hw/s390x/css.c

   1 /*
   2  * Channel subsystem base support.
   3  *
   4  * Copyright 2012 IBM Corp.
   5  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
   6  *
   7  * This work is licensed under the terms of the GNU GPL, version 2 or (at
   8  * your option) any later version. See the COPYING file in the top-level
   9  * directory.
  10  */
  11
  12 #include "qemu/osdep.h"
  13 #include "qapi/error.h"
  14 #include "qapi/visitor.h"
  15 #include "hw/qdev.h"
  16 #include "qemu/bitops.h"
  17 #include "exec/address-spaces.h"
  18 #include "cpu.h"
  19 #include "hw/s390x/ioinst.h"
  20 #include "hw/s390x/css.h"
  21 #include "trace.h"
  22 #include "hw/s390x/s390_flic.h"
  23
  24 typedef struct CrwContainer {
  25     CRW crw;
  26     QTAILQ_ENTRY(CrwContainer) sibling;
  27 } CrwContainer;
  28
  29 typedef struct ChpInfo {
  30     uint8_t in_use;
  31     uint8_t type;
  32     uint8_t is_virtual;
  33 } ChpInfo;
  34
  35 typedef struct SubchSet {
  36     SubchDev *sch[MAX_SCHID + 1];
  37     unsigned long schids_used[BITS_TO_LONGS(MAX_SCHID + 1)];
  38     unsigned long devnos_used[BITS_TO_LONGS(MAX_SCHID + 1)];
  39 } SubchSet;
  40
  41 typedef struct CssImage {
  42     SubchSet *sch_set[MAX_SSID + 1];
  43     ChpInfo chpids[MAX_CHPID + 1];
  44 } CssImage;
  45
  46 typedef struct IoAdapter {
  47     uint32_t id;
  48     uint8_t type;
  49     uint8_t isc;
  50     QTAILQ_ENTRY(IoAdapter) sibling;
  51 } IoAdapter;
  52
  53 typedef struct ChannelSubSys {
  54     QTAILQ_HEAD(, CrwContainer) pending_crws;
  55     bool sei_pending;
  56     bool do_crw_mchk;
  57     bool crws_lost;
  58     uint8_t max_cssid;
  59     uint8_t max_ssid;
  60     bool chnmon_active;
  61     uint64_t chnmon_area;
  62     CssImage *css[MAX_CSSID + 1];
  63     uint8_t default_cssid;
  64     QTAILQ_HEAD(, IoAdapter) io_adapters;
  65     QTAILQ_HEAD(, IndAddr) indicator_addresses;
  66 } ChannelSubSys;
  67
  68 static ChannelSubSys channel_subsys = {
  69     .pending_crws = QTAILQ_HEAD_INITIALIZER(channel_subsys.pending_crws),
  70     .do_crw_mchk = true,
  71     .sei_pending = false,
  72     .do_crw_mchk = true,
  73     .crws_lost = false,
  74     .chnmon_active = false,
  75     .io_adapters = QTAILQ_HEAD_INITIALIZER(channel_subsys.io_adapters),
  76     .indicator_addresses =
  77         QTAILQ_HEAD_INITIALIZER(channel_subsys.indicator_addresses),
  78 };
  79
  80 IndAddr *get_indicator(hwaddr ind_addr, int len)
  81 {
  82     IndAddr *indicator;
  83
  84     QTAILQ_FOREACH(indicator, &channel_subsys.indicator_addresses, sibling) {
  85         if (indicator->addr == ind_addr) {
  86             indicator->refcnt++;
  87             return indicator;
  88         }
  89     }
  90     indicator = g_new0(IndAddr, 1);
  91     indicator->addr = ind_addr;
  92     indicator->len = len;
  93     indicator->refcnt = 1;
  94     QTAILQ_INSERT_TAIL(&channel_subsys.indicator_addresses,
  95                        indicator, sibling);
  96     return indicator;
  97 }
  98
  99 static int s390_io_adapter_map(AdapterInfo *adapter, uint64_t map_addr,
 100                                bool do_map)
 101 {
 102     S390FLICState *fs = s390_get_flic();
 103     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
 104
 105     return fsc->io_adapter_map(fs, adapter->adapter_id, map_addr, do_map);
 106 }
 107
 108 void release_indicator(AdapterInfo *adapter, IndAddr *indicator)
 109 {
 110     assert(indicator->refcnt > 0);
 111     indicator->refcnt--;
 112     if (indicator->refcnt > 0) {
 113         return;
 114     }
 115     QTAILQ_REMOVE(&channel_subsys.indicator_addresses, indicator, sibling);
 116     if (indicator->map) {
 117         s390_io_adapter_map(adapter, indicator->map, false);
 118     }
 119     g_free(indicator);
 120 }
 121
 122 int map_indicator(AdapterInfo *adapter, IndAddr *indicator)
 123 {
 124     int ret;
 125
 126     if (indicator->map) {
 127         return 0; /* already mapped is not an error */
 128     }
 129     indicator->map = indicator->addr;
 130     ret = s390_io_adapter_map(adapter, indicator->map, true);
 131     if ((ret != 0) && (ret != -ENOSYS)) {
 132         goto out_err;
 133     }
 134     return 0;
 135
 136 out_err:
 137     indicator->map = 0;
 138     return ret;
 139 }
 140
 141 int css_create_css_image(uint8_t cssid, bool default_image)
 142 {
 143     trace_css_new_image(cssid, default_image ? "(default)" : "");
 144     if (cssid > MAX_CSSID) {
 145         return -EINVAL;
 146     }
 147     if (channel_subsys.css[cssid]) {
 148         return -EBUSY;
 149     }
 150     channel_subsys.css[cssid] = g_malloc0(sizeof(CssImage));
 151     if (default_image) {
 152         channel_subsys.default_cssid = cssid;
 153     }
 154     return 0;
 155 }
 156
 157 int css_register_io_adapter(uint8_t type, uint8_t isc, bool swap,
 158                             bool maskable, uint32_t *id)
 159 {
 160     IoAdapter *adapter;
 161     bool found = false;
 162     int ret;
 163     S390FLICState *fs = s390_get_flic();
 164     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
 165
 166     *id = 0;
 167     QTAILQ_FOREACH(adapter, &channel_subsys.io_adapters, sibling) {
 168         if ((adapter->type == type) && (adapter->isc == isc)) {
 169             *id = adapter->id;
 170             found = true;
 171             ret = 0;
 172             break;
 173         }
 174         if (adapter->id >= *id) {
 175             *id = adapter->id + 1;
 176         }
 177     }
 178     if (found) {
 179         goto out;
 180     }
 181     adapter = g_new0(IoAdapter, 1);
 182     ret = fsc->register_io_adapter(fs, *id, isc, swap, maskable);
 183     if (ret == 0) {
 184         adapter->id = *id;
 185         adapter->isc = isc;
 186         adapter->type = type;
 187         QTAILQ_INSERT_TAIL(&channel_subsys.io_adapters, adapter, sibling);
 188     } else {
 189         g_free(adapter);
 190         fprintf(stderr, "Unexpected error %d when registering adapter %d\n",
 191                 ret, *id);
 192     }
 193 out:
 194     return ret;
 195 }
 196
 197 static void css_clear_io_interrupt(uint16_t subchannel_id,
 198                                    uint16_t subchannel_nr)
 199 {
 200     Error *err = NULL;
 201     static bool no_clear_irq;
 202     S390FLICState *fs = s390_get_flic();
 203     S390FLICStateClass *fsc = S390_FLIC_COMMON_GET_CLASS(fs);
 204     int r;
 205
 206     if (unlikely(no_clear_irq)) {
 207         return;
 208     }
 209     r = fsc->clear_io_irq(fs, subchannel_id, subchannel_nr);
 210     switch (r) {
 211     case 0:
 212         break;
 213     case -ENOSYS:
 214         no_clear_irq = true;
 215         /*
 216         * Ignore unavailability, as the user can't do anything
 217         * about it anyway.
 218         */
 219         break;
 220     default:
 221         error_setg_errno(&err, -r, "unexpected error condition");
 222         error_propagate(&error_abort, err);
 223     }
 224 }
 225
 226 static inline uint16_t css_do_build_subchannel_id(uint8_t cssid, uint8_t ssid)
 227 {
 228     if (channel_subsys.max_cssid > 0) {
 229         return (cssid << 8) | (1 << 3) | (ssid << 1) | 1;
 230     }
 231     return (ssid << 1) | 1;
 232 }
 233
 234 uint16_t css_build_subchannel_id(SubchDev *sch)
 235 {
 236     return css_do_build_subchannel_id(sch->cssid, sch->ssid);
 237 }
 238
 239 static void css_inject_io_interrupt(SubchDev *sch)
 240 {
 241     uint8_t isc = (sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ISC) >> 11;
 242
 243     trace_css_io_interrupt(sch->cssid, sch->ssid, sch->schid,
 244                            sch->curr_status.pmcw.intparm, isc, "");
 245     s390_io_interrupt(css_build_subchannel_id(sch),
 246                       sch->schid,
 247                       sch->curr_status.pmcw.intparm,
 248                       isc << 27);
 249 }
 250
 251 void css_conditional_io_interrupt(SubchDev *sch)
 252 {
 253     /*
 254      * If the subchannel is not currently status pending, make it pending
 255      * with alert status.
 256      */
 257     if (!(sch->curr_status.scsw.ctrl & SCSW_STCTL_STATUS_PEND)) {
 258         uint8_t isc = (sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ISC) >> 11;
 259
 260         trace_css_io_interrupt(sch->cssid, sch->ssid, sch->schid,
 261                                sch->curr_status.pmcw.intparm, isc,
 262                                "(unsolicited)");
 263         sch->curr_status.scsw.ctrl &= ~SCSW_CTRL_MASK_STCTL;
 264         sch->curr_status.scsw.ctrl |=
 265             SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
 266         /* Inject an I/O interrupt. */
 267         s390_io_interrupt(css_build_subchannel_id(sch),
 268                           sch->schid,
 269                           sch->curr_status.pmcw.intparm,
 270                           isc << 27);
 271     }
 272 }
 273
 274 void css_adapter_interrupt(uint8_t isc)
 275 {
 276     uint32_t io_int_word = (isc << 27) | IO_INT_WORD_AI;
 277
 278     trace_css_adapter_interrupt(isc);
 279     s390_io_interrupt(0, 0, 0, io_int_word);
 280 }
 281
 282 static void sch_handle_clear_func(SubchDev *sch)
 283 {
 284     PMCW *p = &sch->curr_status.pmcw;
 285     SCSW *s = &sch->curr_status.scsw;
 286     int path;
 287
 288     /* Path management: In our simple css, we always choose the only path. */
 289     path = 0x80;
 290
 291     /* Reset values prior to 'issuing the clear signal'. */
 292     p->lpum = 0;
 293     p->pom = 0xff;
 294     s->flags &= ~SCSW_FLAGS_MASK_PNO;
 295
 296     /* We always 'attempt to issue the clear signal', and we always succeed. */
 297     sch->channel_prog = 0x0;
 298     sch->last_cmd_valid = false;
 299     s->ctrl &= ~SCSW_ACTL_CLEAR_PEND;
 300     s->ctrl |= SCSW_STCTL_STATUS_PEND;
 301
 302     s->dstat = 0;
 303     s->cstat = 0;
 304     p->lpum = path;
 305
 306 }
 307
 308 static void sch_handle_halt_func(SubchDev *sch)
 309 {
 310
 311     PMCW *p = &sch->curr_status.pmcw;
 312     SCSW *s = &sch->curr_status.scsw;
 313     hwaddr curr_ccw = sch->channel_prog;
 314     int path;
 315
 316     /* Path management: In our simple css, we always choose the only path. */
 317     path = 0x80;
 318
 319     /* We always 'attempt to issue the halt signal', and we always succeed. */
 320     sch->channel_prog = 0x0;
 321     sch->last_cmd_valid = false;
 322     s->ctrl &= ~SCSW_ACTL_HALT_PEND;
 323     s->ctrl |= SCSW_STCTL_STATUS_PEND;
 324
 325     if ((s->ctrl & (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) ||
 326         !((s->ctrl & SCSW_ACTL_START_PEND) ||
 327           (s->ctrl & SCSW_ACTL_SUSP))) {
 328         s->dstat = SCSW_DSTAT_DEVICE_END;
 329     }
 330     if ((s->ctrl & (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) ||
 331         (s->ctrl & SCSW_ACTL_SUSP)) {
 332         s->cpa = curr_ccw + 8;
 333     }
 334     s->cstat = 0;
 335     p->lpum = path;
 336
 337 }
 338
 339 static void copy_sense_id_to_guest(SenseId *dest, SenseId *src)
 340 {
 341     int i;
 342
 343     dest->reserved = src->reserved;
 344     dest->cu_type = cpu_to_be16(src->cu_type);
 345     dest->cu_model = src->cu_model;
 346     dest->dev_type = cpu_to_be16(src->dev_type);
 347     dest->dev_model = src->dev_model;
 348     dest->unused = src->unused;
 349     for (i = 0; i < ARRAY_SIZE(dest->ciw); i++) {
 350         dest->ciw[i].type = src->ciw[i].type;
 351         dest->ciw[i].command = src->ciw[i].command;
 352         dest->ciw[i].count = cpu_to_be16(src->ciw[i].count);
 353     }
 354 }
 355
 356 static CCW1 copy_ccw_from_guest(hwaddr addr, bool fmt1)
 357 {
 358     CCW0 tmp0;
 359     CCW1 tmp1;
 360     CCW1 ret;
 361
 362     if (fmt1) {
 363         cpu_physical_memory_read(addr, &tmp1, sizeof(tmp1));
 364         ret.cmd_code = tmp1.cmd_code;
 365         ret.flags = tmp1.flags;
 366         ret.count = be16_to_cpu(tmp1.count);
 367         ret.cda = be32_to_cpu(tmp1.cda);
 368     } else {
 369         cpu_physical_memory_read(addr, &tmp0, sizeof(tmp0));
 370         ret.cmd_code = tmp0.cmd_code;
 371         ret.flags = tmp0.flags;
 372         ret.count = be16_to_cpu(tmp0.count);
 373         ret.cda = be16_to_cpu(tmp0.cda1) | (tmp0.cda0 << 16);
 374         if ((ret.cmd_code & 0x0f) == CCW_CMD_TIC) {
 375             ret.cmd_code &= 0x0f;
 376         }
 377     }
 378     return ret;
 379 }
 380
 381 static int css_interpret_ccw(SubchDev *sch, hwaddr ccw_addr,
 382                              bool suspend_allowed)
 383 {
 384     int ret;
 385     bool check_len;
 386     int len;
 387     CCW1 ccw;
 388
 389     if (!ccw_addr) {
 390         return -EIO;
 391     }
 392
 393     /* Translate everything to format-1 ccws - the information is the same. */
 394     ccw = copy_ccw_from_guest(ccw_addr, sch->ccw_fmt_1);
 395
 396     /* Check for invalid command codes. */
 397     if ((ccw.cmd_code & 0x0f) == 0) {
 398         return -EINVAL;
 399     }
 400     if (((ccw.cmd_code & 0x0f) == CCW_CMD_TIC) &&
 401         ((ccw.cmd_code & 0xf0) != 0)) {
 402         return -EINVAL;
 403     }
 404     if (!sch->ccw_fmt_1 && (ccw.count == 0) &&
 405         (ccw.cmd_code != CCW_CMD_TIC)) {
 406         return -EINVAL;
 407     }
 408
 409     if (ccw.flags & CCW_FLAG_SUSPEND) {
 410         return suspend_allowed ? -EINPROGRESS : -EINVAL;
 411     }
 412
 413     check_len = !((ccw.flags & CCW_FLAG_SLI) && !(ccw.flags & CCW_FLAG_DC));
 414
 415     if (!ccw.cda) {
 416         if (sch->ccw_no_data_cnt == 255) {
 417             return -EINVAL;
 418         }
 419         sch->ccw_no_data_cnt++;
 420     }
 421
 422     /* Look at the command. */
 423     switch (ccw.cmd_code) {
 424     case CCW_CMD_NOOP:
 425         /* Nothing to do. */
 426         ret = 0;
 427         break;
 428     case CCW_CMD_BASIC_SENSE:
 429         if (check_len) {
 430             if (ccw.count != sizeof(sch->sense_data)) {
 431                 ret = -EINVAL;
 432                 break;
 433             }
 434         }
 435         len = MIN(ccw.count, sizeof(sch->sense_data));
 436         cpu_physical_memory_write(ccw.cda, sch->sense_data, len);
 437         sch->curr_status.scsw.count = ccw.count - len;
 438         memset(sch->sense_data, 0, sizeof(sch->sense_data));
 439         ret = 0;
 440         break;
 441     case CCW_CMD_SENSE_ID:
 442     {
 443         SenseId sense_id;
 444
 445         copy_sense_id_to_guest(&sense_id, &sch->id);
 446         /* Sense ID information is device specific. */
 447         if (check_len) {
 448             if (ccw.count != sizeof(sense_id)) {
 449                 ret = -EINVAL;
 450                 break;
 451             }
 452         }
 453         len = MIN(ccw.count, sizeof(sense_id));
 454         /*
 455          * Only indicate 0xff in the first sense byte if we actually
 456          * have enough place to store at least bytes 0-3.
 457          */
 458         if (len >= 4) {
 459             sense_id.reserved = 0xff;
 460         } else {
 461             sense_id.reserved = 0;
 462         }
 463         cpu_physical_memory_write(ccw.cda, &sense_id, len);
 464         sch->curr_status.scsw.count = ccw.count - len;
 465         ret = 0;
 466         break;
 467     }
 468     case CCW_CMD_TIC:
 469         if (sch->last_cmd_valid && (sch->last_cmd.cmd_code == CCW_CMD_TIC)) {
 470             ret = -EINVAL;
 471             break;
 472         }
 473         if (ccw.flags & (CCW_FLAG_CC | CCW_FLAG_DC)) {
 474             ret = -EINVAL;
 475             break;
 476         }
 477         sch->channel_prog = ccw.cda;
 478         ret = -EAGAIN;
 479         break;
 480     default:
 481         if (sch->ccw_cb) {
 482             /* Handle device specific commands. */
 483             ret = sch->ccw_cb(sch, ccw);
 484         } else {
 485             ret = -ENOSYS;
 486         }
 487         break;
 488     }
 489     sch->last_cmd = ccw;
 490     sch->last_cmd_valid = true;
 491     if (ret == 0) {
 492         if (ccw.flags & CCW_FLAG_CC) {
 493             sch->channel_prog += 8;
 494             ret = -EAGAIN;
 495         }
 496     }
 497
 498     return ret;
 499 }
 500
 501 static void sch_handle_start_func(SubchDev *sch, ORB *orb)
 502 {
 503
 504     PMCW *p = &sch->curr_status.pmcw;
 505     SCSW *s = &sch->curr_status.scsw;
 506     int path;
 507     int ret;
 508     bool suspend_allowed;
 509
 510     /* Path management: In our simple css, we always choose the only path. */
 511     path = 0x80;
 512
 513     if (!(s->ctrl & SCSW_ACTL_SUSP)) {
 514         /* Start Function triggered via ssch, i.e. we have an ORB */
 515         s->cstat = 0;
 516         s->dstat = 0;
 517         /* Look at the orb and try to execute the channel program. */
 518         assert(orb != NULL); /* resume does not pass an orb */
 519         p->intparm = orb->intparm;
 520         if (!(orb->lpm & path)) {
 521             /* Generate a deferred cc 3 condition. */
 522             s->flags |= SCSW_FLAGS_MASK_CC;
 523             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
 524             s->ctrl |= (SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND);
 525             return;
 526         }
 527         sch->ccw_fmt_1 = !!(orb->ctrl0 & ORB_CTRL0_MASK_FMT);
 528         s->flags |= (sch->ccw_fmt_1) ? SCSW_FLAGS_MASK_FMT : 0;
 529         sch->ccw_no_data_cnt = 0;
 530         suspend_allowed = !!(orb->ctrl0 & ORB_CTRL0_MASK_SPND);
 531     } else {
 532         /* Start Function resumed via rsch, i.e. we don't have an
 533          * ORB */
 534         s->ctrl &= ~(SCSW_ACTL_SUSP | SCSW_ACTL_RESUME_PEND);
 535         /* The channel program had been suspended before. */
 536         suspend_allowed = true;
 537     }
 538     sch->last_cmd_valid = false;
 539     do {
 540         ret = css_interpret_ccw(sch, sch->channel_prog, suspend_allowed);
 541         switch (ret) {
 542         case -EAGAIN:
 543             /* ccw chain, continue processing */
 544             break;
 545         case 0:
 546             /* success */
 547             s->ctrl &= ~SCSW_ACTL_START_PEND;
 548             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
 549             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
 550                     SCSW_STCTL_STATUS_PEND;
 551             s->dstat = SCSW_DSTAT_CHANNEL_END | SCSW_DSTAT_DEVICE_END;
 552             s->cpa = sch->channel_prog + 8;
 553             break;
 554         case -ENOSYS:
 555             /* unsupported command, generate unit check (command reject) */
 556             s->ctrl &= ~SCSW_ACTL_START_PEND;
 557             s->dstat = SCSW_DSTAT_UNIT_CHECK;
 558             /* Set sense bit 0 in ecw0. */
 559             sch->sense_data[0] = 0x80;
 560             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
 561             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
 562                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
 563             s->cpa = sch->channel_prog + 8;
 564             break;
 565         case -EFAULT:
 566             /* memory problem, generate channel data check */
 567             s->ctrl &= ~SCSW_ACTL_START_PEND;
 568             s->cstat = SCSW_CSTAT_DATA_CHECK;
 569             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
 570             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
 571                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
 572             s->cpa = sch->channel_prog + 8;
 573             break;
 574         case -EBUSY:
 575             /* subchannel busy, generate deferred cc 1 */
 576             s->flags &= ~SCSW_FLAGS_MASK_CC;
 577             s->flags |= (1 << 8);
 578             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
 579             s->ctrl |= SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
 580             break;
 581         case -EINPROGRESS:
 582             /* channel program has been suspended */
 583             s->ctrl &= ~SCSW_ACTL_START_PEND;
 584             s->ctrl |= SCSW_ACTL_SUSP;
 585             break;
 586         default:
 587             /* error, generate channel program check */
 588             s->ctrl &= ~SCSW_ACTL_START_PEND;
 589             s->cstat = SCSW_CSTAT_PROG_CHECK;
 590             s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
 591             s->ctrl |= SCSW_STCTL_PRIMARY | SCSW_STCTL_SECONDARY |
 592                     SCSW_STCTL_ALERT | SCSW_STCTL_STATUS_PEND;
 593             s->cpa = sch->channel_prog + 8;
 594             break;
 595         }
 596     } while (ret == -EAGAIN);
 597
 598 }
 599
 600 /*
 601  * On real machines, this would run asynchronously to the main vcpus.
 602  * We might want to make some parts of the ssch handling (interpreting
 603  * read/writes) asynchronous later on if we start supporting more than
 604  * our current very simple devices.
 605  */
 606 static void do_subchannel_work(SubchDev *sch, ORB *orb)
 607 {
 608
 609     SCSW *s = &sch->curr_status.scsw;
 610
 611     if (s->ctrl & SCSW_FCTL_CLEAR_FUNC) {
 612         sch_handle_clear_func(sch);
 613     } else if (s->ctrl & SCSW_FCTL_HALT_FUNC) {
 614         sch_handle_halt_func(sch);
 615     } else if (s->ctrl & SCSW_FCTL_START_FUNC) {
 616         /* Triggered by both ssch and rsch. */
 617         sch_handle_start_func(sch, orb);
 618     } else {
 619         /* Cannot happen. */
 620         return;
 621     }
 622     css_inject_io_interrupt(sch);
 623 }
 624
 625 static void copy_pmcw_to_guest(PMCW *dest, const PMCW *src)
 626 {
 627     int i;
 628
 629     dest->intparm = cpu_to_be32(src->intparm);
 630     dest->flags = cpu_to_be16(src->flags);
 631     dest->devno = cpu_to_be16(src->devno);
 632     dest->lpm = src->lpm;
 633     dest->pnom = src->pnom;
 634     dest->lpum = src->lpum;
 635     dest->pim = src->pim;
 636     dest->mbi = cpu_to_be16(src->mbi);
 637     dest->pom = src->pom;
 638     dest->pam = src->pam;
 639     for (i = 0; i < ARRAY_SIZE(dest->chpid); i++) {
 640         dest->chpid[i] = src->chpid[i];
 641     }
 642     dest->chars = cpu_to_be32(src->chars);
 643 }
 644
 645 static void copy_scsw_to_guest(SCSW *dest, const SCSW *src)
 646 {
 647     dest->flags = cpu_to_be16(src->flags);
 648     dest->ctrl = cpu_to_be16(src->ctrl);
 649     dest->cpa = cpu_to_be32(src->cpa);
 650     dest->dstat = src->dstat;
 651     dest->cstat = src->cstat;
 652     dest->count = cpu_to_be16(src->count);
 653 }
 654
 655 static void copy_schib_to_guest(SCHIB *dest, const SCHIB *src)
 656 {
 657     int i;
 658
 659     copy_pmcw_to_guest(&dest->pmcw, &src->pmcw);
 660     copy_scsw_to_guest(&dest->scsw, &src->scsw);
 661     dest->mba = cpu_to_be64(src->mba);
 662     for (i = 0; i < ARRAY_SIZE(dest->mda); i++) {
 663         dest->mda[i] = src->mda[i];
 664     }
 665 }
 666
 667 int css_do_stsch(SubchDev *sch, SCHIB *schib)
 668 {
 669     /* Use current status. */
 670     copy_schib_to_guest(schib, &sch->curr_status);
 671     return 0;
 672 }
 673
 674 static void copy_pmcw_from_guest(PMCW *dest, const PMCW *src)
 675 {
 676     int i;
 677
 678     dest->intparm = be32_to_cpu(src->intparm);
 679     dest->flags = be16_to_cpu(src->flags);
 680     dest->devno = be16_to_cpu(src->devno);
 681     dest->lpm = src->lpm;
 682     dest->pnom = src->pnom;
 683     dest->lpum = src->lpum;
 684     dest->pim = src->pim;
 685     dest->mbi = be16_to_cpu(src->mbi);
 686     dest->pom = src->pom;
 687     dest->pam = src->pam;
 688     for (i = 0; i < ARRAY_SIZE(dest->chpid); i++) {
 689         dest->chpid[i] = src->chpid[i];
 690     }
 691     dest->chars = be32_to_cpu(src->chars);
 692 }
 693
 694 static void copy_scsw_from_guest(SCSW *dest, const SCSW *src)
 695 {
 696     dest->flags = be16_to_cpu(src->flags);
 697     dest->ctrl = be16_to_cpu(src->ctrl);
 698     dest->cpa = be32_to_cpu(src->cpa);
 699     dest->dstat = src->dstat;
 700     dest->cstat = src->cstat;
 701     dest->count = be16_to_cpu(src->count);
 702 }
 703
 704 static void copy_schib_from_guest(SCHIB *dest, const SCHIB *src)
 705 {
 706     int i;
 707
 708     copy_pmcw_from_guest(&dest->pmcw, &src->pmcw);
 709     copy_scsw_from_guest(&dest->scsw, &src->scsw);
 710     dest->mba = be64_to_cpu(src->mba);
 711     for (i = 0; i < ARRAY_SIZE(dest->mda); i++) {
 712         dest->mda[i] = src->mda[i];
 713     }
 714 }
 715
 716 int css_do_msch(SubchDev *sch, const SCHIB *orig_schib)
 717 {
 718     SCSW *s = &sch->curr_status.scsw;
 719     PMCW *p = &sch->curr_status.pmcw;
 720     uint16_t oldflags;
 721     int ret;
 722     SCHIB schib;
 723
 724     if (!(sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_DNV)) {
 725         ret = 0;
 726         goto out;
 727     }
 728
 729     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
 730         ret = -EINPROGRESS;
 731         goto out;
 732     }
 733
 734     if (s->ctrl &
 735         (SCSW_FCTL_START_FUNC|SCSW_FCTL_HALT_FUNC|SCSW_FCTL_CLEAR_FUNC)) {
 736         ret = -EBUSY;
 737         goto out;
 738     }
 739
 740     copy_schib_from_guest(&schib, orig_schib);
 741     /* Only update the program-modifiable fields. */
 742     p->intparm = schib.pmcw.intparm;
 743     oldflags = p->flags;
 744     p->flags &= ~(PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
 745                   PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
 746                   PMCW_FLAGS_MASK_MP);
 747     p->flags |= schib.pmcw.flags &
 748             (PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
 749              PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
 750              PMCW_FLAGS_MASK_MP);
 751     p->lpm = schib.pmcw.lpm;
 752     p->mbi = schib.pmcw.mbi;
 753     p->pom = schib.pmcw.pom;
 754     p->chars &= ~(PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_CSENSE);
 755     p->chars |= schib.pmcw.chars &
 756             (PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_CSENSE);
 757     sch->curr_status.mba = schib.mba;
 758
 759     /* Has the channel been disabled? */
 760     if (sch->disable_cb && (oldflags & PMCW_FLAGS_MASK_ENA) != 0
 761         && (p->flags & PMCW_FLAGS_MASK_ENA) == 0) {
 762         sch->disable_cb(sch);
 763     }
 764
 765     ret = 0;
 766
 767 out:
 768     return ret;
 769 }
 770
 771 int css_do_xsch(SubchDev *sch)
 772 {
 773     SCSW *s = &sch->curr_status.scsw;
 774     PMCW *p = &sch->curr_status.pmcw;
 775     int ret;
 776
 777     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
 778         ret = -ENODEV;
 779         goto out;
 780     }
 781
 782     if (!(s->ctrl & SCSW_CTRL_MASK_FCTL) ||
 783         ((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||
 784         (!(s->ctrl &
 785            (SCSW_ACTL_RESUME_PEND | SCSW_ACTL_START_PEND | SCSW_ACTL_SUSP))) ||
 786         (s->ctrl & SCSW_ACTL_SUBCH_ACTIVE)) {
 787         ret = -EINPROGRESS;
 788         goto out;
 789     }
 790
 791     if (s->ctrl & SCSW_CTRL_MASK_STCTL) {
 792         ret = -EBUSY;
 793         goto out;
 794     }
 795
 796     /* Cancel the current operation. */
 797     s->ctrl &= ~(SCSW_FCTL_START_FUNC |
 798                  SCSW_ACTL_RESUME_PEND |
 799                  SCSW_ACTL_START_PEND |
 800                  SCSW_ACTL_SUSP);
 801     sch->channel_prog = 0x0;
 802     sch->last_cmd_valid = false;
 803     s->dstat = 0;
 804     s->cstat = 0;
 805     ret = 0;
 806
 807 out:
 808     return ret;
 809 }
 810
 811 int css_do_csch(SubchDev *sch)
 812 {
 813     SCSW *s = &sch->curr_status.scsw;
 814     PMCW *p = &sch->curr_status.pmcw;
 815     int ret;
 816
 817     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
 818         ret = -ENODEV;
 819         goto out;
 820     }
 821
 822     /* Trigger the clear function. */
 823     s->ctrl &= ~(SCSW_CTRL_MASK_FCTL | SCSW_CTRL_MASK_ACTL);
 824     s->ctrl |= SCSW_FCTL_CLEAR_FUNC | SCSW_ACTL_CLEAR_PEND;
 825
 826     do_subchannel_work(sch, NULL);
 827     ret = 0;
 828
 829 out:
 830     return ret;
 831 }
 832
 833 int css_do_hsch(SubchDev *sch)
 834 {
 835     SCSW *s = &sch->curr_status.scsw;
 836     PMCW *p = &sch->curr_status.pmcw;
 837     int ret;
 838
 839     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
 840         ret = -ENODEV;
 841         goto out;
 842     }
 843
 844     if (((s->ctrl & SCSW_CTRL_MASK_STCTL) == SCSW_STCTL_STATUS_PEND) ||
 845         (s->ctrl & (SCSW_STCTL_PRIMARY |
 846                     SCSW_STCTL_SECONDARY |
 847                     SCSW_STCTL_ALERT))) {
 848         ret = -EINPROGRESS;
 849         goto out;
 850     }
 851
 852     if (s->ctrl & (SCSW_FCTL_HALT_FUNC | SCSW_FCTL_CLEAR_FUNC)) {
 853         ret = -EBUSY;
 854         goto out;
 855     }
 856
 857     /* Trigger the halt function. */
 858     s->ctrl |= SCSW_FCTL_HALT_FUNC;
 859     s->ctrl &= ~SCSW_FCTL_START_FUNC;
 860     if (((s->ctrl & SCSW_CTRL_MASK_ACTL) ==
 861          (SCSW_ACTL_SUBCH_ACTIVE | SCSW_ACTL_DEVICE_ACTIVE)) &&
 862         ((s->ctrl & SCSW_CTRL_MASK_STCTL) == SCSW_STCTL_INTERMEDIATE)) {
 863         s->ctrl &= ~SCSW_STCTL_STATUS_PEND;
 864     }
 865     s->ctrl |= SCSW_ACTL_HALT_PEND;
 866
 867     do_subchannel_work(sch, NULL);
 868     ret = 0;
 869
 870 out:
 871     return ret;
 872 }
 873
 874 static void css_update_chnmon(SubchDev *sch)
 875 {
 876     if (!(sch->curr_status.pmcw.flags & PMCW_FLAGS_MASK_MME)) {
 877         /* Not active. */
 878         return;
 879     }
 880     /* The counter is conveniently located at the beginning of the struct. */
 881     if (sch->curr_status.pmcw.chars & PMCW_CHARS_MASK_MBFC) {
 882         /* Format 1, per-subchannel area. */
 883         uint32_t count;
 884
 885         count = address_space_ldl(&address_space_memory,
 886                                   sch->curr_status.mba,
 887                                   MEMTXATTRS_UNSPECIFIED,
 888                                   NULL);
 889         count++;
 890         address_space_stl(&address_space_memory, sch->curr_status.mba, count,
 891                           MEMTXATTRS_UNSPECIFIED, NULL);
 892     } else {
 893         /* Format 0, global area. */
 894         uint32_t offset;
 895         uint16_t count;
 896
 897         offset = sch->curr_status.pmcw.mbi << 5;
 898         count = address_space_lduw(&address_space_memory,
 899                                    channel_subsys.chnmon_area + offset,
 900                                    MEMTXATTRS_UNSPECIFIED,
 901                                    NULL);
 902         count++;
 903         address_space_stw(&address_space_memory,
 904                           channel_subsys.chnmon_area + offset, count,
 905                           MEMTXATTRS_UNSPECIFIED, NULL);
 906     }
 907 }
 908
 909 int css_do_ssch(SubchDev *sch, ORB *orb)
 910 {
 911     SCSW *s = &sch->curr_status.scsw;
 912     PMCW *p = &sch->curr_status.pmcw;
 913     int ret;
 914
 915     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
 916         ret = -ENODEV;
 917         goto out;
 918     }
 919
 920     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
 921         ret = -EINPROGRESS;
 922         goto out;
 923     }
 924
 925     if (s->ctrl & (SCSW_FCTL_START_FUNC |
 926                    SCSW_FCTL_HALT_FUNC |
 927                    SCSW_FCTL_CLEAR_FUNC)) {
 928         ret = -EBUSY;
 929         goto out;
 930     }
 931
 932     /* If monitoring is active, update counter. */
 933     if (channel_subsys.chnmon_active) {
 934         css_update_chnmon(sch);
 935     }
 936     sch->channel_prog = orb->cpa;
 937     /* Trigger the start function. */
 938     s->ctrl |= (SCSW_FCTL_START_FUNC | SCSW_ACTL_START_PEND);
 939     s->flags &= ~SCSW_FLAGS_MASK_PNO;
 940
 941     do_subchannel_work(sch, orb);
 942     ret = 0;
 943
 944 out:
 945     return ret;
 946 }
 947
 948 static void copy_irb_to_guest(IRB *dest, const IRB *src, PMCW *pmcw,
 949                               int *irb_len)
 950 {
 951     int i;
 952     uint16_t stctl = src->scsw.ctrl & SCSW_CTRL_MASK_STCTL;
 953     uint16_t actl = src->scsw.ctrl & SCSW_CTRL_MASK_ACTL;
 954
 955     copy_scsw_to_guest(&dest->scsw, &src->scsw);
 956
 957     for (i = 0; i < ARRAY_SIZE(dest->esw); i++) {
 958         dest->esw[i] = cpu_to_be32(src->esw[i]);
 959     }
 960     for (i = 0; i < ARRAY_SIZE(dest->ecw); i++) {
 961         dest->ecw[i] = cpu_to_be32(src->ecw[i]);
 962     }
 963     *irb_len = sizeof(*dest) - sizeof(dest->emw);
 964
 965     /* extended measurements enabled? */
 966     if ((src->scsw.flags & SCSW_FLAGS_MASK_ESWF) ||
 967         !(pmcw->flags & PMCW_FLAGS_MASK_TF) ||
 968         !(pmcw->chars & PMCW_CHARS_MASK_XMWME)) {
 969         return;
 970     }
 971     /* extended measurements pending? */
 972     if (!(stctl & SCSW_STCTL_STATUS_PEND)) {
 973         return;
 974     }
 975     if ((stctl & SCSW_STCTL_PRIMARY) ||
 976         (stctl == SCSW_STCTL_SECONDARY) ||
 977         ((stctl & SCSW_STCTL_INTERMEDIATE) && (actl & SCSW_ACTL_SUSP))) {
 978         for (i = 0; i < ARRAY_SIZE(dest->emw); i++) {
 979             dest->emw[i] = cpu_to_be32(src->emw[i]);
 980         }
 981     }
 982     *irb_len = sizeof(*dest);
 983 }
 984
 985 int css_do_tsch_get_irb(SubchDev *sch, IRB *target_irb, int *irb_len)
 986 {
 987     SCSW *s = &sch->curr_status.scsw;
 988     PMCW *p = &sch->curr_status.pmcw;
 989     uint16_t stctl;
 990     IRB irb;
 991
 992     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
 993         return 3;
 994     }
 995
 996     stctl = s->ctrl & SCSW_CTRL_MASK_STCTL;
 997
 998     /* Prepare the irb for the guest. */
 999     memset(&irb, 0, sizeof(IRB));
1000
1001     /* Copy scsw from current status. */
1002     memcpy(&irb.scsw, s, sizeof(SCSW));
1003     if (stctl & SCSW_STCTL_STATUS_PEND) {
1004         if (s->cstat & (SCSW_CSTAT_DATA_CHECK |
1005                         SCSW_CSTAT_CHN_CTRL_CHK |
1006                         SCSW_CSTAT_INTF_CTRL_CHK)) {
1007             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF;
1008             irb.esw[0] = 0x04804000;
1009         } else {
1010             irb.esw[0] = 0x00800000;
1011         }
1012         /* If a unit check is pending, copy sense data. */
1013         if ((s->dstat & SCSW_DSTAT_UNIT_CHECK) &&
1014             (p->chars & PMCW_CHARS_MASK_CSENSE)) {
1015             int i;
1016
1017             irb.scsw.flags |= SCSW_FLAGS_MASK_ESWF | SCSW_FLAGS_MASK_ECTL;
1018             /* Attention: sense_data is already BE! */
1019             memcpy(irb.ecw, sch->sense_data, sizeof(sch->sense_data));
1020             for (i = 0; i < ARRAY_SIZE(irb.ecw); i++) {
1021                 irb.ecw[i] = be32_to_cpu(irb.ecw[i]);
1022             }
1023             irb.esw[1] = 0x01000000 | (sizeof(sch->sense_data) << 8);
1024         }
1025     }
1026     /* Store the irb to the guest. */
1027     copy_irb_to_guest(target_irb, &irb, p, irb_len);
1028
1029     return ((stctl & SCSW_STCTL_STATUS_PEND) == 0);
1030 }
1031
1032 void css_do_tsch_update_subch(SubchDev *sch)
1033 {
1034     SCSW *s = &sch->curr_status.scsw;
1035     PMCW *p = &sch->curr_status.pmcw;
1036     uint16_t stctl;
1037     uint16_t fctl;
1038     uint16_t actl;
1039
1040     stctl = s->ctrl & SCSW_CTRL_MASK_STCTL;
1041     fctl = s->ctrl & SCSW_CTRL_MASK_FCTL;
1042     actl = s->ctrl & SCSW_CTRL_MASK_ACTL;
1043
1044     /* Clear conditions on subchannel, if applicable. */
1045     if (stctl & SCSW_STCTL_STATUS_PEND) {
1046         s->ctrl &= ~SCSW_CTRL_MASK_STCTL;
1047         if ((stctl != (SCSW_STCTL_INTERMEDIATE | SCSW_STCTL_STATUS_PEND)) ||
1048             ((fctl & SCSW_FCTL_HALT_FUNC) &&
1049              (actl & SCSW_ACTL_SUSP))) {
1050             s->ctrl &= ~SCSW_CTRL_MASK_FCTL;
1051         }
1052         if (stctl != (SCSW_STCTL_INTERMEDIATE | SCSW_STCTL_STATUS_PEND)) {
1053             s->flags &= ~SCSW_FLAGS_MASK_PNO;
1054             s->ctrl &= ~(SCSW_ACTL_RESUME_PEND |
1055                          SCSW_ACTL_START_PEND |
1056                          SCSW_ACTL_HALT_PEND |
1057                          SCSW_ACTL_CLEAR_PEND |
1058                          SCSW_ACTL_SUSP);
1059         } else {
1060             if ((actl & SCSW_ACTL_SUSP) &&
1061                 (fctl & SCSW_FCTL_START_FUNC)) {
1062                 s->flags &= ~SCSW_FLAGS_MASK_PNO;
1063                 if (fctl & SCSW_FCTL_HALT_FUNC) {
1064                     s->ctrl &= ~(SCSW_ACTL_RESUME_PEND |
1065                                  SCSW_ACTL_START_PEND |
1066                                  SCSW_ACTL_HALT_PEND |
1067                                  SCSW_ACTL_CLEAR_PEND |
1068                                  SCSW_ACTL_SUSP);
1069                 } else {
1070                     s->ctrl &= ~SCSW_ACTL_RESUME_PEND;
1071                 }
1072             }
1073         }
1074         /* Clear pending sense data. */
1075         if (p->chars & PMCW_CHARS_MASK_CSENSE) {
1076             memset(sch->sense_data, 0 , sizeof(sch->sense_data));
1077         }
1078     }
1079 }
1080
1081 static void copy_crw_to_guest(CRW *dest, const CRW *src)
1082 {
1083     dest->flags = cpu_to_be16(src->flags);
1084     dest->rsid = cpu_to_be16(src->rsid);
1085 }
1086
1087 int css_do_stcrw(CRW *crw)
1088 {
1089     CrwContainer *crw_cont;
1090     int ret;
1091
1092     crw_cont = QTAILQ_FIRST(&channel_subsys.pending_crws);
1093     if (crw_cont) {
1094         QTAILQ_REMOVE(&channel_subsys.pending_crws, crw_cont, sibling);
1095         copy_crw_to_guest(crw, &crw_cont->crw);
1096         g_free(crw_cont);
1097         ret = 0;
1098     } else {
1099         /* List was empty, turn crw machine checks on again. */
1100         memset(crw, 0, sizeof(*crw));
1101         channel_subsys.do_crw_mchk = true;
1102         ret = 1;
1103     }
1104
1105     return ret;
1106 }
1107
1108 static void copy_crw_from_guest(CRW *dest, const CRW *src)
1109 {
1110     dest->flags = be16_to_cpu(src->flags);
1111     dest->rsid = be16_to_cpu(src->rsid);
1112 }
1113
1114 void css_undo_stcrw(CRW *crw)
1115 {
1116     CrwContainer *crw_cont;
1117
1118     crw_cont = g_try_malloc0(sizeof(CrwContainer));
1119     if (!crw_cont) {
1120         channel_subsys.crws_lost = true;
1121         return;
1122     }
1123     copy_crw_from_guest(&crw_cont->crw, crw);
1124
1125     QTAILQ_INSERT_HEAD(&channel_subsys.pending_crws, crw_cont, sibling);
1126 }
1127
1128 int css_do_tpi(IOIntCode *int_code, int lowcore)
1129 {
1130     /* No pending interrupts for !KVM. */
1131     return 0;
1132  }
1133
1134 int css_collect_chp_desc(int m, uint8_t cssid, uint8_t f_chpid, uint8_t l_chpid,
1135                          int rfmt, void *buf)
1136 {
1137     int i, desc_size;
1138     uint32_t words[8];
1139     uint32_t chpid_type_word;
1140     CssImage *css;
1141
1142     if (!m && !cssid) {
1143         css = channel_subsys.css[channel_subsys.default_cssid];
1144     } else {
1145         css = channel_subsys.css[cssid];
1146     }
1147     if (!css) {
1148         return 0;
1149     }
1150     desc_size = 0;
1151     for (i = f_chpid; i <= l_chpid; i++) {
1152         if (css->chpids[i].in_use) {
1153             chpid_type_word = 0x80000000 | (css->chpids[i].type << 8) | i;
1154             if (rfmt == 0) {
1155                 words[0] = cpu_to_be32(chpid_type_word);
1156                 words[1] = 0;
1157                 memcpy(buf + desc_size, words, 8);
1158                 desc_size += 8;
1159             } else if (rfmt == 1) {
1160                 words[0] = cpu_to_be32(chpid_type_word);
1161                 words[1] = 0;
1162                 words[2] = 0;
1163                 words[3] = 0;
1164                 words[4] = 0;
1165                 words[5] = 0;
1166                 words[6] = 0;
1167                 words[7] = 0;
1168                 memcpy(buf + desc_size, words, 32);
1169                 desc_size += 32;
1170             }
1171         }
1172     }
1173     return desc_size;
1174 }
1175
1176 void css_do_schm(uint8_t mbk, int update, int dct, uint64_t mbo)
1177 {
1178     /* dct is currently ignored (not really meaningful for our devices) */
1179     /* TODO: Don't ignore mbk. */
1180     if (update && !channel_subsys.chnmon_active) {
1181         /* Enable measuring. */
1182         channel_subsys.chnmon_area = mbo;
1183         channel_subsys.chnmon_active = true;
1184     }
1185     if (!update && channel_subsys.chnmon_active) {
1186         /* Disable measuring. */
1187         channel_subsys.chnmon_area = 0;
1188         channel_subsys.chnmon_active = false;
1189     }
1190 }
1191
1192 int css_do_rsch(SubchDev *sch)
1193 {
1194     SCSW *s = &sch->curr_status.scsw;
1195     PMCW *p = &sch->curr_status.pmcw;
1196     int ret;
1197
1198     if (!(p->flags & (PMCW_FLAGS_MASK_DNV | PMCW_FLAGS_MASK_ENA))) {
1199         ret = -ENODEV;
1200         goto out;
1201     }
1202
1203     if (s->ctrl & SCSW_STCTL_STATUS_PEND) {
1204         ret = -EINPROGRESS;
1205         goto out;
1206     }
1207
1208     if (((s->ctrl & SCSW_CTRL_MASK_FCTL) != SCSW_FCTL_START_FUNC) ||
1209         (s->ctrl & SCSW_ACTL_RESUME_PEND) ||
1210         (!(s->ctrl & SCSW_ACTL_SUSP))) {
1211         ret = -EINVAL;
1212         goto out;
1213     }
1214
1215     /* If monitoring is active, update counter. */
1216     if (channel_subsys.chnmon_active) {
1217         css_update_chnmon(sch);
1218     }
1219
1220     s->ctrl |= SCSW_ACTL_RESUME_PEND;
1221     do_subchannel_work(sch, NULL);
1222     ret = 0;
1223
1224 out:
1225     return ret;
1226 }
1227
1228 int css_do_rchp(uint8_t cssid, uint8_t chpid)
1229 {
1230     uint8_t real_cssid;
1231
1232     if (cssid > channel_subsys.max_cssid) {
1233         return -EINVAL;
1234     }
1235     if (channel_subsys.max_cssid == 0) {
1236         real_cssid = channel_subsys.default_cssid;
1237     } else {
1238         real_cssid = cssid;
1239     }
1240     if (!channel_subsys.css[real_cssid]) {
1241         return -EINVAL;
1242     }
1243
1244     if (!channel_subsys.css[real_cssid]->chpids[chpid].in_use) {
1245         return -ENODEV;
1246     }
1247
1248     if (!channel_subsys.css[real_cssid]->chpids[chpid].is_virtual) {
1249         fprintf(stderr,
1250                 "rchp unsupported for non-virtual chpid %x.%02x!\n",
1251                 real_cssid, chpid);
1252         return -ENODEV;
1253     }
1254
1255     /* We don't really use a channel path, so we're done here. */
1256     css_queue_crw(CRW_RSC_CHP, CRW_ERC_INIT,
1257                   channel_subsys.max_cssid > 0 ? 1 : 0, chpid);
1258     if (channel_subsys.max_cssid > 0) {
1259         css_queue_crw(CRW_RSC_CHP, CRW_ERC_INIT, 0, real_cssid << 8);
1260     }
1261     return 0;
1262 }
1263
1264 bool css_schid_final(int m, uint8_t cssid, uint8_t ssid, uint16_t schid)
1265 {
1266     SubchSet *set;
1267     uint8_t real_cssid;
1268
1269     real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid;
1270     if (real_cssid > MAX_CSSID || ssid > MAX_SSID ||
1271         !channel_subsys.css[real_cssid] ||
1272         !channel_subsys.css[real_cssid]->sch_set[ssid]) {
1273         return true;
1274     }
1275     set = channel_subsys.css[real_cssid]->sch_set[ssid];
1276     return schid > find_last_bit(set->schids_used,
1277                                  (MAX_SCHID + 1) / sizeof(unsigned long));
1278 }
1279
1280 static int css_add_virtual_chpid(uint8_t cssid, uint8_t chpid, uint8_t type)
1281 {
1282     CssImage *css;
1283
1284     trace_css_chpid_add(cssid, chpid, type);
1285     if (cssid > MAX_CSSID) {
1286         return -EINVAL;
1287     }
1288     css = channel_subsys.css[cssid];
1289     if (!css) {
1290         return -EINVAL;
1291     }
1292     if (css->chpids[chpid].in_use) {
1293         return -EEXIST;
1294     }
1295     css->chpids[chpid].in_use = 1;
1296     css->chpids[chpid].type = type;
1297     css->chpids[chpid].is_virtual = 1;
1298
1299     css_generate_chp_crws(cssid, chpid);
1300
1301     return 0;
1302 }
1303
1304 void css_sch_build_virtual_schib(SubchDev *sch, uint8_t chpid, uint8_t type)
1305 {
1306     PMCW *p = &sch->curr_status.pmcw;
1307     SCSW *s = &sch->curr_status.scsw;
1308     int i;
1309     CssImage *css = channel_subsys.css[sch->cssid];
1310
1311     assert(css != NULL);
1312     memset(p, 0, sizeof(PMCW));
1313     p->flags |= PMCW_FLAGS_MASK_DNV;
1314     p->devno = sch->devno;
1315     /* single path */
1316     p->pim = 0x80;
1317     p->pom = 0xff;
1318     p->pam = 0x80;
1319     p->chpid[0] = chpid;
1320     if (!css->chpids[chpid].in_use) {
1321         css_add_virtual_chpid(sch->cssid, chpid, type);
1322     }
1323
1324     memset(s, 0, sizeof(SCSW));
1325     sch->curr_status.mba = 0;
1326     for (i = 0; i < ARRAY_SIZE(sch->curr_status.mda); i++) {
1327         sch->curr_status.mda[i] = 0;
1328     }
1329 }
1330
1331 SubchDev *css_find_subch(uint8_t m, uint8_t cssid, uint8_t ssid, uint16_t schid)
1332 {
1333     uint8_t real_cssid;
1334
1335     real_cssid = (!m && (cssid == 0)) ? channel_subsys.default_cssid : cssid;
1336
1337     if (!channel_subsys.css[real_cssid]) {
1338         return NULL;
1339     }
1340
1341     if (!channel_subsys.css[real_cssid]->sch_set[ssid]) {
1342         return NULL;
1343     }
1344
1345     return channel_subsys.css[real_cssid]->sch_set[ssid]->sch[schid];
1346 }
1347
1348 /**
1349  * Return free device number in subchannel set.
1350  *
1351  * Return index of the first free device number in the subchannel set
1352  * identified by @p cssid and @p ssid, beginning the search at @p
1353  * start and wrapping around at MAX_DEVNO. Return a value exceeding
1354  * MAX_SCHID if there are no free device numbers in the subchannel
1355  * set.
1356  */
1357 static uint32_t css_find_free_devno(uint8_t cssid, uint8_t ssid,
1358                                     uint16_t start)
1359 {
1360     uint32_t round;
1361
1362     for (round = 0; round <= MAX_DEVNO; round++) {
1363         uint16_t devno = (start + round) % MAX_DEVNO;
1364
1365         if (!css_devno_used(cssid, ssid, devno)) {
1366             return devno;
1367         }
1368     }
1369     return MAX_DEVNO + 1;
1370 }
1371
1372 /**
1373  * Return first free subchannel (id) in subchannel set.
1374  *
1375  * Return index of the first free subchannel in the subchannel set
1376  * identified by @p cssid and @p ssid, if there is any. Return a value
1377  * exceeding MAX_SCHID if there are no free subchannels in the
1378  * subchannel set.
1379  */
1380 static uint32_t css_find_free_subch(uint8_t cssid, uint8_t ssid)
1381 {
1382     uint32_t schid;
1383
1384     for (schid = 0; schid <= MAX_SCHID; schid++) {
1385         if (!css_find_subch(1, cssid, ssid, schid)) {
1386             return schid;
1387         }
1388     }
1389     return MAX_SCHID + 1;
1390 }
1391
1392 /**
1393  * Return first free subchannel (id) in subchannel set for a device number
1394  *
1395  * Verify the device number @p devno is not used yet in the subchannel
1396  * set identified by @p cssid and @p ssid. Set @p schid to the index
1397  * of the first free subchannel in the subchannel set, if there is
1398  * any. Return true if everything succeeded and false otherwise.
1399  */
1400 static bool css_find_free_subch_for_devno(uint8_t cssid, uint8_t ssid,
1401                                           uint16_t devno, uint16_t *schid,
1402                                           Error **errp)
1403 {
1404     uint32_t free_schid;
1405
1406     assert(schid);
1407     if (css_devno_used(cssid, ssid, devno)) {
1408         error_setg(errp, "Device %x.%x.%04x already exists",
1409                    cssid, ssid, devno);
1410         return false;
1411     }
1412     free_schid = css_find_free_subch(cssid, ssid);
1413     if (free_schid > MAX_SCHID) {
1414         error_setg(errp, "No free subchannel found for %x.%x.%04x",
1415                    cssid, ssid, devno);
1416         return false;
1417     }
1418     *schid = free_schid;
1419     return true;
1420 }
1421
1422 /**
1423  * Return first free subchannel (id) and device number
1424  *
1425  * Locate the first free subchannel and first free device number in
1426  * any of the subchannel sets of the channel subsystem identified by
1427  * @p cssid. Return false if no free subchannel / device number could
1428  * be found. Otherwise set @p ssid, @p devno and @p schid to identify
1429  * the available subchannel and device number and return true.
1430  *
1431  * May modify @p ssid, @p devno and / or @p schid even if no free
1432  * subchannel / device number could be found.
1433  */
1434 static bool css_find_free_subch_and_devno(uint8_t cssid, uint8_t *ssid,
1435                                           uint16_t *devno, uint16_t *schid,
1436                                           Error **errp)
1437 {
1438     uint32_t free_schid, free_devno;
1439
1440     assert(ssid && devno && schid);
1441     for (*ssid = 0; *ssid <= MAX_SSID; (*ssid)++) {
1442         free_schid = css_find_free_subch(cssid, *ssid);
1443         if (free_schid > MAX_SCHID) {
1444             continue;
1445         }
1446         free_devno = css_find_free_devno(cssid, *ssid, free_schid);
1447         if (free_devno > MAX_DEVNO) {
1448             continue;
1449         }
1450         *schid = free_schid;
1451         *devno = free_devno;
1452         return true;
1453     }
1454     error_setg(errp, "Virtual channel subsystem is full!");
1455     return false;
1456 }
1457
1458 bool css_subch_visible(SubchDev *sch)
1459 {
1460     if (sch->ssid > channel_subsys.max_ssid) {
1461         return false;
1462     }
1463
1464     if (sch->cssid != channel_subsys.default_cssid) {
1465         return (channel_subsys.max_cssid > 0);
1466     }
1467
1468     return true;
1469 }
1470
1471 bool css_present(uint8_t cssid)
1472 {
1473     return (channel_subsys.css[cssid] != NULL);
1474 }
1475
1476 bool css_devno_used(uint8_t cssid, uint8_t ssid, uint16_t devno)
1477 {
1478     if (!channel_subsys.css[cssid]) {
1479         return false;
1480     }
1481     if (!channel_subsys.css[cssid]->sch_set[ssid]) {
1482         return false;
1483     }
1484
1485     return !!test_bit(devno,
1486                       channel_subsys.css[cssid]->sch_set[ssid]->devnos_used);
1487 }
1488
1489 void css_subch_assign(uint8_t cssid, uint8_t ssid, uint16_t schid,
1490                       uint16_t devno, SubchDev *sch)
1491 {
1492     CssImage *css;
1493     SubchSet *s_set;
1494
1495     trace_css_assign_subch(sch ? "assign" : "deassign", cssid, ssid, schid,
1496                            devno);
1497     if (!channel_subsys.css[cssid]) {
1498         fprintf(stderr,
1499                 "Suspicious call to %s (%x.%x.%04x) for non-existing css!\n",
1500                 __func__, cssid, ssid, schid);
1501         return;
1502     }
1503     css = channel_subsys.css[cssid];
1504
1505     if (!css->sch_set[ssid]) {
1506         css->sch_set[ssid] = g_malloc0(sizeof(SubchSet));
1507     }
1508     s_set = css->sch_set[ssid];
1509
1510     s_set->sch[schid] = sch;
1511     if (sch) {
1512         set_bit(schid, s_set->schids_used);
1513         set_bit(devno, s_set->devnos_used);
1514     } else {
1515         clear_bit(schid, s_set->schids_used);
1516         clear_bit(devno, s_set->devnos_used);
1517     }
1518 }
1519
1520 void css_queue_crw(uint8_t rsc, uint8_t erc, int chain, uint16_t rsid)
1521 {
1522     CrwContainer *crw_cont;
1523
1524     trace_css_crw(rsc, erc, rsid, chain ? "(chained)" : "");
1525     /* TODO: Maybe use a static crw pool? */
1526     crw_cont = g_try_malloc0(sizeof(CrwContainer));
1527     if (!crw_cont) {
1528         channel_subsys.crws_lost = true;
1529         return;
1530     }
1531     crw_cont->crw.flags = (rsc << 8) | erc;
1532     if (chain) {
1533         crw_cont->crw.flags |= CRW_FLAGS_MASK_C;
1534     }
1535     crw_cont->crw.rsid = rsid;
1536     if (channel_subsys.crws_lost) {
1537         crw_cont->crw.flags |= CRW_FLAGS_MASK_R;
1538         channel_subsys.crws_lost = false;
1539     }
1540
1541     QTAILQ_INSERT_TAIL(&channel_subsys.pending_crws, crw_cont, sibling);
1542
1543     if (channel_subsys.do_crw_mchk) {
1544         channel_subsys.do_crw_mchk = false;
1545         /* Inject crw pending machine check. */
1546         s390_crw_mchk();
1547     }
1548 }
1549
1550 void css_generate_sch_crws(uint8_t cssid, uint8_t ssid, uint16_t schid,
1551                            int hotplugged, int add)
1552 {
1553     uint8_t guest_cssid;
1554     bool chain_crw;
1555
1556     if (add && !hotplugged) {
1557         return;
1558     }
1559     if (channel_subsys.max_cssid == 0) {
1560         /* Default cssid shows up as 0. */
1561         guest_cssid = (cssid == channel_subsys.default_cssid) ? 0 : cssid;
1562     } else {
1563         /* Show real cssid to the guest. */
1564         guest_cssid = cssid;
1565     }
1566     /*
1567      * Only notify for higher subchannel sets/channel subsystems if the
1568      * guest has enabled it.
1569      */
1570     if ((ssid > channel_subsys.max_ssid) ||
1571         (guest_cssid > channel_subsys.max_cssid) ||
1572         ((channel_subsys.max_cssid == 0) &&
1573          (cssid != channel_subsys.default_cssid))) {
1574         return;
1575     }
1576     chain_crw = (channel_subsys.max_ssid > 0) ||
1577             (channel_subsys.max_cssid > 0);
1578     css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, chain_crw ? 1 : 0, schid);
1579     if (chain_crw) {
1580         css_queue_crw(CRW_RSC_SUBCH, CRW_ERC_IPI, 0,
1581                       (guest_cssid << 8) | (ssid << 4));
1582     }
1583     /* RW_ERC_IPI --> clear pending interrupts */
1584     css_clear_io_interrupt(css_do_build_subchannel_id(cssid, ssid), schid);
1585 }
1586
1587 void css_generate_chp_crws(uint8_t cssid, uint8_t chpid)
1588 {
1589     /* TODO */
1590 }
1591
1592 void css_generate_css_crws(uint8_t cssid)
1593 {
1594     if (!channel_subsys.sei_pending) {
1595         css_queue_crw(CRW_RSC_CSS, 0, 0, cssid);
1596     }
1597     channel_subsys.sei_pending = true;
1598 }
1599
1600 void css_clear_sei_pending(void)
1601 {
1602     channel_subsys.sei_pending = false;
1603 }
1604
1605 int css_enable_mcsse(void)
1606 {
1607     trace_css_enable_facility("mcsse");
1608     channel_subsys.max_cssid = MAX_CSSID;
1609     return 0;
1610 }
1611
1612 int css_enable_mss(void)
1613 {
1614     trace_css_enable_facility("mss");
1615     channel_subsys.max_ssid = MAX_SSID;
1616     return 0;
1617 }
1618
1619 void subch_device_save(SubchDev *s, QEMUFile *f)
1620 {
1621     int i;
1622
1623     qemu_put_byte(f, s->cssid);
1624     qemu_put_byte(f, s->ssid);
1625     qemu_put_be16(f, s->schid);
1626     qemu_put_be16(f, s->devno);
1627     qemu_put_byte(f, s->thinint_active);
1628     /* SCHIB */
1629     /*     PMCW */
1630     qemu_put_be32(f, s->curr_status.pmcw.intparm);
1631     qemu_put_be16(f, s->curr_status.pmcw.flags);
1632     qemu_put_be16(f, s->curr_status.pmcw.devno);
1633     qemu_put_byte(f, s->curr_status.pmcw.lpm);
1634     qemu_put_byte(f, s->curr_status.pmcw.pnom);
1635     qemu_put_byte(f, s->curr_status.pmcw.lpum);
1636     qemu_put_byte(f, s->curr_status.pmcw.pim);
1637     qemu_put_be16(f, s->curr_status.pmcw.mbi);
1638     qemu_put_byte(f, s->curr_status.pmcw.pom);
1639     qemu_put_byte(f, s->curr_status.pmcw.pam);
1640     qemu_put_buffer(f, s->curr_status.pmcw.chpid, 8);
1641     qemu_put_be32(f, s->curr_status.pmcw.chars);
1642     /*     SCSW */
1643     qemu_put_be16(f, s->curr_status.scsw.flags);
1644     qemu_put_be16(f, s->curr_status.scsw.ctrl);
1645     qemu_put_be32(f, s->curr_status.scsw.cpa);
1646     qemu_put_byte(f, s->curr_status.scsw.dstat);
1647     qemu_put_byte(f, s->curr_status.scsw.cstat);
1648     qemu_put_be16(f, s->curr_status.scsw.count);
1649     qemu_put_be64(f, s->curr_status.mba);
1650     qemu_put_buffer(f, s->curr_status.mda, 4);
1651     /* end SCHIB */
1652     qemu_put_buffer(f, s->sense_data, 32);
1653     qemu_put_be64(f, s->channel_prog);
1654     /* last cmd */
1655     qemu_put_byte(f, s->last_cmd.cmd_code);
1656     qemu_put_byte(f, s->last_cmd.flags);
1657     qemu_put_be16(f, s->last_cmd.count);
1658     qemu_put_be32(f, s->last_cmd.cda);
1659     qemu_put_byte(f, s->last_cmd_valid);
1660     qemu_put_byte(f, s->id.reserved);
1661     qemu_put_be16(f, s->id.cu_type);
1662     qemu_put_byte(f, s->id.cu_model);
1663     qemu_put_be16(f, s->id.dev_type);
1664     qemu_put_byte(f, s->id.dev_model);
1665     qemu_put_byte(f, s->id.unused);
1666     for (i = 0; i < ARRAY_SIZE(s->id.ciw); i++) {
1667         qemu_put_byte(f, s->id.ciw[i].type);
1668         qemu_put_byte(f, s->id.ciw[i].command);
1669         qemu_put_be16(f, s->id.ciw[i].count);
1670     }
1671     qemu_put_byte(f, s->ccw_fmt_1);
1672     qemu_put_byte(f, s->ccw_no_data_cnt);
1673 }
1674
1675 int subch_device_load(SubchDev *s, QEMUFile *f)
1676 {
1677     int i;
1678
1679     s->cssid = qemu_get_byte(f);
1680     s->ssid = qemu_get_byte(f);
1681     s->schid = qemu_get_be16(f);
1682     s->devno = qemu_get_be16(f);
1683     s->thinint_active = qemu_get_byte(f);
1684     /* SCHIB */
1685     /*     PMCW */
1686     s->curr_status.pmcw.intparm = qemu_get_be32(f);
1687     s->curr_status.pmcw.flags = qemu_get_be16(f);
1688     s->curr_status.pmcw.devno = qemu_get_be16(f);
1689     s->curr_status.pmcw.lpm = qemu_get_byte(f);
1690     s->curr_status.pmcw.pnom  = qemu_get_byte(f);
1691     s->curr_status.pmcw.lpum = qemu_get_byte(f);
1692     s->curr_status.pmcw.pim = qemu_get_byte(f);
1693     s->curr_status.pmcw.mbi = qemu_get_be16(f);
1694     s->curr_status.pmcw.pom = qemu_get_byte(f);
1695     s->curr_status.pmcw.pam = qemu_get_byte(f);
1696     qemu_get_buffer(f, s->curr_status.pmcw.chpid, 8);
1697     s->curr_status.pmcw.chars = qemu_get_be32(f);
1698     /*     SCSW */
1699     s->curr_status.scsw.flags = qemu_get_be16(f);
1700     s->curr_status.scsw.ctrl = qemu_get_be16(f);
1701     s->curr_status.scsw.cpa = qemu_get_be32(f);
1702     s->curr_status.scsw.dstat = qemu_get_byte(f);
1703     s->curr_status.scsw.cstat = qemu_get_byte(f);
1704     s->curr_status.scsw.count = qemu_get_be16(f);
1705     s->curr_status.mba = qemu_get_be64(f);
1706     qemu_get_buffer(f, s->curr_status.mda, 4);
1707     /* end SCHIB */
1708     qemu_get_buffer(f, s->sense_data, 32);
1709     s->channel_prog = qemu_get_be64(f);
1710     /* last cmd */
1711     s->last_cmd.cmd_code = qemu_get_byte(f);
1712     s->last_cmd.flags = qemu_get_byte(f);
1713     s->last_cmd.count = qemu_get_be16(f);
1714     s->last_cmd.cda = qemu_get_be32(f);
1715     s->last_cmd_valid = qemu_get_byte(f);
1716     s->id.reserved = qemu_get_byte(f);
1717     s->id.cu_type = qemu_get_be16(f);
1718     s->id.cu_model = qemu_get_byte(f);
1719     s->id.dev_type = qemu_get_be16(f);
1720     s->id.dev_model = qemu_get_byte(f);
1721     s->id.unused = qemu_get_byte(f);
1722     for (i = 0; i < ARRAY_SIZE(s->id.ciw); i++) {
1723         s->id.ciw[i].type = qemu_get_byte(f);
1724         s->id.ciw[i].command = qemu_get_byte(f);
1725         s->id.ciw[i].count = qemu_get_be16(f);
1726     }
1727     s->ccw_fmt_1 = qemu_get_byte(f);
1728     s->ccw_no_data_cnt = qemu_get_byte(f);
1729     /*
1730      * Hack alert. We don't migrate the channel subsystem status (no
1731      * device!), but we need to find out if the guest enabled mss/mcss-e.
1732      * If the subchannel is enabled, it certainly was able to access it,
1733      * so adjust the max_ssid/max_cssid values for relevant ssid/cssid
1734      * values. This is not watertight, but better than nothing.
1735      */
1736     if (s->curr_status.pmcw.flags & PMCW_FLAGS_MASK_ENA) {
1737         if (s->ssid) {
1738             channel_subsys.max_ssid = MAX_SSID;
1739         }
1740         if (s->cssid != channel_subsys.default_cssid) {
1741             channel_subsys.max_cssid = MAX_CSSID;
1742         }
1743     }
1744     return 0;
1745 }
1746
1747 void css_reset_sch(SubchDev *sch)
1748 {
1749     PMCW *p = &sch->curr_status.pmcw;
1750
1751     if ((p->flags & PMCW_FLAGS_MASK_ENA) != 0 && sch->disable_cb) {
1752         sch->disable_cb(sch);
1753     }
1754
1755     p->intparm = 0;
1756     p->flags &= ~(PMCW_FLAGS_MASK_ISC | PMCW_FLAGS_MASK_ENA |
1757                   PMCW_FLAGS_MASK_LM | PMCW_FLAGS_MASK_MME |
1758                   PMCW_FLAGS_MASK_MP | PMCW_FLAGS_MASK_TF);
1759     p->flags |= PMCW_FLAGS_MASK_DNV;
1760     p->devno = sch->devno;
1761     p->pim = 0x80;
1762     p->lpm = p->pim;
1763     p->pnom = 0;
1764     p->lpum = 0;
1765     p->mbi = 0;
1766     p->pom = 0xff;
1767     p->pam = 0x80;
1768     p->chars &= ~(PMCW_CHARS_MASK_MBFC | PMCW_CHARS_MASK_XMWME |
1769                   PMCW_CHARS_MASK_CSENSE);
1770
1771     memset(&sch->curr_status.scsw, 0, sizeof(sch->curr_status.scsw));
1772     sch->curr_status.mba = 0;
1773
1774     sch->channel_prog = 0x0;
1775     sch->last_cmd_valid = false;
1776     sch->thinint_active = false;
1777 }
1778
1779 void css_reset(void)
1780 {
1781     CrwContainer *crw_cont;
1782
1783     /* Clean up monitoring. */
1784     channel_subsys.chnmon_active = false;
1785     channel_subsys.chnmon_area = 0;
1786
1787     /* Clear pending CRWs. */
1788     while ((crw_cont = QTAILQ_FIRST(&channel_subsys.pending_crws))) {
1789         QTAILQ_REMOVE(&channel_subsys.pending_crws, crw_cont, sibling);
1790         g_free(crw_cont);
1791     }
1792     channel_subsys.sei_pending = false;
1793     channel_subsys.do_crw_mchk = true;
1794     channel_subsys.crws_lost = false;
1795
1796     /* Reset maximum ids. */
1797     channel_subsys.max_cssid = 0;
1798     channel_subsys.max_ssid = 0;
1799 }
1800
1801 static void get_css_devid(Object *obj, Visitor *v, const char *name,
1802                           void *opaque, Error **errp)
1803 {
1804     DeviceState *dev = DEVICE(obj);
1805     Property *prop = opaque;
1806     CssDevId *dev_id = qdev_get_prop_ptr(dev, prop);
1807     char buffer[] = "xx.x.xxxx";
1808     char *p = buffer;
1809     int r;
1810
1811     if (dev_id->valid) {
1812
1813         r = snprintf(buffer, sizeof(buffer), "%02x.%1x.%04x", dev_id->cssid,
1814                      dev_id->ssid, dev_id->devid);
1815         assert(r == sizeof(buffer) - 1);
1816
1817         /* drop leading zero */
1818         if (dev_id->cssid <= 0xf) {
1819             p++;
1820         }
1821     } else {
1822         snprintf(buffer, sizeof(buffer), "<unset>");
1823     }
1824
1825     visit_type_str(v, name, &p, errp);
1826 }
1827
1828 /*
1829  * parse <cssid>.<ssid>.<devid> and assert valid range for cssid/ssid
1830  */
1831 static void set_css_devid(Object *obj, Visitor *v, const char *name,
1832                           void *opaque, Error **errp)
1833 {
1834     DeviceState *dev = DEVICE(obj);
1835     Property *prop = opaque;
1836     CssDevId *dev_id = qdev_get_prop_ptr(dev, prop);
1837     Error *local_err = NULL;
1838     char *str;
1839     int num, n1, n2;
1840     unsigned int cssid, ssid, devid;
1841
1842     if (dev->realized) {
1843         qdev_prop_set_after_realize(dev, name, errp);
1844         return;
1845     }
1846
1847     visit_type_str(v, name, &str, &local_err);
1848     if (local_err) {
1849         error_propagate(errp, local_err);
1850         return;
1851     }
1852
1853     num = sscanf(str, "%2x.%1x%n.%4x%n", &cssid, &ssid, &n1, &devid, &n2);
1854     if (num != 3 || (n2 - n1) != 5 || strlen(str) != n2) {
1855         error_set_from_qdev_prop_error(errp, EINVAL, dev, prop, str);
1856         goto out;
1857     }
1858     if ((cssid > MAX_CSSID) || (ssid > MAX_SSID)) {
1859         error_setg(errp, "Invalid cssid or ssid: cssid %x, ssid %x",
1860                    cssid, ssid);
1861         goto out;
1862     }
1863
1864     dev_id->cssid = cssid;
1865     dev_id->ssid = ssid;
1866     dev_id->devid = devid;
1867     dev_id->valid = true;
1868
1869 out:
1870     g_free(str);
1871 }
1872
1873 PropertyInfo css_devid_propinfo = {
1874     .name = "str",
1875     .description = "Identifier of an I/O device in the channel "
1876                    "subsystem, example: fe.1.23ab",
1877     .get = get_css_devid,
1878     .set = set_css_devid,
1879 };
1880
1881 SubchDev *css_create_virtual_sch(CssDevId bus_id, Error **errp)
1882 {
1883     uint16_t schid = 0;
1884     SubchDev *sch;
1885
1886     if (bus_id.valid) {
1887         /* Enforce use of virtual cssid. */
1888         if (bus_id.cssid != VIRTUAL_CSSID) {
1889             error_setg(errp, "cssid %hhx not valid for virtual devices",
1890                        bus_id.cssid);
1891             return NULL;
1892         }
1893         if (!css_find_free_subch_for_devno(bus_id.cssid, bus_id.ssid,
1894                                            bus_id.devid, &schid, errp)) {
1895             return NULL;
1896         }
1897     } else {
1898         bus_id.cssid = VIRTUAL_CSSID;
1899         if (!css_find_free_subch_and_devno(bus_id.cssid, &bus_id.ssid,
1900                                            &bus_id.devid, &schid, errp)) {
1901             return NULL;
1902         }
1903     }
1904
1905     sch = g_malloc0(sizeof(*sch));
1906     sch->cssid = bus_id.cssid;
1907     sch->ssid = bus_id.ssid;
1908     sch->devno = bus_id.devid;
1909     sch->schid = schid;
1910     css_subch_assign(sch->cssid, sch->ssid, schid, sch->devno, sch);
1911     return sch;
1912 }