xref: /qemu/hw/s390x/css.c (revision 2c533c54)
1 /*
2  * Channel subsystem base support.
3  *
4  * Copyright 2012 IBM Corp.
5  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or (at
8  * your option) any later version. See the COPYING file in the top-level
9  * directory.
10  */
11 
12 #include "qemu/osdep.h"
13 #include "qapi/error.h"
14 #include "qapi/visitor.h"
15 #include "hw/qdev.h"
16 #include "qemu/bitops.h"
17 #include "exec/address-spaces.h"
18 #include "cpu.h"
19 #include "hw/s390x/ioinst.h"
20 #include "hw/s390x/css.h"
21 #include "trace.h"
22 #include "hw/s390x/s390_flic.h"
23 
24 typedef struct CrwContainer {
25     CRW crw;
26     QTAILQ_ENTRY(CrwContainer) sibling;
27 } CrwContainer;
28 
29 typedef struct ChpInfo {
30     uint8_t in_use;
31     uint8_t type;
32     uint8_t is_virtual;
33 } ChpInfo;
34 
35 typedef struct SubchSet {
36     SubchDev *sch[MAX_SCHID + 1];
37     unsigned long schids_used[BITS_TO_LONGS(MAX_SCHID + 1)];
38     unsigned long devnos_used[BITS_TO_LONGS(MAX_SCHID + 1)];
39 } SubchSet;
40 
41 typedef struct CssImage {
42     SubchSet *sch_set[MAX_SSID + 1];
43     ChpInfo chpids[MAX_CHPID + 1];
44 } CssImage;
45 
46 typedef struct IoAdapter {
47     uint32_t id;
48     uint8_t type;
49     uint8_t isc;
50     QTAILQ_ENTRY(IoAdapter) sibling;
51 } IoAdapter;
52 
53 typedef struct ChannelSubSys {
54     QTAILQ_HEAD(, CrwContainer) pending_crws;
55     bool sei_pending;
56     bool do_crw_mchk;
57     bool crws_lost;
58     uint8_t max_cssid;
59     uint8_t max_ssid;
60     bool chnmon_active;
61     uint64_t chnmon_area;
62     CssImage *css[MAX_CSSID + 1];
63     uint8_t default_cssid;
64     QTAILQ_HEAD(, IoAdapter) io_adapters;
65     QTAILQ_HEAD(, IndAddr) indicator_addresses;
66 } ChannelSubSys;
67 
68 static ChannelSubSys channel_subsys = {
69     .pending_crws = QTAILQ_HEAD_INITIALIZER(channel_subsys.pending_crws),
70     .do_crw_mchk = true,
71     .sei_pending = false,
72     .do_crw_mchk = true,
73     .crws_lost = false,
74     .chnmon_active = false,
75     .io_adapters = QTAILQ_HEAD_INITIALIZER(channel_subsys.io_adapters),
76     .indicator_addresses =
77         QTAILQ_HEAD_INITIALIZER(channel_subsys.indicator_addresses),
78 };
79 
80 IndAddr *get_indicator(hwaddr ind_addr, int len)
81 {
82     IndAddr *indicator;
83 
84     QTAILQ_FOREACH(indicator, &channel_subsys.indicator_addresses, sibling) {
85         if (indicator->addr == ind_addr) {
86             indicator->refcnt++;
87             return indicator;
88         }
89     }
90     indicator = g_new0(IndAddr, 1);
91     indicator->addr = ind_addr;
92     indicator->len = len;
93     indicator->refcnt = 1;
94     QTAILQ_INSERT_TAIL(&channel_subsys.indicator_addresses,
95                        indicator, sibling);
96     return indicator;
97 }
98 
99 static int s390_io_adapter_map(AdapterInfo *adapter, uint64_t map_addr,
100                                bool do_map)
101 {
102     S390FLICState *fs = s390_get_flic();
103     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
104 
105     return fsc->io_adapter_map(fs, adapter->adapter_id, map_addr, do_map);
106 }
107 
108 void release_indicator(AdapterInfo *adapter, IndAddr *indicator)
109 {
110     assert(indicator->refcnt > 0);
111     indicator->refcnt--;
112     if (indicator->refcnt > 0) {
113         return;
114     }
115     QTAILQ_REMOVE(&channel_subsys.indicator_addresses, indicator, sibling);
116     if (indicator->map) {
117         s390_io_adapter_map(adapter, indicator->map, false);
118     }
119     g_free(indicator);
120 }
121 
122 int map_indicator(AdapterInfo *adapter, IndAddr *indicator)
123 {
124     int ret;
125 
126     if (indicator->map) {
127         return 0; /* already mapped is not an error */
128     }
129     indicator->map = indicator->addr;
130     ret = s390_io_adapter_map(adapter, indicator->map, true);
131     if ((ret != 0) && (ret != -ENOSYS)) {
132         goto out_err;
133     }
134     return 0;
135 
136 out_err:
137     indicator->map = 0;
138     return ret;
139 }
140 
141 int css_create_css_image(uint8_t cssid, bool default_image)
142 {
143     trace_css_new_image(cssid, default_image ? "(default)" : "");
144     if (cssid > MAX_CSSID) {
145         return -EINVAL;
146     }
147     if (channel_subsys.css[cssid]) {
148         return -EBUSY;
149     }
150     channel_subsys.css[cssid] = g_malloc0(sizeof(CssImage));
151     if (default_image) {
152         channel_subsys.default_cssid = cssid;
153     }
154     return 0;
155 }
156 
157 int css_register_io_adapter(uint8_t type, uint8_t isc, bool swap,
158                             bool maskable, uint32_t *id)
159 {
160     IoAdapter *adapter;
161     bool found = false;
162     int ret;
163     S390FLICState *fs = s390_get_flic();
164     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
165 
166     *id = 0;
167     QTAILQ_FOREACH(adapter, &channel_subsys.io_adapters, sibling) {
168         if ((adapter->type == type) && (adapter->isc == isc)) {
169             *id = adapter->id;
170             found = true;
171             ret = 0;
172             break;
173         }
174         if (adapter->id >= *id) {
175             *id = adapter->id + 1;
176         }
177     }
178     if (found) {
179         goto out;
180     }
181     adapter = g_new0(IoAdapter, 1);
182     ret = fsc->register_io_adapter(fs, *id, isc, swap, maskable);
183     if (ret == 0) {
184         adapter->id = *id;
185         adapter->isc = isc;
186         adapter->type = type;
187         QTAILQ_INSERT_TAIL(&channel_subsys.io_adapters, adapter, sibling);
188     } else {
189         g_free(adapter);
190         fprintf(stderr, "Unexpected error %d when registering adapter %d\n",
191                 ret, *id);
192     }
193 out:
194     return ret;
195 }
196 
197 static void css_clear_io_interrupt(uint16_t subchannel_id,
198                                    uint16_t subchannel_nr)
199 {
200     Error *err = NULL;
201     static bool no_clear_irq;
202     S390FLICState *fs = s390_get_flic();
203     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
204     int r;
205 
206     if (unlikely(no_clear_irq)) {
207         return;
208     }
209     r = fsc->clear_io_irq(fs, subchannel_id, subchannel_nr);
210     switch (r) {
211     case 0:
212         break;
213     case -ENOSYS:
214         no_clear_irq = true;
215         /*
216         * Ignore unavailability, as the user can't do anything
217         * about it anyway.
218         */
219         break;
220     default:
221         error_setg_errno(&err, -r, "unexpected error condition");
222         error_propagate(&error_abort, err);
223     }
224 }
225 
226 static inline uint16_t css_do_build_subchannel_id(uint8_t cssid, uint8_t ssid)
227 {
228     if (channel_subsys.max_cssid > 0) {
229         return (cssid << 8) | (1 << 3) | (ssid << 1) | 1;
230     }
231     return (ssid << 1) | 1;
232 }
233 
234 uint16_t css_build_subchannel_id(SubchDev *sch)
235 {
236     return css_do_build_subchannel_id(sch->cssid, sch->ssid);
237 }
238 
239 static void css_inject_io_interrupt(SubchDev *sch)
240 {
241     uint8_t isc = (sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ISC) >> 11;
242 
243     trace_css_io_interrupt(sch->cssid, sch->ssid, sch->schid,
244                            sch->curr_status.pmcw.intparm, isc, "");
245     s390_io_interrupt(css_build_subchannel_id(sch),
246                       sch->schid,
247                       sch->curr_status.pmcw.intparm,
248                       isc << 27);
249 }
250 
251 void css_conditional_io_interrupt(SubchDev *sch)
252 {
253     /*
254      * If the subchannel is not currently status pending, make it pending
255      * with alert status.
256      */
257     if (!(sch->curr_status.scsw.ctrl & SCSW_STCTL_STATUS_PEND)) {
258         uint8_t isc = (sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ISC) >> 11;
259 
260         trace_css_io_interrupt(sch->cssid, sch->ssid, sch->schid,
261                                sch->curr_status.pmcw.intparm, isc,
262                                "(unsolicited)");
263         sch->curr_status.scsw.ctrl &= ~SCSW_CTRL_MASK_STCTL;
264         sch->curr_status.scsw.ctrl |=
265             SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
266         /* Inject an I/O interrupt. */
267         s390_io_interrupt(css_build_subchannel_id(sch),
268                           sch->schid,
269                           sch->curr_status.pmcw.intparm,
270                           isc << 27);
271     }
272 }
273 
274 void css_adapter_interrupt(uint8_t isc)
275 {
276     uint32_t io_int_word = (isc << 27) | IO_INT_WORD_AI;
277 
278     trace_css_adapter_interrupt(isc);
279     s390_io_interrupt(0, 0, 0, io_int_word);
280 }
281 
282 static void sch_handle_clear_func(SubchDev *sch)
283 {
284     PMCW *p = &sch->curr_status.pmcw;
285     SCSW *s = &sch->curr_status.scsw;
286     int path;
287 
288     /* Path management: In our simple css, we always choose the only path. */
289     path = 0x80;
290 
291     /* Reset values prior to 'issuing the clear signal'. */
292     p->lpum = 0;
293     p->pom = 0xff;
294     s->flags &= ~SCSW_FLAGS_MASK_PNO;
295 
296     /* We always 'attempt to issue the clear signal', and we always succeed. */
297     sch->channel_prog = 0x0;
298     sch->last_cmd_valid = false;
299     s->ctrl &= ~SCSW_ACTL_CLEAR_PEND;
300     s->ctrl |= SCSW_STCTL_STATUS_PEND;
301 
302     s->dstat = 0;
303     s->cstat = 0;
304     p->lpum = path;
305 
306 }
307 
308 static void sch_handle_halt_func(SubchDev *sch)
309 {
310 
311     PMCW *p = &sch->curr_status.pmcw;
312     SCSW *s = &sch->curr_status.scsw;
313     hwaddr curr_ccw = sch->channel_prog;
314     int path;
315 
316     /* Path management: In our simple css, we always choose the only path. */
317     path = 0x80;
318 
319     /* We always 'attempt to issue the halt signal', and we always succeed. */
320     sch->channel_prog = 0x0;
321     sch->last_cmd_valid = false;
322     s->ctrl &= ~SCSW_ACTL_HALT_PEND;
323     s->ctrl |= SCSW_STCTL_STATUS_PEND;
324 
325     if ((s->ctrl & (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) ||
326         !((s->ctrl & SCSW_ACTL_START_PEND) ||
327           (s->ctrl & SCSW_ACTL_SUSP))) {
328         s->dstat = SCSW_DSTAT_DEVICE_END;
329     }
330     if ((s->ctrl & (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) ||
331         (s->ctrl & SCSW_ACTL_SUSP)) {
332         s->cpa = curr_ccw + 8;
333     }
334     s->cstat = 0;
335     p->lpum = path;
336 
337 }
338 
339 static void copy_sense_id_to_guest(SenseId *dest, SenseId *src)
340 {
341     int i;
342 
343     dest->reserved = src->reserved;
344     dest->cu_type = cpu_to_be16(src->cu_type);
345     dest->cu_model = src->cu_model;
346     dest->dev_type = cpu_to_be16(src->dev_type);
347     dest->dev_model = src->dev_model;
348     dest->unused = src->unused;
349     for (i = 0; i < ARRAY_SIZE(dest->ciw); i++) {
350         dest->ciw[i].type = src->ciw[i].type;
351         dest->ciw[i].command = src->ciw[i].command;
352         dest->ciw[i].count = cpu_to_be16(src->ciw[i].count);
353     }
354 }
355 
356 static CCW1 copy_ccw_from_guest(hwaddr addr, bool fmt1)
357 {
358     CCW0 tmp0;
359     CCW1 tmp1;
360     CCW1 ret;
361 
362     if (fmt1) {
363         cpu_physical_memory_read(addr, &tmp1, sizeof(tmp1));
364         ret.cmd_code = tmp1.cmd_code;
365         ret.flags = tmp1.flags;
366         ret.count = be16_to_cpu(tmp1.count);
367         ret.cda = be32_to_cpu(tmp1.cda);
368     } else {
369         cpu_physical_memory_read(addr, &tmp0, sizeof(tmp0));
370         ret.cmd_code = tmp0.cmd_code;
371         ret.flags = tmp0.flags;
372         ret.count = be16_to_cpu(tmp0.count);
373         ret.cda = be16_to_cpu(tmp0.cda1) | (tmp0.cda0 << 16);
374         if ((ret.cmd_code & 0x0f) == CCW_CMD_TIC) {
375             ret.cmd_code &= 0x0f;
376         }
377     }
378     return ret;
379 }
380 
381 static int css_interpret_ccw(SubchDev *sch, hwaddr ccw_addr,
382                              bool suspend_allowed)
383 {
384     int ret;
385     bool check_len;
386     int len;
387     CCW1 ccw;
388 
389     if (!ccw_addr) {
390         return -EIO;
391     }
392 
393     /* Translate everything to format-1 ccws - the information is the same. */
394     ccw = copy_ccw_from_guest(ccw_addr, sch->ccw_fmt_1);
395 
396     /* Check for invalid command codes. */
397     if ((ccw.cmd_code & 0x0f) == 0) {
398         return -EINVAL;
399     }
400     if (((ccw.cmd_code & 0x0f) == CCW_CMD_TIC) &&
401         ((ccw.cmd_code & 0xf0) != 0)) {
402         return -EINVAL;
403     }
404     if (!sch->ccw_fmt_1 && (ccw.count == 0) &&
405         (ccw.cmd_code != CCW_CMD_TIC)) {
406         return -EINVAL;
407     }
408 
409     if (ccw.flags & CCW_FLAG_SUSPEND) {
410         return suspend_allowed ? -EINPROGRESS : -EINVAL;
411     }
412 
413     check_len = !((ccw.flags & CCW_FLAG_SLI) && !(ccw.flags & CCW_FLAG_DC));
414 
415     if (!ccw.cda) {
416         if (sch->ccw_no_data_cnt == 255) {
417             return -EINVAL;
418         }
419         sch->ccw_no_data_cnt++;
420     }
421 
422     /* Look at the command. */
423     switch (ccw.cmd_code) {
424     case CCW_CMD_NOOP:
425         /* Nothing to do. */
426         ret = 0;
427         break;
428     case CCW_CMD_BASIC_SENSE:
429         if (check_len) {
430             if (ccw.count != sizeof(sch->sense_data)) {
431                 ret = -EINVAL;
432                 break;
433             }
434         }
435         len = MIN(ccw.count, sizeof(sch->sense_data));
436         cpu_physical_memory_write(ccw.cda, sch->sense_data, len);
437         sch->curr_status.scsw.count = ccw.count - len;
438         memset(sch->sense_data, 0, sizeof(sch->sense_data));
439         ret = 0;
440         break;
441     case CCW_CMD_SENSE_ID:
442     {
443         SenseId sense_id;
444 
445         copy_sense_id_to_guest(&sense_id, &sch->id);
446         /* Sense ID information is device specific. */
447         if (check_len) {
448             if (ccw.count != sizeof(sense_id)) {
449                 ret = -EINVAL;
450                 break;
451             }
452         }
453         len = MIN(ccw.count, sizeof(sense_id));
454         /*
455          * Only indicate 0xff in the first sense byte if we actually
456          * have enough place to store at least bytes 0-3.
457          */
458         if (len >= 4) {
459             sense_id.reserved = 0xff;
460         } else {
461             sense_id.reserved = 0;
462         }
463         cpu_physical_memory_write(ccw.cda, &sense_id, len);
464         sch->curr_status.scsw.count = ccw.count - len;
465         ret = 0;
466         break;
467     }
468     case CCW_CMD_TIC:
469         if (sch->last_cmd_valid && (sch->last_cmd.cmd_code == CCW_CMD_TIC)) {
470             ret = -EINVAL;
471             break;
472         }
473         if (ccw.flags & (CCW_FLAG_CC | CCW_FLAG_DC)) {
474             ret = -EINVAL;
475             break;
476         }
477         sch->channel_prog = ccw.cda;
478         ret = -EAGAIN;
479         break;
480     default:
481         if (sch->ccw_cb) {
482             /* Handle device specific commands. */
483             ret = sch->ccw_cb(sch, ccw);
484         } else {
485             ret = -ENOSYS;
486         }
487         break;
488     }
489     sch->last_cmd = ccw;
490     sch->last_cmd_valid = true;
491     if (ret == 0) {
492         if (ccw.flags & CCW_FLAG_CC) {
493             sch->channel_prog += 8;
494             ret = -EAGAIN;
495         }
496     }
497 
498     return ret;
499 }
500 
501 static void sch_handle_start_func(SubchDev *sch, ORB *orb)
502 {
503 
504     PMCW *p = &sch->curr_status.pmcw;
505     SCSW *s = &sch->curr_status.scsw;
506     int path;
507     int ret;
508     bool suspend_allowed;
509 
510     /* Path management: In our simple css, we always choose the only path. */
511     path = 0x80;
512 
513     if (!(s->ctrl & SCSW_ACTL_SUSP)) {
514         /* Start Function triggered via ssch, i.e. we have an ORB */
515         s->cstat = 0;
516         s->dstat = 0;
517         /* Look at the orb and try to execute the channel program. */
518         assert(orb != NULL); /* resume does not pass an orb */
519         p->intparm = orb->intparm;
520         if (!(orb->lpm & path)) {
521             /* Generate a deferred cc 3 condition. */
522             s->flags |= SCSW_FLAGS_MASK_CC;
523             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
524             s->ctrl |= (SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND);
525             return;
526         }
527         sch->ccw_fmt_1 = !!(orb->ctrl0 & ORB_CTRL0_MASK_FMT);
528         s->flags |= (sch->ccw_fmt_1) ? SCSW_FLAGS_MASK_FMT : 0;
529         sch->ccw_no_data_cnt = 0;
530         suspend_allowed = !!(orb->ctrl0 & ORB_CTRL0_MASK_SPND);
531     } else {
532         /* Start Function resumed via rsch, i.e. we don't have an
533          * ORB */
534         s->ctrl &= ~(SCSW_ACTL_SUSP | SCSW_ACTL_RESUME_PEND);
535         /* The channel program had been suspended before. */
536         suspend_allowed = true;
537     }
538     sch->last_cmd_valid = false;
539     do {
540         ret = css_interpret_ccw(sch, sch->channel_prog, suspend_allowed);
541         switch (ret) {
542         case -EAGAIN:
543             /* ccw chain, continue processing */
544             break;
545         case 0:
546             /* success */
547             s->ctrl &= ~SCSW_ACTL_START_PEND;
548             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
549             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
550                     SCSW_STCTL_STATUS_PEND;
551             s->dstat = SCSW_DSTAT_CHANNEL_END | SCSW_DSTAT_DEVICE_END;
552             s->cpa = sch->channel_prog + 8;
553             break;
554         case -ENOSYS:
555             /* unsupported command, generate unit check (command reject) */
556             s->ctrl &= ~SCSW_ACTL_START_PEND;
557             s->dstat = SCSW_DSTAT_UNIT_CHECK;
558             /* Set sense bit 0 in ecw0. */
559             sch->sense_data[0] = 0x80;
560             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
561             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
562                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
563             s->cpa = sch->channel_prog + 8;
564             break;
565         case -EFAULT:
566             /* memory problem, generate channel data check */
567             s->ctrl &= ~SCSW_ACTL_START_PEND;
568             s->cstat = SCSW_CSTAT_DATA_CHECK;
569             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
570             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
571                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
572             s->cpa = sch->channel_prog + 8;
573             break;
574         case -EBUSY:
575             /* subchannel busy, generate deferred cc 1 */
576             s->flags &= ~SCSW_FLAGS_MASK_CC;
577             s->flags |= (1 << 8);
578             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
579             s->ctrl |= SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
580             break;
581         case -EINPROGRESS:
582             /* channel program has been suspended */
583             s->ctrl &= ~SCSW_ACTL_START_PEND;
584             s->ctrl |= SCSW_ACTL_SUSP;
585             break;
586         default:
587             /* error, generate channel program check */
588             s->ctrl &= ~SCSW_ACTL_START_PEND;
589             s->cstat = SCSW_CSTAT_PROG_CHECK;
590             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
591             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
592                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
593             s->cpa = sch->channel_prog + 8;
594             break;
595         }
596     } while (ret == -EAGAIN);
597 
598 }
599 
600 /*
601  * On real machines, this would run asynchronously to the main vcpus.
602  * We might want to make some parts of the ssch handling (interpreting
603  * read/writes) asynchronous later on if we start supporting more than
604  * our current very simple devices.
605  */
606 static void do_subchannel_work(SubchDev *sch, ORB *orb)
607 {
608 
609     SCSW *s = &sch->curr_status.scsw;
610 
611     if (s->ctrl & SCSW_FCTL_CLEAR_FUNC) {
612         sch_handle_clear_func(sch);
613     } else if (s->ctrl & SCSW_FCTL_HALT_FUNC) {
614         sch_handle_halt_func(sch);
615     } else if (s->ctrl & SCSW_FCTL_START_FUNC) {
616         /* Triggered by both ssch and rsch. */
617         sch_handle_start_func(sch, orb);
618     } else {
619         /* Cannot happen. */
620         return;
621     }
622     css_inject_io_interrupt(sch);
623 }
624 
625 static void copy_pmcw_to_guest(PMCW *dest, const PMCW *src)
626 {
627     int i;
628 
629     dest->intparm = cpu_to_be32(src->intparm);
630     dest->flags = cpu_to_be16(src->flags);
631     dest->devno = cpu_to_be16(src->devno);
632     dest->lpm = src->lpm;
633     dest->pnom = src->pnom;
634     dest->lpum = src->lpum;
635     dest->pim = src->pim;
636     dest->mbi = cpu_to_be16(src->mbi);
637     dest->pom = src->pom;
638     dest->pam = src->pam;
639     for (i = 0; i < ARRAY_SIZE(dest->chpid); i++) {
640         dest->chpid[i] = src->chpid[i];
641     }
642     dest->chars = cpu_to_be32(src->chars);
643 }
644 
645 static void copy_scsw_to_guest(SCSW *dest, const SCSW *src)
646 {
647     dest->flags = cpu_to_be16(src->flags);
648     dest->ctrl = cpu_to_be16(src->ctrl);
649     dest->cpa = cpu_to_be32(src->cpa);
650     dest->dstat = src->dstat;
651     dest->cstat = src->cstat;
652     dest->count = cpu_to_be16(src->count);
653 }
654 
655 static void copy_schib_to_guest(SCHIB *dest, const SCHIB *src)
656 {
657     int i;
658 
659     copy_pmcw_to_guest(&dest->pmcw, &src->pmcw);
660     copy_scsw_to_guest(&dest->scsw, &src->scsw);
661     dest->mba = cpu_to_be64(src->mba);
662     for (i = 0; i < ARRAY_SIZE(dest->mda); i++) {
663         dest->mda[i] = src->mda[i];
664     }
665 }
666 
667 int css_do_stsch(SubchDev *sch, SCHIB *schib)
668 {
669     /* Use current status. */
670     copy_schib_to_guest(schib, &sch->curr_status);
671     return 0;
672 }
673 
674 static void copy_pmcw_from_guest(PMCW *dest, const PMCW *src)
675 {
676     int i;
677 
678     dest->intparm = be32_to_cpu(src->intparm);
679     dest->flags = be16_to_cpu(src->flags);
680     dest->devno = be16_to_cpu(src->devno);
681     dest->lpm = src->lpm;
682     dest->pnom = src->pnom;
683     dest->lpum = src->lpum;
684     dest->pim = src->pim;
685     dest->mbi = be16_to_cpu(src->mbi);
686     dest->pom = src->pom;
687     dest->pam = src->pam;
688     for (i = 0; i < ARRAY_SIZE(dest->chpid); i++) {
689         dest->chpid[i] = src->chpid[i];
690     }
691     dest->chars = be32_to_cpu(src->chars);
692 }
693 
694 static void copy_scsw_from_guest(SCSW *dest, const SCSW *src)
695 {
696     dest->flags = be16_to_cpu(src->flags);
697     dest->ctrl = be16_to_cpu(src->ctrl);
698     dest->cpa = be32_to_cpu(src->cpa);
699     dest->dstat = src->dstat;
700     dest->cstat = src->cstat;
701     dest->count = be16_to_cpu(src->count);
702 }
703 
704 static void copy_schib_from_guest(SCHIB *dest, const SCHIB *src)
705 {
706     int i;
707 
708     copy_pmcw_from_guest(&dest->pmcw, &src->pmcw);
709     copy_scsw_from_guest(&dest->scsw, &src->scsw);
710     dest->mba = be64_to_cpu(src->mba);
711     for (i = 0; i < ARRAY_SIZE(dest->mda); i++) {
712         dest->mda[i] = src->mda[i];
713     }
714 }
715 
716 int css_do_msch(SubchDev *sch, const SCHIB *orig_schib)
717 {
718     SCSW *s = &sch->curr_status.scsw;
719     PMCW *p = &sch->curr_status.pmcw;
720     uint16_t oldflags;
721     int ret;
722     SCHIB schib;
723 
724     if (!(sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_DNV)) {
725         ret = 0;
726         goto out;
727     }
728 
729     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
730         ret = -EINPROGRESS;
731         goto out;
732     }
733 
734     if (s->ctrl &
735         (SCSW_FCTL_START_FUNC|SCSW_FCTL_HALT_FUNC|SCSW_FCTL_CLEAR_FUNC)) {
736         ret = -EBUSY;
737         goto out;
738     }
739 
740     copy_schib_from_guest(&schib, orig_schib);
741     /* Only update the program-modifiable fields. */
742     p->intparm = schib.pmcw.intparm;
743     oldflags = p->flags;
744     p->flags &= ~(PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
745                   PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
746                   PMCW_FLAGS_MASK_MP);
747     p->flags |= schib.pmcw.flags &
748             (PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
749              PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
750              PMCW_FLAGS_MASK_MP);
751     p->lpm = schib.pmcw.lpm;
752     p->mbi = schib.pmcw.mbi;
753     p->pom = schib.pmcw.pom;
754     p->chars &= ~(PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_CSENSE);
755     p->chars |= schib.pmcw.chars &
756             (PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_CSENSE);
757     sch->curr_status.mba = schib.mba;
758 
759     /* Has the channel been disabled? */
760     if (sch->disable_cb && (oldflags & PMCW_FLAGS_MASK_ENA) != 0
761         && (p->flags & PMCW_FLAGS_MASK_ENA) == 0) {
762         sch->disable_cb(sch);
763     }
764 
765     ret = 0;
766 
767 out:
768     return ret;
769 }
770 
771 int css_do_xsch(SubchDev *sch)
772 {
773     SCSW *s = &sch->curr_status.scsw;
774     PMCW *p = &sch->curr_status.pmcw;
775     int ret;
776 
777     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
778         ret = -ENODEV;
779         goto out;
780     }
781 
782     if (!(s->ctrl & SCSW_CTRL_MASK_FCTL) ||
783         ((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||
784         (!(s->ctrl &
785            (SCSW_ACTL_RESUME_PEND | SCSW_ACTL_START_PEND | SCSW_ACTL_SUSP))) ||
786         (s->ctrl & SCSW_ACTL_SUBCH_ACTIVE)) {
787         ret = -EINPROGRESS;
788         goto out;
789     }
790 
791     if (s->ctrl & SCSW_CTRL_MASK_STCTL) {
792         ret = -EBUSY;
793         goto out;
794     }
795 
796     /* Cancel the current operation. */
797     s->ctrl &= ~(SCSW_FCTL_START_FUNC |
798                  SCSW_ACTL_RESUME_PEND |
799                  SCSW_ACTL_START_PEND |
800                  SCSW_ACTL_SUSP);
801     sch->channel_prog = 0x0;
802     sch->last_cmd_valid = false;
803     s->dstat = 0;
804     s->cstat = 0;
805     ret = 0;
806 
807 out:
808     return ret;
809 }
810 
811 int css_do_csch(SubchDev *sch)
812 {
813     SCSW *s = &sch->curr_status.scsw;
814     PMCW *p = &sch->curr_status.pmcw;
815     int ret;
816 
817     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
818         ret = -ENODEV;
819         goto out;
820     }
821 
822     /* Trigger the clear function. */
823     s->ctrl &= ~(SCSW_CTRL_MASK_FCTL | SCSW_CTRL_MASK_ACTL);
824     s->ctrl |= SCSW_FCTL_CLEAR_FUNC | SCSW_ACTL_CLEAR_PEND;
825 
826     do_subchannel_work(sch, NULL);
827     ret = 0;
828 
829 out:
830     return ret;
831 }
832 
833 int css_do_hsch(SubchDev *sch)
834 {
835     SCSW *s = &sch->curr_status.scsw;
836     PMCW *p = &sch->curr_status.pmcw;
837     int ret;
838 
839     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
840         ret = -ENODEV;
841         goto out;
842     }
843 
844     if (((s->ctrl & SCSW_CTRL_MASK_STCTL) == SCSW_STCTL_STATUS_PEND) ||
845         (s->ctrl & (SCSW_STCTL_PRIMARY |
846                     SCSW_STCTL_SECONDARY |
847                     SCSW_STCTL_ALERT))) {
848         ret = -EINPROGRESS;
849         goto out;
850     }
851 
852     if (s->ctrl & (SCSW_FCTL_HALT_FUNC | SCSW_FCTL_CLEAR_FUNC)) {
853         ret = -EBUSY;
854         goto out;
855     }
856 
857     /* Trigger the halt function. */
858     s->ctrl |= SCSW_FCTL_HALT_FUNC;
859     s->ctrl &= ~SCSW_FCTL_START_FUNC;
860     if (((s->ctrl & SCSW_CTRL_MASK_ACTL) ==
861          (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) &&
862         ((s->ctrl & SCSW_CTRL_MASK_STCTL) == SCSW_STCTL_INTERMEDIATE)) {
863         s->ctrl &= ~SCSW_STCTL_STATUS_PEND;
864     }
865     s->ctrl |= SCSW_ACTL_HALT_PEND;
866 
867     do_subchannel_work(sch, NULL);
868     ret = 0;
869 
870 out:
871     return ret;
872 }
873 
874 static void css_update_chnmon(SubchDev *sch)
875 {
876     if (!(sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_MME)) {
877         /* Not active. */
878         return;
879     }
880     /* The counter is conveniently located at the beginning of the struct. */
881     if (sch->curr_status.pmcw.chars & PMCW_CHARS_MASK_MBFC) {
882         /* Format 1, per-subchannel area. */
883         uint32_t count;
884 
885         count = address_space_ldl(&address_space_memory,
886                                   sch->curr_status.mba,
887                                   MEMTXATTRS_UNSPECIFIED,
888                                   NULL);
889         count++;
890         address_space_stl(&address_space_memory, sch->curr_status.mba, count,
891                           MEMTXATTRS_UNSPECIFIED, NULL);
892     } else {
893         /* Format 0, global area. */
894         uint32_t offset;
895         uint16_t count;
896 
897         offset = sch->curr_status.pmcw.mbi << 5;
898         count = address_space_lduw(&address_space_memory,
899                                    channel_subsys.chnmon_area + offset,
900                                    MEMTXATTRS_UNSPECIFIED,
901                                    NULL);
902         count++;
903         address_space_stw(&address_space_memory,
904                           channel_subsys.chnmon_area + offset, count,
905                           MEMTXATTRS_UNSPECIFIED, NULL);
906     }
907 }
908 
909 int css_do_ssch(SubchDev *sch, ORB *orb)
910 {
911     SCSW *s = &sch->curr_status.scsw;
912     PMCW *p = &sch->curr_status.pmcw;
913     int ret;
914 
915     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
916         ret = -ENODEV;
917         goto out;
918     }
919 
920     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
921         ret = -EINPROGRESS;
922         goto out;
923     }
924 
925     if (s->ctrl & (SCSW_FCTL_START_FUNC |
926                    SCSW_FCTL_HALT_FUNC |
927                    SCSW_FCTL_CLEAR_FUNC)) {
928         ret = -EBUSY;
929         goto out;
930     }
931 
932     /* If monitoring is active, update counter. */
933     if (channel_subsys.chnmon_active) {
934         css_update_chnmon(sch);
935     }
936     sch->channel_prog = orb->cpa;
937     /* Trigger the start function. */
938     s->ctrl |= (SCSW_FCTL_START_FUNC | SCSW_ACTL_START_PEND);
939     s->flags &= ~SCSW_FLAGS_MASK_PNO;
940 
941     do_subchannel_work(sch, orb);
942     ret = 0;
943 
944 out:
945     return ret;
946 }
947 
948 static void copy_irb_to_guest(IRB *dest, const IRB *src, PMCW *pmcw,
949                               int *irb_len)
950 {
951     int i;
952     uint16_t stctl = src->scsw.ctrl & SCSW_CTRL_MASK_STCTL;
953     uint16_t actl = src->scsw.ctrl & SCSW_CTRL_MASK_ACTL;
954 
955     copy_scsw_to_guest(&dest->scsw, &src->scsw);
956 
957     for (i = 0; i < ARRAY_SIZE(dest->esw); i++) {
958         dest->esw[i] = cpu_to_be32(src->esw[i]);
959     }
960     for (i = 0; i < ARRAY_SIZE(dest->ecw); i++) {
961         dest->ecw[i] = cpu_to_be32(src->ecw[i]);
962     }
963     *irb_len = sizeof(*dest) - sizeof(dest->emw);
964 
965     /* extended measurements enabled? */
966     if ((src->scsw.flags & SCSW_FLAGS_MASK_ESWF) ||
967         !(pmcw->flags & PMCW_FLAGS_MASK_TF) ||
968         !(pmcw->chars & PMCW_CHARS_MASK_XMWME)) {
969         return;
970     }
971     /* extended measurements pending? */
972     if (!(stctl & SCSW_STCTL_STATUS_PEND)) {
973         return;
974     }
975     if ((stctl & SCSW_STCTL_PRIMARY) ||
976         (stctl == SCSW_STCTL_SECONDARY) ||
977         ((stctl & SCSW_STCTL_INTERMEDIATE) && (actl & SCSW_ACTL_SUSP))) {
978         for (i = 0; i < ARRAY_SIZE(dest->emw); i++) {
979             dest->emw[i] = cpu_to_be32(src->emw[i]);
980         }
981     }
982     *irb_len = sizeof(*dest);
983 }
984 
985 int css_do_tsch_get_irb(SubchDev *sch, IRB *target_irb, int *irb_len)
986 {
987     SCSW *s = &sch->curr_status.scsw;
988     PMCW *p = &sch->curr_status.pmcw;
989     uint16_t stctl;
990     IRB irb;
991 
992     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
993         return 3;
994     }
995 
996     stctl = s->ctrl & SCSW_CTRL_MASK_STCTL;
997 
998     /* Prepare the irb for the guest. */
999     memset(&irb, 0, sizeof(IRB));
1000 
1001     /* Copy scsw from current status. */
1002     memcpy(&irb.scsw, s, sizeof(SCSW));
1003     if (stctl & SCSW_STCTL_STATUS_PEND) {
1004         if (s->cstat & (SCSW_CSTAT_DATA_CHECK |
1005                         SCSW_CSTAT_CHN_CTRL_CHK |
1006                         SCSW_CSTAT_INTF_CTRL_CHK)) {
1007             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF;
1008             irb.esw[0] = 0x04804000;
1009         } else {
1010             irb.esw[0] = 0x00800000;
1011         }
1012         /* If a unit check is pending, copy sense data. */
1013         if ((s->dstat & SCSW_DSTAT_UNIT_CHECK) &&
1014             (p->chars & PMCW_CHARS_MASK_CSENSE)) {
1015             int i;
1016 
1017             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF | SCSW_FLAGS_MASK_ECTL;
1018             /* Attention: sense_data is already BE! */
1019             memcpy(irb.ecw, sch->sense_data, sizeof(sch->sense_data));
1020             for (i = 0; i < ARRAY_SIZE(irb.ecw); i++) {
1021                 irb.ecw[i] = be32_to_cpu(irb.ecw[i]);
1022             }
1023             irb.esw[1] = 0x01000000 | (sizeof(sch->sense_data) << 8);
1024         }
1025     }
1026     /* Store the irb to the guest. */
1027     copy_irb_to_guest(target_irb, &irb, p, irb_len);
1028 
1029     return ((stctl & SCSW_STCTL_STATUS_PEND) == 0);
1030 }
1031 
1032 void css_do_tsch_update_subch(SubchDev *sch)
1033 {
1034     SCSW *s = &sch->curr_status.scsw;
1035     PMCW *p = &sch->curr_status.pmcw;
1036     uint16_t stctl;
1037     uint16_t fctl;
1038     uint16_t actl;
1039 
1040     stctl = s->ctrl & SCSW_CTRL_MASK_STCTL;
1041     fctl = s->ctrl & SCSW_CTRL_MASK_FCTL;
1042     actl = s->ctrl & SCSW_CTRL_MASK_ACTL;
1043 
1044     /* Clear conditions on subchannel, if applicable. */
1045     if (stctl & SCSW_STCTL_STATUS_PEND) {
1046         s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
1047         if ((stctl != (SCSW_STCTL_INTERMEDIATE | SCSW_STCTL_STATUS_PEND)) ||
1048             ((fctl & SCSW_FCTL_HALT_FUNC) &&
1049              (actl & SCSW_ACTL_SUSP))) {
1050             s->ctrl &= ~SCSW_CTRL_MASK_FCTL;
1051         }
1052         if (stctl != (SCSW_STCTL_INTERMEDIATE | SCSW_STCTL_STATUS_PEND)) {
1053             s->flags &= ~SCSW_FLAGS_MASK_PNO;
1054             s->ctrl &= ~(SCSW_ACTL_RESUME_PEND |
1055                          SCSW_ACTL_START_PEND |
1056                          SCSW_ACTL_HALT_PEND |
1057                          SCSW_ACTL_CLEAR_PEND |
1058                          SCSW_ACTL_SUSP);
1059         } else {
1060             if ((actl & SCSW_ACTL_SUSP) &&
1061                 (fctl & SCSW_FCTL_START_FUNC)) {
1062                 s->flags &= ~SCSW_FLAGS_MASK_PNO;
1063                 if (fctl & SCSW_FCTL_HALT_FUNC) {
1064                     s->ctrl &= ~(SCSW_ACTL_RESUME_PEND |
1065                                  SCSW_ACTL_START_PEND |
1066                                  SCSW_ACTL_HALT_PEND |
1067                                  SCSW_ACTL_CLEAR_PEND |
1068                                  SCSW_ACTL_SUSP);
1069                 } else {
1070                     s->ctrl &= ~SCSW_ACTL_RESUME_PEND;
1071                 }
1072             }
1073         }
1074         /* Clear pending sense data. */
1075         if (p->chars & PMCW_CHARS_MASK_CSENSE) {
1076             memset(sch->sense_data, 0 , sizeof(sch->sense_data));
1077         }
1078     }
1079 }
1080 
1081 static void copy_crw_to_guest(CRW *dest, const CRW *src)
1082 {
1083     dest->flags = cpu_to_be16(src->flags);
1084     dest->rsid = cpu_to_be16(src->rsid);
1085 }
1086 
1087 int css_do_stcrw(CRW *crw)
1088 {
1089     CrwContainer *crw_cont;
1090     int ret;
1091 
1092     crw_cont = QTAILQ_FIRST(&channel_subsys.pending_crws);
1093     if (crw_cont) {
1094         QTAILQ_REMOVE(&channel_subsys.pending_crws, crw_cont, sibling);
1095         copy_crw_to_guest(crw, &crw_cont->crw);
1096         g_free(crw_cont);
1097         ret = 0;
1098     } else {
1099         /* List was empty, turn crw machine checks on again. */
1100         memset(crw, 0, sizeof(*crw));
1101         channel_subsys.do_crw_mchk = true;
1102         ret = 1;
1103     }
1104 
1105     return ret;
1106 }
1107 
1108 static void copy_crw_from_guest(CRW *dest, const CRW *src)
1109 {
1110     dest->flags = be16_to_cpu(src->flags);
1111     dest->rsid = be16_to_cpu(src->rsid);
1112 }
1113 
1114 void css_undo_stcrw(CRW *crw)
1115 {
1116     CrwContainer *crw_cont;
1117 
1118     crw_cont = g_try_malloc0(sizeof(CrwContainer));
1119     if (!crw_cont) {
1120         channel_subsys.crws_lost = true;
1121         return;
1122     }
1123     copy_crw_from_guest(&crw_cont->crw, crw);
1124 
1125     QTAILQ_INSERT_HEAD(&channel_subsys.pending_crws, crw_cont, sibling);
1126 }
1127 
1128 int css_do_tpi(IOIntCode *int_code, int lowcore)
1129 {
1130     /* No pending interrupts for !KVM. */
1131     return 0;
1132  }
1133 
1134 int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid,
1135                          int rfmt, void *buf)
1136 {
1137     int i, desc_size;
1138     uint32_t words[8];
1139     uint32_t chpid_type_word;
1140     CssImage *css;
1141 
1142     if (!m && !cssid) {
1143         css = channel_subsys.css[channel_subsys.default_cssid];
1144     } else {
1145         css = channel_subsys.css[cssid];
1146     }
1147     if (!css) {
1148         return 0;
1149     }
1150     desc_size = 0;
1151     for (i = f_chpid; i <= l_chpid; i++) {
1152         if (css->chpids[i].in_use) {
1153             chpid_type_word = 0x80000000 | (css->chpids[i].type << 8) | i;
1154             if (rfmt == 0) {
1155                 words[0] = cpu_to_be32(chpid_type_word);
1156                 words[1] = 0;
1157                 memcpy(buf + desc_size, words, 8);
1158                 desc_size += 8;
1159             } else if (rfmt == 1) {
1160                 words[0] = cpu_to_be32(chpid_type_word);
1161                 words[1] = 0;
1162                 words[2] = 0;
1163                 words[3] = 0;
1164                 words[4] = 0;
1165                 words[5] = 0;
1166                 words[6] = 0;
1167                 words[7] = 0;
1168                 memcpy(buf + desc_size, words, 32);
1169                 desc_size += 32;
1170             }
1171         }
1172     }
1173     return desc_size;
1174 }
1175 
1176 void css_do_schm(uint8_t mbk, int update, int dct, uint64_t mbo)
1177 {
1178     /* dct is currently ignored (not really meaningful for our devices) */
1179     /* TODO: Don't ignore mbk. */
1180     if (update && !channel_subsys.chnmon_active) {
1181         /* Enable measuring. */
1182         channel_subsys.chnmon_area = mbo;
1183         channel_subsys.chnmon_active = true;
1184     }
1185     if (!update && channel_subsys.chnmon_active) {
1186         /* Disable measuring. */
1187         channel_subsys.chnmon_area = 0;
1188         channel_subsys.chnmon_active = false;
1189     }
1190 }
1191 
1192 int css_do_rsch(SubchDev *sch)
1193 {
1194     SCSW *s = &sch->curr_status.scsw;
1195     PMCW *p = &sch->curr_status.pmcw;
1196     int ret;
1197 
1198     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
1199         ret = -ENODEV;
1200         goto out;
1201     }
1202 
1203     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
1204         ret = -EINPROGRESS;
1205         goto out;
1206     }
1207 
1208     if (((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||
1209         (s->ctrl & SCSW_ACTL_RESUME_PEND) ||
1210         (!(s->ctrl & SCSW_ACTL_SUSP))) {
1211         ret = -EINVAL;
1212         goto out;
1213     }
1214 
1215     /* If monitoring is active, update counter. */
1216     if (channel_subsys.chnmon_active) {
1217         css_update_chnmon(sch);
1218     }
1219 
1220     s->ctrl |= SCSW_ACTL_RESUME_PEND;
1221     do_subchannel_work(sch, NULL);
1222     ret = 0;
1223 
1224 out:
1225     return ret;
1226 }
1227 
1228 int css_do_rchp(uint8_t cssid, uint8_t chpid)
1229 {
1230     uint8_t real_cssid;
1231 
1232     if (cssid > channel_subsys.max_cssid) {
1233         return -EINVAL;
1234     }
1235     if (channel_subsys.max_cssid == 0) {
1236         real_cssid = channel_subsys.default_cssid;
1237     } else {
1238         real_cssid = cssid;
1239     }
1240     if (!channel_subsys.css[real_cssid]) {
1241         return -EINVAL;
1242     }
1243 
1244     if (!channel_subsys.css[real_cssid]->chpids[chpid].in_use) {
1245         return -ENODEV;
1246     }
1247 
1248     if (!channel_subsys.css[real_cssid]->chpids[chpid].is_virtual) {
1249         fprintf(stderr,
1250                 "rchp unsupported for non-virtual chpid %x.%02x!\n",
1251                 real_cssid, chpid);
1252         return -ENODEV;
1253     }
1254 
1255     /* We don't really use a channel path, so we're done here. */
1256     css_queue_crw(CRW_RSC_CHP, CRW_ERC_INIT,
1257                   channel_subsys.max_cssid > 0 ? 1 : 0, chpid);
1258     if (channel_subsys.max_cssid > 0) {
1259         css_queue_crw(CRW_RSC_CHP, CRW_ERC_INIT, 0, real_cssid << 8);
1260     }
1261     return 0;
1262 }
1263 
1264 bool css_schid_final(int m, uint8_t cssid, uint8_t ssid, uint16_t schid)
1265 {
1266     SubchSet *set;
1267     uint8_t real_cssid;
1268 
1269     real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid;
1270     if (real_cssid > MAX_CSSID || ssid > MAX_SSID ||
1271         !channel_subsys.css[real_cssid] ||
1272         !channel_subsys.css[real_cssid]->sch_set[ssid]) {
1273         return true;
1274     }
1275     set = channel_subsys.css[real_cssid]->sch_set[ssid];
1276     return schid > find_last_bit(set->schids_used,
1277                                  (MAX_SCHID + 1) / sizeof(unsigned long));
1278 }
1279 
1280 static int css_add_virtual_chpid(uint8_t cssid, uint8_t chpid, uint8_t type)
1281 {
1282     CssImage *css;
1283 
1284     trace_css_chpid_add(cssid, chpid, type);
1285     if (cssid > MAX_CSSID) {
1286         return -EINVAL;
1287     }
1288     css = channel_subsys.css[cssid];
1289     if (!css) {
1290         return -EINVAL;
1291     }
1292     if (css->chpids[chpid].in_use) {
1293         return -EEXIST;
1294     }
1295     css->chpids[chpid].in_use = 1;
1296     css->chpids[chpid].type = type;
1297     css->chpids[chpid].is_virtual = 1;
1298 
1299     css_generate_chp_crws(cssid, chpid);
1300 
1301     return 0;
1302 }
1303 
1304 void css_sch_build_virtual_schib(SubchDev *sch, uint8_t chpid, uint8_t type)
1305 {
1306     PMCW *p = &sch->curr_status.pmcw;
1307     SCSW *s = &sch->curr_status.scsw;
1308     int i;
1309     CssImage *css = channel_subsys.css[sch->cssid];
1310 
1311     assert(css != NULL);
1312     memset(p, 0, sizeof(PMCW));
1313     p->flags |= PMCW_FLAGS_MASK_DNV;
1314     p->devno = sch->devno;
1315     /* single path */
1316     p->pim = 0x80;
1317     p->pom = 0xff;
1318     p->pam = 0x80;
1319     p->chpid[0] = chpid;
1320     if (!css->chpids[chpid].in_use) {
1321         css_add_virtual_chpid(sch->cssid, chpid, type);
1322     }
1323 
1324     memset(s, 0, sizeof(SCSW));
1325     sch->curr_status.mba = 0;
1326     for (i = 0; i < ARRAY_SIZE(sch->curr_status.mda); i++) {
1327         sch->curr_status.mda[i] = 0;
1328     }
1329 }
1330 
1331 SubchDev *css_find_subch(uint8_t m, uint8_t cssid, uint8_t ssid, uint16_t schid)
1332 {
1333     uint8_t real_cssid;
1334 
1335     real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid;
1336 
1337     if (!channel_subsys.css[real_cssid]) {
1338         return NULL;
1339     }
1340 
1341     if (!channel_subsys.css[real_cssid]->sch_set[ssid]) {
1342         return NULL;
1343     }
1344 
1345     return channel_subsys.css[real_cssid]->sch_set[ssid]->sch[schid];
1346 }
1347 
1348 /**
1349  * Return free device number in subchannel set.
1350  *
1351  * Return index of the first free device number in the subchannel set
1352  * identified by @p cssid and @p ssid, beginning the search at @p
1353  * start and wrapping around at MAX_DEVNO. Return a value exceeding
1354  * MAX_SCHID if there are no free device numbers in the subchannel
1355  * set.
1356  */
1357 static uint32_t css_find_free_devno(uint8_t cssid, uint8_t ssid,
1358                                     uint16_t start)
1359 {
1360     uint32_t round;
1361 
1362     for (round = 0; round <= MAX_DEVNO; round++) {
1363         uint16_t devno = (start + round) % MAX_DEVNO;
1364 
1365         if (!css_devno_used(cssid, ssid, devno)) {
1366             return devno;
1367         }
1368     }
1369     return MAX_DEVNO + 1;
1370 }
1371 
1372 /**
1373  * Return first free subchannel (id) in subchannel set.
1374  *
1375  * Return index of the first free subchannel in the subchannel set
1376  * identified by @p cssid and @p ssid, if there is any. Return a value
1377  * exceeding MAX_SCHID if there are no free subchannels in the
1378  * subchannel set.
1379  */
1380 static uint32_t css_find_free_subch(uint8_t cssid, uint8_t ssid)
1381 {
1382     uint32_t schid;
1383 
1384     for (schid = 0; schid <= MAX_SCHID; schid++) {
1385         if (!css_find_subch(1, cssid, ssid, schid)) {
1386             return schid;
1387         }
1388     }
1389     return MAX_SCHID + 1;
1390 }
1391 
1392 /**
1393  * Return first free subchannel (id) in subchannel set for a device number
1394  *
1395  * Verify the device number @p devno is not used yet in the subchannel
1396  * set identified by @p cssid and @p ssid. Set @p schid to the index
1397  * of the first free subchannel in the subchannel set, if there is
1398  * any. Return true if everything succeeded and false otherwise.
1399  */
1400 static bool css_find_free_subch_for_devno(uint8_t cssid, uint8_t ssid,
1401                                           uint16_t devno, uint16_t *schid,
1402                                           Error **errp)
1403 {
1404     uint32_t free_schid;
1405 
1406     assert(schid);
1407     if (css_devno_used(cssid, ssid, devno)) {
1408         error_setg(errp, "Device %x.%x.%04x already exists",
1409                    cssid, ssid, devno);
1410         return false;
1411     }
1412     free_schid = css_find_free_subch(cssid, ssid);
1413     if (free_schid > MAX_SCHID) {
1414         error_setg(errp, "No free subchannel found for %x.%x.%04x",
1415                    cssid, ssid, devno);
1416         return false;
1417     }
1418     *schid = free_schid;
1419     return true;
1420 }
1421 
1422 /**
1423  * Return first free subchannel (id) and device number
1424  *
1425  * Locate the first free subchannel and first free device number in
1426  * any of the subchannel sets of the channel subsystem identified by
1427  * @p cssid. Return false if no free subchannel / device number could
1428  * be found. Otherwise set @p ssid, @p devno and @p schid to identify
1429  * the available subchannel and device number and return true.
1430  *
1431  * May modify @p ssid, @p devno and / or @p schid even if no free
1432  * subchannel / device number could be found.
1433  */
1434 static bool css_find_free_subch_and_devno(uint8_t cssid, uint8_t *ssid,
1435                                           uint16_t *devno, uint16_t *schid,
1436                                           Error **errp)
1437 {
1438     uint32_t free_schid, free_devno;
1439 
1440     assert(ssid && devno && schid);
1441     for (*ssid = 0; *ssid <= MAX_SSID; (*ssid)++) {
1442         free_schid = css_find_free_subch(cssid, *ssid);
1443         if (free_schid > MAX_SCHID) {
1444             continue;
1445         }
1446         free_devno = css_find_free_devno(cssid, *ssid, free_schid);
1447         if (free_devno > MAX_DEVNO) {
1448             continue;
1449         }
1450         *schid = free_schid;
1451         *devno = free_devno;
1452         return true;
1453     }
1454     error_setg(errp, "Virtual channel subsystem is full!");
1455     return false;
1456 }
1457 
1458 bool css_subch_visible(SubchDev *sch)
1459 {
1460     if (sch->ssid > channel_subsys.max_ssid) {
1461         return false;
1462     }
1463 
1464     if (sch->cssid != channel_subsys.default_cssid) {
1465         return (channel_subsys.max_cssid > 0);
1466     }
1467 
1468     return true;
1469 }
1470 
1471 bool css_present(uint8_t cssid)
1472 {
1473     return (channel_subsys.css[cssid] != NULL);
1474 }
1475 
1476 bool css_devno_used(uint8_t cssid, uint8_t ssid, uint16_t devno)
1477 {
1478     if (!channel_subsys.css[cssid]) {
1479         return false;
1480     }
1481     if (!channel_subsys.css[cssid]->sch_set[ssid]) {
1482         return false;
1483     }
1484 
1485     return !!test_bit(devno,
1486                       channel_subsys.css[cssid]->sch_set[ssid]->devnos_used);
1487 }
1488 
1489 void css_subch_assign(uint8_t cssid, uint8_t ssid, uint16_t schid,
1490                       uint16_t devno, SubchDev *sch)
1491 {
1492     CssImage *css;
1493     SubchSet *s_set;
1494 
1495     trace_css_assign_subch(sch ? "assign" : "deassign", cssid, ssid, schid,
1496                            devno);
1497     if (!channel_subsys.css[cssid]) {
1498         fprintf(stderr,
1499                 "Suspicious call to %s (%x.%x.%04x) for non-existing css!\n",
1500                 __func__, cssid, ssid, schid);
1501         return;
1502     }
1503     css = channel_subsys.css[cssid];
1504 
1505     if (!css->sch_set[ssid]) {
1506         css->sch_set[ssid] = g_malloc0(sizeof(SubchSet));
1507     }
1508     s_set = css->sch_set[ssid];
1509 
1510     s_set->sch[schid] = sch;
1511     if (sch) {
1512         set_bit(schid, s_set->schids_used);
1513         set_bit(devno, s_set->devnos_used);
1514     } else {
1515         clear_bit(schid, s_set->schids_used);
1516         clear_bit(devno, s_set->devnos_used);
1517     }
1518 }
1519 
1520 void css_queue_crw(uint8_t rsc, uint8_t erc, int chain, uint16_t rsid)
1521 {
1522     CrwContainer *crw_cont;
1523 
1524     trace_css_crw(rsc, erc, rsid, chain ? "(chained)" : "");
1525     /* TODO: Maybe use a static crw pool? */
1526     crw_cont = g_try_malloc0(sizeof(CrwContainer));
1527     if (!crw_cont) {
1528         channel_subsys.crws_lost = true;
1529         return;
1530     }
1531     crw_cont->crw.flags = (rsc << 8) | erc;
1532     if (chain) {
1533         crw_cont->crw.flags |= CRW_FLAGS_MASK_C;
1534     }
1535     crw_cont->crw.rsid = rsid;
1536     if (channel_subsys.crws_lost) {
1537         crw_cont->crw.flags |= CRW_FLAGS_MASK_R;
1538         channel_subsys.crws_lost = false;
1539     }
1540 
1541     QTAILQ_INSERT_TAIL(&channel_subsys.pending_crws, crw_cont, sibling);
1542 
1543     if (channel_subsys.do_crw_mchk) {
1544         channel_subsys.do_crw_mchk = false;
1545         /* Inject crw pending machine check. */
1546         s390_crw_mchk();
1547     }
1548 }
1549 
1550 void css_generate_sch_crws(uint8_t cssid, uint8_t ssid, uint16_t schid,
1551                            int hotplugged, int add)
1552 {
1553     uint8_t guest_cssid;
1554     bool chain_crw;
1555 
1556     if (add && !hotplugged) {
1557         return;
1558     }
1559     if (channel_subsys.max_cssid == 0) {
1560         /* Default cssid shows up as 0. */
1561         guest_cssid = (cssid == channel_subsys.default_cssid) ? 0 : cssid;
1562     } else {
1563         /* Show real cssid to the guest. */
1564         guest_cssid = cssid;
1565     }
1566     /*
1567      * Only notify for higher subchannel sets/channel subsystems if the
1568      * guest has enabled it.
1569      */
1570     if ((ssid > channel_subsys.max_ssid) ||
1571         (guest_cssid > channel_subsys.max_cssid) ||
1572         ((channel_subsys.max_cssid == 0) &&
1573          (cssid != channel_subsys.default_cssid))) {
1574         return;
1575     }
1576     chain_crw = (channel_subsys.max_ssid > 0) ||
1577             (channel_subsys.max_cssid > 0);
1578     css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, chain_crw ? 1 : 0, schid);
1579     if (chain_crw) {
1580         css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, 0,
1581                       (guest_cssid << 8) | (ssid << 4));
1582     }
1583     /* RW_ERC_IPI --> clear pending interrupts */
1584     css_clear_io_interrupt(css_do_build_subchannel_id(cssid, ssid), schid);
1585 }
1586 
1587 void css_generate_chp_crws(uint8_t cssid, uint8_t chpid)
1588 {
1589     /* TODO */
1590 }
1591 
1592 void css_generate_css_crws(uint8_t cssid)
1593 {
1594     if (!channel_subsys.sei_pending) {
1595         css_queue_crw(CRW_RSC_CSS, 0, 0, cssid);
1596     }
1597     channel_subsys.sei_pending = true;
1598 }
1599 
1600 void css_clear_sei_pending(void)
1601 {
1602     channel_subsys.sei_pending = false;
1603 }
1604 
1605 int css_enable_mcsse(void)
1606 {
1607     trace_css_enable_facility("mcsse");
1608     channel_subsys.max_cssid = MAX_CSSID;
1609     return 0;
1610 }
1611 
1612 int css_enable_mss(void)
1613 {
1614     trace_css_enable_facility("mss");
1615     channel_subsys.max_ssid = MAX_SSID;
1616     return 0;
1617 }
1618 
1619 void subch_device_save(SubchDev *s, QEMUFile *f)
1620 {
1621     int i;
1622 
1623     qemu_put_byte(f, s->cssid);
1624     qemu_put_byte(f, s->ssid);
1625     qemu_put_be16(f, s->schid);
1626     qemu_put_be16(f, s->devno);
1627     qemu_put_byte(f, s->thinint_active);
1628     /* SCHIB */
1629     /*     PMCW */
1630     qemu_put_be32(f, s->curr_status.pmcw.intparm);
1631     qemu_put_be16(f, s->curr_status.pmcw.flags);
1632     qemu_put_be16(f, s->curr_status.pmcw.devno);
1633     qemu_put_byte(f, s->curr_status.pmcw.lpm);
1634     qemu_put_byte(f, s->curr_status.pmcw.pnom);
1635     qemu_put_byte(f, s->curr_status.pmcw.lpum);
1636     qemu_put_byte(f, s->curr_status.pmcw.pim);
1637     qemu_put_be16(f, s->curr_status.pmcw.mbi);
1638     qemu_put_byte(f, s->curr_status.pmcw.pom);
1639     qemu_put_byte(f, s->curr_status.pmcw.pam);
1640     qemu_put_buffer(f, s->curr_status.pmcw.chpid, 8);
1641     qemu_put_be32(f, s->curr_status.pmcw.chars);
1642     /*     SCSW */
1643     qemu_put_be16(f, s->curr_status.scsw.flags);
1644     qemu_put_be16(f, s->curr_status.scsw.ctrl);
1645     qemu_put_be32(f, s->curr_status.scsw.cpa);
1646     qemu_put_byte(f, s->curr_status.scsw.dstat);
1647     qemu_put_byte(f, s->curr_status.scsw.cstat);
1648     qemu_put_be16(f, s->curr_status.scsw.count);
1649     qemu_put_be64(f, s->curr_status.mba);
1650     qemu_put_buffer(f, s->curr_status.mda, 4);
1651     /* end SCHIB */
1652     qemu_put_buffer(f, s->sense_data, 32);
1653     qemu_put_be64(f, s->channel_prog);
1654     /* last cmd */
1655     qemu_put_byte(f, s->last_cmd.cmd_code);
1656     qemu_put_byte(f, s->last_cmd.flags);
1657     qemu_put_be16(f, s->last_cmd.count);
1658     qemu_put_be32(f, s->last_cmd.cda);
1659     qemu_put_byte(f, s->last_cmd_valid);
1660     qemu_put_byte(f, s->id.reserved);
1661     qemu_put_be16(f, s->id.cu_type);
1662     qemu_put_byte(f, s->id.cu_model);
1663     qemu_put_be16(f, s->id.dev_type);
1664     qemu_put_byte(f, s->id.dev_model);
1665     qemu_put_byte(f, s->id.unused);
1666     for (i = 0; i < ARRAY_SIZE(s->id.ciw); i++) {
1667         qemu_put_byte(f, s->id.ciw[i].type);
1668         qemu_put_byte(f, s->id.ciw[i].command);
1669         qemu_put_be16(f, s->id.ciw[i].count);
1670     }
1671     qemu_put_byte(f, s->ccw_fmt_1);
1672     qemu_put_byte(f, s->ccw_no_data_cnt);
1673 }
1674 
1675 int subch_device_load(SubchDev *s, QEMUFile *f)
1676 {
1677     int i;
1678 
1679     s->cssid = qemu_get_byte(f);
1680     s->ssid = qemu_get_byte(f);
1681     s->schid = qemu_get_be16(f);
1682     s->devno = qemu_get_be16(f);
1683     s->thinint_active = qemu_get_byte(f);
1684     /* SCHIB */
1685     /*     PMCW */
1686     s->curr_status.pmcw.intparm = qemu_get_be32(f);
1687     s->curr_status.pmcw.flags = qemu_get_be16(f);
1688     s->curr_status.pmcw.devno = qemu_get_be16(f);
1689     s->curr_status.pmcw.lpm = qemu_get_byte(f);
1690     s->curr_status.pmcw.pnom  = qemu_get_byte(f);
1691     s->curr_status.pmcw.lpum = qemu_get_byte(f);
1692     s->curr_status.pmcw.pim = qemu_get_byte(f);
1693     s->curr_status.pmcw.mbi = qemu_get_be16(f);
1694     s->curr_status.pmcw.pom = qemu_get_byte(f);
1695     s->curr_status.pmcw.pam = qemu_get_byte(f);
1696     qemu_get_buffer(f, s->curr_status.pmcw.chpid, 8);
1697     s->curr_status.pmcw.chars = qemu_get_be32(f);
1698     /*     SCSW */
1699     s->curr_status.scsw.flags = qemu_get_be16(f);
1700     s->curr_status.scsw.ctrl = qemu_get_be16(f);
1701     s->curr_status.scsw.cpa = qemu_get_be32(f);
1702     s->curr_status.scsw.dstat = qemu_get_byte(f);
1703     s->curr_status.scsw.cstat = qemu_get_byte(f);
1704     s->curr_status.scsw.count = qemu_get_be16(f);
1705     s->curr_status.mba = qemu_get_be64(f);
1706     qemu_get_buffer(f, s->curr_status.mda, 4);
1707     /* end SCHIB */
1708     qemu_get_buffer(f, s->sense_data, 32);
1709     s->channel_prog = qemu_get_be64(f);
1710     /* last cmd */
1711     s->last_cmd.cmd_code = qemu_get_byte(f);
1712     s->last_cmd.flags = qemu_get_byte(f);
1713     s->last_cmd.count = qemu_get_be16(f);
1714     s->last_cmd.cda = qemu_get_be32(f);
1715     s->last_cmd_valid = qemu_get_byte(f);
1716     s->id.reserved = qemu_get_byte(f);
1717     s->id.cu_type = qemu_get_be16(f);
1718     s->id.cu_model = qemu_get_byte(f);
1719     s->id.dev_type = qemu_get_be16(f);
1720     s->id.dev_model = qemu_get_byte(f);
1721     s->id.unused = qemu_get_byte(f);
1722     for (i = 0; i < ARRAY_SIZE(s->id.ciw); i++) {
1723         s->id.ciw[i].type = qemu_get_byte(f);
1724         s->id.ciw[i].command = qemu_get_byte(f);
1725         s->id.ciw[i].count = qemu_get_be16(f);
1726     }
1727     s->ccw_fmt_1 = qemu_get_byte(f);
1728     s->ccw_no_data_cnt = qemu_get_byte(f);
1729     /*
1730      * Hack alert. We don't migrate the channel subsystem status (no
1731      * device!), but we need to find out if the guest enabled mss/mcss-e.
1732      * If the subchannel is enabled, it certainly was able to access it,
1733      * so adjust the max_ssid/max_cssid values for relevant ssid/cssid
1734      * values. This is not watertight, but better than nothing.
1735      */
1736     if (s->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ENA) {
1737         if (s->ssid) {
1738             channel_subsys.max_ssid = MAX_SSID;
1739         }
1740         if (s->cssid != channel_subsys.default_cssid) {
1741             channel_subsys.max_cssid = MAX_CSSID;
1742         }
1743     }
1744     return 0;
1745 }
1746 
1747 void css_reset_sch(SubchDev *sch)
1748 {
1749     PMCW *p = &sch->curr_status.pmcw;
1750 
1751     if ((p->flags & PMCW_FLAGS_MASK_ENA) != 0 && sch->disable_cb) {
1752         sch->disable_cb(sch);
1753     }
1754 
1755     p->intparm = 0;
1756     p->flags &= ~(PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
1757                   PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
1758                   PMCW_FLAGS_MASK_MP | PMCW_FLAGS_MASK_TF);
1759     p->flags |= PMCW_FLAGS_MASK_DNV;
1760     p->devno = sch->devno;
1761     p->pim = 0x80;
1762     p->lpm = p->pim;
1763     p->pnom = 0;
1764     p->lpum = 0;
1765     p->mbi = 0;
1766     p->pom = 0xff;
1767     p->pam = 0x80;
1768     p->chars &= ~(PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_XMWME |
1769                   PMCW_CHARS_MASK_CSENSE);
1770 
1771     memset(&sch->curr_status.scsw, 0, sizeof(sch->curr_status.scsw));
1772     sch->curr_status.mba = 0;
1773 
1774     sch->channel_prog = 0x0;
1775     sch->last_cmd_valid = false;
1776     sch->thinint_active = false;
1777 }
1778 
1779 void css_reset(void)
1780 {
1781     CrwContainer *crw_cont;
1782 
1783     /* Clean up monitoring. */
1784     channel_subsys.chnmon_active = false;
1785     channel_subsys.chnmon_area = 0;
1786 
1787     /* Clear pending CRWs. */
1788     while ((crw_cont = QTAILQ_FIRST(&channel_subsys.pending_crws))) {
1789         QTAILQ_REMOVE(&channel_subsys.pending_crws, crw_cont, sibling);
1790         g_free(crw_cont);
1791     }
1792     channel_subsys.sei_pending = false;
1793     channel_subsys.do_crw_mchk = true;
1794     channel_subsys.crws_lost = false;
1795 
1796     /* Reset maximum ids. */
1797     channel_subsys.max_cssid = 0;
1798     channel_subsys.max_ssid = 0;
1799 }
1800 
1801 static void get_css_devid(Object *obj, Visitor *v, const char *name,
1802                           void *opaque, Error **errp)
1803 {
1804     DeviceState *dev = DEVICE(obj);
1805     Property *prop = opaque;
1806     CssDevId *dev_id = qdev_get_prop_ptr(dev, prop);
1807     char buffer[] = "xx.x.xxxx";
1808     char *p = buffer;
1809     int r;
1810 
1811     if (dev_id->valid) {
1812 
1813         r = snprintf(buffer, sizeof(buffer), "%02x.%1x.%04x", dev_id->cssid,
1814                      dev_id->ssid, dev_id->devid);
1815         assert(r == sizeof(buffer) - 1);
1816 
1817         /* drop leading zero */
1818         if (dev_id->cssid <= 0xf) {
1819             p++;
1820         }
1821     } else {
1822         snprintf(buffer, sizeof(buffer), "<unset>");
1823     }
1824 
1825     visit_type_str(v, name, &p, errp);
1826 }
1827 
1828 /*
1829  * parse <cssid>.<ssid>.<devid> and assert valid range for cssid/ssid
1830  */
1831 static void set_css_devid(Object *obj, Visitor *v, const char *name,
1832                           void *opaque, Error **errp)
1833 {
1834     DeviceState *dev = DEVICE(obj);
1835     Property *prop = opaque;
1836     CssDevId *dev_id = qdev_get_prop_ptr(dev, prop);
1837     Error *local_err = NULL;
1838     char *str;
1839     int num, n1, n2;
1840     unsigned int cssid, ssid, devid;
1841 
1842     if (dev->realized) {
1843         qdev_prop_set_after_realize(dev, name, errp);
1844         return;
1845     }
1846 
1847     visit_type_str(v, name, &str, &local_err);
1848     if (local_err) {
1849         error_propagate(errp, local_err);
1850         return;
1851     }
1852 
1853     num = sscanf(str, "%2x.%1x%n.%4x%n", &cssid, &ssid, &n1, &devid, &n2);
1854     if (num != 3 || (n2 - n1) != 5 || strlen(str) != n2) {
1855         error_set_from_qdev_prop_error(errp, EINVAL, dev, prop, str);
1856         goto out;
1857     }
1858     if ((cssid > MAX_CSSID) || (ssid > MAX_SSID)) {
1859         error_setg(errp, "Invalid cssid or ssid: cssid %x, ssid %x",
1860                    cssid, ssid);
1861         goto out;
1862     }
1863 
1864     dev_id->cssid = cssid;
1865     dev_id->ssid = ssid;
1866     dev_id->devid = devid;
1867     dev_id->valid = true;
1868 
1869 out:
1870     g_free(str);
1871 }
1872 
1873 PropertyInfo css_devid_propinfo = {
1874     .name = "str",
1875     .description = "Identifier of an I/O device in the channel "
1876                    "subsystem, example: fe.1.23ab",
1877     .get = get_css_devid,
1878     .set = set_css_devid,
1879 };
1880 
1881 SubchDev *css_create_virtual_sch(CssDevId bus_id, Error **errp)
1882 {
1883     uint16_t schid = 0;
1884     SubchDev *sch;
1885 
1886     if (bus_id.valid) {
1887         /* Enforce use of virtual cssid. */
1888         if (bus_id.cssid != VIRTUAL_CSSID) {
1889             error_setg(errp, "cssid %hhx not valid for virtual devices",
1890                        bus_id.cssid);
1891             return NULL;
1892         }
1893         if (!css_find_free_subch_for_devno(bus_id.cssid, bus_id.ssid,
1894                                            bus_id.devid, &schid, errp)) {
1895             return NULL;
1896         }
1897     } else {
1898         bus_id.cssid = VIRTUAL_CSSID;
1899         if (!css_find_free_subch_and_devno(bus_id.cssid, &bus_id.ssid,
1900                                            &bus_id.devid, &schid, errp)) {
1901             return NULL;
1902         }
1903     }
1904 
1905     sch = g_malloc0(sizeof(*sch));
1906     sch->cssid = bus_id.cssid;
1907     sch->ssid = bus_id.ssid;
1908     sch->devno = bus_id.devid;
1909     sch->schid = schid;
1910     css_subch_assign(sch->cssid, sch->ssid, schid, sch->devno, sch);
1911     return sch;
1912 }
1913