Indirect branches to addresses taken from registers go through address
generation, e.g., for BRANCH ON CONDITION Principles of Operation says:
In the RR format, the contents of general register R2 are used to
generate the branch address
QEMU uses r2_nz handler for the respective register operands. Currently
it does not zero out extra bits in 24- and 31-bit addressing modes as
required by address generation. The very frequently used
s390x_tr_init_disas_context() function has a workaround for this,
but the code for saving an old PSW during an interrupt does not.
Add the missing masking to r2_nz. Enforce PSW validity by replacing the
workaround with an assertion.
Reported-by: Thomas Weißschuh <linux@weissschuh.net>
Reported-by: Heiko Carstens <hca@linux.ibm.com>
Link: https://lore.kernel.org/lkml/ab3131a2-c42a-47ff-bf03-e9f68ac053c0@t-8ch.de/
Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Thomas Weißschuh <linux@weissschuh.net>
Message-ID: <20251016175954.41153-4-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
After reset, CKC value is set to 0, so if clock-comparator interrupts
are enabled, one should occur very shortly thereafter.
Currently the code that loads the respective control register does not
set tod_timer, so this does not happen.
Fix by adding a tcg_s390_tod_updated() call to LCTL and LCTLG.
Cc: qemu-stable@nongnu.org
Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-ID: <20251016175954.41153-3-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Suppose TOD clock value is 0x1111111111111111 and clock-comparator
value is 0, in which case clock-comparator interruption should occur
immediately.
With the current code, tod2time(env->ckc - td->base.low) ends up being
a very large number, so this interruption never happens.
Fix by firing the timer immediately if env->ckc < td->base.low.
Cc: qemu-stable@nongnu.org
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-ID: <20251016175954.41153-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.
This change places hooks for IBM System/390 targets. We treat "program
interrupts" and service calls as exceptions. We treat external and io
"exceptions" as well as resets as interrupts.
Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-25-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
* Improve cache handling for the msys2 CI and the functional asset cache
* Clean ups for some minor issues in functional tests
* Don't ignore errors of address_space_rw in s390x MMU code
# -----BEGIN PGP SIGNATURE-----
#
# iQJFBAABCgAvFiEEJ7iIR+7gJQEY8+q5LtnXdP5wLbUFAmjxHGwRHHRodXRoQHJl
# ZGhhdC5jb20ACgkQLtnXdP5wLbUSDw//dSoNzE+qqJ2EWIfzHN/N7iDRf4OWQY6X
# 12S7zfcBt0W7RESf6JGy0h3cwDcyUxhB7UtC9rvT8cYPFhun+7T07H72/Se+95+a
# d3Yih1HHfYKYN6Zl3DAzUfSUvLBorYI76Ab5yeTs5nCg3ewK6IWPvMA9pS+4P2Pj
# iLY+ycflsGd36tHrJbR/G0cda5p6jaxDzpLh/d+D7hh3XoeS+PZv2xeknsDvJlOs
# ykIrrB+XJ8x81NxAFdA3PSeEh7VU5IzVv+t9hSJiBdi98/dAzwfQdH6bTekA8JL0
# pzfT4A5cwoIEHg5yCqsAllG6+sa6RaVzt6tDeRw4UKFeUP33zFXCoVurUygR1TP7
# Bs7E4E4HbXDgSWvd/UFNtE+4MdYicwP/1qBootnJXc4/v8cFEZBVdOlnsLXDmg1S
# qPr4ITAQDE3LEq4vXITKLmUIZehLG2K6N32XalnK9XrQD6Flcvr1BwDepFAP9Gku
# zmQMkeES1F2MhGMtxPwAxWIMfqsRtaPNWGqH4tSlnBYslwqPWwz+XLDGKlUsPpV/
# kXV/TKkeE/bb0DO7WoLFaw3Q5F+Mdj6C0B2cevKVGCurH4wGLRLaIhzGl8J6ZSDH
# Lve4Fc3BvMMO3CFYezaRQcEls+w4cXkOtSTZNwame1Wk7cUiqq+ElmFttYSl4FSC
# WKyZHtapq1U=
# =Ml5x
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 16 Oct 2025 09:25:16 AM PDT
# gpg: using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg: issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [unknown]
# gpg: aka "Thomas Huth <thuth@redhat.com>" [unknown]
# gpg: aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# gpg: aka "Thomas Huth <huth@tuxfamily.org>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3 EAB9 2ED9 D774 FE70 2DB5
* tag 'pull-request-2025-10-16' of https://gitlab.com/thuth/qemu:
target/s390x/mmu_helper: Do not ignore address_space_rw() errors
target/s390x/mmu_helper: Simplify s390_cpu_virt_mem_rw() logic
tests/functional: ensure GDB client is stopped on error
tests/functional: remove use of getLogger in reverse debuging
tests/functional/alpha: Remove superfluous fetch() line from the clipper test
tests: Evict stale files in the functional download cache after a while
tests/functional: Set current time stamp of assets when using them
gitlab: purge msys pacman cache
tests/functional/aarch64: Drop some sbsaref_alpine tests
python/qemu: Replace some remaining "avocados" with "functional tests"
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Replace preprocessor-time #ifdef with a compile-time check
to ensure all code paths are built and tested. This reduces
build-time configuration complexity and simplifies code
maintainability.
No functional change intended.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-Id: <20251010134226.72221-15-philmd@linaro.org>
* rust: fix nightly warnings
* target/i386: a smattering of fixes
* monitor: add "info accelerators"
* kvm: cleanups to kvm_cpu_synchronize_put()
* target/i386: Add TSA attack variants and verw-clear feature flag
* async: tsan bottom half fixes
* rust: migration state wrappers with support for BQL-free devices
# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmjuRZYUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroPTFgf+LRXCvGJwrlJwD4cAS/TBzhzpOAMZ
# v75RZ/s2tF7nYRhT28MDtZWsXeVrjO/nrSXaThxe6WHfmKK2W+16a+BgfhbeTEGt
# wBnK3JMb84i7T2Foy91jVCc4k0igwZu6Wmnf3rOP9gpdjAK6FYLje1KWvF7FrJO1
# ackAzJJ+TiZmc5QpXLW8sjaIidmefveXsdHwMVRz67LDvlDANEhp4rixjTVmKe0Z
# UL3tzrEj/b15vvElkh3a1IrVAttexay425J94R5i3Xpz3fEBqmIdpJt4eiCt9j0L
# zL7TOXwSJWiOX+mec6aJwYh8y4ikD6Yq4f4Hc9xFBEZRcICaxx4uoOscYA==
# =FroL
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 14 Oct 2025 05:44:06 AM PDT
# gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg: issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [unknown]
# gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [unknown]
# gpg: WARNING: The key's User ID is not certified with a trusted signature!
# gpg: There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1
# Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83
* tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (28 commits)
rust: migration: implement ToMigrationState as part of impl_vmstate_bitsized
timer: constify some functions
rust: qemu-macros: add ToMigrationState derive macro
rust: migration: add high-level migration wrappers
rust: move VMState from bql to migration
rust: migration: extract vmstate_fields_ref
rust: migration: validate termination of subsection arrays
rust: migration: do not store raw pointers into VMStateSubsectionsWrapper
rust: migration: do not pass raw pointer to VMStateDescription::fields
rust: bql: add BqlRefCell::get_mut()
accel/kvm: Factor kvm_cpu_synchronize_put() out
accel/kvm: Introduce KvmPutState enum
monitor: generalize query-mshv/"info mshv" to query-accelerators/"info accelerators"
monitor: clarify "info accel" help message
target/i386: user: do not set up a valid LDT on reset
async: access bottom half flags with qatomic_read
target/i386: fix access to the T bit of the TSS
target/i386: fix x86_64 pushw op
i386/tcg/smm_helper: Properly apply DR values on SMM entry / exit
i386/cpu: Prevent delivering SIPI during SMM in TCG mode
...
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Commit b7ecba0f6f ("docs/devel/loads-stores.rst: Document our
various load and store APIs") mentioned cpu_physical_memory_*()
methods are legacy, the replacement being address_space_*().
Replace the *_map() / *_unmap() methods in s390_store_status()
and s390_store_adtl_status(). In s390_store_status(), replace
cpu_physical_memory_write() by address_space_stb(), restricting
@ar_id scope. No behavioral change expected.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251002091132.65703-10-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
s390_store_status() is only called within sigp.c,
move it and the SigpSaveArea structure definition
there where it belongs, with other SIGP handling
code.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251002091132.65703-9-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
s390_store_adtl_status() is only called within sigp.c,
move it and the SigpAdtlSaveArea structure definition
there where it belongs, with other SIGP handling code.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251002091132.65703-8-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Commit b7ecba0f6f ("docs/devel/loads-stores.rst: Document our
various load and store APIs") mentioned cpu_physical_memory_*()
methods are legacy, the replacement being address_space_*().
Replace the *_map() / *_unmap() methods in cpu_[un]map_lowcore().
No behavioral change expected.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251002091132.65703-7-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Commit b7ecba0f6f ("docs/devel/loads-stores.rst: Document our
various load and store APIs") mentioned cpu_physical_memory_*()
methods are legacy, the replacement being address_space_*().
Replace the *_map() / *_unmap() methods in mchk_store_vregs().
No behavioral change expected.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251002091132.65703-5-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
When cpu_address_space_init() isn't called during vCPU creation,
its single address space is the global &address_space_memory.
As s390x boards don't call cpu_address_space_init(), cpu->as
points to &address_space_memory.
We can then replace cpu_physical_memory_rw() by the semantically
equivalent address_space_rw() call.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-9-philmd@linaro.org>
Open coding cpu_reset_interrupt() can cause bugs if the BQL is not
taken, for example i386 has the call chain kvm_cpu_exec() ->
kvm_put_vcpu_events() -> kvm_arch_put_registers().
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Since halting a vCPU and how many left running do not need
to be tied together, split the s390_count_running_cpus()
call out of s390_cpu_halt() to the single caller using it:
s390_handle_wait().
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250708095746.12697-4-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
In order to simplify the next commit where s390_count_running_cpus()
is split out of s390_cpu_halt(), make its prototype public as a
preliminary step.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250708095746.12697-3-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Since commit da94488546 ("target/s390x: make helper.c
sysemu-only") target/s390x/helper.c is only built for
system mode, so s390_cpu_halt() and s390_cpu_unhalt()
are never called from user mode.
Fixes: da94488546 ("target/s390x: make helper.c sysemu-only")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250708095746.12697-2-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Commit 70ebd9ce1c ("s390x/tcg: Fault-safe memset") passed
vaddr type to access_prepare(), and commit b6c636f2cd
("s390x/tcg: Fault-safe memmove") to do_access_get_byte(),
but declared S390Access::vaddr[1,2] as target_ulong.
Directly declare these as vaddr type, and have
s390_probe_access() use that type as argument.
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250707171059.3064-3-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
