hw/s390x/s390-pci-inst.c

   1 /*
   2  * s390 PCI instructions
   3  *
   4  * Copyright 2014 IBM Corp.
   5  * Author(s): Frank Blaschka <frank.blaschka@de.ibm.com>
   6  *            Hong Bo Li <lihbbj@cn.ibm.com>
   7  *            Yi Min Zhao <zyimin@cn.ibm.com>
   8  *
   9  * This work is licensed under the terms of the GNU GPL, version 2 or (at
  10  * your option) any later version. See the COPYING file in the top-level
  11  * directory.
  12  */
  13
  14 #include "qemu/osdep.h"
  15 #include "cpu.h"
  16 #include "exec/memop.h"
  17 #include "exec/memory-internal.h"
  18 #include "qemu/error-report.h"
  19 #include "sysemu/hw_accel.h"
  20 #include "hw/s390x/s390-pci-inst.h"
  21 #include "hw/s390x/s390-pci-bus.h"
  22 #include "hw/s390x/tod.h"
  23
  24 #ifndef DEBUG_S390PCI_INST
  25 #define DEBUG_S390PCI_INST  0
  26 #endif
  27
  28 #define DPRINTF(fmt, ...)                                          \
  29     do {                                                           \
  30         if (DEBUG_S390PCI_INST) {                                  \
  31             fprintf(stderr, "s390pci-inst: " fmt, ## __VA_ARGS__); \
  32         }                                                          \
  33     } while (0)
  34
  35 static inline void inc_dma_avail(S390PCIIOMMU *iommu)
  36 {
  37     if (iommu->dma_limit) {
  38         iommu->dma_limit->avail++;
  39     }
  40 }
  41
  42 static inline void dec_dma_avail(S390PCIIOMMU *iommu)
  43 {
  44     if (iommu->dma_limit) {
  45         iommu->dma_limit->avail--;
  46     }
  47 }
  48
  49 static void s390_set_status_code(CPUS390XState *env,
  50                                  uint8_t r, uint64_t status_code)
  51 {
  52     env->regs[r] &= ~0xff000000ULL;
  53     env->regs[r] |= (status_code & 0xff) << 24;
  54 }
  55
  56 static int list_pci(ClpReqRspListPci *rrb, uint8_t *cc)
  57 {
  58     S390PCIBusDevice *pbdev = NULL;
  59     S390pciState *s = s390_get_phb();
  60     uint32_t res_code, initial_l2, g_l2;
  61     int rc, i;
  62     uint64_t resume_token;
  63
  64     rc = 0;
  65     if (lduw_p(&rrb->request.hdr.len) != 32) {
  66         res_code = CLP_RC_LEN;
  67         rc = -EINVAL;
  68         goto out;
  69     }
  70
  71     if ((ldl_p(&rrb->request.fmt) & CLP_MASK_FMT) != 0) {
  72         res_code = CLP_RC_FMT;
  73         rc = -EINVAL;
  74         goto out;
  75     }
  76
  77     if ((ldl_p(&rrb->request.fmt) & ~CLP_MASK_FMT) != 0 ||
  78         ldq_p(&rrb->request.reserved1) != 0) {
  79         res_code = CLP_RC_RESNOT0;
  80         rc = -EINVAL;
  81         goto out;
  82     }
  83
  84     resume_token = ldq_p(&rrb->request.resume_token);
  85
  86     if (resume_token) {
  87         pbdev = s390_pci_find_dev_by_idx(s, resume_token);
  88         if (!pbdev) {
  89             res_code = CLP_RC_LISTPCI_BADRT;
  90             rc = -EINVAL;
  91             goto out;
  92         }
  93     } else {
  94         pbdev = s390_pci_find_next_avail_dev(s, NULL);
  95     }
  96
  97     if (lduw_p(&rrb->response.hdr.len) < 48) {
  98         res_code = CLP_RC_8K;
  99         rc = -EINVAL;
 100         goto out;
 101     }
 102
 103     initial_l2 = lduw_p(&rrb->response.hdr.len);
 104     if ((initial_l2 - LIST_PCI_HDR_LEN) % sizeof(ClpFhListEntry)
 105         != 0) {
 106         res_code = CLP_RC_LEN;
 107         rc = -EINVAL;
 108         *cc = 3;
 109         goto out;
 110     }
 111
 112     stl_p(&rrb->response.fmt, 0);
 113     stq_p(&rrb->response.reserved1, 0);
 114     stl_p(&rrb->response.mdd, FH_MASK_SHM);
 115     stw_p(&rrb->response.max_fn, PCI_MAX_FUNCTIONS);
 116     rrb->response.flags = UID_CHECKING_ENABLED;
 117     rrb->response.entry_size = sizeof(ClpFhListEntry);
 118
 119     i = 0;
 120     g_l2 = LIST_PCI_HDR_LEN;
 121     while (g_l2 < initial_l2 && pbdev) {
 122         stw_p(&rrb->response.fh_list[i].device_id,
 123             pci_get_word(pbdev->pdev->config + PCI_DEVICE_ID));
 124         stw_p(&rrb->response.fh_list[i].vendor_id,
 125             pci_get_word(pbdev->pdev->config + PCI_VENDOR_ID));
 126         /* Ignore RESERVED devices. */
 127         stl_p(&rrb->response.fh_list[i].config,
 128             pbdev->state == ZPCI_FS_STANDBY ? 0 : 1 << 31);
 129         stl_p(&rrb->response.fh_list[i].fid, pbdev->fid);
 130         stl_p(&rrb->response.fh_list[i].fh, pbdev->fh);
 131
 132         g_l2 += sizeof(ClpFhListEntry);
 133         /* Add endian check for DPRINTF? */
 134         DPRINTF("g_l2 %d vendor id 0x%x device id 0x%x fid 0x%x fh 0x%x\n",
 135                 g_l2,
 136                 lduw_p(&rrb->response.fh_list[i].vendor_id),
 137                 lduw_p(&rrb->response.fh_list[i].device_id),
 138                 ldl_p(&rrb->response.fh_list[i].fid),
 139                 ldl_p(&rrb->response.fh_list[i].fh));
 140         pbdev = s390_pci_find_next_avail_dev(s, pbdev);
 141         i++;
 142     }
 143
 144     if (!pbdev) {
 145         resume_token = 0;
 146     } else {
 147         resume_token = pbdev->fh & FH_MASK_INDEX;
 148     }
 149     stq_p(&rrb->response.resume_token, resume_token);
 150     stw_p(&rrb->response.hdr.len, g_l2);
 151     stw_p(&rrb->response.hdr.rsp, CLP_RC_OK);
 152 out:
 153     if (rc) {
 154         DPRINTF("list pci failed rc 0x%x\n", rc);
 155         stw_p(&rrb->response.hdr.rsp, res_code);
 156     }
 157     return rc;
 158 }
 159
 160 int clp_service_call(S390CPU *cpu, uint8_t r2, uintptr_t ra)
 161 {
 162     ClpReqHdr *reqh;
 163     ClpRspHdr *resh;
 164     S390PCIBusDevice *pbdev;
 165     uint32_t req_len;
 166     uint32_t res_len;
 167     uint8_t buffer[4096 * 2];
 168     uint8_t cc = 0;
 169     CPUS390XState *env = &cpu->env;
 170     S390pciState *s = s390_get_phb();
 171     int i;
 172
 173     if (env->psw.mask & PSW_MASK_PSTATE) {
 174         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
 175         return 0;
 176     }
 177
 178     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer, sizeof(*reqh))) {
 179         s390_cpu_virt_mem_handle_exc(cpu, ra);
 180         return 0;
 181     }
 182     reqh = (ClpReqHdr *)buffer;
 183     req_len = lduw_p(&reqh->len);
 184     if (req_len < 16 || req_len > 8184 || (req_len % 8 != 0)) {
 185         s390_program_interrupt(env, PGM_OPERAND, ra);
 186         return 0;
 187     }
 188
 189     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer,
 190                                req_len + sizeof(*resh))) {
 191         s390_cpu_virt_mem_handle_exc(cpu, ra);
 192         return 0;
 193     }
 194     resh = (ClpRspHdr *)(buffer + req_len);
 195     res_len = lduw_p(&resh->len);
 196     if (res_len < 8 || res_len > 8176 || (res_len % 8 != 0)) {
 197         s390_program_interrupt(env, PGM_OPERAND, ra);
 198         return 0;
 199     }
 200     if ((req_len + res_len) > 8192) {
 201         s390_program_interrupt(env, PGM_OPERAND, ra);
 202         return 0;
 203     }
 204
 205     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer,
 206                                req_len + res_len)) {
 207         s390_cpu_virt_mem_handle_exc(cpu, ra);
 208         return 0;
 209     }
 210
 211     if (req_len != 32) {
 212         stw_p(&resh->rsp, CLP_RC_LEN);
 213         goto out;
 214     }
 215
 216     switch (lduw_p(&reqh->cmd)) {
 217     case CLP_LIST_PCI: {
 218         ClpReqRspListPci *rrb = (ClpReqRspListPci *)buffer;
 219         list_pci(rrb, &cc);
 220         break;
 221     }
 222     case CLP_SET_PCI_FN: {
 223         ClpReqSetPci *reqsetpci = (ClpReqSetPci *)reqh;
 224         ClpRspSetPci *ressetpci = (ClpRspSetPci *)resh;
 225
 226         pbdev = s390_pci_find_dev_by_fh(s, ldl_p(&reqsetpci->fh));
 227         if (!pbdev) {
 228                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FH);
 229                 goto out;
 230         }
 231
 232         switch (reqsetpci->oc) {
 233         case CLP_SET_ENABLE_PCI_FN:
 234             switch (reqsetpci->ndas) {
 235             case 0:
 236                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_DMAAS);
 237                 goto out;
 238             case 1:
 239                 break;
 240             default:
 241                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_RES);
 242                 goto out;
 243             }
 244
 245             if (pbdev->fh & FH_MASK_ENABLE) {
 246                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
 247                 goto out;
 248             }
 249
 250             pbdev->fh |= FH_MASK_ENABLE;
 251             pbdev->state = ZPCI_FS_ENABLED;
 252             stl_p(&ressetpci->fh, pbdev->fh);
 253             stw_p(&ressetpci->hdr.rsp, CLP_RC_OK);
 254             break;
 255         case CLP_SET_DISABLE_PCI_FN:
 256             if (!(pbdev->fh & FH_MASK_ENABLE)) {
 257                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
 258                 goto out;
 259             }
 260             device_legacy_reset(DEVICE(pbdev));
 261             pbdev->fh &= ~FH_MASK_ENABLE;
 262             pbdev->state = ZPCI_FS_DISABLED;
 263             stl_p(&ressetpci->fh, pbdev->fh);
 264             stw_p(&ressetpci->hdr.rsp, CLP_RC_OK);
 265             break;
 266         default:
 267             DPRINTF("unknown set pci command\n");
 268             stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
 269             break;
 270         }
 271         break;
 272     }
 273     case CLP_QUERY_PCI_FN: {
 274         ClpReqQueryPci *reqquery = (ClpReqQueryPci *)reqh;
 275         ClpRspQueryPci *resquery = (ClpRspQueryPci *)resh;
 276
 277         pbdev = s390_pci_find_dev_by_fh(s, ldl_p(&reqquery->fh));
 278         if (!pbdev) {
 279             DPRINTF("query pci no pci dev\n");
 280             stw_p(&resquery->hdr.rsp, CLP_RC_SETPCIFN_FH);
 281             goto out;
 282         }
 283
 284         memcpy(resquery, &pbdev->zpci_fn, sizeof(*resquery));
 285
 286         for (i = 0; i < PCI_BAR_COUNT; i++) {
 287             uint32_t data = pci_get_long(pbdev->pdev->config +
 288                 PCI_BASE_ADDRESS_0 + (i * 4));
 289
 290             stl_p(&resquery->bar[i], data);
 291             resquery->bar_size[i] = pbdev->pdev->io_regions[i].size ?
 292                                     ctz64(pbdev->pdev->io_regions[i].size) : 0;
 293             DPRINTF("bar %d addr 0x%x size 0x%" PRIx64 "barsize 0x%x\n", i,
 294                     ldl_p(&resquery->bar[i]),
 295                     pbdev->pdev->io_regions[i].size,
 296                     resquery->bar_size[i]);
 297         }
 298
 299         stw_p(&resquery->hdr.rsp, CLP_RC_OK);
 300         break;
 301     }
 302     case CLP_QUERY_PCI_FNGRP: {
 303         ClpRspQueryPciGrp *resgrp = (ClpRspQueryPciGrp *)resh;
 304
 305         ClpReqQueryPciGrp *reqgrp = (ClpReqQueryPciGrp *)reqh;
 306         S390PCIGroup *group;
 307
 308         group = s390_group_find(reqgrp->g);
 309         if (!group) {
 310             /* We do not allow access to unknown groups */
 311             /* The group must have been obtained with a vfio device */
 312             stw_p(&resgrp->hdr.rsp, CLP_RC_QUERYPCIFG_PFGID);
 313             goto out;
 314         }
 315         memcpy(resgrp, &group->zpci_group, sizeof(ClpRspQueryPciGrp));
 316         stw_p(&resgrp->hdr.rsp, CLP_RC_OK);
 317         break;
 318     }
 319     default:
 320         DPRINTF("unknown clp command\n");
 321         stw_p(&resh->rsp, CLP_RC_CMD);
 322         break;
 323     }
 324
 325 out:
 326     if (s390_cpu_virt_mem_write(cpu, env->regs[r2], r2, buffer,
 327                                 req_len + res_len)) {
 328         s390_cpu_virt_mem_handle_exc(cpu, ra);
 329         return 0;
 330     }
 331     setcc(cpu, cc);
 332     return 0;
 333 }
 334
 335 /**
 336  * Swap data contained in s390x big endian registers to little endian
 337  * PCI bars.
 338  *
 339  * @ptr: a pointer to a uint64_t data field
 340  * @len: the length of the valid data, must be 1,2,4 or 8
 341  */
 342 static int zpci_endian_swap(uint64_t *ptr, uint8_t len)
 343 {
 344     uint64_t data = *ptr;
 345
 346     switch (len) {
 347     case 1:
 348         break;
 349     case 2:
 350         data = bswap16(data);
 351         break;
 352     case 4:
 353         data = bswap32(data);
 354         break;
 355     case 8:
 356         data = bswap64(data);
 357         break;
 358     default:
 359         return -EINVAL;
 360     }
 361     *ptr = data;
 362     return 0;
 363 }
 364
 365 static MemoryRegion *s390_get_subregion(MemoryRegion *mr, uint64_t offset,
 366                                         uint8_t len)
 367 {
 368     MemoryRegion *subregion;
 369     uint64_t subregion_size;
 370
 371     QTAILQ_FOREACH(subregion, &mr->subregions, subregions_link) {
 372         subregion_size = int128_get64(subregion->size);
 373         if ((offset >= subregion->addr) &&
 374             (offset + len) <= (subregion->addr + subregion_size)) {
 375             mr = subregion;
 376             break;
 377         }
 378     }
 379     return mr;
 380 }
 381
 382 static MemTxResult zpci_read_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
 383                                  uint64_t offset, uint64_t *data, uint8_t len)
 384 {
 385     MemoryRegion *mr;
 386
 387     mr = pbdev->pdev->io_regions[pcias].memory;
 388     mr = s390_get_subregion(mr, offset, len);
 389     offset -= mr->addr;
 390     return memory_region_dispatch_read(mr, offset, data,
 391                                        size_memop(len) | MO_BE,
 392                                        MEMTXATTRS_UNSPECIFIED);
 393 }
 394
 395 int pcilg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
 396 {
 397     CPUS390XState *env = &cpu->env;
 398     S390PCIBusDevice *pbdev;
 399     uint64_t offset;
 400     uint64_t data;
 401     MemTxResult result;
 402     uint8_t len;
 403     uint32_t fh;
 404     uint8_t pcias;
 405
 406     if (env->psw.mask & PSW_MASK_PSTATE) {
 407         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
 408         return 0;
 409     }
 410
 411     if (r2 & 0x1) {
 412         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
 413         return 0;
 414     }
 415
 416     fh = env->regs[r2] >> 32;
 417     pcias = (env->regs[r2] >> 16) & 0xf;
 418     len = env->regs[r2] & 0xf;
 419     offset = env->regs[r2 + 1];
 420
 421     if (!(fh & FH_MASK_ENABLE)) {
 422         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 423         return 0;
 424     }
 425
 426     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
 427     if (!pbdev) {
 428         DPRINTF("pcilg no pci dev\n");
 429         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 430         return 0;
 431     }
 432
 433     switch (pbdev->state) {
 434     case ZPCI_FS_PERMANENT_ERROR:
 435     case ZPCI_FS_ERROR:
 436         setcc(cpu, ZPCI_PCI_LS_ERR);
 437         s390_set_status_code(env, r2, ZPCI_PCI_ST_BLOCKED);
 438         return 0;
 439     default:
 440         break;
 441     }
 442
 443     switch (pcias) {
 444     case ZPCI_IO_BAR_MIN...ZPCI_IO_BAR_MAX:
 445         if (!len || (len > (8 - (offset & 0x7)))) {
 446             s390_program_interrupt(env, PGM_OPERAND, ra);
 447             return 0;
 448         }
 449         result = zpci_read_bar(pbdev, pcias, offset, &data, len);
 450         if (result != MEMTX_OK) {
 451             s390_program_interrupt(env, PGM_OPERAND, ra);
 452             return 0;
 453         }
 454         break;
 455     case ZPCI_CONFIG_BAR:
 456         if (!len || (len > (4 - (offset & 0x3))) || len == 3) {
 457             s390_program_interrupt(env, PGM_OPERAND, ra);
 458             return 0;
 459         }
 460         data =  pci_host_config_read_common(
 461                    pbdev->pdev, offset, pci_config_size(pbdev->pdev), len);
 462
 463         if (zpci_endian_swap(&data, len)) {
 464             s390_program_interrupt(env, PGM_OPERAND, ra);
 465             return 0;
 466         }
 467         break;
 468     default:
 469         DPRINTF("pcilg invalid space\n");
 470         setcc(cpu, ZPCI_PCI_LS_ERR);
 471         s390_set_status_code(env, r2, ZPCI_PCI_ST_INVAL_AS);
 472         return 0;
 473     }
 474
 475     pbdev->fmb.counter[ZPCI_FMB_CNT_LD]++;
 476
 477     env->regs[r1] = data;
 478     setcc(cpu, ZPCI_PCI_LS_OK);
 479     return 0;
 480 }
 481
 482 static MemTxResult zpci_write_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
 483                                   uint64_t offset, uint64_t data, uint8_t len)
 484 {
 485     MemoryRegion *mr;
 486
 487     mr = pbdev->pdev->io_regions[pcias].memory;
 488     mr = s390_get_subregion(mr, offset, len);
 489     offset -= mr->addr;
 490     return memory_region_dispatch_write(mr, offset, data,
 491                                         size_memop(len) | MO_BE,
 492                                         MEMTXATTRS_UNSPECIFIED);
 493 }
 494
 495 int pcistg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
 496 {
 497     CPUS390XState *env = &cpu->env;
 498     uint64_t offset, data;
 499     S390PCIBusDevice *pbdev;
 500     MemTxResult result;
 501     uint8_t len;
 502     uint32_t fh;
 503     uint8_t pcias;
 504
 505     if (env->psw.mask & PSW_MASK_PSTATE) {
 506         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
 507         return 0;
 508     }
 509
 510     if (r2 & 0x1) {
 511         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
 512         return 0;
 513     }
 514
 515     fh = env->regs[r2] >> 32;
 516     pcias = (env->regs[r2] >> 16) & 0xf;
 517     len = env->regs[r2] & 0xf;
 518     offset = env->regs[r2 + 1];
 519     data = env->regs[r1];
 520
 521     if (!(fh & FH_MASK_ENABLE)) {
 522         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 523         return 0;
 524     }
 525
 526     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
 527     if (!pbdev) {
 528         DPRINTF("pcistg no pci dev\n");
 529         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 530         return 0;
 531     }
 532
 533     switch (pbdev->state) {
 534     /* ZPCI_FS_RESERVED, ZPCI_FS_STANDBY and ZPCI_FS_DISABLED
 535      * are already covered by the FH_MASK_ENABLE check above
 536      */
 537     case ZPCI_FS_PERMANENT_ERROR:
 538     case ZPCI_FS_ERROR:
 539         setcc(cpu, ZPCI_PCI_LS_ERR);
 540         s390_set_status_code(env, r2, ZPCI_PCI_ST_BLOCKED);
 541         return 0;
 542     default:
 543         break;
 544     }
 545
 546     switch (pcias) {
 547         /* A ZPCI PCI card may use any BAR from BAR 0 to BAR 5 */
 548     case ZPCI_IO_BAR_MIN...ZPCI_IO_BAR_MAX:
 549         /* Check length:
 550          * A length of 0 is invalid and length should not cross a double word
 551          */
 552         if (!len || (len > (8 - (offset & 0x7)))) {
 553             s390_program_interrupt(env, PGM_OPERAND, ra);
 554             return 0;
 555         }
 556
 557         result = zpci_write_bar(pbdev, pcias, offset, data, len);
 558         if (result != MEMTX_OK) {
 559             s390_program_interrupt(env, PGM_OPERAND, ra);
 560             return 0;
 561         }
 562         break;
 563     case ZPCI_CONFIG_BAR:
 564         /* ZPCI uses the pseudo BAR number 15 as configuration space */
 565         /* possible access lengths are 1,2,4 and must not cross a word */
 566         if (!len || (len > (4 - (offset & 0x3))) || len == 3) {
 567             s390_program_interrupt(env, PGM_OPERAND, ra);
 568             return 0;
 569         }
 570         /* len = 1,2,4 so we do not need to test */
 571         zpci_endian_swap(&data, len);
 572         pci_host_config_write_common(pbdev->pdev, offset,
 573                                      pci_config_size(pbdev->pdev),
 574                                      data, len);
 575         break;
 576     default:
 577         DPRINTF("pcistg invalid space\n");
 578         setcc(cpu, ZPCI_PCI_LS_ERR);
 579         s390_set_status_code(env, r2, ZPCI_PCI_ST_INVAL_AS);
 580         return 0;
 581     }
 582
 583     pbdev->fmb.counter[ZPCI_FMB_CNT_ST]++;
 584
 585     setcc(cpu, ZPCI_PCI_LS_OK);
 586     return 0;
 587 }
 588
 589 static uint32_t s390_pci_update_iotlb(S390PCIIOMMU *iommu,
 590                                       S390IOTLBEntry *entry)
 591 {
 592     S390IOTLBEntry *cache = g_hash_table_lookup(iommu->iotlb, &entry->iova);
 593     IOMMUTLBEntry notify = {
 594         .target_as = &address_space_memory,
 595         .iova = entry->iova,
 596         .translated_addr = entry->translated_addr,
 597         .perm = entry->perm,
 598         .addr_mask = ~PAGE_MASK,
 599     };
 600
 601     if (entry->perm == IOMMU_NONE) {
 602         if (!cache) {
 603             goto out;
 604         }
 605         g_hash_table_remove(iommu->iotlb, &entry->iova);
 606         inc_dma_avail(iommu);
 607     } else {
 608         if (cache) {
 609             if (cache->perm == entry->perm &&
 610                 cache->translated_addr == entry->translated_addr) {
 611                 goto out;
 612             }
 613
 614             notify.perm = IOMMU_NONE;
 615             memory_region_notify_iommu(&iommu->iommu_mr, 0, notify);
 616             notify.perm = entry->perm;
 617         }
 618
 619         cache = g_new(S390IOTLBEntry, 1);
 620         cache->iova = entry->iova;
 621         cache->translated_addr = entry->translated_addr;
 622         cache->len = PAGE_SIZE;
 623         cache->perm = entry->perm;
 624         g_hash_table_replace(iommu->iotlb, &cache->iova, cache);
 625         dec_dma_avail(iommu);
 626     }
 627
 628     memory_region_notify_iommu(&iommu->iommu_mr, 0, notify);
 629
 630 out:
 631     return iommu->dma_limit ? iommu->dma_limit->avail : 1;
 632 }
 633
 634 int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
 635 {
 636     CPUS390XState *env = &cpu->env;
 637     uint32_t fh;
 638     uint16_t error = 0;
 639     S390PCIBusDevice *pbdev;
 640     S390PCIIOMMU *iommu;
 641     S390IOTLBEntry entry;
 642     hwaddr start, end;
 643     uint32_t dma_avail;
 644
 645     if (env->psw.mask & PSW_MASK_PSTATE) {
 646         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
 647         return 0;
 648     }
 649
 650     if (r2 & 0x1) {
 651         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
 652         return 0;
 653     }
 654
 655     fh = env->regs[r1] >> 32;
 656     start = env->regs[r2];
 657     end = start + env->regs[r2 + 1];
 658
 659     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
 660     if (!pbdev) {
 661         DPRINTF("rpcit no pci dev\n");
 662         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 663         return 0;
 664     }
 665
 666     switch (pbdev->state) {
 667     case ZPCI_FS_RESERVED:
 668     case ZPCI_FS_STANDBY:
 669     case ZPCI_FS_DISABLED:
 670     case ZPCI_FS_PERMANENT_ERROR:
 671         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 672         return 0;
 673     case ZPCI_FS_ERROR:
 674         setcc(cpu, ZPCI_PCI_LS_ERR);
 675         s390_set_status_code(env, r1, ZPCI_MOD_ST_ERROR_RECOVER);
 676         return 0;
 677     default:
 678         break;
 679     }
 680
 681     iommu = pbdev->iommu;
 682     if (iommu->dma_limit) {
 683         dma_avail = iommu->dma_limit->avail;
 684     } else {
 685         dma_avail = 1;
 686     }
 687     if (!iommu->g_iota) {
 688         error = ERR_EVENT_INVALAS;
 689         goto err;
 690     }
 691
 692     if (end < iommu->pba || start > iommu->pal) {
 693         error = ERR_EVENT_OORANGE;
 694         goto err;
 695     }
 696
 697     while (start < end) {
 698         error = s390_guest_io_table_walk(iommu->g_iota, start, &entry);
 699         if (error) {
 700             break;
 701         }
 702
 703         start += entry.len;
 704         while (entry.iova < start && entry.iova < end &&
 705                (dma_avail > 0 || entry.perm == IOMMU_NONE)) {
 706             dma_avail = s390_pci_update_iotlb(iommu, &entry);
 707             entry.iova += PAGE_SIZE;
 708             entry.translated_addr += PAGE_SIZE;
 709         }
 710     }
 711 err:
 712     if (error) {
 713         pbdev->state = ZPCI_FS_ERROR;
 714         setcc(cpu, ZPCI_PCI_LS_ERR);
 715         s390_set_status_code(env, r1, ZPCI_PCI_ST_FUNC_IN_ERR);
 716         s390_pci_generate_error_event(error, pbdev->fh, pbdev->fid, start, 0);
 717     } else {
 718         pbdev->fmb.counter[ZPCI_FMB_CNT_RPCIT]++;
 719         if (dma_avail > 0) {
 720             setcc(cpu, ZPCI_PCI_LS_OK);
 721         } else {
 722             /* vfio DMA mappings are exhausted, trigger a RPCIT */
 723             setcc(cpu, ZPCI_PCI_LS_ERR);
 724             s390_set_status_code(env, r1, ZPCI_RPCIT_ST_INSUFF_RES);
 725         }
 726     }
 727     return 0;
 728 }
 729
 730 int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
 731                         uint8_t ar, uintptr_t ra)
 732 {
 733     CPUS390XState *env = &cpu->env;
 734     S390PCIBusDevice *pbdev;
 735     MemoryRegion *mr;
 736     MemTxResult result;
 737     uint64_t offset;
 738     int i;
 739     uint32_t fh;
 740     uint8_t pcias;
 741     uint8_t len;
 742     uint8_t buffer[128];
 743
 744     if (env->psw.mask & PSW_MASK_PSTATE) {
 745         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
 746         return 0;
 747     }
 748
 749     fh = env->regs[r1] >> 32;
 750     pcias = (env->regs[r1] >> 16) & 0xf;
 751     len = env->regs[r1] & 0xff;
 752     offset = env->regs[r3];
 753
 754     if (!(fh & FH_MASK_ENABLE)) {
 755         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 756         return 0;
 757     }
 758
 759     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
 760     if (!pbdev) {
 761         DPRINTF("pcistb no pci dev fh 0x%x\n", fh);
 762         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
 763         return 0;
 764     }
 765
 766     switch (pbdev->state) {
 767     case ZPCI_FS_PERMANENT_ERROR:
 768     case ZPCI_FS_ERROR:
 769         setcc(cpu, ZPCI_PCI_LS_ERR);
 770         s390_set_status_code(env, r1, ZPCI_PCI_ST_BLOCKED);
 771         return 0;
 772     default:
 773         break;
 774     }
 775
 776     if (pcias > ZPCI_IO_BAR_MAX) {
 777         DPRINTF("pcistb invalid space\n");
 778         setcc(cpu, ZPCI_PCI_LS_ERR);
 779         s390_set_status_code(env, r1, ZPCI_PCI_ST_INVAL_AS);
 780         return 0;
 781     }
 782
 783     /* Verify the address, offset and length */
 784     /* offset must be a multiple of 8 */
 785     if (offset % 8) {
 786         goto specification_error;
 787     }
 788     /* Length must be greater than 8, a multiple of 8 */
 789     /* and not greater than maxstbl */
 790     if ((len <= 8) || (len % 8) ||
 791         (len > pbdev->pci_group->zpci_group.maxstbl)) {
 792         goto specification_error;
 793     }
 794     /* Do not cross a 4K-byte boundary */
 795     if (((offset & 0xfff) + len) > 0x1000) {
 796         goto specification_error;
 797     }
 798     /* Guest address must be double word aligned */
 799     if (gaddr & 0x07UL) {
 800         goto specification_error;
 801     }
 802
 803     mr = pbdev->pdev->io_regions[pcias].memory;
 804     mr = s390_get_subregion(mr, offset, len);
 805     offset -= mr->addr;
 806
 807     if (!memory_region_access_valid(mr, offset, len, true,
 808                                     MEMTXATTRS_UNSPECIFIED)) {
 809         s390_program_interrupt(env, PGM_OPERAND, ra);
 810         return 0;
 811     }
 812
 813     if (s390_cpu_virt_mem_read(cpu, gaddr, ar, buffer, len)) {
 814         s390_cpu_virt_mem_handle_exc(cpu, ra);
 815         return 0;
 816     }
 817
 818     for (i = 0; i < len / 8; i++) {
 819         result = memory_region_dispatch_write(mr, offset + i * 8,
 820                                               ldq_p(buffer + i * 8),
 821                                               MO_64, MEMTXATTRS_UNSPECIFIED);
 822         if (result != MEMTX_OK) {
 823             s390_program_interrupt(env, PGM_OPERAND, ra);
 824             return 0;
 825         }
 826     }
 827
 828     pbdev->fmb.counter[ZPCI_FMB_CNT_STB]++;
 829
 830     setcc(cpu, ZPCI_PCI_LS_OK);
 831     return 0;
 832
 833 specification_error:
 834     s390_program_interrupt(env, PGM_SPECIFICATION, ra);
 835     return 0;
 836 }
 837
 838 static int reg_irqs(CPUS390XState *env, S390PCIBusDevice *pbdev, ZpciFib fib)
 839 {
 840     int ret, len;
 841     uint8_t isc = FIB_DATA_ISC(ldl_p(&fib.data));
 842
 843     pbdev->routes.adapter.adapter_id = css_get_adapter_id(
 844                                        CSS_IO_ADAPTER_PCI, isc);
 845     pbdev->summary_ind = get_indicator(ldq_p(&fib.aisb), sizeof(uint64_t));
 846     len = BITS_TO_LONGS(FIB_DATA_NOI(ldl_p(&fib.data))) * sizeof(unsigned long);
 847     pbdev->indicator = get_indicator(ldq_p(&fib.aibv), len);
 848
 849     ret = map_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
 850     if (ret) {
 851         goto out;
 852     }
 853
 854     ret = map_indicator(&pbdev->routes.adapter, pbdev->indicator);
 855     if (ret) {
 856         goto out;
 857     }
 858
 859     pbdev->routes.adapter.summary_addr = ldq_p(&fib.aisb);
 860     pbdev->routes.adapter.summary_offset = FIB_DATA_AISBO(ldl_p(&fib.data));
 861     pbdev->routes.adapter.ind_addr = ldq_p(&fib.aibv);
 862     pbdev->routes.adapter.ind_offset = FIB_DATA_AIBVO(ldl_p(&fib.data));
 863     pbdev->isc = isc;
 864     pbdev->noi = FIB_DATA_NOI(ldl_p(&fib.data));
 865     pbdev->sum = FIB_DATA_SUM(ldl_p(&fib.data));
 866
 867     DPRINTF("reg_irqs adapter id %d\n", pbdev->routes.adapter.adapter_id);
 868     return 0;
 869 out:
 870     release_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
 871     release_indicator(&pbdev->routes.adapter, pbdev->indicator);
 872     pbdev->summary_ind = NULL;
 873     pbdev->indicator = NULL;
 874     return ret;
 875 }
 876
 877 int pci_dereg_irqs(S390PCIBusDevice *pbdev)
 878 {
 879     release_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
 880     release_indicator(&pbdev->routes.adapter, pbdev->indicator);
 881
 882     pbdev->summary_ind = NULL;
 883     pbdev->indicator = NULL;
 884     pbdev->routes.adapter.summary_addr = 0;
 885     pbdev->routes.adapter.summary_offset = 0;
 886     pbdev->routes.adapter.ind_addr = 0;
 887     pbdev->routes.adapter.ind_offset = 0;
 888     pbdev->isc = 0;
 889     pbdev->noi = 0;
 890     pbdev->sum = 0;
 891
 892     DPRINTF("dereg_irqs adapter id %d\n", pbdev->routes.adapter.adapter_id);
 893     return 0;
 894 }
 895
 896 static int reg_ioat(CPUS390XState *env, S390PCIIOMMU *iommu, ZpciFib fib,
 897                     uintptr_t ra)
 898 {
 899     uint64_t pba = ldq_p(&fib.pba);
 900     uint64_t pal = ldq_p(&fib.pal);
 901     uint64_t g_iota = ldq_p(&fib.iota);
 902     uint8_t dt = (g_iota >> 2) & 0x7;
 903     uint8_t t = (g_iota >> 11) & 0x1;
 904
 905     pba &= ~0xfff;
 906     pal |= 0xfff;
 907     if (pba > pal || pba < ZPCI_SDMA_ADDR || pal > ZPCI_EDMA_ADDR) {
 908         s390_program_interrupt(env, PGM_OPERAND, ra);
 909         return -EINVAL;
 910     }
 911
 912     /* currently we only support designation type 1 with translation */
 913     if (!(dt == ZPCI_IOTA_RTTO && t)) {
 914         error_report("unsupported ioat dt %d t %d", dt, t);
 915         s390_program_interrupt(env, PGM_OPERAND, ra);
 916         return -EINVAL;
 917     }
 918
 919     iommu->pba = pba;
 920     iommu->pal = pal;
 921     iommu->g_iota = g_iota;
 922
 923     s390_pci_iommu_enable(iommu);
 924
 925     return 0;
 926 }
 927
 928 void pci_dereg_ioat(S390PCIIOMMU *iommu)
 929 {
 930     s390_pci_iommu_disable(iommu);
 931     iommu->pba = 0;
 932     iommu->pal = 0;
 933     iommu->g_iota = 0;
 934 }
 935
 936 void fmb_timer_free(S390PCIBusDevice *pbdev)
 937 {
 938     if (pbdev->fmb_timer) {
 939         timer_del(pbdev->fmb_timer);
 940         timer_free(pbdev->fmb_timer);
 941         pbdev->fmb_timer = NULL;
 942     }
 943     pbdev->fmb_addr = 0;
 944     memset(&pbdev->fmb, 0, sizeof(ZpciFmb));
 945 }
 946
 947 static int fmb_do_update(S390PCIBusDevice *pbdev, int offset, uint64_t val,
 948                          int len)
 949 {
 950     MemTxResult ret;
 951     uint64_t dst = pbdev->fmb_addr + offset;
 952
 953     switch (len) {
 954     case 8:
 955         address_space_stq_be(&address_space_memory, dst, val,
 956                              MEMTXATTRS_UNSPECIFIED,
 957                              &ret);
 958         break;
 959     case 4:
 960         address_space_stl_be(&address_space_memory, dst, val,
 961                              MEMTXATTRS_UNSPECIFIED,
 962                              &ret);
 963         break;
 964     case 2:
 965         address_space_stw_be(&address_space_memory, dst, val,
 966                              MEMTXATTRS_UNSPECIFIED,
 967                              &ret);
 968         break;
 969     case 1:
 970         address_space_stb(&address_space_memory, dst, val,
 971                           MEMTXATTRS_UNSPECIFIED,
 972                           &ret);
 973         break;
 974     default:
 975         ret = MEMTX_ERROR;
 976         break;
 977     }
 978     if (ret != MEMTX_OK) {
 979         s390_pci_generate_error_event(ERR_EVENT_FMBA, pbdev->fh, pbdev->fid,
 980                                       pbdev->fmb_addr, 0);
 981         fmb_timer_free(pbdev);
 982     }
 983
 984     return ret;
 985 }
 986
 987 static void fmb_update(void *opaque)
 988 {
 989     S390PCIBusDevice *pbdev = opaque;
 990     int64_t t = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
 991     int i;
 992
 993     /* Update U bit */
 994     pbdev->fmb.last_update *= 2;
 995     pbdev->fmb.last_update |= UPDATE_U_BIT;
 996     if (fmb_do_update(pbdev, offsetof(ZpciFmb, last_update),
 997                       pbdev->fmb.last_update,
 998                       sizeof(pbdev->fmb.last_update))) {
 999         return;
1000     }
1001
1002     /* Update FMB sample count */
1003     if (fmb_do_update(pbdev, offsetof(ZpciFmb, sample),
1004                       pbdev->fmb.sample++,
1005                       sizeof(pbdev->fmb.sample))) {
1006         return;
1007     }
1008
1009     /* Update FMB counters */
1010     for (i = 0; i < ZPCI_FMB_CNT_MAX; i++) {
1011         if (fmb_do_update(pbdev, offsetof(ZpciFmb, counter[i]),
1012                           pbdev->fmb.counter[i],
1013                           sizeof(pbdev->fmb.counter[0]))) {
1014             return;
1015         }
1016     }
1017
1018     /* Clear U bit and update the time */
1019     pbdev->fmb.last_update = time2tod(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
1020     pbdev->fmb.last_update *= 2;
1021     if (fmb_do_update(pbdev, offsetof(ZpciFmb, last_update),
1022                       pbdev->fmb.last_update,
1023                       sizeof(pbdev->fmb.last_update))) {
1024         return;
1025     }
1026     timer_mod(pbdev->fmb_timer, t + DEFAULT_MUI);
1027 }
1028
1029 int mpcifc_service_call(S390CPU *cpu, uint8_t r1, uint64_t fiba, uint8_t ar,
1030                         uintptr_t ra)
1031 {
1032     CPUS390XState *env = &cpu->env;
1033     uint8_t oc, dmaas;
1034     uint32_t fh;
1035     ZpciFib fib;
1036     S390PCIBusDevice *pbdev;
1037     uint64_t cc = ZPCI_PCI_LS_OK;
1038
1039     if (env->psw.mask & PSW_MASK_PSTATE) {
1040         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
1041         return 0;
1042     }
1043
1044     oc = env->regs[r1] & 0xff;
1045     dmaas = (env->regs[r1] >> 16) & 0xff;
1046     fh = env->regs[r1] >> 32;
1047
1048     if (fiba & 0x7) {
1049         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
1050         return 0;
1051     }
1052
1053     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
1054     if (!pbdev) {
1055         DPRINTF("mpcifc no pci dev fh 0x%x\n", fh);
1056         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1057         return 0;
1058     }
1059
1060     switch (pbdev->state) {
1061     case ZPCI_FS_RESERVED:
1062     case ZPCI_FS_STANDBY:
1063     case ZPCI_FS_DISABLED:
1064     case ZPCI_FS_PERMANENT_ERROR:
1065         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1066         return 0;
1067     default:
1068         break;
1069     }
1070
1071     if (s390_cpu_virt_mem_read(cpu, fiba, ar, (uint8_t *)&fib, sizeof(fib))) {
1072         s390_cpu_virt_mem_handle_exc(cpu, ra);
1073         return 0;
1074     }
1075
1076     if (fib.fmt != 0) {
1077         s390_program_interrupt(env, PGM_OPERAND, ra);
1078         return 0;
1079     }
1080
1081     switch (oc) {
1082     case ZPCI_MOD_FC_REG_INT:
1083         if (pbdev->summary_ind) {
1084             cc = ZPCI_PCI_LS_ERR;
1085             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1086         } else if (reg_irqs(env, pbdev, fib)) {
1087             cc = ZPCI_PCI_LS_ERR;
1088             s390_set_status_code(env, r1, ZPCI_MOD_ST_RES_NOT_AVAIL);
1089         }
1090         break;
1091     case ZPCI_MOD_FC_DEREG_INT:
1092         if (!pbdev->summary_ind) {
1093             cc = ZPCI_PCI_LS_ERR;
1094             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1095         } else {
1096             pci_dereg_irqs(pbdev);
1097         }
1098         break;
1099     case ZPCI_MOD_FC_REG_IOAT:
1100         if (dmaas != 0) {
1101             cc = ZPCI_PCI_LS_ERR;
1102             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1103         } else if (pbdev->iommu->enabled) {
1104             cc = ZPCI_PCI_LS_ERR;
1105             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1106         } else if (reg_ioat(env, pbdev->iommu, fib, ra)) {
1107             cc = ZPCI_PCI_LS_ERR;
1108             s390_set_status_code(env, r1, ZPCI_MOD_ST_INSUF_RES);
1109         }
1110         break;
1111     case ZPCI_MOD_FC_DEREG_IOAT:
1112         if (dmaas != 0) {
1113             cc = ZPCI_PCI_LS_ERR;
1114             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1115         } else if (!pbdev->iommu->enabled) {
1116             cc = ZPCI_PCI_LS_ERR;
1117             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1118         } else {
1119             pci_dereg_ioat(pbdev->iommu);
1120         }
1121         break;
1122     case ZPCI_MOD_FC_REREG_IOAT:
1123         if (dmaas != 0) {
1124             cc = ZPCI_PCI_LS_ERR;
1125             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1126         } else if (!pbdev->iommu->enabled) {
1127             cc = ZPCI_PCI_LS_ERR;
1128             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1129         } else {
1130             pci_dereg_ioat(pbdev->iommu);
1131             if (reg_ioat(env, pbdev->iommu, fib, ra)) {
1132                 cc = ZPCI_PCI_LS_ERR;
1133                 s390_set_status_code(env, r1, ZPCI_MOD_ST_INSUF_RES);
1134             }
1135         }
1136         break;
1137     case ZPCI_MOD_FC_RESET_ERROR:
1138         switch (pbdev->state) {
1139         case ZPCI_FS_BLOCKED:
1140         case ZPCI_FS_ERROR:
1141             pbdev->state = ZPCI_FS_ENABLED;
1142             break;
1143         default:
1144             cc = ZPCI_PCI_LS_ERR;
1145             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1146         }
1147         break;
1148     case ZPCI_MOD_FC_RESET_BLOCK:
1149         switch (pbdev->state) {
1150         case ZPCI_FS_ERROR:
1151             pbdev->state = ZPCI_FS_BLOCKED;
1152             break;
1153         default:
1154             cc = ZPCI_PCI_LS_ERR;
1155             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1156         }
1157         break;
1158     case ZPCI_MOD_FC_SET_MEASURE: {
1159         uint64_t fmb_addr = ldq_p(&fib.fmb_addr);
1160
1161         if (fmb_addr & FMBK_MASK) {
1162             cc = ZPCI_PCI_LS_ERR;
1163             s390_pci_generate_error_event(ERR_EVENT_FMBPRO, pbdev->fh,
1164                                           pbdev->fid, fmb_addr, 0);
1165             fmb_timer_free(pbdev);
1166             break;
1167         }
1168
1169         if (!fmb_addr) {
1170             /* Stop updating FMB. */
1171             fmb_timer_free(pbdev);
1172             break;
1173         }
1174
1175         if (!pbdev->fmb_timer) {
1176             pbdev->fmb_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL,
1177                                             fmb_update, pbdev);
1178         } else if (timer_pending(pbdev->fmb_timer)) {
1179             /* Remove pending timer to update FMB address. */
1180             timer_del(pbdev->fmb_timer);
1181         }
1182         pbdev->fmb_addr = fmb_addr;
1183         timer_mod(pbdev->fmb_timer,
1184                   qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + DEFAULT_MUI);
1185         break;
1186     }
1187     default:
1188         s390_program_interrupt(&cpu->env, PGM_OPERAND, ra);
1189         cc = ZPCI_PCI_LS_ERR;
1190     }
1191
1192     setcc(cpu, cc);
1193     return 0;
1194 }
1195
1196 int stpcifc_service_call(S390CPU *cpu, uint8_t r1, uint64_t fiba, uint8_t ar,
1197                          uintptr_t ra)
1198 {
1199     CPUS390XState *env = &cpu->env;
1200     uint8_t dmaas;
1201     uint32_t fh;
1202     ZpciFib fib;
1203     S390PCIBusDevice *pbdev;
1204     uint32_t data;
1205     uint64_t cc = ZPCI_PCI_LS_OK;
1206
1207     if (env->psw.mask & PSW_MASK_PSTATE) {
1208         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
1209         return 0;
1210     }
1211
1212     fh = env->regs[r1] >> 32;
1213     dmaas = (env->regs[r1] >> 16) & 0xff;
1214
1215     if (dmaas) {
1216         setcc(cpu, ZPCI_PCI_LS_ERR);
1217         s390_set_status_code(env, r1, ZPCI_STPCIFC_ST_INVAL_DMAAS);
1218         return 0;
1219     }
1220
1221     if (fiba & 0x7) {
1222         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
1223         return 0;
1224     }
1225
1226     pbdev = s390_pci_find_dev_by_idx(s390_get_phb(), fh & FH_MASK_INDEX);
1227     if (!pbdev) {
1228         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1229         return 0;
1230     }
1231
1232     memset(&fib, 0, sizeof(fib));
1233
1234     switch (pbdev->state) {
1235     case ZPCI_FS_RESERVED:
1236     case ZPCI_FS_STANDBY:
1237         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1238         return 0;
1239     case ZPCI_FS_DISABLED:
1240         if (fh & FH_MASK_ENABLE) {
1241             setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1242             return 0;
1243         }
1244         goto out;
1245     /* BLOCKED bit is set to one coincident with the setting of ERROR bit.
1246      * FH Enabled bit is set to one in states of ENABLED, BLOCKED or ERROR. */
1247     case ZPCI_FS_ERROR:
1248         fib.fc |= 0x20;
1249         /* fallthrough */
1250     case ZPCI_FS_BLOCKED:
1251         fib.fc |= 0x40;
1252         /* fallthrough */
1253     case ZPCI_FS_ENABLED:
1254         fib.fc |= 0x80;
1255         if (pbdev->iommu->enabled) {
1256             fib.fc |= 0x10;
1257         }
1258         if (!(fh & FH_MASK_ENABLE)) {
1259             env->regs[r1] |= 1ULL << 63;
1260         }
1261         break;
1262     case ZPCI_FS_PERMANENT_ERROR:
1263         setcc(cpu, ZPCI_PCI_LS_ERR);
1264         s390_set_status_code(env, r1, ZPCI_STPCIFC_ST_PERM_ERROR);
1265         return 0;
1266     }
1267
1268     stq_p(&fib.pba, pbdev->iommu->pba);
1269     stq_p(&fib.pal, pbdev->iommu->pal);
1270     stq_p(&fib.iota, pbdev->iommu->g_iota);
1271     stq_p(&fib.aibv, pbdev->routes.adapter.ind_addr);
1272     stq_p(&fib.aisb, pbdev->routes.adapter.summary_addr);
1273     stq_p(&fib.fmb_addr, pbdev->fmb_addr);
1274
1275     data = ((uint32_t)pbdev->isc << 28) | ((uint32_t)pbdev->noi << 16) |
1276            ((uint32_t)pbdev->routes.adapter.ind_offset << 8) |
1277            ((uint32_t)pbdev->sum << 7) | pbdev->routes.adapter.summary_offset;
1278     stl_p(&fib.data, data);
1279
1280 out:
1281     if (s390_cpu_virt_mem_write(cpu, fiba, ar, (uint8_t *)&fib, sizeof(fib))) {
1282         s390_cpu_virt_mem_handle_exc(cpu, ra);
1283         return 0;
1284     }
1285
1286     setcc(cpu, cc);
1287     return 0;
1288 }