linux.git/arch/s390/kernel, branch master

s390/debug: Fix race between debug area resize and event logging

2026-09-08T13:53:40+00:00

Trace functions check for non-NULL id->areas without lock to minimize
overhead. This opens a race window where a NULL pointer dereference
occurs if id->areas is set to NULL (e.g. via echo 0 > ../pages) after
the check and before id->lock is taken.

Fix this by rechecking id->areas under lock.

Signed-off-by: Mikhail Zaslonko 
Reviewed-by: Peter Oberparleiter 
Signed-off-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik

s390/debug: Do not repeat parameter override notice on debug_set_level()

2026-09-08T13:53:40+00:00

Commit a2cec6863709 ("s390/debug: Add s390dbf kernel parameter") calls
debug_get_param() from both debug_info_create() and debug_set_level().
Since debug_get_param() emits the override notice unconditionally, and
drivers typically call debug_set_level() right after debug_register(),
the same line is printed twice per debug area:

  s390dbf: 0.0.1234: override level to 6
  s390dbf: 0.0.1234: override level to 6

For areas registered per device this is multiplied by the device count.
With 's390dbf=0.0.*:6' a system with many DASDs emits a large number of
redundant lines during boot.

Add a quiet parameter to debug_get_param() and pass quiet=true from
debug_set_level(), where the override has already been announced during
registration. The remaining callers keep printing the notice.

Signed-off-by: Mikhail Zaslonko 
Reviewed-by: Peter Oberparleiter 
Signed-off-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik

s390/debug: Fix NULL pointer dereference in debug_set_level()

2026-09-08T13:53:40+00:00

Commit a2cec6863709 ("s390/debug: Add s390dbf kernel parameter")
incorrectly removed a null-id check from debug_set_level(), introducing
a possible NULL pointer dereference for debug-API users that put
debug_register() results unchecked into debug_set_level().

Fix this by moving the check from the internal _debug_set_level()
variant back to the external debug_set_level() wrapper.

Fixes: a2cec6863709 ("s390/debug: Add s390dbf kernel parameter")

Signed-off-by: Mikhail Zaslonko 
Reviewed-by: Peter Oberparleiter 
Signed-off-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik

s390/pai: Support CPU hotplug for PMU PAI

2026-09-08T13:53:40+00:00

The command 'perf stat -e pai_crypto/CRYPTO_ALL/ -- '
crashes the kernel when CPUs are hotplug added during that run.

Root cause is the missing allocation of per-CPU data structures
for that new CPU. The allocation is dynamic and the first
event that has task context creates such a structure for
each online CPU. This is not sufficient. CPUs may be offline
during event creation and can be set online during the
perf run time. For example commands

 # echo 0 > /sys/devices/system/cpu/cpu1/online
 # perf stat -e cycles -i -- stress-ng -t10s --matrix X
 # sleep 1
 # echo 1 > /sys/devices/system/cpu/cpu1/online

Currently without a CPU hotplug handler, that new CPU has no
per-CPU data infrastructure. The scheduler runs PMU call back
function pai_add() to install the PMU support for that CPU before
the task is being scheduled on that new CPU.
In pai_add() instructions

    mp = this_cpu_ptr(pai_root[idx].mapptr);
    cpump = mp->mapptr;

return a NULL pointer and the result is a kernel panic as variable
cpump is used inside that function.

Add CPU hotplug support for CPU add and delete and create
the necessary per-CPU data infrastructure during CPU hotplug
add processing. Same for CPU hotplug remove.
This is done when the CPU is offline to ensure the data structures
are available when CPU is made online and tasks are scheduled on it.

[hca@linux.ibm.com: fixup error path in pai_init()]

Cc: stable@vger.kernel.org # v6.19
Fixes: 582cc1b28e8c ("s390/pai_ext: Enable per-task and system-wide sampling event")
Fixes: 9f66572f2889 ("s390/pai_crypto: Enable per-task and system-wide sampling event")
Signed-off-by: Thomas Richter 
Reviewed-by: Jan Polensky 
Signed-off-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik

s390/pai: Move locking to event init and delete

2026-09-08T13:53:40+00:00

Move mutex locking from per CPU allocation to event allocation.
No functional change.

Signed-off-by: Thomas Richter 
Reviewed-by: Sumanth Korikkar 
Signed-off-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik

s390/pai: Use PAI PMU index as parameter replacing event

2026-09-08T13:53:40+00:00

Use PAI PMU index value as function argument instead of pointer
to struct perf_event. Only that index value is used inside
functions pai_alloc_cpu() and pai_event_destroy_cpu().
No functional change.

Signed-off-by: Thomas Richter 
Reviewed-by: Sumanth Korikkar 
Signed-off-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik

s390/topology: Switch to common cpu capacity code

2026-08-31T14:25:39+00:00

s390 implementation of cpu capacity management infrastructure code does
not do anything different than its common code counterpart. Switch to
common code functions and remove the smp_cpu_*_capacity() functions.
Make s390 code better align with other architectures which utilize
cpu_capacity. No functional changes.

Allow cpu_capacity attributes inside sysfs to accurately reflect cpu
capacity.
ex:

$ cat /sys/devices/system/cpu/cpu0/polarization
vertical:high
$ cat /sys/devices/system/cpu/cpu0/cpu_capacity
1024

$ cat /sys/devices/system/cpu/cpu40/polarization
vertical:low
$ cat /sys/devices/system/cpu/cpu40/cpu_capacity
128

Prior to commit 6bceea7a1e07 ("arch_topology: Relocate cpu_scale to
topology.[h|c]") cpu_capacity attribute was only available to the common
arch_topology driver's users. Reflect the correct values to the newly
made available attributes.

Signed-off-by: Mete Durlu 
Reviewed-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik 
Signed-off-by: Heiko Carstens

s390/pai: Reduce excessive debug feature size

2026-08-31T14:25:39+00:00

The pai debug feature is registered with 256 areas, where each area
contains 32 pages. This sums up to a total of 32MiB. The code does not use
any debug exceptions, which means that 255 of those areas are never
used. In addition all existing debug feature calls have a lower level (5)
than the default level (3).

This in turn means that without user interaction the debug feature is
unused.

Reduce the number of areas to 1, and also reduce the number of pages for
the remaining area to 1. Since user interaction is required, the user can
also increase the size of the remaining area, instead of wasting memory by
default.

This reduces the total size of the debug feature to 4KiB.

Fixes: a3f8423622ef ("s390/pai_crypto: Add PAI crypto characteristics table for parameters")
Reviewed-by: Thomas Richter 
Signed-off-by: Vasily Gorbik 
Signed-off-by: Heiko Carstens

s390/pai: Handle multiple PMU stop callback invocations

2026-08-31T14:25:39+00:00

Handle the following scenario:
The kernel protects itself against a very high sampling load and
throttles the sampling using:

  perf_event_throttle() --> PMU->stop()

Shortly later the scheduler may terminate the task and removes it from the
CPU. It again calls

  PMU->stop()

which results in two invocations of PMU->stop() called back to back.
Protect against this and check the PERF_HES_STOPPED bit on function
entry.  If it is already set return.
Clear bit PERF_HES_STOPPED in PMU->start().

Prohibit ioctl(fd, PERF_EVENT_IOC_PERIOD, ...) call for this event.
It sets perf_event::event_limit to a positive value and causes
perf_event_overflow() to invoke pai_stop() call back function when
perf_event::event_limit hits zero. This is not supported because the
sample events CRYPTO_ALL and NNPA_ALL are only taken at schedule out
of a task.

Use list_for_each_entry_safe() for safe iteration over syswide_list
in pai_have_samples().

Fixes: 9f66572f2889 ("s390/pai_crypto: Enable per-task and system-wide sampling event")
Fixes: 582cc1b28e8c ("s390/pai_ext: Enable per-task and system-wide sampling event")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Thomas Richter 
Reviewed-by: Sumanth Korikkar 
Signed-off-by: Vasily Gorbik 
Signed-off-by: Heiko Carstens

s390/diag324: Preserve -EBUSY return code

2026-08-31T14:25:39+00:00

When diag324 reports -EBUSY, the error code is
overwritten by the result of copy_to_user() and put_user(). As a result,
the ioctl may incorrectly return success instead of -EBUSY.

Preserve the original diag324 return code and only return -EFAULT when
copying data to userspace fails.

Fixes: 90e6f191e1ee ("s390/diag324: Retrieve power readings via diag 0x324")
Signed-off-by: Sumanth Korikkar 
Reviewed-by: Heiko Carstens 
Signed-off-by: Vasily Gorbik 
Signed-off-by: Heiko Carstens