xref: /qemu/hw/s390x/css.c (revision 25c14678)
1 /*
2  * Channel subsystem base support.
3  *
4  * Copyright 2012 IBM Corp.
5  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or (at
8  * your option) any later version. See the COPYING file in the top-level
9  * directory.
10  */
11 
12 #include "qemu/osdep.h"
13 #include "qapi/error.h"
14 #include "qapi/visitor.h"
15 #include "hw/qdev.h"
16 #include "qemu/bitops.h"
17 #include "qemu/error-report.h"
18 #include "exec/address-spaces.h"
19 #include "cpu.h"
20 #include "hw/s390x/ioinst.h"
21 #include "hw/s390x/css.h"
22 #include "trace.h"
23 #include "hw/s390x/s390_flic.h"
24 #include "hw/s390x/s390-virtio-ccw.h"
25 
26 typedef struct CrwContainer {
27     CRW crw;
28     QTAILQ_ENTRY(CrwContainer) sibling;
29 } CrwContainer;
30 
31 static const VMStateDescription vmstate_crw = {
32     .name = "s390_crw",
33     .version_id = 1,
34     .minimum_version_id = 1,
35     .fields = (VMStateField[]) {
36         VMSTATE_UINT16(flags, CRW),
37         VMSTATE_UINT16(rsid, CRW),
38         VMSTATE_END_OF_LIST()
39     },
40 };
41 
42 static const VMStateDescription vmstate_crw_container = {
43     .name = "s390_crw_container",
44     .version_id = 1,
45     .minimum_version_id = 1,
46     .fields = (VMStateField[]) {
47         VMSTATE_STRUCT(crw, CrwContainer, 0, vmstate_crw, CRW),
48         VMSTATE_END_OF_LIST()
49     },
50 };
51 
52 typedef struct ChpInfo {
53     uint8_t in_use;
54     uint8_t type;
55     uint8_t is_virtual;
56 } ChpInfo;
57 
58 static const VMStateDescription vmstate_chp_info = {
59     .name = "s390_chp_info",
60     .version_id = 1,
61     .minimum_version_id = 1,
62     .fields = (VMStateField[]) {
63         VMSTATE_UINT8(in_use, ChpInfo),
64         VMSTATE_UINT8(type, ChpInfo),
65         VMSTATE_UINT8(is_virtual, ChpInfo),
66         VMSTATE_END_OF_LIST()
67     }
68 };
69 
70 typedef struct SubchSet {
71     SubchDev *sch[MAX_SCHID + 1];
72     unsigned long schids_used[BITS_TO_LONGS(MAX_SCHID + 1)];
73     unsigned long devnos_used[BITS_TO_LONGS(MAX_SCHID + 1)];
74 } SubchSet;
75 
76 static const VMStateDescription vmstate_scsw = {
77     .name = "s390_scsw",
78     .version_id = 1,
79     .minimum_version_id = 1,
80     .fields = (VMStateField[]) {
81         VMSTATE_UINT16(flags, SCSW),
82         VMSTATE_UINT16(ctrl, SCSW),
83         VMSTATE_UINT32(cpa, SCSW),
84         VMSTATE_UINT8(dstat, SCSW),
85         VMSTATE_UINT8(cstat, SCSW),
86         VMSTATE_UINT16(count, SCSW),
87         VMSTATE_END_OF_LIST()
88     }
89 };
90 
91 static const VMStateDescription vmstate_pmcw = {
92     .name = "s390_pmcw",
93     .version_id = 1,
94     .minimum_version_id = 1,
95     .fields = (VMStateField[]) {
96         VMSTATE_UINT32(intparm, PMCW),
97         VMSTATE_UINT16(flags, PMCW),
98         VMSTATE_UINT16(devno, PMCW),
99         VMSTATE_UINT8(lpm, PMCW),
100         VMSTATE_UINT8(pnom, PMCW),
101         VMSTATE_UINT8(lpum, PMCW),
102         VMSTATE_UINT8(pim, PMCW),
103         VMSTATE_UINT16(mbi, PMCW),
104         VMSTATE_UINT8(pom, PMCW),
105         VMSTATE_UINT8(pam, PMCW),
106         VMSTATE_UINT8_ARRAY(chpid, PMCW, 8),
107         VMSTATE_UINT32(chars, PMCW),
108         VMSTATE_END_OF_LIST()
109     }
110 };
111 
112 static const VMStateDescription vmstate_schib = {
113     .name = "s390_schib",
114     .version_id = 1,
115     .minimum_version_id = 1,
116     .fields = (VMStateField[]) {
117         VMSTATE_STRUCT(pmcw, SCHIB, 0, vmstate_pmcw, PMCW),
118         VMSTATE_STRUCT(scsw, SCHIB, 0, vmstate_scsw, SCSW),
119         VMSTATE_UINT64(mba, SCHIB),
120         VMSTATE_UINT8_ARRAY(mda, SCHIB, 4),
121         VMSTATE_END_OF_LIST()
122     }
123 };
124 
125 
126 static const VMStateDescription vmstate_ccw1 = {
127     .name = "s390_ccw1",
128     .version_id = 1,
129     .minimum_version_id = 1,
130     .fields = (VMStateField[]) {
131         VMSTATE_UINT8(cmd_code, CCW1),
132         VMSTATE_UINT8(flags, CCW1),
133         VMSTATE_UINT16(count, CCW1),
134         VMSTATE_UINT32(cda, CCW1),
135         VMSTATE_END_OF_LIST()
136     }
137 };
138 
139 static const VMStateDescription vmstate_ciw = {
140     .name = "s390_ciw",
141     .version_id = 1,
142     .minimum_version_id = 1,
143     .fields = (VMStateField[]) {
144         VMSTATE_UINT8(type, CIW),
145         VMSTATE_UINT8(command, CIW),
146         VMSTATE_UINT16(count, CIW),
147         VMSTATE_END_OF_LIST()
148     }
149 };
150 
151 static const VMStateDescription vmstate_sense_id = {
152     .name = "s390_sense_id",
153     .version_id = 1,
154     .minimum_version_id = 1,
155     .fields = (VMStateField[]) {
156         VMSTATE_UINT8(reserved, SenseId),
157         VMSTATE_UINT16(cu_type, SenseId),
158         VMSTATE_UINT8(cu_model, SenseId),
159         VMSTATE_UINT16(dev_type, SenseId),
160         VMSTATE_UINT8(dev_model, SenseId),
161         VMSTATE_UINT8(unused, SenseId),
162         VMSTATE_STRUCT_ARRAY(ciw, SenseId, MAX_CIWS, 0, vmstate_ciw, CIW),
163         VMSTATE_END_OF_LIST()
164     }
165 };
166 
167 static const VMStateDescription vmstate_orb = {
168     .name = "s390_orb",
169     .version_id = 1,
170     .minimum_version_id = 1,
171     .fields = (VMStateField[]) {
172         VMSTATE_UINT32(intparm, ORB),
173         VMSTATE_UINT16(ctrl0, ORB),
174         VMSTATE_UINT8(lpm, ORB),
175         VMSTATE_UINT8(ctrl1, ORB),
176         VMSTATE_UINT32(cpa, ORB),
177         VMSTATE_END_OF_LIST()
178     }
179 };
180 
181 static bool vmstate_schdev_orb_needed(void *opaque)
182 {
183     return css_migration_enabled();
184 }
185 
186 static const VMStateDescription vmstate_schdev_orb = {
187     .name = "s390_subch_dev/orb",
188     .version_id = 1,
189     .minimum_version_id = 1,
190     .needed = vmstate_schdev_orb_needed,
191     .fields = (VMStateField[]) {
192         VMSTATE_STRUCT(orb, SubchDev, 1, vmstate_orb, ORB),
193         VMSTATE_END_OF_LIST()
194     }
195 };
196 
197 static int subch_dev_post_load(void *opaque, int version_id);
198 static int subch_dev_pre_save(void *opaque);
199 
200 const char err_hint_devno[] = "Devno mismatch, tried to load wrong section!"
201     " Likely reason: some sequences of plug and unplug  can break"
202     " migration for machine versions prior to  2.7 (known design flaw).";
203 
204 const VMStateDescription vmstate_subch_dev = {
205     .name = "s390_subch_dev",
206     .version_id = 1,
207     .minimum_version_id = 1,
208     .post_load = subch_dev_post_load,
209     .pre_save = subch_dev_pre_save,
210     .fields = (VMStateField[]) {
211         VMSTATE_UINT8_EQUAL(cssid, SubchDev, "Bug!"),
212         VMSTATE_UINT8_EQUAL(ssid, SubchDev, "Bug!"),
213         VMSTATE_UINT16(migrated_schid, SubchDev),
214         VMSTATE_UINT16_EQUAL(devno, SubchDev, err_hint_devno),
215         VMSTATE_BOOL(thinint_active, SubchDev),
216         VMSTATE_STRUCT(curr_status, SubchDev, 0, vmstate_schib, SCHIB),
217         VMSTATE_UINT8_ARRAY(sense_data, SubchDev, 32),
218         VMSTATE_UINT64(channel_prog, SubchDev),
219         VMSTATE_STRUCT(last_cmd, SubchDev, 0, vmstate_ccw1, CCW1),
220         VMSTATE_BOOL(last_cmd_valid, SubchDev),
221         VMSTATE_STRUCT(id, SubchDev, 0, vmstate_sense_id, SenseId),
222         VMSTATE_BOOL(ccw_fmt_1, SubchDev),
223         VMSTATE_UINT8(ccw_no_data_cnt, SubchDev),
224         VMSTATE_END_OF_LIST()
225     },
226     .subsections = (const VMStateDescription * []) {
227         &vmstate_schdev_orb,
228         NULL
229     }
230 };
231 
232 typedef struct IndAddrPtrTmp {
233     IndAddr **parent;
234     uint64_t addr;
235     int32_t len;
236 } IndAddrPtrTmp;
237 
238 static int post_load_ind_addr(void *opaque, int version_id)
239 {
240     IndAddrPtrTmp *ptmp = opaque;
241     IndAddr **ind_addr = ptmp->parent;
242 
243     if (ptmp->len != 0) {
244         *ind_addr = get_indicator(ptmp->addr, ptmp->len);
245     } else {
246         *ind_addr = NULL;
247     }
248     return 0;
249 }
250 
251 static int pre_save_ind_addr(void *opaque)
252 {
253     IndAddrPtrTmp *ptmp = opaque;
254     IndAddr *ind_addr = *(ptmp->parent);
255 
256     if (ind_addr != NULL) {
257         ptmp->len = ind_addr->len;
258         ptmp->addr = ind_addr->addr;
259     } else {
260         ptmp->len = 0;
261         ptmp->addr = 0L;
262     }
263 
264     return 0;
265 }
266 
267 const VMStateDescription vmstate_ind_addr_tmp = {
268     .name = "s390_ind_addr_tmp",
269     .pre_save = pre_save_ind_addr,
270     .post_load = post_load_ind_addr,
271 
272     .fields = (VMStateField[]) {
273         VMSTATE_INT32(len, IndAddrPtrTmp),
274         VMSTATE_UINT64(addr, IndAddrPtrTmp),
275         VMSTATE_END_OF_LIST()
276     }
277 };
278 
279 const VMStateDescription vmstate_ind_addr = {
280     .name = "s390_ind_addr_tmp",
281     .fields = (VMStateField[]) {
282         VMSTATE_WITH_TMP(IndAddr*, IndAddrPtrTmp, vmstate_ind_addr_tmp),
283         VMSTATE_END_OF_LIST()
284     }
285 };
286 
287 typedef struct CssImage {
288     SubchSet *sch_set[MAX_SSID + 1];
289     ChpInfo chpids[MAX_CHPID + 1];
290 } CssImage;
291 
292 static const VMStateDescription vmstate_css_img = {
293     .name = "s390_css_img",
294     .version_id = 1,
295     .minimum_version_id = 1,
296     .fields = (VMStateField[]) {
297         /* Subchannel sets have no relevant state. */
298         VMSTATE_STRUCT_ARRAY(chpids, CssImage, MAX_CHPID + 1, 0,
299                              vmstate_chp_info, ChpInfo),
300         VMSTATE_END_OF_LIST()
301     }
302 
303 };
304 
305 typedef struct IoAdapter {
306     uint32_t id;
307     uint8_t type;
308     uint8_t isc;
309     uint8_t flags;
310 } IoAdapter;
311 
312 typedef struct ChannelSubSys {
313     QTAILQ_HEAD(, CrwContainer) pending_crws;
314     bool sei_pending;
315     bool do_crw_mchk;
316     bool crws_lost;
317     uint8_t max_cssid;
318     uint8_t max_ssid;
319     bool chnmon_active;
320     uint64_t chnmon_area;
321     CssImage *css[MAX_CSSID + 1];
322     uint8_t default_cssid;
323     /* don't migrate, see css_register_io_adapters */
324     IoAdapter *io_adapters[CSS_IO_ADAPTER_TYPE_NUMS][MAX_ISC + 1];
325     /* don't migrate, see get_indicator and IndAddrPtrTmp */
326     QTAILQ_HEAD(, IndAddr) indicator_addresses;
327 } ChannelSubSys;
328 
329 static const VMStateDescription vmstate_css = {
330     .name = "s390_css",
331     .version_id = 1,
332     .minimum_version_id = 1,
333     .fields = (VMStateField[]) {
334         VMSTATE_QTAILQ_V(pending_crws, ChannelSubSys, 1, vmstate_crw_container,
335                          CrwContainer, sibling),
336         VMSTATE_BOOL(sei_pending, ChannelSubSys),
337         VMSTATE_BOOL(do_crw_mchk, ChannelSubSys),
338         VMSTATE_BOOL(crws_lost, ChannelSubSys),
339         /* These were kind of migrated by virtio */
340         VMSTATE_UINT8(max_cssid, ChannelSubSys),
341         VMSTATE_UINT8(max_ssid, ChannelSubSys),
342         VMSTATE_BOOL(chnmon_active, ChannelSubSys),
343         VMSTATE_UINT64(chnmon_area, ChannelSubSys),
344         VMSTATE_ARRAY_OF_POINTER_TO_STRUCT(css, ChannelSubSys, MAX_CSSID + 1,
345                 0, vmstate_css_img, CssImage),
346         VMSTATE_UINT8(default_cssid, ChannelSubSys),
347         VMSTATE_END_OF_LIST()
348     }
349 };
350 
351 static ChannelSubSys channel_subsys = {
352     .pending_crws = QTAILQ_HEAD_INITIALIZER(channel_subsys.pending_crws),
353     .do_crw_mchk = true,
354     .sei_pending = false,
355     .do_crw_mchk = true,
356     .crws_lost = false,
357     .chnmon_active = false,
358     .indicator_addresses =
359         QTAILQ_HEAD_INITIALIZER(channel_subsys.indicator_addresses),
360 };
361 
362 static int subch_dev_pre_save(void *opaque)
363 {
364     SubchDev *s = opaque;
365 
366     /* Prepare remote_schid for save */
367     s->migrated_schid = s->schid;
368 
369     return 0;
370 }
371 
372 static int subch_dev_post_load(void *opaque, int version_id)
373 {
374 
375     SubchDev *s = opaque;
376 
377     /* Re-assign the subchannel to remote_schid if necessary */
378     if (s->migrated_schid != s->schid) {
379         if (css_find_subch(true, s->cssid, s->ssid, s->schid) == s) {
380             /*
381              * Cleanup the slot before moving to s->migrated_schid provided
382              * it still belongs to us, i.e. it was not changed by previous
383              * invocation of this function.
384              */
385             css_subch_assign(s->cssid, s->ssid, s->schid, s->devno, NULL);
386         }
387         /* It's OK to re-assign without a prior de-assign. */
388         s->schid = s->migrated_schid;
389         css_subch_assign(s->cssid, s->ssid, s->schid, s->devno, s);
390     }
391 
392     if (css_migration_enabled()) {
393         /* No compat voodoo to do ;) */
394         return 0;
395     }
396     /*
397      * Hack alert. If we don't migrate the channel subsystem status
398      * we still need to find out if the guest enabled mss/mcss-e.
399      * If the subchannel is enabled, it certainly was able to access it,
400      * so adjust the max_ssid/max_cssid values for relevant ssid/cssid
401      * values. This is not watertight, but better than nothing.
402      */
403     if (s->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ENA) {
404         if (s->ssid) {
405             channel_subsys.max_ssid = MAX_SSID;
406         }
407         if (s->cssid != channel_subsys.default_cssid) {
408             channel_subsys.max_cssid = MAX_CSSID;
409         }
410     }
411     return 0;
412 }
413 
414 void css_register_vmstate(void)
415 {
416     vmstate_register(NULL, 0, &vmstate_css, &channel_subsys);
417 }
418 
419 IndAddr *get_indicator(hwaddr ind_addr, int len)
420 {
421     IndAddr *indicator;
422 
423     QTAILQ_FOREACH(indicator, &channel_subsys.indicator_addresses, sibling) {
424         if (indicator->addr == ind_addr) {
425             indicator->refcnt++;
426             return indicator;
427         }
428     }
429     indicator = g_new0(IndAddr, 1);
430     indicator->addr = ind_addr;
431     indicator->len = len;
432     indicator->refcnt = 1;
433     QTAILQ_INSERT_TAIL(&channel_subsys.indicator_addresses,
434                        indicator, sibling);
435     return indicator;
436 }
437 
438 static int s390_io_adapter_map(AdapterInfo *adapter, uint64_t map_addr,
439                                bool do_map)
440 {
441     S390FLICState *fs = s390_get_flic();
442     S390FLICStateClass *fsc = s390_get_flic_class(fs);
443 
444     return fsc->io_adapter_map(fs, adapter->adapter_id, map_addr, do_map);
445 }
446 
447 void release_indicator(AdapterInfo *adapter, IndAddr *indicator)
448 {
449     assert(indicator->refcnt > 0);
450     indicator->refcnt--;
451     if (indicator->refcnt > 0) {
452         return;
453     }
454     QTAILQ_REMOVE(&channel_subsys.indicator_addresses, indicator, sibling);
455     if (indicator->map) {
456         s390_io_adapter_map(adapter, indicator->map, false);
457     }
458     g_free(indicator);
459 }
460 
461 int map_indicator(AdapterInfo *adapter, IndAddr *indicator)
462 {
463     int ret;
464 
465     if (indicator->map) {
466         return 0; /* already mapped is not an error */
467     }
468     indicator->map = indicator->addr;
469     ret = s390_io_adapter_map(adapter, indicator->map, true);
470     if ((ret != 0) && (ret != -ENOSYS)) {
471         goto out_err;
472     }
473     return 0;
474 
475 out_err:
476     indicator->map = 0;
477     return ret;
478 }
479 
480 int css_create_css_image(uint8_t cssid, bool default_image)
481 {
482     trace_css_new_image(cssid, default_image ? "(default)" : "");
483     /* 255 is reserved */
484     if (cssid == 255) {
485         return -EINVAL;
486     }
487     if (channel_subsys.css[cssid]) {
488         return -EBUSY;
489     }
490     channel_subsys.css[cssid] = g_new0(CssImage, 1);
491     if (default_image) {
492         channel_subsys.default_cssid = cssid;
493     }
494     return 0;
495 }
496 
497 uint32_t css_get_adapter_id(CssIoAdapterType type, uint8_t isc)
498 {
499     if (type >= CSS_IO_ADAPTER_TYPE_NUMS || isc > MAX_ISC ||
500         !channel_subsys.io_adapters[type][isc]) {
501         return -1;
502     }
503 
504     return channel_subsys.io_adapters[type][isc]->id;
505 }
506 
507 /**
508  * css_register_io_adapters: Register I/O adapters per ISC during init
509  *
510  * @swap: an indication if byte swap is needed.
511  * @maskable: an indication if the adapter is subject to the mask operation.
512  * @flags: further characteristics of the adapter.
513  *         e.g. suppressible, an indication if the adapter is subject to AIS.
514  * @errp: location to store error information.
515  */
516 void css_register_io_adapters(CssIoAdapterType type, bool swap, bool maskable,
517                               uint8_t flags, Error **errp)
518 {
519     uint32_t id;
520     int ret, isc;
521     IoAdapter *adapter;
522     S390FLICState *fs = s390_get_flic();
523     S390FLICStateClass *fsc = s390_get_flic_class(fs);
524 
525     /*
526      * Disallow multiple registrations for the same device type.
527      * Report an error if registering for an already registered type.
528      */
529     if (channel_subsys.io_adapters[type][0]) {
530         error_setg(errp, "Adapters for type %d already registered", type);
531     }
532 
533     for (isc = 0; isc <= MAX_ISC; isc++) {
534         id = (type << 3) | isc;
535         ret = fsc->register_io_adapter(fs, id, isc, swap, maskable, flags);
536         if (ret == 0) {
537             adapter = g_new0(IoAdapter, 1);
538             adapter->id = id;
539             adapter->isc = isc;
540             adapter->type = type;
541             adapter->flags = flags;
542             channel_subsys.io_adapters[type][isc] = adapter;
543         } else {
544             error_setg_errno(errp, -ret, "Unexpected error %d when "
545                              "registering adapter %d", ret, id);
546             break;
547         }
548     }
549 
550     /*
551      * No need to free registered adapters in kvm: kvm will clean up
552      * when the machine goes away.
553      */
554     if (ret) {
555         for (isc--; isc >= 0; isc--) {
556             g_free(channel_subsys.io_adapters[type][isc]);
557             channel_subsys.io_adapters[type][isc] = NULL;
558         }
559     }
560 
561 }
562 
563 static void css_clear_io_interrupt(uint16_t subchannel_id,
564                                    uint16_t subchannel_nr)
565 {
566     Error *err = NULL;
567     static bool no_clear_irq;
568     S390FLICState *fs = s390_get_flic();
569     S390FLICStateClass *fsc = s390_get_flic_class(fs);
570     int r;
571 
572     if (unlikely(no_clear_irq)) {
573         return;
574     }
575     r = fsc->clear_io_irq(fs, subchannel_id, subchannel_nr);
576     switch (r) {
577     case 0:
578         break;
579     case -ENOSYS:
580         no_clear_irq = true;
581         /*
582         * Ignore unavailability, as the user can't do anything
583         * about it anyway.
584         */
585         break;
586     default:
587         error_setg_errno(&err, -r, "unexpected error condition");
588         error_propagate(&error_abort, err);
589     }
590 }
591 
592 static inline uint16_t css_do_build_subchannel_id(uint8_t cssid, uint8_t ssid)
593 {
594     if (channel_subsys.max_cssid > 0) {
595         return (cssid << 8) | (1 << 3) | (ssid << 1) | 1;
596     }
597     return (ssid << 1) | 1;
598 }
599 
600 uint16_t css_build_subchannel_id(SubchDev *sch)
601 {
602     return css_do_build_subchannel_id(sch->cssid, sch->ssid);
603 }
604 
605 void css_inject_io_interrupt(SubchDev *sch)
606 {
607     uint8_t isc = (sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ISC) >> 11;
608 
609     trace_css_io_interrupt(sch->cssid, sch->ssid, sch->schid,
610                            sch->curr_status.pmcw.intparm, isc, "");
611     s390_io_interrupt(css_build_subchannel_id(sch),
612                       sch->schid,
613                       sch->curr_status.pmcw.intparm,
614                       isc << 27);
615 }
616 
617 void css_conditional_io_interrupt(SubchDev *sch)
618 {
619     /*
620      * If the subchannel is not currently status pending, make it pending
621      * with alert status.
622      */
623     if (!(sch->curr_status.scsw.ctrl & SCSW_STCTL_STATUS_PEND)) {
624         uint8_t isc = (sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ISC) >> 11;
625 
626         trace_css_io_interrupt(sch->cssid, sch->ssid, sch->schid,
627                                sch->curr_status.pmcw.intparm, isc,
628                                "(unsolicited)");
629         sch->curr_status.scsw.ctrl &= ~SCSW_CTRL_MASK_STCTL;
630         sch->curr_status.scsw.ctrl |=
631             SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
632         /* Inject an I/O interrupt. */
633         s390_io_interrupt(css_build_subchannel_id(sch),
634                           sch->schid,
635                           sch->curr_status.pmcw.intparm,
636                           isc << 27);
637     }
638 }
639 
640 int css_do_sic(CPUS390XState *env, uint8_t isc, uint16_t mode)
641 {
642     S390FLICState *fs = s390_get_flic();
643     S390FLICStateClass *fsc = s390_get_flic_class(fs);
644     int r;
645 
646     if (env->psw.mask & PSW_MASK_PSTATE) {
647         r = -PGM_PRIVILEGED;
648         goto out;
649     }
650 
651     trace_css_do_sic(mode, isc);
652     switch (mode) {
653     case SIC_IRQ_MODE_ALL:
654     case SIC_IRQ_MODE_SINGLE:
655         break;
656     default:
657         r = -PGM_OPERAND;
658         goto out;
659     }
660 
661     r = fsc->modify_ais_mode(fs, isc, mode) ? -PGM_OPERATION : 0;
662 out:
663     return r;
664 }
665 
666 void css_adapter_interrupt(CssIoAdapterType type, uint8_t isc)
667 {
668     S390FLICState *fs = s390_get_flic();
669     S390FLICStateClass *fsc = s390_get_flic_class(fs);
670     uint32_t io_int_word = (isc << 27) | IO_INT_WORD_AI;
671     IoAdapter *adapter = channel_subsys.io_adapters[type][isc];
672 
673     if (!adapter) {
674         return;
675     }
676 
677     trace_css_adapter_interrupt(isc);
678     if (fs->ais_supported) {
679         if (fsc->inject_airq(fs, type, isc, adapter->flags)) {
680             error_report("Failed to inject airq with AIS supported");
681             exit(1);
682         }
683     } else {
684         s390_io_interrupt(0, 0, 0, io_int_word);
685     }
686 }
687 
688 static void sch_handle_clear_func(SubchDev *sch)
689 {
690     PMCW *p = &sch->curr_status.pmcw;
691     SCSW *s = &sch->curr_status.scsw;
692     int path;
693 
694     /* Path management: In our simple css, we always choose the only path. */
695     path = 0x80;
696 
697     /* Reset values prior to 'issuing the clear signal'. */
698     p->lpum = 0;
699     p->pom = 0xff;
700     s->flags &= ~SCSW_FLAGS_MASK_PNO;
701 
702     /* We always 'attempt to issue the clear signal', and we always succeed. */
703     sch->channel_prog = 0x0;
704     sch->last_cmd_valid = false;
705     s->ctrl &= ~SCSW_ACTL_CLEAR_PEND;
706     s->ctrl |= SCSW_STCTL_STATUS_PEND;
707 
708     s->dstat = 0;
709     s->cstat = 0;
710     p->lpum = path;
711 
712 }
713 
714 static void sch_handle_halt_func(SubchDev *sch)
715 {
716 
717     PMCW *p = &sch->curr_status.pmcw;
718     SCSW *s = &sch->curr_status.scsw;
719     hwaddr curr_ccw = sch->channel_prog;
720     int path;
721 
722     /* Path management: In our simple css, we always choose the only path. */
723     path = 0x80;
724 
725     /* We always 'attempt to issue the halt signal', and we always succeed. */
726     sch->channel_prog = 0x0;
727     sch->last_cmd_valid = false;
728     s->ctrl &= ~SCSW_ACTL_HALT_PEND;
729     s->ctrl |= SCSW_STCTL_STATUS_PEND;
730 
731     if ((s->ctrl & (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) ||
732         !((s->ctrl & SCSW_ACTL_START_PEND) ||
733           (s->ctrl & SCSW_ACTL_SUSP))) {
734         s->dstat = SCSW_DSTAT_DEVICE_END;
735     }
736     if ((s->ctrl & (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) ||
737         (s->ctrl & SCSW_ACTL_SUSP)) {
738         s->cpa = curr_ccw + 8;
739     }
740     s->cstat = 0;
741     p->lpum = path;
742 
743 }
744 
745 static void copy_sense_id_to_guest(SenseId *dest, SenseId *src)
746 {
747     int i;
748 
749     dest->reserved = src->reserved;
750     dest->cu_type = cpu_to_be16(src->cu_type);
751     dest->cu_model = src->cu_model;
752     dest->dev_type = cpu_to_be16(src->dev_type);
753     dest->dev_model = src->dev_model;
754     dest->unused = src->unused;
755     for (i = 0; i < ARRAY_SIZE(dest->ciw); i++) {
756         dest->ciw[i].type = src->ciw[i].type;
757         dest->ciw[i].command = src->ciw[i].command;
758         dest->ciw[i].count = cpu_to_be16(src->ciw[i].count);
759     }
760 }
761 
762 static CCW1 copy_ccw_from_guest(hwaddr addr, bool fmt1)
763 {
764     CCW0 tmp0;
765     CCW1 tmp1;
766     CCW1 ret;
767 
768     if (fmt1) {
769         cpu_physical_memory_read(addr, &tmp1, sizeof(tmp1));
770         ret.cmd_code = tmp1.cmd_code;
771         ret.flags = tmp1.flags;
772         ret.count = be16_to_cpu(tmp1.count);
773         ret.cda = be32_to_cpu(tmp1.cda);
774     } else {
775         cpu_physical_memory_read(addr, &tmp0, sizeof(tmp0));
776         if ((tmp0.cmd_code & 0x0f) == CCW_CMD_TIC) {
777             ret.cmd_code = CCW_CMD_TIC;
778             ret.flags = 0;
779             ret.count = 0;
780         } else {
781             ret.cmd_code = tmp0.cmd_code;
782             ret.flags = tmp0.flags;
783             ret.count = be16_to_cpu(tmp0.count);
784         }
785         ret.cda = be16_to_cpu(tmp0.cda1) | (tmp0.cda0 << 16);
786     }
787     return ret;
788 }
789 /**
790  * If out of bounds marks the stream broken. If broken returns -EINVAL,
791  * otherwise the requested length (may be zero)
792  */
793 static inline int cds_check_len(CcwDataStream *cds, int len)
794 {
795     if (cds->at_byte + len > cds->count) {
796         cds->flags |= CDS_F_STREAM_BROKEN;
797     }
798     return cds->flags & CDS_F_STREAM_BROKEN ? -EINVAL : len;
799 }
800 
801 static inline bool cds_ccw_addrs_ok(hwaddr addr, int len, bool ccw_fmt1)
802 {
803     return (addr + len) < (ccw_fmt1 ? (1UL << 31) : (1UL << 24));
804 }
805 
806 static int ccw_dstream_rw_noflags(CcwDataStream *cds, void *buff, int len,
807                                   CcwDataStreamOp op)
808 {
809     int ret;
810 
811     ret = cds_check_len(cds, len);
812     if (ret <= 0) {
813         return ret;
814     }
815     if (!cds_ccw_addrs_ok(cds->cda, len, cds->flags & CDS_F_FMT)) {
816         return -EINVAL; /* channel program check */
817     }
818     if (op == CDS_OP_A) {
819         goto incr;
820     }
821     ret = address_space_rw(&address_space_memory, cds->cda,
822                            MEMTXATTRS_UNSPECIFIED, buff, len, op);
823     if (ret != MEMTX_OK) {
824         cds->flags |= CDS_F_STREAM_BROKEN;
825         return -EINVAL;
826     }
827 incr:
828     cds->at_byte += len;
829     cds->cda += len;
830     return 0;
831 }
832 
833 /* returns values between 1 and bsz, where bsz is a power of 2 */
834 static inline uint16_t ida_continuous_left(hwaddr cda, uint64_t bsz)
835 {
836     return bsz - (cda & (bsz - 1));
837 }
838 
839 static inline uint64_t ccw_ida_block_size(uint8_t flags)
840 {
841     if ((flags & CDS_F_C64) && !(flags & CDS_F_I2K)) {
842         return 1ULL << 12;
843     }
844     return 1ULL << 11;
845 }
846 
847 static inline int ida_read_next_idaw(CcwDataStream *cds)
848 {
849     union {uint64_t fmt2; uint32_t fmt1; } idaw;
850     int ret;
851     hwaddr idaw_addr;
852     bool idaw_fmt2 = cds->flags & CDS_F_C64;
853     bool ccw_fmt1 = cds->flags & CDS_F_FMT;
854 
855     if (idaw_fmt2) {
856         idaw_addr = cds->cda_orig + sizeof(idaw.fmt2) * cds->at_idaw;
857         if (idaw_addr & 0x07 || !cds_ccw_addrs_ok(idaw_addr, 0, ccw_fmt1)) {
858             return -EINVAL; /* channel program check */
859         }
860         ret = address_space_rw(&address_space_memory, idaw_addr,
861                                MEMTXATTRS_UNSPECIFIED, (void *) &idaw.fmt2,
862                                sizeof(idaw.fmt2), false);
863         cds->cda = be64_to_cpu(idaw.fmt2);
864     } else {
865         idaw_addr = cds->cda_orig + sizeof(idaw.fmt1) * cds->at_idaw;
866         if (idaw_addr & 0x03 || !cds_ccw_addrs_ok(idaw_addr, 0, ccw_fmt1)) {
867             return -EINVAL; /* channel program check */
868         }
869         ret = address_space_rw(&address_space_memory, idaw_addr,
870                                MEMTXATTRS_UNSPECIFIED, (void *) &idaw.fmt1,
871                                sizeof(idaw.fmt1), false);
872         cds->cda = be64_to_cpu(idaw.fmt1);
873         if (cds->cda & 0x80000000) {
874             return -EINVAL; /* channel program check */
875         }
876     }
877     ++(cds->at_idaw);
878     if (ret != MEMTX_OK) {
879         /* assume inaccessible address */
880         return -EINVAL; /* channel program check */
881     }
882     return 0;
883 }
884 
885 static int ccw_dstream_rw_ida(CcwDataStream *cds, void *buff, int len,
886                               CcwDataStreamOp op)
887 {
888     uint64_t bsz = ccw_ida_block_size(cds->flags);
889     int ret = 0;
890     uint16_t cont_left, iter_len;
891 
892     ret = cds_check_len(cds, len);
893     if (ret <= 0) {
894         return ret;
895     }
896     if (!cds->at_idaw) {
897         /* read first idaw */
898         ret = ida_read_next_idaw(cds);
899         if (ret) {
900             goto err;
901         }
902         cont_left = ida_continuous_left(cds->cda, bsz);
903     } else {
904         cont_left = ida_continuous_left(cds->cda, bsz);
905         if (cont_left == bsz) {
906             ret = ida_read_next_idaw(cds);
907             if (ret) {
908                 goto err;
909             }
910             if (cds->cda & (bsz - 1)) {
911                 ret = -EINVAL; /* channel program check */
912                 goto err;
913             }
914         }
915     }
916     do {
917         iter_len = MIN(len, cont_left);
918         if (op != CDS_OP_A) {
919             ret = address_space_rw(&address_space_memory, cds->cda,
920                                    MEMTXATTRS_UNSPECIFIED, buff, iter_len, op);
921             if (ret != MEMTX_OK) {
922                 /* assume inaccessible address */
923                 ret = -EINVAL; /* channel program check */
924                 goto err;
925             }
926         }
927         cds->at_byte += iter_len;
928         cds->cda += iter_len;
929         len -= iter_len;
930         if (!len) {
931             break;
932         }
933         ret = ida_read_next_idaw(cds);
934         if (ret) {
935             goto err;
936         }
937         cont_left = bsz;
938     } while (true);
939     return ret;
940 err:
941     cds->flags |= CDS_F_STREAM_BROKEN;
942     return ret;
943 }
944 
945 void ccw_dstream_init(CcwDataStream *cds, CCW1 const *ccw, ORB const *orb)
946 {
947     /*
948      * We don't support MIDA (an optional facility) yet and we
949      * catch this earlier. Just for expressing the precondition.
950      */
951     g_assert(!(orb->ctrl1 & ORB_CTRL1_MASK_MIDAW));
952     cds->flags = (orb->ctrl0 & ORB_CTRL0_MASK_I2K ? CDS_F_I2K : 0) |
953                  (orb->ctrl0 & ORB_CTRL0_MASK_C64 ? CDS_F_C64 : 0) |
954                  (orb->ctrl0 & ORB_CTRL0_MASK_FMT ? CDS_F_FMT : 0) |
955                  (ccw->flags & CCW_FLAG_IDA ? CDS_F_IDA : 0);
956 
957     cds->count = ccw->count;
958     cds->cda_orig = ccw->cda;
959     ccw_dstream_rewind(cds);
960     if (!(cds->flags & CDS_F_IDA)) {
961         cds->op_handler = ccw_dstream_rw_noflags;
962     } else {
963         cds->op_handler = ccw_dstream_rw_ida;
964     }
965 }
966 
967 static int css_interpret_ccw(SubchDev *sch, hwaddr ccw_addr,
968                              bool suspend_allowed)
969 {
970     int ret;
971     bool check_len;
972     int len;
973     CCW1 ccw;
974 
975     if (!ccw_addr) {
976         return -EINVAL; /* channel-program check */
977     }
978     /* Check doubleword aligned and 31 or 24 (fmt 0) bit addressable. */
979     if (ccw_addr & (sch->ccw_fmt_1 ? 0x80000007 : 0xff000007)) {
980         return -EINVAL;
981     }
982 
983     /* Translate everything to format-1 ccws - the information is the same. */
984     ccw = copy_ccw_from_guest(ccw_addr, sch->ccw_fmt_1);
985 
986     /* Check for invalid command codes. */
987     if ((ccw.cmd_code & 0x0f) == 0) {
988         return -EINVAL;
989     }
990     if (((ccw.cmd_code & 0x0f) == CCW_CMD_TIC) &&
991         ((ccw.cmd_code & 0xf0) != 0)) {
992         return -EINVAL;
993     }
994     if (!sch->ccw_fmt_1 && (ccw.count == 0) &&
995         (ccw.cmd_code != CCW_CMD_TIC)) {
996         return -EINVAL;
997     }
998 
999     /* We don't support MIDA. */
1000     if (ccw.flags & CCW_FLAG_MIDA) {
1001         return -EINVAL;
1002     }
1003 
1004     if (ccw.flags & CCW_FLAG_SUSPEND) {
1005         return suspend_allowed ? -EINPROGRESS : -EINVAL;
1006     }
1007 
1008     check_len = !((ccw.flags & CCW_FLAG_SLI) && !(ccw.flags & CCW_FLAG_DC));
1009 
1010     if (!ccw.cda) {
1011         if (sch->ccw_no_data_cnt == 255) {
1012             return -EINVAL;
1013         }
1014         sch->ccw_no_data_cnt++;
1015     }
1016 
1017     /* Look at the command. */
1018     ccw_dstream_init(&sch->cds, &ccw, &(sch->orb));
1019     switch (ccw.cmd_code) {
1020     case CCW_CMD_NOOP:
1021         /* Nothing to do. */
1022         ret = 0;
1023         break;
1024     case CCW_CMD_BASIC_SENSE:
1025         if (check_len) {
1026             if (ccw.count != sizeof(sch->sense_data)) {
1027                 ret = -EINVAL;
1028                 break;
1029             }
1030         }
1031         len = MIN(ccw.count, sizeof(sch->sense_data));
1032         ccw_dstream_write_buf(&sch->cds, sch->sense_data, len);
1033         sch->curr_status.scsw.count = ccw_dstream_residual_count(&sch->cds);
1034         memset(sch->sense_data, 0, sizeof(sch->sense_data));
1035         ret = 0;
1036         break;
1037     case CCW_CMD_SENSE_ID:
1038     {
1039         SenseId sense_id;
1040 
1041         copy_sense_id_to_guest(&sense_id, &sch->id);
1042         /* Sense ID information is device specific. */
1043         if (check_len) {
1044             if (ccw.count != sizeof(sense_id)) {
1045                 ret = -EINVAL;
1046                 break;
1047             }
1048         }
1049         len = MIN(ccw.count, sizeof(sense_id));
1050         /*
1051          * Only indicate 0xff in the first sense byte if we actually
1052          * have enough place to store at least bytes 0-3.
1053          */
1054         if (len >= 4) {
1055             sense_id.reserved = 0xff;
1056         } else {
1057             sense_id.reserved = 0;
1058         }
1059         ccw_dstream_write_buf(&sch->cds, &sense_id, len);
1060         sch->curr_status.scsw.count = ccw_dstream_residual_count(&sch->cds);
1061         ret = 0;
1062         break;
1063     }
1064     case CCW_CMD_TIC:
1065         if (sch->last_cmd_valid && (sch->last_cmd.cmd_code == CCW_CMD_TIC)) {
1066             ret = -EINVAL;
1067             break;
1068         }
1069         if (ccw.flags || ccw.count) {
1070             /* We have already sanitized these if converted from fmt 0. */
1071             ret = -EINVAL;
1072             break;
1073         }
1074         sch->channel_prog = ccw.cda;
1075         ret = -EAGAIN;
1076         break;
1077     default:
1078         if (sch->ccw_cb) {
1079             /* Handle device specific commands. */
1080             ret = sch->ccw_cb(sch, ccw);
1081         } else {
1082             ret = -ENOSYS;
1083         }
1084         break;
1085     }
1086     sch->last_cmd = ccw;
1087     sch->last_cmd_valid = true;
1088     if (ret == 0) {
1089         if (ccw.flags & CCW_FLAG_CC) {
1090             sch->channel_prog += 8;
1091             ret = -EAGAIN;
1092         }
1093     }
1094 
1095     return ret;
1096 }
1097 
1098 static void sch_handle_start_func_virtual(SubchDev *sch)
1099 {
1100 
1101     PMCW *p = &sch->curr_status.pmcw;
1102     SCSW *s = &sch->curr_status.scsw;
1103     int path;
1104     int ret;
1105     bool suspend_allowed;
1106 
1107     /* Path management: In our simple css, we always choose the only path. */
1108     path = 0x80;
1109 
1110     if (!(s->ctrl & SCSW_ACTL_SUSP)) {
1111         /* Start Function triggered via ssch, i.e. we have an ORB */
1112         ORB *orb = &sch->orb;
1113         s->cstat = 0;
1114         s->dstat = 0;
1115         /* Look at the orb and try to execute the channel program. */
1116         p->intparm = orb->intparm;
1117         if (!(orb->lpm & path)) {
1118             /* Generate a deferred cc 3 condition. */
1119             s->flags |= SCSW_FLAGS_MASK_CC;
1120             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
1121             s->ctrl |= (SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND);
1122             return;
1123         }
1124         sch->ccw_fmt_1 = !!(orb->ctrl0 & ORB_CTRL0_MASK_FMT);
1125         s->flags |= (sch->ccw_fmt_1) ? SCSW_FLAGS_MASK_FMT : 0;
1126         sch->ccw_no_data_cnt = 0;
1127         suspend_allowed = !!(orb->ctrl0 & ORB_CTRL0_MASK_SPND);
1128     } else {
1129         /* Start Function resumed via rsch */
1130         s->ctrl &= ~(SCSW_ACTL_SUSP | SCSW_ACTL_RESUME_PEND);
1131         /* The channel program had been suspended before. */
1132         suspend_allowed = true;
1133     }
1134     sch->last_cmd_valid = false;
1135     do {
1136         ret = css_interpret_ccw(sch, sch->channel_prog, suspend_allowed);
1137         switch (ret) {
1138         case -EAGAIN:
1139             /* ccw chain, continue processing */
1140             break;
1141         case 0:
1142             /* success */
1143             s->ctrl &= ~SCSW_ACTL_START_PEND;
1144             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
1145             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
1146                     SCSW_STCTL_STATUS_PEND;
1147             s->dstat = SCSW_DSTAT_CHANNEL_END | SCSW_DSTAT_DEVICE_END;
1148             s->cpa = sch->channel_prog + 8;
1149             break;
1150         case -EIO:
1151             /* I/O errors, status depends on specific devices */
1152             break;
1153         case -ENOSYS:
1154             /* unsupported command, generate unit check (command reject) */
1155             s->ctrl &= ~SCSW_ACTL_START_PEND;
1156             s->dstat = SCSW_DSTAT_UNIT_CHECK;
1157             /* Set sense bit 0 in ecw0. */
1158             sch->sense_data[0] = 0x80;
1159             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
1160             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
1161                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
1162             s->cpa = sch->channel_prog + 8;
1163             break;
1164         case -EINPROGRESS:
1165             /* channel program has been suspended */
1166             s->ctrl &= ~SCSW_ACTL_START_PEND;
1167             s->ctrl |= SCSW_ACTL_SUSP;
1168             break;
1169         default:
1170             /* error, generate channel program check */
1171             s->ctrl &= ~SCSW_ACTL_START_PEND;
1172             s->cstat = SCSW_CSTAT_PROG_CHECK;
1173             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
1174             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
1175                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
1176             s->cpa = sch->channel_prog + 8;
1177             break;
1178         }
1179     } while (ret == -EAGAIN);
1180 
1181 }
1182 
1183 static IOInstEnding sch_handle_start_func_passthrough(SubchDev *sch)
1184 {
1185 
1186     PMCW *p = &sch->curr_status.pmcw;
1187     SCSW *s = &sch->curr_status.scsw;
1188 
1189     ORB *orb = &sch->orb;
1190     if (!(s->ctrl & SCSW_ACTL_SUSP)) {
1191         assert(orb != NULL);
1192         p->intparm = orb->intparm;
1193     }
1194 
1195     /*
1196      * Only support prefetch enable mode.
1197      * Only support 64bit addressing idal.
1198      */
1199     if (!(orb->ctrl0 & ORB_CTRL0_MASK_PFCH) ||
1200         !(orb->ctrl0 & ORB_CTRL0_MASK_C64)) {
1201         warn_report("vfio-ccw requires PFCH and C64 flags set");
1202         sch_gen_unit_exception(sch);
1203         css_inject_io_interrupt(sch);
1204         return IOINST_CC_EXPECTED;
1205     }
1206     return s390_ccw_cmd_request(sch);
1207 }
1208 
1209 /*
1210  * On real machines, this would run asynchronously to the main vcpus.
1211  * We might want to make some parts of the ssch handling (interpreting
1212  * read/writes) asynchronous later on if we start supporting more than
1213  * our current very simple devices.
1214  */
1215 IOInstEnding do_subchannel_work_virtual(SubchDev *sch)
1216 {
1217 
1218     SCSW *s = &sch->curr_status.scsw;
1219 
1220     if (s->ctrl & SCSW_FCTL_CLEAR_FUNC) {
1221         sch_handle_clear_func(sch);
1222     } else if (s->ctrl & SCSW_FCTL_HALT_FUNC) {
1223         sch_handle_halt_func(sch);
1224     } else if (s->ctrl & SCSW_FCTL_START_FUNC) {
1225         /* Triggered by both ssch and rsch. */
1226         sch_handle_start_func_virtual(sch);
1227     }
1228     css_inject_io_interrupt(sch);
1229     /* inst must succeed if this func is called */
1230     return IOINST_CC_EXPECTED;
1231 }
1232 
1233 IOInstEnding do_subchannel_work_passthrough(SubchDev *sch)
1234 {
1235     SCSW *s = &sch->curr_status.scsw;
1236 
1237     if (s->ctrl & SCSW_FCTL_CLEAR_FUNC) {
1238         /* TODO: Clear handling */
1239         sch_handle_clear_func(sch);
1240     } else if (s->ctrl & SCSW_FCTL_HALT_FUNC) {
1241         /* TODO: Halt handling */
1242         sch_handle_halt_func(sch);
1243     } else if (s->ctrl & SCSW_FCTL_START_FUNC) {
1244         return sch_handle_start_func_passthrough(sch);
1245     }
1246     return IOINST_CC_EXPECTED;
1247 }
1248 
1249 static IOInstEnding do_subchannel_work(SubchDev *sch)
1250 {
1251     if (!sch->do_subchannel_work) {
1252         return IOINST_CC_STATUS_PRESENT;
1253     }
1254     g_assert(sch->curr_status.scsw.ctrl & SCSW_CTRL_MASK_FCTL);
1255     return sch->do_subchannel_work(sch);
1256 }
1257 
1258 static void copy_pmcw_to_guest(PMCW *dest, const PMCW *src)
1259 {
1260     int i;
1261 
1262     dest->intparm = cpu_to_be32(src->intparm);
1263     dest->flags = cpu_to_be16(src->flags);
1264     dest->devno = cpu_to_be16(src->devno);
1265     dest->lpm = src->lpm;
1266     dest->pnom = src->pnom;
1267     dest->lpum = src->lpum;
1268     dest->pim = src->pim;
1269     dest->mbi = cpu_to_be16(src->mbi);
1270     dest->pom = src->pom;
1271     dest->pam = src->pam;
1272     for (i = 0; i < ARRAY_SIZE(dest->chpid); i++) {
1273         dest->chpid[i] = src->chpid[i];
1274     }
1275     dest->chars = cpu_to_be32(src->chars);
1276 }
1277 
1278 void copy_scsw_to_guest(SCSW *dest, const SCSW *src)
1279 {
1280     dest->flags = cpu_to_be16(src->flags);
1281     dest->ctrl = cpu_to_be16(src->ctrl);
1282     dest->cpa = cpu_to_be32(src->cpa);
1283     dest->dstat = src->dstat;
1284     dest->cstat = src->cstat;
1285     dest->count = cpu_to_be16(src->count);
1286 }
1287 
1288 static void copy_schib_to_guest(SCHIB *dest, const SCHIB *src)
1289 {
1290     int i;
1291 
1292     copy_pmcw_to_guest(&dest->pmcw, &src->pmcw);
1293     copy_scsw_to_guest(&dest->scsw, &src->scsw);
1294     dest->mba = cpu_to_be64(src->mba);
1295     for (i = 0; i < ARRAY_SIZE(dest->mda); i++) {
1296         dest->mda[i] = src->mda[i];
1297     }
1298 }
1299 
1300 int css_do_stsch(SubchDev *sch, SCHIB *schib)
1301 {
1302     /* Use current status. */
1303     copy_schib_to_guest(schib, &sch->curr_status);
1304     return 0;
1305 }
1306 
1307 static void copy_pmcw_from_guest(PMCW *dest, const PMCW *src)
1308 {
1309     int i;
1310 
1311     dest->intparm = be32_to_cpu(src->intparm);
1312     dest->flags = be16_to_cpu(src->flags);
1313     dest->devno = be16_to_cpu(src->devno);
1314     dest->lpm = src->lpm;
1315     dest->pnom = src->pnom;
1316     dest->lpum = src->lpum;
1317     dest->pim = src->pim;
1318     dest->mbi = be16_to_cpu(src->mbi);
1319     dest->pom = src->pom;
1320     dest->pam = src->pam;
1321     for (i = 0; i < ARRAY_SIZE(dest->chpid); i++) {
1322         dest->chpid[i] = src->chpid[i];
1323     }
1324     dest->chars = be32_to_cpu(src->chars);
1325 }
1326 
1327 static void copy_scsw_from_guest(SCSW *dest, const SCSW *src)
1328 {
1329     dest->flags = be16_to_cpu(src->flags);
1330     dest->ctrl = be16_to_cpu(src->ctrl);
1331     dest->cpa = be32_to_cpu(src->cpa);
1332     dest->dstat = src->dstat;
1333     dest->cstat = src->cstat;
1334     dest->count = be16_to_cpu(src->count);
1335 }
1336 
1337 static void copy_schib_from_guest(SCHIB *dest, const SCHIB *src)
1338 {
1339     int i;
1340 
1341     copy_pmcw_from_guest(&dest->pmcw, &src->pmcw);
1342     copy_scsw_from_guest(&dest->scsw, &src->scsw);
1343     dest->mba = be64_to_cpu(src->mba);
1344     for (i = 0; i < ARRAY_SIZE(dest->mda); i++) {
1345         dest->mda[i] = src->mda[i];
1346     }
1347 }
1348 
1349 IOInstEnding css_do_msch(SubchDev *sch, const SCHIB *orig_schib)
1350 {
1351     SCSW *s = &sch->curr_status.scsw;
1352     PMCW *p = &sch->curr_status.pmcw;
1353     uint16_t oldflags;
1354     SCHIB schib;
1355 
1356     if (!(sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_DNV)) {
1357         return IOINST_CC_EXPECTED;
1358     }
1359 
1360     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
1361         return IOINST_CC_STATUS_PRESENT;
1362     }
1363 
1364     if (s->ctrl &
1365         (SCSW_FCTL_START_FUNC|SCSW_FCTL_HALT_FUNC|SCSW_FCTL_CLEAR_FUNC)) {
1366         return IOINST_CC_BUSY;
1367     }
1368 
1369     copy_schib_from_guest(&schib, orig_schib);
1370     /* Only update the program-modifiable fields. */
1371     p->intparm = schib.pmcw.intparm;
1372     oldflags = p->flags;
1373     p->flags &= ~(PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
1374                   PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
1375                   PMCW_FLAGS_MASK_MP);
1376     p->flags |= schib.pmcw.flags &
1377             (PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
1378              PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
1379              PMCW_FLAGS_MASK_MP);
1380     p->lpm = schib.pmcw.lpm;
1381     p->mbi = schib.pmcw.mbi;
1382     p->pom = schib.pmcw.pom;
1383     p->chars &= ~(PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_CSENSE);
1384     p->chars |= schib.pmcw.chars &
1385             (PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_CSENSE);
1386     sch->curr_status.mba = schib.mba;
1387 
1388     /* Has the channel been disabled? */
1389     if (sch->disable_cb && (oldflags & PMCW_FLAGS_MASK_ENA) != 0
1390         && (p->flags & PMCW_FLAGS_MASK_ENA) == 0) {
1391         sch->disable_cb(sch);
1392     }
1393     return IOINST_CC_EXPECTED;
1394 }
1395 
1396 IOInstEnding css_do_xsch(SubchDev *sch)
1397 {
1398     SCSW *s = &sch->curr_status.scsw;
1399     PMCW *p = &sch->curr_status.pmcw;
1400 
1401     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
1402         return IOINST_CC_NOT_OPERATIONAL;
1403     }
1404 
1405     if (s->ctrl & SCSW_CTRL_MASK_STCTL) {
1406         return IOINST_CC_STATUS_PRESENT;
1407     }
1408 
1409     if (!(s->ctrl & SCSW_CTRL_MASK_FCTL) ||
1410         ((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||
1411         (!(s->ctrl &
1412            (SCSW_ACTL_RESUME_PEND | SCSW_ACTL_START_PEND | SCSW_ACTL_SUSP))) ||
1413         (s->ctrl & SCSW_ACTL_SUBCH_ACTIVE)) {
1414         return IOINST_CC_BUSY;
1415     }
1416 
1417     /* Cancel the current operation. */
1418     s->ctrl &= ~(SCSW_FCTL_START_FUNC |
1419                  SCSW_ACTL_RESUME_PEND |
1420                  SCSW_ACTL_START_PEND |
1421                  SCSW_ACTL_SUSP);
1422     sch->channel_prog = 0x0;
1423     sch->last_cmd_valid = false;
1424     s->dstat = 0;
1425     s->cstat = 0;
1426     return IOINST_CC_EXPECTED;
1427 }
1428 
1429 IOInstEnding css_do_csch(SubchDev *sch)
1430 {
1431     SCSW *s = &sch->curr_status.scsw;
1432     PMCW *p = &sch->curr_status.pmcw;
1433 
1434     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
1435         return IOINST_CC_NOT_OPERATIONAL;
1436     }
1437 
1438     /* Trigger the clear function. */
1439     s->ctrl &= ~(SCSW_CTRL_MASK_FCTL | SCSW_CTRL_MASK_ACTL);
1440     s->ctrl |= SCSW_FCTL_CLEAR_FUNC | SCSW_ACTL_CLEAR_PEND;
1441 
1442     return do_subchannel_work(sch);
1443 }
1444 
1445 IOInstEnding css_do_hsch(SubchDev *sch)
1446 {
1447     SCSW *s = &sch->curr_status.scsw;
1448     PMCW *p = &sch->curr_status.pmcw;
1449 
1450     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
1451         return IOINST_CC_NOT_OPERATIONAL;
1452     }
1453 
1454     if (((s->ctrl & SCSW_CTRL_MASK_STCTL) == SCSW_STCTL_STATUS_PEND) ||
1455         (s->ctrl & (SCSW_STCTL_PRIMARY |
1456                     SCSW_STCTL_SECONDARY |
1457                     SCSW_STCTL_ALERT))) {
1458         return IOINST_CC_STATUS_PRESENT;
1459     }
1460 
1461     if (s->ctrl & (SCSW_FCTL_HALT_FUNC | SCSW_FCTL_CLEAR_FUNC)) {
1462         return IOINST_CC_BUSY;
1463     }
1464 
1465     /* Trigger the halt function. */
1466     s->ctrl |= SCSW_FCTL_HALT_FUNC;
1467     s->ctrl &= ~SCSW_FCTL_START_FUNC;
1468     if (((s->ctrl & SCSW_CTRL_MASK_ACTL) ==
1469          (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) &&
1470         ((s->ctrl & SCSW_CTRL_MASK_STCTL) == SCSW_STCTL_INTERMEDIATE)) {
1471         s->ctrl &= ~SCSW_STCTL_STATUS_PEND;
1472     }
1473     s->ctrl |= SCSW_ACTL_HALT_PEND;
1474 
1475     return do_subchannel_work(sch);
1476 }
1477 
1478 static void css_update_chnmon(SubchDev *sch)
1479 {
1480     if (!(sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_MME)) {
1481         /* Not active. */
1482         return;
1483     }
1484     /* The counter is conveniently located at the beginning of the struct. */
1485     if (sch->curr_status.pmcw.chars & PMCW_CHARS_MASK_MBFC) {
1486         /* Format 1, per-subchannel area. */
1487         uint32_t count;
1488 
1489         count = address_space_ldl(&address_space_memory,
1490                                   sch->curr_status.mba,
1491                                   MEMTXATTRS_UNSPECIFIED,
1492                                   NULL);
1493         count++;
1494         address_space_stl(&address_space_memory, sch->curr_status.mba, count,
1495                           MEMTXATTRS_UNSPECIFIED, NULL);
1496     } else {
1497         /* Format 0, global area. */
1498         uint32_t offset;
1499         uint16_t count;
1500 
1501         offset = sch->curr_status.pmcw.mbi << 5;
1502         count = address_space_lduw(&address_space_memory,
1503                                    channel_subsys.chnmon_area + offset,
1504                                    MEMTXATTRS_UNSPECIFIED,
1505                                    NULL);
1506         count++;
1507         address_space_stw(&address_space_memory,
1508                           channel_subsys.chnmon_area + offset, count,
1509                           MEMTXATTRS_UNSPECIFIED, NULL);
1510     }
1511 }
1512 
1513 IOInstEnding css_do_ssch(SubchDev *sch, ORB *orb)
1514 {
1515     SCSW *s = &sch->curr_status.scsw;
1516     PMCW *p = &sch->curr_status.pmcw;
1517 
1518     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
1519         return IOINST_CC_NOT_OPERATIONAL;
1520     }
1521 
1522     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
1523         return IOINST_CC_STATUS_PRESENT;
1524     }
1525 
1526     if (s->ctrl & (SCSW_FCTL_START_FUNC |
1527                    SCSW_FCTL_HALT_FUNC |
1528                    SCSW_FCTL_CLEAR_FUNC)) {
1529         return IOINST_CC_BUSY;
1530     }
1531 
1532     /* If monitoring is active, update counter. */
1533     if (channel_subsys.chnmon_active) {
1534         css_update_chnmon(sch);
1535     }
1536     sch->orb = *orb;
1537     sch->channel_prog = orb->cpa;
1538     /* Trigger the start function. */
1539     s->ctrl |= (SCSW_FCTL_START_FUNC | SCSW_ACTL_START_PEND);
1540     s->flags &= ~SCSW_FLAGS_MASK_PNO;
1541 
1542     return do_subchannel_work(sch);
1543 }
1544 
1545 static void copy_irb_to_guest(IRB *dest, const IRB *src, PMCW *pmcw,
1546                               int *irb_len)
1547 {
1548     int i;
1549     uint16_t stctl = src->scsw.ctrl & SCSW_CTRL_MASK_STCTL;
1550     uint16_t actl = src->scsw.ctrl & SCSW_CTRL_MASK_ACTL;
1551 
1552     copy_scsw_to_guest(&dest->scsw, &src->scsw);
1553 
1554     for (i = 0; i < ARRAY_SIZE(dest->esw); i++) {
1555         dest->esw[i] = cpu_to_be32(src->esw[i]);
1556     }
1557     for (i = 0; i < ARRAY_SIZE(dest->ecw); i++) {
1558         dest->ecw[i] = cpu_to_be32(src->ecw[i]);
1559     }
1560     *irb_len = sizeof(*dest) - sizeof(dest->emw);
1561 
1562     /* extended measurements enabled? */
1563     if ((src->scsw.flags & SCSW_FLAGS_MASK_ESWF) ||
1564         !(pmcw->flags & PMCW_FLAGS_MASK_TF) ||
1565         !(pmcw->chars & PMCW_CHARS_MASK_XMWME)) {
1566         return;
1567     }
1568     /* extended measurements pending? */
1569     if (!(stctl & SCSW_STCTL_STATUS_PEND)) {
1570         return;
1571     }
1572     if ((stctl & SCSW_STCTL_PRIMARY) ||
1573         (stctl == SCSW_STCTL_SECONDARY) ||
1574         ((stctl & SCSW_STCTL_INTERMEDIATE) && (actl & SCSW_ACTL_SUSP))) {
1575         for (i = 0; i < ARRAY_SIZE(dest->emw); i++) {
1576             dest->emw[i] = cpu_to_be32(src->emw[i]);
1577         }
1578     }
1579     *irb_len = sizeof(*dest);
1580 }
1581 
1582 int css_do_tsch_get_irb(SubchDev *sch, IRB *target_irb, int *irb_len)
1583 {
1584     SCSW *s = &sch->curr_status.scsw;
1585     PMCW *p = &sch->curr_status.pmcw;
1586     uint16_t stctl;
1587     IRB irb;
1588 
1589     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
1590         return 3;
1591     }
1592 
1593     stctl = s->ctrl & SCSW_CTRL_MASK_STCTL;
1594 
1595     /* Prepare the irb for the guest. */
1596     memset(&irb, 0, sizeof(IRB));
1597 
1598     /* Copy scsw from current status. */
1599     memcpy(&irb.scsw, s, sizeof(SCSW));
1600     if (stctl & SCSW_STCTL_STATUS_PEND) {
1601         if (s->cstat & (SCSW_CSTAT_DATA_CHECK |
1602                         SCSW_CSTAT_CHN_CTRL_CHK |
1603                         SCSW_CSTAT_INTF_CTRL_CHK)) {
1604             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF;
1605             irb.esw[0] = 0x04804000;
1606         } else {
1607             irb.esw[0] = 0x00800000;
1608         }
1609         /* If a unit check is pending, copy sense data. */
1610         if ((s->dstat & SCSW_DSTAT_UNIT_CHECK) &&
1611             (p->chars & PMCW_CHARS_MASK_CSENSE)) {
1612             int i;
1613 
1614             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF | SCSW_FLAGS_MASK_ECTL;
1615             /* Attention: sense_data is already BE! */
1616             memcpy(irb.ecw, sch->sense_data, sizeof(sch->sense_data));
1617             for (i = 0; i < ARRAY_SIZE(irb.ecw); i++) {
1618                 irb.ecw[i] = be32_to_cpu(irb.ecw[i]);
1619             }
1620             irb.esw[1] = 0x01000000 | (sizeof(sch->sense_data) << 8);
1621         }
1622     }
1623     /* Store the irb to the guest. */
1624     copy_irb_to_guest(target_irb, &irb, p, irb_len);
1625 
1626     return ((stctl & SCSW_STCTL_STATUS_PEND) == 0);
1627 }
1628 
1629 void css_do_tsch_update_subch(SubchDev *sch)
1630 {
1631     SCSW *s = &sch->curr_status.scsw;
1632     PMCW *p = &sch->curr_status.pmcw;
1633     uint16_t stctl;
1634     uint16_t fctl;
1635     uint16_t actl;
1636 
1637     stctl = s->ctrl & SCSW_CTRL_MASK_STCTL;
1638     fctl = s->ctrl & SCSW_CTRL_MASK_FCTL;
1639     actl = s->ctrl & SCSW_CTRL_MASK_ACTL;
1640 
1641     /* Clear conditions on subchannel, if applicable. */
1642     if (stctl & SCSW_STCTL_STATUS_PEND) {
1643         s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
1644         if ((stctl != (SCSW_STCTL_INTERMEDIATE | SCSW_STCTL_STATUS_PEND)) ||
1645             ((fctl & SCSW_FCTL_HALT_FUNC) &&
1646              (actl & SCSW_ACTL_SUSP))) {
1647             s->ctrl &= ~SCSW_CTRL_MASK_FCTL;
1648         }
1649         if (stctl != (SCSW_STCTL_INTERMEDIATE | SCSW_STCTL_STATUS_PEND)) {
1650             s->flags &= ~SCSW_FLAGS_MASK_PNO;
1651             s->ctrl &= ~(SCSW_ACTL_RESUME_PEND |
1652                          SCSW_ACTL_START_PEND |
1653                          SCSW_ACTL_HALT_PEND |
1654                          SCSW_ACTL_CLEAR_PEND |
1655                          SCSW_ACTL_SUSP);
1656         } else {
1657             if ((actl & SCSW_ACTL_SUSP) &&
1658                 (fctl & SCSW_FCTL_START_FUNC)) {
1659                 s->flags &= ~SCSW_FLAGS_MASK_PNO;
1660                 if (fctl & SCSW_FCTL_HALT_FUNC) {
1661                     s->ctrl &= ~(SCSW_ACTL_RESUME_PEND |
1662                                  SCSW_ACTL_START_PEND |
1663                                  SCSW_ACTL_HALT_PEND |
1664                                  SCSW_ACTL_CLEAR_PEND |
1665                                  SCSW_ACTL_SUSP);
1666                 } else {
1667                     s->ctrl &= ~SCSW_ACTL_RESUME_PEND;
1668                 }
1669             }
1670         }
1671         /* Clear pending sense data. */
1672         if (p->chars & PMCW_CHARS_MASK_CSENSE) {
1673             memset(sch->sense_data, 0 , sizeof(sch->sense_data));
1674         }
1675     }
1676 }
1677 
1678 static void copy_crw_to_guest(CRW *dest, const CRW *src)
1679 {
1680     dest->flags = cpu_to_be16(src->flags);
1681     dest->rsid = cpu_to_be16(src->rsid);
1682 }
1683 
1684 int css_do_stcrw(CRW *crw)
1685 {
1686     CrwContainer *crw_cont;
1687     int ret;
1688 
1689     crw_cont = QTAILQ_FIRST(&channel_subsys.pending_crws);
1690     if (crw_cont) {
1691         QTAILQ_REMOVE(&channel_subsys.pending_crws, crw_cont, sibling);
1692         copy_crw_to_guest(crw, &crw_cont->crw);
1693         g_free(crw_cont);
1694         ret = 0;
1695     } else {
1696         /* List was empty, turn crw machine checks on again. */
1697         memset(crw, 0, sizeof(*crw));
1698         channel_subsys.do_crw_mchk = true;
1699         ret = 1;
1700     }
1701 
1702     return ret;
1703 }
1704 
1705 static void copy_crw_from_guest(CRW *dest, const CRW *src)
1706 {
1707     dest->flags = be16_to_cpu(src->flags);
1708     dest->rsid = be16_to_cpu(src->rsid);
1709 }
1710 
1711 void css_undo_stcrw(CRW *crw)
1712 {
1713     CrwContainer *crw_cont;
1714 
1715     crw_cont = g_try_new0(CrwContainer, 1);
1716     if (!crw_cont) {
1717         channel_subsys.crws_lost = true;
1718         return;
1719     }
1720     copy_crw_from_guest(&crw_cont->crw, crw);
1721 
1722     QTAILQ_INSERT_HEAD(&channel_subsys.pending_crws, crw_cont, sibling);
1723 }
1724 
1725 int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid,
1726                          int rfmt, void *buf)
1727 {
1728     int i, desc_size;
1729     uint32_t words[8];
1730     uint32_t chpid_type_word;
1731     CssImage *css;
1732 
1733     if (!m && !cssid) {
1734         css = channel_subsys.css[channel_subsys.default_cssid];
1735     } else {
1736         css = channel_subsys.css[cssid];
1737     }
1738     if (!css) {
1739         return 0;
1740     }
1741     desc_size = 0;
1742     for (i = f_chpid; i <= l_chpid; i++) {
1743         if (css->chpids[i].in_use) {
1744             chpid_type_word = 0x80000000 | (css->chpids[i].type << 8) | i;
1745             if (rfmt == 0) {
1746                 words[0] = cpu_to_be32(chpid_type_word);
1747                 words[1] = 0;
1748                 memcpy(buf + desc_size, words, 8);
1749                 desc_size += 8;
1750             } else if (rfmt == 1) {
1751                 words[0] = cpu_to_be32(chpid_type_word);
1752                 words[1] = 0;
1753                 words[2] = 0;
1754                 words[3] = 0;
1755                 words[4] = 0;
1756                 words[5] = 0;
1757                 words[6] = 0;
1758                 words[7] = 0;
1759                 memcpy(buf + desc_size, words, 32);
1760                 desc_size += 32;
1761             }
1762         }
1763     }
1764     return desc_size;
1765 }
1766 
1767 void css_do_schm(uint8_t mbk, int update, int dct, uint64_t mbo)
1768 {
1769     /* dct is currently ignored (not really meaningful for our devices) */
1770     /* TODO: Don't ignore mbk. */
1771     if (update && !channel_subsys.chnmon_active) {
1772         /* Enable measuring. */
1773         channel_subsys.chnmon_area = mbo;
1774         channel_subsys.chnmon_active = true;
1775     }
1776     if (!update && channel_subsys.chnmon_active) {
1777         /* Disable measuring. */
1778         channel_subsys.chnmon_area = 0;
1779         channel_subsys.chnmon_active = false;
1780     }
1781 }
1782 
1783 IOInstEnding css_do_rsch(SubchDev *sch)
1784 {
1785     SCSW *s = &sch->curr_status.scsw;
1786     PMCW *p = &sch->curr_status.pmcw;
1787 
1788     if (~(p->flags) & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA)) {
1789         return IOINST_CC_NOT_OPERATIONAL;
1790     }
1791 
1792     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
1793         return IOINST_CC_STATUS_PRESENT;
1794     }
1795 
1796     if (((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||
1797         (s->ctrl & SCSW_ACTL_RESUME_PEND) ||
1798         (!(s->ctrl & SCSW_ACTL_SUSP))) {
1799         return IOINST_CC_BUSY;
1800     }
1801 
1802     /* If monitoring is active, update counter. */
1803     if (channel_subsys.chnmon_active) {
1804         css_update_chnmon(sch);
1805     }
1806 
1807     s->ctrl |= SCSW_ACTL_RESUME_PEND;
1808     return do_subchannel_work(sch);
1809 }
1810 
1811 int css_do_rchp(uint8_t cssid, uint8_t chpid)
1812 {
1813     uint8_t real_cssid;
1814 
1815     if (cssid > channel_subsys.max_cssid) {
1816         return -EINVAL;
1817     }
1818     if (channel_subsys.max_cssid == 0) {
1819         real_cssid = channel_subsys.default_cssid;
1820     } else {
1821         real_cssid = cssid;
1822     }
1823     if (!channel_subsys.css[real_cssid]) {
1824         return -EINVAL;
1825     }
1826 
1827     if (!channel_subsys.css[real_cssid]->chpids[chpid].in_use) {
1828         return -ENODEV;
1829     }
1830 
1831     if (!channel_subsys.css[real_cssid]->chpids[chpid].is_virtual) {
1832         fprintf(stderr,
1833                 "rchp unsupported for non-virtual chpid %x.%02x!\n",
1834                 real_cssid, chpid);
1835         return -ENODEV;
1836     }
1837 
1838     /* We don't really use a channel path, so we're done here. */
1839     css_queue_crw(CRW_RSC_CHP, CRW_ERC_INIT, 1,
1840                   channel_subsys.max_cssid > 0 ? 1 : 0, chpid);
1841     if (channel_subsys.max_cssid > 0) {
1842         css_queue_crw(CRW_RSC_CHP, CRW_ERC_INIT, 1, 0, real_cssid << 8);
1843     }
1844     return 0;
1845 }
1846 
1847 bool css_schid_final(int m, uint8_t cssid, uint8_t ssid, uint16_t schid)
1848 {
1849     SubchSet *set;
1850     uint8_t real_cssid;
1851 
1852     real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid;
1853     if (ssid > MAX_SSID ||
1854         !channel_subsys.css[real_cssid] ||
1855         !channel_subsys.css[real_cssid]->sch_set[ssid]) {
1856         return true;
1857     }
1858     set = channel_subsys.css[real_cssid]->sch_set[ssid];
1859     return schid > find_last_bit(set->schids_used,
1860                                  (MAX_SCHID + 1) / sizeof(unsigned long));
1861 }
1862 
1863 unsigned int css_find_free_chpid(uint8_t cssid)
1864 {
1865     CssImage *css = channel_subsys.css[cssid];
1866     unsigned int chpid;
1867 
1868     if (!css) {
1869         return MAX_CHPID + 1;
1870     }
1871 
1872     for (chpid = 0; chpid <= MAX_CHPID; chpid++) {
1873         /* skip reserved chpid */
1874         if (chpid == VIRTIO_CCW_CHPID) {
1875             continue;
1876         }
1877         if (!css->chpids[chpid].in_use) {
1878             return chpid;
1879         }
1880     }
1881     return MAX_CHPID + 1;
1882 }
1883 
1884 static int css_add_chpid(uint8_t cssid, uint8_t chpid, uint8_t type,
1885                          bool is_virt)
1886 {
1887     CssImage *css;
1888 
1889     trace_css_chpid_add(cssid, chpid, type);
1890     css = channel_subsys.css[cssid];
1891     if (!css) {
1892         return -EINVAL;
1893     }
1894     if (css->chpids[chpid].in_use) {
1895         return -EEXIST;
1896     }
1897     css->chpids[chpid].in_use = 1;
1898     css->chpids[chpid].type = type;
1899     css->chpids[chpid].is_virtual = is_virt;
1900 
1901     css_generate_chp_crws(cssid, chpid);
1902 
1903     return 0;
1904 }
1905 
1906 void css_sch_build_virtual_schib(SubchDev *sch, uint8_t chpid, uint8_t type)
1907 {
1908     PMCW *p = &sch->curr_status.pmcw;
1909     SCSW *s = &sch->curr_status.scsw;
1910     int i;
1911     CssImage *css = channel_subsys.css[sch->cssid];
1912 
1913     assert(css != NULL);
1914     memset(p, 0, sizeof(PMCW));
1915     p->flags |= PMCW_FLAGS_MASK_DNV;
1916     p->devno = sch->devno;
1917     /* single path */
1918     p->pim = 0x80;
1919     p->pom = 0xff;
1920     p->pam = 0x80;
1921     p->chpid[0] = chpid;
1922     if (!css->chpids[chpid].in_use) {
1923         css_add_chpid(sch->cssid, chpid, type, true);
1924     }
1925 
1926     memset(s, 0, sizeof(SCSW));
1927     sch->curr_status.mba = 0;
1928     for (i = 0; i < ARRAY_SIZE(sch->curr_status.mda); i++) {
1929         sch->curr_status.mda[i] = 0;
1930     }
1931 }
1932 
1933 SubchDev *css_find_subch(uint8_t m, uint8_t cssid, uint8_t ssid, uint16_t schid)
1934 {
1935     uint8_t real_cssid;
1936 
1937     real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid;
1938 
1939     if (!channel_subsys.css[real_cssid]) {
1940         return NULL;
1941     }
1942 
1943     if (!channel_subsys.css[real_cssid]->sch_set[ssid]) {
1944         return NULL;
1945     }
1946 
1947     return channel_subsys.css[real_cssid]->sch_set[ssid]->sch[schid];
1948 }
1949 
1950 /**
1951  * Return free device number in subchannel set.
1952  *
1953  * Return index of the first free device number in the subchannel set
1954  * identified by @p cssid and @p ssid, beginning the search at @p
1955  * start and wrapping around at MAX_DEVNO. Return a value exceeding
1956  * MAX_SCHID if there are no free device numbers in the subchannel
1957  * set.
1958  */
1959 static uint32_t css_find_free_devno(uint8_t cssid, uint8_t ssid,
1960                                     uint16_t start)
1961 {
1962     uint32_t round;
1963 
1964     for (round = 0; round <= MAX_DEVNO; round++) {
1965         uint16_t devno = (start + round) % MAX_DEVNO;
1966 
1967         if (!css_devno_used(cssid, ssid, devno)) {
1968             return devno;
1969         }
1970     }
1971     return MAX_DEVNO + 1;
1972 }
1973 
1974 /**
1975  * Return first free subchannel (id) in subchannel set.
1976  *
1977  * Return index of the first free subchannel in the subchannel set
1978  * identified by @p cssid and @p ssid, if there is any. Return a value
1979  * exceeding MAX_SCHID if there are no free subchannels in the
1980  * subchannel set.
1981  */
1982 static uint32_t css_find_free_subch(uint8_t cssid, uint8_t ssid)
1983 {
1984     uint32_t schid;
1985 
1986     for (schid = 0; schid <= MAX_SCHID; schid++) {
1987         if (!css_find_subch(1, cssid, ssid, schid)) {
1988             return schid;
1989         }
1990     }
1991     return MAX_SCHID + 1;
1992 }
1993 
1994 /**
1995  * Return first free subchannel (id) in subchannel set for a device number
1996  *
1997  * Verify the device number @p devno is not used yet in the subchannel
1998  * set identified by @p cssid and @p ssid. Set @p schid to the index
1999  * of the first free subchannel in the subchannel set, if there is
2000  * any. Return true if everything succeeded and false otherwise.
2001  */
2002 static bool css_find_free_subch_for_devno(uint8_t cssid, uint8_t ssid,
2003                                           uint16_t devno, uint16_t *schid,
2004                                           Error **errp)
2005 {
2006     uint32_t free_schid;
2007 
2008     assert(schid);
2009     if (css_devno_used(cssid, ssid, devno)) {
2010         error_setg(errp, "Device %x.%x.%04x already exists",
2011                    cssid, ssid, devno);
2012         return false;
2013     }
2014     free_schid = css_find_free_subch(cssid, ssid);
2015     if (free_schid > MAX_SCHID) {
2016         error_setg(errp, "No free subchannel found for %x.%x.%04x",
2017                    cssid, ssid, devno);
2018         return false;
2019     }
2020     *schid = free_schid;
2021     return true;
2022 }
2023 
2024 /**
2025  * Return first free subchannel (id) and device number
2026  *
2027  * Locate the first free subchannel and first free device number in
2028  * any of the subchannel sets of the channel subsystem identified by
2029  * @p cssid. Return false if no free subchannel / device number could
2030  * be found. Otherwise set @p ssid, @p devno and @p schid to identify
2031  * the available subchannel and device number and return true.
2032  *
2033  * May modify @p ssid, @p devno and / or @p schid even if no free
2034  * subchannel / device number could be found.
2035  */
2036 static bool css_find_free_subch_and_devno(uint8_t cssid, uint8_t *ssid,
2037                                           uint16_t *devno, uint16_t *schid,
2038                                           Error **errp)
2039 {
2040     uint32_t free_schid, free_devno;
2041 
2042     assert(ssid && devno && schid);
2043     for (*ssid = 0; *ssid <= MAX_SSID; (*ssid)++) {
2044         free_schid = css_find_free_subch(cssid, *ssid);
2045         if (free_schid > MAX_SCHID) {
2046             continue;
2047         }
2048         free_devno = css_find_free_devno(cssid, *ssid, free_schid);
2049         if (free_devno > MAX_DEVNO) {
2050             continue;
2051         }
2052         *schid = free_schid;
2053         *devno = free_devno;
2054         return true;
2055     }
2056     error_setg(errp, "Virtual channel subsystem is full!");
2057     return false;
2058 }
2059 
2060 bool css_subch_visible(SubchDev *sch)
2061 {
2062     if (sch->ssid > channel_subsys.max_ssid) {
2063         return false;
2064     }
2065 
2066     if (sch->cssid != channel_subsys.default_cssid) {
2067         return (channel_subsys.max_cssid > 0);
2068     }
2069 
2070     return true;
2071 }
2072 
2073 bool css_present(uint8_t cssid)
2074 {
2075     return (channel_subsys.css[cssid] != NULL);
2076 }
2077 
2078 bool css_devno_used(uint8_t cssid, uint8_t ssid, uint16_t devno)
2079 {
2080     if (!channel_subsys.css[cssid]) {
2081         return false;
2082     }
2083     if (!channel_subsys.css[cssid]->sch_set[ssid]) {
2084         return false;
2085     }
2086 
2087     return !!test_bit(devno,
2088                       channel_subsys.css[cssid]->sch_set[ssid]->devnos_used);
2089 }
2090 
2091 void css_subch_assign(uint8_t cssid, uint8_t ssid, uint16_t schid,
2092                       uint16_t devno, SubchDev *sch)
2093 {
2094     CssImage *css;
2095     SubchSet *s_set;
2096 
2097     trace_css_assign_subch(sch ? "assign" : "deassign", cssid, ssid, schid,
2098                            devno);
2099     if (!channel_subsys.css[cssid]) {
2100         fprintf(stderr,
2101                 "Suspicious call to %s (%x.%x.%04x) for non-existing css!\n",
2102                 __func__, cssid, ssid, schid);
2103         return;
2104     }
2105     css = channel_subsys.css[cssid];
2106 
2107     if (!css->sch_set[ssid]) {
2108         css->sch_set[ssid] = g_new0(SubchSet, 1);
2109     }
2110     s_set = css->sch_set[ssid];
2111 
2112     s_set->sch[schid] = sch;
2113     if (sch) {
2114         set_bit(schid, s_set->schids_used);
2115         set_bit(devno, s_set->devnos_used);
2116     } else {
2117         clear_bit(schid, s_set->schids_used);
2118         clear_bit(devno, s_set->devnos_used);
2119     }
2120 }
2121 
2122 void css_queue_crw(uint8_t rsc, uint8_t erc, int solicited,
2123                    int chain, uint16_t rsid)
2124 {
2125     CrwContainer *crw_cont;
2126 
2127     trace_css_crw(rsc, erc, rsid, chain ? "(chained)" : "");
2128     /* TODO: Maybe use a static crw pool? */
2129     crw_cont = g_try_new0(CrwContainer, 1);
2130     if (!crw_cont) {
2131         channel_subsys.crws_lost = true;
2132         return;
2133     }
2134     crw_cont->crw.flags = (rsc << 8) | erc;
2135     if (solicited) {
2136         crw_cont->crw.flags |= CRW_FLAGS_MASK_S;
2137     }
2138     if (chain) {
2139         crw_cont->crw.flags |= CRW_FLAGS_MASK_C;
2140     }
2141     crw_cont->crw.rsid = rsid;
2142     if (channel_subsys.crws_lost) {
2143         crw_cont->crw.flags |= CRW_FLAGS_MASK_R;
2144         channel_subsys.crws_lost = false;
2145     }
2146 
2147     QTAILQ_INSERT_TAIL(&channel_subsys.pending_crws, crw_cont, sibling);
2148 
2149     if (channel_subsys.do_crw_mchk) {
2150         channel_subsys.do_crw_mchk = false;
2151         /* Inject crw pending machine check. */
2152         s390_crw_mchk();
2153     }
2154 }
2155 
2156 void css_generate_sch_crws(uint8_t cssid, uint8_t ssid, uint16_t schid,
2157                            int hotplugged, int add)
2158 {
2159     uint8_t guest_cssid;
2160     bool chain_crw;
2161 
2162     if (add && !hotplugged) {
2163         return;
2164     }
2165     if (channel_subsys.max_cssid == 0) {
2166         /* Default cssid shows up as 0. */
2167         guest_cssid = (cssid == channel_subsys.default_cssid) ? 0 : cssid;
2168     } else {
2169         /* Show real cssid to the guest. */
2170         guest_cssid = cssid;
2171     }
2172     /*
2173      * Only notify for higher subchannel sets/channel subsystems if the
2174      * guest has enabled it.
2175      */
2176     if ((ssid > channel_subsys.max_ssid) ||
2177         (guest_cssid > channel_subsys.max_cssid) ||
2178         ((channel_subsys.max_cssid == 0) &&
2179          (cssid != channel_subsys.default_cssid))) {
2180         return;
2181     }
2182     chain_crw = (channel_subsys.max_ssid > 0) ||
2183             (channel_subsys.max_cssid > 0);
2184     css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, 0, chain_crw ? 1 : 0, schid);
2185     if (chain_crw) {
2186         css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, 0, 0,
2187                       (guest_cssid << 8) | (ssid << 4));
2188     }
2189     /* RW_ERC_IPI --> clear pending interrupts */
2190     css_clear_io_interrupt(css_do_build_subchannel_id(cssid, ssid), schid);
2191 }
2192 
2193 void css_generate_chp_crws(uint8_t cssid, uint8_t chpid)
2194 {
2195     /* TODO */
2196 }
2197 
2198 void css_generate_css_crws(uint8_t cssid)
2199 {
2200     if (!channel_subsys.sei_pending) {
2201         css_queue_crw(CRW_RSC_CSS, CRW_ERC_EVENT, 0, 0, cssid);
2202     }
2203     channel_subsys.sei_pending = true;
2204 }
2205 
2206 void css_clear_sei_pending(void)
2207 {
2208     channel_subsys.sei_pending = false;
2209 }
2210 
2211 int css_enable_mcsse(void)
2212 {
2213     trace_css_enable_facility("mcsse");
2214     channel_subsys.max_cssid = MAX_CSSID;
2215     return 0;
2216 }
2217 
2218 int css_enable_mss(void)
2219 {
2220     trace_css_enable_facility("mss");
2221     channel_subsys.max_ssid = MAX_SSID;
2222     return 0;
2223 }
2224 
2225 void css_reset_sch(SubchDev *sch)
2226 {
2227     PMCW *p = &sch->curr_status.pmcw;
2228 
2229     if ((p->flags & PMCW_FLAGS_MASK_ENA) != 0 && sch->disable_cb) {
2230         sch->disable_cb(sch);
2231     }
2232 
2233     p->intparm = 0;
2234     p->flags &= ~(PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
2235                   PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
2236                   PMCW_FLAGS_MASK_MP | PMCW_FLAGS_MASK_TF);
2237     p->flags |= PMCW_FLAGS_MASK_DNV;
2238     p->devno = sch->devno;
2239     p->pim = 0x80;
2240     p->lpm = p->pim;
2241     p->pnom = 0;
2242     p->lpum = 0;
2243     p->mbi = 0;
2244     p->pom = 0xff;
2245     p->pam = 0x80;
2246     p->chars &= ~(PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_XMWME |
2247                   PMCW_CHARS_MASK_CSENSE);
2248 
2249     memset(&sch->curr_status.scsw, 0, sizeof(sch->curr_status.scsw));
2250     sch->curr_status.mba = 0;
2251 
2252     sch->channel_prog = 0x0;
2253     sch->last_cmd_valid = false;
2254     sch->thinint_active = false;
2255 }
2256 
2257 void css_reset(void)
2258 {
2259     CrwContainer *crw_cont;
2260 
2261     /* Clean up monitoring. */
2262     channel_subsys.chnmon_active = false;
2263     channel_subsys.chnmon_area = 0;
2264 
2265     /* Clear pending CRWs. */
2266     while ((crw_cont = QTAILQ_FIRST(&channel_subsys.pending_crws))) {
2267         QTAILQ_REMOVE(&channel_subsys.pending_crws, crw_cont, sibling);
2268         g_free(crw_cont);
2269     }
2270     channel_subsys.sei_pending = false;
2271     channel_subsys.do_crw_mchk = true;
2272     channel_subsys.crws_lost = false;
2273 
2274     /* Reset maximum ids. */
2275     channel_subsys.max_cssid = 0;
2276     channel_subsys.max_ssid = 0;
2277 }
2278 
2279 static void get_css_devid(Object *obj, Visitor *v, const char *name,
2280                           void *opaque, Error **errp)
2281 {
2282     DeviceState *dev = DEVICE(obj);
2283     Property *prop = opaque;
2284     CssDevId *dev_id = qdev_get_prop_ptr(dev, prop);
2285     char buffer[] = "xx.x.xxxx";
2286     char *p = buffer;
2287     int r;
2288 
2289     if (dev_id->valid) {
2290 
2291         r = snprintf(buffer, sizeof(buffer), "%02x.%1x.%04x", dev_id->cssid,
2292                      dev_id->ssid, dev_id->devid);
2293         assert(r == sizeof(buffer) - 1);
2294 
2295         /* drop leading zero */
2296         if (dev_id->cssid <= 0xf) {
2297             p++;
2298         }
2299     } else {
2300         snprintf(buffer, sizeof(buffer), "<unset>");
2301     }
2302 
2303     visit_type_str(v, name, &p, errp);
2304 }
2305 
2306 /*
2307  * parse <cssid>.<ssid>.<devid> and assert valid range for cssid/ssid
2308  */
2309 static void set_css_devid(Object *obj, Visitor *v, const char *name,
2310                           void *opaque, Error **errp)
2311 {
2312     DeviceState *dev = DEVICE(obj);
2313     Property *prop = opaque;
2314     CssDevId *dev_id = qdev_get_prop_ptr(dev, prop);
2315     Error *local_err = NULL;
2316     char *str;
2317     int num, n1, n2;
2318     unsigned int cssid, ssid, devid;
2319 
2320     if (dev->realized) {
2321         qdev_prop_set_after_realize(dev, name, errp);
2322         return;
2323     }
2324 
2325     visit_type_str(v, name, &str, &local_err);
2326     if (local_err) {
2327         error_propagate(errp, local_err);
2328         return;
2329     }
2330 
2331     num = sscanf(str, "%2x.%1x%n.%4x%n", &cssid, &ssid, &n1, &devid, &n2);
2332     if (num != 3 || (n2 - n1) != 5 || strlen(str) != n2) {
2333         error_set_from_qdev_prop_error(errp, EINVAL, dev, prop, str);
2334         goto out;
2335     }
2336     if ((cssid > MAX_CSSID) || (ssid > MAX_SSID)) {
2337         error_setg(errp, "Invalid cssid or ssid: cssid %x, ssid %x",
2338                    cssid, ssid);
2339         goto out;
2340     }
2341 
2342     dev_id->cssid = cssid;
2343     dev_id->ssid = ssid;
2344     dev_id->devid = devid;
2345     dev_id->valid = true;
2346 
2347 out:
2348     g_free(str);
2349 }
2350 
2351 const PropertyInfo css_devid_propinfo = {
2352     .name = "str",
2353     .description = "Identifier of an I/O device in the channel "
2354                    "subsystem, example: fe.1.23ab",
2355     .get = get_css_devid,
2356     .set = set_css_devid,
2357 };
2358 
2359 const PropertyInfo css_devid_ro_propinfo = {
2360     .name = "str",
2361     .description = "Read-only identifier of an I/O device in the channel "
2362                    "subsystem, example: fe.1.23ab",
2363     .get = get_css_devid,
2364 };
2365 
2366 SubchDev *css_create_sch(CssDevId bus_id, bool squash_mcss, Error **errp)
2367 {
2368     uint16_t schid = 0;
2369     SubchDev *sch;
2370 
2371     if (bus_id.valid) {
2372         if (squash_mcss) {
2373             bus_id.cssid = channel_subsys.default_cssid;
2374         } else if (!channel_subsys.css[bus_id.cssid]) {
2375             css_create_css_image(bus_id.cssid, false);
2376         }
2377 
2378         if (!css_find_free_subch_for_devno(bus_id.cssid, bus_id.ssid,
2379                                            bus_id.devid, &schid, errp)) {
2380             return NULL;
2381         }
2382     } else {
2383         for (bus_id.cssid = channel_subsys.default_cssid;;) {
2384             if (!channel_subsys.css[bus_id.cssid]) {
2385                 css_create_css_image(bus_id.cssid, false);
2386             }
2387 
2388             if   (css_find_free_subch_and_devno(bus_id.cssid, &bus_id.ssid,
2389                                                 &bus_id.devid, &schid,
2390                                                 NULL)) {
2391                 break;
2392             }
2393             bus_id.cssid = (bus_id.cssid + 1) % MAX_CSSID;
2394             if (bus_id.cssid == channel_subsys.default_cssid) {
2395                 error_setg(errp, "Virtual channel subsystem is full!");
2396                 return NULL;
2397             }
2398         }
2399     }
2400 
2401     sch = g_new0(SubchDev, 1);
2402     sch->cssid = bus_id.cssid;
2403     sch->ssid = bus_id.ssid;
2404     sch->devno = bus_id.devid;
2405     sch->schid = schid;
2406     css_subch_assign(sch->cssid, sch->ssid, schid, sch->devno, sch);
2407     return sch;
2408 }
2409 
2410 static int css_sch_get_chpids(SubchDev *sch, CssDevId *dev_id)
2411 {
2412     char *fid_path;
2413     FILE *fd;
2414     uint32_t chpid[8];
2415     int i;
2416     PMCW *p = &sch->curr_status.pmcw;
2417 
2418     fid_path = g_strdup_printf("/sys/bus/css/devices/%x.%x.%04x/chpids",
2419                                dev_id->cssid, dev_id->ssid, dev_id->devid);
2420     fd = fopen(fid_path, "r");
2421     if (fd == NULL) {
2422         error_report("%s: open %s failed", __func__, fid_path);
2423         g_free(fid_path);
2424         return -EINVAL;
2425     }
2426 
2427     if (fscanf(fd, "%x %x %x %x %x %x %x %x",
2428         &chpid[0], &chpid[1], &chpid[2], &chpid[3],
2429         &chpid[4], &chpid[5], &chpid[6], &chpid[7]) != 8) {
2430         fclose(fd);
2431         g_free(fid_path);
2432         return -EINVAL;
2433     }
2434 
2435     for (i = 0; i < ARRAY_SIZE(p->chpid); i++) {
2436         p->chpid[i] = chpid[i];
2437     }
2438 
2439     fclose(fd);
2440     g_free(fid_path);
2441 
2442     return 0;
2443 }
2444 
2445 static int css_sch_get_path_masks(SubchDev *sch, CssDevId *dev_id)
2446 {
2447     char *fid_path;
2448     FILE *fd;
2449     uint32_t pim, pam, pom;
2450     PMCW *p = &sch->curr_status.pmcw;
2451 
2452     fid_path = g_strdup_printf("/sys/bus/css/devices/%x.%x.%04x/pimpampom",
2453                                dev_id->cssid, dev_id->ssid, dev_id->devid);
2454     fd = fopen(fid_path, "r");
2455     if (fd == NULL) {
2456         error_report("%s: open %s failed", __func__, fid_path);
2457         g_free(fid_path);
2458         return -EINVAL;
2459     }
2460 
2461     if (fscanf(fd, "%x %x %x", &pim, &pam, &pom) != 3) {
2462         fclose(fd);
2463         g_free(fid_path);
2464         return -EINVAL;
2465     }
2466 
2467     p->pim = pim;
2468     p->pam = pam;
2469     p->pom = pom;
2470     fclose(fd);
2471     g_free(fid_path);
2472 
2473     return 0;
2474 }
2475 
2476 static int css_sch_get_chpid_type(uint8_t chpid, uint32_t *type,
2477                                   CssDevId *dev_id)
2478 {
2479     char *fid_path;
2480     FILE *fd;
2481 
2482     fid_path = g_strdup_printf("/sys/devices/css%x/chp0.%02x/type",
2483                                dev_id->cssid, chpid);
2484     fd = fopen(fid_path, "r");
2485     if (fd == NULL) {
2486         error_report("%s: open %s failed", __func__, fid_path);
2487         g_free(fid_path);
2488         return -EINVAL;
2489     }
2490 
2491     if (fscanf(fd, "%x", type) != 1) {
2492         fclose(fd);
2493         g_free(fid_path);
2494         return -EINVAL;
2495     }
2496 
2497     fclose(fd);
2498     g_free(fid_path);
2499 
2500     return 0;
2501 }
2502 
2503 /*
2504  * We currently retrieve the real device information from sysfs to build the
2505  * guest subchannel information block without considering the migration feature.
2506  * We need to revisit this problem when we want to add migration support.
2507  */
2508 int css_sch_build_schib(SubchDev *sch, CssDevId *dev_id)
2509 {
2510     CssImage *css = channel_subsys.css[sch->cssid];
2511     PMCW *p = &sch->curr_status.pmcw;
2512     SCSW *s = &sch->curr_status.scsw;
2513     uint32_t type;
2514     int i, ret;
2515 
2516     assert(css != NULL);
2517     memset(p, 0, sizeof(PMCW));
2518     p->flags |= PMCW_FLAGS_MASK_DNV;
2519     /* We are dealing with I/O subchannels only. */
2520     p->devno = sch->devno;
2521 
2522     /* Grab path mask from sysfs. */
2523     ret = css_sch_get_path_masks(sch, dev_id);
2524     if (ret) {
2525         return ret;
2526     }
2527 
2528     /* Grab chpids from sysfs. */
2529     ret = css_sch_get_chpids(sch, dev_id);
2530     if (ret) {
2531         return ret;
2532     }
2533 
2534    /* Build chpid type. */
2535     for (i = 0; i < ARRAY_SIZE(p->chpid); i++) {
2536         if (p->chpid[i] && !css->chpids[p->chpid[i]].in_use) {
2537             ret = css_sch_get_chpid_type(p->chpid[i], &type, dev_id);
2538             if (ret) {
2539                 return ret;
2540             }
2541             css_add_chpid(sch->cssid, p->chpid[i], type, false);
2542         }
2543     }
2544 
2545     memset(s, 0, sizeof(SCSW));
2546     sch->curr_status.mba = 0;
2547     for (i = 0; i < ARRAY_SIZE(sch->curr_status.mda); i++) {
2548         sch->curr_status.mda[i] = 0;
2549     }
2550 
2551     return 0;
2552 }
2553