[PATCH 0/2] s390: Improve handling for stack register corruption

[PATCH 0/2] s390: Improve handling for stack register corruption

[Heiko Carstens]

Two small improvements:

- Copy last breaking event address to correct pt_regs location

- Save lowcore on invalid kernel stack to have more accurate data for
  crash dump analysis

Thanks,
Heiko

Heiko Carstens (2):
  s390/entry: Last breaking event vs invalid kernel stack
  s390/entry: Save lowcore on invalid kernel stack

 arch/s390/kernel/entry.S | 17 ++++++++++++++++-
 arch/s390/kernel/entry.h |  4 ++++
 arch/s390/kernel/traps.c |  6 ++++++
 3 files changed, 26 insertions(+), 1 deletion(-)

-- 
2.53.0

[PATCH 1/2] s390/entry: Last breaking event vs invalid kernel stack

[Heiko Carstens]

In case an invalid kernel stack is detected the last breaking event
address is copied to the orig_gpr2 member of the generated pt_regs
structure. Correct location would be last_break. Fix this.

This adds help information to the printed messages:

Before:
Kernel stack pointer invalid
...
Last Breaking-Event-Address:
 [<0000000000000000>] 0x0

After:
Kernel stack pointer invalid
...
Last Breaking-Event-Address:
 [<000001b802c1ae1c>] proc_reg_write+0x5c/0xd0

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/kernel/entry.S | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 10dd9bbdf985..4e99ed559dbd 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -622,7 +622,7 @@ SYM_CODE_START(stack_invalid)
 	stmg	%r8,%r9,__PT_PSW(%r11)
 	mvc	__PT_R8(64,%r11),0(%r14)
 	GET_LC	%r2
-	mvc	__PT_ORIG_GPR2(8,%r11),__LC_PGM_LAST_BREAK(%r2)
+	mvc	__PT_LAST_BREAK(8,%r11),__LC_PGM_LAST_BREAK(%r2)
 	xc	__SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
 	lgr	%r2,%r11		# pass pointer to pt_regs
 	jg	kernel_stack_invalid
-- 
2.53.0

Re: [PATCH 1/2] s390/entry: Last breaking event vs invalid kernel stack

[sashiko-bot]

> In case an invalid kernel stack is detected the last breaking event
> address is copied to the orig_gpr2 member of the generated pt_regs
> structure. Correct location would be last_break. Fix this.
> 
> This adds help information to the printed messages:
> 
> Before:
> Kernel stack pointer invalid
> ...
> Last Breaking-Event-Address:
>  [<0000000000000000>] 0x0
> 
> After:
> Kernel stack pointer invalid
> ...
> Last Breaking-Event-Address:
>  [<000001b802c1ae1c>] proc_reg_write+0x5c/0xd0
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261002152055.3305184-1-hca@linux.ibm.com?part=1

Re: [PATCH 1/2] s390/entry: Last breaking event vs invalid kernel stack

[Alexander Gordeev]

On Fri, Oct 02, 2026 at 05:20:54PM +0200, Heiko Carstens wrote:
> In case an invalid kernel stack is detected the last breaking event
> address is copied to the orig_gpr2 member of the generated pt_regs
> structure. Correct location would be last_break. Fix this.
> 
> This adds help information to the printed messages:
> 
> Before:
> Kernel stack pointer invalid
> ...
> Last Breaking-Event-Address:
>  [<0000000000000000>] 0x0
> 
> After:
> Kernel stack pointer invalid
> ...
> Last Breaking-Event-Address:
>  [<000001b802c1ae1c>] proc_reg_write+0x5c/0xd0
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>  arch/s390/kernel/entry.S | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
> index 10dd9bbdf985..4e99ed559dbd 100644
> --- a/arch/s390/kernel/entry.S
> +++ b/arch/s390/kernel/entry.S
> @@ -622,7 +622,7 @@ SYM_CODE_START(stack_invalid)
>  	stmg	%r8,%r9,__PT_PSW(%r11)
>  	mvc	__PT_R8(64,%r11),0(%r14)
>  	GET_LC	%r2
> -	mvc	__PT_ORIG_GPR2(8,%r11),__LC_PGM_LAST_BREAK(%r2)
> +	mvc	__PT_LAST_BREAK(8,%r11),__LC_PGM_LAST_BREAK(%r2)
>  	xc	__SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
>  	lgr	%r2,%r11		# pass pointer to pt_regs
>  	jg	kernel_stack_invalid

Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>

[PATCH 2/2] s390/entry: Save lowcore on invalid kernel stack

[Heiko Carstens]

In case of an invalid kernel stack copy the current CPU's lowcore to
stack_invalid_lowcore, so it is available to debug tools after a crash.

The copy is helpful since the lowcore is modified e.g., when printing
messages before a dump is taken. Keep it as unmodified as possible and
as close to the event that caused register corruption.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/kernel/entry.S | 15 +++++++++++++++
 arch/s390/kernel/entry.h |  4 ++++
 arch/s390/kernel/traps.c |  6 ++++++
 3 files changed, 25 insertions(+)

diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 4e99ed559dbd..7346f8ad7f91 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -21,6 +21,7 @@
 #include <asm/thread_info.h>
 #include <asm/asm-offsets.h>
 #include <asm/unistd.h>
+#include <asm/lowcore.h>
 #include <asm/page.h>
 #include <asm/sigp.h>
 #include <asm/bug.h>
@@ -613,6 +614,8 @@ SYM_CODE_END(early_pgm_check_handler)
  * The synchronous or the asynchronous stack pointer is invalid. We are dead.
  * No need to properly save the registers, we are going to panic anyway.
  * Setup a pt_regs so that show_trace can provide a good call trace.
+ * Copy lowcore of the current CPU to stack_invalid_lowcore before it
+ * is modified by printing debug messages and crash handling.
  */
 SYM_CODE_START(stack_invalid)
 	GET_LC	%r15
@@ -623,6 +626,18 @@ SYM_CODE_START(stack_invalid)
 	mvc	__PT_R8(64,%r11),0(%r14)
 	GET_LC	%r2
 	mvc	__PT_LAST_BREAK(8,%r11),__LC_PGM_LAST_BREAK(%r2)
+	/* copy lowcore; skip if used by another CPU */
+	larl	%r4,stack_invalid_lowcore_used
+	lhi	%r1,0
+	lhi	%r3,1
+	cs	%r1,%r3,0(%r4)
+	jne	.Lskip
+	larl	%r0,stack_invalid_lowcore
+	lghi	%r1,LC_PAGES * PAGE_SIZE
+	lgr	%r4,%r2
+	lgr	%r5,%r1
+	mvcl	%r0,%r4
+.Lskip:
 	xc	__SF_BACKCHAIN(8,%r15),__SF_BACKCHAIN(%r15)
 	lgr	%r2,%r11		# pass pointer to pt_regs
 	jg	kernel_stack_invalid
diff --git a/arch/s390/kernel/entry.h b/arch/s390/kernel/entry.h
index dc84ab497251..5d6685e5bf5f 100644
--- a/arch/s390/kernel/entry.h
+++ b/arch/s390/kernel/entry.h
@@ -11,6 +11,7 @@
 #include <linux/types.h>
 #include <linux/signal.h>
 #include <asm/extable.h>
+#include <asm/lowcore.h>
 #include <asm/ptrace.h>
 #include <asm/idle.h>
 
@@ -64,6 +65,9 @@ long sys_s390_sthyi(unsigned long function_code, void __user *buffer, u64 __user
 unsigned long stack_alloc(void);
 void stack_free(unsigned long stack);
 
+extern int stack_invalid_lowcore_used;
+extern struct lowcore stack_invalid_lowcore;
+
 extern char kprobes_insn_page[];
 
 extern char _samode31[], _eamode31[];
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index b6ba4465f59d..cd55729e5f8a 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -283,6 +283,12 @@ static void monitor_event_exception(struct pt_regs *regs)
 	}
 }
 
+/*
+ * Content of the faulting CPU's lowcore, copied by stack_invalid().
+ */
+struct lowcore stack_invalid_lowcore;
+int stack_invalid_lowcore_used;
+
 void kernel_stack_invalid(struct pt_regs *regs)
 {
 	/*
-- 
2.53.0

Re: [PATCH 2/2] s390/entry: Save lowcore on invalid kernel stack

[sashiko-bot]

> In case of an invalid kernel stack copy the current CPU's lowcore to
> stack_invalid_lowcore, so it is available to debug tools after a crash.
> 
> The copy is helpful since the lowcore is modified e.g., when printing
> messages before a dump is taken. Keep it as unmodified as possible and
> as close to the event that caused register corruption.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261002152055.3305184-1-hca@linux.ibm.com?part=2

Re: [PATCH 2/2] s390/entry: Save lowcore on invalid kernel stack

[Alexander Gordeev]

On Fri, Oct 02, 2026 at 05:20:55PM +0200, Heiko Carstens wrote:
> In case of an invalid kernel stack copy the current CPU's lowcore to
> stack_invalid_lowcore, so it is available to debug tools after a crash.
> 
> The copy is helpful since the lowcore is modified e.g., when printing
> messages before a dump is taken. Keep it as unmodified as possible and
> as close to the event that caused register corruption.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
> ---
>  arch/s390/kernel/entry.S | 15 +++++++++++++++
>  arch/s390/kernel/entry.h |  4 ++++
>  arch/s390/kernel/traps.c |  6 ++++++
>  3 files changed, 25 insertions(+)

Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>