[PATCH 0/3] s390/boot: Fix couple of early boot edge cases

[PATCH 0/3] s390/boot: Fix couple of early boot edge cases

[Vasily Gorbik]

Fix three independent minor early-boot issues involving the physical memory
search range, full command lines with IPL parameters, and unbounded facility
ranges.

Vasily Gorbik (3):
  s390/boot: Fix physical memory search range
  s390/boot: Avoid IPL parameter append past command line
  s390/boot: Bound command line facility ranges

 arch/s390/boot/alternative.c  |  5 +++--
 arch/s390/boot/ipl_parm.c     | 23 ++++++++++++-----------
 arch/s390/boot/physmem_info.c |  2 +-
 3 files changed, 16 insertions(+), 14 deletions(-)

-- 
2.53.0

[PATCH 1/3] s390/boot: Fix physical memory search range

[Vasily Gorbik]

search_mem_end() calculates the number of 1MB blocks with a signed int
literal. CONFIG_MAX_PHYSMEM_BITS values of 51 and above either overflow
the signed int or shift beyond its width. This produces an invalid search
range when the binary-search memory detection fallback is used.

Use an unsigned long literal so the full supported physical address range
is represented.

Fixes: 4d14c2666b6b ("s390/mem_detect: replace tprot loop with binary search")
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
---
 arch/s390/boot/physmem_info.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/boot/physmem_info.c b/arch/s390/boot/physmem_info.c
index 1f2ca5435838..0ebb2174713f 100644
--- a/arch/s390/boot/physmem_info.c
+++ b/arch/s390/boot/physmem_info.c
@@ -141,7 +141,7 @@ static int tprot(unsigned long addr)
 
 static unsigned long search_mem_end(void)
 {
-	unsigned long range = 1 << (MAX_PHYSMEM_BITS - 20); /* in 1MB blocks */
+	unsigned long range = 1UL << (MAX_PHYSMEM_BITS - 20); /* in 1MB blocks */
 	unsigned long offset = 0;
 	unsigned long pivot;
 
-- 
2.53.0

Re: [PATCH 1/3] s390/boot: Fix physical memory search range

[sashiko-bot]

> search_mem_end() calculates the number of 1MB blocks with a signed int
> literal. CONFIG_MAX_PHYSMEM_BITS values of 51 and above either overflow
> the signed int or shift beyond its width. This produces an invalid search
> range when the binary-search memory detection fallback is used.
> 
> Use an unsigned long literal so the full supported physical address range
> is represented.
> 
> Fixes: 4d14c2666b6b ("s390/mem_detect: replace tprot loop with binary search")
> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/c00-03.ttkffvj@ub.hpns?part=1

Re: [PATCH 1/3] s390/boot: Fix physical memory search range

[Heiko Carstens]

On Thu, Aug 27, 2026 at 02:01:28PM +0200, Vasily Gorbik wrote:
> search_mem_end() calculates the number of 1MB blocks with a signed int
> literal. CONFIG_MAX_PHYSMEM_BITS values of 51 and above either overflow
> the signed int or shift beyond its width. This produces an invalid search
> range when the binary-search memory detection fallback is used.
> 
> Use an unsigned long literal so the full supported physical address range
> is represented.
> 
> Fixes: 4d14c2666b6b ("s390/mem_detect: replace tprot loop with binary search")
> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
> ---
>  arch/s390/boot/physmem_info.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Heiko Carstens <hca@linux.ibm.com>

[PATCH 2/3] s390/boot: Avoid IPL parameter append past command line

[Vasily Gorbik]

A command line may occupy all but the terminating byte of
COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size
to the IPL parameter conversion helpers and points the destination one
byte past early_command_line. The helpers subtract one from the unsigned
size and write the converted parameter outside the command line buffer.

Convert the IPL parameter in the command line parsing buffer first. A
parameter beginning with '=' can then replace the existing command line
regardless of its length, while other parameters are appended only when
space remains.

Fixes: 5ecb2da660ab ("s390: support command lines longer than 896 bytes")
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
---
 arch/s390/boot/ipl_parm.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/arch/s390/boot/ipl_parm.c b/arch/s390/boot/ipl_parm.c
index 6bc950b92be7..8aa7639ae0cb 100644
--- a/arch/s390/boot/ipl_parm.c
+++ b/arch/s390/boot/ipl_parm.c
@@ -23,6 +23,7 @@ struct parmarea parmarea __section(".parmarea") = {
 };
 
 char __bootdata(early_command_line)[COMMAND_LINE_SIZE];
+static char command_line_buf[COMMAND_LINE_SIZE];
 
 unsigned int __bootdata_preserved(zlib_dfltcc_support) = ZLIB_DFLTCC_FULL;
 struct ipl_parameter_block __bootdata_preserved(ipl_block);
@@ -135,31 +136,32 @@ static size_t ipl_block_get_ascii_scpdata(char *dest, size_t size,
 
 static void append_ipl_block_parm(void)
 {
-	char *parm, *delim;
+	char *delim;
 	size_t len, rc = 0;
 
 	len = strlen(early_command_line);
-
-	delim = early_command_line + len;    /* '\0' character position */
-	parm = early_command_line + len + 1; /* append right after '\0' */
+	delim = early_command_line + len; /* '\0' character position */
 
 	switch (ipl_block.pb0_hdr.pbt) {
 	case IPL_PBT_CCW:
 		rc = ipl_block_get_ascii_vmparm(
-			parm, COMMAND_LINE_SIZE - len - 1, &ipl_block);
+			command_line_buf, sizeof(command_line_buf), &ipl_block);
 		break;
 	case IPL_PBT_FCP:
 	case IPL_PBT_NVME:
 	case IPL_PBT_ECKD:
 		rc = ipl_block_get_ascii_scpdata(
-			parm, COMMAND_LINE_SIZE - len - 1, &ipl_block);
+			command_line_buf, sizeof(command_line_buf), &ipl_block);
 		break;
 	}
 	if (rc) {
-		if (*parm == '=')
-			memmove(early_command_line, parm + 1, rc);
-		else
+		if (command_line_buf[0] == '=') {
+			memmove(early_command_line, command_line_buf + 1, rc);
+		} else if (len < COMMAND_LINE_SIZE - 2) {
 			*delim = ' '; /* replace '\0' with space */
+			sized_strscpy(delim + 1, command_line_buf,
+				       COMMAND_LINE_SIZE - len - 1);
+		}
 	}
 }
 
@@ -245,7 +247,6 @@ static void modify_fac_list(char *str)
 	check_cleared_facilities();
 }
 
-static char command_line_buf[COMMAND_LINE_SIZE];
 void parse_boot_command_line(void)
 {
 	char *param, *val;
-- 
2.53.0

Re: [PATCH 2/3] s390/boot: Avoid IPL parameter append past command line

[sashiko-bot]

> A command line may occupy all but the terminating byte of
> COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size
> to the IPL parameter conversion helpers and points the destination one
> byte past early_command_line. The helpers subtract one from the unsigned
> size and write the converted parameter outside the command line buffer.
> 
> Convert the IPL parameter in the command line parsing buffer first. A
> parameter beginning with '=' can then replace the existing command line
> regardless of its length, while other parameters are appended only when
> space remains.
> 
> Fixes: 5ecb2da660ab ("s390: support command lines longer than 896 bytes")
> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/c00-03.ttkffvj@ub.hpns?part=2

Re: [PATCH 2/3] s390/boot: Avoid IPL parameter append past command line

[Heiko Carstens]

On Thu, Aug 27, 2026 at 02:01:30PM +0200, Vasily Gorbik wrote:
>  static void append_ipl_block_parm(void)
>  {
> -	char *parm, *delim;
> +	char *delim;
>  	size_t len, rc = 0;

Reverse x-mas tree?

>  	switch (ipl_block.pb0_hdr.pbt) {
>  	case IPL_PBT_CCW:
>  		rc = ipl_block_get_ascii_vmparm(
> -			parm, COMMAND_LINE_SIZE - len - 1, &ipl_block);
> +			command_line_buf, sizeof(command_line_buf), &ipl_block);
...
>  		rc = ipl_block_get_ascii_scpdata(
> -			parm, COMMAND_LINE_SIZE - len - 1, &ipl_block);
> +			command_line_buf, sizeof(command_line_buf), &ipl_block);

Both could be long single line statements. :)

>  	if (rc) {
> -		if (*parm == '=')
> -			memmove(early_command_line, parm + 1, rc);
> -		else
> +		if (command_line_buf[0] == '=') {
> +			memmove(early_command_line, command_line_buf + 1, rc);

Would it be possible to use something different than "rc" as name for
the variable? It is actually a length. Maybe something like "append",
or "extra"? That would make the code easier to read.

> +		} else if (len < COMMAND_LINE_SIZE - 2) {
>  			*delim = ' '; /* replace '\0' with space */
> +			sized_strscpy(delim + 1, command_line_buf,
> +				       COMMAND_LINE_SIZE - len - 1);

One line?

Anyway, feel free to ignore the style comments. Code looks good.

Reviewed-by: Heiko Carstens <hca@linux.ibm.com>

[PATCH 3/3] s390/boot: Bound command line facility ranges

[Vasily Gorbik]

The facilities and debug-alternative command line parsers iterate over
inclusive numeric ranges. If a range ends at ULONG_MAX, incrementing the
current value wraps to zero and the loop never terminates. Large finite
out-of-range values also cause unnecessary early boot iterations even
though the bitmap helpers ignore them.

Stop each loop at the size of the bitmap it modifies. This preserves all
meaningful range values while guaranteeing termination.

Fixes: b5e804598d59 ("s390: allow overriding facilities via command line")
Fixes: 15c33a5bc9b8 ("s390/alternatives: Add debug functionality")
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
---
 arch/s390/boot/alternative.c | 5 +++--
 arch/s390/boot/ipl_parm.c    | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/arch/s390/boot/alternative.c b/arch/s390/boot/alternative.c
index 19ea7934b918..77e8bad560c5 100644
--- a/arch/s390/boot/alternative.c
+++ b/arch/s390/boot/alternative.c
@@ -45,11 +45,12 @@ static void alt_debug_modify(int type, unsigned int nr, bool clear)
 
 static char *alt_debug_parse(int type, char *str)
 {
-	unsigned long val, endval;
+	unsigned long val, endval, limit;
 	char *endp;
 	bool clear;
 	int i;
 
+	limit = type == ALT_TYPE_FACILITY ? MAX_FACILITY_BIT : MAX_MFEATURE_BIT;
 	if (*str == ':') {
 		str++;
 	} else {
@@ -73,7 +74,7 @@ static char *alt_debug_parse(int type, char *str)
 			if (str == endp)
 				break;
 			str = endp;
-			while (val <= endval) {
+			while (val <= endval && val < limit) {
 				alt_debug_modify(type, val, clear);
 				val++;
 			}
diff --git a/arch/s390/boot/ipl_parm.c b/arch/s390/boot/ipl_parm.c
index 8aa7639ae0cb..6d8b9d61bcad 100644
--- a/arch/s390/boot/ipl_parm.c
+++ b/arch/s390/boot/ipl_parm.c
@@ -233,7 +233,7 @@ static void modify_fac_list(char *str)
 			if (str == endp)
 				break;
 			str = endp;
-			while (val <= endval) {
+			while (val <= endval && val < MAX_FACILITY_BIT) {
 				modify_facility(val, clear);
 				val++;
 			}
-- 
2.53.0

Re: [PATCH 3/3] s390/boot: Bound command line facility ranges

[sashiko-bot]

> The facilities and debug-alternative command line parsers iterate over
> inclusive numeric ranges. If a range ends at ULONG_MAX, incrementing the
> current value wraps to zero and the loop never terminates. Large finite
> out-of-range values also cause unnecessary early boot iterations even
> though the bitmap helpers ignore them.
> 
> Stop each loop at the size of the bitmap it modifies. This preserves all
> meaningful range values while guaranteeing termination.
> 
> Fixes: b5e804598d59 ("s390: allow overriding facilities via command line")
> Fixes: 15c33a5bc9b8 ("s390/alternatives: Add debug functionality")
> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/c00-03.ttkffvj@ub.hpns?part=3

Re: [PATCH 3/3] s390/boot: Bound command line facility ranges

[Heiko Carstens]

On Thu, Aug 27, 2026 at 02:01:31PM +0200, Vasily Gorbik wrote:
> The facilities and debug-alternative command line parsers iterate over
> inclusive numeric ranges. If a range ends at ULONG_MAX, incrementing the
> current value wraps to zero and the loop never terminates. Large finite
> out-of-range values also cause unnecessary early boot iterations even
> though the bitmap helpers ignore them.
> 
> Stop each loop at the size of the bitmap it modifies. This preserves all
> meaningful range values while guaranteeing termination.
> 
> Fixes: b5e804598d59 ("s390: allow overriding facilities via command line")
> Fixes: 15c33a5bc9b8 ("s390/alternatives: Add debug functionality")

This is quite esoteric. Not sure if this justifies Fixes tags.

> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
> ---
>  arch/s390/boot/alternative.c | 5 +++--
>  arch/s390/boot/ipl_parm.c    | 2 +-
>  2 files changed, 4 insertions(+), 3 deletions(-)

Reviewed-by: Heiko Carstens <hca@linux.ibm.com>

Re: [PATCH 0/3] s390/boot: Fix couple of early boot edge cases

[Vasily Gorbik]

On Thu, Aug 27, 2026 at 02:01:26PM +0200, Vasily Gorbik wrote:
> Fix three independent minor early-boot issues involving the physical memory
> search range, full command lines with IPL parameters, and unbounded facility
> ranges.
> 
> Vasily Gorbik (3):
>   s390/boot: Fix physical memory search range
>   s390/boot: Avoid IPL parameter append past command line
>   s390/boot: Bound command line facility ranges
> 
>  arch/s390/boot/alternative.c  |  5 +++--
>  arch/s390/boot/ipl_parm.c     | 23 ++++++++++++-----------
>  arch/s390/boot/physmem_info.c |  2 +-
>  3 files changed, 16 insertions(+), 14 deletions(-)

Adopted Heiko's proposed style changes, dropped Fixes for patch 3 and applied