[PATCH 0/2] KVM: s390: Fix lpsw/e breaking event handling

[PATCH 0/2] KVM: s390: Fix lpsw/e breaking event handling

[Janosch Frank]

LPSW and LPSWE need to set the gbea on completion but currently don't.
Time to fix this up. LPSWEY was designed to not set the bear.

This is only ever problematic when a machine check is pending and the
guest hasn't opened the PSW machine check mask. In all other cases SIE
handles the BEAR. So impact is very low.

---
v2:
 - BEAR needs to be current psw address - ilen since code 04 is
   suppressing
 - Added simple test
---
Janosch Frank (2):
  KVM: s390: Fix lpsw/e breaking event handling
  KVM: s390: selftests: Add load psw bear test

 arch/s390/kvm/priv.c                     |   8 +-
 tools/testing/selftests/kvm/Makefile.kvm |   1 +
 tools/testing/selftests/kvm/s390/bear.c  | 184 +++++++++++++++++++++++
 3 files changed, 191 insertions(+), 2 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/s390/bear.c

-- 
2.51.0

[PATCH 1/2] KVM: s390: Fix lpsw/e breaking event handling

[Janosch Frank]

LPSW and LPSWE need to set the gbea on completion but currently don't.
Time to fix this up.

LPSWEY was designed to not set the bear.

Fixes: 48a3e950f4cee ("KVM: s390: Add support for machine checks.")
Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
---
 arch/s390/kvm/priv.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index a3250ad83a8e..cc0553da14cb 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -714,12 +714,13 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
 {
 	psw_t *gpsw = &vcpu->arch.sie_block->gpsw;
 	psw32_t new_psw;
-	u64 addr;
+	u64 addr, iaddr;
 	int rc;
 	u8 ar;
 
 	vcpu->stat.instruction_lpsw++;
 
+	iaddr = gpsw->addr - kvm_s390_get_ilen(vcpu);
 	if (gpsw->mask & PSW_MASK_PSTATE)
 		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
@@ -737,18 +738,20 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
 	gpsw->addr = new_psw.addr & ~PSW32_ADDR_AMODE;
 	if (!is_valid_psw(gpsw))
 		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+	vcpu->arch.sie_block->gbea = iaddr;
 	return 0;
 }
 
 static int handle_lpswe(struct kvm_vcpu *vcpu)
 {
 	psw_t new_psw;
-	u64 addr;
+	u64 addr, iaddr;
 	int rc;
 	u8 ar;
 
 	vcpu->stat.instruction_lpswe++;
 
+	iaddr = vcpu->arch.sie_block->gpsw.addr - kvm_s390_get_ilen(vcpu);
 	if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
 		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 
@@ -761,6 +764,7 @@ static int handle_lpswe(struct kvm_vcpu *vcpu)
 	vcpu->arch.sie_block->gpsw = new_psw;
 	if (!is_valid_psw(&vcpu->arch.sie_block->gpsw))
 		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+	vcpu->arch.sie_block->gbea = iaddr;
 	return 0;
 }
 
-- 
2.51.0

[PATCH 2/2] KVM: s390: selftests: Add load psw bear test

[Janosch Frank]

The bear is set for lpsw and lpswe but not for lpswey.

Load PSW and all of its variants are only emulated by KVM if there's a
pending machine check. Therefore the tests inject those but never open
the masks to receive them.

Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
---
 tools/testing/selftests/kvm/Makefile.kvm |   1 +
 tools/testing/selftests/kvm/s390/bear.c  | 184 +++++++++++++++++++++++
 2 files changed, 185 insertions(+)
 create mode 100644 tools/testing/selftests/kvm/s390/bear.c

diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selftests/kvm/Makefile.kvm
index 6471fa214a9f..9afb6479dbee 100644
--- a/tools/testing/selftests/kvm/Makefile.kvm
+++ b/tools/testing/selftests/kvm/Makefile.kvm
@@ -207,6 +207,7 @@ TEST_GEN_PROGS_s390 += s390/user_operexec
 TEST_GEN_PROGS_s390 += s390/keyop
 TEST_GEN_PROGS_s390 += rseq_test
 TEST_GEN_PROGS_s390 += s390/irq_routing
+TEST_GEN_PROGS_s390 += s390/bear
 
 TEST_GEN_PROGS_riscv = $(TEST_GEN_PROGS_COMMON)
 TEST_GEN_PROGS_riscv += riscv/sbi_pmu_test
diff --git a/tools/testing/selftests/kvm/s390/bear.c b/tools/testing/selftests/kvm/s390/bear.c
new file mode 100644
index 000000000000..fee4999532ae
--- /dev/null
+++ b/tools/testing/selftests/kvm/s390/bear.c
@@ -0,0 +1,184 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * LPSW(E|Y) bear tests.
+ * LPSW and LPSWE do set the bear but LPSWEY doesn't.
+ *
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+
+#include "test_util.h"
+#include "kvm_util.h"
+#include "kselftest.h"
+#include "ucall_common.h"
+#include "facility.h"
+
+static void guest_lpswey(void)
+{
+	extern void lpswey_dest_addr(void);
+	u64 psw[2] = {0x0400000180000000ULL, (uintptr_t)lpswey_dest_addr};
+	u64 bear;
+
+	asm volatile (
+		"	larl	%%r3,lpswey_addr\n"
+		"lpswey_addr:\n"
+		"	.insn	siy,0xeb0000000071,%[psw],0\n"
+		"       nop\n"
+		"       nop\n"
+		".globl lpswey_dest_addr \n"
+		"lpswey_dest_addr:\n"
+		"       .insn   s,0xb2010000,%[bear]\n"
+		"	lg	%%r4, %[bear]\n"
+		"       nop\n"
+		"       nop\n"
+		: [bear] "=Q" (bear)
+		: [psw] "T" (psw)
+		: "cc", "r3", "r4"
+		);
+}
+
+static void guest_lpswe(void)
+{
+	extern void lpswe_dest_addr(void);
+	u64 psw[2] = {0x0400000180000000ULL, (uintptr_t)lpswe_dest_addr};
+	u64 bear;
+
+	asm volatile (
+		"	larl	%%r3,lpswe_addr\n"
+		"lpswe_addr:\n"
+		"       lpswe    %[psw]\n"
+		"       nop\n"
+		"       nop\n"
+		".globl lpswe_dest_addr\n"
+		"lpswe_dest_addr:\n"
+		"       .insn   s,0xb2010000,%[bear]\n"
+		"	lg	%%r4, %[bear]\n"
+		"       nop\n"
+		"       nop\n"
+		: [bear] "=Q" (bear)
+		: [psw] "Q" (psw)
+		: "cc", "r3", "r4"
+		);
+}
+
+static void guest_lpsw(void)
+{
+	extern void lpsw_dest_addr(void);
+	u64 psw_short = (0x0400000180000000ULL | BIT(63 - 12) |
+			 (uintptr_t)lpsw_dest_addr);
+	u64 bear;
+
+	asm volatile (
+		"	larl	%%r3,lpsw_addr\n"
+		"lpsw_addr:\n"
+		"       lpsw    %[psw]\n"
+		"       nop\n"
+		"       nop\n"
+		".globl lpsw_dest_addr\n"
+		"lpsw_dest_addr:\n"
+		"       .insn   s,0xb2010000,%[bear]\n"
+		"	lg	%%r4, %[bear]\n"
+		"       nop\n"
+		"       nop\n"
+		: [bear] "=Q" (bear)
+		: [psw] "Q" (psw_short)
+		: "cc", "r3", "r4"
+		);
+}
+
+/* A machine check forces KVM to emulate PSW loading */
+static void inject_mcheck(struct kvm_vcpu *vcpu)
+{
+	struct kvm_s390_irq irq = {};
+	int irqs;
+
+	irq.type = KVM_S390_MCHK;
+	/* External damage mcheck */
+	irq.u.mchk.cr14 = BIT(63 - 38);
+	irq.u.mchk.mcic = BIT(58);
+	irqs = __vcpu_ioctl(vcpu, KVM_S390_IRQ, &irq);
+	TEST_ASSERT(irqs >= 0, "Error injecting MCHECK errno %d", errno);
+}
+
+static void test_lpswey(void)
+{
+	struct kvm_vcpu *vcpu;
+	struct kvm_run *run;
+	struct kvm_vm *vm;
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpswey);
+	inject_mcheck(vcpu);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] != run->s.regs.gprs[4],
+			 "emulation: lpswey bear does not match\n");
+	kvm_vm_free(vm);
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpswey);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] &&
+			 run->s.regs.gprs[3] != run->s.regs.gprs[4],
+			 "interpretation: lpswey bear does not match\n");
+	kvm_vm_free(vm);
+}
+
+static void test_lpswe(void)
+{
+	struct kvm_vcpu *vcpu;
+	struct kvm_run *run;
+	struct kvm_vm *vm;
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpswe);
+	inject_mcheck(vcpu);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "emulation: lpswe bear matches\n");
+	kvm_vm_free(vm);
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpsw);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] &&
+			 run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "interpretation: lpswe bear matches\n");
+	kvm_vm_free(vm);
+}
+
+static void test_lpsw(void)
+{
+	struct kvm_vcpu *vcpu;
+	struct kvm_run *run;
+	struct kvm_vm *vm;
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpsw);
+	inject_mcheck(vcpu);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "emulation: lpsw bear matches\n");
+	kvm_vm_free(vm);
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpsw);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] &&
+			 run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "interpretation: lpsw bear matches\n");
+	kvm_vm_free(vm);
+}
+
+int main(int argc, char *argv[])
+{
+	TEST_REQUIRE(test_facility(193));
+
+	ksft_print_header();
+	ksft_set_plan(6);
+	test_lpsw();
+	test_lpswe();
+	test_lpswey();
+	ksft_finished();
+}
-- 
2.51.0

Re: [PATCH 1/2] KVM: s390: Fix lpsw/e breaking event handling

[Christian Borntraeger]

Am 23.03.26 um 16:35 schrieb Janosch Frank:
> LPSW and LPSWE need to set the gbea on completion but currently don't.
> Time to fix this up.
> 
> LPSWEY was designed to not set the bear.
> 
> Fixes: 48a3e950f4cee ("KVM: s390: Add support for machine checks.")
> Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Signed-off-by: Janosch Frank <frankja@linux.ibm.com>

Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>

Re: [PATCH 2/2] KVM: s390: selftests: Add load psw bear test

[Christian Borntraeger]

Am 23.03.26 um 16:35 schrieb Janosch Frank:
> The bear is set for lpsw and lpswe but not for lpswey.
> 
> Load PSW and all of its variants are only emulated by KVM if there's a
> pending machine check. Therefore the tests inject those but never open
> the masks to receive them.
> 
> Signed-off-by: Janosch Frank <frankja@linux.ibm.com>



Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>

Re: [PATCH 2/2] KVM: s390: selftests: Add load psw bear test

[Christian Borntraeger]

Had a 2nd look.
Just wanted to test that lpswe does indeed leaves the BEAR unchanged and then I
realized that lpswey does not work in our guest due to missing cpu model.
So either remove the lpswey test for now or fix it.
Something like this on top

--- a/tools/testing/selftests/kvm/s390/bear.c
+++ b/tools/testing/selftests/kvm/s390/bear.c
@@ -22,7 +22,10 @@ static void guest_lpswey(void)
         u64 bear;
  
         asm volatile (
-               "       larl    %%r3,lpswey_addr\n"
+               "       larl    %%r3,jump_addr\n"
+               "jump_addr:\n"
+               "       j lpswey_addr\n"
+               "       nop\n"
                 "lpswey_addr:\n"
                 "       .insn   siy,0xeb0000000071,%[psw],0\n"
                 "       nop\n"
@@ -107,21 +110,30 @@ static void test_lpswey(void)
         struct kvm_vcpu *vcpu;
         struct kvm_run *run;
         struct kvm_vm *vm;
+       struct kvm_s390_vm_cpu_processor proc;
+       int r;
+
+       vm = vm_create(1);
+       __kvm_device_attr_get(vm->fd, KVM_S390_VM_CPU_MODEL,
+                                 KVM_S390_VM_CPU_PROCESSOR, &proc);
+       proc.fac_list[3] |= 0x4000000000000000UL;
+       r = __kvm_device_attr_set(vm->fd, KVM_S390_VM_CPU_MODEL,
+                                 KVM_S390_VM_CPU_PROCESSOR, &proc);
+       vcpu = vm_vcpu_add(vm, 0, guest_lpswey);
  
-       vm = vm_create_with_one_vcpu(&vcpu, guest_lpswey);
         inject_mcheck(vcpu);
         run = vcpu->run;
         vcpu_run(vcpu);
-       ksft_test_result(run->s.regs.gprs[3] != run->s.regs.gprs[4],
-                        "emulation: lpswey bear does not match\n");
+       ksft_test_result(run->s.regs.gprs[3] == run->s.regs.gprs[4],
+                        "emulation: lpswey bear does match previous\n");
         kvm_vm_free(vm);
  
         vm = vm_create_with_one_vcpu(&vcpu, guest_lpswey);
         run = vcpu->run;
         vcpu_run(vcpu);
         ksft_test_result(run->s.regs.gprs[3] &&
-                        run->s.regs.gprs[3] != run->s.regs.gprs[4],
-                        "interpretation: lpswey bear does not match\n");
+                        run->s.regs.gprs[3] == run->s.regs.gprs[4],
+                        "interpretation: lpswey bear does match previous\n");
         kvm_vm_free(vm);
  }
  

Re: [PATCH 1/2] KVM: s390: Fix lpsw/e breaking event handling

[Claudio Imbrenda]

On Mon, 23 Mar 2026 15:35:22 +0000
Janosch Frank <frankja@linux.ibm.com> wrote:

> LPSW and LPSWE need to set the gbea on completion but currently don't.
> Time to fix this up.
> 
> LPSWEY was designed to not set the bear.
> 
> Fixes: 48a3e950f4cee ("KVM: s390: Add support for machine checks.")
> Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Signed-off-by: Janosch Frank <frankja@linux.ibm.com>

Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>

> ---
>  arch/s390/kvm/priv.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
> index a3250ad83a8e..cc0553da14cb 100644
> --- a/arch/s390/kvm/priv.c
> +++ b/arch/s390/kvm/priv.c
> @@ -714,12 +714,13 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
>  {
>  	psw_t *gpsw = &vcpu->arch.sie_block->gpsw;
>  	psw32_t new_psw;
> -	u64 addr;
> +	u64 addr, iaddr;
>  	int rc;
>  	u8 ar;
>  
>  	vcpu->stat.instruction_lpsw++;
>  
> +	iaddr = gpsw->addr - kvm_s390_get_ilen(vcpu);
>  	if (gpsw->mask & PSW_MASK_PSTATE)
>  		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
>  
> @@ -737,18 +738,20 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
>  	gpsw->addr = new_psw.addr & ~PSW32_ADDR_AMODE;
>  	if (!is_valid_psw(gpsw))
>  		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
> +	vcpu->arch.sie_block->gbea = iaddr;
>  	return 0;
>  }
>  
>  static int handle_lpswe(struct kvm_vcpu *vcpu)
>  {
>  	psw_t new_psw;
> -	u64 addr;
> +	u64 addr, iaddr;
>  	int rc;
>  	u8 ar;
>  
>  	vcpu->stat.instruction_lpswe++;
>  
> +	iaddr = vcpu->arch.sie_block->gpsw.addr - kvm_s390_get_ilen(vcpu);
>  	if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE)
>  		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
>  
> @@ -761,6 +764,7 @@ static int handle_lpswe(struct kvm_vcpu *vcpu)
>  	vcpu->arch.sie_block->gpsw = new_psw;
>  	if (!is_valid_psw(&vcpu->arch.sie_block->gpsw))
>  		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
> +	vcpu->arch.sie_block->gbea = iaddr;
>  	return 0;
>  }
>  

Re: [PATCH 2/2] KVM: s390: selftests: Add load psw bear test

[Janosch Frank]

On 3/25/26 11:29, Christian Borntraeger wrote:
> Had a 2nd look.
> Just wanted to test that lpswe does indeed leaves the BEAR unchanged and then I
> realized that lpswey does not work in our guest due to missing cpu model.
> So either remove the lpswey test for now or fix it.
> Something like this on top

Yeah one additional problem is that a PGM during guest execution might 
easily be missed since there are no checks and guest execution currently 
actually ends with an operation exception as well.

I'll remove the lpswey test for this series and will try to come up with 
a fix for the PGM issue for 7.1 or 7.2.


> 
> --- a/tools/testing/selftests/kvm/s390/bear.c
> +++ b/tools/testing/selftests/kvm/s390/bear.c
> @@ -22,7 +22,10 @@ static void guest_lpswey(void)
>           u64 bear;
>    
>           asm volatile (
> -               "       larl    %%r3,lpswey_addr\n"
> +               "       larl    %%r3,jump_addr\n"
> +               "jump_addr:\n"
> +               "       j lpswey_addr\n"
> +               "       nop\n"
>                   "lpswey_addr:\n"
>                   "       .insn   siy,0xeb0000000071,%[psw],0\n"
>                   "       nop\n"
> @@ -107,21 +110,30 @@ static void test_lpswey(void)
>           struct kvm_vcpu *vcpu;
>           struct kvm_run *run;
>           struct kvm_vm *vm;
> +       struct kvm_s390_vm_cpu_processor proc;
> +       int r;
> +
> +       vm = vm_create(1);
> +       __kvm_device_attr_get(vm->fd, KVM_S390_VM_CPU_MODEL,
> +                                 KVM_S390_VM_CPU_PROCESSOR, &proc);
> +       proc.fac_list[3] |= 0x4000000000000000UL;
> +       r = __kvm_device_attr_set(vm->fd, KVM_S390_VM_CPU_MODEL,
> +                                 KVM_S390_VM_CPU_PROCESSOR, &proc);
> +       vcpu = vm_vcpu_add(vm, 0, guest_lpswey);
>    
> -       vm = vm_create_with_one_vcpu(&vcpu, guest_lpswey);
>           inject_mcheck(vcpu);
>           run = vcpu->run;
>           vcpu_run(vcpu);
> -       ksft_test_result(run->s.regs.gprs[3] != run->s.regs.gprs[4],
> -                        "emulation: lpswey bear does not match\n");
> +       ksft_test_result(run->s.regs.gprs[3] == run->s.regs.gprs[4],
> +                        "emulation: lpswey bear does match previous\n");
>           kvm_vm_free(vm);
>    
>           vm = vm_create_with_one_vcpu(&vcpu, guest_lpswey);
>           run = vcpu->run;
>           vcpu_run(vcpu);
>           ksft_test_result(run->s.regs.gprs[3] &&
> -                        run->s.regs.gprs[3] != run->s.regs.gprs[4],
> -                        "interpretation: lpswey bear does not match\n");
> +                        run->s.regs.gprs[3] == run->s.regs.gprs[4],
> +                        "interpretation: lpswey bear does match previous\n");
>           kvm_vm_free(vm);
>    }
>    
> 

[PATCH v2] KVM: s390: selftests: Add load psw bear test

[Janosch Frank]

The bear is set for lpsw and lpswe, so let's check that also happens
when kvm emulates these instructions.

Load PSW and all of its variants are only emulated by KVM if there's a
pending machine check. Therefore the tests inject those but never open
the masks to receive them.

Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
---
 tools/testing/selftests/kvm/Makefile.kvm |   1 +
 tools/testing/selftests/kvm/s390/bear.c  | 133 +++++++++++++++++++++++
 2 files changed, 134 insertions(+)
 create mode 100644 tools/testing/selftests/kvm/s390/bear.c

diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selftests/kvm/Makefile.kvm
index 6471fa214a9f..9afb6479dbee 100644
--- a/tools/testing/selftests/kvm/Makefile.kvm
+++ b/tools/testing/selftests/kvm/Makefile.kvm
@@ -207,6 +207,7 @@ TEST_GEN_PROGS_s390 += s390/user_operexec
 TEST_GEN_PROGS_s390 += s390/keyop
 TEST_GEN_PROGS_s390 += rseq_test
 TEST_GEN_PROGS_s390 += s390/irq_routing
+TEST_GEN_PROGS_s390 += s390/bear
 
 TEST_GEN_PROGS_riscv = $(TEST_GEN_PROGS_COMMON)
 TEST_GEN_PROGS_riscv += riscv/sbi_pmu_test
diff --git a/tools/testing/selftests/kvm/s390/bear.c b/tools/testing/selftests/kvm/s390/bear.c
new file mode 100644
index 000000000000..c7604176cf65
--- /dev/null
+++ b/tools/testing/selftests/kvm/s390/bear.c
@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* LPSW/E bear tests. */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+
+#include "test_util.h"
+#include "kvm_util.h"
+#include "kselftest.h"
+#include "ucall_common.h"
+#include "facility.h"
+#include "processor.h"
+
+static void guest_lpswe(void)
+{
+	extern void lpswe_dest_addr(void);
+	u64 psw[2] = {0x0400000180000000ULL, (uintptr_t)lpswe_dest_addr};
+	u64 bear;
+
+	asm volatile (
+		"	larl	%%r3,lpswe_addr\n"
+		"lpswe_addr:\n"
+		"       lpswe    %[psw]\n"
+		"       nop\n"
+		"       nop\n"
+		".globl lpswe_dest_addr\n"
+		"lpswe_dest_addr:\n"
+		"       .insn   s,0xb2010000,%[bear]\n"
+		"	lg	%%r4, %[bear]\n"
+		"       nop\n"
+		"       nop\n"
+		: [bear] "=Q" (bear)
+		: [psw] "Q" (psw)
+		: "cc", "r3", "r4"
+		);
+}
+
+static void guest_lpsw(void)
+{
+	extern void lpsw_dest_addr(void);
+	u64 psw_short = (0x0400000180000000ULL | BIT(63 - 12) |
+			 (uintptr_t)lpsw_dest_addr);
+	u64 bear;
+
+	asm volatile (
+		"	larl	%%r3,lpsw_addr\n"
+		"lpsw_addr:\n"
+		"       lpsw    %[psw]\n"
+		"       nop\n"
+		"       nop\n"
+		".globl lpsw_dest_addr\n"
+		"lpsw_dest_addr:\n"
+		"       .insn   s,0xb2010000,%[bear]\n"
+		"	lg	%%r4, %[bear]\n"
+		"       nop\n"
+		"       nop\n"
+		: [bear] "=Q" (bear)
+		: [psw] "Q" (psw_short)
+		: "cc", "r3", "r4"
+		);
+}
+
+/* A machine check forces KVM to emulate PSW loading */
+static void inject_mcheck(struct kvm_vcpu *vcpu)
+{
+	struct kvm_s390_irq irq = {};
+	int irqs;
+
+	irq.type = KVM_S390_MCHK;
+	/* External damage mcheck */
+	irq.u.mchk.cr14 = BIT(63 - 38);
+	irq.u.mchk.mcic = BIT(58);
+	irqs = __vcpu_ioctl(vcpu, KVM_S390_IRQ, &irq);
+	TEST_ASSERT(irqs >= 0, "Error injecting MCHECK errno %d", errno);
+}
+
+static void test_lpswe(void)
+{
+	struct kvm_vcpu *vcpu;
+	struct kvm_run *run;
+	struct kvm_vm *vm;
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpswe);
+	inject_mcheck(vcpu);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "emulation: lpswe bear matches\n");
+	kvm_vm_free(vm);
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpsw);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] &&
+			 run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "interpretation: lpswe bear matches\n");
+	kvm_vm_free(vm);
+}
+
+static void test_lpsw(void)
+{
+	struct kvm_vcpu *vcpu;
+	struct kvm_run *run;
+	struct kvm_vm *vm;
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpsw);
+	inject_mcheck(vcpu);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "emulation: lpsw bear matches\n");
+	kvm_vm_free(vm);
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpsw);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] &&
+			 run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "interpretation: lpsw bear matches\n");
+	kvm_vm_free(vm);
+}
+
+int main(int argc, char *argv[])
+{
+	TEST_REQUIRE(test_facility(193));
+
+	ksft_print_header();
+	ksft_set_plan(4);
+	test_lpsw();
+	test_lpswe();
+	ksft_finished();
+}
-- 
2.51.0

Re: [PATCH 1/2] KVM: s390: Fix lpsw/e breaking event handling

[Heiko Carstens]

On Mon, Mar 23, 2026 at 03:35:22PM +0000, Janosch Frank wrote:
> LPSW and LPSWE need to set the gbea on completion but currently don't.
> Time to fix this up.
> 
> LPSWEY was designed to not set the bear.
> 
> Fixes: 48a3e950f4cee ("KVM: s390: Add support for machine checks.")
> Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
> Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
> ---
>  arch/s390/kvm/priv.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
> index a3250ad83a8e..cc0553da14cb 100644
> --- a/arch/s390/kvm/priv.c
> +++ b/arch/s390/kvm/priv.c
> @@ -714,12 +714,13 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
>  {
>  	psw_t *gpsw = &vcpu->arch.sie_block->gpsw;
>  	psw32_t new_psw;
> -	u64 addr;
> +	u64 addr, iaddr;
>  	int rc;
>  	u8 ar;
>  
>  	vcpu->stat.instruction_lpsw++;
>  
> +	iaddr = gpsw->addr - kvm_s390_get_ilen(vcpu);
>  	if (gpsw->mask & PSW_MASK_PSTATE)
>  		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
>  
> @@ -737,18 +738,20 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
>  	gpsw->addr = new_psw.addr & ~PSW32_ADDR_AMODE;
>  	if (!is_valid_psw(gpsw))
>  		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
> +	vcpu->arch.sie_block->gbea = iaddr;
>  	return 0;

This doesn't look correct to me: even if there is an early specification
exception the PSW is still replaced, and hence the breaking event address
needs to be updated. Read: the gbea assignment should be moved before
the is_valid_psw() check.

>  static int handle_lpswe(struct kvm_vcpu *vcpu)
>  {
>  	psw_t new_psw;
> -	u64 addr;
> +	u64 addr, iaddr;
>  	int rc;

This breaks reverse x-mas style. :)

> @@ -761,6 +764,7 @@ static int handle_lpswe(struct kvm_vcpu *vcpu)
>  	vcpu->arch.sie_block->gpsw = new_psw;
>  	if (!is_valid_psw(&vcpu->arch.sie_block->gpsw))
>  		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
> +	vcpu->arch.sie_block->gbea = iaddr;
>  	return 0;

Like above, I believe this is not correct.

Re: [PATCH 1/2] KVM: s390: Fix lpsw/e breaking event handling

[Janosch Frank]

On 4/15/26 12:59, Heiko Carstens wrote:
> On Mon, Mar 23, 2026 at 03:35:22PM +0000, Janosch Frank wrote:
>> LPSW and LPSWE need to set the gbea on completion but currently don't.
>> Time to fix this up.
>>
>> LPSWEY was designed to not set the bear.
>>
>> Fixes: 48a3e950f4cee ("KVM: s390: Add support for machine checks.")
>> Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
>> Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
>> ---
>>   arch/s390/kvm/priv.c | 8 ++++++--
>>   1 file changed, 6 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
>> index a3250ad83a8e..cc0553da14cb 100644
>> --- a/arch/s390/kvm/priv.c
>> +++ b/arch/s390/kvm/priv.c
>> @@ -714,12 +714,13 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
>>   {
>>   	psw_t *gpsw = &vcpu->arch.sie_block->gpsw;
>>   	psw32_t new_psw;
>> -	u64 addr;
>> +	u64 addr, iaddr;
>>   	int rc;
>>   	u8 ar;
>>   
>>   	vcpu->stat.instruction_lpsw++;
>>   
>> +	iaddr = gpsw->addr - kvm_s390_get_ilen(vcpu);
>>   	if (gpsw->mask & PSW_MASK_PSTATE)
>>   		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
>>   
>> @@ -737,18 +738,20 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
>>   	gpsw->addr = new_psw.addr & ~PSW32_ADDR_AMODE;
>>   	if (!is_valid_psw(gpsw))
>>   		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
>> +	vcpu->arch.sie_block->gbea = iaddr;
>>   	return 0;
> 
> This doesn't look correct to me: even if there is an early specification
> exception the PSW is still replaced, and hence the breaking event address
> needs to be updated. Read: the gbea assignment should be moved before
> the is_valid_psw() check.

Right, LPSW(E) completes even when we get the early specs and bear is 
set when completing LPSW(E).

We might also be missing setting ilc to 0 on early specs.
I need to look into that.