[PATCH 0/4] s390: Enable CONTEXT_ANALYSIS for various directories

[PATCH 0/4] s390: Enable CONTEXT_ANALYSIS for various directories

[Heiko Carstens]

Enable CONTEXT_ANALYSYS for various directories.

Static code checking for acquiring and releasing locks used to be done
with sparse. That was removed with [1] and replaced with a clang based
approach [2]. The new approach requires that each subsystem needs to be
explicitly enabled for checking.

Do that for various directories. In order to avoid valid warnings add
attributes (sysinfo), or disable context analysis for specific functions
(mm). Disabling context analysis for specific functions still keeps
analysis enabled for the rest of a file.

[1] 5b63d0ae94cc ("compiler-context-analysis: Remove Sparse support")
[2] 3269701cb256 ("compiler-context-analysis: Add infrastructure for Context Analysis with Clang")

Notes:

- More patches for other s390 specific subsystems will follow

- "Pre-existing issues" reported by AI will not be addressed in the
  context of this series

Heiko Carstens (4):
  s390/sysinfo: Add context analysis attributes
  s390/mm: Add __context_unsafe() attribute to do_secure_storage_access()
  s390/mm: Add __context_unsafe() attribute to gmap helper functions
  s390: Enable CONTEXT_ANALYSIS for various directories

 arch/s390/appldata/Makefile  | 2 ++
 arch/s390/hypfs/Makefile     | 2 ++
 arch/s390/kernel/Makefile    | 2 ++
 arch/s390/kernel/sysinfo.c   | 2 ++
 arch/s390/lib/Makefile       | 2 ++
 arch/s390/mm/Makefile        | 2 ++
 arch/s390/mm/fault.c         | 1 +
 arch/s390/mm/gmap_helpers.c  | 3 +++
 arch/s390/net/Makefile       | 3 +++
 arch/s390/purgatory/Makefile | 2 ++
 10 files changed, 21 insertions(+)

-- 
2.53.0

[PATCH 1/4] s390/sysinfo: Add context analysis attributes

[Heiko Carstens]

Add context analysis attributes to service_level_start() and
service_level_stop() to specify that those functions only
acquire or release a lock.

Addresses the following warnings:

arch/s390/kernel/sysinfo.c:331:1: warning: rw_semaphore 'service_level_sem' is still held at the end of function
arch/s390/kernel/sysinfo.c:329:2: note: rw_semaphore acquired here
  329 |         down_read(&service_level_sem);
arch/s390/kernel/sysinfo.c:340:2: warning: releasing rw_semaphore 'service_level_sem' that was not held
  340 |         up_read(&service_level_sem);

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/kernel/sysinfo.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/s390/kernel/sysinfo.c b/arch/s390/kernel/sysinfo.c
index 33ca3e47a0e6..45b4f448fe3d 100644
--- a/arch/s390/kernel/sysinfo.c
+++ b/arch/s390/kernel/sysinfo.c
@@ -325,6 +325,7 @@ int unregister_service_level(struct service_level *slr)
 EXPORT_SYMBOL(unregister_service_level);
 
 static void *service_level_start(struct seq_file *m, loff_t *pos)
+__acquires_shared(service_level_sem)
 {
 	down_read(&service_level_sem);
 	return seq_list_start(&service_level_list, *pos);
@@ -336,6 +337,7 @@ static void *service_level_next(struct seq_file *m, void *p, loff_t *pos)
 }
 
 static void service_level_stop(struct seq_file *m, void *p)
+__releases_shared(service_level_sem)
 {
 	up_read(&service_level_sem);
 }
-- 
2.53.0

Re: [PATCH 1/4] s390/sysinfo: Add context analysis attributes

[sashiko-bot]

> Add context analysis attributes to service_level_start() and
> service_level_stop() to specify that those functions only
> acquire or release a lock.
> 
> Addresses the following warnings:
> 
> arch/s390/kernel/sysinfo.c:331:1: warning: rw_semaphore 'service_level_sem' is still held at the end of function
> arch/s390/kernel/sysinfo.c:329:2: note: rw_semaphore acquired here
>   329 |         down_read(&service_level_sem);
> arch/s390/kernel/sysinfo.c:340:2: warning: releasing rw_semaphore 'service_level_sem' that was not held
>   340 |         up_read(&service_level_sem);
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803172144.827049-1-hca@linux.ibm.com?part=1

[PATCH 2/4] s390/mm: Add __context_unsafe() attribute to do_secure_storage_access()

[Heiko Carstens]

Compiling do_secure_storage_access() with context analysis enabled
results in this warning:

arch/s390/mm/fault.c:472:3: warning: releasing spinlock 'fw.ptl' that was not held
  472 |                 folio_walk_end(&fw, vma);

Problem is that folio_walk_end() comes without the required context
analysis attribute. Also the proper attribute cannot be added easily,
since folio_walk_end() is a macro, and not a function.

For the time being disable context analysis only for
do_secure_storage_access() until this is resolved.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/mm/fault.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 028aeb9c48d6..5af448fca962 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -406,6 +406,7 @@ NOKPROBE_SYMBOL(do_dat_exception);
 #if IS_ENABLED(CONFIG_KVM)
 
 void do_secure_storage_access(struct pt_regs *regs)
+__context_unsafe(/* folio_walk_end() not instrumented */)
 {
 	union teid teid = { .val = regs->int_parm_long };
 	unsigned long addr = get_fault_address(regs);
-- 
2.53.0

Re: [PATCH 2/4] s390/mm: Add __context_unsafe() attribute to do_secure_storage_access()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Using find_vma() instead of vma_lookup() in do_secure_storage_access() allows an unprivileged user to trigger a WARN_ON_ONCE if a secure storage access exception races with an unmap operation or occurs on an unmapped address.
--

--- Patch [2]: [PATCH 2/4] s390/mm: Add __context_unsafe() attribute to do_secure_storage_access() ---
commit 679818f3abe10b8b5132294910a12a6eb003e99e
Author: Heiko Carstens <hca@linux.ibm.com>

s390/mm: Add __context_unsafe() attribute to do_secure_storage_access()

This commit disables context analysis for do_secure_storage_access() by adding
the __context_unsafe() attribute. This prevents a warning during compilation
about releasing a spinlock that wasn't held, which occurs because
folio_walk_end() is a macro and lacks the necessary context analysis attribute.

> diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
> index 028aeb9c48d6f..5af448fca9623 100644
> --- a/arch/s390/mm/fault.c
> +++ b/arch/s390/mm/fault.c
> @@ -406,6 +406,7 @@ NOKPROBE_SYMBOL(do_dat_exception);
>  #if IS_ENABLED(CONFIG_KVM)
>  
>  void do_secure_storage_access(struct pt_regs *regs)
> +__context_unsafe(/* folio_walk_end() not instrumented */)
>  {

[Severity: High]
This isn't a bug introduced by this patch, but could this function trigger a
WARN_ON_ONCE that is reachable by unprivileged users?

Later in do_secure_storage_access(), find_vma() is called instead of
vma_lookup():

arch/s390/mm/fault.c:do_secure_storage_access() {
        ...
		mmap_read_lock(mm);
		vma = find_vma(mm, addr);
		if (!vma)
			return handle_fault_error(regs, SEGV_MAPERR);
		folio = folio_walk_start(&fw, vma, addr, 0);
        ...
}

If a secure storage access exception races with an unmap operation via munmap(),
or occurs on an unmapped address, find_vma() returns the next VMA in the address
space where vma->vm_start > addr.

When this VMA is passed to folio_walk_start(), it hits the explicit
WARN_ON_ONCE(addr < vma->vm_start || addr >= vma->vm_end) check.

With panic_on_warn enabled, could this allow an unprivileged process
manipulating its own memory to cause a denial of service?

>  	union teid teid = { .val = regs->int_parm_long };
>  	unsigned long addr = get_fault_address(regs);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803172144.827049-1-hca@linux.ibm.com?part=2

[PATCH 3/4] s390/mm: Add __context_unsafe() attribute to gmap helper functions

[Heiko Carstens]

Disable context analysis for various gmap helper functions to get rid
of a few warnings:

arch/s390/mm/gmap_helpers.c:80:1: warning: spinlock 'ptl' is not held on every path through here
arch/s390/mm/gmap_helpers.c:116:2: warning: releasing spinlock 'ptl' that was not held
arch/s390/mm/gmap_helpers.c:186:2: warning: releasing spinlock 'ptl' that was not held

Use __context_unsafe() to give a short comment why for function context
analysis is disabled.

try_get_locked_pte() is disabled since it may return a nonull value
regardless if it returns with a lock held or not.

This cannot be reflected with the context analysis attributes. It is
however possible to workaround this e.g. by adding a another `contended`
function parameter, however this would lead to the next problem:
pte_unmap_unlock() is a macro and therefore doesn't come with the
required context analysis attribute to address this.

For that reason also disable context analysis for
gmap_helper_zap_one_page() and gmap_helper_try_set_pte_unused()
until this has been addressed.

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/mm/gmap_helpers.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/s390/mm/gmap_helpers.c b/arch/s390/mm/gmap_helpers.c
index 4bf7c9012feb..f910c9584560 100644
--- a/arch/s390/mm/gmap_helpers.c
+++ b/arch/s390/mm/gmap_helpers.c
@@ -40,6 +40,7 @@
  *   and locked.
  */
 pte_t *try_get_locked_pte(struct mm_struct *mm, unsigned long vmaddr, spinlock_t **ptl)
+__context_unsafe(/* Returns nonnull if lock taken or not taken */)
 {
 	pmd_t *pmdp, pmd, pmdval;
 	pud_t *pudp, pud;
@@ -90,6 +91,7 @@ EXPORT_SYMBOL_GPL(try_get_locked_pte);
  * Context: needs to be called while holding the mmap lock.
  */
 void gmap_helper_zap_one_page(struct mm_struct *mm, unsigned long vmaddr)
+__context_unsafe(/* pte_unmap_unlock() not instrumented */)
 {
 	struct vm_area_struct *vma;
 	spinlock_t *ptl;	/* Lock for the host (userspace) page table */
@@ -161,6 +163,7 @@ EXPORT_SYMBOL_GPL(gmap_helper_discard);
  *          disabled.
  */
 void gmap_helper_try_set_pte_unused(struct mm_struct *mm, unsigned long vmaddr)
+__context_unsafe(/* pte_unmap_unlock() not instrumented */)
 {
 	spinlock_t *ptl;	/* Lock for the host (userspace) page table */
 	pte_t *ptep;
-- 
2.53.0

Re: [PATCH 3/4] s390/mm: Add __context_unsafe() attribute to gmap helper functions

[sashiko-bot]

> Disable context analysis for various gmap helper functions to get rid
> of a few warnings:
> 
> arch/s390/mm/gmap_helpers.c:80:1: warning: spinlock 'ptl' is not held on every path through here
> arch/s390/mm/gmap_helpers.c:116:2: warning: releasing spinlock 'ptl' that was not held
> arch/s390/mm/gmap_helpers.c:186:2: warning: releasing spinlock 'ptl' that was not held
> 
> Use __context_unsafe() to give a short comment why for function context
> analysis is disabled.
> 
> try_get_locked_pte() is disabled since it may return a nonull value
> regardless if it returns with a lock held or not.
> 
> This cannot be reflected with the context analysis attributes. It is
> however possible to workaround this e.g. by adding a another `contended`
> function parameter, however this would lead to the next problem:
> pte_unmap_unlock() is a macro and therefore doesn't come with the
> required context analysis attribute to address this.
> 
> For that reason also disable context analysis for
> gmap_helper_zap_one_page() and gmap_helper_try_set_pte_unused()
> until this has been addressed.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803172144.827049-1-hca@linux.ibm.com?part=3

Re: [PATCH 3/4] s390/mm: Add __context_unsafe() attribute to gmap helper functions

[Claudio Imbrenda]

On Mon,  3 Aug 2026 19:21:43 +0200
Heiko Carstens <hca@linux.ibm.com> wrote:

> Disable context analysis for various gmap helper functions to get rid
> of a few warnings:
> 
> arch/s390/mm/gmap_helpers.c:80:1: warning: spinlock 'ptl' is not held on every path through here
> arch/s390/mm/gmap_helpers.c:116:2: warning: releasing spinlock 'ptl' that was not held
> arch/s390/mm/gmap_helpers.c:186:2: warning: releasing spinlock 'ptl' that was not held
> 
> Use __context_unsafe() to give a short comment why for function context
> analysis is disabled.
> 
> try_get_locked_pte() is disabled since it may return a nonull value
> regardless if it returns with a lock held or not.
> 
> This cannot be reflected with the context analysis attributes. It is
> however possible to workaround this e.g. by adding a another `contended`
> function parameter, however this would lead to the next problem:
> pte_unmap_unlock() is a macro and therefore doesn't come with the
> required context analysis attribute to address this.
> 
> For that reason also disable context analysis for
> gmap_helper_zap_one_page() and gmap_helper_try_set_pte_unused()
> until this has been addressed.
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>

Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com>

> ---
>  arch/s390/mm/gmap_helpers.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/s390/mm/gmap_helpers.c b/arch/s390/mm/gmap_helpers.c
> index 4bf7c9012feb..f910c9584560 100644
> --- a/arch/s390/mm/gmap_helpers.c
> +++ b/arch/s390/mm/gmap_helpers.c
> @@ -40,6 +40,7 @@
>   *   and locked.
>   */
>  pte_t *try_get_locked_pte(struct mm_struct *mm, unsigned long vmaddr, spinlock_t **ptl)
> +__context_unsafe(/* Returns nonnull if lock taken or not taken */)
>  {
>  	pmd_t *pmdp, pmd, pmdval;
>  	pud_t *pudp, pud;
> @@ -90,6 +91,7 @@ EXPORT_SYMBOL_GPL(try_get_locked_pte);
>   * Context: needs to be called while holding the mmap lock.
>   */
>  void gmap_helper_zap_one_page(struct mm_struct *mm, unsigned long vmaddr)
> +__context_unsafe(/* pte_unmap_unlock() not instrumented */)
>  {
>  	struct vm_area_struct *vma;
>  	spinlock_t *ptl;	/* Lock for the host (userspace) page table */
> @@ -161,6 +163,7 @@ EXPORT_SYMBOL_GPL(gmap_helper_discard);
>   *          disabled.
>   */
>  void gmap_helper_try_set_pte_unused(struct mm_struct *mm, unsigned long vmaddr)
> +__context_unsafe(/* pte_unmap_unlock() not instrumented */)
>  {
>  	spinlock_t *ptl;	/* Lock for the host (userspace) page table */
>  	pte_t *ptep;

[PATCH 4/4] s390: Enable CONTEXT_ANALYSIS for various directories

[Heiko Carstens]

Enable CONTEXT_ANALYSIS for various directories which do not generate
any warnings (anymore).

Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
---
 arch/s390/appldata/Makefile  | 2 ++
 arch/s390/hypfs/Makefile     | 2 ++
 arch/s390/kernel/Makefile    | 2 ++
 arch/s390/lib/Makefile       | 2 ++
 arch/s390/mm/Makefile        | 2 ++
 arch/s390/net/Makefile       | 3 +++
 arch/s390/purgatory/Makefile | 2 ++
 7 files changed, 15 insertions(+)

diff --git a/arch/s390/appldata/Makefile b/arch/s390/appldata/Makefile
index b06def4a4f2f..132381f16fb1 100644
--- a/arch/s390/appldata/Makefile
+++ b/arch/s390/appldata/Makefile
@@ -3,6 +3,8 @@
 # Makefile for the Linux - z/VM Monitor Stream.
 #
 
+CONTEXT_ANALYSIS := y
+
 obj-$(CONFIG_APPLDATA_BASE) += appldata_base.o
 obj-$(CONFIG_APPLDATA_MEM) += appldata_mem.o
 obj-$(CONFIG_APPLDATA_OS) += appldata_os.o
diff --git a/arch/s390/hypfs/Makefile b/arch/s390/hypfs/Makefile
index c34854d298f8..5a3daeafe926 100644
--- a/arch/s390/hypfs/Makefile
+++ b/arch/s390/hypfs/Makefile
@@ -3,6 +3,8 @@
 # Makefile for the linux hypfs filesystem routines.
 #
 
+CONTEXT_ANALYSIS := y
+
 obj-$(CONFIG_S390_HYPFS)	+= hypfs_dbfs.o
 obj-$(CONFIG_S390_HYPFS)	+= hypfs_diag.o
 obj-$(CONFIG_S390_HYPFS)	+= hypfs_diag0c.o
diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
index 6c88476d79a3..71330352bf3f 100644
--- a/arch/s390/kernel/Makefile
+++ b/arch/s390/kernel/Makefile
@@ -3,6 +3,8 @@
 # Makefile for the linux kernel.
 #
 
+CONTEXT_ANALYSIS := y
+
 ifdef CONFIG_FUNCTION_TRACER
 
 # Do not trace tracer code
diff --git a/arch/s390/lib/Makefile b/arch/s390/lib/Makefile
index aa6cc6a1fe88..bb707700d7af 100644
--- a/arch/s390/lib/Makefile
+++ b/arch/s390/lib/Makefile
@@ -3,6 +3,8 @@
 # Makefile for s390-specific library files..
 #
 
+CONTEXT_ANALYSIS := y
+
 # string.o implements standard library functions like memset/memcpy etc.
 # Use -ffreestanding to ensure that the compiler does not try to "optimize"
 # them into calls to themselves.
diff --git a/arch/s390/mm/Makefile b/arch/s390/mm/Makefile
index 193899c39ca7..7dea37a5ad3b 100644
--- a/arch/s390/mm/Makefile
+++ b/arch/s390/mm/Makefile
@@ -3,6 +3,8 @@
 # Makefile for the linux s390-specific parts of the memory manager.
 #
 
+CONTEXT_ANALYSIS := y
+
 obj-y		:= init.o fault.o extmem.o mmap.o vmem.o maccess.o
 obj-y		+= page-states.o pageattr.o pgtable.o pgalloc.o extable.o
 
diff --git a/arch/s390/net/Makefile b/arch/s390/net/Makefile
index 9275cf63192a..0a7323c9b372 100644
--- a/arch/s390/net/Makefile
+++ b/arch/s390/net/Makefile
@@ -2,5 +2,8 @@
 #
 # Arch-specific network modules
 #
+
+CONTEXT_ANALYSIS := y
+
 obj-$(CONFIG_BPF_JIT) += bpf_jit_comp.o bpf_timed_may_goto.o
 obj-$(CONFIG_HAVE_PNETID) += pnet.o
diff --git a/arch/s390/purgatory/Makefile b/arch/s390/purgatory/Makefile
index e74410bb1b88..b2f17e0d7fd6 100644
--- a/arch/s390/purgatory/Makefile
+++ b/arch/s390/purgatory/Makefile
@@ -1,5 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 
+CONTEXT_ANALYSIS := y
+
 purgatory-y := head.o purgatory.o string.o sha256.o
 
 targets += $(purgatory-y) purgatory.lds purgatory purgatory.chk purgatory.ro
-- 
2.53.0

Re: [PATCH 4/4] s390: Enable CONTEXT_ANALYSIS for various directories

[sashiko-bot]

> Enable CONTEXT_ANALYSIS for various directories which do not generate
> any warnings (anymore).
> 
> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803172144.827049-1-hca@linux.ibm.com?part=4