[PATCH v2 0/3] s390x/pci: some translation fixes

[PATCH v2 0/3] s390x/pci: some translation fixes

[Matthew Rosato]

While reviewing Konstantin's migration series, a few edge cases have
been identified in the existing code.  Let's tighten them up first.

Changes for v2:

- convert to QEMU_ALIGN_UP
- add newlines to qemu_log_mask
- drop qemu/error-report.h

Matthew Rosato (3):
  s390x/pci: Fix frame stepping in rpcit_service_call()
  s390x/pci: Use qemu_log_mask() for guest-triggered errors in
    reg_ioat()
  s390x/pci: Reject apertures beyond IOAT capacity in translation mode

 hw/s390x/s390-pci-inst.c        | 25 +++++++++++++++++++++----
 include/hw/s390x/s390-pci-bus.h |  1 +
 2 files changed, 22 insertions(+), 4 deletions(-)

-- 
2.55.0

[PATCH v2 1/3] s390x/pci: Fix frame stepping in rpcit_service_call()

[Matthew Rosato]

When walking the guest IO address table, an invalid segment or region
entry causes table_translate() to return entry.len equal to the frame
size for that table level (1 MiB for ST, 2 GiB for RT).  Adding
entry.len directly to start only advances to the correct next frame
boundary if start is already frame-aligned at that level -- which is
true for a well-behaved Linux guest but not a general requirement.

Add logic to advance start to the next frame boundary rather than
simply adding entry.len.  For a frame-aligned start (the typical,
well-behaved case) the result is identical.

Fixes: 0125861eacc3 ("s390x/pci: fixup the code walking IOMMU tables")
Cc: qemu-stable@nongnu.org
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
---
 hw/s390x/s390-pci-inst.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index 652e1712ec..bac813fb6a 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -808,7 +808,8 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
             coalesce = 0;
         }
 
-        start += entry.len;
+        /* Advance to next frame boundary if start was not frame-aligned */
+        start = QEMU_ALIGN_UP(start + 1, entry.len);
         while (entry.iova < start && entry.iova < end) {
             if (dma_avail > 0 || entry.perm == IOMMU_NONE) {
                 dma_avail = s390_pci_update_iotlb(iommu, &entry);
-- 
2.55.0

Re: [PATCH v2 1/3] s390x/pci: Fix frame stepping in rpcit_service_call()

[Farhan Ali]

On 9/29/2026 8:30 AM, Matthew Rosato wrote:
> When walking the guest IO address table, an invalid segment or region
> entry causes table_translate() to return entry.len equal to the frame
> size for that table level (1 MiB for ST, 2 GiB for RT).  Adding
> entry.len directly to start only advances to the correct next frame
> boundary if start is already frame-aligned at that level -- which is
> true for a well-behaved Linux guest but not a general requirement.
>
> Add logic to advance start to the next frame boundary rather than
> simply adding entry.len.  For a frame-aligned start (the typical,
> well-behaved case) the result is identical.
>
> Fixes: 0125861eacc3 ("s390x/pci: fixup the code walking IOMMU tables")
> Cc:qemu-stable@nongnu.org
> Signed-off-by: Matthew Rosato<mjrosato@linux.ibm.com>
> ---
>   hw/s390x/s390-pci-inst.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)

Reviewed-by: Farhan Ali <alifm@linux.ibm.com>

Re: [PATCH v2 1/3] s390x/pci: Fix frame stepping in rpcit_service_call()

[Eric Farman]

On 9/29/26 11:30 AM, Matthew Rosato wrote:
> When walking the guest IO address table, an invalid segment or region
> entry causes table_translate() to return entry.len equal to the frame
> size for that table level (1 MiB for ST, 2 GiB for RT).  Adding
> entry.len directly to start only advances to the correct next frame
> boundary if start is already frame-aligned at that level -- which is
> true for a well-behaved Linux guest but not a general requirement.
> 
> Add logic to advance start to the next frame boundary rather than
> simply adding entry.len.  For a frame-aligned start (the typical,
> well-behaved case) the result is identical.
> 
> Fixes: 0125861eacc3 ("s390x/pci: fixup the code walking IOMMU tables")
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
> ---
>   hw/s390x/s390-pci-inst.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)

Reviewed-by: Eric Farman <farman@linux.ibm.com>

> 
> diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
> index 652e1712ec..bac813fb6a 100644
> --- a/hw/s390x/s390-pci-inst.c
> +++ b/hw/s390x/s390-pci-inst.c
> @@ -808,7 +808,8 @@ int rpcit_service_call(S390CPU *cpu, uint8_t r1, uint8_t r2, uintptr_t ra)
>               coalesce = 0;
>           }
>   
> -        start += entry.len;
> +        /* Advance to next frame boundary if start was not frame-aligned */
> +        start = QEMU_ALIGN_UP(start + 1, entry.len);
>           while (entry.iova < start && entry.iova < end) {
>               if (dma_avail > 0 || entry.perm == IOMMU_NONE) {
>                   dma_avail = s390_pci_update_iotlb(iommu, &entry);

[PATCH v2 2/3] s390x/pci: Use qemu_log_mask() for guest-triggered errors in reg_ioat()

[Matthew Rosato]

The error paths in reg_ioat() that are triggered by a guest providing
invalid MPCIFC arguments use error_report(), which writes unconditionally
to stderr.  A misbehaving guest can exploit this to flood the host log
by repeatedly issuing the instruction with bad arguments.

Replace these with qemu_log_mask(LOG_GUEST_ERROR, ...) so that the
messages are suppressible.

Fixes: 863f6f52b713 ("s390: implement pci instructions")
Fixes: dfcee1ea4c52 ("s390x/pci: add support for guests that request direct mapping")
Cc: qemu-stable@nongnu.org
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
---
 hw/s390x/s390-pci-inst.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index bac813fb6a..73417edade 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -15,8 +15,8 @@
 #include "exec/memop.h"
 #include "exec/target_page.h"
 #include "system/memory.h"
-#include "qemu/error-report.h"
 #include "qemu/bswap.h"
+#include "qemu/log.h"
 #include "system/hw_accel.h"
 #include "hw/core/boards.h"
 #include "hw/pci/pci_device.h"
@@ -1044,11 +1044,12 @@ static int reg_ioat(CPUS390XState *env, S390PCIBusDevice *pbdev, ZpciFib fib,
 
     /* currently we only support designation type 1 with translation */
     if (t && dt != ZPCI_IOTA_RTTO) {
-        error_report("unsupported ioat dt %d t %d", dt, t);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "unsupported ioat dt %d t %d\n", dt, t);
         s390_program_interrupt(env, PGM_OPERAND, ra);
         return -EINVAL;
     } else if (!t && !pbdev->rtr_avail) {
-        error_report("relaxed translation not allowed");
+        qemu_log_mask(LOG_GUEST_ERROR, "relaxed translation not allowed\n");
         s390_program_interrupt(env, PGM_OPERAND, ra);
         return -EINVAL;
     }
-- 
2.55.0

Re: [PATCH v2 2/3] s390x/pci: Use qemu_log_mask() for guest-triggered errors in reg_ioat()

[Eric Farman]

On 9/29/26 11:30 AM, Matthew Rosato wrote:
> The error paths in reg_ioat() that are triggered by a guest providing
> invalid MPCIFC arguments use error_report(), which writes unconditionally
> to stderr.  A misbehaving guest can exploit this to flood the host log
> by repeatedly issuing the instruction with bad arguments.
> 
> Replace these with qemu_log_mask(LOG_GUEST_ERROR, ...) so that the
> messages are suppressible.
> 
> Fixes: 863f6f52b713 ("s390: implement pci instructions")
> Fixes: dfcee1ea4c52 ("s390x/pci: add support for guests that request direct mapping")
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
> ---
>   hw/s390x/s390-pci-inst.c | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)

Christian's comment about newline had me looking at other occurrences; 
looks like one in virtio-ccw I should fix up. But for this:

Reviewed-by: Eric Farman <farman@linux.ibm.com>


> 
> diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
> index bac813fb6a..73417edade 100644
> --- a/hw/s390x/s390-pci-inst.c
> +++ b/hw/s390x/s390-pci-inst.c
> @@ -15,8 +15,8 @@
>   #include "exec/memop.h"
>   #include "exec/target_page.h"
>   #include "system/memory.h"
> -#include "qemu/error-report.h"
>   #include "qemu/bswap.h"
> +#include "qemu/log.h"
>   #include "system/hw_accel.h"
>   #include "hw/core/boards.h"
>   #include "hw/pci/pci_device.h"
> @@ -1044,11 +1044,12 @@ static int reg_ioat(CPUS390XState *env, S390PCIBusDevice *pbdev, ZpciFib fib,
>   
>       /* currently we only support designation type 1 with translation */
>       if (t && dt != ZPCI_IOTA_RTTO) {
> -        error_report("unsupported ioat dt %d t %d", dt, t);
> +        qemu_log_mask(LOG_GUEST_ERROR,
> +                      "unsupported ioat dt %d t %d\n", dt, t);
>           s390_program_interrupt(env, PGM_OPERAND, ra);
>           return -EINVAL;
>       } else if (!t && !pbdev->rtr_avail) {
> -        error_report("relaxed translation not allowed");
> +        qemu_log_mask(LOG_GUEST_ERROR, "relaxed translation not allowed\n");
>           s390_program_interrupt(env, PGM_OPERAND, ra);
>           return -EINVAL;
>       }

Re: [PATCH v2 2/3] s390x/pci: Use qemu_log_mask() for guest-triggered errors in reg_ioat()

[Farhan Ali]

On 9/29/2026 8:30 AM, Matthew Rosato wrote:
> The error paths in reg_ioat() that are triggered by a guest providing
> invalid MPCIFC arguments use error_report(), which writes unconditionally
> to stderr.  A misbehaving guest can exploit this to flood the host log
> by repeatedly issuing the instruction with bad arguments.
>
> Replace these with qemu_log_mask(LOG_GUEST_ERROR, ...) so that the
> messages are suppressible.
>
> Fixes: 863f6f52b713 ("s390: implement pci instructions")
> Fixes: dfcee1ea4c52 ("s390x/pci: add support for guests that request direct mapping")
> Cc:qemu-stable@nongnu.org
> Signed-off-by: Matthew Rosato<mjrosato@linux.ibm.com>
> ---
>   hw/s390x/s390-pci-inst.c | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)

Reviewed-by: Farhan Ali <alifm@linux.ibm.com>

[PATCH v2 3/3] s390x/pci: Reject apertures beyond IOAT capacity in translation mode

[Matthew Rosato]

In order to support direct mapping (which is only bound by the aperture
size of the underlying host EDMA reported via vfio) QEMU reports the
host-provided EDMA to the guest.  However, when using translation mode
QEMU only supports up to 4 TiB currently (the size of a single RT
table).

Reject attempts by a guest to register a translation aperture that
would exceed what QEMU can support by giving an operand exception on
the MPCIFC instruction that requested the large aperture.  This
restriction can be removed in the future if/when support for additional
IOAT regions is added.

Cc: qemu-stable@nongnu.org
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
---
 hw/s390x/s390-pci-inst.c        | 15 +++++++++++++++
 include/hw/s390x/s390-pci-bus.h |  1 +
 2 files changed, 16 insertions(+)

diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index 73417edade..09026360d4 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -1054,6 +1054,21 @@ static int reg_ioat(CPUS390XState *env, S390PCIBusDevice *pbdev, ZpciFib fib,
         return -EINVAL;
     }
 
+    /*
+     * We report an EDMA that may exceed what QEMU can handle in support
+     * of direct-mapping.  If the guest attempts to register an IOAT that
+     * is too large, reject it with an informative message.  Only direct
+     * mapping can be used for guests of this size until support is added
+     * to QEMU for additional IOAT regions.
+     */
+    if (t && pal >= ZPCI_TABLE_SIZE_RT) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "ioat pal 0x%"PRIx64" exceeds max translatable address\n",
+                      pal);
+        s390_program_interrupt(env, PGM_OPERAND, ra);
+        return -EINVAL;
+    }
+
     iommu->pba = pba;
     iommu->pal = pal;
     iommu->g_iota = g_iota;
diff --git a/include/hw/s390x/s390-pci-bus.h b/include/hw/s390x/s390-pci-bus.h
index 9228523ce8..f182bab246 100644
--- a/include/hw/s390x/s390-pci-bus.h
+++ b/include/hw/s390x/s390-pci-bus.h
@@ -140,6 +140,7 @@ enum ZpciIoatDtype {
 #define ZPCI_PT_BITS            8
 #define ZPCI_ST_SHIFT           (ZPCI_PT_BITS + TARGET_PAGE_BITS)
 #define ZPCI_RT_SHIFT           (ZPCI_ST_SHIFT + ZPCI_TABLE_BITS)
+#define ZPCI_TABLE_SIZE_RT      (1ULL << (ZPCI_RT_SHIFT + ZPCI_TABLE_BITS))
 
 #define ZPCI_RTE_FLAG_MASK      0x3fffULL
 #define ZPCI_RTE_ADDR_MASK      (~ZPCI_RTE_FLAG_MASK)
-- 
2.55.0

Re: [PATCH v2 3/3] s390x/pci: Reject apertures beyond IOAT capacity in translation mode

[Farhan Ali]

On 9/29/2026 8:30 AM, Matthew Rosato wrote:
> In order to support direct mapping (which is only bound by the aperture
> size of the underlying host EDMA reported via vfio) QEMU reports the
> host-provided EDMA to the guest.  However, when using translation mode
> QEMU only supports up to 4 TiB currently (the size of a single RT
> table).
>
> Reject attempts by a guest to register a translation aperture that
> would exceed what QEMU can support by giving an operand exception on
> the MPCIFC instruction that requested the large aperture.  This
> restriction can be removed in the future if/when support for additional
> IOAT regions is added.
>
> Cc:qemu-stable@nongnu.org
> Signed-off-by: Matthew Rosato<mjrosato@linux.ibm.com>
> ---
>   hw/s390x/s390-pci-inst.c        | 15 +++++++++++++++
>   include/hw/s390x/s390-pci-bus.h |  1 +
>   2 files changed, 16 insertions(+)

Reviewed-by: Farhan Ali <alifm@linux.ibm.com>

Re: [PATCH v2 0/3] s390x/pci: some translation fixes

[Eric Farman]

On 9/29/26 11:30 AM, Matthew Rosato wrote:
> While reviewing Konstantin's migration series, a few edge cases have
> been identified in the existing code.  Let's tighten them up first.
> 
> Changes for v2:
> 
> - convert to QEMU_ALIGN_UP
> - add newlines to qemu_log_mask
> - drop qemu/error-report.h
> 
> Matthew Rosato (3):
>    s390x/pci: Fix frame stepping in rpcit_service_call()
>    s390x/pci: Use qemu_log_mask() for guest-triggered errors in
>      reg_ioat()
>    s390x/pci: Reject apertures beyond IOAT capacity in translation mode
> 
>   hw/s390x/s390-pci-inst.c        | 25 +++++++++++++++++++++----
>   include/hw/s390x/s390-pci-bus.h |  1 +
>   2 files changed, 22 insertions(+), 4 deletions(-)
> 

Applied for 11.2; thank you!