[PATCH v2 00/10] s390: Consistent usage of text_mutex

[PATCH v2 00/10] s390: Consistent usage of text_mutex

[Heiko Carstens]

v2:
- Use text mutex for all callers of s390_kernel_write(), and add lockdep
  checking. [Based on a review comment from Ilya Leoshkevich, and also
  Sashiko feedback]

- Note: this takes now the mutex also at places where it is technically
  not necessary (e.g. ftrace init nop patching). However this is not much
  of a difference to before, where the spinlock in s390_kernel_write()
  was always taken instead

v1:
Other architectures serialize kernel text patching with text_mutex. s390
does not: __s390_kernel_write() relies on a private spinlock, and callers
partially depend on implicit exclusion (e.g. no kprobe can be set on a
jump label).

Make s390 consistent with other architectures:

- Patches 1-3 add text_mutex to the jump_label, ftrace and bpf text
  patching paths

- Patch 4 removes the redundant spinlock from __s390_kernel_write().
  CPU serialization, previously done implicitly, is now explicit via
  sync_core()

Thanks,
Heiko

Heiko Carstens (10):
  s390/jump_label: Serialize text patching with text_mutex
  s390/ftrace: Serialize text patching with text_mutex
  s390/bpf: Serialize text patching with text_mutex
  s390/runtime-const: Serialize text patching with text_mutex
  s390/module: Serialize text patching with text_mutex
  s390/stackprotector: Serialize text patching with text_mutex
  s390/nospec-branch: Serialize text patching with text_mutex
  s390/alternative: Serialize text patching with text_mutex
  s390/uaccess: Move s390_kernel_write() to asm/text-patching.h
  s390/maccess: Remove spinlock from __s390_kernel_write()

 arch/s390/include/asm/runtime-const.h |  4 +++-
 arch/s390/include/asm/text-patching.h | 14 ++++++++++++++
 arch/s390/include/asm/uaccess.h       |  9 ---------
 arch/s390/kernel/alternative.c        |  6 +++++-
 arch/s390/kernel/ftrace.c             | 11 +++++++++++
 arch/s390/kernel/jump_label.c         |  3 ++-
 arch/s390/kernel/kprobes.c            |  4 +++-
 arch/s390/kernel/module.c             |  2 ++
 arch/s390/kernel/nospec-branch.c      |  4 ++++
 arch/s390/kernel/stackprotector.c     |  6 +++++-
 arch/s390/mm/maccess.c                |  9 ++++-----
 arch/s390/net/bpf_jit_comp.c          | 21 +++++++++++++++++----
 12 files changed, 70 insertions(+), 23 deletions(-)

-- 
2.53.0

[PATCH v2 01/10] s390/jump_label: Serialize text patching with text_mutex

[Heiko Carstens]

Acquire text_mutex around the verify-then-patch sequence in
jump_label_transform(). This way s390 uses text_mutex like other
architectures and does not need to rely on other implicit semantics
(e.g. no kprobe can be set on a jump label).

This is part of larger series where at the end s390_kernel_write()
requires that callers hold text_mutex for serialization.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/kernel/jump_label.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/s390/kernel/jump_label.c b/arch/s390/kernel/jump_label.c
index e808bb8bc0da..548141eaa20b 100644
--- a/arch/s390/kernel/jump_label.c
+++ b/arch/s390/kernel/jump_label.c
@@ -5,6 +5,7 @@
  * Copyright IBM Corp. 2011
  * Author(s): Jan Glauber <jang@linux.vnet.ibm.com>
  */
+#include <linux/memory.h>
 #include <linux/uaccess.h>
 #include <linux/jump_label.h>
 #include <linux/module.h>
@@ -57,6 +58,7 @@ static void jump_label_transform(struct jump_entry *entry,
 		jump_label_make_branch(entry, &old);
 		jump_label_make_nop(entry, &new);
 	}
+	guard(mutex)(&text_mutex);
 	if (memcmp(code, &old, sizeof(old)))
 		jump_label_bug(entry, &old, &new);
 	s390_kernel_write(code, &new, sizeof(new));
-- 
2.53.0

Re: [PATCH v2 01/10] s390/jump_label: Serialize text patching with text_mutex

[Ilya Leoshkevich]

On 10/27/26 15:30, Heiko Carstens wrote:
> Acquire text_mutex around the verify-then-patch sequence in
> jump_label_transform(). This way s390 uses text_mutex like other
> architectures and does not need to rely on other implicit semantics
> (e.g. no kprobe can be set on a jump label).
> 
> This is part of larger series where at the end s390_kernel_write()
> requires that callers hold text_mutex for serialization.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>   arch/s390/kernel/jump_label.c | 2 ++
>   1 file changed, 2 insertions(+)

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

[PATCH v2 02/10] s390/ftrace: Serialize text patching with text_mutex

[Heiko Carstens]

Add ftrace_arch_code_modify_prepare() and extend
ftrace_arch_code_modify_post_process() to acquire and release
text_mutex when ftrace code is modified.

Also add locking to ftrace_init_nop(). This way s390 uses text_mutex
like e.g. x86 and riscv.

This is part of larger series where at the end s390_kernel_write()
requires that callers hold text_mutex for serialization.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/kernel/ftrace.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
index e94bb98f5231..2f0c4ef1b2d6 100644
--- a/arch/s390/kernel/ftrace.c
+++ b/arch/s390/kernel/ftrace.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/hardirq.h>
+#include <linux/memory.h>
 #include <linux/uaccess.h>
 #include <linux/ftrace.h>
 #include <linux/kernel.h>
@@ -90,6 +91,8 @@ int ftrace_init_nop(struct module *mod, struct dyn_ftrace *rec)
 	BUILD_BUG_ON(sizeof(struct ftrace_hotpatch_trampoline) !=
 		     SIZEOF_FTRACE_HOTPATCH_TRAMPOLINE);
 
+	guard(mutex)(&text_mutex);
+
 	next_trampoline = &next_vmlinux_trampoline;
 	trampolines_end = __ftrace_hotpatch_trampolines_end;
 	shared = ftrace_shared_hotpatch_trampoline(NULL);
@@ -247,13 +250,21 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
 	return 0;
 }
 
+void ftrace_arch_code_modify_prepare(void)
+	__acquires(&text_mutex)
+{
+	mutex_lock(&text_mutex);
+}
+
 void arch_ftrace_update_code(int command)
 {
 	ftrace_modify_all_code(command);
 }
 
 void ftrace_arch_code_modify_post_process(void)
+	__releases(&text_mutex)
 {
+	mutex_unlock(&text_mutex);
 	/*
 	 * Flush any pre-fetched instructions on all
 	 * CPUs to make the new code visible.
-- 
2.53.0

Re: [PATCH v2 02/10] s390/ftrace: Serialize text patching with text_mutex

[Ilya Leoshkevich]

On 10/27/26 15:30, Heiko Carstens wrote:
> Add ftrace_arch_code_modify_prepare() and extend
> ftrace_arch_code_modify_post_process() to acquire and release
> text_mutex when ftrace code is modified.
> 
> Also add locking to ftrace_init_nop(). This way s390 uses text_mutex
> like e.g. x86 and riscv.
> 
> This is part of larger series where at the end s390_kernel_write()
> requires that callers hold text_mutex for serialization.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>   arch/s390/kernel/ftrace.c | 11 +++++++++++
>   1 file changed, 11 insertions(+)

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

[PATCH v2 03/10] s390/bpf: Serialize text patching with text_mutex

[Heiko Carstens]

Acquire text_mutex in bpf_arch_text_poke(). This way s390 uses text_mutex
like most other architectures.

This is part of larger series where at the end s390_kernel_write()
requires that callers hold text_mutex for serialization.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/net/bpf_jit_comp.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 51db92c3329d..b8ff1ca2f598 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -22,6 +22,7 @@
 #include <linux/init.h>
 #include <linux/bpf.h>
 #include <linux/cfi.h>
+#include <linux/memory.h>
 #include <linux/mm.h>
 #include <linux/kernel.h>
 #include <asm/cacheflush.h>
@@ -2446,9 +2447,9 @@ bool bpf_jit_supports_far_kfunc_call(void)
 	return true;
 }
 
-int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t,
-		       enum bpf_text_poke_type new_t, void *old_addr,
-		       void *new_addr)
+static int __bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t,
+				enum bpf_text_poke_type new_t, void *old_addr,
+				void *new_addr)
 {
 	struct bpf_plt expected_plt, current_plt, new_plt, *plt;
 	struct {
@@ -2458,6 +2459,8 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t,
 	char *ret;
 	int err;
 
+	guard(mutex)(&text_mutex);
+
 	/* Verify the branch to be patched. */
 	err = copy_from_kernel_nofault(&insn, ip, sizeof(insn));
 	if (err < 0)
@@ -2491,10 +2494,20 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t,
 	/* Adjust the mask of the branch. */
 	insn.opc = 0xc004 | (new_addr ? 0xf0 : 0);
 	s390_kernel_write((char *)ip + 1, (char *)&insn.opc + 1, 1);
+	return 0;
+}
 
+int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type old_t,
+		       enum bpf_text_poke_type new_t, void *old_addr,
+		       void *new_addr)
+{
+	int err;
+
+	err = __bpf_arch_text_poke(ip, old_t, new_t, old_addr, new_addr);
+	if (err)
+		return err;
 	/* Make the new code visible to the other CPUs. */
 	text_poke_sync_lock();
-
 	return 0;
 }
 
-- 
2.53.0

Re: [PATCH v2 03/10] s390/bpf: Serialize text patching with text_mutex

[Ilya Leoshkevich]

On 10/27/26 15:30, Heiko Carstens wrote:
> Acquire text_mutex in bpf_arch_text_poke(). This way s390 uses text_mutex
> like most other architectures.
> 
> This is part of larger series where at the end s390_kernel_write()
> requires that callers hold text_mutex for serialization.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>   arch/s390/net/bpf_jit_comp.c | 21 +++++++++++++++++----
>   1 file changed, 17 insertions(+), 4 deletions(-)

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

[PATCH v2 04/10] s390/runtime-const: Serialize text patching with text_mutex

[Heiko Carstens]

Acquire text_mutex inside runtime_const_fixup() around the patching
loop.

Serialization is not required for runtime_const_fixup(), however this is
part of larger series where at the end s390_kernel_write() requires that
callers hold text_mutex.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/include/asm/runtime-const.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/s390/include/asm/runtime-const.h b/arch/s390/include/asm/runtime-const.h
index 7b71156031ec..0e2402717e8b 100644
--- a/arch/s390/include/asm/runtime-const.h
+++ b/arch/s390/include/asm/runtime-const.h
@@ -3,6 +3,7 @@
 #define _ASM_S390_RUNTIME_CONST_H
 
 #include <linux/uaccess.h>
+#include <linux/memory.h>
 
 #define runtime_const_ptr(sym)					\
 ({								\
@@ -88,6 +89,7 @@ static inline void __runtime_fixup_mask(void *where, unsigned long val)
 static inline void runtime_const_fixup(void (*fn)(void *, unsigned long),
 				       unsigned long val, s32 *start, s32 *end)
 {
+	guard(mutex)(&text_mutex);
 	while (start < end) {
 		fn(*start + (void *)start, val);
 		start++;
-- 
2.53.0

Re: [PATCH v2 04/10] s390/runtime-const: Serialize text patching with text_mutex

[Ilya Leoshkevich]

On 10/27/26 15:30, Heiko Carstens wrote:
> Acquire text_mutex inside runtime_const_fixup() around the patching
> loop.
> 
> Serialization is not required for runtime_const_fixup(), however this is
> part of larger series where at the end s390_kernel_write() requires that
> callers hold text_mutex.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>   arch/s390/include/asm/runtime-const.h | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/arch/s390/include/asm/runtime-const.h b/arch/s390/include/asm/runtime-const.h
> index 7b71156031ec..0e2402717e8b 100644
> --- a/arch/s390/include/asm/runtime-const.h
> +++ b/arch/s390/include/asm/runtime-const.h
> @@ -3,6 +3,7 @@
>   #define _ASM_S390_RUNTIME_CONST_H
>   
>   #include <linux/uaccess.h>
> +#include <linux/memory.h>
>   
>   #define runtime_const_ptr(sym)					\
>   ({								\
> @@ -88,6 +89,7 @@ static inline void __runtime_fixup_mask(void *where, unsigned long val)
>   static inline void runtime_const_fixup(void (*fn)(void *, unsigned long),
>   				       unsigned long val, s32 *start, s32 *end)
>   {
> +	guard(mutex)(&text_mutex);
>   	while (start < end) {
>   		fn(*start + (void *)start, val);
>   		start++;

Interesting, so clang is able to propagate context even through indirect
calls without explicit annotations?


Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

Re: [PATCH v2 04/10] s390/runtime-const: Serialize text patching with text_mutex

[Heiko Carstens]

On Wed, Oct 28, 2026 at 11:58:27AM +0100, Ilya Leoshkevich wrote:
> > @@ -88,6 +89,7 @@ static inline void __runtime_fixup_mask(void *where, unsigned long val)
> >   static inline void runtime_const_fixup(void (*fn)(void *, unsigned long),
> >   				       unsigned long val, s32 *start, s32 *end)
> >   {
> > +	guard(mutex)(&text_mutex);
> >   	while (start < end) {
> >   		fn(*start + (void *)start, val);
> >   		start++;
> 
> Interesting, so clang is able to propagate context even through indirect
> calls without explicit annotations?

There is no clang context analysis involved here - this is purely lockdep
based (with the last patch of this series, which adds lockdep_assert_held()
to s390_kernel_write()).

Re: [PATCH v2 04/10] s390/runtime-const: Serialize text patching with text_mutex

[Ilya Leoshkevich]

On 10/28/26 12:09, Heiko Carstens wrote:
> On Wed, Oct 28, 2026 at 11:58:27AM +0100, Ilya Leoshkevich wrote:
>>> @@ -88,6 +89,7 @@ static inline void __runtime_fixup_mask(void *where, unsigned long val)
>>>    static inline void runtime_const_fixup(void (*fn)(void *, unsigned long),
>>>    				       unsigned long val, s32 *start, s32 *end)
>>>    {
>>> +	guard(mutex)(&text_mutex);
>>>    	while (start < end) {
>>>    		fn(*start + (void *)start, val);
>>>    		start++;
>>
>> Interesting, so clang is able to propagate context even through indirect
>> calls without explicit annotations?
> 
> There is no clang context analysis involved here - this is purely lockdep
> based (with the last patch of this series, which adds lockdep_assert_held()
> to s390_kernel_write()).

Ah, I see, it's stated right in the first line of the cover letter.
Did you consider using it though?

Re: [PATCH v2 04/10] s390/runtime-const: Serialize text patching with text_mutex

[Heiko Carstens]

On Wed, Oct 28, 2026 at 01:22:30PM +0100, Ilya Leoshkevich wrote:
> On 10/28/26 12:09, Heiko Carstens wrote:
> > On Wed, Oct 28, 2026 at 11:58:27AM +0100, Ilya Leoshkevich wrote:
> > > > @@ -88,6 +89,7 @@ static inline void __runtime_fixup_mask(void *where, unsigned long val)
> > > >    static inline void runtime_const_fixup(void (*fn)(void *, unsigned long),
> > > >    				       unsigned long val, s32 *start, s32 *end)
> > > >    {
> > > > +	guard(mutex)(&text_mutex);
> > > >    	while (start < end) {
> > > >    		fn(*start + (void *)start, val);
> > > >    		start++;
> > > 
> > > Interesting, so clang is able to propagate context even through indirect
> > > calls without explicit annotations?
> > 
> > There is no clang context analysis involved here - this is purely lockdep
> > based (with the last patch of this series, which adds lockdep_assert_held()
> > to s390_kernel_write()).
> 
> Ah, I see, it's stated right in the first line of the cover letter.
> Did you consider using it though?

Yes I did, but if I add __must_hold(text_mutex) to the inlined
s390_kernel_write(), then clang cannot prove at all call sites that the lock
is actually held - so plenty of additional annotations would be required (if
possible at all), and then I decided to drop that approach and rely only on
lockdep.

[PATCH v2 05/10] s390/module: Serialize text patching with text_mutex

[Heiko Carstens]

Acquire text_mutex in apply_relocate_add() in order to serialize text
patching.

This is part of larger series where at the end s390_kernel_write()
requires that callers hold text_mutex for serialization.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/kernel/module.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 9d1f8a50f5a4..79bc80d7bd02 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -462,6 +462,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
 	if (!early)
 		write = s390_kernel_write;
 
+	guard(mutex)(&text_mutex);
 	return __apply_relocate_add(sechdrs, strtab, symindex, relsec, me,
 				    write);
 }
-- 
2.53.0

Re: [PATCH v2 05/10] s390/module: Serialize text patching with text_mutex

[Ilya Leoshkevich]

On 10/27/26 15:30, Heiko Carstens wrote:
> Acquire text_mutex in apply_relocate_add() in order to serialize text
> patching.
> 
> This is part of larger series where at the end s390_kernel_write()
> requires that callers hold text_mutex for serialization.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>   arch/s390/kernel/module.c | 1 +
>   1 file changed, 1 insertion(+)

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

[PATCH v2 06/10] s390/stackprotector: Serialize text patching with text_mutex

[Heiko Carstens]

Acquire text_mutex inside __stack_protector_apply() to serialize text
patching.

Serialization is not required for __stack_protector_apply(), however this
is part of larger series where at the end s390_kernel_write() requires
that callers hold text_mutex.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/kernel/stackprotector.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/s390/kernel/stackprotector.c b/arch/s390/kernel/stackprotector.c
index 8bd3ecf9200a..d72aef57a40a 100644
--- a/arch/s390/kernel/stackprotector.c
+++ b/arch/s390/kernel/stackprotector.c
@@ -6,6 +6,7 @@
 
 #include <linux/export.h>
 #include <linux/hex.h>
+#include <linux/memory.h>
 #include <linux/uaccess.h>
 #include <linux/printk.h>
 #include <asm/abs_lowcore.h>
@@ -120,6 +121,9 @@ int __stack_protector_apply(unsigned long *start, unsigned long *end, unsigned l
 	struct insn_ril *insn, new;
 	int rc;
 
+#ifndef __DECOMPRESSOR
+	guard(mutex)(&text_mutex);
+#endif
 	/*
 	 * Convert LARL/LGRL instructions to LLILF so register R1 contains the
 	 * address of the per-cpu / per-process stack canary:
-- 
2.53.0

Re: [PATCH v2 06/10] s390/stackprotector: Serialize text patching with text_mutex

[Ilya Leoshkevich]

On 10/27/26 15:30, Heiko Carstens wrote:
> Acquire text_mutex inside __stack_protector_apply() to serialize text
> patching.
> 
> Serialization is not required for __stack_protector_apply(), however this
> is part of larger series where at the end s390_kernel_write() requires
> that callers hold text_mutex.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>   arch/s390/kernel/stackprotector.c | 4 ++++
>   1 file changed, 4 insertions(+)
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

[PATCH v2 07/10] s390/nospec-branch: Serialize text patching with text_mutex

[Heiko Carstens]

Acquire text_mutex inside __nospec_revert() around the patching loop.

Serialization is not required for __nospec_revert(), however this is
part of larger series where at the end s390_kernel_write() requires
that callers hold text_mutex.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/kernel/nospec-branch.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/s390/kernel/nospec-branch.c b/arch/s390/kernel/nospec-branch.c
index e11ec15960a1..26cd5b278e8a 100644
--- a/arch/s390/kernel/nospec-branch.c
+++ b/arch/s390/kernel/nospec-branch.c
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0
+#include <linux/memory.h>
 #include <linux/module.h>
 #include <linux/device.h>
 #include <linux/cpu.h>
@@ -108,6 +109,7 @@ static void __init_or_module __nospec_revert(s32 *start, s32 *end)
 
 	/* Second part of the instruction replace is always a nop */
 	memcpy(insnbuf + 2, branch, sizeof(branch));
+	guard(mutex)(&text_mutex);
 	for (epo = start; epo < end; epo++) {
 		instr = (u8 *) epo + *epo;
 		if (instr[0] == 0xc0 && (instr[1] & 0x0f) == 0x04)
-- 
2.53.0

Re: [PATCH v2 07/10] s390/nospec-branch: Serialize text patching with text_mutex

[Ilya Leoshkevich]

On 10/27/26 15:30, Heiko Carstens wrote:
> Acquire text_mutex inside __nospec_revert() around the patching loop.
> 
> Serialization is not required for __nospec_revert(), however this is
> part of larger series where at the end s390_kernel_write() requires
> that callers hold text_mutex.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>   arch/s390/kernel/nospec-branch.c | 2 ++
>   1 file changed, 2 insertions(+)

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

[PATCH v2 08/10] s390/alternative: Serialize text patching with text_mutex

[Heiko Carstens]

Acquire text_mutex inside __apply_alternatives() around the patching
loop.

Serialization is not required for __apply_alternatives(), however this is
part of larger series where at the end s390_kernel_write() requires that
callers hold text_mutex.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/kernel/alternative.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/s390/kernel/alternative.c b/arch/s390/kernel/alternative.c
index 02d04ae621ba..6013a75f5241 100644
--- a/arch/s390/kernel/alternative.c
+++ b/arch/s390/kernel/alternative.c
@@ -5,6 +5,7 @@
 #endif
 
 #include <linux/hex.h>
+#include <linux/memory.h>
 #include <linux/uaccess.h>
 #include <linux/printk.h>
 #include <asm/nospec-branch.h>
@@ -55,6 +56,9 @@ void __apply_alternatives(struct alt_instr *start, struct alt_instr *end, unsign
 	bool debug, replace;
 	u8 *old, *new;
 
+#ifndef __DECOMPRESSOR
+	guard(mutex)(&text_mutex);
+#endif
 	/*
 	 * The scan order should be from start to end. A later scanned
 	 * alternative code can overwrite previously scanned alternative code.
-- 
2.53.0

Re: [PATCH v2 08/10] s390/alternative: Serialize text patching with text_mutex

[Ilya Leoshkevich]

On 10/27/26 15:30, Heiko Carstens wrote:
> Acquire text_mutex inside __apply_alternatives() around the patching
> loop.
> 
> Serialization is not required for __apply_alternatives(), however this is
> part of larger series where at the end s390_kernel_write() requires that
> callers hold text_mutex.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>   arch/s390/kernel/alternative.c | 4 ++++
>   1 file changed, 4 insertions(+)
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

[PATCH v2 09/10] s390/uaccess: Move s390_kernel_write() to asm/text-patching.h

[Heiko Carstens]

s390_kernel_write() is a text-patching primitive, not a user access
function. Move its declaration and the inline wrapper from uaccess.h
to text-patching.h.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/include/asm/runtime-const.h |  2 +-
 arch/s390/include/asm/text-patching.h | 11 +++++++++++
 arch/s390/include/asm/uaccess.h       |  9 ---------
 arch/s390/kernel/alternative.c        |  2 +-
 arch/s390/kernel/jump_label.c         |  1 -
 arch/s390/kernel/module.c             |  1 +
 arch/s390/kernel/nospec-branch.c      |  2 ++
 arch/s390/kernel/stackprotector.c     |  2 +-
 arch/s390/mm/maccess.c                |  1 +
 9 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/arch/s390/include/asm/runtime-const.h b/arch/s390/include/asm/runtime-const.h
index 0e2402717e8b..4d73a198f63f 100644
--- a/arch/s390/include/asm/runtime-const.h
+++ b/arch/s390/include/asm/runtime-const.h
@@ -2,7 +2,7 @@
 #ifndef _ASM_S390_RUNTIME_CONST_H
 #define _ASM_S390_RUNTIME_CONST_H
 
-#include <linux/uaccess.h>
+#include <linux/text-patching.h>
 #include <linux/memory.h>
 
 #define runtime_const_ptr(sym)					\
diff --git a/arch/s390/include/asm/text-patching.h b/arch/s390/include/asm/text-patching.h
index b219056a8817..c2f87f20ff97 100644
--- a/arch/s390/include/asm/text-patching.h
+++ b/arch/s390/include/asm/text-patching.h
@@ -3,6 +3,8 @@
 #ifndef _ASM_S390_TEXT_PATCHING_H
 #define _ASM_S390_TEXT_PATCHING_H
 
+#include <linux/string.h>
+#include <linux/memory.h>
 #include <asm/barrier.h>
 
 static __always_inline void sync_core(void)
@@ -13,4 +15,13 @@ static __always_inline void sync_core(void)
 void text_poke_sync(void);
 void text_poke_sync_lock(void);
 
+void *__s390_kernel_write(void *dst, const void *src, size_t size);
+
+static inline void *s390_kernel_write(void *dst, const void *src, size_t size)
+{
+	if (__is_defined(__DECOMPRESSOR))
+		return memcpy(dst, src, size);
+	return __s390_kernel_write(dst, src, size);
+}
+
 #endif /* _ASM_S390_TEXT_PATCHING_H */
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
index ac99b32c6ceb..db6acea9e7b8 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -384,15 +384,6 @@ static __always_inline unsigned long __must_check clear_user(void __user *to, un
 	return __clear_user(to, n);
 }
 
-void *__s390_kernel_write(void *dst, const void *src, size_t size);
-
-static inline void *s390_kernel_write(void *dst, const void *src, size_t size)
-{
-	if (__is_defined(__DECOMPRESSOR))
-		return memcpy(dst, src, size);
-	return __s390_kernel_write(dst, src, size);
-}
-
 void __noreturn __mvc_kernel_nofault_bad(void);
 
 #if defined(CONFIG_CC_HAS_ASM_GOTO_OUTPUT) && defined(CONFIG_CC_HAS_ASM_AOR_FORMAT_FLAGS)
diff --git a/arch/s390/kernel/alternative.c b/arch/s390/kernel/alternative.c
index 6013a75f5241..8efd2165692b 100644
--- a/arch/s390/kernel/alternative.c
+++ b/arch/s390/kernel/alternative.c
@@ -4,9 +4,9 @@
 #define pr_fmt(fmt)	"alt: " fmt
 #endif
 
+#include <linux/text-patching.h>
 #include <linux/hex.h>
 #include <linux/memory.h>
-#include <linux/uaccess.h>
 #include <linux/printk.h>
 #include <asm/nospec-branch.h>
 #include <asm/abs_lowcore.h>
diff --git a/arch/s390/kernel/jump_label.c b/arch/s390/kernel/jump_label.c
index 548141eaa20b..5c3083c917bb 100644
--- a/arch/s390/kernel/jump_label.c
+++ b/arch/s390/kernel/jump_label.c
@@ -6,7 +6,6 @@
  * Author(s): Jan Glauber <jang@linux.vnet.ibm.com>
  */
 #include <linux/memory.h>
-#include <linux/uaccess.h>
 #include <linux/jump_label.h>
 #include <linux/module.h>
 #include <asm/text-patching.h>
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 79bc80d7bd02..4e03f40d2b2e 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -10,6 +10,7 @@
  *  based on i386 version
  *    Copyright (C) 2001 Rusty Russell.
  */
+#include <linux/text-patching.h>
 #include <linux/module.h>
 #include <linux/elf.h>
 #include <linux/vmalloc.h>
diff --git a/arch/s390/kernel/nospec-branch.c b/arch/s390/kernel/nospec-branch.c
index 26cd5b278e8a..1d9d05e1def4 100644
--- a/arch/s390/kernel/nospec-branch.c
+++ b/arch/s390/kernel/nospec-branch.c
@@ -1,4 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
+
+#include <linux/text-patching.h>
 #include <linux/memory.h>
 #include <linux/module.h>
 #include <linux/device.h>
diff --git a/arch/s390/kernel/stackprotector.c b/arch/s390/kernel/stackprotector.c
index d72aef57a40a..5da113c2c7f6 100644
--- a/arch/s390/kernel/stackprotector.c
+++ b/arch/s390/kernel/stackprotector.c
@@ -4,10 +4,10 @@
 #define pr_fmt(fmt)	"stackprot: " fmt
 #endif
 
+#include <linux/text-patching.h>
 #include <linux/export.h>
 #include <linux/hex.h>
 #include <linux/memory.h>
-#include <linux/uaccess.h>
 #include <linux/printk.h>
 #include <asm/abs_lowcore.h>
 #include <asm/sections.h>
diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c
index f39968dd8063..6b25203fb05c 100644
--- a/arch/s390/mm/maccess.c
+++ b/arch/s390/mm/maccess.c
@@ -6,6 +6,7 @@
  *
  */
 
+#include <linux/text-patching.h>
 #include <linux/uaccess.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
-- 
2.53.0

Re: [PATCH v2 09/10] s390/uaccess: Move s390_kernel_write() to asm/text-patching.h

[Ilya Leoshkevich]

On 10/27/26 15:30, Heiko Carstens wrote:
> s390_kernel_write() is a text-patching primitive, not a user access
> function. Move its declaration and the inline wrapper from uaccess.h
> to text-patching.h.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>   arch/s390/include/asm/runtime-const.h |  2 +-
>   arch/s390/include/asm/text-patching.h | 11 +++++++++++
>   arch/s390/include/asm/uaccess.h       |  9 ---------
>   arch/s390/kernel/alternative.c        |  2 +-
>   arch/s390/kernel/jump_label.c         |  1 -
>   arch/s390/kernel/module.c             |  1 +
>   arch/s390/kernel/nospec-branch.c      |  2 ++
>   arch/s390/kernel/stackprotector.c     |  2 +-
>   arch/s390/mm/maccess.c                |  1 +
>   9 files changed, 18 insertions(+), 13 deletions(-)

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

[PATCH v2 10/10] s390/maccess: Remove spinlock from __s390_kernel_write()

[Heiko Carstens]

The spinlock in __s390_kernel_write() was introduced to serialize the
read-modify-write sequence against concurrent callers. Now that all
runtime callers of s390_kernel_write() hold the text_mutex, the
spinlock is not required anymore.

Replace it with preempt_disable() / preempt_enable() and sync_core().
Previously, CPU serialization was implicitly done by other
instructions. Make this explicit with sync_core() instead of
relying on that.

Preemption is disabled so that sync_core() issues the CPU serialization
instruction on the same CPU that executed the stores. This completes all
previous stores and makes them visible to other CPUs.

Other CPUs need to perform CPU serialization, e.g. with text_poke_sync(),
to discard already prefetched instructions.

To verify that text_mutex is held instead of the spinlock, add a
lockdep_assert_held() call to s390_kernel_write(). To make that work
a change to the kprobes code is required:

swap_instruction(), which calls s390_kernel_write(), may be called in
stop_machine() context.
For that case the task which calls s390_kernel_write() is not the task
which called stop_machine() - lockdep_assert_held() will report that
text_mutex is not held by the current task, even though text_mutex is
held by the stop_machine() caller. Exclusive text write access is
guaranteed.
Work around that by calling the non-checking __s390_kernel_write(),
and add lockdep_assert_held() checks to arch_arm_kprobe() and
arch_disarm_kprobe().

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/include/asm/text-patching.h | 7 +++++--
 arch/s390/kernel/kprobes.c            | 4 +++-
 arch/s390/mm/maccess.c                | 8 +++-----
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/arch/s390/include/asm/text-patching.h b/arch/s390/include/asm/text-patching.h
index c2f87f20ff97..a382a3e7c2f8 100644
--- a/arch/s390/include/asm/text-patching.h
+++ b/arch/s390/include/asm/text-patching.h
@@ -19,9 +19,12 @@ void *__s390_kernel_write(void *dst, const void *src, size_t size);
 
 static inline void *s390_kernel_write(void *dst, const void *src, size_t size)
 {
-	if (__is_defined(__DECOMPRESSOR))
-		return memcpy(dst, src, size);
+#ifdef __DECOMPRESSOR
+	return memcpy(dst, src, size);
+#else
+	lockdep_assert_held(&text_mutex);
 	return __s390_kernel_write(dst, src, size);
+#endif
 }
 
 #endif /* _ASM_S390_TEXT_PATCHING_H */
diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index e806b124e4ba..ca7fb8b91c5a 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -148,7 +148,7 @@ static int swap_instruction(void *data)
 	u16 opc;
 
 	opc = args->arm_kprobe ? BREAKPOINT_INSTRUCTION : p->opcode;
-	s390_kernel_write(p->addr, &opc, sizeof(opc));
+	__s390_kernel_write(p->addr, &opc, sizeof(opc));
 	return 0;
 }
 NOKPROBE_SYMBOL(swap_instruction);
@@ -157,6 +157,7 @@ void arch_arm_kprobe(struct kprobe *p)
 {
 	struct swap_insn_args args = {.p = p, .arm_kprobe = 1};
 
+	lockdep_assert_held(&text_mutex);
 	if (cpu_has_seq_insn()) {
 		swap_instruction(&args);
 		text_poke_sync();
@@ -170,6 +171,7 @@ void arch_disarm_kprobe(struct kprobe *p)
 {
 	struct swap_insn_args args = {.p = p, .arm_kprobe = 0};
 
+	lockdep_assert_held(&text_mutex);
 	if (cpu_has_seq_insn()) {
 		swap_instruction(&args);
 		text_poke_sync();
diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c
index 6b25203fb05c..cda3f81dfbc2 100644
--- a/arch/s390/mm/maccess.c
+++ b/arch/s390/mm/maccess.c
@@ -61,22 +61,20 @@ static notrace long s390_kernel_write_odd(void *dst, const void *src, size_t siz
  * bytes from destination at an eight byte boundary, modifies the bytes
  * requested and writes the result back in a loop.
  */
-static DEFINE_SPINLOCK(s390_kernel_write_lock);
-
 notrace void *__s390_kernel_write(void *dst, const void *src, size_t size)
 {
 	void *tmp = dst;
-	unsigned long flags;
 	long copied;
 
-	spin_lock_irqsave(&s390_kernel_write_lock, flags);
+	preempt_disable();
 	while (size) {
 		copied = s390_kernel_write_odd(tmp, src, size);
 		tmp += copied;
 		src += copied;
 		size -= copied;
 	}
-	spin_unlock_irqrestore(&s390_kernel_write_lock, flags);
+	sync_core();
+	preempt_enable();
 
 	return dst;
 }
-- 
2.53.0

Re: [PATCH v2 10/10] s390/maccess: Remove spinlock from __s390_kernel_write()

[Ilya Leoshkevich]

On 10/27/26 15:30, Heiko Carstens wrote:
> The spinlock in __s390_kernel_write() was introduced to serialize the
> read-modify-write sequence against concurrent callers. Now that all
> runtime callers of s390_kernel_write() hold the text_mutex, the
> spinlock is not required anymore.
> 
> Replace it with preempt_disable() / preempt_enable() and sync_core().
> Previously, CPU serialization was implicitly done by other
> instructions. Make this explicit with sync_core() instead of
> relying on that.
> 
> Preemption is disabled so that sync_core() issues the CPU serialization
> instruction on the same CPU that executed the stores. This completes all
> previous stores and makes them visible to other CPUs.

Doesn't preemption happen only via interrupts, which always serialize?
> Other CPUs need to perform CPU serialization, e.g. with text_poke_sync(),
> to discard already prefetched instructions.
> 
> To verify that text_mutex is held instead of the spinlock, add a
> lockdep_assert_held() call to s390_kernel_write(). To make that work
> a change to the kprobes code is required:
> 
> swap_instruction(), which calls s390_kernel_write(), may be called in
> stop_machine() context.
> For that case the task which calls s390_kernel_write() is not the task
> which called stop_machine() - lockdep_assert_held() will report that
> text_mutex is not held by the current task, even though text_mutex is
> held by the stop_machine() caller. Exclusive text write access is
> guaranteed.
> Work around that by calling the non-checking __s390_kernel_write(),
> and add lockdep_assert_held() checks to arch_arm_kprobe() and
> arch_disarm_kprobe().
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>   arch/s390/include/asm/text-patching.h | 7 +++++--
>   arch/s390/kernel/kprobes.c            | 4 +++-
>   arch/s390/mm/maccess.c                | 8 +++-----
>   3 files changed, 11 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/s390/include/asm/text-patching.h b/arch/s390/include/asm/text-patching.h
> index c2f87f20ff97..a382a3e7c2f8 100644
> --- a/arch/s390/include/asm/text-patching.h
> +++ b/arch/s390/include/asm/text-patching.h
> @@ -19,9 +19,12 @@ void *__s390_kernel_write(void *dst, const void *src, size_t size);
>   
>   static inline void *s390_kernel_write(void *dst, const void *src, size_t size)
>   {
> -	if (__is_defined(__DECOMPRESSOR))
> -		return memcpy(dst, src, size);
> +#ifdef __DECOMPRESSOR
> +	return memcpy(dst, src, size);
> +#else
> +	lockdep_assert_held(&text_mutex);
>   	return __s390_kernel_write(dst, src, size);
> +#endif
>   }

I assume #ifdef is required because lockdep_assert_held() is not
available in decompressor and there are no stubs?


Anyhow:

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>

[...]