xref: /openbmc/qemu/target/s390x/ioinst.c (revision ac06724a715864942e2b5e28f92d5d5421f0a0b0)
1 /*
2  * I/O instructions for S/390
3  *
4  * Copyright 2012, 2015 IBM Corp.
5  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
6  *
7  * This work is licensed under the terms of the GNU GPL, version 2 or (at
8  * your option) any later version. See the COPYING file in the top-level
9  * directory.
10  */
11 
12 #include "qemu/osdep.h"
13 
14 #include "cpu.h"
15 #include "hw/s390x/ioinst.h"
16 #include "trace.h"
17 #include "hw/s390x/s390-pci-bus.h"
18 
19 int ioinst_disassemble_sch_ident(uint32_t value, int *m, int *cssid, int *ssid,
20                                  int *schid)
21 {
22     if (!IOINST_SCHID_ONE(value)) {
23         return -EINVAL;
24     }
25     if (!IOINST_SCHID_M(value)) {
26         if (IOINST_SCHID_CSSID(value)) {
27             return -EINVAL;
28         }
29         *cssid = 0;
30         *m = 0;
31     } else {
32         *cssid = IOINST_SCHID_CSSID(value);
33         *m = 1;
34     }
35     *ssid = IOINST_SCHID_SSID(value);
36     *schid = IOINST_SCHID_NR(value);
37     return 0;
38 }
39 
40 void ioinst_handle_xsch(S390CPU *cpu, uint64_t reg1)
41 {
42     int cssid, ssid, schid, m;
43     SubchDev *sch;
44     int ret = -ENODEV;
45     int cc;
46 
47     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
48         program_interrupt(&cpu->env, PGM_OPERAND, 2);
49         return;
50     }
51     trace_ioinst_sch_id("xsch", cssid, ssid, schid);
52     sch = css_find_subch(m, cssid, ssid, schid);
53     if (sch && css_subch_visible(sch)) {
54         ret = css_do_xsch(sch);
55     }
56     switch (ret) {
57     case -ENODEV:
58         cc = 3;
59         break;
60     case -EBUSY:
61         cc = 2;
62         break;
63     case 0:
64         cc = 0;
65         break;
66     default:
67         cc = 1;
68         break;
69     }
70     setcc(cpu, cc);
71 }
72 
73 void ioinst_handle_csch(S390CPU *cpu, uint64_t reg1)
74 {
75     int cssid, ssid, schid, m;
76     SubchDev *sch;
77     int ret = -ENODEV;
78     int cc;
79 
80     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
81         program_interrupt(&cpu->env, PGM_OPERAND, 2);
82         return;
83     }
84     trace_ioinst_sch_id("csch", cssid, ssid, schid);
85     sch = css_find_subch(m, cssid, ssid, schid);
86     if (sch && css_subch_visible(sch)) {
87         ret = css_do_csch(sch);
88     }
89     if (ret == -ENODEV) {
90         cc = 3;
91     } else {
92         cc = 0;
93     }
94     setcc(cpu, cc);
95 }
96 
97 void ioinst_handle_hsch(S390CPU *cpu, uint64_t reg1)
98 {
99     int cssid, ssid, schid, m;
100     SubchDev *sch;
101     int ret = -ENODEV;
102     int cc;
103 
104     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
105         program_interrupt(&cpu->env, PGM_OPERAND, 2);
106         return;
107     }
108     trace_ioinst_sch_id("hsch", cssid, ssid, schid);
109     sch = css_find_subch(m, cssid, ssid, schid);
110     if (sch && css_subch_visible(sch)) {
111         ret = css_do_hsch(sch);
112     }
113     switch (ret) {
114     case -ENODEV:
115         cc = 3;
116         break;
117     case -EBUSY:
118         cc = 2;
119         break;
120     case 0:
121         cc = 0;
122         break;
123     default:
124         cc = 1;
125         break;
126     }
127     setcc(cpu, cc);
128 }
129 
130 static int ioinst_schib_valid(SCHIB *schib)
131 {
132     if ((be16_to_cpu(schib->pmcw.flags) & PMCW_FLAGS_MASK_INVALID) ||
133         (be32_to_cpu(schib->pmcw.chars) & PMCW_CHARS_MASK_INVALID)) {
134         return 0;
135     }
136     /* Disallow extended measurements for now. */
137     if (be32_to_cpu(schib->pmcw.chars) & PMCW_CHARS_MASK_XMWME) {
138         return 0;
139     }
140     return 1;
141 }
142 
143 void ioinst_handle_msch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
144 {
145     int cssid, ssid, schid, m;
146     SubchDev *sch;
147     SCHIB schib;
148     uint64_t addr;
149     int ret = -ENODEV;
150     int cc;
151     CPUS390XState *env = &cpu->env;
152     uint8_t ar;
153 
154     addr = decode_basedisp_s(env, ipb, &ar);
155     if (addr & 3) {
156         program_interrupt(env, PGM_SPECIFICATION, 2);
157         return;
158     }
159     if (s390_cpu_virt_mem_read(cpu, addr, ar, &schib, sizeof(schib))) {
160         return;
161     }
162     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
163         !ioinst_schib_valid(&schib)) {
164         program_interrupt(env, PGM_OPERAND, 2);
165         return;
166     }
167     trace_ioinst_sch_id("msch", cssid, ssid, schid);
168     sch = css_find_subch(m, cssid, ssid, schid);
169     if (sch && css_subch_visible(sch)) {
170         ret = css_do_msch(sch, &schib);
171     }
172     switch (ret) {
173     case -ENODEV:
174         cc = 3;
175         break;
176     case -EBUSY:
177         cc = 2;
178         break;
179     case 0:
180         cc = 0;
181         break;
182     default:
183         cc = 1;
184         break;
185     }
186     setcc(cpu, cc);
187 }
188 
189 static void copy_orb_from_guest(ORB *dest, const ORB *src)
190 {
191     dest->intparm = be32_to_cpu(src->intparm);
192     dest->ctrl0 = be16_to_cpu(src->ctrl0);
193     dest->lpm = src->lpm;
194     dest->ctrl1 = src->ctrl1;
195     dest->cpa = be32_to_cpu(src->cpa);
196 }
197 
198 static int ioinst_orb_valid(ORB *orb)
199 {
200     if ((orb->ctrl0 & ORB_CTRL0_MASK_INVALID) ||
201         (orb->ctrl1 & ORB_CTRL1_MASK_INVALID)) {
202         return 0;
203     }
204     if ((orb->cpa & HIGH_ORDER_BIT) != 0) {
205         return 0;
206     }
207     return 1;
208 }
209 
210 void ioinst_handle_ssch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
211 {
212     int cssid, ssid, schid, m;
213     SubchDev *sch;
214     ORB orig_orb, orb;
215     uint64_t addr;
216     int ret = -ENODEV;
217     int cc;
218     CPUS390XState *env = &cpu->env;
219     uint8_t ar;
220 
221     addr = decode_basedisp_s(env, ipb, &ar);
222     if (addr & 3) {
223         program_interrupt(env, PGM_SPECIFICATION, 2);
224         return;
225     }
226     if (s390_cpu_virt_mem_read(cpu, addr, ar, &orig_orb, sizeof(orb))) {
227         return;
228     }
229     copy_orb_from_guest(&orb, &orig_orb);
230     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid) ||
231         !ioinst_orb_valid(&orb)) {
232         program_interrupt(env, PGM_OPERAND, 2);
233         return;
234     }
235     trace_ioinst_sch_id("ssch", cssid, ssid, schid);
236     sch = css_find_subch(m, cssid, ssid, schid);
237     if (sch && css_subch_visible(sch)) {
238         ret = css_do_ssch(sch, &orb);
239     }
240     switch (ret) {
241     case -ENODEV:
242         cc = 3;
243         break;
244     case -EBUSY:
245         cc = 2;
246         break;
247     case -EFAULT:
248         /*
249          * TODO:
250          * I'm wondering whether there is something better
251          * to do for us here (like setting some device or
252          * subchannel status).
253          */
254         program_interrupt(env, PGM_ADDRESSING, 4);
255         return;
256     case 0:
257         cc = 0;
258         break;
259     default:
260         cc = 1;
261         break;
262     }
263     setcc(cpu, cc);
264 }
265 
266 void ioinst_handle_stcrw(S390CPU *cpu, uint32_t ipb)
267 {
268     CRW crw;
269     uint64_t addr;
270     int cc;
271     CPUS390XState *env = &cpu->env;
272     uint8_t ar;
273 
274     addr = decode_basedisp_s(env, ipb, &ar);
275     if (addr & 3) {
276         program_interrupt(env, PGM_SPECIFICATION, 2);
277         return;
278     }
279 
280     cc = css_do_stcrw(&crw);
281     /* 0 - crw stored, 1 - zeroes stored */
282 
283     if (s390_cpu_virt_mem_write(cpu, addr, ar, &crw, sizeof(crw)) == 0) {
284         setcc(cpu, cc);
285     } else if (cc == 0) {
286         /* Write failed: requeue CRW since STCRW is a suppressing instruction */
287         css_undo_stcrw(&crw);
288     }
289 }
290 
291 void ioinst_handle_stsch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
292 {
293     int cssid, ssid, schid, m;
294     SubchDev *sch;
295     uint64_t addr;
296     int cc;
297     SCHIB schib;
298     CPUS390XState *env = &cpu->env;
299     uint8_t ar;
300 
301     addr = decode_basedisp_s(env, ipb, &ar);
302     if (addr & 3) {
303         program_interrupt(env, PGM_SPECIFICATION, 2);
304         return;
305     }
306 
307     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
308         /*
309          * As operand exceptions have a lower priority than access exceptions,
310          * we check whether the memory area is writeable (injecting the
311          * access execption if it is not) first.
312          */
313         if (!s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib))) {
314             program_interrupt(env, PGM_OPERAND, 2);
315         }
316         return;
317     }
318     trace_ioinst_sch_id("stsch", cssid, ssid, schid);
319     sch = css_find_subch(m, cssid, ssid, schid);
320     if (sch) {
321         if (css_subch_visible(sch)) {
322             css_do_stsch(sch, &schib);
323             cc = 0;
324         } else {
325             /* Indicate no more subchannels in this css/ss */
326             cc = 3;
327         }
328     } else {
329         if (css_schid_final(m, cssid, ssid, schid)) {
330             cc = 3; /* No more subchannels in this css/ss */
331         } else {
332             /* Store an empty schib. */
333             memset(&schib, 0, sizeof(schib));
334             cc = 0;
335         }
336     }
337     if (cc != 3) {
338         if (s390_cpu_virt_mem_write(cpu, addr, ar, &schib,
339                                     sizeof(schib)) != 0) {
340             return;
341         }
342     } else {
343         /* Access exceptions have a higher priority than cc3 */
344         if (s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib)) != 0) {
345             return;
346         }
347     }
348     setcc(cpu, cc);
349 }
350 
351 int ioinst_handle_tsch(S390CPU *cpu, uint64_t reg1, uint32_t ipb)
352 {
353     CPUS390XState *env = &cpu->env;
354     int cssid, ssid, schid, m;
355     SubchDev *sch;
356     IRB irb;
357     uint64_t addr;
358     int cc, irb_len;
359     uint8_t ar;
360 
361     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
362         program_interrupt(env, PGM_OPERAND, 2);
363         return -EIO;
364     }
365     trace_ioinst_sch_id("tsch", cssid, ssid, schid);
366     addr = decode_basedisp_s(env, ipb, &ar);
367     if (addr & 3) {
368         program_interrupt(env, PGM_SPECIFICATION, 2);
369         return -EIO;
370     }
371 
372     sch = css_find_subch(m, cssid, ssid, schid);
373     if (sch && css_subch_visible(sch)) {
374         cc = css_do_tsch_get_irb(sch, &irb, &irb_len);
375     } else {
376         cc = 3;
377     }
378     /* 0 - status pending, 1 - not status pending, 3 - not operational */
379     if (cc != 3) {
380         if (s390_cpu_virt_mem_write(cpu, addr, ar, &irb, irb_len) != 0) {
381             return -EFAULT;
382         }
383         css_do_tsch_update_subch(sch);
384     } else {
385         irb_len = sizeof(irb) - sizeof(irb.emw);
386         /* Access exceptions have a higher priority than cc3 */
387         if (s390_cpu_virt_mem_check_write(cpu, addr, ar, irb_len) != 0) {
388             return -EFAULT;
389         }
390     }
391 
392     setcc(cpu, cc);
393     return 0;
394 }
395 
396 typedef struct ChscReq {
397     uint16_t len;
398     uint16_t command;
399     uint32_t param0;
400     uint32_t param1;
401     uint32_t param2;
402 } QEMU_PACKED ChscReq;
403 
404 typedef struct ChscResp {
405     uint16_t len;
406     uint16_t code;
407     uint32_t param;
408     char data[0];
409 } QEMU_PACKED ChscResp;
410 
411 #define CHSC_MIN_RESP_LEN 0x0008
412 
413 #define CHSC_SCPD 0x0002
414 #define CHSC_SCSC 0x0010
415 #define CHSC_SDA  0x0031
416 #define CHSC_SEI  0x000e
417 
418 #define CHSC_SCPD_0_M 0x20000000
419 #define CHSC_SCPD_0_C 0x10000000
420 #define CHSC_SCPD_0_FMT 0x0f000000
421 #define CHSC_SCPD_0_CSSID 0x00ff0000
422 #define CHSC_SCPD_0_RFMT 0x00000f00
423 #define CHSC_SCPD_0_RES 0xc000f000
424 #define CHSC_SCPD_1_RES 0xffffff00
425 #define CHSC_SCPD_01_CHPID 0x000000ff
426 static void ioinst_handle_chsc_scpd(ChscReq *req, ChscResp *res)
427 {
428     uint16_t len = be16_to_cpu(req->len);
429     uint32_t param0 = be32_to_cpu(req->param0);
430     uint32_t param1 = be32_to_cpu(req->param1);
431     uint16_t resp_code;
432     int rfmt;
433     uint16_t cssid;
434     uint8_t f_chpid, l_chpid;
435     int desc_size;
436     int m;
437 
438     rfmt = (param0 & CHSC_SCPD_0_RFMT) >> 8;
439     if ((rfmt == 0) ||  (rfmt == 1)) {
440         rfmt = !!(param0 & CHSC_SCPD_0_C);
441     }
442     if ((len != 0x0010) || (param0 & CHSC_SCPD_0_RES) ||
443         (param1 & CHSC_SCPD_1_RES) || req->param2) {
444         resp_code = 0x0003;
445         goto out_err;
446     }
447     if (param0 & CHSC_SCPD_0_FMT) {
448         resp_code = 0x0007;
449         goto out_err;
450     }
451     cssid = (param0 & CHSC_SCPD_0_CSSID) >> 16;
452     m = param0 & CHSC_SCPD_0_M;
453     if (cssid != 0) {
454         if (!m || !css_present(cssid)) {
455             resp_code = 0x0008;
456             goto out_err;
457         }
458     }
459     f_chpid = param0 & CHSC_SCPD_01_CHPID;
460     l_chpid = param1 & CHSC_SCPD_01_CHPID;
461     if (l_chpid < f_chpid) {
462         resp_code = 0x0003;
463         goto out_err;
464     }
465     /* css_collect_chp_desc() is endian-aware */
466     desc_size = css_collect_chp_desc(m, cssid, f_chpid, l_chpid, rfmt,
467                                      &res->data);
468     res->code = cpu_to_be16(0x0001);
469     res->len = cpu_to_be16(8 + desc_size);
470     res->param = cpu_to_be32(rfmt);
471     return;
472 
473   out_err:
474     res->code = cpu_to_be16(resp_code);
475     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
476     res->param = cpu_to_be32(rfmt);
477 }
478 
479 #define CHSC_SCSC_0_M 0x20000000
480 #define CHSC_SCSC_0_FMT 0x000f0000
481 #define CHSC_SCSC_0_CSSID 0x0000ff00
482 #define CHSC_SCSC_0_RES 0xdff000ff
483 static void ioinst_handle_chsc_scsc(ChscReq *req, ChscResp *res)
484 {
485     uint16_t len = be16_to_cpu(req->len);
486     uint32_t param0 = be32_to_cpu(req->param0);
487     uint8_t cssid;
488     uint16_t resp_code;
489     uint32_t general_chars[510];
490     uint32_t chsc_chars[508];
491 
492     if (len != 0x0010) {
493         resp_code = 0x0003;
494         goto out_err;
495     }
496 
497     if (param0 & CHSC_SCSC_0_FMT) {
498         resp_code = 0x0007;
499         goto out_err;
500     }
501     cssid = (param0 & CHSC_SCSC_0_CSSID) >> 8;
502     if (cssid != 0) {
503         if (!(param0 & CHSC_SCSC_0_M) || !css_present(cssid)) {
504             resp_code = 0x0008;
505             goto out_err;
506         }
507     }
508     if ((param0 & CHSC_SCSC_0_RES) || req->param1 || req->param2) {
509         resp_code = 0x0003;
510         goto out_err;
511     }
512     res->code = cpu_to_be16(0x0001);
513     res->len = cpu_to_be16(4080);
514     res->param = 0;
515 
516     memset(general_chars, 0, sizeof(general_chars));
517     memset(chsc_chars, 0, sizeof(chsc_chars));
518 
519     general_chars[0] = cpu_to_be32(0x03000000);
520     general_chars[1] = cpu_to_be32(0x00079000);
521     general_chars[3] = cpu_to_be32(0x00080000);
522 
523     chsc_chars[0] = cpu_to_be32(0x40000000);
524     chsc_chars[3] = cpu_to_be32(0x00040000);
525 
526     memcpy(res->data, general_chars, sizeof(general_chars));
527     memcpy(res->data + sizeof(general_chars), chsc_chars, sizeof(chsc_chars));
528     return;
529 
530   out_err:
531     res->code = cpu_to_be16(resp_code);
532     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
533     res->param = 0;
534 }
535 
536 #define CHSC_SDA_0_FMT 0x0f000000
537 #define CHSC_SDA_0_OC 0x0000ffff
538 #define CHSC_SDA_0_RES 0xf0ff0000
539 #define CHSC_SDA_OC_MCSSE 0x0
540 #define CHSC_SDA_OC_MSS 0x2
541 static void ioinst_handle_chsc_sda(ChscReq *req, ChscResp *res)
542 {
543     uint16_t resp_code = 0x0001;
544     uint16_t len = be16_to_cpu(req->len);
545     uint32_t param0 = be32_to_cpu(req->param0);
546     uint16_t oc;
547     int ret;
548 
549     if ((len != 0x0400) || (param0 & CHSC_SDA_0_RES)) {
550         resp_code = 0x0003;
551         goto out;
552     }
553 
554     if (param0 & CHSC_SDA_0_FMT) {
555         resp_code = 0x0007;
556         goto out;
557     }
558 
559     oc = param0 & CHSC_SDA_0_OC;
560     switch (oc) {
561     case CHSC_SDA_OC_MCSSE:
562         ret = css_enable_mcsse();
563         if (ret == -EINVAL) {
564             resp_code = 0x0101;
565             goto out;
566         }
567         break;
568     case CHSC_SDA_OC_MSS:
569         ret = css_enable_mss();
570         if (ret == -EINVAL) {
571             resp_code = 0x0101;
572             goto out;
573         }
574         break;
575     default:
576         resp_code = 0x0003;
577         goto out;
578     }
579 
580 out:
581     res->code = cpu_to_be16(resp_code);
582     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
583     res->param = 0;
584 }
585 
586 static int chsc_sei_nt0_get_event(void *res)
587 {
588     /* no events yet */
589     return 1;
590 }
591 
592 static int chsc_sei_nt0_have_event(void)
593 {
594     /* no events yet */
595     return 0;
596 }
597 
598 #define CHSC_SEI_NT0    (1ULL << 63)
599 #define CHSC_SEI_NT2    (1ULL << 61)
600 static void ioinst_handle_chsc_sei(ChscReq *req, ChscResp *res)
601 {
602     uint64_t selection_mask = ldq_p(&req->param1);
603     uint8_t *res_flags = (uint8_t *)res->data;
604     int have_event = 0;
605     int have_more = 0;
606 
607     /* regarding architecture nt0 can not be masked */
608     have_event = !chsc_sei_nt0_get_event(res);
609     have_more = chsc_sei_nt0_have_event();
610 
611     if (selection_mask & CHSC_SEI_NT2) {
612         if (!have_event) {
613             have_event = !chsc_sei_nt2_get_event(res);
614         }
615 
616         if (!have_more) {
617             have_more = chsc_sei_nt2_have_event();
618         }
619     }
620 
621     if (have_event) {
622         res->code = cpu_to_be16(0x0001);
623         if (have_more) {
624             (*res_flags) |= 0x80;
625         } else {
626             (*res_flags) &= ~0x80;
627             css_clear_sei_pending();
628         }
629     } else {
630         res->code = cpu_to_be16(0x0005);
631         res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
632     }
633 }
634 
635 static void ioinst_handle_chsc_unimplemented(ChscResp *res)
636 {
637     res->len = cpu_to_be16(CHSC_MIN_RESP_LEN);
638     res->code = cpu_to_be16(0x0004);
639     res->param = 0;
640 }
641 
642 void ioinst_handle_chsc(S390CPU *cpu, uint32_t ipb)
643 {
644     ChscReq *req;
645     ChscResp *res;
646     uint64_t addr;
647     int reg;
648     uint16_t len;
649     uint16_t command;
650     CPUS390XState *env = &cpu->env;
651     uint8_t buf[TARGET_PAGE_SIZE];
652 
653     trace_ioinst("chsc");
654     reg = (ipb >> 20) & 0x00f;
655     addr = env->regs[reg];
656     /* Page boundary? */
657     if (addr & 0xfff) {
658         program_interrupt(env, PGM_SPECIFICATION, 2);
659         return;
660     }
661     /*
662      * Reading sizeof(ChscReq) bytes is currently enough for all of our
663      * present CHSC sub-handlers ... if we ever need more, we should take
664      * care of req->len here first.
665      */
666     if (s390_cpu_virt_mem_read(cpu, addr, reg, buf, sizeof(ChscReq))) {
667         return;
668     }
669     req = (ChscReq *)buf;
670     len = be16_to_cpu(req->len);
671     /* Length field valid? */
672     if ((len < 16) || (len > 4088) || (len & 7)) {
673         program_interrupt(env, PGM_OPERAND, 2);
674         return;
675     }
676     memset((char *)req + len, 0, TARGET_PAGE_SIZE - len);
677     res = (void *)((char *)req + len);
678     command = be16_to_cpu(req->command);
679     trace_ioinst_chsc_cmd(command, len);
680     switch (command) {
681     case CHSC_SCSC:
682         ioinst_handle_chsc_scsc(req, res);
683         break;
684     case CHSC_SCPD:
685         ioinst_handle_chsc_scpd(req, res);
686         break;
687     case CHSC_SDA:
688         ioinst_handle_chsc_sda(req, res);
689         break;
690     case CHSC_SEI:
691         ioinst_handle_chsc_sei(req, res);
692         break;
693     default:
694         ioinst_handle_chsc_unimplemented(res);
695         break;
696     }
697 
698     if (!s390_cpu_virt_mem_write(cpu, addr + len, reg, res,
699                                  be16_to_cpu(res->len))) {
700         setcc(cpu, 0);    /* Command execution complete */
701     }
702 }
703 
704 int ioinst_handle_tpi(S390CPU *cpu, uint32_t ipb)
705 {
706     CPUS390XState *env = &cpu->env;
707     uint64_t addr;
708     int lowcore;
709     IOIntCode int_code;
710     hwaddr len;
711     int ret;
712     uint8_t ar;
713 
714     trace_ioinst("tpi");
715     addr = decode_basedisp_s(env, ipb, &ar);
716     if (addr & 3) {
717         program_interrupt(env, PGM_SPECIFICATION, 2);
718         return -EIO;
719     }
720 
721     lowcore = addr ? 0 : 1;
722     len = lowcore ? 8 /* two words */ : 12 /* three words */;
723     ret = css_do_tpi(&int_code, lowcore);
724     if (ret == 1) {
725         s390_cpu_virt_mem_write(cpu, lowcore ? 184 : addr, ar, &int_code, len);
726     }
727     return ret;
728 }
729 
730 #define SCHM_REG1_RES(_reg) (_reg & 0x000000000ffffffc)
731 #define SCHM_REG1_MBK(_reg) ((_reg & 0x00000000f0000000) >> 28)
732 #define SCHM_REG1_UPD(_reg) ((_reg & 0x0000000000000002) >> 1)
733 #define SCHM_REG1_DCT(_reg) (_reg & 0x0000000000000001)
734 
735 void ioinst_handle_schm(S390CPU *cpu, uint64_t reg1, uint64_t reg2,
736                         uint32_t ipb)
737 {
738     uint8_t mbk;
739     int update;
740     int dct;
741     CPUS390XState *env = &cpu->env;
742 
743     trace_ioinst("schm");
744 
745     if (SCHM_REG1_RES(reg1)) {
746         program_interrupt(env, PGM_OPERAND, 2);
747         return;
748     }
749 
750     mbk = SCHM_REG1_MBK(reg1);
751     update = SCHM_REG1_UPD(reg1);
752     dct = SCHM_REG1_DCT(reg1);
753 
754     if (update && (reg2 & 0x000000000000001f)) {
755         program_interrupt(env, PGM_OPERAND, 2);
756         return;
757     }
758 
759     css_do_schm(mbk, update, dct, update ? reg2 : 0);
760 }
761 
762 void ioinst_handle_rsch(S390CPU *cpu, uint64_t reg1)
763 {
764     int cssid, ssid, schid, m;
765     SubchDev *sch;
766     int ret = -ENODEV;
767     int cc;
768 
769     if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) {
770         program_interrupt(&cpu->env, PGM_OPERAND, 2);
771         return;
772     }
773     trace_ioinst_sch_id("rsch", cssid, ssid, schid);
774     sch = css_find_subch(m, cssid, ssid, schid);
775     if (sch && css_subch_visible(sch)) {
776         ret = css_do_rsch(sch);
777     }
778     switch (ret) {
779     case -ENODEV:
780         cc = 3;
781         break;
782     case -EINVAL:
783         cc = 2;
784         break;
785     case 0:
786         cc = 0;
787         break;
788     default:
789         cc = 1;
790         break;
791     }
792     setcc(cpu, cc);
793 }
794 
795 #define RCHP_REG1_RES(_reg) (_reg & 0x00000000ff00ff00)
796 #define RCHP_REG1_CSSID(_reg) ((_reg & 0x0000000000ff0000) >> 16)
797 #define RCHP_REG1_CHPID(_reg) (_reg & 0x00000000000000ff)
798 void ioinst_handle_rchp(S390CPU *cpu, uint64_t reg1)
799 {
800     int cc;
801     uint8_t cssid;
802     uint8_t chpid;
803     int ret;
804     CPUS390XState *env = &cpu->env;
805 
806     if (RCHP_REG1_RES(reg1)) {
807         program_interrupt(env, PGM_OPERAND, 2);
808         return;
809     }
810 
811     cssid = RCHP_REG1_CSSID(reg1);
812     chpid = RCHP_REG1_CHPID(reg1);
813 
814     trace_ioinst_chp_id("rchp", cssid, chpid);
815 
816     ret = css_do_rchp(cssid, chpid);
817 
818     switch (ret) {
819     case -ENODEV:
820         cc = 3;
821         break;
822     case -EBUSY:
823         cc = 2;
824         break;
825     case 0:
826         cc = 0;
827         break;
828     default:
829         /* Invalid channel subsystem. */
830         program_interrupt(env, PGM_OPERAND, 2);
831         return;
832     }
833     setcc(cpu, cc);
834 }
835 
836 #define SAL_REG1_INVALID(_reg) (_reg & 0x0000000080000000)
837 void ioinst_handle_sal(S390CPU *cpu, uint64_t reg1)
838 {
839     /* We do not provide address limit checking, so let's suppress it. */
840     if (SAL_REG1_INVALID(reg1) || reg1 & 0x000000000000ffff) {
841         program_interrupt(&cpu->env, PGM_OPERAND, 2);
842     }
843 }
844