[PATCH v2 0/2] KVM: s390: fix ESSA addressing exception injection in migration mode

[PATCH v2 0/2] KVM: s390: fix ESSA addressing exception injection in migration mode

[Gautam Gala]

ESSA emulation in migration mode silently dropped addressing exceptions
when the guest page-table walk failed, so the guest never received the
expected PGM_ADDRESSING interrupt during live migration.

Patch 1 fixes dat_perform_essa() to return PGM_ADDRESSING on a walk 
failure, and __do_essa() to inject the program interrupt when it sees 
that return value.

Patch 2 adds a regression test integrated into the existing cmma_test
selftest.

Changes since v1:
 - dat_perform_essa() now returns +PGM_ADDRESSING instead of
   -PGM_ADDRESSING; kvm_s390_inject_program_int() takes an unsigned u16
   so passing -5 would have wrapped to 0xFFFB and injected a bogus PIC.
   __do_essa() comparison and inject call updated accordingly. The
   kernel-doc return-value entry is corrected to %PGM_ADDRESSING.
 - Selftest: pgm_handler_c() now reads the actual PIC from lowcore
   (__LC_PGM_INT_CODE) instead of hard-coding PGM_ADDRESSING, so the
   test would have caught the sign error above had it been in v1.
 - Selftest: virt_map(vm, 0, 0, 1) added so the DAT-on guest can
   access the lowcore to read the PIC.
 - Selftest: PGM_ADDRESSING, __LC_PGM_INT_CODE and __LC_PGM_NEW_PSW
   constants moved to the shared s390/processor.h header.
 - Selftest: SIGALRM/alarm() timeout wrapper removed.

Gautam Gala (2):
  KVM: s390: fix ESSA addressing exception injection in migration mode
  KVM: s390: selftests: add ESSA migration mode PGM_ADDRESSING
    regression test

 arch/s390/kvm/gmap/dat.c                      |  5 +-
 arch/s390/kvm/s390/priv.c                     |  2 +
 .../selftests/kvm/include/s390/processor.h    |  7 ++
 tools/testing/selftests/kvm/s390/cmma_test.c  | 69 +++++++++++++++++++
 4 files changed, 82 insertions(+), 1 deletion(-)

-- 
2.55.0

[PATCH v2 1/2] KVM: s390: fix ESSA addressing exception injection in migration mode

[Gautam Gala]

__do_essa() treated any negative return from dat_perform_essa() as the
normal "no CBRL entry appended" case and returned 0, so a page-table
walk failure silently dropped the addressing exception.

Return -PGM_ADDRESSING on a walk failure and inject the program
interrupt in __do_essa() for the -PGM_ADDRESSING return value.

DAT_WALK_ANY is required in the dat_entry_walk() call so that a GFN
backed by a large page (segment or region entry) does not return an
error: the walk stops early but succeeds, leaving ptep as NULL, which is
already handled by the existing "set exception state, return -1" path.
Without DAT_WALK_ANY such addresses would fall through to the new error
path and incorrectly inject PGM_ADDRESSING.

Fixes: e38c884df921 ("KVM: s390: Switch to new gmap")
Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Suggested-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Gautam Gala <ggala@linux.ibm.com>
---
 arch/s390/kvm/gmap/dat.c  | 5 ++++-
 arch/s390/kvm/s390/priv.c | 2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/arch/s390/kvm/gmap/dat.c b/arch/s390/kvm/gmap/dat.c
index ff80d02c9f56..a2031aece4ed 100644
--- a/arch/s390/kvm/gmap/dat.c
+++ b/arch/s390/kvm/gmap/dat.c
@@ -1084,6 +1084,7 @@ int dat_set_prefix_notif_bit(union asce asce, gfn_t gfn)
  * * %1 if the page state has been altered and the page is to be added to the CBRL
  * * %0 if the page state has been altered, but the page is not to be added to the CBRL
  * * %-1 if the page state has not been altered and the page is not to be added to the CBRL
+ * * %PGM_ADDRESSING if the guest page-table walk failed
  */
 int dat_perform_essa(union asce asce, gfn_t gfn, int orc, union essa_state *state, bool *dirty)
 {
@@ -1092,7 +1093,9 @@ int dat_perform_essa(union asce asce, gfn_t gfn, int orc, union essa_state *stat
 	union pte *ptep;
 	int res = 0;
 
-	if (dat_entry_walk(NULL, gfn, asce, 0, TABLE_TYPE_PAGE_TABLE, &crstep, &ptep)) {
+	if (dat_entry_walk(NULL, gfn, asce, DAT_WALK_ANY, TABLE_TYPE_PAGE_TABLE, &crstep, &ptep))
+		return PGM_ADDRESSING;
+	if (!ptep) {
 		*state = (union essa_state) { .exception = 1 };
 		return -1;
 	}
diff --git a/arch/s390/kvm/s390/priv.c b/arch/s390/kvm/s390/priv.c
index b3cb2c2c3aa7..9089b8f5d550 100644
--- a/arch/s390/kvm/s390/priv.c
+++ b/arch/s390/kvm/s390/priv.c
@@ -1168,6 +1168,8 @@ static inline int __do_essa(struct kvm_vcpu *vcpu, const int orc)
 	entries = (vcpu->arch.sie_block->cbrlo & ~PAGE_MASK) >> 3;
 
 	nappended = dat_perform_essa(vcpu->arch.gmap->asce, gfn, orc, &state, &dirtied);
+	if (nappended == PGM_ADDRESSING)
+		return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
 	vcpu->run->s.regs.gprs[r1] = state.val;
 	if (nappended < 0)
 		return 0;
-- 
2.55.0

[PATCH v2 2/2] KVM: s390: selftests: add ESSA migration mode PGM_ADDRESSING regression test

[Gautam Gala]

Regression test for the bug where ESSA emulation in migration mode
silently dropped addressing exceptions instead of injecting
PGM_ADDRESSING into the guest.

The test is integrated into cmma_test alongside the existing CMMA
migration tests.

Signed-off-by: Gautam Gala <ggala@linux.ibm.com>
---
 .../selftests/kvm/include/s390/processor.h    |  7 ++
 tools/testing/selftests/kvm/s390/cmma_test.c  | 69 +++++++++++++++++++
 2 files changed, 76 insertions(+)

diff --git a/tools/testing/selftests/kvm/include/s390/processor.h b/tools/testing/selftests/kvm/include/s390/processor.h
index 33fef6fd9617..d71df6784dad 100644
--- a/tools/testing/selftests/kvm/include/s390/processor.h
+++ b/tools/testing/selftests/kvm/include/s390/processor.h
@@ -26,6 +26,13 @@
 #define PAGE_SIZE BIT_ULL(PAGE_SHIFT)
 #define PAGE_MASK (~(PAGE_SIZE - 1))
 
+/* Program interruption codes */
+#define PGM_ADDRESSING		0x05
+
+/* Lowcore offsets */
+#define __LC_PGM_INT_CODE	0x8e
+#define __LC_PGM_NEW_PSW	0x1d0
+
 /* Is there a portable way to do this? */
 static inline void cpu_relax(void)
 {
diff --git a/tools/testing/selftests/kvm/s390/cmma_test.c b/tools/testing/selftests/kvm/s390/cmma_test.c
index 15d81b2ed7ad..0899fa971dcb 100644
--- a/tools/testing/selftests/kvm/s390/cmma_test.c
+++ b/tools/testing/selftests/kvm/s390/cmma_test.c
@@ -18,6 +18,9 @@
 #include "kselftest.h"
 #include "ucall_common.h"
 #include "processor.h"
+#include "sie.h"
+
+#define UNMAPPED_GFN		0xffff000UL
 
 #define MAIN_PAGE_COUNT 512
 
@@ -651,6 +654,71 @@ static void test_get_skip_holes(void)
 	assert_no_pages_cmma_dirty(vm);
 }
 
+static void pgm_handler_c(void)
+{
+	uint16_t pgm_code;
+
+	memcpy(&pgm_code, (void *)__LC_PGM_INT_CODE, sizeof(pgm_code));
+	GUEST_SYNC(pgm_code);
+	for (;;)
+		;
+}
+
+static void guest_essa_unmapped(void)
+{
+	unsigned long addr = UNMAPPED_GFN << PAGE_SHIFT;
+
+	asm volatile(
+		"	lg   2,%[addr]\n"
+		/* ESSA r1,r2,orc=1 */
+		"	.insn rrf,0xb9ab0000,1,2,1,0\n"
+		:
+		: [addr] "Q"(addr)
+		: "r1", "r2", "cc", "memory"
+	);
+
+	GUEST_SYNC(0);
+}
+
+static void test_essa_migration_pgm(void)
+{
+	struct kvm_vcpu *vcpu;
+	struct kvm_vm *vm;
+	struct ucall uc;
+	char *lowcore;
+	u64 pgm_psw[2] = {};
+
+	vm = __vm_create(VM_SHAPE_DEFAULT, 1, 0);
+
+	enable_cmma(vm);
+
+	vcpu = vm_vcpu_add(vm, 0, guest_essa_unmapped);
+
+	/* The guest runs with DAT on; map the lowcore so the handler can read it. */
+	virt_map(vm, 0, 0, 1);
+
+	lowcore = addr_gpa2hva(vm, 0);
+	pgm_psw[0] = vcpu->run->psw_mask;
+	pgm_psw[1] = (u64)pgm_handler_c;
+	memcpy(lowcore + __LC_PGM_NEW_PSW, pgm_psw, 16);
+
+	vm_mem_region_set_flags(vm, 0, KVM_MEM_LOG_DIRTY_PAGES);
+	enable_migration_mode(vm);
+
+	vcpu_run(vcpu);
+
+	TEST_ASSERT_EQ(vcpu->run->exit_reason, KVM_EXIT_S390_SIEIC);
+	TEST_ASSERT_EQ(vcpu->run->s390_sieic.icptcode, ICPT_INST);
+	TEST_ASSERT_EQ(vcpu->run->s390_sieic.ipa & 0xff00, 0x8300);   /* DIAG */
+	TEST_ASSERT_EQ(vcpu->run->s390_sieic.ipb >> 16, 0x501);
+
+	get_ucall(vcpu, &uc);
+	TEST_ASSERT_EQ(uc.cmd, UCALL_SYNC);
+	TEST_ASSERT_EQ(uc.args[1], PGM_ADDRESSING);
+
+	kvm_vm_free(vm);
+}
+
 struct testdef {
 	const char *name;
 	void (*test)(void);
@@ -659,6 +727,7 @@ struct testdef {
 	{ "GET_CMMA_BITS: basic calls", test_get_cmma_basic },
 	{ "GET_CMMA_BITS: all pages are dirty initially", test_get_initial_dirty },
 	{ "GET_CMMA_BITS: holes are skipped", test_get_skip_holes },
+	{ "ESSA migration mode: PGM_ADDRESSING injected on unmapped GFN", test_essa_migration_pgm },
 };
 
 /**
-- 
2.55.0

Re: [PATCH v2 2/2] KVM: s390: selftests: add ESSA migration mode PGM_ADDRESSING regression test

[sashiko-bot]

> Regression test for the bug where ESSA emulation in migration mode
> silently dropped addressing exceptions instead of injecting
> PGM_ADDRESSING into the guest.
> 
> The test is integrated into cmma_test alongside the existing CMMA
> migration tests.
> 
> Signed-off-by: Gautam Gala <ggala@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015104822.77062-1-ggala@linux.ibm.com?part=2

Re: [PATCH v2 0/2] KVM: s390: fix ESSA addressing exception injection in migration mode

[Claudio Imbrenda]

On Thu, 15 Oct 2026 12:48:20 +0200
Gautam Gala <ggala@linux.ibm.com> wrote:

> ESSA emulation in migration mode silently dropped addressing exceptions
> when the guest page-table walk failed, so the guest never received the
> expected PGM_ADDRESSING interrupt during live migration.
> 
> Patch 1 fixes dat_perform_essa() to return PGM_ADDRESSING on a walk 
> failure, and __do_essa() to inject the program interrupt when it sees 
> that return value.
> 
> Patch 2 adds a regression test integrated into the existing cmma_test
> selftest.

Whole series:

Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>

> 
> Changes since v1:
>  - dat_perform_essa() now returns +PGM_ADDRESSING instead of
>    -PGM_ADDRESSING; kvm_s390_inject_program_int() takes an unsigned u16
>    so passing -5 would have wrapped to 0xFFFB and injected a bogus PIC.
>    __do_essa() comparison and inject call updated accordingly. The
>    kernel-doc return-value entry is corrected to %PGM_ADDRESSING.
>  - Selftest: pgm_handler_c() now reads the actual PIC from lowcore
>    (__LC_PGM_INT_CODE) instead of hard-coding PGM_ADDRESSING, so the
>    test would have caught the sign error above had it been in v1.
>  - Selftest: virt_map(vm, 0, 0, 1) added so the DAT-on guest can
>    access the lowcore to read the PIC.
>  - Selftest: PGM_ADDRESSING, __LC_PGM_INT_CODE and __LC_PGM_NEW_PSW
>    constants moved to the shared s390/processor.h header.
>  - Selftest: SIGALRM/alarm() timeout wrapper removed.
> 
> Gautam Gala (2):
>   KVM: s390: fix ESSA addressing exception injection in migration mode
>   KVM: s390: selftests: add ESSA migration mode PGM_ADDRESSING
>     regression test
> 
>  arch/s390/kvm/gmap/dat.c                      |  5 +-
>  arch/s390/kvm/s390/priv.c                     |  2 +
>  .../selftests/kvm/include/s390/processor.h    |  7 ++
>  tools/testing/selftests/kvm/s390/cmma_test.c  | 69 +++++++++++++++++++
>  4 files changed, 82 insertions(+), 1 deletion(-)
> 

Re: [PATCH v2 1/2] KVM: s390: fix ESSA addressing exception injection in migration mode

[sashiko-bot]

> __do_essa() treated any negative return from dat_perform_essa() as the
> normal "no CBRL entry appended" case and returned 0, so a page-table
> walk failure silently dropped the addressing exception.
> 
> Return -PGM_ADDRESSING on a walk failure and inject the program
> interrupt in __do_essa() for the -PGM_ADDRESSING return value.
> 
> DAT_WALK_ANY is required in the dat_entry_walk() call so that a GFN
> backed by a large page (segment or region entry) does not return an
> error: the walk stops early but succeeds, leaving ptep as NULL, which is
> already handled by the existing "set exception state, return -1" path.
> Without DAT_WALK_ANY such addresses would fall through to the new error
> path and incorrectly inject PGM_ADDRESSING.
> 
> Fixes: e38c884df921 ("KVM: s390: Switch to new gmap")
> Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Suggested-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
> Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Signed-off-by: Gautam Gala <ggala@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015104822.77062-1-ggala@linux.ibm.com?part=1