wireguard-linux/arch/s390/net, branch stable

Merge tag 's390-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

2026-08-23T17:26:44Z

Pull s390 updates from Vasily Gorbik: - Add a cpuidle driver with polling and enabled wait states using the existing CPU idle infrastructure and idle governor to improve latency for frequent sleep/wakeup cycles. Remove the obsolete tick delay heuristic and generic arch_needs_cpu() hook. Add the corresponding driver entry to MAINTAINERS - Add kCFI support using the generic support provided by Clang - Enable Clang CONTEXT_ANALYSIS for various architecture code and for char, PCI, CIO and virtio drivers. Add required lock annotations, exclude unsupported mm helpers and remove conditional PCI locking - Fix secure storage access exception handling and reintroduce DCACHE_WORD_ACCESS previously removed as a workaround - Fix cpum_cf perf crashes when CPUs are brought online while per-task events are active. Allocate and remove per-CPU counter data from CPU hotplug callbacks - Fix a deadlock when an s390dbf debug area is unregistered while one of its debugfs files is being written to - Fix MVIY_PERCPU() with binutils older than 2.39, where an assembler macro silently omitted an instruction needed to repair interrupted operations after CPU migration - Remove/replace cond_resched() calls which are no-ops with the supported s390 preemption models - Fix AP queue depth and maximum message length decoding according to the architecture. Current hardware is not affected, but future hardware could report values which were handled incorrectly - Reflect the configured CPU state in cpu_enabled_mask so deconfigured CPUs are not presented as available for onlining - Restore the vDSO GNU_EH_FRAME program header which was lost when the build switched to direct linker invocation, and mark it read-only - Add SCLP action qualifiers used by Spyre for card initialization, recoverable error and telemetry reporting - Move KMSAN interrupt flag helpers out of line to fix -Wstatic-in-inline build warnings - Use level-specific page table entry accessors for hugetlb entries and ptep_get() when accessing crashed kernel memory in kdump - Make forced AP bus rescans killable so that a user process blocked behind an ongoing scan can still be terminated with SIGKILL - Rework pkey ioctl error paths to remove duplicated cleanup code and avoid freeing error pointers - Allow the protected guest SWIOTLB buffer to be allocated outside the first 2GB. Also enable dynamic SWIOTLB growth and the coherent atomic pool fallback to improve I/O behavior when the initial pool is exhausted - Add program check statistics and spinlock contention tracepoints. Increase the lockdep chain capacity to keep lockdep enabled for complex code paths such as btrfs - Simplify IPL, trap and syscall code and remove the obsolete unistd_32.h generation entry * tag 's390-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (59 commits) s390/percpu: Fix MVIY_PERCPU() with older binutils s390/debug: Fix deadlock during unregister s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks s390: Enable CONTEXT_ANALYSIS for various directories s390/mm: Add __context_unsafe() attribute to gmap helper functions s390/mm: Add __context_unsafe() attribute to do_secure_storage_access() s390/sysinfo: Add context analysis attributes s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN s390/virtio: Enable CONTEXT_ANALYSIS s390/cio: Enable CONTEXT_ANALYSIS s390/vfio_ccw: Add __must_hold() attribute to vfio_ccw_sch_quiesce() s390/pci: Enable CONTEXT_ANALYSIS s390/pci: Rework __zpci_event_availability() to remove conditional locking s390/pci: Rework __zpci_event_error() to remove conditional locking s390/char: Enable CONTEXT_ANALYSIS s390/con3215: Add __must_hold() attribute to raw3215_make_room() s390/ap: Fix MAPML computation s390/cio: Remove cond_resched() calls s390: Remove cond_resched() calls KVM: s390: Remove cond_resched() calls ...

bpf, s390: Clear fetch destination on faulting arena atomic

2026-08-12T17:33:53Z

Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPF_PROBE_ATOMIC and gets an exception table entry, but bpf_jit_probe_atomic_pre() only fills in the arena base and the probe offset, leaving probe->reg at the -1 that bpf_jit_probe_init() set, which bpf_jit_probe_post() writes into the entry and ex_handler_bpf() then reads back as "there is nothing to clear". That is right for a plain BPF_{ADD,AND,OR,XOR}, which only writes memory, but an RMW carrying BPF_FETCH also reads the old value into a register: src_reg for BPF_{ADD,AND,OR,XOR} | BPF_FETCH and BPF_XCHG, and r0 for BPF_CMPXCHG. So on a fault over an unmapped arena page the program resumes at the landing pad with whatever that register held before the atomic instead of the 0 that every other BPF_PROBE_* access delivers. Fill probe->reg in from bpf_atomic_load_reg(). Unlike x86-64 and arm64, s390x does not report arena violations from its exception handler, so there is no access direction to correct here, only the missing register clear. Fixes: 2f9469484a3b ("s390/bpf: Support arena atomics") Signed-off-by: Daniel Borkmann Reviewed-by: Ilya Leoshkevich Link: https://patch.msgid.link/20260811131600.506721-5-daniel@iogearbox.net Signed-off-by: Eduard Zingerman

s390: Enable CONTEXT_ANALYSIS for various directories

2026-08-11T14:42:18Z

Enable CONTEXT_ANALYSIS for various directories which do not generate any warnings (anymore). Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik

s390/bpf: Add kCFI support

2026-08-05T13:16:54Z

This is the s390 variant of commit 710618c760c0 ("arm64/cfi,bpf: Support kCFI + BPF on arm64"). Signed-off-by: Heiko Carstens Reviewed-by: Ilya Leoshkevich Tested-by: Nathan Chancellor Signed-off-by: Vasily Gorbik

s390/bpf: Support load-acquire and store-release instructions

2026-07-24T21:03:07Z

Support load-acquire (BPF_LOAD_ACQ) and store-release (BPF_STORE_REL) instructions. Since s390 has strong memory model, implement them as regular BPF_LDX/BPF_STX instructions. Tested with: ./test_progs -t verifier_load_acquire,verifier_store_release,atomics Signed-off-by: Maxim Khmelevskii Reviewed-by: Ilya Leoshkevich Link: https://lore.kernel.org/bpf/20260723140648.583055-7-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi

s390/bpf: Add emit_ldx and emit_stx functions

2026-07-24T21:03:06Z

Add new functions for load and store to reuse them in the load-acquire and store-release logic. Signed-off-by: Maxim Khmelevskii Reviewed-by: Ilya Leoshkevich Link: https://lore.kernel.org/bpf/20260723140648.583055-6-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi

s390/bpf: Replace ly instruction with llgf

2026-07-07T16:09:42Z

cpu_nr is a 32 bit value and BPF_REG_0 is a 64 bit register, when ly loads the cpu_nr into BPF_REG_0 it does not zero the upper bits, but llgf does. Fixes: 9012cf2491e3 ("s390/bpf: Inline smp_processor_id and current_task") Signed-off-by: Maxim Khmelevskii Signed-off-by: Daniel Borkmann Reviewed-by: Ilya Leoshkevich Link: https://sashiko.dev/#/patchset/20260414142930.528751-1-max%40linux.ibm.com Link: https://lore.kernel.org/bpf/20260703125648.919196-5-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi

bpf: Add struct bpf_tramp_node object

2026-06-07T17:03:01Z

Adding struct bpf_tramp_node to decouple the link out of the trampoline attachment info. At the moment the object for attaching bpf program to the trampoline is 'struct bpf_tramp_link': struct bpf_tramp_link { struct bpf_link link; struct hlist_node tramp_hlist; u64 cookie; } The link holds the bpf_prog pointer and forces one link - one program binding logic. In following changes we want to attach program to multiple trampolines but we want to keep just one bpf_link object. Splitting struct bpf_tramp_link into: struct bpf_tramp_link { struct bpf_link link; struct bpf_tramp_node node; }; struct bpf_tramp_node { struct bpf_link *link; struct hlist_node tramp_hlist; u64 cookie; }; The 'struct bpf_tramp_link' defines standard single trampoline link and 'struct bpf_tramp_node' is the attachment trampoline object with pointer to the bpf_link object. This will allow us to define link for multiple trampolines, like: struct bpf_tracing_multi_link { struct bpf_link link; ... int nodes_cnt; struct bpf_tracing_multi_node nodes[] __counted_by(nodes_cnt); }; Cc: Hengqi Chen Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20260606123955.345967-9-jolsa@kernel.org Signed-off-by: Alexei Starovoitov

s390/bpf: Inline smp_processor_id and current_task

2026-04-21T22:53:45Z

Inline these calls in bpf jit: - bpf_get_smp_processor_id() - bpf_get_current_task() - bpf_get_current_task_btf() s390 has a 8 KiB per-CPU prefix area in the CPU's virtual address space, called the lowcore. It is a struct that contains the cpu number and a pointer to the current task. These are exactly the values returned by the BPF helpers. Emit a load from the lowcore instead of a helper function call. JIT output for `bpf_get_smp_processor_id`: Before: After: --------------- ---------------- brasl %r14,0x3ffe0385460 ly %r14,928 lgr %r14,%r2 JIT output for `bpf_get_current_task`: Before: After: --------------- ---------------- brasl %r14,0x3ffe0362a90 lg %r14,832 lgr %r14,%r2 Benchmark using [1] on KVM(virtme-ng). ./benchs/run_bench_trigger.sh glob-arr-inc arr-inc hash-inc +---------------+--------------------+--------------------+--------------+ | Name | Before | After | % change | |---------------+--------------------+--------------------+--------------| | glob-arr-inc | 244.954 ± 0.654M/s | 278.501 ± 0.834M/s | + 13.70% | | arr-inc | 311.597 ± 1.016M/s | 313.610 ± 0.331M/s | + 0.65% | | hash-inc | 47.421 ± 0.017M/s | 47.600 ± 0.004M/s | + 0.38% | +---------------+--------------------+--------------------+--------------+ [1] https://github.com/anakryiko/linux/commit/8dec900975ef Signed-off-by: Maxim Khmelevskii Reviewed-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20260414142930.528751-1-max@linux.ibm.com Signed-off-by: Alexei Starovoitov

bpf: Pass bpf_verifier_env to JIT

2026-04-16T14:03:40Z

Pass bpf_verifier_env to bpf_int_jit_compile(). The follow-up patch will use env->insn_aux_data in the JIT stage to detect indirect jump targets. Since bpf_prog_select_runtime() can be called by cbpf and lib/test_bpf.c code without verifier, introduce helper __bpf_prog_select_runtime() to accept the env parameter. Remove the call to bpf_prog_select_runtime() in bpf_prog_load(), and switch to call __bpf_prog_select_runtime() in the verifier, with env variable passed. The original bpf_prog_select_runtime() is preserved for cbpf and lib/test_bpf.c, where env is NULL. Now all constants blinding calls are moved into the verifier, except the cbpf and lib/test_bpf.c cases. The instructions arrays are adjusted by bpf_patch_insn_data() function for normal cases, so there is no need to call adjust_insn_arrays() in bpf_jit_blind_constants(). Remove it. Reviewed-by: Anton Protopopov # v8 Reviewed-by: Emil Tsalapatis # v12 Acked-by: Hengqi Chen # v14 Signed-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20260416064341.151802-3-xukuohai@huaweicloud.com Signed-off-by: Alexei Starovoitov