xref: /openbmc/qemu/hw/scsi/megasas.c (revision f606604f1c10b60ef294f1b9b229426521a365e3)
1 /*
2  * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation
3  * Based on the linux driver code at drivers/scsi/megaraid
4  *
5  * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
6  *
7  * This library is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2 of the License, or (at your option) any later version.
11  *
12  * This library is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "hw/hw.h"
22 #include "hw/pci/pci.h"
23 #include "sysemu/dma.h"
24 #include "hw/pci/msix.h"
25 #include "qemu/iov.h"
26 #include "hw/scsi/scsi.h"
27 #include "block/scsi.h"
28 #include "trace.h"
29 
30 #include "mfi.h"
31 
32 #define MEGASAS_VERSION "1.70"
33 #define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */
34 #define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */
35 #define MEGASAS_MAX_SGE 128             /* Firmware limit */
36 #define MEGASAS_DEFAULT_SGE 80
37 #define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */
38 #define MEGASAS_MAX_ARRAYS 128
39 
40 #define MEGASAS_HBA_SERIAL "QEMU123456"
41 #define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
42 #define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
43 
44 #define MEGASAS_FLAG_USE_JBOD      0
45 #define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)
46 #define MEGASAS_FLAG_USE_MSIX      1
47 #define MEGASAS_MASK_USE_MSIX      (1 << MEGASAS_FLAG_USE_MSIX)
48 #define MEGASAS_FLAG_USE_QUEUE64   2
49 #define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)
50 
51 static const char *mfi_frame_desc[] = {
52     "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",
53     "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"};
54 
55 typedef struct MegasasCmd {
56     uint32_t index;
57     uint16_t flags;
58     uint16_t count;
59     uint64_t context;
60 
61     hwaddr pa;
62     hwaddr pa_size;
63     union mfi_frame *frame;
64     SCSIRequest *req;
65     QEMUSGList qsg;
66     void *iov_buf;
67     size_t iov_size;
68     size_t iov_offset;
69     struct MegasasState *state;
70 } MegasasCmd;
71 
72 typedef struct MegasasState {
73     /*< private >*/
74     PCIDevice parent_obj;
75     /*< public >*/
76 
77     MemoryRegion mmio_io;
78     MemoryRegion port_io;
79     MemoryRegion queue_io;
80     uint32_t frame_hi;
81 
82     int fw_state;
83     uint32_t fw_sge;
84     uint32_t fw_cmds;
85     uint32_t flags;
86     int fw_luns;
87     int intr_mask;
88     int doorbell;
89     int busy;
90 
91     MegasasCmd *event_cmd;
92     int event_locale;
93     int event_class;
94     int event_count;
95     int shutdown_event;
96     int boot_event;
97 
98     uint64_t sas_addr;
99     char *hba_serial;
100 
101     uint64_t reply_queue_pa;
102     void *reply_queue;
103     int reply_queue_len;
104     int reply_queue_head;
105     int reply_queue_tail;
106     uint64_t consumer_pa;
107     uint64_t producer_pa;
108 
109     MegasasCmd frames[MEGASAS_MAX_FRAMES];
110 
111     SCSIBus bus;
112 } MegasasState;
113 
114 #define TYPE_MEGASAS "megasas"
115 
116 #define MEGASAS(obj) \
117     OBJECT_CHECK(MegasasState, (obj), TYPE_MEGASAS)
118 
119 #define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
120 
121 static bool megasas_intr_enabled(MegasasState *s)
122 {
123     if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=
124         MEGASAS_INTR_DISABLED_MASK) {
125         return true;
126     }
127     return false;
128 }
129 
130 static bool megasas_use_queue64(MegasasState *s)
131 {
132     return s->flags & MEGASAS_MASK_USE_QUEUE64;
133 }
134 
135 static bool megasas_use_msix(MegasasState *s)
136 {
137     return s->flags & MEGASAS_MASK_USE_MSIX;
138 }
139 
140 static bool megasas_is_jbod(MegasasState *s)
141 {
142     return s->flags & MEGASAS_MASK_USE_JBOD;
143 }
144 
145 static void megasas_frame_set_cmd_status(unsigned long frame, uint8_t v)
146 {
147     stb_phys(frame + offsetof(struct mfi_frame_header, cmd_status), v);
148 }
149 
150 static void megasas_frame_set_scsi_status(unsigned long frame, uint8_t v)
151 {
152     stb_phys(frame + offsetof(struct mfi_frame_header, scsi_status), v);
153 }
154 
155 /*
156  * Context is considered opaque, but the HBA firmware is running
157  * in little endian mode. So convert it to little endian, too.
158  */
159 static uint64_t megasas_frame_get_context(unsigned long frame)
160 {
161     return ldq_le_phys(&address_space_memory,
162                        frame + offsetof(struct mfi_frame_header, context));
163 }
164 
165 static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)
166 {
167     return cmd->flags & MFI_FRAME_IEEE_SGL;
168 }
169 
170 static bool megasas_frame_is_sgl64(MegasasCmd *cmd)
171 {
172     return cmd->flags & MFI_FRAME_SGL64;
173 }
174 
175 static bool megasas_frame_is_sense64(MegasasCmd *cmd)
176 {
177     return cmd->flags & MFI_FRAME_SENSE64;
178 }
179 
180 static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,
181                                      union mfi_sgl *sgl)
182 {
183     uint64_t addr;
184 
185     if (megasas_frame_is_ieee_sgl(cmd)) {
186         addr = le64_to_cpu(sgl->sg_skinny->addr);
187     } else if (megasas_frame_is_sgl64(cmd)) {
188         addr = le64_to_cpu(sgl->sg64->addr);
189     } else {
190         addr = le32_to_cpu(sgl->sg32->addr);
191     }
192     return addr;
193 }
194 
195 static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,
196                                     union mfi_sgl *sgl)
197 {
198     uint32_t len;
199 
200     if (megasas_frame_is_ieee_sgl(cmd)) {
201         len = le32_to_cpu(sgl->sg_skinny->len);
202     } else if (megasas_frame_is_sgl64(cmd)) {
203         len = le32_to_cpu(sgl->sg64->len);
204     } else {
205         len = le32_to_cpu(sgl->sg32->len);
206     }
207     return len;
208 }
209 
210 static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,
211                                        union mfi_sgl *sgl)
212 {
213     uint8_t *next = (uint8_t *)sgl;
214 
215     if (megasas_frame_is_ieee_sgl(cmd)) {
216         next += sizeof(struct mfi_sg_skinny);
217     } else if (megasas_frame_is_sgl64(cmd)) {
218         next += sizeof(struct mfi_sg64);
219     } else {
220         next += sizeof(struct mfi_sg32);
221     }
222 
223     if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {
224         return NULL;
225     }
226     return (union mfi_sgl *)next;
227 }
228 
229 static void megasas_soft_reset(MegasasState *s);
230 
231 static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
232 {
233     int i;
234     int iov_count = 0;
235     size_t iov_size = 0;
236 
237     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
238     iov_count = cmd->frame->header.sge_count;
239     if (iov_count > MEGASAS_MAX_SGE) {
240         trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,
241                                          MEGASAS_MAX_SGE);
242         return iov_count;
243     }
244     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), iov_count);
245     for (i = 0; i < iov_count; i++) {
246         dma_addr_t iov_pa, iov_size_p;
247 
248         if (!sgl) {
249             trace_megasas_iovec_sgl_underflow(cmd->index, i);
250             goto unmap;
251         }
252         iov_pa = megasas_sgl_get_addr(cmd, sgl);
253         iov_size_p = megasas_sgl_get_len(cmd, sgl);
254         if (!iov_pa || !iov_size_p) {
255             trace_megasas_iovec_sgl_invalid(cmd->index, i,
256                                             iov_pa, iov_size_p);
257             goto unmap;
258         }
259         qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);
260         sgl = megasas_sgl_next(cmd, sgl);
261         iov_size += (size_t)iov_size_p;
262     }
263     if (cmd->iov_size > iov_size) {
264         trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
265     } else if (cmd->iov_size < iov_size) {
266         trace_megasas_iovec_underflow(cmd->iov_size, iov_size, cmd->iov_size);
267     }
268     cmd->iov_offset = 0;
269     return 0;
270 unmap:
271     qemu_sglist_destroy(&cmd->qsg);
272     return iov_count - i;
273 }
274 
275 static void megasas_unmap_sgl(MegasasCmd *cmd)
276 {
277     qemu_sglist_destroy(&cmd->qsg);
278     cmd->iov_offset = 0;
279 }
280 
281 /*
282  * passthrough sense and io sense are at the same offset
283  */
284 static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,
285     uint8_t sense_len)
286 {
287     uint32_t pa_hi = 0, pa_lo;
288     hwaddr pa;
289 
290     if (sense_len > cmd->frame->header.sense_len) {
291         sense_len = cmd->frame->header.sense_len;
292     }
293     if (sense_len) {
294         pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);
295         if (megasas_frame_is_sense64(cmd)) {
296             pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);
297         }
298         pa = ((uint64_t) pa_hi << 32) | pa_lo;
299         cpu_physical_memory_write(pa, sense_ptr, sense_len);
300         cmd->frame->header.sense_len = sense_len;
301     }
302     return sense_len;
303 }
304 
305 static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)
306 {
307     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
308     uint8_t sense_len = 18;
309 
310     memset(sense_buf, 0, sense_len);
311     sense_buf[0] = 0xf0;
312     sense_buf[2] = sense.key;
313     sense_buf[7] = 10;
314     sense_buf[12] = sense.asc;
315     sense_buf[13] = sense.ascq;
316     megasas_build_sense(cmd, sense_buf, sense_len);
317 }
318 
319 static void megasas_copy_sense(MegasasCmd *cmd)
320 {
321     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
322     uint8_t sense_len;
323 
324     sense_len = scsi_req_get_sense(cmd->req, sense_buf,
325                                    SCSI_SENSE_BUF_SIZE);
326     megasas_build_sense(cmd, sense_buf, sense_len);
327 }
328 
329 /*
330  * Format an INQUIRY CDB
331  */
332 static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)
333 {
334     memset(cdb, 0, 6);
335     cdb[0] = INQUIRY;
336     if (pg > 0) {
337         cdb[1] = 0x1;
338         cdb[2] = pg;
339     }
340     cdb[3] = (len >> 8) & 0xff;
341     cdb[4] = (len & 0xff);
342     return len;
343 }
344 
345 /*
346  * Encode lba and len into a READ_16/WRITE_16 CDB
347  */
348 static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,
349                                uint32_t len, bool is_write)
350 {
351     memset(cdb, 0x0, 16);
352     if (is_write) {
353         cdb[0] = WRITE_16;
354     } else {
355         cdb[0] = READ_16;
356     }
357     cdb[2] = (lba >> 56) & 0xff;
358     cdb[3] = (lba >> 48) & 0xff;
359     cdb[4] = (lba >> 40) & 0xff;
360     cdb[5] = (lba >> 32) & 0xff;
361     cdb[6] = (lba >> 24) & 0xff;
362     cdb[7] = (lba >> 16) & 0xff;
363     cdb[8] = (lba >> 8) & 0xff;
364     cdb[9] = (lba) & 0xff;
365     cdb[10] = (len >> 24) & 0xff;
366     cdb[11] = (len >> 16) & 0xff;
367     cdb[12] = (len >> 8) & 0xff;
368     cdb[13] = (len) & 0xff;
369 }
370 
371 /*
372  * Utility functions
373  */
374 static uint64_t megasas_fw_time(void)
375 {
376     struct tm curtime;
377     uint64_t bcd_time;
378 
379     qemu_get_timedate(&curtime, 0);
380     bcd_time = ((uint64_t)curtime.tm_sec & 0xff) << 48 |
381         ((uint64_t)curtime.tm_min & 0xff)  << 40 |
382         ((uint64_t)curtime.tm_hour & 0xff) << 32 |
383         ((uint64_t)curtime.tm_mday & 0xff) << 24 |
384         ((uint64_t)curtime.tm_mon & 0xff)  << 16 |
385         ((uint64_t)(curtime.tm_year + 1900) & 0xffff);
386 
387     return bcd_time;
388 }
389 
390 /*
391  * Default disk sata address
392  * 0x1221 is the magic number as
393  * present in real hardware,
394  * so use it here, too.
395  */
396 static uint64_t megasas_get_sata_addr(uint16_t id)
397 {
398     uint64_t addr = (0x1221ULL << 48);
399     return addr & (id << 24);
400 }
401 
402 /*
403  * Frame handling
404  */
405 static int megasas_next_index(MegasasState *s, int index, int limit)
406 {
407     index++;
408     if (index == limit) {
409         index = 0;
410     }
411     return index;
412 }
413 
414 static MegasasCmd *megasas_lookup_frame(MegasasState *s,
415     hwaddr frame)
416 {
417     MegasasCmd *cmd = NULL;
418     int num = 0, index;
419 
420     index = s->reply_queue_head;
421 
422     while (num < s->fw_cmds) {
423         if (s->frames[index].pa && s->frames[index].pa == frame) {
424             cmd = &s->frames[index];
425             break;
426         }
427         index = megasas_next_index(s, index, s->fw_cmds);
428         num++;
429     }
430 
431     return cmd;
432 }
433 
434 static MegasasCmd *megasas_next_frame(MegasasState *s,
435     hwaddr frame)
436 {
437     MegasasCmd *cmd = NULL;
438     int num = 0, index;
439 
440     cmd = megasas_lookup_frame(s, frame);
441     if (cmd) {
442         trace_megasas_qf_found(cmd->index, cmd->pa);
443         return cmd;
444     }
445     index = s->reply_queue_head;
446     num = 0;
447     while (num < s->fw_cmds) {
448         if (!s->frames[index].pa) {
449             cmd = &s->frames[index];
450             break;
451         }
452         index = megasas_next_index(s, index, s->fw_cmds);
453         num++;
454     }
455     if (!cmd) {
456         trace_megasas_qf_failed(frame);
457     }
458     trace_megasas_qf_new(index, cmd);
459     return cmd;
460 }
461 
462 static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
463     hwaddr frame, uint64_t context, int count)
464 {
465     MegasasCmd *cmd = NULL;
466     int frame_size = MFI_FRAME_SIZE * 16;
467     hwaddr frame_size_p = frame_size;
468 
469     cmd = megasas_next_frame(s, frame);
470     /* All frames busy */
471     if (!cmd) {
472         return NULL;
473     }
474     if (!cmd->pa) {
475         cmd->pa = frame;
476         /* Map all possible frames */
477         cmd->frame = cpu_physical_memory_map(frame, &frame_size_p, 0);
478         if (frame_size_p != frame_size) {
479             trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
480             if (cmd->frame) {
481                 cpu_physical_memory_unmap(cmd->frame, frame_size_p, 0, 0);
482                 cmd->frame = NULL;
483                 cmd->pa = 0;
484             }
485             s->event_count++;
486             return NULL;
487         }
488         cmd->pa_size = frame_size_p;
489         cmd->context = context;
490         if (!megasas_use_queue64(s)) {
491             cmd->context &= (uint64_t)0xFFFFFFFF;
492         }
493     }
494     cmd->count = count;
495     s->busy++;
496 
497     trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,
498                              s->reply_queue_head, s->busy);
499 
500     return cmd;
501 }
502 
503 static void megasas_complete_frame(MegasasState *s, uint64_t context)
504 {
505     PCIDevice *pci_dev = PCI_DEVICE(s);
506     int tail, queue_offset;
507 
508     /* Decrement busy count */
509     s->busy--;
510 
511     if (s->reply_queue_pa) {
512         /*
513          * Put command on the reply queue.
514          * Context is opaque, but emulation is running in
515          * little endian. So convert it.
516          */
517         tail = s->reply_queue_head;
518         if (megasas_use_queue64(s)) {
519             queue_offset = tail * sizeof(uint64_t);
520             stq_le_phys(&address_space_memory,
521                         s->reply_queue_pa + queue_offset, context);
522         } else {
523             queue_offset = tail * sizeof(uint32_t);
524             stl_le_phys(s->reply_queue_pa + queue_offset, context);
525         }
526         s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
527         trace_megasas_qf_complete(context, tail, queue_offset,
528                                   s->busy, s->doorbell);
529     }
530 
531     if (megasas_intr_enabled(s)) {
532         /* Notify HBA */
533         s->doorbell++;
534         if (s->doorbell == 1) {
535             if (msix_enabled(pci_dev)) {
536                 trace_megasas_msix_raise(0);
537                 msix_notify(pci_dev, 0);
538             } else {
539                 trace_megasas_irq_raise();
540                 pci_irq_assert(pci_dev);
541             }
542         }
543     } else {
544         trace_megasas_qf_complete_noirq(context);
545     }
546 }
547 
548 static void megasas_reset_frames(MegasasState *s)
549 {
550     int i;
551     MegasasCmd *cmd;
552 
553     for (i = 0; i < s->fw_cmds; i++) {
554         cmd = &s->frames[i];
555         if (cmd->pa) {
556             cpu_physical_memory_unmap(cmd->frame, cmd->pa_size, 0, 0);
557             cmd->frame = NULL;
558             cmd->pa = 0;
559         }
560     }
561 }
562 
563 static void megasas_abort_command(MegasasCmd *cmd)
564 {
565     if (cmd->req) {
566         scsi_req_cancel(cmd->req);
567         cmd->req = NULL;
568     }
569 }
570 
571 static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
572 {
573     uint32_t pa_hi, pa_lo;
574     hwaddr iq_pa, initq_size;
575     struct mfi_init_qinfo *initq;
576     uint32_t flags;
577     int ret = MFI_STAT_OK;
578 
579     pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);
580     pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);
581     iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);
582     trace_megasas_init_firmware((uint64_t)iq_pa);
583     initq_size = sizeof(*initq);
584     initq = cpu_physical_memory_map(iq_pa, &initq_size, 0);
585     if (!initq || initq_size != sizeof(*initq)) {
586         trace_megasas_initq_map_failed(cmd->index);
587         s->event_count++;
588         ret = MFI_STAT_MEMORY_NOT_AVAILABLE;
589         goto out;
590     }
591     s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;
592     if (s->reply_queue_len > s->fw_cmds) {
593         trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);
594         s->event_count++;
595         ret = MFI_STAT_INVALID_PARAMETER;
596         goto out;
597     }
598     pa_lo = le32_to_cpu(initq->rq_addr_lo);
599     pa_hi = le32_to_cpu(initq->rq_addr_hi);
600     s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;
601     pa_lo = le32_to_cpu(initq->ci_addr_lo);
602     pa_hi = le32_to_cpu(initq->ci_addr_hi);
603     s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
604     pa_lo = le32_to_cpu(initq->pi_addr_lo);
605     pa_hi = le32_to_cpu(initq->pi_addr_hi);
606     s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
607     s->reply_queue_head = ldl_le_phys(&address_space_memory, s->producer_pa);
608     s->reply_queue_tail = ldl_le_phys(&address_space_memory, s->consumer_pa);
609     flags = le32_to_cpu(initq->flags);
610     if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
611         s->flags |= MEGASAS_MASK_USE_QUEUE64;
612     }
613     trace_megasas_init_queue((unsigned long)s->reply_queue_pa,
614                              s->reply_queue_len, s->reply_queue_head,
615                              s->reply_queue_tail, flags);
616     megasas_reset_frames(s);
617     s->fw_state = MFI_FWSTATE_OPERATIONAL;
618 out:
619     if (initq) {
620         cpu_physical_memory_unmap(initq, initq_size, 0, 0);
621     }
622     return ret;
623 }
624 
625 static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
626 {
627     dma_addr_t iov_pa, iov_size;
628 
629     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
630     if (!cmd->frame->header.sge_count) {
631         trace_megasas_dcmd_zero_sge(cmd->index);
632         cmd->iov_size = 0;
633         return 0;
634     } else if (cmd->frame->header.sge_count > 1) {
635         trace_megasas_dcmd_invalid_sge(cmd->index,
636                                        cmd->frame->header.sge_count);
637         cmd->iov_size = 0;
638         return -1;
639     }
640     iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
641     iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
642     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), 1);
643     qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
644     cmd->iov_size = iov_size;
645     return cmd->iov_size;
646 }
647 
648 static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
649 {
650     trace_megasas_finish_dcmd(cmd->index, iov_size);
651 
652     if (cmd->frame->header.sge_count) {
653         qemu_sglist_destroy(&cmd->qsg);
654     }
655     if (iov_size > cmd->iov_size) {
656         if (megasas_frame_is_ieee_sgl(cmd)) {
657             cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);
658         } else if (megasas_frame_is_sgl64(cmd)) {
659             cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);
660         } else {
661             cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);
662         }
663     }
664     cmd->iov_size = 0;
665 }
666 
667 static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
668 {
669     PCIDevice *pci_dev = PCI_DEVICE(s);
670     struct mfi_ctrl_info info;
671     size_t dcmd_size = sizeof(info);
672     BusChild *kid;
673     int num_ld_disks = 0;
674     uint16_t sdev_id;
675 
676     memset(&info, 0x0, cmd->iov_size);
677     if (cmd->iov_size < dcmd_size) {
678         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
679                                             dcmd_size);
680         return MFI_STAT_INVALID_PARAMETER;
681     }
682 
683     info.pci.vendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);
684     info.pci.device = cpu_to_le16(PCI_DEVICE_ID_LSI_SAS1078);
685     info.pci.subvendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);
686     info.pci.subdevice = cpu_to_le16(0x1013);
687 
688     /*
689      * For some reason the firmware supports
690      * only up to 8 device ports.
691      * Despite supporting a far larger number
692      * of devices for the physical devices.
693      * So just display the first 8 devices
694      * in the device port list, independent
695      * of how many logical devices are actually
696      * present.
697      */
698     info.host.type = MFI_INFO_HOST_PCIE;
699     info.device.type = MFI_INFO_DEV_SAS3G;
700     info.device.port_count = 8;
701     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
702         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
703 
704         if (num_ld_disks < 8) {
705             sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
706             info.device.port_addr[num_ld_disks] =
707                 cpu_to_le64(megasas_get_sata_addr(sdev_id));
708         }
709         num_ld_disks++;
710     }
711 
712     memcpy(info.product_name, "MegaRAID SAS 8708EM2", 20);
713     snprintf(info.serial_number, 32, "%s", s->hba_serial);
714     snprintf(info.package_version, 0x60, "%s-QEMU", QEMU_VERSION);
715     memcpy(info.image_component[0].name, "APP", 3);
716     memcpy(info.image_component[0].version, MEGASAS_VERSION "-QEMU", 9);
717     memcpy(info.image_component[0].build_date, __DATE__, 11);
718     memcpy(info.image_component[0].build_time, __TIME__, 8);
719     info.image_component_count = 1;
720     if (pci_dev->has_rom) {
721         uint8_t biosver[32];
722         uint8_t *ptr;
723 
724         ptr = memory_region_get_ram_ptr(&pci_dev->rom);
725         memcpy(biosver, ptr + 0x41, 31);
726         memcpy(info.image_component[1].name, "BIOS", 4);
727         memcpy(info.image_component[1].version, biosver,
728                strlen((const char *)biosver));
729         info.image_component_count++;
730     }
731     info.current_fw_time = cpu_to_le32(megasas_fw_time());
732     info.max_arms = 32;
733     info.max_spans = 8;
734     info.max_arrays = MEGASAS_MAX_ARRAYS;
735     info.max_lds = s->fw_luns;
736     info.max_cmds = cpu_to_le16(s->fw_cmds);
737     info.max_sg_elements = cpu_to_le16(s->fw_sge);
738     info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);
739     info.lds_present = cpu_to_le16(num_ld_disks);
740     info.pd_present = cpu_to_le16(num_ld_disks);
741     info.pd_disks_present = cpu_to_le16(num_ld_disks);
742     info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |
743                                    MFI_INFO_HW_MEM |
744                                    MFI_INFO_HW_FLASH);
745     info.memory_size = cpu_to_le16(512);
746     info.nvram_size = cpu_to_le16(32);
747     info.flash_size = cpu_to_le16(16);
748     info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);
749     info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |
750                                     MFI_INFO_AOPS_SELF_DIAGNOSTIC |
751                                     MFI_INFO_AOPS_MIXED_ARRAY);
752     info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |
753                                MFI_INFO_LDOPS_ACCESS_POLICY |
754                                MFI_INFO_LDOPS_IO_POLICY |
755                                MFI_INFO_LDOPS_WRITE_POLICY |
756                                MFI_INFO_LDOPS_READ_POLICY);
757     info.max_strips_per_io = cpu_to_le16(s->fw_sge);
758     info.stripe_sz_ops.min = 3;
759     info.stripe_sz_ops.max = ffs(MEGASAS_MAX_SECTORS + 1) - 1;
760     info.properties.pred_fail_poll_interval = cpu_to_le16(300);
761     info.properties.intr_throttle_cnt = cpu_to_le16(16);
762     info.properties.intr_throttle_timeout = cpu_to_le16(50);
763     info.properties.rebuild_rate = 30;
764     info.properties.patrol_read_rate = 30;
765     info.properties.bgi_rate = 30;
766     info.properties.cc_rate = 30;
767     info.properties.recon_rate = 30;
768     info.properties.cache_flush_interval = 4;
769     info.properties.spinup_drv_cnt = 2;
770     info.properties.spinup_delay = 6;
771     info.properties.ecc_bucket_size = 15;
772     info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);
773     info.properties.expose_encl_devices = 1;
774     info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);
775     info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |
776                                MFI_INFO_PDOPS_FORCE_OFFLINE);
777     info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |
778                                        MFI_INFO_PDMIX_SATA |
779                                        MFI_INFO_PDMIX_LD);
780 
781     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
782     return MFI_STAT_OK;
783 }
784 
785 static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)
786 {
787     struct mfi_defaults info;
788     size_t dcmd_size = sizeof(struct mfi_defaults);
789 
790     memset(&info, 0x0, dcmd_size);
791     if (cmd->iov_size < dcmd_size) {
792         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
793                                             dcmd_size);
794         return MFI_STAT_INVALID_PARAMETER;
795     }
796 
797     info.sas_addr = cpu_to_le64(s->sas_addr);
798     info.stripe_size = 3;
799     info.flush_time = 4;
800     info.background_rate = 30;
801     info.allow_mix_in_enclosure = 1;
802     info.allow_mix_in_ld = 1;
803     info.direct_pd_mapping = 1;
804     /* Enable for BIOS support */
805     info.bios_enumerate_lds = 1;
806     info.disable_ctrl_r = 1;
807     info.expose_enclosure_devices = 1;
808     info.disable_preboot_cli = 1;
809     info.cluster_disable = 1;
810 
811     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
812     return MFI_STAT_OK;
813 }
814 
815 static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)
816 {
817     struct mfi_bios_data info;
818     size_t dcmd_size = sizeof(info);
819 
820     memset(&info, 0x0, dcmd_size);
821     if (cmd->iov_size < dcmd_size) {
822         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
823                                             dcmd_size);
824         return MFI_STAT_INVALID_PARAMETER;
825     }
826     info.continue_on_error = 1;
827     info.verbose = 1;
828     if (megasas_is_jbod(s)) {
829         info.expose_all_drives = 1;
830     }
831 
832     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
833     return MFI_STAT_OK;
834 }
835 
836 static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)
837 {
838     uint64_t fw_time;
839     size_t dcmd_size = sizeof(fw_time);
840 
841     fw_time = cpu_to_le64(megasas_fw_time());
842 
843     cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);
844     return MFI_STAT_OK;
845 }
846 
847 static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)
848 {
849     uint64_t fw_time;
850 
851     /* This is a dummy; setting of firmware time is not allowed */
852     memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));
853 
854     trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);
855     fw_time = cpu_to_le64(megasas_fw_time());
856     return MFI_STAT_OK;
857 }
858 
859 static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)
860 {
861     struct mfi_evt_log_state info;
862     size_t dcmd_size = sizeof(info);
863 
864     memset(&info, 0, dcmd_size);
865 
866     info.newest_seq_num = cpu_to_le32(s->event_count);
867     info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
868     info.boot_seq_num = cpu_to_le32(s->boot_event);
869 
870     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
871     return MFI_STAT_OK;
872 }
873 
874 static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
875 {
876     union mfi_evt event;
877 
878     if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {
879         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
880                                             sizeof(struct mfi_evt_detail));
881         return MFI_STAT_INVALID_PARAMETER;
882     }
883     s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);
884     event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);
885     s->event_locale = event.members.locale;
886     s->event_class = event.members.class;
887     s->event_cmd = cmd;
888     /* Decrease busy count; event frame doesn't count here */
889     s->busy--;
890     cmd->iov_size = sizeof(struct mfi_evt_detail);
891     return MFI_STAT_INVALID_STATUS;
892 }
893 
894 static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
895 {
896     struct mfi_pd_list info;
897     size_t dcmd_size = sizeof(info);
898     BusChild *kid;
899     uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
900     uint16_t sdev_id;
901 
902     memset(&info, 0, dcmd_size);
903     offset = 8;
904     dcmd_limit = offset + sizeof(struct mfi_pd_address);
905     if (cmd->iov_size < dcmd_limit) {
906         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
907                                             dcmd_limit);
908         return MFI_STAT_INVALID_PARAMETER;
909     }
910 
911     max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);
912     if (max_pd_disks > s->fw_luns) {
913         max_pd_disks = s->fw_luns;
914     }
915 
916     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
917         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
918 
919         sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
920         info.addr[num_pd_disks].device_id = cpu_to_le16(sdev_id);
921         info.addr[num_pd_disks].encl_device_id = 0xFFFF;
922         info.addr[num_pd_disks].encl_index = 0;
923         info.addr[num_pd_disks].slot_number = (sdev->id & 0xFF);
924         info.addr[num_pd_disks].scsi_dev_type = sdev->type;
925         info.addr[num_pd_disks].connect_port_bitmap = 0x1;
926         info.addr[num_pd_disks].sas_addr[0] =
927             cpu_to_le64(megasas_get_sata_addr(sdev_id));
928         num_pd_disks++;
929         offset += sizeof(struct mfi_pd_address);
930     }
931     trace_megasas_dcmd_pd_get_list(cmd->index, num_pd_disks,
932                                    max_pd_disks, offset);
933 
934     info.size = cpu_to_le32(offset);
935     info.count = cpu_to_le32(num_pd_disks);
936 
937     cmd->iov_size -= dma_buf_read((uint8_t *)&info, offset, &cmd->qsg);
938     return MFI_STAT_OK;
939 }
940 
941 static int megasas_dcmd_pd_list_query(MegasasState *s, MegasasCmd *cmd)
942 {
943     uint16_t flags;
944 
945     /* mbox0 contains flags */
946     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
947     trace_megasas_dcmd_pd_list_query(cmd->index, flags);
948     if (flags == MR_PD_QUERY_TYPE_ALL ||
949         megasas_is_jbod(s)) {
950         return megasas_dcmd_pd_get_list(s, cmd);
951     }
952 
953     return MFI_STAT_OK;
954 }
955 
956 static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun,
957                                       MegasasCmd *cmd)
958 {
959     struct mfi_pd_info *info = cmd->iov_buf;
960     size_t dcmd_size = sizeof(struct mfi_pd_info);
961     BlockConf *conf = &sdev->conf;
962     uint64_t pd_size;
963     uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (lun & 0xFF);
964     uint8_t cmdbuf[6];
965     SCSIRequest *req;
966     size_t len, resid;
967 
968     if (!cmd->iov_buf) {
969         cmd->iov_buf = g_malloc(dcmd_size);
970         memset(cmd->iov_buf, 0, dcmd_size);
971         info = cmd->iov_buf;
972         info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */
973         info->vpd_page83[0] = 0x7f;
974         megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data));
975         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
976         if (!req) {
977             trace_megasas_dcmd_req_alloc_failed(cmd->index,
978                                                 "PD get info std inquiry");
979             g_free(cmd->iov_buf);
980             cmd->iov_buf = NULL;
981             return MFI_STAT_FLASH_ALLOC_FAIL;
982         }
983         trace_megasas_dcmd_internal_submit(cmd->index,
984                                            "PD get info std inquiry", lun);
985         len = scsi_req_enqueue(req);
986         if (len > 0) {
987             cmd->iov_size = len;
988             scsi_req_continue(req);
989         }
990         return MFI_STAT_INVALID_STATUS;
991     } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) {
992         megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83));
993         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
994         if (!req) {
995             trace_megasas_dcmd_req_alloc_failed(cmd->index,
996                                                 "PD get info vpd inquiry");
997             return MFI_STAT_FLASH_ALLOC_FAIL;
998         }
999         trace_megasas_dcmd_internal_submit(cmd->index,
1000                                            "PD get info vpd inquiry", lun);
1001         len = scsi_req_enqueue(req);
1002         if (len > 0) {
1003             cmd->iov_size = len;
1004             scsi_req_continue(req);
1005         }
1006         return MFI_STAT_INVALID_STATUS;
1007     }
1008     /* Finished, set FW state */
1009     if ((info->inquiry_data[0] >> 5) == 0) {
1010         if (megasas_is_jbod(cmd->state)) {
1011             info->fw_state = cpu_to_le16(MFI_PD_STATE_SYSTEM);
1012         } else {
1013             info->fw_state = cpu_to_le16(MFI_PD_STATE_ONLINE);
1014         }
1015     } else {
1016         info->fw_state = cpu_to_le16(MFI_PD_STATE_OFFLINE);
1017     }
1018 
1019     info->ref.v.device_id = cpu_to_le16(sdev_id);
1020     info->state.ddf.pd_type = cpu_to_le16(MFI_PD_DDF_TYPE_IN_VD|
1021                                           MFI_PD_DDF_TYPE_INTF_SAS);
1022     bdrv_get_geometry(conf->bs, &pd_size);
1023     info->raw_size = cpu_to_le64(pd_size);
1024     info->non_coerced_size = cpu_to_le64(pd_size);
1025     info->coerced_size = cpu_to_le64(pd_size);
1026     info->encl_device_id = 0xFFFF;
1027     info->slot_number = (sdev->id & 0xFF);
1028     info->path_info.count = 1;
1029     info->path_info.sas_addr[0] =
1030         cpu_to_le64(megasas_get_sata_addr(sdev_id));
1031     info->connected_port_bitmap = 0x1;
1032     info->device_speed = 1;
1033     info->link_speed = 1;
1034     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1035     g_free(cmd->iov_buf);
1036     cmd->iov_size = dcmd_size - resid;
1037     cmd->iov_buf = NULL;
1038     return MFI_STAT_OK;
1039 }
1040 
1041 static int megasas_dcmd_pd_get_info(MegasasState *s, MegasasCmd *cmd)
1042 {
1043     size_t dcmd_size = sizeof(struct mfi_pd_info);
1044     uint16_t pd_id;
1045     SCSIDevice *sdev = NULL;
1046     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1047 
1048     if (cmd->iov_size < dcmd_size) {
1049         return MFI_STAT_INVALID_PARAMETER;
1050     }
1051 
1052     /* mbox0 has the ID */
1053     pd_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1054     sdev = scsi_device_find(&s->bus, 0, pd_id, 0);
1055     trace_megasas_dcmd_pd_get_info(cmd->index, pd_id);
1056 
1057     if (sdev) {
1058         /* Submit inquiry */
1059         retval = megasas_pd_get_info_submit(sdev, pd_id, cmd);
1060     }
1061 
1062     return retval;
1063 }
1064 
1065 static int megasas_dcmd_ld_get_list(MegasasState *s, MegasasCmd *cmd)
1066 {
1067     struct mfi_ld_list info;
1068     size_t dcmd_size = sizeof(info), resid;
1069     uint32_t num_ld_disks = 0, max_ld_disks = s->fw_luns;
1070     uint64_t ld_size;
1071     BusChild *kid;
1072 
1073     memset(&info, 0, dcmd_size);
1074     if (cmd->iov_size < dcmd_size) {
1075         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1076                                             dcmd_size);
1077         return MFI_STAT_INVALID_PARAMETER;
1078     }
1079 
1080     if (megasas_is_jbod(s)) {
1081         max_ld_disks = 0;
1082     }
1083     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1084         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1085         BlockConf *conf = &sdev->conf;
1086 
1087         if (num_ld_disks >= max_ld_disks) {
1088             break;
1089         }
1090         /* Logical device size is in blocks */
1091         bdrv_get_geometry(conf->bs, &ld_size);
1092         info.ld_list[num_ld_disks].ld.v.target_id = sdev->id;
1093         info.ld_list[num_ld_disks].ld.v.lun_id = sdev->lun;
1094         info.ld_list[num_ld_disks].state = MFI_LD_STATE_OPTIMAL;
1095         info.ld_list[num_ld_disks].size = cpu_to_le64(ld_size);
1096         num_ld_disks++;
1097     }
1098     info.ld_count = cpu_to_le32(num_ld_disks);
1099     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1100 
1101     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1102     cmd->iov_size = dcmd_size - resid;
1103     return MFI_STAT_OK;
1104 }
1105 
1106 static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun,
1107                                       MegasasCmd *cmd)
1108 {
1109     struct mfi_ld_info *info = cmd->iov_buf;
1110     size_t dcmd_size = sizeof(struct mfi_ld_info);
1111     uint8_t cdb[6];
1112     SCSIRequest *req;
1113     ssize_t len, resid;
1114     BlockConf *conf = &sdev->conf;
1115     uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (lun & 0xFF);
1116     uint64_t ld_size;
1117 
1118     if (!cmd->iov_buf) {
1119         cmd->iov_buf = g_malloc(dcmd_size);
1120         memset(cmd->iov_buf, 0x0, dcmd_size);
1121         info = cmd->iov_buf;
1122         megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83));
1123         req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd);
1124         if (!req) {
1125             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1126                                                 "LD get info vpd inquiry");
1127             g_free(cmd->iov_buf);
1128             cmd->iov_buf = NULL;
1129             return MFI_STAT_FLASH_ALLOC_FAIL;
1130         }
1131         trace_megasas_dcmd_internal_submit(cmd->index,
1132                                            "LD get info vpd inquiry", lun);
1133         len = scsi_req_enqueue(req);
1134         if (len > 0) {
1135             cmd->iov_size = len;
1136             scsi_req_continue(req);
1137         }
1138         return MFI_STAT_INVALID_STATUS;
1139     }
1140 
1141     info->ld_config.params.state = MFI_LD_STATE_OPTIMAL;
1142     info->ld_config.properties.ld.v.target_id = lun;
1143     info->ld_config.params.stripe_size = 3;
1144     info->ld_config.params.num_drives = 1;
1145     info->ld_config.params.is_consistent = 1;
1146     /* Logical device size is in blocks */
1147     bdrv_get_geometry(conf->bs, &ld_size);
1148     info->size = cpu_to_le64(ld_size);
1149     memset(info->ld_config.span, 0, sizeof(info->ld_config.span));
1150     info->ld_config.span[0].start_block = 0;
1151     info->ld_config.span[0].num_blocks = info->size;
1152     info->ld_config.span[0].array_ref = cpu_to_le16(sdev_id);
1153 
1154     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1155     g_free(cmd->iov_buf);
1156     cmd->iov_size = dcmd_size - resid;
1157     cmd->iov_buf = NULL;
1158     return MFI_STAT_OK;
1159 }
1160 
1161 static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
1162 {
1163     struct mfi_ld_info info;
1164     size_t dcmd_size = sizeof(info);
1165     uint16_t ld_id;
1166     uint32_t max_ld_disks = s->fw_luns;
1167     SCSIDevice *sdev = NULL;
1168     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1169 
1170     if (cmd->iov_size < dcmd_size) {
1171         return MFI_STAT_INVALID_PARAMETER;
1172     }
1173 
1174     /* mbox0 has the ID */
1175     ld_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1176     trace_megasas_dcmd_ld_get_info(cmd->index, ld_id);
1177 
1178     if (megasas_is_jbod(s)) {
1179         return MFI_STAT_DEVICE_NOT_FOUND;
1180     }
1181 
1182     if (ld_id < max_ld_disks) {
1183         sdev = scsi_device_find(&s->bus, 0, ld_id, 0);
1184     }
1185 
1186     if (sdev) {
1187         retval = megasas_ld_get_info_submit(sdev, ld_id, cmd);
1188     }
1189 
1190     return retval;
1191 }
1192 
1193 static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
1194 {
1195     uint8_t data[4096];
1196     struct mfi_config_data *info;
1197     int num_pd_disks = 0, array_offset, ld_offset;
1198     BusChild *kid;
1199 
1200     if (cmd->iov_size > 4096) {
1201         return MFI_STAT_INVALID_PARAMETER;
1202     }
1203 
1204     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1205         num_pd_disks++;
1206     }
1207     info = (struct mfi_config_data *)&data;
1208     /*
1209      * Array mapping:
1210      * - One array per SCSI device
1211      * - One logical drive per SCSI device
1212      *   spanning the entire device
1213      */
1214     info->array_count = num_pd_disks;
1215     info->array_size = sizeof(struct mfi_array) * num_pd_disks;
1216     info->log_drv_count = num_pd_disks;
1217     info->log_drv_size = sizeof(struct mfi_ld_config) * num_pd_disks;
1218     info->spares_count = 0;
1219     info->spares_size = sizeof(struct mfi_spare);
1220     info->size = sizeof(struct mfi_config_data) + info->array_size +
1221         info->log_drv_size;
1222     if (info->size > 4096) {
1223         return MFI_STAT_INVALID_PARAMETER;
1224     }
1225 
1226     array_offset = sizeof(struct mfi_config_data);
1227     ld_offset = array_offset + sizeof(struct mfi_array) * num_pd_disks;
1228 
1229     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1230         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1231         BlockConf *conf = &sdev->conf;
1232         uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
1233         struct mfi_array *array;
1234         struct mfi_ld_config *ld;
1235         uint64_t pd_size;
1236         int i;
1237 
1238         array = (struct mfi_array *)(data + array_offset);
1239         bdrv_get_geometry(conf->bs, &pd_size);
1240         array->size = cpu_to_le64(pd_size);
1241         array->num_drives = 1;
1242         array->array_ref = cpu_to_le16(sdev_id);
1243         array->pd[0].ref.v.device_id = cpu_to_le16(sdev_id);
1244         array->pd[0].ref.v.seq_num = 0;
1245         array->pd[0].fw_state = MFI_PD_STATE_ONLINE;
1246         array->pd[0].encl.pd = 0xFF;
1247         array->pd[0].encl.slot = (sdev->id & 0xFF);
1248         for (i = 1; i < MFI_MAX_ROW_SIZE; i++) {
1249             array->pd[i].ref.v.device_id = 0xFFFF;
1250             array->pd[i].ref.v.seq_num = 0;
1251             array->pd[i].fw_state = MFI_PD_STATE_UNCONFIGURED_GOOD;
1252             array->pd[i].encl.pd = 0xFF;
1253             array->pd[i].encl.slot = 0xFF;
1254         }
1255         array_offset += sizeof(struct mfi_array);
1256         ld = (struct mfi_ld_config *)(data + ld_offset);
1257         memset(ld, 0, sizeof(struct mfi_ld_config));
1258         ld->properties.ld.v.target_id = (sdev->id & 0xFF);
1259         ld->properties.default_cache_policy = MR_LD_CACHE_READ_AHEAD |
1260             MR_LD_CACHE_READ_ADAPTIVE;
1261         ld->properties.current_cache_policy = MR_LD_CACHE_READ_AHEAD |
1262             MR_LD_CACHE_READ_ADAPTIVE;
1263         ld->params.state = MFI_LD_STATE_OPTIMAL;
1264         ld->params.stripe_size = 3;
1265         ld->params.num_drives = 1;
1266         ld->params.span_depth = 1;
1267         ld->params.is_consistent = 1;
1268         ld->span[0].start_block = 0;
1269         ld->span[0].num_blocks = cpu_to_le64(pd_size);
1270         ld->span[0].array_ref = cpu_to_le16(sdev_id);
1271         ld_offset += sizeof(struct mfi_ld_config);
1272     }
1273 
1274     cmd->iov_size -= dma_buf_read((uint8_t *)data, info->size, &cmd->qsg);
1275     return MFI_STAT_OK;
1276 }
1277 
1278 static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
1279 {
1280     struct mfi_ctrl_props info;
1281     size_t dcmd_size = sizeof(info);
1282 
1283     memset(&info, 0x0, dcmd_size);
1284     if (cmd->iov_size < dcmd_size) {
1285         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1286                                             dcmd_size);
1287         return MFI_STAT_INVALID_PARAMETER;
1288     }
1289     info.pred_fail_poll_interval = cpu_to_le16(300);
1290     info.intr_throttle_cnt = cpu_to_le16(16);
1291     info.intr_throttle_timeout = cpu_to_le16(50);
1292     info.rebuild_rate = 30;
1293     info.patrol_read_rate = 30;
1294     info.bgi_rate = 30;
1295     info.cc_rate = 30;
1296     info.recon_rate = 30;
1297     info.cache_flush_interval = 4;
1298     info.spinup_drv_cnt = 2;
1299     info.spinup_delay = 6;
1300     info.ecc_bucket_size = 15;
1301     info.ecc_bucket_leak_rate = cpu_to_le16(1440);
1302     info.expose_encl_devices = 1;
1303 
1304     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1305     return MFI_STAT_OK;
1306 }
1307 
1308 static int megasas_cache_flush(MegasasState *s, MegasasCmd *cmd)
1309 {
1310     bdrv_drain_all();
1311     return MFI_STAT_OK;
1312 }
1313 
1314 static int megasas_ctrl_shutdown(MegasasState *s, MegasasCmd *cmd)
1315 {
1316     s->fw_state = MFI_FWSTATE_READY;
1317     return MFI_STAT_OK;
1318 }
1319 
1320 static int megasas_cluster_reset_ld(MegasasState *s, MegasasCmd *cmd)
1321 {
1322     return MFI_STAT_INVALID_DCMD;
1323 }
1324 
1325 static int megasas_dcmd_set_properties(MegasasState *s, MegasasCmd *cmd)
1326 {
1327     struct mfi_ctrl_props info;
1328     size_t dcmd_size = sizeof(info);
1329 
1330     if (cmd->iov_size < dcmd_size) {
1331         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1332                                             dcmd_size);
1333         return MFI_STAT_INVALID_PARAMETER;
1334     }
1335     dma_buf_write((uint8_t *)&info, cmd->iov_size, &cmd->qsg);
1336     trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
1337     return MFI_STAT_OK;
1338 }
1339 
1340 static int megasas_dcmd_dummy(MegasasState *s, MegasasCmd *cmd)
1341 {
1342     trace_megasas_dcmd_dummy(cmd->index, cmd->iov_size);
1343     return MFI_STAT_OK;
1344 }
1345 
1346 static const struct dcmd_cmd_tbl_t {
1347     int opcode;
1348     const char *desc;
1349     int (*func)(MegasasState *s, MegasasCmd *cmd);
1350 } dcmd_cmd_tbl[] = {
1351     { MFI_DCMD_CTRL_MFI_HOST_MEM_ALLOC, "CTRL_HOST_MEM_ALLOC",
1352       megasas_dcmd_dummy },
1353     { MFI_DCMD_CTRL_GET_INFO, "CTRL_GET_INFO",
1354       megasas_ctrl_get_info },
1355     { MFI_DCMD_CTRL_GET_PROPERTIES, "CTRL_GET_PROPERTIES",
1356       megasas_dcmd_get_properties },
1357     { MFI_DCMD_CTRL_SET_PROPERTIES, "CTRL_SET_PROPERTIES",
1358       megasas_dcmd_set_properties },
1359     { MFI_DCMD_CTRL_ALARM_GET, "CTRL_ALARM_GET",
1360       megasas_dcmd_dummy },
1361     { MFI_DCMD_CTRL_ALARM_ENABLE, "CTRL_ALARM_ENABLE",
1362       megasas_dcmd_dummy },
1363     { MFI_DCMD_CTRL_ALARM_DISABLE, "CTRL_ALARM_DISABLE",
1364       megasas_dcmd_dummy },
1365     { MFI_DCMD_CTRL_ALARM_SILENCE, "CTRL_ALARM_SILENCE",
1366       megasas_dcmd_dummy },
1367     { MFI_DCMD_CTRL_ALARM_TEST, "CTRL_ALARM_TEST",
1368       megasas_dcmd_dummy },
1369     { MFI_DCMD_CTRL_EVENT_GETINFO, "CTRL_EVENT_GETINFO",
1370       megasas_event_info },
1371     { MFI_DCMD_CTRL_EVENT_GET, "CTRL_EVENT_GET",
1372       megasas_dcmd_dummy },
1373     { MFI_DCMD_CTRL_EVENT_WAIT, "CTRL_EVENT_WAIT",
1374       megasas_event_wait },
1375     { MFI_DCMD_CTRL_SHUTDOWN, "CTRL_SHUTDOWN",
1376       megasas_ctrl_shutdown },
1377     { MFI_DCMD_HIBERNATE_STANDBY, "CTRL_STANDBY",
1378       megasas_dcmd_dummy },
1379     { MFI_DCMD_CTRL_GET_TIME, "CTRL_GET_TIME",
1380       megasas_dcmd_get_fw_time },
1381     { MFI_DCMD_CTRL_SET_TIME, "CTRL_SET_TIME",
1382       megasas_dcmd_set_fw_time },
1383     { MFI_DCMD_CTRL_BIOS_DATA_GET, "CTRL_BIOS_DATA_GET",
1384       megasas_dcmd_get_bios_info },
1385     { MFI_DCMD_CTRL_FACTORY_DEFAULTS, "CTRL_FACTORY_DEFAULTS",
1386       megasas_dcmd_dummy },
1387     { MFI_DCMD_CTRL_MFC_DEFAULTS_GET, "CTRL_MFC_DEFAULTS_GET",
1388       megasas_mfc_get_defaults },
1389     { MFI_DCMD_CTRL_MFC_DEFAULTS_SET, "CTRL_MFC_DEFAULTS_SET",
1390       megasas_dcmd_dummy },
1391     { MFI_DCMD_CTRL_CACHE_FLUSH, "CTRL_CACHE_FLUSH",
1392       megasas_cache_flush },
1393     { MFI_DCMD_PD_GET_LIST, "PD_GET_LIST",
1394       megasas_dcmd_pd_get_list },
1395     { MFI_DCMD_PD_LIST_QUERY, "PD_LIST_QUERY",
1396       megasas_dcmd_pd_list_query },
1397     { MFI_DCMD_PD_GET_INFO, "PD_GET_INFO",
1398       megasas_dcmd_pd_get_info },
1399     { MFI_DCMD_PD_STATE_SET, "PD_STATE_SET",
1400       megasas_dcmd_dummy },
1401     { MFI_DCMD_PD_REBUILD, "PD_REBUILD",
1402       megasas_dcmd_dummy },
1403     { MFI_DCMD_PD_BLINK, "PD_BLINK",
1404       megasas_dcmd_dummy },
1405     { MFI_DCMD_PD_UNBLINK, "PD_UNBLINK",
1406       megasas_dcmd_dummy },
1407     { MFI_DCMD_LD_GET_LIST, "LD_GET_LIST",
1408       megasas_dcmd_ld_get_list},
1409     { MFI_DCMD_LD_GET_INFO, "LD_GET_INFO",
1410       megasas_dcmd_ld_get_info },
1411     { MFI_DCMD_LD_GET_PROP, "LD_GET_PROP",
1412       megasas_dcmd_dummy },
1413     { MFI_DCMD_LD_SET_PROP, "LD_SET_PROP",
1414       megasas_dcmd_dummy },
1415     { MFI_DCMD_LD_DELETE, "LD_DELETE",
1416       megasas_dcmd_dummy },
1417     { MFI_DCMD_CFG_READ, "CFG_READ",
1418       megasas_dcmd_cfg_read },
1419     { MFI_DCMD_CFG_ADD, "CFG_ADD",
1420       megasas_dcmd_dummy },
1421     { MFI_DCMD_CFG_CLEAR, "CFG_CLEAR",
1422       megasas_dcmd_dummy },
1423     { MFI_DCMD_CFG_FOREIGN_READ, "CFG_FOREIGN_READ",
1424       megasas_dcmd_dummy },
1425     { MFI_DCMD_CFG_FOREIGN_IMPORT, "CFG_FOREIGN_IMPORT",
1426       megasas_dcmd_dummy },
1427     { MFI_DCMD_BBU_STATUS, "BBU_STATUS",
1428       megasas_dcmd_dummy },
1429     { MFI_DCMD_BBU_CAPACITY_INFO, "BBU_CAPACITY_INFO",
1430       megasas_dcmd_dummy },
1431     { MFI_DCMD_BBU_DESIGN_INFO, "BBU_DESIGN_INFO",
1432       megasas_dcmd_dummy },
1433     { MFI_DCMD_BBU_PROP_GET, "BBU_PROP_GET",
1434       megasas_dcmd_dummy },
1435     { MFI_DCMD_CLUSTER, "CLUSTER",
1436       megasas_dcmd_dummy },
1437     { MFI_DCMD_CLUSTER_RESET_ALL, "CLUSTER_RESET_ALL",
1438       megasas_dcmd_dummy },
1439     { MFI_DCMD_CLUSTER_RESET_LD, "CLUSTER_RESET_LD",
1440       megasas_cluster_reset_ld },
1441     { -1, NULL, NULL }
1442 };
1443 
1444 static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)
1445 {
1446     int opcode, len;
1447     int retval = 0;
1448     const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;
1449 
1450     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1451     trace_megasas_handle_dcmd(cmd->index, opcode);
1452     len = megasas_map_dcmd(s, cmd);
1453     if (len < 0) {
1454         return MFI_STAT_MEMORY_NOT_AVAILABLE;
1455     }
1456     while (cmdptr->opcode != -1 && cmdptr->opcode != opcode) {
1457         cmdptr++;
1458     }
1459     if (cmdptr->opcode == -1) {
1460         trace_megasas_dcmd_unhandled(cmd->index, opcode, len);
1461         retval = megasas_dcmd_dummy(s, cmd);
1462     } else {
1463         trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);
1464         retval = cmdptr->func(s, cmd);
1465     }
1466     if (retval != MFI_STAT_INVALID_STATUS) {
1467         megasas_finish_dcmd(cmd, len);
1468     }
1469     return retval;
1470 }
1471 
1472 static int megasas_finish_internal_dcmd(MegasasCmd *cmd,
1473                                         SCSIRequest *req)
1474 {
1475     int opcode;
1476     int retval = MFI_STAT_OK;
1477     int lun = req->lun;
1478 
1479     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1480     scsi_req_unref(req);
1481     trace_megasas_dcmd_internal_finish(cmd->index, opcode, lun);
1482     switch (opcode) {
1483     case MFI_DCMD_PD_GET_INFO:
1484         retval = megasas_pd_get_info_submit(req->dev, lun, cmd);
1485         break;
1486     case MFI_DCMD_LD_GET_INFO:
1487         retval = megasas_ld_get_info_submit(req->dev, lun, cmd);
1488         break;
1489     default:
1490         trace_megasas_dcmd_internal_invalid(cmd->index, opcode);
1491         retval = MFI_STAT_INVALID_DCMD;
1492         break;
1493     }
1494     if (retval != MFI_STAT_INVALID_STATUS) {
1495         megasas_finish_dcmd(cmd, cmd->iov_size);
1496     }
1497     return retval;
1498 }
1499 
1500 static int megasas_enqueue_req(MegasasCmd *cmd, bool is_write)
1501 {
1502     int len;
1503 
1504     len = scsi_req_enqueue(cmd->req);
1505     if (len < 0) {
1506         len = -len;
1507     }
1508     if (len > 0) {
1509         if (len > cmd->iov_size) {
1510             if (is_write) {
1511                 trace_megasas_iov_write_overflow(cmd->index, len,
1512                                                  cmd->iov_size);
1513             } else {
1514                 trace_megasas_iov_read_overflow(cmd->index, len,
1515                                                 cmd->iov_size);
1516             }
1517         }
1518         if (len < cmd->iov_size) {
1519             if (is_write) {
1520                 trace_megasas_iov_write_underflow(cmd->index, len,
1521                                                   cmd->iov_size);
1522             } else {
1523                 trace_megasas_iov_read_underflow(cmd->index, len,
1524                                                  cmd->iov_size);
1525             }
1526             cmd->iov_size = len;
1527         }
1528         scsi_req_continue(cmd->req);
1529     }
1530     return len;
1531 }
1532 
1533 static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
1534                                bool is_logical)
1535 {
1536     uint8_t *cdb;
1537     int len;
1538     bool is_write;
1539     struct SCSIDevice *sdev = NULL;
1540 
1541     cdb = cmd->frame->pass.cdb;
1542 
1543     if (cmd->frame->header.target_id < s->fw_luns) {
1544         sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1545                                 cmd->frame->header.lun_id);
1546     }
1547     cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);
1548     trace_megasas_handle_scsi(mfi_frame_desc[cmd->frame->header.frame_cmd],
1549                               is_logical, cmd->frame->header.target_id,
1550                               cmd->frame->header.lun_id, sdev, cmd->iov_size);
1551 
1552     if (!sdev || (megasas_is_jbod(s) && is_logical)) {
1553         trace_megasas_scsi_target_not_present(
1554             mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1555             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1556         return MFI_STAT_DEVICE_NOT_FOUND;
1557     }
1558 
1559     if (cmd->frame->header.cdb_len > 16) {
1560         trace_megasas_scsi_invalid_cdb_len(
1561                 mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1562                 cmd->frame->header.target_id, cmd->frame->header.lun_id,
1563                 cmd->frame->header.cdb_len);
1564         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1565         cmd->frame->header.scsi_status = CHECK_CONDITION;
1566         s->event_count++;
1567         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1568     }
1569 
1570     if (megasas_map_sgl(s, cmd, &cmd->frame->pass.sgl)) {
1571         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1572         cmd->frame->header.scsi_status = CHECK_CONDITION;
1573         s->event_count++;
1574         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1575     }
1576 
1577     cmd->req = scsi_req_new(sdev, cmd->index,
1578                             cmd->frame->header.lun_id, cdb, cmd);
1579     if (!cmd->req) {
1580         trace_megasas_scsi_req_alloc_failed(
1581                 mfi_frame_desc[cmd->frame->header.frame_cmd],
1582                 cmd->frame->header.target_id, cmd->frame->header.lun_id);
1583         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1584         cmd->frame->header.scsi_status = BUSY;
1585         s->event_count++;
1586         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1587     }
1588 
1589     is_write = (cmd->req->cmd.mode == SCSI_XFER_TO_DEV);
1590     len = megasas_enqueue_req(cmd, is_write);
1591     if (len > 0) {
1592         if (is_write) {
1593             trace_megasas_scsi_write_start(cmd->index, len);
1594         } else {
1595             trace_megasas_scsi_read_start(cmd->index, len);
1596         }
1597     } else {
1598         trace_megasas_scsi_nodata(cmd->index);
1599     }
1600     return MFI_STAT_INVALID_STATUS;
1601 }
1602 
1603 static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd)
1604 {
1605     uint32_t lba_count, lba_start_hi, lba_start_lo;
1606     uint64_t lba_start;
1607     bool is_write = (cmd->frame->header.frame_cmd == MFI_CMD_LD_WRITE);
1608     uint8_t cdb[16];
1609     int len;
1610     struct SCSIDevice *sdev = NULL;
1611 
1612     lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
1613     lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
1614     lba_start_hi = le32_to_cpu(cmd->frame->io.lba_hi);
1615     lba_start = ((uint64_t)lba_start_hi << 32) | lba_start_lo;
1616 
1617     if (cmd->frame->header.target_id < s->fw_luns) {
1618         sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1619                                 cmd->frame->header.lun_id);
1620     }
1621 
1622     trace_megasas_handle_io(cmd->index,
1623                             mfi_frame_desc[cmd->frame->header.frame_cmd],
1624                             cmd->frame->header.target_id,
1625                             cmd->frame->header.lun_id,
1626                             (unsigned long)lba_start, (unsigned long)lba_count);
1627     if (!sdev) {
1628         trace_megasas_io_target_not_present(cmd->index,
1629             mfi_frame_desc[cmd->frame->header.frame_cmd],
1630             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1631         return MFI_STAT_DEVICE_NOT_FOUND;
1632     }
1633 
1634     if (cmd->frame->header.cdb_len > 16) {
1635         trace_megasas_scsi_invalid_cdb_len(
1636             mfi_frame_desc[cmd->frame->header.frame_cmd], 1,
1637             cmd->frame->header.target_id, cmd->frame->header.lun_id,
1638             cmd->frame->header.cdb_len);
1639         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1640         cmd->frame->header.scsi_status = CHECK_CONDITION;
1641         s->event_count++;
1642         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1643     }
1644 
1645     cmd->iov_size = lba_count * sdev->blocksize;
1646     if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
1647         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1648         cmd->frame->header.scsi_status = CHECK_CONDITION;
1649         s->event_count++;
1650         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1651     }
1652 
1653     megasas_encode_lba(cdb, lba_start, lba_count, is_write);
1654     cmd->req = scsi_req_new(sdev, cmd->index,
1655                             cmd->frame->header.lun_id, cdb, cmd);
1656     if (!cmd->req) {
1657         trace_megasas_scsi_req_alloc_failed(
1658             mfi_frame_desc[cmd->frame->header.frame_cmd],
1659             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1660         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1661         cmd->frame->header.scsi_status = BUSY;
1662         s->event_count++;
1663         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1664     }
1665     len = megasas_enqueue_req(cmd, is_write);
1666     if (len > 0) {
1667         if (is_write) {
1668             trace_megasas_io_write_start(cmd->index, lba_start, lba_count, len);
1669         } else {
1670             trace_megasas_io_read_start(cmd->index, lba_start, lba_count, len);
1671         }
1672     }
1673     return MFI_STAT_INVALID_STATUS;
1674 }
1675 
1676 static int megasas_finish_internal_command(MegasasCmd *cmd,
1677                                            SCSIRequest *req, size_t resid)
1678 {
1679     int retval = MFI_STAT_INVALID_CMD;
1680 
1681     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1682         cmd->iov_size -= resid;
1683         retval = megasas_finish_internal_dcmd(cmd, req);
1684     }
1685     return retval;
1686 }
1687 
1688 static QEMUSGList *megasas_get_sg_list(SCSIRequest *req)
1689 {
1690     MegasasCmd *cmd = req->hba_private;
1691 
1692     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1693         return NULL;
1694     } else {
1695         return &cmd->qsg;
1696     }
1697 }
1698 
1699 static void megasas_xfer_complete(SCSIRequest *req, uint32_t len)
1700 {
1701     MegasasCmd *cmd = req->hba_private;
1702     uint8_t *buf;
1703     uint32_t opcode;
1704 
1705     trace_megasas_io_complete(cmd->index, len);
1706 
1707     if (cmd->frame->header.frame_cmd != MFI_CMD_DCMD) {
1708         scsi_req_continue(req);
1709         return;
1710     }
1711 
1712     buf = scsi_req_get_buf(req);
1713     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1714     if (opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) {
1715         struct mfi_pd_info *info = cmd->iov_buf;
1716 
1717         if (info->inquiry_data[0] == 0x7f) {
1718             memset(info->inquiry_data, 0, sizeof(info->inquiry_data));
1719             memcpy(info->inquiry_data, buf, len);
1720         } else if (info->vpd_page83[0] == 0x7f) {
1721             memset(info->vpd_page83, 0, sizeof(info->vpd_page83));
1722             memcpy(info->vpd_page83, buf, len);
1723         }
1724         scsi_req_continue(req);
1725     } else if (opcode == MFI_DCMD_LD_GET_INFO) {
1726         struct mfi_ld_info *info = cmd->iov_buf;
1727 
1728         if (cmd->iov_buf) {
1729             memcpy(info->vpd_page83, buf, sizeof(info->vpd_page83));
1730             scsi_req_continue(req);
1731         }
1732     }
1733 }
1734 
1735 static void megasas_command_complete(SCSIRequest *req, uint32_t status,
1736                                      size_t resid)
1737 {
1738     MegasasCmd *cmd = req->hba_private;
1739     uint8_t cmd_status = MFI_STAT_OK;
1740 
1741     trace_megasas_command_complete(cmd->index, status, resid);
1742 
1743     if (cmd->req != req) {
1744         /*
1745          * Internal command complete
1746          */
1747         cmd_status = megasas_finish_internal_command(cmd, req, resid);
1748         if (cmd_status == MFI_STAT_INVALID_STATUS) {
1749             return;
1750         }
1751     } else {
1752         req->status = status;
1753         trace_megasas_scsi_complete(cmd->index, req->status,
1754                                     cmd->iov_size, req->cmd.xfer);
1755         if (req->status != GOOD) {
1756             cmd_status = MFI_STAT_SCSI_DONE_WITH_ERROR;
1757         }
1758         if (req->status == CHECK_CONDITION) {
1759             megasas_copy_sense(cmd);
1760         }
1761 
1762         megasas_unmap_sgl(cmd);
1763         cmd->frame->header.scsi_status = req->status;
1764         scsi_req_unref(cmd->req);
1765         cmd->req = NULL;
1766     }
1767     cmd->frame->header.cmd_status = cmd_status;
1768     megasas_complete_frame(cmd->state, cmd->context);
1769 }
1770 
1771 static void megasas_command_cancel(SCSIRequest *req)
1772 {
1773     MegasasCmd *cmd = req->hba_private;
1774 
1775     if (cmd) {
1776         megasas_abort_command(cmd);
1777     } else {
1778         scsi_req_unref(req);
1779     }
1780 }
1781 
1782 static int megasas_handle_abort(MegasasState *s, MegasasCmd *cmd)
1783 {
1784     uint64_t abort_ctx = le64_to_cpu(cmd->frame->abort.abort_context);
1785     hwaddr abort_addr, addr_hi, addr_lo;
1786     MegasasCmd *abort_cmd;
1787 
1788     addr_hi = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_hi);
1789     addr_lo = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_lo);
1790     abort_addr = ((uint64_t)addr_hi << 32) | addr_lo;
1791 
1792     abort_cmd = megasas_lookup_frame(s, abort_addr);
1793     if (!abort_cmd) {
1794         trace_megasas_abort_no_cmd(cmd->index, abort_ctx);
1795         s->event_count++;
1796         return MFI_STAT_OK;
1797     }
1798     if (!megasas_use_queue64(s)) {
1799         abort_ctx &= (uint64_t)0xFFFFFFFF;
1800     }
1801     if (abort_cmd->context != abort_ctx) {
1802         trace_megasas_abort_invalid_context(cmd->index, abort_cmd->index,
1803                                             abort_cmd->context);
1804         s->event_count++;
1805         return MFI_STAT_ABORT_NOT_POSSIBLE;
1806     }
1807     trace_megasas_abort_frame(cmd->index, abort_cmd->index);
1808     megasas_abort_command(abort_cmd);
1809     if (!s->event_cmd || abort_cmd != s->event_cmd) {
1810         s->event_cmd = NULL;
1811     }
1812     s->event_count++;
1813     return MFI_STAT_OK;
1814 }
1815 
1816 static void megasas_handle_frame(MegasasState *s, uint64_t frame_addr,
1817                                  uint32_t frame_count)
1818 {
1819     uint8_t frame_status = MFI_STAT_INVALID_CMD;
1820     uint64_t frame_context;
1821     MegasasCmd *cmd;
1822 
1823     /*
1824      * Always read 64bit context, top bits will be
1825      * masked out if required in megasas_enqueue_frame()
1826      */
1827     frame_context = megasas_frame_get_context(frame_addr);
1828 
1829     cmd = megasas_enqueue_frame(s, frame_addr, frame_context, frame_count);
1830     if (!cmd) {
1831         /* reply queue full */
1832         trace_megasas_frame_busy(frame_addr);
1833         megasas_frame_set_scsi_status(frame_addr, BUSY);
1834         megasas_frame_set_cmd_status(frame_addr, MFI_STAT_SCSI_DONE_WITH_ERROR);
1835         megasas_complete_frame(s, frame_context);
1836         s->event_count++;
1837         return;
1838     }
1839     switch (cmd->frame->header.frame_cmd) {
1840     case MFI_CMD_INIT:
1841         frame_status = megasas_init_firmware(s, cmd);
1842         break;
1843     case MFI_CMD_DCMD:
1844         frame_status = megasas_handle_dcmd(s, cmd);
1845         break;
1846     case MFI_CMD_ABORT:
1847         frame_status = megasas_handle_abort(s, cmd);
1848         break;
1849     case MFI_CMD_PD_SCSI_IO:
1850         frame_status = megasas_handle_scsi(s, cmd, 0);
1851         break;
1852     case MFI_CMD_LD_SCSI_IO:
1853         frame_status = megasas_handle_scsi(s, cmd, 1);
1854         break;
1855     case MFI_CMD_LD_READ:
1856     case MFI_CMD_LD_WRITE:
1857         frame_status = megasas_handle_io(s, cmd);
1858         break;
1859     default:
1860         trace_megasas_unhandled_frame_cmd(cmd->index,
1861                                           cmd->frame->header.frame_cmd);
1862         s->event_count++;
1863         break;
1864     }
1865     if (frame_status != MFI_STAT_INVALID_STATUS) {
1866         if (cmd->frame) {
1867             cmd->frame->header.cmd_status = frame_status;
1868         } else {
1869             megasas_frame_set_cmd_status(frame_addr, frame_status);
1870         }
1871         megasas_complete_frame(s, cmd->context);
1872     }
1873 }
1874 
1875 static uint64_t megasas_mmio_read(void *opaque, hwaddr addr,
1876                                   unsigned size)
1877 {
1878     MegasasState *s = opaque;
1879     uint32_t retval = 0;
1880 
1881     switch (addr) {
1882     case MFI_IDB:
1883         retval = 0;
1884         break;
1885     case MFI_OMSG0:
1886     case MFI_OSP0:
1887         retval = (megasas_use_msix(s) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |
1888             (s->fw_state & MFI_FWSTATE_MASK) |
1889             ((s->fw_sge & 0xff) << 16) |
1890             (s->fw_cmds & 0xFFFF);
1891         break;
1892     case MFI_OSTS:
1893         if (megasas_intr_enabled(s) && s->doorbell) {
1894             retval = MFI_1078_RM | 1;
1895         }
1896         break;
1897     case MFI_OMSK:
1898         retval = s->intr_mask;
1899         break;
1900     case MFI_ODCR0:
1901         retval = s->doorbell;
1902         break;
1903     default:
1904         trace_megasas_mmio_invalid_readl(addr);
1905         break;
1906     }
1907     trace_megasas_mmio_readl(addr, retval);
1908     return retval;
1909 }
1910 
1911 static void megasas_mmio_write(void *opaque, hwaddr addr,
1912                                uint64_t val, unsigned size)
1913 {
1914     MegasasState *s = opaque;
1915     PCIDevice *pci_dev = PCI_DEVICE(s);
1916     uint64_t frame_addr;
1917     uint32_t frame_count;
1918     int i;
1919 
1920     trace_megasas_mmio_writel(addr, val);
1921     switch (addr) {
1922     case MFI_IDB:
1923         if (val & MFI_FWINIT_ABORT) {
1924             /* Abort all pending cmds */
1925             for (i = 0; i < s->fw_cmds; i++) {
1926                 megasas_abort_command(&s->frames[i]);
1927             }
1928         }
1929         if (val & MFI_FWINIT_READY) {
1930             /* move to FW READY */
1931             megasas_soft_reset(s);
1932         }
1933         if (val & MFI_FWINIT_MFIMODE) {
1934             /* discard MFIs */
1935         }
1936         break;
1937     case MFI_OMSK:
1938         s->intr_mask = val;
1939         if (!megasas_intr_enabled(s) && !msix_enabled(pci_dev)) {
1940             trace_megasas_irq_lower();
1941             pci_irq_deassert(pci_dev);
1942         }
1943         if (megasas_intr_enabled(s)) {
1944             trace_megasas_intr_enabled();
1945         } else {
1946             trace_megasas_intr_disabled();
1947         }
1948         break;
1949     case MFI_ODCR0:
1950         s->doorbell = 0;
1951         if (s->producer_pa && megasas_intr_enabled(s)) {
1952             /* Update reply queue pointer */
1953             trace_megasas_qf_update(s->reply_queue_head, s->busy);
1954             stl_le_phys(s->producer_pa, s->reply_queue_head);
1955             if (!msix_enabled(pci_dev)) {
1956                 trace_megasas_irq_lower();
1957                 pci_irq_deassert(pci_dev);
1958             }
1959         }
1960         break;
1961     case MFI_IQPH:
1962         /* Received high 32 bits of a 64 bit MFI frame address */
1963         s->frame_hi = val;
1964         break;
1965     case MFI_IQPL:
1966         /* Received low 32 bits of a 64 bit MFI frame address */
1967     case MFI_IQP:
1968         /* Received 32 bit MFI frame address */
1969         frame_addr = (val & ~0x1F);
1970         /* Add possible 64 bit offset */
1971         frame_addr |= ((uint64_t)s->frame_hi << 32);
1972         s->frame_hi = 0;
1973         frame_count = (val >> 1) & 0xF;
1974         megasas_handle_frame(s, frame_addr, frame_count);
1975         break;
1976     default:
1977         trace_megasas_mmio_invalid_writel(addr, val);
1978         break;
1979     }
1980 }
1981 
1982 static const MemoryRegionOps megasas_mmio_ops = {
1983     .read = megasas_mmio_read,
1984     .write = megasas_mmio_write,
1985     .endianness = DEVICE_LITTLE_ENDIAN,
1986     .impl = {
1987         .min_access_size = 8,
1988         .max_access_size = 8,
1989     }
1990 };
1991 
1992 static uint64_t megasas_port_read(void *opaque, hwaddr addr,
1993                                   unsigned size)
1994 {
1995     return megasas_mmio_read(opaque, addr & 0xff, size);
1996 }
1997 
1998 static void megasas_port_write(void *opaque, hwaddr addr,
1999                                uint64_t val, unsigned size)
2000 {
2001     megasas_mmio_write(opaque, addr & 0xff, val, size);
2002 }
2003 
2004 static const MemoryRegionOps megasas_port_ops = {
2005     .read = megasas_port_read,
2006     .write = megasas_port_write,
2007     .endianness = DEVICE_LITTLE_ENDIAN,
2008     .impl = {
2009         .min_access_size = 4,
2010         .max_access_size = 4,
2011     }
2012 };
2013 
2014 static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
2015                                    unsigned size)
2016 {
2017     return 0;
2018 }
2019 
2020 static const MemoryRegionOps megasas_queue_ops = {
2021     .read = megasas_queue_read,
2022     .endianness = DEVICE_LITTLE_ENDIAN,
2023     .impl = {
2024         .min_access_size = 8,
2025         .max_access_size = 8,
2026     }
2027 };
2028 
2029 static void megasas_soft_reset(MegasasState *s)
2030 {
2031     int i;
2032     MegasasCmd *cmd;
2033 
2034     trace_megasas_reset();
2035     for (i = 0; i < s->fw_cmds; i++) {
2036         cmd = &s->frames[i];
2037         megasas_abort_command(cmd);
2038     }
2039     megasas_reset_frames(s);
2040     s->reply_queue_len = s->fw_cmds;
2041     s->reply_queue_pa = 0;
2042     s->consumer_pa = 0;
2043     s->producer_pa = 0;
2044     s->fw_state = MFI_FWSTATE_READY;
2045     s->doorbell = 0;
2046     s->intr_mask = MEGASAS_INTR_DISABLED_MASK;
2047     s->frame_hi = 0;
2048     s->flags &= ~MEGASAS_MASK_USE_QUEUE64;
2049     s->event_count++;
2050     s->boot_event = s->event_count;
2051 }
2052 
2053 static void megasas_scsi_reset(DeviceState *dev)
2054 {
2055     MegasasState *s = MEGASAS(dev);
2056 
2057     megasas_soft_reset(s);
2058 }
2059 
2060 static const VMStateDescription vmstate_megasas = {
2061     .name = "megasas",
2062     .version_id = 0,
2063     .minimum_version_id = 0,
2064     .minimum_version_id_old = 0,
2065     .fields      = (VMStateField[]) {
2066         VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2067 
2068         VMSTATE_INT32(fw_state, MegasasState),
2069         VMSTATE_INT32(intr_mask, MegasasState),
2070         VMSTATE_INT32(doorbell, MegasasState),
2071         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2072         VMSTATE_UINT64(consumer_pa, MegasasState),
2073         VMSTATE_UINT64(producer_pa, MegasasState),
2074         VMSTATE_END_OF_LIST()
2075     }
2076 };
2077 
2078 static void megasas_scsi_uninit(PCIDevice *d)
2079 {
2080     MegasasState *s = MEGASAS(d);
2081 
2082 #ifdef USE_MSIX
2083     msix_uninit(d, &s->mmio_io);
2084 #endif
2085     memory_region_destroy(&s->mmio_io);
2086     memory_region_destroy(&s->port_io);
2087     memory_region_destroy(&s->queue_io);
2088 }
2089 
2090 static const struct SCSIBusInfo megasas_scsi_info = {
2091     .tcq = true,
2092     .max_target = MFI_MAX_LD,
2093     .max_lun = 255,
2094 
2095     .transfer_data = megasas_xfer_complete,
2096     .get_sg_list = megasas_get_sg_list,
2097     .complete = megasas_command_complete,
2098     .cancel = megasas_command_cancel,
2099 };
2100 
2101 static int megasas_scsi_init(PCIDevice *dev)
2102 {
2103     DeviceState *d = DEVICE(dev);
2104     MegasasState *s = MEGASAS(dev);
2105     uint8_t *pci_conf;
2106     int i, bar_type;
2107     Error *err = NULL;
2108 
2109     pci_conf = dev->config;
2110 
2111     /* PCI latency timer = 0 */
2112     pci_conf[PCI_LATENCY_TIMER] = 0;
2113     /* Interrupt pin 1 */
2114     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2115 
2116     memory_region_init_io(&s->mmio_io, OBJECT(s), &megasas_mmio_ops, s,
2117                           "megasas-mmio", 0x4000);
2118     memory_region_init_io(&s->port_io, OBJECT(s), &megasas_port_ops, s,
2119                           "megasas-io", 256);
2120     memory_region_init_io(&s->queue_io, OBJECT(s), &megasas_queue_ops, s,
2121                           "megasas-queue", 0x40000);
2122 
2123 #ifdef USE_MSIX
2124     /* MSI-X support is currently broken */
2125     if (megasas_use_msix(s) &&
2126         msix_init(dev, 15, &s->mmio_io, 0, 0x2000)) {
2127         s->flags &= ~MEGASAS_MASK_USE_MSIX;
2128     }
2129 #else
2130     s->flags &= ~MEGASAS_MASK_USE_MSIX;
2131 #endif
2132 
2133     bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
2134     pci_register_bar(dev, 0, bar_type, &s->mmio_io);
2135     pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
2136     pci_register_bar(dev, 3, bar_type, &s->queue_io);
2137 
2138     if (megasas_use_msix(s)) {
2139         msix_vector_use(dev, 0);
2140     }
2141 
2142     if (!s->sas_addr) {
2143         s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
2144                        IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
2145         s->sas_addr |= (pci_bus_num(dev->bus) << 16);
2146         s->sas_addr |= (PCI_SLOT(dev->devfn) << 8);
2147         s->sas_addr |= PCI_FUNC(dev->devfn);
2148     }
2149     if (!s->hba_serial) {
2150 	s->hba_serial = g_strdup(MEGASAS_HBA_SERIAL);
2151     }
2152     if (s->fw_sge >= MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE) {
2153         s->fw_sge = MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE;
2154     } else if (s->fw_sge >= 128 - MFI_PASS_FRAME_SIZE) {
2155         s->fw_sge = 128 - MFI_PASS_FRAME_SIZE;
2156     } else {
2157         s->fw_sge = 64 - MFI_PASS_FRAME_SIZE;
2158     }
2159     if (s->fw_cmds > MEGASAS_MAX_FRAMES) {
2160         s->fw_cmds = MEGASAS_MAX_FRAMES;
2161     }
2162     trace_megasas_init(s->fw_sge, s->fw_cmds,
2163                        megasas_use_msix(s) ? "MSI-X" : "INTx",
2164                        megasas_is_jbod(s) ? "jbod" : "raid");
2165     s->fw_luns = (MFI_MAX_LD > MAX_SCSI_DEVS) ?
2166         MAX_SCSI_DEVS : MFI_MAX_LD;
2167     s->producer_pa = 0;
2168     s->consumer_pa = 0;
2169     for (i = 0; i < s->fw_cmds; i++) {
2170         s->frames[i].index = i;
2171         s->frames[i].context = -1;
2172         s->frames[i].pa = 0;
2173         s->frames[i].state = s;
2174     }
2175 
2176     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev),
2177                  &megasas_scsi_info, NULL);
2178     if (!d->hotplugged) {
2179         scsi_bus_legacy_handle_cmdline(&s->bus, &err);
2180         if (err != NULL) {
2181             error_free(err);
2182             return -1;
2183         }
2184     }
2185     return 0;
2186 }
2187 
2188 static Property megasas_properties[] = {
2189     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2190                        MEGASAS_DEFAULT_SGE),
2191     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2192                        MEGASAS_DEFAULT_FRAMES),
2193     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2194     DEFINE_PROP_HEX64("sas_address", MegasasState, sas_addr, 0),
2195 #ifdef USE_MSIX
2196     DEFINE_PROP_BIT("use_msix", MegasasState, flags,
2197                     MEGASAS_FLAG_USE_MSIX, false),
2198 #endif
2199     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2200                     MEGASAS_FLAG_USE_JBOD, false),
2201     DEFINE_PROP_END_OF_LIST(),
2202 };
2203 
2204 static void megasas_class_init(ObjectClass *oc, void *data)
2205 {
2206     DeviceClass *dc = DEVICE_CLASS(oc);
2207     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
2208 
2209     pc->init = megasas_scsi_init;
2210     pc->exit = megasas_scsi_uninit;
2211     pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2212     pc->device_id = PCI_DEVICE_ID_LSI_SAS1078;
2213     pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2214     pc->subsystem_id = 0x1013;
2215     pc->class_id = PCI_CLASS_STORAGE_RAID;
2216     dc->props = megasas_properties;
2217     dc->reset = megasas_scsi_reset;
2218     dc->vmsd = &vmstate_megasas;
2219     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2220     dc->desc = "LSI MegaRAID SAS 1078";
2221 }
2222 
2223 static const TypeInfo megasas_info = {
2224     .name  = TYPE_MEGASAS,
2225     .parent = TYPE_PCI_DEVICE,
2226     .instance_size = sizeof(MegasasState),
2227     .class_init = megasas_class_init,
2228 };
2229 
2230 static void megasas_register_types(void)
2231 {
2232     type_register_static(&megasas_info);
2233 }
2234 
2235 type_init(megasas_register_types)
2236