target-s390x/kvm.c

   1 /*
   2  * QEMU S390x KVM implementation
   3  *
   4  * Copyright (c) 2009 Alexander Graf <agraf@suse.de>
   5  * Copyright IBM Corp. 2012
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * Contributions after 2012-10-29 are licensed under the terms of the
  18  * GNU GPL, version 2 or (at your option) any later version.
  19  *
  20  * You should have received a copy of the GNU (Lesser) General Public
  21  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  22  */
  23
  24 #include <sys/types.h>
  25 #include <sys/ioctl.h>
  26 #include <sys/mman.h>
  27
  28 #include <linux/kvm.h>
  29 #include <asm/ptrace.h>
  30
  31 #include "qemu-common.h"
  32 #include "qemu/timer.h"
  33 #include "sysemu/sysemu.h"
  34 #include "sysemu/kvm.h"
  35 #include "hw/hw.h"
  36 #include "cpu.h"
  37 #include "sysemu/device_tree.h"
  38 #include "qapi/qmp/qjson.h"
  39 #include "monitor/monitor.h"
  40 #include "exec/gdbstub.h"
  41 #include "trace.h"
  42 #include "qapi-event.h"
  43
  44 /* #define DEBUG_KVM */
  45
  46 #ifdef DEBUG_KVM
  47 #define DPRINTF(fmt, ...) \
  48     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
  49 #else
  50 #define DPRINTF(fmt, ...) \
  51     do { } while (0)
  52 #endif
  53
  54 #define IPA0_DIAG                       0x8300
  55 #define IPA0_SIGP                       0xae00
  56 #define IPA0_B2                         0xb200
  57 #define IPA0_B9                         0xb900
  58 #define IPA0_EB                         0xeb00
  59
  60 #define PRIV_B2_SCLP_CALL               0x20
  61 #define PRIV_B2_CSCH                    0x30
  62 #define PRIV_B2_HSCH                    0x31
  63 #define PRIV_B2_MSCH                    0x32
  64 #define PRIV_B2_SSCH                    0x33
  65 #define PRIV_B2_STSCH                   0x34
  66 #define PRIV_B2_TSCH                    0x35
  67 #define PRIV_B2_TPI                     0x36
  68 #define PRIV_B2_SAL                     0x37
  69 #define PRIV_B2_RSCH                    0x38
  70 #define PRIV_B2_STCRW                   0x39
  71 #define PRIV_B2_STCPS                   0x3a
  72 #define PRIV_B2_RCHP                    0x3b
  73 #define PRIV_B2_SCHM                    0x3c
  74 #define PRIV_B2_CHSC                    0x5f
  75 #define PRIV_B2_SIGA                    0x74
  76 #define PRIV_B2_XSCH                    0x76
  77
  78 #define PRIV_EB_SQBS                    0x8a
  79
  80 #define PRIV_B9_EQBS                    0x9c
  81
  82 #define DIAG_IPL                        0x308
  83 #define DIAG_KVM_HYPERCALL              0x500
  84 #define DIAG_KVM_BREAKPOINT             0x501
  85
  86 #define ICPT_INSTRUCTION                0x04
  87 #define ICPT_PROGRAM                    0x08
  88 #define ICPT_EXT_INT                    0x14
  89 #define ICPT_WAITPSW                    0x1c
  90 #define ICPT_SOFT_INTERCEPT             0x24
  91 #define ICPT_CPU_STOP                   0x28
  92 #define ICPT_IO                         0x40
  93
  94 static CPUWatchpoint hw_watchpoint;
  95 /*
  96  * We don't use a list because this structure is also used to transmit the
  97  * hardware breakpoints to the kernel.
  98  */
  99 static struct kvm_hw_breakpoint *hw_breakpoints;
 100 static int nb_hw_breakpoints;
 101
 102 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
 103     KVM_CAP_LAST_INFO
 104 };
 105
 106 static int cap_sync_regs;
 107 static int cap_async_pf;
 108
 109 static void *legacy_s390_alloc(size_t size);
 110
 111 static int kvm_s390_check_clear_cmma(KVMState *s)
 112 {
 113     struct kvm_device_attr attr = {
 114         .group = KVM_S390_VM_MEM_CTRL,
 115         .attr = KVM_S390_VM_MEM_CLR_CMMA,
 116     };
 117
 118     return kvm_vm_ioctl(s, KVM_HAS_DEVICE_ATTR, &attr);
 119 }
 120
 121 static int kvm_s390_check_enable_cmma(KVMState *s)
 122 {
 123     struct kvm_device_attr attr = {
 124         .group = KVM_S390_VM_MEM_CTRL,
 125         .attr = KVM_S390_VM_MEM_ENABLE_CMMA,
 126     };
 127
 128     return kvm_vm_ioctl(s, KVM_HAS_DEVICE_ATTR, &attr);
 129 }
 130
 131 void kvm_s390_clear_cmma_callback(void *opaque)
 132 {
 133     int rc;
 134     KVMState *s = opaque;
 135     struct kvm_device_attr attr = {
 136         .group = KVM_S390_VM_MEM_CTRL,
 137         .attr = KVM_S390_VM_MEM_CLR_CMMA,
 138     };
 139
 140     rc = kvm_vm_ioctl(s, KVM_SET_DEVICE_ATTR, &attr);
 141     trace_kvm_clear_cmma(rc);
 142 }
 143
 144 static void kvm_s390_enable_cmma(KVMState *s)
 145 {
 146     int rc;
 147     struct kvm_device_attr attr = {
 148         .group = KVM_S390_VM_MEM_CTRL,
 149         .attr = KVM_S390_VM_MEM_ENABLE_CMMA,
 150     };
 151
 152     if (kvm_s390_check_enable_cmma(s) || kvm_s390_check_clear_cmma(s)) {
 153         return;
 154     }
 155
 156     rc = kvm_vm_ioctl(s, KVM_SET_DEVICE_ATTR, &attr);
 157     if (!rc) {
 158         qemu_register_reset(kvm_s390_clear_cmma_callback, s);
 159     }
 160     trace_kvm_enable_cmma(rc);
 161 }
 162
 163 int kvm_arch_init(KVMState *s)
 164 {
 165     cap_sync_regs = kvm_check_extension(s, KVM_CAP_SYNC_REGS);
 166     cap_async_pf = kvm_check_extension(s, KVM_CAP_ASYNC_PF);
 167
 168     if (kvm_check_extension(s, KVM_CAP_VM_ATTRIBUTES)) {
 169         kvm_s390_enable_cmma(s);
 170     }
 171
 172     if (!kvm_check_extension(s, KVM_CAP_S390_GMAP)
 173         || !kvm_check_extension(s, KVM_CAP_S390_COW)) {
 174         phys_mem_set_alloc(legacy_s390_alloc);
 175     }
 176     return 0;
 177 }
 178
 179 unsigned long kvm_arch_vcpu_id(CPUState *cpu)
 180 {
 181     return cpu->cpu_index;
 182 }
 183
 184 int kvm_arch_init_vcpu(CPUState *cpu)
 185 {
 186     /* nothing todo yet */
 187     return 0;
 188 }
 189
 190 void kvm_s390_reset_vcpu(S390CPU *cpu)
 191 {
 192     CPUState *cs = CPU(cpu);
 193
 194     /* The initial reset call is needed here to reset in-kernel
 195      * vcpu data that we can't access directly from QEMU
 196      * (i.e. with older kernels which don't support sync_regs/ONE_REG).
 197      * Before this ioctl cpu_synchronize_state() is called in common kvm
 198      * code (kvm-all) */
 199     if (kvm_vcpu_ioctl(cs, KVM_S390_INITIAL_RESET, NULL)) {
 200         perror("Can't reset vcpu\n");
 201     }
 202 }
 203
 204 int kvm_arch_put_registers(CPUState *cs, int level)
 205 {
 206     S390CPU *cpu = S390_CPU(cs);
 207     CPUS390XState *env = &cpu->env;
 208     struct kvm_sregs sregs;
 209     struct kvm_regs regs;
 210     struct kvm_fpu fpu;
 211     int r;
 212     int i;
 213
 214     /* always save the PSW  and the GPRS*/
 215     cs->kvm_run->psw_addr = env->psw.addr;
 216     cs->kvm_run->psw_mask = env->psw.mask;
 217
 218     if (cap_sync_regs && cs->kvm_run->kvm_valid_regs & KVM_SYNC_GPRS) {
 219         for (i = 0; i < 16; i++) {
 220             cs->kvm_run->s.regs.gprs[i] = env->regs[i];
 221             cs->kvm_run->kvm_dirty_regs |= KVM_SYNC_GPRS;
 222         }
 223     } else {
 224         for (i = 0; i < 16; i++) {
 225             regs.gprs[i] = env->regs[i];
 226         }
 227         r = kvm_vcpu_ioctl(cs, KVM_SET_REGS, &regs);
 228         if (r < 0) {
 229             return r;
 230         }
 231     }
 232
 233     /* Floating point */
 234     for (i = 0; i < 16; i++) {
 235         fpu.fprs[i] = env->fregs[i].ll;
 236     }
 237     fpu.fpc = env->fpc;
 238
 239     r = kvm_vcpu_ioctl(cs, KVM_SET_FPU, &fpu);
 240     if (r < 0) {
 241         return r;
 242     }
 243
 244     /* Do we need to save more than that? */
 245     if (level == KVM_PUT_RUNTIME_STATE) {
 246         return 0;
 247     }
 248
 249     /*
 250      * These ONE_REGS are not protected by a capability. As they are only
 251      * necessary for migration we just trace a possible error, but don't
 252      * return with an error return code.
 253      */
 254     kvm_set_one_reg(cs, KVM_REG_S390_CPU_TIMER, &env->cputm);
 255     kvm_set_one_reg(cs, KVM_REG_S390_CLOCK_COMP, &env->ckc);
 256     kvm_set_one_reg(cs, KVM_REG_S390_TODPR, &env->todpr);
 257     kvm_set_one_reg(cs, KVM_REG_S390_GBEA, &env->gbea);
 258     kvm_set_one_reg(cs, KVM_REG_S390_PP, &env->pp);
 259
 260     if (cap_async_pf) {
 261         r = kvm_set_one_reg(cs, KVM_REG_S390_PFTOKEN, &env->pfault_token);
 262         if (r < 0) {
 263             return r;
 264         }
 265         r = kvm_set_one_reg(cs, KVM_REG_S390_PFCOMPARE, &env->pfault_compare);
 266         if (r < 0) {
 267             return r;
 268         }
 269         r = kvm_set_one_reg(cs, KVM_REG_S390_PFSELECT, &env->pfault_select);
 270         if (r < 0) {
 271             return r;
 272         }
 273     }
 274
 275     if (cap_sync_regs &&
 276         cs->kvm_run->kvm_valid_regs & KVM_SYNC_ACRS &&
 277         cs->kvm_run->kvm_valid_regs & KVM_SYNC_CRS) {
 278         for (i = 0; i < 16; i++) {
 279             cs->kvm_run->s.regs.acrs[i] = env->aregs[i];
 280             cs->kvm_run->s.regs.crs[i] = env->cregs[i];
 281         }
 282         cs->kvm_run->kvm_dirty_regs |= KVM_SYNC_ACRS;
 283         cs->kvm_run->kvm_dirty_regs |= KVM_SYNC_CRS;
 284     } else {
 285         for (i = 0; i < 16; i++) {
 286             sregs.acrs[i] = env->aregs[i];
 287             sregs.crs[i] = env->cregs[i];
 288         }
 289         r = kvm_vcpu_ioctl(cs, KVM_SET_SREGS, &sregs);
 290         if (r < 0) {
 291             return r;
 292         }
 293     }
 294
 295     /* Finally the prefix */
 296     if (cap_sync_regs && cs->kvm_run->kvm_valid_regs & KVM_SYNC_PREFIX) {
 297         cs->kvm_run->s.regs.prefix = env->psa;
 298         cs->kvm_run->kvm_dirty_regs |= KVM_SYNC_PREFIX;
 299     } else {
 300         /* prefix is only supported via sync regs */
 301     }
 302     return 0;
 303 }
 304
 305 int kvm_arch_get_registers(CPUState *cs)
 306 {
 307     S390CPU *cpu = S390_CPU(cs);
 308     CPUS390XState *env = &cpu->env;
 309     struct kvm_sregs sregs;
 310     struct kvm_regs regs;
 311     struct kvm_fpu fpu;
 312     int i, r;
 313
 314     /* get the PSW */
 315     env->psw.addr = cs->kvm_run->psw_addr;
 316     env->psw.mask = cs->kvm_run->psw_mask;
 317
 318     /* the GPRS */
 319     if (cap_sync_regs && cs->kvm_run->kvm_valid_regs & KVM_SYNC_GPRS) {
 320         for (i = 0; i < 16; i++) {
 321             env->regs[i] = cs->kvm_run->s.regs.gprs[i];
 322         }
 323     } else {
 324         r = kvm_vcpu_ioctl(cs, KVM_GET_REGS, &regs);
 325         if (r < 0) {
 326             return r;
 327         }
 328          for (i = 0; i < 16; i++) {
 329             env->regs[i] = regs.gprs[i];
 330         }
 331     }
 332
 333     /* The ACRS and CRS */
 334     if (cap_sync_regs &&
 335         cs->kvm_run->kvm_valid_regs & KVM_SYNC_ACRS &&
 336         cs->kvm_run->kvm_valid_regs & KVM_SYNC_CRS) {
 337         for (i = 0; i < 16; i++) {
 338             env->aregs[i] = cs->kvm_run->s.regs.acrs[i];
 339             env->cregs[i] = cs->kvm_run->s.regs.crs[i];
 340         }
 341     } else {
 342         r = kvm_vcpu_ioctl(cs, KVM_GET_SREGS, &sregs);
 343         if (r < 0) {
 344             return r;
 345         }
 346          for (i = 0; i < 16; i++) {
 347             env->aregs[i] = sregs.acrs[i];
 348             env->cregs[i] = sregs.crs[i];
 349         }
 350     }
 351
 352     /* Floating point */
 353     r = kvm_vcpu_ioctl(cs, KVM_GET_FPU, &fpu);
 354     if (r < 0) {
 355         return r;
 356     }
 357     for (i = 0; i < 16; i++) {
 358         env->fregs[i].ll = fpu.fprs[i];
 359     }
 360     env->fpc = fpu.fpc;
 361
 362     /* The prefix */
 363     if (cap_sync_regs && cs->kvm_run->kvm_valid_regs & KVM_SYNC_PREFIX) {
 364         env->psa = cs->kvm_run->s.regs.prefix;
 365     }
 366
 367     /*
 368      * These ONE_REGS are not protected by a capability. As they are only
 369      * necessary for migration we just trace a possible error, but don't
 370      * return with an error return code.
 371      */
 372     kvm_get_one_reg(cs, KVM_REG_S390_CPU_TIMER, &env->cputm);
 373     kvm_get_one_reg(cs, KVM_REG_S390_CLOCK_COMP, &env->ckc);
 374     kvm_get_one_reg(cs, KVM_REG_S390_TODPR, &env->todpr);
 375     kvm_get_one_reg(cs, KVM_REG_S390_GBEA, &env->gbea);
 376     kvm_get_one_reg(cs, KVM_REG_S390_PP, &env->pp);
 377
 378     if (cap_async_pf) {
 379         r = kvm_get_one_reg(cs, KVM_REG_S390_PFTOKEN, &env->pfault_token);
 380         if (r < 0) {
 381             return r;
 382         }
 383         r = kvm_get_one_reg(cs, KVM_REG_S390_PFCOMPARE, &env->pfault_compare);
 384         if (r < 0) {
 385             return r;
 386         }
 387         r = kvm_get_one_reg(cs, KVM_REG_S390_PFSELECT, &env->pfault_select);
 388         if (r < 0) {
 389             return r;
 390         }
 391     }
 392
 393     return 0;
 394 }
 395
 396 /*
 397  * Legacy layout for s390:
 398  * Older S390 KVM requires the topmost vma of the RAM to be
 399  * smaller than an system defined value, which is at least 256GB.
 400  * Larger systems have larger values. We put the guest between
 401  * the end of data segment (system break) and this value. We
 402  * use 32GB as a base to have enough room for the system break
 403  * to grow. We also have to use MAP parameters that avoid
 404  * read-only mapping of guest pages.
 405  */
 406 static void *legacy_s390_alloc(size_t size)
 407 {
 408     void *mem;
 409
 410     mem = mmap((void *) 0x800000000ULL, size,
 411                PROT_EXEC|PROT_READ|PROT_WRITE,
 412                MAP_SHARED | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
 413     return mem == MAP_FAILED ? NULL : mem;
 414 }
 415
 416 /* DIAG 501 is used for sw breakpoints */
 417 static const uint8_t diag_501[] = {0x83, 0x24, 0x05, 0x01};
 418
 419 int kvm_arch_insert_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
 420 {
 421
 422     if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn,
 423                             sizeof(diag_501), 0) ||
 424         cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)diag_501,
 425                             sizeof(diag_501), 1)) {
 426         return -EINVAL;
 427     }
 428     return 0;
 429 }
 430
 431 int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
 432 {
 433     uint8_t t[sizeof(diag_501)];
 434
 435     if (cpu_memory_rw_debug(cs, bp->pc, t, sizeof(diag_501), 0)) {
 436         return -EINVAL;
 437     } else if (memcmp(t, diag_501, sizeof(diag_501))) {
 438         return -EINVAL;
 439     } else if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn,
 440                                    sizeof(diag_501), 1)) {
 441         return -EINVAL;
 442     }
 443
 444     return 0;
 445 }
 446
 447 static struct kvm_hw_breakpoint *find_hw_breakpoint(target_ulong addr,
 448                                                     int len, int type)
 449 {
 450     int n;
 451
 452     for (n = 0; n < nb_hw_breakpoints; n++) {
 453         if (hw_breakpoints[n].addr == addr && hw_breakpoints[n].type == type &&
 454             (hw_breakpoints[n].len == len || len == -1)) {
 455             return &hw_breakpoints[n];
 456         }
 457     }
 458
 459     return NULL;
 460 }
 461
 462 static int insert_hw_breakpoint(target_ulong addr, int len, int type)
 463 {
 464     int size;
 465
 466     if (find_hw_breakpoint(addr, len, type)) {
 467         return -EEXIST;
 468     }
 469
 470     size = (nb_hw_breakpoints + 1) * sizeof(struct kvm_hw_breakpoint);
 471
 472     if (!hw_breakpoints) {
 473         nb_hw_breakpoints = 0;
 474         hw_breakpoints = (struct kvm_hw_breakpoint *)g_try_malloc(size);
 475     } else {
 476         hw_breakpoints =
 477             (struct kvm_hw_breakpoint *)g_try_realloc(hw_breakpoints, size);
 478     }
 479
 480     if (!hw_breakpoints) {
 481         nb_hw_breakpoints = 0;
 482         return -ENOMEM;
 483     }
 484
 485     hw_breakpoints[nb_hw_breakpoints].addr = addr;
 486     hw_breakpoints[nb_hw_breakpoints].len = len;
 487     hw_breakpoints[nb_hw_breakpoints].type = type;
 488
 489     nb_hw_breakpoints++;
 490
 491     return 0;
 492 }
 493
 494 int kvm_arch_insert_hw_breakpoint(target_ulong addr,
 495                                   target_ulong len, int type)
 496 {
 497     switch (type) {
 498     case GDB_BREAKPOINT_HW:
 499         type = KVM_HW_BP;
 500         break;
 501     case GDB_WATCHPOINT_WRITE:
 502         if (len < 1) {
 503             return -EINVAL;
 504         }
 505         type = KVM_HW_WP_WRITE;
 506         break;
 507     default:
 508         return -ENOSYS;
 509     }
 510     return insert_hw_breakpoint(addr, len, type);
 511 }
 512
 513 int kvm_arch_remove_hw_breakpoint(target_ulong addr,
 514                                   target_ulong len, int type)
 515 {
 516     int size;
 517     struct kvm_hw_breakpoint *bp = find_hw_breakpoint(addr, len, type);
 518
 519     if (bp == NULL) {
 520         return -ENOENT;
 521     }
 522
 523     nb_hw_breakpoints--;
 524     if (nb_hw_breakpoints > 0) {
 525         /*
 526          * In order to trim the array, move the last element to the position to
 527          * be removed - if necessary.
 528          */
 529         if (bp != &hw_breakpoints[nb_hw_breakpoints]) {
 530             *bp = hw_breakpoints[nb_hw_breakpoints];
 531         }
 532         size = nb_hw_breakpoints * sizeof(struct kvm_hw_breakpoint);
 533         hw_breakpoints =
 534              (struct kvm_hw_breakpoint *)g_realloc(hw_breakpoints, size);
 535     } else {
 536         g_free(hw_breakpoints);
 537         hw_breakpoints = NULL;
 538     }
 539
 540     return 0;
 541 }
 542
 543 void kvm_arch_remove_all_hw_breakpoints(void)
 544 {
 545     nb_hw_breakpoints = 0;
 546     g_free(hw_breakpoints);
 547     hw_breakpoints = NULL;
 548 }
 549
 550 void kvm_arch_update_guest_debug(CPUState *cpu, struct kvm_guest_debug *dbg)
 551 {
 552     int i;
 553
 554     if (nb_hw_breakpoints > 0) {
 555         dbg->arch.nr_hw_bp = nb_hw_breakpoints;
 556         dbg->arch.hw_bp = hw_breakpoints;
 557
 558         for (i = 0; i < nb_hw_breakpoints; ++i) {
 559             hw_breakpoints[i].phys_addr = s390_cpu_get_phys_addr_debug(cpu,
 560                                                        hw_breakpoints[i].addr);
 561         }
 562         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_HW_BP;
 563     } else {
 564         dbg->arch.nr_hw_bp = 0;
 565         dbg->arch.hw_bp = NULL;
 566     }
 567 }
 568
 569 void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
 570 {
 571 }
 572
 573 void kvm_arch_post_run(CPUState *cpu, struct kvm_run *run)
 574 {
 575 }
 576
 577 int kvm_arch_process_async_events(CPUState *cs)
 578 {
 579     return cs->halted;
 580 }
 581
 582 static int s390_kvm_irq_to_interrupt(struct kvm_s390_irq *irq,
 583                                      struct kvm_s390_interrupt *interrupt)
 584 {
 585     int r = 0;
 586
 587     interrupt->type = irq->type;
 588     switch (irq->type) {
 589     case KVM_S390_INT_VIRTIO:
 590         interrupt->parm = irq->u.ext.ext_params;
 591         /* fall through */
 592     case KVM_S390_INT_PFAULT_INIT:
 593     case KVM_S390_INT_PFAULT_DONE:
 594         interrupt->parm64 = irq->u.ext.ext_params2;
 595         break;
 596     case KVM_S390_PROGRAM_INT:
 597         interrupt->parm = irq->u.pgm.code;
 598         break;
 599     case KVM_S390_SIGP_SET_PREFIX:
 600         interrupt->parm = irq->u.prefix.address;
 601         break;
 602     case KVM_S390_INT_SERVICE:
 603         interrupt->parm = irq->u.ext.ext_params;
 604         break;
 605     case KVM_S390_MCHK:
 606         interrupt->parm = irq->u.mchk.cr14;
 607         interrupt->parm64 = irq->u.mchk.mcic;
 608         break;
 609     case KVM_S390_INT_EXTERNAL_CALL:
 610         interrupt->parm = irq->u.extcall.code;
 611         break;
 612     case KVM_S390_INT_EMERGENCY:
 613         interrupt->parm = irq->u.emerg.code;
 614         break;
 615     case KVM_S390_SIGP_STOP:
 616     case KVM_S390_RESTART:
 617         break; /* These types have no parameters */
 618     case KVM_S390_INT_IO_MIN...KVM_S390_INT_IO_MAX:
 619         interrupt->parm = irq->u.io.subchannel_id << 16;
 620         interrupt->parm |= irq->u.io.subchannel_nr;
 621         interrupt->parm64 = (uint64_t)irq->u.io.io_int_parm << 32;
 622         interrupt->parm64 |= irq->u.io.io_int_word;
 623         break;
 624     default:
 625         r = -EINVAL;
 626         break;
 627     }
 628     return r;
 629 }
 630
 631 void kvm_s390_vcpu_interrupt(S390CPU *cpu, struct kvm_s390_irq *irq)
 632 {
 633     struct kvm_s390_interrupt kvmint = {};
 634     CPUState *cs = CPU(cpu);
 635     int r;
 636
 637     r = s390_kvm_irq_to_interrupt(irq, &kvmint);
 638     if (r < 0) {
 639         fprintf(stderr, "%s called with bogus interrupt\n", __func__);
 640         exit(1);
 641     }
 642
 643     r = kvm_vcpu_ioctl(cs, KVM_S390_INTERRUPT, &kvmint);
 644     if (r < 0) {
 645         fprintf(stderr, "KVM failed to inject interrupt\n");
 646         exit(1);
 647     }
 648 }
 649
 650 static void __kvm_s390_floating_interrupt(struct kvm_s390_irq *irq)
 651 {
 652     struct kvm_s390_interrupt kvmint = {};
 653     int r;
 654
 655     r = s390_kvm_irq_to_interrupt(irq, &kvmint);
 656     if (r < 0) {
 657         fprintf(stderr, "%s called with bogus interrupt\n", __func__);
 658         exit(1);
 659     }
 660
 661     r = kvm_vm_ioctl(kvm_state, KVM_S390_INTERRUPT, &kvmint);
 662     if (r < 0) {
 663         fprintf(stderr, "KVM failed to inject interrupt\n");
 664         exit(1);
 665     }
 666 }
 667
 668 void kvm_s390_floating_interrupt(struct kvm_s390_irq *irq)
 669 {
 670     static bool use_flic = true;
 671     int r;
 672
 673     if (use_flic) {
 674         r = kvm_s390_inject_flic(irq);
 675         if (r == -ENOSYS) {
 676             use_flic = false;
 677         }
 678         if (!r) {
 679             return;
 680         }
 681     }
 682     __kvm_s390_floating_interrupt(irq);
 683 }
 684
 685 void kvm_s390_virtio_irq(int config_change, uint64_t token)
 686 {
 687     struct kvm_s390_irq irq = {
 688         .type = KVM_S390_INT_VIRTIO,
 689         .u.ext.ext_params = config_change,
 690         .u.ext.ext_params2 = token,
 691     };
 692
 693     kvm_s390_floating_interrupt(&irq);
 694 }
 695
 696 void kvm_s390_service_interrupt(uint32_t parm)
 697 {
 698     struct kvm_s390_irq irq = {
 699         .type = KVM_S390_INT_SERVICE,
 700         .u.ext.ext_params = parm,
 701     };
 702
 703     kvm_s390_floating_interrupt(&irq);
 704 }
 705
 706 static void enter_pgmcheck(S390CPU *cpu, uint16_t code)
 707 {
 708     struct kvm_s390_irq irq = {
 709         .type = KVM_S390_PROGRAM_INT,
 710         .u.pgm.code = code,
 711     };
 712
 713     kvm_s390_vcpu_interrupt(cpu, &irq);
 714 }
 715
 716 static int kvm_sclp_service_call(S390CPU *cpu, struct kvm_run *run,
 717                                  uint16_t ipbh0)
 718 {
 719     CPUS390XState *env = &cpu->env;
 720     uint64_t sccb;
 721     uint32_t code;
 722     int r = 0;
 723
 724     cpu_synchronize_state(CPU(cpu));
 725     sccb = env->regs[ipbh0 & 0xf];
 726     code = env->regs[(ipbh0 & 0xf0) >> 4];
 727
 728     r = sclp_service_call(env, sccb, code);
 729     if (r < 0) {
 730         enter_pgmcheck(cpu, -r);
 731     } else {
 732         setcc(cpu, r);
 733     }
 734
 735     return 0;
 736 }
 737
 738 static int handle_b2(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
 739 {
 740     CPUS390XState *env = &cpu->env;
 741     int rc = 0;
 742     uint16_t ipbh0 = (run->s390_sieic.ipb & 0xffff0000) >> 16;
 743
 744     cpu_synchronize_state(CPU(cpu));
 745
 746     switch (ipa1) {
 747     case PRIV_B2_XSCH:
 748         ioinst_handle_xsch(cpu, env->regs[1]);
 749         break;
 750     case PRIV_B2_CSCH:
 751         ioinst_handle_csch(cpu, env->regs[1]);
 752         break;
 753     case PRIV_B2_HSCH:
 754         ioinst_handle_hsch(cpu, env->regs[1]);
 755         break;
 756     case PRIV_B2_MSCH:
 757         ioinst_handle_msch(cpu, env->regs[1], run->s390_sieic.ipb);
 758         break;
 759     case PRIV_B2_SSCH:
 760         ioinst_handle_ssch(cpu, env->regs[1], run->s390_sieic.ipb);
 761         break;
 762     case PRIV_B2_STCRW:
 763         ioinst_handle_stcrw(cpu, run->s390_sieic.ipb);
 764         break;
 765     case PRIV_B2_STSCH:
 766         ioinst_handle_stsch(cpu, env->regs[1], run->s390_sieic.ipb);
 767         break;
 768     case PRIV_B2_TSCH:
 769         /* We should only get tsch via KVM_EXIT_S390_TSCH. */
 770         fprintf(stderr, "Spurious tsch intercept\n");
 771         break;
 772     case PRIV_B2_CHSC:
 773         ioinst_handle_chsc(cpu, run->s390_sieic.ipb);
 774         break;
 775     case PRIV_B2_TPI:
 776         /* This should have been handled by kvm already. */
 777         fprintf(stderr, "Spurious tpi intercept\n");
 778         break;
 779     case PRIV_B2_SCHM:
 780         ioinst_handle_schm(cpu, env->regs[1], env->regs[2],
 781                            run->s390_sieic.ipb);
 782         break;
 783     case PRIV_B2_RSCH:
 784         ioinst_handle_rsch(cpu, env->regs[1]);
 785         break;
 786     case PRIV_B2_RCHP:
 787         ioinst_handle_rchp(cpu, env->regs[1]);
 788         break;
 789     case PRIV_B2_STCPS:
 790         /* We do not provide this instruction, it is suppressed. */
 791         break;
 792     case PRIV_B2_SAL:
 793         ioinst_handle_sal(cpu, env->regs[1]);
 794         break;
 795     case PRIV_B2_SIGA:
 796         /* Not provided, set CC = 3 for subchannel not operational */
 797         setcc(cpu, 3);
 798         break;
 799     case PRIV_B2_SCLP_CALL:
 800         rc = kvm_sclp_service_call(cpu, run, ipbh0);
 801         break;
 802     default:
 803         rc = -1;
 804         DPRINTF("KVM: unhandled PRIV: 0xb2%x\n", ipa1);
 805         break;
 806     }
 807
 808     return rc;
 809 }
 810
 811 static int handle_b9(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
 812 {
 813     int r = 0;
 814
 815     switch (ipa1) {
 816     case PRIV_B9_EQBS:
 817         /* just inject exception */
 818         r = -1;
 819         break;
 820     default:
 821         r = -1;
 822         DPRINTF("KVM: unhandled PRIV: 0xb9%x\n", ipa1);
 823         break;
 824     }
 825
 826     return r;
 827 }
 828
 829 static int handle_eb(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
 830 {
 831     int r = 0;
 832
 833     switch (ipa1) {
 834     case PRIV_EB_SQBS:
 835         /* just inject exception */
 836         r = -1;
 837         break;
 838     default:
 839         r = -1;
 840         DPRINTF("KVM: unhandled PRIV: 0xeb%x\n", ipa1);
 841         break;
 842     }
 843
 844     return r;
 845 }
 846
 847 static int handle_hypercall(S390CPU *cpu, struct kvm_run *run)
 848 {
 849     CPUS390XState *env = &cpu->env;
 850     int ret;
 851
 852     cpu_synchronize_state(CPU(cpu));
 853     ret = s390_virtio_hypercall(env);
 854     if (ret == -EINVAL) {
 855         enter_pgmcheck(cpu, PGM_SPECIFICATION);
 856         return 0;
 857     }
 858
 859     return ret;
 860 }
 861
 862 static void kvm_handle_diag_308(S390CPU *cpu, struct kvm_run *run)
 863 {
 864     uint64_t r1, r3;
 865
 866     cpu_synchronize_state(CPU(cpu));
 867     r1 = (run->s390_sieic.ipa & 0x00f0) >> 8;
 868     r3 = run->s390_sieic.ipa & 0x000f;
 869     handle_diag_308(&cpu->env, r1, r3);
 870 }
 871
 872 static int handle_sw_breakpoint(S390CPU *cpu, struct kvm_run *run)
 873 {
 874     CPUS390XState *env = &cpu->env;
 875     unsigned long pc;
 876
 877     cpu_synchronize_state(CPU(cpu));
 878
 879     pc = env->psw.addr - 4;
 880     if (kvm_find_sw_breakpoint(CPU(cpu), pc)) {
 881         env->psw.addr = pc;
 882         return EXCP_DEBUG;
 883     }
 884
 885     return -ENOENT;
 886 }
 887
 888 #define DIAG_KVM_CODE_MASK 0x000000000000ffff
 889
 890 static int handle_diag(S390CPU *cpu, struct kvm_run *run, uint32_t ipb)
 891 {
 892     int r = 0;
 893     uint16_t func_code;
 894
 895     /*
 896      * For any diagnose call we support, bits 48-63 of the resulting
 897      * address specify the function code; the remainder is ignored.
 898      */
 899     func_code = decode_basedisp_rs(&cpu->env, ipb) & DIAG_KVM_CODE_MASK;
 900     switch (func_code) {
 901     case DIAG_IPL:
 902         kvm_handle_diag_308(cpu, run);
 903         break;
 904     case DIAG_KVM_HYPERCALL:
 905         r = handle_hypercall(cpu, run);
 906         break;
 907     case DIAG_KVM_BREAKPOINT:
 908         r = handle_sw_breakpoint(cpu, run);
 909         break;
 910     default:
 911         DPRINTF("KVM: unknown DIAG: 0x%x\n", func_code);
 912         r = -1;
 913         break;
 914     }
 915
 916     return r;
 917 }
 918
 919 static int kvm_s390_cpu_start(S390CPU *cpu)
 920 {
 921     s390_add_running_cpu(cpu);
 922     qemu_cpu_kick(CPU(cpu));
 923     DPRINTF("DONE: KVM cpu start: %p\n", &cpu->env);
 924     return 0;
 925 }
 926
 927 int kvm_s390_cpu_restart(S390CPU *cpu)
 928 {
 929     struct kvm_s390_irq irq = {
 930         .type = KVM_S390_RESTART,
 931     };
 932
 933     kvm_s390_vcpu_interrupt(cpu, &irq);
 934     s390_add_running_cpu(cpu);
 935     qemu_cpu_kick(CPU(cpu));
 936     DPRINTF("DONE: KVM cpu restart: %p\n", &cpu->env);
 937     return 0;
 938 }
 939
 940 static void sigp_initial_cpu_reset(void *arg)
 941 {
 942     CPUState *cpu = arg;
 943     S390CPUClass *scc = S390_CPU_GET_CLASS(cpu);
 944
 945     cpu_synchronize_state(cpu);
 946     scc->initial_cpu_reset(cpu);
 947 }
 948
 949 static void sigp_cpu_reset(void *arg)
 950 {
 951     CPUState *cpu = arg;
 952     S390CPUClass *scc = S390_CPU_GET_CLASS(cpu);
 953
 954     cpu_synchronize_state(cpu);
 955     scc->cpu_reset(cpu);
 956 }
 957
 958 #define SIGP_ORDER_MASK 0x000000ff
 959
 960 static int handle_sigp(S390CPU *cpu, struct kvm_run *run, uint8_t ipa1)
 961 {
 962     CPUS390XState *env = &cpu->env;
 963     uint8_t order_code;
 964     uint16_t cpu_addr;
 965     S390CPU *target_cpu;
 966     uint64_t *statusreg = &env->regs[ipa1 >> 4];
 967     int cc;
 968
 969     cpu_synchronize_state(CPU(cpu));
 970
 971     /* get order code */
 972     order_code = decode_basedisp_rs(env, run->s390_sieic.ipb) & SIGP_ORDER_MASK;
 973
 974     cpu_addr = env->regs[ipa1 & 0x0f];
 975     target_cpu = s390_cpu_addr2state(cpu_addr);
 976     if (target_cpu == NULL) {
 977         cc = 3;    /* not operational */
 978         goto out;
 979     }
 980
 981     switch (order_code) {
 982     case SIGP_START:
 983         cc = kvm_s390_cpu_start(target_cpu);
 984         break;
 985     case SIGP_RESTART:
 986         cc = kvm_s390_cpu_restart(target_cpu);
 987         break;
 988     case SIGP_SET_ARCH:
 989         *statusreg &= 0xffffffff00000000UL;
 990         *statusreg |= SIGP_STAT_INVALID_PARAMETER;
 991         cc = 1;   /* status stored */
 992         break;
 993     case SIGP_INITIAL_CPU_RESET:
 994         run_on_cpu(CPU(target_cpu), sigp_initial_cpu_reset, CPU(target_cpu));
 995         cc = 0;
 996         break;
 997     case SIGP_CPU_RESET:
 998         run_on_cpu(CPU(target_cpu), sigp_cpu_reset, CPU(target_cpu));
 999         cc = 0;
1000         break;
1001     default:
1002         DPRINTF("KVM: unknown SIGP: 0x%x\n", order_code);
1003         *statusreg &= 0xffffffff00000000UL;
1004         *statusreg |= SIGP_STAT_INVALID_ORDER;
1005         cc = 1;   /* status stored */
1006         break;
1007     }
1008
1009 out:
1010     setcc(cpu, cc);
1011     return 0;
1012 }
1013
1014 static int handle_instruction(S390CPU *cpu, struct kvm_run *run)
1015 {
1016     unsigned int ipa0 = (run->s390_sieic.ipa & 0xff00);
1017     uint8_t ipa1 = run->s390_sieic.ipa & 0x00ff;
1018     int r = -1;
1019
1020     DPRINTF("handle_instruction 0x%x 0x%x\n",
1021             run->s390_sieic.ipa, run->s390_sieic.ipb);
1022     switch (ipa0) {
1023     case IPA0_B2:
1024         r = handle_b2(cpu, run, ipa1);
1025         break;
1026     case IPA0_B9:
1027         r = handle_b9(cpu, run, ipa1);
1028         break;
1029     case IPA0_EB:
1030         r = handle_eb(cpu, run, ipa1);
1031         break;
1032     case IPA0_DIAG:
1033         r = handle_diag(cpu, run, run->s390_sieic.ipb);
1034         break;
1035     case IPA0_SIGP:
1036         r = handle_sigp(cpu, run, ipa1);
1037         break;
1038     }
1039
1040     if (r < 0) {
1041         r = 0;
1042         enter_pgmcheck(cpu, 0x0001);
1043     }
1044
1045     return r;
1046 }
1047
1048 static bool is_special_wait_psw(CPUState *cs)
1049 {
1050     /* signal quiesce */
1051     return cs->kvm_run->psw_addr == 0xfffUL;
1052 }
1053
1054 static void guest_panicked(void)
1055 {
1056     qapi_event_send_guest_panicked(GUEST_PANIC_ACTION_PAUSE,
1057                                    &error_abort);
1058     vm_stop(RUN_STATE_GUEST_PANICKED);
1059 }
1060
1061 static void unmanageable_intercept(S390CPU *cpu, const char *str, int pswoffset)
1062 {
1063     CPUState *cs = CPU(cpu);
1064
1065     error_report("Unmanageable %s! CPU%i new PSW: 0x%016lx:%016lx",
1066                  str, cs->cpu_index, ldq_phys(cs->as, cpu->env.psa + pswoffset),
1067                  ldq_phys(cs->as, cpu->env.psa + pswoffset + 8));
1068     s390_del_running_cpu(cpu);
1069     guest_panicked();
1070 }
1071
1072 static int handle_intercept(S390CPU *cpu)
1073 {
1074     CPUState *cs = CPU(cpu);
1075     struct kvm_run *run = cs->kvm_run;
1076     int icpt_code = run->s390_sieic.icptcode;
1077     int r = 0;
1078
1079     DPRINTF("intercept: 0x%x (at 0x%lx)\n", icpt_code,
1080             (long)cs->kvm_run->psw_addr);
1081     switch (icpt_code) {
1082         case ICPT_INSTRUCTION:
1083             r = handle_instruction(cpu, run);
1084             break;
1085         case ICPT_PROGRAM:
1086             unmanageable_intercept(cpu, "program interrupt",
1087                                    offsetof(LowCore, program_new_psw));
1088             r = EXCP_HALTED;
1089             break;
1090         case ICPT_EXT_INT:
1091             unmanageable_intercept(cpu, "external interrupt",
1092                                    offsetof(LowCore, external_new_psw));
1093             r = EXCP_HALTED;
1094             break;
1095         case ICPT_WAITPSW:
1096             /* disabled wait, since enabled wait is handled in kernel */
1097             if (s390_del_running_cpu(cpu) == 0) {
1098                 if (is_special_wait_psw(cs)) {
1099                     qemu_system_shutdown_request();
1100                 } else {
1101                     guest_panicked();
1102                 }
1103             }
1104             r = EXCP_HALTED;
1105             break;
1106         case ICPT_CPU_STOP:
1107             if (s390_del_running_cpu(cpu) == 0) {
1108                 qemu_system_shutdown_request();
1109             }
1110             r = EXCP_HALTED;
1111             break;
1112         case ICPT_SOFT_INTERCEPT:
1113             fprintf(stderr, "KVM unimplemented icpt SOFT\n");
1114             exit(1);
1115             break;
1116         case ICPT_IO:
1117             fprintf(stderr, "KVM unimplemented icpt IO\n");
1118             exit(1);
1119             break;
1120         default:
1121             fprintf(stderr, "Unknown intercept code: %d\n", icpt_code);
1122             exit(1);
1123             break;
1124     }
1125
1126     return r;
1127 }
1128
1129 static int handle_tsch(S390CPU *cpu)
1130 {
1131     CPUS390XState *env = &cpu->env;
1132     CPUState *cs = CPU(cpu);
1133     struct kvm_run *run = cs->kvm_run;
1134     int ret;
1135
1136     cpu_synchronize_state(cs);
1137
1138     ret = ioinst_handle_tsch(env, env->regs[1], run->s390_tsch.ipb);
1139     if (ret >= 0) {
1140         /* Success; set condition code. */
1141         setcc(cpu, ret);
1142         ret = 0;
1143     } else if (ret < -1) {
1144         /*
1145          * Failure.
1146          * If an I/O interrupt had been dequeued, we have to reinject it.
1147          */
1148         if (run->s390_tsch.dequeued) {
1149             kvm_s390_io_interrupt(run->s390_tsch.subchannel_id,
1150                                   run->s390_tsch.subchannel_nr,
1151                                   run->s390_tsch.io_int_parm,
1152                                   run->s390_tsch.io_int_word);
1153         }
1154         ret = 0;
1155     }
1156     return ret;
1157 }
1158
1159 static int kvm_arch_handle_debug_exit(S390CPU *cpu)
1160 {
1161     CPUState *cs = CPU(cpu);
1162     struct kvm_run *run = cs->kvm_run;
1163
1164     int ret = 0;
1165     struct kvm_debug_exit_arch *arch_info = &run->debug.arch;
1166
1167     switch (arch_info->type) {
1168     case KVM_HW_WP_WRITE:
1169         if (find_hw_breakpoint(arch_info->addr, -1, arch_info->type)) {
1170             cs->watchpoint_hit = &hw_watchpoint;
1171             hw_watchpoint.vaddr = arch_info->addr;
1172             hw_watchpoint.flags = BP_MEM_WRITE;
1173             ret = EXCP_DEBUG;
1174         }
1175         break;
1176     case KVM_HW_BP:
1177         if (find_hw_breakpoint(arch_info->addr, -1, arch_info->type)) {
1178             ret = EXCP_DEBUG;
1179         }
1180         break;
1181     case KVM_SINGLESTEP:
1182         if (cs->singlestep_enabled) {
1183             ret = EXCP_DEBUG;
1184         }
1185         break;
1186     default:
1187         ret = -ENOSYS;
1188     }
1189
1190     return ret;
1191 }
1192
1193 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
1194 {
1195     S390CPU *cpu = S390_CPU(cs);
1196     int ret = 0;
1197
1198     switch (run->exit_reason) {
1199         case KVM_EXIT_S390_SIEIC:
1200             ret = handle_intercept(cpu);
1201             break;
1202         case KVM_EXIT_S390_RESET:
1203             qemu_system_reset_request();
1204             break;
1205         case KVM_EXIT_S390_TSCH:
1206             ret = handle_tsch(cpu);
1207             break;
1208         case KVM_EXIT_DEBUG:
1209             ret = kvm_arch_handle_debug_exit(cpu);
1210             break;
1211         default:
1212             fprintf(stderr, "Unknown KVM exit: %d\n", run->exit_reason);
1213             break;
1214     }
1215
1216     if (ret == 0) {
1217         ret = EXCP_INTERRUPT;
1218     }
1219     return ret;
1220 }
1221
1222 bool kvm_arch_stop_on_emulation_error(CPUState *cpu)
1223 {
1224     return true;
1225 }
1226
1227 int kvm_arch_on_sigbus_vcpu(CPUState *cpu, int code, void *addr)
1228 {
1229     return 1;
1230 }
1231
1232 int kvm_arch_on_sigbus(int code, void *addr)
1233 {
1234     return 1;
1235 }
1236
1237 void kvm_s390_io_interrupt(uint16_t subchannel_id,
1238                            uint16_t subchannel_nr, uint32_t io_int_parm,
1239                            uint32_t io_int_word)
1240 {
1241     struct kvm_s390_irq irq = {
1242         .u.io.subchannel_id = subchannel_id,
1243         .u.io.subchannel_nr = subchannel_nr,
1244         .u.io.io_int_parm = io_int_parm,
1245         .u.io.io_int_word = io_int_word,
1246     };
1247
1248     if (io_int_word & IO_INT_WORD_AI) {
1249         irq.type = KVM_S390_INT_IO(1, 0, 0, 0);
1250     } else {
1251         irq.type = ((subchannel_id & 0xff00) << 24) |
1252             ((subchannel_id & 0x00060) << 22) | (subchannel_nr << 16);
1253     }
1254     kvm_s390_floating_interrupt(&irq);
1255 }
1256
1257 void kvm_s390_crw_mchk(void)
1258 {
1259     struct kvm_s390_irq irq = {
1260         .type = KVM_S390_MCHK,
1261         .u.mchk.cr14 = 1 << 28,
1262         .u.mchk.mcic = 0x00400f1d40330000,
1263     };
1264     kvm_s390_floating_interrupt(&irq);
1265 }
1266
1267 void kvm_s390_enable_css_support(S390CPU *cpu)
1268 {
1269     int r;
1270
1271     /* Activate host kernel channel subsystem support. */
1272     r = kvm_vcpu_enable_cap(CPU(cpu), KVM_CAP_S390_CSS_SUPPORT, 0);
1273     assert(r == 0);
1274 }
1275
1276 void kvm_arch_init_irq_routing(KVMState *s)
1277 {
1278     /*
1279      * Note that while irqchip capabilities generally imply that cpustates
1280      * are handled in-kernel, it is not true for s390 (yet); therefore, we
1281      * have to override the common code kvm_halt_in_kernel_allowed setting.
1282      */
1283     if (kvm_check_extension(s, KVM_CAP_IRQ_ROUTING)) {
1284         kvm_irqfds_allowed = true;
1285         kvm_gsi_routing_allowed = true;
1286         kvm_halt_in_kernel_allowed = false;
1287     }
1288 }
1289
1290 int kvm_s390_assign_subch_ioeventfd(EventNotifier *notifier, uint32_t sch,
1291                                     int vq, bool assign)
1292 {
1293     struct kvm_ioeventfd kick = {
1294         .flags = KVM_IOEVENTFD_FLAG_VIRTIO_CCW_NOTIFY |
1295         KVM_IOEVENTFD_FLAG_DATAMATCH,
1296         .fd = event_notifier_get_fd(notifier),
1297         .datamatch = vq,
1298         .addr = sch,
1299         .len = 8,
1300     };
1301     if (!kvm_check_extension(kvm_state, KVM_CAP_IOEVENTFD)) {
1302         return -ENOSYS;
1303     }
1304     if (!assign) {
1305         kick.flags |= KVM_IOEVENTFD_FLAG_DEASSIGN;
1306     }
1307     return kvm_vm_ioctl(kvm_state, KVM_IOEVENTFD, &kick);
1308 }