From: Matthew Rosato <mjrosato@linux.ibm.com>
To: qemu-s390x@nongnu.org
Cc: alifm@linux.ibm.com, farman@linux.ibm.com,
richard.henderson@linaro.org, iii@linux.ibm.com,
david@kernel.org, pasic@linux.ibm.com, borntraeger@linux.ibm.com,
cohuck@redhat.com, qemu-devel@nongnu.org, qemu-stable@nongnu.org
Subject: [PATCH v2 3/3] s390x/pci: Reject apertures beyond IOAT capacity in translation mode
Date: Tue, 29 Sep 2026 11:30:12 -0400 [thread overview]
Message-ID: <20260929153012.774530-4-mjrosato@linux.ibm.com> (raw)
In-Reply-To: <20260929153012.774530-1-mjrosato@linux.ibm.com>
In order to support direct mapping (which is only bound by the aperture
size of the underlying host EDMA reported via vfio) QEMU reports the
host-provided EDMA to the guest. However, when using translation mode
QEMU only supports up to 4 TiB currently (the size of a single RT
table).
Reject attempts by a guest to register a translation aperture that
would exceed what QEMU can support by giving an operand exception on
the MPCIFC instruction that requested the large aperture. This
restriction can be removed in the future if/when support for additional
IOAT regions is added.
Cc: qemu-stable@nongnu.org
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
---
hw/s390x/s390-pci-inst.c | 15 +++++++++++++++
include/hw/s390x/s390-pci-bus.h | 1 +
2 files changed, 16 insertions(+)
diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index 73417edade..09026360d4 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -1054,6 +1054,21 @@ static int reg_ioat(CPUS390XState *env, S390PCIBusDevice *pbdev, ZpciFib fib,
return -EINVAL;
}
+ /*
+ * We report an EDMA that may exceed what QEMU can handle in support
+ * of direct-mapping. If the guest attempts to register an IOAT that
+ * is too large, reject it with an informative message. Only direct
+ * mapping can be used for guests of this size until support is added
+ * to QEMU for additional IOAT regions.
+ */
+ if (t && pal >= ZPCI_TABLE_SIZE_RT) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "ioat pal 0x%"PRIx64" exceeds max translatable address\n",
+ pal);
+ s390_program_interrupt(env, PGM_OPERAND, ra);
+ return -EINVAL;
+ }
+
iommu->pba = pba;
iommu->pal = pal;
iommu->g_iota = g_iota;
diff --git a/include/hw/s390x/s390-pci-bus.h b/include/hw/s390x/s390-pci-bus.h
index 9228523ce8..f182bab246 100644
--- a/include/hw/s390x/s390-pci-bus.h
+++ b/include/hw/s390x/s390-pci-bus.h
@@ -140,6 +140,7 @@ enum ZpciIoatDtype {
#define ZPCI_PT_BITS 8
#define ZPCI_ST_SHIFT (ZPCI_PT_BITS + TARGET_PAGE_BITS)
#define ZPCI_RT_SHIFT (ZPCI_ST_SHIFT + ZPCI_TABLE_BITS)
+#define ZPCI_TABLE_SIZE_RT (1ULL << (ZPCI_RT_SHIFT + ZPCI_TABLE_BITS))
#define ZPCI_RTE_FLAG_MASK 0x3fffULL
#define ZPCI_RTE_ADDR_MASK (~ZPCI_RTE_FLAG_MASK)
--
2.55.0
next prev parent reply other threads:[~2026-09-29 15:32 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-29 15:30 [PATCH v2 0/3] s390x/pci: some translation fixes Matthew Rosato
2026-09-29 15:30 ` [PATCH v2 1/3] s390x/pci: Fix frame stepping in rpcit_service_call() Matthew Rosato
2026-09-29 17:33 ` Farhan Ali
2026-09-29 17:36 ` Eric Farman
2026-09-29 15:30 ` [PATCH v2 2/3] s390x/pci: Use qemu_log_mask() for guest-triggered errors in reg_ioat() Matthew Rosato
2026-09-29 17:36 ` Eric Farman
2026-09-29 17:38 ` Farhan Ali
2026-09-29 15:30 ` Matthew Rosato [this message]
2026-09-29 17:47 ` [PATCH v2 3/3] s390x/pci: Reject apertures beyond IOAT capacity in translation mode Farhan Ali
2026-09-29 20:09 ` [PATCH v2 0/3] s390x/pci: some translation fixes Eric Farman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260929153012.774530-4-mjrosato@linux.ibm.com \
--to=mjrosato@linux.ibm.com \
--cc=alifm@linux.ibm.com \
--cc=borntraeger@linux.ibm.com \
--cc=cohuck@redhat.com \
--cc=david@kernel.org \
--cc=farman@linux.ibm.com \
--cc=iii@linux.ibm.com \
--cc=pasic@linux.ibm.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-s390x@nongnu.org \
--cc=qemu-stable@nongnu.org \
--cc=richard.henderson@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.