xref: /qemu/hw/s390x/css.c (revision 01b2ffce)
1 /*
2  * Channel subsystem base support.
3  *
4  * Copyright 2012 IBM Corp.
5  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or (at
8  * your option) any later version. See the COPYING file in the top-level
9  * directory.
10  */
11 
12 #include "qemu/osdep.h"
13 #include "qapi/error.h"
14 #include "qapi/visitor.h"
15 #include "hw/qdev.h"
16 #include "qemu/error-report.h"
17 #include "qemu/bitops.h"
18 #include "qemu/error-report.h"
19 #include "exec/address-spaces.h"
20 #include "cpu.h"
21 #include "hw/s390x/ioinst.h"
22 #include "hw/s390x/css.h"
23 #include "trace.h"
24 #include "hw/s390x/s390_flic.h"
25 
26 typedef struct CrwContainer {
27     CRW crw;
28     QTAILQ_ENTRY(CrwContainer) sibling;
29 } CrwContainer;
30 
31 typedef struct ChpInfo {
32     uint8_t in_use;
33     uint8_t type;
34     uint8_t is_virtual;
35 } ChpInfo;
36 
37 typedef struct SubchSet {
38     SubchDev *sch[MAX_SCHID + 1];
39     unsigned long schids_used[BITS_TO_LONGS(MAX_SCHID + 1)];
40     unsigned long devnos_used[BITS_TO_LONGS(MAX_SCHID + 1)];
41 } SubchSet;
42 
43 typedef struct CssImage {
44     SubchSet *sch_set[MAX_SSID + 1];
45     ChpInfo chpids[MAX_CHPID + 1];
46 } CssImage;
47 
48 typedef struct IoAdapter {
49     uint32_t id;
50     uint8_t type;
51     uint8_t isc;
52 } IoAdapter;
53 
54 typedef struct ChannelSubSys {
55     QTAILQ_HEAD(, CrwContainer) pending_crws;
56     bool sei_pending;
57     bool do_crw_mchk;
58     bool crws_lost;
59     uint8_t max_cssid;
60     uint8_t max_ssid;
61     bool chnmon_active;
62     uint64_t chnmon_area;
63     CssImage *css[MAX_CSSID + 1];
64     uint8_t default_cssid;
65     IoAdapter *io_adapters[CSS_IO_ADAPTER_TYPE_NUMS][MAX_ISC + 1];
66     QTAILQ_HEAD(, IndAddr) indicator_addresses;
67 } ChannelSubSys;
68 
69 static ChannelSubSys channel_subsys = {
70     .pending_crws = QTAILQ_HEAD_INITIALIZER(channel_subsys.pending_crws),
71     .do_crw_mchk = true,
72     .sei_pending = false,
73     .do_crw_mchk = true,
74     .crws_lost = false,
75     .chnmon_active = false,
76     .indicator_addresses =
77         QTAILQ_HEAD_INITIALIZER(channel_subsys.indicator_addresses),
78 };
79 
80 IndAddr *get_indicator(hwaddr ind_addr, int len)
81 {
82     IndAddr *indicator;
83 
84     QTAILQ_FOREACH(indicator, &channel_subsys.indicator_addresses, sibling) {
85         if (indicator->addr == ind_addr) {
86             indicator->refcnt++;
87             return indicator;
88         }
89     }
90     indicator = g_new0(IndAddr, 1);
91     indicator->addr = ind_addr;
92     indicator->len = len;
93     indicator->refcnt = 1;
94     QTAILQ_INSERT_TAIL(&channel_subsys.indicator_addresses,
95                        indicator, sibling);
96     return indicator;
97 }
98 
99 static int s390_io_adapter_map(AdapterInfo *adapter, uint64_t map_addr,
100                                bool do_map)
101 {
102     S390FLICState *fs = s390_get_flic();
103     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
104 
105     return fsc->io_adapter_map(fs, adapter->adapter_id, map_addr, do_map);
106 }
107 
108 void release_indicator(AdapterInfo *adapter, IndAddr *indicator)
109 {
110     assert(indicator->refcnt > 0);
111     indicator->refcnt--;
112     if (indicator->refcnt > 0) {
113         return;
114     }
115     QTAILQ_REMOVE(&channel_subsys.indicator_addresses, indicator, sibling);
116     if (indicator->map) {
117         s390_io_adapter_map(adapter, indicator->map, false);
118     }
119     g_free(indicator);
120 }
121 
122 int map_indicator(AdapterInfo *adapter, IndAddr *indicator)
123 {
124     int ret;
125 
126     if (indicator->map) {
127         return 0; /* already mapped is not an error */
128     }
129     indicator->map = indicator->addr;
130     ret = s390_io_adapter_map(adapter, indicator->map, true);
131     if ((ret != 0) && (ret != -ENOSYS)) {
132         goto out_err;
133     }
134     return 0;
135 
136 out_err:
137     indicator->map = 0;
138     return ret;
139 }
140 
141 int css_create_css_image(uint8_t cssid, bool default_image)
142 {
143     trace_css_new_image(cssid, default_image ? "(default)" : "");
144     /* 255 is reserved */
145     if (cssid == 255) {
146         return -EINVAL;
147     }
148     if (channel_subsys.css[cssid]) {
149         return -EBUSY;
150     }
151     channel_subsys.css[cssid] = g_malloc0(sizeof(CssImage));
152     if (default_image) {
153         channel_subsys.default_cssid = cssid;
154     }
155     return 0;
156 }
157 
158 uint32_t css_get_adapter_id(CssIoAdapterType type, uint8_t isc)
159 {
160     if (type >= CSS_IO_ADAPTER_TYPE_NUMS || isc > MAX_ISC ||
161         !channel_subsys.io_adapters[type][isc]) {
162         return -1;
163     }
164 
165     return channel_subsys.io_adapters[type][isc]->id;
166 }
167 
168 /**
169  * css_register_io_adapters: Register I/O adapters per ISC during init
170  *
171  * @swap: an indication if byte swap is needed.
172  * @maskable: an indication if the adapter is subject to the mask operation.
173  * @errp: location to store error information.
174  */
175 void css_register_io_adapters(CssIoAdapterType type, bool swap, bool maskable,
176                               Error **errp)
177 {
178     uint32_t id;
179     int ret, isc;
180     IoAdapter *adapter;
181     S390FLICState *fs = s390_get_flic();
182     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
183 
184     /*
185      * Disallow multiple registrations for the same device type.
186      * Report an error if registering for an already registered type.
187      */
188     if (channel_subsys.io_adapters[type][0]) {
189         error_setg(errp, "Adapters for type %d already registered", type);
190     }
191 
192     for (isc = 0; isc <= MAX_ISC; isc++) {
193         id = (type << 3) | isc;
194         ret = fsc->register_io_adapter(fs, id, isc, swap, maskable);
195         if (ret == 0) {
196             adapter = g_new0(IoAdapter, 1);
197             adapter->id = id;
198             adapter->isc = isc;
199             adapter->type = type;
200             channel_subsys.io_adapters[type][isc] = adapter;
201         } else {
202             error_setg_errno(errp, -ret, "Unexpected error %d when "
203                              "registering adapter %d", ret, id);
204             break;
205         }
206     }
207 
208     /*
209      * No need to free registered adapters in kvm: kvm will clean up
210      * when the machine goes away.
211      */
212     if (ret) {
213         for (isc--; isc >= 0; isc--) {
214             g_free(channel_subsys.io_adapters[type][isc]);
215             channel_subsys.io_adapters[type][isc] = NULL;
216         }
217     }
218 
219 }
220 
221 static void css_clear_io_interrupt(uint16_t subchannel_id,
222                                    uint16_t subchannel_nr)
223 {
224     Error *err = NULL;
225     static bool no_clear_irq;
226     S390FLICState *fs = s390_get_flic();
227     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
228     int r;
229 
230     if (unlikely(no_clear_irq)) {
231         return;
232     }
233     r = fsc->clear_io_irq(fs, subchannel_id, subchannel_nr);
234     switch (r) {
235     case 0:
236         break;
237     case -ENOSYS:
238         no_clear_irq = true;
239         /*
240         * Ignore unavailability, as the user can't do anything
241         * about it anyway.
242         */
243         break;
244     default:
245         error_setg_errno(&err, -r, "unexpected error condition");
246         error_propagate(&error_abort, err);
247     }
248 }
249 
250 static inline uint16_t css_do_build_subchannel_id(uint8_t cssid, uint8_t ssid)
251 {
252     if (channel_subsys.max_cssid > 0) {
253         return (cssid << 8) | (1 << 3) | (ssid << 1) | 1;
254     }
255     return (ssid << 1) | 1;
256 }
257 
258 uint16_t css_build_subchannel_id(SubchDev *sch)
259 {
260     return css_do_build_subchannel_id(sch->cssid, sch->ssid);
261 }
262 
263 void css_inject_io_interrupt(SubchDev *sch)
264 {
265     uint8_t isc = (sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ISC) >> 11;
266 
267     trace_css_io_interrupt(sch->cssid, sch->ssid, sch->schid,
268                            sch->curr_status.pmcw.intparm, isc, "");
269     s390_io_interrupt(css_build_subchannel_id(sch),
270                       sch->schid,
271                       sch->curr_status.pmcw.intparm,
272                       isc << 27);
273 }
274 
275 void css_conditional_io_interrupt(SubchDev *sch)
276 {
277     /*
278      * If the subchannel is not currently status pending, make it pending
279      * with alert status.
280      */
281     if (!(sch->curr_status.scsw.ctrl & SCSW_STCTL_STATUS_PEND)) {
282         uint8_t isc = (sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ISC) >> 11;
283 
284         trace_css_io_interrupt(sch->cssid, sch->ssid, sch->schid,
285                                sch->curr_status.pmcw.intparm, isc,
286                                "(unsolicited)");
287         sch->curr_status.scsw.ctrl &= ~SCSW_CTRL_MASK_STCTL;
288         sch->curr_status.scsw.ctrl |=
289             SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
290         /* Inject an I/O interrupt. */
291         s390_io_interrupt(css_build_subchannel_id(sch),
292                           sch->schid,
293                           sch->curr_status.pmcw.intparm,
294                           isc << 27);
295     }
296 }
297 
298 void css_adapter_interrupt(uint8_t isc)
299 {
300     uint32_t io_int_word = (isc << 27) | IO_INT_WORD_AI;
301 
302     trace_css_adapter_interrupt(isc);
303     s390_io_interrupt(0, 0, 0, io_int_word);
304 }
305 
306 static void sch_handle_clear_func(SubchDev *sch)
307 {
308     PMCW *p = &sch->curr_status.pmcw;
309     SCSW *s = &sch->curr_status.scsw;
310     int path;
311 
312     /* Path management: In our simple css, we always choose the only path. */
313     path = 0x80;
314 
315     /* Reset values prior to 'issuing the clear signal'. */
316     p->lpum = 0;
317     p->pom = 0xff;
318     s->flags &= ~SCSW_FLAGS_MASK_PNO;
319 
320     /* We always 'attempt to issue the clear signal', and we always succeed. */
321     sch->channel_prog = 0x0;
322     sch->last_cmd_valid = false;
323     s->ctrl &= ~SCSW_ACTL_CLEAR_PEND;
324     s->ctrl |= SCSW_STCTL_STATUS_PEND;
325 
326     s->dstat = 0;
327     s->cstat = 0;
328     p->lpum = path;
329 
330 }
331 
332 static void sch_handle_halt_func(SubchDev *sch)
333 {
334 
335     PMCW *p = &sch->curr_status.pmcw;
336     SCSW *s = &sch->curr_status.scsw;
337     hwaddr curr_ccw = sch->channel_prog;
338     int path;
339 
340     /* Path management: In our simple css, we always choose the only path. */
341     path = 0x80;
342 
343     /* We always 'attempt to issue the halt signal', and we always succeed. */
344     sch->channel_prog = 0x0;
345     sch->last_cmd_valid = false;
346     s->ctrl &= ~SCSW_ACTL_HALT_PEND;
347     s->ctrl |= SCSW_STCTL_STATUS_PEND;
348 
349     if ((s->ctrl & (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) ||
350         !((s->ctrl & SCSW_ACTL_START_PEND) ||
351           (s->ctrl & SCSW_ACTL_SUSP))) {
352         s->dstat = SCSW_DSTAT_DEVICE_END;
353     }
354     if ((s->ctrl & (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) ||
355         (s->ctrl & SCSW_ACTL_SUSP)) {
356         s->cpa = curr_ccw + 8;
357     }
358     s->cstat = 0;
359     p->lpum = path;
360 
361 }
362 
363 static void copy_sense_id_to_guest(SenseId *dest, SenseId *src)
364 {
365     int i;
366 
367     dest->reserved = src->reserved;
368     dest->cu_type = cpu_to_be16(src->cu_type);
369     dest->cu_model = src->cu_model;
370     dest->dev_type = cpu_to_be16(src->dev_type);
371     dest->dev_model = src->dev_model;
372     dest->unused = src->unused;
373     for (i = 0; i < ARRAY_SIZE(dest->ciw); i++) {
374         dest->ciw[i].type = src->ciw[i].type;
375         dest->ciw[i].command = src->ciw[i].command;
376         dest->ciw[i].count = cpu_to_be16(src->ciw[i].count);
377     }
378 }
379 
380 static CCW1 copy_ccw_from_guest(hwaddr addr, bool fmt1)
381 {
382     CCW0 tmp0;
383     CCW1 tmp1;
384     CCW1 ret;
385 
386     if (fmt1) {
387         cpu_physical_memory_read(addr, &tmp1, sizeof(tmp1));
388         ret.cmd_code = tmp1.cmd_code;
389         ret.flags = tmp1.flags;
390         ret.count = be16_to_cpu(tmp1.count);
391         ret.cda = be32_to_cpu(tmp1.cda);
392     } else {
393         cpu_physical_memory_read(addr, &tmp0, sizeof(tmp0));
394         if ((tmp0.cmd_code & 0x0f) == CCW_CMD_TIC) {
395             ret.cmd_code = CCW_CMD_TIC;
396             ret.flags = 0;
397             ret.count = 0;
398         } else {
399             ret.cmd_code = tmp0.cmd_code;
400             ret.flags = tmp0.flags;
401             ret.count = be16_to_cpu(tmp0.count);
402         }
403         ret.cda = be16_to_cpu(tmp0.cda1) | (tmp0.cda0 << 16);
404     }
405     return ret;
406 }
407 
408 static int css_interpret_ccw(SubchDev *sch, hwaddr ccw_addr,
409                              bool suspend_allowed)
410 {
411     int ret;
412     bool check_len;
413     int len;
414     CCW1 ccw;
415 
416     if (!ccw_addr) {
417         return -EIO;
418     }
419 
420     /* Translate everything to format-1 ccws - the information is the same. */
421     ccw = copy_ccw_from_guest(ccw_addr, sch->ccw_fmt_1);
422 
423     /* Check for invalid command codes. */
424     if ((ccw.cmd_code & 0x0f) == 0) {
425         return -EINVAL;
426     }
427     if (((ccw.cmd_code & 0x0f) == CCW_CMD_TIC) &&
428         ((ccw.cmd_code & 0xf0) != 0)) {
429         return -EINVAL;
430     }
431     if (!sch->ccw_fmt_1 && (ccw.count == 0) &&
432         (ccw.cmd_code != CCW_CMD_TIC)) {
433         return -EINVAL;
434     }
435 
436     /* We don't support MIDA. */
437     if (ccw.flags & CCW_FLAG_MIDA) {
438         return -EINVAL;
439     }
440 
441     if (ccw.flags & CCW_FLAG_SUSPEND) {
442         return suspend_allowed ? -EINPROGRESS : -EINVAL;
443     }
444 
445     check_len = !((ccw.flags & CCW_FLAG_SLI) && !(ccw.flags & CCW_FLAG_DC));
446 
447     if (!ccw.cda) {
448         if (sch->ccw_no_data_cnt == 255) {
449             return -EINVAL;
450         }
451         sch->ccw_no_data_cnt++;
452     }
453 
454     /* Look at the command. */
455     switch (ccw.cmd_code) {
456     case CCW_CMD_NOOP:
457         /* Nothing to do. */
458         ret = 0;
459         break;
460     case CCW_CMD_BASIC_SENSE:
461         if (check_len) {
462             if (ccw.count != sizeof(sch->sense_data)) {
463                 ret = -EINVAL;
464                 break;
465             }
466         }
467         len = MIN(ccw.count, sizeof(sch->sense_data));
468         cpu_physical_memory_write(ccw.cda, sch->sense_data, len);
469         sch->curr_status.scsw.count = ccw.count - len;
470         memset(sch->sense_data, 0, sizeof(sch->sense_data));
471         ret = 0;
472         break;
473     case CCW_CMD_SENSE_ID:
474     {
475         SenseId sense_id;
476 
477         copy_sense_id_to_guest(&sense_id, &sch->id);
478         /* Sense ID information is device specific. */
479         if (check_len) {
480             if (ccw.count != sizeof(sense_id)) {
481                 ret = -EINVAL;
482                 break;
483             }
484         }
485         len = MIN(ccw.count, sizeof(sense_id));
486         /*
487          * Only indicate 0xff in the first sense byte if we actually
488          * have enough place to store at least bytes 0-3.
489          */
490         if (len >= 4) {
491             sense_id.reserved = 0xff;
492         } else {
493             sense_id.reserved = 0;
494         }
495         cpu_physical_memory_write(ccw.cda, &sense_id, len);
496         sch->curr_status.scsw.count = ccw.count - len;
497         ret = 0;
498         break;
499     }
500     case CCW_CMD_TIC:
501         if (sch->last_cmd_valid && (sch->last_cmd.cmd_code == CCW_CMD_TIC)) {
502             ret = -EINVAL;
503             break;
504         }
505         if (ccw.flags & (CCW_FLAG_CC | CCW_FLAG_DC)) {
506             ret = -EINVAL;
507             break;
508         }
509         sch->channel_prog = ccw.cda;
510         ret = -EAGAIN;
511         break;
512     default:
513         if (sch->ccw_cb) {
514             /* Handle device specific commands. */
515             ret = sch->ccw_cb(sch, ccw);
516         } else {
517             ret = -ENOSYS;
518         }
519         break;
520     }
521     sch->last_cmd = ccw;
522     sch->last_cmd_valid = true;
523     if (ret == 0) {
524         if (ccw.flags & CCW_FLAG_CC) {
525             sch->channel_prog += 8;
526             ret = -EAGAIN;
527         }
528     }
529 
530     return ret;
531 }
532 
533 static void sch_handle_start_func_virtual(SubchDev *sch, ORB *orb)
534 {
535 
536     PMCW *p = &sch->curr_status.pmcw;
537     SCSW *s = &sch->curr_status.scsw;
538     int path;
539     int ret;
540     bool suspend_allowed;
541 
542     /* Path management: In our simple css, we always choose the only path. */
543     path = 0x80;
544 
545     if (!(s->ctrl & SCSW_ACTL_SUSP)) {
546         /* Start Function triggered via ssch, i.e. we have an ORB */
547         s->cstat = 0;
548         s->dstat = 0;
549         /* Look at the orb and try to execute the channel program. */
550         assert(orb != NULL); /* resume does not pass an orb */
551         p->intparm = orb->intparm;
552         if (!(orb->lpm & path)) {
553             /* Generate a deferred cc 3 condition. */
554             s->flags |= SCSW_FLAGS_MASK_CC;
555             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
556             s->ctrl |= (SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND);
557             return;
558         }
559         sch->ccw_fmt_1 = !!(orb->ctrl0 & ORB_CTRL0_MASK_FMT);
560         s->flags |= (sch->ccw_fmt_1) ? SCSW_FLAGS_MASK_FMT : 0;
561         sch->ccw_no_data_cnt = 0;
562         suspend_allowed = !!(orb->ctrl0 & ORB_CTRL0_MASK_SPND);
563     } else {
564         /* Start Function resumed via rsch, i.e. we don't have an
565          * ORB */
566         s->ctrl &= ~(SCSW_ACTL_SUSP | SCSW_ACTL_RESUME_PEND);
567         /* The channel program had been suspended before. */
568         suspend_allowed = true;
569     }
570     sch->last_cmd_valid = false;
571     do {
572         ret = css_interpret_ccw(sch, sch->channel_prog, suspend_allowed);
573         switch (ret) {
574         case -EAGAIN:
575             /* ccw chain, continue processing */
576             break;
577         case 0:
578             /* success */
579             s->ctrl &= ~SCSW_ACTL_START_PEND;
580             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
581             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
582                     SCSW_STCTL_STATUS_PEND;
583             s->dstat = SCSW_DSTAT_CHANNEL_END | SCSW_DSTAT_DEVICE_END;
584             s->cpa = sch->channel_prog + 8;
585             break;
586         case -EIO:
587             /* I/O errors, status depends on specific devices */
588             break;
589         case -ENOSYS:
590             /* unsupported command, generate unit check (command reject) */
591             s->ctrl &= ~SCSW_ACTL_START_PEND;
592             s->dstat = SCSW_DSTAT_UNIT_CHECK;
593             /* Set sense bit 0 in ecw0. */
594             sch->sense_data[0] = 0x80;
595             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
596             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
597                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
598             s->cpa = sch->channel_prog + 8;
599             break;
600         case -EFAULT:
601             /* memory problem, generate channel data check */
602             s->ctrl &= ~SCSW_ACTL_START_PEND;
603             s->cstat = SCSW_CSTAT_DATA_CHECK;
604             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
605             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
606                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
607             s->cpa = sch->channel_prog + 8;
608             break;
609         case -EBUSY:
610             /* subchannel busy, generate deferred cc 1 */
611             s->flags &= ~SCSW_FLAGS_MASK_CC;
612             s->flags |= (1 << 8);
613             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
614             s->ctrl |= SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
615             break;
616         case -EINPROGRESS:
617             /* channel program has been suspended */
618             s->ctrl &= ~SCSW_ACTL_START_PEND;
619             s->ctrl |= SCSW_ACTL_SUSP;
620             break;
621         default:
622             /* error, generate channel program check */
623             s->ctrl &= ~SCSW_ACTL_START_PEND;
624             s->cstat = SCSW_CSTAT_PROG_CHECK;
625             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
626             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
627                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
628             s->cpa = sch->channel_prog + 8;
629             break;
630         }
631     } while (ret == -EAGAIN);
632 
633 }
634 
635 static int sch_handle_start_func_passthrough(SubchDev *sch, ORB *orb)
636 {
637 
638     PMCW *p = &sch->curr_status.pmcw;
639     SCSW *s = &sch->curr_status.scsw;
640     int ret;
641 
642     if (!(s->ctrl & SCSW_ACTL_SUSP)) {
643         assert(orb != NULL);
644         p->intparm = orb->intparm;
645     }
646 
647     /*
648      * Only support prefetch enable mode.
649      * Only support 64bit addressing idal.
650      */
651     if (!(orb->ctrl0 & ORB_CTRL0_MASK_PFCH) ||
652         !(orb->ctrl0 & ORB_CTRL0_MASK_C64)) {
653         return -EINVAL;
654     }
655 
656     ret = s390_ccw_cmd_request(orb, s, sch->driver_data);
657     switch (ret) {
658     /* Currently we don't update control block and just return the cc code. */
659     case 0:
660         break;
661     case -EBUSY:
662         break;
663     case -ENODEV:
664         break;
665     case -EACCES:
666         /* Let's reflect an inaccessible host device by cc 3. */
667         ret = -ENODEV;
668         break;
669     default:
670        /*
671         * All other return codes will trigger a program check,
672         * or set cc to 1.
673         */
674        break;
675     };
676 
677     return ret;
678 }
679 
680 /*
681  * On real machines, this would run asynchronously to the main vcpus.
682  * We might want to make some parts of the ssch handling (interpreting
683  * read/writes) asynchronous later on if we start supporting more than
684  * our current very simple devices.
685  */
686 int do_subchannel_work_virtual(SubchDev *sch, ORB *orb)
687 {
688 
689     SCSW *s = &sch->curr_status.scsw;
690 
691     if (s->ctrl & SCSW_FCTL_CLEAR_FUNC) {
692         sch_handle_clear_func(sch);
693     } else if (s->ctrl & SCSW_FCTL_HALT_FUNC) {
694         sch_handle_halt_func(sch);
695     } else if (s->ctrl & SCSW_FCTL_START_FUNC) {
696         /* Triggered by both ssch and rsch. */
697         sch_handle_start_func_virtual(sch, orb);
698     } else {
699         /* Cannot happen. */
700         return 0;
701     }
702     css_inject_io_interrupt(sch);
703     return 0;
704 }
705 
706 int do_subchannel_work_passthrough(SubchDev *sch, ORB *orb)
707 {
708     int ret;
709     SCSW *s = &sch->curr_status.scsw;
710 
711     if (s->ctrl & SCSW_FCTL_CLEAR_FUNC) {
712         /* TODO: Clear handling */
713         sch_handle_clear_func(sch);
714         ret = 0;
715     } else if (s->ctrl & SCSW_FCTL_HALT_FUNC) {
716         /* TODO: Halt handling */
717         sch_handle_halt_func(sch);
718         ret = 0;
719     } else if (s->ctrl & SCSW_FCTL_START_FUNC) {
720         ret = sch_handle_start_func_passthrough(sch, orb);
721     } else {
722         /* Cannot happen. */
723         return -ENODEV;
724     }
725 
726     return ret;
727 }
728 
729 static int do_subchannel_work(SubchDev *sch, ORB *orb)
730 {
731     if (sch->do_subchannel_work) {
732         return sch->do_subchannel_work(sch, orb);
733     } else {
734         return -EINVAL;
735     }
736 }
737 
738 static void copy_pmcw_to_guest(PMCW *dest, const PMCW *src)
739 {
740     int i;
741 
742     dest->intparm = cpu_to_be32(src->intparm);
743     dest->flags = cpu_to_be16(src->flags);
744     dest->devno = cpu_to_be16(src->devno);
745     dest->lpm = src->lpm;
746     dest->pnom = src->pnom;
747     dest->lpum = src->lpum;
748     dest->pim = src->pim;
749     dest->mbi = cpu_to_be16(src->mbi);
750     dest->pom = src->pom;
751     dest->pam = src->pam;
752     for (i = 0; i < ARRAY_SIZE(dest->chpid); i++) {
753         dest->chpid[i] = src->chpid[i];
754     }
755     dest->chars = cpu_to_be32(src->chars);
756 }
757 
758 void copy_scsw_to_guest(SCSW *dest, const SCSW *src)
759 {
760     dest->flags = cpu_to_be16(src->flags);
761     dest->ctrl = cpu_to_be16(src->ctrl);
762     dest->cpa = cpu_to_be32(src->cpa);
763     dest->dstat = src->dstat;
764     dest->cstat = src->cstat;
765     dest->count = cpu_to_be16(src->count);
766 }
767 
768 static void copy_schib_to_guest(SCHIB *dest, const SCHIB *src)
769 {
770     int i;
771 
772     copy_pmcw_to_guest(&dest->pmcw, &src->pmcw);
773     copy_scsw_to_guest(&dest->scsw, &src->scsw);
774     dest->mba = cpu_to_be64(src->mba);
775     for (i = 0; i < ARRAY_SIZE(dest->mda); i++) {
776         dest->mda[i] = src->mda[i];
777     }
778 }
779 
780 int css_do_stsch(SubchDev *sch, SCHIB *schib)
781 {
782     /* Use current status. */
783     copy_schib_to_guest(schib, &sch->curr_status);
784     return 0;
785 }
786 
787 static void copy_pmcw_from_guest(PMCW *dest, const PMCW *src)
788 {
789     int i;
790 
791     dest->intparm = be32_to_cpu(src->intparm);
792     dest->flags = be16_to_cpu(src->flags);
793     dest->devno = be16_to_cpu(src->devno);
794     dest->lpm = src->lpm;
795     dest->pnom = src->pnom;
796     dest->lpum = src->lpum;
797     dest->pim = src->pim;
798     dest->mbi = be16_to_cpu(src->mbi);
799     dest->pom = src->pom;
800     dest->pam = src->pam;
801     for (i = 0; i < ARRAY_SIZE(dest->chpid); i++) {
802         dest->chpid[i] = src->chpid[i];
803     }
804     dest->chars = be32_to_cpu(src->chars);
805 }
806 
807 static void copy_scsw_from_guest(SCSW *dest, const SCSW *src)
808 {
809     dest->flags = be16_to_cpu(src->flags);
810     dest->ctrl = be16_to_cpu(src->ctrl);
811     dest->cpa = be32_to_cpu(src->cpa);
812     dest->dstat = src->dstat;
813     dest->cstat = src->cstat;
814     dest->count = be16_to_cpu(src->count);
815 }
816 
817 static void copy_schib_from_guest(SCHIB *dest, const SCHIB *src)
818 {
819     int i;
820 
821     copy_pmcw_from_guest(&dest->pmcw, &src->pmcw);
822     copy_scsw_from_guest(&dest->scsw, &src->scsw);
823     dest->mba = be64_to_cpu(src->mba);
824     for (i = 0; i < ARRAY_SIZE(dest->mda); i++) {
825         dest->mda[i] = src->mda[i];
826     }
827 }
828 
829 int css_do_msch(SubchDev *sch, const SCHIB *orig_schib)
830 {
831     SCSW *s = &sch->curr_status.scsw;
832     PMCW *p = &sch->curr_status.pmcw;
833     uint16_t oldflags;
834     int ret;
835     SCHIB schib;
836 
837     if (!(sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_DNV)) {
838         ret = 0;
839         goto out;
840     }
841 
842     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
843         ret = -EINPROGRESS;
844         goto out;
845     }
846 
847     if (s->ctrl &
848         (SCSW_FCTL_START_FUNC|SCSW_FCTL_HALT_FUNC|SCSW_FCTL_CLEAR_FUNC)) {
849         ret = -EBUSY;
850         goto out;
851     }
852 
853     copy_schib_from_guest(&schib, orig_schib);
854     /* Only update the program-modifiable fields. */
855     p->intparm = schib.pmcw.intparm;
856     oldflags = p->flags;
857     p->flags &= ~(PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
858                   PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
859                   PMCW_FLAGS_MASK_MP);
860     p->flags |= schib.pmcw.flags &
861             (PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
862              PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
863              PMCW_FLAGS_MASK_MP);
864     p->lpm = schib.pmcw.lpm;
865     p->mbi = schib.pmcw.mbi;
866     p->pom = schib.pmcw.pom;
867     p->chars &= ~(PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_CSENSE);
868     p->chars |= schib.pmcw.chars &
869             (PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_CSENSE);
870     sch->curr_status.mba = schib.mba;
871 
872     /* Has the channel been disabled? */
873     if (sch->disable_cb && (oldflags & PMCW_FLAGS_MASK_ENA) != 0
874         && (p->flags & PMCW_FLAGS_MASK_ENA) == 0) {
875         sch->disable_cb(sch);
876     }
877 
878     ret = 0;
879 
880 out:
881     return ret;
882 }
883 
884 int css_do_xsch(SubchDev *sch)
885 {
886     SCSW *s = &sch->curr_status.scsw;
887     PMCW *p = &sch->curr_status.pmcw;
888     int ret;
889 
890     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
891         ret = -ENODEV;
892         goto out;
893     }
894 
895     if (!(s->ctrl & SCSW_CTRL_MASK_FCTL) ||
896         ((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||
897         (!(s->ctrl &
898            (SCSW_ACTL_RESUME_PEND | SCSW_ACTL_START_PEND | SCSW_ACTL_SUSP))) ||
899         (s->ctrl & SCSW_ACTL_SUBCH_ACTIVE)) {
900         ret = -EINPROGRESS;
901         goto out;
902     }
903 
904     if (s->ctrl & SCSW_CTRL_MASK_STCTL) {
905         ret = -EBUSY;
906         goto out;
907     }
908 
909     /* Cancel the current operation. */
910     s->ctrl &= ~(SCSW_FCTL_START_FUNC |
911                  SCSW_ACTL_RESUME_PEND |
912                  SCSW_ACTL_START_PEND |
913                  SCSW_ACTL_SUSP);
914     sch->channel_prog = 0x0;
915     sch->last_cmd_valid = false;
916     s->dstat = 0;
917     s->cstat = 0;
918     ret = 0;
919 
920 out:
921     return ret;
922 }
923 
924 int css_do_csch(SubchDev *sch)
925 {
926     SCSW *s = &sch->curr_status.scsw;
927     PMCW *p = &sch->curr_status.pmcw;
928     int ret;
929 
930     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
931         ret = -ENODEV;
932         goto out;
933     }
934 
935     /* Trigger the clear function. */
936     s->ctrl &= ~(SCSW_CTRL_MASK_FCTL | SCSW_CTRL_MASK_ACTL);
937     s->ctrl |= SCSW_FCTL_CLEAR_FUNC | SCSW_ACTL_CLEAR_PEND;
938 
939     do_subchannel_work(sch, NULL);
940     ret = 0;
941 
942 out:
943     return ret;
944 }
945 
946 int css_do_hsch(SubchDev *sch)
947 {
948     SCSW *s = &sch->curr_status.scsw;
949     PMCW *p = &sch->curr_status.pmcw;
950     int ret;
951 
952     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
953         ret = -ENODEV;
954         goto out;
955     }
956 
957     if (((s->ctrl & SCSW_CTRL_MASK_STCTL) == SCSW_STCTL_STATUS_PEND) ||
958         (s->ctrl & (SCSW_STCTL_PRIMARY |
959                     SCSW_STCTL_SECONDARY |
960                     SCSW_STCTL_ALERT))) {
961         ret = -EINPROGRESS;
962         goto out;
963     }
964 
965     if (s->ctrl & (SCSW_FCTL_HALT_FUNC | SCSW_FCTL_CLEAR_FUNC)) {
966         ret = -EBUSY;
967         goto out;
968     }
969 
970     /* Trigger the halt function. */
971     s->ctrl |= SCSW_FCTL_HALT_FUNC;
972     s->ctrl &= ~SCSW_FCTL_START_FUNC;
973     if (((s->ctrl & SCSW_CTRL_MASK_ACTL) ==
974          (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) &&
975         ((s->ctrl & SCSW_CTRL_MASK_STCTL) == SCSW_STCTL_INTERMEDIATE)) {
976         s->ctrl &= ~SCSW_STCTL_STATUS_PEND;
977     }
978     s->ctrl |= SCSW_ACTL_HALT_PEND;
979 
980     do_subchannel_work(sch, NULL);
981     ret = 0;
982 
983 out:
984     return ret;
985 }
986 
987 static void css_update_chnmon(SubchDev *sch)
988 {
989     if (!(sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_MME)) {
990         /* Not active. */
991         return;
992     }
993     /* The counter is conveniently located at the beginning of the struct. */
994     if (sch->curr_status.pmcw.chars & PMCW_CHARS_MASK_MBFC) {
995         /* Format 1, per-subchannel area. */
996         uint32_t count;
997 
998         count = address_space_ldl(&address_space_memory,
999                                   sch->curr_status.mba,
1000                                   MEMTXATTRS_UNSPECIFIED,
1001                                   NULL);
1002         count++;
1003         address_space_stl(&address_space_memory, sch->curr_status.mba, count,
1004                           MEMTXATTRS_UNSPECIFIED, NULL);
1005     } else {
1006         /* Format 0, global area. */
1007         uint32_t offset;
1008         uint16_t count;
1009 
1010         offset = sch->curr_status.pmcw.mbi << 5;
1011         count = address_space_lduw(&address_space_memory,
1012                                    channel_subsys.chnmon_area + offset,
1013                                    MEMTXATTRS_UNSPECIFIED,
1014                                    NULL);
1015         count++;
1016         address_space_stw(&address_space_memory,
1017                           channel_subsys.chnmon_area + offset, count,
1018                           MEMTXATTRS_UNSPECIFIED, NULL);
1019     }
1020 }
1021 
1022 int css_do_ssch(SubchDev *sch, ORB *orb)
1023 {
1024     SCSW *s = &sch->curr_status.scsw;
1025     PMCW *p = &sch->curr_status.pmcw;
1026     int ret;
1027 
1028     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
1029         ret = -ENODEV;
1030         goto out;
1031     }
1032 
1033     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
1034         ret = -EINPROGRESS;
1035         goto out;
1036     }
1037 
1038     if (s->ctrl & (SCSW_FCTL_START_FUNC |
1039                    SCSW_FCTL_HALT_FUNC |
1040                    SCSW_FCTL_CLEAR_FUNC)) {
1041         ret = -EBUSY;
1042         goto out;
1043     }
1044 
1045     /* If monitoring is active, update counter. */
1046     if (channel_subsys.chnmon_active) {
1047         css_update_chnmon(sch);
1048     }
1049     sch->channel_prog = orb->cpa;
1050     /* Trigger the start function. */
1051     s->ctrl |= (SCSW_FCTL_START_FUNC | SCSW_ACTL_START_PEND);
1052     s->flags &= ~SCSW_FLAGS_MASK_PNO;
1053 
1054     ret = do_subchannel_work(sch, orb);
1055 
1056 out:
1057     return ret;
1058 }
1059 
1060 static void copy_irb_to_guest(IRB *dest, const IRB *src, PMCW *pmcw,
1061                               int *irb_len)
1062 {
1063     int i;
1064     uint16_t stctl = src->scsw.ctrl & SCSW_CTRL_MASK_STCTL;
1065     uint16_t actl = src->scsw.ctrl & SCSW_CTRL_MASK_ACTL;
1066 
1067     copy_scsw_to_guest(&dest->scsw, &src->scsw);
1068 
1069     for (i = 0; i < ARRAY_SIZE(dest->esw); i++) {
1070         dest->esw[i] = cpu_to_be32(src->esw[i]);
1071     }
1072     for (i = 0; i < ARRAY_SIZE(dest->ecw); i++) {
1073         dest->ecw[i] = cpu_to_be32(src->ecw[i]);
1074     }
1075     *irb_len = sizeof(*dest) - sizeof(dest->emw);
1076 
1077     /* extended measurements enabled? */
1078     if ((src->scsw.flags & SCSW_FLAGS_MASK_ESWF) ||
1079         !(pmcw->flags & PMCW_FLAGS_MASK_TF) ||
1080         !(pmcw->chars & PMCW_CHARS_MASK_XMWME)) {
1081         return;
1082     }
1083     /* extended measurements pending? */
1084     if (!(stctl & SCSW_STCTL_STATUS_PEND)) {
1085         return;
1086     }
1087     if ((stctl & SCSW_STCTL_PRIMARY) ||
1088         (stctl == SCSW_STCTL_SECONDARY) ||
1089         ((stctl & SCSW_STCTL_INTERMEDIATE) && (actl & SCSW_ACTL_SUSP))) {
1090         for (i = 0; i < ARRAY_SIZE(dest->emw); i++) {
1091             dest->emw[i] = cpu_to_be32(src->emw[i]);
1092         }
1093     }
1094     *irb_len = sizeof(*dest);
1095 }
1096 
1097 int css_do_tsch_get_irb(SubchDev *sch, IRB *target_irb, int *irb_len)
1098 {
1099     SCSW *s = &sch->curr_status.scsw;
1100     PMCW *p = &sch->curr_status.pmcw;
1101     uint16_t stctl;
1102     IRB irb;
1103 
1104     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
1105         return 3;
1106     }
1107 
1108     stctl = s->ctrl & SCSW_CTRL_MASK_STCTL;
1109 
1110     /* Prepare the irb for the guest. */
1111     memset(&irb, 0, sizeof(IRB));
1112 
1113     /* Copy scsw from current status. */
1114     memcpy(&irb.scsw, s, sizeof(SCSW));
1115     if (stctl & SCSW_STCTL_STATUS_PEND) {
1116         if (s->cstat & (SCSW_CSTAT_DATA_CHECK |
1117                         SCSW_CSTAT_CHN_CTRL_CHK |
1118                         SCSW_CSTAT_INTF_CTRL_CHK)) {
1119             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF;
1120             irb.esw[0] = 0x04804000;
1121         } else {
1122             irb.esw[0] = 0x00800000;
1123         }
1124         /* If a unit check is pending, copy sense data. */
1125         if ((s->dstat & SCSW_DSTAT_UNIT_CHECK) &&
1126             (p->chars & PMCW_CHARS_MASK_CSENSE)) {
1127             int i;
1128 
1129             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF | SCSW_FLAGS_MASK_ECTL;
1130             /* Attention: sense_data is already BE! */
1131             memcpy(irb.ecw, sch->sense_data, sizeof(sch->sense_data));
1132             for (i = 0; i < ARRAY_SIZE(irb.ecw); i++) {
1133                 irb.ecw[i] = be32_to_cpu(irb.ecw[i]);
1134             }
1135             irb.esw[1] = 0x01000000 | (sizeof(sch->sense_data) << 8);
1136         }
1137     }
1138     /* Store the irb to the guest. */
1139     copy_irb_to_guest(target_irb, &irb, p, irb_len);
1140 
1141     return ((stctl & SCSW_STCTL_STATUS_PEND) == 0);
1142 }
1143 
1144 void css_do_tsch_update_subch(SubchDev *sch)
1145 {
1146     SCSW *s = &sch->curr_status.scsw;
1147     PMCW *p = &sch->curr_status.pmcw;
1148     uint16_t stctl;
1149     uint16_t fctl;
1150     uint16_t actl;
1151 
1152     stctl = s->ctrl & SCSW_CTRL_MASK_STCTL;
1153     fctl = s->ctrl & SCSW_CTRL_MASK_FCTL;
1154     actl = s->ctrl & SCSW_CTRL_MASK_ACTL;
1155 
1156     /* Clear conditions on subchannel, if applicable. */
1157     if (stctl & SCSW_STCTL_STATUS_PEND) {
1158         s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
1159         if ((stctl != (SCSW_STCTL_INTERMEDIATE | SCSW_STCTL_STATUS_PEND)) ||
1160             ((fctl & SCSW_FCTL_HALT_FUNC) &&
1161              (actl & SCSW_ACTL_SUSP))) {
1162             s->ctrl &= ~SCSW_CTRL_MASK_FCTL;
1163         }
1164         if (stctl != (SCSW_STCTL_INTERMEDIATE | SCSW_STCTL_STATUS_PEND)) {
1165             s->flags &= ~SCSW_FLAGS_MASK_PNO;
1166             s->ctrl &= ~(SCSW_ACTL_RESUME_PEND |
1167                          SCSW_ACTL_START_PEND |
1168                          SCSW_ACTL_HALT_PEND |
1169                          SCSW_ACTL_CLEAR_PEND |
1170                          SCSW_ACTL_SUSP);
1171         } else {
1172             if ((actl & SCSW_ACTL_SUSP) &&
1173                 (fctl & SCSW_FCTL_START_FUNC)) {
1174                 s->flags &= ~SCSW_FLAGS_MASK_PNO;
1175                 if (fctl & SCSW_FCTL_HALT_FUNC) {
1176                     s->ctrl &= ~(SCSW_ACTL_RESUME_PEND |
1177                                  SCSW_ACTL_START_PEND |
1178                                  SCSW_ACTL_HALT_PEND |
1179                                  SCSW_ACTL_CLEAR_PEND |
1180                                  SCSW_ACTL_SUSP);
1181                 } else {
1182                     s->ctrl &= ~SCSW_ACTL_RESUME_PEND;
1183                 }
1184             }
1185         }
1186         /* Clear pending sense data. */
1187         if (p->chars & PMCW_CHARS_MASK_CSENSE) {
1188             memset(sch->sense_data, 0 , sizeof(sch->sense_data));
1189         }
1190     }
1191 }
1192 
1193 static void copy_crw_to_guest(CRW *dest, const CRW *src)
1194 {
1195     dest->flags = cpu_to_be16(src->flags);
1196     dest->rsid = cpu_to_be16(src->rsid);
1197 }
1198 
1199 int css_do_stcrw(CRW *crw)
1200 {
1201     CrwContainer *crw_cont;
1202     int ret;
1203 
1204     crw_cont = QTAILQ_FIRST(&channel_subsys.pending_crws);
1205     if (crw_cont) {
1206         QTAILQ_REMOVE(&channel_subsys.pending_crws, crw_cont, sibling);
1207         copy_crw_to_guest(crw, &crw_cont->crw);
1208         g_free(crw_cont);
1209         ret = 0;
1210     } else {
1211         /* List was empty, turn crw machine checks on again. */
1212         memset(crw, 0, sizeof(*crw));
1213         channel_subsys.do_crw_mchk = true;
1214         ret = 1;
1215     }
1216 
1217     return ret;
1218 }
1219 
1220 static void copy_crw_from_guest(CRW *dest, const CRW *src)
1221 {
1222     dest->flags = be16_to_cpu(src->flags);
1223     dest->rsid = be16_to_cpu(src->rsid);
1224 }
1225 
1226 void css_undo_stcrw(CRW *crw)
1227 {
1228     CrwContainer *crw_cont;
1229 
1230     crw_cont = g_try_malloc0(sizeof(CrwContainer));
1231     if (!crw_cont) {
1232         channel_subsys.crws_lost = true;
1233         return;
1234     }
1235     copy_crw_from_guest(&crw_cont->crw, crw);
1236 
1237     QTAILQ_INSERT_HEAD(&channel_subsys.pending_crws, crw_cont, sibling);
1238 }
1239 
1240 int css_do_tpi(IOIntCode *int_code, int lowcore)
1241 {
1242     /* No pending interrupts for !KVM. */
1243     return 0;
1244  }
1245 
1246 int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid,
1247                          int rfmt, void *buf)
1248 {
1249     int i, desc_size;
1250     uint32_t words[8];
1251     uint32_t chpid_type_word;
1252     CssImage *css;
1253 
1254     if (!m && !cssid) {
1255         css = channel_subsys.css[channel_subsys.default_cssid];
1256     } else {
1257         css = channel_subsys.css[cssid];
1258     }
1259     if (!css) {
1260         return 0;
1261     }
1262     desc_size = 0;
1263     for (i = f_chpid; i <= l_chpid; i++) {
1264         if (css->chpids[i].in_use) {
1265             chpid_type_word = 0x80000000 | (css->chpids[i].type << 8) | i;
1266             if (rfmt == 0) {
1267                 words[0] = cpu_to_be32(chpid_type_word);
1268                 words[1] = 0;
1269                 memcpy(buf + desc_size, words, 8);
1270                 desc_size += 8;
1271             } else if (rfmt == 1) {
1272                 words[0] = cpu_to_be32(chpid_type_word);
1273                 words[1] = 0;
1274                 words[2] = 0;
1275                 words[3] = 0;
1276                 words[4] = 0;
1277                 words[5] = 0;
1278                 words[6] = 0;
1279                 words[7] = 0;
1280                 memcpy(buf + desc_size, words, 32);
1281                 desc_size += 32;
1282             }
1283         }
1284     }
1285     return desc_size;
1286 }
1287 
1288 void css_do_schm(uint8_t mbk, int update, int dct, uint64_t mbo)
1289 {
1290     /* dct is currently ignored (not really meaningful for our devices) */
1291     /* TODO: Don't ignore mbk. */
1292     if (update && !channel_subsys.chnmon_active) {
1293         /* Enable measuring. */
1294         channel_subsys.chnmon_area = mbo;
1295         channel_subsys.chnmon_active = true;
1296     }
1297     if (!update && channel_subsys.chnmon_active) {
1298         /* Disable measuring. */
1299         channel_subsys.chnmon_area = 0;
1300         channel_subsys.chnmon_active = false;
1301     }
1302 }
1303 
1304 int css_do_rsch(SubchDev *sch)
1305 {
1306     SCSW *s = &sch->curr_status.scsw;
1307     PMCW *p = &sch->curr_status.pmcw;
1308     int ret;
1309 
1310     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
1311         ret = -ENODEV;
1312         goto out;
1313     }
1314 
1315     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
1316         ret = -EINPROGRESS;
1317         goto out;
1318     }
1319 
1320     if (((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||
1321         (s->ctrl & SCSW_ACTL_RESUME_PEND) ||
1322         (!(s->ctrl & SCSW_ACTL_SUSP))) {
1323         ret = -EINVAL;
1324         goto out;
1325     }
1326 
1327     /* If monitoring is active, update counter. */
1328     if (channel_subsys.chnmon_active) {
1329         css_update_chnmon(sch);
1330     }
1331 
1332     s->ctrl |= SCSW_ACTL_RESUME_PEND;
1333     do_subchannel_work(sch, NULL);
1334     ret = 0;
1335 
1336 out:
1337     return ret;
1338 }
1339 
1340 int css_do_rchp(uint8_t cssid, uint8_t chpid)
1341 {
1342     uint8_t real_cssid;
1343 
1344     if (cssid > channel_subsys.max_cssid) {
1345         return -EINVAL;
1346     }
1347     if (channel_subsys.max_cssid == 0) {
1348         real_cssid = channel_subsys.default_cssid;
1349     } else {
1350         real_cssid = cssid;
1351     }
1352     if (!channel_subsys.css[real_cssid]) {
1353         return -EINVAL;
1354     }
1355 
1356     if (!channel_subsys.css[real_cssid]->chpids[chpid].in_use) {
1357         return -ENODEV;
1358     }
1359 
1360     if (!channel_subsys.css[real_cssid]->chpids[chpid].is_virtual) {
1361         fprintf(stderr,
1362                 "rchp unsupported for non-virtual chpid %x.%02x!\n",
1363                 real_cssid, chpid);
1364         return -ENODEV;
1365     }
1366 
1367     /* We don't really use a channel path, so we're done here. */
1368     css_queue_crw(CRW_RSC_CHP, CRW_ERC_INIT,
1369                   channel_subsys.max_cssid > 0 ? 1 : 0, chpid);
1370     if (channel_subsys.max_cssid > 0) {
1371         css_queue_crw(CRW_RSC_CHP, CRW_ERC_INIT, 0, real_cssid << 8);
1372     }
1373     return 0;
1374 }
1375 
1376 bool css_schid_final(int m, uint8_t cssid, uint8_t ssid, uint16_t schid)
1377 {
1378     SubchSet *set;
1379     uint8_t real_cssid;
1380 
1381     real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid;
1382     if (ssid > MAX_SSID ||
1383         !channel_subsys.css[real_cssid] ||
1384         !channel_subsys.css[real_cssid]->sch_set[ssid]) {
1385         return true;
1386     }
1387     set = channel_subsys.css[real_cssid]->sch_set[ssid];
1388     return schid > find_last_bit(set->schids_used,
1389                                  (MAX_SCHID + 1) / sizeof(unsigned long));
1390 }
1391 
1392 unsigned int css_find_free_chpid(uint8_t cssid)
1393 {
1394     CssImage *css = channel_subsys.css[cssid];
1395     unsigned int chpid;
1396 
1397     if (!css) {
1398         return MAX_CHPID + 1;
1399     }
1400 
1401     for (chpid = 0; chpid <= MAX_CHPID; chpid++) {
1402         /* skip reserved chpid */
1403         if (chpid == VIRTIO_CCW_CHPID) {
1404             continue;
1405         }
1406         if (!css->chpids[chpid].in_use) {
1407             return chpid;
1408         }
1409     }
1410     return MAX_CHPID + 1;
1411 }
1412 
1413 static int css_add_chpid(uint8_t cssid, uint8_t chpid, uint8_t type,
1414                          bool is_virt)
1415 {
1416     CssImage *css;
1417 
1418     trace_css_chpid_add(cssid, chpid, type);
1419     css = channel_subsys.css[cssid];
1420     if (!css) {
1421         return -EINVAL;
1422     }
1423     if (css->chpids[chpid].in_use) {
1424         return -EEXIST;
1425     }
1426     css->chpids[chpid].in_use = 1;
1427     css->chpids[chpid].type = type;
1428     css->chpids[chpid].is_virtual = is_virt;
1429 
1430     css_generate_chp_crws(cssid, chpid);
1431 
1432     return 0;
1433 }
1434 
1435 void css_sch_build_virtual_schib(SubchDev *sch, uint8_t chpid, uint8_t type)
1436 {
1437     PMCW *p = &sch->curr_status.pmcw;
1438     SCSW *s = &sch->curr_status.scsw;
1439     int i;
1440     CssImage *css = channel_subsys.css[sch->cssid];
1441 
1442     assert(css != NULL);
1443     memset(p, 0, sizeof(PMCW));
1444     p->flags |= PMCW_FLAGS_MASK_DNV;
1445     p->devno = sch->devno;
1446     /* single path */
1447     p->pim = 0x80;
1448     p->pom = 0xff;
1449     p->pam = 0x80;
1450     p->chpid[0] = chpid;
1451     if (!css->chpids[chpid].in_use) {
1452         css_add_chpid(sch->cssid, chpid, type, true);
1453     }
1454 
1455     memset(s, 0, sizeof(SCSW));
1456     sch->curr_status.mba = 0;
1457     for (i = 0; i < ARRAY_SIZE(sch->curr_status.mda); i++) {
1458         sch->curr_status.mda[i] = 0;
1459     }
1460 }
1461 
1462 SubchDev *css_find_subch(uint8_t m, uint8_t cssid, uint8_t ssid, uint16_t schid)
1463 {
1464     uint8_t real_cssid;
1465 
1466     real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid;
1467 
1468     if (!channel_subsys.css[real_cssid]) {
1469         return NULL;
1470     }
1471 
1472     if (!channel_subsys.css[real_cssid]->sch_set[ssid]) {
1473         return NULL;
1474     }
1475 
1476     return channel_subsys.css[real_cssid]->sch_set[ssid]->sch[schid];
1477 }
1478 
1479 /**
1480  * Return free device number in subchannel set.
1481  *
1482  * Return index of the first free device number in the subchannel set
1483  * identified by @p cssid and @p ssid, beginning the search at @p
1484  * start and wrapping around at MAX_DEVNO. Return a value exceeding
1485  * MAX_SCHID if there are no free device numbers in the subchannel
1486  * set.
1487  */
1488 static uint32_t css_find_free_devno(uint8_t cssid, uint8_t ssid,
1489                                     uint16_t start)
1490 {
1491     uint32_t round;
1492 
1493     for (round = 0; round <= MAX_DEVNO; round++) {
1494         uint16_t devno = (start + round) % MAX_DEVNO;
1495 
1496         if (!css_devno_used(cssid, ssid, devno)) {
1497             return devno;
1498         }
1499     }
1500     return MAX_DEVNO + 1;
1501 }
1502 
1503 /**
1504  * Return first free subchannel (id) in subchannel set.
1505  *
1506  * Return index of the first free subchannel in the subchannel set
1507  * identified by @p cssid and @p ssid, if there is any. Return a value
1508  * exceeding MAX_SCHID if there are no free subchannels in the
1509  * subchannel set.
1510  */
1511 static uint32_t css_find_free_subch(uint8_t cssid, uint8_t ssid)
1512 {
1513     uint32_t schid;
1514 
1515     for (schid = 0; schid <= MAX_SCHID; schid++) {
1516         if (!css_find_subch(1, cssid, ssid, schid)) {
1517             return schid;
1518         }
1519     }
1520     return MAX_SCHID + 1;
1521 }
1522 
1523 /**
1524  * Return first free subchannel (id) in subchannel set for a device number
1525  *
1526  * Verify the device number @p devno is not used yet in the subchannel
1527  * set identified by @p cssid and @p ssid. Set @p schid to the index
1528  * of the first free subchannel in the subchannel set, if there is
1529  * any. Return true if everything succeeded and false otherwise.
1530  */
1531 static bool css_find_free_subch_for_devno(uint8_t cssid, uint8_t ssid,
1532                                           uint16_t devno, uint16_t *schid,
1533                                           Error **errp)
1534 {
1535     uint32_t free_schid;
1536 
1537     assert(schid);
1538     if (css_devno_used(cssid, ssid, devno)) {
1539         error_setg(errp, "Device %x.%x.%04x already exists",
1540                    cssid, ssid, devno);
1541         return false;
1542     }
1543     free_schid = css_find_free_subch(cssid, ssid);
1544     if (free_schid > MAX_SCHID) {
1545         error_setg(errp, "No free subchannel found for %x.%x.%04x",
1546                    cssid, ssid, devno);
1547         return false;
1548     }
1549     *schid = free_schid;
1550     return true;
1551 }
1552 
1553 /**
1554  * Return first free subchannel (id) and device number
1555  *
1556  * Locate the first free subchannel and first free device number in
1557  * any of the subchannel sets of the channel subsystem identified by
1558  * @p cssid. Return false if no free subchannel / device number could
1559  * be found. Otherwise set @p ssid, @p devno and @p schid to identify
1560  * the available subchannel and device number and return true.
1561  *
1562  * May modify @p ssid, @p devno and / or @p schid even if no free
1563  * subchannel / device number could be found.
1564  */
1565 static bool css_find_free_subch_and_devno(uint8_t cssid, uint8_t *ssid,
1566                                           uint16_t *devno, uint16_t *schid,
1567                                           Error **errp)
1568 {
1569     uint32_t free_schid, free_devno;
1570 
1571     assert(ssid && devno && schid);
1572     for (*ssid = 0; *ssid <= MAX_SSID; (*ssid)++) {
1573         free_schid = css_find_free_subch(cssid, *ssid);
1574         if (free_schid > MAX_SCHID) {
1575             continue;
1576         }
1577         free_devno = css_find_free_devno(cssid, *ssid, free_schid);
1578         if (free_devno > MAX_DEVNO) {
1579             continue;
1580         }
1581         *schid = free_schid;
1582         *devno = free_devno;
1583         return true;
1584     }
1585     error_setg(errp, "Virtual channel subsystem is full!");
1586     return false;
1587 }
1588 
1589 bool css_subch_visible(SubchDev *sch)
1590 {
1591     if (sch->ssid > channel_subsys.max_ssid) {
1592         return false;
1593     }
1594 
1595     if (sch->cssid != channel_subsys.default_cssid) {
1596         return (channel_subsys.max_cssid > 0);
1597     }
1598 
1599     return true;
1600 }
1601 
1602 bool css_present(uint8_t cssid)
1603 {
1604     return (channel_subsys.css[cssid] != NULL);
1605 }
1606 
1607 bool css_devno_used(uint8_t cssid, uint8_t ssid, uint16_t devno)
1608 {
1609     if (!channel_subsys.css[cssid]) {
1610         return false;
1611     }
1612     if (!channel_subsys.css[cssid]->sch_set[ssid]) {
1613         return false;
1614     }
1615 
1616     return !!test_bit(devno,
1617                       channel_subsys.css[cssid]->sch_set[ssid]->devnos_used);
1618 }
1619 
1620 void css_subch_assign(uint8_t cssid, uint8_t ssid, uint16_t schid,
1621                       uint16_t devno, SubchDev *sch)
1622 {
1623     CssImage *css;
1624     SubchSet *s_set;
1625 
1626     trace_css_assign_subch(sch ? "assign" : "deassign", cssid, ssid, schid,
1627                            devno);
1628     if (!channel_subsys.css[cssid]) {
1629         fprintf(stderr,
1630                 "Suspicious call to %s (%x.%x.%04x) for non-existing css!\n",
1631                 __func__, cssid, ssid, schid);
1632         return;
1633     }
1634     css = channel_subsys.css[cssid];
1635 
1636     if (!css->sch_set[ssid]) {
1637         css->sch_set[ssid] = g_malloc0(sizeof(SubchSet));
1638     }
1639     s_set = css->sch_set[ssid];
1640 
1641     s_set->sch[schid] = sch;
1642     if (sch) {
1643         set_bit(schid, s_set->schids_used);
1644         set_bit(devno, s_set->devnos_used);
1645     } else {
1646         clear_bit(schid, s_set->schids_used);
1647         clear_bit(devno, s_set->devnos_used);
1648     }
1649 }
1650 
1651 void css_queue_crw(uint8_t rsc, uint8_t erc, int chain, uint16_t rsid)
1652 {
1653     CrwContainer *crw_cont;
1654 
1655     trace_css_crw(rsc, erc, rsid, chain ? "(chained)" : "");
1656     /* TODO: Maybe use a static crw pool? */
1657     crw_cont = g_try_malloc0(sizeof(CrwContainer));
1658     if (!crw_cont) {
1659         channel_subsys.crws_lost = true;
1660         return;
1661     }
1662     crw_cont->crw.flags = (rsc << 8) | erc;
1663     if (chain) {
1664         crw_cont->crw.flags |= CRW_FLAGS_MASK_C;
1665     }
1666     crw_cont->crw.rsid = rsid;
1667     if (channel_subsys.crws_lost) {
1668         crw_cont->crw.flags |= CRW_FLAGS_MASK_R;
1669         channel_subsys.crws_lost = false;
1670     }
1671 
1672     QTAILQ_INSERT_TAIL(&channel_subsys.pending_crws, crw_cont, sibling);
1673 
1674     if (channel_subsys.do_crw_mchk) {
1675         channel_subsys.do_crw_mchk = false;
1676         /* Inject crw pending machine check. */
1677         s390_crw_mchk();
1678     }
1679 }
1680 
1681 void css_generate_sch_crws(uint8_t cssid, uint8_t ssid, uint16_t schid,
1682                            int hotplugged, int add)
1683 {
1684     uint8_t guest_cssid;
1685     bool chain_crw;
1686 
1687     if (add && !hotplugged) {
1688         return;
1689     }
1690     if (channel_subsys.max_cssid == 0) {
1691         /* Default cssid shows up as 0. */
1692         guest_cssid = (cssid == channel_subsys.default_cssid) ? 0 : cssid;
1693     } else {
1694         /* Show real cssid to the guest. */
1695         guest_cssid = cssid;
1696     }
1697     /*
1698      * Only notify for higher subchannel sets/channel subsystems if the
1699      * guest has enabled it.
1700      */
1701     if ((ssid > channel_subsys.max_ssid) ||
1702         (guest_cssid > channel_subsys.max_cssid) ||
1703         ((channel_subsys.max_cssid == 0) &&
1704          (cssid != channel_subsys.default_cssid))) {
1705         return;
1706     }
1707     chain_crw = (channel_subsys.max_ssid > 0) ||
1708             (channel_subsys.max_cssid > 0);
1709     css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, chain_crw ? 1 : 0, schid);
1710     if (chain_crw) {
1711         css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, 0,
1712                       (guest_cssid << 8) | (ssid << 4));
1713     }
1714     /* RW_ERC_IPI --> clear pending interrupts */
1715     css_clear_io_interrupt(css_do_build_subchannel_id(cssid, ssid), schid);
1716 }
1717 
1718 void css_generate_chp_crws(uint8_t cssid, uint8_t chpid)
1719 {
1720     /* TODO */
1721 }
1722 
1723 void css_generate_css_crws(uint8_t cssid)
1724 {
1725     if (!channel_subsys.sei_pending) {
1726         css_queue_crw(CRW_RSC_CSS, 0, 0, cssid);
1727     }
1728     channel_subsys.sei_pending = true;
1729 }
1730 
1731 void css_clear_sei_pending(void)
1732 {
1733     channel_subsys.sei_pending = false;
1734 }
1735 
1736 int css_enable_mcsse(void)
1737 {
1738     trace_css_enable_facility("mcsse");
1739     channel_subsys.max_cssid = MAX_CSSID;
1740     return 0;
1741 }
1742 
1743 int css_enable_mss(void)
1744 {
1745     trace_css_enable_facility("mss");
1746     channel_subsys.max_ssid = MAX_SSID;
1747     return 0;
1748 }
1749 
1750 void subch_device_save(SubchDev *s, QEMUFile *f)
1751 {
1752     int i;
1753 
1754     qemu_put_byte(f, s->cssid);
1755     qemu_put_byte(f, s->ssid);
1756     qemu_put_be16(f, s->schid);
1757     qemu_put_be16(f, s->devno);
1758     qemu_put_byte(f, s->thinint_active);
1759     /* SCHIB */
1760     /*     PMCW */
1761     qemu_put_be32(f, s->curr_status.pmcw.intparm);
1762     qemu_put_be16(f, s->curr_status.pmcw.flags);
1763     qemu_put_be16(f, s->curr_status.pmcw.devno);
1764     qemu_put_byte(f, s->curr_status.pmcw.lpm);
1765     qemu_put_byte(f, s->curr_status.pmcw.pnom);
1766     qemu_put_byte(f, s->curr_status.pmcw.lpum);
1767     qemu_put_byte(f, s->curr_status.pmcw.pim);
1768     qemu_put_be16(f, s->curr_status.pmcw.mbi);
1769     qemu_put_byte(f, s->curr_status.pmcw.pom);
1770     qemu_put_byte(f, s->curr_status.pmcw.pam);
1771     qemu_put_buffer(f, s->curr_status.pmcw.chpid, 8);
1772     qemu_put_be32(f, s->curr_status.pmcw.chars);
1773     /*     SCSW */
1774     qemu_put_be16(f, s->curr_status.scsw.flags);
1775     qemu_put_be16(f, s->curr_status.scsw.ctrl);
1776     qemu_put_be32(f, s->curr_status.scsw.cpa);
1777     qemu_put_byte(f, s->curr_status.scsw.dstat);
1778     qemu_put_byte(f, s->curr_status.scsw.cstat);
1779     qemu_put_be16(f, s->curr_status.scsw.count);
1780     qemu_put_be64(f, s->curr_status.mba);
1781     qemu_put_buffer(f, s->curr_status.mda, 4);
1782     /* end SCHIB */
1783     qemu_put_buffer(f, s->sense_data, 32);
1784     qemu_put_be64(f, s->channel_prog);
1785     /* last cmd */
1786     qemu_put_byte(f, s->last_cmd.cmd_code);
1787     qemu_put_byte(f, s->last_cmd.flags);
1788     qemu_put_be16(f, s->last_cmd.count);
1789     qemu_put_be32(f, s->last_cmd.cda);
1790     qemu_put_byte(f, s->last_cmd_valid);
1791     qemu_put_byte(f, s->id.reserved);
1792     qemu_put_be16(f, s->id.cu_type);
1793     qemu_put_byte(f, s->id.cu_model);
1794     qemu_put_be16(f, s->id.dev_type);
1795     qemu_put_byte(f, s->id.dev_model);
1796     qemu_put_byte(f, s->id.unused);
1797     for (i = 0; i < ARRAY_SIZE(s->id.ciw); i++) {
1798         qemu_put_byte(f, s->id.ciw[i].type);
1799         qemu_put_byte(f, s->id.ciw[i].command);
1800         qemu_put_be16(f, s->id.ciw[i].count);
1801     }
1802     qemu_put_byte(f, s->ccw_fmt_1);
1803     qemu_put_byte(f, s->ccw_no_data_cnt);
1804 }
1805 
1806 int subch_device_load(SubchDev *s, QEMUFile *f)
1807 {
1808     SubchDev *old_s;
1809     Error *err = NULL;
1810     uint16_t old_schid = s->schid;
1811     uint16_t old_devno = s->devno;
1812     int i;
1813 
1814     s->cssid = qemu_get_byte(f);
1815     s->ssid = qemu_get_byte(f);
1816     s->schid = qemu_get_be16(f);
1817     s->devno = qemu_get_be16(f);
1818     if (s->devno != old_devno) {
1819         /* Only possible if machine < 2.7 (no css_dev_path) */
1820 
1821         error_setg(&err, "%x != %x", old_devno,  s->devno);
1822         error_append_hint(&err, "Devno mismatch, tried to load wrong section!"
1823                           " Likely reason: some sequences of plug and unplug"
1824                           " can break migration for machine versions prior to"
1825                           " 2.7 (known design flaw).\n");
1826         error_report_err(err);
1827         return -EINVAL;
1828     }
1829     /* Re-assign subch. */
1830     if (old_schid != s->schid) {
1831         old_s = channel_subsys.css[s->cssid]->sch_set[s->ssid]->sch[old_schid];
1832         /*
1833          * (old_s != s) means that some other device has its correct
1834          * subchannel already assigned (in load).
1835          */
1836         if (old_s == s) {
1837             css_subch_assign(s->cssid, s->ssid, old_schid, s->devno, NULL);
1838         }
1839         /* It's OK to re-assign without a prior de-assign. */
1840         css_subch_assign(s->cssid, s->ssid, s->schid, s->devno, s);
1841     }
1842     s->thinint_active = qemu_get_byte(f);
1843     /* SCHIB */
1844     /*     PMCW */
1845     s->curr_status.pmcw.intparm = qemu_get_be32(f);
1846     s->curr_status.pmcw.flags = qemu_get_be16(f);
1847     s->curr_status.pmcw.devno = qemu_get_be16(f);
1848     s->curr_status.pmcw.lpm = qemu_get_byte(f);
1849     s->curr_status.pmcw.pnom  = qemu_get_byte(f);
1850     s->curr_status.pmcw.lpum = qemu_get_byte(f);
1851     s->curr_status.pmcw.pim = qemu_get_byte(f);
1852     s->curr_status.pmcw.mbi = qemu_get_be16(f);
1853     s->curr_status.pmcw.pom = qemu_get_byte(f);
1854     s->curr_status.pmcw.pam = qemu_get_byte(f);
1855     qemu_get_buffer(f, s->curr_status.pmcw.chpid, 8);
1856     s->curr_status.pmcw.chars = qemu_get_be32(f);
1857     /*     SCSW */
1858     s->curr_status.scsw.flags = qemu_get_be16(f);
1859     s->curr_status.scsw.ctrl = qemu_get_be16(f);
1860     s->curr_status.scsw.cpa = qemu_get_be32(f);
1861     s->curr_status.scsw.dstat = qemu_get_byte(f);
1862     s->curr_status.scsw.cstat = qemu_get_byte(f);
1863     s->curr_status.scsw.count = qemu_get_be16(f);
1864     s->curr_status.mba = qemu_get_be64(f);
1865     qemu_get_buffer(f, s->curr_status.mda, 4);
1866     /* end SCHIB */
1867     qemu_get_buffer(f, s->sense_data, 32);
1868     s->channel_prog = qemu_get_be64(f);
1869     /* last cmd */
1870     s->last_cmd.cmd_code = qemu_get_byte(f);
1871     s->last_cmd.flags = qemu_get_byte(f);
1872     s->last_cmd.count = qemu_get_be16(f);
1873     s->last_cmd.cda = qemu_get_be32(f);
1874     s->last_cmd_valid = qemu_get_byte(f);
1875     s->id.reserved = qemu_get_byte(f);
1876     s->id.cu_type = qemu_get_be16(f);
1877     s->id.cu_model = qemu_get_byte(f);
1878     s->id.dev_type = qemu_get_be16(f);
1879     s->id.dev_model = qemu_get_byte(f);
1880     s->id.unused = qemu_get_byte(f);
1881     for (i = 0; i < ARRAY_SIZE(s->id.ciw); i++) {
1882         s->id.ciw[i].type = qemu_get_byte(f);
1883         s->id.ciw[i].command = qemu_get_byte(f);
1884         s->id.ciw[i].count = qemu_get_be16(f);
1885     }
1886     s->ccw_fmt_1 = qemu_get_byte(f);
1887     s->ccw_no_data_cnt = qemu_get_byte(f);
1888     /*
1889      * Hack alert. We don't migrate the channel subsystem status (no
1890      * device!), but we need to find out if the guest enabled mss/mcss-e.
1891      * If the subchannel is enabled, it certainly was able to access it,
1892      * so adjust the max_ssid/max_cssid values for relevant ssid/cssid
1893      * values. This is not watertight, but better than nothing.
1894      */
1895     if (s->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ENA) {
1896         if (s->ssid) {
1897             channel_subsys.max_ssid = MAX_SSID;
1898         }
1899         if (s->cssid != channel_subsys.default_cssid) {
1900             channel_subsys.max_cssid = MAX_CSSID;
1901         }
1902     }
1903     return 0;
1904 }
1905 
1906 void css_reset_sch(SubchDev *sch)
1907 {
1908     PMCW *p = &sch->curr_status.pmcw;
1909 
1910     if ((p->flags & PMCW_FLAGS_MASK_ENA) != 0 && sch->disable_cb) {
1911         sch->disable_cb(sch);
1912     }
1913 
1914     p->intparm = 0;
1915     p->flags &= ~(PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
1916                   PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
1917                   PMCW_FLAGS_MASK_MP | PMCW_FLAGS_MASK_TF);
1918     p->flags |= PMCW_FLAGS_MASK_DNV;
1919     p->devno = sch->devno;
1920     p->pim = 0x80;
1921     p->lpm = p->pim;
1922     p->pnom = 0;
1923     p->lpum = 0;
1924     p->mbi = 0;
1925     p->pom = 0xff;
1926     p->pam = 0x80;
1927     p->chars &= ~(PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_XMWME |
1928                   PMCW_CHARS_MASK_CSENSE);
1929 
1930     memset(&sch->curr_status.scsw, 0, sizeof(sch->curr_status.scsw));
1931     sch->curr_status.mba = 0;
1932 
1933     sch->channel_prog = 0x0;
1934     sch->last_cmd_valid = false;
1935     sch->thinint_active = false;
1936 }
1937 
1938 void css_reset(void)
1939 {
1940     CrwContainer *crw_cont;
1941 
1942     /* Clean up monitoring. */
1943     channel_subsys.chnmon_active = false;
1944     channel_subsys.chnmon_area = 0;
1945 
1946     /* Clear pending CRWs. */
1947     while ((crw_cont = QTAILQ_FIRST(&channel_subsys.pending_crws))) {
1948         QTAILQ_REMOVE(&channel_subsys.pending_crws, crw_cont, sibling);
1949         g_free(crw_cont);
1950     }
1951     channel_subsys.sei_pending = false;
1952     channel_subsys.do_crw_mchk = true;
1953     channel_subsys.crws_lost = false;
1954 
1955     /* Reset maximum ids. */
1956     channel_subsys.max_cssid = 0;
1957     channel_subsys.max_ssid = 0;
1958 }
1959 
1960 static void get_css_devid(Object *obj, Visitor *v, const char *name,
1961                           void *opaque, Error **errp)
1962 {
1963     DeviceState *dev = DEVICE(obj);
1964     Property *prop = opaque;
1965     CssDevId *dev_id = qdev_get_prop_ptr(dev, prop);
1966     char buffer[] = "xx.x.xxxx";
1967     char *p = buffer;
1968     int r;
1969 
1970     if (dev_id->valid) {
1971 
1972         r = snprintf(buffer, sizeof(buffer), "%02x.%1x.%04x", dev_id->cssid,
1973                      dev_id->ssid, dev_id->devid);
1974         assert(r == sizeof(buffer) - 1);
1975 
1976         /* drop leading zero */
1977         if (dev_id->cssid <= 0xf) {
1978             p++;
1979         }
1980     } else {
1981         snprintf(buffer, sizeof(buffer), "<unset>");
1982     }
1983 
1984     visit_type_str(v, name, &p, errp);
1985 }
1986 
1987 /*
1988  * parse <cssid>.<ssid>.<devid> and assert valid range for cssid/ssid
1989  */
1990 static void set_css_devid(Object *obj, Visitor *v, const char *name,
1991                           void *opaque, Error **errp)
1992 {
1993     DeviceState *dev = DEVICE(obj);
1994     Property *prop = opaque;
1995     CssDevId *dev_id = qdev_get_prop_ptr(dev, prop);
1996     Error *local_err = NULL;
1997     char *str;
1998     int num, n1, n2;
1999     unsigned int cssid, ssid, devid;
2000 
2001     if (dev->realized) {
2002         qdev_prop_set_after_realize(dev, name, errp);
2003         return;
2004     }
2005 
2006     visit_type_str(v, name, &str, &local_err);
2007     if (local_err) {
2008         error_propagate(errp, local_err);
2009         return;
2010     }
2011 
2012     num = sscanf(str, "%2x.%1x%n.%4x%n", &cssid, &ssid, &n1, &devid, &n2);
2013     if (num != 3 || (n2 - n1) != 5 || strlen(str) != n2) {
2014         error_set_from_qdev_prop_error(errp, EINVAL, dev, prop, str);
2015         goto out;
2016     }
2017     if ((cssid > MAX_CSSID) || (ssid > MAX_SSID)) {
2018         error_setg(errp, "Invalid cssid or ssid: cssid %x, ssid %x",
2019                    cssid, ssid);
2020         goto out;
2021     }
2022 
2023     dev_id->cssid = cssid;
2024     dev_id->ssid = ssid;
2025     dev_id->devid = devid;
2026     dev_id->valid = true;
2027 
2028 out:
2029     g_free(str);
2030 }
2031 
2032 PropertyInfo css_devid_propinfo = {
2033     .name = "str",
2034     .description = "Identifier of an I/O device in the channel "
2035                    "subsystem, example: fe.1.23ab",
2036     .get = get_css_devid,
2037     .set = set_css_devid,
2038 };
2039 
2040 PropertyInfo css_devid_ro_propinfo = {
2041     .name = "str",
2042     .description = "Read-only identifier of an I/O device in the channel "
2043                    "subsystem, example: fe.1.23ab",
2044     .get = get_css_devid,
2045 };
2046 
2047 SubchDev *css_create_sch(CssDevId bus_id, bool is_virtual, bool squash_mcss,
2048                          Error **errp)
2049 {
2050     uint16_t schid = 0;
2051     SubchDev *sch;
2052 
2053     if (bus_id.valid) {
2054         if (is_virtual != (bus_id.cssid == VIRTUAL_CSSID)) {
2055             error_setg(errp, "cssid %hhx not valid for %s devices",
2056                        bus_id.cssid,
2057                        (is_virtual ? "virtual" : "non-virtual"));
2058             return NULL;
2059         }
2060     }
2061 
2062     if (bus_id.valid) {
2063         if (squash_mcss) {
2064             bus_id.cssid = channel_subsys.default_cssid;
2065         } else if (!channel_subsys.css[bus_id.cssid]) {
2066             css_create_css_image(bus_id.cssid, false);
2067         }
2068 
2069         if (!css_find_free_subch_for_devno(bus_id.cssid, bus_id.ssid,
2070                                            bus_id.devid, &schid, errp)) {
2071             return NULL;
2072         }
2073     } else if (squash_mcss || is_virtual) {
2074         bus_id.cssid = channel_subsys.default_cssid;
2075 
2076         if (!css_find_free_subch_and_devno(bus_id.cssid, &bus_id.ssid,
2077                                            &bus_id.devid, &schid, errp)) {
2078             return NULL;
2079         }
2080     } else {
2081         for (bus_id.cssid = 0; bus_id.cssid < MAX_CSSID; ++bus_id.cssid) {
2082             if (bus_id.cssid == VIRTUAL_CSSID) {
2083                 continue;
2084             }
2085 
2086             if (!channel_subsys.css[bus_id.cssid]) {
2087                 css_create_css_image(bus_id.cssid, false);
2088             }
2089 
2090             if   (css_find_free_subch_and_devno(bus_id.cssid, &bus_id.ssid,
2091                                                 &bus_id.devid, &schid,
2092                                                 NULL)) {
2093                 break;
2094             }
2095             if (bus_id.cssid == MAX_CSSID) {
2096                 error_setg(errp, "Virtual channel subsystem is full!");
2097                 return NULL;
2098             }
2099         }
2100     }
2101 
2102     sch = g_malloc0(sizeof(*sch));
2103     sch->cssid = bus_id.cssid;
2104     sch->ssid = bus_id.ssid;
2105     sch->devno = bus_id.devid;
2106     sch->schid = schid;
2107     css_subch_assign(sch->cssid, sch->ssid, schid, sch->devno, sch);
2108     return sch;
2109 }
2110 
2111 static int css_sch_get_chpids(SubchDev *sch, CssDevId *dev_id)
2112 {
2113     char *fid_path;
2114     FILE *fd;
2115     uint32_t chpid[8];
2116     int i;
2117     PMCW *p = &sch->curr_status.pmcw;
2118 
2119     fid_path = g_strdup_printf("/sys/bus/css/devices/%x.%x.%04x/chpids",
2120                                dev_id->cssid, dev_id->ssid, dev_id->devid);
2121     fd = fopen(fid_path, "r");
2122     if (fd == NULL) {
2123         error_report("%s: open %s failed", __func__, fid_path);
2124         g_free(fid_path);
2125         return -EINVAL;
2126     }
2127 
2128     if (fscanf(fd, "%x %x %x %x %x %x %x %x",
2129         &chpid[0], &chpid[1], &chpid[2], &chpid[3],
2130         &chpid[4], &chpid[5], &chpid[6], &chpid[7]) != 8) {
2131         fclose(fd);
2132         g_free(fid_path);
2133         return -EINVAL;
2134     }
2135 
2136     for (i = 0; i < ARRAY_SIZE(p->chpid); i++) {
2137         p->chpid[i] = chpid[i];
2138     }
2139 
2140     fclose(fd);
2141     g_free(fid_path);
2142 
2143     return 0;
2144 }
2145 
2146 static int css_sch_get_path_masks(SubchDev *sch, CssDevId *dev_id)
2147 {
2148     char *fid_path;
2149     FILE *fd;
2150     uint32_t pim, pam, pom;
2151     PMCW *p = &sch->curr_status.pmcw;
2152 
2153     fid_path = g_strdup_printf("/sys/bus/css/devices/%x.%x.%04x/pimpampom",
2154                                dev_id->cssid, dev_id->ssid, dev_id->devid);
2155     fd = fopen(fid_path, "r");
2156     if (fd == NULL) {
2157         error_report("%s: open %s failed", __func__, fid_path);
2158         g_free(fid_path);
2159         return -EINVAL;
2160     }
2161 
2162     if (fscanf(fd, "%x %x %x", &pim, &pam, &pom) != 3) {
2163         fclose(fd);
2164         g_free(fid_path);
2165         return -EINVAL;
2166     }
2167 
2168     p->pim = pim;
2169     p->pam = pam;
2170     p->pom = pom;
2171     fclose(fd);
2172     g_free(fid_path);
2173 
2174     return 0;
2175 }
2176 
2177 static int css_sch_get_chpid_type(uint8_t chpid, uint32_t *type,
2178                                   CssDevId *dev_id)
2179 {
2180     char *fid_path;
2181     FILE *fd;
2182 
2183     fid_path = g_strdup_printf("/sys/devices/css%x/chp0.%02x/type",
2184                                dev_id->cssid, chpid);
2185     fd = fopen(fid_path, "r");
2186     if (fd == NULL) {
2187         error_report("%s: open %s failed", __func__, fid_path);
2188         g_free(fid_path);
2189         return -EINVAL;
2190     }
2191 
2192     if (fscanf(fd, "%x", type) != 1) {
2193         fclose(fd);
2194         g_free(fid_path);
2195         return -EINVAL;
2196     }
2197 
2198     fclose(fd);
2199     g_free(fid_path);
2200 
2201     return 0;
2202 }
2203 
2204 /*
2205  * We currently retrieve the real device information from sysfs to build the
2206  * guest subchannel information block without considering the migration feature.
2207  * We need to revisit this problem when we want to add migration support.
2208  */
2209 int css_sch_build_schib(SubchDev *sch, CssDevId *dev_id)
2210 {
2211     CssImage *css = channel_subsys.css[sch->cssid];
2212     PMCW *p = &sch->curr_status.pmcw;
2213     SCSW *s = &sch->curr_status.scsw;
2214     uint32_t type;
2215     int i, ret;
2216 
2217     assert(css != NULL);
2218     memset(p, 0, sizeof(PMCW));
2219     p->flags |= PMCW_FLAGS_MASK_DNV;
2220     /* We are dealing with I/O subchannels only. */
2221     p->devno = sch->devno;
2222 
2223     /* Grab path mask from sysfs. */
2224     ret = css_sch_get_path_masks(sch, dev_id);
2225     if (ret) {
2226         return ret;
2227     }
2228 
2229     /* Grab chpids from sysfs. */
2230     ret = css_sch_get_chpids(sch, dev_id);
2231     if (ret) {
2232         return ret;
2233     }
2234 
2235    /* Build chpid type. */
2236     for (i = 0; i < ARRAY_SIZE(p->chpid); i++) {
2237         if (p->chpid[i] && !css->chpids[p->chpid[i]].in_use) {
2238             ret = css_sch_get_chpid_type(p->chpid[i], &type, dev_id);
2239             if (ret) {
2240                 return ret;
2241             }
2242             css_add_chpid(sch->cssid, p->chpid[i], type, false);
2243         }
2244     }
2245 
2246     memset(s, 0, sizeof(SCSW));
2247     sch->curr_status.mba = 0;
2248     for (i = 0; i < ARRAY_SIZE(sch->curr_status.mda); i++) {
2249         sch->curr_status.mda[i] = 0;
2250     }
2251 
2252     return 0;
2253 }
2254