target/s390x/ioinst.c

   1 /*
   2  * I/O instructions for S/390
   3  *
   4  * Copyright 2012, 2015 IBM Corp.
   5  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
   6  *
   7  * This work is licensed under the terms of the GNU GPL, version 2 or (at
   8  * your option) any later version. See the COPYING file in the top-level
   9  * directory.
  10  */
  11
  12 #include "qemu/osdep.h"
  13
  14 #include "cpu.h"
  15 #include "hw/s390x/ioinst.h"
  16 #include "trace.h"
  17 #include "hw/s390x/s390-pci-bus.h"
  18
  19 int ioinst_disassemble_sch_ident(uint32_t value, int *m, int *cssid, int *ssid,
  20                                  int *schid)
  21 {
  22     if (!IOINST_SCHID_ONE(value)) {
  23         return -EINVAL;
  24     }
  25     if (!IOINST_SCHID_M(value)) {
  26         if (IOINST_SCHID_CSSID(value)) {
  27             return -EINVAL;
  28         }
  29         *cssid = 0;
  30         *m = 0;
  31     } else {
  32         *cssid = IOINST_SCHID_CSSID(value);
  33         *m = 1;
  34     }
  35     *ssid = IOINST_SCHID_SSID(value);
  36     *schid = IOINST_SCHID_NR(value);
  37     return 0;
  38 }
  39
  40 void ioinst_handle_xsch(S390CPU *cpu, uint64_t reg1)
  41 {
  42     int cssid, ssid, schid, m;
  43     SubchDev *sch;
  44     int ret = -ENODEV;
  45     int cc;
  46
  47     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
  48         program_interrupt(&cpu->env, PGM_OPERAND, 2);
  49         return;
  50     }
  51     trace_ioinst_sch_id("xsch", cssid, ssid, schid);
  52     sch = css_find_subch(m, cssid, ssid, schid);
  53     if (sch && css_subch_visible(sch)) {
  54         ret = css_do_xsch(sch);
  55     }
  56     switch (ret) {
  57     case -ENODEV:
  58         cc = 3;
  59         break;
  60     case -EBUSY:
  61         cc = 2;
  62         break;
  63     case 0:
  64         cc = 0;
  65         break;
  66     default:
  67         cc = 1;
  68         break;
  69     }
  70     setcc(cpu, cc);
  71 }
  72
  73 void ioinst_handle_csch(S390CPU *cpu, uint64_t reg1)
  74 {
  75     int cssid, ssid, schid, m;
  76     SubchDev *sch;
  77     int ret = -ENODEV;
  78     int cc;
  79
  80     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
  81         program_interrupt(&cpu->env, PGM_OPERAND, 2);
  82         return;
  83     }
  84     trace_ioinst_sch_id("csch", cssid, ssid, schid);
  85     sch = css_find_subch(m, cssid, ssid, schid);
  86     if (sch && css_subch_visible(sch)) {
  87         ret = css_do_csch(sch);
  88     }
  89     if (ret == -ENODEV) {
  90         cc = 3;
  91     } else {
  92         cc = 0;
  93     }
  94     setcc(cpu, cc);
  95 }
  96
  97 void ioinst_handle_hsch(S390CPU *cpu, uint64_t reg1)
  98 {
  99     int cssid, ssid, schid, m;
 100     SubchDev *sch;
 101     int ret = -ENODEV;
 102     int cc;
 103
 104     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 105         program_interrupt(&cpu->env, PGM_OPERAND, 2);
 106         return;
 107     }
 108     trace_ioinst_sch_id("hsch", cssid, ssid, schid);
 109     sch = css_find_subch(m, cssid, ssid, schid);
 110     if (sch && css_subch_visible(sch)) {
 111         ret = css_do_hsch(sch);
 112     }
 113     switch (ret) {
 114     case -ENODEV:
 115         cc = 3;
 116         break;
 117     case -EBUSY:
 118         cc = 2;
 119         break;
 120     case 0:
 121         cc = 0;
 122         break;
 123     default:
 124         cc = 1;
 125         break;
 126     }
 127     setcc(cpu, cc);
 128 }
 129
 130 static int ioinst_schib_valid(SCHIB *schib)
 131 {
 132     if ((be16_to_cpu(schib->pmcw.flags) & PMCW_FLAGS_MASK_INVALID) ||
 133         (be32_to_cpu(schib->pmcw.chars) & PMCW_CHARS_MASK_INVALID)) {
 134         return 0;
 135     }
 136     /* Disallow extended measurements for now. */
 137     if (be32_to_cpu(schib->pmcw.chars) & PMCW_CHARS_MASK_XMWME) {
 138         return 0;
 139     }
 140     return 1;
 141 }
 142
 143 void ioinst_handle_msch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 144 {
 145     int cssid, ssid, schid, m;
 146     SubchDev *sch;
 147     SCHIB schib;
 148     uint64_t addr;
 149     int ret = -ENODEV;
 150     int cc;
 151     CPUS390XState *env = &cpu->env;
 152     uint8_t ar;
 153
 154     addr = decode_basedisp_s(env, ipb, &ar);
 155     if (addr & 3) {
 156         program_interrupt(env, PGM_SPECIFICATION, 2);
 157         return;
 158     }
 159     if (s390_cpu_virt_mem_read(cpu, addr, ar, &schib, sizeof(schib))) {
 160         return;
 161     }
 162     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
 163         !ioinst_schib_valid(&schib)) {
 164         program_interrupt(env, PGM_OPERAND, 2);
 165         return;
 166     }
 167     trace_ioinst_sch_id("msch", cssid, ssid, schid);
 168     sch = css_find_subch(m, cssid, ssid, schid);
 169     if (sch && css_subch_visible(sch)) {
 170         ret = css_do_msch(sch, &schib);
 171     }
 172     switch (ret) {
 173     case -ENODEV:
 174         cc = 3;
 175         break;
 176     case -EBUSY:
 177         cc = 2;
 178         break;
 179     case 0:
 180         cc = 0;
 181         break;
 182     default:
 183         cc = 1;
 184         break;
 185     }
 186     setcc(cpu, cc);
 187 }
 188
 189 static void copy_orb_from_guest(ORB *dest, const ORB *src)
 190 {
 191     dest->intparm = be32_to_cpu(src->intparm);
 192     dest->ctrl0 = be16_to_cpu(src->ctrl0);
 193     dest->lpm = src->lpm;
 194     dest->ctrl1 = src->ctrl1;
 195     dest->cpa = be32_to_cpu(src->cpa);
 196 }
 197
 198 static int ioinst_orb_valid(ORB *orb)
 199 {
 200     if ((orb->ctrl0 & ORB_CTRL0_MASK_INVALID) ||
 201         (orb->ctrl1 & ORB_CTRL1_MASK_INVALID)) {
 202         return 0;
 203     }
 204     if ((orb->cpa & HIGH_ORDER_BIT) != 0) {
 205         return 0;
 206     }
 207     return 1;
 208 }
 209
 210 void ioinst_handle_ssch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 211 {
 212     int cssid, ssid, schid, m;
 213     SubchDev *sch;
 214     ORB orig_orb, orb;
 215     uint64_t addr;
 216     int ret = -ENODEV;
 217     int cc;
 218     CPUS390XState *env = &cpu->env;
 219     uint8_t ar;
 220
 221     addr = decode_basedisp_s(env, ipb, &ar);
 222     if (addr & 3) {
 223         program_interrupt(env, PGM_SPECIFICATION, 2);
 224         return;
 225     }
 226     if (s390_cpu_virt_mem_read(cpu, addr, ar, &orig_orb, sizeof(orb))) {
 227         return;
 228     }
 229     copy_orb_from_guest(&orb, &orig_orb);
 230     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
 231         !ioinst_orb_valid(&orb)) {
 232         program_interrupt(env, PGM_OPERAND, 2);
 233         return;
 234     }
 235     trace_ioinst_sch_id("ssch", cssid, ssid, schid);
 236     sch = css_find_subch(m, cssid, ssid, schid);
 237     if (sch && css_subch_visible(sch)) {
 238         ret = css_do_ssch(sch, &orb);
 239     }
 240     switch (ret) {
 241     case -ENODEV:
 242         cc = 3;
 243         break;
 244     case -EBUSY:
 245         cc = 2;
 246         break;
 247     case -EFAULT:
 248         /*
 249          * TODO:
 250          * I'm wondering whether there is something better
 251          * to do for us here (like setting some device or
 252          * subchannel status).
 253          */
 254         program_interrupt(env, PGM_ADDRESSING, 4);
 255         return;
 256     case 0:
 257         cc = 0;
 258         break;
 259     default:
 260         cc = 1;
 261         break;
 262     }
 263     setcc(cpu, cc);
 264 }
 265
 266 void ioinst_handle_stcrw(S390CPU *cpu, uint32_t ipb)
 267 {
 268     CRW crw;
 269     uint64_t addr;
 270     int cc;
 271     CPUS390XState *env = &cpu->env;
 272     uint8_t ar;
 273
 274     addr = decode_basedisp_s(env, ipb, &ar);
 275     if (addr & 3) {
 276         program_interrupt(env, PGM_SPECIFICATION, 2);
 277         return;
 278     }
 279
 280     cc = css_do_stcrw(&crw);
 281     /* 0 - crw stored, 1 - zeroes stored */
 282
 283     if (s390_cpu_virt_mem_write(cpu, addr, ar, &crw, sizeof(crw)) == 0) {
 284         setcc(cpu, cc);
 285     } else if (cc == 0) {
 286         /* Write failed: requeue CRW since STCRW is a suppressing instruction */
 287         css_undo_stcrw(&crw);
 288     }
 289 }
 290
 291 void ioinst_handle_stsch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 292 {
 293     int cssid, ssid, schid, m;
 294     SubchDev *sch;
 295     uint64_t addr;
 296     int cc;
 297     SCHIB schib;
 298     CPUS390XState *env = &cpu->env;
 299     uint8_t ar;
 300
 301     addr = decode_basedisp_s(env, ipb, &ar);
 302     if (addr & 3) {
 303         program_interrupt(env, PGM_SPECIFICATION, 2);
 304         return;
 305     }
 306
 307     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 308         /*
 309          * As operand exceptions have a lower priority than access exceptions,
 310          * we check whether the memory area is writeable (injecting the
 311          * access execption if it is not) first.
 312          */
 313         if (!s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib))) {
 314             program_interrupt(env, PGM_OPERAND, 2);
 315         }
 316         return;
 317     }
 318     trace_ioinst_sch_id("stsch", cssid, ssid, schid);
 319     sch = css_find_subch(m, cssid, ssid, schid);
 320     if (sch) {
 321         if (css_subch_visible(sch)) {
 322             css_do_stsch(sch, &schib);
 323             cc = 0;
 324         } else {
 325             /* Indicate no more subchannels in this css/ss */
 326             cc = 3;
 327         }
 328     } else {
 329         if (css_schid_final(m, cssid, ssid, schid)) {
 330             cc = 3; /* No more subchannels in this css/ss */
 331         } else {
 332             /* Store an empty schib. */
 333             memset(&schib, 0, sizeof(schib));
 334             cc = 0;
 335         }
 336     }
 337     if (cc != 3) {
 338         if (s390_cpu_virt_mem_write(cpu, addr, ar, &schib,
 339                                     sizeof(schib)) != 0) {
 340             return;
 341         }
 342     } else {
 343         /* Access exceptions have a higher priority than cc3 */
 344         if (s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib)) != 0) {
 345             return;
 346         }
 347     }
 348     setcc(cpu, cc);
 349 }
 350
 351 int ioinst_handle_tsch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 352 {
 353     CPUS390XState *env = &cpu->env;
 354     int cssid, ssid, schid, m;
 355     SubchDev *sch;
 356     IRB irb;
 357     uint64_t addr;
 358     int cc, irb_len;
 359     uint8_t ar;
 360
 361     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 362         program_interrupt(env, PGM_OPERAND, 2);
 363         return -EIO;
 364     }
 365     trace_ioinst_sch_id("tsch", cssid, ssid, schid);
 366     addr = decode_basedisp_s(env, ipb, &ar);
 367     if (addr & 3) {
 368         program_interrupt(env, PGM_SPECIFICATION, 2);
 369         return -EIO;
 370     }
 371
 372     sch = css_find_subch(m, cssid, ssid, schid);
 373     if (sch && css_subch_visible(sch)) {
 374         cc = css_do_tsch_get_irb(sch, &irb, &irb_len);
 375     } else {
 376         cc = 3;
 377     }
 378     /* 0 - status pending, 1 - not status pending, 3 - not operational */
 379     if (cc != 3) {
 380         if (s390_cpu_virt_mem_write(cpu, addr, ar, &irb, irb_len) != 0) {
 381             return -EFAULT;
 382         }
 383         css_do_tsch_update_subch(sch);
 384     } else {
 385         irb_len = sizeof(irb) - sizeof(irb.emw);
 386         /* Access exceptions have a higher priority than cc3 */
 387         if (s390_cpu_virt_mem_check_write(cpu, addr, ar, irb_len) != 0) {
 388             return -EFAULT;
 389         }
 390     }
 391
 392     setcc(cpu, cc);
 393     return 0;
 394 }
 395
 396 typedef struct ChscReq {
 397     uint16_t len;
 398     uint16_t command;
 399     uint32_t param0;
 400     uint32_t param1;
 401     uint32_t param2;
 402 } QEMU_PACKED ChscReq;
 403
 404 typedef struct ChscResp {
 405     uint16_t len;
 406     uint16_t code;
 407     uint32_t param;
 408     char data[0];
 409 } QEMU_PACKED ChscResp;
 410
 411 #define CHSC_MIN_RESP_LEN 0x0008
 412
 413 #define CHSC_SCPD 0x0002
 414 #define CHSC_SCSC 0x0010
 415 #define CHSC_SDA  0x0031
 416 #define CHSC_SEI  0x000e
 417
 418 #define CHSC_SCPD_0_M 0x20000000
 419 #define CHSC_SCPD_0_C 0x10000000
 420 #define CHSC_SCPD_0_FMT 0x0f000000
 421 #define CHSC_SCPD_0_CSSID 0x00ff0000
 422 #define CHSC_SCPD_0_RFMT 0x00000f00
 423 #define CHSC_SCPD_0_RES 0xc000f000
 424 #define CHSC_SCPD_1_RES 0xffffff00
 425 #define CHSC_SCPD_01_CHPID 0x000000ff
 426 static void ioinst_handle_chsc_scpd(ChscReq *req, ChscResp *res)
 427 {
 428     uint16_t len = be16_to_cpu(req->len);
 429     uint32_t param0 = be32_to_cpu(req->param0);
 430     uint32_t param1 = be32_to_cpu(req->param1);
 431     uint16_t resp_code;
 432     int rfmt;
 433     uint16_t cssid;
 434     uint8_t f_chpid, l_chpid;
 435     int desc_size;
 436     int m;
 437
 438     rfmt = (param0 & CHSC_SCPD_0_RFMT) >> 8;
 439     if ((rfmt == 0) ||  (rfmt == 1)) {
 440         rfmt = !!(param0 & CHSC_SCPD_0_C);
 441     }
 442     if ((len != 0x0010) || (param0 & CHSC_SCPD_0_RES) ||
 443         (param1 & CHSC_SCPD_1_RES) || req->param2) {
 444         resp_code = 0x0003;
 445         goto out_err;
 446     }
 447     if (param0 & CHSC_SCPD_0_FMT) {
 448         resp_code = 0x0007;
 449         goto out_err;
 450     }
 451     cssid = (param0 & CHSC_SCPD_0_CSSID) >> 16;
 452     m = param0 & CHSC_SCPD_0_M;
 453     if (cssid != 0) {
 454         if (!m || !css_present(cssid)) {
 455             resp_code = 0x0008;
 456             goto out_err;
 457         }
 458     }
 459     f_chpid = param0 & CHSC_SCPD_01_CHPID;
 460     l_chpid = param1 & CHSC_SCPD_01_CHPID;
 461     if (l_chpid < f_chpid) {
 462         resp_code = 0x0003;
 463         goto out_err;
 464     }
 465     /* css_collect_chp_desc() is endian-aware */
 466     desc_size = css_collect_chp_desc(m, cssid, f_chpid, l_chpid, rfmt,
 467                                      &res->data);
 468     res->code = cpu_to_be16(0x0001);
 469     res->len = cpu_to_be16(8 + desc_size);
 470     res->param = cpu_to_be32(rfmt);
 471     return;
 472
 473   out_err:
 474     res->code = cpu_to_be16(resp_code);
 475     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 476     res->param = cpu_to_be32(rfmt);
 477 }
 478
 479 #define CHSC_SCSC_0_M 0x20000000
 480 #define CHSC_SCSC_0_FMT 0x000f0000
 481 #define CHSC_SCSC_0_CSSID 0x0000ff00
 482 #define CHSC_SCSC_0_RES 0xdff000ff
 483 static void ioinst_handle_chsc_scsc(ChscReq *req, ChscResp *res)
 484 {
 485     uint16_t len = be16_to_cpu(req->len);
 486     uint32_t param0 = be32_to_cpu(req->param0);
 487     uint8_t cssid;
 488     uint16_t resp_code;
 489     uint32_t general_chars[510];
 490     uint32_t chsc_chars[508];
 491
 492     if (len != 0x0010) {
 493         resp_code = 0x0003;
 494         goto out_err;
 495     }
 496
 497     if (param0 & CHSC_SCSC_0_FMT) {
 498         resp_code = 0x0007;
 499         goto out_err;
 500     }
 501     cssid = (param0 & CHSC_SCSC_0_CSSID) >> 8;
 502     if (cssid != 0) {
 503         if (!(param0 & CHSC_SCSC_0_M) || !css_present(cssid)) {
 504             resp_code = 0x0008;
 505             goto out_err;
 506         }
 507     }
 508     if ((param0 & CHSC_SCSC_0_RES) || req->param1 || req->param2) {
 509         resp_code = 0x0003;
 510         goto out_err;
 511     }
 512     res->code = cpu_to_be16(0x0001);
 513     res->len = cpu_to_be16(4080);
 514     res->param = 0;
 515
 516     memset(general_chars, 0, sizeof(general_chars));
 517     memset(chsc_chars, 0, sizeof(chsc_chars));
 518
 519     general_chars[0] = cpu_to_be32(0x03000000);
 520     general_chars[1] = cpu_to_be32(0x00079000);
 521     general_chars[3] = cpu_to_be32(0x00080000);
 522
 523     chsc_chars[0] = cpu_to_be32(0x40000000);
 524     chsc_chars[3] = cpu_to_be32(0x00040000);
 525
 526     memcpy(res->data, general_chars, sizeof(general_chars));
 527     memcpy(res->data + sizeof(general_chars), chsc_chars, sizeof(chsc_chars));
 528     return;
 529
 530   out_err:
 531     res->code = cpu_to_be16(resp_code);
 532     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 533     res->param = 0;
 534 }
 535
 536 #define CHSC_SDA_0_FMT 0x0f000000
 537 #define CHSC_SDA_0_OC 0x0000ffff
 538 #define CHSC_SDA_0_RES 0xf0ff0000
 539 #define CHSC_SDA_OC_MCSSE 0x0
 540 #define CHSC_SDA_OC_MSS 0x2
 541 static void ioinst_handle_chsc_sda(ChscReq *req, ChscResp *res)
 542 {
 543     uint16_t resp_code = 0x0001;
 544     uint16_t len = be16_to_cpu(req->len);
 545     uint32_t param0 = be32_to_cpu(req->param0);
 546     uint16_t oc;
 547     int ret;
 548
 549     if ((len != 0x0400) || (param0 & CHSC_SDA_0_RES)) {
 550         resp_code = 0x0003;
 551         goto out;
 552     }
 553
 554     if (param0 & CHSC_SDA_0_FMT) {
 555         resp_code = 0x0007;
 556         goto out;
 557     }
 558
 559     oc = param0 & CHSC_SDA_0_OC;
 560     switch (oc) {
 561     case CHSC_SDA_OC_MCSSE:
 562         ret = css_enable_mcsse();
 563         if (ret == -EINVAL) {
 564             resp_code = 0x0101;
 565             goto out;
 566         }
 567         break;
 568     case CHSC_SDA_OC_MSS:
 569         ret = css_enable_mss();
 570         if (ret == -EINVAL) {
 571             resp_code = 0x0101;
 572             goto out;
 573         }
 574         break;
 575     default:
 576         resp_code = 0x0003;
 577         goto out;
 578     }
 579
 580 out:
 581     res->code = cpu_to_be16(resp_code);
 582     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 583     res->param = 0;
 584 }
 585
 586 static int chsc_sei_nt0_get_event(void *res)
 587 {
 588     /* no events yet */
 589     return 1;
 590 }
 591
 592 static int chsc_sei_nt0_have_event(void)
 593 {
 594     /* no events yet */
 595     return 0;
 596 }
 597
 598 #define CHSC_SEI_NT0    (1ULL << 63)
 599 #define CHSC_SEI_NT2    (1ULL << 61)
 600 static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
 601 {
 602     uint64_t selection_mask = ldq_p(&req->param1);
 603     uint8_t *res_flags = (uint8_t *)res->data;
 604     int have_event = 0;
 605     int have_more = 0;
 606
 607     /* regarding architecture nt0 can not be masked */
 608     have_event = !chsc_sei_nt0_get_event(res);
 609     have_more = chsc_sei_nt0_have_event();
 610
 611     if (selection_mask & CHSC_SEI_NT2) {
 612         if (!have_event) {
 613             have_event = !chsc_sei_nt2_get_event(res);
 614         }
 615
 616         if (!have_more) {
 617             have_more = chsc_sei_nt2_have_event();
 618         }
 619     }
 620
 621     if (have_event) {
 622         res->code = cpu_to_be16(0x0001);
 623         if (have_more) {
 624             (*res_flags) |= 0x80;
 625         } else {
 626             (*res_flags) &= ~0x80;
 627             css_clear_sei_pending();
 628         }
 629     } else {
 630         res->code = cpu_to_be16(0x0005);
 631         res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 632     }
 633 }
 634
 635 static void ioinst_handle_chsc_unimplemented(ChscResp *res)
 636 {
 637     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 638     res->code = cpu_to_be16(0x0004);
 639     res->param = 0;
 640 }
 641
 642 void ioinst_handle_chsc(S390CPU *cpu, uint32_t ipb)
 643 {
 644     ChscReq *req;
 645     ChscResp *res;
 646     uint64_t addr;
 647     int reg;
 648     uint16_t len;
 649     uint16_t command;
 650     CPUS390XState *env = &cpu->env;
 651     uint8_t buf[TARGET_PAGE_SIZE];
 652
 653     trace_ioinst("chsc");
 654     reg = (ipb >> 20) & 0x00f;
 655     addr = env->regs[reg];
 656     /* Page boundary? */
 657     if (addr & 0xfff) {
 658         program_interrupt(env, PGM_SPECIFICATION, 2);
 659         return;
 660     }
 661     /*
 662      * Reading sizeof(ChscReq) bytes is currently enough for all of our
 663      * present CHSC sub-handlers ... if we ever need more, we should take
 664      * care of req->len here first.
 665      */
 666     if (s390_cpu_virt_mem_read(cpu, addr, reg, buf, sizeof(ChscReq))) {
 667         return;
 668     }
 669     req = (ChscReq *)buf;
 670     len = be16_to_cpu(req->len);
 671     /* Length field valid? */
 672     if ((len < 16) || (len > 4088) || (len & 7)) {
 673         program_interrupt(env, PGM_OPERAND, 2);
 674         return;
 675     }
 676     memset((char *)req + len, 0, TARGET_PAGE_SIZE - len);
 677     res = (void *)((char *)req + len);
 678     command = be16_to_cpu(req->command);
 679     trace_ioinst_chsc_cmd(command, len);
 680     switch (command) {
 681     case CHSC_SCSC:
 682         ioinst_handle_chsc_scsc(req, res);
 683         break;
 684     case CHSC_SCPD:
 685         ioinst_handle_chsc_scpd(req, res);
 686         break;
 687     case CHSC_SDA:
 688         ioinst_handle_chsc_sda(req, res);
 689         break;
 690     case CHSC_SEI:
 691         ioinst_handle_chsc_sei(req, res);
 692         break;
 693     default:
 694         ioinst_handle_chsc_unimplemented(res);
 695         break;
 696     }
 697
 698     if (!s390_cpu_virt_mem_write(cpu, addr + len, reg, res,
 699                                  be16_to_cpu(res->len))) {
 700         setcc(cpu, 0);    /* Command execution complete */
 701     }
 702 }
 703
 704 int ioinst_handle_tpi(S390CPU *cpu, uint32_t ipb)
 705 {
 706     CPUS390XState *env = &cpu->env;
 707     uint64_t addr;
 708     int lowcore;
 709     IOIntCode int_code;
 710     hwaddr len;
 711     int ret;
 712     uint8_t ar;
 713
 714     trace_ioinst("tpi");
 715     addr = decode_basedisp_s(env, ipb, &ar);
 716     if (addr & 3) {
 717         program_interrupt(env, PGM_SPECIFICATION, 2);
 718         return -EIO;
 719     }
 720
 721     lowcore = addr ? 0 : 1;
 722     len = lowcore ? 8 /* two words */ : 12 /* three words */;
 723     ret = css_do_tpi(&int_code, lowcore);
 724     if (ret == 1) {
 725         s390_cpu_virt_mem_write(cpu, lowcore ? 184 : addr, ar, &int_code, len);
 726     }
 727     return ret;
 728 }
 729
 730 #define SCHM_REG1_RES(_reg) (_reg & 0x000000000ffffffc)
 731 #define SCHM_REG1_MBK(_reg) ((_reg & 0x00000000f0000000) >> 28)
 732 #define SCHM_REG1_UPD(_reg) ((_reg & 0x0000000000000002) >> 1)
 733 #define SCHM_REG1_DCT(_reg) (_reg & 0x0000000000000001)
 734
 735 void ioinst_handle_schm(S390CPU *cpu, uint64_t reg1, uint64_t reg2,
 736                         uint32_t ipb)
 737 {
 738     uint8_t mbk;
 739     int update;
 740     int dct;
 741     CPUS390XState *env = &cpu->env;
 742
 743     trace_ioinst("schm");
 744
 745     if (SCHM_REG1_RES(reg1)) {
 746         program_interrupt(env, PGM_OPERAND, 2);
 747         return;
 748     }
 749
 750     mbk = SCHM_REG1_MBK(reg1);
 751     update = SCHM_REG1_UPD(reg1);
 752     dct = SCHM_REG1_DCT(reg1);
 753
 754     if (update && (reg2 & 0x000000000000001f)) {
 755         program_interrupt(env, PGM_OPERAND, 2);
 756         return;
 757     }
 758
 759     css_do_schm(mbk, update, dct, update ? reg2 : 0);
 760 }
 761
 762 void ioinst_handle_rsch(S390CPU *cpu, uint64_t reg1)
 763 {
 764     int cssid, ssid, schid, m;
 765     SubchDev *sch;
 766     int ret = -ENODEV;
 767     int cc;
 768
 769     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 770         program_interrupt(&cpu->env, PGM_OPERAND, 2);
 771         return;
 772     }
 773     trace_ioinst_sch_id("rsch", cssid, ssid, schid);
 774     sch = css_find_subch(m, cssid, ssid, schid);
 775     if (sch && css_subch_visible(sch)) {
 776         ret = css_do_rsch(sch);
 777     }
 778     switch (ret) {
 779     case -ENODEV:
 780         cc = 3;
 781         break;
 782     case -EINVAL:
 783         cc = 2;
 784         break;
 785     case 0:
 786         cc = 0;
 787         break;
 788     default:
 789         cc = 1;
 790         break;
 791     }
 792     setcc(cpu, cc);
 793 }
 794
 795 #define RCHP_REG1_RES(_reg) (_reg & 0x00000000ff00ff00)
 796 #define RCHP_REG1_CSSID(_reg) ((_reg & 0x0000000000ff0000) >> 16)
 797 #define RCHP_REG1_CHPID(_reg) (_reg & 0x00000000000000ff)
 798 void ioinst_handle_rchp(S390CPU *cpu, uint64_t reg1)
 799 {
 800     int cc;
 801     uint8_t cssid;
 802     uint8_t chpid;
 803     int ret;
 804     CPUS390XState *env = &cpu->env;
 805
 806     if (RCHP_REG1_RES(reg1)) {
 807         program_interrupt(env, PGM_OPERAND, 2);
 808         return;
 809     }
 810
 811     cssid = RCHP_REG1_CSSID(reg1);
 812     chpid = RCHP_REG1_CHPID(reg1);
 813
 814     trace_ioinst_chp_id("rchp", cssid, chpid);
 815
 816     ret = css_do_rchp(cssid, chpid);
 817
 818     switch (ret) {
 819     case -ENODEV:
 820         cc = 3;
 821         break;
 822     case -EBUSY:
 823         cc = 2;
 824         break;
 825     case 0:
 826         cc = 0;
 827         break;
 828     default:
 829         /* Invalid channel subsystem. */
 830         program_interrupt(env, PGM_OPERAND, 2);
 831         return;
 832     }
 833     setcc(cpu, cc);
 834 }
 835
 836 #define SAL_REG1_INVALID(_reg) (_reg & 0x0000000080000000)
 837 void ioinst_handle_sal(S390CPU *cpu, uint64_t reg1)
 838 {
 839     /* We do not provide address limit checking, so let's suppress it. */
 840     if (SAL_REG1_INVALID(reg1) || reg1 & 0x000000000000ffff) {
 841         program_interrupt(&cpu->env, PGM_OPERAND, 2);
 842     }
 843 }