@samitouri / QOSamiQemu / commits / c4d9412cdd

pc-bios/s390-ccw: Fix off-by-one errors with loadparm and boot entries

The loadparm may optionally be used to select a boot entry, with the intended range being 0 through 31 inclusive, for a total of 32 entries. Previously, MAX_BOOT_ENTRIES was defined as 31, indicating that it was intended to correspond to the index of the boot entry rather than the count; however, some guards also used MAX_BOOT_ENTRIES as a count of the maximum allowed entries, which resulted in a mismatch between the intended and actual range such that index 31 could never be used in practice. Move the definition of MAX_BOOT_ENTRIES to qipl.h so it is shared and change the value to 32, representing a count of the maximum number of allowed boot entries and allowing the loadparm to accept values 0 through 31 as intended. Update some instances in the netboot code where MAX_BOOT_ENTRIES was used as the max index so that all guards treat MAX_BOOT_ENTRIES as a count across all boot methods. Cc: qemu-stable@nongnu.org Fixes: 806315279d5c ("pc-bios/s390-ccw: Remove panics from ECKD IPL path") Signed-off-by: Jared Rossi <jrossi@linux.ibm.com> Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260728223013.4047042-1-jrossi@linux.ibm.com Signed-off-by: Eric Farman <farman@linux.ibm.com>

Jared Rossi committed Jul 28, 2026 at 18:30 UTC c4d9412cdd1c9d1b8b2fcb0e0dbf57ca6286afd7
3 files changed +9 -6
include/hw/s390x/ipl/qipl.h
+2
@@ -20,6 +20,8 @@
20 #define LOADPARM_LEN 8
21 #define NO_LOADPARM "\0\0\0\0\0\0\0\0"
22
23 +#define MAX_BOOT_ENTRIES 32
24 +
25 enum S390IplType {
26 S390_IPL_TYPE_FCP = 0x00,
27 S390_IPL_TYPE_CCW = 0x02,
pc-bios/s390-ccw/netmain.c
+7 -4
@@ -40,6 +40,9 @@
40 #define DEFAULT_BOOT_RETRIES 10
41 #define DEFAULT_TFTP_RETRIES 20
42
43 +/* Index 0 is reserved for default alias, start PXE cfg indices at 1 */
44 +#define PXECFG_MAX (MAX_BOOT_ENTRIES - 1)
45 +
46 extern char _start[];
47
48 #define KERNEL_ADDR ((void *)0L)
@@ -381,13 +384,13 @@ static int net_select_and_load_kernel(filename_ip_t *fn_ip,
384
385 static int net_try_pxelinux_cfg(filename_ip_t *fn_ip)
386 {
384 - struct pl_cfg_entry entries[MAX_BOOT_ENTRIES];
387 + struct pl_cfg_entry entries[PXECFG_MAX];
388 int num_ent, def_ent = 0;
389
390 num_ent = pxelinux_load_parse_cfg(fn_ip, mac, get_uuid(),
391 DEFAULT_TFTP_RETRIES,
392 cfgbuf, sizeof(cfgbuf),
390 - entries, MAX_BOOT_ENTRIES, &def_ent);
393 + entries, PXECFG_MAX, &def_ent);
394
395 return net_select_and_load_kernel(fn_ip, num_ent, def_ent, entries);
396 }
@@ -470,11 +473,11 @@ static int net_try_direct_tftp_load(filename_ip_t *fn_ip)
473 * a magic comment string.
474 */
475 if (!strncasecmp("# pxelinux", cfgbuf, 10)) {
473 - struct pl_cfg_entry entries[MAX_BOOT_ENTRIES];
476 + struct pl_cfg_entry entries[PXECFG_MAX];
477 int num_ent, def_ent = 0;
478
479 num_ent = pxelinux_parse_cfg(cfgbuf, sizeof(cfgbuf), entries,
477 - MAX_BOOT_ENTRIES, &def_ent);
480 + PXECFG_MAX, &def_ent);
481 return net_select_and_load_kernel(fn_ip, num_ent, def_ent,
482 entries);
483 }
pc-bios/s390-ccw/s390-ccw.h
-2
@@ -82,8 +82,6 @@ int menu_get_enum_boot_index(bool *valid_entries);
82 bool menu_is_enabled_enum(void);
83 int menu_get_boot_index(bool *valid_entries);
84
85 -#define MAX_BOOT_ENTRIES 31
86 -
85 __attribute__ ((__noreturn__))
86 static inline void panic(const char *string)
87 {