1 files changed, 641 insertions, 63 deletions

diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 5f79d2d79ca7..200a8f9390b6 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -1,7 +1,7 @@
 /*
  * handling kvm guest interrupts
  *
- * Copyright IBM Corp. 2008
+ * Copyright IBM Corp. 2008,2014
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License (version 2 only)
@@ -13,6 +13,7 @@
 #include <linux/interrupt.h>
 #include <linux/kvm_host.h>
 #include <linux/hrtimer.h>
+#include <linux/mmu_context.h>
 #include <linux/signal.h>
 #include <linux/slab.h>
 #include <asm/asm-offsets.h>
@@ -31,7 +32,7 @@ static int is_ioint(u64 type)
         return ((type & 0xfffe0000u) != 0xfffe0000u);
 }
 
-static int psw_extint_disabled(struct kvm_vcpu *vcpu)
+int psw_extint_disabled(struct kvm_vcpu *vcpu)
 {
         return !(vcpu->arch.sie_block->gpsw.mask & PSW_MASK_EXT);
 }
@@ -78,11 +79,8 @@ static int __interrupt_is_deliverable(struct kvm_vcpu *vcpu,
                         return 1;
                 return 0;
         case KVM_S390_INT_SERVICE:
-                if (psw_extint_disabled(vcpu))
-                        return 0;
-                if (vcpu->arch.sie_block->gcr[0] & 0x200ul)
-                        return 1;
-                return 0;
+        case KVM_S390_INT_PFAULT_INIT:
+        case KVM_S390_INT_PFAULT_DONE:
         case KVM_S390_INT_VIRTIO:
                 if (psw_extint_disabled(vcpu))
                         return 0;
@@ -117,14 +115,12 @@ static int __interrupt_is_deliverable(struct kvm_vcpu *vcpu,
 
 static void __set_cpu_idle(struct kvm_vcpu *vcpu)
 {
-        BUG_ON(vcpu->vcpu_id > KVM_MAX_VCPUS - 1);
         atomic_set_mask(CPUSTAT_WAIT, &vcpu->arch.sie_block->cpuflags);
         set_bit(vcpu->vcpu_id, vcpu->arch.local_int.float_int->idle_mask);
 }
 
 static void __unset_cpu_idle(struct kvm_vcpu *vcpu)
 {
-        BUG_ON(vcpu->vcpu_id > KVM_MAX_VCPUS - 1);
         atomic_clear_mask(CPUSTAT_WAIT, &vcpu->arch.sie_block->cpuflags);
         clear_bit(vcpu->vcpu_id, vcpu->arch.local_int.float_int->idle_mask);
 }
@@ -150,6 +146,8 @@ static void __set_intercept_indicator(struct kvm_vcpu *vcpu,
         case KVM_S390_INT_EXTERNAL_CALL:
         case KVM_S390_INT_EMERGENCY:
         case KVM_S390_INT_SERVICE:
+        case KVM_S390_INT_PFAULT_INIT:
+        case KVM_S390_INT_PFAULT_DONE:
         case KVM_S390_INT_VIRTIO:
                 if (psw_extint_disabled(vcpu))
                         __set_cpuflag(vcpu, CPUSTAT_EXT_INT);
@@ -223,6 +221,30 @@ static void __do_deliver_interrupt(struct kvm_vcpu *vcpu,
                 rc |= put_guest(vcpu, inti->ext.ext_params,
                                 (u32 __user *)__LC_EXT_PARAMS);
                 break;
+        case KVM_S390_INT_PFAULT_INIT:
+                trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, inti->type, 0,
+                                                 inti->ext.ext_params2);
+                rc  = put_guest(vcpu, 0x2603, (u16 __user *) __LC_EXT_INT_CODE);
+                rc |= put_guest(vcpu, 0x0600, (u16 __user *) __LC_EXT_CPU_ADDR);
+                rc |= copy_to_guest(vcpu, __LC_EXT_OLD_PSW,
+                                    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
+                rc |= copy_from_guest(vcpu, &vcpu->arch.sie_block->gpsw,
+                                      __LC_EXT_NEW_PSW, sizeof(psw_t));
+                rc |= put_guest(vcpu, inti->ext.ext_params2,
+                                (u64 __user *) __LC_EXT_PARAMS2);
+                break;
+        case KVM_S390_INT_PFAULT_DONE:
+                trace_kvm_s390_deliver_interrupt(vcpu->vcpu_id, inti->type, 0,
+                                                 inti->ext.ext_params2);
+                rc  = put_guest(vcpu, 0x2603, (u16 __user *) __LC_EXT_INT_CODE);
+                rc |= put_guest(vcpu, 0x0680, (u16 __user *) __LC_EXT_CPU_ADDR);
+                rc |= copy_to_guest(vcpu, __LC_EXT_OLD_PSW,
+                                    &vcpu->arch.sie_block->gpsw, sizeof(psw_t));
+                rc |= copy_from_guest(vcpu, &vcpu->arch.sie_block->gpsw,
+                                      __LC_EXT_NEW_PSW, sizeof(psw_t));
+                rc |= put_guest(vcpu, inti->ext.ext_params2,
+                                (u64 __user *) __LC_EXT_PARAMS2);
+                break;
         case KVM_S390_INT_VIRTIO:
                 VCPU_EVENT(vcpu, 4, "interrupt: virtio parm:%x,parm64:%llx",
                            inti->ext.ext_params, inti->ext.ext_params2);
@@ -357,7 +379,7 @@ static int __try_deliver_ckc_interrupt(struct kvm_vcpu *vcpu)
         return 1;
 }
 
-static int kvm_cpu_has_interrupt(struct kvm_vcpu *vcpu)
+int kvm_cpu_has_interrupt(struct kvm_vcpu *vcpu)
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
         struct kvm_s390_float_interrupt *fi = vcpu->arch.local_int.float_int;
@@ -482,11 +504,26 @@ enum hrtimer_restart kvm_s390_idle_wakeup(struct hrtimer *timer)
         struct kvm_vcpu *vcpu;
 
         vcpu = container_of(timer, struct kvm_vcpu, arch.ckc_timer);
+        vcpu->preempted = true;
         tasklet_schedule(&vcpu->arch.tasklet);
 
         return HRTIMER_NORESTART;
 }
 
+void kvm_s390_clear_local_irqs(struct kvm_vcpu *vcpu)
+{
+        struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
+        struct kvm_s390_interrupt_info  *n, *inti = NULL;
+
+        spin_lock_bh(&li->lock);
+        list_for_each_entry_safe(inti, n, &li->list, list) {
+                list_del(&inti->list);
+                kfree(inti);
+        }
+        atomic_set(&li->active, 0);
+        spin_unlock_bh(&li->lock);
+}
+
 void kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu)
 {
         struct kvm_s390_local_interrupt *li = &vcpu->arch.local_int;
@@ -528,6 +565,7 @@ void kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu)
                         list_for_each_entry_safe(inti, n, &fi->list, list) {
                                 if (__interrupt_is_deliverable(vcpu, inti)) {
                                         list_del(&inti->list);
+                                        fi->irq_count--;
                                         deliver = 1;
                                         break;
                                 }
@@ -583,6 +621,7 @@ void kvm_s390_deliver_pending_machine_checks(struct kvm_vcpu *vcpu)
                                 if ((inti->type == KVM_S390_MCHK) &&
                                     __interrupt_is_deliverable(vcpu, inti)) {
                                         list_del(&inti->list);
+                                        fi->irq_count--;
                                         deliver = 1;
                                         break;
                                 }
@@ -650,8 +689,10 @@ struct kvm_s390_interrupt_info *kvm_s390_get_io_int(struct kvm *kvm,
                 inti = iter;
                 break;
         }
-        if (inti)
+        if (inti) {
                 list_del_init(&inti->list);
+                fi->irq_count--;
+        }
         if (list_empty(&fi->list))
                 atomic_set(&fi->active, 0);
         spin_unlock(&fi->lock);
@@ -659,53 +700,101 @@ struct kvm_s390_interrupt_info *kvm_s390_get_io_int(struct kvm *kvm,
         return inti;
 }
 
-int kvm_s390_inject_vm(struct kvm *kvm,
-                       struct kvm_s390_interrupt *s390int)
+static int __inject_vm(struct kvm *kvm, struct kvm_s390_interrupt_info *inti)
 {
         struct kvm_s390_local_interrupt *li;
         struct kvm_s390_float_interrupt *fi;
-        struct kvm_s390_interrupt_info *inti, *iter;
+        struct kvm_s390_interrupt_info *iter;
+        struct kvm_vcpu *dst_vcpu = NULL;
         int sigcpu;
+        int rc = 0;
+
+        mutex_lock(&kvm->lock);
+        fi = &kvm->arch.float_int;
+        spin_lock(&fi->lock);
+        if (fi->irq_count >= KVM_S390_MAX_FLOAT_IRQS) {
+                rc = -EINVAL;
+                goto unlock_fi;
+        }
+        fi->irq_count++;
+        if (!is_ioint(inti->type)) {
+                list_add_tail(&inti->list, &fi->list);
+        } else {
+                u64 isc_bits = int_word_to_isc_bits(inti->io.io_int_word);
+
+                /* Keep I/O interrupts sorted in isc order. */
+                list_for_each_entry(iter, &fi->list, list) {
+                        if (!is_ioint(iter->type))
+                                continue;
+                        if (int_word_to_isc_bits(iter->io.io_int_word)
+                            <= isc_bits)
+                                continue;
+                        break;
+                }
+                list_add_tail(&inti->list, &iter->list);
+        }
+        atomic_set(&fi->active, 1);
+        sigcpu = find_first_bit(fi->idle_mask, KVM_MAX_VCPUS);
+        if (sigcpu == KVM_MAX_VCPUS) {
+                do {
+                        sigcpu = fi->next_rr_cpu++;
+                        if (sigcpu == KVM_MAX_VCPUS)
+                                sigcpu = fi->next_rr_cpu = 0;
+                } while (kvm_get_vcpu(kvm, sigcpu) == NULL);
+        }
+        dst_vcpu = kvm_get_vcpu(kvm, sigcpu);
+        li = &dst_vcpu->arch.local_int;
+        spin_lock_bh(&li->lock);
+        atomic_set_mask(CPUSTAT_EXT_INT, li->cpuflags);
+        if (waitqueue_active(li->wq))
+                wake_up_interruptible(li->wq);
+        kvm_get_vcpu(kvm, sigcpu)->preempted = true;
+        spin_unlock_bh(&li->lock);
+unlock_fi:
+        spin_unlock(&fi->lock);
+        mutex_unlock(&kvm->lock);
+        return rc;
+}
+
+int kvm_s390_inject_vm(struct kvm *kvm,
+                       struct kvm_s390_interrupt *s390int)
+{
+        struct kvm_s390_interrupt_info *inti;
 
         inti = kzalloc(sizeof(*inti), GFP_KERNEL);
         if (!inti)
                 return -ENOMEM;
 
-        switch (s390int->type) {
+        inti->type = s390int->type;
+        switch (inti->type) {
         case KVM_S390_INT_VIRTIO:
                 VM_EVENT(kvm, 5, "inject: virtio parm:%x,parm64:%llx",
                          s390int->parm, s390int->parm64);
-                inti->type = s390int->type;
                 inti->ext.ext_params = s390int->parm;
                 inti->ext.ext_params2 = s390int->parm64;
                 break;
         case KVM_S390_INT_SERVICE:
                 VM_EVENT(kvm, 5, "inject: sclp parm:%x", s390int->parm);
-                inti->type = s390int->type;
                 inti->ext.ext_params = s390int->parm;
                 break;
-        case KVM_S390_PROGRAM_INT:
-        case KVM_S390_SIGP_STOP:
-        case KVM_S390_INT_EXTERNAL_CALL:
-        case KVM_S390_INT_EMERGENCY:
-                kfree(inti);
-                return -EINVAL;
+        case KVM_S390_INT_PFAULT_DONE:
+                inti->type = s390int->type;
+                inti->ext.ext_params2 = s390int->parm64;
+                break;
         case KVM_S390_MCHK:
                 VM_EVENT(kvm, 5, "inject: machine check parm64:%llx",
                          s390int->parm64);
-                inti->type = s390int->type;
                 inti->mchk.cr14 = s390int->parm; /* upper bits are not used */
                 inti->mchk.mcic = s390int->parm64;
                 break;
         case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
-                if (s390int->type & IOINT_AI_MASK)
+                if (inti->type & IOINT_AI_MASK)
                         VM_EVENT(kvm, 5, "%s", "inject: I/O (AI)");
                 else
                         VM_EVENT(kvm, 5, "inject: I/O css %x ss %x schid %04x",
                                  s390int->type & IOINT_CSSID_MASK,
                                  s390int->type & IOINT_SSID_MASK,
                                  s390int->type & IOINT_SCHID_MASK);
-                inti->type = s390int->type;
                 inti->io.subchannel_id = s390int->parm >> 16;
                 inti->io.subchannel_nr = s390int->parm & 0x0000ffffu;
                 inti->io.io_int_parm = s390int->parm64 >> 32;
@@ -718,43 +807,7 @@ int kvm_s390_inject_vm(struct kvm *kvm,
         trace_kvm_s390_inject_vm(s390int->type, s390int->parm, s390int->parm64,
                                  2);
 
-        mutex_lock(&kvm->lock);
-        fi = &kvm->arch.float_int;
-        spin_lock(&fi->lock);
-        if (!is_ioint(inti->type))
-                list_add_tail(&inti->list, &fi->list);
-        else {
-                u64 isc_bits = int_word_to_isc_bits(inti->io.io_int_word);
-
-                /* Keep I/O interrupts sorted in isc order. */
-                list_for_each_entry(iter, &fi->list, list) {
-                        if (!is_ioint(iter->type))
-                                continue;
-                        if (int_word_to_isc_bits(iter->io.io_int_word)
-                            <= isc_bits)
-                                continue;
-                        break;
-                }
-                list_add_tail(&inti->list, &iter->list);
-        }
-        atomic_set(&fi->active, 1);
-        sigcpu = find_first_bit(fi->idle_mask, KVM_MAX_VCPUS);
-        if (sigcpu == KVM_MAX_VCPUS) {
-                do {
-                        sigcpu = fi->next_rr_cpu++;
-                        if (sigcpu == KVM_MAX_VCPUS)
-                                sigcpu = fi->next_rr_cpu = 0;
-                } while (fi->local_int[sigcpu] == NULL);
-        }
-        li = fi->local_int[sigcpu];
-        spin_lock_bh(&li->lock);
-        atomic_set_mask(CPUSTAT_EXT_INT, li->cpuflags);
-        if (waitqueue_active(li->wq))
-                wake_up_interruptible(li->wq);
-        spin_unlock_bh(&li->lock);
-        spin_unlock(&fi->lock);
-        mutex_unlock(&kvm->lock);
-        return 0;
+        return __inject_vm(kvm, inti);
 }
 
 int kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu,
@@ -814,6 +867,10 @@ int kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu,
                 inti->type = s390int->type;
                 inti->mchk.mcic = s390int->parm64;
                 break;
+        case KVM_S390_INT_PFAULT_INIT:
+                inti->type = s390int->type;
+                inti->ext.ext_params2 = s390int->parm64;
+                break;
         case KVM_S390_INT_VIRTIO:
         case KVM_S390_INT_SERVICE:
         case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
@@ -837,7 +894,528 @@ int kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu,
         atomic_set_mask(CPUSTAT_EXT_INT, li->cpuflags);
         if (waitqueue_active(&vcpu->wq))
                 wake_up_interruptible(&vcpu->wq);
+        vcpu->preempted = true;
         spin_unlock_bh(&li->lock);
         mutex_unlock(&vcpu->kvm->lock);
         return 0;
 }
+
+static void clear_floating_interrupts(struct kvm *kvm)
+{
+        struct kvm_s390_float_interrupt *fi;
+        struct kvm_s390_interrupt_info  *n, *inti = NULL;
+
+        mutex_lock(&kvm->lock);
+        fi = &kvm->arch.float_int;
+        spin_lock(&fi->lock);
+        list_for_each_entry_safe(inti, n, &fi->list, list) {
+                list_del(&inti->list);
+                kfree(inti);
+        }
+        fi->irq_count = 0;
+        atomic_set(&fi->active, 0);
+        spin_unlock(&fi->lock);
+        mutex_unlock(&kvm->lock);
+}
+
+static inline int copy_irq_to_user(struct kvm_s390_interrupt_info *inti,
+                                   u8 *addr)
+{
+        struct kvm_s390_irq __user *uptr = (struct kvm_s390_irq __user *) addr;
+        struct kvm_s390_irq irq = {0};
+
+        irq.type = inti->type;
+        switch (inti->type) {
+        case KVM_S390_INT_PFAULT_INIT:
+        case KVM_S390_INT_PFAULT_DONE:
+        case KVM_S390_INT_VIRTIO:
+        case KVM_S390_INT_SERVICE:
+                irq.u.ext = inti->ext;
+                break;
+        case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
+                irq.u.io = inti->io;
+                break;
+        case KVM_S390_MCHK:
+                irq.u.mchk = inti->mchk;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        if (copy_to_user(uptr, &irq, sizeof(irq)))
+                return -EFAULT;
+
+        return 0;
+}
+
+static int get_all_floating_irqs(struct kvm *kvm, __u8 *buf, __u64 len)
+{
+        struct kvm_s390_interrupt_info *inti;
+        struct kvm_s390_float_interrupt *fi;
+        int ret = 0;
+        int n = 0;
+
+        mutex_lock(&kvm->lock);
+        fi = &kvm->arch.float_int;
+        spin_lock(&fi->lock);
+
+        list_for_each_entry(inti, &fi->list, list) {
+                if (len < sizeof(struct kvm_s390_irq)) {
+                        /* signal userspace to try again */
+                        ret = -ENOMEM;
+                        break;
+                }
+                ret = copy_irq_to_user(inti, buf);
+                if (ret)
+                        break;
+                buf += sizeof(struct kvm_s390_irq);
+                len -= sizeof(struct kvm_s390_irq);
+                n++;
+        }
+
+        spin_unlock(&fi->lock);
+        mutex_unlock(&kvm->lock);
+
+        return ret < 0 ? ret : n;
+}
+
+static int flic_get_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
+{
+        int r;
+
+        switch (attr->group) {
+        case KVM_DEV_FLIC_GET_ALL_IRQS:
+                r = get_all_floating_irqs(dev->kvm, (u8 *) attr->addr,
+                                          attr->attr);
+                break;
+        default:
+                r = -EINVAL;
+        }
+
+        return r;
+}
+
+static inline int copy_irq_from_user(struct kvm_s390_interrupt_info *inti,
+                                     u64 addr)
+{
+        struct kvm_s390_irq __user *uptr = (struct kvm_s390_irq __user *) addr;
+        void *target = NULL;
+        void __user *source;
+        u64 size;
+
+        if (get_user(inti->type, (u64 __user *)addr))
+                return -EFAULT;
+
+        switch (inti->type) {
+        case KVM_S390_INT_PFAULT_INIT:
+        case KVM_S390_INT_PFAULT_DONE:
+        case KVM_S390_INT_VIRTIO:
+        case KVM_S390_INT_SERVICE:
+                target = (void *) &inti->ext;
+                source = &uptr->u.ext;
+                size = sizeof(inti->ext);
+                break;
+        case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
+                target = (void *) &inti->io;
+                source = &uptr->u.io;
+                size = sizeof(inti->io);
+                break;
+        case KVM_S390_MCHK:
+                target = (void *) &inti->mchk;
+                source = &uptr->u.mchk;
+                size = sizeof(inti->mchk);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        if (copy_from_user(target, source, size))
+                return -EFAULT;
+
+        return 0;
+}
+
+static int enqueue_floating_irq(struct kvm_device *dev,
+                                struct kvm_device_attr *attr)
+{
+        struct kvm_s390_interrupt_info *inti = NULL;
+        int r = 0;
+        int len = attr->attr;
+
+        if (len % sizeof(struct kvm_s390_irq) != 0)
+                return -EINVAL;
+        else if (len > KVM_S390_FLIC_MAX_BUFFER)
+                return -EINVAL;
+
+        while (len >= sizeof(struct kvm_s390_irq)) {
+                inti = kzalloc(sizeof(*inti), GFP_KERNEL);
+                if (!inti)
+                        return -ENOMEM;
+
+                r = copy_irq_from_user(inti, attr->addr);
+                if (r) {
+                        kfree(inti);
+                        return r;
+                }
+                r = __inject_vm(dev->kvm, inti);
+                if (r) {
+                        kfree(inti);
+                        return r;
+                }
+                len -= sizeof(struct kvm_s390_irq);
+                attr->addr += sizeof(struct kvm_s390_irq);
+        }
+
+        return r;
+}
+
+static struct s390_io_adapter *get_io_adapter(struct kvm *kvm, unsigned int id)
+{
+        if (id >= MAX_S390_IO_ADAPTERS)
+                return NULL;
+        return kvm->arch.adapters[id];
+}
+
+static int register_io_adapter(struct kvm_device *dev,
+                               struct kvm_device_attr *attr)
+{
+        struct s390_io_adapter *adapter;
+        struct kvm_s390_io_adapter adapter_info;
+
+        if (copy_from_user(&adapter_info,
+                           (void __user *)attr->addr, sizeof(adapter_info)))
+                return -EFAULT;
+
+        if ((adapter_info.id >= MAX_S390_IO_ADAPTERS) ||
+            (dev->kvm->arch.adapters[adapter_info.id] != NULL))
+                return -EINVAL;
+
+        adapter = kzalloc(sizeof(*adapter), GFP_KERNEL);
+        if (!adapter)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&adapter->maps);
+        init_rwsem(&adapter->maps_lock);
+        atomic_set(&adapter->nr_maps, 0);
+        adapter->id = adapter_info.id;
+        adapter->isc = adapter_info.isc;
+        adapter->maskable = adapter_info.maskable;
+        adapter->masked = false;
+        adapter->swap = adapter_info.swap;
+        dev->kvm->arch.adapters[adapter->id] = adapter;
+
+        return 0;
+}
+
+int kvm_s390_mask_adapter(struct kvm *kvm, unsigned int id, bool masked)
+{
+        int ret;
+        struct s390_io_adapter *adapter = get_io_adapter(kvm, id);
+
+        if (!adapter || !adapter->maskable)
+                return -EINVAL;
+        ret = adapter->masked;
+        adapter->masked = masked;
+        return ret;
+}
+
+static int kvm_s390_adapter_map(struct kvm *kvm, unsigned int id, __u64 addr)
+{
+        struct s390_io_adapter *adapter = get_io_adapter(kvm, id);
+        struct s390_map_info *map;
+        int ret;
+
+        if (!adapter || !addr)
+                return -EINVAL;
+
+        map = kzalloc(sizeof(*map), GFP_KERNEL);
+        if (!map) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        INIT_LIST_HEAD(&map->list);
+        map->guest_addr = addr;
+        map->addr = gmap_translate(addr, kvm->arch.gmap);
+        if (map->addr == -EFAULT) {
+                ret = -EFAULT;
+                goto out;
+        }
+        ret = get_user_pages_fast(map->addr, 1, 1, &map->page);
+        if (ret < 0)
+                goto out;
+        BUG_ON(ret != 1);
+        down_write(&adapter->maps_lock);
+        if (atomic_inc_return(&adapter->nr_maps) < MAX_S390_ADAPTER_MAPS) {
+                list_add_tail(&map->list, &adapter->maps);
+                ret = 0;
+        } else {
+                put_page(map->page);
+                ret = -EINVAL;
+        }
+        up_write(&adapter->maps_lock);
+out:
+        if (ret)
+                kfree(map);
+        return ret;
+}
+
+static int kvm_s390_adapter_unmap(struct kvm *kvm, unsigned int id, __u64 addr)
+{
+        struct s390_io_adapter *adapter = get_io_adapter(kvm, id);
+        struct s390_map_info *map, *tmp;
+        int found = 0;
+
+        if (!adapter || !addr)
+                return -EINVAL;
+
+        down_write(&adapter->maps_lock);
+        list_for_each_entry_safe(map, tmp, &adapter->maps, list) {
+                if (map->guest_addr == addr) {
+                        found = 1;
+                        atomic_dec(&adapter->nr_maps);
+                        list_del(&map->list);
+                        put_page(map->page);
+                        kfree(map);
+                        break;
+                }
+        }
+        up_write(&adapter->maps_lock);
+
+        return found ? 0 : -EINVAL;
+}
+
+void kvm_s390_destroy_adapters(struct kvm *kvm)
+{
+        int i;
+        struct s390_map_info *map, *tmp;
+
+        for (i = 0; i < MAX_S390_IO_ADAPTERS; i++) {
+                if (!kvm->arch.adapters[i])
+                        continue;
+                list_for_each_entry_safe(map, tmp,
+                                         &kvm->arch.adapters[i]->maps, list) {
+                        list_del(&map->list);
+                        put_page(map->page);
+                        kfree(map);
+                }
+                kfree(kvm->arch.adapters[i]);
+        }
+}
+
+static int modify_io_adapter(struct kvm_device *dev,
+                             struct kvm_device_attr *attr)
+{
+        struct kvm_s390_io_adapter_req req;
+        struct s390_io_adapter *adapter;
+        int ret;
+
+        if (copy_from_user(&req, (void __user *)attr->addr, sizeof(req)))
+                return -EFAULT;
+
+        adapter = get_io_adapter(dev->kvm, req.id);
+        if (!adapter)
+                return -EINVAL;
+        switch (req.type) {
+        case KVM_S390_IO_ADAPTER_MASK:
+                ret = kvm_s390_mask_adapter(dev->kvm, req.id, req.mask);
+                if (ret > 0)
+                        ret = 0;
+                break;
+        case KVM_S390_IO_ADAPTER_MAP:
+                ret = kvm_s390_adapter_map(dev->kvm, req.id, req.addr);
+                break;
+        case KVM_S390_IO_ADAPTER_UNMAP:
+                ret = kvm_s390_adapter_unmap(dev->kvm, req.id, req.addr);
+                break;
+        default:
+                ret = -EINVAL;
+        }
+
+        return ret;
+}
+
+static int flic_set_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
+{
+        int r = 0;
+        unsigned int i;
+        struct kvm_vcpu *vcpu;
+
+        switch (attr->group) {
+        case KVM_DEV_FLIC_ENQUEUE:
+                r = enqueue_floating_irq(dev, attr);
+                break;
+        case KVM_DEV_FLIC_CLEAR_IRQS:
+                r = 0;
+                clear_floating_interrupts(dev->kvm);
+                break;
+        case KVM_DEV_FLIC_APF_ENABLE:
+                dev->kvm->arch.gmap->pfault_enabled = 1;
+                break;
+        case KVM_DEV_FLIC_APF_DISABLE_WAIT:
+                dev->kvm->arch.gmap->pfault_enabled = 0;
+                /*
+                 * Make sure no async faults are in transition when
+                 * clearing the queues. So we don't need to worry
+                 * about late coming workers.
+                 */
+                synchronize_srcu(&dev->kvm->srcu);
+                kvm_for_each_vcpu(i, vcpu, dev->kvm)
+                        kvm_clear_async_pf_completion_queue(vcpu);
+                break;
+        case KVM_DEV_FLIC_ADAPTER_REGISTER:
+                r = register_io_adapter(dev, attr);
+                break;
+        case KVM_DEV_FLIC_ADAPTER_MODIFY:
+                r = modify_io_adapter(dev, attr);
+                break;
+        default:
+                r = -EINVAL;
+        }
+
+        return r;
+}
+
+static int flic_create(struct kvm_device *dev, u32 type)
+{
+        if (!dev)
+                return -EINVAL;
+        if (dev->kvm->arch.flic)
+                return -EINVAL;
+        dev->kvm->arch.flic = dev;
+        return 0;
+}
+
+static void flic_destroy(struct kvm_device *dev)
+{
+        dev->kvm->arch.flic = NULL;
+        kfree(dev);
+}
+
+/* s390 floating irq controller (flic) */
+struct kvm_device_ops kvm_flic_ops = {
+        .name = "kvm-flic",
+        .get_attr = flic_get_attr,
+        .set_attr = flic_set_attr,
+        .create = flic_create,
+        .destroy = flic_destroy,
+};
+
+static unsigned long get_ind_bit(__u64 addr, unsigned long bit_nr, bool swap)
+{
+        unsigned long bit;
+
+        bit = bit_nr + (addr % PAGE_SIZE) * 8;
+
+        return swap ? (bit ^ (BITS_PER_LONG - 1)) : bit;
+}
+
+static struct s390_map_info *get_map_info(struct s390_io_adapter *adapter,
+                                          u64 addr)
+{
+        struct s390_map_info *map;
+
+        if (!adapter)
+                return NULL;
+
+        list_for_each_entry(map, &adapter->maps, list) {
+                if (map->guest_addr == addr)
+                        return map;
+        }
+        return NULL;
+}
+
+static int adapter_indicators_set(struct kvm *kvm,
+                                  struct s390_io_adapter *adapter,
+                                  struct kvm_s390_adapter_int *adapter_int)
+{
+        unsigned long bit;
+        int summary_set, idx;
+        struct s390_map_info *info;
+        void *map;
+
+        info = get_map_info(adapter, adapter_int->ind_addr);
+        if (!info)
+                return -1;
+        map = page_address(info->page);
+        bit = get_ind_bit(info->addr, adapter_int->ind_offset, adapter->swap);
+        set_bit(bit, map);
+        idx = srcu_read_lock(&kvm->srcu);
+        mark_page_dirty(kvm, info->guest_addr >> PAGE_SHIFT);
+        set_page_dirty_lock(info->page);
+        info = get_map_info(adapter, adapter_int->summary_addr);
+        if (!info) {
+                srcu_read_unlock(&kvm->srcu, idx);
+                return -1;
+        }
+        map = page_address(info->page);
+        bit = get_ind_bit(info->addr, adapter_int->summary_offset,
+                          adapter->swap);
+        summary_set = test_and_set_bit(bit, map);
+        mark_page_dirty(kvm, info->guest_addr >> PAGE_SHIFT);
+        set_page_dirty_lock(info->page);
+        srcu_read_unlock(&kvm->srcu, idx);
+        return summary_set ? 0 : 1;
+}
+
+/*
+ * < 0 - not injected due to error
+ * = 0 - coalesced, summary indicator already active
+ * > 0 - injected interrupt
+ */
+static int set_adapter_int(struct kvm_kernel_irq_routing_entry *e,
+                           struct kvm *kvm, int irq_source_id, int level,
+                           bool line_status)
+{
+        int ret;
+        struct s390_io_adapter *adapter;
+
+        /* We're only interested in the 0->1 transition. */
+        if (!level)
+                return 0;
+        adapter = get_io_adapter(kvm, e->adapter.adapter_id);
+        if (!adapter)
+                return -1;
+        down_read(&adapter->maps_lock);
+        ret = adapter_indicators_set(kvm, adapter, &e->adapter);
+        up_read(&adapter->maps_lock);
+        if ((ret > 0) && !adapter->masked) {
+                struct kvm_s390_interrupt s390int = {
+                        .type = KVM_S390_INT_IO(1, 0, 0, 0),
+                        .parm = 0,
+                        .parm64 = (adapter->isc << 27) | 0x80000000,
+                };
+                ret = kvm_s390_inject_vm(kvm, &s390int);
+                if (ret == 0)
+                        ret = 1;
+        }
+        return ret;
+}
+
+int kvm_set_routing_entry(struct kvm_irq_routing_table *rt,
+                          struct kvm_kernel_irq_routing_entry *e,
+                          const struct kvm_irq_routing_entry *ue)
+{
+        int ret;
+
+        switch (ue->type) {
+        case KVM_IRQ_ROUTING_S390_ADAPTER:
+                e->set = set_adapter_int;
+                e->adapter.summary_addr = ue->u.adapter.summary_addr;
+                e->adapter.ind_addr = ue->u.adapter.ind_addr;
+                e->adapter.summary_offset = ue->u.adapter.summary_offset;
+                e->adapter.ind_offset = ue->u.adapter.ind_offset;
+                e->adapter.adapter_id = ue->u.adapter.adapter_id;
+                ret = 0;
+                break;
+        default:
+                ret = -EINVAL;
+        }
+
+        return ret;
+}
+
+int kvm_set_msi(struct kvm_kernel_irq_routing_entry *e, struct kvm *kvm,
+                int irq_source_id, int level, bool line_status)
+{
+        return -EINVAL;
+}