb)
 {
     WriteEventMask *we_mask = (WriteEventMask *) sccb;
+    uint16_t sccb_length = be16_to_cpu(sccb->h.length);
     uint16_t mask_length = be16_to_cpu(we_mask->mask_length);
     sccb_mask_t tmp_mask;
 
@@ -294,6 +295,11 @@ static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb)
         return;
     }
 
+    if (sccb_length < sizeof(WriteEventMask) + 4 * mask_length) {
+        sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
+        return;
+    }
+
     /*
      * Note: We currently only support masks up to 8 byte length;
      *       the remainder is filled up with zeroes. Older Linux
-- 
2.53.0

Re: [PATCH 1/5] s390x/sclp: reject invalid write event data headers

[Matthew Rosato]

On 7/6/26 5:19 AM, Christian Borntraeger wrote:
> If a guest submits an sccb with a tiny header length but a large number
> of event mask entries, the write_event_mask handler will
> 1. return the wrong RC (ok instead of error)
> 2. write to memory after the allocated sccb in qemu host memory.
> 
> Add the necessary checks.
> 
> Cc: qemu-stable@nongnu.org
> Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> ---

Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>

>  hw/s390x/event-facility.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/hw/s390x/event-facility.c b/hw/s390x/event-facility.c
> index fee286ea63..184c469bd3 100644
> --- a/hw/s390x/event-facility.c
> +++ b/hw/s390x/event-facility.c
> @@ -286,6 +286,7 @@ static void read_event_data(SCLPEventFacility *ef, SCCB *sccb)
>  static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb)
>  {
>      WriteEventMask *we_mask = (WriteEventMask *) sccb;
> +    uint16_t sccb_length = be16_to_cpu(sccb->h.length);
>      uint16_t mask_length = be16_to_cpu(we_mask->mask_length);
>      sccb_mask_t tmp_mask;
>  
> @@ -294,6 +295,11 @@ static void write_event_mask(SCLPEventFacility *ef, SCCB *sccb)
>          return;
>      }
>  
> +    if (sccb_length < sizeof(WriteEventMask) + 4 * mask_length) {
> +        sccb->h.response_code = cpu_to_be16(SCLP_RC_INSUFFICIENT_SCCB_LENGTH);
> +        return;
> +    }
> +
>      /*
>       * Note: We currently only support masks up to 8 byte length;
>       *       the remainder is filled up with zeroes. Older Linux

Re: [PATCH 1/5] s390x/sclp: reject invalid write event data headers

[Eric Farman]

On Mon, 2026-07-06 at 11:19 +0200, Christian Borntraeger wrote:
> If a guest submits an sccb with a tiny header length but a large number
> of event mask entries, the write_event_mask handler will
> 1. return the wrong RC (ok instead of error)
> 2. write to memory after the allocated sccb in qemu host memory.
> 
> Add the necessary checks.
> 
> Cc: qemu-stable@nongnu.org
> Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> ---
>  hw/s390x/event-facility.c | 6 ++++++
>  1 file changed, 6 insertions(+)

Reviewed-by: Eric Farman <farman@linux.ibm.com>

Re: [PATCH 1/5] s390x/sclp: reject invalid write event data headers

[Philippe Mathieu-Daudé]

On 6/7/26 11:19, Christian Borntraeger wrote:
> If a guest submits an sccb with a tiny header length but a large number
> of event mask entries, the write_event_mask handler will
> 1. return the wrong RC (ok instead of error)
> 2. write to memory after the allocated sccb in qemu host memory.
> 
> Add the necessary checks.
> 
> Cc: qemu-stable@nongnu.org
> Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> ---
>   hw/s390x/event-facility.c | 6 ++++++
>   1 file changed, 6 insertions(+)

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

[PATCH 2/5] s390x/pci: Tighten region detection for BAR read/write

[Christian Borntraeger]

From: Matthew Rosato <mjrosato@linux.ibm.com>

For PCISTG/PCISTB/PCILG instruction emulation, ensure that the offset
and length provided by the guest does not overflow, and only return
a memory region when the specified offset+length combination matches
an existing subregion or the parent region.

Cc: qemu-stable@nongnu.org
Fixes: 4f6482bfe3 ("s390x/pci: search for subregion inside the BARs")
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
---
 hw/s390x/s390-pci-inst.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index 10066ca618..ef20f7645e 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -392,13 +392,22 @@ static int zpci_endian_swap(uint64_t *ptr, uint8_t len)
 static MemoryRegion *s390_get_subregion(MemoryRegion *mr, uint64_t offset,
                                         uint8_t len)
 {
+    uint64_t last = offset + len;
     MemoryRegion *subregion;
     uint64_t subregion_size;
 
+    /*
+     * Ensure the region is valid, the calculated address cannot wrap and that
+     * it falls within this region.
+     */
+    if (!mr || offset > last || last > memory_region_size(mr)) {
+        return NULL;
+    }
+
     QTAILQ_FOREACH(subregion, &mr->subregions, subregions_link) {
         subregion_size = memory_region_size(subregion);
         if ((offset >= subregion->addr) &&
-            (offset + len) <= (subregion->addr + subregion_size)) {
+            (last) <= (subregion->addr + subregion_size)) {
             mr = subregion;
             break;
         }
@@ -413,6 +422,10 @@ static MemTxResult zpci_read_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
 
     mr = pbdev->pdev->io_regions[pcias].memory;
     mr = s390_get_subregion(mr, offset, len);
+    if (!mr) {
+        return MEMTX_ERROR;
+    }
+
     offset -= mr->addr;
     return memory_region_dispatch_read(mr, offset, data,
                                        size_memop(len) | MO_BE,
@@ -513,6 +526,10 @@ static MemTxResult zpci_write_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
 
     mr = pbdev->pdev->io_regions[pcias].memory;
     mr = s390_get_subregion(mr, offset, len);
+    if (!mr) {
+        return MEMTX_ERROR;
+    }
+
     offset -= mr->addr;
     return memory_region_dispatch_write(mr, offset, data,
                                         size_memop(len) | MO_BE,
@@ -900,6 +917,11 @@ int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
 
     mr = pbdev->pdev->io_regions[pcias].memory;
     mr = s390_get_subregion(mr, offset, len);
+    if (!mr) {
+        s390_program_interrupt(env, PGM_OPERAND, ra);
+        return 0;
+    }
+
     offset -= mr->addr;
 
     for (i = 0; i < len; i += 8) {
-- 
2.53.0

Re: [PATCH 2/5] s390x/pci: Tighten region detection for BAR read/write

[Farhan Ali]

On 7/6/2026 2:19 AM, Christian Borntraeger wrote:
> From: Matthew Rosato<mjrosato@linux.ibm.com>
>
> For PCISTG/PCISTB/PCILG instruction emulation, ensure that the offset
> and length provided by the guest does not overflow, and only return
> a memory region when the specified offset+length combination matches
> an existing subregion or the parent region.
>
> Cc:qemu-stable@nongnu.org
> Fixes: 4f6482bfe3 ("s390x/pci: search for subregion inside the BARs")
> Reviewed-by: Christian Borntraeger<borntraeger@linux.ibm.com>
> Signed-off-by: Matthew Rosato<mjrosato@linux.ibm.com>
> ---
>   hw/s390x/s390-pci-inst.c | 24 +++++++++++++++++++++++-
>   1 file changed, 23 insertions(+), 1 deletion(-)

Reviewed-by: Farhan Ali<alifm@linux.ibm.com>

[PATCH 3/5] s390x/pci: Shrink RPCIT ranges to registered window

[Christian Borntraeger]

From: Matthew Rosato <mjrosato@linux.ibm.com>

Today, if a RPCIT instruction is presented from the guest whose range
exceeds the previously-registered IOAT, QEMU will process the range
so long as 1) the specified range at least partially overlaps with
what was previously registered and 2) the guest has valid IOAT entries
in its table.  If the entries are not present (invalid), then the
RPCIT will unnecessarily spend time reporting the invalid
region/segment entries.

Optimize this path by exiting immediately if the requested range falls
completely outside of the previously-registered range or if the
requested range ends before it starts (which would only occur if the
guest-specified address + length would overflow a u64).  Otherwise,
clamp the request to only the portion of the range that overlaps with
what was previously registered, effectively ignoring the portion
outside of the registered range.

Cc: qemu-stable@nongnu.org
Fixes: 5d1abf2344 ("s390x/pci: enforce zPCI state checking")
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
---
 hw/s390x/s390-pci-inst.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index ef20f7645e..b7de23c7d2 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -770,10 +770,16 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
         goto err;
     }
 
-    if (end < iommu->pba || start > iommu->pal) {
+    if (end < start || end < iommu->pba || start > iommu->pal) {
         error = ERR_EVENT_OORANGE;
         goto err;
     }
+    /*
+     * If the specified range at least partially overlaps the registered
+     * aperture, clamp the request to the aperture and ignore the rest.
+     */
+    sstart = MAX(start, iommu->pba);
+    end = MIN(end, iommu->pal + 1);
 
  retry:
     start = sstart;
-- 
2.53.0

Re: [PATCH 3/5] s390x/pci: Shrink RPCIT ranges to registered window

[Farhan Ali]

On 7/6/2026 2:19 AM, Christian Borntraeger wrote:
> From: Matthew Rosato<mjrosato@linux.ibm.com>
>
> Today, if a RPCIT instruction is presented from the guest whose range
> exceeds the previously-registered IOAT, QEMU will process the range
> so long as 1) the specified range at least partially overlaps with
> what was previously registered and 2) the guest has valid IOAT entries
> in its table.  If the entries are not present (invalid), then the
> RPCIT will unnecessarily spend time reporting the invalid
> region/segment entries.
>
> Optimize this path by exiting immediately if the requested range falls
> completely outside of the previously-registered range or if the
> requested range ends before it starts (which would only occur if the
> guest-specified address + length would overflow a u64).  Otherwise,
> clamp the request to only the portion of the range that overlaps with
> what was previously registered, effectively ignoring the portion
> outside of the registered range.
>
> Cc:qemu-stable@nongnu.org
> Fixes: 5d1abf2344 ("s390x/pci: enforce zPCI state checking")
> Reviewed-by: Christian Borntraeger<borntraeger@linux.ibm.com>
> Signed-off-by: Matthew Rosato<mjrosato@linux.ibm.com>
> ---
>   hw/s390x/s390-pci-inst.c | 8 +++++++-
>   1 file changed, 7 insertions(+), 1 deletion(-)

Reviewed-by: Farhan Ali<alifm@linux.ibm.com>

[PATCH 4/5] s390x/ioinst: Require strict length and format for SEI CHSC handler

[Christian Borntraeger]

From: Matthew Rosato <mjrosato@linux.ibm.com>

Ensure SEI commands that are received are of the appropriate length and
format before handling.

Cc: qemu-stable@nongnu.org
Fixes: 8cba80c3a0 ("s390: Add PCI bus support")
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
---
 target/s390x/ioinst.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/target/s390x/ioinst.c b/target/s390x/ioinst.c
index 2320dd4c12..94619f9215 100644
--- a/target/s390x/ioinst.c
+++ b/target/s390x/ioinst.c
@@ -609,13 +609,27 @@ static int chsc_sei_nt2_have_event(void)
 
 #define CHSC_SEI_NT0    (1ULL << 63)
 #define CHSC_SEI_NT2    (1ULL << 61)
+#define CHSC_SEI_0_FMT 0x0f000000
 static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
 {
     uint64_t selection_mask = ldq_be_p(&req->param1);
+    uint32_t param0 = be32_to_cpu(req->param0);
     uint8_t *res_flags = (uint8_t *)res->data;
+    uint16_t len = be16_to_cpu(req->len);
+    uint16_t resp_code;
     int have_event = 0;
     int have_more = 0;
 
+    if (len != 0x0010) {
+        resp_code = 0x0003;
+        goto out_err;
+    }
+
+    if (param0 & CHSC_SEI_0_FMT) {
+        resp_code = 0x0007;
+        goto out_err;
+    }
+
     /* regarding architecture nt0 can not be masked */
     have_event = !chsc_sei_nt0_get_event(res);
     have_more = chsc_sei_nt0_have_event();
@@ -642,6 +656,12 @@ static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
         res->code = cpu_to_be16(0x0005);
         res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
     }
+    return;
+
+ out_err:
+    res->code = cpu_to_be16(resp_code);
+    res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
+    res->param = 0;
 }
 
 static void ioinst_handle_chsc_unimplemented(ChscResp *res)
-- 
2.53.0

Re: [PATCH 4/5] s390x/ioinst: Require strict length and format for SEI CHSC handler

[Farhan Ali]

On 7/6/2026 2:19 AM, Christian Borntraeger wrote:
> From: Matthew Rosato<mjrosato@linux.ibm.com>
>
> Ensure SEI commands that are received are of the appropriate length and
> format before handling.
>
> Cc:qemu-stable@nongnu.org
> Fixes: 8cba80c3a0 ("s390: Add PCI bus support")
> Reviewed-by: Christian Borntraeger<borntraeger@linux.ibm.com>
> Signed-off-by: Matthew Rosato<mjrosato@linux.ibm.com>

Reviewed-by: Farhan Ali<alifm@linux.ibm.com>

Re: [PATCH 4/5] s390x/ioinst: Require strict length and format for SEI CHSC handler

[Eric Farman]

On Mon, 2026-07-06 at 11:19 +0200, Christian Borntraeger wrote:
> From: Matthew Rosato <mjrosato@linux.ibm.com>
> 
> Ensure SEI commands that are received are of the appropriate length and
> format before handling.
> 
> Cc: qemu-stable@nongnu.org
> Fixes: 8cba80c3a0 ("s390: Add PCI bus support")
> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
> ---
>  target/s390x/ioinst.c | 20 ++++++++++++++++++++
>  1 file changed, 20 insertions(+)

Reviewed-by: Eric Farman <farman@linux.ibm.com>

[PATCH 5/5] s390x/css: limit number of CHPIDs in description

[Christian Borntraeger]

From: Eric Farman <farman@linux.ibm.com>

virtio-ccw uses a single virtual CHPID for all devices and
device-types, but vfio-ccw (passthrough) shares real CHPID
information with the guest. A sufficiently large passthrough
configuration would exceed the defined response payload.

Fix this by limiting the number of CHPID descriptions that
are returned based on the given response format.

Cc: qemu-stable@nongnu.org
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Eric Farman <farman@linux.ibm.com>
---
 hw/s390x/css.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/hw/s390x/css.c b/hw/s390x/css.c
index 96d5378f3c..29ba39f79e 100644
--- a/hw/s390x/css.c
+++ b/hw/s390x/css.c
@@ -1872,6 +1872,7 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid,
     int i, desc_size;
     uint32_t words[8];
     uint32_t chpid_type_word;
+    uint32_t max_chpids, chpid_count = 0;
     CssImage *css;
 
     if (!m && !cssid) {
@@ -1882,9 +1883,25 @@ int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid,
     if (!css) {
         return 0;
     }
+
+    if (rfmt == 0) {
+        max_chpids = 256;
+    } else if (rfmt == 1) {
+        max_chpids = 127;
+    } else {
+        /* Should be rejected by caller */
+        return 0;
+    }
+
     desc_size = 0;
     for (i = f_chpid; i <= l_chpid; i++) {
         if (css->chpids[i].in_use) {
+            /* Limit number of CHPIDs sent back */
+            if (chpid_count == max_chpids) {
+                break;
+            }
+
+            chpid_count++;
             chpid_type_word = 0x80000000 | (css->chpids[i].type << 8) | i;
             if (rfmt == 0) {
                 words[0] = cpu_to_be32(chpid_type_word);
-- 
2.53.0

Re: [PATCH 5/5] s390x/css: limit number of CHPIDs in description

[Matthew Rosato]

On 7/6/26 5:19 AM, Christian Borntraeger wrote:
> From: Eric Farman <farman@linux.ibm.com>
> 
> virtio-ccw uses a single virtual CHPID for all devices and
> device-types, but vfio-ccw (passthrough) shares real CHPID
> information with the guest. A sufficiently large passthrough
> configuration would exceed the defined response payload.
> 
> Fix this by limiting the number of CHPID descriptions that
> are returned based on the given response format.
> 
> Cc: qemu-stable@nongnu.org
> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Signed-off-by: Eric Farman <farman@linux.ibm.com>

Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>

Re: [PATCH 0/5] s390x: interface hardening fixes

[Cornelia Huck]

On Mon, Jul 06 2026, Christian Borntraeger <borntraeger@linux.ibm.com> wrote:

> Several fixes that improve the guest->host error handling.
>
> Christian Borntraeger (1):
>   s390x/sclp: reject invalid write event data headers
>
> Eric Farman (1):
>   s390x/css: limit number of CHPIDs in description
>
> Matthew Rosato (3):
>   s390x/pci: Tighten region detection for BAR read/write
>   s390x/pci: Shrink RPCIT ranges to registered window
>   s390x/ioinst: Require strict length and format for SEI CHSC handler
>
>  hw/s390x/css.c            | 17 +++++++++++++++++
>  hw/s390x/event-facility.c |  6 ++++++
>  hw/s390x/s390-pci-inst.c  | 32 ++++++++++++++++++++++++++++++--
>  target/s390x/ioinst.c     | 20 ++++++++++++++++++++
>  4 files changed, 73 insertions(+), 2 deletions(-)

I think the patches from other people are missing your s-o-b?

Re: [PATCH 0/5] s390x: interface hardening fixes

[Christian Borntraeger]

Am 06.07.26 um 17:13 schrieb Cornelia Huck:
> On Mon, Jul 06 2026, Christian Borntraeger <borntraeger@linux.ibm.com> wrote:
> 
>> Several fixes that improve the guest->host error handling.
>>
>> Christian Borntraeger (1):
>>    s390x/sclp: reject invalid write event data headers
>>
>> Eric Farman (1):
>>    s390x/css: limit number of CHPIDs in description
>>
>> Matthew Rosato (3):
>>    s390x/pci: Tighten region detection for BAR read/write
>>    s390x/pci: Shrink RPCIT ranges to registered window
>>    s390x/ioinst: Require strict length and format for SEI CHSC handler
>>
>>   hw/s390x/css.c            | 17 +++++++++++++++++
>>   hw/s390x/event-facility.c |  6 ++++++
>>   hw/s390x/s390-pci-inst.c  | 32 ++++++++++++++++++++++++++++++--
>>   target/s390x/ioinst.c     | 20 ++++++++++++++++++++
>>   4 files changed, 73 insertions(+), 2 deletions(-)
> 
> I think the patches from other people are missing your s-o-b?
> 

Right. I guess I must re-send them, we cannot "heal" the patches by
Adding
Christian Borntraeger <borntraeger@linux.ibm.com>

Re: [PATCH 0/5] s390x: interface hardening fixes

[Cornelia Huck]

On Mon, Jul 06 2026, Christian Borntraeger <borntraeger@linux.ibm.com> wrote:

> Am 06.07.26 um 17:13 schrieb Cornelia Huck:
>> On Mon, Jul 06 2026, Christian Borntraeger <borntraeger@linux.ibm.com> wrote:
>> 
>>> Several fixes that improve the guest->host error handling.
>>>
>>> Christian Borntraeger (1):
>>>    s390x/sclp: reject invalid write event data headers
>>>
>>> Eric Farman (1):
>>>    s390x/css: limit number of CHPIDs in description
>>>
>>> Matthew Rosato (3):
>>>    s390x/pci: Tighten region detection for BAR read/write
>>>    s390x/pci: Shrink RPCIT ranges to registered window
>>>    s390x/ioinst: Require strict length and format for SEI CHSC handler
>>>
>>>   hw/s390x/css.c            | 17 +++++++++++++++++
>>>   hw/s390x/event-facility.c |  6 ++++++
>>>   hw/s390x/s390-pci-inst.c  | 32 ++++++++++++++++++++++++++++++--
>>>   target/s390x/ioinst.c     | 20 ++++++++++++++++++++
>>>   4 files changed, 73 insertions(+), 2 deletions(-)
>> 
>> I think the patches from other people are missing your s-o-b?
>> 
>
> Right. I guess I must re-send them, we cannot "heal" the patches by
> Adding
> Christian Borntraeger <borntraeger@linux.ibm.com>

A quick resend would be easier for me.