xref: /openbmc/qemu/hw/scsi/megasas.c (revision 2d7fedeb) 
1 /*
2  * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation
3  * Based on the linux driver code at drivers/scsi/megaraid
4  *
5  * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
6  *
7  * This library is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2 of the License, or (at your option) any later version.
11  *
12  * This library is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "qemu/osdep.h"
22 #include "hw/hw.h"
23 #include "hw/pci/pci.h"
24 #include "sysemu/dma.h"
25 #include "sysemu/block-backend.h"
26 #include "hw/pci/msi.h"
27 #include "hw/pci/msix.h"
28 #include "qemu/iov.h"
29 #include "hw/scsi/scsi.h"
30 #include "block/scsi.h"
31 #include "trace.h"
32 
33 #include "mfi.h"
34 
35 #define MEGASAS_VERSION_GEN1 "1.70"
36 #define MEGASAS_VERSION_GEN2 "1.80"
37 #define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */
38 #define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */
39 #define MEGASAS_GEN2_DEFAULT_FRAMES 1008     /* Windows requires this */
40 #define MEGASAS_MAX_SGE 128             /* Firmware limit */
41 #define MEGASAS_DEFAULT_SGE 80
42 #define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */
43 #define MEGASAS_MAX_ARRAYS 128
44 
45 #define MEGASAS_HBA_SERIAL "QEMU123456"
46 #define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
47 #define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
48 
49 #define MEGASAS_FLAG_USE_JBOD      0
50 #define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)
51 #define MEGASAS_FLAG_USE_MSI       1
52 #define MEGASAS_MASK_USE_MSI       (1 << MEGASAS_FLAG_USE_MSI)
53 #define MEGASAS_FLAG_USE_MSIX      2
54 #define MEGASAS_MASK_USE_MSIX      (1 << MEGASAS_FLAG_USE_MSIX)
55 #define MEGASAS_FLAG_USE_QUEUE64   3
56 #define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)
57 
58 static const char *mfi_frame_desc[] = {
59     "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",
60     "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"};
61 
62 typedef struct MegasasCmd {
63     uint32_t index;
64     uint16_t flags;
65     uint16_t count;
66     uint64_t context;
67 
68     hwaddr pa;
69     hwaddr pa_size;
70     union mfi_frame *frame;
71     SCSIRequest *req;
72     QEMUSGList qsg;
73     void *iov_buf;
74     size_t iov_size;
75     size_t iov_offset;
76     struct MegasasState *state;
77 } MegasasCmd;
78 
79 typedef struct MegasasState {
80     /*< private >*/
81     PCIDevice parent_obj;
82     /*< public >*/
83 
84     MemoryRegion mmio_io;
85     MemoryRegion port_io;
86     MemoryRegion queue_io;
87     uint32_t frame_hi;
88 
89     int fw_state;
90     uint32_t fw_sge;
91     uint32_t fw_cmds;
92     uint32_t flags;
93     int fw_luns;
94     int intr_mask;
95     int doorbell;
96     int busy;
97     int diag;
98     int adp_reset;
99 
100     MegasasCmd *event_cmd;
101     int event_locale;
102     int event_class;
103     int event_count;
104     int shutdown_event;
105     int boot_event;
106 
107     uint64_t sas_addr;
108     char *hba_serial;
109 
110     uint64_t reply_queue_pa;
111     void *reply_queue;
112     int reply_queue_len;
113     int reply_queue_head;
114     int reply_queue_tail;
115     uint64_t consumer_pa;
116     uint64_t producer_pa;
117 
118     MegasasCmd frames[MEGASAS_MAX_FRAMES];
119     DECLARE_BITMAP(frame_map, MEGASAS_MAX_FRAMES);
120     SCSIBus bus;
121 } MegasasState;
122 
123 typedef struct MegasasBaseClass {
124     PCIDeviceClass parent_class;
125     const char *product_name;
126     const char *product_version;
127     int mmio_bar;
128     int ioport_bar;
129     int osts;
130 } MegasasBaseClass;
131 
132 #define TYPE_MEGASAS_BASE "megasas-base"
133 #define TYPE_MEGASAS_GEN1 "megasas"
134 #define TYPE_MEGASAS_GEN2 "megasas-gen2"
135 
136 #define MEGASAS(obj) \
137     OBJECT_CHECK(MegasasState, (obj), TYPE_MEGASAS_BASE)
138 
139 #define MEGASAS_DEVICE_CLASS(oc) \
140     OBJECT_CLASS_CHECK(MegasasBaseClass, (oc), TYPE_MEGASAS_BASE)
141 #define MEGASAS_DEVICE_GET_CLASS(oc) \
142     OBJECT_GET_CLASS(MegasasBaseClass, (oc), TYPE_MEGASAS_BASE)
143 
144 #define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
145 
146 static bool megasas_intr_enabled(MegasasState *s)
147 {
148     if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=
149         MEGASAS_INTR_DISABLED_MASK) {
150         return true;
151     }
152     return false;
153 }
154 
155 static bool megasas_use_queue64(MegasasState *s)
156 {
157     return s->flags & MEGASAS_MASK_USE_QUEUE64;
158 }
159 
160 static bool megasas_use_msi(MegasasState *s)
161 {
162     return s->flags & MEGASAS_MASK_USE_MSI;
163 }
164 
165 static bool megasas_use_msix(MegasasState *s)
166 {
167     return s->flags & MEGASAS_MASK_USE_MSIX;
168 }
169 
170 static bool megasas_is_jbod(MegasasState *s)
171 {
172     return s->flags & MEGASAS_MASK_USE_JBOD;
173 }
174 
175 static void megasas_frame_set_cmd_status(MegasasState *s,
176                                          unsigned long frame, uint8_t v)
177 {
178     PCIDevice *pci = &s->parent_obj;
179     stb_pci_dma(pci, frame + offsetof(struct mfi_frame_header, cmd_status), v);
180 }
181 
182 static void megasas_frame_set_scsi_status(MegasasState *s,
183                                           unsigned long frame, uint8_t v)
184 {
185     PCIDevice *pci = &s->parent_obj;
186     stb_pci_dma(pci, frame + offsetof(struct mfi_frame_header, scsi_status), v);
187 }
188 
189 /*
190  * Context is considered opaque, but the HBA firmware is running
191  * in little endian mode. So convert it to little endian, too.
192  */
193 static uint64_t megasas_frame_get_context(MegasasState *s,
194                                           unsigned long frame)
195 {
196     PCIDevice *pci = &s->parent_obj;
197     return ldq_le_pci_dma(pci, frame + offsetof(struct mfi_frame_header, context));
198 }
199 
200 static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)
201 {
202     return cmd->flags & MFI_FRAME_IEEE_SGL;
203 }
204 
205 static bool megasas_frame_is_sgl64(MegasasCmd *cmd)
206 {
207     return cmd->flags & MFI_FRAME_SGL64;
208 }
209 
210 static bool megasas_frame_is_sense64(MegasasCmd *cmd)
211 {
212     return cmd->flags & MFI_FRAME_SENSE64;
213 }
214 
215 static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,
216                                      union mfi_sgl *sgl)
217 {
218     uint64_t addr;
219 
220     if (megasas_frame_is_ieee_sgl(cmd)) {
221         addr = le64_to_cpu(sgl->sg_skinny->addr);
222     } else if (megasas_frame_is_sgl64(cmd)) {
223         addr = le64_to_cpu(sgl->sg64->addr);
224     } else {
225         addr = le32_to_cpu(sgl->sg32->addr);
226     }
227     return addr;
228 }
229 
230 static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,
231                                     union mfi_sgl *sgl)
232 {
233     uint32_t len;
234 
235     if (megasas_frame_is_ieee_sgl(cmd)) {
236         len = le32_to_cpu(sgl->sg_skinny->len);
237     } else if (megasas_frame_is_sgl64(cmd)) {
238         len = le32_to_cpu(sgl->sg64->len);
239     } else {
240         len = le32_to_cpu(sgl->sg32->len);
241     }
242     return len;
243 }
244 
245 static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,
246                                        union mfi_sgl *sgl)
247 {
248     uint8_t *next = (uint8_t *)sgl;
249 
250     if (megasas_frame_is_ieee_sgl(cmd)) {
251         next += sizeof(struct mfi_sg_skinny);
252     } else if (megasas_frame_is_sgl64(cmd)) {
253         next += sizeof(struct mfi_sg64);
254     } else {
255         next += sizeof(struct mfi_sg32);
256     }
257 
258     if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {
259         return NULL;
260     }
261     return (union mfi_sgl *)next;
262 }
263 
264 static void megasas_soft_reset(MegasasState *s);
265 
266 static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
267 {
268     int i;
269     int iov_count = 0;
270     size_t iov_size = 0;
271 
272     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
273     iov_count = cmd->frame->header.sge_count;
274     if (iov_count > MEGASAS_MAX_SGE) {
275         trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,
276                                          MEGASAS_MAX_SGE);
277         return iov_count;
278     }
279     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), iov_count);
280     for (i = 0; i < iov_count; i++) {
281         dma_addr_t iov_pa, iov_size_p;
282 
283         if (!sgl) {
284             trace_megasas_iovec_sgl_underflow(cmd->index, i);
285             goto unmap;
286         }
287         iov_pa = megasas_sgl_get_addr(cmd, sgl);
288         iov_size_p = megasas_sgl_get_len(cmd, sgl);
289         if (!iov_pa || !iov_size_p) {
290             trace_megasas_iovec_sgl_invalid(cmd->index, i,
291                                             iov_pa, iov_size_p);
292             goto unmap;
293         }
294         qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);
295         sgl = megasas_sgl_next(cmd, sgl);
296         iov_size += (size_t)iov_size_p;
297     }
298     if (cmd->iov_size > iov_size) {
299         trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
300     } else if (cmd->iov_size < iov_size) {
301         trace_megasas_iovec_underflow(cmd->iov_size, iov_size, cmd->iov_size);
302     }
303     cmd->iov_offset = 0;
304     return 0;
305 unmap:
306     qemu_sglist_destroy(&cmd->qsg);
307     return iov_count - i;
308 }
309 
310 static void megasas_unmap_sgl(MegasasCmd *cmd)
311 {
312     qemu_sglist_destroy(&cmd->qsg);
313     cmd->iov_offset = 0;
314 }
315 
316 /*
317  * passthrough sense and io sense are at the same offset
318  */
319 static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,
320     uint8_t sense_len)
321 {
322     PCIDevice *pcid = PCI_DEVICE(cmd->state);
323     uint32_t pa_hi = 0, pa_lo;
324     hwaddr pa;
325 
326     if (sense_len > cmd->frame->header.sense_len) {
327         sense_len = cmd->frame->header.sense_len;
328     }
329     if (sense_len) {
330         pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);
331         if (megasas_frame_is_sense64(cmd)) {
332             pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);
333         }
334         pa = ((uint64_t) pa_hi << 32) | pa_lo;
335         pci_dma_write(pcid, pa, sense_ptr, sense_len);
336         cmd->frame->header.sense_len = sense_len;
337     }
338     return sense_len;
339 }
340 
341 static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)
342 {
343     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
344     uint8_t sense_len = 18;
345 
346     memset(sense_buf, 0, sense_len);
347     sense_buf[0] = 0xf0;
348     sense_buf[2] = sense.key;
349     sense_buf[7] = 10;
350     sense_buf[12] = sense.asc;
351     sense_buf[13] = sense.ascq;
352     megasas_build_sense(cmd, sense_buf, sense_len);
353 }
354 
355 static void megasas_copy_sense(MegasasCmd *cmd)
356 {
357     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
358     uint8_t sense_len;
359 
360     sense_len = scsi_req_get_sense(cmd->req, sense_buf,
361                                    SCSI_SENSE_BUF_SIZE);
362     megasas_build_sense(cmd, sense_buf, sense_len);
363 }
364 
365 /*
366  * Format an INQUIRY CDB
367  */
368 static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)
369 {
370     memset(cdb, 0, 6);
371     cdb[0] = INQUIRY;
372     if (pg > 0) {
373         cdb[1] = 0x1;
374         cdb[2] = pg;
375     }
376     cdb[3] = (len >> 8) & 0xff;
377     cdb[4] = (len & 0xff);
378     return len;
379 }
380 
381 /*
382  * Encode lba and len into a READ_16/WRITE_16 CDB
383  */
384 static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,
385                                uint32_t len, bool is_write)
386 {
387     memset(cdb, 0x0, 16);
388     if (is_write) {
389         cdb[0] = WRITE_16;
390     } else {
391         cdb[0] = READ_16;
392     }
393     cdb[2] = (lba >> 56) & 0xff;
394     cdb[3] = (lba >> 48) & 0xff;
395     cdb[4] = (lba >> 40) & 0xff;
396     cdb[5] = (lba >> 32) & 0xff;
397     cdb[6] = (lba >> 24) & 0xff;
398     cdb[7] = (lba >> 16) & 0xff;
399     cdb[8] = (lba >> 8) & 0xff;
400     cdb[9] = (lba) & 0xff;
401     cdb[10] = (len >> 24) & 0xff;
402     cdb[11] = (len >> 16) & 0xff;
403     cdb[12] = (len >> 8) & 0xff;
404     cdb[13] = (len) & 0xff;
405 }
406 
407 /*
408  * Utility functions
409  */
410 static uint64_t megasas_fw_time(void)
411 {
412     struct tm curtime;
413     uint64_t bcd_time;
414 
415     qemu_get_timedate(&curtime, 0);
416     bcd_time = ((uint64_t)curtime.tm_sec & 0xff) << 48 |
417         ((uint64_t)curtime.tm_min & 0xff)  << 40 |
418         ((uint64_t)curtime.tm_hour & 0xff) << 32 |
419         ((uint64_t)curtime.tm_mday & 0xff) << 24 |
420         ((uint64_t)curtime.tm_mon & 0xff)  << 16 |
421         ((uint64_t)(curtime.tm_year + 1900) & 0xffff);
422 
423     return bcd_time;
424 }
425 
426 /*
427  * Default disk sata address
428  * 0x1221 is the magic number as
429  * present in real hardware,
430  * so use it here, too.
431  */
432 static uint64_t megasas_get_sata_addr(uint16_t id)
433 {
434     uint64_t addr = (0x1221ULL << 48);
435     return addr | ((uint64_t)id << 24);
436 }
437 
438 /*
439  * Frame handling
440  */
441 static int megasas_next_index(MegasasState *s, int index, int limit)
442 {
443     index++;
444     if (index == limit) {
445         index = 0;
446     }
447     return index;
448 }
449 
450 static MegasasCmd *megasas_lookup_frame(MegasasState *s,
451     hwaddr frame)
452 {
453     MegasasCmd *cmd = NULL;
454     int num = 0, index;
455 
456     index = s->reply_queue_head;
457 
458     while (num < s->fw_cmds) {
459         if (s->frames[index].pa && s->frames[index].pa == frame) {
460             cmd = &s->frames[index];
461             break;
462         }
463         index = megasas_next_index(s, index, s->fw_cmds);
464         num++;
465     }
466 
467     return cmd;
468 }
469 
470 static void megasas_unmap_frame(MegasasState *s, MegasasCmd *cmd)
471 {
472     PCIDevice *p = PCI_DEVICE(s);
473 
474     pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0);
475     cmd->frame = NULL;
476     cmd->pa = 0;
477     clear_bit(cmd->index, s->frame_map);
478 }
479 
480 /*
481  * This absolutely needs to be locked if
482  * qemu ever goes multithreaded.
483  */
484 static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
485     hwaddr frame, uint64_t context, int count)
486 {
487     PCIDevice *pcid = PCI_DEVICE(s);
488     MegasasCmd *cmd = NULL;
489     int frame_size = MFI_FRAME_SIZE * 16;
490     hwaddr frame_size_p = frame_size;
491     unsigned long index;
492 
493     index = 0;
494     while (index < s->fw_cmds) {
495         index = find_next_zero_bit(s->frame_map, s->fw_cmds, index);
496         if (!s->frames[index].pa)
497             break;
498         /* Busy frame found */
499         trace_megasas_qf_mapped(index);
500     }
501     if (index >= s->fw_cmds) {
502         /* All frames busy */
503         trace_megasas_qf_busy(frame);
504         return NULL;
505     }
506     cmd = &s->frames[index];
507     set_bit(index, s->frame_map);
508     trace_megasas_qf_new(index, frame);
509 
510     cmd->pa = frame;
511     /* Map all possible frames */
512     cmd->frame = pci_dma_map(pcid, frame, &frame_size_p, 0);
513     if (frame_size_p != frame_size) {
514         trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
515         if (cmd->frame) {
516             megasas_unmap_frame(s, cmd);
517         }
518         s->event_count++;
519         return NULL;
520     }
521     cmd->pa_size = frame_size_p;
522     cmd->context = context;
523     if (!megasas_use_queue64(s)) {
524         cmd->context &= (uint64_t)0xFFFFFFFF;
525     }
526     cmd->count = count;
527     s->busy++;
528 
529     if (s->consumer_pa) {
530         s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa);
531     }
532     trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,
533                              s->reply_queue_head, s->reply_queue_tail, s->busy);
534 
535     return cmd;
536 }
537 
538 static void megasas_complete_frame(MegasasState *s, uint64_t context)
539 {
540     PCIDevice *pci_dev = PCI_DEVICE(s);
541     int tail, queue_offset;
542 
543     /* Decrement busy count */
544     s->busy--;
545     if (s->reply_queue_pa) {
546         /*
547          * Put command on the reply queue.
548          * Context is opaque, but emulation is running in
549          * little endian. So convert it.
550          */
551         if (megasas_use_queue64(s)) {
552             queue_offset = s->reply_queue_head * sizeof(uint64_t);
553             stq_le_pci_dma(pci_dev, s->reply_queue_pa + queue_offset, context);
554         } else {
555             queue_offset = s->reply_queue_head * sizeof(uint32_t);
556             stl_le_pci_dma(pci_dev, s->reply_queue_pa + queue_offset, context);
557         }
558         s->reply_queue_tail = ldl_le_pci_dma(pci_dev, s->consumer_pa);
559         trace_megasas_qf_complete(context, s->reply_queue_head,
560                                   s->reply_queue_tail, s->busy);
561     }
562 
563     if (megasas_intr_enabled(s)) {
564         /* Update reply queue pointer */
565         s->reply_queue_tail = ldl_le_pci_dma(pci_dev, s->consumer_pa);
566         tail = s->reply_queue_head;
567         s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
568         trace_megasas_qf_update(s->reply_queue_head, s->reply_queue_tail,
569                                 s->busy);
570         stl_le_pci_dma(pci_dev, s->producer_pa, s->reply_queue_head);
571         /* Notify HBA */
572         if (msix_enabled(pci_dev)) {
573             trace_megasas_msix_raise(0);
574             msix_notify(pci_dev, 0);
575         } else if (msi_enabled(pci_dev)) {
576             trace_megasas_msi_raise(0);
577             msi_notify(pci_dev, 0);
578         } else {
579             s->doorbell++;
580             if (s->doorbell == 1) {
581                 trace_megasas_irq_raise();
582                 pci_irq_assert(pci_dev);
583             }
584         }
585     } else {
586         trace_megasas_qf_complete_noirq(context);
587     }
588 }
589 
590 static void megasas_reset_frames(MegasasState *s)
591 {
592     int i;
593     MegasasCmd *cmd;
594 
595     for (i = 0; i < s->fw_cmds; i++) {
596         cmd = &s->frames[i];
597         if (cmd->pa) {
598             megasas_unmap_frame(s, cmd);
599         }
600     }
601     bitmap_zero(s->frame_map, MEGASAS_MAX_FRAMES);
602 }
603 
604 static void megasas_abort_command(MegasasCmd *cmd)
605 {
606     if (cmd->req) {
607         scsi_req_cancel(cmd->req);
608         cmd->req = NULL;
609     }
610 }
611 
612 static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
613 {
614     PCIDevice *pcid = PCI_DEVICE(s);
615     uint32_t pa_hi, pa_lo;
616     hwaddr iq_pa, initq_size = sizeof(struct mfi_init_qinfo);
617     struct mfi_init_qinfo *initq = NULL;
618     uint32_t flags;
619     int ret = MFI_STAT_OK;
620 
621     if (s->reply_queue_pa) {
622         trace_megasas_initq_mapped(s->reply_queue_pa);
623         goto out;
624     }
625     pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);
626     pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);
627     iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);
628     trace_megasas_init_firmware((uint64_t)iq_pa);
629     initq = pci_dma_map(pcid, iq_pa, &initq_size, 0);
630     if (!initq || initq_size != sizeof(*initq)) {
631         trace_megasas_initq_map_failed(cmd->index);
632         s->event_count++;
633         ret = MFI_STAT_MEMORY_NOT_AVAILABLE;
634         goto out;
635     }
636     s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;
637     if (s->reply_queue_len > s->fw_cmds) {
638         trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);
639         s->event_count++;
640         ret = MFI_STAT_INVALID_PARAMETER;
641         goto out;
642     }
643     pa_lo = le32_to_cpu(initq->rq_addr_lo);
644     pa_hi = le32_to_cpu(initq->rq_addr_hi);
645     s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;
646     pa_lo = le32_to_cpu(initq->ci_addr_lo);
647     pa_hi = le32_to_cpu(initq->ci_addr_hi);
648     s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
649     pa_lo = le32_to_cpu(initq->pi_addr_lo);
650     pa_hi = le32_to_cpu(initq->pi_addr_hi);
651     s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
652     s->reply_queue_head = ldl_le_pci_dma(pcid, s->producer_pa);
653     s->reply_queue_head %= MEGASAS_MAX_FRAMES;
654     s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa);
655     s->reply_queue_tail %= MEGASAS_MAX_FRAMES;
656     flags = le32_to_cpu(initq->flags);
657     if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
658         s->flags |= MEGASAS_MASK_USE_QUEUE64;
659     }
660     trace_megasas_init_queue((unsigned long)s->reply_queue_pa,
661                              s->reply_queue_len, s->reply_queue_head,
662                              s->reply_queue_tail, flags);
663     megasas_reset_frames(s);
664     s->fw_state = MFI_FWSTATE_OPERATIONAL;
665 out:
666     if (initq) {
667         pci_dma_unmap(pcid, initq, initq_size, 0, 0);
668     }
669     return ret;
670 }
671 
672 static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
673 {
674     dma_addr_t iov_pa, iov_size;
675 
676     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
677     if (!cmd->frame->header.sge_count) {
678         trace_megasas_dcmd_zero_sge(cmd->index);
679         cmd->iov_size = 0;
680         return 0;
681     } else if (cmd->frame->header.sge_count > 1) {
682         trace_megasas_dcmd_invalid_sge(cmd->index,
683                                        cmd->frame->header.sge_count);
684         cmd->iov_size = 0;
685         return -1;
686     }
687     iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
688     iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
689     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), 1);
690     qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
691     cmd->iov_size = iov_size;
692     return cmd->iov_size;
693 }
694 
695 static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
696 {
697     trace_megasas_finish_dcmd(cmd->index, iov_size);
698 
699     if (cmd->frame->header.sge_count) {
700         qemu_sglist_destroy(&cmd->qsg);
701     }
702     if (iov_size > cmd->iov_size) {
703         if (megasas_frame_is_ieee_sgl(cmd)) {
704             cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);
705         } else if (megasas_frame_is_sgl64(cmd)) {
706             cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);
707         } else {
708             cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);
709         }
710     }
711     cmd->iov_size = 0;
712 }
713 
714 static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
715 {
716     PCIDevice *pci_dev = PCI_DEVICE(s);
717     PCIDeviceClass *pci_class = PCI_DEVICE_GET_CLASS(pci_dev);
718     MegasasBaseClass *base_class = MEGASAS_DEVICE_GET_CLASS(s);
719     struct mfi_ctrl_info info;
720     size_t dcmd_size = sizeof(info);
721     BusChild *kid;
722     int num_pd_disks = 0;
723 
724     memset(&info, 0x0, dcmd_size);
725     if (cmd->iov_size < dcmd_size) {
726         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
727                                             dcmd_size);
728         return MFI_STAT_INVALID_PARAMETER;
729     }
730 
731     info.pci.vendor = cpu_to_le16(pci_class->vendor_id);
732     info.pci.device = cpu_to_le16(pci_class->device_id);
733     info.pci.subvendor = cpu_to_le16(pci_class->subsystem_vendor_id);
734     info.pci.subdevice = cpu_to_le16(pci_class->subsystem_id);
735 
736     /*
737      * For some reason the firmware supports
738      * only up to 8 device ports.
739      * Despite supporting a far larger number
740      * of devices for the physical devices.
741      * So just display the first 8 devices
742      * in the device port list, independent
743      * of how many logical devices are actually
744      * present.
745      */
746     info.host.type = MFI_INFO_HOST_PCIE;
747     info.device.type = MFI_INFO_DEV_SAS3G;
748     info.device.port_count = 8;
749     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
750         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
751         uint16_t pd_id;
752 
753         if (num_pd_disks < 8) {
754             pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
755             info.device.port_addr[num_pd_disks] =
756                 cpu_to_le64(megasas_get_sata_addr(pd_id));
757         }
758         num_pd_disks++;
759     }
760 
761     memcpy(info.product_name, base_class->product_name, 24);
762     snprintf(info.serial_number, 32, "%s", s->hba_serial);
763     snprintf(info.package_version, 0x60, "%s-QEMU", qemu_hw_version());
764     memcpy(info.image_component[0].name, "APP", 3);
765     snprintf(info.image_component[0].version, 10, "%s-QEMU",
766              base_class->product_version);
767     memcpy(info.image_component[0].build_date, "Apr  1 2014", 11);
768     memcpy(info.image_component[0].build_time, "12:34:56", 8);
769     info.image_component_count = 1;
770     if (pci_dev->has_rom) {
771         uint8_t biosver[32];
772         uint8_t *ptr;
773 
774         ptr = memory_region_get_ram_ptr(&pci_dev->rom);
775         memcpy(biosver, ptr + 0x41, 31);
776         memcpy(info.image_component[1].name, "BIOS", 4);
777         memcpy(info.image_component[1].version, biosver,
778                strlen((const char *)biosver));
779         info.image_component_count++;
780     }
781     info.current_fw_time = cpu_to_le32(megasas_fw_time());
782     info.max_arms = 32;
783     info.max_spans = 8;
784     info.max_arrays = MEGASAS_MAX_ARRAYS;
785     info.max_lds = MFI_MAX_LD;
786     info.max_cmds = cpu_to_le16(s->fw_cmds);
787     info.max_sg_elements = cpu_to_le16(s->fw_sge);
788     info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);
789     if (!megasas_is_jbod(s))
790         info.lds_present = cpu_to_le16(num_pd_disks);
791     info.pd_present = cpu_to_le16(num_pd_disks);
792     info.pd_disks_present = cpu_to_le16(num_pd_disks);
793     info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |
794                                    MFI_INFO_HW_MEM |
795                                    MFI_INFO_HW_FLASH);
796     info.memory_size = cpu_to_le16(512);
797     info.nvram_size = cpu_to_le16(32);
798     info.flash_size = cpu_to_le16(16);
799     info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);
800     info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |
801                                     MFI_INFO_AOPS_SELF_DIAGNOSTIC |
802                                     MFI_INFO_AOPS_MIXED_ARRAY);
803     info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |
804                                MFI_INFO_LDOPS_ACCESS_POLICY |
805                                MFI_INFO_LDOPS_IO_POLICY |
806                                MFI_INFO_LDOPS_WRITE_POLICY |
807                                MFI_INFO_LDOPS_READ_POLICY);
808     info.max_strips_per_io = cpu_to_le16(s->fw_sge);
809     info.stripe_sz_ops.min = 3;
810     info.stripe_sz_ops.max = ctz32(MEGASAS_MAX_SECTORS + 1);
811     info.properties.pred_fail_poll_interval = cpu_to_le16(300);
812     info.properties.intr_throttle_cnt = cpu_to_le16(16);
813     info.properties.intr_throttle_timeout = cpu_to_le16(50);
814     info.properties.rebuild_rate = 30;
815     info.properties.patrol_read_rate = 30;
816     info.properties.bgi_rate = 30;
817     info.properties.cc_rate = 30;
818     info.properties.recon_rate = 30;
819     info.properties.cache_flush_interval = 4;
820     info.properties.spinup_drv_cnt = 2;
821     info.properties.spinup_delay = 6;
822     info.properties.ecc_bucket_size = 15;
823     info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);
824     info.properties.expose_encl_devices = 1;
825     info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);
826     info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |
827                                MFI_INFO_PDOPS_FORCE_OFFLINE);
828     info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |
829                                        MFI_INFO_PDMIX_SATA |
830                                        MFI_INFO_PDMIX_LD);
831 
832     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
833     return MFI_STAT_OK;
834 }
835 
836 static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)
837 {
838     struct mfi_defaults info;
839     size_t dcmd_size = sizeof(struct mfi_defaults);
840 
841     memset(&info, 0x0, dcmd_size);
842     if (cmd->iov_size < dcmd_size) {
843         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
844                                             dcmd_size);
845         return MFI_STAT_INVALID_PARAMETER;
846     }
847 
848     info.sas_addr = cpu_to_le64(s->sas_addr);
849     info.stripe_size = 3;
850     info.flush_time = 4;
851     info.background_rate = 30;
852     info.allow_mix_in_enclosure = 1;
853     info.allow_mix_in_ld = 1;
854     info.direct_pd_mapping = 1;
855     /* Enable for BIOS support */
856     info.bios_enumerate_lds = 1;
857     info.disable_ctrl_r = 1;
858     info.expose_enclosure_devices = 1;
859     info.disable_preboot_cli = 1;
860     info.cluster_disable = 1;
861 
862     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
863     return MFI_STAT_OK;
864 }
865 
866 static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)
867 {
868     struct mfi_bios_data info;
869     size_t dcmd_size = sizeof(info);
870 
871     memset(&info, 0x0, dcmd_size);
872     if (cmd->iov_size < dcmd_size) {
873         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
874                                             dcmd_size);
875         return MFI_STAT_INVALID_PARAMETER;
876     }
877     info.continue_on_error = 1;
878     info.verbose = 1;
879     if (megasas_is_jbod(s)) {
880         info.expose_all_drives = 1;
881     }
882 
883     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
884     return MFI_STAT_OK;
885 }
886 
887 static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)
888 {
889     uint64_t fw_time;
890     size_t dcmd_size = sizeof(fw_time);
891 
892     fw_time = cpu_to_le64(megasas_fw_time());
893 
894     cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);
895     return MFI_STAT_OK;
896 }
897 
898 static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)
899 {
900     uint64_t fw_time;
901 
902     /* This is a dummy; setting of firmware time is not allowed */
903     memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));
904 
905     trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);
906     fw_time = cpu_to_le64(megasas_fw_time());
907     return MFI_STAT_OK;
908 }
909 
910 static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)
911 {
912     struct mfi_evt_log_state info;
913     size_t dcmd_size = sizeof(info);
914 
915     memset(&info, 0, dcmd_size);
916 
917     info.newest_seq_num = cpu_to_le32(s->event_count);
918     info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
919     info.boot_seq_num = cpu_to_le32(s->boot_event);
920 
921     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
922     return MFI_STAT_OK;
923 }
924 
925 static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
926 {
927     union mfi_evt event;
928 
929     if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {
930         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
931                                             sizeof(struct mfi_evt_detail));
932         return MFI_STAT_INVALID_PARAMETER;
933     }
934     s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);
935     event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);
936     s->event_locale = event.members.locale;
937     s->event_class = event.members.class;
938     s->event_cmd = cmd;
939     /* Decrease busy count; event frame doesn't count here */
940     s->busy--;
941     cmd->iov_size = sizeof(struct mfi_evt_detail);
942     return MFI_STAT_INVALID_STATUS;
943 }
944 
945 static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
946 {
947     struct mfi_pd_list info;
948     size_t dcmd_size = sizeof(info);
949     BusChild *kid;
950     uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
951 
952     memset(&info, 0, dcmd_size);
953     offset = 8;
954     dcmd_limit = offset + sizeof(struct mfi_pd_address);
955     if (cmd->iov_size < dcmd_limit) {
956         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
957                                             dcmd_limit);
958         return MFI_STAT_INVALID_PARAMETER;
959     }
960 
961     max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);
962     if (max_pd_disks > MFI_MAX_SYS_PDS) {
963         max_pd_disks = MFI_MAX_SYS_PDS;
964     }
965     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
966         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
967         uint16_t pd_id;
968 
969         if (num_pd_disks >= max_pd_disks)
970             break;
971 
972         pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
973         info.addr[num_pd_disks].device_id = cpu_to_le16(pd_id);
974         info.addr[num_pd_disks].encl_device_id = 0xFFFF;
975         info.addr[num_pd_disks].encl_index = 0;
976         info.addr[num_pd_disks].slot_number = sdev->id & 0xFF;
977         info.addr[num_pd_disks].scsi_dev_type = sdev->type;
978         info.addr[num_pd_disks].connect_port_bitmap = 0x1;
979         info.addr[num_pd_disks].sas_addr[0] =
980             cpu_to_le64(megasas_get_sata_addr(pd_id));
981         num_pd_disks++;
982         offset += sizeof(struct mfi_pd_address);
983     }
984     trace_megasas_dcmd_pd_get_list(cmd->index, num_pd_disks,
985                                    max_pd_disks, offset);
986 
987     info.size = cpu_to_le32(offset);
988     info.count = cpu_to_le32(num_pd_disks);
989 
990     cmd->iov_size -= dma_buf_read((uint8_t *)&info, offset, &cmd->qsg);
991     return MFI_STAT_OK;
992 }
993 
994 static int megasas_dcmd_pd_list_query(MegasasState *s, MegasasCmd *cmd)
995 {
996     uint16_t flags;
997 
998     /* mbox0 contains flags */
999     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1000     trace_megasas_dcmd_pd_list_query(cmd->index, flags);
1001     if (flags == MR_PD_QUERY_TYPE_ALL ||
1002         megasas_is_jbod(s)) {
1003         return megasas_dcmd_pd_get_list(s, cmd);
1004     }
1005 
1006     return MFI_STAT_OK;
1007 }
1008 
1009 static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun,
1010                                       MegasasCmd *cmd)
1011 {
1012     struct mfi_pd_info *info = cmd->iov_buf;
1013     size_t dcmd_size = sizeof(struct mfi_pd_info);
1014     uint64_t pd_size;
1015     uint16_t pd_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1016     uint8_t cmdbuf[6];
1017     SCSIRequest *req;
1018     size_t len, resid;
1019 
1020     if (!cmd->iov_buf) {
1021         cmd->iov_buf = g_malloc0(dcmd_size);
1022         info = cmd->iov_buf;
1023         info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */
1024         info->vpd_page83[0] = 0x7f;
1025         megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data));
1026         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1027         if (!req) {
1028             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1029                                                 "PD get info std inquiry");
1030             g_free(cmd->iov_buf);
1031             cmd->iov_buf = NULL;
1032             return MFI_STAT_FLASH_ALLOC_FAIL;
1033         }
1034         trace_megasas_dcmd_internal_submit(cmd->index,
1035                                            "PD get info std inquiry", lun);
1036         len = scsi_req_enqueue(req);
1037         if (len > 0) {
1038             cmd->iov_size = len;
1039             scsi_req_continue(req);
1040         }
1041         return MFI_STAT_INVALID_STATUS;
1042     } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) {
1043         megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83));
1044         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1045         if (!req) {
1046             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1047                                                 "PD get info vpd inquiry");
1048             return MFI_STAT_FLASH_ALLOC_FAIL;
1049         }
1050         trace_megasas_dcmd_internal_submit(cmd->index,
1051                                            "PD get info vpd inquiry", lun);
1052         len = scsi_req_enqueue(req);
1053         if (len > 0) {
1054             cmd->iov_size = len;
1055             scsi_req_continue(req);
1056         }
1057         return MFI_STAT_INVALID_STATUS;
1058     }
1059     /* Finished, set FW state */
1060     if ((info->inquiry_data[0] >> 5) == 0) {
1061         if (megasas_is_jbod(cmd->state)) {
1062             info->fw_state = cpu_to_le16(MFI_PD_STATE_SYSTEM);
1063         } else {
1064             info->fw_state = cpu_to_le16(MFI_PD_STATE_ONLINE);
1065         }
1066     } else {
1067         info->fw_state = cpu_to_le16(MFI_PD_STATE_OFFLINE);
1068     }
1069 
1070     info->ref.v.device_id = cpu_to_le16(pd_id);
1071     info->state.ddf.pd_type = cpu_to_le16(MFI_PD_DDF_TYPE_IN_VD|
1072                                           MFI_PD_DDF_TYPE_INTF_SAS);
1073     blk_get_geometry(sdev->conf.blk, &pd_size);
1074     info->raw_size = cpu_to_le64(pd_size);
1075     info->non_coerced_size = cpu_to_le64(pd_size);
1076     info->coerced_size = cpu_to_le64(pd_size);
1077     info->encl_device_id = 0xFFFF;
1078     info->slot_number = (sdev->id & 0xFF);
1079     info->path_info.count = 1;
1080     info->path_info.sas_addr[0] =
1081         cpu_to_le64(megasas_get_sata_addr(pd_id));
1082     info->connected_port_bitmap = 0x1;
1083     info->device_speed = 1;
1084     info->link_speed = 1;
1085     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1086     g_free(cmd->iov_buf);
1087     cmd->iov_size = dcmd_size - resid;
1088     cmd->iov_buf = NULL;
1089     return MFI_STAT_OK;
1090 }
1091 
1092 static int megasas_dcmd_pd_get_info(MegasasState *s, MegasasCmd *cmd)
1093 {
1094     size_t dcmd_size = sizeof(struct mfi_pd_info);
1095     uint16_t pd_id;
1096     uint8_t target_id, lun_id;
1097     SCSIDevice *sdev = NULL;
1098     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1099 
1100     if (cmd->iov_size < dcmd_size) {
1101         return MFI_STAT_INVALID_PARAMETER;
1102     }
1103 
1104     /* mbox0 has the ID */
1105     pd_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1106     target_id = (pd_id >> 8) & 0xFF;
1107     lun_id = pd_id & 0xFF;
1108     sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
1109     trace_megasas_dcmd_pd_get_info(cmd->index, pd_id);
1110 
1111     if (sdev) {
1112         /* Submit inquiry */
1113         retval = megasas_pd_get_info_submit(sdev, pd_id, cmd);
1114     }
1115 
1116     return retval;
1117 }
1118 
1119 static int megasas_dcmd_ld_get_list(MegasasState *s, MegasasCmd *cmd)
1120 {
1121     struct mfi_ld_list info;
1122     size_t dcmd_size = sizeof(info), resid;
1123     uint32_t num_ld_disks = 0, max_ld_disks;
1124     uint64_t ld_size;
1125     BusChild *kid;
1126 
1127     memset(&info, 0, dcmd_size);
1128     if (cmd->iov_size > dcmd_size) {
1129         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1130                                             dcmd_size);
1131         return MFI_STAT_INVALID_PARAMETER;
1132     }
1133 
1134     max_ld_disks = (cmd->iov_size - 8) / 16;
1135     if (megasas_is_jbod(s)) {
1136         max_ld_disks = 0;
1137     }
1138     if (max_ld_disks > MFI_MAX_LD) {
1139         max_ld_disks = MFI_MAX_LD;
1140     }
1141     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1142         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1143 
1144         if (num_ld_disks >= max_ld_disks) {
1145             break;
1146         }
1147         /* Logical device size is in blocks */
1148         blk_get_geometry(sdev->conf.blk, &ld_size);
1149         info.ld_list[num_ld_disks].ld.v.target_id = sdev->id;
1150         info.ld_list[num_ld_disks].state = MFI_LD_STATE_OPTIMAL;
1151         info.ld_list[num_ld_disks].size = cpu_to_le64(ld_size);
1152         num_ld_disks++;
1153     }
1154     info.ld_count = cpu_to_le32(num_ld_disks);
1155     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1156 
1157     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1158     cmd->iov_size = dcmd_size - resid;
1159     return MFI_STAT_OK;
1160 }
1161 
1162 static int megasas_dcmd_ld_list_query(MegasasState *s, MegasasCmd *cmd)
1163 {
1164     uint16_t flags;
1165     struct mfi_ld_targetid_list info;
1166     size_t dcmd_size = sizeof(info), resid;
1167     uint32_t num_ld_disks = 0, max_ld_disks = s->fw_luns;
1168     BusChild *kid;
1169 
1170     /* mbox0 contains flags */
1171     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1172     trace_megasas_dcmd_ld_list_query(cmd->index, flags);
1173     if (flags != MR_LD_QUERY_TYPE_ALL &&
1174         flags != MR_LD_QUERY_TYPE_EXPOSED_TO_HOST) {
1175         max_ld_disks = 0;
1176     }
1177 
1178     memset(&info, 0, dcmd_size);
1179     if (cmd->iov_size < 12) {
1180         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1181                                             dcmd_size);
1182         return MFI_STAT_INVALID_PARAMETER;
1183     }
1184     dcmd_size = sizeof(uint32_t) * 2 + 3;
1185     max_ld_disks = cmd->iov_size - dcmd_size;
1186     if (megasas_is_jbod(s)) {
1187         max_ld_disks = 0;
1188     }
1189     if (max_ld_disks > MFI_MAX_LD) {
1190         max_ld_disks = MFI_MAX_LD;
1191     }
1192     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1193         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1194 
1195         if (num_ld_disks >= max_ld_disks) {
1196             break;
1197         }
1198         info.targetid[num_ld_disks] = sdev->lun;
1199         num_ld_disks++;
1200         dcmd_size++;
1201     }
1202     info.ld_count = cpu_to_le32(num_ld_disks);
1203     info.size = dcmd_size;
1204     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1205 
1206     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1207     cmd->iov_size = dcmd_size - resid;
1208     return MFI_STAT_OK;
1209 }
1210 
1211 static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun,
1212                                       MegasasCmd *cmd)
1213 {
1214     struct mfi_ld_info *info = cmd->iov_buf;
1215     size_t dcmd_size = sizeof(struct mfi_ld_info);
1216     uint8_t cdb[6];
1217     SCSIRequest *req;
1218     ssize_t len, resid;
1219     uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1220     uint64_t ld_size;
1221 
1222     if (!cmd->iov_buf) {
1223         cmd->iov_buf = g_malloc0(dcmd_size);
1224         info = cmd->iov_buf;
1225         megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83));
1226         req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd);
1227         if (!req) {
1228             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1229                                                 "LD get info vpd inquiry");
1230             g_free(cmd->iov_buf);
1231             cmd->iov_buf = NULL;
1232             return MFI_STAT_FLASH_ALLOC_FAIL;
1233         }
1234         trace_megasas_dcmd_internal_submit(cmd->index,
1235                                            "LD get info vpd inquiry", lun);
1236         len = scsi_req_enqueue(req);
1237         if (len > 0) {
1238             cmd->iov_size = len;
1239             scsi_req_continue(req);
1240         }
1241         return MFI_STAT_INVALID_STATUS;
1242     }
1243 
1244     info->ld_config.params.state = MFI_LD_STATE_OPTIMAL;
1245     info->ld_config.properties.ld.v.target_id = lun;
1246     info->ld_config.params.stripe_size = 3;
1247     info->ld_config.params.num_drives = 1;
1248     info->ld_config.params.is_consistent = 1;
1249     /* Logical device size is in blocks */
1250     blk_get_geometry(sdev->conf.blk, &ld_size);
1251     info->size = cpu_to_le64(ld_size);
1252     memset(info->ld_config.span, 0, sizeof(info->ld_config.span));
1253     info->ld_config.span[0].start_block = 0;
1254     info->ld_config.span[0].num_blocks = info->size;
1255     info->ld_config.span[0].array_ref = cpu_to_le16(sdev_id);
1256 
1257     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1258     g_free(cmd->iov_buf);
1259     cmd->iov_size = dcmd_size - resid;
1260     cmd->iov_buf = NULL;
1261     return MFI_STAT_OK;
1262 }
1263 
1264 static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
1265 {
1266     struct mfi_ld_info info;
1267     size_t dcmd_size = sizeof(info);
1268     uint16_t ld_id;
1269     uint32_t max_ld_disks = s->fw_luns;
1270     SCSIDevice *sdev = NULL;
1271     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1272 
1273     if (cmd->iov_size < dcmd_size) {
1274         return MFI_STAT_INVALID_PARAMETER;
1275     }
1276 
1277     /* mbox0 has the ID */
1278     ld_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1279     trace_megasas_dcmd_ld_get_info(cmd->index, ld_id);
1280 
1281     if (megasas_is_jbod(s)) {
1282         return MFI_STAT_DEVICE_NOT_FOUND;
1283     }
1284 
1285     if (ld_id < max_ld_disks) {
1286         sdev = scsi_device_find(&s->bus, 0, ld_id, 0);
1287     }
1288 
1289     if (sdev) {
1290         retval = megasas_ld_get_info_submit(sdev, ld_id, cmd);
1291     }
1292 
1293     return retval;
1294 }
1295 
1296 static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
1297 {
1298     uint8_t data[4096] = { 0 };
1299     struct mfi_config_data *info;
1300     int num_pd_disks = 0, array_offset, ld_offset;
1301     BusChild *kid;
1302 
1303     if (cmd->iov_size > 4096) {
1304         return MFI_STAT_INVALID_PARAMETER;
1305     }
1306 
1307     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1308         num_pd_disks++;
1309     }
1310     info = (struct mfi_config_data *)&data;
1311     /*
1312      * Array mapping:
1313      * - One array per SCSI device
1314      * - One logical drive per SCSI device
1315      *   spanning the entire device
1316      */
1317     info->array_count = num_pd_disks;
1318     info->array_size = sizeof(struct mfi_array) * num_pd_disks;
1319     info->log_drv_count = num_pd_disks;
1320     info->log_drv_size = sizeof(struct mfi_ld_config) * num_pd_disks;
1321     info->spares_count = 0;
1322     info->spares_size = sizeof(struct mfi_spare);
1323     info->size = sizeof(struct mfi_config_data) + info->array_size +
1324         info->log_drv_size;
1325     if (info->size > 4096) {
1326         return MFI_STAT_INVALID_PARAMETER;
1327     }
1328 
1329     array_offset = sizeof(struct mfi_config_data);
1330     ld_offset = array_offset + sizeof(struct mfi_array) * num_pd_disks;
1331 
1332     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1333         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1334         uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
1335         struct mfi_array *array;
1336         struct mfi_ld_config *ld;
1337         uint64_t pd_size;
1338         int i;
1339 
1340         array = (struct mfi_array *)(data + array_offset);
1341         blk_get_geometry(sdev->conf.blk, &pd_size);
1342         array->size = cpu_to_le64(pd_size);
1343         array->num_drives = 1;
1344         array->array_ref = cpu_to_le16(sdev_id);
1345         array->pd[0].ref.v.device_id = cpu_to_le16(sdev_id);
1346         array->pd[0].ref.v.seq_num = 0;
1347         array->pd[0].fw_state = MFI_PD_STATE_ONLINE;
1348         array->pd[0].encl.pd = 0xFF;
1349         array->pd[0].encl.slot = (sdev->id & 0xFF);
1350         for (i = 1; i < MFI_MAX_ROW_SIZE; i++) {
1351             array->pd[i].ref.v.device_id = 0xFFFF;
1352             array->pd[i].ref.v.seq_num = 0;
1353             array->pd[i].fw_state = MFI_PD_STATE_UNCONFIGURED_GOOD;
1354             array->pd[i].encl.pd = 0xFF;
1355             array->pd[i].encl.slot = 0xFF;
1356         }
1357         array_offset += sizeof(struct mfi_array);
1358         ld = (struct mfi_ld_config *)(data + ld_offset);
1359         memset(ld, 0, sizeof(struct mfi_ld_config));
1360         ld->properties.ld.v.target_id = sdev->id;
1361         ld->properties.default_cache_policy = MR_LD_CACHE_READ_AHEAD |
1362             MR_LD_CACHE_READ_ADAPTIVE;
1363         ld->properties.current_cache_policy = MR_LD_CACHE_READ_AHEAD |
1364             MR_LD_CACHE_READ_ADAPTIVE;
1365         ld->params.state = MFI_LD_STATE_OPTIMAL;
1366         ld->params.stripe_size = 3;
1367         ld->params.num_drives = 1;
1368         ld->params.span_depth = 1;
1369         ld->params.is_consistent = 1;
1370         ld->span[0].start_block = 0;
1371         ld->span[0].num_blocks = cpu_to_le64(pd_size);
1372         ld->span[0].array_ref = cpu_to_le16(sdev_id);
1373         ld_offset += sizeof(struct mfi_ld_config);
1374     }
1375 
1376     cmd->iov_size -= dma_buf_read((uint8_t *)data, info->size, &cmd->qsg);
1377     return MFI_STAT_OK;
1378 }
1379 
1380 static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
1381 {
1382     struct mfi_ctrl_props info;
1383     size_t dcmd_size = sizeof(info);
1384 
1385     memset(&info, 0x0, dcmd_size);
1386     if (cmd->iov_size < dcmd_size) {
1387         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1388                                             dcmd_size);
1389         return MFI_STAT_INVALID_PARAMETER;
1390     }
1391     info.pred_fail_poll_interval = cpu_to_le16(300);
1392     info.intr_throttle_cnt = cpu_to_le16(16);
1393     info.intr_throttle_timeout = cpu_to_le16(50);
1394     info.rebuild_rate = 30;
1395     info.patrol_read_rate = 30;
1396     info.bgi_rate = 30;
1397     info.cc_rate = 30;
1398     info.recon_rate = 30;
1399     info.cache_flush_interval = 4;
1400     info.spinup_drv_cnt = 2;
1401     info.spinup_delay = 6;
1402     info.ecc_bucket_size = 15;
1403     info.ecc_bucket_leak_rate = cpu_to_le16(1440);
1404     info.expose_encl_devices = 1;
1405 
1406     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1407     return MFI_STAT_OK;
1408 }
1409 
1410 static int megasas_cache_flush(MegasasState *s, MegasasCmd *cmd)
1411 {
1412     blk_drain_all();
1413     return MFI_STAT_OK;
1414 }
1415 
1416 static int megasas_ctrl_shutdown(MegasasState *s, MegasasCmd *cmd)
1417 {
1418     s->fw_state = MFI_FWSTATE_READY;
1419     return MFI_STAT_OK;
1420 }
1421 
1422 /* Some implementations use CLUSTER RESET LD to simulate a device reset */
1423 static int megasas_cluster_reset_ld(MegasasState *s, MegasasCmd *cmd)
1424 {
1425     uint16_t target_id;
1426     int i;
1427 
1428     /* mbox0 contains the device index */
1429     target_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1430     trace_megasas_dcmd_reset_ld(cmd->index, target_id);
1431     for (i = 0; i < s->fw_cmds; i++) {
1432         MegasasCmd *tmp_cmd = &s->frames[i];
1433         if (tmp_cmd->req && tmp_cmd->req->dev->id == target_id) {
1434             SCSIDevice *d = tmp_cmd->req->dev;
1435             qdev_reset_all(&d->qdev);
1436         }
1437     }
1438     return MFI_STAT_OK;
1439 }
1440 
1441 static int megasas_dcmd_set_properties(MegasasState *s, MegasasCmd *cmd)
1442 {
1443     struct mfi_ctrl_props info;
1444     size_t dcmd_size = sizeof(info);
1445 
1446     if (cmd->iov_size < dcmd_size) {
1447         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1448                                             dcmd_size);
1449         return MFI_STAT_INVALID_PARAMETER;
1450     }
1451     dma_buf_write((uint8_t *)&info, dcmd_size, &cmd->qsg);
1452     trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
1453     return MFI_STAT_OK;
1454 }
1455 
1456 static int megasas_dcmd_dummy(MegasasState *s, MegasasCmd *cmd)
1457 {
1458     trace_megasas_dcmd_dummy(cmd->index, cmd->iov_size);
1459     return MFI_STAT_OK;
1460 }
1461 
1462 static const struct dcmd_cmd_tbl_t {
1463     int opcode;
1464     const char *desc;
1465     int (*func)(MegasasState *s, MegasasCmd *cmd);
1466 } dcmd_cmd_tbl[] = {
1467     { MFI_DCMD_CTRL_MFI_HOST_MEM_ALLOC, "CTRL_HOST_MEM_ALLOC",
1468       megasas_dcmd_dummy },
1469     { MFI_DCMD_CTRL_GET_INFO, "CTRL_GET_INFO",
1470       megasas_ctrl_get_info },
1471     { MFI_DCMD_CTRL_GET_PROPERTIES, "CTRL_GET_PROPERTIES",
1472       megasas_dcmd_get_properties },
1473     { MFI_DCMD_CTRL_SET_PROPERTIES, "CTRL_SET_PROPERTIES",
1474       megasas_dcmd_set_properties },
1475     { MFI_DCMD_CTRL_ALARM_GET, "CTRL_ALARM_GET",
1476       megasas_dcmd_dummy },
1477     { MFI_DCMD_CTRL_ALARM_ENABLE, "CTRL_ALARM_ENABLE",
1478       megasas_dcmd_dummy },
1479     { MFI_DCMD_CTRL_ALARM_DISABLE, "CTRL_ALARM_DISABLE",
1480       megasas_dcmd_dummy },
1481     { MFI_DCMD_CTRL_ALARM_SILENCE, "CTRL_ALARM_SILENCE",
1482       megasas_dcmd_dummy },
1483     { MFI_DCMD_CTRL_ALARM_TEST, "CTRL_ALARM_TEST",
1484       megasas_dcmd_dummy },
1485     { MFI_DCMD_CTRL_EVENT_GETINFO, "CTRL_EVENT_GETINFO",
1486       megasas_event_info },
1487     { MFI_DCMD_CTRL_EVENT_GET, "CTRL_EVENT_GET",
1488       megasas_dcmd_dummy },
1489     { MFI_DCMD_CTRL_EVENT_WAIT, "CTRL_EVENT_WAIT",
1490       megasas_event_wait },
1491     { MFI_DCMD_CTRL_SHUTDOWN, "CTRL_SHUTDOWN",
1492       megasas_ctrl_shutdown },
1493     { MFI_DCMD_HIBERNATE_STANDBY, "CTRL_STANDBY",
1494       megasas_dcmd_dummy },
1495     { MFI_DCMD_CTRL_GET_TIME, "CTRL_GET_TIME",
1496       megasas_dcmd_get_fw_time },
1497     { MFI_DCMD_CTRL_SET_TIME, "CTRL_SET_TIME",
1498       megasas_dcmd_set_fw_time },
1499     { MFI_DCMD_CTRL_BIOS_DATA_GET, "CTRL_BIOS_DATA_GET",
1500       megasas_dcmd_get_bios_info },
1501     { MFI_DCMD_CTRL_FACTORY_DEFAULTS, "CTRL_FACTORY_DEFAULTS",
1502       megasas_dcmd_dummy },
1503     { MFI_DCMD_CTRL_MFC_DEFAULTS_GET, "CTRL_MFC_DEFAULTS_GET",
1504       megasas_mfc_get_defaults },
1505     { MFI_DCMD_CTRL_MFC_DEFAULTS_SET, "CTRL_MFC_DEFAULTS_SET",
1506       megasas_dcmd_dummy },
1507     { MFI_DCMD_CTRL_CACHE_FLUSH, "CTRL_CACHE_FLUSH",
1508       megasas_cache_flush },
1509     { MFI_DCMD_PD_GET_LIST, "PD_GET_LIST",
1510       megasas_dcmd_pd_get_list },
1511     { MFI_DCMD_PD_LIST_QUERY, "PD_LIST_QUERY",
1512       megasas_dcmd_pd_list_query },
1513     { MFI_DCMD_PD_GET_INFO, "PD_GET_INFO",
1514       megasas_dcmd_pd_get_info },
1515     { MFI_DCMD_PD_STATE_SET, "PD_STATE_SET",
1516       megasas_dcmd_dummy },
1517     { MFI_DCMD_PD_REBUILD, "PD_REBUILD",
1518       megasas_dcmd_dummy },
1519     { MFI_DCMD_PD_BLINK, "PD_BLINK",
1520       megasas_dcmd_dummy },
1521     { MFI_DCMD_PD_UNBLINK, "PD_UNBLINK",
1522       megasas_dcmd_dummy },
1523     { MFI_DCMD_LD_GET_LIST, "LD_GET_LIST",
1524       megasas_dcmd_ld_get_list},
1525     { MFI_DCMD_LD_LIST_QUERY, "LD_LIST_QUERY",
1526       megasas_dcmd_ld_list_query },
1527     { MFI_DCMD_LD_GET_INFO, "LD_GET_INFO",
1528       megasas_dcmd_ld_get_info },
1529     { MFI_DCMD_LD_GET_PROP, "LD_GET_PROP",
1530       megasas_dcmd_dummy },
1531     { MFI_DCMD_LD_SET_PROP, "LD_SET_PROP",
1532       megasas_dcmd_dummy },
1533     { MFI_DCMD_LD_DELETE, "LD_DELETE",
1534       megasas_dcmd_dummy },
1535     { MFI_DCMD_CFG_READ, "CFG_READ",
1536       megasas_dcmd_cfg_read },
1537     { MFI_DCMD_CFG_ADD, "CFG_ADD",
1538       megasas_dcmd_dummy },
1539     { MFI_DCMD_CFG_CLEAR, "CFG_CLEAR",
1540       megasas_dcmd_dummy },
1541     { MFI_DCMD_CFG_FOREIGN_READ, "CFG_FOREIGN_READ",
1542       megasas_dcmd_dummy },
1543     { MFI_DCMD_CFG_FOREIGN_IMPORT, "CFG_FOREIGN_IMPORT",
1544       megasas_dcmd_dummy },
1545     { MFI_DCMD_BBU_STATUS, "BBU_STATUS",
1546       megasas_dcmd_dummy },
1547     { MFI_DCMD_BBU_CAPACITY_INFO, "BBU_CAPACITY_INFO",
1548       megasas_dcmd_dummy },
1549     { MFI_DCMD_BBU_DESIGN_INFO, "BBU_DESIGN_INFO",
1550       megasas_dcmd_dummy },
1551     { MFI_DCMD_BBU_PROP_GET, "BBU_PROP_GET",
1552       megasas_dcmd_dummy },
1553     { MFI_DCMD_CLUSTER, "CLUSTER",
1554       megasas_dcmd_dummy },
1555     { MFI_DCMD_CLUSTER_RESET_ALL, "CLUSTER_RESET_ALL",
1556       megasas_dcmd_dummy },
1557     { MFI_DCMD_CLUSTER_RESET_LD, "CLUSTER_RESET_LD",
1558       megasas_cluster_reset_ld },
1559     { -1, NULL, NULL }
1560 };
1561 
1562 static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)
1563 {
1564     int opcode, len;
1565     int retval = 0;
1566     const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;
1567 
1568     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1569     trace_megasas_handle_dcmd(cmd->index, opcode);
1570     len = megasas_map_dcmd(s, cmd);
1571     if (len < 0) {
1572         return MFI_STAT_MEMORY_NOT_AVAILABLE;
1573     }
1574     while (cmdptr->opcode != -1 && cmdptr->opcode != opcode) {
1575         cmdptr++;
1576     }
1577     if (cmdptr->opcode == -1) {
1578         trace_megasas_dcmd_unhandled(cmd->index, opcode, len);
1579         retval = megasas_dcmd_dummy(s, cmd);
1580     } else {
1581         trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);
1582         retval = cmdptr->func(s, cmd);
1583     }
1584     if (retval != MFI_STAT_INVALID_STATUS) {
1585         megasas_finish_dcmd(cmd, len);
1586     }
1587     return retval;
1588 }
1589 
1590 static int megasas_finish_internal_dcmd(MegasasCmd *cmd,
1591                                         SCSIRequest *req)
1592 {
1593     int opcode;
1594     int retval = MFI_STAT_OK;
1595     int lun = req->lun;
1596 
1597     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1598     scsi_req_unref(req);
1599     trace_megasas_dcmd_internal_finish(cmd->index, opcode, lun);
1600     switch (opcode) {
1601     case MFI_DCMD_PD_GET_INFO:
1602         retval = megasas_pd_get_info_submit(req->dev, lun, cmd);
1603         break;
1604     case MFI_DCMD_LD_GET_INFO:
1605         retval = megasas_ld_get_info_submit(req->dev, lun, cmd);
1606         break;
1607     default:
1608         trace_megasas_dcmd_internal_invalid(cmd->index, opcode);
1609         retval = MFI_STAT_INVALID_DCMD;
1610         break;
1611     }
1612     if (retval != MFI_STAT_INVALID_STATUS) {
1613         megasas_finish_dcmd(cmd, cmd->iov_size);
1614     }
1615     return retval;
1616 }
1617 
1618 static int megasas_enqueue_req(MegasasCmd *cmd, bool is_write)
1619 {
1620     int len;
1621 
1622     len = scsi_req_enqueue(cmd->req);
1623     if (len < 0) {
1624         len = -len;
1625     }
1626     if (len > 0) {
1627         if (len > cmd->iov_size) {
1628             if (is_write) {
1629                 trace_megasas_iov_write_overflow(cmd->index, len,
1630                                                  cmd->iov_size);
1631             } else {
1632                 trace_megasas_iov_read_overflow(cmd->index, len,
1633                                                 cmd->iov_size);
1634             }
1635         }
1636         if (len < cmd->iov_size) {
1637             if (is_write) {
1638                 trace_megasas_iov_write_underflow(cmd->index, len,
1639                                                   cmd->iov_size);
1640             } else {
1641                 trace_megasas_iov_read_underflow(cmd->index, len,
1642                                                  cmd->iov_size);
1643             }
1644             cmd->iov_size = len;
1645         }
1646         scsi_req_continue(cmd->req);
1647     }
1648     return len;
1649 }
1650 
1651 static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
1652                                bool is_logical)
1653 {
1654     uint8_t *cdb;
1655     bool is_write;
1656     struct SCSIDevice *sdev = NULL;
1657 
1658     cdb = cmd->frame->pass.cdb;
1659 
1660     if (is_logical) {
1661         if (cmd->frame->header.target_id >= MFI_MAX_LD ||
1662             cmd->frame->header.lun_id != 0) {
1663             trace_megasas_scsi_target_not_present(
1664                 mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1665                 cmd->frame->header.target_id, cmd->frame->header.lun_id);
1666             return MFI_STAT_DEVICE_NOT_FOUND;
1667         }
1668     }
1669     sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1670                             cmd->frame->header.lun_id);
1671 
1672     cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);
1673     trace_megasas_handle_scsi(mfi_frame_desc[cmd->frame->header.frame_cmd],
1674                               is_logical, cmd->frame->header.target_id,
1675                               cmd->frame->header.lun_id, sdev, cmd->iov_size);
1676 
1677     if (!sdev || (megasas_is_jbod(s) && is_logical)) {
1678         trace_megasas_scsi_target_not_present(
1679             mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1680             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1681         return MFI_STAT_DEVICE_NOT_FOUND;
1682     }
1683 
1684     if (cmd->frame->header.cdb_len > 16) {
1685         trace_megasas_scsi_invalid_cdb_len(
1686                 mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1687                 cmd->frame->header.target_id, cmd->frame->header.lun_id,
1688                 cmd->frame->header.cdb_len);
1689         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1690         cmd->frame->header.scsi_status = CHECK_CONDITION;
1691         s->event_count++;
1692         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1693     }
1694 
1695     if (megasas_map_sgl(s, cmd, &cmd->frame->pass.sgl)) {
1696         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1697         cmd->frame->header.scsi_status = CHECK_CONDITION;
1698         s->event_count++;
1699         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1700     }
1701 
1702     cmd->req = scsi_req_new(sdev, cmd->index,
1703                             cmd->frame->header.lun_id, cdb, cmd);
1704     if (!cmd->req) {
1705         trace_megasas_scsi_req_alloc_failed(
1706                 mfi_frame_desc[cmd->frame->header.frame_cmd],
1707                 cmd->frame->header.target_id, cmd->frame->header.lun_id);
1708         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1709         cmd->frame->header.scsi_status = BUSY;
1710         s->event_count++;
1711         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1712     }
1713 
1714     is_write = (cmd->req->cmd.mode == SCSI_XFER_TO_DEV);
1715     if (cmd->iov_size) {
1716         if (is_write) {
1717             trace_megasas_scsi_write_start(cmd->index, cmd->iov_size);
1718         } else {
1719             trace_megasas_scsi_read_start(cmd->index, cmd->iov_size);
1720         }
1721     } else {
1722         trace_megasas_scsi_nodata(cmd->index);
1723     }
1724     megasas_enqueue_req(cmd, is_write);
1725     return MFI_STAT_INVALID_STATUS;
1726 }
1727 
1728 static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd)
1729 {
1730     uint32_t lba_count, lba_start_hi, lba_start_lo;
1731     uint64_t lba_start;
1732     bool is_write = (cmd->frame->header.frame_cmd == MFI_CMD_LD_WRITE);
1733     uint8_t cdb[16];
1734     int len;
1735     struct SCSIDevice *sdev = NULL;
1736 
1737     lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
1738     lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
1739     lba_start_hi = le32_to_cpu(cmd->frame->io.lba_hi);
1740     lba_start = ((uint64_t)lba_start_hi << 32) | lba_start_lo;
1741 
1742     if (cmd->frame->header.target_id < MFI_MAX_LD &&
1743         cmd->frame->header.lun_id == 0) {
1744         sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1745                                 cmd->frame->header.lun_id);
1746     }
1747 
1748     trace_megasas_handle_io(cmd->index,
1749                             mfi_frame_desc[cmd->frame->header.frame_cmd],
1750                             cmd->frame->header.target_id,
1751                             cmd->frame->header.lun_id,
1752                             (unsigned long)lba_start, (unsigned long)lba_count);
1753     if (!sdev) {
1754         trace_megasas_io_target_not_present(cmd->index,
1755             mfi_frame_desc[cmd->frame->header.frame_cmd],
1756             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1757         return MFI_STAT_DEVICE_NOT_FOUND;
1758     }
1759 
1760     if (cmd->frame->header.cdb_len > 16) {
1761         trace_megasas_scsi_invalid_cdb_len(
1762             mfi_frame_desc[cmd->frame->header.frame_cmd], 1,
1763             cmd->frame->header.target_id, cmd->frame->header.lun_id,
1764             cmd->frame->header.cdb_len);
1765         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1766         cmd->frame->header.scsi_status = CHECK_CONDITION;
1767         s->event_count++;
1768         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1769     }
1770 
1771     cmd->iov_size = lba_count * sdev->blocksize;
1772     if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
1773         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1774         cmd->frame->header.scsi_status = CHECK_CONDITION;
1775         s->event_count++;
1776         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1777     }
1778 
1779     megasas_encode_lba(cdb, lba_start, lba_count, is_write);
1780     cmd->req = scsi_req_new(sdev, cmd->index,
1781                             cmd->frame->header.lun_id, cdb, cmd);
1782     if (!cmd->req) {
1783         trace_megasas_scsi_req_alloc_failed(
1784             mfi_frame_desc[cmd->frame->header.frame_cmd],
1785             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1786         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1787         cmd->frame->header.scsi_status = BUSY;
1788         s->event_count++;
1789         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1790     }
1791     len = megasas_enqueue_req(cmd, is_write);
1792     if (len > 0) {
1793         if (is_write) {
1794             trace_megasas_io_write_start(cmd->index, lba_start, lba_count, len);
1795         } else {
1796             trace_megasas_io_read_start(cmd->index, lba_start, lba_count, len);
1797         }
1798     }
1799     return MFI_STAT_INVALID_STATUS;
1800 }
1801 
1802 static int megasas_finish_internal_command(MegasasCmd *cmd,
1803                                            SCSIRequest *req, size_t resid)
1804 {
1805     int retval = MFI_STAT_INVALID_CMD;
1806 
1807     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1808         cmd->iov_size -= resid;
1809         retval = megasas_finish_internal_dcmd(cmd, req);
1810     }
1811     return retval;
1812 }
1813 
1814 static QEMUSGList *megasas_get_sg_list(SCSIRequest *req)
1815 {
1816     MegasasCmd *cmd = req->hba_private;
1817 
1818     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1819         return NULL;
1820     } else {
1821         return &cmd->qsg;
1822     }
1823 }
1824 
1825 static void megasas_xfer_complete(SCSIRequest *req, uint32_t len)
1826 {
1827     MegasasCmd *cmd = req->hba_private;
1828     uint8_t *buf;
1829     uint32_t opcode;
1830 
1831     trace_megasas_io_complete(cmd->index, len);
1832 
1833     if (cmd->frame->header.frame_cmd != MFI_CMD_DCMD) {
1834         scsi_req_continue(req);
1835         return;
1836     }
1837 
1838     buf = scsi_req_get_buf(req);
1839     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1840     if (opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) {
1841         struct mfi_pd_info *info = cmd->iov_buf;
1842 
1843         if (info->inquiry_data[0] == 0x7f) {
1844             memset(info->inquiry_data, 0, sizeof(info->inquiry_data));
1845             memcpy(info->inquiry_data, buf, len);
1846         } else if (info->vpd_page83[0] == 0x7f) {
1847             memset(info->vpd_page83, 0, sizeof(info->vpd_page83));
1848             memcpy(info->vpd_page83, buf, len);
1849         }
1850         scsi_req_continue(req);
1851     } else if (opcode == MFI_DCMD_LD_GET_INFO) {
1852         struct mfi_ld_info *info = cmd->iov_buf;
1853 
1854         if (cmd->iov_buf) {
1855             memcpy(info->vpd_page83, buf, sizeof(info->vpd_page83));
1856             scsi_req_continue(req);
1857         }
1858     }
1859 }
1860 
1861 static void megasas_command_complete(SCSIRequest *req, uint32_t status,
1862                                      size_t resid)
1863 {
1864     MegasasCmd *cmd = req->hba_private;
1865     uint8_t cmd_status = MFI_STAT_OK;
1866 
1867     trace_megasas_command_complete(cmd->index, status, resid);
1868 
1869     if (cmd->req != req) {
1870         /*
1871          * Internal command complete
1872          */
1873         cmd_status = megasas_finish_internal_command(cmd, req, resid);
1874         if (cmd_status == MFI_STAT_INVALID_STATUS) {
1875             return;
1876         }
1877     } else {
1878         req->status = status;
1879         trace_megasas_scsi_complete(cmd->index, req->status,
1880                                     cmd->iov_size, req->cmd.xfer);
1881         if (req->status != GOOD) {
1882             cmd_status = MFI_STAT_SCSI_DONE_WITH_ERROR;
1883         }
1884         if (req->status == CHECK_CONDITION) {
1885             megasas_copy_sense(cmd);
1886         }
1887 
1888         megasas_unmap_sgl(cmd);
1889         cmd->frame->header.scsi_status = req->status;
1890         scsi_req_unref(cmd->req);
1891         cmd->req = NULL;
1892     }
1893     cmd->frame->header.cmd_status = cmd_status;
1894     megasas_unmap_frame(cmd->state, cmd);
1895     megasas_complete_frame(cmd->state, cmd->context);
1896 }
1897 
1898 static void megasas_command_cancel(SCSIRequest *req)
1899 {
1900     MegasasCmd *cmd = req->hba_private;
1901 
1902     if (cmd) {
1903         megasas_abort_command(cmd);
1904     } else {
1905         scsi_req_unref(req);
1906     }
1907 }
1908 
1909 static int megasas_handle_abort(MegasasState *s, MegasasCmd *cmd)
1910 {
1911     uint64_t abort_ctx = le64_to_cpu(cmd->frame->abort.abort_context);
1912     hwaddr abort_addr, addr_hi, addr_lo;
1913     MegasasCmd *abort_cmd;
1914 
1915     addr_hi = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_hi);
1916     addr_lo = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_lo);
1917     abort_addr = ((uint64_t)addr_hi << 32) | addr_lo;
1918 
1919     abort_cmd = megasas_lookup_frame(s, abort_addr);
1920     if (!abort_cmd) {
1921         trace_megasas_abort_no_cmd(cmd->index, abort_ctx);
1922         s->event_count++;
1923         return MFI_STAT_OK;
1924     }
1925     if (!megasas_use_queue64(s)) {
1926         abort_ctx &= (uint64_t)0xFFFFFFFF;
1927     }
1928     if (abort_cmd->context != abort_ctx) {
1929         trace_megasas_abort_invalid_context(cmd->index, abort_cmd->index,
1930                                             abort_cmd->context);
1931         s->event_count++;
1932         return MFI_STAT_ABORT_NOT_POSSIBLE;
1933     }
1934     trace_megasas_abort_frame(cmd->index, abort_cmd->index);
1935     megasas_abort_command(abort_cmd);
1936     if (!s->event_cmd || abort_cmd != s->event_cmd) {
1937         s->event_cmd = NULL;
1938     }
1939     s->event_count++;
1940     return MFI_STAT_OK;
1941 }
1942 
1943 static void megasas_handle_frame(MegasasState *s, uint64_t frame_addr,
1944                                  uint32_t frame_count)
1945 {
1946     uint8_t frame_status = MFI_STAT_INVALID_CMD;
1947     uint64_t frame_context;
1948     MegasasCmd *cmd;
1949 
1950     /*
1951      * Always read 64bit context, top bits will be
1952      * masked out if required in megasas_enqueue_frame()
1953      */
1954     frame_context = megasas_frame_get_context(s, frame_addr);
1955 
1956     cmd = megasas_enqueue_frame(s, frame_addr, frame_context, frame_count);
1957     if (!cmd) {
1958         /* reply queue full */
1959         trace_megasas_frame_busy(frame_addr);
1960         megasas_frame_set_scsi_status(s, frame_addr, BUSY);
1961         megasas_frame_set_cmd_status(s, frame_addr, MFI_STAT_SCSI_DONE_WITH_ERROR);
1962         megasas_complete_frame(s, frame_context);
1963         s->event_count++;
1964         return;
1965     }
1966     switch (cmd->frame->header.frame_cmd) {
1967     case MFI_CMD_INIT:
1968         frame_status = megasas_init_firmware(s, cmd);
1969         break;
1970     case MFI_CMD_DCMD:
1971         frame_status = megasas_handle_dcmd(s, cmd);
1972         break;
1973     case MFI_CMD_ABORT:
1974         frame_status = megasas_handle_abort(s, cmd);
1975         break;
1976     case MFI_CMD_PD_SCSI_IO:
1977         frame_status = megasas_handle_scsi(s, cmd, 0);
1978         break;
1979     case MFI_CMD_LD_SCSI_IO:
1980         frame_status = megasas_handle_scsi(s, cmd, 1);
1981         break;
1982     case MFI_CMD_LD_READ:
1983     case MFI_CMD_LD_WRITE:
1984         frame_status = megasas_handle_io(s, cmd);
1985         break;
1986     default:
1987         trace_megasas_unhandled_frame_cmd(cmd->index,
1988                                           cmd->frame->header.frame_cmd);
1989         s->event_count++;
1990         break;
1991     }
1992     if (frame_status != MFI_STAT_INVALID_STATUS) {
1993         if (cmd->frame) {
1994             cmd->frame->header.cmd_status = frame_status;
1995         } else {
1996             megasas_frame_set_cmd_status(s, frame_addr, frame_status);
1997         }
1998         megasas_unmap_frame(s, cmd);
1999         megasas_complete_frame(s, cmd->context);
2000     }
2001 }
2002 
2003 static uint64_t megasas_mmio_read(void *opaque, hwaddr addr,
2004                                   unsigned size)
2005 {
2006     MegasasState *s = opaque;
2007     PCIDevice *pci_dev = PCI_DEVICE(s);
2008     MegasasBaseClass *base_class = MEGASAS_DEVICE_GET_CLASS(s);
2009     uint32_t retval = 0;
2010 
2011     switch (addr) {
2012     case MFI_IDB:
2013         retval = 0;
2014         trace_megasas_mmio_readl("MFI_IDB", retval);
2015         break;
2016     case MFI_OMSG0:
2017     case MFI_OSP0:
2018         retval = (msix_present(pci_dev) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |
2019             (s->fw_state & MFI_FWSTATE_MASK) |
2020             ((s->fw_sge & 0xff) << 16) |
2021             (s->fw_cmds & 0xFFFF);
2022         trace_megasas_mmio_readl(addr == MFI_OMSG0 ? "MFI_OMSG0" : "MFI_OSP0",
2023                                  retval);
2024         break;
2025     case MFI_OSTS:
2026         if (megasas_intr_enabled(s) && s->doorbell) {
2027             retval = base_class->osts;
2028         }
2029         trace_megasas_mmio_readl("MFI_OSTS", retval);
2030         break;
2031     case MFI_OMSK:
2032         retval = s->intr_mask;
2033         trace_megasas_mmio_readl("MFI_OMSK", retval);
2034         break;
2035     case MFI_ODCR0:
2036         retval = s->doorbell ? 1 : 0;
2037         trace_megasas_mmio_readl("MFI_ODCR0", retval);
2038         break;
2039     case MFI_DIAG:
2040         retval = s->diag;
2041         trace_megasas_mmio_readl("MFI_DIAG", retval);
2042         break;
2043     case MFI_OSP1:
2044         retval = 15;
2045         trace_megasas_mmio_readl("MFI_OSP1", retval);
2046         break;
2047     default:
2048         trace_megasas_mmio_invalid_readl(addr);
2049         break;
2050     }
2051     return retval;
2052 }
2053 
2054 static int adp_reset_seq[] = {0x00, 0x04, 0x0b, 0x02, 0x07, 0x0d};
2055 
2056 static void megasas_mmio_write(void *opaque, hwaddr addr,
2057                                uint64_t val, unsigned size)
2058 {
2059     MegasasState *s = opaque;
2060     PCIDevice *pci_dev = PCI_DEVICE(s);
2061     uint64_t frame_addr;
2062     uint32_t frame_count;
2063     int i;
2064 
2065     switch (addr) {
2066     case MFI_IDB:
2067         trace_megasas_mmio_writel("MFI_IDB", val);
2068         if (val & MFI_FWINIT_ABORT) {
2069             /* Abort all pending cmds */
2070             for (i = 0; i < s->fw_cmds; i++) {
2071                 megasas_abort_command(&s->frames[i]);
2072             }
2073         }
2074         if (val & MFI_FWINIT_READY) {
2075             /* move to FW READY */
2076             megasas_soft_reset(s);
2077         }
2078         if (val & MFI_FWINIT_MFIMODE) {
2079             /* discard MFIs */
2080         }
2081         if (val & MFI_FWINIT_STOP_ADP) {
2082             /* Terminal error, stop processing */
2083             s->fw_state = MFI_FWSTATE_FAULT;
2084         }
2085         break;
2086     case MFI_OMSK:
2087         trace_megasas_mmio_writel("MFI_OMSK", val);
2088         s->intr_mask = val;
2089         if (!megasas_intr_enabled(s) &&
2090             !msi_enabled(pci_dev) &&
2091             !msix_enabled(pci_dev)) {
2092             trace_megasas_irq_lower();
2093             pci_irq_deassert(pci_dev);
2094         }
2095         if (megasas_intr_enabled(s)) {
2096             if (msix_enabled(pci_dev)) {
2097                 trace_megasas_msix_enabled(0);
2098             } else if (msi_enabled(pci_dev)) {
2099                 trace_megasas_msi_enabled(0);
2100             } else {
2101                 trace_megasas_intr_enabled();
2102             }
2103         } else {
2104             trace_megasas_intr_disabled();
2105             megasas_soft_reset(s);
2106         }
2107         break;
2108     case MFI_ODCR0:
2109         trace_megasas_mmio_writel("MFI_ODCR0", val);
2110         s->doorbell = 0;
2111         if (megasas_intr_enabled(s)) {
2112             if (!msix_enabled(pci_dev) && !msi_enabled(pci_dev)) {
2113                 trace_megasas_irq_lower();
2114                 pci_irq_deassert(pci_dev);
2115             }
2116         }
2117         break;
2118     case MFI_IQPH:
2119         trace_megasas_mmio_writel("MFI_IQPH", val);
2120         /* Received high 32 bits of a 64 bit MFI frame address */
2121         s->frame_hi = val;
2122         break;
2123     case MFI_IQPL:
2124         trace_megasas_mmio_writel("MFI_IQPL", val);
2125         /* Received low 32 bits of a 64 bit MFI frame address */
2126         /* Fallthrough */
2127     case MFI_IQP:
2128         if (addr == MFI_IQP) {
2129             trace_megasas_mmio_writel("MFI_IQP", val);
2130             /* Received 64 bit MFI frame address */
2131             s->frame_hi = 0;
2132         }
2133         frame_addr = (val & ~0x1F);
2134         /* Add possible 64 bit offset */
2135         frame_addr |= ((uint64_t)s->frame_hi << 32);
2136         s->frame_hi = 0;
2137         frame_count = (val >> 1) & 0xF;
2138         megasas_handle_frame(s, frame_addr, frame_count);
2139         break;
2140     case MFI_SEQ:
2141         trace_megasas_mmio_writel("MFI_SEQ", val);
2142         /* Magic sequence to start ADP reset */
2143         if (adp_reset_seq[s->adp_reset] == val) {
2144             s->adp_reset++;
2145         } else {
2146             s->adp_reset = 0;
2147             s->diag = 0;
2148         }
2149         if (s->adp_reset == 6) {
2150             s->diag = MFI_DIAG_WRITE_ENABLE;
2151         }
2152         break;
2153     case MFI_DIAG:
2154         trace_megasas_mmio_writel("MFI_DIAG", val);
2155         /* ADP reset */
2156         if ((s->diag & MFI_DIAG_WRITE_ENABLE) &&
2157             (val & MFI_DIAG_RESET_ADP)) {
2158             s->diag |= MFI_DIAG_RESET_ADP;
2159             megasas_soft_reset(s);
2160             s->adp_reset = 0;
2161             s->diag = 0;
2162         }
2163         break;
2164     default:
2165         trace_megasas_mmio_invalid_writel(addr, val);
2166         break;
2167     }
2168 }
2169 
2170 static const MemoryRegionOps megasas_mmio_ops = {
2171     .read = megasas_mmio_read,
2172     .write = megasas_mmio_write,
2173     .endianness = DEVICE_LITTLE_ENDIAN,
2174     .impl = {
2175         .min_access_size = 8,
2176         .max_access_size = 8,
2177     }
2178 };
2179 
2180 static uint64_t megasas_port_read(void *opaque, hwaddr addr,
2181                                   unsigned size)
2182 {
2183     return megasas_mmio_read(opaque, addr & 0xff, size);
2184 }
2185 
2186 static void megasas_port_write(void *opaque, hwaddr addr,
2187                                uint64_t val, unsigned size)
2188 {
2189     megasas_mmio_write(opaque, addr & 0xff, val, size);
2190 }
2191 
2192 static const MemoryRegionOps megasas_port_ops = {
2193     .read = megasas_port_read,
2194     .write = megasas_port_write,
2195     .endianness = DEVICE_LITTLE_ENDIAN,
2196     .impl = {
2197         .min_access_size = 4,
2198         .max_access_size = 4,
2199     }
2200 };
2201 
2202 static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
2203                                    unsigned size)
2204 {
2205     return 0;
2206 }
2207 
2208 static void megasas_queue_write(void *opaque, hwaddr addr,
2209                                uint64_t val, unsigned size)
2210 {
2211     return;
2212 }
2213 
2214 static const MemoryRegionOps megasas_queue_ops = {
2215     .read = megasas_queue_read,
2216     .write = megasas_queue_write,
2217     .endianness = DEVICE_LITTLE_ENDIAN,
2218     .impl = {
2219         .min_access_size = 8,
2220         .max_access_size = 8,
2221     }
2222 };
2223 
2224 static void megasas_soft_reset(MegasasState *s)
2225 {
2226     int i;
2227     MegasasCmd *cmd;
2228 
2229     trace_megasas_reset(s->fw_state);
2230     for (i = 0; i < s->fw_cmds; i++) {
2231         cmd = &s->frames[i];
2232         megasas_abort_command(cmd);
2233     }
2234     if (s->fw_state == MFI_FWSTATE_READY) {
2235         BusChild *kid;
2236 
2237         /*
2238          * The EFI firmware doesn't handle UA,
2239          * so we need to clear the Power On/Reset UA
2240          * after the initial reset.
2241          */
2242         QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
2243             SCSIDevice *sdev = SCSI_DEVICE(kid->child);
2244 
2245             sdev->unit_attention = SENSE_CODE(NO_SENSE);
2246             scsi_device_unit_attention_reported(sdev);
2247         }
2248     }
2249     megasas_reset_frames(s);
2250     s->reply_queue_len = s->fw_cmds;
2251     s->reply_queue_pa = 0;
2252     s->consumer_pa = 0;
2253     s->producer_pa = 0;
2254     s->fw_state = MFI_FWSTATE_READY;
2255     s->doorbell = 0;
2256     s->intr_mask = MEGASAS_INTR_DISABLED_MASK;
2257     s->frame_hi = 0;
2258     s->flags &= ~MEGASAS_MASK_USE_QUEUE64;
2259     s->event_count++;
2260     s->boot_event = s->event_count;
2261 }
2262 
2263 static void megasas_scsi_reset(DeviceState *dev)
2264 {
2265     MegasasState *s = MEGASAS(dev);
2266 
2267     megasas_soft_reset(s);
2268 }
2269 
2270 static const VMStateDescription vmstate_megasas_gen1 = {
2271     .name = "megasas",
2272     .version_id = 0,
2273     .minimum_version_id = 0,
2274     .fields = (VMStateField[]) {
2275         VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2276         VMSTATE_MSIX(parent_obj, MegasasState),
2277 
2278         VMSTATE_INT32(fw_state, MegasasState),
2279         VMSTATE_INT32(intr_mask, MegasasState),
2280         VMSTATE_INT32(doorbell, MegasasState),
2281         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2282         VMSTATE_UINT64(consumer_pa, MegasasState),
2283         VMSTATE_UINT64(producer_pa, MegasasState),
2284         VMSTATE_END_OF_LIST()
2285     }
2286 };
2287 
2288 static const VMStateDescription vmstate_megasas_gen2 = {
2289     .name = "megasas-gen2",
2290     .version_id = 0,
2291     .minimum_version_id = 0,
2292     .minimum_version_id_old = 0,
2293     .fields      = (VMStateField[]) {
2294         VMSTATE_PCIE_DEVICE(parent_obj, MegasasState),
2295         VMSTATE_MSIX(parent_obj, MegasasState),
2296 
2297         VMSTATE_INT32(fw_state, MegasasState),
2298         VMSTATE_INT32(intr_mask, MegasasState),
2299         VMSTATE_INT32(doorbell, MegasasState),
2300         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2301         VMSTATE_UINT64(consumer_pa, MegasasState),
2302         VMSTATE_UINT64(producer_pa, MegasasState),
2303         VMSTATE_END_OF_LIST()
2304     }
2305 };
2306 
2307 static void megasas_scsi_uninit(PCIDevice *d)
2308 {
2309     MegasasState *s = MEGASAS(d);
2310 
2311     if (megasas_use_msix(s)) {
2312         msix_uninit(d, &s->mmio_io, &s->mmio_io);
2313     }
2314     if (megasas_use_msi(s)) {
2315         msi_uninit(d);
2316     }
2317 }
2318 
2319 static const struct SCSIBusInfo megasas_scsi_info = {
2320     .tcq = true,
2321     .max_target = MFI_MAX_LD,
2322     .max_lun = 255,
2323 
2324     .transfer_data = megasas_xfer_complete,
2325     .get_sg_list = megasas_get_sg_list,
2326     .complete = megasas_command_complete,
2327     .cancel = megasas_command_cancel,
2328 };
2329 
2330 static void megasas_scsi_realize(PCIDevice *dev, Error **errp)
2331 {
2332     DeviceState *d = DEVICE(dev);
2333     MegasasState *s = MEGASAS(dev);
2334     MegasasBaseClass *b = MEGASAS_DEVICE_GET_CLASS(s);
2335     uint8_t *pci_conf;
2336     int i, bar_type;
2337 
2338     pci_conf = dev->config;
2339 
2340     /* PCI latency timer = 0 */
2341     pci_conf[PCI_LATENCY_TIMER] = 0;
2342     /* Interrupt pin 1 */
2343     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2344 
2345     memory_region_init_io(&s->mmio_io, OBJECT(s), &megasas_mmio_ops, s,
2346                           "megasas-mmio", 0x4000);
2347     memory_region_init_io(&s->port_io, OBJECT(s), &megasas_port_ops, s,
2348                           "megasas-io", 256);
2349     memory_region_init_io(&s->queue_io, OBJECT(s), &megasas_queue_ops, s,
2350                           "megasas-queue", 0x40000);
2351 
2352     if (megasas_use_msi(s) &&
2353         msi_init(dev, 0x50, 1, true, false)) {
2354         s->flags &= ~MEGASAS_MASK_USE_MSI;
2355     }
2356     if (megasas_use_msix(s) &&
2357         msix_init(dev, 15, &s->mmio_io, b->mmio_bar, 0x2000,
2358                   &s->mmio_io, b->mmio_bar, 0x3800, 0x68)) {
2359         s->flags &= ~MEGASAS_MASK_USE_MSIX;
2360     }
2361     if (pci_is_express(dev)) {
2362         pcie_endpoint_cap_init(dev, 0xa0);
2363     }
2364 
2365     bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
2366     pci_register_bar(dev, b->ioport_bar,
2367                      PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
2368     pci_register_bar(dev, b->mmio_bar, bar_type, &s->mmio_io);
2369     pci_register_bar(dev, 3, bar_type, &s->queue_io);
2370 
2371     if (megasas_use_msix(s)) {
2372         msix_vector_use(dev, 0);
2373     }
2374 
2375     s->fw_state = MFI_FWSTATE_READY;
2376     if (!s->sas_addr) {
2377         s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
2378                        IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
2379         s->sas_addr |= (pci_bus_num(dev->bus) << 16);
2380         s->sas_addr |= (PCI_SLOT(dev->devfn) << 8);
2381         s->sas_addr |= PCI_FUNC(dev->devfn);
2382     }
2383     if (!s->hba_serial) {
2384         s->hba_serial = g_strdup(MEGASAS_HBA_SERIAL);
2385     }
2386     if (s->fw_sge >= MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE) {
2387         s->fw_sge = MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE;
2388     } else if (s->fw_sge >= 128 - MFI_PASS_FRAME_SIZE) {
2389         s->fw_sge = 128 - MFI_PASS_FRAME_SIZE;
2390     } else {
2391         s->fw_sge = 64 - MFI_PASS_FRAME_SIZE;
2392     }
2393     if (s->fw_cmds > MEGASAS_MAX_FRAMES) {
2394         s->fw_cmds = MEGASAS_MAX_FRAMES;
2395     }
2396     trace_megasas_init(s->fw_sge, s->fw_cmds,
2397                        megasas_is_jbod(s) ? "jbod" : "raid");
2398 
2399     if (megasas_is_jbod(s)) {
2400         s->fw_luns = MFI_MAX_SYS_PDS;
2401     } else {
2402         s->fw_luns = MFI_MAX_LD;
2403     }
2404     s->producer_pa = 0;
2405     s->consumer_pa = 0;
2406     for (i = 0; i < s->fw_cmds; i++) {
2407         s->frames[i].index = i;
2408         s->frames[i].context = -1;
2409         s->frames[i].pa = 0;
2410         s->frames[i].state = s;
2411     }
2412 
2413     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev),
2414                  &megasas_scsi_info, NULL);
2415     if (!d->hotplugged) {
2416         scsi_bus_legacy_handle_cmdline(&s->bus, errp);
2417     }
2418 }
2419 
2420 static Property megasas_properties_gen1[] = {
2421     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2422                        MEGASAS_DEFAULT_SGE),
2423     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2424                        MEGASAS_DEFAULT_FRAMES),
2425     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2426     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2427     DEFINE_PROP_BIT("use_msi", MegasasState, flags,
2428                     MEGASAS_FLAG_USE_MSI, false),
2429     DEFINE_PROP_BIT("use_msix", MegasasState, flags,
2430                     MEGASAS_FLAG_USE_MSIX, false),
2431     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2432                     MEGASAS_FLAG_USE_JBOD, false),
2433     DEFINE_PROP_END_OF_LIST(),
2434 };
2435 
2436 static Property megasas_properties_gen2[] = {
2437     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2438                        MEGASAS_DEFAULT_SGE),
2439     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2440                        MEGASAS_GEN2_DEFAULT_FRAMES),
2441     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2442     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2443     DEFINE_PROP_BIT("use_msi", MegasasState, flags,
2444                     MEGASAS_FLAG_USE_MSI, true),
2445     DEFINE_PROP_BIT("use_msix", MegasasState, flags,
2446                     MEGASAS_FLAG_USE_MSIX, true),
2447     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2448                     MEGASAS_FLAG_USE_JBOD, false),
2449     DEFINE_PROP_END_OF_LIST(),
2450 };
2451 
2452 typedef struct MegasasInfo {
2453     const char *name;
2454     const char *desc;
2455     const char *product_name;
2456     const char *product_version;
2457     uint16_t device_id;
2458     uint16_t subsystem_id;
2459     int ioport_bar;
2460     int mmio_bar;
2461     bool is_express;
2462     int osts;
2463     const VMStateDescription *vmsd;
2464     Property *props;
2465 } MegasasInfo;
2466 
2467 static struct MegasasInfo megasas_devices[] = {
2468     {
2469         .name = TYPE_MEGASAS_GEN1,
2470         .desc = "LSI MegaRAID SAS 1078",
2471         .product_name = "LSI MegaRAID SAS 8708EM2",
2472         .product_version = MEGASAS_VERSION_GEN1,
2473         .device_id = PCI_DEVICE_ID_LSI_SAS1078,
2474         .subsystem_id = 0x1013,
2475         .ioport_bar = 2,
2476         .mmio_bar = 0,
2477         .osts = MFI_1078_RM | 1,
2478         .is_express = false,
2479         .vmsd = &vmstate_megasas_gen1,
2480         .props = megasas_properties_gen1,
2481     },{
2482         .name = TYPE_MEGASAS_GEN2,
2483         .desc = "LSI MegaRAID SAS 2108",
2484         .product_name = "LSI MegaRAID SAS 9260-8i",
2485         .product_version = MEGASAS_VERSION_GEN2,
2486         .device_id = PCI_DEVICE_ID_LSI_SAS0079,
2487         .subsystem_id = 0x9261,
2488         .ioport_bar = 0,
2489         .mmio_bar = 1,
2490         .osts = MFI_GEN2_RM,
2491         .is_express = true,
2492         .vmsd = &vmstate_megasas_gen2,
2493         .props = megasas_properties_gen2,
2494     }
2495 };
2496 
2497 static void megasas_class_init(ObjectClass *oc, void *data)
2498 {
2499     DeviceClass *dc = DEVICE_CLASS(oc);
2500     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
2501     MegasasBaseClass *e = MEGASAS_DEVICE_CLASS(oc);
2502     const MegasasInfo *info = data;
2503 
2504     pc->realize = megasas_scsi_realize;
2505     pc->exit = megasas_scsi_uninit;
2506     pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2507     pc->device_id = info->device_id;
2508     pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2509     pc->subsystem_id = info->subsystem_id;
2510     pc->class_id = PCI_CLASS_STORAGE_RAID;
2511     pc->is_express = info->is_express;
2512     e->mmio_bar = info->mmio_bar;
2513     e->ioport_bar = info->ioport_bar;
2514     e->osts = info->osts;
2515     e->product_name = info->product_name;
2516     e->product_version = info->product_version;
2517     dc->props = info->props;
2518     dc->reset = megasas_scsi_reset;
2519     dc->vmsd = info->vmsd;
2520     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2521     dc->desc = info->desc;
2522 }
2523 
2524 static const TypeInfo megasas_info = {
2525     .name  = TYPE_MEGASAS_BASE,
2526     .parent = TYPE_PCI_DEVICE,
2527     .instance_size = sizeof(MegasasState),
2528     .class_size = sizeof(MegasasBaseClass),
2529     .abstract = true,
2530 };
2531 
2532 static void megasas_register_types(void)
2533 {
2534     int i;
2535 
2536     type_register_static(&megasas_info);
2537     for (i = 0; i < ARRAY_SIZE(megasas_devices); i++) {
2538         const MegasasInfo *info = &megasas_devices[i];
2539         TypeInfo type_info = {};
2540 
2541         type_info.name = info->name;
2542         type_info.parent = TYPE_MEGASAS_BASE;
2543         type_info.class_data = (void *)info;
2544         type_info.class_init = megasas_class_init;
2545 
2546         type_register(&type_info);
2547     }
2548 }
2549 
2550 type_init(megasas_register_types)
2551