[PATCH 0/3] KVM: s390: Additional LPSW/E fixes

[PATCH 0/3] KVM: s390: Additional LPSW/E fixes

[Janosch Frank]

Another round of fixups for LPSW/E since Heiko found a problem with my
fix and I found another pre-existing issue where the ilc is not being
set to 0.

To verify my fixes I've added code to the bear test which loads an
invalid PSW and checks the bear and ilc values. Due to the current
s390 lib state I had to resort to real address memory accesses.

I'd expect the fixes to arrive via master while the test moves through
next landing after Christian's cpumodel change.

I've added \n two the first fix to make the code a bit more readable.

Janosch Frank (3):
  KVM: s390: selftests: Add load psw bear test
  kvm: s390: Fix LPSW/E early exception bear behavior
  kvm: s390: Fix lpsw/e spec exception ilc reporting

 arch/s390/kvm/priv.c                     |  20 +-
 tools/testing/selftests/kvm/Makefile.kvm |   1 +
 tools/testing/selftests/kvm/s390/bear.c  | 250 +++++++++++++++++++++++
 3 files changed, 267 insertions(+), 4 deletions(-)
 create mode 100644 tools/testing/selftests/kvm/s390/bear.c

-- 
2.51.0

[PATCH 1/3] KVM: s390: selftests: Add load psw bear test

[Janosch Frank]

The bear is set for lpsw and lpswe, so let's check that also happens
when kvm emulates these instructions.

Load PSW and all of its variants are only emulated by KVM if there's a
pending machine check. Therefore the tests inject those but never open
the masks to receive them.

Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
---
 tools/testing/selftests/kvm/Makefile.kvm |   1 +
 tools/testing/selftests/kvm/s390/bear.c  | 250 +++++++++++++++++++++++
 2 files changed, 251 insertions(+)
 create mode 100644 tools/testing/selftests/kvm/s390/bear.c

diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selftests/kvm/Makefile.kvm
index 6471fa214a9f..9afb6479dbee 100644
--- a/tools/testing/selftests/kvm/Makefile.kvm
+++ b/tools/testing/selftests/kvm/Makefile.kvm
@@ -207,6 +207,7 @@ TEST_GEN_PROGS_s390 += s390/user_operexec
 TEST_GEN_PROGS_s390 += s390/keyop
 TEST_GEN_PROGS_s390 += rseq_test
 TEST_GEN_PROGS_s390 += s390/irq_routing
+TEST_GEN_PROGS_s390 += s390/bear
 
 TEST_GEN_PROGS_riscv = $(TEST_GEN_PROGS_COMMON)
 TEST_GEN_PROGS_riscv += riscv/sbi_pmu_test
diff --git a/tools/testing/selftests/kvm/s390/bear.c b/tools/testing/selftests/kvm/s390/bear.c
new file mode 100644
index 000000000000..63032a789c8d
--- /dev/null
+++ b/tools/testing/selftests/kvm/s390/bear.c
@@ -0,0 +1,250 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/* LPSW/E bear tests. */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+
+#include "test_util.h"
+#include "kvm_util.h"
+#include "kselftest.h"
+#include "ucall_common.h"
+#include "facility.h"
+#include "processor.h"
+
+u64 psw_mask = 0x0400000180000000ULL;
+
+static void guest_lpswe_inv(void)
+{
+	extern void lpswe_dest_addr_inv(void);
+	u64 psw_inv[2] = {psw_mask | BIT(63), (uintptr_t)lpswe_dest_addr_inv};
+	u64 psw_pgm[2] = {psw_mask,  (uintptr_t)lpswe_dest_addr_inv};
+	u64 bear;
+
+	/*
+	 * Advanced shenanigans:
+	 * - Use real stores (sturg) to lowcore PGM new PSW since the
+	 *   lowcore isn't mapped in DAT
+	 * - After the exception store invalid address to PGM new so
+	 *   the test exits
+	 */
+	asm volatile (
+		"	larl	%%r3,lpswe_addr_inv\n"
+		"	lghi	%%r6, 464\n"
+		"	lg	%%r5, %[psw_pgm_m]\n"
+		"	sturg	%%r5, %%r6\n"
+		"	lghi	%%r6, 472\n"
+		"	lg      %%r5, %[psw_pgm_a]\n"
+		"	sturg	%%r5, %%r6\n"
+		"	lghi	%%r5, 0x80\n"
+		"	xgr	%%r6, %%r6\n"
+		"	sturg	%%r5, %%r6\n"
+		"lpswe_addr_inv:\n"
+		"       lpswe    %[psw_inv]\n"
+		"       nop\n"
+		"       nop\n"
+		".globl lpswe_dest_addr_inv\n"
+		"lpswe_dest_addr_inv:\n"
+		"       .insn   s,0xb2010000,%[bear]\n"
+		"	lg	%%r4, %[bear]\n"
+		"       lghi    %%r6, 472\n"
+		"	lghi	%%r5, 1\n"
+		"	sturg	%%r5, %%r6\n"
+		"	lghi	%%r6, 0x8c\n"
+		"	lura	%%r5, %%r6\n"
+		: [bear] "=Q" (bear)
+		: [psw_inv] "Q" (psw_inv),
+		  [psw_pgm_m] "Q" (psw_pgm), [psw_pgm_a] "Q" (psw_pgm[1])
+		: "cc", "r3", "r4", "r5", "r6"
+		);
+}
+
+static void guest_lpswe(void)
+{
+	extern void lpswe_dest_addr(void);
+	u64 psw[2] = {psw_mask, (uintptr_t)lpswe_dest_addr};
+	u64 bear;
+
+	asm volatile (
+		"	larl	%%r3,lpswe_addr\n"
+		"lpswe_addr:\n"
+		"       lpswe    %[psw]\n"
+		"       nop\n"
+		"       nop\n"
+		".globl lpswe_dest_addr\n"
+		"lpswe_dest_addr:\n"
+		"       .insn   s,0xb2010000,%[bear]\n"
+		"	lg	%%r4, %[bear]\n"
+		"       nop\n"
+		"       nop\n"
+		: [bear] "=Q" (bear)
+		: [psw] "Q" (psw)
+		: "cc", "r3", "r4"
+		);
+}
+
+static void guest_lpsw(void)
+{
+	extern void lpsw_dest_addr(void);
+	u64 psw_short = (psw_mask | BIT(63 - 12) | (uintptr_t)lpsw_dest_addr);
+	u64 bear;
+
+	asm volatile (
+		"	larl	%%r3,lpsw_addr\n"
+		"lpsw_addr:\n"
+		"       lpsw    %[psw]\n"
+		"       nop\n"
+		"       nop\n"
+		".globl lpsw_dest_addr\n"
+		"lpsw_dest_addr:\n"
+		"       .insn   s,0xb2010000,%[bear]\n"
+		"	lg	%%r4, %[bear]\n"
+		"       nop\n"
+		"       nop\n"
+		: [bear] "=Q" (bear)
+		: [psw] "Q" (psw_short)
+		: "cc", "r3", "r4"
+		);
+}
+
+static void guest_lpsw_inv(void)
+{
+	extern void lpsw_dest_addr_inv(void);
+	u64 psw_short_inv = (psw_mask | BIT(63 - 12) | BIT(63) | (uintptr_t)lpsw_dest_addr_inv);
+	u64 psw_pgm[2] = {psw_mask,  (uintptr_t)lpsw_dest_addr_inv};
+	u64 bear;
+
+	/*
+	 * Advanced shenanigans:
+	 * - Use real stores (sturg) to lowcore PGM new PSW since the
+	 *   lowcore isn't mapped in DAT
+	 * - After the exception store invalid address to PGM new so
+	 *   the test exits
+	 */
+	asm volatile (
+		"	larl	%%r3,lpsw_addr_inv\n"
+		"	lghi	%%r6, 464\n"
+		"	lg	%%r5, %[psw_pgm_m]\n"
+		"	sturg	%%r5, %%r6\n"
+		"	lghi	%%r6, 472\n"
+		"	lg      %%r5, %[psw_pgm_a]\n"
+		"	sturg	%%r5, %%r6\n"
+		"	lghi	%%r5, 0x80\n"
+		"	xgr	%%r6, %%r6\n"
+		"	sturg	%%r5, %%r6\n"
+		"lpsw_addr_inv:\n"
+		"       lpsw    %[psw_inv]\n"
+		"       nop\n"
+		"       nop\n"
+		".globl lpsw_dest_addr_inv\n"
+		"lpsw_dest_addr_inv:\n"
+		"       .insn   s,0xb2010000,%[bear]\n"
+		"	lg	%%r4, %[bear]\n"
+		"       lghi    %%r6, 472\n"
+		"	lghi	%%r5, 1\n"
+		"	sturg	%%r5, %%r6\n"
+		"	lghi	%%r6, 0x8c\n"
+		"	lura	%%r5, %%r6\n"
+		: [bear] "=Q" (bear)
+		: [psw_inv] "Q" (psw_short_inv),
+		  [psw_pgm_m] "Q" (psw_pgm), [psw_pgm_a] "Q" (psw_pgm[1])
+		: "cc", "r3", "r4", "r5", "r6"
+		);
+}
+
+/* A machine check forces KVM to emulate PSW loading */
+static void inject_mcheck(struct kvm_vcpu *vcpu)
+{
+	struct kvm_s390_irq irq = {};
+	int irqs;
+
+	irq.type = KVM_S390_MCHK;
+	/* External damage mcheck */
+	irq.u.mchk.cr14 = BIT(63 - 38);
+	irq.u.mchk.mcic = BIT(58);
+	irqs = __vcpu_ioctl(vcpu, KVM_S390_IRQ, &irq);
+	TEST_ASSERT(irqs >= 0, "Error injecting MCHECK errno %d", errno);
+}
+
+static void test_lpswe(void)
+{
+	struct kvm_vcpu *vcpu;
+	struct kvm_run *run;
+	struct kvm_vm *vm;
+	void *lc;
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpswe);
+	inject_mcheck(vcpu);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "lpswe: emulation: bear matches\n");
+	kvm_vm_free(vm);
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpswe_inv);
+	lc = addr_gpa2hva(vm, 0);
+	memset(lc, 0, PAGE_SIZE);
+	inject_mcheck(vcpu);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "lpswe: emulation: pgm: lpsw bear matches\n");
+	ksft_test_result(run->s.regs.gprs[5] == 6,
+			 "lpswe: emulation: pgm: ILC is 0\n");
+	kvm_vm_free(vm);
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpsw);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] &&
+			 run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "lpswe: interpretation: lpswe bear matches\n");
+	kvm_vm_free(vm);
+}
+
+static void test_lpsw(void)
+{
+	struct kvm_vcpu *vcpu;
+	struct kvm_run *run;
+	struct kvm_vm *vm;
+	void *lc;
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpsw);
+	inject_mcheck(vcpu);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "lpsw: emulation: bear matches\n");
+	kvm_vm_free(vm);
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpsw_inv);
+	lc = addr_gpa2hva(vm, 0);
+	memset(lc, 0, PAGE_SIZE);
+	inject_mcheck(vcpu);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "lpsw: emulation: pgm: invalid: bear matches\n");
+	ksft_test_result(run->s.regs.gprs[5] == 6,
+			 "lpsw: emulation: pgm: ILC is 0\n");
+	kvm_vm_free(vm);
+
+	vm = vm_create_with_one_vcpu(&vcpu, guest_lpsw);
+	run = vcpu->run;
+	vcpu_run(vcpu);
+	ksft_test_result(run->s.regs.gprs[3] &&
+			 run->s.regs.gprs[3] == run->s.regs.gprs[4],
+			 "lpsw: interpretation: bear matches\n");
+	kvm_vm_free(vm);
+}
+
+int main(int argc, char *argv[])
+{
+	TEST_REQUIRE(test_facility(193));
+
+	ksft_print_header();
+	ksft_set_plan(8);
+	test_lpsw();
+	test_lpswe();
+	ksft_finished();
+}
-- 
2.51.0

[PATCH 2/3] kvm: s390: Fix LPSW/E early exception bear behavior

[Janosch Frank]

When loading a PSW a lot of specification exceptions are recognized
after the PSW has been loaded. In these cases the load PSW(E) succeeds
but the loaded PSW was invalid. Since the load completed we need to
set the bear.

Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Fixes: 1653545abc68 ("KVM: s390: Fix lpsw/e breaking event handling")
---
 arch/s390/kvm/priv.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index cc0553da14cb..56e63679f9d1 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -736,9 +736,11 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
 	gpsw->mask = (new_psw.mask & ~PSW32_MASK_BASE) << 32;
 	gpsw->mask |= new_psw.addr & PSW32_ADDR_AMODE;
 	gpsw->addr = new_psw.addr & ~PSW32_ADDR_AMODE;
+	vcpu->arch.sie_block->gbea = iaddr;
+
 	if (!is_valid_psw(gpsw))
 		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
-	vcpu->arch.sie_block->gbea = iaddr;
+
 	return 0;
 }
 
@@ -762,9 +764,11 @@ static int handle_lpswe(struct kvm_vcpu *vcpu)
 	if (rc)
 		return kvm_s390_inject_prog_cond(vcpu, rc);
 	vcpu->arch.sie_block->gpsw = new_psw;
+	vcpu->arch.sie_block->gbea = iaddr;
+
 	if (!is_valid_psw(&vcpu->arch.sie_block->gpsw))
 		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
-	vcpu->arch.sie_block->gbea = iaddr;
+
 	return 0;
 }
 
-- 
2.51.0

[PATCH 3/3] kvm: s390: Fix lpsw/e spec exception ilc reporting

[Janosch Frank]

On early PSW specification exception the ILC has to be 0 according to
architecture.

Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Fixes: 48a3e950f4cee ("KVM: s390: Add support for machine checks.")
---
 arch/s390/kvm/priv.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index 56e63679f9d1..9fd7d3f1d1e8 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -713,6 +713,7 @@ int is_valid_psw(psw_t *psw)
 int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
 {
 	psw_t *gpsw = &vcpu->arch.sie_block->gpsw;
+	struct kvm_s390_pgm_info info = {};
 	psw32_t new_psw;
 	u64 addr, iaddr;
 	int rc;
@@ -738,14 +739,18 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
 	gpsw->addr = new_psw.addr & ~PSW32_ADDR_AMODE;
 	vcpu->arch.sie_block->gbea = iaddr;
 
-	if (!is_valid_psw(gpsw))
-		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+	if (!is_valid_psw(gpsw)) {
+		info.code = PGM_SPECIFICATION;
+		info.flags = KVM_S390_PGM_FLAGS_ILC_VALID;
+		return kvm_s390_inject_prog_irq(vcpu, &info);
+	}
 
 	return 0;
 }
 
 static int handle_lpswe(struct kvm_vcpu *vcpu)
 {
+	struct kvm_s390_pgm_info info = {};
 	psw_t new_psw;
 	u64 addr, iaddr;
 	int rc;
@@ -766,8 +771,11 @@ static int handle_lpswe(struct kvm_vcpu *vcpu)
 	vcpu->arch.sie_block->gpsw = new_psw;
 	vcpu->arch.sie_block->gbea = iaddr;
 
-	if (!is_valid_psw(&vcpu->arch.sie_block->gpsw))
-		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
+	if (!is_valid_psw(&vcpu->arch.sie_block->gpsw)) {
+		info.code = PGM_SPECIFICATION;
+		info.flags = KVM_S390_PGM_FLAGS_ILC_VALID;
+		return kvm_s390_inject_prog_irq(vcpu, &info);
+	}
 
 	return 0;
 }
-- 
2.51.0

Re: [PATCH 3/3] kvm: s390: Fix lpsw/e spec exception ilc reporting

[Heiko Carstens]

On Thu, Apr 23, 2026 at 12:36:04PM +0000, Janosch Frank wrote:
> On early PSW specification exception the ILC has to be 0 according to
> architecture.
> 
> Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
> Fixes: 48a3e950f4cee ("KVM: s390: Add support for machine checks.")
> ---
>  arch/s390/kvm/priv.c | 16 ++++++++++++----
>  1 file changed, 12 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
> index 56e63679f9d1..9fd7d3f1d1e8 100644
> --- a/arch/s390/kvm/priv.c
> +++ b/arch/s390/kvm/priv.c
> @@ -713,6 +713,7 @@ int is_valid_psw(psw_t *psw)
>  int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
>  {
>  	psw_t *gpsw = &vcpu->arch.sie_block->gpsw;
> +	struct kvm_s390_pgm_info info = {};
>  	psw32_t new_psw;
>  	u64 addr, iaddr;
>  	int rc;
> @@ -738,14 +739,18 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
>  	gpsw->addr = new_psw.addr & ~PSW32_ADDR_AMODE;
>  	vcpu->arch.sie_block->gbea = iaddr;
>  
> -	if (!is_valid_psw(gpsw))
> -		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
> +	if (!is_valid_psw(gpsw)) {
> +		info.code = PGM_SPECIFICATION;
> +		info.flags = KVM_S390_PGM_FLAGS_ILC_VALID;
> +		return kvm_s390_inject_prog_irq(vcpu, &info);
> +	}

Hmm... looking at the architecture: an odd instruction address in the PSW
does not result in an early specification exception, but a "normal"
specification exception. is_valid_psw() however also checks for an odd
instruction address. So I guess this is still not entirely correct.

I'm also wondering if the above implementation is correct if PER is enabled
when the specification happens...

Btw.: you may want to have consistent short descriptions for your two
patches. That is consistently use upper or lower case for "LPSW/E".

Re: [PATCH 3/3] kvm: s390: Fix lpsw/e spec exception ilc reporting

[Janosch Frank]

On 4/23/26 15:36, Heiko Carstens wrote:
> On Thu, Apr 23, 2026 at 12:36:04PM +0000, Janosch Frank wrote:
>> On early PSW specification exception the ILC has to be 0 according to
>> architecture.
>>
>> Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
>> Fixes: 48a3e950f4cee ("KVM: s390: Add support for machine checks.")
>> ---
>>   arch/s390/kvm/priv.c | 16 ++++++++++++----
>>   1 file changed, 12 insertions(+), 4 deletions(-)
>>
>> diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
>> index 56e63679f9d1..9fd7d3f1d1e8 100644
>> --- a/arch/s390/kvm/priv.c
>> +++ b/arch/s390/kvm/priv.c
>> @@ -713,6 +713,7 @@ int is_valid_psw(psw_t *psw)
>>   int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
>>   {
>>   	psw_t *gpsw = &vcpu->arch.sie_block->gpsw;
>> +	struct kvm_s390_pgm_info info = {};
>>   	psw32_t new_psw;
>>   	u64 addr, iaddr;
>>   	int rc;
>> @@ -738,14 +739,18 @@ int kvm_s390_handle_lpsw(struct kvm_vcpu *vcpu)
>>   	gpsw->addr = new_psw.addr & ~PSW32_ADDR_AMODE;
>>   	vcpu->arch.sie_block->gbea = iaddr;
>>   
>> -	if (!is_valid_psw(gpsw))
>> -		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
>> +	if (!is_valid_psw(gpsw)) {
>> +		info.code = PGM_SPECIFICATION;
>> +		info.flags = KVM_S390_PGM_FLAGS_ILC_VALID;
>> +		return kvm_s390_inject_prog_irq(vcpu, &info);
>> +	}
> 
> Hmm... looking at the architecture: an odd instruction address in the PSW
> does not result in an early specification exception, but a "normal"
> specification exception. is_valid_psw() however also checks for an odd
> instruction address. So I guess this is still not entirely correct.
> 
> I'm also wondering if the above implementation is correct if PER is enabled
> when the specification happens...

Well, we're hopefully slowly getting there one patch at a time.

> 
> Btw.: you may want to have consistent short descriptions for your two
> patches. That is consistently use upper or lower case for "LPSW/E".

Will fix
I'll also have to rename the bear test to lpsw since we're now testing 
way more things.