target/s390x/ioinst.c

   1 /*
   2  * I/O instructions for S/390
   3  *
   4  * Copyright 2012, 2015 IBM Corp.
   5  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
   6  *
   7  * This work is licensed under the terms of the GNU GPL, version 2 or (at
   8  * your option) any later version. See the COPYING file in the top-level
   9  * directory.
  10  */
  11
  12 #include "qemu/osdep.h"
  13
  14 #include "cpu.h"
  15 #include "internal.h"
  16 #include "hw/s390x/ioinst.h"
  17 #include "trace.h"
  18 #include "hw/s390x/s390-pci-bus.h"
  19
  20 int ioinst_disassemble_sch_ident(uint32_t value, int *m, int *cssid, int *ssid,
  21                                  int *schid)
  22 {
  23     if (!IOINST_SCHID_ONE(value)) {
  24         return -EINVAL;
  25     }
  26     if (!IOINST_SCHID_M(value)) {
  27         if (IOINST_SCHID_CSSID(value)) {
  28             return -EINVAL;
  29         }
  30         *cssid = 0;
  31         *m = 0;
  32     } else {
  33         *cssid = IOINST_SCHID_CSSID(value);
  34         *m = 1;
  35     }
  36     *ssid = IOINST_SCHID_SSID(value);
  37     *schid = IOINST_SCHID_NR(value);
  38     return 0;
  39 }
  40
  41 void ioinst_handle_xsch(S390CPU *cpu, uint64_t reg1)
  42 {
  43     int cssid, ssid, schid, m;
  44     SubchDev *sch;
  45
  46     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
  47         program_interrupt(&cpu->env, PGM_OPERAND, 4);
  48         return;
  49     }
  50     trace_ioinst_sch_id("xsch", cssid, ssid, schid);
  51     sch = css_find_subch(m, cssid, ssid, schid);
  52     if (!sch || !css_subch_visible(sch)) {
  53         setcc(cpu, 3);
  54         return;
  55     }
  56     setcc(cpu, css_do_xsch(sch));
  57 }
  58
  59 void ioinst_handle_csch(S390CPU *cpu, uint64_t reg1)
  60 {
  61     int cssid, ssid, schid, m;
  62     SubchDev *sch;
  63
  64     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
  65         program_interrupt(&cpu->env, PGM_OPERAND, 4);
  66         return;
  67     }
  68     trace_ioinst_sch_id("csch", cssid, ssid, schid);
  69     sch = css_find_subch(m, cssid, ssid, schid);
  70     if (!sch || !css_subch_visible(sch)) {
  71         setcc(cpu, 3);
  72         return;
  73     }
  74     setcc(cpu, css_do_csch(sch));
  75 }
  76
  77 void ioinst_handle_hsch(S390CPU *cpu, uint64_t reg1)
  78 {
  79     int cssid, ssid, schid, m;
  80     SubchDev *sch;
  81     int ret = -ENODEV;
  82     int cc;
  83
  84     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
  85         program_interrupt(&cpu->env, PGM_OPERAND, 4);
  86         return;
  87     }
  88     trace_ioinst_sch_id("hsch", cssid, ssid, schid);
  89     sch = css_find_subch(m, cssid, ssid, schid);
  90     if (sch && css_subch_visible(sch)) {
  91         ret = css_do_hsch(sch);
  92     }
  93     switch (ret) {
  94     case -ENODEV:
  95         cc = 3;
  96         break;
  97     case -EBUSY:
  98         cc = 2;
  99         break;
 100     case 0:
 101         cc = 0;
 102         break;
 103     default:
 104         cc = 1;
 105         break;
 106     }
 107     setcc(cpu, cc);
 108 }
 109
 110 static int ioinst_schib_valid(SCHIB *schib)
 111 {
 112     if ((be16_to_cpu(schib->pmcw.flags) & PMCW_FLAGS_MASK_INVALID) ||
 113         (be32_to_cpu(schib->pmcw.chars) & PMCW_CHARS_MASK_INVALID)) {
 114         return 0;
 115     }
 116     /* Disallow extended measurements for now. */
 117     if (be32_to_cpu(schib->pmcw.chars) & PMCW_CHARS_MASK_XMWME) {
 118         return 0;
 119     }
 120     return 1;
 121 }
 122
 123 void ioinst_handle_msch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 124 {
 125     int cssid, ssid, schid, m;
 126     SubchDev *sch;
 127     SCHIB schib;
 128     uint64_t addr;
 129     int ret = -ENODEV;
 130     int cc;
 131     CPUS390XState *env = &cpu->env;
 132     uint8_t ar;
 133
 134     addr = decode_basedisp_s(env, ipb, &ar);
 135     if (addr & 3) {
 136         program_interrupt(env, PGM_SPECIFICATION, 4);
 137         return;
 138     }
 139     if (s390_cpu_virt_mem_read(cpu, addr, ar, &schib, sizeof(schib))) {
 140         return;
 141     }
 142     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
 143         !ioinst_schib_valid(&schib)) {
 144         program_interrupt(env, PGM_OPERAND, 4);
 145         return;
 146     }
 147     trace_ioinst_sch_id("msch", cssid, ssid, schid);
 148     sch = css_find_subch(m, cssid, ssid, schid);
 149     if (sch && css_subch_visible(sch)) {
 150         ret = css_do_msch(sch, &schib);
 151     }
 152     switch (ret) {
 153     case -ENODEV:
 154         cc = 3;
 155         break;
 156     case -EBUSY:
 157         cc = 2;
 158         break;
 159     case 0:
 160         cc = 0;
 161         break;
 162     default:
 163         cc = 1;
 164         break;
 165     }
 166     setcc(cpu, cc);
 167 }
 168
 169 static void copy_orb_from_guest(ORB *dest, const ORB *src)
 170 {
 171     dest->intparm = be32_to_cpu(src->intparm);
 172     dest->ctrl0 = be16_to_cpu(src->ctrl0);
 173     dest->lpm = src->lpm;
 174     dest->ctrl1 = src->ctrl1;
 175     dest->cpa = be32_to_cpu(src->cpa);
 176 }
 177
 178 static int ioinst_orb_valid(ORB *orb)
 179 {
 180     if ((orb->ctrl0 & ORB_CTRL0_MASK_INVALID) ||
 181         (orb->ctrl1 & ORB_CTRL1_MASK_INVALID)) {
 182         return 0;
 183     }
 184     /* We don't support MIDA. */
 185     if (orb->ctrl1 & ORB_CTRL1_MASK_MIDAW) {
 186         return 0;
 187     }
 188     if ((orb->cpa & HIGH_ORDER_BIT) != 0) {
 189         return 0;
 190     }
 191     return 1;
 192 }
 193
 194 void ioinst_handle_ssch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 195 {
 196     int cssid, ssid, schid, m;
 197     SubchDev *sch;
 198     ORB orig_orb, orb;
 199     uint64_t addr;
 200     CPUS390XState *env = &cpu->env;
 201     uint8_t ar;
 202
 203     addr = decode_basedisp_s(env, ipb, &ar);
 204     if (addr & 3) {
 205         program_interrupt(env, PGM_SPECIFICATION, 4);
 206         return;
 207     }
 208     if (s390_cpu_virt_mem_read(cpu, addr, ar, &orig_orb, sizeof(orb))) {
 209         return;
 210     }
 211     copy_orb_from_guest(&orb, &orig_orb);
 212     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
 213         !ioinst_orb_valid(&orb)) {
 214         program_interrupt(env, PGM_OPERAND, 4);
 215         return;
 216     }
 217     trace_ioinst_sch_id("ssch", cssid, ssid, schid);
 218     sch = css_find_subch(m, cssid, ssid, schid);
 219     if (!sch || !css_subch_visible(sch)) {
 220         setcc(cpu, 3);
 221         return;
 222     }
 223     setcc(cpu, css_do_ssch(sch, &orb));
 224 }
 225
 226 void ioinst_handle_stcrw(S390CPU *cpu, uint32_t ipb)
 227 {
 228     CRW crw;
 229     uint64_t addr;
 230     int cc;
 231     CPUS390XState *env = &cpu->env;
 232     uint8_t ar;
 233
 234     addr = decode_basedisp_s(env, ipb, &ar);
 235     if (addr & 3) {
 236         program_interrupt(env, PGM_SPECIFICATION, 4);
 237         return;
 238     }
 239
 240     cc = css_do_stcrw(&crw);
 241     /* 0 - crw stored, 1 - zeroes stored */
 242
 243     if (s390_cpu_virt_mem_write(cpu, addr, ar, &crw, sizeof(crw)) == 0) {
 244         setcc(cpu, cc);
 245     } else if (cc == 0) {
 246         /* Write failed: requeue CRW since STCRW is a suppressing instruction */
 247         css_undo_stcrw(&crw);
 248     }
 249 }
 250
 251 void ioinst_handle_stsch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 252 {
 253     int cssid, ssid, schid, m;
 254     SubchDev *sch;
 255     uint64_t addr;
 256     int cc;
 257     SCHIB schib;
 258     CPUS390XState *env = &cpu->env;
 259     uint8_t ar;
 260
 261     addr = decode_basedisp_s(env, ipb, &ar);
 262     if (addr & 3) {
 263         program_interrupt(env, PGM_SPECIFICATION, 4);
 264         return;
 265     }
 266
 267     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 268         /*
 269          * As operand exceptions have a lower priority than access exceptions,
 270          * we check whether the memory area is writeable (injecting the
 271          * access execption if it is not) first.
 272          */
 273         if (!s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib))) {
 274             program_interrupt(env, PGM_OPERAND, 4);
 275         }
 276         return;
 277     }
 278     trace_ioinst_sch_id("stsch", cssid, ssid, schid);
 279     sch = css_find_subch(m, cssid, ssid, schid);
 280     if (sch) {
 281         if (css_subch_visible(sch)) {
 282             css_do_stsch(sch, &schib);
 283             cc = 0;
 284         } else {
 285             /* Indicate no more subchannels in this css/ss */
 286             cc = 3;
 287         }
 288     } else {
 289         if (css_schid_final(m, cssid, ssid, schid)) {
 290             cc = 3; /* No more subchannels in this css/ss */
 291         } else {
 292             /* Store an empty schib. */
 293             memset(&schib, 0, sizeof(schib));
 294             cc = 0;
 295         }
 296     }
 297     if (cc != 3) {
 298         if (s390_cpu_virt_mem_write(cpu, addr, ar, &schib,
 299                                     sizeof(schib)) != 0) {
 300             return;
 301         }
 302     } else {
 303         /* Access exceptions have a higher priority than cc3 */
 304         if (s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib)) != 0) {
 305             return;
 306         }
 307     }
 308     setcc(cpu, cc);
 309 }
 310
 311 int ioinst_handle_tsch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 312 {
 313     CPUS390XState *env = &cpu->env;
 314     int cssid, ssid, schid, m;
 315     SubchDev *sch;
 316     IRB irb;
 317     uint64_t addr;
 318     int cc, irb_len;
 319     uint8_t ar;
 320
 321     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 322         program_interrupt(env, PGM_OPERAND, 4);
 323         return -EIO;
 324     }
 325     trace_ioinst_sch_id("tsch", cssid, ssid, schid);
 326     addr = decode_basedisp_s(env, ipb, &ar);
 327     if (addr & 3) {
 328         program_interrupt(env, PGM_SPECIFICATION, 4);
 329         return -EIO;
 330     }
 331
 332     sch = css_find_subch(m, cssid, ssid, schid);
 333     if (sch && css_subch_visible(sch)) {
 334         cc = css_do_tsch_get_irb(sch, &irb, &irb_len);
 335     } else {
 336         cc = 3;
 337     }
 338     /* 0 - status pending, 1 - not status pending, 3 - not operational */
 339     if (cc != 3) {
 340         if (s390_cpu_virt_mem_write(cpu, addr, ar, &irb, irb_len) != 0) {
 341             return -EFAULT;
 342         }
 343         css_do_tsch_update_subch(sch);
 344     } else {
 345         irb_len = sizeof(irb) - sizeof(irb.emw);
 346         /* Access exceptions have a higher priority than cc3 */
 347         if (s390_cpu_virt_mem_check_write(cpu, addr, ar, irb_len) != 0) {
 348             return -EFAULT;
 349         }
 350     }
 351
 352     setcc(cpu, cc);
 353     return 0;
 354 }
 355
 356 typedef struct ChscReq {
 357     uint16_t len;
 358     uint16_t command;
 359     uint32_t param0;
 360     uint32_t param1;
 361     uint32_t param2;
 362 } QEMU_PACKED ChscReq;
 363
 364 typedef struct ChscResp {
 365     uint16_t len;
 366     uint16_t code;
 367     uint32_t param;
 368     char data[0];
 369 } QEMU_PACKED ChscResp;
 370
 371 #define CHSC_MIN_RESP_LEN 0x0008
 372
 373 #define CHSC_SCPD 0x0002
 374 #define CHSC_SCSC 0x0010
 375 #define CHSC_SDA  0x0031
 376 #define CHSC_SEI  0x000e
 377
 378 #define CHSC_SCPD_0_M 0x20000000
 379 #define CHSC_SCPD_0_C 0x10000000
 380 #define CHSC_SCPD_0_FMT 0x0f000000
 381 #define CHSC_SCPD_0_CSSID 0x00ff0000
 382 #define CHSC_SCPD_0_RFMT 0x00000f00
 383 #define CHSC_SCPD_0_RES 0xc000f000
 384 #define CHSC_SCPD_1_RES 0xffffff00
 385 #define CHSC_SCPD_01_CHPID 0x000000ff
 386 static void ioinst_handle_chsc_scpd(ChscReq *req, ChscResp *res)
 387 {
 388     uint16_t len = be16_to_cpu(req->len);
 389     uint32_t param0 = be32_to_cpu(req->param0);
 390     uint32_t param1 = be32_to_cpu(req->param1);
 391     uint16_t resp_code;
 392     int rfmt;
 393     uint16_t cssid;
 394     uint8_t f_chpid, l_chpid;
 395     int desc_size;
 396     int m;
 397
 398     rfmt = (param0 & CHSC_SCPD_0_RFMT) >> 8;
 399     if ((rfmt == 0) ||  (rfmt == 1)) {
 400         rfmt = !!(param0 & CHSC_SCPD_0_C);
 401     }
 402     if ((len != 0x0010) || (param0 & CHSC_SCPD_0_RES) ||
 403         (param1 & CHSC_SCPD_1_RES) || req->param2) {
 404         resp_code = 0x0003;
 405         goto out_err;
 406     }
 407     if (param0 & CHSC_SCPD_0_FMT) {
 408         resp_code = 0x0007;
 409         goto out_err;
 410     }
 411     cssid = (param0 & CHSC_SCPD_0_CSSID) >> 16;
 412     m = param0 & CHSC_SCPD_0_M;
 413     if (cssid != 0) {
 414         if (!m || !css_present(cssid)) {
 415             resp_code = 0x0008;
 416             goto out_err;
 417         }
 418     }
 419     f_chpid = param0 & CHSC_SCPD_01_CHPID;
 420     l_chpid = param1 & CHSC_SCPD_01_CHPID;
 421     if (l_chpid < f_chpid) {
 422         resp_code = 0x0003;
 423         goto out_err;
 424     }
 425     /* css_collect_chp_desc() is endian-aware */
 426     desc_size = css_collect_chp_desc(m, cssid, f_chpid, l_chpid, rfmt,
 427                                      &res->data);
 428     res->code = cpu_to_be16(0x0001);
 429     res->len = cpu_to_be16(8 + desc_size);
 430     res->param = cpu_to_be32(rfmt);
 431     return;
 432
 433   out_err:
 434     res->code = cpu_to_be16(resp_code);
 435     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 436     res->param = cpu_to_be32(rfmt);
 437 }
 438
 439 #define CHSC_SCSC_0_M 0x20000000
 440 #define CHSC_SCSC_0_FMT 0x000f0000
 441 #define CHSC_SCSC_0_CSSID 0x0000ff00
 442 #define CHSC_SCSC_0_RES 0xdff000ff
 443 static void ioinst_handle_chsc_scsc(ChscReq *req, ChscResp *res)
 444 {
 445     uint16_t len = be16_to_cpu(req->len);
 446     uint32_t param0 = be32_to_cpu(req->param0);
 447     uint8_t cssid;
 448     uint16_t resp_code;
 449     uint32_t general_chars[510];
 450     uint32_t chsc_chars[508];
 451
 452     if (len != 0x0010) {
 453         resp_code = 0x0003;
 454         goto out_err;
 455     }
 456
 457     if (param0 & CHSC_SCSC_0_FMT) {
 458         resp_code = 0x0007;
 459         goto out_err;
 460     }
 461     cssid = (param0 & CHSC_SCSC_0_CSSID) >> 8;
 462     if (cssid != 0) {
 463         if (!(param0 & CHSC_SCSC_0_M) || !css_present(cssid)) {
 464             resp_code = 0x0008;
 465             goto out_err;
 466         }
 467     }
 468     if ((param0 & CHSC_SCSC_0_RES) || req->param1 || req->param2) {
 469         resp_code = 0x0003;
 470         goto out_err;
 471     }
 472     res->code = cpu_to_be16(0x0001);
 473     res->len = cpu_to_be16(4080);
 474     res->param = 0;
 475
 476     memset(general_chars, 0, sizeof(general_chars));
 477     memset(chsc_chars, 0, sizeof(chsc_chars));
 478
 479     general_chars[0] = cpu_to_be32(0x03000000);
 480     general_chars[1] = cpu_to_be32(0x00079000);
 481     general_chars[3] = cpu_to_be32(0x00080000);
 482
 483     chsc_chars[0] = cpu_to_be32(0x40000000);
 484     chsc_chars[3] = cpu_to_be32(0x00040000);
 485
 486     memcpy(res->data, general_chars, sizeof(general_chars));
 487     memcpy(res->data + sizeof(general_chars), chsc_chars, sizeof(chsc_chars));
 488     return;
 489
 490   out_err:
 491     res->code = cpu_to_be16(resp_code);
 492     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 493     res->param = 0;
 494 }
 495
 496 #define CHSC_SDA_0_FMT 0x0f000000
 497 #define CHSC_SDA_0_OC 0x0000ffff
 498 #define CHSC_SDA_0_RES 0xf0ff0000
 499 #define CHSC_SDA_OC_MCSSE 0x0
 500 #define CHSC_SDA_OC_MSS 0x2
 501 static void ioinst_handle_chsc_sda(ChscReq *req, ChscResp *res)
 502 {
 503     uint16_t resp_code = 0x0001;
 504     uint16_t len = be16_to_cpu(req->len);
 505     uint32_t param0 = be32_to_cpu(req->param0);
 506     uint16_t oc;
 507     int ret;
 508
 509     if ((len != 0x0400) || (param0 & CHSC_SDA_0_RES)) {
 510         resp_code = 0x0003;
 511         goto out;
 512     }
 513
 514     if (param0 & CHSC_SDA_0_FMT) {
 515         resp_code = 0x0007;
 516         goto out;
 517     }
 518
 519     oc = param0 & CHSC_SDA_0_OC;
 520     switch (oc) {
 521     case CHSC_SDA_OC_MCSSE:
 522         ret = css_enable_mcsse();
 523         if (ret == -EINVAL) {
 524             resp_code = 0x0101;
 525             goto out;
 526         }
 527         break;
 528     case CHSC_SDA_OC_MSS:
 529         ret = css_enable_mss();
 530         if (ret == -EINVAL) {
 531             resp_code = 0x0101;
 532             goto out;
 533         }
 534         break;
 535     default:
 536         resp_code = 0x0003;
 537         goto out;
 538     }
 539
 540 out:
 541     res->code = cpu_to_be16(resp_code);
 542     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 543     res->param = 0;
 544 }
 545
 546 static int chsc_sei_nt0_get_event(void *res)
 547 {
 548     /* no events yet */
 549     return 1;
 550 }
 551
 552 static int chsc_sei_nt0_have_event(void)
 553 {
 554     /* no events yet */
 555     return 0;
 556 }
 557
 558 static int chsc_sei_nt2_get_event(void *res)
 559 {
 560     if (s390_has_feat(S390_FEAT_ZPCI)) {
 561         return pci_chsc_sei_nt2_get_event(res);
 562     }
 563     return 1;
 564 }
 565
 566 static int chsc_sei_nt2_have_event(void)
 567 {
 568     if (s390_has_feat(S390_FEAT_ZPCI)) {
 569         return pci_chsc_sei_nt2_have_event();
 570     }
 571     return 0;
 572 }
 573
 574 #define CHSC_SEI_NT0    (1ULL << 63)
 575 #define CHSC_SEI_NT2    (1ULL << 61)
 576 static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
 577 {
 578     uint64_t selection_mask = ldq_p(&req->param1);
 579     uint8_t *res_flags = (uint8_t *)res->data;
 580     int have_event = 0;
 581     int have_more = 0;
 582
 583     /* regarding architecture nt0 can not be masked */
 584     have_event = !chsc_sei_nt0_get_event(res);
 585     have_more = chsc_sei_nt0_have_event();
 586
 587     if (selection_mask & CHSC_SEI_NT2) {
 588         if (!have_event) {
 589             have_event = !chsc_sei_nt2_get_event(res);
 590         }
 591
 592         if (!have_more) {
 593             have_more = chsc_sei_nt2_have_event();
 594         }
 595     }
 596
 597     if (have_event) {
 598         res->code = cpu_to_be16(0x0001);
 599         if (have_more) {
 600             (*res_flags) |= 0x80;
 601         } else {
 602             (*res_flags) &= ~0x80;
 603             css_clear_sei_pending();
 604         }
 605     } else {
 606         res->code = cpu_to_be16(0x0005);
 607         res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 608     }
 609 }
 610
 611 static void ioinst_handle_chsc_unimplemented(ChscResp *res)
 612 {
 613     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 614     res->code = cpu_to_be16(0x0004);
 615     res->param = 0;
 616 }
 617
 618 void ioinst_handle_chsc(S390CPU *cpu, uint32_t ipb)
 619 {
 620     ChscReq *req;
 621     ChscResp *res;
 622     uint64_t addr;
 623     int reg;
 624     uint16_t len;
 625     uint16_t command;
 626     CPUS390XState *env = &cpu->env;
 627     uint8_t buf[TARGET_PAGE_SIZE];
 628
 629     trace_ioinst("chsc");
 630     reg = (ipb >> 20) & 0x00f;
 631     addr = env->regs[reg];
 632     /* Page boundary? */
 633     if (addr & 0xfff) {
 634         program_interrupt(env, PGM_SPECIFICATION, 4);
 635         return;
 636     }
 637     /*
 638      * Reading sizeof(ChscReq) bytes is currently enough for all of our
 639      * present CHSC sub-handlers ... if we ever need more, we should take
 640      * care of req->len here first.
 641      */
 642     if (s390_cpu_virt_mem_read(cpu, addr, reg, buf, sizeof(ChscReq))) {
 643         return;
 644     }
 645     req = (ChscReq *)buf;
 646     len = be16_to_cpu(req->len);
 647     /* Length field valid? */
 648     if ((len < 16) || (len > 4088) || (len & 7)) {
 649         program_interrupt(env, PGM_OPERAND, 4);
 650         return;
 651     }
 652     memset((char *)req + len, 0, TARGET_PAGE_SIZE - len);
 653     res = (void *)((char *)req + len);
 654     command = be16_to_cpu(req->command);
 655     trace_ioinst_chsc_cmd(command, len);
 656     switch (command) {
 657     case CHSC_SCSC:
 658         ioinst_handle_chsc_scsc(req, res);
 659         break;
 660     case CHSC_SCPD:
 661         ioinst_handle_chsc_scpd(req, res);
 662         break;
 663     case CHSC_SDA:
 664         ioinst_handle_chsc_sda(req, res);
 665         break;
 666     case CHSC_SEI:
 667         ioinst_handle_chsc_sei(req, res);
 668         break;
 669     default:
 670         ioinst_handle_chsc_unimplemented(res);
 671         break;
 672     }
 673
 674     if (!s390_cpu_virt_mem_write(cpu, addr + len, reg, res,
 675                                  be16_to_cpu(res->len))) {
 676         setcc(cpu, 0);    /* Command execution complete */
 677     }
 678 }
 679
 680 int ioinst_handle_tpi(S390CPU *cpu, uint32_t ipb)
 681 {
 682     CPUS390XState *env = &cpu->env;
 683     uint64_t addr;
 684     int lowcore;
 685     IOIntCode int_code;
 686     hwaddr len;
 687     int ret;
 688     uint8_t ar;
 689
 690     trace_ioinst("tpi");
 691     addr = decode_basedisp_s(env, ipb, &ar);
 692     if (addr & 3) {
 693         program_interrupt(env, PGM_SPECIFICATION, 4);
 694         return -EIO;
 695     }
 696
 697     lowcore = addr ? 0 : 1;
 698     len = lowcore ? 8 /* two words */ : 12 /* three words */;
 699     ret = css_do_tpi(&int_code, lowcore);
 700     if (ret == 1) {
 701         s390_cpu_virt_mem_write(cpu, lowcore ? 184 : addr, ar, &int_code, len);
 702     }
 703     return ret;
 704 }
 705
 706 #define SCHM_REG1_RES(_reg) (_reg & 0x000000000ffffffc)
 707 #define SCHM_REG1_MBK(_reg) ((_reg & 0x00000000f0000000) >> 28)
 708 #define SCHM_REG1_UPD(_reg) ((_reg & 0x0000000000000002) >> 1)
 709 #define SCHM_REG1_DCT(_reg) (_reg & 0x0000000000000001)
 710
 711 void ioinst_handle_schm(S390CPU *cpu, uint64_t reg1, uint64_t reg2,
 712                         uint32_t ipb)
 713 {
 714     uint8_t mbk;
 715     int update;
 716     int dct;
 717     CPUS390XState *env = &cpu->env;
 718
 719     trace_ioinst("schm");
 720
 721     if (SCHM_REG1_RES(reg1)) {
 722         program_interrupt(env, PGM_OPERAND, 4);
 723         return;
 724     }
 725
 726     mbk = SCHM_REG1_MBK(reg1);
 727     update = SCHM_REG1_UPD(reg1);
 728     dct = SCHM_REG1_DCT(reg1);
 729
 730     if (update && (reg2 & 0x000000000000001f)) {
 731         program_interrupt(env, PGM_OPERAND, 4);
 732         return;
 733     }
 734
 735     css_do_schm(mbk, update, dct, update ? reg2 : 0);
 736 }
 737
 738 void ioinst_handle_rsch(S390CPU *cpu, uint64_t reg1)
 739 {
 740     int cssid, ssid, schid, m;
 741     SubchDev *sch;
 742
 743     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 744         program_interrupt(&cpu->env, PGM_OPERAND, 4);
 745         return;
 746     }
 747     trace_ioinst_sch_id("rsch", cssid, ssid, schid);
 748     sch = css_find_subch(m, cssid, ssid, schid);
 749     if (!sch || !css_subch_visible(sch)) {
 750         setcc(cpu, 3);
 751         return;
 752     }
 753     setcc(cpu, css_do_rsch(sch));
 754 }
 755
 756 #define RCHP_REG1_RES(_reg) (_reg & 0x00000000ff00ff00)
 757 #define RCHP_REG1_CSSID(_reg) ((_reg & 0x0000000000ff0000) >> 16)
 758 #define RCHP_REG1_CHPID(_reg) (_reg & 0x00000000000000ff)
 759 void ioinst_handle_rchp(S390CPU *cpu, uint64_t reg1)
 760 {
 761     int cc;
 762     uint8_t cssid;
 763     uint8_t chpid;
 764     int ret;
 765     CPUS390XState *env = &cpu->env;
 766
 767     if (RCHP_REG1_RES(reg1)) {
 768         program_interrupt(env, PGM_OPERAND, 4);
 769         return;
 770     }
 771
 772     cssid = RCHP_REG1_CSSID(reg1);
 773     chpid = RCHP_REG1_CHPID(reg1);
 774
 775     trace_ioinst_chp_id("rchp", cssid, chpid);
 776
 777     ret = css_do_rchp(cssid, chpid);
 778
 779     switch (ret) {
 780     case -ENODEV:
 781         cc = 3;
 782         break;
 783     case -EBUSY:
 784         cc = 2;
 785         break;
 786     case 0:
 787         cc = 0;
 788         break;
 789     default:
 790         /* Invalid channel subsystem. */
 791         program_interrupt(env, PGM_OPERAND, 4);
 792         return;
 793     }
 794     setcc(cpu, cc);
 795 }
 796
 797 #define SAL_REG1_INVALID(_reg) (_reg & 0x0000000080000000)
 798 void ioinst_handle_sal(S390CPU *cpu, uint64_t reg1)
 799 {
 800     /* We do not provide address limit checking, so let's suppress it. */
 801     if (SAL_REG1_INVALID(reg1) || reg1 & 0x000000000000ffff) {
 802         program_interrupt(&cpu->env, PGM_OPERAND, 4);
 803     }
 804 }