xref: /openbmc/qemu/hw/s390x/s390-pci-inst.c (revision 64552b6b)
1 /*
2  * s390 PCI instructions
3  *
4  * Copyright 2014 IBM Corp.
5  * Author(s): Frank Blaschka <frank.blaschka@de.ibm.com>
6  *            Hong Bo Li <lihbbj@cn.ibm.com>
7  *            Yi Min Zhao <zyimin@cn.ibm.com>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2 or (at
10  * your option) any later version. See the COPYING file in the top-level
11  * directory.
12  */
13 
14 #include "qemu/osdep.h"
15 #include "cpu.h"
16 #include "s390-pci-inst.h"
17 #include "s390-pci-bus.h"
18 #include "exec/memory-internal.h"
19 #include "qemu/error-report.h"
20 #include "sysemu/hw_accel.h"
21 #include "hw/s390x/tod.h"
22 
23 #ifndef DEBUG_S390PCI_INST
24 #define DEBUG_S390PCI_INST  0
25 #endif
26 
27 #define DPRINTF(fmt, ...)                                          \
28     do {                                                           \
29         if (DEBUG_S390PCI_INST) {                                  \
30             fprintf(stderr, "s390pci-inst: " fmt, ## __VA_ARGS__); \
31         }                                                          \
32     } while (0)
33 
34 static void s390_set_status_code(CPUS390XState *env,
35                                  uint8_t r, uint64_t status_code)
36 {
37     env->regs[r] &= ~0xff000000ULL;
38     env->regs[r] |= (status_code & 0xff) << 24;
39 }
40 
41 static int list_pci(ClpReqRspListPci *rrb, uint8_t *cc)
42 {
43     S390PCIBusDevice *pbdev = NULL;
44     S390pciState *s = s390_get_phb();
45     uint32_t res_code, initial_l2, g_l2;
46     int rc, i;
47     uint64_t resume_token;
48 
49     rc = 0;
50     if (lduw_p(&rrb->request.hdr.len) != 32) {
51         res_code = CLP_RC_LEN;
52         rc = -EINVAL;
53         goto out;
54     }
55 
56     if ((ldl_p(&rrb->request.fmt) & CLP_MASK_FMT) != 0) {
57         res_code = CLP_RC_FMT;
58         rc = -EINVAL;
59         goto out;
60     }
61 
62     if ((ldl_p(&rrb->request.fmt) & ~CLP_MASK_FMT) != 0 ||
63         ldq_p(&rrb->request.reserved1) != 0) {
64         res_code = CLP_RC_RESNOT0;
65         rc = -EINVAL;
66         goto out;
67     }
68 
69     resume_token = ldq_p(&rrb->request.resume_token);
70 
71     if (resume_token) {
72         pbdev = s390_pci_find_dev_by_idx(s, resume_token);
73         if (!pbdev) {
74             res_code = CLP_RC_LISTPCI_BADRT;
75             rc = -EINVAL;
76             goto out;
77         }
78     } else {
79         pbdev = s390_pci_find_next_avail_dev(s, NULL);
80     }
81 
82     if (lduw_p(&rrb->response.hdr.len) < 48) {
83         res_code = CLP_RC_8K;
84         rc = -EINVAL;
85         goto out;
86     }
87 
88     initial_l2 = lduw_p(&rrb->response.hdr.len);
89     if ((initial_l2 - LIST_PCI_HDR_LEN) % sizeof(ClpFhListEntry)
90         != 0) {
91         res_code = CLP_RC_LEN;
92         rc = -EINVAL;
93         *cc = 3;
94         goto out;
95     }
96 
97     stl_p(&rrb->response.fmt, 0);
98     stq_p(&rrb->response.reserved1, 0);
99     stl_p(&rrb->response.mdd, FH_MASK_SHM);
100     stw_p(&rrb->response.max_fn, PCI_MAX_FUNCTIONS);
101     rrb->response.flags = UID_CHECKING_ENABLED;
102     rrb->response.entry_size = sizeof(ClpFhListEntry);
103 
104     i = 0;
105     g_l2 = LIST_PCI_HDR_LEN;
106     while (g_l2 < initial_l2 && pbdev) {
107         stw_p(&rrb->response.fh_list[i].device_id,
108             pci_get_word(pbdev->pdev->config + PCI_DEVICE_ID));
109         stw_p(&rrb->response.fh_list[i].vendor_id,
110             pci_get_word(pbdev->pdev->config + PCI_VENDOR_ID));
111         /* Ignore RESERVED devices. */
112         stl_p(&rrb->response.fh_list[i].config,
113             pbdev->state == ZPCI_FS_STANDBY ? 0 : 1 << 31);
114         stl_p(&rrb->response.fh_list[i].fid, pbdev->fid);
115         stl_p(&rrb->response.fh_list[i].fh, pbdev->fh);
116 
117         g_l2 += sizeof(ClpFhListEntry);
118         /* Add endian check for DPRINTF? */
119         DPRINTF("g_l2 %d vendor id 0x%x device id 0x%x fid 0x%x fh 0x%x\n",
120                 g_l2,
121                 lduw_p(&rrb->response.fh_list[i].vendor_id),
122                 lduw_p(&rrb->response.fh_list[i].device_id),
123                 ldl_p(&rrb->response.fh_list[i].fid),
124                 ldl_p(&rrb->response.fh_list[i].fh));
125         pbdev = s390_pci_find_next_avail_dev(s, pbdev);
126         i++;
127     }
128 
129     if (!pbdev) {
130         resume_token = 0;
131     } else {
132         resume_token = pbdev->fh & FH_MASK_INDEX;
133     }
134     stq_p(&rrb->response.resume_token, resume_token);
135     stw_p(&rrb->response.hdr.len, g_l2);
136     stw_p(&rrb->response.hdr.rsp, CLP_RC_OK);
137 out:
138     if (rc) {
139         DPRINTF("list pci failed rc 0x%x\n", rc);
140         stw_p(&rrb->response.hdr.rsp, res_code);
141     }
142     return rc;
143 }
144 
145 int clp_service_call(S390CPU *cpu, uint8_t r2, uintptr_t ra)
146 {
147     ClpReqHdr *reqh;
148     ClpRspHdr *resh;
149     S390PCIBusDevice *pbdev;
150     uint32_t req_len;
151     uint32_t res_len;
152     uint8_t buffer[4096 * 2];
153     uint8_t cc = 0;
154     CPUS390XState *env = &cpu->env;
155     S390pciState *s = s390_get_phb();
156     int i;
157 
158     if (env->psw.mask & PSW_MASK_PSTATE) {
159         s390_program_interrupt(env, PGM_PRIVILEGED, 4, ra);
160         return 0;
161     }
162 
163     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer, sizeof(*reqh))) {
164         s390_cpu_virt_mem_handle_exc(cpu, ra);
165         return 0;
166     }
167     reqh = (ClpReqHdr *)buffer;
168     req_len = lduw_p(&reqh->len);
169     if (req_len < 16 || req_len > 8184 || (req_len % 8 != 0)) {
170         s390_program_interrupt(env, PGM_OPERAND, 4, ra);
171         return 0;
172     }
173 
174     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer,
175                                req_len + sizeof(*resh))) {
176         s390_cpu_virt_mem_handle_exc(cpu, ra);
177         return 0;
178     }
179     resh = (ClpRspHdr *)(buffer + req_len);
180     res_len = lduw_p(&resh->len);
181     if (res_len < 8 || res_len > 8176 || (res_len % 8 != 0)) {
182         s390_program_interrupt(env, PGM_OPERAND, 4, ra);
183         return 0;
184     }
185     if ((req_len + res_len) > 8192) {
186         s390_program_interrupt(env, PGM_OPERAND, 4, ra);
187         return 0;
188     }
189 
190     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer,
191                                req_len + res_len)) {
192         s390_cpu_virt_mem_handle_exc(cpu, ra);
193         return 0;
194     }
195 
196     if (req_len != 32) {
197         stw_p(&resh->rsp, CLP_RC_LEN);
198         goto out;
199     }
200 
201     switch (lduw_p(&reqh->cmd)) {
202     case CLP_LIST_PCI: {
203         ClpReqRspListPci *rrb = (ClpReqRspListPci *)buffer;
204         list_pci(rrb, &cc);
205         break;
206     }
207     case CLP_SET_PCI_FN: {
208         ClpReqSetPci *reqsetpci = (ClpReqSetPci *)reqh;
209         ClpRspSetPci *ressetpci = (ClpRspSetPci *)resh;
210 
211         pbdev = s390_pci_find_dev_by_fh(s, ldl_p(&reqsetpci->fh));
212         if (!pbdev) {
213                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FH);
214                 goto out;
215         }
216 
217         switch (reqsetpci->oc) {
218         case CLP_SET_ENABLE_PCI_FN:
219             switch (reqsetpci->ndas) {
220             case 0:
221                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_DMAAS);
222                 goto out;
223             case 1:
224                 break;
225             default:
226                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_RES);
227                 goto out;
228             }
229 
230             if (pbdev->fh & FH_MASK_ENABLE) {
231                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
232                 goto out;
233             }
234 
235             pbdev->fh |= FH_MASK_ENABLE;
236             pbdev->state = ZPCI_FS_ENABLED;
237             stl_p(&ressetpci->fh, pbdev->fh);
238             stw_p(&ressetpci->hdr.rsp, CLP_RC_OK);
239             break;
240         case CLP_SET_DISABLE_PCI_FN:
241             if (!(pbdev->fh & FH_MASK_ENABLE)) {
242                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
243                 goto out;
244             }
245             device_reset(DEVICE(pbdev));
246             pbdev->fh &= ~FH_MASK_ENABLE;
247             pbdev->state = ZPCI_FS_DISABLED;
248             stl_p(&ressetpci->fh, pbdev->fh);
249             stw_p(&ressetpci->hdr.rsp, CLP_RC_OK);
250             break;
251         default:
252             DPRINTF("unknown set pci command\n");
253             stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
254             break;
255         }
256         break;
257     }
258     case CLP_QUERY_PCI_FN: {
259         ClpReqQueryPci *reqquery = (ClpReqQueryPci *)reqh;
260         ClpRspQueryPci *resquery = (ClpRspQueryPci *)resh;
261 
262         pbdev = s390_pci_find_dev_by_fh(s, ldl_p(&reqquery->fh));
263         if (!pbdev) {
264             DPRINTF("query pci no pci dev\n");
265             stw_p(&resquery->hdr.rsp, CLP_RC_SETPCIFN_FH);
266             goto out;
267         }
268 
269         for (i = 0; i < PCI_BAR_COUNT; i++) {
270             uint32_t data = pci_get_long(pbdev->pdev->config +
271                 PCI_BASE_ADDRESS_0 + (i * 4));
272 
273             stl_p(&resquery->bar[i], data);
274             resquery->bar_size[i] = pbdev->pdev->io_regions[i].size ?
275                                     ctz64(pbdev->pdev->io_regions[i].size) : 0;
276             DPRINTF("bar %d addr 0x%x size 0x%" PRIx64 "barsize 0x%x\n", i,
277                     ldl_p(&resquery->bar[i]),
278                     pbdev->pdev->io_regions[i].size,
279                     resquery->bar_size[i]);
280         }
281 
282         stq_p(&resquery->sdma, ZPCI_SDMA_ADDR);
283         stq_p(&resquery->edma, ZPCI_EDMA_ADDR);
284         stl_p(&resquery->fid, pbdev->fid);
285         stw_p(&resquery->pchid, 0);
286         stw_p(&resquery->ug, 1);
287         stl_p(&resquery->uid, pbdev->uid);
288         stw_p(&resquery->hdr.rsp, CLP_RC_OK);
289         break;
290     }
291     case CLP_QUERY_PCI_FNGRP: {
292         ClpRspQueryPciGrp *resgrp = (ClpRspQueryPciGrp *)resh;
293         resgrp->fr = 1;
294         stq_p(&resgrp->dasm, 0);
295         stq_p(&resgrp->msia, ZPCI_MSI_ADDR);
296         stw_p(&resgrp->mui, DEFAULT_MUI);
297         stw_p(&resgrp->i, 128);
298         stw_p(&resgrp->maxstbl, 128);
299         resgrp->version = 0;
300 
301         stw_p(&resgrp->hdr.rsp, CLP_RC_OK);
302         break;
303     }
304     default:
305         DPRINTF("unknown clp command\n");
306         stw_p(&resh->rsp, CLP_RC_CMD);
307         break;
308     }
309 
310 out:
311     if (s390_cpu_virt_mem_write(cpu, env->regs[r2], r2, buffer,
312                                 req_len + res_len)) {
313         s390_cpu_virt_mem_handle_exc(cpu, ra);
314         return 0;
315     }
316     setcc(cpu, cc);
317     return 0;
318 }
319 
320 /**
321  * Swap data contained in s390x big endian registers to little endian
322  * PCI bars.
323  *
324  * @ptr: a pointer to a uint64_t data field
325  * @len: the length of the valid data, must be 1,2,4 or 8
326  */
327 static int zpci_endian_swap(uint64_t *ptr, uint8_t len)
328 {
329     uint64_t data = *ptr;
330 
331     switch (len) {
332     case 1:
333         break;
334     case 2:
335         data = bswap16(data);
336         break;
337     case 4:
338         data = bswap32(data);
339         break;
340     case 8:
341         data = bswap64(data);
342         break;
343     default:
344         return -EINVAL;
345     }
346     *ptr = data;
347     return 0;
348 }
349 
350 static MemoryRegion *s390_get_subregion(MemoryRegion *mr, uint64_t offset,
351                                         uint8_t len)
352 {
353     MemoryRegion *subregion;
354     uint64_t subregion_size;
355 
356     QTAILQ_FOREACH(subregion, &mr->subregions, subregions_link) {
357         subregion_size = int128_get64(subregion->size);
358         if ((offset >= subregion->addr) &&
359             (offset + len) <= (subregion->addr + subregion_size)) {
360             mr = subregion;
361             break;
362         }
363     }
364     return mr;
365 }
366 
367 static MemTxResult zpci_read_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
368                                  uint64_t offset, uint64_t *data, uint8_t len)
369 {
370     MemoryRegion *mr;
371 
372     mr = pbdev->pdev->io_regions[pcias].memory;
373     mr = s390_get_subregion(mr, offset, len);
374     offset -= mr->addr;
375     return memory_region_dispatch_read(mr, offset, data, len,
376                                        MEMTXATTRS_UNSPECIFIED);
377 }
378 
379 int pcilg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
380 {
381     CPUS390XState *env = &cpu->env;
382     S390PCIBusDevice *pbdev;
383     uint64_t offset;
384     uint64_t data;
385     MemTxResult result;
386     uint8_t len;
387     uint32_t fh;
388     uint8_t pcias;
389 
390     if (env->psw.mask & PSW_MASK_PSTATE) {
391         s390_program_interrupt(env, PGM_PRIVILEGED, 4, ra);
392         return 0;
393     }
394 
395     if (r2 & 0x1) {
396         s390_program_interrupt(env, PGM_SPECIFICATION, 4, ra);
397         return 0;
398     }
399 
400     fh = env->regs[r2] >> 32;
401     pcias = (env->regs[r2] >> 16) & 0xf;
402     len = env->regs[r2] & 0xf;
403     offset = env->regs[r2 + 1];
404 
405     if (!(fh & FH_MASK_ENABLE)) {
406         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
407         return 0;
408     }
409 
410     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
411     if (!pbdev) {
412         DPRINTF("pcilg no pci dev\n");
413         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
414         return 0;
415     }
416 
417     switch (pbdev->state) {
418     case ZPCI_FS_PERMANENT_ERROR:
419     case ZPCI_FS_ERROR:
420         setcc(cpu, ZPCI_PCI_LS_ERR);
421         s390_set_status_code(env, r2, ZPCI_PCI_ST_BLOCKED);
422         return 0;
423     default:
424         break;
425     }
426 
427     switch (pcias) {
428     case ZPCI_IO_BAR_MIN...ZPCI_IO_BAR_MAX:
429         if (!len || (len > (8 - (offset & 0x7)))) {
430             s390_program_interrupt(env, PGM_OPERAND, 4, ra);
431             return 0;
432         }
433         result = zpci_read_bar(pbdev, pcias, offset, &data, len);
434         if (result != MEMTX_OK) {
435             s390_program_interrupt(env, PGM_OPERAND, 4, ra);
436             return 0;
437         }
438         break;
439     case ZPCI_CONFIG_BAR:
440         if (!len || (len > (4 - (offset & 0x3))) || len == 3) {
441             s390_program_interrupt(env, PGM_OPERAND, 4, ra);
442             return 0;
443         }
444         data =  pci_host_config_read_common(
445                    pbdev->pdev, offset, pci_config_size(pbdev->pdev), len);
446 
447         if (zpci_endian_swap(&data, len)) {
448             s390_program_interrupt(env, PGM_OPERAND, 4, ra);
449             return 0;
450         }
451         break;
452     default:
453         DPRINTF("pcilg invalid space\n");
454         setcc(cpu, ZPCI_PCI_LS_ERR);
455         s390_set_status_code(env, r2, ZPCI_PCI_ST_INVAL_AS);
456         return 0;
457     }
458 
459     pbdev->fmb.counter[ZPCI_FMB_CNT_LD]++;
460 
461     env->regs[r1] = data;
462     setcc(cpu, ZPCI_PCI_LS_OK);
463     return 0;
464 }
465 
466 static MemTxResult zpci_write_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
467                                   uint64_t offset, uint64_t data, uint8_t len)
468 {
469     MemoryRegion *mr;
470 
471     mr = pbdev->pdev->io_regions[pcias].memory;
472     mr = s390_get_subregion(mr, offset, len);
473     offset -= mr->addr;
474     return memory_region_dispatch_write(mr, offset, data, len,
475                                         MEMTXATTRS_UNSPECIFIED);
476 }
477 
478 int pcistg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
479 {
480     CPUS390XState *env = &cpu->env;
481     uint64_t offset, data;
482     S390PCIBusDevice *pbdev;
483     MemTxResult result;
484     uint8_t len;
485     uint32_t fh;
486     uint8_t pcias;
487 
488     if (env->psw.mask & PSW_MASK_PSTATE) {
489         s390_program_interrupt(env, PGM_PRIVILEGED, 4, ra);
490         return 0;
491     }
492 
493     if (r2 & 0x1) {
494         s390_program_interrupt(env, PGM_SPECIFICATION, 4, ra);
495         return 0;
496     }
497 
498     fh = env->regs[r2] >> 32;
499     pcias = (env->regs[r2] >> 16) & 0xf;
500     len = env->regs[r2] & 0xf;
501     offset = env->regs[r2 + 1];
502     data = env->regs[r1];
503 
504     if (!(fh & FH_MASK_ENABLE)) {
505         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
506         return 0;
507     }
508 
509     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
510     if (!pbdev) {
511         DPRINTF("pcistg no pci dev\n");
512         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
513         return 0;
514     }
515 
516     switch (pbdev->state) {
517     /* ZPCI_FS_RESERVED, ZPCI_FS_STANDBY and ZPCI_FS_DISABLED
518      * are already covered by the FH_MASK_ENABLE check above
519      */
520     case ZPCI_FS_PERMANENT_ERROR:
521     case ZPCI_FS_ERROR:
522         setcc(cpu, ZPCI_PCI_LS_ERR);
523         s390_set_status_code(env, r2, ZPCI_PCI_ST_BLOCKED);
524         return 0;
525     default:
526         break;
527     }
528 
529     switch (pcias) {
530         /* A ZPCI PCI card may use any BAR from BAR 0 to BAR 5 */
531     case ZPCI_IO_BAR_MIN...ZPCI_IO_BAR_MAX:
532         /* Check length:
533          * A length of 0 is invalid and length should not cross a double word
534          */
535         if (!len || (len > (8 - (offset & 0x7)))) {
536             s390_program_interrupt(env, PGM_OPERAND, 4, ra);
537             return 0;
538         }
539 
540         result = zpci_write_bar(pbdev, pcias, offset, data, len);
541         if (result != MEMTX_OK) {
542             s390_program_interrupt(env, PGM_OPERAND, 4, ra);
543             return 0;
544         }
545         break;
546     case ZPCI_CONFIG_BAR:
547         /* ZPCI uses the pseudo BAR number 15 as configuration space */
548         /* possible access lengths are 1,2,4 and must not cross a word */
549         if (!len || (len > (4 - (offset & 0x3))) || len == 3) {
550             s390_program_interrupt(env, PGM_OPERAND, 4, ra);
551             return 0;
552         }
553         /* len = 1,2,4 so we do not need to test */
554         zpci_endian_swap(&data, len);
555         pci_host_config_write_common(pbdev->pdev, offset,
556                                      pci_config_size(pbdev->pdev),
557                                      data, len);
558         break;
559     default:
560         DPRINTF("pcistg invalid space\n");
561         setcc(cpu, ZPCI_PCI_LS_ERR);
562         s390_set_status_code(env, r2, ZPCI_PCI_ST_INVAL_AS);
563         return 0;
564     }
565 
566     pbdev->fmb.counter[ZPCI_FMB_CNT_ST]++;
567 
568     setcc(cpu, ZPCI_PCI_LS_OK);
569     return 0;
570 }
571 
572 static void s390_pci_update_iotlb(S390PCIIOMMU *iommu, S390IOTLBEntry *entry)
573 {
574     S390IOTLBEntry *cache = g_hash_table_lookup(iommu->iotlb, &entry->iova);
575     IOMMUTLBEntry notify = {
576         .target_as = &address_space_memory,
577         .iova = entry->iova,
578         .translated_addr = entry->translated_addr,
579         .perm = entry->perm,
580         .addr_mask = ~PAGE_MASK,
581     };
582 
583     if (entry->perm == IOMMU_NONE) {
584         if (!cache) {
585             return;
586         }
587         g_hash_table_remove(iommu->iotlb, &entry->iova);
588     } else {
589         if (cache) {
590             if (cache->perm == entry->perm &&
591                 cache->translated_addr == entry->translated_addr) {
592                 return;
593             }
594 
595             notify.perm = IOMMU_NONE;
596             memory_region_notify_iommu(&iommu->iommu_mr, 0, notify);
597             notify.perm = entry->perm;
598         }
599 
600         cache = g_new(S390IOTLBEntry, 1);
601         cache->iova = entry->iova;
602         cache->translated_addr = entry->translated_addr;
603         cache->len = PAGE_SIZE;
604         cache->perm = entry->perm;
605         g_hash_table_replace(iommu->iotlb, &cache->iova, cache);
606     }
607 
608     memory_region_notify_iommu(&iommu->iommu_mr, 0, notify);
609 }
610 
611 int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
612 {
613     CPUS390XState *env = &cpu->env;
614     uint32_t fh;
615     uint16_t error = 0;
616     S390PCIBusDevice *pbdev;
617     S390PCIIOMMU *iommu;
618     S390IOTLBEntry entry;
619     hwaddr start, end;
620 
621     if (env->psw.mask & PSW_MASK_PSTATE) {
622         s390_program_interrupt(env, PGM_PRIVILEGED, 4, ra);
623         return 0;
624     }
625 
626     if (r2 & 0x1) {
627         s390_program_interrupt(env, PGM_SPECIFICATION, 4, ra);
628         return 0;
629     }
630 
631     fh = env->regs[r1] >> 32;
632     start = env->regs[r2];
633     end = start + env->regs[r2 + 1];
634 
635     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
636     if (!pbdev) {
637         DPRINTF("rpcit no pci dev\n");
638         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
639         return 0;
640     }
641 
642     switch (pbdev->state) {
643     case ZPCI_FS_RESERVED:
644     case ZPCI_FS_STANDBY:
645     case ZPCI_FS_DISABLED:
646     case ZPCI_FS_PERMANENT_ERROR:
647         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
648         return 0;
649     case ZPCI_FS_ERROR:
650         setcc(cpu, ZPCI_PCI_LS_ERR);
651         s390_set_status_code(env, r1, ZPCI_MOD_ST_ERROR_RECOVER);
652         return 0;
653     default:
654         break;
655     }
656 
657     iommu = pbdev->iommu;
658     if (!iommu->g_iota) {
659         error = ERR_EVENT_INVALAS;
660         goto err;
661     }
662 
663     if (end < iommu->pba || start > iommu->pal) {
664         error = ERR_EVENT_OORANGE;
665         goto err;
666     }
667 
668     while (start < end) {
669         error = s390_guest_io_table_walk(iommu->g_iota, start, &entry);
670         if (error) {
671             break;
672         }
673 
674         start += entry.len;
675         while (entry.iova < start && entry.iova < end) {
676             s390_pci_update_iotlb(iommu, &entry);
677             entry.iova += PAGE_SIZE;
678             entry.translated_addr += PAGE_SIZE;
679         }
680     }
681 err:
682     if (error) {
683         pbdev->state = ZPCI_FS_ERROR;
684         setcc(cpu, ZPCI_PCI_LS_ERR);
685         s390_set_status_code(env, r1, ZPCI_PCI_ST_FUNC_IN_ERR);
686         s390_pci_generate_error_event(error, pbdev->fh, pbdev->fid, start, 0);
687     } else {
688         pbdev->fmb.counter[ZPCI_FMB_CNT_RPCIT]++;
689         setcc(cpu, ZPCI_PCI_LS_OK);
690     }
691     return 0;
692 }
693 
694 int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
695                         uint8_t ar, uintptr_t ra)
696 {
697     CPUS390XState *env = &cpu->env;
698     S390PCIBusDevice *pbdev;
699     MemoryRegion *mr;
700     MemTxResult result;
701     uint64_t offset;
702     int i;
703     uint32_t fh;
704     uint8_t pcias;
705     uint8_t len;
706     uint8_t buffer[128];
707 
708     if (env->psw.mask & PSW_MASK_PSTATE) {
709         s390_program_interrupt(env, PGM_PRIVILEGED, 6, ra);
710         return 0;
711     }
712 
713     fh = env->regs[r1] >> 32;
714     pcias = (env->regs[r1] >> 16) & 0xf;
715     len = env->regs[r1] & 0xff;
716     offset = env->regs[r3];
717 
718     if (!(fh & FH_MASK_ENABLE)) {
719         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
720         return 0;
721     }
722 
723     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
724     if (!pbdev) {
725         DPRINTF("pcistb no pci dev fh 0x%x\n", fh);
726         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
727         return 0;
728     }
729 
730     switch (pbdev->state) {
731     case ZPCI_FS_PERMANENT_ERROR:
732     case ZPCI_FS_ERROR:
733         setcc(cpu, ZPCI_PCI_LS_ERR);
734         s390_set_status_code(env, r1, ZPCI_PCI_ST_BLOCKED);
735         return 0;
736     default:
737         break;
738     }
739 
740     if (pcias > ZPCI_IO_BAR_MAX) {
741         DPRINTF("pcistb invalid space\n");
742         setcc(cpu, ZPCI_PCI_LS_ERR);
743         s390_set_status_code(env, r1, ZPCI_PCI_ST_INVAL_AS);
744         return 0;
745     }
746 
747     /* Verify the address, offset and length */
748     /* offset must be a multiple of 8 */
749     if (offset % 8) {
750         goto specification_error;
751     }
752     /* Length must be greater than 8, a multiple of 8 */
753     /* and not greater than maxstbl */
754     if ((len <= 8) || (len % 8) || (len > pbdev->maxstbl)) {
755         goto specification_error;
756     }
757     /* Do not cross a 4K-byte boundary */
758     if (((offset & 0xfff) + len) > 0x1000) {
759         goto specification_error;
760     }
761     /* Guest address must be double word aligned */
762     if (gaddr & 0x07UL) {
763         goto specification_error;
764     }
765 
766     mr = pbdev->pdev->io_regions[pcias].memory;
767     mr = s390_get_subregion(mr, offset, len);
768     offset -= mr->addr;
769 
770     if (!memory_region_access_valid(mr, offset, len, true,
771                                     MEMTXATTRS_UNSPECIFIED)) {
772         s390_program_interrupt(env, PGM_OPERAND, 6, ra);
773         return 0;
774     }
775 
776     if (s390_cpu_virt_mem_read(cpu, gaddr, ar, buffer, len)) {
777         s390_cpu_virt_mem_handle_exc(cpu, ra);
778         return 0;
779     }
780 
781     for (i = 0; i < len / 8; i++) {
782         result = memory_region_dispatch_write(mr, offset + i * 8,
783                                               ldq_p(buffer + i * 8), 8,
784                                               MEMTXATTRS_UNSPECIFIED);
785         if (result != MEMTX_OK) {
786             s390_program_interrupt(env, PGM_OPERAND, 6, ra);
787             return 0;
788         }
789     }
790 
791     pbdev->fmb.counter[ZPCI_FMB_CNT_STB]++;
792 
793     setcc(cpu, ZPCI_PCI_LS_OK);
794     return 0;
795 
796 specification_error:
797     s390_program_interrupt(env, PGM_SPECIFICATION, 6, ra);
798     return 0;
799 }
800 
801 static int reg_irqs(CPUS390XState *env, S390PCIBusDevice *pbdev, ZpciFib fib)
802 {
803     int ret, len;
804     uint8_t isc = FIB_DATA_ISC(ldl_p(&fib.data));
805 
806     pbdev->routes.adapter.adapter_id = css_get_adapter_id(
807                                        CSS_IO_ADAPTER_PCI, isc);
808     pbdev->summary_ind = get_indicator(ldq_p(&fib.aisb), sizeof(uint64_t));
809     len = BITS_TO_LONGS(FIB_DATA_NOI(ldl_p(&fib.data))) * sizeof(unsigned long);
810     pbdev->indicator = get_indicator(ldq_p(&fib.aibv), len);
811 
812     ret = map_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
813     if (ret) {
814         goto out;
815     }
816 
817     ret = map_indicator(&pbdev->routes.adapter, pbdev->indicator);
818     if (ret) {
819         goto out;
820     }
821 
822     pbdev->routes.adapter.summary_addr = ldq_p(&fib.aisb);
823     pbdev->routes.adapter.summary_offset = FIB_DATA_AISBO(ldl_p(&fib.data));
824     pbdev->routes.adapter.ind_addr = ldq_p(&fib.aibv);
825     pbdev->routes.adapter.ind_offset = FIB_DATA_AIBVO(ldl_p(&fib.data));
826     pbdev->isc = isc;
827     pbdev->noi = FIB_DATA_NOI(ldl_p(&fib.data));
828     pbdev->sum = FIB_DATA_SUM(ldl_p(&fib.data));
829 
830     DPRINTF("reg_irqs adapter id %d\n", pbdev->routes.adapter.adapter_id);
831     return 0;
832 out:
833     release_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
834     release_indicator(&pbdev->routes.adapter, pbdev->indicator);
835     pbdev->summary_ind = NULL;
836     pbdev->indicator = NULL;
837     return ret;
838 }
839 
840 int pci_dereg_irqs(S390PCIBusDevice *pbdev)
841 {
842     release_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
843     release_indicator(&pbdev->routes.adapter, pbdev->indicator);
844 
845     pbdev->summary_ind = NULL;
846     pbdev->indicator = NULL;
847     pbdev->routes.adapter.summary_addr = 0;
848     pbdev->routes.adapter.summary_offset = 0;
849     pbdev->routes.adapter.ind_addr = 0;
850     pbdev->routes.adapter.ind_offset = 0;
851     pbdev->isc = 0;
852     pbdev->noi = 0;
853     pbdev->sum = 0;
854 
855     DPRINTF("dereg_irqs adapter id %d\n", pbdev->routes.adapter.adapter_id);
856     return 0;
857 }
858 
859 static int reg_ioat(CPUS390XState *env, S390PCIIOMMU *iommu, ZpciFib fib,
860                     uintptr_t ra)
861 {
862     uint64_t pba = ldq_p(&fib.pba);
863     uint64_t pal = ldq_p(&fib.pal);
864     uint64_t g_iota = ldq_p(&fib.iota);
865     uint8_t dt = (g_iota >> 2) & 0x7;
866     uint8_t t = (g_iota >> 11) & 0x1;
867 
868     pba &= ~0xfff;
869     pal |= 0xfff;
870     if (pba > pal || pba < ZPCI_SDMA_ADDR || pal > ZPCI_EDMA_ADDR) {
871         s390_program_interrupt(env, PGM_OPERAND, 6, ra);
872         return -EINVAL;
873     }
874 
875     /* currently we only support designation type 1 with translation */
876     if (!(dt == ZPCI_IOTA_RTTO && t)) {
877         error_report("unsupported ioat dt %d t %d", dt, t);
878         s390_program_interrupt(env, PGM_OPERAND, 6, ra);
879         return -EINVAL;
880     }
881 
882     iommu->pba = pba;
883     iommu->pal = pal;
884     iommu->g_iota = g_iota;
885 
886     s390_pci_iommu_enable(iommu);
887 
888     return 0;
889 }
890 
891 void pci_dereg_ioat(S390PCIIOMMU *iommu)
892 {
893     s390_pci_iommu_disable(iommu);
894     iommu->pba = 0;
895     iommu->pal = 0;
896     iommu->g_iota = 0;
897 }
898 
899 void fmb_timer_free(S390PCIBusDevice *pbdev)
900 {
901     if (pbdev->fmb_timer) {
902         timer_del(pbdev->fmb_timer);
903         timer_free(pbdev->fmb_timer);
904         pbdev->fmb_timer = NULL;
905     }
906     pbdev->fmb_addr = 0;
907     memset(&pbdev->fmb, 0, sizeof(ZpciFmb));
908 }
909 
910 static int fmb_do_update(S390PCIBusDevice *pbdev, int offset, uint64_t val,
911                          int len)
912 {
913     MemTxResult ret;
914     uint64_t dst = pbdev->fmb_addr + offset;
915 
916     switch (len) {
917     case 8:
918         address_space_stq_be(&address_space_memory, dst, val,
919                              MEMTXATTRS_UNSPECIFIED,
920                              &ret);
921         break;
922     case 4:
923         address_space_stl_be(&address_space_memory, dst, val,
924                              MEMTXATTRS_UNSPECIFIED,
925                              &ret);
926         break;
927     case 2:
928         address_space_stw_be(&address_space_memory, dst, val,
929                              MEMTXATTRS_UNSPECIFIED,
930                              &ret);
931         break;
932     case 1:
933         address_space_stb(&address_space_memory, dst, val,
934                           MEMTXATTRS_UNSPECIFIED,
935                           &ret);
936         break;
937     default:
938         ret = MEMTX_ERROR;
939         break;
940     }
941     if (ret != MEMTX_OK) {
942         s390_pci_generate_error_event(ERR_EVENT_FMBA, pbdev->fh, pbdev->fid,
943                                       pbdev->fmb_addr, 0);
944         fmb_timer_free(pbdev);
945     }
946 
947     return ret;
948 }
949 
950 static void fmb_update(void *opaque)
951 {
952     S390PCIBusDevice *pbdev = opaque;
953     int64_t t = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
954     int i;
955 
956     /* Update U bit */
957     pbdev->fmb.last_update *= 2;
958     pbdev->fmb.last_update |= UPDATE_U_BIT;
959     if (fmb_do_update(pbdev, offsetof(ZpciFmb, last_update),
960                       pbdev->fmb.last_update,
961                       sizeof(pbdev->fmb.last_update))) {
962         return;
963     }
964 
965     /* Update FMB sample count */
966     if (fmb_do_update(pbdev, offsetof(ZpciFmb, sample),
967                       pbdev->fmb.sample++,
968                       sizeof(pbdev->fmb.sample))) {
969         return;
970     }
971 
972     /* Update FMB counters */
973     for (i = 0; i < ZPCI_FMB_CNT_MAX; i++) {
974         if (fmb_do_update(pbdev, offsetof(ZpciFmb, counter[i]),
975                           pbdev->fmb.counter[i],
976                           sizeof(pbdev->fmb.counter[0]))) {
977             return;
978         }
979     }
980 
981     /* Clear U bit and update the time */
982     pbdev->fmb.last_update = time2tod(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
983     pbdev->fmb.last_update *= 2;
984     if (fmb_do_update(pbdev, offsetof(ZpciFmb, last_update),
985                       pbdev->fmb.last_update,
986                       sizeof(pbdev->fmb.last_update))) {
987         return;
988     }
989     timer_mod(pbdev->fmb_timer, t + DEFAULT_MUI);
990 }
991 
992 int mpcifc_service_call(S390CPU *cpu, uint8_t r1, uint64_t fiba, uint8_t ar,
993                         uintptr_t ra)
994 {
995     CPUS390XState *env = &cpu->env;
996     uint8_t oc, dmaas;
997     uint32_t fh;
998     ZpciFib fib;
999     S390PCIBusDevice *pbdev;
1000     uint64_t cc = ZPCI_PCI_LS_OK;
1001 
1002     if (env->psw.mask & PSW_MASK_PSTATE) {
1003         s390_program_interrupt(env, PGM_PRIVILEGED, 6, ra);
1004         return 0;
1005     }
1006 
1007     oc = env->regs[r1] & 0xff;
1008     dmaas = (env->regs[r1] >> 16) & 0xff;
1009     fh = env->regs[r1] >> 32;
1010 
1011     if (fiba & 0x7) {
1012         s390_program_interrupt(env, PGM_SPECIFICATION, 6, ra);
1013         return 0;
1014     }
1015 
1016     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
1017     if (!pbdev) {
1018         DPRINTF("mpcifc no pci dev fh 0x%x\n", fh);
1019         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1020         return 0;
1021     }
1022 
1023     switch (pbdev->state) {
1024     case ZPCI_FS_RESERVED:
1025     case ZPCI_FS_STANDBY:
1026     case ZPCI_FS_DISABLED:
1027     case ZPCI_FS_PERMANENT_ERROR:
1028         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1029         return 0;
1030     default:
1031         break;
1032     }
1033 
1034     if (s390_cpu_virt_mem_read(cpu, fiba, ar, (uint8_t *)&fib, sizeof(fib))) {
1035         s390_cpu_virt_mem_handle_exc(cpu, ra);
1036         return 0;
1037     }
1038 
1039     if (fib.fmt != 0) {
1040         s390_program_interrupt(env, PGM_OPERAND, 6, ra);
1041         return 0;
1042     }
1043 
1044     switch (oc) {
1045     case ZPCI_MOD_FC_REG_INT:
1046         if (pbdev->summary_ind) {
1047             cc = ZPCI_PCI_LS_ERR;
1048             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1049         } else if (reg_irqs(env, pbdev, fib)) {
1050             cc = ZPCI_PCI_LS_ERR;
1051             s390_set_status_code(env, r1, ZPCI_MOD_ST_RES_NOT_AVAIL);
1052         }
1053         break;
1054     case ZPCI_MOD_FC_DEREG_INT:
1055         if (!pbdev->summary_ind) {
1056             cc = ZPCI_PCI_LS_ERR;
1057             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1058         } else {
1059             pci_dereg_irqs(pbdev);
1060         }
1061         break;
1062     case ZPCI_MOD_FC_REG_IOAT:
1063         if (dmaas != 0) {
1064             cc = ZPCI_PCI_LS_ERR;
1065             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1066         } else if (pbdev->iommu->enabled) {
1067             cc = ZPCI_PCI_LS_ERR;
1068             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1069         } else if (reg_ioat(env, pbdev->iommu, fib, ra)) {
1070             cc = ZPCI_PCI_LS_ERR;
1071             s390_set_status_code(env, r1, ZPCI_MOD_ST_INSUF_RES);
1072         }
1073         break;
1074     case ZPCI_MOD_FC_DEREG_IOAT:
1075         if (dmaas != 0) {
1076             cc = ZPCI_PCI_LS_ERR;
1077             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1078         } else if (!pbdev->iommu->enabled) {
1079             cc = ZPCI_PCI_LS_ERR;
1080             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1081         } else {
1082             pci_dereg_ioat(pbdev->iommu);
1083         }
1084         break;
1085     case ZPCI_MOD_FC_REREG_IOAT:
1086         if (dmaas != 0) {
1087             cc = ZPCI_PCI_LS_ERR;
1088             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1089         } else if (!pbdev->iommu->enabled) {
1090             cc = ZPCI_PCI_LS_ERR;
1091             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1092         } else {
1093             pci_dereg_ioat(pbdev->iommu);
1094             if (reg_ioat(env, pbdev->iommu, fib, ra)) {
1095                 cc = ZPCI_PCI_LS_ERR;
1096                 s390_set_status_code(env, r1, ZPCI_MOD_ST_INSUF_RES);
1097             }
1098         }
1099         break;
1100     case ZPCI_MOD_FC_RESET_ERROR:
1101         switch (pbdev->state) {
1102         case ZPCI_FS_BLOCKED:
1103         case ZPCI_FS_ERROR:
1104             pbdev->state = ZPCI_FS_ENABLED;
1105             break;
1106         default:
1107             cc = ZPCI_PCI_LS_ERR;
1108             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1109         }
1110         break;
1111     case ZPCI_MOD_FC_RESET_BLOCK:
1112         switch (pbdev->state) {
1113         case ZPCI_FS_ERROR:
1114             pbdev->state = ZPCI_FS_BLOCKED;
1115             break;
1116         default:
1117             cc = ZPCI_PCI_LS_ERR;
1118             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1119         }
1120         break;
1121     case ZPCI_MOD_FC_SET_MEASURE: {
1122         uint64_t fmb_addr = ldq_p(&fib.fmb_addr);
1123 
1124         if (fmb_addr & FMBK_MASK) {
1125             cc = ZPCI_PCI_LS_ERR;
1126             s390_pci_generate_error_event(ERR_EVENT_FMBPRO, pbdev->fh,
1127                                           pbdev->fid, fmb_addr, 0);
1128             fmb_timer_free(pbdev);
1129             break;
1130         }
1131 
1132         if (!fmb_addr) {
1133             /* Stop updating FMB. */
1134             fmb_timer_free(pbdev);
1135             break;
1136         }
1137 
1138         if (!pbdev->fmb_timer) {
1139             pbdev->fmb_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL,
1140                                             fmb_update, pbdev);
1141         } else if (timer_pending(pbdev->fmb_timer)) {
1142             /* Remove pending timer to update FMB address. */
1143             timer_del(pbdev->fmb_timer);
1144         }
1145         pbdev->fmb_addr = fmb_addr;
1146         timer_mod(pbdev->fmb_timer,
1147                   qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + DEFAULT_MUI);
1148         break;
1149     }
1150     default:
1151         s390_program_interrupt(&cpu->env, PGM_OPERAND, 6, ra);
1152         cc = ZPCI_PCI_LS_ERR;
1153     }
1154 
1155     setcc(cpu, cc);
1156     return 0;
1157 }
1158 
1159 int stpcifc_service_call(S390CPU *cpu, uint8_t r1, uint64_t fiba, uint8_t ar,
1160                          uintptr_t ra)
1161 {
1162     CPUS390XState *env = &cpu->env;
1163     uint8_t dmaas;
1164     uint32_t fh;
1165     ZpciFib fib;
1166     S390PCIBusDevice *pbdev;
1167     uint32_t data;
1168     uint64_t cc = ZPCI_PCI_LS_OK;
1169 
1170     if (env->psw.mask & PSW_MASK_PSTATE) {
1171         s390_program_interrupt(env, PGM_PRIVILEGED, 6, ra);
1172         return 0;
1173     }
1174 
1175     fh = env->regs[r1] >> 32;
1176     dmaas = (env->regs[r1] >> 16) & 0xff;
1177 
1178     if (dmaas) {
1179         setcc(cpu, ZPCI_PCI_LS_ERR);
1180         s390_set_status_code(env, r1, ZPCI_STPCIFC_ST_INVAL_DMAAS);
1181         return 0;
1182     }
1183 
1184     if (fiba & 0x7) {
1185         s390_program_interrupt(env, PGM_SPECIFICATION, 6, ra);
1186         return 0;
1187     }
1188 
1189     pbdev = s390_pci_find_dev_by_idx(s390_get_phb(), fh & FH_MASK_INDEX);
1190     if (!pbdev) {
1191         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1192         return 0;
1193     }
1194 
1195     memset(&fib, 0, sizeof(fib));
1196 
1197     switch (pbdev->state) {
1198     case ZPCI_FS_RESERVED:
1199     case ZPCI_FS_STANDBY:
1200         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1201         return 0;
1202     case ZPCI_FS_DISABLED:
1203         if (fh & FH_MASK_ENABLE) {
1204             setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1205             return 0;
1206         }
1207         goto out;
1208     /* BLOCKED bit is set to one coincident with the setting of ERROR bit.
1209      * FH Enabled bit is set to one in states of ENABLED, BLOCKED or ERROR. */
1210     case ZPCI_FS_ERROR:
1211         fib.fc |= 0x20;
1212         /* fallthrough */
1213     case ZPCI_FS_BLOCKED:
1214         fib.fc |= 0x40;
1215         /* fallthrough */
1216     case ZPCI_FS_ENABLED:
1217         fib.fc |= 0x80;
1218         if (pbdev->iommu->enabled) {
1219             fib.fc |= 0x10;
1220         }
1221         if (!(fh & FH_MASK_ENABLE)) {
1222             env->regs[r1] |= 1ULL << 63;
1223         }
1224         break;
1225     case ZPCI_FS_PERMANENT_ERROR:
1226         setcc(cpu, ZPCI_PCI_LS_ERR);
1227         s390_set_status_code(env, r1, ZPCI_STPCIFC_ST_PERM_ERROR);
1228         return 0;
1229     }
1230 
1231     stq_p(&fib.pba, pbdev->iommu->pba);
1232     stq_p(&fib.pal, pbdev->iommu->pal);
1233     stq_p(&fib.iota, pbdev->iommu->g_iota);
1234     stq_p(&fib.aibv, pbdev->routes.adapter.ind_addr);
1235     stq_p(&fib.aisb, pbdev->routes.adapter.summary_addr);
1236     stq_p(&fib.fmb_addr, pbdev->fmb_addr);
1237 
1238     data = ((uint32_t)pbdev->isc << 28) | ((uint32_t)pbdev->noi << 16) |
1239            ((uint32_t)pbdev->routes.adapter.ind_offset << 8) |
1240            ((uint32_t)pbdev->sum << 7) | pbdev->routes.adapter.summary_offset;
1241     stl_p(&fib.data, data);
1242 
1243 out:
1244     if (s390_cpu_virt_mem_write(cpu, fiba, ar, (uint8_t *)&fib, sizeof(fib))) {
1245         s390_cpu_virt_mem_handle_exc(cpu, ra);
1246         return 0;
1247     }
1248 
1249     setcc(cpu, cc);
1250     return 0;
1251 }
1252