hw/s390x/s390-pci-inst.c

   1 /*
   2  * s390 PCI instructions
   3  *
   4  * Copyright 2014 IBM Corp.
   5  * Author(s): Frank Blaschka <frank.blaschka@de.ibm.com>
   6  *            Hong Bo Li <lihbbj@cn.ibm.com>
   7  *            Yi Min Zhao <zyimin@cn.ibm.com>
   8  *
   9  * This work is licensed under the terms of the GNU GPL, version 2 or (at
  10  * your option) any later version. See the COPYING file in the top-level
  11  * directory.
  12  */
  13
  14 #include "qemu/osdep.h"
  15 #include "cpu.h"
  16 #include "exec/memop.h"
  17 #include "exec/memory-internal.h"
  18 #include "qemu/error-report.h"
  19 #include "sysemu/hw_accel.h"
  20 #include "hw/s390x/s390-pci-inst.h"
  21 #include "hw/s390x/s390-pci-bus.h"
  22 #include "hw/s390x/tod.h"
  23
  24 #ifndef DEBUG_S390PCI_INST
  25 #define DEBUG_S390PCI_INST  0
  26 #endif
  27
  28 #define DPRINTF(fmt, ...)                                          \
  29     do {                                                           \
  30         if (DEBUG_S390PCI_INST) {                                  \
  31             fprintf(stderr, "s390pci-inst: " fmt, ## __VA_ARGS__); \
  32         }                                                          \
  33     } while (0)
  34
  35 static inline void inc_dma_avail(S390PCIIOMMU *iommu)
  36 {
  37     if (iommu->dma_limit) {
  38         iommu->dma_limit->avail++;
  39     }
  40 }
  41
  42 static inline void dec_dma_avail(S390PCIIOMMU *iommu)
  43 {
  44     if (iommu->dma_limit) {
  45         iommu->dma_limit->avail--;
  46     }
  47 }
  48
  49 static void s390_set_status_code(CPUS390XState *env,
  50                                  uint8_t r, uint64_t status_code)
  51 {
  52     env->regs[r] &= ~0xff000000ULL;
  53     env->regs[r] |= (status_code & 0xff) << 24;
  54 }
  55
  56 static int list_pci(ClpReqRspListPci *rrb, uint8_t *cc)
  57 {
  58     S390PCIBusDevice *pbdev = NULL;
  59     S390pciState *s = s390_get_phb();
  60     uint32_t res_code, initial_l2, g_l2;
  61     int rc, i;
  62     uint64_t resume_token;
  63
  64     rc = 0;
  65     if (lduw_p(&rrb->request.hdr.len) != 32) {
  66         res_code = CLP_RC_LEN;
  67         rc = -EINVAL;
  68         goto out;
  69     }
  70
  71     if ((ldl_p(&rrb->request.fmt) & CLP_MASK_FMT) != 0) {
  72         res_code = CLP_RC_FMT;
  73         rc = -EINVAL;
  74         goto out;
  75     }
  76
  77     if ((ldl_p(&rrb->request.fmt) & ~CLP_MASK_FMT) != 0 ||
  78         ldq_p(&rrb->request.reserved1) != 0) {
  79         res_code = CLP_RC_RESNOT0;
  80         rc = -EINVAL;
  81         goto out;
  82     }
  83
  84     resume_token = ldq_p(&rrb->request.resume_token);
  85
  86     if (resume_token) {
  87         pbdev = s390_pci_find_dev_by_idx(s, resume_token);
  88         if (!pbdev) {
  89             res_code = CLP_RC_LISTPCI_BADRT;
  90             rc = -EINVAL;
  91             goto out;
  92         }
  93     } else {
  94         pbdev = s390_pci_find_next_avail_dev(s, NULL);
  95     }
  96
  97     if (lduw_p(&rrb->response.hdr.len) < 48) {
  98         res_code = CLP_RC_8K;
  99         rc = -EINVAL;
 100         goto out;
 101     }
 102
 103     initial_l2 = lduw_p(&rrb->response.hdr.len);
 104     if ((initial_l2 - LIST_PCI_HDR_LEN) % sizeof(ClpFhListEntry)
 105         != 0) {
 106         res_code = CLP_RC_LEN;
 107         rc = -EINVAL;
 108         *cc = 3;
 109         goto out;
 110     }
 111
 112     stl_p(&rrb->response.fmt, 0);
 113     stq_p(&rrb->response.reserved1, 0);
 114     stl_p(&rrb->response.mdd, FH_MASK_SHM);
 115     stw_p(&rrb->response.max_fn, PCI_MAX_FUNCTIONS);
 116     rrb->response.flags = UID_CHECKING_ENABLED;
 117     rrb->response.entry_size = sizeof(ClpFhListEntry);
 118
 119     i = 0;
 120     g_l2 = LIST_PCI_HDR_LEN;
 121     while (g_l2 < initial_l2 && pbdev) {
 122         stw_p(&rrb->response.fh_list[i].device_id,
 123             pci_get_word(pbdev->pdev->config + PCI_DEVICE_ID));
 124         stw_p(&rrb->response.fh_list[i].vendor_id,
 125             pci_get_word(pbdev->pdev->config + PCI_VENDOR_ID));
 126         /* Ignore RESERVED devices. */
 127         stl_p(&rrb->response.fh_list[i].config,
 128             pbdev->state == ZPCI_FS_STANDBY ? 0 : 1 << 31);
 129         stl_p(&rrb->response.fh_list[i].fid, pbdev->fid);
 130         stl_p(&rrb->response.fh_list[i].fh, pbdev->fh);
 131
 132         g_l2 += sizeof(ClpFhListEntry);
 133         /* Add endian check for DPRINTF? */
 134         DPRINTF("g_l2 %d vendor id 0x%x device id 0x%x fid 0x%x fh 0x%x\n",
 135                 g_l2,
 136                 lduw_p(&rrb->response.fh_list[i].vendor_id),
 137                 lduw_p(&rrb->response.fh_list[i].device_id),
 138                 ldl_p(&rrb->response.fh_list[i].fid),
 139                 ldl_p(&rrb->response.fh_list[i].fh));
 140         pbdev = s390_pci_find_next_avail_dev(s, pbdev);
 141         i++;
 142     }
 143
 144     if (!pbdev) {
 145         resume_token = 0;
 146     } else {
 147         resume_token = pbdev->fh & FH_MASK_INDEX;
 148     }
 149     stq_p(&rrb->response.resume_token, resume_token);
 150     stw_p(&rrb->response.hdr.len, g_l2);
 151     stw_p(&rrb->response.hdr.rsp, CLP_RC_OK);
 152 out:
 153     if (rc) {
 154         DPRINTF("list pci failed rc 0x%x\n", rc);
 155         stw_p(&rrb->response.hdr.rsp, res_code);
 156     }
 157     return rc;
 158 }
 159
 160 int clp_service_call(S390CPU *cpu, uint8_t r2, uintptr_t ra)
 161 {
 162     ClpReqHdr *reqh;
 163     ClpRspHdr *resh;
 164     S390PCIBusDevice *pbdev;
 165     uint32_t req_len;
 166     uint32_t res_len;
 167     uint8_t buffer[4096 * 2];
 168     uint8_t cc = 0;
 169     CPUS390XState *env = &cpu->env;
 170     S390pciState *s = s390_get_phb();
 171     int i;
 172
 173     if (env->psw.mask & PSW_MASK_PSTATE) {
 174         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
 175         return 0;
 176     }
 177
 178     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer, sizeof(*reqh))) {
 179         s390_cpu_virt_mem_handle_exc(cpu, ra);
 180         return 0;
 181     }
 182     reqh = (ClpReqHdr *)buffer;
 183     req_len = lduw_p(&reqh->len);
 184     if (req_len < 16 || req_len > 8184 || (req_len % 8 != 0)) {
 185         s390_program_interrupt(env, PGM_OPERAND, ra);
 186         return 0;
 187     }
 188
 189     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer,
 190                                req_len + sizeof(*resh))) {
 191         s390_cpu_virt_mem_handle_exc(cpu, ra);
 192         return 0;
 193     }
 194     resh = (ClpRspHdr *)(buffer + req_len);
 195     res_len = lduw_p(&resh->len);
 196     if (res_len < 8 || res_len > 8176 || (res_len % 8 != 0)) {
 197         s390_program_interrupt(env, PGM_OPERAND, ra);
 198         return 0;
 199     }
 200     if ((req_len + res_len) > 8192) {
 201         s390_program_interrupt(env, PGM_OPERAND, ra);
 202         return 0;
 203     }
 204
 205     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer,
 206                                req_len + res_len)) {
 207         s390_cpu_virt_mem_handle_exc(cpu, ra);
 208         return 0;
 209     }
 210
 211     if (req_len != 32) {
 212         stw_p(&resh->rsp, CLP_RC_LEN);
 213         goto out;
 214     }
 215
 216     switch (lduw_p(&reqh->cmd)) {
 217     case CLP_LIST_PCI: {
 218         ClpReqRspListPci *rrb = (ClpReqRspListPci *)buffer;
 219         list_pci(rrb, &cc);
 220         break;
 221     }
 222     case CLP_SET_PCI_FN: {
 223         ClpReqSetPci *reqsetpci = (ClpReqSetPci *)reqh;
 224         ClpRspSetPci *ressetpci = (ClpRspSetPci *)resh;
 225
 226         pbdev = s390_pci_find_dev_by_fh(s, ldl_p(&reqsetpci->fh));
 227         if (!pbdev) {
 228                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FH);
 229                 goto out;
 230         }
 231
 232         switch (reqsetpci->oc) {
 233         case CLP_SET_ENABLE_PCI_FN:
 234             switch (reqsetpci->ndas) {
 235             case 0:
 236                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_DMAAS);
 237                 goto out;
 238             case 1:
 239                 break;
 240             default:
 241                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_RES);
 242                 goto out;
 243             }
 244
 245             if (pbdev->fh & FH_MASK_ENABLE) {
 246                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
 247                 goto out;
 248             }
 249
 250             pbdev->fh |= FH_MASK_ENABLE;
 251             pbdev->state = ZPCI_FS_ENABLED;
 252             stl_p(&ressetpci->fh, pbdev->fh);
 253             stw_p(&ressetpci->hdr.rsp, CLP_RC_OK);
 254             break;
 255         case CLP_SET_DISABLE_PCI_FN:
 256             if (!(pbdev->fh & FH_MASK_ENABLE)) {
 257                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
 258                 goto out;
 259             }
 260             device_legacy_reset(DEVICE(pbdev));
 261             pbdev->fh &= ~FH_MASK_ENABLE;
 262             pbdev->state = ZPCI_FS_DISABLED;
 263             stl_p(&ressetpci->fh, pbdev->fh);
 264             stw_p(&ressetpci->hdr.rsp, CLP_RC_OK);
 265             break;
 266         default:
 267             DPRINTF("unknown set pci command\n");
 268             stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
 269             break;
 270         }
 271         break;
 272     }
 273     case CLP_QUERY_PCI_FN: {
 274         ClpReqQueryPci *reqquery = (ClpReqQueryPci *)reqh;
 275         ClpRspQueryPci *resquery = (ClpRspQueryPci *)resh;
 276
 277         pbdev = s390_pci_find_dev_by_fh(s, ldl_p(&reqquery->fh));
 278         if (!pbdev) {
 279             DPRINTF("query pci no pci dev\n");
 280             stw_p(&resquery->hdr.rsp, CLP_RC_SETPCIFN_FH);
 281             goto out;
 282         }
 283
 284         for (i = 0; i < PCI_BAR_COUNT; i++) {
 285             uint32_t data = pci_get_long(pbdev->pdev->config +
 286                 PCI_BASE_ADDRESS_0 + (i * 4));
 287
 288             stl_p(&resquery->bar[i], data);
 289             resquery->bar_size[i] = pbdev->pdev->io_regions[i].size ?
 290                                     ctz64(pbdev->pdev->io_regions[i].size) : 0;
 291             DPRINTF("bar %d addr 0x%x size 0x%" PRIx64 "barsize 0x%x\n", i,
 292                     ldl_p(&resquery->bar[i]),
 293                     pbdev->pdev->io_regions[i].size,
 294                     resquery->bar_size[i]);
 295         }
 296
 297         stq_p(&resquery->sdma, ZPCI_SDMA_ADDR);
 298         stq_p(&resquery->edma, ZPCI_EDMA_ADDR);
 299         stl_p(&resquery->fid, pbdev->fid);
 300         stw_p(&resquery->pchid, 0);
 301         stw_p(&resquery->ug, ZPCI_DEFAULT_FN_GRP);
 302         stl_p(&resquery->uid, pbdev->uid);
 303         stw_p(&resquery->hdr.rsp, CLP_RC_OK);
 304         break;
 305     }
 306     case CLP_QUERY_PCI_FNGRP: {
 307         ClpRspQueryPciGrp *resgrp = (ClpRspQueryPciGrp *)resh;
 308
 309         ClpReqQueryPciGrp *reqgrp = (ClpReqQueryPciGrp *)reqh;
 310         S390PCIGroup *group;
 311
 312         group = s390_group_find(reqgrp->g);
 313         if (!group) {
 314             /* We do not allow access to unknown groups */
 315             /* The group must have been obtained with a vfio device */
 316             stw_p(&resgrp->hdr.rsp, CLP_RC_QUERYPCIFG_PFGID);
 317             goto out;
 318         }
 319         memcpy(resgrp, &group->zpci_group, sizeof(ClpRspQueryPciGrp));
 320         stw_p(&resgrp->hdr.rsp, CLP_RC_OK);
 321         break;
 322     }
 323     default:
 324         DPRINTF("unknown clp command\n");
 325         stw_p(&resh->rsp, CLP_RC_CMD);
 326         break;
 327     }
 328
 329 out:
 330     if (s390_cpu_virt_mem_write(cpu, env->regs[r2], r2, buffer,
 331                                 req_len + res_len)) {
 332         s390_cpu_virt_mem_handle_exc(cpu, ra);
 333         return 0;
 334     }
 335     setcc(cpu, cc);
 336     return 0;
 337 }
 338
 339 /**
 340  * Swap data contained in s390x big endian registers to little endian
 341  * PCI bars.
 342  *
 343  * @ptr: a pointer to a uint64_t data field
 344  * @len: the length of the valid data, must be 1,2,4 or 8
 345  */
 346 static int zpci_endian_swap(uint64_t *ptr, uint8_t len)
 347 {
 348     uint64_t data = *ptr;
 349
 350     switch (len) {
 351     case 1:
 352         break;
 353     case 2:
 354         data = bswap16(data);
 355         break;
 356     case 4:
 357         data = bswap32(data);
 358         break;
 359     case 8:
 360         data = bswap64(data);
 361         break;
 362     default:
 363         return -EINVAL;
 364     }
 365     *ptr = data;
 366     return 0;
 367 }
 368
 369 static MemoryRegion *s390_get_subregion(MemoryRegion *mr, uint64_t offset,
 370                                         uint8_t len)
 371 {
 372     MemoryRegion *subregion;
 373     uint64_t subregion_size;
 374
 375     QTAILQ_FOREACH(subregion, &mr->subregions, subregions_link) {
 376         subregion_size = int128_get64(subregion->size);
 377         if ((offset >= subregion->addr) &&
 378             (offset + len) <= (subregion->addr + subregion_size)) {
 379             mr = subregion;
 380             break;
 381         }
 382     }
 383     return mr;
 384 }
 385
 386 static MemTxResult zpci_read_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
 387                                  uint64_t offset, uint64_t *data, uint8_t len)
 388 {
 389     MemoryRegion *mr;
 390
 391     mr = pbdev->pdev->io_regions[pcias].memory;
 392     mr = s390_get_subregion(mr, offset, len);
 393     offset -= mr->addr;
 394     return memory_region_dispatch_read(mr, offset, data,
 395                                        size_memop(len) | MO_BE,
 396                                        MEMTXATTRS_UNSPECIFIED);
 397 }
 398
 399 int pcilg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
 400 {
 401     CPUS390XState *env = &cpu->env;
 402     S390PCIBusDevice *pbdev;
 403     uint64_t offset;
 404     uint64_t data;
 405     MemTxResult result;
 406     uint8_t len;
 407     uint32_t fh;
 408     uint8_t pcias;
 409
 410     if (env->psw.mask & PSW_MASK_PSTATE) {
 411         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
 412         return 0;
 413     }
 414
 415     if (r2 & 0x1) {
 416         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
 417         return 0;
 418     }
 419
 420     fh = env->regs[r2] >> 32;
 421     pcias = (env->regs[r2] >> 16) & 0xf;
 422     len = env->regs[r2] & 0xf;
 423     offset = env->regs[r2 + 1];
 424
 425     if (!(fh & FH_MASK_ENABLE)) {
 426         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 427         return 0;
 428     }
 429
 430     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
 431     if (!pbdev) {
 432         DPRINTF("pcilg no pci dev\n");
 433         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 434         return 0;
 435     }
 436
 437     switch (pbdev->state) {
 438     case ZPCI_FS_PERMANENT_ERROR:
 439     case ZPCI_FS_ERROR:
 440         setcc(cpu, ZPCI_PCI_LS_ERR);
 441         s390_set_status_code(env, r2, ZPCI_PCI_ST_BLOCKED);
 442         return 0;
 443     default:
 444         break;
 445     }
 446
 447     switch (pcias) {
 448     case ZPCI_IO_BAR_MIN...ZPCI_IO_BAR_MAX:
 449         if (!len || (len > (8 - (offset & 0x7)))) {
 450             s390_program_interrupt(env, PGM_OPERAND, ra);
 451             return 0;
 452         }
 453         result = zpci_read_bar(pbdev, pcias, offset, &data, len);
 454         if (result != MEMTX_OK) {
 455             s390_program_interrupt(env, PGM_OPERAND, ra);
 456             return 0;
 457         }
 458         break;
 459     case ZPCI_CONFIG_BAR:
 460         if (!len || (len > (4 - (offset & 0x3))) || len == 3) {
 461             s390_program_interrupt(env, PGM_OPERAND, ra);
 462             return 0;
 463         }
 464         data =  pci_host_config_read_common(
 465                    pbdev->pdev, offset, pci_config_size(pbdev->pdev), len);
 466
 467         if (zpci_endian_swap(&data, len)) {
 468             s390_program_interrupt(env, PGM_OPERAND, ra);
 469             return 0;
 470         }
 471         break;
 472     default:
 473         DPRINTF("pcilg invalid space\n");
 474         setcc(cpu, ZPCI_PCI_LS_ERR);
 475         s390_set_status_code(env, r2, ZPCI_PCI_ST_INVAL_AS);
 476         return 0;
 477     }
 478
 479     pbdev->fmb.counter[ZPCI_FMB_CNT_LD]++;
 480
 481     env->regs[r1] = data;
 482     setcc(cpu, ZPCI_PCI_LS_OK);
 483     return 0;
 484 }
 485
 486 static MemTxResult zpci_write_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
 487                                   uint64_t offset, uint64_t data, uint8_t len)
 488 {
 489     MemoryRegion *mr;
 490
 491     mr = pbdev->pdev->io_regions[pcias].memory;
 492     mr = s390_get_subregion(mr, offset, len);
 493     offset -= mr->addr;
 494     return memory_region_dispatch_write(mr, offset, data,
 495                                         size_memop(len) | MO_BE,
 496                                         MEMTXATTRS_UNSPECIFIED);
 497 }
 498
 499 int pcistg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
 500 {
 501     CPUS390XState *env = &cpu->env;
 502     uint64_t offset, data;
 503     S390PCIBusDevice *pbdev;
 504     MemTxResult result;
 505     uint8_t len;
 506     uint32_t fh;
 507     uint8_t pcias;
 508
 509     if (env->psw.mask & PSW_MASK_PSTATE) {
 510         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
 511         return 0;
 512     }
 513
 514     if (r2 & 0x1) {
 515         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
 516         return 0;
 517     }
 518
 519     fh = env->regs[r2] >> 32;
 520     pcias = (env->regs[r2] >> 16) & 0xf;
 521     len = env->regs[r2] & 0xf;
 522     offset = env->regs[r2 + 1];
 523     data = env->regs[r1];
 524
 525     if (!(fh & FH_MASK_ENABLE)) {
 526         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 527         return 0;
 528     }
 529
 530     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
 531     if (!pbdev) {
 532         DPRINTF("pcistg no pci dev\n");
 533         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 534         return 0;
 535     }
 536
 537     switch (pbdev->state) {
 538     /* ZPCI_FS_RESERVED, ZPCI_FS_STANDBY and ZPCI_FS_DISABLED
 539      * are already covered by the FH_MASK_ENABLE check above
 540      */
 541     case ZPCI_FS_PERMANENT_ERROR:
 542     case ZPCI_FS_ERROR:
 543         setcc(cpu, ZPCI_PCI_LS_ERR);
 544         s390_set_status_code(env, r2, ZPCI_PCI_ST_BLOCKED);
 545         return 0;
 546     default:
 547         break;
 548     }
 549
 550     switch (pcias) {
 551         /* A ZPCI PCI card may use any BAR from BAR 0 to BAR 5 */
 552     case ZPCI_IO_BAR_MIN...ZPCI_IO_BAR_MAX:
 553         /* Check length:
 554          * A length of 0 is invalid and length should not cross a double word
 555          */
 556         if (!len || (len > (8 - (offset & 0x7)))) {
 557             s390_program_interrupt(env, PGM_OPERAND, ra);
 558             return 0;
 559         }
 560
 561         result = zpci_write_bar(pbdev, pcias, offset, data, len);
 562         if (result != MEMTX_OK) {
 563             s390_program_interrupt(env, PGM_OPERAND, ra);
 564             return 0;
 565         }
 566         break;
 567     case ZPCI_CONFIG_BAR:
 568         /* ZPCI uses the pseudo BAR number 15 as configuration space */
 569         /* possible access lengths are 1,2,4 and must not cross a word */
 570         if (!len || (len > (4 - (offset & 0x3))) || len == 3) {
 571             s390_program_interrupt(env, PGM_OPERAND, ra);
 572             return 0;
 573         }
 574         /* len = 1,2,4 so we do not need to test */
 575         zpci_endian_swap(&data, len);
 576         pci_host_config_write_common(pbdev->pdev, offset,
 577                                      pci_config_size(pbdev->pdev),
 578                                      data, len);
 579         break;
 580     default:
 581         DPRINTF("pcistg invalid space\n");
 582         setcc(cpu, ZPCI_PCI_LS_ERR);
 583         s390_set_status_code(env, r2, ZPCI_PCI_ST_INVAL_AS);
 584         return 0;
 585     }
 586
 587     pbdev->fmb.counter[ZPCI_FMB_CNT_ST]++;
 588
 589     setcc(cpu, ZPCI_PCI_LS_OK);
 590     return 0;
 591 }
 592
 593 static uint32_t s390_pci_update_iotlb(S390PCIIOMMU *iommu,
 594                                       S390IOTLBEntry *entry)
 595 {
 596     S390IOTLBEntry *cache = g_hash_table_lookup(iommu->iotlb, &entry->iova);
 597     IOMMUTLBEntry notify = {
 598         .target_as = &address_space_memory,
 599         .iova = entry->iova,
 600         .translated_addr = entry->translated_addr,
 601         .perm = entry->perm,
 602         .addr_mask = ~PAGE_MASK,
 603     };
 604
 605     if (entry->perm == IOMMU_NONE) {
 606         if (!cache) {
 607             goto out;
 608         }
 609         g_hash_table_remove(iommu->iotlb, &entry->iova);
 610         inc_dma_avail(iommu);
 611     } else {
 612         if (cache) {
 613             if (cache->perm == entry->perm &&
 614                 cache->translated_addr == entry->translated_addr) {
 615                 goto out;
 616             }
 617
 618             notify.perm = IOMMU_NONE;
 619             memory_region_notify_iommu(&iommu->iommu_mr, 0, notify);
 620             notify.perm = entry->perm;
 621         }
 622
 623         cache = g_new(S390IOTLBEntry, 1);
 624         cache->iova = entry->iova;
 625         cache->translated_addr = entry->translated_addr;
 626         cache->len = PAGE_SIZE;
 627         cache->perm = entry->perm;
 628         g_hash_table_replace(iommu->iotlb, &cache->iova, cache);
 629         dec_dma_avail(iommu);
 630     }
 631
 632     memory_region_notify_iommu(&iommu->iommu_mr, 0, notify);
 633
 634 out:
 635     return iommu->dma_limit ? iommu->dma_limit->avail : 1;
 636 }
 637
 638 int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
 639 {
 640     CPUS390XState *env = &cpu->env;
 641     uint32_t fh;
 642     uint16_t error = 0;
 643     S390PCIBusDevice *pbdev;
 644     S390PCIIOMMU *iommu;
 645     S390IOTLBEntry entry;
 646     hwaddr start, end;
 647     uint32_t dma_avail;
 648
 649     if (env->psw.mask & PSW_MASK_PSTATE) {
 650         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
 651         return 0;
 652     }
 653
 654     if (r2 & 0x1) {
 655         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
 656         return 0;
 657     }
 658
 659     fh = env->regs[r1] >> 32;
 660     start = env->regs[r2];
 661     end = start + env->regs[r2 + 1];
 662
 663     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
 664     if (!pbdev) {
 665         DPRINTF("rpcit no pci dev\n");
 666         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 667         return 0;
 668     }
 669
 670     switch (pbdev->state) {
 671     case ZPCI_FS_RESERVED:
 672     case ZPCI_FS_STANDBY:
 673     case ZPCI_FS_DISABLED:
 674     case ZPCI_FS_PERMANENT_ERROR:
 675         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 676         return 0;
 677     case ZPCI_FS_ERROR:
 678         setcc(cpu, ZPCI_PCI_LS_ERR);
 679         s390_set_status_code(env, r1, ZPCI_MOD_ST_ERROR_RECOVER);
 680         return 0;
 681     default:
 682         break;
 683     }
 684
 685     iommu = pbdev->iommu;
 686     if (iommu->dma_limit) {
 687         dma_avail = iommu->dma_limit->avail;
 688     } else {
 689         dma_avail = 1;
 690     }
 691     if (!iommu->g_iota) {
 692         error = ERR_EVENT_INVALAS;
 693         goto err;
 694     }
 695
 696     if (end < iommu->pba || start > iommu->pal) {
 697         error = ERR_EVENT_OORANGE;
 698         goto err;
 699     }
 700
 701     while (start < end) {
 702         error = s390_guest_io_table_walk(iommu->g_iota, start, &entry);
 703         if (error) {
 704             break;
 705         }
 706
 707         start += entry.len;
 708         while (entry.iova < start && entry.iova < end &&
 709                (dma_avail > 0 || entry.perm == IOMMU_NONE)) {
 710             dma_avail = s390_pci_update_iotlb(iommu, &entry);
 711             entry.iova += PAGE_SIZE;
 712             entry.translated_addr += PAGE_SIZE;
 713         }
 714     }
 715 err:
 716     if (error) {
 717         pbdev->state = ZPCI_FS_ERROR;
 718         setcc(cpu, ZPCI_PCI_LS_ERR);
 719         s390_set_status_code(env, r1, ZPCI_PCI_ST_FUNC_IN_ERR);
 720         s390_pci_generate_error_event(error, pbdev->fh, pbdev->fid, start, 0);
 721     } else {
 722         pbdev->fmb.counter[ZPCI_FMB_CNT_RPCIT]++;
 723         if (dma_avail > 0) {
 724             setcc(cpu, ZPCI_PCI_LS_OK);
 725         } else {
 726             /* vfio DMA mappings are exhausted, trigger a RPCIT */
 727             setcc(cpu, ZPCI_PCI_LS_ERR);
 728             s390_set_status_code(env, r1, ZPCI_RPCIT_ST_INSUFF_RES);
 729         }
 730     }
 731     return 0;
 732 }
 733
 734 int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
 735                         uint8_t ar, uintptr_t ra)
 736 {
 737     CPUS390XState *env = &cpu->env;
 738     S390PCIBusDevice *pbdev;
 739     MemoryRegion *mr;
 740     MemTxResult result;
 741     uint64_t offset;
 742     int i;
 743     uint32_t fh;
 744     uint8_t pcias;
 745     uint8_t len;
 746     uint8_t buffer[128];
 747
 748     if (env->psw.mask & PSW_MASK_PSTATE) {
 749         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
 750         return 0;
 751     }
 752
 753     fh = env->regs[r1] >> 32;
 754     pcias = (env->regs[r1] >> 16) & 0xf;
 755     len = env->regs[r1] & 0xff;
 756     offset = env->regs[r3];
 757
 758     if (!(fh & FH_MASK_ENABLE)) {
 759         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 760         return 0;
 761     }
 762
 763     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
 764     if (!pbdev) {
 765         DPRINTF("pcistb no pci dev fh 0x%x\n", fh);
 766         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 767         return 0;
 768     }
 769
 770     switch (pbdev->state) {
 771     case ZPCI_FS_PERMANENT_ERROR:
 772     case ZPCI_FS_ERROR:
 773         setcc(cpu, ZPCI_PCI_LS_ERR);
 774         s390_set_status_code(env, r1, ZPCI_PCI_ST_BLOCKED);
 775         return 0;
 776     default:
 777         break;
 778     }
 779
 780     if (pcias > ZPCI_IO_BAR_MAX) {
 781         DPRINTF("pcistb invalid space\n");
 782         setcc(cpu, ZPCI_PCI_LS_ERR);
 783         s390_set_status_code(env, r1, ZPCI_PCI_ST_INVAL_AS);
 784         return 0;
 785     }
 786
 787     /* Verify the address, offset and length */
 788     /* offset must be a multiple of 8 */
 789     if (offset % 8) {
 790         goto specification_error;
 791     }
 792     /* Length must be greater than 8, a multiple of 8 */
 793     /* and not greater than maxstbl */
 794     if ((len <= 8) || (len % 8) ||
 795         (len > pbdev->pci_group->zpci_group.maxstbl)) {
 796         goto specification_error;
 797     }
 798     /* Do not cross a 4K-byte boundary */
 799     if (((offset & 0xfff) + len) > 0x1000) {
 800         goto specification_error;
 801     }
 802     /* Guest address must be double word aligned */
 803     if (gaddr & 0x07UL) {
 804         goto specification_error;
 805     }
 806
 807     mr = pbdev->pdev->io_regions[pcias].memory;
 808     mr = s390_get_subregion(mr, offset, len);
 809     offset -= mr->addr;
 810
 811     if (!memory_region_access_valid(mr, offset, len, true,
 812                                     MEMTXATTRS_UNSPECIFIED)) {
 813         s390_program_interrupt(env, PGM_OPERAND, ra);
 814         return 0;
 815     }
 816
 817     if (s390_cpu_virt_mem_read(cpu, gaddr, ar, buffer, len)) {
 818         s390_cpu_virt_mem_handle_exc(cpu, ra);
 819         return 0;
 820     }
 821
 822     for (i = 0; i < len / 8; i++) {
 823         result = memory_region_dispatch_write(mr, offset + i * 8,
 824                                               ldq_p(buffer + i * 8),
 825                                               MO_64, MEMTXATTRS_UNSPECIFIED);
 826         if (result != MEMTX_OK) {
 827             s390_program_interrupt(env, PGM_OPERAND, ra);
 828             return 0;
 829         }
 830     }
 831
 832     pbdev->fmb.counter[ZPCI_FMB_CNT_STB]++;
 833
 834     setcc(cpu, ZPCI_PCI_LS_OK);
 835     return 0;
 836
 837 specification_error:
 838     s390_program_interrupt(env, PGM_SPECIFICATION, ra);
 839     return 0;
 840 }
 841
 842 static int reg_irqs(CPUS390XState *env, S390PCIBusDevice *pbdev, ZpciFib fib)
 843 {
 844     int ret, len;
 845     uint8_t isc = FIB_DATA_ISC(ldl_p(&fib.data));
 846
 847     pbdev->routes.adapter.adapter_id = css_get_adapter_id(
 848                                        CSS_IO_ADAPTER_PCI, isc);
 849     pbdev->summary_ind = get_indicator(ldq_p(&fib.aisb), sizeof(uint64_t));
 850     len = BITS_TO_LONGS(FIB_DATA_NOI(ldl_p(&fib.data))) * sizeof(unsigned long);
 851     pbdev->indicator = get_indicator(ldq_p(&fib.aibv), len);
 852
 853     ret = map_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
 854     if (ret) {
 855         goto out;
 856     }
 857
 858     ret = map_indicator(&pbdev->routes.adapter, pbdev->indicator);
 859     if (ret) {
 860         goto out;
 861     }
 862
 863     pbdev->routes.adapter.summary_addr = ldq_p(&fib.aisb);
 864     pbdev->routes.adapter.summary_offset = FIB_DATA_AISBO(ldl_p(&fib.data));
 865     pbdev->routes.adapter.ind_addr = ldq_p(&fib.aibv);
 866     pbdev->routes.adapter.ind_offset = FIB_DATA_AIBVO(ldl_p(&fib.data));
 867     pbdev->isc = isc;
 868     pbdev->noi = FIB_DATA_NOI(ldl_p(&fib.data));
 869     pbdev->sum = FIB_DATA_SUM(ldl_p(&fib.data));
 870
 871     DPRINTF("reg_irqs adapter id %d\n", pbdev->routes.adapter.adapter_id);
 872     return 0;
 873 out:
 874     release_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
 875     release_indicator(&pbdev->routes.adapter, pbdev->indicator);
 876     pbdev->summary_ind = NULL;
 877     pbdev->indicator = NULL;
 878     return ret;
 879 }
 880
 881 int pci_dereg_irqs(S390PCIBusDevice *pbdev)
 882 {
 883     release_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
 884     release_indicator(&pbdev->routes.adapter, pbdev->indicator);
 885
 886     pbdev->summary_ind = NULL;
 887     pbdev->indicator = NULL;
 888     pbdev->routes.adapter.summary_addr = 0;
 889     pbdev->routes.adapter.summary_offset = 0;
 890     pbdev->routes.adapter.ind_addr = 0;
 891     pbdev->routes.adapter.ind_offset = 0;
 892     pbdev->isc = 0;
 893     pbdev->noi = 0;
 894     pbdev->sum = 0;
 895
 896     DPRINTF("dereg_irqs adapter id %d\n", pbdev->routes.adapter.adapter_id);
 897     return 0;
 898 }
 899
 900 static int reg_ioat(CPUS390XState *env, S390PCIIOMMU *iommu, ZpciFib fib,
 901                     uintptr_t ra)
 902 {
 903     uint64_t pba = ldq_p(&fib.pba);
 904     uint64_t pal = ldq_p(&fib.pal);
 905     uint64_t g_iota = ldq_p(&fib.iota);
 906     uint8_t dt = (g_iota >> 2) & 0x7;
 907     uint8_t t = (g_iota >> 11) & 0x1;
 908
 909     pba &= ~0xfff;
 910     pal |= 0xfff;
 911     if (pba > pal || pba < ZPCI_SDMA_ADDR || pal > ZPCI_EDMA_ADDR) {
 912         s390_program_interrupt(env, PGM_OPERAND, ra);
 913         return -EINVAL;
 914     }
 915
 916     /* currently we only support designation type 1 with translation */
 917     if (!(dt == ZPCI_IOTA_RTTO && t)) {
 918         error_report("unsupported ioat dt %d t %d", dt, t);
 919         s390_program_interrupt(env, PGM_OPERAND, ra);
 920         return -EINVAL;
 921     }
 922
 923     iommu->pba = pba;
 924     iommu->pal = pal;
 925     iommu->g_iota = g_iota;
 926
 927     s390_pci_iommu_enable(iommu);
 928
 929     return 0;
 930 }
 931
 932 void pci_dereg_ioat(S390PCIIOMMU *iommu)
 933 {
 934     s390_pci_iommu_disable(iommu);
 935     iommu->pba = 0;
 936     iommu->pal = 0;
 937     iommu->g_iota = 0;
 938 }
 939
 940 void fmb_timer_free(S390PCIBusDevice *pbdev)
 941 {
 942     if (pbdev->fmb_timer) {
 943         timer_del(pbdev->fmb_timer);
 944         timer_free(pbdev->fmb_timer);
 945         pbdev->fmb_timer = NULL;
 946     }
 947     pbdev->fmb_addr = 0;
 948     memset(&pbdev->fmb, 0, sizeof(ZpciFmb));
 949 }
 950
 951 static int fmb_do_update(S390PCIBusDevice *pbdev, int offset, uint64_t val,
 952                          int len)
 953 {
 954     MemTxResult ret;
 955     uint64_t dst = pbdev->fmb_addr + offset;
 956
 957     switch (len) {
 958     case 8:
 959         address_space_stq_be(&address_space_memory, dst, val,
 960                              MEMTXATTRS_UNSPECIFIED,
 961                              &ret);
 962         break;
 963     case 4:
 964         address_space_stl_be(&address_space_memory, dst, val,
 965                              MEMTXATTRS_UNSPECIFIED,
 966                              &ret);
 967         break;
 968     case 2:
 969         address_space_stw_be(&address_space_memory, dst, val,
 970                              MEMTXATTRS_UNSPECIFIED,
 971                              &ret);
 972         break;
 973     case 1:
 974         address_space_stb(&address_space_memory, dst, val,
 975                           MEMTXATTRS_UNSPECIFIED,
 976                           &ret);
 977         break;
 978     default:
 979         ret = MEMTX_ERROR;
 980         break;
 981     }
 982     if (ret != MEMTX_OK) {
 983         s390_pci_generate_error_event(ERR_EVENT_FMBA, pbdev->fh, pbdev->fid,
 984                                       pbdev->fmb_addr, 0);
 985         fmb_timer_free(pbdev);
 986     }
 987
 988     return ret;
 989 }
 990
 991 static void fmb_update(void *opaque)
 992 {
 993     S390PCIBusDevice *pbdev = opaque;
 994     int64_t t = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
 995     int i;
 996
 997     /* Update U bit */
 998     pbdev->fmb.last_update *= 2;
 999     pbdev->fmb.last_update |= UPDATE_U_BIT;
1000     if (fmb_do_update(pbdev, offsetof(ZpciFmb, last_update),
1001                       pbdev->fmb.last_update,
1002                       sizeof(pbdev->fmb.last_update))) {
1003         return;
1004     }
1005
1006     /* Update FMB sample count */
1007     if (fmb_do_update(pbdev, offsetof(ZpciFmb, sample),
1008                       pbdev->fmb.sample++,
1009                       sizeof(pbdev->fmb.sample))) {
1010         return;
1011     }
1012
1013     /* Update FMB counters */
1014     for (i = 0; i < ZPCI_FMB_CNT_MAX; i++) {
1015         if (fmb_do_update(pbdev, offsetof(ZpciFmb, counter[i]),
1016                           pbdev->fmb.counter[i],
1017                           sizeof(pbdev->fmb.counter[0]))) {
1018             return;
1019         }
1020     }
1021
1022     /* Clear U bit and update the time */
1023     pbdev->fmb.last_update = time2tod(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
1024     pbdev->fmb.last_update *= 2;
1025     if (fmb_do_update(pbdev, offsetof(ZpciFmb, last_update),
1026                       pbdev->fmb.last_update,
1027                       sizeof(pbdev->fmb.last_update))) {
1028         return;
1029     }
1030     timer_mod(pbdev->fmb_timer, t + DEFAULT_MUI);
1031 }
1032
1033 int mpcifc_service_call(S390CPU *cpu, uint8_t r1, uint64_t fiba, uint8_t ar,
1034                         uintptr_t ra)
1035 {
1036     CPUS390XState *env = &cpu->env;
1037     uint8_t oc, dmaas;
1038     uint32_t fh;
1039     ZpciFib fib;
1040     S390PCIBusDevice *pbdev;
1041     uint64_t cc = ZPCI_PCI_LS_OK;
1042
1043     if (env->psw.mask & PSW_MASK_PSTATE) {
1044         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
1045         return 0;
1046     }
1047
1048     oc = env->regs[r1] & 0xff;
1049     dmaas = (env->regs[r1] >> 16) & 0xff;
1050     fh = env->regs[r1] >> 32;
1051
1052     if (fiba & 0x7) {
1053         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
1054         return 0;
1055     }
1056
1057     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
1058     if (!pbdev) {
1059         DPRINTF("mpcifc no pci dev fh 0x%x\n", fh);
1060         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1061         return 0;
1062     }
1063
1064     switch (pbdev->state) {
1065     case ZPCI_FS_RESERVED:
1066     case ZPCI_FS_STANDBY:
1067     case ZPCI_FS_DISABLED:
1068     case ZPCI_FS_PERMANENT_ERROR:
1069         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1070         return 0;
1071     default:
1072         break;
1073     }
1074
1075     if (s390_cpu_virt_mem_read(cpu, fiba, ar, (uint8_t *)&fib, sizeof(fib))) {
1076         s390_cpu_virt_mem_handle_exc(cpu, ra);
1077         return 0;
1078     }
1079
1080     if (fib.fmt != 0) {
1081         s390_program_interrupt(env, PGM_OPERAND, ra);
1082         return 0;
1083     }
1084
1085     switch (oc) {
1086     case ZPCI_MOD_FC_REG_INT:
1087         if (pbdev->summary_ind) {
1088             cc = ZPCI_PCI_LS_ERR;
1089             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1090         } else if (reg_irqs(env, pbdev, fib)) {
1091             cc = ZPCI_PCI_LS_ERR;
1092             s390_set_status_code(env, r1, ZPCI_MOD_ST_RES_NOT_AVAIL);
1093         }
1094         break;
1095     case ZPCI_MOD_FC_DEREG_INT:
1096         if (!pbdev->summary_ind) {
1097             cc = ZPCI_PCI_LS_ERR;
1098             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1099         } else {
1100             pci_dereg_irqs(pbdev);
1101         }
1102         break;
1103     case ZPCI_MOD_FC_REG_IOAT:
1104         if (dmaas != 0) {
1105             cc = ZPCI_PCI_LS_ERR;
1106             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1107         } else if (pbdev->iommu->enabled) {
1108             cc = ZPCI_PCI_LS_ERR;
1109             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1110         } else if (reg_ioat(env, pbdev->iommu, fib, ra)) {
1111             cc = ZPCI_PCI_LS_ERR;
1112             s390_set_status_code(env, r1, ZPCI_MOD_ST_INSUF_RES);
1113         }
1114         break;
1115     case ZPCI_MOD_FC_DEREG_IOAT:
1116         if (dmaas != 0) {
1117             cc = ZPCI_PCI_LS_ERR;
1118             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1119         } else if (!pbdev->iommu->enabled) {
1120             cc = ZPCI_PCI_LS_ERR;
1121             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1122         } else {
1123             pci_dereg_ioat(pbdev->iommu);
1124         }
1125         break;
1126     case ZPCI_MOD_FC_REREG_IOAT:
1127         if (dmaas != 0) {
1128             cc = ZPCI_PCI_LS_ERR;
1129             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1130         } else if (!pbdev->iommu->enabled) {
1131             cc = ZPCI_PCI_LS_ERR;
1132             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1133         } else {
1134             pci_dereg_ioat(pbdev->iommu);
1135             if (reg_ioat(env, pbdev->iommu, fib, ra)) {
1136                 cc = ZPCI_PCI_LS_ERR;
1137                 s390_set_status_code(env, r1, ZPCI_MOD_ST_INSUF_RES);
1138             }
1139         }
1140         break;
1141     case ZPCI_MOD_FC_RESET_ERROR:
1142         switch (pbdev->state) {
1143         case ZPCI_FS_BLOCKED:
1144         case ZPCI_FS_ERROR:
1145             pbdev->state = ZPCI_FS_ENABLED;
1146             break;
1147         default:
1148             cc = ZPCI_PCI_LS_ERR;
1149             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1150         }
1151         break;
1152     case ZPCI_MOD_FC_RESET_BLOCK:
1153         switch (pbdev->state) {
1154         case ZPCI_FS_ERROR:
1155             pbdev->state = ZPCI_FS_BLOCKED;
1156             break;
1157         default:
1158             cc = ZPCI_PCI_LS_ERR;
1159             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1160         }
1161         break;
1162     case ZPCI_MOD_FC_SET_MEASURE: {
1163         uint64_t fmb_addr = ldq_p(&fib.fmb_addr);
1164
1165         if (fmb_addr & FMBK_MASK) {
1166             cc = ZPCI_PCI_LS_ERR;
1167             s390_pci_generate_error_event(ERR_EVENT_FMBPRO, pbdev->fh,
1168                                           pbdev->fid, fmb_addr, 0);
1169             fmb_timer_free(pbdev);
1170             break;
1171         }
1172
1173         if (!fmb_addr) {
1174             /* Stop updating FMB. */
1175             fmb_timer_free(pbdev);
1176             break;
1177         }
1178
1179         if (!pbdev->fmb_timer) {
1180             pbdev->fmb_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL,
1181                                             fmb_update, pbdev);
1182         } else if (timer_pending(pbdev->fmb_timer)) {
1183             /* Remove pending timer to update FMB address. */
1184             timer_del(pbdev->fmb_timer);
1185         }
1186         pbdev->fmb_addr = fmb_addr;
1187         timer_mod(pbdev->fmb_timer,
1188                   qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + DEFAULT_MUI);
1189         break;
1190     }
1191     default:
1192         s390_program_interrupt(&cpu->env, PGM_OPERAND, ra);
1193         cc = ZPCI_PCI_LS_ERR;
1194     }
1195
1196     setcc(cpu, cc);
1197     return 0;
1198 }
1199
1200 int stpcifc_service_call(S390CPU *cpu, uint8_t r1, uint64_t fiba, uint8_t ar,
1201                          uintptr_t ra)
1202 {
1203     CPUS390XState *env = &cpu->env;
1204     uint8_t dmaas;
1205     uint32_t fh;
1206     ZpciFib fib;
1207     S390PCIBusDevice *pbdev;
1208     uint32_t data;
1209     uint64_t cc = ZPCI_PCI_LS_OK;
1210
1211     if (env->psw.mask & PSW_MASK_PSTATE) {
1212         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
1213         return 0;
1214     }
1215
1216     fh = env->regs[r1] >> 32;
1217     dmaas = (env->regs[r1] >> 16) & 0xff;
1218
1219     if (dmaas) {
1220         setcc(cpu, ZPCI_PCI_LS_ERR);
1221         s390_set_status_code(env, r1, ZPCI_STPCIFC_ST_INVAL_DMAAS);
1222         return 0;
1223     }
1224
1225     if (fiba & 0x7) {
1226         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
1227         return 0;
1228     }
1229
1230     pbdev = s390_pci_find_dev_by_idx(s390_get_phb(), fh & FH_MASK_INDEX);
1231     if (!pbdev) {
1232         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1233         return 0;
1234     }
1235
1236     memset(&fib, 0, sizeof(fib));
1237
1238     switch (pbdev->state) {
1239     case ZPCI_FS_RESERVED:
1240     case ZPCI_FS_STANDBY:
1241         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1242         return 0;
1243     case ZPCI_FS_DISABLED:
1244         if (fh & FH_MASK_ENABLE) {
1245             setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1246             return 0;
1247         }
1248         goto out;
1249     /* BLOCKED bit is set to one coincident with the setting of ERROR bit.
1250      * FH Enabled bit is set to one in states of ENABLED, BLOCKED or ERROR. */
1251     case ZPCI_FS_ERROR:
1252         fib.fc |= 0x20;
1253         /* fallthrough */
1254     case ZPCI_FS_BLOCKED:
1255         fib.fc |= 0x40;
1256         /* fallthrough */
1257     case ZPCI_FS_ENABLED:
1258         fib.fc |= 0x80;
1259         if (pbdev->iommu->enabled) {
1260             fib.fc |= 0x10;
1261         }
1262         if (!(fh & FH_MASK_ENABLE)) {
1263             env->regs[r1] |= 1ULL << 63;
1264         }
1265         break;
1266     case ZPCI_FS_PERMANENT_ERROR:
1267         setcc(cpu, ZPCI_PCI_LS_ERR);
1268         s390_set_status_code(env, r1, ZPCI_STPCIFC_ST_PERM_ERROR);
1269         return 0;
1270     }
1271
1272     stq_p(&fib.pba, pbdev->iommu->pba);
1273     stq_p(&fib.pal, pbdev->iommu->pal);
1274     stq_p(&fib.iota, pbdev->iommu->g_iota);
1275     stq_p(&fib.aibv, pbdev->routes.adapter.ind_addr);
1276     stq_p(&fib.aisb, pbdev->routes.adapter.summary_addr);
1277     stq_p(&fib.fmb_addr, pbdev->fmb_addr);
1278
1279     data = ((uint32_t)pbdev->isc << 28) | ((uint32_t)pbdev->noi << 16) |
1280            ((uint32_t)pbdev->routes.adapter.ind_offset << 8) |
1281            ((uint32_t)pbdev->sum << 7) | pbdev->routes.adapter.summary_offset;
1282     stl_p(&fib.data, data);
1283
1284 out:
1285     if (s390_cpu_virt_mem_write(cpu, fiba, ar, (uint8_t *)&fib, sizeof(fib))) {
1286         s390_cpu_virt_mem_handle_exc(cpu, ra);
1287         return 0;
1288     }
1289
1290     setcc(cpu, cc);
1291     return 0;
1292 }