xref: /openbmc/qemu/hw/scsi/megasas.c (revision 795c40b8) 
1 /*
2  * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation
3  * Based on the linux driver code at drivers/scsi/megaraid
4  *
5  * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
6  *
7  * This library is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2 of the License, or (at your option) any later version.
11  *
12  * This library is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "qemu/osdep.h"
22 #include "hw/hw.h"
23 #include "hw/pci/pci.h"
24 #include "sysemu/dma.h"
25 #include "sysemu/block-backend.h"
26 #include "hw/pci/msi.h"
27 #include "hw/pci/msix.h"
28 #include "qemu/iov.h"
29 #include "hw/scsi/scsi.h"
30 #include "block/scsi.h"
31 #include "trace.h"
32 #include "qapi/error.h"
33 #include "mfi.h"
34 
35 #define MEGASAS_VERSION_GEN1 "1.70"
36 #define MEGASAS_VERSION_GEN2 "1.80"
37 #define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */
38 #define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */
39 #define MEGASAS_GEN2_DEFAULT_FRAMES 1008     /* Windows requires this */
40 #define MEGASAS_MAX_SGE 128             /* Firmware limit */
41 #define MEGASAS_DEFAULT_SGE 80
42 #define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */
43 #define MEGASAS_MAX_ARRAYS 128
44 
45 #define MEGASAS_HBA_SERIAL "QEMU123456"
46 #define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
47 #define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
48 
49 #define MEGASAS_FLAG_USE_JBOD      0
50 #define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)
51 #define MEGASAS_FLAG_USE_QUEUE64   1
52 #define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)
53 
54 static const char *mfi_frame_desc[] = {
55     "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",
56     "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"};
57 
58 typedef struct MegasasCmd {
59     uint32_t index;
60     uint16_t flags;
61     uint16_t count;
62     uint64_t context;
63 
64     hwaddr pa;
65     hwaddr pa_size;
66     union mfi_frame *frame;
67     SCSIRequest *req;
68     QEMUSGList qsg;
69     void *iov_buf;
70     size_t iov_size;
71     size_t iov_offset;
72     struct MegasasState *state;
73 } MegasasCmd;
74 
75 typedef struct MegasasState {
76     /*< private >*/
77     PCIDevice parent_obj;
78     /*< public >*/
79 
80     MemoryRegion mmio_io;
81     MemoryRegion port_io;
82     MemoryRegion queue_io;
83     uint32_t frame_hi;
84 
85     int fw_state;
86     uint32_t fw_sge;
87     uint32_t fw_cmds;
88     uint32_t flags;
89     int fw_luns;
90     int intr_mask;
91     int doorbell;
92     int busy;
93     int diag;
94     int adp_reset;
95     OnOffAuto msi;
96     OnOffAuto msix;
97 
98     MegasasCmd *event_cmd;
99     int event_locale;
100     int event_class;
101     int event_count;
102     int shutdown_event;
103     int boot_event;
104 
105     uint64_t sas_addr;
106     char *hba_serial;
107 
108     uint64_t reply_queue_pa;
109     void *reply_queue;
110     int reply_queue_len;
111     int reply_queue_head;
112     int reply_queue_tail;
113     uint64_t consumer_pa;
114     uint64_t producer_pa;
115 
116     MegasasCmd frames[MEGASAS_MAX_FRAMES];
117     DECLARE_BITMAP(frame_map, MEGASAS_MAX_FRAMES);
118     SCSIBus bus;
119 } MegasasState;
120 
121 typedef struct MegasasBaseClass {
122     PCIDeviceClass parent_class;
123     const char *product_name;
124     const char *product_version;
125     int mmio_bar;
126     int ioport_bar;
127     int osts;
128 } MegasasBaseClass;
129 
130 #define TYPE_MEGASAS_BASE "megasas-base"
131 #define TYPE_MEGASAS_GEN1 "megasas"
132 #define TYPE_MEGASAS_GEN2 "megasas-gen2"
133 
134 #define MEGASAS(obj) \
135     OBJECT_CHECK(MegasasState, (obj), TYPE_MEGASAS_BASE)
136 
137 #define MEGASAS_DEVICE_CLASS(oc) \
138     OBJECT_CLASS_CHECK(MegasasBaseClass, (oc), TYPE_MEGASAS_BASE)
139 #define MEGASAS_DEVICE_GET_CLASS(oc) \
140     OBJECT_GET_CLASS(MegasasBaseClass, (oc), TYPE_MEGASAS_BASE)
141 
142 #define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
143 
144 static bool megasas_intr_enabled(MegasasState *s)
145 {
146     if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=
147         MEGASAS_INTR_DISABLED_MASK) {
148         return true;
149     }
150     return false;
151 }
152 
153 static bool megasas_use_queue64(MegasasState *s)
154 {
155     return s->flags & MEGASAS_MASK_USE_QUEUE64;
156 }
157 
158 static bool megasas_use_msix(MegasasState *s)
159 {
160     return s->msix != ON_OFF_AUTO_OFF;
161 }
162 
163 static bool megasas_is_jbod(MegasasState *s)
164 {
165     return s->flags & MEGASAS_MASK_USE_JBOD;
166 }
167 
168 static void megasas_frame_set_cmd_status(MegasasState *s,
169                                          unsigned long frame, uint8_t v)
170 {
171     PCIDevice *pci = &s->parent_obj;
172     stb_pci_dma(pci, frame + offsetof(struct mfi_frame_header, cmd_status), v);
173 }
174 
175 static void megasas_frame_set_scsi_status(MegasasState *s,
176                                           unsigned long frame, uint8_t v)
177 {
178     PCIDevice *pci = &s->parent_obj;
179     stb_pci_dma(pci, frame + offsetof(struct mfi_frame_header, scsi_status), v);
180 }
181 
182 /*
183  * Context is considered opaque, but the HBA firmware is running
184  * in little endian mode. So convert it to little endian, too.
185  */
186 static uint64_t megasas_frame_get_context(MegasasState *s,
187                                           unsigned long frame)
188 {
189     PCIDevice *pci = &s->parent_obj;
190     return ldq_le_pci_dma(pci, frame + offsetof(struct mfi_frame_header, context));
191 }
192 
193 static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)
194 {
195     return cmd->flags & MFI_FRAME_IEEE_SGL;
196 }
197 
198 static bool megasas_frame_is_sgl64(MegasasCmd *cmd)
199 {
200     return cmd->flags & MFI_FRAME_SGL64;
201 }
202 
203 static bool megasas_frame_is_sense64(MegasasCmd *cmd)
204 {
205     return cmd->flags & MFI_FRAME_SENSE64;
206 }
207 
208 static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,
209                                      union mfi_sgl *sgl)
210 {
211     uint64_t addr;
212 
213     if (megasas_frame_is_ieee_sgl(cmd)) {
214         addr = le64_to_cpu(sgl->sg_skinny->addr);
215     } else if (megasas_frame_is_sgl64(cmd)) {
216         addr = le64_to_cpu(sgl->sg64->addr);
217     } else {
218         addr = le32_to_cpu(sgl->sg32->addr);
219     }
220     return addr;
221 }
222 
223 static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,
224                                     union mfi_sgl *sgl)
225 {
226     uint32_t len;
227 
228     if (megasas_frame_is_ieee_sgl(cmd)) {
229         len = le32_to_cpu(sgl->sg_skinny->len);
230     } else if (megasas_frame_is_sgl64(cmd)) {
231         len = le32_to_cpu(sgl->sg64->len);
232     } else {
233         len = le32_to_cpu(sgl->sg32->len);
234     }
235     return len;
236 }
237 
238 static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,
239                                        union mfi_sgl *sgl)
240 {
241     uint8_t *next = (uint8_t *)sgl;
242 
243     if (megasas_frame_is_ieee_sgl(cmd)) {
244         next += sizeof(struct mfi_sg_skinny);
245     } else if (megasas_frame_is_sgl64(cmd)) {
246         next += sizeof(struct mfi_sg64);
247     } else {
248         next += sizeof(struct mfi_sg32);
249     }
250 
251     if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {
252         return NULL;
253     }
254     return (union mfi_sgl *)next;
255 }
256 
257 static void megasas_soft_reset(MegasasState *s);
258 
259 static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
260 {
261     int i;
262     int iov_count = 0;
263     size_t iov_size = 0;
264 
265     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
266     iov_count = cmd->frame->header.sge_count;
267     if (iov_count > MEGASAS_MAX_SGE) {
268         trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,
269                                          MEGASAS_MAX_SGE);
270         return iov_count;
271     }
272     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), iov_count);
273     for (i = 0; i < iov_count; i++) {
274         dma_addr_t iov_pa, iov_size_p;
275 
276         if (!sgl) {
277             trace_megasas_iovec_sgl_underflow(cmd->index, i);
278             goto unmap;
279         }
280         iov_pa = megasas_sgl_get_addr(cmd, sgl);
281         iov_size_p = megasas_sgl_get_len(cmd, sgl);
282         if (!iov_pa || !iov_size_p) {
283             trace_megasas_iovec_sgl_invalid(cmd->index, i,
284                                             iov_pa, iov_size_p);
285             goto unmap;
286         }
287         qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);
288         sgl = megasas_sgl_next(cmd, sgl);
289         iov_size += (size_t)iov_size_p;
290     }
291     if (cmd->iov_size > iov_size) {
292         trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
293     } else if (cmd->iov_size < iov_size) {
294         trace_megasas_iovec_underflow(cmd->index, iov_size, cmd->iov_size);
295     }
296     cmd->iov_offset = 0;
297     return 0;
298 unmap:
299     qemu_sglist_destroy(&cmd->qsg);
300     return iov_count - i;
301 }
302 
303 /*
304  * passthrough sense and io sense are at the same offset
305  */
306 static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,
307     uint8_t sense_len)
308 {
309     PCIDevice *pcid = PCI_DEVICE(cmd->state);
310     uint32_t pa_hi = 0, pa_lo;
311     hwaddr pa;
312 
313     if (sense_len > cmd->frame->header.sense_len) {
314         sense_len = cmd->frame->header.sense_len;
315     }
316     if (sense_len) {
317         pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);
318         if (megasas_frame_is_sense64(cmd)) {
319             pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);
320         }
321         pa = ((uint64_t) pa_hi << 32) | pa_lo;
322         pci_dma_write(pcid, pa, sense_ptr, sense_len);
323         cmd->frame->header.sense_len = sense_len;
324     }
325     return sense_len;
326 }
327 
328 static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)
329 {
330     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
331     uint8_t sense_len = 18;
332 
333     memset(sense_buf, 0, sense_len);
334     sense_buf[0] = 0xf0;
335     sense_buf[2] = sense.key;
336     sense_buf[7] = 10;
337     sense_buf[12] = sense.asc;
338     sense_buf[13] = sense.ascq;
339     megasas_build_sense(cmd, sense_buf, sense_len);
340 }
341 
342 static void megasas_copy_sense(MegasasCmd *cmd)
343 {
344     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
345     uint8_t sense_len;
346 
347     sense_len = scsi_req_get_sense(cmd->req, sense_buf,
348                                    SCSI_SENSE_BUF_SIZE);
349     megasas_build_sense(cmd, sense_buf, sense_len);
350 }
351 
352 /*
353  * Format an INQUIRY CDB
354  */
355 static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)
356 {
357     memset(cdb, 0, 6);
358     cdb[0] = INQUIRY;
359     if (pg > 0) {
360         cdb[1] = 0x1;
361         cdb[2] = pg;
362     }
363     cdb[3] = (len >> 8) & 0xff;
364     cdb[4] = (len & 0xff);
365     return len;
366 }
367 
368 /*
369  * Encode lba and len into a READ_16/WRITE_16 CDB
370  */
371 static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,
372                                uint32_t len, bool is_write)
373 {
374     memset(cdb, 0x0, 16);
375     if (is_write) {
376         cdb[0] = WRITE_16;
377     } else {
378         cdb[0] = READ_16;
379     }
380     cdb[2] = (lba >> 56) & 0xff;
381     cdb[3] = (lba >> 48) & 0xff;
382     cdb[4] = (lba >> 40) & 0xff;
383     cdb[5] = (lba >> 32) & 0xff;
384     cdb[6] = (lba >> 24) & 0xff;
385     cdb[7] = (lba >> 16) & 0xff;
386     cdb[8] = (lba >> 8) & 0xff;
387     cdb[9] = (lba) & 0xff;
388     cdb[10] = (len >> 24) & 0xff;
389     cdb[11] = (len >> 16) & 0xff;
390     cdb[12] = (len >> 8) & 0xff;
391     cdb[13] = (len) & 0xff;
392 }
393 
394 /*
395  * Utility functions
396  */
397 static uint64_t megasas_fw_time(void)
398 {
399     struct tm curtime;
400 
401     qemu_get_timedate(&curtime, 0);
402     return ((uint64_t)curtime.tm_sec & 0xff) << 48 |
403         ((uint64_t)curtime.tm_min & 0xff)  << 40 |
404         ((uint64_t)curtime.tm_hour & 0xff) << 32 |
405         ((uint64_t)curtime.tm_mday & 0xff) << 24 |
406         ((uint64_t)curtime.tm_mon & 0xff)  << 16 |
407         ((uint64_t)(curtime.tm_year + 1900) & 0xffff);
408 }
409 
410 /*
411  * Default disk sata address
412  * 0x1221 is the magic number as
413  * present in real hardware,
414  * so use it here, too.
415  */
416 static uint64_t megasas_get_sata_addr(uint16_t id)
417 {
418     uint64_t addr = (0x1221ULL << 48);
419     return addr | ((uint64_t)id << 24);
420 }
421 
422 /*
423  * Frame handling
424  */
425 static int megasas_next_index(MegasasState *s, int index, int limit)
426 {
427     index++;
428     if (index == limit) {
429         index = 0;
430     }
431     return index;
432 }
433 
434 static MegasasCmd *megasas_lookup_frame(MegasasState *s,
435     hwaddr frame)
436 {
437     MegasasCmd *cmd = NULL;
438     int num = 0, index;
439 
440     index = s->reply_queue_head;
441 
442     while (num < s->fw_cmds) {
443         if (s->frames[index].pa && s->frames[index].pa == frame) {
444             cmd = &s->frames[index];
445             break;
446         }
447         index = megasas_next_index(s, index, s->fw_cmds);
448         num++;
449     }
450 
451     return cmd;
452 }
453 
454 static void megasas_unmap_frame(MegasasState *s, MegasasCmd *cmd)
455 {
456     PCIDevice *p = PCI_DEVICE(s);
457 
458     if (cmd->pa_size) {
459         pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0);
460     }
461     cmd->frame = NULL;
462     cmd->pa = 0;
463     cmd->pa_size = 0;
464     clear_bit(cmd->index, s->frame_map);
465 }
466 
467 /*
468  * This absolutely needs to be locked if
469  * qemu ever goes multithreaded.
470  */
471 static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
472     hwaddr frame, uint64_t context, int count)
473 {
474     PCIDevice *pcid = PCI_DEVICE(s);
475     MegasasCmd *cmd = NULL;
476     int frame_size = MFI_FRAME_SIZE * 16;
477     hwaddr frame_size_p = frame_size;
478     unsigned long index;
479 
480     index = 0;
481     while (index < s->fw_cmds) {
482         index = find_next_zero_bit(s->frame_map, s->fw_cmds, index);
483         if (!s->frames[index].pa)
484             break;
485         /* Busy frame found */
486         trace_megasas_qf_mapped(index);
487     }
488     if (index >= s->fw_cmds) {
489         /* All frames busy */
490         trace_megasas_qf_busy(frame);
491         return NULL;
492     }
493     cmd = &s->frames[index];
494     set_bit(index, s->frame_map);
495     trace_megasas_qf_new(index, frame);
496 
497     cmd->pa = frame;
498     /* Map all possible frames */
499     cmd->frame = pci_dma_map(pcid, frame, &frame_size_p, 0);
500     if (frame_size_p != frame_size) {
501         trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
502         if (cmd->frame) {
503             megasas_unmap_frame(s, cmd);
504         }
505         s->event_count++;
506         return NULL;
507     }
508     cmd->pa_size = frame_size_p;
509     cmd->context = context;
510     if (!megasas_use_queue64(s)) {
511         cmd->context &= (uint64_t)0xFFFFFFFF;
512     }
513     cmd->count = count;
514     s->busy++;
515 
516     if (s->consumer_pa) {
517         s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa);
518     }
519     trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,
520                              s->reply_queue_head, s->reply_queue_tail, s->busy);
521 
522     return cmd;
523 }
524 
525 static void megasas_complete_frame(MegasasState *s, uint64_t context)
526 {
527     PCIDevice *pci_dev = PCI_DEVICE(s);
528     int tail, queue_offset;
529 
530     /* Decrement busy count */
531     s->busy--;
532     if (s->reply_queue_pa) {
533         /*
534          * Put command on the reply queue.
535          * Context is opaque, but emulation is running in
536          * little endian. So convert it.
537          */
538         if (megasas_use_queue64(s)) {
539             queue_offset = s->reply_queue_head * sizeof(uint64_t);
540             stq_le_pci_dma(pci_dev, s->reply_queue_pa + queue_offset, context);
541         } else {
542             queue_offset = s->reply_queue_head * sizeof(uint32_t);
543             stl_le_pci_dma(pci_dev, s->reply_queue_pa + queue_offset, context);
544         }
545         s->reply_queue_tail = ldl_le_pci_dma(pci_dev, s->consumer_pa);
546         trace_megasas_qf_complete(context, s->reply_queue_head,
547                                   s->reply_queue_tail, s->busy);
548     }
549 
550     if (megasas_intr_enabled(s)) {
551         /* Update reply queue pointer */
552         s->reply_queue_tail = ldl_le_pci_dma(pci_dev, s->consumer_pa);
553         tail = s->reply_queue_head;
554         s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
555         trace_megasas_qf_update(s->reply_queue_head, s->reply_queue_tail,
556                                 s->busy);
557         stl_le_pci_dma(pci_dev, s->producer_pa, s->reply_queue_head);
558         /* Notify HBA */
559         if (msix_enabled(pci_dev)) {
560             trace_megasas_msix_raise(0);
561             msix_notify(pci_dev, 0);
562         } else if (msi_enabled(pci_dev)) {
563             trace_megasas_msi_raise(0);
564             msi_notify(pci_dev, 0);
565         } else {
566             s->doorbell++;
567             if (s->doorbell == 1) {
568                 trace_megasas_irq_raise();
569                 pci_irq_assert(pci_dev);
570             }
571         }
572     } else {
573         trace_megasas_qf_complete_noirq(context);
574     }
575 }
576 
577 static void megasas_complete_command(MegasasCmd *cmd)
578 {
579     qemu_sglist_destroy(&cmd->qsg);
580     cmd->iov_size = 0;
581     cmd->iov_offset = 0;
582 
583     cmd->req->hba_private = NULL;
584     scsi_req_unref(cmd->req);
585     cmd->req = NULL;
586 
587     megasas_unmap_frame(cmd->state, cmd);
588     megasas_complete_frame(cmd->state, cmd->context);
589 }
590 
591 static void megasas_reset_frames(MegasasState *s)
592 {
593     int i;
594     MegasasCmd *cmd;
595 
596     for (i = 0; i < s->fw_cmds; i++) {
597         cmd = &s->frames[i];
598         if (cmd->pa) {
599             megasas_unmap_frame(s, cmd);
600         }
601     }
602     bitmap_zero(s->frame_map, MEGASAS_MAX_FRAMES);
603 }
604 
605 static void megasas_abort_command(MegasasCmd *cmd)
606 {
607     /* Never abort internal commands.  */
608     if (cmd->req != NULL) {
609         scsi_req_cancel(cmd->req);
610     }
611 }
612 
613 static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
614 {
615     PCIDevice *pcid = PCI_DEVICE(s);
616     uint32_t pa_hi, pa_lo;
617     hwaddr iq_pa, initq_size = sizeof(struct mfi_init_qinfo);
618     struct mfi_init_qinfo *initq = NULL;
619     uint32_t flags;
620     int ret = MFI_STAT_OK;
621 
622     if (s->reply_queue_pa) {
623         trace_megasas_initq_mapped(s->reply_queue_pa);
624         goto out;
625     }
626     pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);
627     pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);
628     iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);
629     trace_megasas_init_firmware((uint64_t)iq_pa);
630     initq = pci_dma_map(pcid, iq_pa, &initq_size, 0);
631     if (!initq || initq_size != sizeof(*initq)) {
632         trace_megasas_initq_map_failed(cmd->index);
633         s->event_count++;
634         ret = MFI_STAT_MEMORY_NOT_AVAILABLE;
635         goto out;
636     }
637     s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;
638     if (s->reply_queue_len > s->fw_cmds) {
639         trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);
640         s->event_count++;
641         ret = MFI_STAT_INVALID_PARAMETER;
642         goto out;
643     }
644     pa_lo = le32_to_cpu(initq->rq_addr_lo);
645     pa_hi = le32_to_cpu(initq->rq_addr_hi);
646     s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;
647     pa_lo = le32_to_cpu(initq->ci_addr_lo);
648     pa_hi = le32_to_cpu(initq->ci_addr_hi);
649     s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
650     pa_lo = le32_to_cpu(initq->pi_addr_lo);
651     pa_hi = le32_to_cpu(initq->pi_addr_hi);
652     s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
653     s->reply_queue_head = ldl_le_pci_dma(pcid, s->producer_pa);
654     s->reply_queue_head %= MEGASAS_MAX_FRAMES;
655     s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa);
656     s->reply_queue_tail %= MEGASAS_MAX_FRAMES;
657     flags = le32_to_cpu(initq->flags);
658     if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
659         s->flags |= MEGASAS_MASK_USE_QUEUE64;
660     }
661     trace_megasas_init_queue((unsigned long)s->reply_queue_pa,
662                              s->reply_queue_len, s->reply_queue_head,
663                              s->reply_queue_tail, flags);
664     megasas_reset_frames(s);
665     s->fw_state = MFI_FWSTATE_OPERATIONAL;
666 out:
667     if (initq) {
668         pci_dma_unmap(pcid, initq, initq_size, 0, 0);
669     }
670     return ret;
671 }
672 
673 static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
674 {
675     dma_addr_t iov_pa, iov_size;
676 
677     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
678     if (!cmd->frame->header.sge_count) {
679         trace_megasas_dcmd_zero_sge(cmd->index);
680         cmd->iov_size = 0;
681         return 0;
682     } else if (cmd->frame->header.sge_count > 1) {
683         trace_megasas_dcmd_invalid_sge(cmd->index,
684                                        cmd->frame->header.sge_count);
685         cmd->iov_size = 0;
686         return -EINVAL;
687     }
688     iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
689     iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
690     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), 1);
691     qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
692     cmd->iov_size = iov_size;
693     return 0;
694 }
695 
696 static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
697 {
698     trace_megasas_finish_dcmd(cmd->index, iov_size);
699 
700     if (iov_size > cmd->iov_size) {
701         if (megasas_frame_is_ieee_sgl(cmd)) {
702             cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);
703         } else if (megasas_frame_is_sgl64(cmd)) {
704             cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);
705         } else {
706             cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);
707         }
708     }
709 }
710 
711 static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
712 {
713     PCIDevice *pci_dev = PCI_DEVICE(s);
714     PCIDeviceClass *pci_class = PCI_DEVICE_GET_CLASS(pci_dev);
715     MegasasBaseClass *base_class = MEGASAS_DEVICE_GET_CLASS(s);
716     struct mfi_ctrl_info info;
717     size_t dcmd_size = sizeof(info);
718     BusChild *kid;
719     int num_pd_disks = 0;
720 
721     memset(&info, 0x0, dcmd_size);
722     if (cmd->iov_size < dcmd_size) {
723         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
724                                             dcmd_size);
725         return MFI_STAT_INVALID_PARAMETER;
726     }
727 
728     info.pci.vendor = cpu_to_le16(pci_class->vendor_id);
729     info.pci.device = cpu_to_le16(pci_class->device_id);
730     info.pci.subvendor = cpu_to_le16(pci_class->subsystem_vendor_id);
731     info.pci.subdevice = cpu_to_le16(pci_class->subsystem_id);
732 
733     /*
734      * For some reason the firmware supports
735      * only up to 8 device ports.
736      * Despite supporting a far larger number
737      * of devices for the physical devices.
738      * So just display the first 8 devices
739      * in the device port list, independent
740      * of how many logical devices are actually
741      * present.
742      */
743     info.host.type = MFI_INFO_HOST_PCIE;
744     info.device.type = MFI_INFO_DEV_SAS3G;
745     info.device.port_count = 8;
746     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
747         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
748         uint16_t pd_id;
749 
750         if (num_pd_disks < 8) {
751             pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
752             info.device.port_addr[num_pd_disks] =
753                 cpu_to_le64(megasas_get_sata_addr(pd_id));
754         }
755         num_pd_disks++;
756     }
757 
758     memcpy(info.product_name, base_class->product_name, 24);
759     snprintf(info.serial_number, 32, "%s", s->hba_serial);
760     snprintf(info.package_version, 0x60, "%s-QEMU", qemu_hw_version());
761     memcpy(info.image_component[0].name, "APP", 3);
762     snprintf(info.image_component[0].version, 10, "%s-QEMU",
763              base_class->product_version);
764     memcpy(info.image_component[0].build_date, "Apr  1 2014", 11);
765     memcpy(info.image_component[0].build_time, "12:34:56", 8);
766     info.image_component_count = 1;
767     if (pci_dev->has_rom) {
768         uint8_t biosver[32];
769         uint8_t *ptr;
770 
771         ptr = memory_region_get_ram_ptr(&pci_dev->rom);
772         memcpy(biosver, ptr + 0x41, 31);
773         biosver[31] = 0;
774         memcpy(info.image_component[1].name, "BIOS", 4);
775         memcpy(info.image_component[1].version, biosver,
776                strlen((const char *)biosver));
777         info.image_component_count++;
778     }
779     info.current_fw_time = cpu_to_le32(megasas_fw_time());
780     info.max_arms = 32;
781     info.max_spans = 8;
782     info.max_arrays = MEGASAS_MAX_ARRAYS;
783     info.max_lds = MFI_MAX_LD;
784     info.max_cmds = cpu_to_le16(s->fw_cmds);
785     info.max_sg_elements = cpu_to_le16(s->fw_sge);
786     info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);
787     if (!megasas_is_jbod(s))
788         info.lds_present = cpu_to_le16(num_pd_disks);
789     info.pd_present = cpu_to_le16(num_pd_disks);
790     info.pd_disks_present = cpu_to_le16(num_pd_disks);
791     info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |
792                                    MFI_INFO_HW_MEM |
793                                    MFI_INFO_HW_FLASH);
794     info.memory_size = cpu_to_le16(512);
795     info.nvram_size = cpu_to_le16(32);
796     info.flash_size = cpu_to_le16(16);
797     info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);
798     info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |
799                                     MFI_INFO_AOPS_SELF_DIAGNOSTIC |
800                                     MFI_INFO_AOPS_MIXED_ARRAY);
801     info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |
802                                MFI_INFO_LDOPS_ACCESS_POLICY |
803                                MFI_INFO_LDOPS_IO_POLICY |
804                                MFI_INFO_LDOPS_WRITE_POLICY |
805                                MFI_INFO_LDOPS_READ_POLICY);
806     info.max_strips_per_io = cpu_to_le16(s->fw_sge);
807     info.stripe_sz_ops.min = 3;
808     info.stripe_sz_ops.max = ctz32(MEGASAS_MAX_SECTORS + 1);
809     info.properties.pred_fail_poll_interval = cpu_to_le16(300);
810     info.properties.intr_throttle_cnt = cpu_to_le16(16);
811     info.properties.intr_throttle_timeout = cpu_to_le16(50);
812     info.properties.rebuild_rate = 30;
813     info.properties.patrol_read_rate = 30;
814     info.properties.bgi_rate = 30;
815     info.properties.cc_rate = 30;
816     info.properties.recon_rate = 30;
817     info.properties.cache_flush_interval = 4;
818     info.properties.spinup_drv_cnt = 2;
819     info.properties.spinup_delay = 6;
820     info.properties.ecc_bucket_size = 15;
821     info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);
822     info.properties.expose_encl_devices = 1;
823     info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);
824     info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |
825                                MFI_INFO_PDOPS_FORCE_OFFLINE);
826     info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |
827                                        MFI_INFO_PDMIX_SATA |
828                                        MFI_INFO_PDMIX_LD);
829 
830     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
831     return MFI_STAT_OK;
832 }
833 
834 static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)
835 {
836     struct mfi_defaults info;
837     size_t dcmd_size = sizeof(struct mfi_defaults);
838 
839     memset(&info, 0x0, dcmd_size);
840     if (cmd->iov_size < dcmd_size) {
841         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
842                                             dcmd_size);
843         return MFI_STAT_INVALID_PARAMETER;
844     }
845 
846     info.sas_addr = cpu_to_le64(s->sas_addr);
847     info.stripe_size = 3;
848     info.flush_time = 4;
849     info.background_rate = 30;
850     info.allow_mix_in_enclosure = 1;
851     info.allow_mix_in_ld = 1;
852     info.direct_pd_mapping = 1;
853     /* Enable for BIOS support */
854     info.bios_enumerate_lds = 1;
855     info.disable_ctrl_r = 1;
856     info.expose_enclosure_devices = 1;
857     info.disable_preboot_cli = 1;
858     info.cluster_disable = 1;
859 
860     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
861     return MFI_STAT_OK;
862 }
863 
864 static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)
865 {
866     struct mfi_bios_data info;
867     size_t dcmd_size = sizeof(info);
868 
869     memset(&info, 0x0, dcmd_size);
870     if (cmd->iov_size < dcmd_size) {
871         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
872                                             dcmd_size);
873         return MFI_STAT_INVALID_PARAMETER;
874     }
875     info.continue_on_error = 1;
876     info.verbose = 1;
877     if (megasas_is_jbod(s)) {
878         info.expose_all_drives = 1;
879     }
880 
881     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
882     return MFI_STAT_OK;
883 }
884 
885 static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)
886 {
887     uint64_t fw_time;
888     size_t dcmd_size = sizeof(fw_time);
889 
890     fw_time = cpu_to_le64(megasas_fw_time());
891 
892     cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);
893     return MFI_STAT_OK;
894 }
895 
896 static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)
897 {
898     uint64_t fw_time;
899 
900     /* This is a dummy; setting of firmware time is not allowed */
901     memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));
902 
903     trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);
904     fw_time = cpu_to_le64(megasas_fw_time());
905     return MFI_STAT_OK;
906 }
907 
908 static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)
909 {
910     struct mfi_evt_log_state info;
911     size_t dcmd_size = sizeof(info);
912 
913     memset(&info, 0, dcmd_size);
914 
915     info.newest_seq_num = cpu_to_le32(s->event_count);
916     info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
917     info.boot_seq_num = cpu_to_le32(s->boot_event);
918 
919     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
920     return MFI_STAT_OK;
921 }
922 
923 static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
924 {
925     union mfi_evt event;
926 
927     if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {
928         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
929                                             sizeof(struct mfi_evt_detail));
930         return MFI_STAT_INVALID_PARAMETER;
931     }
932     s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);
933     event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);
934     s->event_locale = event.members.locale;
935     s->event_class = event.members.class;
936     s->event_cmd = cmd;
937     /* Decrease busy count; event frame doesn't count here */
938     s->busy--;
939     cmd->iov_size = sizeof(struct mfi_evt_detail);
940     return MFI_STAT_INVALID_STATUS;
941 }
942 
943 static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
944 {
945     struct mfi_pd_list info;
946     size_t dcmd_size = sizeof(info);
947     BusChild *kid;
948     uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
949 
950     memset(&info, 0, dcmd_size);
951     offset = 8;
952     dcmd_limit = offset + sizeof(struct mfi_pd_address);
953     if (cmd->iov_size < dcmd_limit) {
954         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
955                                             dcmd_limit);
956         return MFI_STAT_INVALID_PARAMETER;
957     }
958 
959     max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);
960     if (max_pd_disks > MFI_MAX_SYS_PDS) {
961         max_pd_disks = MFI_MAX_SYS_PDS;
962     }
963     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
964         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
965         uint16_t pd_id;
966 
967         if (num_pd_disks >= max_pd_disks)
968             break;
969 
970         pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
971         info.addr[num_pd_disks].device_id = cpu_to_le16(pd_id);
972         info.addr[num_pd_disks].encl_device_id = 0xFFFF;
973         info.addr[num_pd_disks].encl_index = 0;
974         info.addr[num_pd_disks].slot_number = sdev->id & 0xFF;
975         info.addr[num_pd_disks].scsi_dev_type = sdev->type;
976         info.addr[num_pd_disks].connect_port_bitmap = 0x1;
977         info.addr[num_pd_disks].sas_addr[0] =
978             cpu_to_le64(megasas_get_sata_addr(pd_id));
979         num_pd_disks++;
980         offset += sizeof(struct mfi_pd_address);
981     }
982     trace_megasas_dcmd_pd_get_list(cmd->index, num_pd_disks,
983                                    max_pd_disks, offset);
984 
985     info.size = cpu_to_le32(offset);
986     info.count = cpu_to_le32(num_pd_disks);
987 
988     cmd->iov_size -= dma_buf_read((uint8_t *)&info, offset, &cmd->qsg);
989     return MFI_STAT_OK;
990 }
991 
992 static int megasas_dcmd_pd_list_query(MegasasState *s, MegasasCmd *cmd)
993 {
994     uint16_t flags;
995 
996     /* mbox0 contains flags */
997     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
998     trace_megasas_dcmd_pd_list_query(cmd->index, flags);
999     if (flags == MR_PD_QUERY_TYPE_ALL ||
1000         megasas_is_jbod(s)) {
1001         return megasas_dcmd_pd_get_list(s, cmd);
1002     }
1003 
1004     return MFI_STAT_OK;
1005 }
1006 
1007 static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun,
1008                                       MegasasCmd *cmd)
1009 {
1010     struct mfi_pd_info *info = cmd->iov_buf;
1011     size_t dcmd_size = sizeof(struct mfi_pd_info);
1012     uint64_t pd_size;
1013     uint16_t pd_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1014     uint8_t cmdbuf[6];
1015     SCSIRequest *req;
1016     size_t len, resid;
1017 
1018     if (!cmd->iov_buf) {
1019         cmd->iov_buf = g_malloc0(dcmd_size);
1020         info = cmd->iov_buf;
1021         info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */
1022         info->vpd_page83[0] = 0x7f;
1023         megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data));
1024         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1025         if (!req) {
1026             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1027                                                 "PD get info std inquiry");
1028             g_free(cmd->iov_buf);
1029             cmd->iov_buf = NULL;
1030             return MFI_STAT_FLASH_ALLOC_FAIL;
1031         }
1032         trace_megasas_dcmd_internal_submit(cmd->index,
1033                                            "PD get info std inquiry", lun);
1034         len = scsi_req_enqueue(req);
1035         if (len > 0) {
1036             cmd->iov_size = len;
1037             scsi_req_continue(req);
1038         }
1039         return MFI_STAT_INVALID_STATUS;
1040     } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) {
1041         megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83));
1042         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1043         if (!req) {
1044             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1045                                                 "PD get info vpd inquiry");
1046             return MFI_STAT_FLASH_ALLOC_FAIL;
1047         }
1048         trace_megasas_dcmd_internal_submit(cmd->index,
1049                                            "PD get info vpd inquiry", lun);
1050         len = scsi_req_enqueue(req);
1051         if (len > 0) {
1052             cmd->iov_size = len;
1053             scsi_req_continue(req);
1054         }
1055         return MFI_STAT_INVALID_STATUS;
1056     }
1057     /* Finished, set FW state */
1058     if ((info->inquiry_data[0] >> 5) == 0) {
1059         if (megasas_is_jbod(cmd->state)) {
1060             info->fw_state = cpu_to_le16(MFI_PD_STATE_SYSTEM);
1061         } else {
1062             info->fw_state = cpu_to_le16(MFI_PD_STATE_ONLINE);
1063         }
1064     } else {
1065         info->fw_state = cpu_to_le16(MFI_PD_STATE_OFFLINE);
1066     }
1067 
1068     info->ref.v.device_id = cpu_to_le16(pd_id);
1069     info->state.ddf.pd_type = cpu_to_le16(MFI_PD_DDF_TYPE_IN_VD|
1070                                           MFI_PD_DDF_TYPE_INTF_SAS);
1071     blk_get_geometry(sdev->conf.blk, &pd_size);
1072     info->raw_size = cpu_to_le64(pd_size);
1073     info->non_coerced_size = cpu_to_le64(pd_size);
1074     info->coerced_size = cpu_to_le64(pd_size);
1075     info->encl_device_id = 0xFFFF;
1076     info->slot_number = (sdev->id & 0xFF);
1077     info->path_info.count = 1;
1078     info->path_info.sas_addr[0] =
1079         cpu_to_le64(megasas_get_sata_addr(pd_id));
1080     info->connected_port_bitmap = 0x1;
1081     info->device_speed = 1;
1082     info->link_speed = 1;
1083     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1084     g_free(cmd->iov_buf);
1085     cmd->iov_size = dcmd_size - resid;
1086     cmd->iov_buf = NULL;
1087     return MFI_STAT_OK;
1088 }
1089 
1090 static int megasas_dcmd_pd_get_info(MegasasState *s, MegasasCmd *cmd)
1091 {
1092     size_t dcmd_size = sizeof(struct mfi_pd_info);
1093     uint16_t pd_id;
1094     uint8_t target_id, lun_id;
1095     SCSIDevice *sdev = NULL;
1096     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1097 
1098     if (cmd->iov_size < dcmd_size) {
1099         return MFI_STAT_INVALID_PARAMETER;
1100     }
1101 
1102     /* mbox0 has the ID */
1103     pd_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1104     target_id = (pd_id >> 8) & 0xFF;
1105     lun_id = pd_id & 0xFF;
1106     sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
1107     trace_megasas_dcmd_pd_get_info(cmd->index, pd_id);
1108 
1109     if (sdev) {
1110         /* Submit inquiry */
1111         retval = megasas_pd_get_info_submit(sdev, pd_id, cmd);
1112     }
1113 
1114     return retval;
1115 }
1116 
1117 static int megasas_dcmd_ld_get_list(MegasasState *s, MegasasCmd *cmd)
1118 {
1119     struct mfi_ld_list info;
1120     size_t dcmd_size = sizeof(info), resid;
1121     uint32_t num_ld_disks = 0, max_ld_disks;
1122     uint64_t ld_size;
1123     BusChild *kid;
1124 
1125     memset(&info, 0, dcmd_size);
1126     if (cmd->iov_size > dcmd_size) {
1127         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1128                                             dcmd_size);
1129         return MFI_STAT_INVALID_PARAMETER;
1130     }
1131 
1132     max_ld_disks = (cmd->iov_size - 8) / 16;
1133     if (megasas_is_jbod(s)) {
1134         max_ld_disks = 0;
1135     }
1136     if (max_ld_disks > MFI_MAX_LD) {
1137         max_ld_disks = MFI_MAX_LD;
1138     }
1139     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1140         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1141 
1142         if (num_ld_disks >= max_ld_disks) {
1143             break;
1144         }
1145         /* Logical device size is in blocks */
1146         blk_get_geometry(sdev->conf.blk, &ld_size);
1147         info.ld_list[num_ld_disks].ld.v.target_id = sdev->id;
1148         info.ld_list[num_ld_disks].state = MFI_LD_STATE_OPTIMAL;
1149         info.ld_list[num_ld_disks].size = cpu_to_le64(ld_size);
1150         num_ld_disks++;
1151     }
1152     info.ld_count = cpu_to_le32(num_ld_disks);
1153     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1154 
1155     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1156     cmd->iov_size = dcmd_size - resid;
1157     return MFI_STAT_OK;
1158 }
1159 
1160 static int megasas_dcmd_ld_list_query(MegasasState *s, MegasasCmd *cmd)
1161 {
1162     uint16_t flags;
1163     struct mfi_ld_targetid_list info;
1164     size_t dcmd_size = sizeof(info), resid;
1165     uint32_t num_ld_disks = 0, max_ld_disks = s->fw_luns;
1166     BusChild *kid;
1167 
1168     /* mbox0 contains flags */
1169     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1170     trace_megasas_dcmd_ld_list_query(cmd->index, flags);
1171     if (flags != MR_LD_QUERY_TYPE_ALL &&
1172         flags != MR_LD_QUERY_TYPE_EXPOSED_TO_HOST) {
1173         max_ld_disks = 0;
1174     }
1175 
1176     memset(&info, 0, dcmd_size);
1177     if (cmd->iov_size < 12) {
1178         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1179                                             dcmd_size);
1180         return MFI_STAT_INVALID_PARAMETER;
1181     }
1182     dcmd_size = sizeof(uint32_t) * 2 + 3;
1183     max_ld_disks = cmd->iov_size - dcmd_size;
1184     if (megasas_is_jbod(s)) {
1185         max_ld_disks = 0;
1186     }
1187     if (max_ld_disks > MFI_MAX_LD) {
1188         max_ld_disks = MFI_MAX_LD;
1189     }
1190     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1191         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1192 
1193         if (num_ld_disks >= max_ld_disks) {
1194             break;
1195         }
1196         info.targetid[num_ld_disks] = sdev->lun;
1197         num_ld_disks++;
1198         dcmd_size++;
1199     }
1200     info.ld_count = cpu_to_le32(num_ld_disks);
1201     info.size = dcmd_size;
1202     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1203 
1204     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1205     cmd->iov_size = dcmd_size - resid;
1206     return MFI_STAT_OK;
1207 }
1208 
1209 static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun,
1210                                       MegasasCmd *cmd)
1211 {
1212     struct mfi_ld_info *info = cmd->iov_buf;
1213     size_t dcmd_size = sizeof(struct mfi_ld_info);
1214     uint8_t cdb[6];
1215     SCSIRequest *req;
1216     ssize_t len, resid;
1217     uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1218     uint64_t ld_size;
1219 
1220     if (!cmd->iov_buf) {
1221         cmd->iov_buf = g_malloc0(dcmd_size);
1222         info = cmd->iov_buf;
1223         megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83));
1224         req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd);
1225         if (!req) {
1226             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1227                                                 "LD get info vpd inquiry");
1228             g_free(cmd->iov_buf);
1229             cmd->iov_buf = NULL;
1230             return MFI_STAT_FLASH_ALLOC_FAIL;
1231         }
1232         trace_megasas_dcmd_internal_submit(cmd->index,
1233                                            "LD get info vpd inquiry", lun);
1234         len = scsi_req_enqueue(req);
1235         if (len > 0) {
1236             cmd->iov_size = len;
1237             scsi_req_continue(req);
1238         }
1239         return MFI_STAT_INVALID_STATUS;
1240     }
1241 
1242     info->ld_config.params.state = MFI_LD_STATE_OPTIMAL;
1243     info->ld_config.properties.ld.v.target_id = lun;
1244     info->ld_config.params.stripe_size = 3;
1245     info->ld_config.params.num_drives = 1;
1246     info->ld_config.params.is_consistent = 1;
1247     /* Logical device size is in blocks */
1248     blk_get_geometry(sdev->conf.blk, &ld_size);
1249     info->size = cpu_to_le64(ld_size);
1250     memset(info->ld_config.span, 0, sizeof(info->ld_config.span));
1251     info->ld_config.span[0].start_block = 0;
1252     info->ld_config.span[0].num_blocks = info->size;
1253     info->ld_config.span[0].array_ref = cpu_to_le16(sdev_id);
1254 
1255     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1256     g_free(cmd->iov_buf);
1257     cmd->iov_size = dcmd_size - resid;
1258     cmd->iov_buf = NULL;
1259     return MFI_STAT_OK;
1260 }
1261 
1262 static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
1263 {
1264     struct mfi_ld_info info;
1265     size_t dcmd_size = sizeof(info);
1266     uint16_t ld_id;
1267     uint32_t max_ld_disks = s->fw_luns;
1268     SCSIDevice *sdev = NULL;
1269     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1270 
1271     if (cmd->iov_size < dcmd_size) {
1272         return MFI_STAT_INVALID_PARAMETER;
1273     }
1274 
1275     /* mbox0 has the ID */
1276     ld_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1277     trace_megasas_dcmd_ld_get_info(cmd->index, ld_id);
1278 
1279     if (megasas_is_jbod(s)) {
1280         return MFI_STAT_DEVICE_NOT_FOUND;
1281     }
1282 
1283     if (ld_id < max_ld_disks) {
1284         sdev = scsi_device_find(&s->bus, 0, ld_id, 0);
1285     }
1286 
1287     if (sdev) {
1288         retval = megasas_ld_get_info_submit(sdev, ld_id, cmd);
1289     }
1290 
1291     return retval;
1292 }
1293 
1294 static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
1295 {
1296     uint8_t data[4096] = { 0 };
1297     struct mfi_config_data *info;
1298     int num_pd_disks = 0, array_offset, ld_offset;
1299     BusChild *kid;
1300 
1301     if (cmd->iov_size > 4096) {
1302         return MFI_STAT_INVALID_PARAMETER;
1303     }
1304 
1305     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1306         num_pd_disks++;
1307     }
1308     info = (struct mfi_config_data *)&data;
1309     /*
1310      * Array mapping:
1311      * - One array per SCSI device
1312      * - One logical drive per SCSI device
1313      *   spanning the entire device
1314      */
1315     info->array_count = num_pd_disks;
1316     info->array_size = sizeof(struct mfi_array) * num_pd_disks;
1317     info->log_drv_count = num_pd_disks;
1318     info->log_drv_size = sizeof(struct mfi_ld_config) * num_pd_disks;
1319     info->spares_count = 0;
1320     info->spares_size = sizeof(struct mfi_spare);
1321     info->size = sizeof(struct mfi_config_data) + info->array_size +
1322         info->log_drv_size;
1323     if (info->size > 4096) {
1324         return MFI_STAT_INVALID_PARAMETER;
1325     }
1326 
1327     array_offset = sizeof(struct mfi_config_data);
1328     ld_offset = array_offset + sizeof(struct mfi_array) * num_pd_disks;
1329 
1330     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1331         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1332         uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
1333         struct mfi_array *array;
1334         struct mfi_ld_config *ld;
1335         uint64_t pd_size;
1336         int i;
1337 
1338         array = (struct mfi_array *)(data + array_offset);
1339         blk_get_geometry(sdev->conf.blk, &pd_size);
1340         array->size = cpu_to_le64(pd_size);
1341         array->num_drives = 1;
1342         array->array_ref = cpu_to_le16(sdev_id);
1343         array->pd[0].ref.v.device_id = cpu_to_le16(sdev_id);
1344         array->pd[0].ref.v.seq_num = 0;
1345         array->pd[0].fw_state = MFI_PD_STATE_ONLINE;
1346         array->pd[0].encl.pd = 0xFF;
1347         array->pd[0].encl.slot = (sdev->id & 0xFF);
1348         for (i = 1; i < MFI_MAX_ROW_SIZE; i++) {
1349             array->pd[i].ref.v.device_id = 0xFFFF;
1350             array->pd[i].ref.v.seq_num = 0;
1351             array->pd[i].fw_state = MFI_PD_STATE_UNCONFIGURED_GOOD;
1352             array->pd[i].encl.pd = 0xFF;
1353             array->pd[i].encl.slot = 0xFF;
1354         }
1355         array_offset += sizeof(struct mfi_array);
1356         ld = (struct mfi_ld_config *)(data + ld_offset);
1357         memset(ld, 0, sizeof(struct mfi_ld_config));
1358         ld->properties.ld.v.target_id = sdev->id;
1359         ld->properties.default_cache_policy = MR_LD_CACHE_READ_AHEAD |
1360             MR_LD_CACHE_READ_ADAPTIVE;
1361         ld->properties.current_cache_policy = MR_LD_CACHE_READ_AHEAD |
1362             MR_LD_CACHE_READ_ADAPTIVE;
1363         ld->params.state = MFI_LD_STATE_OPTIMAL;
1364         ld->params.stripe_size = 3;
1365         ld->params.num_drives = 1;
1366         ld->params.span_depth = 1;
1367         ld->params.is_consistent = 1;
1368         ld->span[0].start_block = 0;
1369         ld->span[0].num_blocks = cpu_to_le64(pd_size);
1370         ld->span[0].array_ref = cpu_to_le16(sdev_id);
1371         ld_offset += sizeof(struct mfi_ld_config);
1372     }
1373 
1374     cmd->iov_size -= dma_buf_read((uint8_t *)data, info->size, &cmd->qsg);
1375     return MFI_STAT_OK;
1376 }
1377 
1378 static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
1379 {
1380     struct mfi_ctrl_props info;
1381     size_t dcmd_size = sizeof(info);
1382 
1383     memset(&info, 0x0, dcmd_size);
1384     if (cmd->iov_size < dcmd_size) {
1385         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1386                                             dcmd_size);
1387         return MFI_STAT_INVALID_PARAMETER;
1388     }
1389     info.pred_fail_poll_interval = cpu_to_le16(300);
1390     info.intr_throttle_cnt = cpu_to_le16(16);
1391     info.intr_throttle_timeout = cpu_to_le16(50);
1392     info.rebuild_rate = 30;
1393     info.patrol_read_rate = 30;
1394     info.bgi_rate = 30;
1395     info.cc_rate = 30;
1396     info.recon_rate = 30;
1397     info.cache_flush_interval = 4;
1398     info.spinup_drv_cnt = 2;
1399     info.spinup_delay = 6;
1400     info.ecc_bucket_size = 15;
1401     info.ecc_bucket_leak_rate = cpu_to_le16(1440);
1402     info.expose_encl_devices = 1;
1403 
1404     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1405     return MFI_STAT_OK;
1406 }
1407 
1408 static int megasas_cache_flush(MegasasState *s, MegasasCmd *cmd)
1409 {
1410     blk_drain_all();
1411     return MFI_STAT_OK;
1412 }
1413 
1414 static int megasas_ctrl_shutdown(MegasasState *s, MegasasCmd *cmd)
1415 {
1416     s->fw_state = MFI_FWSTATE_READY;
1417     return MFI_STAT_OK;
1418 }
1419 
1420 /* Some implementations use CLUSTER RESET LD to simulate a device reset */
1421 static int megasas_cluster_reset_ld(MegasasState *s, MegasasCmd *cmd)
1422 {
1423     uint16_t target_id;
1424     int i;
1425 
1426     /* mbox0 contains the device index */
1427     target_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1428     trace_megasas_dcmd_reset_ld(cmd->index, target_id);
1429     for (i = 0; i < s->fw_cmds; i++) {
1430         MegasasCmd *tmp_cmd = &s->frames[i];
1431         if (tmp_cmd->req && tmp_cmd->req->dev->id == target_id) {
1432             SCSIDevice *d = tmp_cmd->req->dev;
1433             qdev_reset_all(&d->qdev);
1434         }
1435     }
1436     return MFI_STAT_OK;
1437 }
1438 
1439 static int megasas_dcmd_set_properties(MegasasState *s, MegasasCmd *cmd)
1440 {
1441     struct mfi_ctrl_props info;
1442     size_t dcmd_size = sizeof(info);
1443 
1444     if (cmd->iov_size < dcmd_size) {
1445         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1446                                             dcmd_size);
1447         return MFI_STAT_INVALID_PARAMETER;
1448     }
1449     dma_buf_write((uint8_t *)&info, dcmd_size, &cmd->qsg);
1450     trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
1451     return MFI_STAT_OK;
1452 }
1453 
1454 static int megasas_dcmd_dummy(MegasasState *s, MegasasCmd *cmd)
1455 {
1456     trace_megasas_dcmd_dummy(cmd->index, cmd->iov_size);
1457     return MFI_STAT_OK;
1458 }
1459 
1460 static const struct dcmd_cmd_tbl_t {
1461     int opcode;
1462     const char *desc;
1463     int (*func)(MegasasState *s, MegasasCmd *cmd);
1464 } dcmd_cmd_tbl[] = {
1465     { MFI_DCMD_CTRL_MFI_HOST_MEM_ALLOC, "CTRL_HOST_MEM_ALLOC",
1466       megasas_dcmd_dummy },
1467     { MFI_DCMD_CTRL_GET_INFO, "CTRL_GET_INFO",
1468       megasas_ctrl_get_info },
1469     { MFI_DCMD_CTRL_GET_PROPERTIES, "CTRL_GET_PROPERTIES",
1470       megasas_dcmd_get_properties },
1471     { MFI_DCMD_CTRL_SET_PROPERTIES, "CTRL_SET_PROPERTIES",
1472       megasas_dcmd_set_properties },
1473     { MFI_DCMD_CTRL_ALARM_GET, "CTRL_ALARM_GET",
1474       megasas_dcmd_dummy },
1475     { MFI_DCMD_CTRL_ALARM_ENABLE, "CTRL_ALARM_ENABLE",
1476       megasas_dcmd_dummy },
1477     { MFI_DCMD_CTRL_ALARM_DISABLE, "CTRL_ALARM_DISABLE",
1478       megasas_dcmd_dummy },
1479     { MFI_DCMD_CTRL_ALARM_SILENCE, "CTRL_ALARM_SILENCE",
1480       megasas_dcmd_dummy },
1481     { MFI_DCMD_CTRL_ALARM_TEST, "CTRL_ALARM_TEST",
1482       megasas_dcmd_dummy },
1483     { MFI_DCMD_CTRL_EVENT_GETINFO, "CTRL_EVENT_GETINFO",
1484       megasas_event_info },
1485     { MFI_DCMD_CTRL_EVENT_GET, "CTRL_EVENT_GET",
1486       megasas_dcmd_dummy },
1487     { MFI_DCMD_CTRL_EVENT_WAIT, "CTRL_EVENT_WAIT",
1488       megasas_event_wait },
1489     { MFI_DCMD_CTRL_SHUTDOWN, "CTRL_SHUTDOWN",
1490       megasas_ctrl_shutdown },
1491     { MFI_DCMD_HIBERNATE_STANDBY, "CTRL_STANDBY",
1492       megasas_dcmd_dummy },
1493     { MFI_DCMD_CTRL_GET_TIME, "CTRL_GET_TIME",
1494       megasas_dcmd_get_fw_time },
1495     { MFI_DCMD_CTRL_SET_TIME, "CTRL_SET_TIME",
1496       megasas_dcmd_set_fw_time },
1497     { MFI_DCMD_CTRL_BIOS_DATA_GET, "CTRL_BIOS_DATA_GET",
1498       megasas_dcmd_get_bios_info },
1499     { MFI_DCMD_CTRL_FACTORY_DEFAULTS, "CTRL_FACTORY_DEFAULTS",
1500       megasas_dcmd_dummy },
1501     { MFI_DCMD_CTRL_MFC_DEFAULTS_GET, "CTRL_MFC_DEFAULTS_GET",
1502       megasas_mfc_get_defaults },
1503     { MFI_DCMD_CTRL_MFC_DEFAULTS_SET, "CTRL_MFC_DEFAULTS_SET",
1504       megasas_dcmd_dummy },
1505     { MFI_DCMD_CTRL_CACHE_FLUSH, "CTRL_CACHE_FLUSH",
1506       megasas_cache_flush },
1507     { MFI_DCMD_PD_GET_LIST, "PD_GET_LIST",
1508       megasas_dcmd_pd_get_list },
1509     { MFI_DCMD_PD_LIST_QUERY, "PD_LIST_QUERY",
1510       megasas_dcmd_pd_list_query },
1511     { MFI_DCMD_PD_GET_INFO, "PD_GET_INFO",
1512       megasas_dcmd_pd_get_info },
1513     { MFI_DCMD_PD_STATE_SET, "PD_STATE_SET",
1514       megasas_dcmd_dummy },
1515     { MFI_DCMD_PD_REBUILD, "PD_REBUILD",
1516       megasas_dcmd_dummy },
1517     { MFI_DCMD_PD_BLINK, "PD_BLINK",
1518       megasas_dcmd_dummy },
1519     { MFI_DCMD_PD_UNBLINK, "PD_UNBLINK",
1520       megasas_dcmd_dummy },
1521     { MFI_DCMD_LD_GET_LIST, "LD_GET_LIST",
1522       megasas_dcmd_ld_get_list},
1523     { MFI_DCMD_LD_LIST_QUERY, "LD_LIST_QUERY",
1524       megasas_dcmd_ld_list_query },
1525     { MFI_DCMD_LD_GET_INFO, "LD_GET_INFO",
1526       megasas_dcmd_ld_get_info },
1527     { MFI_DCMD_LD_GET_PROP, "LD_GET_PROP",
1528       megasas_dcmd_dummy },
1529     { MFI_DCMD_LD_SET_PROP, "LD_SET_PROP",
1530       megasas_dcmd_dummy },
1531     { MFI_DCMD_LD_DELETE, "LD_DELETE",
1532       megasas_dcmd_dummy },
1533     { MFI_DCMD_CFG_READ, "CFG_READ",
1534       megasas_dcmd_cfg_read },
1535     { MFI_DCMD_CFG_ADD, "CFG_ADD",
1536       megasas_dcmd_dummy },
1537     { MFI_DCMD_CFG_CLEAR, "CFG_CLEAR",
1538       megasas_dcmd_dummy },
1539     { MFI_DCMD_CFG_FOREIGN_READ, "CFG_FOREIGN_READ",
1540       megasas_dcmd_dummy },
1541     { MFI_DCMD_CFG_FOREIGN_IMPORT, "CFG_FOREIGN_IMPORT",
1542       megasas_dcmd_dummy },
1543     { MFI_DCMD_BBU_STATUS, "BBU_STATUS",
1544       megasas_dcmd_dummy },
1545     { MFI_DCMD_BBU_CAPACITY_INFO, "BBU_CAPACITY_INFO",
1546       megasas_dcmd_dummy },
1547     { MFI_DCMD_BBU_DESIGN_INFO, "BBU_DESIGN_INFO",
1548       megasas_dcmd_dummy },
1549     { MFI_DCMD_BBU_PROP_GET, "BBU_PROP_GET",
1550       megasas_dcmd_dummy },
1551     { MFI_DCMD_CLUSTER, "CLUSTER",
1552       megasas_dcmd_dummy },
1553     { MFI_DCMD_CLUSTER_RESET_ALL, "CLUSTER_RESET_ALL",
1554       megasas_dcmd_dummy },
1555     { MFI_DCMD_CLUSTER_RESET_LD, "CLUSTER_RESET_LD",
1556       megasas_cluster_reset_ld },
1557     { -1, NULL, NULL }
1558 };
1559 
1560 static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)
1561 {
1562     int opcode;
1563     int retval = 0;
1564     size_t len;
1565     const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;
1566 
1567     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1568     trace_megasas_handle_dcmd(cmd->index, opcode);
1569     if (megasas_map_dcmd(s, cmd) < 0) {
1570         return MFI_STAT_MEMORY_NOT_AVAILABLE;
1571     }
1572     while (cmdptr->opcode != -1 && cmdptr->opcode != opcode) {
1573         cmdptr++;
1574     }
1575     len = cmd->iov_size;
1576     if (cmdptr->opcode == -1) {
1577         trace_megasas_dcmd_unhandled(cmd->index, opcode, len);
1578         retval = megasas_dcmd_dummy(s, cmd);
1579     } else {
1580         trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);
1581         retval = cmdptr->func(s, cmd);
1582     }
1583     if (retval != MFI_STAT_INVALID_STATUS) {
1584         megasas_finish_dcmd(cmd, len);
1585     }
1586     return retval;
1587 }
1588 
1589 static int megasas_finish_internal_dcmd(MegasasCmd *cmd,
1590                                         SCSIRequest *req)
1591 {
1592     int opcode;
1593     int retval = MFI_STAT_OK;
1594     int lun = req->lun;
1595 
1596     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1597     trace_megasas_dcmd_internal_finish(cmd->index, opcode, lun);
1598     switch (opcode) {
1599     case MFI_DCMD_PD_GET_INFO:
1600         retval = megasas_pd_get_info_submit(req->dev, lun, cmd);
1601         break;
1602     case MFI_DCMD_LD_GET_INFO:
1603         retval = megasas_ld_get_info_submit(req->dev, lun, cmd);
1604         break;
1605     default:
1606         trace_megasas_dcmd_internal_invalid(cmd->index, opcode);
1607         retval = MFI_STAT_INVALID_DCMD;
1608         break;
1609     }
1610     if (retval != MFI_STAT_INVALID_STATUS) {
1611         megasas_finish_dcmd(cmd, cmd->iov_size);
1612     }
1613     return retval;
1614 }
1615 
1616 static int megasas_enqueue_req(MegasasCmd *cmd, bool is_write)
1617 {
1618     int len;
1619 
1620     len = scsi_req_enqueue(cmd->req);
1621     if (len < 0) {
1622         len = -len;
1623     }
1624     if (len > 0) {
1625         if (len > cmd->iov_size) {
1626             if (is_write) {
1627                 trace_megasas_iov_write_overflow(cmd->index, len,
1628                                                  cmd->iov_size);
1629             } else {
1630                 trace_megasas_iov_read_overflow(cmd->index, len,
1631                                                 cmd->iov_size);
1632             }
1633         }
1634         if (len < cmd->iov_size) {
1635             if (is_write) {
1636                 trace_megasas_iov_write_underflow(cmd->index, len,
1637                                                   cmd->iov_size);
1638             } else {
1639                 trace_megasas_iov_read_underflow(cmd->index, len,
1640                                                  cmd->iov_size);
1641             }
1642             cmd->iov_size = len;
1643         }
1644         scsi_req_continue(cmd->req);
1645     }
1646     return len;
1647 }
1648 
1649 static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
1650                                bool is_logical)
1651 {
1652     uint8_t *cdb;
1653     bool is_write;
1654     struct SCSIDevice *sdev = NULL;
1655 
1656     cdb = cmd->frame->pass.cdb;
1657 
1658     if (is_logical) {
1659         if (cmd->frame->header.target_id >= MFI_MAX_LD ||
1660             cmd->frame->header.lun_id != 0) {
1661             trace_megasas_scsi_target_not_present(
1662                 mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1663                 cmd->frame->header.target_id, cmd->frame->header.lun_id);
1664             return MFI_STAT_DEVICE_NOT_FOUND;
1665         }
1666     }
1667     sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1668                             cmd->frame->header.lun_id);
1669 
1670     cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);
1671     trace_megasas_handle_scsi(mfi_frame_desc[cmd->frame->header.frame_cmd],
1672                               is_logical, cmd->frame->header.target_id,
1673                               cmd->frame->header.lun_id, sdev, cmd->iov_size);
1674 
1675     if (!sdev || (megasas_is_jbod(s) && is_logical)) {
1676         trace_megasas_scsi_target_not_present(
1677             mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1678             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1679         return MFI_STAT_DEVICE_NOT_FOUND;
1680     }
1681 
1682     if (cmd->frame->header.cdb_len > 16) {
1683         trace_megasas_scsi_invalid_cdb_len(
1684                 mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1685                 cmd->frame->header.target_id, cmd->frame->header.lun_id,
1686                 cmd->frame->header.cdb_len);
1687         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1688         cmd->frame->header.scsi_status = CHECK_CONDITION;
1689         s->event_count++;
1690         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1691     }
1692 
1693     if (megasas_map_sgl(s, cmd, &cmd->frame->pass.sgl)) {
1694         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1695         cmd->frame->header.scsi_status = CHECK_CONDITION;
1696         s->event_count++;
1697         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1698     }
1699 
1700     cmd->req = scsi_req_new(sdev, cmd->index,
1701                             cmd->frame->header.lun_id, cdb, cmd);
1702     if (!cmd->req) {
1703         trace_megasas_scsi_req_alloc_failed(
1704                 mfi_frame_desc[cmd->frame->header.frame_cmd],
1705                 cmd->frame->header.target_id, cmd->frame->header.lun_id);
1706         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1707         cmd->frame->header.scsi_status = BUSY;
1708         s->event_count++;
1709         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1710     }
1711 
1712     is_write = (cmd->req->cmd.mode == SCSI_XFER_TO_DEV);
1713     if (cmd->iov_size) {
1714         if (is_write) {
1715             trace_megasas_scsi_write_start(cmd->index, cmd->iov_size);
1716         } else {
1717             trace_megasas_scsi_read_start(cmd->index, cmd->iov_size);
1718         }
1719     } else {
1720         trace_megasas_scsi_nodata(cmd->index);
1721     }
1722     megasas_enqueue_req(cmd, is_write);
1723     return MFI_STAT_INVALID_STATUS;
1724 }
1725 
1726 static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd)
1727 {
1728     uint32_t lba_count, lba_start_hi, lba_start_lo;
1729     uint64_t lba_start;
1730     bool is_write = (cmd->frame->header.frame_cmd == MFI_CMD_LD_WRITE);
1731     uint8_t cdb[16];
1732     int len;
1733     struct SCSIDevice *sdev = NULL;
1734 
1735     lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
1736     lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
1737     lba_start_hi = le32_to_cpu(cmd->frame->io.lba_hi);
1738     lba_start = ((uint64_t)lba_start_hi << 32) | lba_start_lo;
1739 
1740     if (cmd->frame->header.target_id < MFI_MAX_LD &&
1741         cmd->frame->header.lun_id == 0) {
1742         sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1743                                 cmd->frame->header.lun_id);
1744     }
1745 
1746     trace_megasas_handle_io(cmd->index,
1747                             mfi_frame_desc[cmd->frame->header.frame_cmd],
1748                             cmd->frame->header.target_id,
1749                             cmd->frame->header.lun_id,
1750                             (unsigned long)lba_start, (unsigned long)lba_count);
1751     if (!sdev) {
1752         trace_megasas_io_target_not_present(cmd->index,
1753             mfi_frame_desc[cmd->frame->header.frame_cmd],
1754             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1755         return MFI_STAT_DEVICE_NOT_FOUND;
1756     }
1757 
1758     if (cmd->frame->header.cdb_len > 16) {
1759         trace_megasas_scsi_invalid_cdb_len(
1760             mfi_frame_desc[cmd->frame->header.frame_cmd], 1,
1761             cmd->frame->header.target_id, cmd->frame->header.lun_id,
1762             cmd->frame->header.cdb_len);
1763         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1764         cmd->frame->header.scsi_status = CHECK_CONDITION;
1765         s->event_count++;
1766         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1767     }
1768 
1769     cmd->iov_size = lba_count * sdev->blocksize;
1770     if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
1771         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1772         cmd->frame->header.scsi_status = CHECK_CONDITION;
1773         s->event_count++;
1774         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1775     }
1776 
1777     megasas_encode_lba(cdb, lba_start, lba_count, is_write);
1778     cmd->req = scsi_req_new(sdev, cmd->index,
1779                             cmd->frame->header.lun_id, cdb, cmd);
1780     if (!cmd->req) {
1781         trace_megasas_scsi_req_alloc_failed(
1782             mfi_frame_desc[cmd->frame->header.frame_cmd],
1783             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1784         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1785         cmd->frame->header.scsi_status = BUSY;
1786         s->event_count++;
1787         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1788     }
1789     len = megasas_enqueue_req(cmd, is_write);
1790     if (len > 0) {
1791         if (is_write) {
1792             trace_megasas_io_write_start(cmd->index, lba_start, lba_count, len);
1793         } else {
1794             trace_megasas_io_read_start(cmd->index, lba_start, lba_count, len);
1795         }
1796     }
1797     return MFI_STAT_INVALID_STATUS;
1798 }
1799 
1800 static int megasas_finish_internal_command(MegasasCmd *cmd,
1801                                            SCSIRequest *req, size_t resid)
1802 {
1803     int retval = MFI_STAT_INVALID_CMD;
1804 
1805     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1806         cmd->iov_size -= resid;
1807         retval = megasas_finish_internal_dcmd(cmd, req);
1808     }
1809     return retval;
1810 }
1811 
1812 static QEMUSGList *megasas_get_sg_list(SCSIRequest *req)
1813 {
1814     MegasasCmd *cmd = req->hba_private;
1815 
1816     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1817         return NULL;
1818     } else {
1819         return &cmd->qsg;
1820     }
1821 }
1822 
1823 static void megasas_xfer_complete(SCSIRequest *req, uint32_t len)
1824 {
1825     MegasasCmd *cmd = req->hba_private;
1826     uint8_t *buf;
1827     uint32_t opcode;
1828 
1829     trace_megasas_io_complete(cmd->index, len);
1830 
1831     if (cmd->frame->header.frame_cmd != MFI_CMD_DCMD) {
1832         scsi_req_continue(req);
1833         return;
1834     }
1835 
1836     buf = scsi_req_get_buf(req);
1837     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1838     if (opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) {
1839         struct mfi_pd_info *info = cmd->iov_buf;
1840 
1841         if (info->inquiry_data[0] == 0x7f) {
1842             memset(info->inquiry_data, 0, sizeof(info->inquiry_data));
1843             memcpy(info->inquiry_data, buf, len);
1844         } else if (info->vpd_page83[0] == 0x7f) {
1845             memset(info->vpd_page83, 0, sizeof(info->vpd_page83));
1846             memcpy(info->vpd_page83, buf, len);
1847         }
1848         scsi_req_continue(req);
1849     } else if (opcode == MFI_DCMD_LD_GET_INFO) {
1850         struct mfi_ld_info *info = cmd->iov_buf;
1851 
1852         if (cmd->iov_buf) {
1853             memcpy(info->vpd_page83, buf, sizeof(info->vpd_page83));
1854             scsi_req_continue(req);
1855         }
1856     }
1857 }
1858 
1859 static void megasas_command_complete(SCSIRequest *req, uint32_t status,
1860                                      size_t resid)
1861 {
1862     MegasasCmd *cmd = req->hba_private;
1863     uint8_t cmd_status = MFI_STAT_OK;
1864 
1865     trace_megasas_command_complete(cmd->index, status, resid);
1866 
1867     if (req->io_canceled) {
1868         return;
1869     }
1870 
1871     if (cmd->req == NULL) {
1872         /*
1873          * Internal command complete
1874          */
1875         cmd_status = megasas_finish_internal_command(cmd, req, resid);
1876         if (cmd_status == MFI_STAT_INVALID_STATUS) {
1877             return;
1878         }
1879     } else {
1880         req->status = status;
1881         trace_megasas_scsi_complete(cmd->index, req->status,
1882                                     cmd->iov_size, req->cmd.xfer);
1883         if (req->status != GOOD) {
1884             cmd_status = MFI_STAT_SCSI_DONE_WITH_ERROR;
1885         }
1886         if (req->status == CHECK_CONDITION) {
1887             megasas_copy_sense(cmd);
1888         }
1889 
1890         cmd->frame->header.scsi_status = req->status;
1891     }
1892     cmd->frame->header.cmd_status = cmd_status;
1893     megasas_complete_command(cmd);
1894 }
1895 
1896 static void megasas_command_cancelled(SCSIRequest *req)
1897 {
1898     MegasasCmd *cmd = req->hba_private;
1899 
1900     if (!cmd) {
1901         return;
1902     }
1903     cmd->frame->header.cmd_status = MFI_STAT_SCSI_IO_FAILED;
1904     megasas_complete_command(cmd);
1905 }
1906 
1907 static int megasas_handle_abort(MegasasState *s, MegasasCmd *cmd)
1908 {
1909     uint64_t abort_ctx = le64_to_cpu(cmd->frame->abort.abort_context);
1910     hwaddr abort_addr, addr_hi, addr_lo;
1911     MegasasCmd *abort_cmd;
1912 
1913     addr_hi = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_hi);
1914     addr_lo = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_lo);
1915     abort_addr = ((uint64_t)addr_hi << 32) | addr_lo;
1916 
1917     abort_cmd = megasas_lookup_frame(s, abort_addr);
1918     if (!abort_cmd) {
1919         trace_megasas_abort_no_cmd(cmd->index, abort_ctx);
1920         s->event_count++;
1921         return MFI_STAT_OK;
1922     }
1923     if (!megasas_use_queue64(s)) {
1924         abort_ctx &= (uint64_t)0xFFFFFFFF;
1925     }
1926     if (abort_cmd->context != abort_ctx) {
1927         trace_megasas_abort_invalid_context(cmd->index, abort_cmd->context,
1928                                             abort_cmd->index);
1929         s->event_count++;
1930         return MFI_STAT_ABORT_NOT_POSSIBLE;
1931     }
1932     trace_megasas_abort_frame(cmd->index, abort_cmd->index);
1933     megasas_abort_command(abort_cmd);
1934     if (!s->event_cmd || abort_cmd != s->event_cmd) {
1935         s->event_cmd = NULL;
1936     }
1937     s->event_count++;
1938     return MFI_STAT_OK;
1939 }
1940 
1941 static void megasas_handle_frame(MegasasState *s, uint64_t frame_addr,
1942                                  uint32_t frame_count)
1943 {
1944     uint8_t frame_status = MFI_STAT_INVALID_CMD;
1945     uint64_t frame_context;
1946     MegasasCmd *cmd;
1947 
1948     /*
1949      * Always read 64bit context, top bits will be
1950      * masked out if required in megasas_enqueue_frame()
1951      */
1952     frame_context = megasas_frame_get_context(s, frame_addr);
1953 
1954     cmd = megasas_enqueue_frame(s, frame_addr, frame_context, frame_count);
1955     if (!cmd) {
1956         /* reply queue full */
1957         trace_megasas_frame_busy(frame_addr);
1958         megasas_frame_set_scsi_status(s, frame_addr, BUSY);
1959         megasas_frame_set_cmd_status(s, frame_addr, MFI_STAT_SCSI_DONE_WITH_ERROR);
1960         megasas_complete_frame(s, frame_context);
1961         s->event_count++;
1962         return;
1963     }
1964     switch (cmd->frame->header.frame_cmd) {
1965     case MFI_CMD_INIT:
1966         frame_status = megasas_init_firmware(s, cmd);
1967         break;
1968     case MFI_CMD_DCMD:
1969         frame_status = megasas_handle_dcmd(s, cmd);
1970         break;
1971     case MFI_CMD_ABORT:
1972         frame_status = megasas_handle_abort(s, cmd);
1973         break;
1974     case MFI_CMD_PD_SCSI_IO:
1975         frame_status = megasas_handle_scsi(s, cmd, 0);
1976         break;
1977     case MFI_CMD_LD_SCSI_IO:
1978         frame_status = megasas_handle_scsi(s, cmd, 1);
1979         break;
1980     case MFI_CMD_LD_READ:
1981     case MFI_CMD_LD_WRITE:
1982         frame_status = megasas_handle_io(s, cmd);
1983         break;
1984     default:
1985         trace_megasas_unhandled_frame_cmd(cmd->index,
1986                                           cmd->frame->header.frame_cmd);
1987         s->event_count++;
1988         break;
1989     }
1990     if (frame_status != MFI_STAT_INVALID_STATUS) {
1991         if (cmd->frame) {
1992             cmd->frame->header.cmd_status = frame_status;
1993         } else {
1994             megasas_frame_set_cmd_status(s, frame_addr, frame_status);
1995         }
1996         megasas_unmap_frame(s, cmd);
1997         megasas_complete_frame(s, cmd->context);
1998     }
1999 }
2000 
2001 static uint64_t megasas_mmio_read(void *opaque, hwaddr addr,
2002                                   unsigned size)
2003 {
2004     MegasasState *s = opaque;
2005     PCIDevice *pci_dev = PCI_DEVICE(s);
2006     MegasasBaseClass *base_class = MEGASAS_DEVICE_GET_CLASS(s);
2007     uint32_t retval = 0;
2008 
2009     switch (addr) {
2010     case MFI_IDB:
2011         retval = 0;
2012         trace_megasas_mmio_readl("MFI_IDB", retval);
2013         break;
2014     case MFI_OMSG0:
2015     case MFI_OSP0:
2016         retval = (msix_present(pci_dev) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |
2017             (s->fw_state & MFI_FWSTATE_MASK) |
2018             ((s->fw_sge & 0xff) << 16) |
2019             (s->fw_cmds & 0xFFFF);
2020         trace_megasas_mmio_readl(addr == MFI_OMSG0 ? "MFI_OMSG0" : "MFI_OSP0",
2021                                  retval);
2022         break;
2023     case MFI_OSTS:
2024         if (megasas_intr_enabled(s) && s->doorbell) {
2025             retval = base_class->osts;
2026         }
2027         trace_megasas_mmio_readl("MFI_OSTS", retval);
2028         break;
2029     case MFI_OMSK:
2030         retval = s->intr_mask;
2031         trace_megasas_mmio_readl("MFI_OMSK", retval);
2032         break;
2033     case MFI_ODCR0:
2034         retval = s->doorbell ? 1 : 0;
2035         trace_megasas_mmio_readl("MFI_ODCR0", retval);
2036         break;
2037     case MFI_DIAG:
2038         retval = s->diag;
2039         trace_megasas_mmio_readl("MFI_DIAG", retval);
2040         break;
2041     case MFI_OSP1:
2042         retval = 15;
2043         trace_megasas_mmio_readl("MFI_OSP1", retval);
2044         break;
2045     default:
2046         trace_megasas_mmio_invalid_readl(addr);
2047         break;
2048     }
2049     return retval;
2050 }
2051 
2052 static int adp_reset_seq[] = {0x00, 0x04, 0x0b, 0x02, 0x07, 0x0d};
2053 
2054 static void megasas_mmio_write(void *opaque, hwaddr addr,
2055                                uint64_t val, unsigned size)
2056 {
2057     MegasasState *s = opaque;
2058     PCIDevice *pci_dev = PCI_DEVICE(s);
2059     uint64_t frame_addr;
2060     uint32_t frame_count;
2061     int i;
2062 
2063     switch (addr) {
2064     case MFI_IDB:
2065         trace_megasas_mmio_writel("MFI_IDB", val);
2066         if (val & MFI_FWINIT_ABORT) {
2067             /* Abort all pending cmds */
2068             for (i = 0; i < s->fw_cmds; i++) {
2069                 megasas_abort_command(&s->frames[i]);
2070             }
2071         }
2072         if (val & MFI_FWINIT_READY) {
2073             /* move to FW READY */
2074             megasas_soft_reset(s);
2075         }
2076         if (val & MFI_FWINIT_MFIMODE) {
2077             /* discard MFIs */
2078         }
2079         if (val & MFI_FWINIT_STOP_ADP) {
2080             /* Terminal error, stop processing */
2081             s->fw_state = MFI_FWSTATE_FAULT;
2082         }
2083         break;
2084     case MFI_OMSK:
2085         trace_megasas_mmio_writel("MFI_OMSK", val);
2086         s->intr_mask = val;
2087         if (!megasas_intr_enabled(s) &&
2088             !msi_enabled(pci_dev) &&
2089             !msix_enabled(pci_dev)) {
2090             trace_megasas_irq_lower();
2091             pci_irq_deassert(pci_dev);
2092         }
2093         if (megasas_intr_enabled(s)) {
2094             if (msix_enabled(pci_dev)) {
2095                 trace_megasas_msix_enabled(0);
2096             } else if (msi_enabled(pci_dev)) {
2097                 trace_megasas_msi_enabled(0);
2098             } else {
2099                 trace_megasas_intr_enabled();
2100             }
2101         } else {
2102             trace_megasas_intr_disabled();
2103             megasas_soft_reset(s);
2104         }
2105         break;
2106     case MFI_ODCR0:
2107         trace_megasas_mmio_writel("MFI_ODCR0", val);
2108         s->doorbell = 0;
2109         if (megasas_intr_enabled(s)) {
2110             if (!msix_enabled(pci_dev) && !msi_enabled(pci_dev)) {
2111                 trace_megasas_irq_lower();
2112                 pci_irq_deassert(pci_dev);
2113             }
2114         }
2115         break;
2116     case MFI_IQPH:
2117         trace_megasas_mmio_writel("MFI_IQPH", val);
2118         /* Received high 32 bits of a 64 bit MFI frame address */
2119         s->frame_hi = val;
2120         break;
2121     case MFI_IQPL:
2122         trace_megasas_mmio_writel("MFI_IQPL", val);
2123         /* Received low 32 bits of a 64 bit MFI frame address */
2124         /* Fallthrough */
2125     case MFI_IQP:
2126         if (addr == MFI_IQP) {
2127             trace_megasas_mmio_writel("MFI_IQP", val);
2128             /* Received 64 bit MFI frame address */
2129             s->frame_hi = 0;
2130         }
2131         frame_addr = (val & ~0x1F);
2132         /* Add possible 64 bit offset */
2133         frame_addr |= ((uint64_t)s->frame_hi << 32);
2134         s->frame_hi = 0;
2135         frame_count = (val >> 1) & 0xF;
2136         megasas_handle_frame(s, frame_addr, frame_count);
2137         break;
2138     case MFI_SEQ:
2139         trace_megasas_mmio_writel("MFI_SEQ", val);
2140         /* Magic sequence to start ADP reset */
2141         if (adp_reset_seq[s->adp_reset++] == val) {
2142             if (s->adp_reset == 6) {
2143                 s->adp_reset = 0;
2144                 s->diag = MFI_DIAG_WRITE_ENABLE;
2145             }
2146         } else {
2147             s->adp_reset = 0;
2148             s->diag = 0;
2149         }
2150         break;
2151     case MFI_DIAG:
2152         trace_megasas_mmio_writel("MFI_DIAG", val);
2153         /* ADP reset */
2154         if ((s->diag & MFI_DIAG_WRITE_ENABLE) &&
2155             (val & MFI_DIAG_RESET_ADP)) {
2156             s->diag |= MFI_DIAG_RESET_ADP;
2157             megasas_soft_reset(s);
2158             s->adp_reset = 0;
2159             s->diag = 0;
2160         }
2161         break;
2162     default:
2163         trace_megasas_mmio_invalid_writel(addr, val);
2164         break;
2165     }
2166 }
2167 
2168 static const MemoryRegionOps megasas_mmio_ops = {
2169     .read = megasas_mmio_read,
2170     .write = megasas_mmio_write,
2171     .endianness = DEVICE_LITTLE_ENDIAN,
2172     .impl = {
2173         .min_access_size = 8,
2174         .max_access_size = 8,
2175     }
2176 };
2177 
2178 static uint64_t megasas_port_read(void *opaque, hwaddr addr,
2179                                   unsigned size)
2180 {
2181     return megasas_mmio_read(opaque, addr & 0xff, size);
2182 }
2183 
2184 static void megasas_port_write(void *opaque, hwaddr addr,
2185                                uint64_t val, unsigned size)
2186 {
2187     megasas_mmio_write(opaque, addr & 0xff, val, size);
2188 }
2189 
2190 static const MemoryRegionOps megasas_port_ops = {
2191     .read = megasas_port_read,
2192     .write = megasas_port_write,
2193     .endianness = DEVICE_LITTLE_ENDIAN,
2194     .impl = {
2195         .min_access_size = 4,
2196         .max_access_size = 4,
2197     }
2198 };
2199 
2200 static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
2201                                    unsigned size)
2202 {
2203     return 0;
2204 }
2205 
2206 static void megasas_queue_write(void *opaque, hwaddr addr,
2207                                uint64_t val, unsigned size)
2208 {
2209     return;
2210 }
2211 
2212 static const MemoryRegionOps megasas_queue_ops = {
2213     .read = megasas_queue_read,
2214     .write = megasas_queue_write,
2215     .endianness = DEVICE_LITTLE_ENDIAN,
2216     .impl = {
2217         .min_access_size = 8,
2218         .max_access_size = 8,
2219     }
2220 };
2221 
2222 static void megasas_soft_reset(MegasasState *s)
2223 {
2224     int i;
2225     MegasasCmd *cmd;
2226 
2227     trace_megasas_reset(s->fw_state);
2228     for (i = 0; i < s->fw_cmds; i++) {
2229         cmd = &s->frames[i];
2230         megasas_abort_command(cmd);
2231     }
2232     if (s->fw_state == MFI_FWSTATE_READY) {
2233         BusChild *kid;
2234 
2235         /*
2236          * The EFI firmware doesn't handle UA,
2237          * so we need to clear the Power On/Reset UA
2238          * after the initial reset.
2239          */
2240         QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
2241             SCSIDevice *sdev = SCSI_DEVICE(kid->child);
2242 
2243             sdev->unit_attention = SENSE_CODE(NO_SENSE);
2244             scsi_device_unit_attention_reported(sdev);
2245         }
2246     }
2247     megasas_reset_frames(s);
2248     s->reply_queue_len = s->fw_cmds;
2249     s->reply_queue_pa = 0;
2250     s->consumer_pa = 0;
2251     s->producer_pa = 0;
2252     s->fw_state = MFI_FWSTATE_READY;
2253     s->doorbell = 0;
2254     s->intr_mask = MEGASAS_INTR_DISABLED_MASK;
2255     s->frame_hi = 0;
2256     s->flags &= ~MEGASAS_MASK_USE_QUEUE64;
2257     s->event_count++;
2258     s->boot_event = s->event_count;
2259 }
2260 
2261 static void megasas_scsi_reset(DeviceState *dev)
2262 {
2263     MegasasState *s = MEGASAS(dev);
2264 
2265     megasas_soft_reset(s);
2266 }
2267 
2268 static const VMStateDescription vmstate_megasas_gen1 = {
2269     .name = "megasas",
2270     .version_id = 0,
2271     .minimum_version_id = 0,
2272     .fields = (VMStateField[]) {
2273         VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2274         VMSTATE_MSIX(parent_obj, MegasasState),
2275 
2276         VMSTATE_INT32(fw_state, MegasasState),
2277         VMSTATE_INT32(intr_mask, MegasasState),
2278         VMSTATE_INT32(doorbell, MegasasState),
2279         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2280         VMSTATE_UINT64(consumer_pa, MegasasState),
2281         VMSTATE_UINT64(producer_pa, MegasasState),
2282         VMSTATE_END_OF_LIST()
2283     }
2284 };
2285 
2286 static const VMStateDescription vmstate_megasas_gen2 = {
2287     .name = "megasas-gen2",
2288     .version_id = 0,
2289     .minimum_version_id = 0,
2290     .minimum_version_id_old = 0,
2291     .fields      = (VMStateField[]) {
2292         VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2293         VMSTATE_MSIX(parent_obj, MegasasState),
2294 
2295         VMSTATE_INT32(fw_state, MegasasState),
2296         VMSTATE_INT32(intr_mask, MegasasState),
2297         VMSTATE_INT32(doorbell, MegasasState),
2298         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2299         VMSTATE_UINT64(consumer_pa, MegasasState),
2300         VMSTATE_UINT64(producer_pa, MegasasState),
2301         VMSTATE_END_OF_LIST()
2302     }
2303 };
2304 
2305 static void megasas_scsi_uninit(PCIDevice *d)
2306 {
2307     MegasasState *s = MEGASAS(d);
2308 
2309     if (megasas_use_msix(s)) {
2310         msix_uninit(d, &s->mmio_io, &s->mmio_io);
2311     }
2312     msi_uninit(d);
2313 }
2314 
2315 static const struct SCSIBusInfo megasas_scsi_info = {
2316     .tcq = true,
2317     .max_target = MFI_MAX_LD,
2318     .max_lun = 255,
2319 
2320     .transfer_data = megasas_xfer_complete,
2321     .get_sg_list = megasas_get_sg_list,
2322     .complete = megasas_command_complete,
2323     .cancel = megasas_command_cancelled,
2324 };
2325 
2326 static void megasas_scsi_realize(PCIDevice *dev, Error **errp)
2327 {
2328     MegasasState *s = MEGASAS(dev);
2329     MegasasBaseClass *b = MEGASAS_DEVICE_GET_CLASS(s);
2330     uint8_t *pci_conf;
2331     int i, bar_type;
2332     Error *err = NULL;
2333     int ret;
2334 
2335     pci_conf = dev->config;
2336 
2337     /* PCI latency timer = 0 */
2338     pci_conf[PCI_LATENCY_TIMER] = 0;
2339     /* Interrupt pin 1 */
2340     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2341 
2342     if (s->msi != ON_OFF_AUTO_OFF) {
2343         ret = msi_init(dev, 0x50, 1, true, false, &err);
2344         /* Any error other than -ENOTSUP(board's MSI support is broken)
2345          * is a programming error */
2346         assert(!ret || ret == -ENOTSUP);
2347         if (ret && s->msi == ON_OFF_AUTO_ON) {
2348             /* Can't satisfy user's explicit msi=on request, fail */
2349             error_append_hint(&err, "You have to use msi=auto (default) or "
2350                     "msi=off with this machine type.\n");
2351             error_propagate(errp, err);
2352             return;
2353         } else if (ret) {
2354             /* With msi=auto, we fall back to MSI off silently */
2355             s->msi = ON_OFF_AUTO_OFF;
2356             error_free(err);
2357         }
2358     }
2359 
2360     memory_region_init_io(&s->mmio_io, OBJECT(s), &megasas_mmio_ops, s,
2361                           "megasas-mmio", 0x4000);
2362     memory_region_init_io(&s->port_io, OBJECT(s), &megasas_port_ops, s,
2363                           "megasas-io", 256);
2364     memory_region_init_io(&s->queue_io, OBJECT(s), &megasas_queue_ops, s,
2365                           "megasas-queue", 0x40000);
2366 
2367     if (megasas_use_msix(s) &&
2368         msix_init(dev, 15, &s->mmio_io, b->mmio_bar, 0x2000,
2369                   &s->mmio_io, b->mmio_bar, 0x3800, 0x68, NULL)) {
2370         /* TODO: check msix_init's error, and should fail on msix=on */
2371         s->msix = ON_OFF_AUTO_OFF;
2372     }
2373 
2374     if (pci_is_express(dev)) {
2375         pcie_endpoint_cap_init(dev, 0xa0);
2376     }
2377 
2378     bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
2379     pci_register_bar(dev, b->ioport_bar,
2380                      PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
2381     pci_register_bar(dev, b->mmio_bar, bar_type, &s->mmio_io);
2382     pci_register_bar(dev, 3, bar_type, &s->queue_io);
2383 
2384     if (megasas_use_msix(s)) {
2385         msix_vector_use(dev, 0);
2386     }
2387 
2388     s->fw_state = MFI_FWSTATE_READY;
2389     if (!s->sas_addr) {
2390         s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
2391                        IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
2392         s->sas_addr |= (pci_bus_num(dev->bus) << 16);
2393         s->sas_addr |= (PCI_SLOT(dev->devfn) << 8);
2394         s->sas_addr |= PCI_FUNC(dev->devfn);
2395     }
2396     if (!s->hba_serial) {
2397         s->hba_serial = g_strdup(MEGASAS_HBA_SERIAL);
2398     }
2399     if (s->fw_sge >= MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE) {
2400         s->fw_sge = MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE;
2401     } else if (s->fw_sge >= 128 - MFI_PASS_FRAME_SIZE) {
2402         s->fw_sge = 128 - MFI_PASS_FRAME_SIZE;
2403     } else {
2404         s->fw_sge = 64 - MFI_PASS_FRAME_SIZE;
2405     }
2406     if (s->fw_cmds > MEGASAS_MAX_FRAMES) {
2407         s->fw_cmds = MEGASAS_MAX_FRAMES;
2408     }
2409     trace_megasas_init(s->fw_sge, s->fw_cmds,
2410                        megasas_is_jbod(s) ? "jbod" : "raid");
2411 
2412     if (megasas_is_jbod(s)) {
2413         s->fw_luns = MFI_MAX_SYS_PDS;
2414     } else {
2415         s->fw_luns = MFI_MAX_LD;
2416     }
2417     s->producer_pa = 0;
2418     s->consumer_pa = 0;
2419     for (i = 0; i < s->fw_cmds; i++) {
2420         s->frames[i].index = i;
2421         s->frames[i].context = -1;
2422         s->frames[i].pa = 0;
2423         s->frames[i].state = s;
2424     }
2425 
2426     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev),
2427                  &megasas_scsi_info, NULL);
2428 }
2429 
2430 static Property megasas_properties_gen1[] = {
2431     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2432                        MEGASAS_DEFAULT_SGE),
2433     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2434                        MEGASAS_DEFAULT_FRAMES),
2435     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2436     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2437     DEFINE_PROP_ON_OFF_AUTO("msi", MegasasState, msi, ON_OFF_AUTO_AUTO),
2438     DEFINE_PROP_ON_OFF_AUTO("msix", MegasasState, msix, ON_OFF_AUTO_AUTO),
2439     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2440                     MEGASAS_FLAG_USE_JBOD, false),
2441     DEFINE_PROP_END_OF_LIST(),
2442 };
2443 
2444 static Property megasas_properties_gen2[] = {
2445     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2446                        MEGASAS_DEFAULT_SGE),
2447     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2448                        MEGASAS_GEN2_DEFAULT_FRAMES),
2449     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2450     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2451     DEFINE_PROP_ON_OFF_AUTO("msi", MegasasState, msi, ON_OFF_AUTO_AUTO),
2452     DEFINE_PROP_ON_OFF_AUTO("msix", MegasasState, msix, ON_OFF_AUTO_AUTO),
2453     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2454                     MEGASAS_FLAG_USE_JBOD, false),
2455     DEFINE_PROP_END_OF_LIST(),
2456 };
2457 
2458 typedef struct MegasasInfo {
2459     const char *name;
2460     const char *desc;
2461     const char *product_name;
2462     const char *product_version;
2463     uint16_t device_id;
2464     uint16_t subsystem_id;
2465     int ioport_bar;
2466     int mmio_bar;
2467     bool is_express;
2468     int osts;
2469     const VMStateDescription *vmsd;
2470     Property *props;
2471 } MegasasInfo;
2472 
2473 static struct MegasasInfo megasas_devices[] = {
2474     {
2475         .name = TYPE_MEGASAS_GEN1,
2476         .desc = "LSI MegaRAID SAS 1078",
2477         .product_name = "LSI MegaRAID SAS 8708EM2",
2478         .product_version = MEGASAS_VERSION_GEN1,
2479         .device_id = PCI_DEVICE_ID_LSI_SAS1078,
2480         .subsystem_id = 0x1013,
2481         .ioport_bar = 2,
2482         .mmio_bar = 0,
2483         .osts = MFI_1078_RM | 1,
2484         .is_express = false,
2485         .vmsd = &vmstate_megasas_gen1,
2486         .props = megasas_properties_gen1,
2487     },{
2488         .name = TYPE_MEGASAS_GEN2,
2489         .desc = "LSI MegaRAID SAS 2108",
2490         .product_name = "LSI MegaRAID SAS 9260-8i",
2491         .product_version = MEGASAS_VERSION_GEN2,
2492         .device_id = PCI_DEVICE_ID_LSI_SAS0079,
2493         .subsystem_id = 0x9261,
2494         .ioport_bar = 0,
2495         .mmio_bar = 1,
2496         .osts = MFI_GEN2_RM,
2497         .is_express = true,
2498         .vmsd = &vmstate_megasas_gen2,
2499         .props = megasas_properties_gen2,
2500     }
2501 };
2502 
2503 static void megasas_class_init(ObjectClass *oc, void *data)
2504 {
2505     DeviceClass *dc = DEVICE_CLASS(oc);
2506     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
2507     MegasasBaseClass *e = MEGASAS_DEVICE_CLASS(oc);
2508     const MegasasInfo *info = data;
2509 
2510     pc->realize = megasas_scsi_realize;
2511     pc->exit = megasas_scsi_uninit;
2512     pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2513     pc->device_id = info->device_id;
2514     pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2515     pc->subsystem_id = info->subsystem_id;
2516     pc->class_id = PCI_CLASS_STORAGE_RAID;
2517     pc->is_express = info->is_express;
2518     e->mmio_bar = info->mmio_bar;
2519     e->ioport_bar = info->ioport_bar;
2520     e->osts = info->osts;
2521     e->product_name = info->product_name;
2522     e->product_version = info->product_version;
2523     dc->props = info->props;
2524     dc->reset = megasas_scsi_reset;
2525     dc->vmsd = info->vmsd;
2526     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2527     dc->desc = info->desc;
2528 }
2529 
2530 static const TypeInfo megasas_info = {
2531     .name  = TYPE_MEGASAS_BASE,
2532     .parent = TYPE_PCI_DEVICE,
2533     .instance_size = sizeof(MegasasState),
2534     .class_size = sizeof(MegasasBaseClass),
2535     .abstract = true,
2536 };
2537 
2538 static void megasas_register_types(void)
2539 {
2540     int i;
2541 
2542     type_register_static(&megasas_info);
2543     for (i = 0; i < ARRAY_SIZE(megasas_devices); i++) {
2544         const MegasasInfo *info = &megasas_devices[i];
2545         TypeInfo type_info = {};
2546 
2547         type_info.name = info->name;
2548         type_info.parent = TYPE_MEGASAS_BASE;
2549         type_info.class_data = (void *)info;
2550         type_info.class_init = megasas_class_init;
2551 
2552         type_register(&type_info);
2553     }
2554 }
2555 
2556 type_init(megasas_register_types)
2557