target/s390x/ioinst.c

   1 /*
   2  * I/O instructions for S/390
   3  *
   4  * Copyright 2012, 2015 IBM Corp.
   5  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
   6  *
   7  * This work is licensed under the terms of the GNU GPL, version 2 or (at
   8  * your option) any later version. See the COPYING file in the top-level
   9  * directory.
  10  */
  11
  12 #include "qemu/osdep.h"
  13
  14 #include "cpu.h"
  15 #include "internal.h"
  16 #include "hw/s390x/ioinst.h"
  17 #include "trace.h"
  18 #include "hw/s390x/s390-pci-bus.h"
  19
  20 int ioinst_disassemble_sch_ident(uint32_t value, int *m, int *cssid, int *ssid,
  21                                  int *schid)
  22 {
  23     if (!IOINST_SCHID_ONE(value)) {
  24         return -EINVAL;
  25     }
  26     if (!IOINST_SCHID_M(value)) {
  27         if (IOINST_SCHID_CSSID(value)) {
  28             return -EINVAL;
  29         }
  30         *cssid = 0;
  31         *m = 0;
  32     } else {
  33         *cssid = IOINST_SCHID_CSSID(value);
  34         *m = 1;
  35     }
  36     *ssid = IOINST_SCHID_SSID(value);
  37     *schid = IOINST_SCHID_NR(value);
  38     return 0;
  39 }
  40
  41 void ioinst_handle_xsch(S390CPU *cpu, uint64_t reg1)
  42 {
  43     int cssid, ssid, schid, m;
  44     SubchDev *sch;
  45     int ret = -ENODEV;
  46     int cc;
  47
  48     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
  49         program_interrupt(&cpu->env, PGM_OPERAND, 4);
  50         return;
  51     }
  52     trace_ioinst_sch_id("xsch", cssid, ssid, schid);
  53     sch = css_find_subch(m, cssid, ssid, schid);
  54     if (sch && css_subch_visible(sch)) {
  55         ret = css_do_xsch(sch);
  56     }
  57     switch (ret) {
  58     case -ENODEV:
  59         cc = 3;
  60         break;
  61     case -EBUSY:
  62         cc = 2;
  63         break;
  64     case 0:
  65         cc = 0;
  66         break;
  67     default:
  68         cc = 1;
  69         break;
  70     }
  71     setcc(cpu, cc);
  72 }
  73
  74 void ioinst_handle_csch(S390CPU *cpu, uint64_t reg1)
  75 {
  76     int cssid, ssid, schid, m;
  77     SubchDev *sch;
  78     int ret = -ENODEV;
  79     int cc;
  80
  81     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
  82         program_interrupt(&cpu->env, PGM_OPERAND, 4);
  83         return;
  84     }
  85     trace_ioinst_sch_id("csch", cssid, ssid, schid);
  86     sch = css_find_subch(m, cssid, ssid, schid);
  87     if (sch && css_subch_visible(sch)) {
  88         ret = css_do_csch(sch);
  89     }
  90     if (ret == -ENODEV) {
  91         cc = 3;
  92     } else {
  93         cc = 0;
  94     }
  95     setcc(cpu, cc);
  96 }
  97
  98 void ioinst_handle_hsch(S390CPU *cpu, uint64_t reg1)
  99 {
 100     int cssid, ssid, schid, m;
 101     SubchDev *sch;
 102     int ret = -ENODEV;
 103     int cc;
 104
 105     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 106         program_interrupt(&cpu->env, PGM_OPERAND, 4);
 107         return;
 108     }
 109     trace_ioinst_sch_id("hsch", cssid, ssid, schid);
 110     sch = css_find_subch(m, cssid, ssid, schid);
 111     if (sch && css_subch_visible(sch)) {
 112         ret = css_do_hsch(sch);
 113     }
 114     switch (ret) {
 115     case -ENODEV:
 116         cc = 3;
 117         break;
 118     case -EBUSY:
 119         cc = 2;
 120         break;
 121     case 0:
 122         cc = 0;
 123         break;
 124     default:
 125         cc = 1;
 126         break;
 127     }
 128     setcc(cpu, cc);
 129 }
 130
 131 static int ioinst_schib_valid(SCHIB *schib)
 132 {
 133     if ((be16_to_cpu(schib->pmcw.flags) & PMCW_FLAGS_MASK_INVALID) ||
 134         (be32_to_cpu(schib->pmcw.chars) & PMCW_CHARS_MASK_INVALID)) {
 135         return 0;
 136     }
 137     /* Disallow extended measurements for now. */
 138     if (be32_to_cpu(schib->pmcw.chars) & PMCW_CHARS_MASK_XMWME) {
 139         return 0;
 140     }
 141     return 1;
 142 }
 143
 144 void ioinst_handle_msch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 145 {
 146     int cssid, ssid, schid, m;
 147     SubchDev *sch;
 148     SCHIB schib;
 149     uint64_t addr;
 150     int ret = -ENODEV;
 151     int cc;
 152     CPUS390XState *env = &cpu->env;
 153     uint8_t ar;
 154
 155     addr = decode_basedisp_s(env, ipb, &ar);
 156     if (addr & 3) {
 157         program_interrupt(env, PGM_SPECIFICATION, 4);
 158         return;
 159     }
 160     if (s390_cpu_virt_mem_read(cpu, addr, ar, &schib, sizeof(schib))) {
 161         return;
 162     }
 163     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
 164         !ioinst_schib_valid(&schib)) {
 165         program_interrupt(env, PGM_OPERAND, 4);
 166         return;
 167     }
 168     trace_ioinst_sch_id("msch", cssid, ssid, schid);
 169     sch = css_find_subch(m, cssid, ssid, schid);
 170     if (sch && css_subch_visible(sch)) {
 171         ret = css_do_msch(sch, &schib);
 172     }
 173     switch (ret) {
 174     case -ENODEV:
 175         cc = 3;
 176         break;
 177     case -EBUSY:
 178         cc = 2;
 179         break;
 180     case 0:
 181         cc = 0;
 182         break;
 183     default:
 184         cc = 1;
 185         break;
 186     }
 187     setcc(cpu, cc);
 188 }
 189
 190 static void copy_orb_from_guest(ORB *dest, const ORB *src)
 191 {
 192     dest->intparm = be32_to_cpu(src->intparm);
 193     dest->ctrl0 = be16_to_cpu(src->ctrl0);
 194     dest->lpm = src->lpm;
 195     dest->ctrl1 = src->ctrl1;
 196     dest->cpa = be32_to_cpu(src->cpa);
 197 }
 198
 199 static int ioinst_orb_valid(ORB *orb)
 200 {
 201     if ((orb->ctrl0 & ORB_CTRL0_MASK_INVALID) ||
 202         (orb->ctrl1 & ORB_CTRL1_MASK_INVALID)) {
 203         return 0;
 204     }
 205     /* We don't support MIDA. */
 206     if (orb->ctrl1 & ORB_CTRL1_MASK_MIDAW) {
 207         return 0;
 208     }
 209     if ((orb->cpa & HIGH_ORDER_BIT) != 0) {
 210         return 0;
 211     }
 212     return 1;
 213 }
 214
 215 void ioinst_handle_ssch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 216 {
 217     int cssid, ssid, schid, m;
 218     SubchDev *sch;
 219     ORB orig_orb, orb;
 220     uint64_t addr;
 221     CPUS390XState *env = &cpu->env;
 222     uint8_t ar;
 223
 224     addr = decode_basedisp_s(env, ipb, &ar);
 225     if (addr & 3) {
 226         program_interrupt(env, PGM_SPECIFICATION, 4);
 227         return;
 228     }
 229     if (s390_cpu_virt_mem_read(cpu, addr, ar, &orig_orb, sizeof(orb))) {
 230         return;
 231     }
 232     copy_orb_from_guest(&orb, &orig_orb);
 233     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
 234         !ioinst_orb_valid(&orb)) {
 235         program_interrupt(env, PGM_OPERAND, 4);
 236         return;
 237     }
 238     trace_ioinst_sch_id("ssch", cssid, ssid, schid);
 239     sch = css_find_subch(m, cssid, ssid, schid);
 240     if (!sch || !css_subch_visible(sch)) {
 241         setcc(cpu, 3);
 242         return;
 243     }
 244     setcc(cpu, css_do_ssch(sch, &orb));
 245 }
 246
 247 void ioinst_handle_stcrw(S390CPU *cpu, uint32_t ipb)
 248 {
 249     CRW crw;
 250     uint64_t addr;
 251     int cc;
 252     CPUS390XState *env = &cpu->env;
 253     uint8_t ar;
 254
 255     addr = decode_basedisp_s(env, ipb, &ar);
 256     if (addr & 3) {
 257         program_interrupt(env, PGM_SPECIFICATION, 4);
 258         return;
 259     }
 260
 261     cc = css_do_stcrw(&crw);
 262     /* 0 - crw stored, 1 - zeroes stored */
 263
 264     if (s390_cpu_virt_mem_write(cpu, addr, ar, &crw, sizeof(crw)) == 0) {
 265         setcc(cpu, cc);
 266     } else if (cc == 0) {
 267         /* Write failed: requeue CRW since STCRW is a suppressing instruction */
 268         css_undo_stcrw(&crw);
 269     }
 270 }
 271
 272 void ioinst_handle_stsch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 273 {
 274     int cssid, ssid, schid, m;
 275     SubchDev *sch;
 276     uint64_t addr;
 277     int cc;
 278     SCHIB schib;
 279     CPUS390XState *env = &cpu->env;
 280     uint8_t ar;
 281
 282     addr = decode_basedisp_s(env, ipb, &ar);
 283     if (addr & 3) {
 284         program_interrupt(env, PGM_SPECIFICATION, 4);
 285         return;
 286     }
 287
 288     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 289         /*
 290          * As operand exceptions have a lower priority than access exceptions,
 291          * we check whether the memory area is writeable (injecting the
 292          * access execption if it is not) first.
 293          */
 294         if (!s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib))) {
 295             program_interrupt(env, PGM_OPERAND, 4);
 296         }
 297         return;
 298     }
 299     trace_ioinst_sch_id("stsch", cssid, ssid, schid);
 300     sch = css_find_subch(m, cssid, ssid, schid);
 301     if (sch) {
 302         if (css_subch_visible(sch)) {
 303             css_do_stsch(sch, &schib);
 304             cc = 0;
 305         } else {
 306             /* Indicate no more subchannels in this css/ss */
 307             cc = 3;
 308         }
 309     } else {
 310         if (css_schid_final(m, cssid, ssid, schid)) {
 311             cc = 3; /* No more subchannels in this css/ss */
 312         } else {
 313             /* Store an empty schib. */
 314             memset(&schib, 0, sizeof(schib));
 315             cc = 0;
 316         }
 317     }
 318     if (cc != 3) {
 319         if (s390_cpu_virt_mem_write(cpu, addr, ar, &schib,
 320                                     sizeof(schib)) != 0) {
 321             return;
 322         }
 323     } else {
 324         /* Access exceptions have a higher priority than cc3 */
 325         if (s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib)) != 0) {
 326             return;
 327         }
 328     }
 329     setcc(cpu, cc);
 330 }
 331
 332 int ioinst_handle_tsch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 333 {
 334     CPUS390XState *env = &cpu->env;
 335     int cssid, ssid, schid, m;
 336     SubchDev *sch;
 337     IRB irb;
 338     uint64_t addr;
 339     int cc, irb_len;
 340     uint8_t ar;
 341
 342     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 343         program_interrupt(env, PGM_OPERAND, 4);
 344         return -EIO;
 345     }
 346     trace_ioinst_sch_id("tsch", cssid, ssid, schid);
 347     addr = decode_basedisp_s(env, ipb, &ar);
 348     if (addr & 3) {
 349         program_interrupt(env, PGM_SPECIFICATION, 4);
 350         return -EIO;
 351     }
 352
 353     sch = css_find_subch(m, cssid, ssid, schid);
 354     if (sch && css_subch_visible(sch)) {
 355         cc = css_do_tsch_get_irb(sch, &irb, &irb_len);
 356     } else {
 357         cc = 3;
 358     }
 359     /* 0 - status pending, 1 - not status pending, 3 - not operational */
 360     if (cc != 3) {
 361         if (s390_cpu_virt_mem_write(cpu, addr, ar, &irb, irb_len) != 0) {
 362             return -EFAULT;
 363         }
 364         css_do_tsch_update_subch(sch);
 365     } else {
 366         irb_len = sizeof(irb) - sizeof(irb.emw);
 367         /* Access exceptions have a higher priority than cc3 */
 368         if (s390_cpu_virt_mem_check_write(cpu, addr, ar, irb_len) != 0) {
 369             return -EFAULT;
 370         }
 371     }
 372
 373     setcc(cpu, cc);
 374     return 0;
 375 }
 376
 377 typedef struct ChscReq {
 378     uint16_t len;
 379     uint16_t command;
 380     uint32_t param0;
 381     uint32_t param1;
 382     uint32_t param2;
 383 } QEMU_PACKED ChscReq;
 384
 385 typedef struct ChscResp {
 386     uint16_t len;
 387     uint16_t code;
 388     uint32_t param;
 389     char data[0];
 390 } QEMU_PACKED ChscResp;
 391
 392 #define CHSC_MIN_RESP_LEN 0x0008
 393
 394 #define CHSC_SCPD 0x0002
 395 #define CHSC_SCSC 0x0010
 396 #define CHSC_SDA  0x0031
 397 #define CHSC_SEI  0x000e
 398
 399 #define CHSC_SCPD_0_M 0x20000000
 400 #define CHSC_SCPD_0_C 0x10000000
 401 #define CHSC_SCPD_0_FMT 0x0f000000
 402 #define CHSC_SCPD_0_CSSID 0x00ff0000
 403 #define CHSC_SCPD_0_RFMT 0x00000f00
 404 #define CHSC_SCPD_0_RES 0xc000f000
 405 #define CHSC_SCPD_1_RES 0xffffff00
 406 #define CHSC_SCPD_01_CHPID 0x000000ff
 407 static void ioinst_handle_chsc_scpd(ChscReq *req, ChscResp *res)
 408 {
 409     uint16_t len = be16_to_cpu(req->len);
 410     uint32_t param0 = be32_to_cpu(req->param0);
 411     uint32_t param1 = be32_to_cpu(req->param1);
 412     uint16_t resp_code;
 413     int rfmt;
 414     uint16_t cssid;
 415     uint8_t f_chpid, l_chpid;
 416     int desc_size;
 417     int m;
 418
 419     rfmt = (param0 & CHSC_SCPD_0_RFMT) >> 8;
 420     if ((rfmt == 0) ||  (rfmt == 1)) {
 421         rfmt = !!(param0 & CHSC_SCPD_0_C);
 422     }
 423     if ((len != 0x0010) || (param0 & CHSC_SCPD_0_RES) ||
 424         (param1 & CHSC_SCPD_1_RES) || req->param2) {
 425         resp_code = 0x0003;
 426         goto out_err;
 427     }
 428     if (param0 & CHSC_SCPD_0_FMT) {
 429         resp_code = 0x0007;
 430         goto out_err;
 431     }
 432     cssid = (param0 & CHSC_SCPD_0_CSSID) >> 16;
 433     m = param0 & CHSC_SCPD_0_M;
 434     if (cssid != 0) {
 435         if (!m || !css_present(cssid)) {
 436             resp_code = 0x0008;
 437             goto out_err;
 438         }
 439     }
 440     f_chpid = param0 & CHSC_SCPD_01_CHPID;
 441     l_chpid = param1 & CHSC_SCPD_01_CHPID;
 442     if (l_chpid < f_chpid) {
 443         resp_code = 0x0003;
 444         goto out_err;
 445     }
 446     /* css_collect_chp_desc() is endian-aware */
 447     desc_size = css_collect_chp_desc(m, cssid, f_chpid, l_chpid, rfmt,
 448                                      &res->data);
 449     res->code = cpu_to_be16(0x0001);
 450     res->len = cpu_to_be16(8 + desc_size);
 451     res->param = cpu_to_be32(rfmt);
 452     return;
 453
 454   out_err:
 455     res->code = cpu_to_be16(resp_code);
 456     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 457     res->param = cpu_to_be32(rfmt);
 458 }
 459
 460 #define CHSC_SCSC_0_M 0x20000000
 461 #define CHSC_SCSC_0_FMT 0x000f0000
 462 #define CHSC_SCSC_0_CSSID 0x0000ff00
 463 #define CHSC_SCSC_0_RES 0xdff000ff
 464 static void ioinst_handle_chsc_scsc(ChscReq *req, ChscResp *res)
 465 {
 466     uint16_t len = be16_to_cpu(req->len);
 467     uint32_t param0 = be32_to_cpu(req->param0);
 468     uint8_t cssid;
 469     uint16_t resp_code;
 470     uint32_t general_chars[510];
 471     uint32_t chsc_chars[508];
 472
 473     if (len != 0x0010) {
 474         resp_code = 0x0003;
 475         goto out_err;
 476     }
 477
 478     if (param0 & CHSC_SCSC_0_FMT) {
 479         resp_code = 0x0007;
 480         goto out_err;
 481     }
 482     cssid = (param0 & CHSC_SCSC_0_CSSID) >> 8;
 483     if (cssid != 0) {
 484         if (!(param0 & CHSC_SCSC_0_M) || !css_present(cssid)) {
 485             resp_code = 0x0008;
 486             goto out_err;
 487         }
 488     }
 489     if ((param0 & CHSC_SCSC_0_RES) || req->param1 || req->param2) {
 490         resp_code = 0x0003;
 491         goto out_err;
 492     }
 493     res->code = cpu_to_be16(0x0001);
 494     res->len = cpu_to_be16(4080);
 495     res->param = 0;
 496
 497     memset(general_chars, 0, sizeof(general_chars));
 498     memset(chsc_chars, 0, sizeof(chsc_chars));
 499
 500     general_chars[0] = cpu_to_be32(0x03000000);
 501     general_chars[1] = cpu_to_be32(0x00079000);
 502     general_chars[3] = cpu_to_be32(0x00080000);
 503
 504     chsc_chars[0] = cpu_to_be32(0x40000000);
 505     chsc_chars[3] = cpu_to_be32(0x00040000);
 506
 507     memcpy(res->data, general_chars, sizeof(general_chars));
 508     memcpy(res->data + sizeof(general_chars), chsc_chars, sizeof(chsc_chars));
 509     return;
 510
 511   out_err:
 512     res->code = cpu_to_be16(resp_code);
 513     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 514     res->param = 0;
 515 }
 516
 517 #define CHSC_SDA_0_FMT 0x0f000000
 518 #define CHSC_SDA_0_OC 0x0000ffff
 519 #define CHSC_SDA_0_RES 0xf0ff0000
 520 #define CHSC_SDA_OC_MCSSE 0x0
 521 #define CHSC_SDA_OC_MSS 0x2
 522 static void ioinst_handle_chsc_sda(ChscReq *req, ChscResp *res)
 523 {
 524     uint16_t resp_code = 0x0001;
 525     uint16_t len = be16_to_cpu(req->len);
 526     uint32_t param0 = be32_to_cpu(req->param0);
 527     uint16_t oc;
 528     int ret;
 529
 530     if ((len != 0x0400) || (param0 & CHSC_SDA_0_RES)) {
 531         resp_code = 0x0003;
 532         goto out;
 533     }
 534
 535     if (param0 & CHSC_SDA_0_FMT) {
 536         resp_code = 0x0007;
 537         goto out;
 538     }
 539
 540     oc = param0 & CHSC_SDA_0_OC;
 541     switch (oc) {
 542     case CHSC_SDA_OC_MCSSE:
 543         ret = css_enable_mcsse();
 544         if (ret == -EINVAL) {
 545             resp_code = 0x0101;
 546             goto out;
 547         }
 548         break;
 549     case CHSC_SDA_OC_MSS:
 550         ret = css_enable_mss();
 551         if (ret == -EINVAL) {
 552             resp_code = 0x0101;
 553             goto out;
 554         }
 555         break;
 556     default:
 557         resp_code = 0x0003;
 558         goto out;
 559     }
 560
 561 out:
 562     res->code = cpu_to_be16(resp_code);
 563     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 564     res->param = 0;
 565 }
 566
 567 static int chsc_sei_nt0_get_event(void *res)
 568 {
 569     /* no events yet */
 570     return 1;
 571 }
 572
 573 static int chsc_sei_nt0_have_event(void)
 574 {
 575     /* no events yet */
 576     return 0;
 577 }
 578
 579 static int chsc_sei_nt2_get_event(void *res)
 580 {
 581     if (s390_has_feat(S390_FEAT_ZPCI)) {
 582         return pci_chsc_sei_nt2_get_event(res);
 583     }
 584     return 1;
 585 }
 586
 587 static int chsc_sei_nt2_have_event(void)
 588 {
 589     if (s390_has_feat(S390_FEAT_ZPCI)) {
 590         return pci_chsc_sei_nt2_have_event();
 591     }
 592     return 0;
 593 }
 594
 595 #define CHSC_SEI_NT0    (1ULL << 63)
 596 #define CHSC_SEI_NT2    (1ULL << 61)
 597 static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
 598 {
 599     uint64_t selection_mask = ldq_p(&req->param1);
 600     uint8_t *res_flags = (uint8_t *)res->data;
 601     int have_event = 0;
 602     int have_more = 0;
 603
 604     /* regarding architecture nt0 can not be masked */
 605     have_event = !chsc_sei_nt0_get_event(res);
 606     have_more = chsc_sei_nt0_have_event();
 607
 608     if (selection_mask & CHSC_SEI_NT2) {
 609         if (!have_event) {
 610             have_event = !chsc_sei_nt2_get_event(res);
 611         }
 612
 613         if (!have_more) {
 614             have_more = chsc_sei_nt2_have_event();
 615         }
 616     }
 617
 618     if (have_event) {
 619         res->code = cpu_to_be16(0x0001);
 620         if (have_more) {
 621             (*res_flags) |= 0x80;
 622         } else {
 623             (*res_flags) &= ~0x80;
 624             css_clear_sei_pending();
 625         }
 626     } else {
 627         res->code = cpu_to_be16(0x0005);
 628         res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 629     }
 630 }
 631
 632 static void ioinst_handle_chsc_unimplemented(ChscResp *res)
 633 {
 634     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 635     res->code = cpu_to_be16(0x0004);
 636     res->param = 0;
 637 }
 638
 639 void ioinst_handle_chsc(S390CPU *cpu, uint32_t ipb)
 640 {
 641     ChscReq *req;
 642     ChscResp *res;
 643     uint64_t addr;
 644     int reg;
 645     uint16_t len;
 646     uint16_t command;
 647     CPUS390XState *env = &cpu->env;
 648     uint8_t buf[TARGET_PAGE_SIZE];
 649
 650     trace_ioinst("chsc");
 651     reg = (ipb >> 20) & 0x00f;
 652     addr = env->regs[reg];
 653     /* Page boundary? */
 654     if (addr & 0xfff) {
 655         program_interrupt(env, PGM_SPECIFICATION, 4);
 656         return;
 657     }
 658     /*
 659      * Reading sizeof(ChscReq) bytes is currently enough for all of our
 660      * present CHSC sub-handlers ... if we ever need more, we should take
 661      * care of req->len here first.
 662      */
 663     if (s390_cpu_virt_mem_read(cpu, addr, reg, buf, sizeof(ChscReq))) {
 664         return;
 665     }
 666     req = (ChscReq *)buf;
 667     len = be16_to_cpu(req->len);
 668     /* Length field valid? */
 669     if ((len < 16) || (len > 4088) || (len & 7)) {
 670         program_interrupt(env, PGM_OPERAND, 4);
 671         return;
 672     }
 673     memset((char *)req + len, 0, TARGET_PAGE_SIZE - len);
 674     res = (void *)((char *)req + len);
 675     command = be16_to_cpu(req->command);
 676     trace_ioinst_chsc_cmd(command, len);
 677     switch (command) {
 678     case CHSC_SCSC:
 679         ioinst_handle_chsc_scsc(req, res);
 680         break;
 681     case CHSC_SCPD:
 682         ioinst_handle_chsc_scpd(req, res);
 683         break;
 684     case CHSC_SDA:
 685         ioinst_handle_chsc_sda(req, res);
 686         break;
 687     case CHSC_SEI:
 688         ioinst_handle_chsc_sei(req, res);
 689         break;
 690     default:
 691         ioinst_handle_chsc_unimplemented(res);
 692         break;
 693     }
 694
 695     if (!s390_cpu_virt_mem_write(cpu, addr + len, reg, res,
 696                                  be16_to_cpu(res->len))) {
 697         setcc(cpu, 0);    /* Command execution complete */
 698     }
 699 }
 700
 701 int ioinst_handle_tpi(S390CPU *cpu, uint32_t ipb)
 702 {
 703     CPUS390XState *env = &cpu->env;
 704     uint64_t addr;
 705     int lowcore;
 706     IOIntCode int_code;
 707     hwaddr len;
 708     int ret;
 709     uint8_t ar;
 710
 711     trace_ioinst("tpi");
 712     addr = decode_basedisp_s(env, ipb, &ar);
 713     if (addr & 3) {
 714         program_interrupt(env, PGM_SPECIFICATION, 4);
 715         return -EIO;
 716     }
 717
 718     lowcore = addr ? 0 : 1;
 719     len = lowcore ? 8 /* two words */ : 12 /* three words */;
 720     ret = css_do_tpi(&int_code, lowcore);
 721     if (ret == 1) {
 722         s390_cpu_virt_mem_write(cpu, lowcore ? 184 : addr, ar, &int_code, len);
 723     }
 724     return ret;
 725 }
 726
 727 #define SCHM_REG1_RES(_reg) (_reg & 0x000000000ffffffc)
 728 #define SCHM_REG1_MBK(_reg) ((_reg & 0x00000000f0000000) >> 28)
 729 #define SCHM_REG1_UPD(_reg) ((_reg & 0x0000000000000002) >> 1)
 730 #define SCHM_REG1_DCT(_reg) (_reg & 0x0000000000000001)
 731
 732 void ioinst_handle_schm(S390CPU *cpu, uint64_t reg1, uint64_t reg2,
 733                         uint32_t ipb)
 734 {
 735     uint8_t mbk;
 736     int update;
 737     int dct;
 738     CPUS390XState *env = &cpu->env;
 739
 740     trace_ioinst("schm");
 741
 742     if (SCHM_REG1_RES(reg1)) {
 743         program_interrupt(env, PGM_OPERAND, 4);
 744         return;
 745     }
 746
 747     mbk = SCHM_REG1_MBK(reg1);
 748     update = SCHM_REG1_UPD(reg1);
 749     dct = SCHM_REG1_DCT(reg1);
 750
 751     if (update && (reg2 & 0x000000000000001f)) {
 752         program_interrupt(env, PGM_OPERAND, 4);
 753         return;
 754     }
 755
 756     css_do_schm(mbk, update, dct, update ? reg2 : 0);
 757 }
 758
 759 void ioinst_handle_rsch(S390CPU *cpu, uint64_t reg1)
 760 {
 761     int cssid, ssid, schid, m;
 762     SubchDev *sch;
 763
 764     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 765         program_interrupt(&cpu->env, PGM_OPERAND, 4);
 766         return;
 767     }
 768     trace_ioinst_sch_id("rsch", cssid, ssid, schid);
 769     sch = css_find_subch(m, cssid, ssid, schid);
 770     if (!sch || !css_subch_visible(sch)) {
 771         setcc(cpu, 3);
 772         return;
 773     }
 774     setcc(cpu, css_do_rsch(sch));
 775 }
 776
 777 #define RCHP_REG1_RES(_reg) (_reg & 0x00000000ff00ff00)
 778 #define RCHP_REG1_CSSID(_reg) ((_reg & 0x0000000000ff0000) >> 16)
 779 #define RCHP_REG1_CHPID(_reg) (_reg & 0x00000000000000ff)
 780 void ioinst_handle_rchp(S390CPU *cpu, uint64_t reg1)
 781 {
 782     int cc;
 783     uint8_t cssid;
 784     uint8_t chpid;
 785     int ret;
 786     CPUS390XState *env = &cpu->env;
 787
 788     if (RCHP_REG1_RES(reg1)) {
 789         program_interrupt(env, PGM_OPERAND, 4);
 790         return;
 791     }
 792
 793     cssid = RCHP_REG1_CSSID(reg1);
 794     chpid = RCHP_REG1_CHPID(reg1);
 795
 796     trace_ioinst_chp_id("rchp", cssid, chpid);
 797
 798     ret = css_do_rchp(cssid, chpid);
 799
 800     switch (ret) {
 801     case -ENODEV:
 802         cc = 3;
 803         break;
 804     case -EBUSY:
 805         cc = 2;
 806         break;
 807     case 0:
 808         cc = 0;
 809         break;
 810     default:
 811         /* Invalid channel subsystem. */
 812         program_interrupt(env, PGM_OPERAND, 4);
 813         return;
 814     }
 815     setcc(cpu, cc);
 816 }
 817
 818 #define SAL_REG1_INVALID(_reg) (_reg & 0x0000000080000000)
 819 void ioinst_handle_sal(S390CPU *cpu, uint64_t reg1)
 820 {
 821     /* We do not provide address limit checking, so let's suppress it. */
 822     if (SAL_REG1_INVALID(reg1) || reg1 & 0x000000000000ffff) {
 823         program_interrupt(&cpu->env, PGM_OPERAND, 4);
 824     }
 825 }