xref: /qemu/hw/s390x/css.c (revision 52ea63de)
1 /*
2  * Channel subsystem base support.
3  *
4  * Copyright 2012 IBM Corp.
5  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or (at
8  * your option) any later version. See the COPYING file in the top-level
9  * directory.
10  */
11 
12 #include "qemu/osdep.h"
13 #include "qapi/error.h"
14 #include "qapi/visitor.h"
15 #include <hw/qdev.h>
16 #include "qemu/bitops.h"
17 #include "exec/address-spaces.h"
18 #include "cpu.h"
19 #include "hw/s390x/ioinst.h"
20 #include "hw/s390x/css.h"
21 #include "trace.h"
22 #include "hw/s390x/s390_flic.h"
23 
24 typedef struct CrwContainer {
25     CRW crw;
26     QTAILQ_ENTRY(CrwContainer) sibling;
27 } CrwContainer;
28 
29 typedef struct ChpInfo {
30     uint8_t in_use;
31     uint8_t type;
32     uint8_t is_virtual;
33 } ChpInfo;
34 
35 typedef struct SubchSet {
36     SubchDev *sch[MAX_SCHID + 1];
37     unsigned long schids_used[BITS_TO_LONGS(MAX_SCHID + 1)];
38     unsigned long devnos_used[BITS_TO_LONGS(MAX_SCHID + 1)];
39 } SubchSet;
40 
41 typedef struct CssImage {
42     SubchSet *sch_set[MAX_SSID + 1];
43     ChpInfo chpids[MAX_CHPID + 1];
44 } CssImage;
45 
46 typedef struct IoAdapter {
47     uint32_t id;
48     uint8_t type;
49     uint8_t isc;
50     QTAILQ_ENTRY(IoAdapter) sibling;
51 } IoAdapter;
52 
53 typedef struct ChannelSubSys {
54     QTAILQ_HEAD(, CrwContainer) pending_crws;
55     bool sei_pending;
56     bool do_crw_mchk;
57     bool crws_lost;
58     uint8_t max_cssid;
59     uint8_t max_ssid;
60     bool chnmon_active;
61     uint64_t chnmon_area;
62     CssImage *css[MAX_CSSID + 1];
63     uint8_t default_cssid;
64     QTAILQ_HEAD(, IoAdapter) io_adapters;
65     QTAILQ_HEAD(, IndAddr) indicator_addresses;
66 } ChannelSubSys;
67 
68 static ChannelSubSys channel_subsys = {
69     .pending_crws = QTAILQ_HEAD_INITIALIZER(channel_subsys.pending_crws),
70     .do_crw_mchk = true,
71     .sei_pending = false,
72     .do_crw_mchk = true,
73     .crws_lost = false,
74     .chnmon_active = false,
75     .io_adapters = QTAILQ_HEAD_INITIALIZER(channel_subsys.io_adapters),
76     .indicator_addresses =
77         QTAILQ_HEAD_INITIALIZER(channel_subsys.indicator_addresses),
78 };
79 
80 IndAddr *get_indicator(hwaddr ind_addr, int len)
81 {
82     IndAddr *indicator;
83 
84     QTAILQ_FOREACH(indicator, &channel_subsys.indicator_addresses, sibling) {
85         if (indicator->addr == ind_addr) {
86             indicator->refcnt++;
87             return indicator;
88         }
89     }
90     indicator = g_new0(IndAddr, 1);
91     indicator->addr = ind_addr;
92     indicator->len = len;
93     indicator->refcnt = 1;
94     QTAILQ_INSERT_TAIL(&channel_subsys.indicator_addresses,
95                        indicator, sibling);
96     return indicator;
97 }
98 
99 static int s390_io_adapter_map(AdapterInfo *adapter, uint64_t map_addr,
100                                bool do_map)
101 {
102     S390FLICState *fs = s390_get_flic();
103     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
104 
105     return fsc->io_adapter_map(fs, adapter->adapter_id, map_addr, do_map);
106 }
107 
108 void release_indicator(AdapterInfo *adapter, IndAddr *indicator)
109 {
110     assert(indicator->refcnt > 0);
111     indicator->refcnt--;
112     if (indicator->refcnt > 0) {
113         return;
114     }
115     QTAILQ_REMOVE(&channel_subsys.indicator_addresses, indicator, sibling);
116     if (indicator->map) {
117         s390_io_adapter_map(adapter, indicator->map, false);
118     }
119     g_free(indicator);
120 }
121 
122 int map_indicator(AdapterInfo *adapter, IndAddr *indicator)
123 {
124     int ret;
125 
126     if (indicator->map) {
127         return 0; /* already mapped is not an error */
128     }
129     indicator->map = indicator->addr;
130     ret = s390_io_adapter_map(adapter, indicator->map, true);
131     if ((ret != 0) && (ret != -ENOSYS)) {
132         goto out_err;
133     }
134     return 0;
135 
136 out_err:
137     indicator->map = 0;
138     return ret;
139 }
140 
141 int css_create_css_image(uint8_t cssid, bool default_image)
142 {
143     trace_css_new_image(cssid, default_image ? "(default)" : "");
144     if (cssid > MAX_CSSID) {
145         return -EINVAL;
146     }
147     if (channel_subsys.css[cssid]) {
148         return -EBUSY;
149     }
150     channel_subsys.css[cssid] = g_malloc0(sizeof(CssImage));
151     if (default_image) {
152         channel_subsys.default_cssid = cssid;
153     }
154     return 0;
155 }
156 
157 int css_register_io_adapter(uint8_t type, uint8_t isc, bool swap,
158                             bool maskable, uint32_t *id)
159 {
160     IoAdapter *adapter;
161     bool found = false;
162     int ret;
163     S390FLICState *fs = s390_get_flic();
164     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
165 
166     *id = 0;
167     QTAILQ_FOREACH(adapter, &channel_subsys.io_adapters, sibling) {
168         if ((adapter->type == type) && (adapter->isc == isc)) {
169             *id = adapter->id;
170             found = true;
171             ret = 0;
172             break;
173         }
174         if (adapter->id >= *id) {
175             *id = adapter->id + 1;
176         }
177     }
178     if (found) {
179         goto out;
180     }
181     adapter = g_new0(IoAdapter, 1);
182     ret = fsc->register_io_adapter(fs, *id, isc, swap, maskable);
183     if (ret == 0) {
184         adapter->id = *id;
185         adapter->isc = isc;
186         adapter->type = type;
187         QTAILQ_INSERT_TAIL(&channel_subsys.io_adapters, adapter, sibling);
188     } else {
189         g_free(adapter);
190         fprintf(stderr, "Unexpected error %d when registering adapter %d\n",
191                 ret, *id);
192     }
193 out:
194     return ret;
195 }
196 
197 static void css_clear_io_interrupt(uint16_t subchannel_id,
198                                    uint16_t subchannel_nr)
199 {
200     Error *err = NULL;
201     static bool no_clear_irq;
202     S390FLICState *fs = s390_get_flic();
203     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
204     int r;
205 
206     if (unlikely(no_clear_irq)) {
207         return;
208     }
209     r = fsc->clear_io_irq(fs, subchannel_id, subchannel_nr);
210     switch (r) {
211     case 0:
212         break;
213     case -ENOSYS:
214         no_clear_irq = true;
215         /*
216         * Ignore unavailability, as the user can't do anything
217         * about it anyway.
218         */
219         break;
220     default:
221         error_setg_errno(&err, -r, "unexpected error condition");
222         error_propagate(&error_abort, err);
223     }
224 }
225 
226 static inline uint16_t css_do_build_subchannel_id(uint8_t cssid, uint8_t ssid)
227 {
228     if (channel_subsys.max_cssid > 0) {
229         return (cssid << 8) | (1 << 3) | (ssid << 1) | 1;
230     }
231     return (ssid << 1) | 1;
232 }
233 
234 uint16_t css_build_subchannel_id(SubchDev *sch)
235 {
236     return css_do_build_subchannel_id(sch->cssid, sch->ssid);
237 }
238 
239 static void css_inject_io_interrupt(SubchDev *sch)
240 {
241     uint8_t isc = (sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ISC) >> 11;
242 
243     trace_css_io_interrupt(sch->cssid, sch->ssid, sch->schid,
244                            sch->curr_status.pmcw.intparm, isc, "");
245     s390_io_interrupt(css_build_subchannel_id(sch),
246                       sch->schid,
247                       sch->curr_status.pmcw.intparm,
248                       isc << 27);
249 }
250 
251 void css_conditional_io_interrupt(SubchDev *sch)
252 {
253     /*
254      * If the subchannel is not currently status pending, make it pending
255      * with alert status.
256      */
257     if (!(sch->curr_status.scsw.ctrl & SCSW_STCTL_STATUS_PEND)) {
258         uint8_t isc = (sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ISC) >> 11;
259 
260         trace_css_io_interrupt(sch->cssid, sch->ssid, sch->schid,
261                                sch->curr_status.pmcw.intparm, isc,
262                                "(unsolicited)");
263         sch->curr_status.scsw.ctrl &= ~SCSW_CTRL_MASK_STCTL;
264         sch->curr_status.scsw.ctrl |=
265             SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
266         /* Inject an I/O interrupt. */
267         s390_io_interrupt(css_build_subchannel_id(sch),
268                           sch->schid,
269                           sch->curr_status.pmcw.intparm,
270                           isc << 27);
271     }
272 }
273 
274 void css_adapter_interrupt(uint8_t isc)
275 {
276     uint32_t io_int_word = (isc << 27) | IO_INT_WORD_AI;
277 
278     trace_css_adapter_interrupt(isc);
279     s390_io_interrupt(0, 0, 0, io_int_word);
280 }
281 
282 static void sch_handle_clear_func(SubchDev *sch)
283 {
284     PMCW *p = &sch->curr_status.pmcw;
285     SCSW *s = &sch->curr_status.scsw;
286     int path;
287 
288     /* Path management: In our simple css, we always choose the only path. */
289     path = 0x80;
290 
291     /* Reset values prior to 'issuing the clear signal'. */
292     p->lpum = 0;
293     p->pom = 0xff;
294     s->flags &= ~SCSW_FLAGS_MASK_PNO;
295 
296     /* We always 'attempt to issue the clear signal', and we always succeed. */
297     sch->channel_prog = 0x0;
298     sch->last_cmd_valid = false;
299     s->ctrl &= ~SCSW_ACTL_CLEAR_PEND;
300     s->ctrl |= SCSW_STCTL_STATUS_PEND;
301 
302     s->dstat = 0;
303     s->cstat = 0;
304     p->lpum = path;
305 
306 }
307 
308 static void sch_handle_halt_func(SubchDev *sch)
309 {
310 
311     PMCW *p = &sch->curr_status.pmcw;
312     SCSW *s = &sch->curr_status.scsw;
313     hwaddr curr_ccw = sch->channel_prog;
314     int path;
315 
316     /* Path management: In our simple css, we always choose the only path. */
317     path = 0x80;
318 
319     /* We always 'attempt to issue the halt signal', and we always succeed. */
320     sch->channel_prog = 0x0;
321     sch->last_cmd_valid = false;
322     s->ctrl &= ~SCSW_ACTL_HALT_PEND;
323     s->ctrl |= SCSW_STCTL_STATUS_PEND;
324 
325     if ((s->ctrl & (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) ||
326         !((s->ctrl & SCSW_ACTL_START_PEND) ||
327           (s->ctrl & SCSW_ACTL_SUSP))) {
328         s->dstat = SCSW_DSTAT_DEVICE_END;
329     }
330     if ((s->ctrl & (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) ||
331         (s->ctrl & SCSW_ACTL_SUSP)) {
332         s->cpa = curr_ccw + 8;
333     }
334     s->cstat = 0;
335     p->lpum = path;
336 
337 }
338 
339 static void copy_sense_id_to_guest(SenseId *dest, SenseId *src)
340 {
341     int i;
342 
343     dest->reserved = src->reserved;
344     dest->cu_type = cpu_to_be16(src->cu_type);
345     dest->cu_model = src->cu_model;
346     dest->dev_type = cpu_to_be16(src->dev_type);
347     dest->dev_model = src->dev_model;
348     dest->unused = src->unused;
349     for (i = 0; i < ARRAY_SIZE(dest->ciw); i++) {
350         dest->ciw[i].type = src->ciw[i].type;
351         dest->ciw[i].command = src->ciw[i].command;
352         dest->ciw[i].count = cpu_to_be16(src->ciw[i].count);
353     }
354 }
355 
356 static CCW1 copy_ccw_from_guest(hwaddr addr, bool fmt1)
357 {
358     CCW0 tmp0;
359     CCW1 tmp1;
360     CCW1 ret;
361 
362     if (fmt1) {
363         cpu_physical_memory_read(addr, &tmp1, sizeof(tmp1));
364         ret.cmd_code = tmp1.cmd_code;
365         ret.flags = tmp1.flags;
366         ret.count = be16_to_cpu(tmp1.count);
367         ret.cda = be32_to_cpu(tmp1.cda);
368     } else {
369         cpu_physical_memory_read(addr, &tmp0, sizeof(tmp0));
370         ret.cmd_code = tmp0.cmd_code;
371         ret.flags = tmp0.flags;
372         ret.count = be16_to_cpu(tmp0.count);
373         ret.cda = be16_to_cpu(tmp0.cda1) | (tmp0.cda0 << 16);
374         if ((ret.cmd_code & 0x0f) == CCW_CMD_TIC) {
375             ret.cmd_code &= 0x0f;
376         }
377     }
378     return ret;
379 }
380 
381 static int css_interpret_ccw(SubchDev *sch, hwaddr ccw_addr,
382                              bool suspend_allowed)
383 {
384     int ret;
385     bool check_len;
386     int len;
387     CCW1 ccw;
388 
389     if (!ccw_addr) {
390         return -EIO;
391     }
392 
393     /* Translate everything to format-1 ccws - the information is the same. */
394     ccw = copy_ccw_from_guest(ccw_addr, sch->ccw_fmt_1);
395 
396     /* Check for invalid command codes. */
397     if ((ccw.cmd_code & 0x0f) == 0) {
398         return -EINVAL;
399     }
400     if (((ccw.cmd_code & 0x0f) == CCW_CMD_TIC) &&
401         ((ccw.cmd_code & 0xf0) != 0)) {
402         return -EINVAL;
403     }
404     if (!sch->ccw_fmt_1 && (ccw.count == 0) &&
405         (ccw.cmd_code != CCW_CMD_TIC)) {
406         return -EINVAL;
407     }
408 
409     if (ccw.flags & CCW_FLAG_SUSPEND) {
410         return suspend_allowed ? -EINPROGRESS : -EINVAL;
411     }
412 
413     check_len = !((ccw.flags & CCW_FLAG_SLI) && !(ccw.flags & CCW_FLAG_DC));
414 
415     if (!ccw.cda) {
416         if (sch->ccw_no_data_cnt == 255) {
417             return -EINVAL;
418         }
419         sch->ccw_no_data_cnt++;
420     }
421 
422     /* Look at the command. */
423     switch (ccw.cmd_code) {
424     case CCW_CMD_NOOP:
425         /* Nothing to do. */
426         ret = 0;
427         break;
428     case CCW_CMD_BASIC_SENSE:
429         if (check_len) {
430             if (ccw.count != sizeof(sch->sense_data)) {
431                 ret = -EINVAL;
432                 break;
433             }
434         }
435         len = MIN(ccw.count, sizeof(sch->sense_data));
436         cpu_physical_memory_write(ccw.cda, sch->sense_data, len);
437         sch->curr_status.scsw.count = ccw.count - len;
438         memset(sch->sense_data, 0, sizeof(sch->sense_data));
439         ret = 0;
440         break;
441     case CCW_CMD_SENSE_ID:
442     {
443         SenseId sense_id;
444 
445         copy_sense_id_to_guest(&sense_id, &sch->id);
446         /* Sense ID information is device specific. */
447         if (check_len) {
448             if (ccw.count != sizeof(sense_id)) {
449                 ret = -EINVAL;
450                 break;
451             }
452         }
453         len = MIN(ccw.count, sizeof(sense_id));
454         /*
455          * Only indicate 0xff in the first sense byte if we actually
456          * have enough place to store at least bytes 0-3.
457          */
458         if (len >= 4) {
459             sense_id.reserved = 0xff;
460         } else {
461             sense_id.reserved = 0;
462         }
463         cpu_physical_memory_write(ccw.cda, &sense_id, len);
464         sch->curr_status.scsw.count = ccw.count - len;
465         ret = 0;
466         break;
467     }
468     case CCW_CMD_TIC:
469         if (sch->last_cmd_valid && (sch->last_cmd.cmd_code == CCW_CMD_TIC)) {
470             ret = -EINVAL;
471             break;
472         }
473         if (ccw.flags & (CCW_FLAG_CC | CCW_FLAG_DC)) {
474             ret = -EINVAL;
475             break;
476         }
477         sch->channel_prog = ccw.cda;
478         ret = -EAGAIN;
479         break;
480     default:
481         if (sch->ccw_cb) {
482             /* Handle device specific commands. */
483             ret = sch->ccw_cb(sch, ccw);
484         } else {
485             ret = -ENOSYS;
486         }
487         break;
488     }
489     sch->last_cmd = ccw;
490     sch->last_cmd_valid = true;
491     if (ret == 0) {
492         if (ccw.flags & CCW_FLAG_CC) {
493             sch->channel_prog += 8;
494             ret = -EAGAIN;
495         }
496     }
497 
498     return ret;
499 }
500 
501 static void sch_handle_start_func(SubchDev *sch, ORB *orb)
502 {
503 
504     PMCW *p = &sch->curr_status.pmcw;
505     SCSW *s = &sch->curr_status.scsw;
506     int path;
507     int ret;
508     bool suspend_allowed;
509 
510     /* Path management: In our simple css, we always choose the only path. */
511     path = 0x80;
512 
513     if (!(s->ctrl & SCSW_ACTL_SUSP)) {
514         s->cstat = 0;
515         s->dstat = 0;
516         /* Look at the orb and try to execute the channel program. */
517         assert(orb != NULL); /* resume does not pass an orb */
518         p->intparm = orb->intparm;
519         if (!(orb->lpm & path)) {
520             /* Generate a deferred cc 3 condition. */
521             s->flags |= SCSW_FLAGS_MASK_CC;
522             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
523             s->ctrl |= (SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND);
524             return;
525         }
526         sch->ccw_fmt_1 = !!(orb->ctrl0 & ORB_CTRL0_MASK_FMT);
527         sch->ccw_no_data_cnt = 0;
528         suspend_allowed = !!(orb->ctrl0 & ORB_CTRL0_MASK_SPND);
529     } else {
530         s->ctrl &= ~(SCSW_ACTL_SUSP | SCSW_ACTL_RESUME_PEND);
531         /* The channel program had been suspended before. */
532         suspend_allowed = true;
533     }
534     sch->last_cmd_valid = false;
535     do {
536         ret = css_interpret_ccw(sch, sch->channel_prog, suspend_allowed);
537         switch (ret) {
538         case -EAGAIN:
539             /* ccw chain, continue processing */
540             break;
541         case 0:
542             /* success */
543             s->ctrl &= ~SCSW_ACTL_START_PEND;
544             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
545             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
546                     SCSW_STCTL_STATUS_PEND;
547             s->dstat = SCSW_DSTAT_CHANNEL_END | SCSW_DSTAT_DEVICE_END;
548             s->cpa = sch->channel_prog + 8;
549             break;
550         case -ENOSYS:
551             /* unsupported command, generate unit check (command reject) */
552             s->ctrl &= ~SCSW_ACTL_START_PEND;
553             s->dstat = SCSW_DSTAT_UNIT_CHECK;
554             /* Set sense bit 0 in ecw0. */
555             sch->sense_data[0] = 0x80;
556             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
557             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
558                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
559             s->cpa = sch->channel_prog + 8;
560             break;
561         case -EFAULT:
562             /* memory problem, generate channel data check */
563             s->ctrl &= ~SCSW_ACTL_START_PEND;
564             s->cstat = SCSW_CSTAT_DATA_CHECK;
565             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
566             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
567                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
568             s->cpa = sch->channel_prog + 8;
569             break;
570         case -EBUSY:
571             /* subchannel busy, generate deferred cc 1 */
572             s->flags &= ~SCSW_FLAGS_MASK_CC;
573             s->flags |= (1 << 8);
574             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
575             s->ctrl |= SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
576             break;
577         case -EINPROGRESS:
578             /* channel program has been suspended */
579             s->ctrl &= ~SCSW_ACTL_START_PEND;
580             s->ctrl |= SCSW_ACTL_SUSP;
581             break;
582         default:
583             /* error, generate channel program check */
584             s->ctrl &= ~SCSW_ACTL_START_PEND;
585             s->cstat = SCSW_CSTAT_PROG_CHECK;
586             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
587             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
588                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
589             s->cpa = sch->channel_prog + 8;
590             break;
591         }
592     } while (ret == -EAGAIN);
593 
594 }
595 
596 /*
597  * On real machines, this would run asynchronously to the main vcpus.
598  * We might want to make some parts of the ssch handling (interpreting
599  * read/writes) asynchronous later on if we start supporting more than
600  * our current very simple devices.
601  */
602 static void do_subchannel_work(SubchDev *sch, ORB *orb)
603 {
604 
605     SCSW *s = &sch->curr_status.scsw;
606 
607     if (s->ctrl & SCSW_FCTL_CLEAR_FUNC) {
608         sch_handle_clear_func(sch);
609     } else if (s->ctrl & SCSW_FCTL_HALT_FUNC) {
610         sch_handle_halt_func(sch);
611     } else if (s->ctrl & SCSW_FCTL_START_FUNC) {
612         sch_handle_start_func(sch, orb);
613     } else {
614         /* Cannot happen. */
615         return;
616     }
617     css_inject_io_interrupt(sch);
618 }
619 
620 static void copy_pmcw_to_guest(PMCW *dest, const PMCW *src)
621 {
622     int i;
623 
624     dest->intparm = cpu_to_be32(src->intparm);
625     dest->flags = cpu_to_be16(src->flags);
626     dest->devno = cpu_to_be16(src->devno);
627     dest->lpm = src->lpm;
628     dest->pnom = src->pnom;
629     dest->lpum = src->lpum;
630     dest->pim = src->pim;
631     dest->mbi = cpu_to_be16(src->mbi);
632     dest->pom = src->pom;
633     dest->pam = src->pam;
634     for (i = 0; i < ARRAY_SIZE(dest->chpid); i++) {
635         dest->chpid[i] = src->chpid[i];
636     }
637     dest->chars = cpu_to_be32(src->chars);
638 }
639 
640 static void copy_scsw_to_guest(SCSW *dest, const SCSW *src)
641 {
642     dest->flags = cpu_to_be16(src->flags);
643     dest->ctrl = cpu_to_be16(src->ctrl);
644     dest->cpa = cpu_to_be32(src->cpa);
645     dest->dstat = src->dstat;
646     dest->cstat = src->cstat;
647     dest->count = cpu_to_be16(src->count);
648 }
649 
650 static void copy_schib_to_guest(SCHIB *dest, const SCHIB *src)
651 {
652     int i;
653 
654     copy_pmcw_to_guest(&dest->pmcw, &src->pmcw);
655     copy_scsw_to_guest(&dest->scsw, &src->scsw);
656     dest->mba = cpu_to_be64(src->mba);
657     for (i = 0; i < ARRAY_SIZE(dest->mda); i++) {
658         dest->mda[i] = src->mda[i];
659     }
660 }
661 
662 int css_do_stsch(SubchDev *sch, SCHIB *schib)
663 {
664     /* Use current status. */
665     copy_schib_to_guest(schib, &sch->curr_status);
666     return 0;
667 }
668 
669 static void copy_pmcw_from_guest(PMCW *dest, const PMCW *src)
670 {
671     int i;
672 
673     dest->intparm = be32_to_cpu(src->intparm);
674     dest->flags = be16_to_cpu(src->flags);
675     dest->devno = be16_to_cpu(src->devno);
676     dest->lpm = src->lpm;
677     dest->pnom = src->pnom;
678     dest->lpum = src->lpum;
679     dest->pim = src->pim;
680     dest->mbi = be16_to_cpu(src->mbi);
681     dest->pom = src->pom;
682     dest->pam = src->pam;
683     for (i = 0; i < ARRAY_SIZE(dest->chpid); i++) {
684         dest->chpid[i] = src->chpid[i];
685     }
686     dest->chars = be32_to_cpu(src->chars);
687 }
688 
689 static void copy_scsw_from_guest(SCSW *dest, const SCSW *src)
690 {
691     dest->flags = be16_to_cpu(src->flags);
692     dest->ctrl = be16_to_cpu(src->ctrl);
693     dest->cpa = be32_to_cpu(src->cpa);
694     dest->dstat = src->dstat;
695     dest->cstat = src->cstat;
696     dest->count = be16_to_cpu(src->count);
697 }
698 
699 static void copy_schib_from_guest(SCHIB *dest, const SCHIB *src)
700 {
701     int i;
702 
703     copy_pmcw_from_guest(&dest->pmcw, &src->pmcw);
704     copy_scsw_from_guest(&dest->scsw, &src->scsw);
705     dest->mba = be64_to_cpu(src->mba);
706     for (i = 0; i < ARRAY_SIZE(dest->mda); i++) {
707         dest->mda[i] = src->mda[i];
708     }
709 }
710 
711 int css_do_msch(SubchDev *sch, const SCHIB *orig_schib)
712 {
713     SCSW *s = &sch->curr_status.scsw;
714     PMCW *p = &sch->curr_status.pmcw;
715     uint16_t oldflags;
716     int ret;
717     SCHIB schib;
718 
719     if (!(sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_DNV)) {
720         ret = 0;
721         goto out;
722     }
723 
724     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
725         ret = -EINPROGRESS;
726         goto out;
727     }
728 
729     if (s->ctrl &
730         (SCSW_FCTL_START_FUNC|SCSW_FCTL_HALT_FUNC|SCSW_FCTL_CLEAR_FUNC)) {
731         ret = -EBUSY;
732         goto out;
733     }
734 
735     copy_schib_from_guest(&schib, orig_schib);
736     /* Only update the program-modifiable fields. */
737     p->intparm = schib.pmcw.intparm;
738     oldflags = p->flags;
739     p->flags &= ~(PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
740                   PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
741                   PMCW_FLAGS_MASK_MP);
742     p->flags |= schib.pmcw.flags &
743             (PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
744              PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
745              PMCW_FLAGS_MASK_MP);
746     p->lpm = schib.pmcw.lpm;
747     p->mbi = schib.pmcw.mbi;
748     p->pom = schib.pmcw.pom;
749     p->chars &= ~(PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_CSENSE);
750     p->chars |= schib.pmcw.chars &
751             (PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_CSENSE);
752     sch->curr_status.mba = schib.mba;
753 
754     /* Has the channel been disabled? */
755     if (sch->disable_cb && (oldflags & PMCW_FLAGS_MASK_ENA) != 0
756         && (p->flags & PMCW_FLAGS_MASK_ENA) == 0) {
757         sch->disable_cb(sch);
758     }
759 
760     ret = 0;
761 
762 out:
763     return ret;
764 }
765 
766 int css_do_xsch(SubchDev *sch)
767 {
768     SCSW *s = &sch->curr_status.scsw;
769     PMCW *p = &sch->curr_status.pmcw;
770     int ret;
771 
772     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
773         ret = -ENODEV;
774         goto out;
775     }
776 
777     if (!(s->ctrl & SCSW_CTRL_MASK_FCTL) ||
778         ((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||
779         (!(s->ctrl &
780            (SCSW_ACTL_RESUME_PEND | SCSW_ACTL_START_PEND | SCSW_ACTL_SUSP))) ||
781         (s->ctrl & SCSW_ACTL_SUBCH_ACTIVE)) {
782         ret = -EINPROGRESS;
783         goto out;
784     }
785 
786     if (s->ctrl & SCSW_CTRL_MASK_STCTL) {
787         ret = -EBUSY;
788         goto out;
789     }
790 
791     /* Cancel the current operation. */
792     s->ctrl &= ~(SCSW_FCTL_START_FUNC |
793                  SCSW_ACTL_RESUME_PEND |
794                  SCSW_ACTL_START_PEND |
795                  SCSW_ACTL_SUSP);
796     sch->channel_prog = 0x0;
797     sch->last_cmd_valid = false;
798     s->dstat = 0;
799     s->cstat = 0;
800     ret = 0;
801 
802 out:
803     return ret;
804 }
805 
806 int css_do_csch(SubchDev *sch)
807 {
808     SCSW *s = &sch->curr_status.scsw;
809     PMCW *p = &sch->curr_status.pmcw;
810     int ret;
811 
812     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
813         ret = -ENODEV;
814         goto out;
815     }
816 
817     /* Trigger the clear function. */
818     s->ctrl &= ~(SCSW_CTRL_MASK_FCTL | SCSW_CTRL_MASK_ACTL);
819     s->ctrl |= SCSW_FCTL_CLEAR_FUNC | SCSW_ACTL_CLEAR_PEND;
820 
821     do_subchannel_work(sch, NULL);
822     ret = 0;
823 
824 out:
825     return ret;
826 }
827 
828 int css_do_hsch(SubchDev *sch)
829 {
830     SCSW *s = &sch->curr_status.scsw;
831     PMCW *p = &sch->curr_status.pmcw;
832     int ret;
833 
834     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
835         ret = -ENODEV;
836         goto out;
837     }
838 
839     if (((s->ctrl & SCSW_CTRL_MASK_STCTL) == SCSW_STCTL_STATUS_PEND) ||
840         (s->ctrl & (SCSW_STCTL_PRIMARY |
841                     SCSW_STCTL_SECONDARY |
842                     SCSW_STCTL_ALERT))) {
843         ret = -EINPROGRESS;
844         goto out;
845     }
846 
847     if (s->ctrl & (SCSW_FCTL_HALT_FUNC | SCSW_FCTL_CLEAR_FUNC)) {
848         ret = -EBUSY;
849         goto out;
850     }
851 
852     /* Trigger the halt function. */
853     s->ctrl |= SCSW_FCTL_HALT_FUNC;
854     s->ctrl &= ~SCSW_FCTL_START_FUNC;
855     if (((s->ctrl & SCSW_CTRL_MASK_ACTL) ==
856          (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) &&
857         ((s->ctrl & SCSW_CTRL_MASK_STCTL) == SCSW_STCTL_INTERMEDIATE)) {
858         s->ctrl &= ~SCSW_STCTL_STATUS_PEND;
859     }
860     s->ctrl |= SCSW_ACTL_HALT_PEND;
861 
862     do_subchannel_work(sch, NULL);
863     ret = 0;
864 
865 out:
866     return ret;
867 }
868 
869 static void css_update_chnmon(SubchDev *sch)
870 {
871     if (!(sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_MME)) {
872         /* Not active. */
873         return;
874     }
875     /* The counter is conveniently located at the beginning of the struct. */
876     if (sch->curr_status.pmcw.chars & PMCW_CHARS_MASK_MBFC) {
877         /* Format 1, per-subchannel area. */
878         uint32_t count;
879 
880         count = address_space_ldl(&address_space_memory,
881                                   sch->curr_status.mba,
882                                   MEMTXATTRS_UNSPECIFIED,
883                                   NULL);
884         count++;
885         address_space_stl(&address_space_memory, sch->curr_status.mba, count,
886                           MEMTXATTRS_UNSPECIFIED, NULL);
887     } else {
888         /* Format 0, global area. */
889         uint32_t offset;
890         uint16_t count;
891 
892         offset = sch->curr_status.pmcw.mbi << 5;
893         count = address_space_lduw(&address_space_memory,
894                                    channel_subsys.chnmon_area + offset,
895                                    MEMTXATTRS_UNSPECIFIED,
896                                    NULL);
897         count++;
898         address_space_stw(&address_space_memory,
899                           channel_subsys.chnmon_area + offset, count,
900                           MEMTXATTRS_UNSPECIFIED, NULL);
901     }
902 }
903 
904 int css_do_ssch(SubchDev *sch, ORB *orb)
905 {
906     SCSW *s = &sch->curr_status.scsw;
907     PMCW *p = &sch->curr_status.pmcw;
908     int ret;
909 
910     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
911         ret = -ENODEV;
912         goto out;
913     }
914 
915     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
916         ret = -EINPROGRESS;
917         goto out;
918     }
919 
920     if (s->ctrl & (SCSW_FCTL_START_FUNC |
921                    SCSW_FCTL_HALT_FUNC |
922                    SCSW_FCTL_CLEAR_FUNC)) {
923         ret = -EBUSY;
924         goto out;
925     }
926 
927     /* If monitoring is active, update counter. */
928     if (channel_subsys.chnmon_active) {
929         css_update_chnmon(sch);
930     }
931     sch->channel_prog = orb->cpa;
932     /* Trigger the start function. */
933     s->ctrl |= (SCSW_FCTL_START_FUNC | SCSW_ACTL_START_PEND);
934     s->flags &= ~SCSW_FLAGS_MASK_PNO;
935 
936     do_subchannel_work(sch, orb);
937     ret = 0;
938 
939 out:
940     return ret;
941 }
942 
943 static void copy_irb_to_guest(IRB *dest, const IRB *src, PMCW *pmcw,
944                               int *irb_len)
945 {
946     int i;
947     uint16_t stctl = src->scsw.ctrl & SCSW_CTRL_MASK_STCTL;
948     uint16_t actl = src->scsw.ctrl & SCSW_CTRL_MASK_ACTL;
949 
950     copy_scsw_to_guest(&dest->scsw, &src->scsw);
951 
952     for (i = 0; i < ARRAY_SIZE(dest->esw); i++) {
953         dest->esw[i] = cpu_to_be32(src->esw[i]);
954     }
955     for (i = 0; i < ARRAY_SIZE(dest->ecw); i++) {
956         dest->ecw[i] = cpu_to_be32(src->ecw[i]);
957     }
958     *irb_len = sizeof(*dest) - sizeof(dest->emw);
959 
960     /* extended measurements enabled? */
961     if ((src->scsw.flags & SCSW_FLAGS_MASK_ESWF) ||
962         !(pmcw->flags & PMCW_FLAGS_MASK_TF) ||
963         !(pmcw->chars & PMCW_CHARS_MASK_XMWME)) {
964         return;
965     }
966     /* extended measurements pending? */
967     if (!(stctl & SCSW_STCTL_STATUS_PEND)) {
968         return;
969     }
970     if ((stctl & SCSW_STCTL_PRIMARY) ||
971         (stctl == SCSW_STCTL_SECONDARY) ||
972         ((stctl & SCSW_STCTL_INTERMEDIATE) && (actl & SCSW_ACTL_SUSP))) {
973         for (i = 0; i < ARRAY_SIZE(dest->emw); i++) {
974             dest->emw[i] = cpu_to_be32(src->emw[i]);
975         }
976     }
977     *irb_len = sizeof(*dest);
978 }
979 
980 int css_do_tsch_get_irb(SubchDev *sch, IRB *target_irb, int *irb_len)
981 {
982     SCSW *s = &sch->curr_status.scsw;
983     PMCW *p = &sch->curr_status.pmcw;
984     uint16_t stctl;
985     IRB irb;
986 
987     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
988         return 3;
989     }
990 
991     stctl = s->ctrl & SCSW_CTRL_MASK_STCTL;
992 
993     /* Prepare the irb for the guest. */
994     memset(&irb, 0, sizeof(IRB));
995 
996     /* Copy scsw from current status. */
997     memcpy(&irb.scsw, s, sizeof(SCSW));
998     if (stctl & SCSW_STCTL_STATUS_PEND) {
999         if (s->cstat & (SCSW_CSTAT_DATA_CHECK |
1000                         SCSW_CSTAT_CHN_CTRL_CHK |
1001                         SCSW_CSTAT_INTF_CTRL_CHK)) {
1002             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF;
1003             irb.esw[0] = 0x04804000;
1004         } else {
1005             irb.esw[0] = 0x00800000;
1006         }
1007         /* If a unit check is pending, copy sense data. */
1008         if ((s->dstat & SCSW_DSTAT_UNIT_CHECK) &&
1009             (p->chars & PMCW_CHARS_MASK_CSENSE)) {
1010             int i;
1011 
1012             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF | SCSW_FLAGS_MASK_ECTL;
1013             /* Attention: sense_data is already BE! */
1014             memcpy(irb.ecw, sch->sense_data, sizeof(sch->sense_data));
1015             for (i = 0; i < ARRAY_SIZE(irb.ecw); i++) {
1016                 irb.ecw[i] = be32_to_cpu(irb.ecw[i]);
1017             }
1018             irb.esw[1] = 0x01000000 | (sizeof(sch->sense_data) << 8);
1019         }
1020     }
1021     /* Store the irb to the guest. */
1022     copy_irb_to_guest(target_irb, &irb, p, irb_len);
1023 
1024     return ((stctl & SCSW_STCTL_STATUS_PEND) == 0);
1025 }
1026 
1027 void css_do_tsch_update_subch(SubchDev *sch)
1028 {
1029     SCSW *s = &sch->curr_status.scsw;
1030     PMCW *p = &sch->curr_status.pmcw;
1031     uint16_t stctl;
1032     uint16_t fctl;
1033     uint16_t actl;
1034 
1035     stctl = s->ctrl & SCSW_CTRL_MASK_STCTL;
1036     fctl = s->ctrl & SCSW_CTRL_MASK_FCTL;
1037     actl = s->ctrl & SCSW_CTRL_MASK_ACTL;
1038 
1039     /* Clear conditions on subchannel, if applicable. */
1040     if (stctl & SCSW_STCTL_STATUS_PEND) {
1041         s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
1042         if ((stctl != (SCSW_STCTL_INTERMEDIATE | SCSW_STCTL_STATUS_PEND)) ||
1043             ((fctl & SCSW_FCTL_HALT_FUNC) &&
1044              (actl & SCSW_ACTL_SUSP))) {
1045             s->ctrl &= ~SCSW_CTRL_MASK_FCTL;
1046         }
1047         if (stctl != (SCSW_STCTL_INTERMEDIATE | SCSW_STCTL_STATUS_PEND)) {
1048             s->flags &= ~SCSW_FLAGS_MASK_PNO;
1049             s->ctrl &= ~(SCSW_ACTL_RESUME_PEND |
1050                          SCSW_ACTL_START_PEND |
1051                          SCSW_ACTL_HALT_PEND |
1052                          SCSW_ACTL_CLEAR_PEND |
1053                          SCSW_ACTL_SUSP);
1054         } else {
1055             if ((actl & SCSW_ACTL_SUSP) &&
1056                 (fctl & SCSW_FCTL_START_FUNC)) {
1057                 s->flags &= ~SCSW_FLAGS_MASK_PNO;
1058                 if (fctl & SCSW_FCTL_HALT_FUNC) {
1059                     s->ctrl &= ~(SCSW_ACTL_RESUME_PEND |
1060                                  SCSW_ACTL_START_PEND |
1061                                  SCSW_ACTL_HALT_PEND |
1062                                  SCSW_ACTL_CLEAR_PEND |
1063                                  SCSW_ACTL_SUSP);
1064                 } else {
1065                     s->ctrl &= ~SCSW_ACTL_RESUME_PEND;
1066                 }
1067             }
1068         }
1069         /* Clear pending sense data. */
1070         if (p->chars & PMCW_CHARS_MASK_CSENSE) {
1071             memset(sch->sense_data, 0 , sizeof(sch->sense_data));
1072         }
1073     }
1074 }
1075 
1076 static void copy_crw_to_guest(CRW *dest, const CRW *src)
1077 {
1078     dest->flags = cpu_to_be16(src->flags);
1079     dest->rsid = cpu_to_be16(src->rsid);
1080 }
1081 
1082 int css_do_stcrw(CRW *crw)
1083 {
1084     CrwContainer *crw_cont;
1085     int ret;
1086 
1087     crw_cont = QTAILQ_FIRST(&channel_subsys.pending_crws);
1088     if (crw_cont) {
1089         QTAILQ_REMOVE(&channel_subsys.pending_crws, crw_cont, sibling);
1090         copy_crw_to_guest(crw, &crw_cont->crw);
1091         g_free(crw_cont);
1092         ret = 0;
1093     } else {
1094         /* List was empty, turn crw machine checks on again. */
1095         memset(crw, 0, sizeof(*crw));
1096         channel_subsys.do_crw_mchk = true;
1097         ret = 1;
1098     }
1099 
1100     return ret;
1101 }
1102 
1103 static void copy_crw_from_guest(CRW *dest, const CRW *src)
1104 {
1105     dest->flags = be16_to_cpu(src->flags);
1106     dest->rsid = be16_to_cpu(src->rsid);
1107 }
1108 
1109 void css_undo_stcrw(CRW *crw)
1110 {
1111     CrwContainer *crw_cont;
1112 
1113     crw_cont = g_try_malloc0(sizeof(CrwContainer));
1114     if (!crw_cont) {
1115         channel_subsys.crws_lost = true;
1116         return;
1117     }
1118     copy_crw_from_guest(&crw_cont->crw, crw);
1119 
1120     QTAILQ_INSERT_HEAD(&channel_subsys.pending_crws, crw_cont, sibling);
1121 }
1122 
1123 int css_do_tpi(IOIntCode *int_code, int lowcore)
1124 {
1125     /* No pending interrupts for !KVM. */
1126     return 0;
1127  }
1128 
1129 int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid,
1130                          int rfmt, void *buf)
1131 {
1132     int i, desc_size;
1133     uint32_t words[8];
1134     uint32_t chpid_type_word;
1135     CssImage *css;
1136 
1137     if (!m && !cssid) {
1138         css = channel_subsys.css[channel_subsys.default_cssid];
1139     } else {
1140         css = channel_subsys.css[cssid];
1141     }
1142     if (!css) {
1143         return 0;
1144     }
1145     desc_size = 0;
1146     for (i = f_chpid; i <= l_chpid; i++) {
1147         if (css->chpids[i].in_use) {
1148             chpid_type_word = 0x80000000 | (css->chpids[i].type << 8) | i;
1149             if (rfmt == 0) {
1150                 words[0] = cpu_to_be32(chpid_type_word);
1151                 words[1] = 0;
1152                 memcpy(buf + desc_size, words, 8);
1153                 desc_size += 8;
1154             } else if (rfmt == 1) {
1155                 words[0] = cpu_to_be32(chpid_type_word);
1156                 words[1] = 0;
1157                 words[2] = 0;
1158                 words[3] = 0;
1159                 words[4] = 0;
1160                 words[5] = 0;
1161                 words[6] = 0;
1162                 words[7] = 0;
1163                 memcpy(buf + desc_size, words, 32);
1164                 desc_size += 32;
1165             }
1166         }
1167     }
1168     return desc_size;
1169 }
1170 
1171 void css_do_schm(uint8_t mbk, int update, int dct, uint64_t mbo)
1172 {
1173     /* dct is currently ignored (not really meaningful for our devices) */
1174     /* TODO: Don't ignore mbk. */
1175     if (update && !channel_subsys.chnmon_active) {
1176         /* Enable measuring. */
1177         channel_subsys.chnmon_area = mbo;
1178         channel_subsys.chnmon_active = true;
1179     }
1180     if (!update && channel_subsys.chnmon_active) {
1181         /* Disable measuring. */
1182         channel_subsys.chnmon_area = 0;
1183         channel_subsys.chnmon_active = false;
1184     }
1185 }
1186 
1187 int css_do_rsch(SubchDev *sch)
1188 {
1189     SCSW *s = &sch->curr_status.scsw;
1190     PMCW *p = &sch->curr_status.pmcw;
1191     int ret;
1192 
1193     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
1194         ret = -ENODEV;
1195         goto out;
1196     }
1197 
1198     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
1199         ret = -EINPROGRESS;
1200         goto out;
1201     }
1202 
1203     if (((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||
1204         (s->ctrl & SCSW_ACTL_RESUME_PEND) ||
1205         (!(s->ctrl & SCSW_ACTL_SUSP))) {
1206         ret = -EINVAL;
1207         goto out;
1208     }
1209 
1210     /* If monitoring is active, update counter. */
1211     if (channel_subsys.chnmon_active) {
1212         css_update_chnmon(sch);
1213     }
1214 
1215     s->ctrl |= SCSW_ACTL_RESUME_PEND;
1216     do_subchannel_work(sch, NULL);
1217     ret = 0;
1218 
1219 out:
1220     return ret;
1221 }
1222 
1223 int css_do_rchp(uint8_t cssid, uint8_t chpid)
1224 {
1225     uint8_t real_cssid;
1226 
1227     if (cssid > channel_subsys.max_cssid) {
1228         return -EINVAL;
1229     }
1230     if (channel_subsys.max_cssid == 0) {
1231         real_cssid = channel_subsys.default_cssid;
1232     } else {
1233         real_cssid = cssid;
1234     }
1235     if (!channel_subsys.css[real_cssid]) {
1236         return -EINVAL;
1237     }
1238 
1239     if (!channel_subsys.css[real_cssid]->chpids[chpid].in_use) {
1240         return -ENODEV;
1241     }
1242 
1243     if (!channel_subsys.css[real_cssid]->chpids[chpid].is_virtual) {
1244         fprintf(stderr,
1245                 "rchp unsupported for non-virtual chpid %x.%02x!\n",
1246                 real_cssid, chpid);
1247         return -ENODEV;
1248     }
1249 
1250     /* We don't really use a channel path, so we're done here. */
1251     css_queue_crw(CRW_RSC_CHP, CRW_ERC_INIT,
1252                   channel_subsys.max_cssid > 0 ? 1 : 0, chpid);
1253     if (channel_subsys.max_cssid > 0) {
1254         css_queue_crw(CRW_RSC_CHP, CRW_ERC_INIT, 0, real_cssid << 8);
1255     }
1256     return 0;
1257 }
1258 
1259 bool css_schid_final(int m, uint8_t cssid, uint8_t ssid, uint16_t schid)
1260 {
1261     SubchSet *set;
1262     uint8_t real_cssid;
1263 
1264     real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid;
1265     if (real_cssid > MAX_CSSID || ssid > MAX_SSID ||
1266         !channel_subsys.css[real_cssid] ||
1267         !channel_subsys.css[real_cssid]->sch_set[ssid]) {
1268         return true;
1269     }
1270     set = channel_subsys.css[real_cssid]->sch_set[ssid];
1271     return schid > find_last_bit(set->schids_used,
1272                                  (MAX_SCHID + 1) / sizeof(unsigned long));
1273 }
1274 
1275 static int css_add_virtual_chpid(uint8_t cssid, uint8_t chpid, uint8_t type)
1276 {
1277     CssImage *css;
1278 
1279     trace_css_chpid_add(cssid, chpid, type);
1280     if (cssid > MAX_CSSID) {
1281         return -EINVAL;
1282     }
1283     css = channel_subsys.css[cssid];
1284     if (!css) {
1285         return -EINVAL;
1286     }
1287     if (css->chpids[chpid].in_use) {
1288         return -EEXIST;
1289     }
1290     css->chpids[chpid].in_use = 1;
1291     css->chpids[chpid].type = type;
1292     css->chpids[chpid].is_virtual = 1;
1293 
1294     css_generate_chp_crws(cssid, chpid);
1295 
1296     return 0;
1297 }
1298 
1299 void css_sch_build_virtual_schib(SubchDev *sch, uint8_t chpid, uint8_t type)
1300 {
1301     PMCW *p = &sch->curr_status.pmcw;
1302     SCSW *s = &sch->curr_status.scsw;
1303     int i;
1304     CssImage *css = channel_subsys.css[sch->cssid];
1305 
1306     assert(css != NULL);
1307     memset(p, 0, sizeof(PMCW));
1308     p->flags |= PMCW_FLAGS_MASK_DNV;
1309     p->devno = sch->devno;
1310     /* single path */
1311     p->pim = 0x80;
1312     p->pom = 0xff;
1313     p->pam = 0x80;
1314     p->chpid[0] = chpid;
1315     if (!css->chpids[chpid].in_use) {
1316         css_add_virtual_chpid(sch->cssid, chpid, type);
1317     }
1318 
1319     memset(s, 0, sizeof(SCSW));
1320     sch->curr_status.mba = 0;
1321     for (i = 0; i < ARRAY_SIZE(sch->curr_status.mda); i++) {
1322         sch->curr_status.mda[i] = 0;
1323     }
1324 }
1325 
1326 SubchDev *css_find_subch(uint8_t m, uint8_t cssid, uint8_t ssid, uint16_t schid)
1327 {
1328     uint8_t real_cssid;
1329 
1330     real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid;
1331 
1332     if (!channel_subsys.css[real_cssid]) {
1333         return NULL;
1334     }
1335 
1336     if (!channel_subsys.css[real_cssid]->sch_set[ssid]) {
1337         return NULL;
1338     }
1339 
1340     return channel_subsys.css[real_cssid]->sch_set[ssid]->sch[schid];
1341 }
1342 
1343 bool css_subch_visible(SubchDev *sch)
1344 {
1345     if (sch->ssid > channel_subsys.max_ssid) {
1346         return false;
1347     }
1348 
1349     if (sch->cssid != channel_subsys.default_cssid) {
1350         return (channel_subsys.max_cssid > 0);
1351     }
1352 
1353     return true;
1354 }
1355 
1356 bool css_present(uint8_t cssid)
1357 {
1358     return (channel_subsys.css[cssid] != NULL);
1359 }
1360 
1361 bool css_devno_used(uint8_t cssid, uint8_t ssid, uint16_t devno)
1362 {
1363     if (!channel_subsys.css[cssid]) {
1364         return false;
1365     }
1366     if (!channel_subsys.css[cssid]->sch_set[ssid]) {
1367         return false;
1368     }
1369 
1370     return !!test_bit(devno,
1371                       channel_subsys.css[cssid]->sch_set[ssid]->devnos_used);
1372 }
1373 
1374 void css_subch_assign(uint8_t cssid, uint8_t ssid, uint16_t schid,
1375                       uint16_t devno, SubchDev *sch)
1376 {
1377     CssImage *css;
1378     SubchSet *s_set;
1379 
1380     trace_css_assign_subch(sch ? "assign" : "deassign", cssid, ssid, schid,
1381                            devno);
1382     if (!channel_subsys.css[cssid]) {
1383         fprintf(stderr,
1384                 "Suspicious call to %s (%x.%x.%04x) for non-existing css!\n",
1385                 __func__, cssid, ssid, schid);
1386         return;
1387     }
1388     css = channel_subsys.css[cssid];
1389 
1390     if (!css->sch_set[ssid]) {
1391         css->sch_set[ssid] = g_malloc0(sizeof(SubchSet));
1392     }
1393     s_set = css->sch_set[ssid];
1394 
1395     s_set->sch[schid] = sch;
1396     if (sch) {
1397         set_bit(schid, s_set->schids_used);
1398         set_bit(devno, s_set->devnos_used);
1399     } else {
1400         clear_bit(schid, s_set->schids_used);
1401         clear_bit(devno, s_set->devnos_used);
1402     }
1403 }
1404 
1405 void css_queue_crw(uint8_t rsc, uint8_t erc, int chain, uint16_t rsid)
1406 {
1407     CrwContainer *crw_cont;
1408 
1409     trace_css_crw(rsc, erc, rsid, chain ? "(chained)" : "");
1410     /* TODO: Maybe use a static crw pool? */
1411     crw_cont = g_try_malloc0(sizeof(CrwContainer));
1412     if (!crw_cont) {
1413         channel_subsys.crws_lost = true;
1414         return;
1415     }
1416     crw_cont->crw.flags = (rsc << 8) | erc;
1417     if (chain) {
1418         crw_cont->crw.flags |= CRW_FLAGS_MASK_C;
1419     }
1420     crw_cont->crw.rsid = rsid;
1421     if (channel_subsys.crws_lost) {
1422         crw_cont->crw.flags |= CRW_FLAGS_MASK_R;
1423         channel_subsys.crws_lost = false;
1424     }
1425 
1426     QTAILQ_INSERT_TAIL(&channel_subsys.pending_crws, crw_cont, sibling);
1427 
1428     if (channel_subsys.do_crw_mchk) {
1429         channel_subsys.do_crw_mchk = false;
1430         /* Inject crw pending machine check. */
1431         s390_crw_mchk();
1432     }
1433 }
1434 
1435 void css_generate_sch_crws(uint8_t cssid, uint8_t ssid, uint16_t schid,
1436                            int hotplugged, int add)
1437 {
1438     uint8_t guest_cssid;
1439     bool chain_crw;
1440 
1441     if (add && !hotplugged) {
1442         return;
1443     }
1444     if (channel_subsys.max_cssid == 0) {
1445         /* Default cssid shows up as 0. */
1446         guest_cssid = (cssid == channel_subsys.default_cssid) ? 0 : cssid;
1447     } else {
1448         /* Show real cssid to the guest. */
1449         guest_cssid = cssid;
1450     }
1451     /*
1452      * Only notify for higher subchannel sets/channel subsystems if the
1453      * guest has enabled it.
1454      */
1455     if ((ssid > channel_subsys.max_ssid) ||
1456         (guest_cssid > channel_subsys.max_cssid) ||
1457         ((channel_subsys.max_cssid == 0) &&
1458          (cssid != channel_subsys.default_cssid))) {
1459         return;
1460     }
1461     chain_crw = (channel_subsys.max_ssid > 0) ||
1462             (channel_subsys.max_cssid > 0);
1463     css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, chain_crw ? 1 : 0, schid);
1464     if (chain_crw) {
1465         css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, 0,
1466                       (guest_cssid << 8) | (ssid << 4));
1467     }
1468     /* RW_ERC_IPI --> clear pending interrupts */
1469     css_clear_io_interrupt(css_do_build_subchannel_id(cssid, ssid), schid);
1470 }
1471 
1472 void css_generate_chp_crws(uint8_t cssid, uint8_t chpid)
1473 {
1474     /* TODO */
1475 }
1476 
1477 void css_generate_css_crws(uint8_t cssid)
1478 {
1479     if (!channel_subsys.sei_pending) {
1480         css_queue_crw(CRW_RSC_CSS, 0, 0, cssid);
1481     }
1482     channel_subsys.sei_pending = true;
1483 }
1484 
1485 void css_clear_sei_pending(void)
1486 {
1487     channel_subsys.sei_pending = false;
1488 }
1489 
1490 int css_enable_mcsse(void)
1491 {
1492     trace_css_enable_facility("mcsse");
1493     channel_subsys.max_cssid = MAX_CSSID;
1494     return 0;
1495 }
1496 
1497 int css_enable_mss(void)
1498 {
1499     trace_css_enable_facility("mss");
1500     channel_subsys.max_ssid = MAX_SSID;
1501     return 0;
1502 }
1503 
1504 void subch_device_save(SubchDev *s, QEMUFile *f)
1505 {
1506     int i;
1507 
1508     qemu_put_byte(f, s->cssid);
1509     qemu_put_byte(f, s->ssid);
1510     qemu_put_be16(f, s->schid);
1511     qemu_put_be16(f, s->devno);
1512     qemu_put_byte(f, s->thinint_active);
1513     /* SCHIB */
1514     /*     PMCW */
1515     qemu_put_be32(f, s->curr_status.pmcw.intparm);
1516     qemu_put_be16(f, s->curr_status.pmcw.flags);
1517     qemu_put_be16(f, s->curr_status.pmcw.devno);
1518     qemu_put_byte(f, s->curr_status.pmcw.lpm);
1519     qemu_put_byte(f, s->curr_status.pmcw.pnom);
1520     qemu_put_byte(f, s->curr_status.pmcw.lpum);
1521     qemu_put_byte(f, s->curr_status.pmcw.pim);
1522     qemu_put_be16(f, s->curr_status.pmcw.mbi);
1523     qemu_put_byte(f, s->curr_status.pmcw.pom);
1524     qemu_put_byte(f, s->curr_status.pmcw.pam);
1525     qemu_put_buffer(f, s->curr_status.pmcw.chpid, 8);
1526     qemu_put_be32(f, s->curr_status.pmcw.chars);
1527     /*     SCSW */
1528     qemu_put_be16(f, s->curr_status.scsw.flags);
1529     qemu_put_be16(f, s->curr_status.scsw.ctrl);
1530     qemu_put_be32(f, s->curr_status.scsw.cpa);
1531     qemu_put_byte(f, s->curr_status.scsw.dstat);
1532     qemu_put_byte(f, s->curr_status.scsw.cstat);
1533     qemu_put_be16(f, s->curr_status.scsw.count);
1534     qemu_put_be64(f, s->curr_status.mba);
1535     qemu_put_buffer(f, s->curr_status.mda, 4);
1536     /* end SCHIB */
1537     qemu_put_buffer(f, s->sense_data, 32);
1538     qemu_put_be64(f, s->channel_prog);
1539     /* last cmd */
1540     qemu_put_byte(f, s->last_cmd.cmd_code);
1541     qemu_put_byte(f, s->last_cmd.flags);
1542     qemu_put_be16(f, s->last_cmd.count);
1543     qemu_put_be32(f, s->last_cmd.cda);
1544     qemu_put_byte(f, s->last_cmd_valid);
1545     qemu_put_byte(f, s->id.reserved);
1546     qemu_put_be16(f, s->id.cu_type);
1547     qemu_put_byte(f, s->id.cu_model);
1548     qemu_put_be16(f, s->id.dev_type);
1549     qemu_put_byte(f, s->id.dev_model);
1550     qemu_put_byte(f, s->id.unused);
1551     for (i = 0; i < ARRAY_SIZE(s->id.ciw); i++) {
1552         qemu_put_byte(f, s->id.ciw[i].type);
1553         qemu_put_byte(f, s->id.ciw[i].command);
1554         qemu_put_be16(f, s->id.ciw[i].count);
1555     }
1556     qemu_put_byte(f, s->ccw_fmt_1);
1557     qemu_put_byte(f, s->ccw_no_data_cnt);
1558 }
1559 
1560 int subch_device_load(SubchDev *s, QEMUFile *f)
1561 {
1562     int i;
1563 
1564     s->cssid = qemu_get_byte(f);
1565     s->ssid = qemu_get_byte(f);
1566     s->schid = qemu_get_be16(f);
1567     s->devno = qemu_get_be16(f);
1568     s->thinint_active = qemu_get_byte(f);
1569     /* SCHIB */
1570     /*     PMCW */
1571     s->curr_status.pmcw.intparm = qemu_get_be32(f);
1572     s->curr_status.pmcw.flags = qemu_get_be16(f);
1573     s->curr_status.pmcw.devno = qemu_get_be16(f);
1574     s->curr_status.pmcw.lpm = qemu_get_byte(f);
1575     s->curr_status.pmcw.pnom  = qemu_get_byte(f);
1576     s->curr_status.pmcw.lpum = qemu_get_byte(f);
1577     s->curr_status.pmcw.pim = qemu_get_byte(f);
1578     s->curr_status.pmcw.mbi = qemu_get_be16(f);
1579     s->curr_status.pmcw.pom = qemu_get_byte(f);
1580     s->curr_status.pmcw.pam = qemu_get_byte(f);
1581     qemu_get_buffer(f, s->curr_status.pmcw.chpid, 8);
1582     s->curr_status.pmcw.chars = qemu_get_be32(f);
1583     /*     SCSW */
1584     s->curr_status.scsw.flags = qemu_get_be16(f);
1585     s->curr_status.scsw.ctrl = qemu_get_be16(f);
1586     s->curr_status.scsw.cpa = qemu_get_be32(f);
1587     s->curr_status.scsw.dstat = qemu_get_byte(f);
1588     s->curr_status.scsw.cstat = qemu_get_byte(f);
1589     s->curr_status.scsw.count = qemu_get_be16(f);
1590     s->curr_status.mba = qemu_get_be64(f);
1591     qemu_get_buffer(f, s->curr_status.mda, 4);
1592     /* end SCHIB */
1593     qemu_get_buffer(f, s->sense_data, 32);
1594     s->channel_prog = qemu_get_be64(f);
1595     /* last cmd */
1596     s->last_cmd.cmd_code = qemu_get_byte(f);
1597     s->last_cmd.flags = qemu_get_byte(f);
1598     s->last_cmd.count = qemu_get_be16(f);
1599     s->last_cmd.cda = qemu_get_be32(f);
1600     s->last_cmd_valid = qemu_get_byte(f);
1601     s->id.reserved = qemu_get_byte(f);
1602     s->id.cu_type = qemu_get_be16(f);
1603     s->id.cu_model = qemu_get_byte(f);
1604     s->id.dev_type = qemu_get_be16(f);
1605     s->id.dev_model = qemu_get_byte(f);
1606     s->id.unused = qemu_get_byte(f);
1607     for (i = 0; i < ARRAY_SIZE(s->id.ciw); i++) {
1608         s->id.ciw[i].type = qemu_get_byte(f);
1609         s->id.ciw[i].command = qemu_get_byte(f);
1610         s->id.ciw[i].count = qemu_get_be16(f);
1611     }
1612     s->ccw_fmt_1 = qemu_get_byte(f);
1613     s->ccw_no_data_cnt = qemu_get_byte(f);
1614     /*
1615      * Hack alert. We don't migrate the channel subsystem status (no
1616      * device!), but we need to find out if the guest enabled mss/mcss-e.
1617      * If the subchannel is enabled, it certainly was able to access it,
1618      * so adjust the max_ssid/max_cssid values for relevant ssid/cssid
1619      * values. This is not watertight, but better than nothing.
1620      */
1621     if (s->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ENA) {
1622         if (s->ssid) {
1623             channel_subsys.max_ssid = MAX_SSID;
1624         }
1625         if (s->cssid != channel_subsys.default_cssid) {
1626             channel_subsys.max_cssid = MAX_CSSID;
1627         }
1628     }
1629     return 0;
1630 }
1631 
1632 void css_reset_sch(SubchDev *sch)
1633 {
1634     PMCW *p = &sch->curr_status.pmcw;
1635 
1636     if ((p->flags & PMCW_FLAGS_MASK_ENA) != 0 && sch->disable_cb) {
1637         sch->disable_cb(sch);
1638     }
1639 
1640     p->intparm = 0;
1641     p->flags &= ~(PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
1642                   PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
1643                   PMCW_FLAGS_MASK_MP | PMCW_FLAGS_MASK_TF);
1644     p->flags |= PMCW_FLAGS_MASK_DNV;
1645     p->devno = sch->devno;
1646     p->pim = 0x80;
1647     p->lpm = p->pim;
1648     p->pnom = 0;
1649     p->lpum = 0;
1650     p->mbi = 0;
1651     p->pom = 0xff;
1652     p->pam = 0x80;
1653     p->chars &= ~(PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_XMWME |
1654                   PMCW_CHARS_MASK_CSENSE);
1655 
1656     memset(&sch->curr_status.scsw, 0, sizeof(sch->curr_status.scsw));
1657     sch->curr_status.mba = 0;
1658 
1659     sch->channel_prog = 0x0;
1660     sch->last_cmd_valid = false;
1661     sch->thinint_active = false;
1662 }
1663 
1664 void css_reset(void)
1665 {
1666     CrwContainer *crw_cont;
1667 
1668     /* Clean up monitoring. */
1669     channel_subsys.chnmon_active = false;
1670     channel_subsys.chnmon_area = 0;
1671 
1672     /* Clear pending CRWs. */
1673     while ((crw_cont = QTAILQ_FIRST(&channel_subsys.pending_crws))) {
1674         QTAILQ_REMOVE(&channel_subsys.pending_crws, crw_cont, sibling);
1675         g_free(crw_cont);
1676     }
1677     channel_subsys.sei_pending = false;
1678     channel_subsys.do_crw_mchk = true;
1679     channel_subsys.crws_lost = false;
1680 
1681     /* Reset maximum ids. */
1682     channel_subsys.max_cssid = 0;
1683     channel_subsys.max_ssid = 0;
1684 }
1685 
1686 static void get_css_devid(Object *obj, Visitor *v, const char *name,
1687                           void *opaque, Error **errp)
1688 {
1689     DeviceState *dev = DEVICE(obj);
1690     Property *prop = opaque;
1691     CssDevId *dev_id = qdev_get_prop_ptr(dev, prop);
1692     char buffer[] = "xx.x.xxxx";
1693     char *p = buffer;
1694     int r;
1695 
1696     if (dev_id->valid) {
1697 
1698         r = snprintf(buffer, sizeof(buffer), "%02x.%1x.%04x", dev_id->cssid,
1699                      dev_id->ssid, dev_id->devid);
1700         assert(r == sizeof(buffer) - 1);
1701 
1702         /* drop leading zero */
1703         if (dev_id->cssid <= 0xf) {
1704             p++;
1705         }
1706     } else {
1707         snprintf(buffer, sizeof(buffer), "<unset>");
1708     }
1709 
1710     visit_type_str(v, name, &p, errp);
1711 }
1712 
1713 /*
1714  * parse <cssid>.<ssid>.<devid> and assert valid range for cssid/ssid
1715  */
1716 static void set_css_devid(Object *obj, Visitor *v, const char *name,
1717                           void *opaque, Error **errp)
1718 {
1719     DeviceState *dev = DEVICE(obj);
1720     Property *prop = opaque;
1721     CssDevId *dev_id = qdev_get_prop_ptr(dev, prop);
1722     Error *local_err = NULL;
1723     char *str;
1724     int num, n1, n2;
1725     unsigned int cssid, ssid, devid;
1726 
1727     if (dev->realized) {
1728         qdev_prop_set_after_realize(dev, name, errp);
1729         return;
1730     }
1731 
1732     visit_type_str(v, name, &str, &local_err);
1733     if (local_err) {
1734         error_propagate(errp, local_err);
1735         return;
1736     }
1737 
1738     num = sscanf(str, "%2x.%1x%n.%4x%n", &cssid, &ssid, &n1, &devid, &n2);
1739     if (num != 3 || (n2 - n1) != 5 || strlen(str) != n2) {
1740         error_set_from_qdev_prop_error(errp, EINVAL, dev, prop, str);
1741         goto out;
1742     }
1743     if ((cssid > MAX_CSSID) || (ssid > MAX_SSID)) {
1744         error_setg(errp, "Invalid cssid or ssid: cssid %x, ssid %x",
1745                    cssid, ssid);
1746         goto out;
1747     }
1748 
1749     dev_id->cssid = cssid;
1750     dev_id->ssid = ssid;
1751     dev_id->devid = devid;
1752     dev_id->valid = true;
1753 
1754 out:
1755     g_free(str);
1756 }
1757 
1758 PropertyInfo css_devid_propinfo = {
1759     .name = "str",
1760     .description = "Identifier of an I/O device in the channel "
1761                    "subsystem, example: fe.1.23ab",
1762     .get = get_css_devid,
1763     .set = set_css_devid,
1764 };
1765