xref: /qemu/hw/s390x/s390-pci-inst.c (revision 92eecfff)
1 /*
2  * s390 PCI instructions
3  *
4  * Copyright 2014 IBM Corp.
5  * Author(s): Frank Blaschka <frank.blaschka@de.ibm.com>
6  *            Hong Bo Li <lihbbj@cn.ibm.com>
7  *            Yi Min Zhao <zyimin@cn.ibm.com>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2 or (at
10  * your option) any later version. See the COPYING file in the top-level
11  * directory.
12  */
13 
14 #include "qemu/osdep.h"
15 #include "cpu.h"
16 #include "exec/memop.h"
17 #include "exec/memory-internal.h"
18 #include "qemu/error-report.h"
19 #include "sysemu/hw_accel.h"
20 #include "hw/s390x/s390-pci-inst.h"
21 #include "hw/s390x/s390-pci-bus.h"
22 #include "hw/s390x/tod.h"
23 
24 #ifndef DEBUG_S390PCI_INST
25 #define DEBUG_S390PCI_INST  0
26 #endif
27 
28 #define DPRINTF(fmt, ...)                                          \
29     do {                                                           \
30         if (DEBUG_S390PCI_INST) {                                  \
31             fprintf(stderr, "s390pci-inst: " fmt, ## __VA_ARGS__); \
32         }                                                          \
33     } while (0)
34 
35 static inline void inc_dma_avail(S390PCIIOMMU *iommu)
36 {
37     if (iommu->dma_limit) {
38         iommu->dma_limit->avail++;
39     }
40 }
41 
42 static inline void dec_dma_avail(S390PCIIOMMU *iommu)
43 {
44     if (iommu->dma_limit) {
45         iommu->dma_limit->avail--;
46     }
47 }
48 
49 static void s390_set_status_code(CPUS390XState *env,
50                                  uint8_t r, uint64_t status_code)
51 {
52     env->regs[r] &= ~0xff000000ULL;
53     env->regs[r] |= (status_code & 0xff) << 24;
54 }
55 
56 static int list_pci(ClpReqRspListPci *rrb, uint8_t *cc)
57 {
58     S390PCIBusDevice *pbdev = NULL;
59     S390pciState *s = s390_get_phb();
60     uint32_t res_code, initial_l2, g_l2;
61     int rc, i;
62     uint64_t resume_token;
63 
64     rc = 0;
65     if (lduw_p(&rrb->request.hdr.len) != 32) {
66         res_code = CLP_RC_LEN;
67         rc = -EINVAL;
68         goto out;
69     }
70 
71     if ((ldl_p(&rrb->request.fmt) & CLP_MASK_FMT) != 0) {
72         res_code = CLP_RC_FMT;
73         rc = -EINVAL;
74         goto out;
75     }
76 
77     if ((ldl_p(&rrb->request.fmt) & ~CLP_MASK_FMT) != 0 ||
78         ldq_p(&rrb->request.reserved1) != 0) {
79         res_code = CLP_RC_RESNOT0;
80         rc = -EINVAL;
81         goto out;
82     }
83 
84     resume_token = ldq_p(&rrb->request.resume_token);
85 
86     if (resume_token) {
87         pbdev = s390_pci_find_dev_by_idx(s, resume_token);
88         if (!pbdev) {
89             res_code = CLP_RC_LISTPCI_BADRT;
90             rc = -EINVAL;
91             goto out;
92         }
93     } else {
94         pbdev = s390_pci_find_next_avail_dev(s, NULL);
95     }
96 
97     if (lduw_p(&rrb->response.hdr.len) < 48) {
98         res_code = CLP_RC_8K;
99         rc = -EINVAL;
100         goto out;
101     }
102 
103     initial_l2 = lduw_p(&rrb->response.hdr.len);
104     if ((initial_l2 - LIST_PCI_HDR_LEN) % sizeof(ClpFhListEntry)
105         != 0) {
106         res_code = CLP_RC_LEN;
107         rc = -EINVAL;
108         *cc = 3;
109         goto out;
110     }
111 
112     stl_p(&rrb->response.fmt, 0);
113     stq_p(&rrb->response.reserved1, 0);
114     stl_p(&rrb->response.mdd, FH_MASK_SHM);
115     stw_p(&rrb->response.max_fn, PCI_MAX_FUNCTIONS);
116     rrb->response.flags = UID_CHECKING_ENABLED;
117     rrb->response.entry_size = sizeof(ClpFhListEntry);
118 
119     i = 0;
120     g_l2 = LIST_PCI_HDR_LEN;
121     while (g_l2 < initial_l2 && pbdev) {
122         stw_p(&rrb->response.fh_list[i].device_id,
123             pci_get_word(pbdev->pdev->config + PCI_DEVICE_ID));
124         stw_p(&rrb->response.fh_list[i].vendor_id,
125             pci_get_word(pbdev->pdev->config + PCI_VENDOR_ID));
126         /* Ignore RESERVED devices. */
127         stl_p(&rrb->response.fh_list[i].config,
128             pbdev->state == ZPCI_FS_STANDBY ? 0 : 1 << 31);
129         stl_p(&rrb->response.fh_list[i].fid, pbdev->fid);
130         stl_p(&rrb->response.fh_list[i].fh, pbdev->fh);
131 
132         g_l2 += sizeof(ClpFhListEntry);
133         /* Add endian check for DPRINTF? */
134         DPRINTF("g_l2 %d vendor id 0x%x device id 0x%x fid 0x%x fh 0x%x\n",
135                 g_l2,
136                 lduw_p(&rrb->response.fh_list[i].vendor_id),
137                 lduw_p(&rrb->response.fh_list[i].device_id),
138                 ldl_p(&rrb->response.fh_list[i].fid),
139                 ldl_p(&rrb->response.fh_list[i].fh));
140         pbdev = s390_pci_find_next_avail_dev(s, pbdev);
141         i++;
142     }
143 
144     if (!pbdev) {
145         resume_token = 0;
146     } else {
147         resume_token = pbdev->fh & FH_MASK_INDEX;
148     }
149     stq_p(&rrb->response.resume_token, resume_token);
150     stw_p(&rrb->response.hdr.len, g_l2);
151     stw_p(&rrb->response.hdr.rsp, CLP_RC_OK);
152 out:
153     if (rc) {
154         DPRINTF("list pci failed rc 0x%x\n", rc);
155         stw_p(&rrb->response.hdr.rsp, res_code);
156     }
157     return rc;
158 }
159 
160 int clp_service_call(S390CPU *cpu, uint8_t r2, uintptr_t ra)
161 {
162     ClpReqHdr *reqh;
163     ClpRspHdr *resh;
164     S390PCIBusDevice *pbdev;
165     uint32_t req_len;
166     uint32_t res_len;
167     uint8_t buffer[4096 * 2];
168     uint8_t cc = 0;
169     CPUS390XState *env = &cpu->env;
170     S390pciState *s = s390_get_phb();
171     int i;
172 
173     if (env->psw.mask & PSW_MASK_PSTATE) {
174         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
175         return 0;
176     }
177 
178     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer, sizeof(*reqh))) {
179         s390_cpu_virt_mem_handle_exc(cpu, ra);
180         return 0;
181     }
182     reqh = (ClpReqHdr *)buffer;
183     req_len = lduw_p(&reqh->len);
184     if (req_len < 16 || req_len > 8184 || (req_len % 8 != 0)) {
185         s390_program_interrupt(env, PGM_OPERAND, ra);
186         return 0;
187     }
188 
189     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer,
190                                req_len + sizeof(*resh))) {
191         s390_cpu_virt_mem_handle_exc(cpu, ra);
192         return 0;
193     }
194     resh = (ClpRspHdr *)(buffer + req_len);
195     res_len = lduw_p(&resh->len);
196     if (res_len < 8 || res_len > 8176 || (res_len % 8 != 0)) {
197         s390_program_interrupt(env, PGM_OPERAND, ra);
198         return 0;
199     }
200     if ((req_len + res_len) > 8192) {
201         s390_program_interrupt(env, PGM_OPERAND, ra);
202         return 0;
203     }
204 
205     if (s390_cpu_virt_mem_read(cpu, env->regs[r2], r2, buffer,
206                                req_len + res_len)) {
207         s390_cpu_virt_mem_handle_exc(cpu, ra);
208         return 0;
209     }
210 
211     if (req_len != 32) {
212         stw_p(&resh->rsp, CLP_RC_LEN);
213         goto out;
214     }
215 
216     switch (lduw_p(&reqh->cmd)) {
217     case CLP_LIST_PCI: {
218         ClpReqRspListPci *rrb = (ClpReqRspListPci *)buffer;
219         list_pci(rrb, &cc);
220         break;
221     }
222     case CLP_SET_PCI_FN: {
223         ClpReqSetPci *reqsetpci = (ClpReqSetPci *)reqh;
224         ClpRspSetPci *ressetpci = (ClpRspSetPci *)resh;
225 
226         pbdev = s390_pci_find_dev_by_fh(s, ldl_p(&reqsetpci->fh));
227         if (!pbdev) {
228                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FH);
229                 goto out;
230         }
231 
232         switch (reqsetpci->oc) {
233         case CLP_SET_ENABLE_PCI_FN:
234             switch (reqsetpci->ndas) {
235             case 0:
236                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_DMAAS);
237                 goto out;
238             case 1:
239                 break;
240             default:
241                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_RES);
242                 goto out;
243             }
244 
245             if (pbdev->fh & FH_MASK_ENABLE) {
246                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
247                 goto out;
248             }
249 
250             pbdev->fh |= FH_MASK_ENABLE;
251             pbdev->state = ZPCI_FS_ENABLED;
252             stl_p(&ressetpci->fh, pbdev->fh);
253             stw_p(&ressetpci->hdr.rsp, CLP_RC_OK);
254             break;
255         case CLP_SET_DISABLE_PCI_FN:
256             if (!(pbdev->fh & FH_MASK_ENABLE)) {
257                 stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
258                 goto out;
259             }
260             device_legacy_reset(DEVICE(pbdev));
261             pbdev->fh &= ~FH_MASK_ENABLE;
262             pbdev->state = ZPCI_FS_DISABLED;
263             stl_p(&ressetpci->fh, pbdev->fh);
264             stw_p(&ressetpci->hdr.rsp, CLP_RC_OK);
265             break;
266         default:
267             DPRINTF("unknown set pci command\n");
268             stw_p(&ressetpci->hdr.rsp, CLP_RC_SETPCIFN_FHOP);
269             break;
270         }
271         break;
272     }
273     case CLP_QUERY_PCI_FN: {
274         ClpReqQueryPci *reqquery = (ClpReqQueryPci *)reqh;
275         ClpRspQueryPci *resquery = (ClpRspQueryPci *)resh;
276 
277         pbdev = s390_pci_find_dev_by_fh(s, ldl_p(&reqquery->fh));
278         if (!pbdev) {
279             DPRINTF("query pci no pci dev\n");
280             stw_p(&resquery->hdr.rsp, CLP_RC_SETPCIFN_FH);
281             goto out;
282         }
283 
284         memcpy(resquery, &pbdev->zpci_fn, sizeof(*resquery));
285 
286         for (i = 0; i < PCI_BAR_COUNT; i++) {
287             uint32_t data = pci_get_long(pbdev->pdev->config +
288                 PCI_BASE_ADDRESS_0 + (i * 4));
289 
290             stl_p(&resquery->bar[i], data);
291             resquery->bar_size[i] = pbdev->pdev->io_regions[i].size ?
292                                     ctz64(pbdev->pdev->io_regions[i].size) : 0;
293             DPRINTF("bar %d addr 0x%x size 0x%" PRIx64 "barsize 0x%x\n", i,
294                     ldl_p(&resquery->bar[i]),
295                     pbdev->pdev->io_regions[i].size,
296                     resquery->bar_size[i]);
297         }
298 
299         stw_p(&resquery->hdr.rsp, CLP_RC_OK);
300         break;
301     }
302     case CLP_QUERY_PCI_FNGRP: {
303         ClpRspQueryPciGrp *resgrp = (ClpRspQueryPciGrp *)resh;
304 
305         ClpReqQueryPciGrp *reqgrp = (ClpReqQueryPciGrp *)reqh;
306         S390PCIGroup *group;
307 
308         group = s390_group_find(reqgrp->g);
309         if (!group) {
310             /* We do not allow access to unknown groups */
311             /* The group must have been obtained with a vfio device */
312             stw_p(&resgrp->hdr.rsp, CLP_RC_QUERYPCIFG_PFGID);
313             goto out;
314         }
315         memcpy(resgrp, &group->zpci_group, sizeof(ClpRspQueryPciGrp));
316         stw_p(&resgrp->hdr.rsp, CLP_RC_OK);
317         break;
318     }
319     default:
320         DPRINTF("unknown clp command\n");
321         stw_p(&resh->rsp, CLP_RC_CMD);
322         break;
323     }
324 
325 out:
326     if (s390_cpu_virt_mem_write(cpu, env->regs[r2], r2, buffer,
327                                 req_len + res_len)) {
328         s390_cpu_virt_mem_handle_exc(cpu, ra);
329         return 0;
330     }
331     setcc(cpu, cc);
332     return 0;
333 }
334 
335 /**
336  * Swap data contained in s390x big endian registers to little endian
337  * PCI bars.
338  *
339  * @ptr: a pointer to a uint64_t data field
340  * @len: the length of the valid data, must be 1,2,4 or 8
341  */
342 static int zpci_endian_swap(uint64_t *ptr, uint8_t len)
343 {
344     uint64_t data = *ptr;
345 
346     switch (len) {
347     case 1:
348         break;
349     case 2:
350         data = bswap16(data);
351         break;
352     case 4:
353         data = bswap32(data);
354         break;
355     case 8:
356         data = bswap64(data);
357         break;
358     default:
359         return -EINVAL;
360     }
361     *ptr = data;
362     return 0;
363 }
364 
365 static MemoryRegion *s390_get_subregion(MemoryRegion *mr, uint64_t offset,
366                                         uint8_t len)
367 {
368     MemoryRegion *subregion;
369     uint64_t subregion_size;
370 
371     QTAILQ_FOREACH(subregion, &mr->subregions, subregions_link) {
372         subregion_size = int128_get64(subregion->size);
373         if ((offset >= subregion->addr) &&
374             (offset + len) <= (subregion->addr + subregion_size)) {
375             mr = subregion;
376             break;
377         }
378     }
379     return mr;
380 }
381 
382 static MemTxResult zpci_read_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
383                                  uint64_t offset, uint64_t *data, uint8_t len)
384 {
385     MemoryRegion *mr;
386 
387     mr = pbdev->pdev->io_regions[pcias].memory;
388     mr = s390_get_subregion(mr, offset, len);
389     offset -= mr->addr;
390     return memory_region_dispatch_read(mr, offset, data,
391                                        size_memop(len) | MO_BE,
392                                        MEMTXATTRS_UNSPECIFIED);
393 }
394 
395 int pcilg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
396 {
397     CPUS390XState *env = &cpu->env;
398     S390PCIBusDevice *pbdev;
399     uint64_t offset;
400     uint64_t data;
401     MemTxResult result;
402     uint8_t len;
403     uint32_t fh;
404     uint8_t pcias;
405 
406     if (env->psw.mask & PSW_MASK_PSTATE) {
407         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
408         return 0;
409     }
410 
411     if (r2 & 0x1) {
412         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
413         return 0;
414     }
415 
416     fh = env->regs[r2] >> 32;
417     pcias = (env->regs[r2] >> 16) & 0xf;
418     len = env->regs[r2] & 0xf;
419     offset = env->regs[r2 + 1];
420 
421     if (!(fh & FH_MASK_ENABLE)) {
422         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
423         return 0;
424     }
425 
426     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
427     if (!pbdev) {
428         DPRINTF("pcilg no pci dev\n");
429         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
430         return 0;
431     }
432 
433     switch (pbdev->state) {
434     case ZPCI_FS_PERMANENT_ERROR:
435     case ZPCI_FS_ERROR:
436         setcc(cpu, ZPCI_PCI_LS_ERR);
437         s390_set_status_code(env, r2, ZPCI_PCI_ST_BLOCKED);
438         return 0;
439     default:
440         break;
441     }
442 
443     switch (pcias) {
444     case ZPCI_IO_BAR_MIN...ZPCI_IO_BAR_MAX:
445         if (!len || (len > (8 - (offset & 0x7)))) {
446             s390_program_interrupt(env, PGM_OPERAND, ra);
447             return 0;
448         }
449         result = zpci_read_bar(pbdev, pcias, offset, &data, len);
450         if (result != MEMTX_OK) {
451             s390_program_interrupt(env, PGM_OPERAND, ra);
452             return 0;
453         }
454         break;
455     case ZPCI_CONFIG_BAR:
456         if (!len || (len > (4 - (offset & 0x3))) || len == 3) {
457             s390_program_interrupt(env, PGM_OPERAND, ra);
458             return 0;
459         }
460         data =  pci_host_config_read_common(
461                    pbdev->pdev, offset, pci_config_size(pbdev->pdev), len);
462 
463         if (zpci_endian_swap(&data, len)) {
464             s390_program_interrupt(env, PGM_OPERAND, ra);
465             return 0;
466         }
467         break;
468     default:
469         DPRINTF("pcilg invalid space\n");
470         setcc(cpu, ZPCI_PCI_LS_ERR);
471         s390_set_status_code(env, r2, ZPCI_PCI_ST_INVAL_AS);
472         return 0;
473     }
474 
475     pbdev->fmb.counter[ZPCI_FMB_CNT_LD]++;
476 
477     env->regs[r1] = data;
478     setcc(cpu, ZPCI_PCI_LS_OK);
479     return 0;
480 }
481 
482 static MemTxResult zpci_write_bar(S390PCIBusDevice *pbdev, uint8_t pcias,
483                                   uint64_t offset, uint64_t data, uint8_t len)
484 {
485     MemoryRegion *mr;
486 
487     mr = pbdev->pdev->io_regions[pcias].memory;
488     mr = s390_get_subregion(mr, offset, len);
489     offset -= mr->addr;
490     return memory_region_dispatch_write(mr, offset, data,
491                                         size_memop(len) | MO_BE,
492                                         MEMTXATTRS_UNSPECIFIED);
493 }
494 
495 int pcistg_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
496 {
497     CPUS390XState *env = &cpu->env;
498     uint64_t offset, data;
499     S390PCIBusDevice *pbdev;
500     MemTxResult result;
501     uint8_t len;
502     uint32_t fh;
503     uint8_t pcias;
504 
505     if (env->psw.mask & PSW_MASK_PSTATE) {
506         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
507         return 0;
508     }
509 
510     if (r2 & 0x1) {
511         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
512         return 0;
513     }
514 
515     fh = env->regs[r2] >> 32;
516     pcias = (env->regs[r2] >> 16) & 0xf;
517     len = env->regs[r2] & 0xf;
518     offset = env->regs[r2 + 1];
519     data = env->regs[r1];
520 
521     if (!(fh & FH_MASK_ENABLE)) {
522         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
523         return 0;
524     }
525 
526     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
527     if (!pbdev) {
528         DPRINTF("pcistg no pci dev\n");
529         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
530         return 0;
531     }
532 
533     switch (pbdev->state) {
534     /* ZPCI_FS_RESERVED, ZPCI_FS_STANDBY and ZPCI_FS_DISABLED
535      * are already covered by the FH_MASK_ENABLE check above
536      */
537     case ZPCI_FS_PERMANENT_ERROR:
538     case ZPCI_FS_ERROR:
539         setcc(cpu, ZPCI_PCI_LS_ERR);
540         s390_set_status_code(env, r2, ZPCI_PCI_ST_BLOCKED);
541         return 0;
542     default:
543         break;
544     }
545 
546     switch (pcias) {
547         /* A ZPCI PCI card may use any BAR from BAR 0 to BAR 5 */
548     case ZPCI_IO_BAR_MIN...ZPCI_IO_BAR_MAX:
549         /* Check length:
550          * A length of 0 is invalid and length should not cross a double word
551          */
552         if (!len || (len > (8 - (offset & 0x7)))) {
553             s390_program_interrupt(env, PGM_OPERAND, ra);
554             return 0;
555         }
556 
557         result = zpci_write_bar(pbdev, pcias, offset, data, len);
558         if (result != MEMTX_OK) {
559             s390_program_interrupt(env, PGM_OPERAND, ra);
560             return 0;
561         }
562         break;
563     case ZPCI_CONFIG_BAR:
564         /* ZPCI uses the pseudo BAR number 15 as configuration space */
565         /* possible access lengths are 1,2,4 and must not cross a word */
566         if (!len || (len > (4 - (offset & 0x3))) || len == 3) {
567             s390_program_interrupt(env, PGM_OPERAND, ra);
568             return 0;
569         }
570         /* len = 1,2,4 so we do not need to test */
571         zpci_endian_swap(&data, len);
572         pci_host_config_write_common(pbdev->pdev, offset,
573                                      pci_config_size(pbdev->pdev),
574                                      data, len);
575         break;
576     default:
577         DPRINTF("pcistg invalid space\n");
578         setcc(cpu, ZPCI_PCI_LS_ERR);
579         s390_set_status_code(env, r2, ZPCI_PCI_ST_INVAL_AS);
580         return 0;
581     }
582 
583     pbdev->fmb.counter[ZPCI_FMB_CNT_ST]++;
584 
585     setcc(cpu, ZPCI_PCI_LS_OK);
586     return 0;
587 }
588 
589 static uint32_t s390_pci_update_iotlb(S390PCIIOMMU *iommu,
590                                       S390IOTLBEntry *entry)
591 {
592     S390IOTLBEntry *cache = g_hash_table_lookup(iommu->iotlb, &entry->iova);
593     IOMMUTLBEntry notify = {
594         .target_as = &address_space_memory,
595         .iova = entry->iova,
596         .translated_addr = entry->translated_addr,
597         .perm = entry->perm,
598         .addr_mask = ~PAGE_MASK,
599     };
600 
601     if (entry->perm == IOMMU_NONE) {
602         if (!cache) {
603             goto out;
604         }
605         g_hash_table_remove(iommu->iotlb, &entry->iova);
606         inc_dma_avail(iommu);
607     } else {
608         if (cache) {
609             if (cache->perm == entry->perm &&
610                 cache->translated_addr == entry->translated_addr) {
611                 goto out;
612             }
613 
614             notify.perm = IOMMU_NONE;
615             memory_region_notify_iommu(&iommu->iommu_mr, 0, notify);
616             notify.perm = entry->perm;
617         }
618 
619         cache = g_new(S390IOTLBEntry, 1);
620         cache->iova = entry->iova;
621         cache->translated_addr = entry->translated_addr;
622         cache->len = PAGE_SIZE;
623         cache->perm = entry->perm;
624         g_hash_table_replace(iommu->iotlb, &cache->iova, cache);
625         dec_dma_avail(iommu);
626     }
627 
628     memory_region_notify_iommu(&iommu->iommu_mr, 0, notify);
629 
630 out:
631     return iommu->dma_limit ? iommu->dma_limit->avail : 1;
632 }
633 
634 int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
635 {
636     CPUS390XState *env = &cpu->env;
637     uint32_t fh;
638     uint16_t error = 0;
639     S390PCIBusDevice *pbdev;
640     S390PCIIOMMU *iommu;
641     S390IOTLBEntry entry;
642     hwaddr start, end;
643     uint32_t dma_avail;
644 
645     if (env->psw.mask & PSW_MASK_PSTATE) {
646         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
647         return 0;
648     }
649 
650     if (r2 & 0x1) {
651         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
652         return 0;
653     }
654 
655     fh = env->regs[r1] >> 32;
656     start = env->regs[r2];
657     end = start + env->regs[r2 + 1];
658 
659     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
660     if (!pbdev) {
661         DPRINTF("rpcit no pci dev\n");
662         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
663         return 0;
664     }
665 
666     switch (pbdev->state) {
667     case ZPCI_FS_RESERVED:
668     case ZPCI_FS_STANDBY:
669     case ZPCI_FS_DISABLED:
670     case ZPCI_FS_PERMANENT_ERROR:
671         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
672         return 0;
673     case ZPCI_FS_ERROR:
674         setcc(cpu, ZPCI_PCI_LS_ERR);
675         s390_set_status_code(env, r1, ZPCI_MOD_ST_ERROR_RECOVER);
676         return 0;
677     default:
678         break;
679     }
680 
681     iommu = pbdev->iommu;
682     if (iommu->dma_limit) {
683         dma_avail = iommu->dma_limit->avail;
684     } else {
685         dma_avail = 1;
686     }
687     if (!iommu->g_iota) {
688         error = ERR_EVENT_INVALAS;
689         goto err;
690     }
691 
692     if (end < iommu->pba || start > iommu->pal) {
693         error = ERR_EVENT_OORANGE;
694         goto err;
695     }
696 
697     while (start < end) {
698         error = s390_guest_io_table_walk(iommu->g_iota, start, &entry);
699         if (error) {
700             break;
701         }
702 
703         start += entry.len;
704         while (entry.iova < start && entry.iova < end &&
705                (dma_avail > 0 || entry.perm == IOMMU_NONE)) {
706             dma_avail = s390_pci_update_iotlb(iommu, &entry);
707             entry.iova += PAGE_SIZE;
708             entry.translated_addr += PAGE_SIZE;
709         }
710     }
711 err:
712     if (error) {
713         pbdev->state = ZPCI_FS_ERROR;
714         setcc(cpu, ZPCI_PCI_LS_ERR);
715         s390_set_status_code(env, r1, ZPCI_PCI_ST_FUNC_IN_ERR);
716         s390_pci_generate_error_event(error, pbdev->fh, pbdev->fid, start, 0);
717     } else {
718         pbdev->fmb.counter[ZPCI_FMB_CNT_RPCIT]++;
719         if (dma_avail > 0) {
720             setcc(cpu, ZPCI_PCI_LS_OK);
721         } else {
722             /* vfio DMA mappings are exhausted, trigger a RPCIT */
723             setcc(cpu, ZPCI_PCI_LS_ERR);
724             s390_set_status_code(env, r1, ZPCI_RPCIT_ST_INSUFF_RES);
725         }
726     }
727     return 0;
728 }
729 
730 int pcistb_service_call(S390CPU *cpu, uint8_t r1, uint8_t r3, uint64_t gaddr,
731                         uint8_t ar, uintptr_t ra)
732 {
733     CPUS390XState *env = &cpu->env;
734     S390PCIBusDevice *pbdev;
735     MemoryRegion *mr;
736     MemTxResult result;
737     uint64_t offset;
738     int i;
739     uint32_t fh;
740     uint8_t pcias;
741     uint8_t len;
742     uint8_t buffer[128];
743 
744     if (env->psw.mask & PSW_MASK_PSTATE) {
745         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
746         return 0;
747     }
748 
749     fh = env->regs[r1] >> 32;
750     pcias = (env->regs[r1] >> 16) & 0xf;
751     len = env->regs[r1] & 0xff;
752     offset = env->regs[r3];
753 
754     if (!(fh & FH_MASK_ENABLE)) {
755         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
756         return 0;
757     }
758 
759     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
760     if (!pbdev) {
761         DPRINTF("pcistb no pci dev fh 0x%x\n", fh);
762         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
763         return 0;
764     }
765 
766     switch (pbdev->state) {
767     case ZPCI_FS_PERMANENT_ERROR:
768     case ZPCI_FS_ERROR:
769         setcc(cpu, ZPCI_PCI_LS_ERR);
770         s390_set_status_code(env, r1, ZPCI_PCI_ST_BLOCKED);
771         return 0;
772     default:
773         break;
774     }
775 
776     if (pcias > ZPCI_IO_BAR_MAX) {
777         DPRINTF("pcistb invalid space\n");
778         setcc(cpu, ZPCI_PCI_LS_ERR);
779         s390_set_status_code(env, r1, ZPCI_PCI_ST_INVAL_AS);
780         return 0;
781     }
782 
783     /* Verify the address, offset and length */
784     /* offset must be a multiple of 8 */
785     if (offset % 8) {
786         goto specification_error;
787     }
788     /* Length must be greater than 8, a multiple of 8 */
789     /* and not greater than maxstbl */
790     if ((len <= 8) || (len % 8) ||
791         (len > pbdev->pci_group->zpci_group.maxstbl)) {
792         goto specification_error;
793     }
794     /* Do not cross a 4K-byte boundary */
795     if (((offset & 0xfff) + len) > 0x1000) {
796         goto specification_error;
797     }
798     /* Guest address must be double word aligned */
799     if (gaddr & 0x07UL) {
800         goto specification_error;
801     }
802 
803     mr = pbdev->pdev->io_regions[pcias].memory;
804     mr = s390_get_subregion(mr, offset, len);
805     offset -= mr->addr;
806 
807     if (!memory_region_access_valid(mr, offset, len, true,
808                                     MEMTXATTRS_UNSPECIFIED)) {
809         s390_program_interrupt(env, PGM_OPERAND, ra);
810         return 0;
811     }
812 
813     if (s390_cpu_virt_mem_read(cpu, gaddr, ar, buffer, len)) {
814         s390_cpu_virt_mem_handle_exc(cpu, ra);
815         return 0;
816     }
817 
818     for (i = 0; i < len / 8; i++) {
819         result = memory_region_dispatch_write(mr, offset + i * 8,
820                                               ldq_p(buffer + i * 8),
821                                               MO_64, MEMTXATTRS_UNSPECIFIED);
822         if (result != MEMTX_OK) {
823             s390_program_interrupt(env, PGM_OPERAND, ra);
824             return 0;
825         }
826     }
827 
828     pbdev->fmb.counter[ZPCI_FMB_CNT_STB]++;
829 
830     setcc(cpu, ZPCI_PCI_LS_OK);
831     return 0;
832 
833 specification_error:
834     s390_program_interrupt(env, PGM_SPECIFICATION, ra);
835     return 0;
836 }
837 
838 static int reg_irqs(CPUS390XState *env, S390PCIBusDevice *pbdev, ZpciFib fib)
839 {
840     int ret, len;
841     uint8_t isc = FIB_DATA_ISC(ldl_p(&fib.data));
842 
843     pbdev->routes.adapter.adapter_id = css_get_adapter_id(
844                                        CSS_IO_ADAPTER_PCI, isc);
845     pbdev->summary_ind = get_indicator(ldq_p(&fib.aisb), sizeof(uint64_t));
846     len = BITS_TO_LONGS(FIB_DATA_NOI(ldl_p(&fib.data))) * sizeof(unsigned long);
847     pbdev->indicator = get_indicator(ldq_p(&fib.aibv), len);
848 
849     ret = map_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
850     if (ret) {
851         goto out;
852     }
853 
854     ret = map_indicator(&pbdev->routes.adapter, pbdev->indicator);
855     if (ret) {
856         goto out;
857     }
858 
859     pbdev->routes.adapter.summary_addr = ldq_p(&fib.aisb);
860     pbdev->routes.adapter.summary_offset = FIB_DATA_AISBO(ldl_p(&fib.data));
861     pbdev->routes.adapter.ind_addr = ldq_p(&fib.aibv);
862     pbdev->routes.adapter.ind_offset = FIB_DATA_AIBVO(ldl_p(&fib.data));
863     pbdev->isc = isc;
864     pbdev->noi = FIB_DATA_NOI(ldl_p(&fib.data));
865     pbdev->sum = FIB_DATA_SUM(ldl_p(&fib.data));
866 
867     DPRINTF("reg_irqs adapter id %d\n", pbdev->routes.adapter.adapter_id);
868     return 0;
869 out:
870     release_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
871     release_indicator(&pbdev->routes.adapter, pbdev->indicator);
872     pbdev->summary_ind = NULL;
873     pbdev->indicator = NULL;
874     return ret;
875 }
876 
877 int pci_dereg_irqs(S390PCIBusDevice *pbdev)
878 {
879     release_indicator(&pbdev->routes.adapter, pbdev->summary_ind);
880     release_indicator(&pbdev->routes.adapter, pbdev->indicator);
881 
882     pbdev->summary_ind = NULL;
883     pbdev->indicator = NULL;
884     pbdev->routes.adapter.summary_addr = 0;
885     pbdev->routes.adapter.summary_offset = 0;
886     pbdev->routes.adapter.ind_addr = 0;
887     pbdev->routes.adapter.ind_offset = 0;
888     pbdev->isc = 0;
889     pbdev->noi = 0;
890     pbdev->sum = 0;
891 
892     DPRINTF("dereg_irqs adapter id %d\n", pbdev->routes.adapter.adapter_id);
893     return 0;
894 }
895 
896 static int reg_ioat(CPUS390XState *env, S390PCIIOMMU *iommu, ZpciFib fib,
897                     uintptr_t ra)
898 {
899     uint64_t pba = ldq_p(&fib.pba);
900     uint64_t pal = ldq_p(&fib.pal);
901     uint64_t g_iota = ldq_p(&fib.iota);
902     uint8_t dt = (g_iota >> 2) & 0x7;
903     uint8_t t = (g_iota >> 11) & 0x1;
904 
905     pba &= ~0xfff;
906     pal |= 0xfff;
907     if (pba > pal || pba < ZPCI_SDMA_ADDR || pal > ZPCI_EDMA_ADDR) {
908         s390_program_interrupt(env, PGM_OPERAND, ra);
909         return -EINVAL;
910     }
911 
912     /* currently we only support designation type 1 with translation */
913     if (!(dt == ZPCI_IOTA_RTTO && t)) {
914         error_report("unsupported ioat dt %d t %d", dt, t);
915         s390_program_interrupt(env, PGM_OPERAND, ra);
916         return -EINVAL;
917     }
918 
919     iommu->pba = pba;
920     iommu->pal = pal;
921     iommu->g_iota = g_iota;
922 
923     s390_pci_iommu_enable(iommu);
924 
925     return 0;
926 }
927 
928 void pci_dereg_ioat(S390PCIIOMMU *iommu)
929 {
930     s390_pci_iommu_disable(iommu);
931     iommu->pba = 0;
932     iommu->pal = 0;
933     iommu->g_iota = 0;
934 }
935 
936 void fmb_timer_free(S390PCIBusDevice *pbdev)
937 {
938     if (pbdev->fmb_timer) {
939         timer_del(pbdev->fmb_timer);
940         timer_free(pbdev->fmb_timer);
941         pbdev->fmb_timer = NULL;
942     }
943     pbdev->fmb_addr = 0;
944     memset(&pbdev->fmb, 0, sizeof(ZpciFmb));
945 }
946 
947 static int fmb_do_update(S390PCIBusDevice *pbdev, int offset, uint64_t val,
948                          int len)
949 {
950     MemTxResult ret;
951     uint64_t dst = pbdev->fmb_addr + offset;
952 
953     switch (len) {
954     case 8:
955         address_space_stq_be(&address_space_memory, dst, val,
956                              MEMTXATTRS_UNSPECIFIED,
957                              &ret);
958         break;
959     case 4:
960         address_space_stl_be(&address_space_memory, dst, val,
961                              MEMTXATTRS_UNSPECIFIED,
962                              &ret);
963         break;
964     case 2:
965         address_space_stw_be(&address_space_memory, dst, val,
966                              MEMTXATTRS_UNSPECIFIED,
967                              &ret);
968         break;
969     case 1:
970         address_space_stb(&address_space_memory, dst, val,
971                           MEMTXATTRS_UNSPECIFIED,
972                           &ret);
973         break;
974     default:
975         ret = MEMTX_ERROR;
976         break;
977     }
978     if (ret != MEMTX_OK) {
979         s390_pci_generate_error_event(ERR_EVENT_FMBA, pbdev->fh, pbdev->fid,
980                                       pbdev->fmb_addr, 0);
981         fmb_timer_free(pbdev);
982     }
983 
984     return ret;
985 }
986 
987 static void fmb_update(void *opaque)
988 {
989     S390PCIBusDevice *pbdev = opaque;
990     int64_t t = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);
991     int i;
992 
993     /* Update U bit */
994     pbdev->fmb.last_update *= 2;
995     pbdev->fmb.last_update |= UPDATE_U_BIT;
996     if (fmb_do_update(pbdev, offsetof(ZpciFmb, last_update),
997                       pbdev->fmb.last_update,
998                       sizeof(pbdev->fmb.last_update))) {
999         return;
1000     }
1001 
1002     /* Update FMB sample count */
1003     if (fmb_do_update(pbdev, offsetof(ZpciFmb, sample),
1004                       pbdev->fmb.sample++,
1005                       sizeof(pbdev->fmb.sample))) {
1006         return;
1007     }
1008 
1009     /* Update FMB counters */
1010     for (i = 0; i < ZPCI_FMB_CNT_MAX; i++) {
1011         if (fmb_do_update(pbdev, offsetof(ZpciFmb, counter[i]),
1012                           pbdev->fmb.counter[i],
1013                           sizeof(pbdev->fmb.counter[0]))) {
1014             return;
1015         }
1016     }
1017 
1018     /* Clear U bit and update the time */
1019     pbdev->fmb.last_update = time2tod(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
1020     pbdev->fmb.last_update *= 2;
1021     if (fmb_do_update(pbdev, offsetof(ZpciFmb, last_update),
1022                       pbdev->fmb.last_update,
1023                       sizeof(pbdev->fmb.last_update))) {
1024         return;
1025     }
1026     timer_mod(pbdev->fmb_timer, t + DEFAULT_MUI);
1027 }
1028 
1029 int mpcifc_service_call(S390CPU *cpu, uint8_t r1, uint64_t fiba, uint8_t ar,
1030                         uintptr_t ra)
1031 {
1032     CPUS390XState *env = &cpu->env;
1033     uint8_t oc, dmaas;
1034     uint32_t fh;
1035     ZpciFib fib;
1036     S390PCIBusDevice *pbdev;
1037     uint64_t cc = ZPCI_PCI_LS_OK;
1038 
1039     if (env->psw.mask & PSW_MASK_PSTATE) {
1040         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
1041         return 0;
1042     }
1043 
1044     oc = env->regs[r1] & 0xff;
1045     dmaas = (env->regs[r1] >> 16) & 0xff;
1046     fh = env->regs[r1] >> 32;
1047 
1048     if (fiba & 0x7) {
1049         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
1050         return 0;
1051     }
1052 
1053     pbdev = s390_pci_find_dev_by_fh(s390_get_phb(), fh);
1054     if (!pbdev) {
1055         DPRINTF("mpcifc no pci dev fh 0x%x\n", fh);
1056         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1057         return 0;
1058     }
1059 
1060     switch (pbdev->state) {
1061     case ZPCI_FS_RESERVED:
1062     case ZPCI_FS_STANDBY:
1063     case ZPCI_FS_DISABLED:
1064     case ZPCI_FS_PERMANENT_ERROR:
1065         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1066         return 0;
1067     default:
1068         break;
1069     }
1070 
1071     if (s390_cpu_virt_mem_read(cpu, fiba, ar, (uint8_t *)&fib, sizeof(fib))) {
1072         s390_cpu_virt_mem_handle_exc(cpu, ra);
1073         return 0;
1074     }
1075 
1076     if (fib.fmt != 0) {
1077         s390_program_interrupt(env, PGM_OPERAND, ra);
1078         return 0;
1079     }
1080 
1081     switch (oc) {
1082     case ZPCI_MOD_FC_REG_INT:
1083         if (pbdev->summary_ind) {
1084             cc = ZPCI_PCI_LS_ERR;
1085             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1086         } else if (reg_irqs(env, pbdev, fib)) {
1087             cc = ZPCI_PCI_LS_ERR;
1088             s390_set_status_code(env, r1, ZPCI_MOD_ST_RES_NOT_AVAIL);
1089         }
1090         break;
1091     case ZPCI_MOD_FC_DEREG_INT:
1092         if (!pbdev->summary_ind) {
1093             cc = ZPCI_PCI_LS_ERR;
1094             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1095         } else {
1096             pci_dereg_irqs(pbdev);
1097         }
1098         break;
1099     case ZPCI_MOD_FC_REG_IOAT:
1100         if (dmaas != 0) {
1101             cc = ZPCI_PCI_LS_ERR;
1102             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1103         } else if (pbdev->iommu->enabled) {
1104             cc = ZPCI_PCI_LS_ERR;
1105             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1106         } else if (reg_ioat(env, pbdev->iommu, fib, ra)) {
1107             cc = ZPCI_PCI_LS_ERR;
1108             s390_set_status_code(env, r1, ZPCI_MOD_ST_INSUF_RES);
1109         }
1110         break;
1111     case ZPCI_MOD_FC_DEREG_IOAT:
1112         if (dmaas != 0) {
1113             cc = ZPCI_PCI_LS_ERR;
1114             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1115         } else if (!pbdev->iommu->enabled) {
1116             cc = ZPCI_PCI_LS_ERR;
1117             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1118         } else {
1119             pci_dereg_ioat(pbdev->iommu);
1120         }
1121         break;
1122     case ZPCI_MOD_FC_REREG_IOAT:
1123         if (dmaas != 0) {
1124             cc = ZPCI_PCI_LS_ERR;
1125             s390_set_status_code(env, r1, ZPCI_MOD_ST_DMAAS_INVAL);
1126         } else if (!pbdev->iommu->enabled) {
1127             cc = ZPCI_PCI_LS_ERR;
1128             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1129         } else {
1130             pci_dereg_ioat(pbdev->iommu);
1131             if (reg_ioat(env, pbdev->iommu, fib, ra)) {
1132                 cc = ZPCI_PCI_LS_ERR;
1133                 s390_set_status_code(env, r1, ZPCI_MOD_ST_INSUF_RES);
1134             }
1135         }
1136         break;
1137     case ZPCI_MOD_FC_RESET_ERROR:
1138         switch (pbdev->state) {
1139         case ZPCI_FS_BLOCKED:
1140         case ZPCI_FS_ERROR:
1141             pbdev->state = ZPCI_FS_ENABLED;
1142             break;
1143         default:
1144             cc = ZPCI_PCI_LS_ERR;
1145             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1146         }
1147         break;
1148     case ZPCI_MOD_FC_RESET_BLOCK:
1149         switch (pbdev->state) {
1150         case ZPCI_FS_ERROR:
1151             pbdev->state = ZPCI_FS_BLOCKED;
1152             break;
1153         default:
1154             cc = ZPCI_PCI_LS_ERR;
1155             s390_set_status_code(env, r1, ZPCI_MOD_ST_SEQUENCE);
1156         }
1157         break;
1158     case ZPCI_MOD_FC_SET_MEASURE: {
1159         uint64_t fmb_addr = ldq_p(&fib.fmb_addr);
1160 
1161         if (fmb_addr & FMBK_MASK) {
1162             cc = ZPCI_PCI_LS_ERR;
1163             s390_pci_generate_error_event(ERR_EVENT_FMBPRO, pbdev->fh,
1164                                           pbdev->fid, fmb_addr, 0);
1165             fmb_timer_free(pbdev);
1166             break;
1167         }
1168 
1169         if (!fmb_addr) {
1170             /* Stop updating FMB. */
1171             fmb_timer_free(pbdev);
1172             break;
1173         }
1174 
1175         if (!pbdev->fmb_timer) {
1176             pbdev->fmb_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL,
1177                                             fmb_update, pbdev);
1178         } else if (timer_pending(pbdev->fmb_timer)) {
1179             /* Remove pending timer to update FMB address. */
1180             timer_del(pbdev->fmb_timer);
1181         }
1182         pbdev->fmb_addr = fmb_addr;
1183         timer_mod(pbdev->fmb_timer,
1184                   qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + DEFAULT_MUI);
1185         break;
1186     }
1187     default:
1188         s390_program_interrupt(&cpu->env, PGM_OPERAND, ra);
1189         cc = ZPCI_PCI_LS_ERR;
1190     }
1191 
1192     setcc(cpu, cc);
1193     return 0;
1194 }
1195 
1196 int stpcifc_service_call(S390CPU *cpu, uint8_t r1, uint64_t fiba, uint8_t ar,
1197                          uintptr_t ra)
1198 {
1199     CPUS390XState *env = &cpu->env;
1200     uint8_t dmaas;
1201     uint32_t fh;
1202     ZpciFib fib;
1203     S390PCIBusDevice *pbdev;
1204     uint32_t data;
1205     uint64_t cc = ZPCI_PCI_LS_OK;
1206 
1207     if (env->psw.mask & PSW_MASK_PSTATE) {
1208         s390_program_interrupt(env, PGM_PRIVILEGED, ra);
1209         return 0;
1210     }
1211 
1212     fh = env->regs[r1] >> 32;
1213     dmaas = (env->regs[r1] >> 16) & 0xff;
1214 
1215     if (dmaas) {
1216         setcc(cpu, ZPCI_PCI_LS_ERR);
1217         s390_set_status_code(env, r1, ZPCI_STPCIFC_ST_INVAL_DMAAS);
1218         return 0;
1219     }
1220 
1221     if (fiba & 0x7) {
1222         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
1223         return 0;
1224     }
1225 
1226     pbdev = s390_pci_find_dev_by_idx(s390_get_phb(), fh & FH_MASK_INDEX);
1227     if (!pbdev) {
1228         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1229         return 0;
1230     }
1231 
1232     memset(&fib, 0, sizeof(fib));
1233 
1234     switch (pbdev->state) {
1235     case ZPCI_FS_RESERVED:
1236     case ZPCI_FS_STANDBY:
1237         setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1238         return 0;
1239     case ZPCI_FS_DISABLED:
1240         if (fh & FH_MASK_ENABLE) {
1241             setcc(cpu, ZPCI_PCI_LS_INVAL_HANDLE);
1242             return 0;
1243         }
1244         goto out;
1245     /* BLOCKED bit is set to one coincident with the setting of ERROR bit.
1246      * FH Enabled bit is set to one in states of ENABLED, BLOCKED or ERROR. */
1247     case ZPCI_FS_ERROR:
1248         fib.fc |= 0x20;
1249         /* fallthrough */
1250     case ZPCI_FS_BLOCKED:
1251         fib.fc |= 0x40;
1252         /* fallthrough */
1253     case ZPCI_FS_ENABLED:
1254         fib.fc |= 0x80;
1255         if (pbdev->iommu->enabled) {
1256             fib.fc |= 0x10;
1257         }
1258         if (!(fh & FH_MASK_ENABLE)) {
1259             env->regs[r1] |= 1ULL << 63;
1260         }
1261         break;
1262     case ZPCI_FS_PERMANENT_ERROR:
1263         setcc(cpu, ZPCI_PCI_LS_ERR);
1264         s390_set_status_code(env, r1, ZPCI_STPCIFC_ST_PERM_ERROR);
1265         return 0;
1266     }
1267 
1268     stq_p(&fib.pba, pbdev->iommu->pba);
1269     stq_p(&fib.pal, pbdev->iommu->pal);
1270     stq_p(&fib.iota, pbdev->iommu->g_iota);
1271     stq_p(&fib.aibv, pbdev->routes.adapter.ind_addr);
1272     stq_p(&fib.aisb, pbdev->routes.adapter.summary_addr);
1273     stq_p(&fib.fmb_addr, pbdev->fmb_addr);
1274 
1275     data = ((uint32_t)pbdev->isc << 28) | ((uint32_t)pbdev->noi << 16) |
1276            ((uint32_t)pbdev->routes.adapter.ind_offset << 8) |
1277            ((uint32_t)pbdev->sum << 7) | pbdev->routes.adapter.summary_offset;
1278     stl_p(&fib.data, data);
1279 
1280 out:
1281     if (s390_cpu_virt_mem_write(cpu, fiba, ar, (uint8_t *)&fib, sizeof(fib))) {
1282         s390_cpu_virt_mem_handle_exc(cpu, ra);
1283         return 0;
1284     }
1285 
1286     setcc(cpu, cc);
1287     return 0;
1288 }
1289