target/s390x/ioinst.c

   1 /*
   2  * I/O instructions for S/390
   3  *
   4  * Copyright 2012, 2015 IBM Corp.
   5  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
   6  *
   7  * This work is licensed under the terms of the GNU GPL, version 2 or (at
   8  * your option) any later version. See the COPYING file in the top-level
   9  * directory.
  10  */
  11
  12 #include "qemu/osdep.h"
  13
  14 #include "cpu.h"
  15 #include "internal.h"
  16 #include "hw/s390x/ioinst.h"
  17 #include "trace.h"
  18 #include "hw/s390x/s390-pci-bus.h"
  19
  20 int ioinst_disassemble_sch_ident(uint32_t value, int *m, int *cssid, int *ssid,
  21                                  int *schid)
  22 {
  23     if (!IOINST_SCHID_ONE(value)) {
  24         return -EINVAL;
  25     }
  26     if (!IOINST_SCHID_M(value)) {
  27         if (IOINST_SCHID_CSSID(value)) {
  28             return -EINVAL;
  29         }
  30         *cssid = 0;
  31         *m = 0;
  32     } else {
  33         *cssid = IOINST_SCHID_CSSID(value);
  34         *m = 1;
  35     }
  36     *ssid = IOINST_SCHID_SSID(value);
  37     *schid = IOINST_SCHID_NR(value);
  38     return 0;
  39 }
  40
  41 void ioinst_handle_xsch(S390CPU *cpu, uint64_t reg1)
  42 {
  43     int cssid, ssid, schid, m;
  44     SubchDev *sch;
  45
  46     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
  47         program_interrupt(&cpu->env, PGM_OPERAND, 4);
  48         return;
  49     }
  50     trace_ioinst_sch_id("xsch", cssid, ssid, schid);
  51     sch = css_find_subch(m, cssid, ssid, schid);
  52     if (!sch || !css_subch_visible(sch)) {
  53         setcc(cpu, 3);
  54         return;
  55     }
  56     setcc(cpu, css_do_xsch(sch));
  57 }
  58
  59 void ioinst_handle_csch(S390CPU *cpu, uint64_t reg1)
  60 {
  61     int cssid, ssid, schid, m;
  62     SubchDev *sch;
  63     int ret = -ENODEV;
  64     int cc;
  65
  66     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
  67         program_interrupt(&cpu->env, PGM_OPERAND, 4);
  68         return;
  69     }
  70     trace_ioinst_sch_id("csch", cssid, ssid, schid);
  71     sch = css_find_subch(m, cssid, ssid, schid);
  72     if (sch && css_subch_visible(sch)) {
  73         ret = css_do_csch(sch);
  74     }
  75     if (ret == -ENODEV) {
  76         cc = 3;
  77     } else {
  78         cc = 0;
  79     }
  80     setcc(cpu, cc);
  81 }
  82
  83 void ioinst_handle_hsch(S390CPU *cpu, uint64_t reg1)
  84 {
  85     int cssid, ssid, schid, m;
  86     SubchDev *sch;
  87     int ret = -ENODEV;
  88     int cc;
  89
  90     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
  91         program_interrupt(&cpu->env, PGM_OPERAND, 4);
  92         return;
  93     }
  94     trace_ioinst_sch_id("hsch", cssid, ssid, schid);
  95     sch = css_find_subch(m, cssid, ssid, schid);
  96     if (sch && css_subch_visible(sch)) {
  97         ret = css_do_hsch(sch);
  98     }
  99     switch (ret) {
 100     case -ENODEV:
 101         cc = 3;
 102         break;
 103     case -EBUSY:
 104         cc = 2;
 105         break;
 106     case 0:
 107         cc = 0;
 108         break;
 109     default:
 110         cc = 1;
 111         break;
 112     }
 113     setcc(cpu, cc);
 114 }
 115
 116 static int ioinst_schib_valid(SCHIB *schib)
 117 {
 118     if ((be16_to_cpu(schib->pmcw.flags) & PMCW_FLAGS_MASK_INVALID) ||
 119         (be32_to_cpu(schib->pmcw.chars) & PMCW_CHARS_MASK_INVALID)) {
 120         return 0;
 121     }
 122     /* Disallow extended measurements for now. */
 123     if (be32_to_cpu(schib->pmcw.chars) & PMCW_CHARS_MASK_XMWME) {
 124         return 0;
 125     }
 126     return 1;
 127 }
 128
 129 void ioinst_handle_msch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 130 {
 131     int cssid, ssid, schid, m;
 132     SubchDev *sch;
 133     SCHIB schib;
 134     uint64_t addr;
 135     int ret = -ENODEV;
 136     int cc;
 137     CPUS390XState *env = &cpu->env;
 138     uint8_t ar;
 139
 140     addr = decode_basedisp_s(env, ipb, &ar);
 141     if (addr & 3) {
 142         program_interrupt(env, PGM_SPECIFICATION, 4);
 143         return;
 144     }
 145     if (s390_cpu_virt_mem_read(cpu, addr, ar, &schib, sizeof(schib))) {
 146         return;
 147     }
 148     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
 149         !ioinst_schib_valid(&schib)) {
 150         program_interrupt(env, PGM_OPERAND, 4);
 151         return;
 152     }
 153     trace_ioinst_sch_id("msch", cssid, ssid, schid);
 154     sch = css_find_subch(m, cssid, ssid, schid);
 155     if (sch && css_subch_visible(sch)) {
 156         ret = css_do_msch(sch, &schib);
 157     }
 158     switch (ret) {
 159     case -ENODEV:
 160         cc = 3;
 161         break;
 162     case -EBUSY:
 163         cc = 2;
 164         break;
 165     case 0:
 166         cc = 0;
 167         break;
 168     default:
 169         cc = 1;
 170         break;
 171     }
 172     setcc(cpu, cc);
 173 }
 174
 175 static void copy_orb_from_guest(ORB *dest, const ORB *src)
 176 {
 177     dest->intparm = be32_to_cpu(src->intparm);
 178     dest->ctrl0 = be16_to_cpu(src->ctrl0);
 179     dest->lpm = src->lpm;
 180     dest->ctrl1 = src->ctrl1;
 181     dest->cpa = be32_to_cpu(src->cpa);
 182 }
 183
 184 static int ioinst_orb_valid(ORB *orb)
 185 {
 186     if ((orb->ctrl0 & ORB_CTRL0_MASK_INVALID) ||
 187         (orb->ctrl1 & ORB_CTRL1_MASK_INVALID)) {
 188         return 0;
 189     }
 190     /* We don't support MIDA. */
 191     if (orb->ctrl1 & ORB_CTRL1_MASK_MIDAW) {
 192         return 0;
 193     }
 194     if ((orb->cpa & HIGH_ORDER_BIT) != 0) {
 195         return 0;
 196     }
 197     return 1;
 198 }
 199
 200 void ioinst_handle_ssch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 201 {
 202     int cssid, ssid, schid, m;
 203     SubchDev *sch;
 204     ORB orig_orb, orb;
 205     uint64_t addr;
 206     CPUS390XState *env = &cpu->env;
 207     uint8_t ar;
 208
 209     addr = decode_basedisp_s(env, ipb, &ar);
 210     if (addr & 3) {
 211         program_interrupt(env, PGM_SPECIFICATION, 4);
 212         return;
 213     }
 214     if (s390_cpu_virt_mem_read(cpu, addr, ar, &orig_orb, sizeof(orb))) {
 215         return;
 216     }
 217     copy_orb_from_guest(&orb, &orig_orb);
 218     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
 219         !ioinst_orb_valid(&orb)) {
 220         program_interrupt(env, PGM_OPERAND, 4);
 221         return;
 222     }
 223     trace_ioinst_sch_id("ssch", cssid, ssid, schid);
 224     sch = css_find_subch(m, cssid, ssid, schid);
 225     if (!sch || !css_subch_visible(sch)) {
 226         setcc(cpu, 3);
 227         return;
 228     }
 229     setcc(cpu, css_do_ssch(sch, &orb));
 230 }
 231
 232 void ioinst_handle_stcrw(S390CPU *cpu, uint32_t ipb)
 233 {
 234     CRW crw;
 235     uint64_t addr;
 236     int cc;
 237     CPUS390XState *env = &cpu->env;
 238     uint8_t ar;
 239
 240     addr = decode_basedisp_s(env, ipb, &ar);
 241     if (addr & 3) {
 242         program_interrupt(env, PGM_SPECIFICATION, 4);
 243         return;
 244     }
 245
 246     cc = css_do_stcrw(&crw);
 247     /* 0 - crw stored, 1 - zeroes stored */
 248
 249     if (s390_cpu_virt_mem_write(cpu, addr, ar, &crw, sizeof(crw)) == 0) {
 250         setcc(cpu, cc);
 251     } else if (cc == 0) {
 252         /* Write failed: requeue CRW since STCRW is a suppressing instruction */
 253         css_undo_stcrw(&crw);
 254     }
 255 }
 256
 257 void ioinst_handle_stsch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 258 {
 259     int cssid, ssid, schid, m;
 260     SubchDev *sch;
 261     uint64_t addr;
 262     int cc;
 263     SCHIB schib;
 264     CPUS390XState *env = &cpu->env;
 265     uint8_t ar;
 266
 267     addr = decode_basedisp_s(env, ipb, &ar);
 268     if (addr & 3) {
 269         program_interrupt(env, PGM_SPECIFICATION, 4);
 270         return;
 271     }
 272
 273     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 274         /*
 275          * As operand exceptions have a lower priority than access exceptions,
 276          * we check whether the memory area is writeable (injecting the
 277          * access execption if it is not) first.
 278          */
 279         if (!s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib))) {
 280             program_interrupt(env, PGM_OPERAND, 4);
 281         }
 282         return;
 283     }
 284     trace_ioinst_sch_id("stsch", cssid, ssid, schid);
 285     sch = css_find_subch(m, cssid, ssid, schid);
 286     if (sch) {
 287         if (css_subch_visible(sch)) {
 288             css_do_stsch(sch, &schib);
 289             cc = 0;
 290         } else {
 291             /* Indicate no more subchannels in this css/ss */
 292             cc = 3;
 293         }
 294     } else {
 295         if (css_schid_final(m, cssid, ssid, schid)) {
 296             cc = 3; /* No more subchannels in this css/ss */
 297         } else {
 298             /* Store an empty schib. */
 299             memset(&schib, 0, sizeof(schib));
 300             cc = 0;
 301         }
 302     }
 303     if (cc != 3) {
 304         if (s390_cpu_virt_mem_write(cpu, addr, ar, &schib,
 305                                     sizeof(schib)) != 0) {
 306             return;
 307         }
 308     } else {
 309         /* Access exceptions have a higher priority than cc3 */
 310         if (s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib)) != 0) {
 311             return;
 312         }
 313     }
 314     setcc(cpu, cc);
 315 }
 316
 317 int ioinst_handle_tsch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
 318 {
 319     CPUS390XState *env = &cpu->env;
 320     int cssid, ssid, schid, m;
 321     SubchDev *sch;
 322     IRB irb;
 323     uint64_t addr;
 324     int cc, irb_len;
 325     uint8_t ar;
 326
 327     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 328         program_interrupt(env, PGM_OPERAND, 4);
 329         return -EIO;
 330     }
 331     trace_ioinst_sch_id("tsch", cssid, ssid, schid);
 332     addr = decode_basedisp_s(env, ipb, &ar);
 333     if (addr & 3) {
 334         program_interrupt(env, PGM_SPECIFICATION, 4);
 335         return -EIO;
 336     }
 337
 338     sch = css_find_subch(m, cssid, ssid, schid);
 339     if (sch && css_subch_visible(sch)) {
 340         cc = css_do_tsch_get_irb(sch, &irb, &irb_len);
 341     } else {
 342         cc = 3;
 343     }
 344     /* 0 - status pending, 1 - not status pending, 3 - not operational */
 345     if (cc != 3) {
 346         if (s390_cpu_virt_mem_write(cpu, addr, ar, &irb, irb_len) != 0) {
 347             return -EFAULT;
 348         }
 349         css_do_tsch_update_subch(sch);
 350     } else {
 351         irb_len = sizeof(irb) - sizeof(irb.emw);
 352         /* Access exceptions have a higher priority than cc3 */
 353         if (s390_cpu_virt_mem_check_write(cpu, addr, ar, irb_len) != 0) {
 354             return -EFAULT;
 355         }
 356     }
 357
 358     setcc(cpu, cc);
 359     return 0;
 360 }
 361
 362 typedef struct ChscReq {
 363     uint16_t len;
 364     uint16_t command;
 365     uint32_t param0;
 366     uint32_t param1;
 367     uint32_t param2;
 368 } QEMU_PACKED ChscReq;
 369
 370 typedef struct ChscResp {
 371     uint16_t len;
 372     uint16_t code;
 373     uint32_t param;
 374     char data[0];
 375 } QEMU_PACKED ChscResp;
 376
 377 #define CHSC_MIN_RESP_LEN 0x0008
 378
 379 #define CHSC_SCPD 0x0002
 380 #define CHSC_SCSC 0x0010
 381 #define CHSC_SDA  0x0031
 382 #define CHSC_SEI  0x000e
 383
 384 #define CHSC_SCPD_0_M 0x20000000
 385 #define CHSC_SCPD_0_C 0x10000000
 386 #define CHSC_SCPD_0_FMT 0x0f000000
 387 #define CHSC_SCPD_0_CSSID 0x00ff0000
 388 #define CHSC_SCPD_0_RFMT 0x00000f00
 389 #define CHSC_SCPD_0_RES 0xc000f000
 390 #define CHSC_SCPD_1_RES 0xffffff00
 391 #define CHSC_SCPD_01_CHPID 0x000000ff
 392 static void ioinst_handle_chsc_scpd(ChscReq *req, ChscResp *res)
 393 {
 394     uint16_t len = be16_to_cpu(req->len);
 395     uint32_t param0 = be32_to_cpu(req->param0);
 396     uint32_t param1 = be32_to_cpu(req->param1);
 397     uint16_t resp_code;
 398     int rfmt;
 399     uint16_t cssid;
 400     uint8_t f_chpid, l_chpid;
 401     int desc_size;
 402     int m;
 403
 404     rfmt = (param0 & CHSC_SCPD_0_RFMT) >> 8;
 405     if ((rfmt == 0) ||  (rfmt == 1)) {
 406         rfmt = !!(param0 & CHSC_SCPD_0_C);
 407     }
 408     if ((len != 0x0010) || (param0 & CHSC_SCPD_0_RES) ||
 409         (param1 & CHSC_SCPD_1_RES) || req->param2) {
 410         resp_code = 0x0003;
 411         goto out_err;
 412     }
 413     if (param0 & CHSC_SCPD_0_FMT) {
 414         resp_code = 0x0007;
 415         goto out_err;
 416     }
 417     cssid = (param0 & CHSC_SCPD_0_CSSID) >> 16;
 418     m = param0 & CHSC_SCPD_0_M;
 419     if (cssid != 0) {
 420         if (!m || !css_present(cssid)) {
 421             resp_code = 0x0008;
 422             goto out_err;
 423         }
 424     }
 425     f_chpid = param0 & CHSC_SCPD_01_CHPID;
 426     l_chpid = param1 & CHSC_SCPD_01_CHPID;
 427     if (l_chpid < f_chpid) {
 428         resp_code = 0x0003;
 429         goto out_err;
 430     }
 431     /* css_collect_chp_desc() is endian-aware */
 432     desc_size = css_collect_chp_desc(m, cssid, f_chpid, l_chpid, rfmt,
 433                                      &res->data);
 434     res->code = cpu_to_be16(0x0001);
 435     res->len = cpu_to_be16(8 + desc_size);
 436     res->param = cpu_to_be32(rfmt);
 437     return;
 438
 439   out_err:
 440     res->code = cpu_to_be16(resp_code);
 441     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 442     res->param = cpu_to_be32(rfmt);
 443 }
 444
 445 #define CHSC_SCSC_0_M 0x20000000
 446 #define CHSC_SCSC_0_FMT 0x000f0000
 447 #define CHSC_SCSC_0_CSSID 0x0000ff00
 448 #define CHSC_SCSC_0_RES 0xdff000ff
 449 static void ioinst_handle_chsc_scsc(ChscReq *req, ChscResp *res)
 450 {
 451     uint16_t len = be16_to_cpu(req->len);
 452     uint32_t param0 = be32_to_cpu(req->param0);
 453     uint8_t cssid;
 454     uint16_t resp_code;
 455     uint32_t general_chars[510];
 456     uint32_t chsc_chars[508];
 457
 458     if (len != 0x0010) {
 459         resp_code = 0x0003;
 460         goto out_err;
 461     }
 462
 463     if (param0 & CHSC_SCSC_0_FMT) {
 464         resp_code = 0x0007;
 465         goto out_err;
 466     }
 467     cssid = (param0 & CHSC_SCSC_0_CSSID) >> 8;
 468     if (cssid != 0) {
 469         if (!(param0 & CHSC_SCSC_0_M) || !css_present(cssid)) {
 470             resp_code = 0x0008;
 471             goto out_err;
 472         }
 473     }
 474     if ((param0 & CHSC_SCSC_0_RES) || req->param1 || req->param2) {
 475         resp_code = 0x0003;
 476         goto out_err;
 477     }
 478     res->code = cpu_to_be16(0x0001);
 479     res->len = cpu_to_be16(4080);
 480     res->param = 0;
 481
 482     memset(general_chars, 0, sizeof(general_chars));
 483     memset(chsc_chars, 0, sizeof(chsc_chars));
 484
 485     general_chars[0] = cpu_to_be32(0x03000000);
 486     general_chars[1] = cpu_to_be32(0x00079000);
 487     general_chars[3] = cpu_to_be32(0x00080000);
 488
 489     chsc_chars[0] = cpu_to_be32(0x40000000);
 490     chsc_chars[3] = cpu_to_be32(0x00040000);
 491
 492     memcpy(res->data, general_chars, sizeof(general_chars));
 493     memcpy(res->data + sizeof(general_chars), chsc_chars, sizeof(chsc_chars));
 494     return;
 495
 496   out_err:
 497     res->code = cpu_to_be16(resp_code);
 498     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 499     res->param = 0;
 500 }
 501
 502 #define CHSC_SDA_0_FMT 0x0f000000
 503 #define CHSC_SDA_0_OC 0x0000ffff
 504 #define CHSC_SDA_0_RES 0xf0ff0000
 505 #define CHSC_SDA_OC_MCSSE 0x0
 506 #define CHSC_SDA_OC_MSS 0x2
 507 static void ioinst_handle_chsc_sda(ChscReq *req, ChscResp *res)
 508 {
 509     uint16_t resp_code = 0x0001;
 510     uint16_t len = be16_to_cpu(req->len);
 511     uint32_t param0 = be32_to_cpu(req->param0);
 512     uint16_t oc;
 513     int ret;
 514
 515     if ((len != 0x0400) || (param0 & CHSC_SDA_0_RES)) {
 516         resp_code = 0x0003;
 517         goto out;
 518     }
 519
 520     if (param0 & CHSC_SDA_0_FMT) {
 521         resp_code = 0x0007;
 522         goto out;
 523     }
 524
 525     oc = param0 & CHSC_SDA_0_OC;
 526     switch (oc) {
 527     case CHSC_SDA_OC_MCSSE:
 528         ret = css_enable_mcsse();
 529         if (ret == -EINVAL) {
 530             resp_code = 0x0101;
 531             goto out;
 532         }
 533         break;
 534     case CHSC_SDA_OC_MSS:
 535         ret = css_enable_mss();
 536         if (ret == -EINVAL) {
 537             resp_code = 0x0101;
 538             goto out;
 539         }
 540         break;
 541     default:
 542         resp_code = 0x0003;
 543         goto out;
 544     }
 545
 546 out:
 547     res->code = cpu_to_be16(resp_code);
 548     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 549     res->param = 0;
 550 }
 551
 552 static int chsc_sei_nt0_get_event(void *res)
 553 {
 554     /* no events yet */
 555     return 1;
 556 }
 557
 558 static int chsc_sei_nt0_have_event(void)
 559 {
 560     /* no events yet */
 561     return 0;
 562 }
 563
 564 static int chsc_sei_nt2_get_event(void *res)
 565 {
 566     if (s390_has_feat(S390_FEAT_ZPCI)) {
 567         return pci_chsc_sei_nt2_get_event(res);
 568     }
 569     return 1;
 570 }
 571
 572 static int chsc_sei_nt2_have_event(void)
 573 {
 574     if (s390_has_feat(S390_FEAT_ZPCI)) {
 575         return pci_chsc_sei_nt2_have_event();
 576     }
 577     return 0;
 578 }
 579
 580 #define CHSC_SEI_NT0    (1ULL << 63)
 581 #define CHSC_SEI_NT2    (1ULL << 61)
 582 static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
 583 {
 584     uint64_t selection_mask = ldq_p(&req->param1);
 585     uint8_t *res_flags = (uint8_t *)res->data;
 586     int have_event = 0;
 587     int have_more = 0;
 588
 589     /* regarding architecture nt0 can not be masked */
 590     have_event = !chsc_sei_nt0_get_event(res);
 591     have_more = chsc_sei_nt0_have_event();
 592
 593     if (selection_mask & CHSC_SEI_NT2) {
 594         if (!have_event) {
 595             have_event = !chsc_sei_nt2_get_event(res);
 596         }
 597
 598         if (!have_more) {
 599             have_more = chsc_sei_nt2_have_event();
 600         }
 601     }
 602
 603     if (have_event) {
 604         res->code = cpu_to_be16(0x0001);
 605         if (have_more) {
 606             (*res_flags) |= 0x80;
 607         } else {
 608             (*res_flags) &= ~0x80;
 609             css_clear_sei_pending();
 610         }
 611     } else {
 612         res->code = cpu_to_be16(0x0005);
 613         res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 614     }
 615 }
 616
 617 static void ioinst_handle_chsc_unimplemented(ChscResp *res)
 618 {
 619     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
 620     res->code = cpu_to_be16(0x0004);
 621     res->param = 0;
 622 }
 623
 624 void ioinst_handle_chsc(S390CPU *cpu, uint32_t ipb)
 625 {
 626     ChscReq *req;
 627     ChscResp *res;
 628     uint64_t addr;
 629     int reg;
 630     uint16_t len;
 631     uint16_t command;
 632     CPUS390XState *env = &cpu->env;
 633     uint8_t buf[TARGET_PAGE_SIZE];
 634
 635     trace_ioinst("chsc");
 636     reg = (ipb >> 20) & 0x00f;
 637     addr = env->regs[reg];
 638     /* Page boundary? */
 639     if (addr & 0xfff) {
 640         program_interrupt(env, PGM_SPECIFICATION, 4);
 641         return;
 642     }
 643     /*
 644      * Reading sizeof(ChscReq) bytes is currently enough for all of our
 645      * present CHSC sub-handlers ... if we ever need more, we should take
 646      * care of req->len here first.
 647      */
 648     if (s390_cpu_virt_mem_read(cpu, addr, reg, buf, sizeof(ChscReq))) {
 649         return;
 650     }
 651     req = (ChscReq *)buf;
 652     len = be16_to_cpu(req->len);
 653     /* Length field valid? */
 654     if ((len < 16) || (len > 4088) || (len & 7)) {
 655         program_interrupt(env, PGM_OPERAND, 4);
 656         return;
 657     }
 658     memset((char *)req + len, 0, TARGET_PAGE_SIZE - len);
 659     res = (void *)((char *)req + len);
 660     command = be16_to_cpu(req->command);
 661     trace_ioinst_chsc_cmd(command, len);
 662     switch (command) {
 663     case CHSC_SCSC:
 664         ioinst_handle_chsc_scsc(req, res);
 665         break;
 666     case CHSC_SCPD:
 667         ioinst_handle_chsc_scpd(req, res);
 668         break;
 669     case CHSC_SDA:
 670         ioinst_handle_chsc_sda(req, res);
 671         break;
 672     case CHSC_SEI:
 673         ioinst_handle_chsc_sei(req, res);
 674         break;
 675     default:
 676         ioinst_handle_chsc_unimplemented(res);
 677         break;
 678     }
 679
 680     if (!s390_cpu_virt_mem_write(cpu, addr + len, reg, res,
 681                                  be16_to_cpu(res->len))) {
 682         setcc(cpu, 0);    /* Command execution complete */
 683     }
 684 }
 685
 686 int ioinst_handle_tpi(S390CPU *cpu, uint32_t ipb)
 687 {
 688     CPUS390XState *env = &cpu->env;
 689     uint64_t addr;
 690     int lowcore;
 691     IOIntCode int_code;
 692     hwaddr len;
 693     int ret;
 694     uint8_t ar;
 695
 696     trace_ioinst("tpi");
 697     addr = decode_basedisp_s(env, ipb, &ar);
 698     if (addr & 3) {
 699         program_interrupt(env, PGM_SPECIFICATION, 4);
 700         return -EIO;
 701     }
 702
 703     lowcore = addr ? 0 : 1;
 704     len = lowcore ? 8 /* two words */ : 12 /* three words */;
 705     ret = css_do_tpi(&int_code, lowcore);
 706     if (ret == 1) {
 707         s390_cpu_virt_mem_write(cpu, lowcore ? 184 : addr, ar, &int_code, len);
 708     }
 709     return ret;
 710 }
 711
 712 #define SCHM_REG1_RES(_reg) (_reg & 0x000000000ffffffc)
 713 #define SCHM_REG1_MBK(_reg) ((_reg & 0x00000000f0000000) >> 28)
 714 #define SCHM_REG1_UPD(_reg) ((_reg & 0x0000000000000002) >> 1)
 715 #define SCHM_REG1_DCT(_reg) (_reg & 0x0000000000000001)
 716
 717 void ioinst_handle_schm(S390CPU *cpu, uint64_t reg1, uint64_t reg2,
 718                         uint32_t ipb)
 719 {
 720     uint8_t mbk;
 721     int update;
 722     int dct;
 723     CPUS390XState *env = &cpu->env;
 724
 725     trace_ioinst("schm");
 726
 727     if (SCHM_REG1_RES(reg1)) {
 728         program_interrupt(env, PGM_OPERAND, 4);
 729         return;
 730     }
 731
 732     mbk = SCHM_REG1_MBK(reg1);
 733     update = SCHM_REG1_UPD(reg1);
 734     dct = SCHM_REG1_DCT(reg1);
 735
 736     if (update && (reg2 & 0x000000000000001f)) {
 737         program_interrupt(env, PGM_OPERAND, 4);
 738         return;
 739     }
 740
 741     css_do_schm(mbk, update, dct, update ? reg2 : 0);
 742 }
 743
 744 void ioinst_handle_rsch(S390CPU *cpu, uint64_t reg1)
 745 {
 746     int cssid, ssid, schid, m;
 747     SubchDev *sch;
 748
 749     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
 750         program_interrupt(&cpu->env, PGM_OPERAND, 4);
 751         return;
 752     }
 753     trace_ioinst_sch_id("rsch", cssid, ssid, schid);
 754     sch = css_find_subch(m, cssid, ssid, schid);
 755     if (!sch || !css_subch_visible(sch)) {
 756         setcc(cpu, 3);
 757         return;
 758     }
 759     setcc(cpu, css_do_rsch(sch));
 760 }
 761
 762 #define RCHP_REG1_RES(_reg) (_reg & 0x00000000ff00ff00)
 763 #define RCHP_REG1_CSSID(_reg) ((_reg & 0x0000000000ff0000) >> 16)
 764 #define RCHP_REG1_CHPID(_reg) (_reg & 0x00000000000000ff)
 765 void ioinst_handle_rchp(S390CPU *cpu, uint64_t reg1)
 766 {
 767     int cc;
 768     uint8_t cssid;
 769     uint8_t chpid;
 770     int ret;
 771     CPUS390XState *env = &cpu->env;
 772
 773     if (RCHP_REG1_RES(reg1)) {
 774         program_interrupt(env, PGM_OPERAND, 4);
 775         return;
 776     }
 777
 778     cssid = RCHP_REG1_CSSID(reg1);
 779     chpid = RCHP_REG1_CHPID(reg1);
 780
 781     trace_ioinst_chp_id("rchp", cssid, chpid);
 782
 783     ret = css_do_rchp(cssid, chpid);
 784
 785     switch (ret) {
 786     case -ENODEV:
 787         cc = 3;
 788         break;
 789     case -EBUSY:
 790         cc = 2;
 791         break;
 792     case 0:
 793         cc = 0;
 794         break;
 795     default:
 796         /* Invalid channel subsystem. */
 797         program_interrupt(env, PGM_OPERAND, 4);
 798         return;
 799     }
 800     setcc(cpu, cc);
 801 }
 802
 803 #define SAL_REG1_INVALID(_reg) (_reg & 0x0000000080000000)
 804 void ioinst_handle_sal(S390CPU *cpu, uint64_t reg1)
 805 {
 806     /* We do not provide address limit checking, so let's suppress it. */
 807     if (SAL_REG1_INVALID(reg1) || reg1 & 0x000000000000ffff) {
 808         program_interrupt(&cpu->env, PGM_OPERAND, 4);
 809     }
 810 }