kernel/linux.git/arch/s390, branch v6.1.186

KVM: Introduce vcpu->wants_to_run

2026-08-23T12:18:28+00:00

[ Upstream commit a6816314af5749cd88944bfdceb270c627cdf348 ] Introduce vcpu->wants_to_run to indicate when a vCPU is in its core run loop, i.e. when the vCPU is running the KVM_RUN ioctl and immediate_exit was not set. Replace all references to vcpu->run->immediate_exit with !vcpu->wants_to_run to avoid TOCTOU races with userspace. For example, a malicious userspace could invoked KVM_RUN with immediate_exit=true and then after KVM reads it to set wants_to_run=false, flip it to false. This would result in the vCPU running in KVM_RUN with wants_to_run=false. This wouldn't cause any real bugs today but is a dangerous landmine. Signed-off-by: David Matlack Link: https://lore.kernel.org/r/20240503181734.1467938-2-dmatlack@google.com Signed-off-by: Sean Christopherson Stable-dep-of: e800decd9c0a ("KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()

2026-08-23T12:18:23+00:00

[ Upstream commit 49145bce539117db4b6e9e83c0e5ef528e361050 ] ev variable is userspace controlled via event->attr.config and used as an array index after bounds checking, but without speculation barriers. Add the missing array_index_nospec() call to prevent speculative execution. Cc: stable@vger.kernel.org Fixes: 212188a596d1 ("[S390] perf: add support for s390x CPU counters") Signed-off-by: Sumanth Korikkar Reviewed-by: Ilya Leoshkevich Acked-by: Thomas Richter Signed-off-by: Vasily Gorbik Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

s390/cpum_cf: merge source files for CPU Measurement counter facility

2026-08-23T12:18:23+00:00

[ Upstream commit 1e99c242acb2fc211aa9f57cd1060622e66bbf63 ] With no in-kernel user, the source files can be merged. Move all functions and the variable definitions to file perf_cpum_cf.c This file now contains all the necessary functions and definitions for the CPU Measurement counter facility device driver. The files cpu_mcf.h and perf_cpum_cf_common.c are deleted. Signed-off-by: Thomas Richter Acked-by: Hendrik Brueckner Signed-off-by: Heiko Carstens Stable-dep-of: 49145bce5391 ("s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

s390/cpum_cf: remove in-kernel counting facility interface

2026-08-23T12:18:23+00:00

[ Upstream commit ea53e6995f45e857fd34e4fbfbd436b5457da5f7 ] Commit 17bebcc68eee ("s390/cpum_cf: Add minimal in-kernel interface for counter measurements") introduced a small in-kernel interface for CPU Measurement counter facility. There are no users of this interface, therefore remove it. The following functions are removed: kernel_cpumcf_alert(), kernel_cpumcf_begin(), kernel_cpumcf_end(), kernel_cpumcf_avail() there is no need for them anymore. With the removal of function kernel_cpumcf_alert(), also remove member alert in struct cpu_cf_events. Its purpose was to counter measurement alert interrupts for the in-kernel interface. Signed-off-by: Thomas Richter Signed-off-by: Heiko Carstens Stable-dep-of: 49145bce5391 ("s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

s390/cpum_cf: move stccm_avail()

2026-08-23T12:18:23+00:00

[ Upstream commit 7a8f09ac1850b17ca0cc9e1e4d6621a64661347e ] Function stccm_avail() is defined in a header file and the only user is one single source file. Move this function to the source file where it is also used and remove it from the header file. No functional change. Signed-off-by: Thomas Richter Acked-by: Hendrik Brueckner Signed-off-by: Heiko Carstens Stable-dep-of: 49145bce5391 ("s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

s390/cpum_cf: move cpum_cf_ctrset_size()

2026-08-23T12:18:23+00:00

[ Upstream commit 345d2a4dcdb7d0f33ebd990a19aeb3f3f458817d ] Function cpum_cf_ctrset_size() is defined in one source file and the only user is in another source file. Move this function to the source file where it is used and remove its prototype from the header file. No functional change. Signed-off-by: Thomas Richter Acked-by: Hendrik Brueckner Signed-off-by: Heiko Carstens Stable-dep-of: 49145bce5391 ("s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()") Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman

KVM: s390: pci: Fix aisb calculation

2026-08-23T12:18:16+00:00

[ Upstream commit 0cfe660559e857d7c00ab86c73e4510ce069086f ] The current implementation of aisb calculation will erroneously index via an unsigned long * as well as multiply by 8B for every 64-bits in the offset; only one or the other is required. This throws off aisb calculations once the number of devices exceeds 64, and can result in out-of-bounds access as well as failure to indicate summary bits associated with those devices in guests. Fix this by converting to a physical address before applying the offset, as is already done in arch/s390/pci/pci_irq.c. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding") Signed-off-by: Matthew Rosato Reviewed-by: Niklas Schnelle Signed-off-by: Christian Borntraeger [alifm@linux.ibm.com: Resolved merge conflict] Signed-off-by: Farhan Ali Signed-off-by: Sasha Levin

KVM: s390: pci: Fix resource leak on IRQ registration failure

2026-08-23T12:18:16+00:00

[ Upstream commit 5580c9858f1e00f60191eb09c3add359836d60b6 ] Currently if kvm_zpci_set_airq() fails, kvm_s390_pci_aif_enable() returns the error code but doesn't do any resource cleanup thus leaking resources. Fix this by cleaning up all the resources such as the GAITE, AIBV, AISB and unpinning any pinned pages. While at it, remove dead code that stored FIB values that were never referenced. As part of the cleanup, we are also holding the aift_lock a bit longer, as we hold the lock while executing the MPCIFC instruction. Though this is not strictly necessary, it means we don't have to drop and re-acquire in the error case. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Matthew Rosato Reviewed-by: Christian Borntraeger Signed-off-by: Farhan Ali Tested-by: Matthew Rosato Signed-off-by: Christian Borntraeger [alifm@linux.ibm.com: Resolved merge conflict] Signed-off-by: Farhan Ali Signed-off-by: Sasha Levin

KVM: s390: pci: Fix missing error codes and memory unaccounting

2026-08-23T12:18:16+00:00

[ Upstream commit f86842e4d6c482300f4567f492d512c9ccf5bc4f ] In kvm_s390_pci_aif_enable() two error paths failed to set an error code, causing the function to return 0 on failure. It also failed to rollback memory accounting on failure. Fix both by propagating an error code on failure and calling unaccount_mem() in the cleanup path. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali Tested-by: Matthew Rosato Signed-off-by: Christian Borntraeger Signed-off-by: Farhan Ali Signed-off-by: Sasha Levin

KVM: s390: pci: Fix memory accounting for pinned/unpinned pages

2026-08-23T12:18:16+00:00

[ Upstream commit 36f6999ecde3976731a8bfc0b8e667da6f593069 ] The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation. But we don't decrement the count by calling free_uid(). It also accounted/unaccounted the pages against the current->mm. But its possible the unaccount_mem() can be called from a different process context than the one that originally pinned the pages. Let's fix this by storing the pinning process user_struct and mm_struct when accounting for pinned pages, and subsequently free these resources when the pages are unpinned. Fixes: 3c5a1b6f0a18 ("KVM: s390: pci: provide routines for enabling/disabling interrupt forwarding") Cc: stable@vger.kernel.org Reviewed-by: Christian Borntraeger Reviewed-by: Matthew Rosato Signed-off-by: Farhan Ali Tested-by: Matthew Rosato [borntraeger@linux.ibm.com: Fixed whitespace] Signed-off-by: Christian Borntraeger [alifm@linux.ibm.com: Resolved merge conflict] Signed-off-by: Farhan Ali Signed-off-by: Sasha Levin