xref: /openbmc/qemu/hw/scsi/megasas.c (revision 398f9a84ac7132e38caf7b066273734b3bf619ff)
1 /*
2  * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation
3  * Based on the linux driver code at drivers/scsi/megaraid
4  *
5  * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
6  *
7  * This library is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2.1 of the License, or (at your option) any later version.
11  *
12  * This library is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qemu-common.h"
23 #include "hw/pci/pci.h"
24 #include "hw/qdev-properties.h"
25 #include "sysemu/dma.h"
26 #include "sysemu/block-backend.h"
27 #include "hw/pci/msi.h"
28 #include "hw/pci/msix.h"
29 #include "qemu/iov.h"
30 #include "qemu/module.h"
31 #include "hw/scsi/scsi.h"
32 #include "scsi/constants.h"
33 #include "trace.h"
34 #include "qapi/error.h"
35 #include "mfi.h"
36 #include "migration/vmstate.h"
37 #include "qom/object.h"
38 
39 #define MEGASAS_VERSION_GEN1 "1.70"
40 #define MEGASAS_VERSION_GEN2 "1.80"
41 #define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */
42 #define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */
43 #define MEGASAS_GEN2_DEFAULT_FRAMES 1008     /* Windows requires this */
44 #define MEGASAS_MAX_SGE 128             /* Firmware limit */
45 #define MEGASAS_DEFAULT_SGE 80
46 #define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */
47 #define MEGASAS_MAX_ARRAYS 128
48 
49 #define MEGASAS_HBA_SERIAL "QEMU123456"
50 #define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
51 #define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
52 
53 #define MEGASAS_FLAG_USE_JBOD      0
54 #define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)
55 #define MEGASAS_FLAG_USE_QUEUE64   1
56 #define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)
57 
58 typedef struct MegasasCmd {
59     uint32_t index;
60     uint16_t flags;
61     uint16_t count;
62     uint64_t context;
63 
64     hwaddr pa;
65     hwaddr pa_size;
66     uint32_t dcmd_opcode;
67     union mfi_frame *frame;
68     SCSIRequest *req;
69     QEMUSGList qsg;
70     void *iov_buf;
71     size_t iov_size;
72     size_t iov_offset;
73     struct MegasasState *state;
74 } MegasasCmd;
75 
76 struct MegasasState {
77     /*< private >*/
78     PCIDevice parent_obj;
79     /*< public >*/
80 
81     MemoryRegion mmio_io;
82     MemoryRegion port_io;
83     MemoryRegion queue_io;
84     uint32_t frame_hi;
85 
86     uint32_t fw_state;
87     uint32_t fw_sge;
88     uint32_t fw_cmds;
89     uint32_t flags;
90     uint32_t fw_luns;
91     uint32_t intr_mask;
92     uint32_t doorbell;
93     uint32_t busy;
94     uint32_t diag;
95     uint32_t adp_reset;
96     OnOffAuto msi;
97     OnOffAuto msix;
98 
99     MegasasCmd *event_cmd;
100     uint16_t event_locale;
101     int event_class;
102     uint32_t event_count;
103     uint32_t shutdown_event;
104     uint32_t boot_event;
105 
106     uint64_t sas_addr;
107     char *hba_serial;
108 
109     uint64_t reply_queue_pa;
110     void *reply_queue;
111     uint16_t reply_queue_len;
112     uint32_t reply_queue_head;
113     uint32_t reply_queue_tail;
114     uint64_t consumer_pa;
115     uint64_t producer_pa;
116 
117     MegasasCmd frames[MEGASAS_MAX_FRAMES];
118     DECLARE_BITMAP(frame_map, MEGASAS_MAX_FRAMES);
119     SCSIBus bus;
120 };
121 typedef struct MegasasState MegasasState;
122 
123 struct MegasasBaseClass {
124     PCIDeviceClass parent_class;
125     const char *product_name;
126     const char *product_version;
127     int mmio_bar;
128     int ioport_bar;
129     int osts;
130 };
131 typedef struct MegasasBaseClass MegasasBaseClass;
132 
133 #define TYPE_MEGASAS_BASE "megasas-base"
134 #define TYPE_MEGASAS_GEN1 "megasas"
135 #define TYPE_MEGASAS_GEN2 "megasas-gen2"
136 
137 DECLARE_OBJ_CHECKERS(MegasasState, MegasasBaseClass,
138                      MEGASAS, TYPE_MEGASAS_BASE)
139 
140 
141 #define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
142 
143 static bool megasas_intr_enabled(MegasasState *s)
144 {
145     if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=
146         MEGASAS_INTR_DISABLED_MASK) {
147         return true;
148     }
149     return false;
150 }
151 
152 static bool megasas_use_queue64(MegasasState *s)
153 {
154     return s->flags & MEGASAS_MASK_USE_QUEUE64;
155 }
156 
157 static bool megasas_use_msix(MegasasState *s)
158 {
159     return s->msix != ON_OFF_AUTO_OFF;
160 }
161 
162 static bool megasas_is_jbod(MegasasState *s)
163 {
164     return s->flags & MEGASAS_MASK_USE_JBOD;
165 }
166 
167 static void megasas_frame_set_cmd_status(MegasasState *s,
168                                          unsigned long frame, uint8_t v)
169 {
170     PCIDevice *pci = &s->parent_obj;
171     stb_pci_dma(pci, frame + offsetof(struct mfi_frame_header, cmd_status),
172                 v, MEMTXATTRS_UNSPECIFIED);
173 }
174 
175 static void megasas_frame_set_scsi_status(MegasasState *s,
176                                           unsigned long frame, uint8_t v)
177 {
178     PCIDevice *pci = &s->parent_obj;
179     stb_pci_dma(pci, frame + offsetof(struct mfi_frame_header, scsi_status),
180                 v, MEMTXATTRS_UNSPECIFIED);
181 }
182 
183 static inline const char *mfi_frame_desc(unsigned int cmd)
184 {
185     static const char *mfi_frame_descs[] = {
186         "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",
187         "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"
188     };
189 
190     if (cmd < ARRAY_SIZE(mfi_frame_descs)) {
191         return mfi_frame_descs[cmd];
192     }
193 
194     return "Unknown";
195 }
196 
197 /*
198  * Context is considered opaque, but the HBA firmware is running
199  * in little endian mode. So convert it to little endian, too.
200  */
201 static uint64_t megasas_frame_get_context(MegasasState *s,
202                                           unsigned long frame)
203 {
204     PCIDevice *pci = &s->parent_obj;
205     return ldq_le_pci_dma(pci,
206                           frame + offsetof(struct mfi_frame_header, context),
207                           MEMTXATTRS_UNSPECIFIED);
208 }
209 
210 static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)
211 {
212     return cmd->flags & MFI_FRAME_IEEE_SGL;
213 }
214 
215 static bool megasas_frame_is_sgl64(MegasasCmd *cmd)
216 {
217     return cmd->flags & MFI_FRAME_SGL64;
218 }
219 
220 static bool megasas_frame_is_sense64(MegasasCmd *cmd)
221 {
222     return cmd->flags & MFI_FRAME_SENSE64;
223 }
224 
225 static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,
226                                      union mfi_sgl *sgl)
227 {
228     uint64_t addr;
229 
230     if (megasas_frame_is_ieee_sgl(cmd)) {
231         addr = le64_to_cpu(sgl->sg_skinny->addr);
232     } else if (megasas_frame_is_sgl64(cmd)) {
233         addr = le64_to_cpu(sgl->sg64->addr);
234     } else {
235         addr = le32_to_cpu(sgl->sg32->addr);
236     }
237     return addr;
238 }
239 
240 static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,
241                                     union mfi_sgl *sgl)
242 {
243     uint32_t len;
244 
245     if (megasas_frame_is_ieee_sgl(cmd)) {
246         len = le32_to_cpu(sgl->sg_skinny->len);
247     } else if (megasas_frame_is_sgl64(cmd)) {
248         len = le32_to_cpu(sgl->sg64->len);
249     } else {
250         len = le32_to_cpu(sgl->sg32->len);
251     }
252     return len;
253 }
254 
255 static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,
256                                        union mfi_sgl *sgl)
257 {
258     uint8_t *next = (uint8_t *)sgl;
259 
260     if (megasas_frame_is_ieee_sgl(cmd)) {
261         next += sizeof(struct mfi_sg_skinny);
262     } else if (megasas_frame_is_sgl64(cmd)) {
263         next += sizeof(struct mfi_sg64);
264     } else {
265         next += sizeof(struct mfi_sg32);
266     }
267 
268     if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {
269         return NULL;
270     }
271     return (union mfi_sgl *)next;
272 }
273 
274 static void megasas_soft_reset(MegasasState *s);
275 
276 static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
277 {
278     int i;
279     int iov_count = 0;
280     size_t iov_size = 0;
281 
282     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
283     iov_count = cmd->frame->header.sge_count;
284     if (!iov_count || iov_count > MEGASAS_MAX_SGE) {
285         trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,
286                                          MEGASAS_MAX_SGE);
287         return -1;
288     }
289     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), iov_count);
290     for (i = 0; i < iov_count; i++) {
291         dma_addr_t iov_pa, iov_size_p;
292 
293         if (!sgl) {
294             trace_megasas_iovec_sgl_underflow(cmd->index, i);
295             goto unmap;
296         }
297         iov_pa = megasas_sgl_get_addr(cmd, sgl);
298         iov_size_p = megasas_sgl_get_len(cmd, sgl);
299         if (!iov_pa || !iov_size_p) {
300             trace_megasas_iovec_sgl_invalid(cmd->index, i,
301                                             iov_pa, iov_size_p);
302             goto unmap;
303         }
304         qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);
305         sgl = megasas_sgl_next(cmd, sgl);
306         iov_size += (size_t)iov_size_p;
307     }
308     if (cmd->iov_size > iov_size) {
309         trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
310         goto unmap;
311     } else if (cmd->iov_size < iov_size) {
312         trace_megasas_iovec_underflow(cmd->index, iov_size, cmd->iov_size);
313     }
314     cmd->iov_offset = 0;
315     return 0;
316 unmap:
317     qemu_sglist_destroy(&cmd->qsg);
318     return -1;
319 }
320 
321 /*
322  * passthrough sense and io sense are at the same offset
323  */
324 static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,
325     uint8_t sense_len)
326 {
327     PCIDevice *pcid = PCI_DEVICE(cmd->state);
328     uint32_t pa_hi = 0, pa_lo;
329     hwaddr pa;
330     int frame_sense_len;
331 
332     frame_sense_len = cmd->frame->header.sense_len;
333     if (sense_len > frame_sense_len) {
334         sense_len = frame_sense_len;
335     }
336     if (sense_len) {
337         pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);
338         if (megasas_frame_is_sense64(cmd)) {
339             pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);
340         }
341         pa = ((uint64_t) pa_hi << 32) | pa_lo;
342         pci_dma_write(pcid, pa, sense_ptr, sense_len);
343         cmd->frame->header.sense_len = sense_len;
344     }
345     return sense_len;
346 }
347 
348 static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)
349 {
350     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
351     uint8_t sense_len = 18;
352 
353     memset(sense_buf, 0, sense_len);
354     sense_buf[0] = 0xf0;
355     sense_buf[2] = sense.key;
356     sense_buf[7] = 10;
357     sense_buf[12] = sense.asc;
358     sense_buf[13] = sense.ascq;
359     megasas_build_sense(cmd, sense_buf, sense_len);
360 }
361 
362 static void megasas_copy_sense(MegasasCmd *cmd)
363 {
364     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
365     uint8_t sense_len;
366 
367     sense_len = scsi_req_get_sense(cmd->req, sense_buf,
368                                    SCSI_SENSE_BUF_SIZE);
369     megasas_build_sense(cmd, sense_buf, sense_len);
370 }
371 
372 /*
373  * Format an INQUIRY CDB
374  */
375 static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)
376 {
377     memset(cdb, 0, 6);
378     cdb[0] = INQUIRY;
379     if (pg > 0) {
380         cdb[1] = 0x1;
381         cdb[2] = pg;
382     }
383     cdb[3] = (len >> 8) & 0xff;
384     cdb[4] = (len & 0xff);
385     return len;
386 }
387 
388 /*
389  * Encode lba and len into a READ_16/WRITE_16 CDB
390  */
391 static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,
392                                uint32_t len, bool is_write)
393 {
394     memset(cdb, 0x0, 16);
395     if (is_write) {
396         cdb[0] = WRITE_16;
397     } else {
398         cdb[0] = READ_16;
399     }
400     cdb[2] = (lba >> 56) & 0xff;
401     cdb[3] = (lba >> 48) & 0xff;
402     cdb[4] = (lba >> 40) & 0xff;
403     cdb[5] = (lba >> 32) & 0xff;
404     cdb[6] = (lba >> 24) & 0xff;
405     cdb[7] = (lba >> 16) & 0xff;
406     cdb[8] = (lba >> 8) & 0xff;
407     cdb[9] = (lba) & 0xff;
408     cdb[10] = (len >> 24) & 0xff;
409     cdb[11] = (len >> 16) & 0xff;
410     cdb[12] = (len >> 8) & 0xff;
411     cdb[13] = (len) & 0xff;
412 }
413 
414 /*
415  * Utility functions
416  */
417 static uint64_t megasas_fw_time(void)
418 {
419     struct tm curtime;
420 
421     qemu_get_timedate(&curtime, 0);
422     return ((uint64_t)curtime.tm_sec & 0xff) << 48 |
423         ((uint64_t)curtime.tm_min & 0xff)  << 40 |
424         ((uint64_t)curtime.tm_hour & 0xff) << 32 |
425         ((uint64_t)curtime.tm_mday & 0xff) << 24 |
426         ((uint64_t)curtime.tm_mon & 0xff)  << 16 |
427         ((uint64_t)(curtime.tm_year + 1900) & 0xffff);
428 }
429 
430 /*
431  * Default disk sata address
432  * 0x1221 is the magic number as
433  * present in real hardware,
434  * so use it here, too.
435  */
436 static uint64_t megasas_get_sata_addr(uint16_t id)
437 {
438     uint64_t addr = (0x1221ULL << 48);
439     return addr | ((uint64_t)id << 24);
440 }
441 
442 /*
443  * Frame handling
444  */
445 static int megasas_next_index(MegasasState *s, int index, int limit)
446 {
447     index++;
448     if (index == limit) {
449         index = 0;
450     }
451     return index;
452 }
453 
454 static MegasasCmd *megasas_lookup_frame(MegasasState *s,
455     hwaddr frame)
456 {
457     MegasasCmd *cmd = NULL;
458     int num = 0, index;
459 
460     index = s->reply_queue_head;
461 
462     while (num < s->fw_cmds && index < MEGASAS_MAX_FRAMES) {
463         if (s->frames[index].pa && s->frames[index].pa == frame) {
464             cmd = &s->frames[index];
465             break;
466         }
467         index = megasas_next_index(s, index, s->fw_cmds);
468         num++;
469     }
470 
471     return cmd;
472 }
473 
474 static void megasas_unmap_frame(MegasasState *s, MegasasCmd *cmd)
475 {
476     PCIDevice *p = PCI_DEVICE(s);
477 
478     if (cmd->pa_size) {
479         pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0);
480     }
481     cmd->frame = NULL;
482     cmd->pa = 0;
483     cmd->pa_size = 0;
484     qemu_sglist_destroy(&cmd->qsg);
485     clear_bit(cmd->index, s->frame_map);
486 }
487 
488 /*
489  * This absolutely needs to be locked if
490  * qemu ever goes multithreaded.
491  */
492 static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
493     hwaddr frame, uint64_t context, int count)
494 {
495     PCIDevice *pcid = PCI_DEVICE(s);
496     MegasasCmd *cmd = NULL;
497     int frame_size = MEGASAS_MAX_SGE * sizeof(union mfi_sgl);
498     hwaddr frame_size_p = frame_size;
499     unsigned long index;
500 
501     index = 0;
502     while (index < s->fw_cmds) {
503         index = find_next_zero_bit(s->frame_map, s->fw_cmds, index);
504         if (!s->frames[index].pa)
505             break;
506         /* Busy frame found */
507         trace_megasas_qf_mapped(index);
508     }
509     if (index >= s->fw_cmds) {
510         /* All frames busy */
511         trace_megasas_qf_busy(frame);
512         return NULL;
513     }
514     cmd = &s->frames[index];
515     set_bit(index, s->frame_map);
516     trace_megasas_qf_new(index, frame);
517 
518     cmd->pa = frame;
519     /* Map all possible frames */
520     cmd->frame = pci_dma_map(pcid, frame, &frame_size_p, 0);
521     if (!cmd->frame || frame_size_p != frame_size) {
522         trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
523         if (cmd->frame) {
524             megasas_unmap_frame(s, cmd);
525         }
526         s->event_count++;
527         return NULL;
528     }
529     cmd->pa_size = frame_size_p;
530     cmd->context = context;
531     if (!megasas_use_queue64(s)) {
532         cmd->context &= (uint64_t)0xFFFFFFFF;
533     }
534     cmd->count = count;
535     cmd->dcmd_opcode = -1;
536     s->busy++;
537 
538     if (s->consumer_pa) {
539         s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa,
540                                              MEMTXATTRS_UNSPECIFIED);
541     }
542     trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,
543                              s->reply_queue_head, s->reply_queue_tail, s->busy);
544 
545     return cmd;
546 }
547 
548 static void megasas_complete_frame(MegasasState *s, uint64_t context)
549 {
550     const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
551     PCIDevice *pci_dev = PCI_DEVICE(s);
552     int tail, queue_offset;
553 
554     /* Decrement busy count */
555     s->busy--;
556     if (s->reply_queue_pa) {
557         /*
558          * Put command on the reply queue.
559          * Context is opaque, but emulation is running in
560          * little endian. So convert it.
561          */
562         if (megasas_use_queue64(s)) {
563             queue_offset = s->reply_queue_head * sizeof(uint64_t);
564             stq_le_pci_dma(pci_dev, s->reply_queue_pa + queue_offset,
565                            context, attrs);
566         } else {
567             queue_offset = s->reply_queue_head * sizeof(uint32_t);
568             stl_le_pci_dma(pci_dev, s->reply_queue_pa + queue_offset,
569                            context, attrs);
570         }
571         s->reply_queue_tail = ldl_le_pci_dma(pci_dev, s->consumer_pa, attrs);
572         trace_megasas_qf_complete(context, s->reply_queue_head,
573                                   s->reply_queue_tail, s->busy);
574     }
575 
576     if (megasas_intr_enabled(s)) {
577         /* Update reply queue pointer */
578         s->reply_queue_tail = ldl_le_pci_dma(pci_dev, s->consumer_pa, attrs);
579         tail = s->reply_queue_head;
580         s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
581         trace_megasas_qf_update(s->reply_queue_head, s->reply_queue_tail,
582                                 s->busy);
583         stl_le_pci_dma(pci_dev, s->producer_pa, s->reply_queue_head, attrs);
584         /* Notify HBA */
585         if (msix_enabled(pci_dev)) {
586             trace_megasas_msix_raise(0);
587             msix_notify(pci_dev, 0);
588         } else if (msi_enabled(pci_dev)) {
589             trace_megasas_msi_raise(0);
590             msi_notify(pci_dev, 0);
591         } else {
592             s->doorbell++;
593             if (s->doorbell == 1) {
594                 trace_megasas_irq_raise();
595                 pci_irq_assert(pci_dev);
596             }
597         }
598     } else {
599         trace_megasas_qf_complete_noirq(context);
600     }
601 }
602 
603 static void megasas_complete_command(MegasasCmd *cmd)
604 {
605     cmd->iov_size = 0;
606     cmd->iov_offset = 0;
607 
608     cmd->req->hba_private = NULL;
609     scsi_req_unref(cmd->req);
610     cmd->req = NULL;
611 
612     megasas_unmap_frame(cmd->state, cmd);
613     megasas_complete_frame(cmd->state, cmd->context);
614 }
615 
616 static void megasas_reset_frames(MegasasState *s)
617 {
618     int i;
619     MegasasCmd *cmd;
620 
621     for (i = 0; i < s->fw_cmds; i++) {
622         cmd = &s->frames[i];
623         if (cmd->pa) {
624             megasas_unmap_frame(s, cmd);
625         }
626     }
627     bitmap_zero(s->frame_map, MEGASAS_MAX_FRAMES);
628 }
629 
630 static void megasas_abort_command(MegasasCmd *cmd)
631 {
632     /* Never abort internal commands.  */
633     if (cmd->dcmd_opcode != -1) {
634         return;
635     }
636     if (cmd->req != NULL) {
637         scsi_req_cancel(cmd->req);
638     }
639 }
640 
641 static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
642 {
643     const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
644     PCIDevice *pcid = PCI_DEVICE(s);
645     uint32_t pa_hi, pa_lo;
646     hwaddr iq_pa, initq_size = sizeof(struct mfi_init_qinfo);
647     struct mfi_init_qinfo *initq = NULL;
648     uint32_t flags;
649     int ret = MFI_STAT_OK;
650 
651     if (s->reply_queue_pa) {
652         trace_megasas_initq_mapped(s->reply_queue_pa);
653         goto out;
654     }
655     pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);
656     pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);
657     iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);
658     trace_megasas_init_firmware((uint64_t)iq_pa);
659     initq = pci_dma_map(pcid, iq_pa, &initq_size, 0);
660     if (!initq || initq_size != sizeof(*initq)) {
661         trace_megasas_initq_map_failed(cmd->index);
662         s->event_count++;
663         ret = MFI_STAT_MEMORY_NOT_AVAILABLE;
664         goto out;
665     }
666     s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;
667     if (s->reply_queue_len > s->fw_cmds) {
668         trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);
669         s->event_count++;
670         ret = MFI_STAT_INVALID_PARAMETER;
671         goto out;
672     }
673     pa_lo = le32_to_cpu(initq->rq_addr_lo);
674     pa_hi = le32_to_cpu(initq->rq_addr_hi);
675     s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;
676     pa_lo = le32_to_cpu(initq->ci_addr_lo);
677     pa_hi = le32_to_cpu(initq->ci_addr_hi);
678     s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
679     pa_lo = le32_to_cpu(initq->pi_addr_lo);
680     pa_hi = le32_to_cpu(initq->pi_addr_hi);
681     s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
682     s->reply_queue_head = ldl_le_pci_dma(pcid, s->producer_pa, attrs);
683     s->reply_queue_head %= MEGASAS_MAX_FRAMES;
684     s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa, attrs);
685     s->reply_queue_tail %= MEGASAS_MAX_FRAMES;
686     flags = le32_to_cpu(initq->flags);
687     if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
688         s->flags |= MEGASAS_MASK_USE_QUEUE64;
689     }
690     trace_megasas_init_queue((unsigned long)s->reply_queue_pa,
691                              s->reply_queue_len, s->reply_queue_head,
692                              s->reply_queue_tail, flags);
693     megasas_reset_frames(s);
694     s->fw_state = MFI_FWSTATE_OPERATIONAL;
695 out:
696     if (initq) {
697         pci_dma_unmap(pcid, initq, initq_size, 0, 0);
698     }
699     return ret;
700 }
701 
702 static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
703 {
704     dma_addr_t iov_pa, iov_size;
705     int iov_count;
706 
707     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
708     iov_count = cmd->frame->header.sge_count;
709     if (!iov_count) {
710         trace_megasas_dcmd_zero_sge(cmd->index);
711         cmd->iov_size = 0;
712         return 0;
713     } else if (iov_count > 1) {
714         trace_megasas_dcmd_invalid_sge(cmd->index, iov_count);
715         cmd->iov_size = 0;
716         return -EINVAL;
717     }
718     iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
719     iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
720     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), 1);
721     qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
722     cmd->iov_size = iov_size;
723     return 0;
724 }
725 
726 static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
727 {
728     trace_megasas_finish_dcmd(cmd->index, iov_size);
729 
730     if (iov_size > cmd->iov_size) {
731         if (megasas_frame_is_ieee_sgl(cmd)) {
732             cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);
733         } else if (megasas_frame_is_sgl64(cmd)) {
734             cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);
735         } else {
736             cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);
737         }
738     }
739 }
740 
741 static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
742 {
743     PCIDevice *pci_dev = PCI_DEVICE(s);
744     PCIDeviceClass *pci_class = PCI_DEVICE_GET_CLASS(pci_dev);
745     MegasasBaseClass *base_class = MEGASAS_GET_CLASS(s);
746     struct mfi_ctrl_info info;
747     size_t dcmd_size = sizeof(info);
748     BusChild *kid;
749     int num_pd_disks = 0;
750 
751     memset(&info, 0x0, dcmd_size);
752     if (cmd->iov_size < dcmd_size) {
753         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
754                                             dcmd_size);
755         return MFI_STAT_INVALID_PARAMETER;
756     }
757 
758     info.pci.vendor = cpu_to_le16(pci_class->vendor_id);
759     info.pci.device = cpu_to_le16(pci_class->device_id);
760     info.pci.subvendor = cpu_to_le16(pci_class->subsystem_vendor_id);
761     info.pci.subdevice = cpu_to_le16(pci_class->subsystem_id);
762 
763     /*
764      * For some reason the firmware supports
765      * only up to 8 device ports.
766      * Despite supporting a far larger number
767      * of devices for the physical devices.
768      * So just display the first 8 devices
769      * in the device port list, independent
770      * of how many logical devices are actually
771      * present.
772      */
773     info.host.type = MFI_INFO_HOST_PCIE;
774     info.device.type = MFI_INFO_DEV_SAS3G;
775     info.device.port_count = 8;
776     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
777         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
778         uint16_t pd_id;
779 
780         if (num_pd_disks < 8) {
781             pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
782             info.device.port_addr[num_pd_disks] =
783                 cpu_to_le64(megasas_get_sata_addr(pd_id));
784         }
785         num_pd_disks++;
786     }
787 
788     memcpy(info.product_name, base_class->product_name, 24);
789     snprintf(info.serial_number, 32, "%s", s->hba_serial);
790     snprintf(info.package_version, 0x60, "%s-QEMU", qemu_hw_version());
791     memcpy(info.image_component[0].name, "APP", 3);
792     snprintf(info.image_component[0].version, 10, "%s-QEMU",
793              base_class->product_version);
794     memcpy(info.image_component[0].build_date, "Apr  1 2014", 11);
795     memcpy(info.image_component[0].build_time, "12:34:56", 8);
796     info.image_component_count = 1;
797     if (pci_dev->has_rom) {
798         uint8_t biosver[32];
799         uint8_t *ptr;
800 
801         ptr = memory_region_get_ram_ptr(&pci_dev->rom);
802         memcpy(biosver, ptr + 0x41, 31);
803         biosver[31] = 0;
804         memcpy(info.image_component[1].name, "BIOS", 4);
805         memcpy(info.image_component[1].version, biosver,
806                strlen((const char *)biosver));
807         info.image_component_count++;
808     }
809     info.current_fw_time = cpu_to_le32(megasas_fw_time());
810     info.max_arms = 32;
811     info.max_spans = 8;
812     info.max_arrays = MEGASAS_MAX_ARRAYS;
813     info.max_lds = MFI_MAX_LD;
814     info.max_cmds = cpu_to_le16(s->fw_cmds);
815     info.max_sg_elements = cpu_to_le16(s->fw_sge);
816     info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);
817     if (!megasas_is_jbod(s))
818         info.lds_present = cpu_to_le16(num_pd_disks);
819     info.pd_present = cpu_to_le16(num_pd_disks);
820     info.pd_disks_present = cpu_to_le16(num_pd_disks);
821     info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |
822                                    MFI_INFO_HW_MEM |
823                                    MFI_INFO_HW_FLASH);
824     info.memory_size = cpu_to_le16(512);
825     info.nvram_size = cpu_to_le16(32);
826     info.flash_size = cpu_to_le16(16);
827     info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);
828     info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |
829                                     MFI_INFO_AOPS_SELF_DIAGNOSTIC |
830                                     MFI_INFO_AOPS_MIXED_ARRAY);
831     info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |
832                                MFI_INFO_LDOPS_ACCESS_POLICY |
833                                MFI_INFO_LDOPS_IO_POLICY |
834                                MFI_INFO_LDOPS_WRITE_POLICY |
835                                MFI_INFO_LDOPS_READ_POLICY);
836     info.max_strips_per_io = cpu_to_le16(s->fw_sge);
837     info.stripe_sz_ops.min = 3;
838     info.stripe_sz_ops.max = ctz32(MEGASAS_MAX_SECTORS + 1);
839     info.properties.pred_fail_poll_interval = cpu_to_le16(300);
840     info.properties.intr_throttle_cnt = cpu_to_le16(16);
841     info.properties.intr_throttle_timeout = cpu_to_le16(50);
842     info.properties.rebuild_rate = 30;
843     info.properties.patrol_read_rate = 30;
844     info.properties.bgi_rate = 30;
845     info.properties.cc_rate = 30;
846     info.properties.recon_rate = 30;
847     info.properties.cache_flush_interval = 4;
848     info.properties.spinup_drv_cnt = 2;
849     info.properties.spinup_delay = 6;
850     info.properties.ecc_bucket_size = 15;
851     info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);
852     info.properties.expose_encl_devices = 1;
853     info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);
854     info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |
855                                MFI_INFO_PDOPS_FORCE_OFFLINE);
856     info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |
857                                        MFI_INFO_PDMIX_SATA |
858                                        MFI_INFO_PDMIX_LD);
859 
860     cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
861     return MFI_STAT_OK;
862 }
863 
864 static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)
865 {
866     struct mfi_defaults info;
867     size_t dcmd_size = sizeof(struct mfi_defaults);
868 
869     memset(&info, 0x0, dcmd_size);
870     if (cmd->iov_size < dcmd_size) {
871         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
872                                             dcmd_size);
873         return MFI_STAT_INVALID_PARAMETER;
874     }
875 
876     info.sas_addr = cpu_to_le64(s->sas_addr);
877     info.stripe_size = 3;
878     info.flush_time = 4;
879     info.background_rate = 30;
880     info.allow_mix_in_enclosure = 1;
881     info.allow_mix_in_ld = 1;
882     info.direct_pd_mapping = 1;
883     /* Enable for BIOS support */
884     info.bios_enumerate_lds = 1;
885     info.disable_ctrl_r = 1;
886     info.expose_enclosure_devices = 1;
887     info.disable_preboot_cli = 1;
888     info.cluster_disable = 1;
889 
890     cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
891     return MFI_STAT_OK;
892 }
893 
894 static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)
895 {
896     struct mfi_bios_data info;
897     size_t dcmd_size = sizeof(info);
898 
899     memset(&info, 0x0, dcmd_size);
900     if (cmd->iov_size < dcmd_size) {
901         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
902                                             dcmd_size);
903         return MFI_STAT_INVALID_PARAMETER;
904     }
905     info.continue_on_error = 1;
906     info.verbose = 1;
907     if (megasas_is_jbod(s)) {
908         info.expose_all_drives = 1;
909     }
910 
911     cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
912     return MFI_STAT_OK;
913 }
914 
915 static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)
916 {
917     uint64_t fw_time;
918     size_t dcmd_size = sizeof(fw_time);
919 
920     fw_time = cpu_to_le64(megasas_fw_time());
921 
922     cmd->iov_size -= dma_buf_read(&fw_time, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
923     return MFI_STAT_OK;
924 }
925 
926 static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)
927 {
928     uint64_t fw_time;
929 
930     /* This is a dummy; setting of firmware time is not allowed */
931     memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));
932 
933     trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);
934     fw_time = cpu_to_le64(megasas_fw_time());
935     return MFI_STAT_OK;
936 }
937 
938 static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)
939 {
940     struct mfi_evt_log_state info;
941     size_t dcmd_size = sizeof(info);
942 
943     memset(&info, 0, dcmd_size);
944 
945     info.newest_seq_num = cpu_to_le32(s->event_count);
946     info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
947     info.boot_seq_num = cpu_to_le32(s->boot_event);
948 
949     cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
950     return MFI_STAT_OK;
951 }
952 
953 static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
954 {
955     union mfi_evt event;
956 
957     if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {
958         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
959                                             sizeof(struct mfi_evt_detail));
960         return MFI_STAT_INVALID_PARAMETER;
961     }
962     s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);
963     event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);
964     s->event_locale = event.members.locale;
965     s->event_class = event.members.class;
966     s->event_cmd = cmd;
967     /* Decrease busy count; event frame doesn't count here */
968     s->busy--;
969     cmd->iov_size = sizeof(struct mfi_evt_detail);
970     return MFI_STAT_INVALID_STATUS;
971 }
972 
973 static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
974 {
975     struct mfi_pd_list info;
976     size_t dcmd_size = sizeof(info);
977     BusChild *kid;
978     uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
979 
980     memset(&info, 0, dcmd_size);
981     offset = 8;
982     dcmd_limit = offset + sizeof(struct mfi_pd_address);
983     if (cmd->iov_size < dcmd_limit) {
984         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
985                                             dcmd_limit);
986         return MFI_STAT_INVALID_PARAMETER;
987     }
988 
989     max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);
990     if (max_pd_disks > MFI_MAX_SYS_PDS) {
991         max_pd_disks = MFI_MAX_SYS_PDS;
992     }
993     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
994         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
995         uint16_t pd_id;
996 
997         if (num_pd_disks >= max_pd_disks)
998             break;
999 
1000         pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
1001         info.addr[num_pd_disks].device_id = cpu_to_le16(pd_id);
1002         info.addr[num_pd_disks].encl_device_id = 0xFFFF;
1003         info.addr[num_pd_disks].encl_index = 0;
1004         info.addr[num_pd_disks].slot_number = sdev->id & 0xFF;
1005         info.addr[num_pd_disks].scsi_dev_type = sdev->type;
1006         info.addr[num_pd_disks].connect_port_bitmap = 0x1;
1007         info.addr[num_pd_disks].sas_addr[0] =
1008             cpu_to_le64(megasas_get_sata_addr(pd_id));
1009         num_pd_disks++;
1010         offset += sizeof(struct mfi_pd_address);
1011     }
1012     trace_megasas_dcmd_pd_get_list(cmd->index, num_pd_disks,
1013                                    max_pd_disks, offset);
1014 
1015     info.size = cpu_to_le32(offset);
1016     info.count = cpu_to_le32(num_pd_disks);
1017 
1018     cmd->iov_size -= dma_buf_read(&info, offset, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
1019     return MFI_STAT_OK;
1020 }
1021 
1022 static int megasas_dcmd_pd_list_query(MegasasState *s, MegasasCmd *cmd)
1023 {
1024     uint16_t flags;
1025 
1026     /* mbox0 contains flags */
1027     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1028     trace_megasas_dcmd_pd_list_query(cmd->index, flags);
1029     if (flags == MR_PD_QUERY_TYPE_ALL ||
1030         megasas_is_jbod(s)) {
1031         return megasas_dcmd_pd_get_list(s, cmd);
1032     }
1033 
1034     return MFI_STAT_OK;
1035 }
1036 
1037 static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun,
1038                                       MegasasCmd *cmd)
1039 {
1040     struct mfi_pd_info *info = cmd->iov_buf;
1041     size_t dcmd_size = sizeof(struct mfi_pd_info);
1042     uint64_t pd_size;
1043     uint16_t pd_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1044     uint8_t cmdbuf[6];
1045     size_t len, resid;
1046 
1047     if (!cmd->iov_buf) {
1048         cmd->iov_buf = g_malloc0(dcmd_size);
1049         info = cmd->iov_buf;
1050         info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */
1051         info->vpd_page83[0] = 0x7f;
1052         megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data));
1053         cmd->req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1054         if (!cmd->req) {
1055             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1056                                                 "PD get info std inquiry");
1057             g_free(cmd->iov_buf);
1058             cmd->iov_buf = NULL;
1059             return MFI_STAT_FLASH_ALLOC_FAIL;
1060         }
1061         trace_megasas_dcmd_internal_submit(cmd->index,
1062                                            "PD get info std inquiry", lun);
1063         len = scsi_req_enqueue(cmd->req);
1064         if (len > 0) {
1065             cmd->iov_size = len;
1066             scsi_req_continue(cmd->req);
1067         }
1068         return MFI_STAT_INVALID_STATUS;
1069     } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) {
1070         megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83));
1071         cmd->req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1072         if (!cmd->req) {
1073             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1074                                                 "PD get info vpd inquiry");
1075             return MFI_STAT_FLASH_ALLOC_FAIL;
1076         }
1077         trace_megasas_dcmd_internal_submit(cmd->index,
1078                                            "PD get info vpd inquiry", lun);
1079         len = scsi_req_enqueue(cmd->req);
1080         if (len > 0) {
1081             cmd->iov_size = len;
1082             scsi_req_continue(cmd->req);
1083         }
1084         return MFI_STAT_INVALID_STATUS;
1085     }
1086     /* Finished, set FW state */
1087     if ((info->inquiry_data[0] >> 5) == 0) {
1088         if (megasas_is_jbod(cmd->state)) {
1089             info->fw_state = cpu_to_le16(MFI_PD_STATE_SYSTEM);
1090         } else {
1091             info->fw_state = cpu_to_le16(MFI_PD_STATE_ONLINE);
1092         }
1093     } else {
1094         info->fw_state = cpu_to_le16(MFI_PD_STATE_OFFLINE);
1095     }
1096 
1097     info->ref.v.device_id = cpu_to_le16(pd_id);
1098     info->state.ddf.pd_type = cpu_to_le16(MFI_PD_DDF_TYPE_IN_VD|
1099                                           MFI_PD_DDF_TYPE_INTF_SAS);
1100     blk_get_geometry(sdev->conf.blk, &pd_size);
1101     info->raw_size = cpu_to_le64(pd_size);
1102     info->non_coerced_size = cpu_to_le64(pd_size);
1103     info->coerced_size = cpu_to_le64(pd_size);
1104     info->encl_device_id = 0xFFFF;
1105     info->slot_number = (sdev->id & 0xFF);
1106     info->path_info.count = 1;
1107     info->path_info.sas_addr[0] =
1108         cpu_to_le64(megasas_get_sata_addr(pd_id));
1109     info->connected_port_bitmap = 0x1;
1110     info->device_speed = 1;
1111     info->link_speed = 1;
1112     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
1113     g_free(cmd->iov_buf);
1114     cmd->iov_size = dcmd_size - resid;
1115     cmd->iov_buf = NULL;
1116     return MFI_STAT_OK;
1117 }
1118 
1119 static int megasas_dcmd_pd_get_info(MegasasState *s, MegasasCmd *cmd)
1120 {
1121     size_t dcmd_size = sizeof(struct mfi_pd_info);
1122     uint16_t pd_id;
1123     uint8_t target_id, lun_id;
1124     SCSIDevice *sdev = NULL;
1125     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1126 
1127     if (cmd->iov_size < dcmd_size) {
1128         return MFI_STAT_INVALID_PARAMETER;
1129     }
1130 
1131     /* mbox0 has the ID */
1132     pd_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1133     target_id = (pd_id >> 8) & 0xFF;
1134     lun_id = pd_id & 0xFF;
1135     sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
1136     trace_megasas_dcmd_pd_get_info(cmd->index, pd_id);
1137 
1138     if (sdev) {
1139         /* Submit inquiry */
1140         retval = megasas_pd_get_info_submit(sdev, pd_id, cmd);
1141     }
1142 
1143     return retval;
1144 }
1145 
1146 static int megasas_dcmd_ld_get_list(MegasasState *s, MegasasCmd *cmd)
1147 {
1148     struct mfi_ld_list info;
1149     size_t dcmd_size = sizeof(info), resid;
1150     uint32_t num_ld_disks = 0, max_ld_disks;
1151     uint64_t ld_size;
1152     BusChild *kid;
1153 
1154     memset(&info, 0, dcmd_size);
1155     if (cmd->iov_size > dcmd_size) {
1156         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1157                                             dcmd_size);
1158         return MFI_STAT_INVALID_PARAMETER;
1159     }
1160 
1161     max_ld_disks = (cmd->iov_size - 8) / 16;
1162     if (megasas_is_jbod(s)) {
1163         max_ld_disks = 0;
1164     }
1165     if (max_ld_disks > MFI_MAX_LD) {
1166         max_ld_disks = MFI_MAX_LD;
1167     }
1168     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1169         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1170 
1171         if (num_ld_disks >= max_ld_disks) {
1172             break;
1173         }
1174         /* Logical device size is in blocks */
1175         blk_get_geometry(sdev->conf.blk, &ld_size);
1176         info.ld_list[num_ld_disks].ld.v.target_id = sdev->id;
1177         info.ld_list[num_ld_disks].state = MFI_LD_STATE_OPTIMAL;
1178         info.ld_list[num_ld_disks].size = cpu_to_le64(ld_size);
1179         num_ld_disks++;
1180     }
1181     info.ld_count = cpu_to_le32(num_ld_disks);
1182     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1183 
1184     resid = dma_buf_read(&info, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
1185     cmd->iov_size = dcmd_size - resid;
1186     return MFI_STAT_OK;
1187 }
1188 
1189 static int megasas_dcmd_ld_list_query(MegasasState *s, MegasasCmd *cmd)
1190 {
1191     uint16_t flags;
1192     struct mfi_ld_targetid_list info;
1193     size_t dcmd_size = sizeof(info), resid;
1194     uint32_t num_ld_disks = 0, max_ld_disks = s->fw_luns;
1195     BusChild *kid;
1196 
1197     /* mbox0 contains flags */
1198     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1199     trace_megasas_dcmd_ld_list_query(cmd->index, flags);
1200     if (flags != MR_LD_QUERY_TYPE_ALL &&
1201         flags != MR_LD_QUERY_TYPE_EXPOSED_TO_HOST) {
1202         max_ld_disks = 0;
1203     }
1204 
1205     memset(&info, 0, dcmd_size);
1206     if (cmd->iov_size < 12) {
1207         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1208                                             dcmd_size);
1209         return MFI_STAT_INVALID_PARAMETER;
1210     }
1211     dcmd_size = sizeof(uint32_t) * 2 + 3;
1212     max_ld_disks = cmd->iov_size - dcmd_size;
1213     if (megasas_is_jbod(s)) {
1214         max_ld_disks = 0;
1215     }
1216     if (max_ld_disks > MFI_MAX_LD) {
1217         max_ld_disks = MFI_MAX_LD;
1218     }
1219     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1220         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1221 
1222         if (num_ld_disks >= max_ld_disks) {
1223             break;
1224         }
1225         info.targetid[num_ld_disks] = sdev->lun;
1226         num_ld_disks++;
1227         dcmd_size++;
1228     }
1229     info.ld_count = cpu_to_le32(num_ld_disks);
1230     info.size = dcmd_size;
1231     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1232 
1233     resid = dma_buf_read(&info, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
1234     cmd->iov_size = dcmd_size - resid;
1235     return MFI_STAT_OK;
1236 }
1237 
1238 static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun,
1239                                       MegasasCmd *cmd)
1240 {
1241     struct mfi_ld_info *info = cmd->iov_buf;
1242     size_t dcmd_size = sizeof(struct mfi_ld_info);
1243     uint8_t cdb[6];
1244     ssize_t len, resid;
1245     uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1246     uint64_t ld_size;
1247 
1248     if (!cmd->iov_buf) {
1249         cmd->iov_buf = g_malloc0(dcmd_size);
1250         info = cmd->iov_buf;
1251         megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83));
1252         cmd->req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd);
1253         if (!cmd->req) {
1254             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1255                                                 "LD get info vpd inquiry");
1256             g_free(cmd->iov_buf);
1257             cmd->iov_buf = NULL;
1258             return MFI_STAT_FLASH_ALLOC_FAIL;
1259         }
1260         trace_megasas_dcmd_internal_submit(cmd->index,
1261                                            "LD get info vpd inquiry", lun);
1262         len = scsi_req_enqueue(cmd->req);
1263         if (len > 0) {
1264             cmd->iov_size = len;
1265             scsi_req_continue(cmd->req);
1266         }
1267         return MFI_STAT_INVALID_STATUS;
1268     }
1269 
1270     info->ld_config.params.state = MFI_LD_STATE_OPTIMAL;
1271     info->ld_config.properties.ld.v.target_id = lun;
1272     info->ld_config.params.stripe_size = 3;
1273     info->ld_config.params.num_drives = 1;
1274     info->ld_config.params.is_consistent = 1;
1275     /* Logical device size is in blocks */
1276     blk_get_geometry(sdev->conf.blk, &ld_size);
1277     info->size = cpu_to_le64(ld_size);
1278     memset(info->ld_config.span, 0, sizeof(info->ld_config.span));
1279     info->ld_config.span[0].start_block = 0;
1280     info->ld_config.span[0].num_blocks = info->size;
1281     info->ld_config.span[0].array_ref = cpu_to_le16(sdev_id);
1282 
1283     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
1284     g_free(cmd->iov_buf);
1285     cmd->iov_size = dcmd_size - resid;
1286     cmd->iov_buf = NULL;
1287     return MFI_STAT_OK;
1288 }
1289 
1290 static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
1291 {
1292     struct mfi_ld_info info;
1293     size_t dcmd_size = sizeof(info);
1294     uint16_t ld_id;
1295     uint32_t max_ld_disks = s->fw_luns;
1296     SCSIDevice *sdev = NULL;
1297     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1298 
1299     if (cmd->iov_size < dcmd_size) {
1300         return MFI_STAT_INVALID_PARAMETER;
1301     }
1302 
1303     /* mbox0 has the ID */
1304     ld_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1305     trace_megasas_dcmd_ld_get_info(cmd->index, ld_id);
1306 
1307     if (megasas_is_jbod(s)) {
1308         return MFI_STAT_DEVICE_NOT_FOUND;
1309     }
1310 
1311     if (ld_id < max_ld_disks) {
1312         sdev = scsi_device_find(&s->bus, 0, ld_id, 0);
1313     }
1314 
1315     if (sdev) {
1316         retval = megasas_ld_get_info_submit(sdev, ld_id, cmd);
1317     }
1318 
1319     return retval;
1320 }
1321 
1322 static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
1323 {
1324     uint8_t data[4096] = { 0 };
1325     struct mfi_config_data *info;
1326     int num_pd_disks = 0, array_offset, ld_offset;
1327     BusChild *kid;
1328 
1329     if (cmd->iov_size > 4096) {
1330         return MFI_STAT_INVALID_PARAMETER;
1331     }
1332 
1333     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1334         num_pd_disks++;
1335     }
1336     info = (struct mfi_config_data *)&data;
1337     /*
1338      * Array mapping:
1339      * - One array per SCSI device
1340      * - One logical drive per SCSI device
1341      *   spanning the entire device
1342      */
1343     info->array_count = num_pd_disks;
1344     info->array_size = sizeof(struct mfi_array) * num_pd_disks;
1345     info->log_drv_count = num_pd_disks;
1346     info->log_drv_size = sizeof(struct mfi_ld_config) * num_pd_disks;
1347     info->spares_count = 0;
1348     info->spares_size = sizeof(struct mfi_spare);
1349     info->size = sizeof(struct mfi_config_data) + info->array_size +
1350         info->log_drv_size;
1351     if (info->size > 4096) {
1352         return MFI_STAT_INVALID_PARAMETER;
1353     }
1354 
1355     array_offset = sizeof(struct mfi_config_data);
1356     ld_offset = array_offset + sizeof(struct mfi_array) * num_pd_disks;
1357 
1358     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1359         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1360         uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
1361         struct mfi_array *array;
1362         struct mfi_ld_config *ld;
1363         uint64_t pd_size;
1364         int i;
1365 
1366         array = (struct mfi_array *)(data + array_offset);
1367         blk_get_geometry(sdev->conf.blk, &pd_size);
1368         array->size = cpu_to_le64(pd_size);
1369         array->num_drives = 1;
1370         array->array_ref = cpu_to_le16(sdev_id);
1371         array->pd[0].ref.v.device_id = cpu_to_le16(sdev_id);
1372         array->pd[0].ref.v.seq_num = 0;
1373         array->pd[0].fw_state = MFI_PD_STATE_ONLINE;
1374         array->pd[0].encl.pd = 0xFF;
1375         array->pd[0].encl.slot = (sdev->id & 0xFF);
1376         for (i = 1; i < MFI_MAX_ROW_SIZE; i++) {
1377             array->pd[i].ref.v.device_id = 0xFFFF;
1378             array->pd[i].ref.v.seq_num = 0;
1379             array->pd[i].fw_state = MFI_PD_STATE_UNCONFIGURED_GOOD;
1380             array->pd[i].encl.pd = 0xFF;
1381             array->pd[i].encl.slot = 0xFF;
1382         }
1383         array_offset += sizeof(struct mfi_array);
1384         ld = (struct mfi_ld_config *)(data + ld_offset);
1385         memset(ld, 0, sizeof(struct mfi_ld_config));
1386         ld->properties.ld.v.target_id = sdev->id;
1387         ld->properties.default_cache_policy = MR_LD_CACHE_READ_AHEAD |
1388             MR_LD_CACHE_READ_ADAPTIVE;
1389         ld->properties.current_cache_policy = MR_LD_CACHE_READ_AHEAD |
1390             MR_LD_CACHE_READ_ADAPTIVE;
1391         ld->params.state = MFI_LD_STATE_OPTIMAL;
1392         ld->params.stripe_size = 3;
1393         ld->params.num_drives = 1;
1394         ld->params.span_depth = 1;
1395         ld->params.is_consistent = 1;
1396         ld->span[0].start_block = 0;
1397         ld->span[0].num_blocks = cpu_to_le64(pd_size);
1398         ld->span[0].array_ref = cpu_to_le16(sdev_id);
1399         ld_offset += sizeof(struct mfi_ld_config);
1400     }
1401 
1402     cmd->iov_size -= dma_buf_read(data, info->size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
1403     return MFI_STAT_OK;
1404 }
1405 
1406 static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
1407 {
1408     struct mfi_ctrl_props info;
1409     size_t dcmd_size = sizeof(info);
1410 
1411     memset(&info, 0x0, dcmd_size);
1412     if (cmd->iov_size < dcmd_size) {
1413         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1414                                             dcmd_size);
1415         return MFI_STAT_INVALID_PARAMETER;
1416     }
1417     info.pred_fail_poll_interval = cpu_to_le16(300);
1418     info.intr_throttle_cnt = cpu_to_le16(16);
1419     info.intr_throttle_timeout = cpu_to_le16(50);
1420     info.rebuild_rate = 30;
1421     info.patrol_read_rate = 30;
1422     info.bgi_rate = 30;
1423     info.cc_rate = 30;
1424     info.recon_rate = 30;
1425     info.cache_flush_interval = 4;
1426     info.spinup_drv_cnt = 2;
1427     info.spinup_delay = 6;
1428     info.ecc_bucket_size = 15;
1429     info.ecc_bucket_leak_rate = cpu_to_le16(1440);
1430     info.expose_encl_devices = 1;
1431 
1432     cmd->iov_size -= dma_buf_read(&info, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
1433     return MFI_STAT_OK;
1434 }
1435 
1436 static int megasas_cache_flush(MegasasState *s, MegasasCmd *cmd)
1437 {
1438     blk_drain_all();
1439     return MFI_STAT_OK;
1440 }
1441 
1442 static int megasas_ctrl_shutdown(MegasasState *s, MegasasCmd *cmd)
1443 {
1444     s->fw_state = MFI_FWSTATE_READY;
1445     return MFI_STAT_OK;
1446 }
1447 
1448 /* Some implementations use CLUSTER RESET LD to simulate a device reset */
1449 static int megasas_cluster_reset_ld(MegasasState *s, MegasasCmd *cmd)
1450 {
1451     uint16_t target_id;
1452     int i;
1453 
1454     /* mbox0 contains the device index */
1455     target_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1456     trace_megasas_dcmd_reset_ld(cmd->index, target_id);
1457     for (i = 0; i < s->fw_cmds; i++) {
1458         MegasasCmd *tmp_cmd = &s->frames[i];
1459         if (tmp_cmd->req && tmp_cmd->req->dev->id == target_id) {
1460             SCSIDevice *d = tmp_cmd->req->dev;
1461             qdev_reset_all(&d->qdev);
1462         }
1463     }
1464     return MFI_STAT_OK;
1465 }
1466 
1467 static int megasas_dcmd_set_properties(MegasasState *s, MegasasCmd *cmd)
1468 {
1469     struct mfi_ctrl_props info;
1470     size_t dcmd_size = sizeof(info);
1471 
1472     if (cmd->iov_size < dcmd_size) {
1473         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1474                                             dcmd_size);
1475         return MFI_STAT_INVALID_PARAMETER;
1476     }
1477     dma_buf_write(&info, dcmd_size, &cmd->qsg, MEMTXATTRS_UNSPECIFIED);
1478     trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
1479     return MFI_STAT_OK;
1480 }
1481 
1482 static int megasas_dcmd_dummy(MegasasState *s, MegasasCmd *cmd)
1483 {
1484     trace_megasas_dcmd_dummy(cmd->index, cmd->iov_size);
1485     return MFI_STAT_OK;
1486 }
1487 
1488 static const struct dcmd_cmd_tbl_t {
1489     int opcode;
1490     const char *desc;
1491     int (*func)(MegasasState *s, MegasasCmd *cmd);
1492 } dcmd_cmd_tbl[] = {
1493     { MFI_DCMD_CTRL_MFI_HOST_MEM_ALLOC, "CTRL_HOST_MEM_ALLOC",
1494       megasas_dcmd_dummy },
1495     { MFI_DCMD_CTRL_GET_INFO, "CTRL_GET_INFO",
1496       megasas_ctrl_get_info },
1497     { MFI_DCMD_CTRL_GET_PROPERTIES, "CTRL_GET_PROPERTIES",
1498       megasas_dcmd_get_properties },
1499     { MFI_DCMD_CTRL_SET_PROPERTIES, "CTRL_SET_PROPERTIES",
1500       megasas_dcmd_set_properties },
1501     { MFI_DCMD_CTRL_ALARM_GET, "CTRL_ALARM_GET",
1502       megasas_dcmd_dummy },
1503     { MFI_DCMD_CTRL_ALARM_ENABLE, "CTRL_ALARM_ENABLE",
1504       megasas_dcmd_dummy },
1505     { MFI_DCMD_CTRL_ALARM_DISABLE, "CTRL_ALARM_DISABLE",
1506       megasas_dcmd_dummy },
1507     { MFI_DCMD_CTRL_ALARM_SILENCE, "CTRL_ALARM_SILENCE",
1508       megasas_dcmd_dummy },
1509     { MFI_DCMD_CTRL_ALARM_TEST, "CTRL_ALARM_TEST",
1510       megasas_dcmd_dummy },
1511     { MFI_DCMD_CTRL_EVENT_GETINFO, "CTRL_EVENT_GETINFO",
1512       megasas_event_info },
1513     { MFI_DCMD_CTRL_EVENT_GET, "CTRL_EVENT_GET",
1514       megasas_dcmd_dummy },
1515     { MFI_DCMD_CTRL_EVENT_WAIT, "CTRL_EVENT_WAIT",
1516       megasas_event_wait },
1517     { MFI_DCMD_CTRL_SHUTDOWN, "CTRL_SHUTDOWN",
1518       megasas_ctrl_shutdown },
1519     { MFI_DCMD_HIBERNATE_STANDBY, "CTRL_STANDBY",
1520       megasas_dcmd_dummy },
1521     { MFI_DCMD_CTRL_GET_TIME, "CTRL_GET_TIME",
1522       megasas_dcmd_get_fw_time },
1523     { MFI_DCMD_CTRL_SET_TIME, "CTRL_SET_TIME",
1524       megasas_dcmd_set_fw_time },
1525     { MFI_DCMD_CTRL_BIOS_DATA_GET, "CTRL_BIOS_DATA_GET",
1526       megasas_dcmd_get_bios_info },
1527     { MFI_DCMD_CTRL_FACTORY_DEFAULTS, "CTRL_FACTORY_DEFAULTS",
1528       megasas_dcmd_dummy },
1529     { MFI_DCMD_CTRL_MFC_DEFAULTS_GET, "CTRL_MFC_DEFAULTS_GET",
1530       megasas_mfc_get_defaults },
1531     { MFI_DCMD_CTRL_MFC_DEFAULTS_SET, "CTRL_MFC_DEFAULTS_SET",
1532       megasas_dcmd_dummy },
1533     { MFI_DCMD_CTRL_CACHE_FLUSH, "CTRL_CACHE_FLUSH",
1534       megasas_cache_flush },
1535     { MFI_DCMD_PD_GET_LIST, "PD_GET_LIST",
1536       megasas_dcmd_pd_get_list },
1537     { MFI_DCMD_PD_LIST_QUERY, "PD_LIST_QUERY",
1538       megasas_dcmd_pd_list_query },
1539     { MFI_DCMD_PD_GET_INFO, "PD_GET_INFO",
1540       megasas_dcmd_pd_get_info },
1541     { MFI_DCMD_PD_STATE_SET, "PD_STATE_SET",
1542       megasas_dcmd_dummy },
1543     { MFI_DCMD_PD_REBUILD, "PD_REBUILD",
1544       megasas_dcmd_dummy },
1545     { MFI_DCMD_PD_BLINK, "PD_BLINK",
1546       megasas_dcmd_dummy },
1547     { MFI_DCMD_PD_UNBLINK, "PD_UNBLINK",
1548       megasas_dcmd_dummy },
1549     { MFI_DCMD_LD_GET_LIST, "LD_GET_LIST",
1550       megasas_dcmd_ld_get_list},
1551     { MFI_DCMD_LD_LIST_QUERY, "LD_LIST_QUERY",
1552       megasas_dcmd_ld_list_query },
1553     { MFI_DCMD_LD_GET_INFO, "LD_GET_INFO",
1554       megasas_dcmd_ld_get_info },
1555     { MFI_DCMD_LD_GET_PROP, "LD_GET_PROP",
1556       megasas_dcmd_dummy },
1557     { MFI_DCMD_LD_SET_PROP, "LD_SET_PROP",
1558       megasas_dcmd_dummy },
1559     { MFI_DCMD_LD_DELETE, "LD_DELETE",
1560       megasas_dcmd_dummy },
1561     { MFI_DCMD_CFG_READ, "CFG_READ",
1562       megasas_dcmd_cfg_read },
1563     { MFI_DCMD_CFG_ADD, "CFG_ADD",
1564       megasas_dcmd_dummy },
1565     { MFI_DCMD_CFG_CLEAR, "CFG_CLEAR",
1566       megasas_dcmd_dummy },
1567     { MFI_DCMD_CFG_FOREIGN_READ, "CFG_FOREIGN_READ",
1568       megasas_dcmd_dummy },
1569     { MFI_DCMD_CFG_FOREIGN_IMPORT, "CFG_FOREIGN_IMPORT",
1570       megasas_dcmd_dummy },
1571     { MFI_DCMD_BBU_STATUS, "BBU_STATUS",
1572       megasas_dcmd_dummy },
1573     { MFI_DCMD_BBU_CAPACITY_INFO, "BBU_CAPACITY_INFO",
1574       megasas_dcmd_dummy },
1575     { MFI_DCMD_BBU_DESIGN_INFO, "BBU_DESIGN_INFO",
1576       megasas_dcmd_dummy },
1577     { MFI_DCMD_BBU_PROP_GET, "BBU_PROP_GET",
1578       megasas_dcmd_dummy },
1579     { MFI_DCMD_CLUSTER, "CLUSTER",
1580       megasas_dcmd_dummy },
1581     { MFI_DCMD_CLUSTER_RESET_ALL, "CLUSTER_RESET_ALL",
1582       megasas_dcmd_dummy },
1583     { MFI_DCMD_CLUSTER_RESET_LD, "CLUSTER_RESET_LD",
1584       megasas_cluster_reset_ld },
1585     { -1, NULL, NULL }
1586 };
1587 
1588 static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)
1589 {
1590     int retval = 0;
1591     size_t len;
1592     const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;
1593 
1594     cmd->dcmd_opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1595     trace_megasas_handle_dcmd(cmd->index, cmd->dcmd_opcode);
1596     if (megasas_map_dcmd(s, cmd) < 0) {
1597         return MFI_STAT_MEMORY_NOT_AVAILABLE;
1598     }
1599     while (cmdptr->opcode != -1 && cmdptr->opcode != cmd->dcmd_opcode) {
1600         cmdptr++;
1601     }
1602     len = cmd->iov_size;
1603     if (cmdptr->opcode == -1) {
1604         trace_megasas_dcmd_unhandled(cmd->index, cmd->dcmd_opcode, len);
1605         retval = megasas_dcmd_dummy(s, cmd);
1606     } else {
1607         trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);
1608         retval = cmdptr->func(s, cmd);
1609     }
1610     if (retval != MFI_STAT_INVALID_STATUS) {
1611         megasas_finish_dcmd(cmd, len);
1612     }
1613     return retval;
1614 }
1615 
1616 static int megasas_finish_internal_dcmd(MegasasCmd *cmd,
1617                                         SCSIRequest *req, size_t resid)
1618 {
1619     int retval = MFI_STAT_OK;
1620     int lun = req->lun;
1621 
1622     trace_megasas_dcmd_internal_finish(cmd->index, cmd->dcmd_opcode, lun);
1623     cmd->iov_size -= resid;
1624     switch (cmd->dcmd_opcode) {
1625     case MFI_DCMD_PD_GET_INFO:
1626         retval = megasas_pd_get_info_submit(req->dev, lun, cmd);
1627         break;
1628     case MFI_DCMD_LD_GET_INFO:
1629         retval = megasas_ld_get_info_submit(req->dev, lun, cmd);
1630         break;
1631     default:
1632         trace_megasas_dcmd_internal_invalid(cmd->index, cmd->dcmd_opcode);
1633         retval = MFI_STAT_INVALID_DCMD;
1634         break;
1635     }
1636     if (retval != MFI_STAT_INVALID_STATUS) {
1637         megasas_finish_dcmd(cmd, cmd->iov_size);
1638     }
1639     return retval;
1640 }
1641 
1642 static int megasas_enqueue_req(MegasasCmd *cmd, bool is_write)
1643 {
1644     int len;
1645 
1646     len = scsi_req_enqueue(cmd->req);
1647     if (len < 0) {
1648         len = -len;
1649     }
1650     if (len > 0) {
1651         if (len > cmd->iov_size) {
1652             if (is_write) {
1653                 trace_megasas_iov_write_overflow(cmd->index, len,
1654                                                  cmd->iov_size);
1655             } else {
1656                 trace_megasas_iov_read_overflow(cmd->index, len,
1657                                                 cmd->iov_size);
1658             }
1659         }
1660         if (len < cmd->iov_size) {
1661             if (is_write) {
1662                 trace_megasas_iov_write_underflow(cmd->index, len,
1663                                                   cmd->iov_size);
1664             } else {
1665                 trace_megasas_iov_read_underflow(cmd->index, len,
1666                                                  cmd->iov_size);
1667             }
1668             cmd->iov_size = len;
1669         }
1670         scsi_req_continue(cmd->req);
1671     }
1672     return len;
1673 }
1674 
1675 static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
1676                                int frame_cmd)
1677 {
1678     uint8_t *cdb;
1679     int target_id, lun_id, cdb_len;
1680     bool is_write;
1681     struct SCSIDevice *sdev = NULL;
1682     bool is_logical = (frame_cmd == MFI_CMD_LD_SCSI_IO);
1683 
1684     cdb = cmd->frame->pass.cdb;
1685     target_id = cmd->frame->header.target_id;
1686     lun_id = cmd->frame->header.lun_id;
1687     cdb_len = cmd->frame->header.cdb_len;
1688 
1689     if (is_logical) {
1690         if (target_id >= MFI_MAX_LD || lun_id != 0) {
1691             trace_megasas_scsi_target_not_present(
1692                 mfi_frame_desc(frame_cmd), is_logical, target_id, lun_id);
1693             return MFI_STAT_DEVICE_NOT_FOUND;
1694         }
1695     }
1696     sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
1697 
1698     cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);
1699     trace_megasas_handle_scsi(mfi_frame_desc(frame_cmd), is_logical,
1700                               target_id, lun_id, sdev, cmd->iov_size);
1701 
1702     if (!sdev || (megasas_is_jbod(s) && is_logical)) {
1703         trace_megasas_scsi_target_not_present(
1704             mfi_frame_desc(frame_cmd), is_logical, target_id, lun_id);
1705         return MFI_STAT_DEVICE_NOT_FOUND;
1706     }
1707 
1708     if (cdb_len > 16) {
1709         trace_megasas_scsi_invalid_cdb_len(
1710                 mfi_frame_desc(frame_cmd), is_logical,
1711                 target_id, lun_id, cdb_len);
1712         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1713         cmd->frame->header.scsi_status = CHECK_CONDITION;
1714         s->event_count++;
1715         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1716     }
1717 
1718     if (megasas_map_sgl(s, cmd, &cmd->frame->pass.sgl)) {
1719         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1720         cmd->frame->header.scsi_status = CHECK_CONDITION;
1721         s->event_count++;
1722         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1723     }
1724 
1725     cmd->req = scsi_req_new(sdev, cmd->index, lun_id, cdb, cmd);
1726     if (!cmd->req) {
1727         trace_megasas_scsi_req_alloc_failed(
1728                 mfi_frame_desc(frame_cmd), target_id, lun_id);
1729         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1730         cmd->frame->header.scsi_status = BUSY;
1731         s->event_count++;
1732         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1733     }
1734 
1735     is_write = (cmd->req->cmd.mode == SCSI_XFER_TO_DEV);
1736     if (cmd->iov_size) {
1737         if (is_write) {
1738             trace_megasas_scsi_write_start(cmd->index, cmd->iov_size);
1739         } else {
1740             trace_megasas_scsi_read_start(cmd->index, cmd->iov_size);
1741         }
1742     } else {
1743         trace_megasas_scsi_nodata(cmd->index);
1744     }
1745     megasas_enqueue_req(cmd, is_write);
1746     return MFI_STAT_INVALID_STATUS;
1747 }
1748 
1749 static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd)
1750 {
1751     uint32_t lba_count, lba_start_hi, lba_start_lo;
1752     uint64_t lba_start;
1753     bool is_write = (frame_cmd == MFI_CMD_LD_WRITE);
1754     uint8_t cdb[16];
1755     int len;
1756     struct SCSIDevice *sdev = NULL;
1757     int target_id, lun_id, cdb_len;
1758 
1759     lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
1760     lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
1761     lba_start_hi = le32_to_cpu(cmd->frame->io.lba_hi);
1762     lba_start = ((uint64_t)lba_start_hi << 32) | lba_start_lo;
1763 
1764     target_id = cmd->frame->header.target_id;
1765     lun_id = cmd->frame->header.lun_id;
1766     cdb_len = cmd->frame->header.cdb_len;
1767 
1768     if (target_id < MFI_MAX_LD && lun_id == 0) {
1769         sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
1770     }
1771 
1772     trace_megasas_handle_io(cmd->index,
1773                             mfi_frame_desc(frame_cmd), target_id, lun_id,
1774                             (unsigned long)lba_start, (unsigned long)lba_count);
1775     if (!sdev) {
1776         trace_megasas_io_target_not_present(cmd->index,
1777             mfi_frame_desc(frame_cmd), target_id, lun_id);
1778         return MFI_STAT_DEVICE_NOT_FOUND;
1779     }
1780 
1781     if (cdb_len > 16) {
1782         trace_megasas_scsi_invalid_cdb_len(
1783             mfi_frame_desc(frame_cmd), 1, target_id, lun_id, cdb_len);
1784         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1785         cmd->frame->header.scsi_status = CHECK_CONDITION;
1786         s->event_count++;
1787         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1788     }
1789 
1790     cmd->iov_size = lba_count * sdev->blocksize;
1791     if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
1792         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1793         cmd->frame->header.scsi_status = CHECK_CONDITION;
1794         s->event_count++;
1795         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1796     }
1797 
1798     megasas_encode_lba(cdb, lba_start, lba_count, is_write);
1799     cmd->req = scsi_req_new(sdev, cmd->index,
1800                             lun_id, cdb, cmd);
1801     if (!cmd->req) {
1802         trace_megasas_scsi_req_alloc_failed(
1803             mfi_frame_desc(frame_cmd), target_id, lun_id);
1804         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1805         cmd->frame->header.scsi_status = BUSY;
1806         s->event_count++;
1807         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1808     }
1809     len = megasas_enqueue_req(cmd, is_write);
1810     if (len > 0) {
1811         if (is_write) {
1812             trace_megasas_io_write_start(cmd->index, lba_start, lba_count, len);
1813         } else {
1814             trace_megasas_io_read_start(cmd->index, lba_start, lba_count, len);
1815         }
1816     }
1817     return MFI_STAT_INVALID_STATUS;
1818 }
1819 
1820 static QEMUSGList *megasas_get_sg_list(SCSIRequest *req)
1821 {
1822     MegasasCmd *cmd = req->hba_private;
1823 
1824     if (cmd->dcmd_opcode != -1) {
1825         return NULL;
1826     } else {
1827         return &cmd->qsg;
1828     }
1829 }
1830 
1831 static void megasas_xfer_complete(SCSIRequest *req, uint32_t len)
1832 {
1833     MegasasCmd *cmd = req->hba_private;
1834     uint8_t *buf;
1835 
1836     trace_megasas_io_complete(cmd->index, len);
1837 
1838     if (cmd->dcmd_opcode != -1) {
1839         scsi_req_continue(req);
1840         return;
1841     }
1842 
1843     buf = scsi_req_get_buf(req);
1844     if (cmd->dcmd_opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) {
1845         struct mfi_pd_info *info = cmd->iov_buf;
1846 
1847         if (info->inquiry_data[0] == 0x7f) {
1848             memset(info->inquiry_data, 0, sizeof(info->inquiry_data));
1849             memcpy(info->inquiry_data, buf, len);
1850         } else if (info->vpd_page83[0] == 0x7f) {
1851             memset(info->vpd_page83, 0, sizeof(info->vpd_page83));
1852             memcpy(info->vpd_page83, buf, len);
1853         }
1854         scsi_req_continue(req);
1855     } else if (cmd->dcmd_opcode == MFI_DCMD_LD_GET_INFO) {
1856         struct mfi_ld_info *info = cmd->iov_buf;
1857 
1858         if (cmd->iov_buf) {
1859             memcpy(info->vpd_page83, buf, sizeof(info->vpd_page83));
1860             scsi_req_continue(req);
1861         }
1862     }
1863 }
1864 
1865 static void megasas_command_complete(SCSIRequest *req, size_t resid)
1866 {
1867     MegasasCmd *cmd = req->hba_private;
1868     uint8_t cmd_status = MFI_STAT_OK;
1869 
1870     trace_megasas_command_complete(cmd->index, req->status, resid);
1871 
1872     if (req->io_canceled) {
1873         return;
1874     }
1875 
1876     if (cmd->dcmd_opcode != -1) {
1877         /*
1878          * Internal command complete
1879          */
1880         cmd_status = megasas_finish_internal_dcmd(cmd, req, resid);
1881         if (cmd_status == MFI_STAT_INVALID_STATUS) {
1882             return;
1883         }
1884     } else {
1885         trace_megasas_scsi_complete(cmd->index, req->status,
1886                                     cmd->iov_size, req->cmd.xfer);
1887         if (req->status != GOOD) {
1888             cmd_status = MFI_STAT_SCSI_DONE_WITH_ERROR;
1889         }
1890         if (req->status == CHECK_CONDITION) {
1891             megasas_copy_sense(cmd);
1892         }
1893 
1894         cmd->frame->header.scsi_status = req->status;
1895     }
1896     cmd->frame->header.cmd_status = cmd_status;
1897     megasas_complete_command(cmd);
1898 }
1899 
1900 static void megasas_command_cancelled(SCSIRequest *req)
1901 {
1902     MegasasCmd *cmd = req->hba_private;
1903 
1904     if (!cmd) {
1905         return;
1906     }
1907     cmd->frame->header.cmd_status = MFI_STAT_SCSI_IO_FAILED;
1908     megasas_complete_command(cmd);
1909 }
1910 
1911 static int megasas_handle_abort(MegasasState *s, MegasasCmd *cmd)
1912 {
1913     uint64_t abort_ctx = le64_to_cpu(cmd->frame->abort.abort_context);
1914     hwaddr abort_addr, addr_hi, addr_lo;
1915     MegasasCmd *abort_cmd;
1916 
1917     addr_hi = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_hi);
1918     addr_lo = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_lo);
1919     abort_addr = ((uint64_t)addr_hi << 32) | addr_lo;
1920 
1921     abort_cmd = megasas_lookup_frame(s, abort_addr);
1922     if (!abort_cmd) {
1923         trace_megasas_abort_no_cmd(cmd->index, abort_ctx);
1924         s->event_count++;
1925         return MFI_STAT_OK;
1926     }
1927     if (!megasas_use_queue64(s)) {
1928         abort_ctx &= (uint64_t)0xFFFFFFFF;
1929     }
1930     if (abort_cmd->context != abort_ctx) {
1931         trace_megasas_abort_invalid_context(cmd->index, abort_cmd->context,
1932                                             abort_cmd->index);
1933         s->event_count++;
1934         return MFI_STAT_ABORT_NOT_POSSIBLE;
1935     }
1936     trace_megasas_abort_frame(cmd->index, abort_cmd->index);
1937     megasas_abort_command(abort_cmd);
1938     if (!s->event_cmd || abort_cmd != s->event_cmd) {
1939         s->event_cmd = NULL;
1940     }
1941     s->event_count++;
1942     return MFI_STAT_OK;
1943 }
1944 
1945 static void megasas_handle_frame(MegasasState *s, uint64_t frame_addr,
1946                                  uint32_t frame_count)
1947 {
1948     uint8_t frame_status = MFI_STAT_INVALID_CMD;
1949     uint64_t frame_context;
1950     int frame_cmd;
1951     MegasasCmd *cmd;
1952 
1953     /*
1954      * Always read 64bit context, top bits will be
1955      * masked out if required in megasas_enqueue_frame()
1956      */
1957     frame_context = megasas_frame_get_context(s, frame_addr);
1958 
1959     cmd = megasas_enqueue_frame(s, frame_addr, frame_context, frame_count);
1960     if (!cmd) {
1961         /* reply queue full */
1962         trace_megasas_frame_busy(frame_addr);
1963         megasas_frame_set_scsi_status(s, frame_addr, BUSY);
1964         megasas_frame_set_cmd_status(s, frame_addr, MFI_STAT_SCSI_DONE_WITH_ERROR);
1965         megasas_complete_frame(s, frame_context);
1966         s->event_count++;
1967         return;
1968     }
1969     frame_cmd = cmd->frame->header.frame_cmd;
1970     switch (frame_cmd) {
1971     case MFI_CMD_INIT:
1972         frame_status = megasas_init_firmware(s, cmd);
1973         break;
1974     case MFI_CMD_DCMD:
1975         frame_status = megasas_handle_dcmd(s, cmd);
1976         break;
1977     case MFI_CMD_ABORT:
1978         frame_status = megasas_handle_abort(s, cmd);
1979         break;
1980     case MFI_CMD_PD_SCSI_IO:
1981     case MFI_CMD_LD_SCSI_IO:
1982         frame_status = megasas_handle_scsi(s, cmd, frame_cmd);
1983         break;
1984     case MFI_CMD_LD_READ:
1985     case MFI_CMD_LD_WRITE:
1986         frame_status = megasas_handle_io(s, cmd, frame_cmd);
1987         break;
1988     default:
1989         trace_megasas_unhandled_frame_cmd(cmd->index, frame_cmd);
1990         s->event_count++;
1991         break;
1992     }
1993     if (frame_status != MFI_STAT_INVALID_STATUS) {
1994         if (cmd->frame) {
1995             cmd->frame->header.cmd_status = frame_status;
1996         } else {
1997             megasas_frame_set_cmd_status(s, frame_addr, frame_status);
1998         }
1999         megasas_unmap_frame(s, cmd);
2000         megasas_complete_frame(s, cmd->context);
2001     }
2002 }
2003 
2004 static uint64_t megasas_mmio_read(void *opaque, hwaddr addr,
2005                                   unsigned size)
2006 {
2007     MegasasState *s = opaque;
2008     PCIDevice *pci_dev = PCI_DEVICE(s);
2009     MegasasBaseClass *base_class = MEGASAS_GET_CLASS(s);
2010     uint32_t retval = 0;
2011 
2012     switch (addr) {
2013     case MFI_IDB:
2014         retval = 0;
2015         trace_megasas_mmio_readl("MFI_IDB", retval);
2016         break;
2017     case MFI_OMSG0:
2018     case MFI_OSP0:
2019         retval = (msix_present(pci_dev) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |
2020             (s->fw_state & MFI_FWSTATE_MASK) |
2021             ((s->fw_sge & 0xff) << 16) |
2022             (s->fw_cmds & 0xFFFF);
2023         trace_megasas_mmio_readl(addr == MFI_OMSG0 ? "MFI_OMSG0" : "MFI_OSP0",
2024                                  retval);
2025         break;
2026     case MFI_OSTS:
2027         if (megasas_intr_enabled(s) && s->doorbell) {
2028             retval = base_class->osts;
2029         }
2030         trace_megasas_mmio_readl("MFI_OSTS", retval);
2031         break;
2032     case MFI_OMSK:
2033         retval = s->intr_mask;
2034         trace_megasas_mmio_readl("MFI_OMSK", retval);
2035         break;
2036     case MFI_ODCR0:
2037         retval = s->doorbell ? 1 : 0;
2038         trace_megasas_mmio_readl("MFI_ODCR0", retval);
2039         break;
2040     case MFI_DIAG:
2041         retval = s->diag;
2042         trace_megasas_mmio_readl("MFI_DIAG", retval);
2043         break;
2044     case MFI_OSP1:
2045         retval = 15;
2046         trace_megasas_mmio_readl("MFI_OSP1", retval);
2047         break;
2048     default:
2049         trace_megasas_mmio_invalid_readl(addr);
2050         break;
2051     }
2052     return retval;
2053 }
2054 
2055 static int adp_reset_seq[] = {0x00, 0x04, 0x0b, 0x02, 0x07, 0x0d};
2056 
2057 static void megasas_mmio_write(void *opaque, hwaddr addr,
2058                                uint64_t val, unsigned size)
2059 {
2060     MegasasState *s = opaque;
2061     PCIDevice *pci_dev = PCI_DEVICE(s);
2062     uint64_t frame_addr;
2063     uint32_t frame_count;
2064     int i;
2065 
2066     switch (addr) {
2067     case MFI_IDB:
2068         trace_megasas_mmio_writel("MFI_IDB", val);
2069         if (val & MFI_FWINIT_ABORT) {
2070             /* Abort all pending cmds */
2071             for (i = 0; i < s->fw_cmds; i++) {
2072                 megasas_abort_command(&s->frames[i]);
2073             }
2074         }
2075         if (val & MFI_FWINIT_READY) {
2076             /* move to FW READY */
2077             megasas_soft_reset(s);
2078         }
2079         if (val & MFI_FWINIT_MFIMODE) {
2080             /* discard MFIs */
2081         }
2082         if (val & MFI_FWINIT_STOP_ADP) {
2083             /* Terminal error, stop processing */
2084             s->fw_state = MFI_FWSTATE_FAULT;
2085         }
2086         break;
2087     case MFI_OMSK:
2088         trace_megasas_mmio_writel("MFI_OMSK", val);
2089         s->intr_mask = val;
2090         if (!megasas_intr_enabled(s) &&
2091             !msi_enabled(pci_dev) &&
2092             !msix_enabled(pci_dev)) {
2093             trace_megasas_irq_lower();
2094             pci_irq_deassert(pci_dev);
2095         }
2096         if (megasas_intr_enabled(s)) {
2097             if (msix_enabled(pci_dev)) {
2098                 trace_megasas_msix_enabled(0);
2099             } else if (msi_enabled(pci_dev)) {
2100                 trace_megasas_msi_enabled(0);
2101             } else {
2102                 trace_megasas_intr_enabled();
2103             }
2104         } else {
2105             trace_megasas_intr_disabled();
2106             megasas_soft_reset(s);
2107         }
2108         break;
2109     case MFI_ODCR0:
2110         trace_megasas_mmio_writel("MFI_ODCR0", val);
2111         s->doorbell = 0;
2112         if (megasas_intr_enabled(s)) {
2113             if (!msix_enabled(pci_dev) && !msi_enabled(pci_dev)) {
2114                 trace_megasas_irq_lower();
2115                 pci_irq_deassert(pci_dev);
2116             }
2117         }
2118         break;
2119     case MFI_IQPH:
2120         trace_megasas_mmio_writel("MFI_IQPH", val);
2121         /* Received high 32 bits of a 64 bit MFI frame address */
2122         s->frame_hi = val;
2123         break;
2124     case MFI_IQPL:
2125         trace_megasas_mmio_writel("MFI_IQPL", val);
2126         /* Received low 32 bits of a 64 bit MFI frame address */
2127         /* Fallthrough */
2128     case MFI_IQP:
2129         if (addr == MFI_IQP) {
2130             trace_megasas_mmio_writel("MFI_IQP", val);
2131             /* Received 64 bit MFI frame address */
2132             s->frame_hi = 0;
2133         }
2134         frame_addr = (val & ~0x1F);
2135         /* Add possible 64 bit offset */
2136         frame_addr |= ((uint64_t)s->frame_hi << 32);
2137         s->frame_hi = 0;
2138         frame_count = (val >> 1) & 0xF;
2139         megasas_handle_frame(s, frame_addr, frame_count);
2140         break;
2141     case MFI_SEQ:
2142         trace_megasas_mmio_writel("MFI_SEQ", val);
2143         /* Magic sequence to start ADP reset */
2144         if (adp_reset_seq[s->adp_reset++] == val) {
2145             if (s->adp_reset == 6) {
2146                 s->adp_reset = 0;
2147                 s->diag = MFI_DIAG_WRITE_ENABLE;
2148             }
2149         } else {
2150             s->adp_reset = 0;
2151             s->diag = 0;
2152         }
2153         break;
2154     case MFI_DIAG:
2155         trace_megasas_mmio_writel("MFI_DIAG", val);
2156         /* ADP reset */
2157         if ((s->diag & MFI_DIAG_WRITE_ENABLE) &&
2158             (val & MFI_DIAG_RESET_ADP)) {
2159             s->diag |= MFI_DIAG_RESET_ADP;
2160             megasas_soft_reset(s);
2161             s->adp_reset = 0;
2162             s->diag = 0;
2163         }
2164         break;
2165     default:
2166         trace_megasas_mmio_invalid_writel(addr, val);
2167         break;
2168     }
2169 }
2170 
2171 static const MemoryRegionOps megasas_mmio_ops = {
2172     .read = megasas_mmio_read,
2173     .write = megasas_mmio_write,
2174     .endianness = DEVICE_LITTLE_ENDIAN,
2175     .impl = {
2176         .min_access_size = 8,
2177         .max_access_size = 8,
2178     }
2179 };
2180 
2181 static uint64_t megasas_port_read(void *opaque, hwaddr addr,
2182                                   unsigned size)
2183 {
2184     return megasas_mmio_read(opaque, addr & 0xff, size);
2185 }
2186 
2187 static void megasas_port_write(void *opaque, hwaddr addr,
2188                                uint64_t val, unsigned size)
2189 {
2190     megasas_mmio_write(opaque, addr & 0xff, val, size);
2191 }
2192 
2193 static const MemoryRegionOps megasas_port_ops = {
2194     .read = megasas_port_read,
2195     .write = megasas_port_write,
2196     .endianness = DEVICE_LITTLE_ENDIAN,
2197     .impl = {
2198         .min_access_size = 4,
2199         .max_access_size = 4,
2200     }
2201 };
2202 
2203 static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
2204                                    unsigned size)
2205 {
2206     return 0;
2207 }
2208 
2209 static void megasas_queue_write(void *opaque, hwaddr addr,
2210                                uint64_t val, unsigned size)
2211 {
2212     return;
2213 }
2214 
2215 static const MemoryRegionOps megasas_queue_ops = {
2216     .read = megasas_queue_read,
2217     .write = megasas_queue_write,
2218     .endianness = DEVICE_LITTLE_ENDIAN,
2219     .impl = {
2220         .min_access_size = 8,
2221         .max_access_size = 8,
2222     }
2223 };
2224 
2225 static void megasas_soft_reset(MegasasState *s)
2226 {
2227     int i;
2228     MegasasCmd *cmd;
2229 
2230     trace_megasas_reset(s->fw_state);
2231     for (i = 0; i < s->fw_cmds; i++) {
2232         cmd = &s->frames[i];
2233         megasas_abort_command(cmd);
2234     }
2235     if (s->fw_state == MFI_FWSTATE_READY) {
2236         BusChild *kid;
2237 
2238         /*
2239          * The EFI firmware doesn't handle UA,
2240          * so we need to clear the Power On/Reset UA
2241          * after the initial reset.
2242          */
2243         QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
2244             SCSIDevice *sdev = SCSI_DEVICE(kid->child);
2245 
2246             sdev->unit_attention = SENSE_CODE(NO_SENSE);
2247             scsi_device_unit_attention_reported(sdev);
2248         }
2249     }
2250     megasas_reset_frames(s);
2251     s->reply_queue_len = s->fw_cmds;
2252     s->reply_queue_pa = 0;
2253     s->consumer_pa = 0;
2254     s->producer_pa = 0;
2255     s->fw_state = MFI_FWSTATE_READY;
2256     s->doorbell = 0;
2257     s->intr_mask = MEGASAS_INTR_DISABLED_MASK;
2258     s->frame_hi = 0;
2259     s->flags &= ~MEGASAS_MASK_USE_QUEUE64;
2260     s->event_count++;
2261     s->boot_event = s->event_count;
2262 }
2263 
2264 static void megasas_scsi_reset(DeviceState *dev)
2265 {
2266     MegasasState *s = MEGASAS(dev);
2267 
2268     megasas_soft_reset(s);
2269 }
2270 
2271 static const VMStateDescription vmstate_megasas_gen1 = {
2272     .name = "megasas",
2273     .version_id = 0,
2274     .minimum_version_id = 0,
2275     .fields = (VMStateField[]) {
2276         VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2277         VMSTATE_MSIX(parent_obj, MegasasState),
2278 
2279         VMSTATE_UINT32(fw_state, MegasasState),
2280         VMSTATE_UINT32(intr_mask, MegasasState),
2281         VMSTATE_UINT32(doorbell, MegasasState),
2282         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2283         VMSTATE_UINT64(consumer_pa, MegasasState),
2284         VMSTATE_UINT64(producer_pa, MegasasState),
2285         VMSTATE_END_OF_LIST()
2286     }
2287 };
2288 
2289 static const VMStateDescription vmstate_megasas_gen2 = {
2290     .name = "megasas-gen2",
2291     .version_id = 0,
2292     .minimum_version_id = 0,
2293     .minimum_version_id_old = 0,
2294     .fields      = (VMStateField[]) {
2295         VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2296         VMSTATE_MSIX(parent_obj, MegasasState),
2297 
2298         VMSTATE_UINT32(fw_state, MegasasState),
2299         VMSTATE_UINT32(intr_mask, MegasasState),
2300         VMSTATE_UINT32(doorbell, MegasasState),
2301         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2302         VMSTATE_UINT64(consumer_pa, MegasasState),
2303         VMSTATE_UINT64(producer_pa, MegasasState),
2304         VMSTATE_END_OF_LIST()
2305     }
2306 };
2307 
2308 static void megasas_scsi_uninit(PCIDevice *d)
2309 {
2310     MegasasState *s = MEGASAS(d);
2311 
2312     if (megasas_use_msix(s)) {
2313         msix_uninit(d, &s->mmio_io, &s->mmio_io);
2314     }
2315     msi_uninit(d);
2316 }
2317 
2318 static const struct SCSIBusInfo megasas_scsi_info = {
2319     .tcq = true,
2320     .max_target = MFI_MAX_LD,
2321     .max_lun = 255,
2322 
2323     .transfer_data = megasas_xfer_complete,
2324     .get_sg_list = megasas_get_sg_list,
2325     .complete = megasas_command_complete,
2326     .cancel = megasas_command_cancelled,
2327 };
2328 
2329 static void megasas_scsi_realize(PCIDevice *dev, Error **errp)
2330 {
2331     MegasasState *s = MEGASAS(dev);
2332     MegasasBaseClass *b = MEGASAS_GET_CLASS(s);
2333     uint8_t *pci_conf;
2334     int i, bar_type;
2335     Error *err = NULL;
2336     int ret;
2337 
2338     pci_conf = dev->config;
2339 
2340     /* PCI latency timer = 0 */
2341     pci_conf[PCI_LATENCY_TIMER] = 0;
2342     /* Interrupt pin 1 */
2343     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2344 
2345     if (s->msi != ON_OFF_AUTO_OFF) {
2346         ret = msi_init(dev, 0x50, 1, true, false, &err);
2347         /* Any error other than -ENOTSUP(board's MSI support is broken)
2348          * is a programming error */
2349         assert(!ret || ret == -ENOTSUP);
2350         if (ret && s->msi == ON_OFF_AUTO_ON) {
2351             /* Can't satisfy user's explicit msi=on request, fail */
2352             error_append_hint(&err, "You have to use msi=auto (default) or "
2353                     "msi=off with this machine type.\n");
2354             error_propagate(errp, err);
2355             return;
2356         } else if (ret) {
2357             /* With msi=auto, we fall back to MSI off silently */
2358             s->msi = ON_OFF_AUTO_OFF;
2359             error_free(err);
2360         }
2361     }
2362 
2363     memory_region_init_io(&s->mmio_io, OBJECT(s), &megasas_mmio_ops, s,
2364                           "megasas-mmio", 0x4000);
2365     memory_region_init_io(&s->port_io, OBJECT(s), &megasas_port_ops, s,
2366                           "megasas-io", 256);
2367     memory_region_init_io(&s->queue_io, OBJECT(s), &megasas_queue_ops, s,
2368                           "megasas-queue", 0x40000);
2369 
2370     if (megasas_use_msix(s) &&
2371         msix_init(dev, 15, &s->mmio_io, b->mmio_bar, 0x2000,
2372                   &s->mmio_io, b->mmio_bar, 0x3800, 0x68, NULL)) {
2373         /* TODO: check msix_init's error, and should fail on msix=on */
2374         s->msix = ON_OFF_AUTO_OFF;
2375     }
2376 
2377     if (pci_is_express(dev)) {
2378         pcie_endpoint_cap_init(dev, 0xa0);
2379     }
2380 
2381     bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
2382     pci_register_bar(dev, b->ioport_bar,
2383                      PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
2384     pci_register_bar(dev, b->mmio_bar, bar_type, &s->mmio_io);
2385     pci_register_bar(dev, 3, bar_type, &s->queue_io);
2386 
2387     if (megasas_use_msix(s)) {
2388         msix_vector_use(dev, 0);
2389     }
2390 
2391     s->fw_state = MFI_FWSTATE_READY;
2392     if (!s->sas_addr) {
2393         s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
2394                        IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
2395         s->sas_addr |= pci_dev_bus_num(dev) << 16;
2396         s->sas_addr |= PCI_SLOT(dev->devfn) << 8;
2397         s->sas_addr |= PCI_FUNC(dev->devfn);
2398     }
2399     if (!s->hba_serial) {
2400         s->hba_serial = g_strdup(MEGASAS_HBA_SERIAL);
2401     }
2402     if (s->fw_sge >= MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE) {
2403         s->fw_sge = MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE;
2404     } else if (s->fw_sge >= 128 - MFI_PASS_FRAME_SIZE) {
2405         s->fw_sge = 128 - MFI_PASS_FRAME_SIZE;
2406     } else {
2407         s->fw_sge = 64 - MFI_PASS_FRAME_SIZE;
2408     }
2409     if (s->fw_cmds > MEGASAS_MAX_FRAMES) {
2410         s->fw_cmds = MEGASAS_MAX_FRAMES;
2411     }
2412     trace_megasas_init(s->fw_sge, s->fw_cmds,
2413                        megasas_is_jbod(s) ? "jbod" : "raid");
2414 
2415     if (megasas_is_jbod(s)) {
2416         s->fw_luns = MFI_MAX_SYS_PDS;
2417     } else {
2418         s->fw_luns = MFI_MAX_LD;
2419     }
2420     s->producer_pa = 0;
2421     s->consumer_pa = 0;
2422     for (i = 0; i < s->fw_cmds; i++) {
2423         s->frames[i].index = i;
2424         s->frames[i].context = -1;
2425         s->frames[i].pa = 0;
2426         s->frames[i].state = s;
2427     }
2428 
2429     scsi_bus_init(&s->bus, sizeof(s->bus), DEVICE(dev), &megasas_scsi_info);
2430 }
2431 
2432 static Property megasas_properties_gen1[] = {
2433     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2434                        MEGASAS_DEFAULT_SGE),
2435     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2436                        MEGASAS_DEFAULT_FRAMES),
2437     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2438     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2439     DEFINE_PROP_ON_OFF_AUTO("msi", MegasasState, msi, ON_OFF_AUTO_AUTO),
2440     DEFINE_PROP_ON_OFF_AUTO("msix", MegasasState, msix, ON_OFF_AUTO_AUTO),
2441     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2442                     MEGASAS_FLAG_USE_JBOD, false),
2443     DEFINE_PROP_END_OF_LIST(),
2444 };
2445 
2446 static Property megasas_properties_gen2[] = {
2447     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2448                        MEGASAS_DEFAULT_SGE),
2449     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2450                        MEGASAS_GEN2_DEFAULT_FRAMES),
2451     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2452     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2453     DEFINE_PROP_ON_OFF_AUTO("msi", MegasasState, msi, ON_OFF_AUTO_AUTO),
2454     DEFINE_PROP_ON_OFF_AUTO("msix", MegasasState, msix, ON_OFF_AUTO_AUTO),
2455     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2456                     MEGASAS_FLAG_USE_JBOD, false),
2457     DEFINE_PROP_END_OF_LIST(),
2458 };
2459 
2460 typedef struct MegasasInfo {
2461     const char *name;
2462     const char *desc;
2463     const char *product_name;
2464     const char *product_version;
2465     uint16_t device_id;
2466     uint16_t subsystem_id;
2467     int ioport_bar;
2468     int mmio_bar;
2469     int osts;
2470     const VMStateDescription *vmsd;
2471     Property *props;
2472     InterfaceInfo *interfaces;
2473 } MegasasInfo;
2474 
2475 static struct MegasasInfo megasas_devices[] = {
2476     {
2477         .name = TYPE_MEGASAS_GEN1,
2478         .desc = "LSI MegaRAID SAS 1078",
2479         .product_name = "LSI MegaRAID SAS 8708EM2",
2480         .product_version = MEGASAS_VERSION_GEN1,
2481         .device_id = PCI_DEVICE_ID_LSI_SAS1078,
2482         .subsystem_id = 0x1013,
2483         .ioport_bar = 2,
2484         .mmio_bar = 0,
2485         .osts = MFI_1078_RM | 1,
2486         .vmsd = &vmstate_megasas_gen1,
2487         .props = megasas_properties_gen1,
2488         .interfaces = (InterfaceInfo[]) {
2489             { INTERFACE_CONVENTIONAL_PCI_DEVICE },
2490             { },
2491         },
2492     },{
2493         .name = TYPE_MEGASAS_GEN2,
2494         .desc = "LSI MegaRAID SAS 2108",
2495         .product_name = "LSI MegaRAID SAS 9260-8i",
2496         .product_version = MEGASAS_VERSION_GEN2,
2497         .device_id = PCI_DEVICE_ID_LSI_SAS0079,
2498         .subsystem_id = 0x9261,
2499         .ioport_bar = 0,
2500         .mmio_bar = 1,
2501         .osts = MFI_GEN2_RM,
2502         .vmsd = &vmstate_megasas_gen2,
2503         .props = megasas_properties_gen2,
2504         .interfaces = (InterfaceInfo[]) {
2505             { INTERFACE_PCIE_DEVICE },
2506             { }
2507         },
2508     }
2509 };
2510 
2511 static void megasas_class_init(ObjectClass *oc, void *data)
2512 {
2513     DeviceClass *dc = DEVICE_CLASS(oc);
2514     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
2515     MegasasBaseClass *e = MEGASAS_CLASS(oc);
2516     const MegasasInfo *info = data;
2517 
2518     pc->realize = megasas_scsi_realize;
2519     pc->exit = megasas_scsi_uninit;
2520     pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2521     pc->device_id = info->device_id;
2522     pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2523     pc->subsystem_id = info->subsystem_id;
2524     pc->class_id = PCI_CLASS_STORAGE_RAID;
2525     e->mmio_bar = info->mmio_bar;
2526     e->ioport_bar = info->ioport_bar;
2527     e->osts = info->osts;
2528     e->product_name = info->product_name;
2529     e->product_version = info->product_version;
2530     device_class_set_props(dc, info->props);
2531     dc->reset = megasas_scsi_reset;
2532     dc->vmsd = info->vmsd;
2533     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2534     dc->desc = info->desc;
2535 }
2536 
2537 static const TypeInfo megasas_info = {
2538     .name  = TYPE_MEGASAS_BASE,
2539     .parent = TYPE_PCI_DEVICE,
2540     .instance_size = sizeof(MegasasState),
2541     .class_size = sizeof(MegasasBaseClass),
2542     .abstract = true,
2543 };
2544 
2545 static void megasas_register_types(void)
2546 {
2547     int i;
2548 
2549     type_register_static(&megasas_info);
2550     for (i = 0; i < ARRAY_SIZE(megasas_devices); i++) {
2551         const MegasasInfo *info = &megasas_devices[i];
2552         TypeInfo type_info = {};
2553 
2554         type_info.name = info->name;
2555         type_info.parent = TYPE_MEGASAS_BASE;
2556         type_info.class_data = (void *)info;
2557         type_info.class_init = megasas_class_init;
2558         type_info.interfaces = info->interfaces;
2559 
2560         type_register(&type_info);
2561     }
2562 }
2563 
2564 type_init(megasas_register_types)
2565