[PATCH] s390/sclp: Allow SCLP Action Qualifiers for Spyre card status reporting

[PATCH] s390/sclp: Allow SCLP Action Qualifiers for Spyre card status reporting

[Niklas Schnelle]

Add SCLP Action Qualifiers used by the Spyre stack for reporting of the
card's initialization status, recoverable errors, and telemetry data.

Co-developed-by: Andreas Krebbel <krebbel@linux.ibm.com>
Signed-off-by: Andreas Krebbel <krebbel@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
---
 arch/s390/include/asm/sclp.h | 3 +++
 drivers/s390/char/sclp_pci.c | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/arch/s390/include/asm/sclp.h b/arch/s390/include/asm/sclp.h
index f2d490558054..44066550b9b1 100644
--- a/arch/s390/include/asm/sclp.h
+++ b/arch/s390/include/asm/sclp.h
@@ -21,6 +21,9 @@
 #define SCLP_ERRNOTIFY_AQ_INFO_LOG		2
 #define SCLP_ERRNOTIFY_AQ_OPTICS_DATA		3
 #define SCLP_ERRNOTIFY_AQ_NVME_SMART_LOG	4
+#define SCLP_ERRNOTIFY_AQ_ADAPTER_INITIALIZED	5
+#define SCLP_ERRNOTIFY_AQ_RECOVERABLE_ERROR	6
+#define SCLP_ERRNOTIFY_AQ_TELEMETRY_DATA	7
 
 #ifndef __ASSEMBLER__
 #include <linux/uio.h>
diff --git a/drivers/s390/char/sclp_pci.c b/drivers/s390/char/sclp_pci.c
index d61a7fc0dd61..b79ef7006e46 100644
--- a/drivers/s390/char/sclp_pci.c
+++ b/drivers/s390/char/sclp_pci.c
@@ -99,6 +99,9 @@ static int sclp_pci_check_report(struct zpci_report_error_header *report)
 	case SCLP_ERRNOTIFY_AQ_INFO_LOG:
 	case SCLP_ERRNOTIFY_AQ_OPTICS_DATA:
 	case SCLP_ERRNOTIFY_AQ_NVME_SMART_LOG:
+	case SCLP_ERRNOTIFY_AQ_ADAPTER_INITIALIZED:
+	case SCLP_ERRNOTIFY_AQ_RECOVERABLE_ERROR:
+	case SCLP_ERRNOTIFY_AQ_TELEMETRY_DATA:
 		break;
 	default:
 		return -EINVAL;

---
base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f
change-id: 20260722-sclp_allow_aqs_spyre-338886694a76

Best regards,
-- 
Niklas Schnelle

Re: [PATCH] s390/sclp: Allow SCLP Action Qualifiers for Spyre card status reporting

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] The sysfs `report_error` binary attribute does not verify that the user-provided write buffer size (`count`) is large enough to cover the embedded payload length (`report->length`). This leads to reading uninitialized kernel heap memory which is then sent to the SCLP hardware.
--

--- Patch [1]: [PATCH] s390/sclp: Allow SCLP Action Qualifiers for Spyre card status reporting ---
commit 320785563461e373b0db5b021ac2e04f40ee8406
Author: Niklas Schnelle <schnelle@linux.ibm.com>

s390/sclp: Allow SCLP Action Qualifiers for Spyre card status reporting

Add SCLP Action Qualifiers used by the Spyre stack for reporting of the
card's initialization status, recoverable errors, and telemetry data.

> diff --git a/drivers/s390/char/sclp_pci.c b/drivers/s390/char/sclp_pci.c
> index d61a7fc0dd610..b79ef7006e46f 100644
> --- a/drivers/s390/char/sclp_pci.c
> +++ b/drivers/s390/char/sclp_pci.c
> @@ -99,6 +99,9 @@ static int sclp_pci_check_report(struct zpci_report_error_header *report)
>  	case SCLP_ERRNOTIFY_AQ_INFO_LOG:
>  	case SCLP_ERRNOTIFY_AQ_OPTICS_DATA:
>  	case SCLP_ERRNOTIFY_AQ_NVME_SMART_LOG:
> +	case SCLP_ERRNOTIFY_AQ_ADAPTER_INITIALIZED:
> +	case SCLP_ERRNOTIFY_AQ_RECOVERABLE_ERROR:
> +	case SCLP_ERRNOTIFY_AQ_TELEMETRY_DATA:

[Severity: Medium]
This is a pre-existing issue and was not introduced by the patch under review,
but could this code leak uninitialized kernel heap memory to the SCLP
hardware?

Looking at how report_error_write() handles the sysfs write, it verifies the
buffer is at least as large as the header struct:

arch/s390/pci/pci_sysfs.c:report_error_write() {
	if (off || (count < sizeof(*report)))
		return -EINVAL;
}

However, it does not check if the user-provided count is large enough to cover
the embedded payload length (report->length).

Later, when sclp_pci_report() processes this report, it copies report->length
bytes:

drivers/s390/char/sclp_pci.c:sclp_pci_report() {
	memcpy(sccb->evbuf.data, report->data, report->length);
}

If a user writes a small payload length but specifies a large report->length
in the embedded header, will memcpy() read past the end of the sysfs buffer
and send uninitialized heap data?

>  		break;
>  	default:
>  		return -EINVAL;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724-sclp_allow_aqs_spyre-v1-1-569acfe11385@linux.ibm.com?part=1

Re: [PATCH] s390/sclp: Allow SCLP Action Qualifiers for Spyre card status reporting

[Benjamin Block]

On Fri, Jul 24, 2026 at 02:23:01PM +0200, Niklas Schnelle wrote:
> Add SCLP Action Qualifiers used by the Spyre stack for reporting of the
> card's initialization status, recoverable errors, and telemetry data.
> 
> Co-developed-by: Andreas Krebbel <krebbel@linux.ibm.com>
> Signed-off-by: Andreas Krebbel <krebbel@linux.ibm.com>
> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
> ---
>  arch/s390/include/asm/sclp.h | 3 +++
>  drivers/s390/char/sclp_pci.c | 3 +++
>  2 files changed, 6 insertions(+)
> 
> diff --git a/arch/s390/include/asm/sclp.h b/arch/s390/include/asm/sclp.h
> index f2d490558054..44066550b9b1 100644
> --- a/arch/s390/include/asm/sclp.h
> +++ b/arch/s390/include/asm/sclp.h
> @@ -21,6 +21,9 @@
>  #define SCLP_ERRNOTIFY_AQ_INFO_LOG		2
>  #define SCLP_ERRNOTIFY_AQ_OPTICS_DATA		3
>  #define SCLP_ERRNOTIFY_AQ_NVME_SMART_LOG	4
> +#define SCLP_ERRNOTIFY_AQ_ADAPTER_INITIALIZED	5
> +#define SCLP_ERRNOTIFY_AQ_RECOVERABLE_ERROR	6
> +#define SCLP_ERRNOTIFY_AQ_TELEMETRY_DATA	7
>  
>  #ifndef __ASSEMBLER__
>  #include <linux/uio.h>
> diff --git a/drivers/s390/char/sclp_pci.c b/drivers/s390/char/sclp_pci.c
> index d61a7fc0dd61..b79ef7006e46 100644
> --- a/drivers/s390/char/sclp_pci.c
> +++ b/drivers/s390/char/sclp_pci.c
> @@ -99,6 +99,9 @@ static int sclp_pci_check_report(struct zpci_report_error_header *report)
>  	case SCLP_ERRNOTIFY_AQ_INFO_LOG:
>  	case SCLP_ERRNOTIFY_AQ_OPTICS_DATA:
>  	case SCLP_ERRNOTIFY_AQ_NVME_SMART_LOG:
> +	case SCLP_ERRNOTIFY_AQ_ADAPTER_INITIALIZED:
> +	case SCLP_ERRNOTIFY_AQ_RECOVERABLE_ERROR:
> +	case SCLP_ERRNOTIFY_AQ_TELEMETRY_DATA:
>  		break;
>  	default:
>  		return -EINVAL;

LGTM.


Signed-off-by: Benjamin Block <bblock@linux.ibm.com>

-- 
Best Regards, Benjamin Block        /        Linux on IBM Z Kernel Development
IBM Deutschland Research & Development GmbH    /   https://www.ibm.com/privacy
Vors. Aufs.-R.: Wolfgang Wendt         /        Geschäftsführung: David Faller
Sitz der Ges.: Ehningen     /     Registergericht: AmtsG Stuttgart, HRB 243294

Re: [PATCH] s390/sclp: Allow SCLP Action Qualifiers for Spyre card status reporting

[Benjamin Block]

On Fri, Jul 24, 2026 at 02:49:00PM +0200, Benjamin Block wrote:
> On Fri, Jul 24, 2026 at 02:23:01PM +0200, Niklas Schnelle wrote:
> > Add SCLP Action Qualifiers used by the Spyre stack for reporting of the
> > card's initialization status, recoverable errors, and telemetry data.
> > 
> > Co-developed-by: Andreas Krebbel <krebbel@linux.ibm.com>
> > Signed-off-by: Andreas Krebbel <krebbel@linux.ibm.com>
> > Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
> > ---
> >  arch/s390/include/asm/sclp.h | 3 +++
> >  drivers/s390/char/sclp_pci.c | 3 +++
> >  2 files changed, 6 insertions(+)
--8<--
> 
> LGTM.
> 
> 
> Signed-off-by: Benjamin Block <bblock@linux.ibm.com>

Sorry.. 

Reviewed-by: Benjamin Block <bblock@linux.ibm.com>

Obviously.

-- 
Best Regards, Benjamin Block        /        Linux on IBM Z Kernel Development
IBM Deutschland Research & Development GmbH    /   https://www.ibm.com/privacy
Vors. Aufs.-R.: Wolfgang Wendt         /        Geschäftsführung: David Faller
Sitz der Ges.: Ehningen     /     Registergericht: AmtsG Stuttgart, HRB 243294