summaryrefslogtreecommitdiff
path: root/arch/s390/kernel
AgeCommit message (Collapse)Author
23 hoursMerge branch 'next' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux.git
23 hoursMerge branch 'master' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git # Conflicts: # Documentation/scheduler/index.rst # arch/arm64/configs/defconfig
24 hoursMerge branch 'for-next' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/s390/linux.git # Conflicts: # arch/s390/kernel/traps.c
28 hoursMerge branch into tip/master: 'sched/core'Ingo Molnar
# New commits in sched/core: 4a3b51aab6e2 ("smpboot: Don't park the thread if work is pending") 40dcc9bdbef3 ("irq_work: Flush lazy work CPU down on PREEMPT_RT") 791b1760accd ("irq_work: Update a comment regarding CPU hotplug invocation") 648d44bda731 ("sched/topology: Add asymmetric SMT packing override") c8fc4136fd3c ("sched/fair: Honor asymmetric SMT priority in idle selection") 53bc5c556b82 ("sched: Set TIF_NEED_RESCHED before calling __trace_set_need_resched()") 4b1f75be23c4 ("sched/core: Fix context analysis errors in non-preferred CPU push") 1fb28c664a19 ("virt/steal_governor: Enable the driver") 27d47ebce4d6 ("virt/steal_governor: Implement steal_governor policy loop") 4b9302d494ff ("virt/steal_governor: Add control knobs for handling steal values") 9a8e740ee9f6 ("virt: Introduce steal governor driver") 68957caaa9c0 ("sched/debug: Add migration stats due to non preferred CPUs") 74699f56ebcf ("sched/core: Push current task from non preferred CPU") 4ee29b029058 ("sched/fair: Load balance only among preferred CPUs") d8a3da0de843 ("sched/core: Try to use a preferred CPU in is_cpu_allowed") 620824516557 ("sysfs: Add preferred CPU file") 518b32bd5bb3 ("cpumask: Introduce cpu_preferred_mask") 06a49ef784ac ("sched/docs: Document cpu_preferred_mask and Preferred CPU concept") cfb463b7172d ("cpumask: Introduce cpumask_intersects_and") a8d0854a76a8 ("sched/cputime: Add kcpustat_field_total helper") be100c77178e ("sched: Add sched_ext hooks for proxy execution") 57c75e3ae38c ("sched: Add helper to block retained proxy donors") a49653d0abeb ("sched/core: Mark wakeups completed through ttwu_runnable()") 8f8c0417e973 ("sched/core: Dequeue waking proxy donors before reset") 313b652837d0 ("sched/core: Drop mutex locks before proxy rescheduling") 627ea30aca3b ("sched/wait: Clarify WF_SYNC wakeup semantics") d2e010082757 ("sched/eevdf: Handle more short slice waking cases") 4bf32ec3327d ("sched/eevdf: Align update_protect_slice to set_protect_slice") aae2a33ea662 ("sched/eevdf: Ensure that vprot will never go above a min slice") c9ce69fc43bd ("sched/fair: Randomize equally shallow slow-path candidates") abe440b3770f ("sched/fair: Drop idle recency from slow-path CPU selection") fbbc63fed0b0 ("sched/core: Remove redundant core_sched_seq") 819224e506bc ("sched/fair: Remove dead code on enqueue_task_fair()") c72945693b90 ("sched: Restart fair hrtick after same-task repicks") a9b3c7570564 ("sched/headers: Replace __ASSEMBLY__ with __ASSEMBLER__ in the <uapi/linux/sched.h> header") e81ee0630837 ("sched/fair: Reset NUMA fault locality after scan period update") ef9293b3b797 ("sched: dynamic: Fix preemption model strings") 879eaa76e608 ("sched: Remove unneeded function type cast in do_balance_callbacks()") f549101187c8 ("sched/deadline: check start_dl_timer expiry with ktime_before()") 2a672daa4b27 ("sched/feat: Use the new static key API for sched_feat") a5576ebce920 ("sched: Convert paravirt_steal to new static key APIs") 9650ce11f2e3 ("sched: dynamic: Simplify preempt model accessors") 5b9a28eeed37 ("sched: dynamic: Remove HAVE_PREEMPT_DYNAMIC_{CALL,KEY}") aa4178f63847 ("sched: dynamic: Simplify irqentry_exit_cond_resched()") b9d267b9d632 ("sched: dynamic: Simplify preempt_schedule{,_notrace}()") 88e0b3bb9930 ("sched: dynamic: Simplify {cond,might}_resched()") d3d16750693b ("sched: dynamic: Make PREEMPT_DYNAMIC depend on ARCH_HAS_PREEMPT_LAZY") 772d9ffbfd26 ("sched: Migrate whole chain in proxy_migrate_task()") 6b73a09e943f ("sched: Break out core of attach_tasks() helper into sched.h") 1f8805138593 ("sched: Switch rq->next_class in proxy_reset_donor()") 09351db90a28 ("sched/core: Don't proxy-exec unmatched cookie lock owners") 9be817f991e2 ("sched/core: Avoid migrating blocked_on tasks") 3dd95f077371 ("sched/core: Don't steal a proxy-exec donor") Signed-off-by: Ingo Molnar <mingo@kernel.org>
28 hoursMerge branch into tip/master: 'perf/merge'Ingo Molnar
# New commits in perf/merge: 7606d01b963f ("x86/fpu: Remove additional remnants of math emulation") 67639ee98521 ("x86/fpu: Remove unnecessary checks for X86_FEATURE_FPU") 391cac638edd ("selftests/x86: Add tests for signal frame FPU portability") fd14edd82077 ("x86/fpu: Pre-fault only required size of xstate buffer") f1751b220bc8 ("x86/fpu: Fix potential underflow in xstate_calculate_size()") 731300df4f7d ("x86/fpu: Document reasoning of FX-only fallback") 6916dec7a02f ("x86/fpu: Extract restore_from_ia32_fxstate() and clean up fpu__restore_sig()") 344907fab5fd ("x86/fpu: Clean up and rename variables in signal frame handling") 3d69596c684b ("x86/fpu: Document signal frame layout and portability") 6350de8671b9 ("perf/x86/amd/uncore: Free counter slot by index") 4a8557a4e5d2 ("perf/x86/amd/uncore: Remove redundant event slot scan") ba29babd881e ("perf/x86/intel: Check only PMC bits in PEBS_ENABLED when detecting host PEBS usage") 193ef44e3261 ("KVM: VMX: Only tell perf to enable PEBS counters for fully enabled PMCs") 57c764783330 ("KVM: VMX: Drop a redundant pmu->global_ctrl check when processing pebs_enable") 31f7cf337ce7 ("perf/x86/intel: KVM: Handle cross-mapped PEBS PMCs entirely within KVM") a634e4536ec2 ("perf/x86: KVM: Have perf define a dedicated struct for getting guest PEBS data") b7b84fff2bd6 ("perf/x86/intel: Invert names of intel_ctrl_{guest,host}_mask") 52a6457f59ad ("perf/x86/intel: Annotate x86_pmu::hybrid_pmu with __counted_by_ptr") df935e26ca9a ("perf/x86/amd/uncore: Turn amd_uncore_ctx events into a flexible array") c0a44d1745d3 ("xor: Add AVX-512 optimized xor_gen()") 2405d15e5ae4 ("xor: Remove redundant X86_FEATURE_OSXSAVE check") b93f05df9c66 ("lib/crc: x86: Stop using cpu_has_xfeatures()") ffe52429f870 ("lib/crypto: x86: Stop using cpu_has_xfeatures()") 9256e0496c14 ("crypto: x86 - Stop using cpu_has_xfeatures()") 19c5d90800a2 ("um: Check for missing AVX and AVX-512 xstate bits") 518aa9948e4f ("x86/fpu: Check for missing AVX and AVX-512 xstate bits") 68aca309e49c ("perf/x86/intel: Add sanity check for PEBS record/fragment size") c34db2f95094 ("perf/x86: Activate back-to-back NMI detection for arch-PEBS induced NMIs") 00cf8daabe2b ("perf/x86/intel: Advertise PERF_PMU_CAP_SIMD_REGS capability") c4fabb67a47f ("perf/x86/intel: Support arch-PEBS based SIMD/eGPRs sampling") 098cdd582a9b ("perf/x86: Support SSP sampling using sample_regs_* fields") 578460d9af8d ("perf/x86: Support eGPRs sampling using sample_regs_* fields") a2c64c74c029 ("perf: Enhance perf_reg_validate() with simd_enabled argument") 74d55a827e31 ("perf/x86: Support OPMASK sampling using sample_simd_pred_reg_* fields") 3807f6996a0b ("perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields") b76210d32147 ("perf/x86: Support YMM sampling using sample_simd_vec_reg_* fields") e9d76ada769c ("perf/x86: Support XMM sampling using sample_simd_vec_reg_* fields") 918b7d6d1729 ("perf: Add sampling support for SIMD registers") edd9aec51213 ("perf/x86: Enable XMM register sampling for REGS_USER case") b84c96283684 ("perf/x86: Enable XMM register sampling for non-PEBS events") c09466807467 ("perf/x86/intel: Centralize PERF_PMU_CAP_EXTENDED_REGS updates") 05fe8825796e ("perf: Move and enhance has_extended_regs() for arch-specific use") 450d73dc5f91 ("x86/fpu: Add update_fpu_state_and_flag() helper") 03b89c9f202e ("x86/fpu/xstate: Add xsaves_nmi() helper") 9c05620b4971 ("perf/x86: Use x86_perf_regs in NMI handlers") cb388bd530cc ("perf: Eliminate duplicate arch-specific function definitions") bbdf84fcedfa ("perf/x86/intel: Convert x86_perf_regs to per-cpu variables") 62e074f55f41 ("perf/x86/intel: Enable large PEBS sampling for XMMs") 9106892e27ca ("perf/x86: Move hybrid PMU initialization before x86_pmu_starting_cpu()") Signed-off-by: Ingo Molnar <mingo@kernel.org>
45 hoursMerge branch 'features' into for-nextHeiko Carstens
* features: s390/entry: Save lowcore on invalid kernel stack s390/entry: Last breaking event vs invalid kernel stack s390/percpu: Implement this_cpu_try_cmpxchg() s390/percpu: Drop unused output register from arch_this_cpu_to_op() s390/percpu: Drop unused output register from arch_this_cpu_add() s390/percpu: Use asm_inline for arch_this_cpu_add() s390/extable: Remove EX_TABLE macros and fallback extable search s390/bpf: Simplify exception table entry handling s390/sclp: Convert inline assembly to EX_TABLE_INSN s390/diag_ftp: Convert inline assembly to EX_TABLE_INSN s390/dasd: Convert inline assembly to EX_TABLE_INSN s390/cio: Convert inline assembly to EX_TABLE_INSN s390/boot: Convert inline assembly to EX_TABLE_INSN s390/pci: Convert inline assembly to EX_TABLE_INSN s390/kvm: Convert inline assembly to EX_TABLE_INSN s390/word-at-a-time: Convert inline assembly to EX_TABLE_INSN s390/traps: Convert inline assembly to EX_TABLE_INSN s390/fpu: Convert inline assembly to EX_TABLE_INSN s390/ap: Convert inline assembly to EX_TABLE_INSN s390/hypfs: Convert inline assembly to EX_TABLE_INSN s390/ipl: Convert inline assembly to EX_TABLE_INSN s390/cert_store: Convert inline assembly to EX_TABLE_INSN s390/cpu_mf: Convert inline assembly to EX_TABLE_INSN s390/mm/pfault: Convert inline assembly to EX_TABLE_INSN s390/diag: Convert inline assembly to EX_TABLE_INSN s390/futex: Convert inline assembly to EX_TABLE_INSN s390/lib/uaccess: Convert inline assembly to EX_TABLE_INSN s390/uaccess: Convert inline assembly to EX_TABLE_INSN s390/diag: Convert amode31 exception tables to EX_TABLE_INSN s390/extable: Rework exception handling logic s390/dis: Improve show_code() output s390/traps: Handle nullifying program checks in get_trap_ip() s390/tools: Generate bitmap of nullified program checks s390/tools: Rename gen_facilities to gen_bitmaps s390/bug: Indicate modified PSW in disassembly s390: Clear pt_regs flags field s390/early: Fix early warning handling s390/kprobes: Prevent kprobes on instructions with exception table entry s390/pci: Unregister the adapter interrupt first in zpci_irq_exit() s390/pci: Drop the unused index argument of zpci_msi_clear_airq() s390/pci: Set MSI_FLAG_NO_AFFINITY at IRQ init time s390/pci: Add error cleanup in zpci_directed_irq_init() s390/pci: Fix use-after-free race in zpci floating interrupt cleanup s390/pci: Fix MSI directed-mode teardown IRQ bit count s390/pci: Fix resource leak in zpci MSI setup s390/pci: Fix double-free and NULL deref in zpci MSI domain cleanup s390/uprobes: Fix off-by-one bug in emulated PER handling s390/extable: Fix mvcos instruction decoding s390/ptrace: Preserve ILC when updating system call number s390/zcrypt: Fix out-of-bounds ptr advance in cca_query_crypto_facility() s390/zcrypt: Guard domain index uses against speculative bypass s390/vtime: Remove vtimer infrastructure s390/appldata: Emulate virtual timer with delayed work s390/cpum_cf: Honor hwctr session cpu mask during hotplug s390/cpum_cf: Check session mask before cpu offline s390/dis: Mark non-NUL-terminated character arrays with __nonstring s390/fs3270: Return -ENOTTY for unknown ioctls in fs3270_ioctl() s390/zcrypt: Fix and improve zcrypt reply message verification checks s390/vmcp: Initialize full session info to zero s390/configs: Enable NVMe-oF RDMA and TCP in defconfig s390/percpu: Rework to simplify percpu_entry() and percpu_exit() s390/percpu: Use percpu code section for this_cpu_cmpxchg() s390/percpu: Use percpu code section for this_cpu_xchg() s390/percpu: Use percpu code section for this_cpu_cmpxchg128() s390/percpu: Use __PCPU_BEGIN() and __PCPU_END() for inline assemblies s390/percpu: Rename inline assembly symbolic names s390/percpu/lowcore: Add and use LC_PERCPU lowcore offset defines s390/percpu: Let MVIY_PERCPU() calculate alternative displacement s390/lowcore: Remove _AC() from LOWCORE_ALT_ADDRESS s390/percpu: Add sanity check to GEN_MVIY macro s390/percpu: Fix comment typo s390/sclp: Implement resize for sclp-vt220 console s390/sclp: Introduce dedicated sclp-vt220 event buffer type s390/scm: Use kmalloc() for SCM information s390/qdio_setup: Use kmalloc() for the SSQD request s390/qdio_setup: Use kmalloc() for the storage list s390/qdio_setup: Use kzalloc() for QDIO buffers s390/qdio_main: Use kzalloc() for the QDR s390/qdio_main: Use kzalloc() for the IRQ structure s390/idals: Use kmalloc() for IDAL data buffers s390/cmf: Use kmalloc() for the CMB area s390/cio: Use kzalloc() for CHSC work areas s390/chsc_sch: Use __free(kfree) for synchronous CHSC requests s390/chsc_sch: Use kzalloc() for CHSC requests s390/chsc: Use kzalloc() for the SEI work area s390/chsc: Use kzalloc() for CUBs s390/keyboard: Allocate key_maps and func_table with ARRAY_SIZE() s390/hiperdispatch: Use system_dfl_wq to reschedule hd_capacity_work s390/rwlock: Add contention tracepoints to rwlock slowpath s390: Warn if kernel command line contains non-printable EBCDIC characters s390/ebcdic: Add character classes for the ASCII subset of EBCDIC Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
45 hourss390/entry: Save lowcore on invalid kernel stackHeiko Carstens
In case of an invalid kernel stack copy the current CPU's lowcore to stack_invalid_lowcore, so it is available to debug tools after a crash. The copy is helpful since the lowcore is modified e.g., when printing messages before a dump is taken. Keep it as unmodified as possible and as close to the event that caused register corruption. Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
45 hourss390/entry: Last breaking event vs invalid kernel stackHeiko Carstens
In case an invalid kernel stack is detected the last breaking event address is copied to the orig_gpr2 member of the generated pt_regs structure. Correct location would be last_break. Fix this. This adds help information to the printed messages: Before: Kernel stack pointer invalid ... Last Breaking-Event-Address: [<0000000000000000>] 0x0 After: Kernel stack pointer invalid ... Last Breaking-Event-Address: [<000001b802c1ae1c>] proc_reg_write+0x5c/0xd0 Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/traps: Convert inline assembly to EX_TABLE_INSNHeiko Carstens
Convert the monitor call exception table entry to use EX_TABLE_INSN. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/ipl: Convert inline assembly to EX_TABLE_INSNHeiko Carstens
Convert the diag308 exception table entry to use EX_TABLE_INSN. With EX_TABLE_INSN entries always point to the faulting instruction, so nopr padding is no longer needed and removed. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/cert_store: Convert inline assembly to EX_TABLE_INSNHeiko Carstens
Convert the diag320 exception table entry to use EX_TABLE_INSN. With EX_TABLE_INSN entries always point to the faulting instruction, so nopr padding is no longer needed and removed. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/diag: Convert inline assembly to EX_TABLE_INSNHeiko Carstens
Convert all diag exception table entries to use EX_TABLE_INSN. With EX_TABLE_INSN entries always point to the faulting instruction, so duplicate entries and nopr padding are no longer needed and removed. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/diag: Convert amode31 exception tables to EX_TABLE_INSNHeiko Carstens
Convert all amode31 exception table entries to use EX_TABLE_INSN. With EX_TABLE_INSN entries always point to the faulting instruction, so named labels are replaced with numeric labels. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/dis: Improve show_code() outputHeiko Carstens
Replace the '>' and '*' instruction markers with explicit 'PSW >' and 'PGM >' markers which identify both the PSW address and the faulting instruction. Previously, '>' marked the PSW address, while '*' marked the preceding instruction as a guess for the faulting instruction for suppressing exceptions: Krnl Code: 000003ff8dc7bff8: e310f0080004 lg %r1,8(%r15) *000003ff8dc7bffe: e3a0e0000004 lg %r10,0(%r14) >000003ff8dc7c004: a7280000 lhi %r2,0 000003ff8dc7c008: eb9ff0900024 stmg %r9,%r15,144(%r15) Now 'PGM >' explicitly marks the faulting instruction without guessing and 'PSW >' marks the PSW address: Krnl Code: 000003ff8dc7bff8: e310f0080004 lg %r1,8(%r15) PGM >000003ff8dc7bffe: e3a0e0000004 lg %r10,0(%r14) PSW >000003ff8dc7c004: a7280000 lhi %r2,0 000003ff8dc7c008: eb9ff0900024 stmg %r9,%r15,144(%r15) For nullifying exceptions where both addresses are the same, 'PGM+PSW >' is printed instead: Krnl Code: 000003ff8dc7bff8: e310f0080004 lg %r1,8(%r15) PGM+PSW >000003ff8dc7bffe: e3a0e0000004 lg %r10,0(%r14) 000003ff8dc7c004: a7280000 lhi %r2,0 000003ff8dc7c008: eb9ff0900024 stmg %r9,%r15,144(%r15) show_code() may also be called in other contexts where pt_regs does not originate from a program check (e.g. system calls). Introduce and set PIF_PGM_CHECK to indicate when in program check context, and print the PGM marker only in such a context. Note that corner cases are not taken into account. Like before kprobes is not considered, which means that the disassembly may contain unexpected instructions, or that disassembly and/or instruction length count as well as interruption do not match. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/traps: Handle nullifying program checks in get_trap_ip()Heiko Carstens
get_trap_ip() always rewinds the PSW address by the instruction length from the interruption code. For nullifying program checks the PSW already points at the faulting instruction, so rewinding is wrong. Add a nullified[] bitmap and return the unchanged PSW address for nullifying cases, or if PIF_PSW_ADDR_ADJUSTED is set. No functional change for existing callers, which only deal with suppressing, terminating, or completing program checks. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/bug: Indicate modified PSW in disassemblyHeiko Carstens
With [1] the PSW address is set to the return address of the calling __WARN_trap() function in order to provide a more useful disassembly of the caller rather than the helper itself. However, since regs->psw.addr is modified, regs->int_code has nothing to do with the exception. In order to make that more obvious change the disassembler output. Introduce a new PIF_WARN_TRAP_SKIPPED pt_regs flag and set it whenever __WARN_trap() is skipped. In the disassembler output print a "WARN RET" prefix to make it obvious that the PSW points to the return address of the warning trap function. Also do not print the interruption code and instruction length code for this case, since they have nothing to do with the modified PSW. Example output: Krnl Code: 000003ffe185bc1c: e3f0ff98ff71 lay %r15,-104(%r15) 000003ffe185bc22: e3e0f0980024 stg %r14,152(%r15) 000003ffe185bc28: c0e5ff45ed94 brasl %r14,000003ffe0119750 WARN RET >000003ffe185bc2e: c0e5ffa052b9 brasl %r14,000003ffe0c661a0 000003ffe185bc34: c020fffe86d6 larl %r2,000003ffe182c9e0 000003ffe185bc3a: e548f0a80006 mvghi 168(%r15),6 000003ffe185bc40: e548f0a00005 mvghi 160(%r15),5 000003ffe185bc46: a7690004 lghi %r6,4 [1] 79996065cfa2 ("s390/bug: Skip __WARN_trap() in call traces") Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390: Clear pt_regs flags fieldHeiko Carstens
Clear the pt_regs flags field in the early program check handler as well as in the stack_invalid handler. Without this the pt_regs flags field will have random values, depending on previous stack contents. This matters currently for bug reporting and disassembly, where flags like PIF_PSW_ADDR_ADJUSTED may then be incorrectly set, which could lead to a partially incorrect disassembly or wrong code markers. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/early: Fix early warning handlingHeiko Carstens
When adding support for __WARN_printf() the early program check handler was not taken into account. Add the missing support to the early program check handler. This avoids that the kernel crashes instead of printing a warning. Fixes: 04dabb4261c3 ("s390/bug: Implement __WARN_printf()") Fixes: 79996065cfa2 ("s390/bug: Skip __WARN_trap() in call traces") Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/kprobes: Prevent kprobes on instructions with exception table entryHeiko Carstens
The mvcos exception handler ex_handler_ua_mvcos() decodes the faulting instruction, assuming it is an mvcos instruction. In case the instruction is kprobed the decoded instruction is a breakpoint instruction instead, which leads to incorrect instruction decoding and potential register corruption. Fix this by simply preventing to set a kprobe on such instructions, similar like arm64 is doing it. Fixes: c488f5187a24 ("s390/uaccess: Shorten raw_copy_from_user() / raw_copy_to_user() inline assemblies") Cc: stable@vger.kernel.org Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/uprobes: Fix off-by-one bug in emulated PER handlingHeiko Carstens
The uprobes code emulates some instructions, and with that also PER storage-alteration handling, in case a debugger is attached. The PER storage-alteration handling contains an off-by-one bug, which may lead to PER traps which should not happen. Adjust the comparison in sim_stor_event() to fix that. Fixes: 8d1a2427d8fc ("s390/uprobes: fix user space PER events") Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
46 hourss390/ptrace: Preserve ILC when updating system call numberHeiko Carstens
When an attached debugger changes gpr2 via PTRACE_POKEUSR while the traced process has PIF_SYSCALL set, the int_code in pt_regs is also updated. In case of an svc it contains the instruction length code (ILC), as well as the system call number. The ptrace code sets the ILC unconditionally to a value which matches the svc instruction. However the svc instruction also may have been executed via the execute or execute relative long instruction, which have a different length. Therefore preserve the ILC and only change the system call number using syscall_set_nr(). This makes sure that in case of a PSW rewind the instruction address points to the correct instruction. Fixes: 56e62a737028 ("s390: convert to generic entry") Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
6 dayss390/vtime: Remove vtimer infrastructureHeiko Carstens
The only user is gone - remove the vtimer infrastructure. Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
6 dayss390/cpum_cf: Honor hwctr session cpu mask during hotplugSumanth Korikkar
cfset_online_cpu() and cfset_offline_cpu() cpu hotplug callbacks start and stop counter sets for every active hwctr session without checking the session cpu mask, and dynamically modify that mask on each hotplug event. For example, assume cpu0 and cpu1 are online and cpu2 is offline. Start an hwctr session restricted to cpu0 and cpu1, and then bring cpu2 online: lshwc -l 9999 -i 5 0-1:b chcpu -e 2 Although cpu2 is not part of the requested mask, cfset_online_cpu() starts the counter sets on cpu2 and adds it to the session mask. cpu2 can then appear in lshwc output (s390-tools) and is handled as part of the session until it is stopped. Keep the userspace provided cpu mask unchanged and update counter sets only when the hotplugged cpu belongs to that mask. For all cpu requests, lshwc should supply the possible cpu mask so that cpus coming online later remain part of the session. Note: A corresponding lshwc (s390-tools) change is needed to supply the possible cpu mask for allcpu sessions, ensuring that cpus coming online later remain part of the session. Without it, newly online cpus would be silently excluded from an active session. Since this userspace change is not yet available, the patch is not suitable for stable kernels and intentionally omits a Fixes: tag. The prerequisite bug fix is in "s390/cpum_cf: Check session mask before cpu offline". Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
6 dayss390/cpum_cf: Check session mask before cpu offlineSumanth Korikkar
cfset_offline_cpu() stops counter sets for every active session without checking whether the outgoing cpu belongs to the session mask. For example, run an hwctr session on cpu0 and a cpu bound perf event on cpu1: lshwc -l 9999 -i 5 0:b perf stat -C 1 -e cpum_cf/CPU_CYCLES/ sleep 120 chcpu -d 1 chcpu -e 1 Although the hwctr session does not include cpu1, cfset_offline_cpu() decrements its counter set reference count. The subsequent perf teardown decrements it again, causing it to underflow. The perf event keeps the percpu state alive across hotplug. When cpu1 comes online, the hwctr session is started there and the reference count moves from -1 to 0. Stopping the hwctr session then decrements it to -1 again, so the zero triggered counter set disable path is skipped. Check the session mask before stopping counter sets on the outgoing cpu. This prevents the unmatched decrement and the resulting reference count underflow. Fixes: a029a4eab39e ("s390/cpumf: Allow concurrent access for CPU Measurement Counter Facility") Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: stable@vger.kernel.org # v5.14+ Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
6 dayss390/dis: Mark non-NUL-terminated character arrays with __nonstringHeiko Carstens
With [1] the generated string initializers were changed to use an array instead of a non-NUL-terminated string. The reason was that GCC 15 warns about string initializers that truncate the NUL terminator with -Wunterminated-string-initialization. The better solution is to use the __nonstring annotation, which exists to deal exactly with this problem. Therefore use it and basically revert [1] in order to generate more readable initializers: Before: [LONG_INSN_ALGHSIK] = { 'a', 'l', 'g', 'h', 's', 'i', 'k', }, After: [LONG_INSN_ALGHSIK] = "alghsik", [1] commit 7cbae7ea3de5 ("s390/tools: Use array instead of string initializer") Reviewed-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
8 dayss390: implement arch_do_panicMete Durlu
Implement s390 specific arch_do_panic() instead of using s390 specific ifdef sections in vpanic() code. disabled_wait() is now called after "end Kernel panic" marker. No functional changes. Link: https://lore.kernel.org/20260831-arch_do_panic-v6-2-a1e170a9e7fd@linux.ibm.com Signed-off-by: Mete Durlu <meted@linux.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Bradley Morgan <include@grrlz.net> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Cc: Alexander Gordeev <agordeev@linux.ibm.com> Cc: Andreas Larsson <andreas@gaisler.com> Cc: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: David S. Miller <davem@davemloft.net> Cc: Petr Mladek <pmladek@suse.com> Cc: Sven Schnelle <svens@linux.ibm.com> Cc: Vasily Gorbik <gor@linux.ibm.com>
13 daysMerge tag 'random-7.3-rc6-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator fixes from Jason Donenfeld: - VMGENID memory needs to be mapped with the decrypted tag, so that SEV-SNP machines can boot - A fix for an initialization race in VMGENID, followed by a cleanup - Trivial kernel doc cleanups in siphash and random.c - A fix for a new compilation failure with recent clang on PPC and RISC-V, due to generating an out-of-line memset in the vDSO * tag 'random-7.3-rc6-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: random: vDSO: avoid call to memset() when zeroing reserved parameter random: fix vgetrandom_opaque_params kernel-doc random: vDSO: fix repeated word 'to' in comment siphash: clean up kernel-doc comments virt: vmgenid: move to using dev_set/get_drvdata virt: vmgenid: set driver_data before registering notification handlers virt: vmgenid: remap memory as decrypted
13 daysrandom: vDSO: avoid call to memset() when zeroing reserved parameterNathan Chancellor
After a recent change in LLVM [1], builds with the random vDSO implementation, such as PowerPC and RISC-V, fail when checking the vDSO: arch/powerpc/kernel/vdso/vdso32.so.dbg: dynamic relocations are not supported arch/riscv/kernel/vdso/vdso.so.dbg: dynamic relocations are not supported memset() is now generated when zeroing params->reserved for some builds because LLVM has an optimization (now run in more instances) that can recognize at compile time when it is assigning a static value to a contiguous area of memory and turn that into a call to memset(). Both clang and GCC assume memset() is always available [2]. Clang has an internal fiddly hook, -max-store-memset, which we can set to a high number, to disable generating out of line memset calls [3]. Similarly, GCC has -finline-stringops=memset to do the same [4], should this issue ever hit future version of GCC. While these options wouldn't make sense for normal kernel code, it is fine for the extremely limited and intentionally compact vDSO code. Link: https://github.com/llvm/llvm-project/commit/90cebef1411617fc3eedd359bdf00cb44b1c2439 [1] Link: https://gcc.gnu.org/onlinedocs/gcc-16.2.0/gcc/Standards.html#index-ffreestanding [2] Link: https://github.com/llvm/llvm-project/commit/b28eeb28bea39148738dc375e8a97072a1907e64 [3] Link: https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-finline-stringops [4] Closes: https://github.com/ClangBuiltLinux/linux/issues/2183 Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
2026-09-30s390/percpu: Rework to simplify percpu_entry() and percpu_exit()Heiko Carstens
The percpu code section functionality uses a rather complex method to figure out if the register, which contains the address of the current cpu's percpu variable, needs to be adjusted. If an interrupt happens within a percpu code section (indicated by a lowcore field), the instruction at the interrupted location is checked. If it is not a specific AG instruction, the register needs to be updated. This mechanism needs to take kprobes into account, and enforces a specific instruction ordering. Mark Rutland provided a different solution for arm64 [1] which comes without such limitations, but requires to use one more instruction, and two more registers. Given that this simplifies percpu_entry() and percpu_exit() it seems to be worth to go that route. Change s390 to implement a similar approach. This requires to encode three register numbers into the "percpu_register" field, which is used to indicate if a percpu code section is executed. The used mviy instruction can write only one byte, which allows to encode only two register numbers. Use a register pair for the inline assemblies, and only encode the even register number of the register pair to work around this. The generated code changes like this for e.g. a simple this_cpu_inc(): Old: c0 20 00 00 00 00 larl %r2,c6 <foo+0x6> <-- load address of percpu var b9 04 00 32 lgr %r3,%r2 <-- pointless copy of address eb 03 03 c0 00 52 mviy 960,3 <-- start of percpu code section - gpr 3 contains percpu var address e3 30 03 b8 00 08 ag %r3,952 <-- add percpu offset eb 01 30 00 00 7a agsi 0(%r3),1 <-- atomic inc eb 00 03 c0 00 52 mviy 960,0 <-- end of percpu code section New: c0 10 00 00 00 00 larl %r1,c6 <foo+0x6> <-- load address of percpu var eb 21 03 c0 00 52 mviy 960,33 <-- start of percpu code section 33 == 0x21: - gpr 1 contains percpu var address - gpr 2 used for percpu offset - gpr 2+1 == 3 used for current cpu's percpu var address e3 20 03 b8 00 04 lg %r2,952 <-- load percpu offset 41 32 10 00 la %r3,0(%r2,%r1) <-- generate current cpu's percpu var address eb 01 30 00 00 7a agsi 0(%r3),1 <-- atomic inc eb 00 03 c0 00 52 mviy 960,0 <-- end of percpu code section In the above "new" code example 33 (0x21) is used as indicator value to mark that a percpu code section is executed. This value implies that registers 2 and 3 will (only) hold the percpu offset and the current cpu's percpu var address. Those registers will be updated by percpu_exit() if the process was migrated to a different cpu to contain the percpu offset and percpu var address of the new cpu. Note that because of the pointless lgr instruction in the "old" code example the two code sequences have identical size, and it looks like only one more register is used. However this is because of suboptimal gcc code generation. [1] https://lore.kernel.org/all/20260908151741.394589-1-mark.rutland@arm.com/ Acked-by: Alexander Gordeev <agordeev@linux.ibm.com> Tested-by: Mete Durlu <meted@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-09-28s390/uv: Rework page allocation for guest variable storage areaHeiko Carstens
Alexander Gordeev reported that the allocation of pages of the guest variable storage area via the uv_alloc_range_cb() callback of apply_to_page_range() will cause problems as soon as s390 fully supports lazy mmu mode. Problem is that uv_alloc_range_cb() allocates pages with GFP_KERNEL while preemption would be disabled. This would result in reports like this: BUG: sleeping function called from invalid context at ./include/linux/sched/mm.h:322 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6092, name: qemu-kvm preempt_count: 1, expected: 0 ... Call Trace: dump_stack_lvl+0xae/0x108 __might_resched+0x1de/0x2f0 prepare_alloc_pages+0x1ba/0x220 __alloc_frozen_pages_noprof+0xc6/0x390 alloc_pages_mpol+0xe6/0x220 alloc_frozen_pages_noprof+0x5c/0x80 alloc_pages_noprof+0x22/0x80 uv_alloc_range_cb+0x30/0x300 apply_to_pte_range+0x11a/0x3b0 apply_to_pmd_range+0x13a/0x250 __apply_to_page_range+0x232/0x4d0 apply_to_page_range+0x28/0x40 uv_alloc_stor_var+0x5e/0x90 kvm_s390_pv_alloc_vm+0x118/0x1e0 [kvm] kvm_s390_pv_init_vm+0x84/0x2e0 [kvm] kvm_s390_handle_pv+0x502/0xf70 [kvm] kvm_arch_vm_ioctl+0x234/0xdd0 [kvm] kvm_vm_ioctl+0x33a/0x890 [kvm] __s390x_sys_ioctl+0xfa/0x130 __do_syscall+0x1fc/0x700 system_call+0x72/0x90 Preallocate the pages and make use of vm_area_map_pages() to address this potential future bug. Reported-by: Alexander Gordeev <agordeev@linux.ibm.com> Closes: https://lore.kernel.org/all/e9449c63-b8d2-4ed9-a184-7dcab3e8dfce-agordeev@linux.ibm.com Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Acked-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
2026-09-28sched/cputime: Add kcpustat_field_total helperShrikanth Hegde
Provide a new helper function which sums up a given type of cpustat over a specified cpumask. This allows the caller's code to be simpler and avoids duplication. For example, subsequent patch in the steal governor use this exact same pattern when calculating steal time. Number of cpus can be derived from cpumask_weight() where necessary. Suggested-by: Yury Norov <yury.norov@gmail.com> Signed-off-by: Shrikanth Hegde <sshegde@linux.ibm.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Yury Norov <ynorov@nvidia.com> Reviewed-by: Mete Durlu <meted@linux.ibm.com> Acked-by: Frederic Weisbecker <frederic@kernel.org> Link: https://patch.msgid.link/20260928053728.797539-2-sshegde@linux.ibm.com
2026-09-27Merge branch 'perf/core' into perf/merge, to assist CI testingIngo Molnar
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2026-09-26Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm fixes from Paolo Bonzini: "Arm: - Invalidate the ITS translation cache when the guest changes the base address of the ITS tables (Fuad Tabba) - Skip saving ITS devices with device IDs that are out-of-bounds rather than failing the entire ITS save ioctl (Fuad Tabba) - Close race between VM teardown and invalidations of nested MMUs when handling MMU operations that are allowed to block (Lorenzo Stoakes) - Various fixes for the handling of the host's untrusted SVE configuration in pKVM (Fuad Tabba) - Make sure that empty SMCCC ranges based at 0 are rejected by the kvm_smccc_set_filter() (Karl Mehltretter) - Revoke the host mapping for pKVM's private stack pages, along with a new sanity check that all mappings in the hyp's private VA range have been correctly marked as hyp-owned (Fuad Tabba) - Lifetime fixes for the array of shadow stage-2 MMUs, ensuring that concurrent vCPU initialization cannot relocate in-use MMUs. Defer the freeing of shadow stage-2 MMUs to the point that no other users (e.g. MMU notifier) could reference them (Marc Zyngier) - Drop useless WARN when rejecting an unsupported ioctl for pKVM (Fuad Tabba) - Fix the steal_time selftest to install correctly-sized mappings for non-4K hosts (Sebastian Ott) - Correct mapping of fine-grained trap for GCSPOPX instruction (Mark Brown) - Fix KVM_BUG_ON() due to missing handling of DBGBXVR<n> from 32-bit guests (Karl Mehltretter) RISC-V: - Synchronize hrtimer during VCPU teardown - Fix the conversion between vsip and hvip values - Serialize IMSIC attributes with vCPU migration - Release unused page after MMU invalidation - Propagate interrupted G-stage faults to KVM user-space as EINTR - Fix nested acceleration hfence entry update order - Fix sdata leak and stale snapshot_addr in snapshot_set_shmem - Preserve firmware counter value across PMU counter stop/start - Report PMU snapshot write failure to the guest - Fix perf-backed counter accounting across PMU stop and read - Correctly propagate error of a hart status SBI call s390: - Ensure that accesses through kvm_arch_set_irq_inatomic mark as dirty the pages that contain indicator and summary bits - Fix compile warning for kvm_s390_update_cmma_dirty() - Fix incorrect propagation of ENOENT from _gaccess_shadow_fault() to userspace - Move s390_kvm_mmu_commit_memory_region() into s390_kvm_mmu_prepare_memory_region() so that it can fail instead of WARN - Add missing srcu in kvm_s390_set_irq_state() - Fix potential races in storage functions - Fix race in _destroy_pages_crste() - Fix issues in the handling of KVM interrupt and page resources, when a queue that is assigned to a mediated device (mdev) is removed from the host's AP configuration - Fix loop condition in uv_find_secrets - Prevent potential out-of-bounds read x86: - Fix a brown paper bag bug where KVM would incorrectly treat Intel PMU MSRs as valid on AMD - Fix a regression in the hardware disable selftest where it checked the wrong macro when detecting glibc support (breaks at least musl) - Never clear KVM_REQ_VM_DEAD so that dead VMs stay dead, which is especially important for KVM_BUG_ON() flows, which often guard more dangerous bugs - Re-pend GET_NESTED_STATE_PAGES if getting the pages fails, to fix a bug where KVM would let userspace run a broken setup with stale vmcs12 pages - Fix a class of bugs where KVM would fail to fill kvm_run exit fields if getting nested pages failed - Treat reserved entries in the memory attributes xarray as "no attributes", to fix false positives when checking for mixed attributes - Fix memcg accounting for the memory attributes xarray (the xarray library subtly requires the xarray to be configured for accounting upfront; the gfp flags taken at runtime are used only rarely) - Don't pre-reserve xarray entries when storing empty attributes, as storing NULL must not require memory allocation (KVM and other subsystems heavily rely on this behavior) - Fix a memory leak and a cache maintenance issue related to doing intra-host migration on an SEV guest" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (54 commits) KVM: SEV: Do cache maintenance on the source VM during intra-host migration KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV KVM: Don't pre-reserve xarray entries when storing empty/NULL attributes KVM: Ensure memory attributes xarray nodes are accounted to the caller's memcg KVM: Don't treat reserved xarray entries as having memory attributes KVM: x86: Fill kvm_run exit fields in common get_nested_state_pages() error paths KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails KVM: arm64: Fix AArch32 DBGBXVR<n> handling KVM: arm64: Fix FGT mapping for HFGITR_EL2.nGCSEPP KVM: selftests: fix steal_time for arm64 with host page size > 4K KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction KVM: arm64: nv: Fix life cycle of the nested_mmus array KVM: arm64: Check every private mapping is hyp-owned at pKVM init KVM: arm64: Move the private VA allocation cursor to __io_map_next KVM: arm64: Match hyp text by physical address in fix_host_ownership() KVM: arm64: Transfer the hyp stack pages out of the host stage-2 KVM: arm64: selftests: Test empty SMCCC filter range at base 0 KVM: arm64: Return -EINVAL for an empty SMCCC filter range at base 0 KVM: arm64: Derive GUEST_HAS_SVE from the SVE feature bit at EL2 ...
2026-09-23Merge branch 'perf/urgent' into perf/core, to resolve conflictIngo Molnar
Conflicts: include/linux/perf_event.h Signed-off-by: Ingo Molnar <mingo@kernel.org>
2026-09-22s390/debug: Fix NULL pointer dereference in debug_info_copy()Mikhail Zaslonko
When debug_register_static() fails, it clears areas, active_pages and active_entries but leaves the area bounds unchanged. Copying such an area, either by opening its view file or via debug_dump(), makes debug_info_copy() dereference the NULL pointers. Skip the copy loop when the source has no areas. Closes: https://lore.kernel.org/r/20260903132123.12F271F00A3F@smtp.kernel.org Fixes: d72541f94512 ("s390/debug: add early tracing support") Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-09-22s390/debug: Do not register views for failed static debug areasMikhail Zaslonko
__REGISTER_STATIC_DEBUG_INFO() calls debug_register_view() unconditionally, even when debug_register_static() has failed. In that case _debug_register() was never reached and id->debugfs_root_entry is still NULL, so debugfs_create_file() places the view file in the debugfs root directory. For sclp_err this leaves a /sys/kernel/debug/hex_ascii file with nothing to indicate which debug log it belongs to. debug_register_static() is not exported and the macro is its only caller, so let it return an error code and skip the view registration when it fails. No debugfs files are created for such an area then. Reproduce by booting with s390dbf=sclp_err::100000000. The sclp_err registration fails, no s390dbf/sclp_err/ directory is created, and a hex_ascii file appears in the debugfs root instead. Fixes: d72541f94512 ("s390/debug: add early tracing support") Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-09-22s390/debug: Reject NULL debug info in debug_dump()Mikhail Zaslonko
debug_dump() passes id on to debug_info_copy(), which dereferences in->name unchecked. debug_unregister(), debug_set_size() and debug_register_view() guard against a NULL id but debug_dump() does not. Nothing reaches this today, but add the check for consistency. Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/all/20260910110147.96E851F000FF@smtp.kernel.org/ Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-09-21Merge tag 'kvmarm-fixes-7.3-1' of ↵Paolo Bonzini
https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 changes for 7.3, take #2 - Invalidate the ITS translation cache when the guest changes the base address of the ITS tables (Fuad Tabba) - Skip saving ITS devices with device IDs that are out-of-bounds rather than failing the entire ITS save ioctl (Fuad Tabba) - Close race between VM teardown and invalidations of nested MMUs when handling MMU operations that are allowed to block (Lorenzo Stoakes) - Various fixes for the handling of the host's untrusted SVE configuration in pKVM (Fuad Tabba) - Make sure that empty SMCCC ranges based at 0 are rejected by the kvm_smccc_set_filter() (Karl Mehltretter) - Revoke the host mapping for pKVM's private stack pages, along with a new sanity check that all mappings in the hyp's private VA range have been correctly marked as hyp-owned (Fuad Tabba) - Lifetime fixes for the array of shadow stage-2 MMUs, ensuring that concurrent vCPU initialization cannot relocate in-use MMUs. Defer the freeing of shadow stage-2 MMUs to the point that no other users (e.g. MMU notifier) could reference them (Marc Zyngier) - Drop useless WARN when rejecting an unsupported ioctl for pKVM (Fuad Tabba) - Fix the steal_time selftest to install correctly-sized mappings for non-4K hosts (Sebastian Ott) - Correct mapping of fine-grained trap for GCSPOPX instruction (Mark Brown) - Fix KVM_BUG_ON() due to missing handling of DBGBXVR<n> from 32-bit guests (Karl Mehltretter)
2026-09-17s390/hiperdispatch: Use system_dfl_wq to reschedule hd_capacity_workEuan Bourke
In hd_enable_hiperdispatch(), hd_capacity_work is scheduled on system_dfl_wq, however the work function reschedules itself with schedule_delayed_work(), which uses system_percpu_wq. Hiperdispatch does not benefit from using the percpu workqueue. Use queue_delayed_work() with system_dfl_wq for consistency. Changing the workqueue from system_percpu_wq to system_dfl_wq causes no functional changes. Signed-off-by: Euan Bourke <euan@linux.ibm.com> Tested-by: Mete Durlu <meted@linux.ibm.com> Reviewed-by: Mete Durlu <meted@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-09-08s390/ebcdic: Add character classes for the ASCII subset of EBCDICIlya Leoshkevich
Add _ctype-like array for EBCDIC characters. Mark only those that also exist in ASCII, loosely based on invariant subset of EBCDIC [1], but with cent, broken bar, not sign, and plus-minus sign, left out. [1] https://en.wikipedia.org/wiki/EBCDIC#Code_page_layout [hca@linux.ibm.com: Reformatted tabled] Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-09-08s390/debug: Fix race between debug area resize and event loggingMikhail Zaslonko
Trace functions check for non-NULL id->areas without lock to minimize overhead. This opens a race window where a NULL pointer dereference occurs if id->areas is set to NULL (e.g. via echo 0 > ../pages) after the check and before id->lock is taken. Fix this by rechecking id->areas under lock. Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-09-08s390/debug: Do not repeat parameter override notice on debug_set_level()Mikhail Zaslonko
Commit a2cec6863709 ("s390/debug: Add s390dbf kernel parameter") calls debug_get_param() from both debug_info_create() and debug_set_level(). Since debug_get_param() emits the override notice unconditionally, and drivers typically call debug_set_level() right after debug_register(), the same line is printed twice per debug area: s390dbf: 0.0.1234: override level to 6 s390dbf: 0.0.1234: override level to 6 For areas registered per device this is multiplied by the device count. With 's390dbf=0.0.*:6' a system with many DASDs emits a large number of redundant lines during boot. Add a quiet parameter to debug_get_param() and pass quiet=true from debug_set_level(), where the override has already been announced during registration. The remaining callers keep printing the notice. Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-09-08s390/debug: Fix NULL pointer dereference in debug_set_level()Mikhail Zaslonko
Commit a2cec6863709 ("s390/debug: Add s390dbf kernel parameter") incorrectly removed a null-id check from debug_set_level(), introducing a possible NULL pointer dereference for debug-API users that put debug_register() results unchecked into debug_set_level(). Fix this by moving the check from the internal _debug_set_level() variant back to the external debug_set_level() wrapper. Fixes: a2cec6863709 ("s390/debug: Add s390dbf kernel parameter") Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-09-08s390/pai: Support CPU hotplug for PMU PAIThomas Richter
The command 'perf stat -e pai_crypto/CRYPTO_ALL/ -- <command>' crashes the kernel when CPUs are hotplug added during that run. Root cause is the missing allocation of per-CPU data structures for that new CPU. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands # echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online Currently without a CPU hotplug handler, that new CPU has no per-CPU data infrastructure. The scheduler runs PMU call back function pai_add() to install the PMU support for that CPU before the task is being scheduled on that new CPU. In pai_add() instructions mp = this_cpu_ptr(pai_root[idx].mapptr); cpump = mp->mapptr; return a NULL pointer and the result is a kernel panic as variable cpump is used inside that function. Add CPU hotplug support for CPU add and delete and create the necessary per-CPU data infrastructure during CPU hotplug add processing. Same for CPU hotplug remove. This is done when the CPU is offline to ensure the data structures are available when CPU is made online and tasks are scheduled on it. [hca@linux.ibm.com: fixup error path in pai_init()] Cc: stable@vger.kernel.org # v6.19 Fixes: 582cc1b28e8c ("s390/pai_ext: Enable per-task and system-wide sampling event") Fixes: 9f66572f2889 ("s390/pai_crypto: Enable per-task and system-wide sampling event") Signed-off-by: Thomas Richter <tmricht@linux.ibm.com> Reviewed-by: Jan Polensky <japo@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-09-08s390/pai: Move locking to event init and deleteThomas Richter
Move mutex locking from per CPU allocation to event allocation. No functional change. Signed-off-by: Thomas Richter <tmricht@linux.ibm.com> Reviewed-by: Sumanth Korikkar <sumanthk@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-09-08s390/pai: Use PAI PMU index as parameter replacing eventThomas Richter
Use PAI PMU index value as function argument instead of pointer to struct perf_event. Only that index value is used inside functions pai_alloc_cpu() and pai_event_destroy_cpu(). No functional change. Signed-off-by: Thomas Richter <tmricht@linux.ibm.com> Reviewed-by: Sumanth Korikkar <sumanthk@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-09-02s390/uv: Prevent potential out-of-bounds readSteffen Eiden
When the system has more than 85 secrets, the uv_secret_list struct array only holds up to 85 items per page, resulting in an out of bounds read in find_secret_in_page if the targeted secret is in the next page or not stored at all. Fix this by looping over the number of stored secrets which is the per sub-list count of stored secrets and not the overall count. Fixes: 7c9137af2042 ("s390/uv: Retrieve UV secrets support") Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812-uv_secrets_fix-v3-2-a85bd29e0666@linux.ibm.com>
2026-09-02s390/uv: Fix loop condition in uv_find_secretsSteffen Eiden
Systems with more than 85 UV secrets got -ENOENT for any secret past the first page. Fix this by setting the start index at the beginning of the loop in uv_find_secret() and not at the end. First test if there are more secrets left by comparing start_idx with list->next_secret_idx, and then set the start index to the next secret index. Fixes: 7c9137af2042 ("s390/uv: Retrieve UV secrets support") Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Reviewed-by: Christoph Schlameuss <schlameuss@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260812-uv_secrets_fix-v3-1-a85bd29e0666@linux.ibm.com>
2026-09-02perf: Enhance perf_reg_validate() with simd_enabled argumentDapeng Mi
The upcoming patch will support x86 APX eGPRs sampling by using the reclaimed XMM register space to represent eGPRs in sample_regs_* fields. To differentiate between XMM and eGPRs in sample_regs_* fields, an additional argument, simd_enabled, is introduced to the perf_reg_validate() helper. If simd_enabled is set to 1, it indicates that eGPRs are represented in sample_regs_* fields for the x86 platform; otherwise, XMM registers are represented. Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260824082731.1013973-18-dapeng1.mi@linux.intel.com
2026-08-31s390/topology: Switch to common cpu capacity codeMete Durlu
s390 implementation of cpu capacity management infrastructure code does not do anything different than its common code counterpart. Switch to common code functions and remove the smp_cpu_*_capacity() functions. Make s390 code better align with other architectures which utilize cpu_capacity. No functional changes. Allow cpu_capacity attributes inside sysfs to accurately reflect cpu capacity. ex: $ cat /sys/devices/system/cpu/cpu0/polarization vertical:high $ cat /sys/devices/system/cpu/cpu0/cpu_capacity 1024 $ cat /sys/devices/system/cpu/cpu40/polarization vertical:low $ cat /sys/devices/system/cpu/cpu40/cpu_capacity 128 Prior to commit 6bceea7a1e07 ("arch_topology: Relocate cpu_scale to topology.[h|c]") cpu_capacity attribute was only available to the common arch_topology driver's users. Reflect the correct values to the newly made available attributes. Signed-off-by: Mete Durlu <meted@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>