* [PATCH v2 1/2] KVM: s390: fix ESSA addressing exception injection in migration mode
2026-10-15 10:48 [PATCH v2 0/2] KVM: s390: fix ESSA addressing exception injection in migration mode Gautam Gala
@ 2026-10-15 10:48 ` Gautam Gala
2026-10-15 10:59 ` sashiko-bot
2026-10-15 10:48 ` [PATCH v2 2/2] KVM: s390: selftests: add ESSA migration mode PGM_ADDRESSING regression test Gautam Gala
2026-10-15 10:56 ` [PATCH v2 0/2] KVM: s390: fix ESSA addressing exception injection in migration mode Claudio Imbrenda
2 siblings, 1 reply; 6+ messages in thread
From: Gautam Gala @ 2026-10-15 10:48 UTC (permalink / raw)
To: borntraeger, imbrenda, kvm, linux-s390, linux-kernel,
linux-kselftest
Cc: frankja, david, hca, gor, agordeev, svens, pbonzini, seanjc,
shuah
__do_essa() treated any negative return from dat_perform_essa() as the
normal "no CBRL entry appended" case and returned 0, so a page-table
walk failure silently dropped the addressing exception.
Return -PGM_ADDRESSING on a walk failure and inject the program
interrupt in __do_essa() for the -PGM_ADDRESSING return value.
DAT_WALK_ANY is required in the dat_entry_walk() call so that a GFN
backed by a large page (segment or region entry) does not return an
error: the walk stops early but succeeds, leaving ptep as NULL, which is
already handled by the existing "set exception state, return -1" path.
Without DAT_WALK_ANY such addresses would fall through to the new error
path and incorrectly inject PGM_ADDRESSING.
Fixes: e38c884df921 ("KVM: s390: Switch to new gmap")
Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Suggested-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Gautam Gala <ggala@linux.ibm.com>
---
arch/s390/kvm/gmap/dat.c | 5 ++++-
arch/s390/kvm/s390/priv.c | 2 ++
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/s390/kvm/gmap/dat.c b/arch/s390/kvm/gmap/dat.c
index ff80d02c9f56..a2031aece4ed 100644
--- a/arch/s390/kvm/gmap/dat.c
+++ b/arch/s390/kvm/gmap/dat.c
@@ -1084,6 +1084,7 @@ int dat_set_prefix_notif_bit(union asce asce, gfn_t gfn)
* * %1 if the page state has been altered and the page is to be added to the CBRL
* * %0 if the page state has been altered, but the page is not to be added to the CBRL
* * %-1 if the page state has not been altered and the page is not to be added to the CBRL
+ * * %PGM_ADDRESSING if the guest page-table walk failed
*/
int dat_perform_essa(union asce asce, gfn_t gfn, int orc, union essa_state *state, bool *dirty)
{
@@ -1092,7 +1093,9 @@ int dat_perform_essa(union asce asce, gfn_t gfn, int orc, union essa_state *stat
union pte *ptep;
int res = 0;
- if (dat_entry_walk(NULL, gfn, asce, 0, TABLE_TYPE_PAGE_TABLE, &crstep, &ptep)) {
+ if (dat_entry_walk(NULL, gfn, asce, DAT_WALK_ANY, TABLE_TYPE_PAGE_TABLE, &crstep, &ptep))
+ return PGM_ADDRESSING;
+ if (!ptep) {
*state = (union essa_state) { .exception = 1 };
return -1;
}
diff --git a/arch/s390/kvm/s390/priv.c b/arch/s390/kvm/s390/priv.c
index b3cb2c2c3aa7..9089b8f5d550 100644
--- a/arch/s390/kvm/s390/priv.c
+++ b/arch/s390/kvm/s390/priv.c
@@ -1168,6 +1168,8 @@ static inline int __do_essa(struct kvm_vcpu *vcpu, const int orc)
entries = (vcpu->arch.sie_block->cbrlo & ~PAGE_MASK) >> 3;
nappended = dat_perform_essa(vcpu->arch.gmap->asce, gfn, orc, &state, &dirtied);
+ if (nappended == PGM_ADDRESSING)
+ return kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
vcpu->run->s.regs.gprs[r1] = state.val;
if (nappended < 0)
return 0;
--
2.55.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v2 1/2] KVM: s390: fix ESSA addressing exception injection in migration mode
2026-10-15 10:48 ` [PATCH v2 1/2] " Gautam Gala
@ 2026-10-15 10:59 ` sashiko-bot
0 siblings, 0 replies; 6+ messages in thread
From: sashiko-bot @ 2026-10-15 10:59 UTC (permalink / raw)
To: Gautam Gala, linux-s390
Cc: Heiko Carstens, Vasily Gorbik, Alexander Gordeev,
Christian Borntraeger
> __do_essa() treated any negative return from dat_perform_essa() as the
> normal "no CBRL entry appended" case and returned 0, so a page-table
> walk failure silently dropped the addressing exception.
>
> Return -PGM_ADDRESSING on a walk failure and inject the program
> interrupt in __do_essa() for the -PGM_ADDRESSING return value.
>
> DAT_WALK_ANY is required in the dat_entry_walk() call so that a GFN
> backed by a large page (segment or region entry) does not return an
> error: the walk stops early but succeeds, leaving ptep as NULL, which is
> already handled by the existing "set exception state, return -1" path.
> Without DAT_WALK_ANY such addresses would fall through to the new error
> path and incorrectly inject PGM_ADDRESSING.
>
> Fixes: e38c884df921 ("KVM: s390: Switch to new gmap")
> Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Suggested-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
> Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Signed-off-by: Gautam Gala <ggala@linux.ibm.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261015104822.77062-1-ggala@linux.ibm.com?part=1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2 2/2] KVM: s390: selftests: add ESSA migration mode PGM_ADDRESSING regression test
2026-10-15 10:48 [PATCH v2 0/2] KVM: s390: fix ESSA addressing exception injection in migration mode Gautam Gala
2026-10-15 10:48 ` [PATCH v2 1/2] " Gautam Gala
@ 2026-10-15 10:48 ` Gautam Gala
2026-10-15 10:54 ` sashiko-bot
2026-10-15 10:56 ` [PATCH v2 0/2] KVM: s390: fix ESSA addressing exception injection in migration mode Claudio Imbrenda
2 siblings, 1 reply; 6+ messages in thread
From: Gautam Gala @ 2026-10-15 10:48 UTC (permalink / raw)
To: borntraeger, imbrenda, kvm, linux-s390, linux-kernel,
linux-kselftest
Cc: frankja, david, hca, gor, agordeev, svens, pbonzini, seanjc,
shuah
Regression test for the bug where ESSA emulation in migration mode
silently dropped addressing exceptions instead of injecting
PGM_ADDRESSING into the guest.
The test is integrated into cmma_test alongside the existing CMMA
migration tests.
Signed-off-by: Gautam Gala <ggala@linux.ibm.com>
---
.../selftests/kvm/include/s390/processor.h | 7 ++
tools/testing/selftests/kvm/s390/cmma_test.c | 69 +++++++++++++++++++
2 files changed, 76 insertions(+)
diff --git a/tools/testing/selftests/kvm/include/s390/processor.h b/tools/testing/selftests/kvm/include/s390/processor.h
index 33fef6fd9617..d71df6784dad 100644
--- a/tools/testing/selftests/kvm/include/s390/processor.h
+++ b/tools/testing/selftests/kvm/include/s390/processor.h
@@ -26,6 +26,13 @@
#define PAGE_SIZE BIT_ULL(PAGE_SHIFT)
#define PAGE_MASK (~(PAGE_SIZE - 1))
+/* Program interruption codes */
+#define PGM_ADDRESSING 0x05
+
+/* Lowcore offsets */
+#define __LC_PGM_INT_CODE 0x8e
+#define __LC_PGM_NEW_PSW 0x1d0
+
/* Is there a portable way to do this? */
static inline void cpu_relax(void)
{
diff --git a/tools/testing/selftests/kvm/s390/cmma_test.c b/tools/testing/selftests/kvm/s390/cmma_test.c
index 15d81b2ed7ad..0899fa971dcb 100644
--- a/tools/testing/selftests/kvm/s390/cmma_test.c
+++ b/tools/testing/selftests/kvm/s390/cmma_test.c
@@ -18,6 +18,9 @@
#include "kselftest.h"
#include "ucall_common.h"
#include "processor.h"
+#include "sie.h"
+
+#define UNMAPPED_GFN 0xffff000UL
#define MAIN_PAGE_COUNT 512
@@ -651,6 +654,71 @@ static void test_get_skip_holes(void)
assert_no_pages_cmma_dirty(vm);
}
+static void pgm_handler_c(void)
+{
+ uint16_t pgm_code;
+
+ memcpy(&pgm_code, (void *)__LC_PGM_INT_CODE, sizeof(pgm_code));
+ GUEST_SYNC(pgm_code);
+ for (;;)
+ ;
+}
+
+static void guest_essa_unmapped(void)
+{
+ unsigned long addr = UNMAPPED_GFN << PAGE_SHIFT;
+
+ asm volatile(
+ " lg 2,%[addr]\n"
+ /* ESSA r1,r2,orc=1 */
+ " .insn rrf,0xb9ab0000,1,2,1,0\n"
+ :
+ : [addr] "Q"(addr)
+ : "r1", "r2", "cc", "memory"
+ );
+
+ GUEST_SYNC(0);
+}
+
+static void test_essa_migration_pgm(void)
+{
+ struct kvm_vcpu *vcpu;
+ struct kvm_vm *vm;
+ struct ucall uc;
+ char *lowcore;
+ u64 pgm_psw[2] = {};
+
+ vm = __vm_create(VM_SHAPE_DEFAULT, 1, 0);
+
+ enable_cmma(vm);
+
+ vcpu = vm_vcpu_add(vm, 0, guest_essa_unmapped);
+
+ /* The guest runs with DAT on; map the lowcore so the handler can read it. */
+ virt_map(vm, 0, 0, 1);
+
+ lowcore = addr_gpa2hva(vm, 0);
+ pgm_psw[0] = vcpu->run->psw_mask;
+ pgm_psw[1] = (u64)pgm_handler_c;
+ memcpy(lowcore + __LC_PGM_NEW_PSW, pgm_psw, 16);
+
+ vm_mem_region_set_flags(vm, 0, KVM_MEM_LOG_DIRTY_PAGES);
+ enable_migration_mode(vm);
+
+ vcpu_run(vcpu);
+
+ TEST_ASSERT_EQ(vcpu->run->exit_reason, KVM_EXIT_S390_SIEIC);
+ TEST_ASSERT_EQ(vcpu->run->s390_sieic.icptcode, ICPT_INST);
+ TEST_ASSERT_EQ(vcpu->run->s390_sieic.ipa & 0xff00, 0x8300); /* DIAG */
+ TEST_ASSERT_EQ(vcpu->run->s390_sieic.ipb >> 16, 0x501);
+
+ get_ucall(vcpu, &uc);
+ TEST_ASSERT_EQ(uc.cmd, UCALL_SYNC);
+ TEST_ASSERT_EQ(uc.args[1], PGM_ADDRESSING);
+
+ kvm_vm_free(vm);
+}
+
struct testdef {
const char *name;
void (*test)(void);
@@ -659,6 +727,7 @@ struct testdef {
{ "GET_CMMA_BITS: basic calls", test_get_cmma_basic },
{ "GET_CMMA_BITS: all pages are dirty initially", test_get_initial_dirty },
{ "GET_CMMA_BITS: holes are skipped", test_get_skip_holes },
+ { "ESSA migration mode: PGM_ADDRESSING injected on unmapped GFN", test_essa_migration_pgm },
};
/**
--
2.55.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v2 0/2] KVM: s390: fix ESSA addressing exception injection in migration mode
2026-10-15 10:48 [PATCH v2 0/2] KVM: s390: fix ESSA addressing exception injection in migration mode Gautam Gala
2026-10-15 10:48 ` [PATCH v2 1/2] " Gautam Gala
2026-10-15 10:48 ` [PATCH v2 2/2] KVM: s390: selftests: add ESSA migration mode PGM_ADDRESSING regression test Gautam Gala
@ 2026-10-15 10:56 ` Claudio Imbrenda
2 siblings, 0 replies; 6+ messages in thread
From: Claudio Imbrenda @ 2026-10-15 10:56 UTC (permalink / raw)
To: Gautam Gala
Cc: borntraeger, kvm, linux-s390, linux-kernel, linux-kselftest,
frankja, david, hca, gor, agordeev, svens, pbonzini, seanjc,
shuah
On Thu, 15 Oct 2026 12:48:20 +0200
Gautam Gala <ggala@linux.ibm.com> wrote:
> ESSA emulation in migration mode silently dropped addressing exceptions
> when the guest page-table walk failed, so the guest never received the
> expected PGM_ADDRESSING interrupt during live migration.
>
> Patch 1 fixes dat_perform_essa() to return PGM_ADDRESSING on a walk
> failure, and __do_essa() to inject the program interrupt when it sees
> that return value.
>
> Patch 2 adds a regression test integrated into the existing cmma_test
> selftest.
Whole series:
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
>
> Changes since v1:
> - dat_perform_essa() now returns +PGM_ADDRESSING instead of
> -PGM_ADDRESSING; kvm_s390_inject_program_int() takes an unsigned u16
> so passing -5 would have wrapped to 0xFFFB and injected a bogus PIC.
> __do_essa() comparison and inject call updated accordingly. The
> kernel-doc return-value entry is corrected to %PGM_ADDRESSING.
> - Selftest: pgm_handler_c() now reads the actual PIC from lowcore
> (__LC_PGM_INT_CODE) instead of hard-coding PGM_ADDRESSING, so the
> test would have caught the sign error above had it been in v1.
> - Selftest: virt_map(vm, 0, 0, 1) added so the DAT-on guest can
> access the lowcore to read the PIC.
> - Selftest: PGM_ADDRESSING, __LC_PGM_INT_CODE and __LC_PGM_NEW_PSW
> constants moved to the shared s390/processor.h header.
> - Selftest: SIGALRM/alarm() timeout wrapper removed.
>
> Gautam Gala (2):
> KVM: s390: fix ESSA addressing exception injection in migration mode
> KVM: s390: selftests: add ESSA migration mode PGM_ADDRESSING
> regression test
>
> arch/s390/kvm/gmap/dat.c | 5 +-
> arch/s390/kvm/s390/priv.c | 2 +
> .../selftests/kvm/include/s390/processor.h | 7 ++
> tools/testing/selftests/kvm/s390/cmma_test.c | 69 +++++++++++++++++++
> 4 files changed, 82 insertions(+), 1 deletion(-)
>
^ permalink raw reply [flat|nested] 6+ messages in thread