xref: /openbmc/qemu/hw/scsi/megasas.c (revision 5b24c641)
1 /*
2  * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation
3  * Based on the linux driver code at drivers/scsi/megaraid
4  *
5  * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
6  *
7  * This library is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2 of the License, or (at your option) any later version.
11  *
12  * This library is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "hw/hw.h"
22 #include "hw/pci/pci.h"
23 #include "sysemu/dma.h"
24 #include "hw/pci/msix.h"
25 #include "qemu/iov.h"
26 #include "hw/scsi/scsi.h"
27 #include "block/scsi.h"
28 #include "trace.h"
29 
30 #include "mfi.h"
31 
32 #define MEGASAS_VERSION "1.70"
33 #define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */
34 #define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */
35 #define MEGASAS_MAX_SGE 128             /* Firmware limit */
36 #define MEGASAS_DEFAULT_SGE 80
37 #define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */
38 #define MEGASAS_MAX_ARRAYS 128
39 
40 #define MEGASAS_HBA_SERIAL "QEMU123456"
41 #define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
42 #define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
43 
44 #define MEGASAS_FLAG_USE_JBOD      0
45 #define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)
46 #define MEGASAS_FLAG_USE_MSIX      1
47 #define MEGASAS_MASK_USE_MSIX      (1 << MEGASAS_FLAG_USE_MSIX)
48 #define MEGASAS_FLAG_USE_QUEUE64   2
49 #define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)
50 
51 static const char *mfi_frame_desc[] = {
52     "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",
53     "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"};
54 
55 typedef struct MegasasCmd {
56     uint32_t index;
57     uint16_t flags;
58     uint16_t count;
59     uint64_t context;
60 
61     hwaddr pa;
62     hwaddr pa_size;
63     union mfi_frame *frame;
64     SCSIRequest *req;
65     QEMUSGList qsg;
66     void *iov_buf;
67     size_t iov_size;
68     size_t iov_offset;
69     struct MegasasState *state;
70 } MegasasCmd;
71 
72 typedef struct MegasasState {
73     /*< private >*/
74     PCIDevice parent_obj;
75     /*< public >*/
76 
77     MemoryRegion mmio_io;
78     MemoryRegion port_io;
79     MemoryRegion queue_io;
80     uint32_t frame_hi;
81 
82     int fw_state;
83     uint32_t fw_sge;
84     uint32_t fw_cmds;
85     uint32_t flags;
86     int fw_luns;
87     int intr_mask;
88     int doorbell;
89     int busy;
90 
91     MegasasCmd *event_cmd;
92     int event_locale;
93     int event_class;
94     int event_count;
95     int shutdown_event;
96     int boot_event;
97 
98     uint64_t sas_addr;
99     char *hba_serial;
100 
101     uint64_t reply_queue_pa;
102     void *reply_queue;
103     int reply_queue_len;
104     int reply_queue_head;
105     int reply_queue_tail;
106     uint64_t consumer_pa;
107     uint64_t producer_pa;
108 
109     MegasasCmd frames[MEGASAS_MAX_FRAMES];
110 
111     SCSIBus bus;
112 } MegasasState;
113 
114 #define TYPE_MEGASAS "megasas"
115 
116 #define MEGASAS(obj) \
117     OBJECT_CHECK(MegasasState, (obj), TYPE_MEGASAS)
118 
119 #define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
120 
121 static bool megasas_intr_enabled(MegasasState *s)
122 {
123     if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=
124         MEGASAS_INTR_DISABLED_MASK) {
125         return true;
126     }
127     return false;
128 }
129 
130 static bool megasas_use_queue64(MegasasState *s)
131 {
132     return s->flags & MEGASAS_MASK_USE_QUEUE64;
133 }
134 
135 static bool megasas_use_msix(MegasasState *s)
136 {
137     return s->flags & MEGASAS_MASK_USE_MSIX;
138 }
139 
140 static bool megasas_is_jbod(MegasasState *s)
141 {
142     return s->flags & MEGASAS_MASK_USE_JBOD;
143 }
144 
145 static void megasas_frame_set_cmd_status(unsigned long frame, uint8_t v)
146 {
147     stb_phys(frame + offsetof(struct mfi_frame_header, cmd_status), v);
148 }
149 
150 static void megasas_frame_set_scsi_status(unsigned long frame, uint8_t v)
151 {
152     stb_phys(frame + offsetof(struct mfi_frame_header, scsi_status), v);
153 }
154 
155 /*
156  * Context is considered opaque, but the HBA firmware is running
157  * in little endian mode. So convert it to little endian, too.
158  */
159 static uint64_t megasas_frame_get_context(unsigned long frame)
160 {
161     return ldq_le_phys(frame + offsetof(struct mfi_frame_header, context));
162 }
163 
164 static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)
165 {
166     return cmd->flags & MFI_FRAME_IEEE_SGL;
167 }
168 
169 static bool megasas_frame_is_sgl64(MegasasCmd *cmd)
170 {
171     return cmd->flags & MFI_FRAME_SGL64;
172 }
173 
174 static bool megasas_frame_is_sense64(MegasasCmd *cmd)
175 {
176     return cmd->flags & MFI_FRAME_SENSE64;
177 }
178 
179 static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,
180                                      union mfi_sgl *sgl)
181 {
182     uint64_t addr;
183 
184     if (megasas_frame_is_ieee_sgl(cmd)) {
185         addr = le64_to_cpu(sgl->sg_skinny->addr);
186     } else if (megasas_frame_is_sgl64(cmd)) {
187         addr = le64_to_cpu(sgl->sg64->addr);
188     } else {
189         addr = le32_to_cpu(sgl->sg32->addr);
190     }
191     return addr;
192 }
193 
194 static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,
195                                     union mfi_sgl *sgl)
196 {
197     uint32_t len;
198 
199     if (megasas_frame_is_ieee_sgl(cmd)) {
200         len = le32_to_cpu(sgl->sg_skinny->len);
201     } else if (megasas_frame_is_sgl64(cmd)) {
202         len = le32_to_cpu(sgl->sg64->len);
203     } else {
204         len = le32_to_cpu(sgl->sg32->len);
205     }
206     return len;
207 }
208 
209 static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,
210                                        union mfi_sgl *sgl)
211 {
212     uint8_t *next = (uint8_t *)sgl;
213 
214     if (megasas_frame_is_ieee_sgl(cmd)) {
215         next += sizeof(struct mfi_sg_skinny);
216     } else if (megasas_frame_is_sgl64(cmd)) {
217         next += sizeof(struct mfi_sg64);
218     } else {
219         next += sizeof(struct mfi_sg32);
220     }
221 
222     if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {
223         return NULL;
224     }
225     return (union mfi_sgl *)next;
226 }
227 
228 static void megasas_soft_reset(MegasasState *s);
229 
230 static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
231 {
232     int i;
233     int iov_count = 0;
234     size_t iov_size = 0;
235 
236     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
237     iov_count = cmd->frame->header.sge_count;
238     if (iov_count > MEGASAS_MAX_SGE) {
239         trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,
240                                          MEGASAS_MAX_SGE);
241         return iov_count;
242     }
243     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), iov_count);
244     for (i = 0; i < iov_count; i++) {
245         dma_addr_t iov_pa, iov_size_p;
246 
247         if (!sgl) {
248             trace_megasas_iovec_sgl_underflow(cmd->index, i);
249             goto unmap;
250         }
251         iov_pa = megasas_sgl_get_addr(cmd, sgl);
252         iov_size_p = megasas_sgl_get_len(cmd, sgl);
253         if (!iov_pa || !iov_size_p) {
254             trace_megasas_iovec_sgl_invalid(cmd->index, i,
255                                             iov_pa, iov_size_p);
256             goto unmap;
257         }
258         qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);
259         sgl = megasas_sgl_next(cmd, sgl);
260         iov_size += (size_t)iov_size_p;
261     }
262     if (cmd->iov_size > iov_size) {
263         trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
264     } else if (cmd->iov_size < iov_size) {
265         trace_megasas_iovec_underflow(cmd->iov_size, iov_size, cmd->iov_size);
266     }
267     cmd->iov_offset = 0;
268     return 0;
269 unmap:
270     qemu_sglist_destroy(&cmd->qsg);
271     return iov_count - i;
272 }
273 
274 static void megasas_unmap_sgl(MegasasCmd *cmd)
275 {
276     qemu_sglist_destroy(&cmd->qsg);
277     cmd->iov_offset = 0;
278 }
279 
280 /*
281  * passthrough sense and io sense are at the same offset
282  */
283 static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,
284     uint8_t sense_len)
285 {
286     uint32_t pa_hi = 0, pa_lo;
287     hwaddr pa;
288 
289     if (sense_len > cmd->frame->header.sense_len) {
290         sense_len = cmd->frame->header.sense_len;
291     }
292     if (sense_len) {
293         pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);
294         if (megasas_frame_is_sense64(cmd)) {
295             pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);
296         }
297         pa = ((uint64_t) pa_hi << 32) | pa_lo;
298         cpu_physical_memory_write(pa, sense_ptr, sense_len);
299         cmd->frame->header.sense_len = sense_len;
300     }
301     return sense_len;
302 }
303 
304 static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)
305 {
306     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
307     uint8_t sense_len = 18;
308 
309     memset(sense_buf, 0, sense_len);
310     sense_buf[0] = 0xf0;
311     sense_buf[2] = sense.key;
312     sense_buf[7] = 10;
313     sense_buf[12] = sense.asc;
314     sense_buf[13] = sense.ascq;
315     megasas_build_sense(cmd, sense_buf, sense_len);
316 }
317 
318 static void megasas_copy_sense(MegasasCmd *cmd)
319 {
320     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
321     uint8_t sense_len;
322 
323     sense_len = scsi_req_get_sense(cmd->req, sense_buf,
324                                    SCSI_SENSE_BUF_SIZE);
325     megasas_build_sense(cmd, sense_buf, sense_len);
326 }
327 
328 /*
329  * Format an INQUIRY CDB
330  */
331 static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)
332 {
333     memset(cdb, 0, 6);
334     cdb[0] = INQUIRY;
335     if (pg > 0) {
336         cdb[1] = 0x1;
337         cdb[2] = pg;
338     }
339     cdb[3] = (len >> 8) & 0xff;
340     cdb[4] = (len & 0xff);
341     return len;
342 }
343 
344 /*
345  * Encode lba and len into a READ_16/WRITE_16 CDB
346  */
347 static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,
348                                uint32_t len, bool is_write)
349 {
350     memset(cdb, 0x0, 16);
351     if (is_write) {
352         cdb[0] = WRITE_16;
353     } else {
354         cdb[0] = READ_16;
355     }
356     cdb[2] = (lba >> 56) & 0xff;
357     cdb[3] = (lba >> 48) & 0xff;
358     cdb[4] = (lba >> 40) & 0xff;
359     cdb[5] = (lba >> 32) & 0xff;
360     cdb[6] = (lba >> 24) & 0xff;
361     cdb[7] = (lba >> 16) & 0xff;
362     cdb[8] = (lba >> 8) & 0xff;
363     cdb[9] = (lba) & 0xff;
364     cdb[10] = (len >> 24) & 0xff;
365     cdb[11] = (len >> 16) & 0xff;
366     cdb[12] = (len >> 8) & 0xff;
367     cdb[13] = (len) & 0xff;
368 }
369 
370 /*
371  * Utility functions
372  */
373 static uint64_t megasas_fw_time(void)
374 {
375     struct tm curtime;
376     uint64_t bcd_time;
377 
378     qemu_get_timedate(&curtime, 0);
379     bcd_time = ((uint64_t)curtime.tm_sec & 0xff) << 48 |
380         ((uint64_t)curtime.tm_min & 0xff)  << 40 |
381         ((uint64_t)curtime.tm_hour & 0xff) << 32 |
382         ((uint64_t)curtime.tm_mday & 0xff) << 24 |
383         ((uint64_t)curtime.tm_mon & 0xff)  << 16 |
384         ((uint64_t)(curtime.tm_year + 1900) & 0xffff);
385 
386     return bcd_time;
387 }
388 
389 /*
390  * Default disk sata address
391  * 0x1221 is the magic number as
392  * present in real hardware,
393  * so use it here, too.
394  */
395 static uint64_t megasas_get_sata_addr(uint16_t id)
396 {
397     uint64_t addr = (0x1221ULL << 48);
398     return addr & (id << 24);
399 }
400 
401 /*
402  * Frame handling
403  */
404 static int megasas_next_index(MegasasState *s, int index, int limit)
405 {
406     index++;
407     if (index == limit) {
408         index = 0;
409     }
410     return index;
411 }
412 
413 static MegasasCmd *megasas_lookup_frame(MegasasState *s,
414     hwaddr frame)
415 {
416     MegasasCmd *cmd = NULL;
417     int num = 0, index;
418 
419     index = s->reply_queue_head;
420 
421     while (num < s->fw_cmds) {
422         if (s->frames[index].pa && s->frames[index].pa == frame) {
423             cmd = &s->frames[index];
424             break;
425         }
426         index = megasas_next_index(s, index, s->fw_cmds);
427         num++;
428     }
429 
430     return cmd;
431 }
432 
433 static MegasasCmd *megasas_next_frame(MegasasState *s,
434     hwaddr frame)
435 {
436     MegasasCmd *cmd = NULL;
437     int num = 0, index;
438 
439     cmd = megasas_lookup_frame(s, frame);
440     if (cmd) {
441         trace_megasas_qf_found(cmd->index, cmd->pa);
442         return cmd;
443     }
444     index = s->reply_queue_head;
445     num = 0;
446     while (num < s->fw_cmds) {
447         if (!s->frames[index].pa) {
448             cmd = &s->frames[index];
449             break;
450         }
451         index = megasas_next_index(s, index, s->fw_cmds);
452         num++;
453     }
454     if (!cmd) {
455         trace_megasas_qf_failed(frame);
456     }
457     trace_megasas_qf_new(index, cmd);
458     return cmd;
459 }
460 
461 static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
462     hwaddr frame, uint64_t context, int count)
463 {
464     MegasasCmd *cmd = NULL;
465     int frame_size = MFI_FRAME_SIZE * 16;
466     hwaddr frame_size_p = frame_size;
467 
468     cmd = megasas_next_frame(s, frame);
469     /* All frames busy */
470     if (!cmd) {
471         return NULL;
472     }
473     if (!cmd->pa) {
474         cmd->pa = frame;
475         /* Map all possible frames */
476         cmd->frame = cpu_physical_memory_map(frame, &frame_size_p, 0);
477         if (frame_size_p != frame_size) {
478             trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
479             if (cmd->frame) {
480                 cpu_physical_memory_unmap(cmd->frame, frame_size_p, 0, 0);
481                 cmd->frame = NULL;
482                 cmd->pa = 0;
483             }
484             s->event_count++;
485             return NULL;
486         }
487         cmd->pa_size = frame_size_p;
488         cmd->context = context;
489         if (!megasas_use_queue64(s)) {
490             cmd->context &= (uint64_t)0xFFFFFFFF;
491         }
492     }
493     cmd->count = count;
494     s->busy++;
495 
496     trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,
497                              s->reply_queue_head, s->busy);
498 
499     return cmd;
500 }
501 
502 static void megasas_complete_frame(MegasasState *s, uint64_t context)
503 {
504     PCIDevice *pci_dev = PCI_DEVICE(s);
505     int tail, queue_offset;
506 
507     /* Decrement busy count */
508     s->busy--;
509 
510     if (s->reply_queue_pa) {
511         /*
512          * Put command on the reply queue.
513          * Context is opaque, but emulation is running in
514          * little endian. So convert it.
515          */
516         tail = s->reply_queue_head;
517         if (megasas_use_queue64(s)) {
518             queue_offset = tail * sizeof(uint64_t);
519             stq_le_phys(s->reply_queue_pa + queue_offset, context);
520         } else {
521             queue_offset = tail * sizeof(uint32_t);
522             stl_le_phys(s->reply_queue_pa + queue_offset, context);
523         }
524         s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
525         trace_megasas_qf_complete(context, tail, queue_offset,
526                                   s->busy, s->doorbell);
527     }
528 
529     if (megasas_intr_enabled(s)) {
530         /* Notify HBA */
531         s->doorbell++;
532         if (s->doorbell == 1) {
533             if (msix_enabled(pci_dev)) {
534                 trace_megasas_msix_raise(0);
535                 msix_notify(pci_dev, 0);
536             } else {
537                 trace_megasas_irq_raise();
538                 qemu_irq_raise(pci_dev->irq[0]);
539             }
540         }
541     } else {
542         trace_megasas_qf_complete_noirq(context);
543     }
544 }
545 
546 static void megasas_reset_frames(MegasasState *s)
547 {
548     int i;
549     MegasasCmd *cmd;
550 
551     for (i = 0; i < s->fw_cmds; i++) {
552         cmd = &s->frames[i];
553         if (cmd->pa) {
554             cpu_physical_memory_unmap(cmd->frame, cmd->pa_size, 0, 0);
555             cmd->frame = NULL;
556             cmd->pa = 0;
557         }
558     }
559 }
560 
561 static void megasas_abort_command(MegasasCmd *cmd)
562 {
563     if (cmd->req) {
564         scsi_req_cancel(cmd->req);
565         cmd->req = NULL;
566     }
567 }
568 
569 static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
570 {
571     uint32_t pa_hi, pa_lo;
572     hwaddr iq_pa, initq_size;
573     struct mfi_init_qinfo *initq;
574     uint32_t flags;
575     int ret = MFI_STAT_OK;
576 
577     pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);
578     pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);
579     iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);
580     trace_megasas_init_firmware((uint64_t)iq_pa);
581     initq_size = sizeof(*initq);
582     initq = cpu_physical_memory_map(iq_pa, &initq_size, 0);
583     if (!initq || initq_size != sizeof(*initq)) {
584         trace_megasas_initq_map_failed(cmd->index);
585         s->event_count++;
586         ret = MFI_STAT_MEMORY_NOT_AVAILABLE;
587         goto out;
588     }
589     s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;
590     if (s->reply_queue_len > s->fw_cmds) {
591         trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);
592         s->event_count++;
593         ret = MFI_STAT_INVALID_PARAMETER;
594         goto out;
595     }
596     pa_lo = le32_to_cpu(initq->rq_addr_lo);
597     pa_hi = le32_to_cpu(initq->rq_addr_hi);
598     s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;
599     pa_lo = le32_to_cpu(initq->ci_addr_lo);
600     pa_hi = le32_to_cpu(initq->ci_addr_hi);
601     s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
602     pa_lo = le32_to_cpu(initq->pi_addr_lo);
603     pa_hi = le32_to_cpu(initq->pi_addr_hi);
604     s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
605     s->reply_queue_head = ldl_le_phys(s->producer_pa);
606     s->reply_queue_tail = ldl_le_phys(s->consumer_pa);
607     flags = le32_to_cpu(initq->flags);
608     if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
609         s->flags |= MEGASAS_MASK_USE_QUEUE64;
610     }
611     trace_megasas_init_queue((unsigned long)s->reply_queue_pa,
612                              s->reply_queue_len, s->reply_queue_head,
613                              s->reply_queue_tail, flags);
614     megasas_reset_frames(s);
615     s->fw_state = MFI_FWSTATE_OPERATIONAL;
616 out:
617     if (initq) {
618         cpu_physical_memory_unmap(initq, initq_size, 0, 0);
619     }
620     return ret;
621 }
622 
623 static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
624 {
625     dma_addr_t iov_pa, iov_size;
626 
627     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
628     if (!cmd->frame->header.sge_count) {
629         trace_megasas_dcmd_zero_sge(cmd->index);
630         cmd->iov_size = 0;
631         return 0;
632     } else if (cmd->frame->header.sge_count > 1) {
633         trace_megasas_dcmd_invalid_sge(cmd->index,
634                                        cmd->frame->header.sge_count);
635         cmd->iov_size = 0;
636         return -1;
637     }
638     iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
639     iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
640     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), 1);
641     qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
642     cmd->iov_size = iov_size;
643     return cmd->iov_size;
644 }
645 
646 static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
647 {
648     trace_megasas_finish_dcmd(cmd->index, iov_size);
649 
650     if (cmd->frame->header.sge_count) {
651         qemu_sglist_destroy(&cmd->qsg);
652     }
653     if (iov_size > cmd->iov_size) {
654         if (megasas_frame_is_ieee_sgl(cmd)) {
655             cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);
656         } else if (megasas_frame_is_sgl64(cmd)) {
657             cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);
658         } else {
659             cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);
660         }
661     }
662     cmd->iov_size = 0;
663 }
664 
665 static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
666 {
667     PCIDevice *pci_dev = PCI_DEVICE(s);
668     struct mfi_ctrl_info info;
669     size_t dcmd_size = sizeof(info);
670     BusChild *kid;
671     int num_ld_disks = 0;
672     uint16_t sdev_id;
673 
674     memset(&info, 0x0, cmd->iov_size);
675     if (cmd->iov_size < dcmd_size) {
676         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
677                                             dcmd_size);
678         return MFI_STAT_INVALID_PARAMETER;
679     }
680 
681     info.pci.vendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);
682     info.pci.device = cpu_to_le16(PCI_DEVICE_ID_LSI_SAS1078);
683     info.pci.subvendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);
684     info.pci.subdevice = cpu_to_le16(0x1013);
685 
686     /*
687      * For some reason the firmware supports
688      * only up to 8 device ports.
689      * Despite supporting a far larger number
690      * of devices for the physical devices.
691      * So just display the first 8 devices
692      * in the device port list, independent
693      * of how many logical devices are actually
694      * present.
695      */
696     info.host.type = MFI_INFO_HOST_PCIE;
697     info.device.type = MFI_INFO_DEV_SAS3G;
698     info.device.port_count = 8;
699     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
700         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
701 
702         if (num_ld_disks < 8) {
703             sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
704             info.device.port_addr[num_ld_disks] =
705                 cpu_to_le64(megasas_get_sata_addr(sdev_id));
706         }
707         num_ld_disks++;
708     }
709 
710     memcpy(info.product_name, "MegaRAID SAS 8708EM2", 20);
711     snprintf(info.serial_number, 32, "%s", s->hba_serial);
712     snprintf(info.package_version, 0x60, "%s-QEMU", QEMU_VERSION);
713     memcpy(info.image_component[0].name, "APP", 3);
714     memcpy(info.image_component[0].version, MEGASAS_VERSION "-QEMU", 9);
715     memcpy(info.image_component[0].build_date, __DATE__, 11);
716     memcpy(info.image_component[0].build_time, __TIME__, 8);
717     info.image_component_count = 1;
718     if (pci_dev->has_rom) {
719         uint8_t biosver[32];
720         uint8_t *ptr;
721 
722         ptr = memory_region_get_ram_ptr(&pci_dev->rom);
723         memcpy(biosver, ptr + 0x41, 31);
724         memcpy(info.image_component[1].name, "BIOS", 4);
725         memcpy(info.image_component[1].version, biosver,
726                strlen((const char *)biosver));
727         info.image_component_count++;
728     }
729     info.current_fw_time = cpu_to_le32(megasas_fw_time());
730     info.max_arms = 32;
731     info.max_spans = 8;
732     info.max_arrays = MEGASAS_MAX_ARRAYS;
733     info.max_lds = s->fw_luns;
734     info.max_cmds = cpu_to_le16(s->fw_cmds);
735     info.max_sg_elements = cpu_to_le16(s->fw_sge);
736     info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);
737     info.lds_present = cpu_to_le16(num_ld_disks);
738     info.pd_present = cpu_to_le16(num_ld_disks);
739     info.pd_disks_present = cpu_to_le16(num_ld_disks);
740     info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |
741                                    MFI_INFO_HW_MEM |
742                                    MFI_INFO_HW_FLASH);
743     info.memory_size = cpu_to_le16(512);
744     info.nvram_size = cpu_to_le16(32);
745     info.flash_size = cpu_to_le16(16);
746     info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);
747     info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |
748                                     MFI_INFO_AOPS_SELF_DIAGNOSTIC |
749                                     MFI_INFO_AOPS_MIXED_ARRAY);
750     info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |
751                                MFI_INFO_LDOPS_ACCESS_POLICY |
752                                MFI_INFO_LDOPS_IO_POLICY |
753                                MFI_INFO_LDOPS_WRITE_POLICY |
754                                MFI_INFO_LDOPS_READ_POLICY);
755     info.max_strips_per_io = cpu_to_le16(s->fw_sge);
756     info.stripe_sz_ops.min = 3;
757     info.stripe_sz_ops.max = ffs(MEGASAS_MAX_SECTORS + 1) - 1;
758     info.properties.pred_fail_poll_interval = cpu_to_le16(300);
759     info.properties.intr_throttle_cnt = cpu_to_le16(16);
760     info.properties.intr_throttle_timeout = cpu_to_le16(50);
761     info.properties.rebuild_rate = 30;
762     info.properties.patrol_read_rate = 30;
763     info.properties.bgi_rate = 30;
764     info.properties.cc_rate = 30;
765     info.properties.recon_rate = 30;
766     info.properties.cache_flush_interval = 4;
767     info.properties.spinup_drv_cnt = 2;
768     info.properties.spinup_delay = 6;
769     info.properties.ecc_bucket_size = 15;
770     info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);
771     info.properties.expose_encl_devices = 1;
772     info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);
773     info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |
774                                MFI_INFO_PDOPS_FORCE_OFFLINE);
775     info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |
776                                        MFI_INFO_PDMIX_SATA |
777                                        MFI_INFO_PDMIX_LD);
778 
779     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
780     return MFI_STAT_OK;
781 }
782 
783 static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)
784 {
785     struct mfi_defaults info;
786     size_t dcmd_size = sizeof(struct mfi_defaults);
787 
788     memset(&info, 0x0, dcmd_size);
789     if (cmd->iov_size < dcmd_size) {
790         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
791                                             dcmd_size);
792         return MFI_STAT_INVALID_PARAMETER;
793     }
794 
795     info.sas_addr = cpu_to_le64(s->sas_addr);
796     info.stripe_size = 3;
797     info.flush_time = 4;
798     info.background_rate = 30;
799     info.allow_mix_in_enclosure = 1;
800     info.allow_mix_in_ld = 1;
801     info.direct_pd_mapping = 1;
802     /* Enable for BIOS support */
803     info.bios_enumerate_lds = 1;
804     info.disable_ctrl_r = 1;
805     info.expose_enclosure_devices = 1;
806     info.disable_preboot_cli = 1;
807     info.cluster_disable = 1;
808 
809     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
810     return MFI_STAT_OK;
811 }
812 
813 static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)
814 {
815     struct mfi_bios_data info;
816     size_t dcmd_size = sizeof(info);
817 
818     memset(&info, 0x0, dcmd_size);
819     if (cmd->iov_size < dcmd_size) {
820         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
821                                             dcmd_size);
822         return MFI_STAT_INVALID_PARAMETER;
823     }
824     info.continue_on_error = 1;
825     info.verbose = 1;
826     if (megasas_is_jbod(s)) {
827         info.expose_all_drives = 1;
828     }
829 
830     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
831     return MFI_STAT_OK;
832 }
833 
834 static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)
835 {
836     uint64_t fw_time;
837     size_t dcmd_size = sizeof(fw_time);
838 
839     fw_time = cpu_to_le64(megasas_fw_time());
840 
841     cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);
842     return MFI_STAT_OK;
843 }
844 
845 static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)
846 {
847     uint64_t fw_time;
848 
849     /* This is a dummy; setting of firmware time is not allowed */
850     memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));
851 
852     trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);
853     fw_time = cpu_to_le64(megasas_fw_time());
854     return MFI_STAT_OK;
855 }
856 
857 static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)
858 {
859     struct mfi_evt_log_state info;
860     size_t dcmd_size = sizeof(info);
861 
862     memset(&info, 0, dcmd_size);
863 
864     info.newest_seq_num = cpu_to_le32(s->event_count);
865     info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
866     info.boot_seq_num = cpu_to_le32(s->boot_event);
867 
868     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
869     return MFI_STAT_OK;
870 }
871 
872 static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
873 {
874     union mfi_evt event;
875 
876     if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {
877         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
878                                             sizeof(struct mfi_evt_detail));
879         return MFI_STAT_INVALID_PARAMETER;
880     }
881     s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);
882     event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);
883     s->event_locale = event.members.locale;
884     s->event_class = event.members.class;
885     s->event_cmd = cmd;
886     /* Decrease busy count; event frame doesn't count here */
887     s->busy--;
888     cmd->iov_size = sizeof(struct mfi_evt_detail);
889     return MFI_STAT_INVALID_STATUS;
890 }
891 
892 static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
893 {
894     struct mfi_pd_list info;
895     size_t dcmd_size = sizeof(info);
896     BusChild *kid;
897     uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
898     uint16_t sdev_id;
899 
900     memset(&info, 0, dcmd_size);
901     offset = 8;
902     dcmd_limit = offset + sizeof(struct mfi_pd_address);
903     if (cmd->iov_size < dcmd_limit) {
904         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
905                                             dcmd_limit);
906         return MFI_STAT_INVALID_PARAMETER;
907     }
908 
909     max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);
910     if (max_pd_disks > s->fw_luns) {
911         max_pd_disks = s->fw_luns;
912     }
913 
914     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
915         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
916 
917         sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
918         info.addr[num_pd_disks].device_id = cpu_to_le16(sdev_id);
919         info.addr[num_pd_disks].encl_device_id = 0xFFFF;
920         info.addr[num_pd_disks].encl_index = 0;
921         info.addr[num_pd_disks].slot_number = (sdev->id & 0xFF);
922         info.addr[num_pd_disks].scsi_dev_type = sdev->type;
923         info.addr[num_pd_disks].connect_port_bitmap = 0x1;
924         info.addr[num_pd_disks].sas_addr[0] =
925             cpu_to_le64(megasas_get_sata_addr(sdev_id));
926         num_pd_disks++;
927         offset += sizeof(struct mfi_pd_address);
928     }
929     trace_megasas_dcmd_pd_get_list(cmd->index, num_pd_disks,
930                                    max_pd_disks, offset);
931 
932     info.size = cpu_to_le32(offset);
933     info.count = cpu_to_le32(num_pd_disks);
934 
935     cmd->iov_size -= dma_buf_read((uint8_t *)&info, offset, &cmd->qsg);
936     return MFI_STAT_OK;
937 }
938 
939 static int megasas_dcmd_pd_list_query(MegasasState *s, MegasasCmd *cmd)
940 {
941     uint16_t flags;
942 
943     /* mbox0 contains flags */
944     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
945     trace_megasas_dcmd_pd_list_query(cmd->index, flags);
946     if (flags == MR_PD_QUERY_TYPE_ALL ||
947         megasas_is_jbod(s)) {
948         return megasas_dcmd_pd_get_list(s, cmd);
949     }
950 
951     return MFI_STAT_OK;
952 }
953 
954 static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun,
955                                       MegasasCmd *cmd)
956 {
957     struct mfi_pd_info *info = cmd->iov_buf;
958     size_t dcmd_size = sizeof(struct mfi_pd_info);
959     BlockConf *conf = &sdev->conf;
960     uint64_t pd_size;
961     uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (lun & 0xFF);
962     uint8_t cmdbuf[6];
963     SCSIRequest *req;
964     size_t len, resid;
965 
966     if (!cmd->iov_buf) {
967         cmd->iov_buf = g_malloc(dcmd_size);
968         memset(cmd->iov_buf, 0, dcmd_size);
969         info = cmd->iov_buf;
970         info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */
971         info->vpd_page83[0] = 0x7f;
972         megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data));
973         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
974         if (!req) {
975             trace_megasas_dcmd_req_alloc_failed(cmd->index,
976                                                 "PD get info std inquiry");
977             g_free(cmd->iov_buf);
978             cmd->iov_buf = NULL;
979             return MFI_STAT_FLASH_ALLOC_FAIL;
980         }
981         trace_megasas_dcmd_internal_submit(cmd->index,
982                                            "PD get info std inquiry", lun);
983         len = scsi_req_enqueue(req);
984         if (len > 0) {
985             cmd->iov_size = len;
986             scsi_req_continue(req);
987         }
988         return MFI_STAT_INVALID_STATUS;
989     } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) {
990         megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83));
991         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
992         if (!req) {
993             trace_megasas_dcmd_req_alloc_failed(cmd->index,
994                                                 "PD get info vpd inquiry");
995             return MFI_STAT_FLASH_ALLOC_FAIL;
996         }
997         trace_megasas_dcmd_internal_submit(cmd->index,
998                                            "PD get info vpd inquiry", lun);
999         len = scsi_req_enqueue(req);
1000         if (len > 0) {
1001             cmd->iov_size = len;
1002             scsi_req_continue(req);
1003         }
1004         return MFI_STAT_INVALID_STATUS;
1005     }
1006     /* Finished, set FW state */
1007     if ((info->inquiry_data[0] >> 5) == 0) {
1008         if (megasas_is_jbod(cmd->state)) {
1009             info->fw_state = cpu_to_le16(MFI_PD_STATE_SYSTEM);
1010         } else {
1011             info->fw_state = cpu_to_le16(MFI_PD_STATE_ONLINE);
1012         }
1013     } else {
1014         info->fw_state = cpu_to_le16(MFI_PD_STATE_OFFLINE);
1015     }
1016 
1017     info->ref.v.device_id = cpu_to_le16(sdev_id);
1018     info->state.ddf.pd_type = cpu_to_le16(MFI_PD_DDF_TYPE_IN_VD|
1019                                           MFI_PD_DDF_TYPE_INTF_SAS);
1020     bdrv_get_geometry(conf->bs, &pd_size);
1021     info->raw_size = cpu_to_le64(pd_size);
1022     info->non_coerced_size = cpu_to_le64(pd_size);
1023     info->coerced_size = cpu_to_le64(pd_size);
1024     info->encl_device_id = 0xFFFF;
1025     info->slot_number = (sdev->id & 0xFF);
1026     info->path_info.count = 1;
1027     info->path_info.sas_addr[0] =
1028         cpu_to_le64(megasas_get_sata_addr(sdev_id));
1029     info->connected_port_bitmap = 0x1;
1030     info->device_speed = 1;
1031     info->link_speed = 1;
1032     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1033     g_free(cmd->iov_buf);
1034     cmd->iov_size = dcmd_size - resid;
1035     cmd->iov_buf = NULL;
1036     return MFI_STAT_OK;
1037 }
1038 
1039 static int megasas_dcmd_pd_get_info(MegasasState *s, MegasasCmd *cmd)
1040 {
1041     size_t dcmd_size = sizeof(struct mfi_pd_info);
1042     uint16_t pd_id;
1043     SCSIDevice *sdev = NULL;
1044     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1045 
1046     if (cmd->iov_size < dcmd_size) {
1047         return MFI_STAT_INVALID_PARAMETER;
1048     }
1049 
1050     /* mbox0 has the ID */
1051     pd_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1052     sdev = scsi_device_find(&s->bus, 0, pd_id, 0);
1053     trace_megasas_dcmd_pd_get_info(cmd->index, pd_id);
1054 
1055     if (sdev) {
1056         /* Submit inquiry */
1057         retval = megasas_pd_get_info_submit(sdev, pd_id, cmd);
1058     }
1059 
1060     return retval;
1061 }
1062 
1063 static int megasas_dcmd_ld_get_list(MegasasState *s, MegasasCmd *cmd)
1064 {
1065     struct mfi_ld_list info;
1066     size_t dcmd_size = sizeof(info), resid;
1067     uint32_t num_ld_disks = 0, max_ld_disks = s->fw_luns;
1068     uint64_t ld_size;
1069     BusChild *kid;
1070 
1071     memset(&info, 0, dcmd_size);
1072     if (cmd->iov_size < dcmd_size) {
1073         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1074                                             dcmd_size);
1075         return MFI_STAT_INVALID_PARAMETER;
1076     }
1077 
1078     if (megasas_is_jbod(s)) {
1079         max_ld_disks = 0;
1080     }
1081     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1082         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1083         BlockConf *conf = &sdev->conf;
1084 
1085         if (num_ld_disks >= max_ld_disks) {
1086             break;
1087         }
1088         /* Logical device size is in blocks */
1089         bdrv_get_geometry(conf->bs, &ld_size);
1090         info.ld_list[num_ld_disks].ld.v.target_id = sdev->id;
1091         info.ld_list[num_ld_disks].ld.v.lun_id = sdev->lun;
1092         info.ld_list[num_ld_disks].state = MFI_LD_STATE_OPTIMAL;
1093         info.ld_list[num_ld_disks].size = cpu_to_le64(ld_size);
1094         num_ld_disks++;
1095     }
1096     info.ld_count = cpu_to_le32(num_ld_disks);
1097     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1098 
1099     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1100     cmd->iov_size = dcmd_size - resid;
1101     return MFI_STAT_OK;
1102 }
1103 
1104 static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun,
1105                                       MegasasCmd *cmd)
1106 {
1107     struct mfi_ld_info *info = cmd->iov_buf;
1108     size_t dcmd_size = sizeof(struct mfi_ld_info);
1109     uint8_t cdb[6];
1110     SCSIRequest *req;
1111     ssize_t len, resid;
1112     BlockConf *conf = &sdev->conf;
1113     uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (lun & 0xFF);
1114     uint64_t ld_size;
1115 
1116     if (!cmd->iov_buf) {
1117         cmd->iov_buf = g_malloc(dcmd_size);
1118         memset(cmd->iov_buf, 0x0, dcmd_size);
1119         info = cmd->iov_buf;
1120         megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83));
1121         req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd);
1122         if (!req) {
1123             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1124                                                 "LD get info vpd inquiry");
1125             g_free(cmd->iov_buf);
1126             cmd->iov_buf = NULL;
1127             return MFI_STAT_FLASH_ALLOC_FAIL;
1128         }
1129         trace_megasas_dcmd_internal_submit(cmd->index,
1130                                            "LD get info vpd inquiry", lun);
1131         len = scsi_req_enqueue(req);
1132         if (len > 0) {
1133             cmd->iov_size = len;
1134             scsi_req_continue(req);
1135         }
1136         return MFI_STAT_INVALID_STATUS;
1137     }
1138 
1139     info->ld_config.params.state = MFI_LD_STATE_OPTIMAL;
1140     info->ld_config.properties.ld.v.target_id = lun;
1141     info->ld_config.params.stripe_size = 3;
1142     info->ld_config.params.num_drives = 1;
1143     info->ld_config.params.is_consistent = 1;
1144     /* Logical device size is in blocks */
1145     bdrv_get_geometry(conf->bs, &ld_size);
1146     info->size = cpu_to_le64(ld_size);
1147     memset(info->ld_config.span, 0, sizeof(info->ld_config.span));
1148     info->ld_config.span[0].start_block = 0;
1149     info->ld_config.span[0].num_blocks = info->size;
1150     info->ld_config.span[0].array_ref = cpu_to_le16(sdev_id);
1151 
1152     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1153     g_free(cmd->iov_buf);
1154     cmd->iov_size = dcmd_size - resid;
1155     cmd->iov_buf = NULL;
1156     return MFI_STAT_OK;
1157 }
1158 
1159 static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
1160 {
1161     struct mfi_ld_info info;
1162     size_t dcmd_size = sizeof(info);
1163     uint16_t ld_id;
1164     uint32_t max_ld_disks = s->fw_luns;
1165     SCSIDevice *sdev = NULL;
1166     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1167 
1168     if (cmd->iov_size < dcmd_size) {
1169         return MFI_STAT_INVALID_PARAMETER;
1170     }
1171 
1172     /* mbox0 has the ID */
1173     ld_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1174     trace_megasas_dcmd_ld_get_info(cmd->index, ld_id);
1175 
1176     if (megasas_is_jbod(s)) {
1177         return MFI_STAT_DEVICE_NOT_FOUND;
1178     }
1179 
1180     if (ld_id < max_ld_disks) {
1181         sdev = scsi_device_find(&s->bus, 0, ld_id, 0);
1182     }
1183 
1184     if (sdev) {
1185         retval = megasas_ld_get_info_submit(sdev, ld_id, cmd);
1186     }
1187 
1188     return retval;
1189 }
1190 
1191 static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
1192 {
1193     uint8_t data[4096];
1194     struct mfi_config_data *info;
1195     int num_pd_disks = 0, array_offset, ld_offset;
1196     BusChild *kid;
1197 
1198     if (cmd->iov_size > 4096) {
1199         return MFI_STAT_INVALID_PARAMETER;
1200     }
1201 
1202     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1203         num_pd_disks++;
1204     }
1205     info = (struct mfi_config_data *)&data;
1206     /*
1207      * Array mapping:
1208      * - One array per SCSI device
1209      * - One logical drive per SCSI device
1210      *   spanning the entire device
1211      */
1212     info->array_count = num_pd_disks;
1213     info->array_size = sizeof(struct mfi_array) * num_pd_disks;
1214     info->log_drv_count = num_pd_disks;
1215     info->log_drv_size = sizeof(struct mfi_ld_config) * num_pd_disks;
1216     info->spares_count = 0;
1217     info->spares_size = sizeof(struct mfi_spare);
1218     info->size = sizeof(struct mfi_config_data) + info->array_size +
1219         info->log_drv_size;
1220     if (info->size > 4096) {
1221         return MFI_STAT_INVALID_PARAMETER;
1222     }
1223 
1224     array_offset = sizeof(struct mfi_config_data);
1225     ld_offset = array_offset + sizeof(struct mfi_array) * num_pd_disks;
1226 
1227     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1228         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1229         BlockConf *conf = &sdev->conf;
1230         uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
1231         struct mfi_array *array;
1232         struct mfi_ld_config *ld;
1233         uint64_t pd_size;
1234         int i;
1235 
1236         array = (struct mfi_array *)(data + array_offset);
1237         bdrv_get_geometry(conf->bs, &pd_size);
1238         array->size = cpu_to_le64(pd_size);
1239         array->num_drives = 1;
1240         array->array_ref = cpu_to_le16(sdev_id);
1241         array->pd[0].ref.v.device_id = cpu_to_le16(sdev_id);
1242         array->pd[0].ref.v.seq_num = 0;
1243         array->pd[0].fw_state = MFI_PD_STATE_ONLINE;
1244         array->pd[0].encl.pd = 0xFF;
1245         array->pd[0].encl.slot = (sdev->id & 0xFF);
1246         for (i = 1; i < MFI_MAX_ROW_SIZE; i++) {
1247             array->pd[i].ref.v.device_id = 0xFFFF;
1248             array->pd[i].ref.v.seq_num = 0;
1249             array->pd[i].fw_state = MFI_PD_STATE_UNCONFIGURED_GOOD;
1250             array->pd[i].encl.pd = 0xFF;
1251             array->pd[i].encl.slot = 0xFF;
1252         }
1253         array_offset += sizeof(struct mfi_array);
1254         ld = (struct mfi_ld_config *)(data + ld_offset);
1255         memset(ld, 0, sizeof(struct mfi_ld_config));
1256         ld->properties.ld.v.target_id = (sdev->id & 0xFF);
1257         ld->properties.default_cache_policy = MR_LD_CACHE_READ_AHEAD |
1258             MR_LD_CACHE_READ_ADAPTIVE;
1259         ld->properties.current_cache_policy = MR_LD_CACHE_READ_AHEAD |
1260             MR_LD_CACHE_READ_ADAPTIVE;
1261         ld->params.state = MFI_LD_STATE_OPTIMAL;
1262         ld->params.stripe_size = 3;
1263         ld->params.num_drives = 1;
1264         ld->params.span_depth = 1;
1265         ld->params.is_consistent = 1;
1266         ld->span[0].start_block = 0;
1267         ld->span[0].num_blocks = cpu_to_le64(pd_size);
1268         ld->span[0].array_ref = cpu_to_le16(sdev_id);
1269         ld_offset += sizeof(struct mfi_ld_config);
1270     }
1271 
1272     cmd->iov_size -= dma_buf_read((uint8_t *)data, info->size, &cmd->qsg);
1273     return MFI_STAT_OK;
1274 }
1275 
1276 static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
1277 {
1278     struct mfi_ctrl_props info;
1279     size_t dcmd_size = sizeof(info);
1280 
1281     memset(&info, 0x0, dcmd_size);
1282     if (cmd->iov_size < dcmd_size) {
1283         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1284                                             dcmd_size);
1285         return MFI_STAT_INVALID_PARAMETER;
1286     }
1287     info.pred_fail_poll_interval = cpu_to_le16(300);
1288     info.intr_throttle_cnt = cpu_to_le16(16);
1289     info.intr_throttle_timeout = cpu_to_le16(50);
1290     info.rebuild_rate = 30;
1291     info.patrol_read_rate = 30;
1292     info.bgi_rate = 30;
1293     info.cc_rate = 30;
1294     info.recon_rate = 30;
1295     info.cache_flush_interval = 4;
1296     info.spinup_drv_cnt = 2;
1297     info.spinup_delay = 6;
1298     info.ecc_bucket_size = 15;
1299     info.ecc_bucket_leak_rate = cpu_to_le16(1440);
1300     info.expose_encl_devices = 1;
1301 
1302     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1303     return MFI_STAT_OK;
1304 }
1305 
1306 static int megasas_cache_flush(MegasasState *s, MegasasCmd *cmd)
1307 {
1308     bdrv_drain_all();
1309     return MFI_STAT_OK;
1310 }
1311 
1312 static int megasas_ctrl_shutdown(MegasasState *s, MegasasCmd *cmd)
1313 {
1314     s->fw_state = MFI_FWSTATE_READY;
1315     return MFI_STAT_OK;
1316 }
1317 
1318 static int megasas_cluster_reset_ld(MegasasState *s, MegasasCmd *cmd)
1319 {
1320     return MFI_STAT_INVALID_DCMD;
1321 }
1322 
1323 static int megasas_dcmd_set_properties(MegasasState *s, MegasasCmd *cmd)
1324 {
1325     struct mfi_ctrl_props info;
1326     size_t dcmd_size = sizeof(info);
1327 
1328     if (cmd->iov_size < dcmd_size) {
1329         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1330                                             dcmd_size);
1331         return MFI_STAT_INVALID_PARAMETER;
1332     }
1333     dma_buf_write((uint8_t *)&info, cmd->iov_size, &cmd->qsg);
1334     trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
1335     return MFI_STAT_OK;
1336 }
1337 
1338 static int megasas_dcmd_dummy(MegasasState *s, MegasasCmd *cmd)
1339 {
1340     trace_megasas_dcmd_dummy(cmd->index, cmd->iov_size);
1341     return MFI_STAT_OK;
1342 }
1343 
1344 static const struct dcmd_cmd_tbl_t {
1345     int opcode;
1346     const char *desc;
1347     int (*func)(MegasasState *s, MegasasCmd *cmd);
1348 } dcmd_cmd_tbl[] = {
1349     { MFI_DCMD_CTRL_MFI_HOST_MEM_ALLOC, "CTRL_HOST_MEM_ALLOC",
1350       megasas_dcmd_dummy },
1351     { MFI_DCMD_CTRL_GET_INFO, "CTRL_GET_INFO",
1352       megasas_ctrl_get_info },
1353     { MFI_DCMD_CTRL_GET_PROPERTIES, "CTRL_GET_PROPERTIES",
1354       megasas_dcmd_get_properties },
1355     { MFI_DCMD_CTRL_SET_PROPERTIES, "CTRL_SET_PROPERTIES",
1356       megasas_dcmd_set_properties },
1357     { MFI_DCMD_CTRL_ALARM_GET, "CTRL_ALARM_GET",
1358       megasas_dcmd_dummy },
1359     { MFI_DCMD_CTRL_ALARM_ENABLE, "CTRL_ALARM_ENABLE",
1360       megasas_dcmd_dummy },
1361     { MFI_DCMD_CTRL_ALARM_DISABLE, "CTRL_ALARM_DISABLE",
1362       megasas_dcmd_dummy },
1363     { MFI_DCMD_CTRL_ALARM_SILENCE, "CTRL_ALARM_SILENCE",
1364       megasas_dcmd_dummy },
1365     { MFI_DCMD_CTRL_ALARM_TEST, "CTRL_ALARM_TEST",
1366       megasas_dcmd_dummy },
1367     { MFI_DCMD_CTRL_EVENT_GETINFO, "CTRL_EVENT_GETINFO",
1368       megasas_event_info },
1369     { MFI_DCMD_CTRL_EVENT_GET, "CTRL_EVENT_GET",
1370       megasas_dcmd_dummy },
1371     { MFI_DCMD_CTRL_EVENT_WAIT, "CTRL_EVENT_WAIT",
1372       megasas_event_wait },
1373     { MFI_DCMD_CTRL_SHUTDOWN, "CTRL_SHUTDOWN",
1374       megasas_ctrl_shutdown },
1375     { MFI_DCMD_HIBERNATE_STANDBY, "CTRL_STANDBY",
1376       megasas_dcmd_dummy },
1377     { MFI_DCMD_CTRL_GET_TIME, "CTRL_GET_TIME",
1378       megasas_dcmd_get_fw_time },
1379     { MFI_DCMD_CTRL_SET_TIME, "CTRL_SET_TIME",
1380       megasas_dcmd_set_fw_time },
1381     { MFI_DCMD_CTRL_BIOS_DATA_GET, "CTRL_BIOS_DATA_GET",
1382       megasas_dcmd_get_bios_info },
1383     { MFI_DCMD_CTRL_FACTORY_DEFAULTS, "CTRL_FACTORY_DEFAULTS",
1384       megasas_dcmd_dummy },
1385     { MFI_DCMD_CTRL_MFC_DEFAULTS_GET, "CTRL_MFC_DEFAULTS_GET",
1386       megasas_mfc_get_defaults },
1387     { MFI_DCMD_CTRL_MFC_DEFAULTS_SET, "CTRL_MFC_DEFAULTS_SET",
1388       megasas_dcmd_dummy },
1389     { MFI_DCMD_CTRL_CACHE_FLUSH, "CTRL_CACHE_FLUSH",
1390       megasas_cache_flush },
1391     { MFI_DCMD_PD_GET_LIST, "PD_GET_LIST",
1392       megasas_dcmd_pd_get_list },
1393     { MFI_DCMD_PD_LIST_QUERY, "PD_LIST_QUERY",
1394       megasas_dcmd_pd_list_query },
1395     { MFI_DCMD_PD_GET_INFO, "PD_GET_INFO",
1396       megasas_dcmd_pd_get_info },
1397     { MFI_DCMD_PD_STATE_SET, "PD_STATE_SET",
1398       megasas_dcmd_dummy },
1399     { MFI_DCMD_PD_REBUILD, "PD_REBUILD",
1400       megasas_dcmd_dummy },
1401     { MFI_DCMD_PD_BLINK, "PD_BLINK",
1402       megasas_dcmd_dummy },
1403     { MFI_DCMD_PD_UNBLINK, "PD_UNBLINK",
1404       megasas_dcmd_dummy },
1405     { MFI_DCMD_LD_GET_LIST, "LD_GET_LIST",
1406       megasas_dcmd_ld_get_list},
1407     { MFI_DCMD_LD_GET_INFO, "LD_GET_INFO",
1408       megasas_dcmd_ld_get_info },
1409     { MFI_DCMD_LD_GET_PROP, "LD_GET_PROP",
1410       megasas_dcmd_dummy },
1411     { MFI_DCMD_LD_SET_PROP, "LD_SET_PROP",
1412       megasas_dcmd_dummy },
1413     { MFI_DCMD_LD_DELETE, "LD_DELETE",
1414       megasas_dcmd_dummy },
1415     { MFI_DCMD_CFG_READ, "CFG_READ",
1416       megasas_dcmd_cfg_read },
1417     { MFI_DCMD_CFG_ADD, "CFG_ADD",
1418       megasas_dcmd_dummy },
1419     { MFI_DCMD_CFG_CLEAR, "CFG_CLEAR",
1420       megasas_dcmd_dummy },
1421     { MFI_DCMD_CFG_FOREIGN_READ, "CFG_FOREIGN_READ",
1422       megasas_dcmd_dummy },
1423     { MFI_DCMD_CFG_FOREIGN_IMPORT, "CFG_FOREIGN_IMPORT",
1424       megasas_dcmd_dummy },
1425     { MFI_DCMD_BBU_STATUS, "BBU_STATUS",
1426       megasas_dcmd_dummy },
1427     { MFI_DCMD_BBU_CAPACITY_INFO, "BBU_CAPACITY_INFO",
1428       megasas_dcmd_dummy },
1429     { MFI_DCMD_BBU_DESIGN_INFO, "BBU_DESIGN_INFO",
1430       megasas_dcmd_dummy },
1431     { MFI_DCMD_BBU_PROP_GET, "BBU_PROP_GET",
1432       megasas_dcmd_dummy },
1433     { MFI_DCMD_CLUSTER, "CLUSTER",
1434       megasas_dcmd_dummy },
1435     { MFI_DCMD_CLUSTER_RESET_ALL, "CLUSTER_RESET_ALL",
1436       megasas_dcmd_dummy },
1437     { MFI_DCMD_CLUSTER_RESET_LD, "CLUSTER_RESET_LD",
1438       megasas_cluster_reset_ld },
1439     { -1, NULL, NULL }
1440 };
1441 
1442 static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)
1443 {
1444     int opcode, len;
1445     int retval = 0;
1446     const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;
1447 
1448     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1449     trace_megasas_handle_dcmd(cmd->index, opcode);
1450     len = megasas_map_dcmd(s, cmd);
1451     if (len < 0) {
1452         return MFI_STAT_MEMORY_NOT_AVAILABLE;
1453     }
1454     while (cmdptr->opcode != -1 && cmdptr->opcode != opcode) {
1455         cmdptr++;
1456     }
1457     if (cmdptr->opcode == -1) {
1458         trace_megasas_dcmd_unhandled(cmd->index, opcode, len);
1459         retval = megasas_dcmd_dummy(s, cmd);
1460     } else {
1461         trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);
1462         retval = cmdptr->func(s, cmd);
1463     }
1464     if (retval != MFI_STAT_INVALID_STATUS) {
1465         megasas_finish_dcmd(cmd, len);
1466     }
1467     return retval;
1468 }
1469 
1470 static int megasas_finish_internal_dcmd(MegasasCmd *cmd,
1471                                         SCSIRequest *req)
1472 {
1473     int opcode;
1474     int retval = MFI_STAT_OK;
1475     int lun = req->lun;
1476 
1477     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1478     scsi_req_unref(req);
1479     trace_megasas_dcmd_internal_finish(cmd->index, opcode, lun);
1480     switch (opcode) {
1481     case MFI_DCMD_PD_GET_INFO:
1482         retval = megasas_pd_get_info_submit(req->dev, lun, cmd);
1483         break;
1484     case MFI_DCMD_LD_GET_INFO:
1485         retval = megasas_ld_get_info_submit(req->dev, lun, cmd);
1486         break;
1487     default:
1488         trace_megasas_dcmd_internal_invalid(cmd->index, opcode);
1489         retval = MFI_STAT_INVALID_DCMD;
1490         break;
1491     }
1492     if (retval != MFI_STAT_INVALID_STATUS) {
1493         megasas_finish_dcmd(cmd, cmd->iov_size);
1494     }
1495     return retval;
1496 }
1497 
1498 static int megasas_enqueue_req(MegasasCmd *cmd, bool is_write)
1499 {
1500     int len;
1501 
1502     len = scsi_req_enqueue(cmd->req);
1503     if (len < 0) {
1504         len = -len;
1505     }
1506     if (len > 0) {
1507         if (len > cmd->iov_size) {
1508             if (is_write) {
1509                 trace_megasas_iov_write_overflow(cmd->index, len,
1510                                                  cmd->iov_size);
1511             } else {
1512                 trace_megasas_iov_read_overflow(cmd->index, len,
1513                                                 cmd->iov_size);
1514             }
1515         }
1516         if (len < cmd->iov_size) {
1517             if (is_write) {
1518                 trace_megasas_iov_write_underflow(cmd->index, len,
1519                                                   cmd->iov_size);
1520             } else {
1521                 trace_megasas_iov_read_underflow(cmd->index, len,
1522                                                  cmd->iov_size);
1523             }
1524             cmd->iov_size = len;
1525         }
1526         scsi_req_continue(cmd->req);
1527     }
1528     return len;
1529 }
1530 
1531 static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
1532                                bool is_logical)
1533 {
1534     uint8_t *cdb;
1535     int len;
1536     bool is_write;
1537     struct SCSIDevice *sdev = NULL;
1538 
1539     cdb = cmd->frame->pass.cdb;
1540 
1541     if (cmd->frame->header.target_id < s->fw_luns) {
1542         sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1543                                 cmd->frame->header.lun_id);
1544     }
1545     cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);
1546     trace_megasas_handle_scsi(mfi_frame_desc[cmd->frame->header.frame_cmd],
1547                               is_logical, cmd->frame->header.target_id,
1548                               cmd->frame->header.lun_id, sdev, cmd->iov_size);
1549 
1550     if (!sdev || (megasas_is_jbod(s) && is_logical)) {
1551         trace_megasas_scsi_target_not_present(
1552             mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1553             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1554         return MFI_STAT_DEVICE_NOT_FOUND;
1555     }
1556 
1557     if (cmd->frame->header.cdb_len > 16) {
1558         trace_megasas_scsi_invalid_cdb_len(
1559                 mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1560                 cmd->frame->header.target_id, cmd->frame->header.lun_id,
1561                 cmd->frame->header.cdb_len);
1562         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1563         cmd->frame->header.scsi_status = CHECK_CONDITION;
1564         s->event_count++;
1565         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1566     }
1567 
1568     if (megasas_map_sgl(s, cmd, &cmd->frame->pass.sgl)) {
1569         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1570         cmd->frame->header.scsi_status = CHECK_CONDITION;
1571         s->event_count++;
1572         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1573     }
1574 
1575     cmd->req = scsi_req_new(sdev, cmd->index,
1576                             cmd->frame->header.lun_id, cdb, cmd);
1577     if (!cmd->req) {
1578         trace_megasas_scsi_req_alloc_failed(
1579                 mfi_frame_desc[cmd->frame->header.frame_cmd],
1580                 cmd->frame->header.target_id, cmd->frame->header.lun_id);
1581         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1582         cmd->frame->header.scsi_status = BUSY;
1583         s->event_count++;
1584         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1585     }
1586 
1587     is_write = (cmd->req->cmd.mode == SCSI_XFER_TO_DEV);
1588     len = megasas_enqueue_req(cmd, is_write);
1589     if (len > 0) {
1590         if (is_write) {
1591             trace_megasas_scsi_write_start(cmd->index, len);
1592         } else {
1593             trace_megasas_scsi_read_start(cmd->index, len);
1594         }
1595     } else {
1596         trace_megasas_scsi_nodata(cmd->index);
1597     }
1598     return MFI_STAT_INVALID_STATUS;
1599 }
1600 
1601 static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd)
1602 {
1603     uint32_t lba_count, lba_start_hi, lba_start_lo;
1604     uint64_t lba_start;
1605     bool is_write = (cmd->frame->header.frame_cmd == MFI_CMD_LD_WRITE);
1606     uint8_t cdb[16];
1607     int len;
1608     struct SCSIDevice *sdev = NULL;
1609 
1610     lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
1611     lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
1612     lba_start_hi = le32_to_cpu(cmd->frame->io.lba_hi);
1613     lba_start = ((uint64_t)lba_start_hi << 32) | lba_start_lo;
1614 
1615     if (cmd->frame->header.target_id < s->fw_luns) {
1616         sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1617                                 cmd->frame->header.lun_id);
1618     }
1619 
1620     trace_megasas_handle_io(cmd->index,
1621                             mfi_frame_desc[cmd->frame->header.frame_cmd],
1622                             cmd->frame->header.target_id,
1623                             cmd->frame->header.lun_id,
1624                             (unsigned long)lba_start, (unsigned long)lba_count);
1625     if (!sdev) {
1626         trace_megasas_io_target_not_present(cmd->index,
1627             mfi_frame_desc[cmd->frame->header.frame_cmd],
1628             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1629         return MFI_STAT_DEVICE_NOT_FOUND;
1630     }
1631 
1632     if (cmd->frame->header.cdb_len > 16) {
1633         trace_megasas_scsi_invalid_cdb_len(
1634             mfi_frame_desc[cmd->frame->header.frame_cmd], 1,
1635             cmd->frame->header.target_id, cmd->frame->header.lun_id,
1636             cmd->frame->header.cdb_len);
1637         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1638         cmd->frame->header.scsi_status = CHECK_CONDITION;
1639         s->event_count++;
1640         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1641     }
1642 
1643     cmd->iov_size = lba_count * sdev->blocksize;
1644     if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
1645         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1646         cmd->frame->header.scsi_status = CHECK_CONDITION;
1647         s->event_count++;
1648         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1649     }
1650 
1651     megasas_encode_lba(cdb, lba_start, lba_count, is_write);
1652     cmd->req = scsi_req_new(sdev, cmd->index,
1653                             cmd->frame->header.lun_id, cdb, cmd);
1654     if (!cmd->req) {
1655         trace_megasas_scsi_req_alloc_failed(
1656             mfi_frame_desc[cmd->frame->header.frame_cmd],
1657             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1658         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1659         cmd->frame->header.scsi_status = BUSY;
1660         s->event_count++;
1661         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1662     }
1663     len = megasas_enqueue_req(cmd, is_write);
1664     if (len > 0) {
1665         if (is_write) {
1666             trace_megasas_io_write_start(cmd->index, lba_start, lba_count, len);
1667         } else {
1668             trace_megasas_io_read_start(cmd->index, lba_start, lba_count, len);
1669         }
1670     }
1671     return MFI_STAT_INVALID_STATUS;
1672 }
1673 
1674 static int megasas_finish_internal_command(MegasasCmd *cmd,
1675                                            SCSIRequest *req, size_t resid)
1676 {
1677     int retval = MFI_STAT_INVALID_CMD;
1678 
1679     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1680         cmd->iov_size -= resid;
1681         retval = megasas_finish_internal_dcmd(cmd, req);
1682     }
1683     return retval;
1684 }
1685 
1686 static QEMUSGList *megasas_get_sg_list(SCSIRequest *req)
1687 {
1688     MegasasCmd *cmd = req->hba_private;
1689 
1690     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1691         return NULL;
1692     } else {
1693         return &cmd->qsg;
1694     }
1695 }
1696 
1697 static void megasas_xfer_complete(SCSIRequest *req, uint32_t len)
1698 {
1699     MegasasCmd *cmd = req->hba_private;
1700     uint8_t *buf;
1701     uint32_t opcode;
1702 
1703     trace_megasas_io_complete(cmd->index, len);
1704 
1705     if (cmd->frame->header.frame_cmd != MFI_CMD_DCMD) {
1706         scsi_req_continue(req);
1707         return;
1708     }
1709 
1710     buf = scsi_req_get_buf(req);
1711     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1712     if (opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) {
1713         struct mfi_pd_info *info = cmd->iov_buf;
1714 
1715         if (info->inquiry_data[0] == 0x7f) {
1716             memset(info->inquiry_data, 0, sizeof(info->inquiry_data));
1717             memcpy(info->inquiry_data, buf, len);
1718         } else if (info->vpd_page83[0] == 0x7f) {
1719             memset(info->vpd_page83, 0, sizeof(info->vpd_page83));
1720             memcpy(info->vpd_page83, buf, len);
1721         }
1722         scsi_req_continue(req);
1723     } else if (opcode == MFI_DCMD_LD_GET_INFO) {
1724         struct mfi_ld_info *info = cmd->iov_buf;
1725 
1726         if (cmd->iov_buf) {
1727             memcpy(info->vpd_page83, buf, sizeof(info->vpd_page83));
1728             scsi_req_continue(req);
1729         }
1730     }
1731 }
1732 
1733 static void megasas_command_complete(SCSIRequest *req, uint32_t status,
1734                                      size_t resid)
1735 {
1736     MegasasCmd *cmd = req->hba_private;
1737     uint8_t cmd_status = MFI_STAT_OK;
1738 
1739     trace_megasas_command_complete(cmd->index, status, resid);
1740 
1741     if (cmd->req != req) {
1742         /*
1743          * Internal command complete
1744          */
1745         cmd_status = megasas_finish_internal_command(cmd, req, resid);
1746         if (cmd_status == MFI_STAT_INVALID_STATUS) {
1747             return;
1748         }
1749     } else {
1750         req->status = status;
1751         trace_megasas_scsi_complete(cmd->index, req->status,
1752                                     cmd->iov_size, req->cmd.xfer);
1753         if (req->status != GOOD) {
1754             cmd_status = MFI_STAT_SCSI_DONE_WITH_ERROR;
1755         }
1756         if (req->status == CHECK_CONDITION) {
1757             megasas_copy_sense(cmd);
1758         }
1759 
1760         megasas_unmap_sgl(cmd);
1761         cmd->frame->header.scsi_status = req->status;
1762         scsi_req_unref(cmd->req);
1763         cmd->req = NULL;
1764     }
1765     cmd->frame->header.cmd_status = cmd_status;
1766     megasas_complete_frame(cmd->state, cmd->context);
1767 }
1768 
1769 static void megasas_command_cancel(SCSIRequest *req)
1770 {
1771     MegasasCmd *cmd = req->hba_private;
1772 
1773     if (cmd) {
1774         megasas_abort_command(cmd);
1775     } else {
1776         scsi_req_unref(req);
1777     }
1778 }
1779 
1780 static int megasas_handle_abort(MegasasState *s, MegasasCmd *cmd)
1781 {
1782     uint64_t abort_ctx = le64_to_cpu(cmd->frame->abort.abort_context);
1783     hwaddr abort_addr, addr_hi, addr_lo;
1784     MegasasCmd *abort_cmd;
1785 
1786     addr_hi = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_hi);
1787     addr_lo = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_lo);
1788     abort_addr = ((uint64_t)addr_hi << 32) | addr_lo;
1789 
1790     abort_cmd = megasas_lookup_frame(s, abort_addr);
1791     if (!abort_cmd) {
1792         trace_megasas_abort_no_cmd(cmd->index, abort_ctx);
1793         s->event_count++;
1794         return MFI_STAT_OK;
1795     }
1796     if (!megasas_use_queue64(s)) {
1797         abort_ctx &= (uint64_t)0xFFFFFFFF;
1798     }
1799     if (abort_cmd->context != abort_ctx) {
1800         trace_megasas_abort_invalid_context(cmd->index, abort_cmd->index,
1801                                             abort_cmd->context);
1802         s->event_count++;
1803         return MFI_STAT_ABORT_NOT_POSSIBLE;
1804     }
1805     trace_megasas_abort_frame(cmd->index, abort_cmd->index);
1806     megasas_abort_command(abort_cmd);
1807     if (!s->event_cmd || abort_cmd != s->event_cmd) {
1808         s->event_cmd = NULL;
1809     }
1810     s->event_count++;
1811     return MFI_STAT_OK;
1812 }
1813 
1814 static void megasas_handle_frame(MegasasState *s, uint64_t frame_addr,
1815                                  uint32_t frame_count)
1816 {
1817     uint8_t frame_status = MFI_STAT_INVALID_CMD;
1818     uint64_t frame_context;
1819     MegasasCmd *cmd;
1820 
1821     /*
1822      * Always read 64bit context, top bits will be
1823      * masked out if required in megasas_enqueue_frame()
1824      */
1825     frame_context = megasas_frame_get_context(frame_addr);
1826 
1827     cmd = megasas_enqueue_frame(s, frame_addr, frame_context, frame_count);
1828     if (!cmd) {
1829         /* reply queue full */
1830         trace_megasas_frame_busy(frame_addr);
1831         megasas_frame_set_scsi_status(frame_addr, BUSY);
1832         megasas_frame_set_cmd_status(frame_addr, MFI_STAT_SCSI_DONE_WITH_ERROR);
1833         megasas_complete_frame(s, frame_context);
1834         s->event_count++;
1835         return;
1836     }
1837     switch (cmd->frame->header.frame_cmd) {
1838     case MFI_CMD_INIT:
1839         frame_status = megasas_init_firmware(s, cmd);
1840         break;
1841     case MFI_CMD_DCMD:
1842         frame_status = megasas_handle_dcmd(s, cmd);
1843         break;
1844     case MFI_CMD_ABORT:
1845         frame_status = megasas_handle_abort(s, cmd);
1846         break;
1847     case MFI_CMD_PD_SCSI_IO:
1848         frame_status = megasas_handle_scsi(s, cmd, 0);
1849         break;
1850     case MFI_CMD_LD_SCSI_IO:
1851         frame_status = megasas_handle_scsi(s, cmd, 1);
1852         break;
1853     case MFI_CMD_LD_READ:
1854     case MFI_CMD_LD_WRITE:
1855         frame_status = megasas_handle_io(s, cmd);
1856         break;
1857     default:
1858         trace_megasas_unhandled_frame_cmd(cmd->index,
1859                                           cmd->frame->header.frame_cmd);
1860         s->event_count++;
1861         break;
1862     }
1863     if (frame_status != MFI_STAT_INVALID_STATUS) {
1864         if (cmd->frame) {
1865             cmd->frame->header.cmd_status = frame_status;
1866         } else {
1867             megasas_frame_set_cmd_status(frame_addr, frame_status);
1868         }
1869         megasas_complete_frame(s, cmd->context);
1870     }
1871 }
1872 
1873 static uint64_t megasas_mmio_read(void *opaque, hwaddr addr,
1874                                   unsigned size)
1875 {
1876     MegasasState *s = opaque;
1877     uint32_t retval = 0;
1878 
1879     switch (addr) {
1880     case MFI_IDB:
1881         retval = 0;
1882         break;
1883     case MFI_OMSG0:
1884     case MFI_OSP0:
1885         retval = (megasas_use_msix(s) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |
1886             (s->fw_state & MFI_FWSTATE_MASK) |
1887             ((s->fw_sge & 0xff) << 16) |
1888             (s->fw_cmds & 0xFFFF);
1889         break;
1890     case MFI_OSTS:
1891         if (megasas_intr_enabled(s) && s->doorbell) {
1892             retval = MFI_1078_RM | 1;
1893         }
1894         break;
1895     case MFI_OMSK:
1896         retval = s->intr_mask;
1897         break;
1898     case MFI_ODCR0:
1899         retval = s->doorbell;
1900         break;
1901     default:
1902         trace_megasas_mmio_invalid_readl(addr);
1903         break;
1904     }
1905     trace_megasas_mmio_readl(addr, retval);
1906     return retval;
1907 }
1908 
1909 static void megasas_mmio_write(void *opaque, hwaddr addr,
1910                                uint64_t val, unsigned size)
1911 {
1912     MegasasState *s = opaque;
1913     PCIDevice *pci_dev = PCI_DEVICE(s);
1914     uint64_t frame_addr;
1915     uint32_t frame_count;
1916     int i;
1917 
1918     trace_megasas_mmio_writel(addr, val);
1919     switch (addr) {
1920     case MFI_IDB:
1921         if (val & MFI_FWINIT_ABORT) {
1922             /* Abort all pending cmds */
1923             for (i = 0; i < s->fw_cmds; i++) {
1924                 megasas_abort_command(&s->frames[i]);
1925             }
1926         }
1927         if (val & MFI_FWINIT_READY) {
1928             /* move to FW READY */
1929             megasas_soft_reset(s);
1930         }
1931         if (val & MFI_FWINIT_MFIMODE) {
1932             /* discard MFIs */
1933         }
1934         break;
1935     case MFI_OMSK:
1936         s->intr_mask = val;
1937         if (!megasas_intr_enabled(s) && !msix_enabled(pci_dev)) {
1938             trace_megasas_irq_lower();
1939             qemu_irq_lower(pci_dev->irq[0]);
1940         }
1941         if (megasas_intr_enabled(s)) {
1942             trace_megasas_intr_enabled();
1943         } else {
1944             trace_megasas_intr_disabled();
1945         }
1946         break;
1947     case MFI_ODCR0:
1948         s->doorbell = 0;
1949         if (s->producer_pa && megasas_intr_enabled(s)) {
1950             /* Update reply queue pointer */
1951             trace_megasas_qf_update(s->reply_queue_head, s->busy);
1952             stl_le_phys(s->producer_pa, s->reply_queue_head);
1953             if (!msix_enabled(pci_dev)) {
1954                 trace_megasas_irq_lower();
1955                 qemu_irq_lower(pci_dev->irq[0]);
1956             }
1957         }
1958         break;
1959     case MFI_IQPH:
1960         /* Received high 32 bits of a 64 bit MFI frame address */
1961         s->frame_hi = val;
1962         break;
1963     case MFI_IQPL:
1964         /* Received low 32 bits of a 64 bit MFI frame address */
1965     case MFI_IQP:
1966         /* Received 32 bit MFI frame address */
1967         frame_addr = (val & ~0x1F);
1968         /* Add possible 64 bit offset */
1969         frame_addr |= ((uint64_t)s->frame_hi << 32);
1970         s->frame_hi = 0;
1971         frame_count = (val >> 1) & 0xF;
1972         megasas_handle_frame(s, frame_addr, frame_count);
1973         break;
1974     default:
1975         trace_megasas_mmio_invalid_writel(addr, val);
1976         break;
1977     }
1978 }
1979 
1980 static const MemoryRegionOps megasas_mmio_ops = {
1981     .read = megasas_mmio_read,
1982     .write = megasas_mmio_write,
1983     .endianness = DEVICE_LITTLE_ENDIAN,
1984     .impl = {
1985         .min_access_size = 8,
1986         .max_access_size = 8,
1987     }
1988 };
1989 
1990 static uint64_t megasas_port_read(void *opaque, hwaddr addr,
1991                                   unsigned size)
1992 {
1993     return megasas_mmio_read(opaque, addr & 0xff, size);
1994 }
1995 
1996 static void megasas_port_write(void *opaque, hwaddr addr,
1997                                uint64_t val, unsigned size)
1998 {
1999     megasas_mmio_write(opaque, addr & 0xff, val, size);
2000 }
2001 
2002 static const MemoryRegionOps megasas_port_ops = {
2003     .read = megasas_port_read,
2004     .write = megasas_port_write,
2005     .endianness = DEVICE_LITTLE_ENDIAN,
2006     .impl = {
2007         .min_access_size = 4,
2008         .max_access_size = 4,
2009     }
2010 };
2011 
2012 static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
2013                                    unsigned size)
2014 {
2015     return 0;
2016 }
2017 
2018 static const MemoryRegionOps megasas_queue_ops = {
2019     .read = megasas_queue_read,
2020     .endianness = DEVICE_LITTLE_ENDIAN,
2021     .impl = {
2022         .min_access_size = 8,
2023         .max_access_size = 8,
2024     }
2025 };
2026 
2027 static void megasas_soft_reset(MegasasState *s)
2028 {
2029     int i;
2030     MegasasCmd *cmd;
2031 
2032     trace_megasas_reset();
2033     for (i = 0; i < s->fw_cmds; i++) {
2034         cmd = &s->frames[i];
2035         megasas_abort_command(cmd);
2036     }
2037     megasas_reset_frames(s);
2038     s->reply_queue_len = s->fw_cmds;
2039     s->reply_queue_pa = 0;
2040     s->consumer_pa = 0;
2041     s->producer_pa = 0;
2042     s->fw_state = MFI_FWSTATE_READY;
2043     s->doorbell = 0;
2044     s->intr_mask = MEGASAS_INTR_DISABLED_MASK;
2045     s->frame_hi = 0;
2046     s->flags &= ~MEGASAS_MASK_USE_QUEUE64;
2047     s->event_count++;
2048     s->boot_event = s->event_count;
2049 }
2050 
2051 static void megasas_scsi_reset(DeviceState *dev)
2052 {
2053     MegasasState *s = MEGASAS(dev);
2054 
2055     megasas_soft_reset(s);
2056 }
2057 
2058 static const VMStateDescription vmstate_megasas = {
2059     .name = "megasas",
2060     .version_id = 0,
2061     .minimum_version_id = 0,
2062     .minimum_version_id_old = 0,
2063     .fields      = (VMStateField[]) {
2064         VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2065 
2066         VMSTATE_INT32(fw_state, MegasasState),
2067         VMSTATE_INT32(intr_mask, MegasasState),
2068         VMSTATE_INT32(doorbell, MegasasState),
2069         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2070         VMSTATE_UINT64(consumer_pa, MegasasState),
2071         VMSTATE_UINT64(producer_pa, MegasasState),
2072         VMSTATE_END_OF_LIST()
2073     }
2074 };
2075 
2076 static void megasas_scsi_uninit(PCIDevice *d)
2077 {
2078     MegasasState *s = MEGASAS(d);
2079 
2080 #ifdef USE_MSIX
2081     msix_uninit(d, &s->mmio_io);
2082 #endif
2083     memory_region_destroy(&s->mmio_io);
2084     memory_region_destroy(&s->port_io);
2085     memory_region_destroy(&s->queue_io);
2086 }
2087 
2088 static const struct SCSIBusInfo megasas_scsi_info = {
2089     .tcq = true,
2090     .max_target = MFI_MAX_LD,
2091     .max_lun = 255,
2092 
2093     .transfer_data = megasas_xfer_complete,
2094     .get_sg_list = megasas_get_sg_list,
2095     .complete = megasas_command_complete,
2096     .cancel = megasas_command_cancel,
2097 };
2098 
2099 static int megasas_scsi_init(PCIDevice *dev)
2100 {
2101     DeviceState *d = DEVICE(dev);
2102     MegasasState *s = MEGASAS(dev);
2103     uint8_t *pci_conf;
2104     int i, bar_type;
2105     Error *err = NULL;
2106 
2107     pci_conf = dev->config;
2108 
2109     /* PCI latency timer = 0 */
2110     pci_conf[PCI_LATENCY_TIMER] = 0;
2111     /* Interrupt pin 1 */
2112     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2113 
2114     memory_region_init_io(&s->mmio_io, OBJECT(s), &megasas_mmio_ops, s,
2115                           "megasas-mmio", 0x4000);
2116     memory_region_init_io(&s->port_io, OBJECT(s), &megasas_port_ops, s,
2117                           "megasas-io", 256);
2118     memory_region_init_io(&s->queue_io, OBJECT(s), &megasas_queue_ops, s,
2119                           "megasas-queue", 0x40000);
2120 
2121 #ifdef USE_MSIX
2122     /* MSI-X support is currently broken */
2123     if (megasas_use_msix(s) &&
2124         msix_init(dev, 15, &s->mmio_io, 0, 0x2000)) {
2125         s->flags &= ~MEGASAS_MASK_USE_MSIX;
2126     }
2127 #else
2128     s->flags &= ~MEGASAS_MASK_USE_MSIX;
2129 #endif
2130 
2131     bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
2132     pci_register_bar(dev, 0, bar_type, &s->mmio_io);
2133     pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
2134     pci_register_bar(dev, 3, bar_type, &s->queue_io);
2135 
2136     if (megasas_use_msix(s)) {
2137         msix_vector_use(dev, 0);
2138     }
2139 
2140     if (!s->sas_addr) {
2141         s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
2142                        IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
2143         s->sas_addr |= (pci_bus_num(dev->bus) << 16);
2144         s->sas_addr |= (PCI_SLOT(dev->devfn) << 8);
2145         s->sas_addr |= PCI_FUNC(dev->devfn);
2146     }
2147     if (!s->hba_serial) {
2148 	s->hba_serial = g_strdup(MEGASAS_HBA_SERIAL);
2149     }
2150     if (s->fw_sge >= MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE) {
2151         s->fw_sge = MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE;
2152     } else if (s->fw_sge >= 128 - MFI_PASS_FRAME_SIZE) {
2153         s->fw_sge = 128 - MFI_PASS_FRAME_SIZE;
2154     } else {
2155         s->fw_sge = 64 - MFI_PASS_FRAME_SIZE;
2156     }
2157     if (s->fw_cmds > MEGASAS_MAX_FRAMES) {
2158         s->fw_cmds = MEGASAS_MAX_FRAMES;
2159     }
2160     trace_megasas_init(s->fw_sge, s->fw_cmds,
2161                        megasas_use_msix(s) ? "MSI-X" : "INTx",
2162                        megasas_is_jbod(s) ? "jbod" : "raid");
2163     s->fw_luns = (MFI_MAX_LD > MAX_SCSI_DEVS) ?
2164         MAX_SCSI_DEVS : MFI_MAX_LD;
2165     s->producer_pa = 0;
2166     s->consumer_pa = 0;
2167     for (i = 0; i < s->fw_cmds; i++) {
2168         s->frames[i].index = i;
2169         s->frames[i].context = -1;
2170         s->frames[i].pa = 0;
2171         s->frames[i].state = s;
2172     }
2173 
2174     scsi_bus_new(&s->bus, DEVICE(dev), &megasas_scsi_info, NULL);
2175     if (!d->hotplugged) {
2176         scsi_bus_legacy_handle_cmdline(&s->bus, &err);
2177         if (err != NULL) {
2178             error_free(err);
2179             return -1;
2180         }
2181     }
2182     return 0;
2183 }
2184 
2185 static Property megasas_properties[] = {
2186     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2187                        MEGASAS_DEFAULT_SGE),
2188     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2189                        MEGASAS_DEFAULT_FRAMES),
2190     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2191     DEFINE_PROP_HEX64("sas_address", MegasasState, sas_addr, 0),
2192 #ifdef USE_MSIX
2193     DEFINE_PROP_BIT("use_msix", MegasasState, flags,
2194                     MEGASAS_FLAG_USE_MSIX, false),
2195 #endif
2196     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2197                     MEGASAS_FLAG_USE_JBOD, false),
2198     DEFINE_PROP_END_OF_LIST(),
2199 };
2200 
2201 static void megasas_class_init(ObjectClass *oc, void *data)
2202 {
2203     DeviceClass *dc = DEVICE_CLASS(oc);
2204     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
2205 
2206     pc->init = megasas_scsi_init;
2207     pc->exit = megasas_scsi_uninit;
2208     pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2209     pc->device_id = PCI_DEVICE_ID_LSI_SAS1078;
2210     pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2211     pc->subsystem_id = 0x1013;
2212     pc->class_id = PCI_CLASS_STORAGE_RAID;
2213     dc->props = megasas_properties;
2214     dc->reset = megasas_scsi_reset;
2215     dc->vmsd = &vmstate_megasas;
2216     dc->desc = "LSI MegaRAID SAS 1078";
2217 }
2218 
2219 static const TypeInfo megasas_info = {
2220     .name  = TYPE_MEGASAS,
2221     .parent = TYPE_PCI_DEVICE,
2222     .instance_size = sizeof(MegasasState),
2223     .class_init = megasas_class_init,
2224 };
2225 
2226 static void megasas_register_types(void)
2227 {
2228     type_register_static(&megasas_info);
2229 }
2230 
2231 type_init(megasas_register_types)
2232