[PULL v2 00/11] First batch of s390x updates for 11.1

[PULL v2 00/11] First batch of s390x updates for 11.1

[Cornelia Huck]

[Changes from v1: dropped since-merged machine types patch, added fix for
functional test]

The following changes since commit 282771e1f9b9b6e0147adf5f9d676325175b1767:

  Merge tag 'pull-riscv-to-apply-20260429-1' of https://github.com/alistair23/qemu into staging (2026-04-29 09:22:51 -0400)

are available in the Git repository at:

  https://gitlab.com/cohuck/qemu tags/s390x-20260430

for you to fetch changes up to bbb412adc4a6e6a11806a5d778da6aa1c24edf56:

  tests/functional/s390x: Update expected virtio-pci IDs (2026-04-30 16:59:09 +0200)

----------------------------------------------------------------
First batch of s390x updates for 11.1:
- disable legacy virtio-pci from now on by default (did not work anyway)
- add a new boot test
- simplifications and cleanups

----------------------------------------------------------------

Eric Farman (1):
  MAINTAINERS: Update s390 trees

Jaehoon Kim (1):
  hw/s390x/ccw: Disable legacy virtio-pci by default (v11.1+)

Matthew Rosato (1):
  tests/functional/s390x: Update expected virtio-pci IDs

Philippe Mathieu-Daudé (6):
  target/s390x: Replace legacy ld/st_phys -> address_space_ld/st (cpu)
  target/s390x: Replace legacy ld/st_phys -> address_space_ld/st (mmu)
  target/s390x: Replace legacy ld/st_phys -> address_space_ld/st (tcg)
  target/s390x: Replace legacy ld/st_phys -> address_space_ld/st (kvm)
  configs/targets: Restrict the legacy ldst_phys() API on s390x target
  target/s390x: Prefer MO_128 definition over magic value

Thomas Huth (2):
  target/s390x/kvm: Simplify the async pfault handling code
  tests/functional/s390x: Add test for booting from a disk with 4k
    sectors

 MAINTAINERS                               |   6 +-
 configs/targets/s390x-softmmu.mak         |   1 +
 hw/s390x/s390-virtio-ccw.c                |  26 ++++
 target/s390x/cpu-system.c                 |   2 +-
 target/s390x/kvm/kvm.c                    |  64 +++-------
 target/s390x/mmu_helper.c                 |   5 +-
 target/s390x/tcg/excp_helper.c            |  21 ++--
 target/s390x/tcg/mem_helper.c             |  12 +-
 target/s390x/tcg/translate_vx.c.inc       |   2 +-
 tests/functional/s390x/meson.build        |   1 +
 tests/functional/s390x/test_boot_4k.py    | 138 ++++++++++++++++++++++
 tests/functional/s390x/test_ccw_virtio.py |   4 +-
 12 files changed, 213 insertions(+), 69 deletions(-)
 create mode 100755 tests/functional/s390x/test_boot_4k.py

-- 
2.53.0

[PULL v2 01/11] target/s390x/kvm: Simplify the async pfault handling code

[Cornelia Huck]

From: Thomas Huth <thuth@redhat.com>

Since commit 126e7f78036 ("kvm: require KVM_CAP_IOEVENTFD and
KVM_CAP_IOEVENTFD_ANY_LENGTH") we require at least kernel v4.4 to
be able to use KVM. KVM_CAP_ASYNC_PF is available in the kernel
since v3.15 and KVM_SYNC_PFAULT is available since kernel v3.18,
so we can assume now that they are available in all supported
kernels. Thus simplify the code a little bit by removing the
checks for these features.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Message-ID: <20260317134531.460141-1-thuth@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 target/s390x/kvm/kvm.c | 52 +++++++++---------------------------------
 1 file changed, 11 insertions(+), 41 deletions(-)

diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index 54d28e37d4dd..133e8c12fd4d 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -140,7 +140,6 @@ const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
     KVM_CAP_LAST_INFO
 };
 
-static int cap_async_pf;
 static int cap_mem_op;
 static int cap_mem_op_extension;
 static int cap_s390_irq;
@@ -333,6 +332,7 @@ int kvm_arch_get_default_type(MachineState *ms)
 int kvm_arch_init(MachineState *ms, KVMState *s)
 {
     int required_caps[] = {
+        KVM_CAP_ASYNC_PF,
         KVM_CAP_DEVICE_CTRL,
         KVM_CAP_SYNC_REGS,
     };
@@ -340,7 +340,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
     for (int i = 0; i < ARRAY_SIZE(required_caps); i++) {
         if (!kvm_check_extension(s, required_caps[i])) {
             error_report("KVM is missing capability #%d - "
-                         "please use kernel 3.15 or newer", required_caps[i]);
+                         "please use kernel 4.4 or newer", required_caps[i]);
             return -1;
         }
     }
@@ -354,7 +354,6 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
         return -1;
     }
 
-    cap_async_pf = kvm_check_extension(s, KVM_CAP_ASYNC_PF);
     cap_mem_op = kvm_check_extension(s, KVM_CAP_S390_MEM_OP);
     cap_mem_op_extension = kvm_check_extension(s, KVM_CAP_S390_MEM_OP_EXTENSION);
     mem_op_storage_key_support = cap_mem_op_extension > 0;
@@ -466,7 +465,8 @@ static int can_sync_regs(CPUState *cs, int regs)
 }
 
 #define KVM_SYNC_REQUIRED_REGS (KVM_SYNC_GPRS | KVM_SYNC_ACRS | \
-                                KVM_SYNC_CRS | KVM_SYNC_PREFIX)
+                                KVM_SYNC_CRS | KVM_SYNC_PREFIX | \
+                                KVM_SYNC_PFAULT)
 
 int kvm_arch_put_registers(CPUState *cs, KvmPutState level, Error **errp)
 {
@@ -550,25 +550,10 @@ int kvm_arch_put_registers(CPUState *cs, KvmPutState level, Error **errp)
     }
 
     /* pfault parameters */
-    if (can_sync_regs(cs, KVM_SYNC_PFAULT)) {
-        cs->kvm_run->s.regs.pft = env->pfault_token;
-        cs->kvm_run->s.regs.pfs = env->pfault_select;
-        cs->kvm_run->s.regs.pfc = env->pfault_compare;
-        cs->kvm_run->kvm_dirty_regs |= KVM_SYNC_PFAULT;
-    } else if (cap_async_pf) {
-        r = kvm_set_one_reg(cs, KVM_REG_S390_PFTOKEN, &env->pfault_token);
-        if (r < 0) {
-            return r;
-        }
-        r = kvm_set_one_reg(cs, KVM_REG_S390_PFCOMPARE, &env->pfault_compare);
-        if (r < 0) {
-            return r;
-        }
-        r = kvm_set_one_reg(cs, KVM_REG_S390_PFSELECT, &env->pfault_select);
-        if (r < 0) {
-            return r;
-        }
-    }
+    cs->kvm_run->s.regs.pft = env->pfault_token;
+    cs->kvm_run->s.regs.pfs = env->pfault_select;
+    cs->kvm_run->s.regs.pfc = env->pfault_compare;
+    cs->kvm_run->kvm_dirty_regs |= KVM_SYNC_PFAULT;
 
     if (can_sync_regs(cs, KVM_SYNC_GSCB)) {
         memcpy(cs->kvm_run->s.regs.gscb, env->gscb, 32);
@@ -673,24 +658,9 @@ int kvm_arch_get_registers(CPUState *cs, Error **errp)
     }
 
     /* pfault parameters */
-    if (can_sync_regs(cs, KVM_SYNC_PFAULT)) {
-        env->pfault_token = cs->kvm_run->s.regs.pft;
-        env->pfault_select = cs->kvm_run->s.regs.pfs;
-        env->pfault_compare = cs->kvm_run->s.regs.pfc;
-    } else if (cap_async_pf) {
-        r = kvm_get_one_reg(cs, KVM_REG_S390_PFTOKEN, &env->pfault_token);
-        if (r < 0) {
-            return r;
-        }
-        r = kvm_get_one_reg(cs, KVM_REG_S390_PFCOMPARE, &env->pfault_compare);
-        if (r < 0) {
-            return r;
-        }
-        r = kvm_get_one_reg(cs, KVM_REG_S390_PFSELECT, &env->pfault_select);
-        if (r < 0) {
-            return r;
-        }
-    }
+    env->pfault_token = cs->kvm_run->s.regs.pft;
+    env->pfault_select = cs->kvm_run->s.regs.pfs;
+    env->pfault_compare = cs->kvm_run->s.regs.pfc;
 
     if (can_sync_regs(cs, KVM_SYNC_DIAG318)) {
         env->diag318_info = cs->kvm_run->s.regs.diag318;
-- 
2.53.0

[PULL v2 02/11] target/s390x: Replace legacy ld/st_phys -> address_space_ld/st (cpu)

[Cornelia Huck]

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Prefer the address_space_ld/st API over the legacy ld_phys()
because it allow checking for bus access fault.
This code however doesn't check for fault, so we simply inline
the calls (not specifying any memory transaction attribute nor
expecting transation result). No logical change intended.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260319185203.11799-2-philmd@linaro.org>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 target/s390x/tcg/excp_helper.c | 21 +++++++++++++--------
 target/s390x/tcg/mem_helper.c  | 12 +++++++-----
 2 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index 41b0017d767c..05e448d3f20c 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -54,8 +54,9 @@ G_NORETURN void tcg_s390_data_exception(CPUS390XState *env, uint32_t dxc,
     g_assert(dxc <= 0xff);
 #if !defined(CONFIG_USER_ONLY)
     /* Store the DXC into the lowcore */
-    stl_be_phys(env_cpu(env)->as,
-                env->psa + offsetof(LowCore, data_exc_code), dxc);
+    address_space_stl_be(env_cpu(env)->as,
+                         env->psa + offsetof(LowCore, data_exc_code), dxc,
+                         MEMTXATTRS_UNSPECIFIED, NULL);
 #endif
 
     /* Store the DXC into the FPC if AFP is enabled */
@@ -71,8 +72,9 @@ G_NORETURN void tcg_s390_vector_exception(CPUS390XState *env, uint32_t vxc,
     g_assert(vxc <= 0xff);
 #if !defined(CONFIG_USER_ONLY)
     /* Always store the VXC into the lowcore, without AFP it is undefined */
-    stl_be_phys(env_cpu(env)->as,
-                env->psa + offsetof(LowCore, data_exc_code), vxc);
+    address_space_stl_be(env_cpu(env)->as,
+                         env->psa + offsetof(LowCore, data_exc_code), vxc,
+                         MEMTXATTRS_UNSPECIFIED, NULL);
 #endif
 
     /* Always store the VXC into the FPC, without AFP it is undefined */
@@ -619,11 +621,14 @@ void monitor_event(CPUS390XState *env,
                    uint64_t monitor_code,
                    uint8_t monitor_class, uintptr_t ra)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
+    AddressSpace *as = env_cpu(env)->as;
+
     /* Store the Monitor Code and the Monitor Class Number into the lowcore */
-    stq_be_phys(env_cpu(env)->as,
-                env->psa + offsetof(LowCore, monitor_code), monitor_code);
-    stw_be_phys(env_cpu(env)->as,
-                env->psa + offsetof(LowCore, mon_class_num), monitor_class);
+    address_space_stq_be(as, env->psa + offsetof(LowCore, monitor_code),
+                         monitor_code, attrs, NULL);
+    address_space_stw_be(as, env->psa + offsetof(LowCore, mon_class_num),
+                         monitor_class, attrs, NULL);
 
     tcg_s390_program_interrupt(env, PGM_MONITOR, ra);
 }
diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index 2a79a789f639..8474a6941107 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -41,6 +41,7 @@
 #else
 #include "hw/s390x/storage-keys.h"
 #include "hw/core/boards.h"
+#include "system/memory.h"
 #endif
 
 #ifdef CONFIG_USER_ONLY
@@ -958,13 +959,14 @@ uint32_t HELPER(mvpg)(CPUS390XState *env, uint64_t r0, uint32_t r1, uint32_t r2)
 inject_exc:
 #if !defined(CONFIG_USER_ONLY)
     if (exc != PGM_ADDRESSING) {
-        stq_be_phys(env_cpu(env)->as,
-                    env->psa + offsetof(LowCore, trans_exc_code),
-                    env->tlb_fill_tec);
+        address_space_stq_be(env_cpu(env)->as,
+                             env->psa + offsetof(LowCore, trans_exc_code),
+                             env->tlb_fill_tec, MEMTXATTRS_UNSPECIFIED, NULL);
     }
     if (exc == PGM_PAGE_TRANS) {
-        stb_phys(env_cpu(env)->as, env->psa + offsetof(LowCore, op_access_id),
-                 r1 << 4 | r2);
+        address_space_stb(env_cpu(env)->as,
+                          env->psa + offsetof(LowCore, op_access_id),
+                          r1 << 4 | r2, MEMTXATTRS_UNSPECIFIED, NULL);
     }
 #endif
     tcg_s390_program_interrupt(env, exc, ra);
-- 
2.53.0

[PULL v2 03/11] target/s390x: Replace legacy ld/st_phys -> address_space_ld/st (mmu)

[Cornelia Huck]

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Prefer the address_space_ld/st API over the legacy ld_phys()
because it allow checking for bus access fault.
This code however doesn't check for fault, so we simply inline
the calls (not specifying any memory transaction attribute nor
expecting transation result). No logical change intended.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260319185203.11799-3-philmd@linaro.org>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 target/s390x/mmu_helper.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
index 246573ff6429..255271b9d340 100644
--- a/target/s390x/mmu_helper.c
+++ b/target/s390x/mmu_helper.c
@@ -44,8 +44,9 @@ static void trigger_access_exception(CPUS390XState *env, uint32_t type,
     } else {
         CPUState *cs = env_cpu(env);
         if (type != PGM_ADDRESSING) {
-            stq_be_phys(cs->as, env->psa + offsetof(LowCore, trans_exc_code),
-                        tec);
+            address_space_stq_be(cs->as,
+                                 env->psa + offsetof(LowCore, trans_exc_code),
+                                 tec, MEMTXATTRS_UNSPECIFIED, NULL);
         }
         trigger_pgm_exception(env, type);
     }
-- 
2.53.0

[PULL v2 04/11] target/s390x: Replace legacy ld/st_phys -> address_space_ld/st (tcg)

[Cornelia Huck]

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Prefer the address_space_ld/st API over the legacy ld_phys()
because it allow checking for bus access fault.
This code however doesn't check for fault, so we simply inline
the calls (not specifying any memory transaction attribute nor
expecting transation result). No logical change intended.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260319185203.11799-4-philmd@linaro.org>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 target/s390x/cpu-system.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/cpu-system.c b/target/s390x/cpu-system.c
index 881171d71a26..285f59996616 100644
--- a/target/s390x/cpu-system.c
+++ b/target/s390x/cpu-system.c
@@ -63,7 +63,7 @@ static void s390_cpu_load_normal(CPUState *s)
     uint64_t spsw;
 
     if (!s390_is_pv()) {
-        spsw = ldq_be_phys(s->as, 0);
+        spsw = address_space_ldq_be(s->as, 0, MEMTXATTRS_UNSPECIFIED, NULL);
         cpu->env.psw.mask = spsw & PSW_MASK_SHORT_CTRL;
         /*
          * Invert short psw indication, so SIE will report a specification
-- 
2.53.0

[PULL v2 05/11] target/s390x: Replace legacy ld/st_phys -> address_space_ld/st (kvm)

[Cornelia Huck]

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Prefer the address_space_ld/st API over the legacy ld_phys()
because it allow checking for bus access fault.
This code however doesn't check for fault, so we simply inline
the calls (not specifying any memory transaction attribute nor
expecting transation result). No logical change intended.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260319185203.11799-5-philmd@linaro.org>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 target/s390x/kvm/kvm.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index 133e8c12fd4d..2e4f435c5371 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -36,6 +36,7 @@
 #include "qemu/main-loop.h"
 #include "qemu/mmap-alloc.h"
 #include "qemu/log.h"
+#include "system/memory.h"
 #include "system/system.h"
 #include "system/hw_accel.h"
 #include "system/runstate.h"
@@ -1634,13 +1635,16 @@ static void unmanageable_intercept(S390CPU *cpu, S390CrashReason reason,
 /* try to detect pgm check loops */
 static int handle_oper_loop(S390CPU *cpu, struct kvm_run *run)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     CPUState *cs = CPU(cpu);
     PSW oldpsw, newpsw;
 
-    newpsw.mask = ldq_be_phys(cs->as, cpu->env.psa +
-                              offsetof(LowCore, program_new_psw));
-    newpsw.addr = ldq_be_phys(cs->as, cpu->env.psa +
-                              offsetof(LowCore, program_new_psw) + 8);
+    newpsw.mask = address_space_ldq_be(cs->as, cpu->env.psa +
+                                       offsetof(LowCore, program_new_psw),
+                                       attrs, NULL);
+    newpsw.addr = address_space_ldq_be(cs->as, cpu->env.psa +
+                                       offsetof(LowCore, program_new_psw) + 8,
+                                       attrs, NULL);
     oldpsw.mask  = run->psw_mask;
     oldpsw.addr  = run->psw_addr;
     /*
-- 
2.53.0

[PULL v2 06/11] configs/targets: Restrict the legacy ldst_phys() API on s390x target

[Cornelia Huck]

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The s390x target doesn't use the legacy ldst_phys() API anymore.
Set the TARGET_NOT_USING_LEGACY_LDST_PHYS_API variable to hide
the legacy API to the qemu-system-loongarch64 binary, avoiding
further API uses to creep in.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260319185203.11799-6-philmd@linaro.org>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 configs/targets/s390x-softmmu.mak | 1 +
 1 file changed, 1 insertion(+)

diff --git a/configs/targets/s390x-softmmu.mak b/configs/targets/s390x-softmmu.mak
index e273075f1a99..478988e6d4a5 100644
--- a/configs/targets/s390x-softmmu.mak
+++ b/configs/targets/s390x-softmmu.mak
@@ -4,3 +4,4 @@ TARGET_KVM_HAVE_GUEST_DEBUG=y
 TARGET_XML_FILES= s390x-core64.xml s390-acr.xml s390-fpr.xml s390-vx.xml s390-cr.xml s390-virt.xml s390-virt-kvm.xml s390-gs.xml
 TARGET_LONG_BITS=64
 TARGET_NOT_USING_LEGACY_NATIVE_ENDIAN_API=y
+TARGET_NOT_USING_LEGACY_LDST_PHYS_API=y
-- 
2.53.0

[PULL v2 07/11] tests/functional/s390x: Add test for booting from a disk with 4k sectors

[Cornelia Huck]

From: Thomas Huth <thuth@redhat.com>

The DASD disks on s390x have a different sector size (4k) and use
a different layout of the boot loader data compared to the usual
"SCSI"-style disks with 512 sectors that are used with most modern
guests. To make sure that there are no regressions with 4k disk
booting, add a test case that uses a disk image with these 4k sectors
and check that we can successfully show the boot menu and and load the
right kernel in all supported cases.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Message-ID: <20260323171423.112205-1-thuth@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 tests/functional/s390x/meson.build     |   1 +
 tests/functional/s390x/test_boot_4k.py | 138 +++++++++++++++++++++++++
 2 files changed, 139 insertions(+)
 create mode 100755 tests/functional/s390x/test_boot_4k.py

diff --git a/tests/functional/s390x/meson.build b/tests/functional/s390x/meson.build
index 0f03e1c9db8a..b065b666bc2e 100644
--- a/tests/functional/s390x/meson.build
+++ b/tests/functional/s390x/meson.build
@@ -10,6 +10,7 @@ tests_s390x_system_quick = [
 ]
 
 tests_s390x_system_thorough = [
+  'boot_4k',
   'ccw_virtio',
   'pxelinux',
   'replay',
diff --git a/tests/functional/s390x/test_boot_4k.py b/tests/functional/s390x/test_boot_4k.py
new file mode 100755
index 000000000000..965123ebd311
--- /dev/null
+++ b/tests/functional/s390x/test_boot_4k.py
@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Copyright 2026 Red Hat, Inc.
+#
+# Author:
+#  Thomas Huth <thuth@redhat.com>
+'''
+Functional test that boots from a (incomplete) disk with 4k sectors
+(DASD/ECKD geometry) and multiple kernels installed, so we can check
+the boot menu and various LOADPARM options.
+'''
+
+from qemu_test import QemuSystemTest, Asset, skipFlakyTest
+from qemu_test import wait_for_console_pattern
+
+
+class S390Boot4k(QemuSystemTest):
+
+    # This disk image has been taken from a DASD with 4k sectors.
+    # Note: It's incomplete (to keep it small), it contains just enough
+    # data for booting the kernels that are installed on the disk image
+    ASSET_DISK = Asset(
+        ('https://github.com/huth/qemu-paddock/raw/refs/heads/main/s390x/'
+         'f32-4k-bootmenu.raw.xz'),
+        'f4e2c91b4ec50a4756e8816b7a7c8ca01cc0d929f7a711cfd8124640c304ea41')
+
+    def wait_for_pattern(self, success_message, vm=None):
+        wait_for_console_pattern(self, success_message, vm=vm,
+                                 failure_message='panic')
+
+    def basic_machine_setup(self):
+        self.set_machine('s390-ccw-virtio')
+        disk_path = self.uncompress(self.ASSET_DISK, format="xz")
+
+        self.vm.set_console()
+        self.vm.add_args("-nographic", "-no-shutdown", "-blockdev",
+                         f"driver=file,filename={disk_path},node-name=d1")
+
+    def test_default(self):
+        '''
+        Check that the default kernel boots up correctly from a ccw device
+        '''
+        self.basic_machine_setup()
+        self.vm.add_args("-device", "virtio-blk-ccw,drive=d1")
+        self.vm.launch()
+        self.wait_for_pattern("Linux version 5.8.15-301.fc33.s390x")
+        self.wait_for_pattern("Trying to unpack rootfs image as initramfs")
+
+    def test_loadparm_machine(self):
+        '''
+        Check that we can select a kernel via "-machine loadparm=..."
+        '''
+        self.basic_machine_setup()
+        self.vm.add_args("-device", "virtio-blk-ccw,drive=d1",
+                         "-machine", "loadparm=2")
+        self.vm.launch()
+        self.wait_for_pattern("Linux version 5.6.6-300.fc32.s390x")
+
+    def test_loadparm_device(self):
+        '''
+        Check that we can select a kernel via  "-device ...,loadparm=..."
+        '''
+        self.basic_machine_setup()
+        self.vm.add_args("-device",
+                         "virtio-blk-ccw,drive=d1,bootindex=1,loadparm=3")
+        self.vm.launch()
+        self.wait_for_pattern("Linux version 5.6.6-300.fc32.s390x")
+
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/work_items/3350")
+    def test_loadparm_pci(self):
+        '''
+        Check that we can select a kernel via  "-device ...-pci,loadparm=..."
+        '''
+        self.require_device('virtio-blk-pci')
+        self.basic_machine_setup()
+        self.vm.add_args("-device",
+                         "virtio-blk-pci,drive=d1,bootindex=1,loadparm=2")
+        self.vm.launch()
+        self.wait_for_pattern("Linux version 5.6.6-300.fc32.s390x")
+
+    def test_scsi_default(self):
+        '''
+        Check that we can boot via SCSI, too (need to set logical block size
+        here to avoid that the auto-detection in the bios fails)
+        '''
+        self.basic_machine_setup()
+        self.vm.add_args("-device", "virtio-scsi", "-device",
+            "scsi-hd,drive=d1,physical_block_size=4096,logical_block_size=4096")
+        self.vm.launch()
+        self.wait_for_pattern("Linux version 5.8.15-301.fc33.s390x")
+
+    def test_scsi_loadparm(self):
+        '''
+        Check that we can boot via SCSI with loadparm
+        '''
+        self.basic_machine_setup()
+        self.vm.add_args("-device", "virtio-scsi", "-device",
+                         ("scsi-hd,drive=d1,bootindex=1,loadparm=3,"
+                          "physical_block_size=4096,logical_block_size=4096"))
+        self.vm.launch()
+        self.wait_for_pattern("Linux version 5.6.6-300.fc32.s390x")
+
+    def test_menu(self):
+        '''
+        Check that boot menu shows up correctly
+        '''
+        self.basic_machine_setup()
+        self.vm.add_args("-device", "virtio-blk-ccw,drive=d1,bootindex=1",
+                         "-boot", "menu=on")
+        self.vm.launch()
+        self.wait_for_pattern("1. Fedora (5.8.15-301.fc33.s390x) 33")
+        self.wait_for_pattern("2. Fedora (5.6.6-300.fc32.s390x) 32")
+        self.wait_for_pattern("3. Fedora (0-rescue-b7218f0092704c5a9")
+        self.wait_for_pattern("Please choose:")
+        # For some unknown reason, sending a key to the bios does not work
+        # in the testing framework yet:
+        # exec_command_and_wait_for_pattern(self, '2',
+        #                              "Linux version 5.6.6-300.fc32.s390x")
+
+    def test_menu_timeout(self):
+        '''
+        Check that boot menu shows up and boot continues automatically
+        when a timeout has been specified
+        '''
+        self.basic_machine_setup()
+        self.vm.add_args("-device", "virtio-blk-ccw,drive=d1,bootindex=1",
+                         "-boot", "menu=on,splash-time=1")
+        self.vm.launch()
+        self.wait_for_pattern("s390-ccw zIPL Boot Menu")
+        self.wait_for_pattern("0. default (Fedora (5.8.15-301.fc33.s390x)")
+        self.wait_for_pattern("(default will boot in 0 seconds)")
+        self.wait_for_pattern("Linux version 5.8.15-301.fc33.s390x")
+
+
+if __name__ == '__main__':
+    QemuSystemTest.main()
-- 
2.53.0

[PULL v2 08/11] target/s390x: Prefer MO_128 definition over magic value

[Cornelia Huck]

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The MO_128 definition was not existing when commit 6d841663be8
("s390x/tcg: Implement VECTOR GATHER ELEMENT") introduced the
ES_128 definition. It was added 2 years later in commit 4b473e0c60d
("tcg: Expand MO_SIZE to 3 bits"). Since it is now available,
replace the magic '4' by the more explicit 'MO_128'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Message-ID: <20260415220358.93063-1-philmd@linaro.org>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 target/s390x/tcg/translate_vx.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/s390x/tcg/translate_vx.c.inc b/target/s390x/tcg/translate_vx.c.inc
index b53e9e526391..447641df25c0 100644
--- a/target/s390x/tcg/translate_vx.c.inc
+++ b/target/s390x/tcg/translate_vx.c.inc
@@ -50,7 +50,7 @@
 #define ES_16   MO_16
 #define ES_32   MO_32
 #define ES_64   MO_64
-#define ES_128  4
+#define ES_128  MO_128
 
 /* Floating-Point Format */
 #define FPF_SHORT       2
-- 
2.53.0

[PULL v2 09/11] MAINTAINERS: Update s390 trees

[Cornelia Huck]

From: Eric Farman <farman@linux.ibm.com>

Move Cornelia's git tree from virtio-ccw to the overall
s390 architecture group, since all the subgroups funnel
up through that.

Remove Christian's tree from the subgroups, since they are
not specified consistently across areas but also haven't
been used in ~6 years.

Signed-off-by: Eric Farman <farman@linux.ibm.com>
Acked-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Message-ID: <20260417152236.1305333-2-farman@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 MAINTAINERS | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index e41f0eb92cfd..39618d89b6f1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -126,6 +126,7 @@ F: docs/system/target-s390x.rst
 F: docs/system/s390x/
 F: tests/qtest/migration/s390x/
 K: ^Subject:.*(?i)s390x?
+T: git https://gitlab.com/cohuck/qemu.git s390-next
 L: qemu-s390x@nongnu.org
 
 MIPS general architecture support
@@ -500,7 +501,6 @@ F: target/s390x/kvm/
 F: target/s390x/machine.c
 F: target/s390x/sigp.c
 F: gdbstub/gdb-xml/s390*.xml
-T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
 
 X86 KVM CPUs
@@ -1863,7 +1863,6 @@ F: hw/s390x/
 F: include/hw/s390x/
 F: configs/devices/s390x-softmmu/default.mak
 F: tests/functional/s390x
-T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
 
 S390-ccw boot
@@ -1877,7 +1876,6 @@ F: pc-bios/s390-ccw/
 F: pc-bios/s390-ccw.img
 F: docs/devel/s390-dasd-ipl.rst
 F: tests/functional/s390x/test_pxelinux.py
-T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
 
 S390 PCI
@@ -2464,8 +2462,6 @@ M: Eric Farman <farman@linux.ibm.com>
 S: Supported
 F: hw/s390x/virtio-ccw*.[hc]
 F: hw/s390x/vhost-*-ccw.c
-T: git https://gitlab.com/cohuck/qemu.git s390-next
-T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
 
 virtio-dmabuf
-- 
2.53.0

[PULL v2 10/11] hw/s390x/ccw: Disable legacy virtio-pci by default (v11.1+)

[Cornelia Huck]

From: Jaehoon Kim <jhkim@linux.ibm.com>

On the s390 Linux kernel, IO_SPACE_LIMIT has been 0 since the initial
zPCI implementation (commit cd24834130ac "s390/pci: base support"),
making I/O BARs unusable.

However, when virtio-pci devices operate in transitional mode, QEMU
unconditionally exposes the legacy interface via BAR0. This results in
firmware warnings during PCI enumeration, such as:

  pci 0005:00:00.0: [Firmware Bug]: BAR 0: invalid; can't size

even though BAR0 is never usable on the s390 kernel.

Close this gap by disabling legacy virtio-pci support starting from
machine version 11.1. This effectively makes virtio-pci devices
non-transitional and prevents the creation of the unusable legacy I/O
BAR.

This introduces s390x-specific global compatibility properties that
set disable-legacy=on as the default for virtio-pci devices. Machine
versions v11.0 and earlier set disable-legacy=off to maintain their
original default behavior (legacy support enabled), ensuring VMs
created with those versions continue to work identically.

Users can override the default on the command line if needed:
  - On v11.1+: -global virtio-pci.disable-legacy=off (to enable legacy)
  - On v11.0-: -global virtio-pci.disable-legacy=on (to disable legacy)

Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com>
Reviewed-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Tested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260420144759.2970726-2-jhkim@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index cc768daeb04c..4d35f9b10bcc 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -788,6 +788,21 @@ static void machine_set_loadparm(Object *obj, Visitor *v,
     g_free(val);
 }
 
+ /*
+  * S390x-specific global compatibility properties.
+  *
+  * On the s390 kernel, legacy virtio-pci is not usable because I/O BARs
+  * are not supported (IO_SPACE_LIMIT is 0), and would only result in
+  * unusable BARs and firmware warnings.
+  *
+  * Therefore, starting from v11.1, disable legacy virtio-pci by default,
+  * while older machine types keep legacy behavior for compatibility.
+  */
+static GlobalProperty hw_compat_s390x[] = {
+    { TYPE_VIRTIO_PCI, "disable-legacy", "on", .optional = true},
+};
+static const size_t hw_compat_s390x_len = G_N_ELEMENTS(hw_compat_s390x);
+
 static void ccw_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -878,6 +893,9 @@ static const TypeInfo ccw_machine_info = {
         const void *data)                                                     \
     {                                                                         \
         MachineClass *mc = MACHINE_CLASS(oc);                                 \
+        /* Apply global s390x-wide default properties */                      \
+        compat_props_add(mc->compat_props, hw_compat_s390x,                   \
+                         hw_compat_s390x_len);                                \
         MACHINE_VER_SYM(class_options, ccw, __VA_ARGS__)(mc);                 \
         mc->desc = "Virtual s390x machine (version " MACHINE_VER_STR(__VA_ARGS__) ")"; \
         mc->init = MACHINE_VER_SYM(mach_init, ccw, __VA_ARGS__);              \
@@ -923,7 +941,15 @@ static void ccw_machine_11_0_instance_options(MachineState *machine)
 
 static void ccw_machine_11_0_class_options(MachineClass *mc)
 {
+    /*
+     * Preserve v11.0 and older version behavior:
+     * keep legacy virtio-pci enabled.
+     */
+    static GlobalProperty compat[] = {
+        { TYPE_VIRTIO_PCI, "disable-legacy", "off" },
+    };
     ccw_machine_11_1_class_options(mc);
+    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
     compat_props_add(mc->compat_props, hw_compat_11_0, hw_compat_11_0_len);
 }
 DEFINE_CCW_MACHINE(11, 0);
-- 
2.53.0

[PULL v2 11/11] tests/functional/s390x: Update expected virtio-pci IDs

[Cornelia Huck]

From: Matthew Rosato <mjrosato@linux.ibm.com>

Now that legacy virtio-pci is disabled by default for s390x, adjust
existing testcases to look for appropriate device IDs.

Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20260424132703.833249-1-mjrosato@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 tests/functional/s390x/test_ccw_virtio.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/functional/s390x/test_ccw_virtio.py b/tests/functional/s390x/test_ccw_virtio.py
index 045533785670..1d4958bbe293 100755
--- a/tests/functional/s390x/test_ccw_virtio.py
+++ b/tests/functional/s390x/test_ccw_virtio.py
@@ -136,7 +136,7 @@ def test_s390x_devices(self):
                     r'0x1af4')
         exec_command_and_wait_for_pattern(self,
                     r'cat /sys/bus/pci/devices/0005\:00\:00.0/subsystem_device',
-                    r'0x0001')
+                    r'0x1100')
         # check fid propagation
         exec_command_and_wait_for_pattern(self,
                     r'cat /sys/bus/pci/devices/000a\:00\:00.0/function_id',
@@ -203,7 +203,7 @@ def test_s390x_fedora(self):
                         'while ! (dmesg | grep enP7p0s0) ; do sleep 1 ; done',
                         'virtio_net virtio0 enP7p0s0: renamed')
         exec_command_and_wait_for_pattern(self, 'lspci',
-                             '0007:00:00.0 Class 0200: Device 1af4:1000')
+                             '0007:00:00.0 Class 0200: Device 1af4:1041')
         exec_command_and_wait_for_pattern(self,
                              'cat /sys/class/net/enP7p0s0/address',
                              '02:ca:fe:fa:ce:12')
-- 
2.53.0

Re: [PULL v2 00/11] First batch of s390x updates for 11.1

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]