xref: /openbmc/qemu/hw/scsi/megasas.c (revision b45c03f5) 
1 /*
2  * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation
3  * Based on the linux driver code at drivers/scsi/megaraid
4  *
5  * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
6  *
7  * This library is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2 of the License, or (at your option) any later version.
11  *
12  * This library is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "hw/hw.h"
22 #include "hw/pci/pci.h"
23 #include "sysemu/dma.h"
24 #include "sysemu/block-backend.h"
25 #include "hw/pci/msi.h"
26 #include "hw/pci/msix.h"
27 #include "qemu/iov.h"
28 #include "hw/scsi/scsi.h"
29 #include "block/scsi.h"
30 #include "trace.h"
31 
32 #include "mfi.h"
33 
34 #define MEGASAS_VERSION_GEN1 "1.70"
35 #define MEGASAS_VERSION_GEN2 "1.80"
36 #define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */
37 #define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */
38 #define MEGASAS_GEN2_DEFAULT_FRAMES 1008     /* Windows requires this */
39 #define MEGASAS_MAX_SGE 128             /* Firmware limit */
40 #define MEGASAS_DEFAULT_SGE 80
41 #define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */
42 #define MEGASAS_MAX_ARRAYS 128
43 
44 #define MEGASAS_HBA_SERIAL "QEMU123456"
45 #define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
46 #define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
47 
48 #define MEGASAS_FLAG_USE_JBOD      0
49 #define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)
50 #define MEGASAS_FLAG_USE_MSI       1
51 #define MEGASAS_MASK_USE_MSI       (1 << MEGASAS_FLAG_USE_MSI)
52 #define MEGASAS_FLAG_USE_MSIX      2
53 #define MEGASAS_MASK_USE_MSIX      (1 << MEGASAS_FLAG_USE_MSIX)
54 #define MEGASAS_FLAG_USE_QUEUE64   3
55 #define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)
56 
57 static const char *mfi_frame_desc[] = {
58     "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",
59     "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"};
60 
61 typedef struct MegasasCmd {
62     uint32_t index;
63     uint16_t flags;
64     uint16_t count;
65     uint64_t context;
66 
67     hwaddr pa;
68     hwaddr pa_size;
69     union mfi_frame *frame;
70     SCSIRequest *req;
71     QEMUSGList qsg;
72     void *iov_buf;
73     size_t iov_size;
74     size_t iov_offset;
75     struct MegasasState *state;
76 } MegasasCmd;
77 
78 typedef struct MegasasState {
79     /*< private >*/
80     PCIDevice parent_obj;
81     /*< public >*/
82 
83     MemoryRegion mmio_io;
84     MemoryRegion port_io;
85     MemoryRegion queue_io;
86     uint32_t frame_hi;
87 
88     int fw_state;
89     uint32_t fw_sge;
90     uint32_t fw_cmds;
91     uint32_t flags;
92     int fw_luns;
93     int intr_mask;
94     int doorbell;
95     int busy;
96     int diag;
97     int adp_reset;
98 
99     MegasasCmd *event_cmd;
100     int event_locale;
101     int event_class;
102     int event_count;
103     int shutdown_event;
104     int boot_event;
105 
106     uint64_t sas_addr;
107     char *hba_serial;
108 
109     uint64_t reply_queue_pa;
110     void *reply_queue;
111     int reply_queue_len;
112     int reply_queue_head;
113     int reply_queue_tail;
114     uint64_t consumer_pa;
115     uint64_t producer_pa;
116 
117     MegasasCmd frames[MEGASAS_MAX_FRAMES];
118     DECLARE_BITMAP(frame_map, MEGASAS_MAX_FRAMES);
119     SCSIBus bus;
120 } MegasasState;
121 
122 typedef struct MegasasBaseClass {
123     PCIDeviceClass parent_class;
124     const char *product_name;
125     const char *product_version;
126     int mmio_bar;
127     int ioport_bar;
128     int osts;
129 } MegasasBaseClass;
130 
131 #define TYPE_MEGASAS_BASE "megasas-base"
132 #define TYPE_MEGASAS_GEN1 "megasas"
133 #define TYPE_MEGASAS_GEN2 "megasas-gen2"
134 
135 #define MEGASAS(obj) \
136     OBJECT_CHECK(MegasasState, (obj), TYPE_MEGASAS_BASE)
137 
138 #define MEGASAS_DEVICE_CLASS(oc) \
139     OBJECT_CLASS_CHECK(MegasasBaseClass, (oc), TYPE_MEGASAS_BASE)
140 #define MEGASAS_DEVICE_GET_CLASS(oc) \
141     OBJECT_GET_CLASS(MegasasBaseClass, (oc), TYPE_MEGASAS_BASE)
142 
143 #define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
144 
145 static bool megasas_intr_enabled(MegasasState *s)
146 {
147     if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=
148         MEGASAS_INTR_DISABLED_MASK) {
149         return true;
150     }
151     return false;
152 }
153 
154 static bool megasas_use_queue64(MegasasState *s)
155 {
156     return s->flags & MEGASAS_MASK_USE_QUEUE64;
157 }
158 
159 static bool megasas_use_msi(MegasasState *s)
160 {
161     return s->flags & MEGASAS_MASK_USE_MSI;
162 }
163 
164 static bool megasas_use_msix(MegasasState *s)
165 {
166     return s->flags & MEGASAS_MASK_USE_MSIX;
167 }
168 
169 static bool megasas_is_jbod(MegasasState *s)
170 {
171     return s->flags & MEGASAS_MASK_USE_JBOD;
172 }
173 
174 static void megasas_frame_set_cmd_status(MegasasState *s,
175                                          unsigned long frame, uint8_t v)
176 {
177     PCIDevice *pci = &s->parent_obj;
178     stb_pci_dma(pci, frame + offsetof(struct mfi_frame_header, cmd_status), v);
179 }
180 
181 static void megasas_frame_set_scsi_status(MegasasState *s,
182                                           unsigned long frame, uint8_t v)
183 {
184     PCIDevice *pci = &s->parent_obj;
185     stb_pci_dma(pci, frame + offsetof(struct mfi_frame_header, scsi_status), v);
186 }
187 
188 /*
189  * Context is considered opaque, but the HBA firmware is running
190  * in little endian mode. So convert it to little endian, too.
191  */
192 static uint64_t megasas_frame_get_context(MegasasState *s,
193                                           unsigned long frame)
194 {
195     PCIDevice *pci = &s->parent_obj;
196     return ldq_le_pci_dma(pci, frame + offsetof(struct mfi_frame_header, context));
197 }
198 
199 static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)
200 {
201     return cmd->flags & MFI_FRAME_IEEE_SGL;
202 }
203 
204 static bool megasas_frame_is_sgl64(MegasasCmd *cmd)
205 {
206     return cmd->flags & MFI_FRAME_SGL64;
207 }
208 
209 static bool megasas_frame_is_sense64(MegasasCmd *cmd)
210 {
211     return cmd->flags & MFI_FRAME_SENSE64;
212 }
213 
214 static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,
215                                      union mfi_sgl *sgl)
216 {
217     uint64_t addr;
218 
219     if (megasas_frame_is_ieee_sgl(cmd)) {
220         addr = le64_to_cpu(sgl->sg_skinny->addr);
221     } else if (megasas_frame_is_sgl64(cmd)) {
222         addr = le64_to_cpu(sgl->sg64->addr);
223     } else {
224         addr = le32_to_cpu(sgl->sg32->addr);
225     }
226     return addr;
227 }
228 
229 static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,
230                                     union mfi_sgl *sgl)
231 {
232     uint32_t len;
233 
234     if (megasas_frame_is_ieee_sgl(cmd)) {
235         len = le32_to_cpu(sgl->sg_skinny->len);
236     } else if (megasas_frame_is_sgl64(cmd)) {
237         len = le32_to_cpu(sgl->sg64->len);
238     } else {
239         len = le32_to_cpu(sgl->sg32->len);
240     }
241     return len;
242 }
243 
244 static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,
245                                        union mfi_sgl *sgl)
246 {
247     uint8_t *next = (uint8_t *)sgl;
248 
249     if (megasas_frame_is_ieee_sgl(cmd)) {
250         next += sizeof(struct mfi_sg_skinny);
251     } else if (megasas_frame_is_sgl64(cmd)) {
252         next += sizeof(struct mfi_sg64);
253     } else {
254         next += sizeof(struct mfi_sg32);
255     }
256 
257     if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {
258         return NULL;
259     }
260     return (union mfi_sgl *)next;
261 }
262 
263 static void megasas_soft_reset(MegasasState *s);
264 
265 static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
266 {
267     int i;
268     int iov_count = 0;
269     size_t iov_size = 0;
270 
271     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
272     iov_count = cmd->frame->header.sge_count;
273     if (iov_count > MEGASAS_MAX_SGE) {
274         trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,
275                                          MEGASAS_MAX_SGE);
276         return iov_count;
277     }
278     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), iov_count);
279     for (i = 0; i < iov_count; i++) {
280         dma_addr_t iov_pa, iov_size_p;
281 
282         if (!sgl) {
283             trace_megasas_iovec_sgl_underflow(cmd->index, i);
284             goto unmap;
285         }
286         iov_pa = megasas_sgl_get_addr(cmd, sgl);
287         iov_size_p = megasas_sgl_get_len(cmd, sgl);
288         if (!iov_pa || !iov_size_p) {
289             trace_megasas_iovec_sgl_invalid(cmd->index, i,
290                                             iov_pa, iov_size_p);
291             goto unmap;
292         }
293         qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);
294         sgl = megasas_sgl_next(cmd, sgl);
295         iov_size += (size_t)iov_size_p;
296     }
297     if (cmd->iov_size > iov_size) {
298         trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
299     } else if (cmd->iov_size < iov_size) {
300         trace_megasas_iovec_underflow(cmd->iov_size, iov_size, cmd->iov_size);
301     }
302     cmd->iov_offset = 0;
303     return 0;
304 unmap:
305     qemu_sglist_destroy(&cmd->qsg);
306     return iov_count - i;
307 }
308 
309 static void megasas_unmap_sgl(MegasasCmd *cmd)
310 {
311     qemu_sglist_destroy(&cmd->qsg);
312     cmd->iov_offset = 0;
313 }
314 
315 /*
316  * passthrough sense and io sense are at the same offset
317  */
318 static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,
319     uint8_t sense_len)
320 {
321     PCIDevice *pcid = PCI_DEVICE(cmd->state);
322     uint32_t pa_hi = 0, pa_lo;
323     hwaddr pa;
324 
325     if (sense_len > cmd->frame->header.sense_len) {
326         sense_len = cmd->frame->header.sense_len;
327     }
328     if (sense_len) {
329         pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);
330         if (megasas_frame_is_sense64(cmd)) {
331             pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);
332         }
333         pa = ((uint64_t) pa_hi << 32) | pa_lo;
334         pci_dma_write(pcid, pa, sense_ptr, sense_len);
335         cmd->frame->header.sense_len = sense_len;
336     }
337     return sense_len;
338 }
339 
340 static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)
341 {
342     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
343     uint8_t sense_len = 18;
344 
345     memset(sense_buf, 0, sense_len);
346     sense_buf[0] = 0xf0;
347     sense_buf[2] = sense.key;
348     sense_buf[7] = 10;
349     sense_buf[12] = sense.asc;
350     sense_buf[13] = sense.ascq;
351     megasas_build_sense(cmd, sense_buf, sense_len);
352 }
353 
354 static void megasas_copy_sense(MegasasCmd *cmd)
355 {
356     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
357     uint8_t sense_len;
358 
359     sense_len = scsi_req_get_sense(cmd->req, sense_buf,
360                                    SCSI_SENSE_BUF_SIZE);
361     megasas_build_sense(cmd, sense_buf, sense_len);
362 }
363 
364 /*
365  * Format an INQUIRY CDB
366  */
367 static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)
368 {
369     memset(cdb, 0, 6);
370     cdb[0] = INQUIRY;
371     if (pg > 0) {
372         cdb[1] = 0x1;
373         cdb[2] = pg;
374     }
375     cdb[3] = (len >> 8) & 0xff;
376     cdb[4] = (len & 0xff);
377     return len;
378 }
379 
380 /*
381  * Encode lba and len into a READ_16/WRITE_16 CDB
382  */
383 static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,
384                                uint32_t len, bool is_write)
385 {
386     memset(cdb, 0x0, 16);
387     if (is_write) {
388         cdb[0] = WRITE_16;
389     } else {
390         cdb[0] = READ_16;
391     }
392     cdb[2] = (lba >> 56) & 0xff;
393     cdb[3] = (lba >> 48) & 0xff;
394     cdb[4] = (lba >> 40) & 0xff;
395     cdb[5] = (lba >> 32) & 0xff;
396     cdb[6] = (lba >> 24) & 0xff;
397     cdb[7] = (lba >> 16) & 0xff;
398     cdb[8] = (lba >> 8) & 0xff;
399     cdb[9] = (lba) & 0xff;
400     cdb[10] = (len >> 24) & 0xff;
401     cdb[11] = (len >> 16) & 0xff;
402     cdb[12] = (len >> 8) & 0xff;
403     cdb[13] = (len) & 0xff;
404 }
405 
406 /*
407  * Utility functions
408  */
409 static uint64_t megasas_fw_time(void)
410 {
411     struct tm curtime;
412     uint64_t bcd_time;
413 
414     qemu_get_timedate(&curtime, 0);
415     bcd_time = ((uint64_t)curtime.tm_sec & 0xff) << 48 |
416         ((uint64_t)curtime.tm_min & 0xff)  << 40 |
417         ((uint64_t)curtime.tm_hour & 0xff) << 32 |
418         ((uint64_t)curtime.tm_mday & 0xff) << 24 |
419         ((uint64_t)curtime.tm_mon & 0xff)  << 16 |
420         ((uint64_t)(curtime.tm_year + 1900) & 0xffff);
421 
422     return bcd_time;
423 }
424 
425 /*
426  * Default disk sata address
427  * 0x1221 is the magic number as
428  * present in real hardware,
429  * so use it here, too.
430  */
431 static uint64_t megasas_get_sata_addr(uint16_t id)
432 {
433     uint64_t addr = (0x1221ULL << 48);
434     return addr & (id << 24);
435 }
436 
437 /*
438  * Frame handling
439  */
440 static int megasas_next_index(MegasasState *s, int index, int limit)
441 {
442     index++;
443     if (index == limit) {
444         index = 0;
445     }
446     return index;
447 }
448 
449 static MegasasCmd *megasas_lookup_frame(MegasasState *s,
450     hwaddr frame)
451 {
452     MegasasCmd *cmd = NULL;
453     int num = 0, index;
454 
455     index = s->reply_queue_head;
456 
457     while (num < s->fw_cmds) {
458         if (s->frames[index].pa && s->frames[index].pa == frame) {
459             cmd = &s->frames[index];
460             break;
461         }
462         index = megasas_next_index(s, index, s->fw_cmds);
463         num++;
464     }
465 
466     return cmd;
467 }
468 
469 static void megasas_unmap_frame(MegasasState *s, MegasasCmd *cmd)
470 {
471     PCIDevice *p = PCI_DEVICE(s);
472 
473     pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0);
474     cmd->frame = NULL;
475     cmd->pa = 0;
476     clear_bit(cmd->index, s->frame_map);
477 }
478 
479 /*
480  * This absolutely needs to be locked if
481  * qemu ever goes multithreaded.
482  */
483 static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
484     hwaddr frame, uint64_t context, int count)
485 {
486     PCIDevice *pcid = PCI_DEVICE(s);
487     MegasasCmd *cmd = NULL;
488     int frame_size = MFI_FRAME_SIZE * 16;
489     hwaddr frame_size_p = frame_size;
490     unsigned long index;
491 
492     index = 0;
493     while (index < s->fw_cmds) {
494         index = find_next_zero_bit(s->frame_map, s->fw_cmds, index);
495         if (!s->frames[index].pa)
496             break;
497         /* Busy frame found */
498         trace_megasas_qf_mapped(index);
499     }
500     if (index >= s->fw_cmds) {
501         /* All frames busy */
502         trace_megasas_qf_busy(frame);
503         return NULL;
504     }
505     cmd = &s->frames[index];
506     set_bit(index, s->frame_map);
507     trace_megasas_qf_new(index, frame);
508 
509     cmd->pa = frame;
510     /* Map all possible frames */
511     cmd->frame = pci_dma_map(pcid, frame, &frame_size_p, 0);
512     if (frame_size_p != frame_size) {
513         trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
514         if (cmd->frame) {
515             megasas_unmap_frame(s, cmd);
516         }
517         s->event_count++;
518         return NULL;
519     }
520     cmd->pa_size = frame_size_p;
521     cmd->context = context;
522     if (!megasas_use_queue64(s)) {
523         cmd->context &= (uint64_t)0xFFFFFFFF;
524     }
525     cmd->count = count;
526     s->busy++;
527 
528     if (s->consumer_pa) {
529         s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa);
530     }
531     trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,
532                              s->reply_queue_head, s->reply_queue_tail, s->busy);
533 
534     return cmd;
535 }
536 
537 static void megasas_complete_frame(MegasasState *s, uint64_t context)
538 {
539     PCIDevice *pci_dev = PCI_DEVICE(s);
540     int tail, queue_offset;
541 
542     /* Decrement busy count */
543     s->busy--;
544     if (s->reply_queue_pa) {
545         /*
546          * Put command on the reply queue.
547          * Context is opaque, but emulation is running in
548          * little endian. So convert it.
549          */
550         if (megasas_use_queue64(s)) {
551             queue_offset = s->reply_queue_head * sizeof(uint64_t);
552             stq_le_pci_dma(pci_dev, s->reply_queue_pa + queue_offset, context);
553         } else {
554             queue_offset = s->reply_queue_head * sizeof(uint32_t);
555             stl_le_pci_dma(pci_dev, s->reply_queue_pa + queue_offset, context);
556         }
557         s->reply_queue_tail = ldl_le_pci_dma(pci_dev, s->consumer_pa);
558         trace_megasas_qf_complete(context, s->reply_queue_head,
559                                   s->reply_queue_tail, s->busy);
560     }
561 
562     if (megasas_intr_enabled(s)) {
563         /* Update reply queue pointer */
564         s->reply_queue_tail = ldl_le_pci_dma(pci_dev, s->consumer_pa);
565         tail = s->reply_queue_head;
566         s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
567         trace_megasas_qf_update(s->reply_queue_head, s->reply_queue_tail,
568                                 s->busy);
569         stl_le_pci_dma(pci_dev, s->producer_pa, s->reply_queue_head);
570         /* Notify HBA */
571         if (msix_enabled(pci_dev)) {
572             trace_megasas_msix_raise(0);
573             msix_notify(pci_dev, 0);
574         } else if (msi_enabled(pci_dev)) {
575             trace_megasas_msi_raise(0);
576             msi_notify(pci_dev, 0);
577         } else {
578             s->doorbell++;
579             if (s->doorbell == 1) {
580                 trace_megasas_irq_raise();
581                 pci_irq_assert(pci_dev);
582             }
583         }
584     } else {
585         trace_megasas_qf_complete_noirq(context);
586     }
587 }
588 
589 static void megasas_reset_frames(MegasasState *s)
590 {
591     int i;
592     MegasasCmd *cmd;
593 
594     for (i = 0; i < s->fw_cmds; i++) {
595         cmd = &s->frames[i];
596         if (cmd->pa) {
597             megasas_unmap_frame(s, cmd);
598         }
599     }
600     bitmap_zero(s->frame_map, MEGASAS_MAX_FRAMES);
601 }
602 
603 static void megasas_abort_command(MegasasCmd *cmd)
604 {
605     if (cmd->req) {
606         scsi_req_cancel(cmd->req);
607         cmd->req = NULL;
608     }
609 }
610 
611 static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
612 {
613     PCIDevice *pcid = PCI_DEVICE(s);
614     uint32_t pa_hi, pa_lo;
615     hwaddr iq_pa, initq_size = sizeof(struct mfi_init_qinfo);
616     struct mfi_init_qinfo *initq = NULL;
617     uint32_t flags;
618     int ret = MFI_STAT_OK;
619 
620     if (s->reply_queue_pa) {
621         trace_megasas_initq_mapped(s->reply_queue_pa);
622         goto out;
623     }
624     pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);
625     pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);
626     iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);
627     trace_megasas_init_firmware((uint64_t)iq_pa);
628     initq = pci_dma_map(pcid, iq_pa, &initq_size, 0);
629     if (!initq || initq_size != sizeof(*initq)) {
630         trace_megasas_initq_map_failed(cmd->index);
631         s->event_count++;
632         ret = MFI_STAT_MEMORY_NOT_AVAILABLE;
633         goto out;
634     }
635     s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;
636     if (s->reply_queue_len > s->fw_cmds) {
637         trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);
638         s->event_count++;
639         ret = MFI_STAT_INVALID_PARAMETER;
640         goto out;
641     }
642     pa_lo = le32_to_cpu(initq->rq_addr_lo);
643     pa_hi = le32_to_cpu(initq->rq_addr_hi);
644     s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;
645     pa_lo = le32_to_cpu(initq->ci_addr_lo);
646     pa_hi = le32_to_cpu(initq->ci_addr_hi);
647     s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
648     pa_lo = le32_to_cpu(initq->pi_addr_lo);
649     pa_hi = le32_to_cpu(initq->pi_addr_hi);
650     s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
651     s->reply_queue_head = ldl_le_pci_dma(pcid, s->producer_pa);
652     s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa);
653     flags = le32_to_cpu(initq->flags);
654     if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
655         s->flags |= MEGASAS_MASK_USE_QUEUE64;
656     }
657     trace_megasas_init_queue((unsigned long)s->reply_queue_pa,
658                              s->reply_queue_len, s->reply_queue_head,
659                              s->reply_queue_tail, flags);
660     megasas_reset_frames(s);
661     s->fw_state = MFI_FWSTATE_OPERATIONAL;
662 out:
663     if (initq) {
664         pci_dma_unmap(pcid, initq, initq_size, 0, 0);
665     }
666     return ret;
667 }
668 
669 static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
670 {
671     dma_addr_t iov_pa, iov_size;
672 
673     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
674     if (!cmd->frame->header.sge_count) {
675         trace_megasas_dcmd_zero_sge(cmd->index);
676         cmd->iov_size = 0;
677         return 0;
678     } else if (cmd->frame->header.sge_count > 1) {
679         trace_megasas_dcmd_invalid_sge(cmd->index,
680                                        cmd->frame->header.sge_count);
681         cmd->iov_size = 0;
682         return -1;
683     }
684     iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
685     iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
686     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), 1);
687     qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
688     cmd->iov_size = iov_size;
689     return cmd->iov_size;
690 }
691 
692 static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
693 {
694     trace_megasas_finish_dcmd(cmd->index, iov_size);
695 
696     if (cmd->frame->header.sge_count) {
697         qemu_sglist_destroy(&cmd->qsg);
698     }
699     if (iov_size > cmd->iov_size) {
700         if (megasas_frame_is_ieee_sgl(cmd)) {
701             cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);
702         } else if (megasas_frame_is_sgl64(cmd)) {
703             cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);
704         } else {
705             cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);
706         }
707     }
708     cmd->iov_size = 0;
709 }
710 
711 static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
712 {
713     PCIDevice *pci_dev = PCI_DEVICE(s);
714     PCIDeviceClass *pci_class = PCI_DEVICE_GET_CLASS(pci_dev);
715     MegasasBaseClass *base_class = MEGASAS_DEVICE_GET_CLASS(s);
716     struct mfi_ctrl_info info;
717     size_t dcmd_size = sizeof(info);
718     BusChild *kid;
719     int num_pd_disks = 0;
720 
721     memset(&info, 0x0, cmd->iov_size);
722     if (cmd->iov_size < dcmd_size) {
723         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
724                                             dcmd_size);
725         return MFI_STAT_INVALID_PARAMETER;
726     }
727 
728     info.pci.vendor = cpu_to_le16(pci_class->vendor_id);
729     info.pci.device = cpu_to_le16(pci_class->device_id);
730     info.pci.subvendor = cpu_to_le16(pci_class->subsystem_vendor_id);
731     info.pci.subdevice = cpu_to_le16(pci_class->subsystem_id);
732 
733     /*
734      * For some reason the firmware supports
735      * only up to 8 device ports.
736      * Despite supporting a far larger number
737      * of devices for the physical devices.
738      * So just display the first 8 devices
739      * in the device port list, independent
740      * of how many logical devices are actually
741      * present.
742      */
743     info.host.type = MFI_INFO_HOST_PCIE;
744     info.device.type = MFI_INFO_DEV_SAS3G;
745     info.device.port_count = 8;
746     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
747         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
748         uint16_t pd_id;
749 
750         if (num_pd_disks < 8) {
751             pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
752             info.device.port_addr[num_pd_disks] =
753                 cpu_to_le64(megasas_get_sata_addr(pd_id));
754         }
755         num_pd_disks++;
756     }
757 
758     memcpy(info.product_name, base_class->product_name, 24);
759     snprintf(info.serial_number, 32, "%s", s->hba_serial);
760     snprintf(info.package_version, 0x60, "%s-QEMU", QEMU_VERSION);
761     memcpy(info.image_component[0].name, "APP", 3);
762     snprintf(info.image_component[0].version, 10, "%s-QEMU",
763              base_class->product_version);
764     memcpy(info.image_component[0].build_date, "Apr  1 2014", 11);
765     memcpy(info.image_component[0].build_time, "12:34:56", 8);
766     info.image_component_count = 1;
767     if (pci_dev->has_rom) {
768         uint8_t biosver[32];
769         uint8_t *ptr;
770 
771         ptr = memory_region_get_ram_ptr(&pci_dev->rom);
772         memcpy(biosver, ptr + 0x41, 31);
773         memcpy(info.image_component[1].name, "BIOS", 4);
774         memcpy(info.image_component[1].version, biosver,
775                strlen((const char *)biosver));
776         info.image_component_count++;
777     }
778     info.current_fw_time = cpu_to_le32(megasas_fw_time());
779     info.max_arms = 32;
780     info.max_spans = 8;
781     info.max_arrays = MEGASAS_MAX_ARRAYS;
782     info.max_lds = MFI_MAX_LD;
783     info.max_cmds = cpu_to_le16(s->fw_cmds);
784     info.max_sg_elements = cpu_to_le16(s->fw_sge);
785     info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);
786     if (!megasas_is_jbod(s))
787         info.lds_present = cpu_to_le16(num_pd_disks);
788     info.pd_present = cpu_to_le16(num_pd_disks);
789     info.pd_disks_present = cpu_to_le16(num_pd_disks);
790     info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |
791                                    MFI_INFO_HW_MEM |
792                                    MFI_INFO_HW_FLASH);
793     info.memory_size = cpu_to_le16(512);
794     info.nvram_size = cpu_to_le16(32);
795     info.flash_size = cpu_to_le16(16);
796     info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);
797     info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |
798                                     MFI_INFO_AOPS_SELF_DIAGNOSTIC |
799                                     MFI_INFO_AOPS_MIXED_ARRAY);
800     info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |
801                                MFI_INFO_LDOPS_ACCESS_POLICY |
802                                MFI_INFO_LDOPS_IO_POLICY |
803                                MFI_INFO_LDOPS_WRITE_POLICY |
804                                MFI_INFO_LDOPS_READ_POLICY);
805     info.max_strips_per_io = cpu_to_le16(s->fw_sge);
806     info.stripe_sz_ops.min = 3;
807     info.stripe_sz_ops.max = ctz32(MEGASAS_MAX_SECTORS + 1);
808     info.properties.pred_fail_poll_interval = cpu_to_le16(300);
809     info.properties.intr_throttle_cnt = cpu_to_le16(16);
810     info.properties.intr_throttle_timeout = cpu_to_le16(50);
811     info.properties.rebuild_rate = 30;
812     info.properties.patrol_read_rate = 30;
813     info.properties.bgi_rate = 30;
814     info.properties.cc_rate = 30;
815     info.properties.recon_rate = 30;
816     info.properties.cache_flush_interval = 4;
817     info.properties.spinup_drv_cnt = 2;
818     info.properties.spinup_delay = 6;
819     info.properties.ecc_bucket_size = 15;
820     info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);
821     info.properties.expose_encl_devices = 1;
822     info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);
823     info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |
824                                MFI_INFO_PDOPS_FORCE_OFFLINE);
825     info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |
826                                        MFI_INFO_PDMIX_SATA |
827                                        MFI_INFO_PDMIX_LD);
828 
829     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
830     return MFI_STAT_OK;
831 }
832 
833 static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)
834 {
835     struct mfi_defaults info;
836     size_t dcmd_size = sizeof(struct mfi_defaults);
837 
838     memset(&info, 0x0, dcmd_size);
839     if (cmd->iov_size < dcmd_size) {
840         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
841                                             dcmd_size);
842         return MFI_STAT_INVALID_PARAMETER;
843     }
844 
845     info.sas_addr = cpu_to_le64(s->sas_addr);
846     info.stripe_size = 3;
847     info.flush_time = 4;
848     info.background_rate = 30;
849     info.allow_mix_in_enclosure = 1;
850     info.allow_mix_in_ld = 1;
851     info.direct_pd_mapping = 1;
852     /* Enable for BIOS support */
853     info.bios_enumerate_lds = 1;
854     info.disable_ctrl_r = 1;
855     info.expose_enclosure_devices = 1;
856     info.disable_preboot_cli = 1;
857     info.cluster_disable = 1;
858 
859     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
860     return MFI_STAT_OK;
861 }
862 
863 static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)
864 {
865     struct mfi_bios_data info;
866     size_t dcmd_size = sizeof(info);
867 
868     memset(&info, 0x0, dcmd_size);
869     if (cmd->iov_size < dcmd_size) {
870         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
871                                             dcmd_size);
872         return MFI_STAT_INVALID_PARAMETER;
873     }
874     info.continue_on_error = 1;
875     info.verbose = 1;
876     if (megasas_is_jbod(s)) {
877         info.expose_all_drives = 1;
878     }
879 
880     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
881     return MFI_STAT_OK;
882 }
883 
884 static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)
885 {
886     uint64_t fw_time;
887     size_t dcmd_size = sizeof(fw_time);
888 
889     fw_time = cpu_to_le64(megasas_fw_time());
890 
891     cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);
892     return MFI_STAT_OK;
893 }
894 
895 static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)
896 {
897     uint64_t fw_time;
898 
899     /* This is a dummy; setting of firmware time is not allowed */
900     memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));
901 
902     trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);
903     fw_time = cpu_to_le64(megasas_fw_time());
904     return MFI_STAT_OK;
905 }
906 
907 static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)
908 {
909     struct mfi_evt_log_state info;
910     size_t dcmd_size = sizeof(info);
911 
912     memset(&info, 0, dcmd_size);
913 
914     info.newest_seq_num = cpu_to_le32(s->event_count);
915     info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
916     info.boot_seq_num = cpu_to_le32(s->boot_event);
917 
918     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
919     return MFI_STAT_OK;
920 }
921 
922 static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
923 {
924     union mfi_evt event;
925 
926     if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {
927         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
928                                             sizeof(struct mfi_evt_detail));
929         return MFI_STAT_INVALID_PARAMETER;
930     }
931     s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);
932     event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);
933     s->event_locale = event.members.locale;
934     s->event_class = event.members.class;
935     s->event_cmd = cmd;
936     /* Decrease busy count; event frame doesn't count here */
937     s->busy--;
938     cmd->iov_size = sizeof(struct mfi_evt_detail);
939     return MFI_STAT_INVALID_STATUS;
940 }
941 
942 static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
943 {
944     struct mfi_pd_list info;
945     size_t dcmd_size = sizeof(info);
946     BusChild *kid;
947     uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
948 
949     memset(&info, 0, dcmd_size);
950     offset = 8;
951     dcmd_limit = offset + sizeof(struct mfi_pd_address);
952     if (cmd->iov_size < dcmd_limit) {
953         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
954                                             dcmd_limit);
955         return MFI_STAT_INVALID_PARAMETER;
956     }
957 
958     max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);
959     if (max_pd_disks > MFI_MAX_SYS_PDS) {
960         max_pd_disks = MFI_MAX_SYS_PDS;
961     }
962     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
963         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
964         uint16_t pd_id;
965 
966         if (num_pd_disks >= max_pd_disks)
967             break;
968 
969         pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
970         info.addr[num_pd_disks].device_id = cpu_to_le16(pd_id);
971         info.addr[num_pd_disks].encl_device_id = 0xFFFF;
972         info.addr[num_pd_disks].encl_index = 0;
973         info.addr[num_pd_disks].slot_number = sdev->id & 0xFF;
974         info.addr[num_pd_disks].scsi_dev_type = sdev->type;
975         info.addr[num_pd_disks].connect_port_bitmap = 0x1;
976         info.addr[num_pd_disks].sas_addr[0] =
977             cpu_to_le64(megasas_get_sata_addr(pd_id));
978         num_pd_disks++;
979         offset += sizeof(struct mfi_pd_address);
980     }
981     trace_megasas_dcmd_pd_get_list(cmd->index, num_pd_disks,
982                                    max_pd_disks, offset);
983 
984     info.size = cpu_to_le32(offset);
985     info.count = cpu_to_le32(num_pd_disks);
986 
987     cmd->iov_size -= dma_buf_read((uint8_t *)&info, offset, &cmd->qsg);
988     return MFI_STAT_OK;
989 }
990 
991 static int megasas_dcmd_pd_list_query(MegasasState *s, MegasasCmd *cmd)
992 {
993     uint16_t flags;
994 
995     /* mbox0 contains flags */
996     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
997     trace_megasas_dcmd_pd_list_query(cmd->index, flags);
998     if (flags == MR_PD_QUERY_TYPE_ALL ||
999         megasas_is_jbod(s)) {
1000         return megasas_dcmd_pd_get_list(s, cmd);
1001     }
1002 
1003     return MFI_STAT_OK;
1004 }
1005 
1006 static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun,
1007                                       MegasasCmd *cmd)
1008 {
1009     struct mfi_pd_info *info = cmd->iov_buf;
1010     size_t dcmd_size = sizeof(struct mfi_pd_info);
1011     uint64_t pd_size;
1012     uint16_t pd_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1013     uint8_t cmdbuf[6];
1014     SCSIRequest *req;
1015     size_t len, resid;
1016 
1017     if (!cmd->iov_buf) {
1018         cmd->iov_buf = g_malloc0(dcmd_size);
1019         info = cmd->iov_buf;
1020         info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */
1021         info->vpd_page83[0] = 0x7f;
1022         megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data));
1023         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1024         if (!req) {
1025             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1026                                                 "PD get info std inquiry");
1027             g_free(cmd->iov_buf);
1028             cmd->iov_buf = NULL;
1029             return MFI_STAT_FLASH_ALLOC_FAIL;
1030         }
1031         trace_megasas_dcmd_internal_submit(cmd->index,
1032                                            "PD get info std inquiry", lun);
1033         len = scsi_req_enqueue(req);
1034         if (len > 0) {
1035             cmd->iov_size = len;
1036             scsi_req_continue(req);
1037         }
1038         return MFI_STAT_INVALID_STATUS;
1039     } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) {
1040         megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83));
1041         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1042         if (!req) {
1043             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1044                                                 "PD get info vpd inquiry");
1045             return MFI_STAT_FLASH_ALLOC_FAIL;
1046         }
1047         trace_megasas_dcmd_internal_submit(cmd->index,
1048                                            "PD get info vpd inquiry", lun);
1049         len = scsi_req_enqueue(req);
1050         if (len > 0) {
1051             cmd->iov_size = len;
1052             scsi_req_continue(req);
1053         }
1054         return MFI_STAT_INVALID_STATUS;
1055     }
1056     /* Finished, set FW state */
1057     if ((info->inquiry_data[0] >> 5) == 0) {
1058         if (megasas_is_jbod(cmd->state)) {
1059             info->fw_state = cpu_to_le16(MFI_PD_STATE_SYSTEM);
1060         } else {
1061             info->fw_state = cpu_to_le16(MFI_PD_STATE_ONLINE);
1062         }
1063     } else {
1064         info->fw_state = cpu_to_le16(MFI_PD_STATE_OFFLINE);
1065     }
1066 
1067     info->ref.v.device_id = cpu_to_le16(pd_id);
1068     info->state.ddf.pd_type = cpu_to_le16(MFI_PD_DDF_TYPE_IN_VD|
1069                                           MFI_PD_DDF_TYPE_INTF_SAS);
1070     blk_get_geometry(sdev->conf.blk, &pd_size);
1071     info->raw_size = cpu_to_le64(pd_size);
1072     info->non_coerced_size = cpu_to_le64(pd_size);
1073     info->coerced_size = cpu_to_le64(pd_size);
1074     info->encl_device_id = 0xFFFF;
1075     info->slot_number = (sdev->id & 0xFF);
1076     info->path_info.count = 1;
1077     info->path_info.sas_addr[0] =
1078         cpu_to_le64(megasas_get_sata_addr(pd_id));
1079     info->connected_port_bitmap = 0x1;
1080     info->device_speed = 1;
1081     info->link_speed = 1;
1082     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1083     g_free(cmd->iov_buf);
1084     cmd->iov_size = dcmd_size - resid;
1085     cmd->iov_buf = NULL;
1086     return MFI_STAT_OK;
1087 }
1088 
1089 static int megasas_dcmd_pd_get_info(MegasasState *s, MegasasCmd *cmd)
1090 {
1091     size_t dcmd_size = sizeof(struct mfi_pd_info);
1092     uint16_t pd_id;
1093     uint8_t target_id, lun_id;
1094     SCSIDevice *sdev = NULL;
1095     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1096 
1097     if (cmd->iov_size < dcmd_size) {
1098         return MFI_STAT_INVALID_PARAMETER;
1099     }
1100 
1101     /* mbox0 has the ID */
1102     pd_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1103     target_id = (pd_id >> 8) & 0xFF;
1104     lun_id = pd_id & 0xFF;
1105     sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
1106     trace_megasas_dcmd_pd_get_info(cmd->index, pd_id);
1107 
1108     if (sdev) {
1109         /* Submit inquiry */
1110         retval = megasas_pd_get_info_submit(sdev, pd_id, cmd);
1111     }
1112 
1113     return retval;
1114 }
1115 
1116 static int megasas_dcmd_ld_get_list(MegasasState *s, MegasasCmd *cmd)
1117 {
1118     struct mfi_ld_list info;
1119     size_t dcmd_size = sizeof(info), resid;
1120     uint32_t num_ld_disks = 0, max_ld_disks;
1121     uint64_t ld_size;
1122     BusChild *kid;
1123 
1124     memset(&info, 0, dcmd_size);
1125     if (cmd->iov_size > dcmd_size) {
1126         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1127                                             dcmd_size);
1128         return MFI_STAT_INVALID_PARAMETER;
1129     }
1130 
1131     max_ld_disks = (cmd->iov_size - 8) / 16;
1132     if (megasas_is_jbod(s)) {
1133         max_ld_disks = 0;
1134     }
1135     if (max_ld_disks > MFI_MAX_LD) {
1136         max_ld_disks = MFI_MAX_LD;
1137     }
1138     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1139         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1140 
1141         if (num_ld_disks >= max_ld_disks) {
1142             break;
1143         }
1144         /* Logical device size is in blocks */
1145         blk_get_geometry(sdev->conf.blk, &ld_size);
1146         info.ld_list[num_ld_disks].ld.v.target_id = sdev->id;
1147         info.ld_list[num_ld_disks].state = MFI_LD_STATE_OPTIMAL;
1148         info.ld_list[num_ld_disks].size = cpu_to_le64(ld_size);
1149         num_ld_disks++;
1150     }
1151     info.ld_count = cpu_to_le32(num_ld_disks);
1152     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1153 
1154     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1155     cmd->iov_size = dcmd_size - resid;
1156     return MFI_STAT_OK;
1157 }
1158 
1159 static int megasas_dcmd_ld_list_query(MegasasState *s, MegasasCmd *cmd)
1160 {
1161     uint16_t flags;
1162     struct mfi_ld_targetid_list info;
1163     size_t dcmd_size = sizeof(info), resid;
1164     uint32_t num_ld_disks = 0, max_ld_disks = s->fw_luns;
1165     BusChild *kid;
1166 
1167     /* mbox0 contains flags */
1168     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1169     trace_megasas_dcmd_ld_list_query(cmd->index, flags);
1170     if (flags != MR_LD_QUERY_TYPE_ALL &&
1171         flags != MR_LD_QUERY_TYPE_EXPOSED_TO_HOST) {
1172         max_ld_disks = 0;
1173     }
1174 
1175     memset(&info, 0, dcmd_size);
1176     if (cmd->iov_size < 12) {
1177         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1178                                             dcmd_size);
1179         return MFI_STAT_INVALID_PARAMETER;
1180     }
1181     dcmd_size = sizeof(uint32_t) * 2 + 3;
1182     max_ld_disks = cmd->iov_size - dcmd_size;
1183     if (megasas_is_jbod(s)) {
1184         max_ld_disks = 0;
1185     }
1186     if (max_ld_disks > MFI_MAX_LD) {
1187         max_ld_disks = MFI_MAX_LD;
1188     }
1189     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1190         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1191 
1192         if (num_ld_disks >= max_ld_disks) {
1193             break;
1194         }
1195         info.targetid[num_ld_disks] = sdev->lun;
1196         num_ld_disks++;
1197         dcmd_size++;
1198     }
1199     info.ld_count = cpu_to_le32(num_ld_disks);
1200     info.size = dcmd_size;
1201     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1202 
1203     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1204     cmd->iov_size = dcmd_size - resid;
1205     return MFI_STAT_OK;
1206 }
1207 
1208 static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun,
1209                                       MegasasCmd *cmd)
1210 {
1211     struct mfi_ld_info *info = cmd->iov_buf;
1212     size_t dcmd_size = sizeof(struct mfi_ld_info);
1213     uint8_t cdb[6];
1214     SCSIRequest *req;
1215     ssize_t len, resid;
1216     uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1217     uint64_t ld_size;
1218 
1219     if (!cmd->iov_buf) {
1220         cmd->iov_buf = g_malloc0(dcmd_size);
1221         info = cmd->iov_buf;
1222         megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83));
1223         req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd);
1224         if (!req) {
1225             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1226                                                 "LD get info vpd inquiry");
1227             g_free(cmd->iov_buf);
1228             cmd->iov_buf = NULL;
1229             return MFI_STAT_FLASH_ALLOC_FAIL;
1230         }
1231         trace_megasas_dcmd_internal_submit(cmd->index,
1232                                            "LD get info vpd inquiry", lun);
1233         len = scsi_req_enqueue(req);
1234         if (len > 0) {
1235             cmd->iov_size = len;
1236             scsi_req_continue(req);
1237         }
1238         return MFI_STAT_INVALID_STATUS;
1239     }
1240 
1241     info->ld_config.params.state = MFI_LD_STATE_OPTIMAL;
1242     info->ld_config.properties.ld.v.target_id = lun;
1243     info->ld_config.params.stripe_size = 3;
1244     info->ld_config.params.num_drives = 1;
1245     info->ld_config.params.is_consistent = 1;
1246     /* Logical device size is in blocks */
1247     blk_get_geometry(sdev->conf.blk, &ld_size);
1248     info->size = cpu_to_le64(ld_size);
1249     memset(info->ld_config.span, 0, sizeof(info->ld_config.span));
1250     info->ld_config.span[0].start_block = 0;
1251     info->ld_config.span[0].num_blocks = info->size;
1252     info->ld_config.span[0].array_ref = cpu_to_le16(sdev_id);
1253 
1254     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1255     g_free(cmd->iov_buf);
1256     cmd->iov_size = dcmd_size - resid;
1257     cmd->iov_buf = NULL;
1258     return MFI_STAT_OK;
1259 }
1260 
1261 static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
1262 {
1263     struct mfi_ld_info info;
1264     size_t dcmd_size = sizeof(info);
1265     uint16_t ld_id;
1266     uint32_t max_ld_disks = s->fw_luns;
1267     SCSIDevice *sdev = NULL;
1268     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1269 
1270     if (cmd->iov_size < dcmd_size) {
1271         return MFI_STAT_INVALID_PARAMETER;
1272     }
1273 
1274     /* mbox0 has the ID */
1275     ld_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1276     trace_megasas_dcmd_ld_get_info(cmd->index, ld_id);
1277 
1278     if (megasas_is_jbod(s)) {
1279         return MFI_STAT_DEVICE_NOT_FOUND;
1280     }
1281 
1282     if (ld_id < max_ld_disks) {
1283         sdev = scsi_device_find(&s->bus, 0, ld_id, 0);
1284     }
1285 
1286     if (sdev) {
1287         retval = megasas_ld_get_info_submit(sdev, ld_id, cmd);
1288     }
1289 
1290     return retval;
1291 }
1292 
1293 static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
1294 {
1295     uint8_t data[4096];
1296     struct mfi_config_data *info;
1297     int num_pd_disks = 0, array_offset, ld_offset;
1298     BusChild *kid;
1299 
1300     if (cmd->iov_size > 4096) {
1301         return MFI_STAT_INVALID_PARAMETER;
1302     }
1303 
1304     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1305         num_pd_disks++;
1306     }
1307     info = (struct mfi_config_data *)&data;
1308     /*
1309      * Array mapping:
1310      * - One array per SCSI device
1311      * - One logical drive per SCSI device
1312      *   spanning the entire device
1313      */
1314     info->array_count = num_pd_disks;
1315     info->array_size = sizeof(struct mfi_array) * num_pd_disks;
1316     info->log_drv_count = num_pd_disks;
1317     info->log_drv_size = sizeof(struct mfi_ld_config) * num_pd_disks;
1318     info->spares_count = 0;
1319     info->spares_size = sizeof(struct mfi_spare);
1320     info->size = sizeof(struct mfi_config_data) + info->array_size +
1321         info->log_drv_size;
1322     if (info->size > 4096) {
1323         return MFI_STAT_INVALID_PARAMETER;
1324     }
1325 
1326     array_offset = sizeof(struct mfi_config_data);
1327     ld_offset = array_offset + sizeof(struct mfi_array) * num_pd_disks;
1328 
1329     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1330         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1331         uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
1332         struct mfi_array *array;
1333         struct mfi_ld_config *ld;
1334         uint64_t pd_size;
1335         int i;
1336 
1337         array = (struct mfi_array *)(data + array_offset);
1338         blk_get_geometry(sdev->conf.blk, &pd_size);
1339         array->size = cpu_to_le64(pd_size);
1340         array->num_drives = 1;
1341         array->array_ref = cpu_to_le16(sdev_id);
1342         array->pd[0].ref.v.device_id = cpu_to_le16(sdev_id);
1343         array->pd[0].ref.v.seq_num = 0;
1344         array->pd[0].fw_state = MFI_PD_STATE_ONLINE;
1345         array->pd[0].encl.pd = 0xFF;
1346         array->pd[0].encl.slot = (sdev->id & 0xFF);
1347         for (i = 1; i < MFI_MAX_ROW_SIZE; i++) {
1348             array->pd[i].ref.v.device_id = 0xFFFF;
1349             array->pd[i].ref.v.seq_num = 0;
1350             array->pd[i].fw_state = MFI_PD_STATE_UNCONFIGURED_GOOD;
1351             array->pd[i].encl.pd = 0xFF;
1352             array->pd[i].encl.slot = 0xFF;
1353         }
1354         array_offset += sizeof(struct mfi_array);
1355         ld = (struct mfi_ld_config *)(data + ld_offset);
1356         memset(ld, 0, sizeof(struct mfi_ld_config));
1357         ld->properties.ld.v.target_id = sdev->id;
1358         ld->properties.default_cache_policy = MR_LD_CACHE_READ_AHEAD |
1359             MR_LD_CACHE_READ_ADAPTIVE;
1360         ld->properties.current_cache_policy = MR_LD_CACHE_READ_AHEAD |
1361             MR_LD_CACHE_READ_ADAPTIVE;
1362         ld->params.state = MFI_LD_STATE_OPTIMAL;
1363         ld->params.stripe_size = 3;
1364         ld->params.num_drives = 1;
1365         ld->params.span_depth = 1;
1366         ld->params.is_consistent = 1;
1367         ld->span[0].start_block = 0;
1368         ld->span[0].num_blocks = cpu_to_le64(pd_size);
1369         ld->span[0].array_ref = cpu_to_le16(sdev_id);
1370         ld_offset += sizeof(struct mfi_ld_config);
1371     }
1372 
1373     cmd->iov_size -= dma_buf_read((uint8_t *)data, info->size, &cmd->qsg);
1374     return MFI_STAT_OK;
1375 }
1376 
1377 static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
1378 {
1379     struct mfi_ctrl_props info;
1380     size_t dcmd_size = sizeof(info);
1381 
1382     memset(&info, 0x0, dcmd_size);
1383     if (cmd->iov_size < dcmd_size) {
1384         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1385                                             dcmd_size);
1386         return MFI_STAT_INVALID_PARAMETER;
1387     }
1388     info.pred_fail_poll_interval = cpu_to_le16(300);
1389     info.intr_throttle_cnt = cpu_to_le16(16);
1390     info.intr_throttle_timeout = cpu_to_le16(50);
1391     info.rebuild_rate = 30;
1392     info.patrol_read_rate = 30;
1393     info.bgi_rate = 30;
1394     info.cc_rate = 30;
1395     info.recon_rate = 30;
1396     info.cache_flush_interval = 4;
1397     info.spinup_drv_cnt = 2;
1398     info.spinup_delay = 6;
1399     info.ecc_bucket_size = 15;
1400     info.ecc_bucket_leak_rate = cpu_to_le16(1440);
1401     info.expose_encl_devices = 1;
1402 
1403     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1404     return MFI_STAT_OK;
1405 }
1406 
1407 static int megasas_cache_flush(MegasasState *s, MegasasCmd *cmd)
1408 {
1409     blk_drain_all();
1410     return MFI_STAT_OK;
1411 }
1412 
1413 static int megasas_ctrl_shutdown(MegasasState *s, MegasasCmd *cmd)
1414 {
1415     s->fw_state = MFI_FWSTATE_READY;
1416     return MFI_STAT_OK;
1417 }
1418 
1419 /* Some implementations use CLUSTER RESET LD to simulate a device reset */
1420 static int megasas_cluster_reset_ld(MegasasState *s, MegasasCmd *cmd)
1421 {
1422     uint16_t target_id;
1423     int i;
1424 
1425     /* mbox0 contains the device index */
1426     target_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1427     trace_megasas_dcmd_reset_ld(cmd->index, target_id);
1428     for (i = 0; i < s->fw_cmds; i++) {
1429         MegasasCmd *tmp_cmd = &s->frames[i];
1430         if (tmp_cmd->req && tmp_cmd->req->dev->id == target_id) {
1431             SCSIDevice *d = tmp_cmd->req->dev;
1432             qdev_reset_all(&d->qdev);
1433         }
1434     }
1435     return MFI_STAT_OK;
1436 }
1437 
1438 static int megasas_dcmd_set_properties(MegasasState *s, MegasasCmd *cmd)
1439 {
1440     struct mfi_ctrl_props info;
1441     size_t dcmd_size = sizeof(info);
1442 
1443     if (cmd->iov_size < dcmd_size) {
1444         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1445                                             dcmd_size);
1446         return MFI_STAT_INVALID_PARAMETER;
1447     }
1448     dma_buf_write((uint8_t *)&info, cmd->iov_size, &cmd->qsg);
1449     trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
1450     return MFI_STAT_OK;
1451 }
1452 
1453 static int megasas_dcmd_dummy(MegasasState *s, MegasasCmd *cmd)
1454 {
1455     trace_megasas_dcmd_dummy(cmd->index, cmd->iov_size);
1456     return MFI_STAT_OK;
1457 }
1458 
1459 static const struct dcmd_cmd_tbl_t {
1460     int opcode;
1461     const char *desc;
1462     int (*func)(MegasasState *s, MegasasCmd *cmd);
1463 } dcmd_cmd_tbl[] = {
1464     { MFI_DCMD_CTRL_MFI_HOST_MEM_ALLOC, "CTRL_HOST_MEM_ALLOC",
1465       megasas_dcmd_dummy },
1466     { MFI_DCMD_CTRL_GET_INFO, "CTRL_GET_INFO",
1467       megasas_ctrl_get_info },
1468     { MFI_DCMD_CTRL_GET_PROPERTIES, "CTRL_GET_PROPERTIES",
1469       megasas_dcmd_get_properties },
1470     { MFI_DCMD_CTRL_SET_PROPERTIES, "CTRL_SET_PROPERTIES",
1471       megasas_dcmd_set_properties },
1472     { MFI_DCMD_CTRL_ALARM_GET, "CTRL_ALARM_GET",
1473       megasas_dcmd_dummy },
1474     { MFI_DCMD_CTRL_ALARM_ENABLE, "CTRL_ALARM_ENABLE",
1475       megasas_dcmd_dummy },
1476     { MFI_DCMD_CTRL_ALARM_DISABLE, "CTRL_ALARM_DISABLE",
1477       megasas_dcmd_dummy },
1478     { MFI_DCMD_CTRL_ALARM_SILENCE, "CTRL_ALARM_SILENCE",
1479       megasas_dcmd_dummy },
1480     { MFI_DCMD_CTRL_ALARM_TEST, "CTRL_ALARM_TEST",
1481       megasas_dcmd_dummy },
1482     { MFI_DCMD_CTRL_EVENT_GETINFO, "CTRL_EVENT_GETINFO",
1483       megasas_event_info },
1484     { MFI_DCMD_CTRL_EVENT_GET, "CTRL_EVENT_GET",
1485       megasas_dcmd_dummy },
1486     { MFI_DCMD_CTRL_EVENT_WAIT, "CTRL_EVENT_WAIT",
1487       megasas_event_wait },
1488     { MFI_DCMD_CTRL_SHUTDOWN, "CTRL_SHUTDOWN",
1489       megasas_ctrl_shutdown },
1490     { MFI_DCMD_HIBERNATE_STANDBY, "CTRL_STANDBY",
1491       megasas_dcmd_dummy },
1492     { MFI_DCMD_CTRL_GET_TIME, "CTRL_GET_TIME",
1493       megasas_dcmd_get_fw_time },
1494     { MFI_DCMD_CTRL_SET_TIME, "CTRL_SET_TIME",
1495       megasas_dcmd_set_fw_time },
1496     { MFI_DCMD_CTRL_BIOS_DATA_GET, "CTRL_BIOS_DATA_GET",
1497       megasas_dcmd_get_bios_info },
1498     { MFI_DCMD_CTRL_FACTORY_DEFAULTS, "CTRL_FACTORY_DEFAULTS",
1499       megasas_dcmd_dummy },
1500     { MFI_DCMD_CTRL_MFC_DEFAULTS_GET, "CTRL_MFC_DEFAULTS_GET",
1501       megasas_mfc_get_defaults },
1502     { MFI_DCMD_CTRL_MFC_DEFAULTS_SET, "CTRL_MFC_DEFAULTS_SET",
1503       megasas_dcmd_dummy },
1504     { MFI_DCMD_CTRL_CACHE_FLUSH, "CTRL_CACHE_FLUSH",
1505       megasas_cache_flush },
1506     { MFI_DCMD_PD_GET_LIST, "PD_GET_LIST",
1507       megasas_dcmd_pd_get_list },
1508     { MFI_DCMD_PD_LIST_QUERY, "PD_LIST_QUERY",
1509       megasas_dcmd_pd_list_query },
1510     { MFI_DCMD_PD_GET_INFO, "PD_GET_INFO",
1511       megasas_dcmd_pd_get_info },
1512     { MFI_DCMD_PD_STATE_SET, "PD_STATE_SET",
1513       megasas_dcmd_dummy },
1514     { MFI_DCMD_PD_REBUILD, "PD_REBUILD",
1515       megasas_dcmd_dummy },
1516     { MFI_DCMD_PD_BLINK, "PD_BLINK",
1517       megasas_dcmd_dummy },
1518     { MFI_DCMD_PD_UNBLINK, "PD_UNBLINK",
1519       megasas_dcmd_dummy },
1520     { MFI_DCMD_LD_GET_LIST, "LD_GET_LIST",
1521       megasas_dcmd_ld_get_list},
1522     { MFI_DCMD_LD_LIST_QUERY, "LD_LIST_QUERY",
1523       megasas_dcmd_ld_list_query },
1524     { MFI_DCMD_LD_GET_INFO, "LD_GET_INFO",
1525       megasas_dcmd_ld_get_info },
1526     { MFI_DCMD_LD_GET_PROP, "LD_GET_PROP",
1527       megasas_dcmd_dummy },
1528     { MFI_DCMD_LD_SET_PROP, "LD_SET_PROP",
1529       megasas_dcmd_dummy },
1530     { MFI_DCMD_LD_DELETE, "LD_DELETE",
1531       megasas_dcmd_dummy },
1532     { MFI_DCMD_CFG_READ, "CFG_READ",
1533       megasas_dcmd_cfg_read },
1534     { MFI_DCMD_CFG_ADD, "CFG_ADD",
1535       megasas_dcmd_dummy },
1536     { MFI_DCMD_CFG_CLEAR, "CFG_CLEAR",
1537       megasas_dcmd_dummy },
1538     { MFI_DCMD_CFG_FOREIGN_READ, "CFG_FOREIGN_READ",
1539       megasas_dcmd_dummy },
1540     { MFI_DCMD_CFG_FOREIGN_IMPORT, "CFG_FOREIGN_IMPORT",
1541       megasas_dcmd_dummy },
1542     { MFI_DCMD_BBU_STATUS, "BBU_STATUS",
1543       megasas_dcmd_dummy },
1544     { MFI_DCMD_BBU_CAPACITY_INFO, "BBU_CAPACITY_INFO",
1545       megasas_dcmd_dummy },
1546     { MFI_DCMD_BBU_DESIGN_INFO, "BBU_DESIGN_INFO",
1547       megasas_dcmd_dummy },
1548     { MFI_DCMD_BBU_PROP_GET, "BBU_PROP_GET",
1549       megasas_dcmd_dummy },
1550     { MFI_DCMD_CLUSTER, "CLUSTER",
1551       megasas_dcmd_dummy },
1552     { MFI_DCMD_CLUSTER_RESET_ALL, "CLUSTER_RESET_ALL",
1553       megasas_dcmd_dummy },
1554     { MFI_DCMD_CLUSTER_RESET_LD, "CLUSTER_RESET_LD",
1555       megasas_cluster_reset_ld },
1556     { -1, NULL, NULL }
1557 };
1558 
1559 static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)
1560 {
1561     int opcode, len;
1562     int retval = 0;
1563     const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;
1564 
1565     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1566     trace_megasas_handle_dcmd(cmd->index, opcode);
1567     len = megasas_map_dcmd(s, cmd);
1568     if (len < 0) {
1569         return MFI_STAT_MEMORY_NOT_AVAILABLE;
1570     }
1571     while (cmdptr->opcode != -1 && cmdptr->opcode != opcode) {
1572         cmdptr++;
1573     }
1574     if (cmdptr->opcode == -1) {
1575         trace_megasas_dcmd_unhandled(cmd->index, opcode, len);
1576         retval = megasas_dcmd_dummy(s, cmd);
1577     } else {
1578         trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);
1579         retval = cmdptr->func(s, cmd);
1580     }
1581     if (retval != MFI_STAT_INVALID_STATUS) {
1582         megasas_finish_dcmd(cmd, len);
1583     }
1584     return retval;
1585 }
1586 
1587 static int megasas_finish_internal_dcmd(MegasasCmd *cmd,
1588                                         SCSIRequest *req)
1589 {
1590     int opcode;
1591     int retval = MFI_STAT_OK;
1592     int lun = req->lun;
1593 
1594     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1595     scsi_req_unref(req);
1596     trace_megasas_dcmd_internal_finish(cmd->index, opcode, lun);
1597     switch (opcode) {
1598     case MFI_DCMD_PD_GET_INFO:
1599         retval = megasas_pd_get_info_submit(req->dev, lun, cmd);
1600         break;
1601     case MFI_DCMD_LD_GET_INFO:
1602         retval = megasas_ld_get_info_submit(req->dev, lun, cmd);
1603         break;
1604     default:
1605         trace_megasas_dcmd_internal_invalid(cmd->index, opcode);
1606         retval = MFI_STAT_INVALID_DCMD;
1607         break;
1608     }
1609     if (retval != MFI_STAT_INVALID_STATUS) {
1610         megasas_finish_dcmd(cmd, cmd->iov_size);
1611     }
1612     return retval;
1613 }
1614 
1615 static int megasas_enqueue_req(MegasasCmd *cmd, bool is_write)
1616 {
1617     int len;
1618 
1619     len = scsi_req_enqueue(cmd->req);
1620     if (len < 0) {
1621         len = -len;
1622     }
1623     if (len > 0) {
1624         if (len > cmd->iov_size) {
1625             if (is_write) {
1626                 trace_megasas_iov_write_overflow(cmd->index, len,
1627                                                  cmd->iov_size);
1628             } else {
1629                 trace_megasas_iov_read_overflow(cmd->index, len,
1630                                                 cmd->iov_size);
1631             }
1632         }
1633         if (len < cmd->iov_size) {
1634             if (is_write) {
1635                 trace_megasas_iov_write_underflow(cmd->index, len,
1636                                                   cmd->iov_size);
1637             } else {
1638                 trace_megasas_iov_read_underflow(cmd->index, len,
1639                                                  cmd->iov_size);
1640             }
1641             cmd->iov_size = len;
1642         }
1643         scsi_req_continue(cmd->req);
1644     }
1645     return len;
1646 }
1647 
1648 static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
1649                                bool is_logical)
1650 {
1651     uint8_t *cdb;
1652     bool is_write;
1653     struct SCSIDevice *sdev = NULL;
1654 
1655     cdb = cmd->frame->pass.cdb;
1656 
1657     if (is_logical) {
1658         if (cmd->frame->header.target_id >= MFI_MAX_LD ||
1659             cmd->frame->header.lun_id != 0) {
1660             trace_megasas_scsi_target_not_present(
1661                 mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1662                 cmd->frame->header.target_id, cmd->frame->header.lun_id);
1663             return MFI_STAT_DEVICE_NOT_FOUND;
1664         }
1665     }
1666     sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1667                             cmd->frame->header.lun_id);
1668 
1669     cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);
1670     trace_megasas_handle_scsi(mfi_frame_desc[cmd->frame->header.frame_cmd],
1671                               is_logical, cmd->frame->header.target_id,
1672                               cmd->frame->header.lun_id, sdev, cmd->iov_size);
1673 
1674     if (!sdev || (megasas_is_jbod(s) && is_logical)) {
1675         trace_megasas_scsi_target_not_present(
1676             mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1677             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1678         return MFI_STAT_DEVICE_NOT_FOUND;
1679     }
1680 
1681     if (cmd->frame->header.cdb_len > 16) {
1682         trace_megasas_scsi_invalid_cdb_len(
1683                 mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1684                 cmd->frame->header.target_id, cmd->frame->header.lun_id,
1685                 cmd->frame->header.cdb_len);
1686         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1687         cmd->frame->header.scsi_status = CHECK_CONDITION;
1688         s->event_count++;
1689         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1690     }
1691 
1692     if (megasas_map_sgl(s, cmd, &cmd->frame->pass.sgl)) {
1693         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1694         cmd->frame->header.scsi_status = CHECK_CONDITION;
1695         s->event_count++;
1696         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1697     }
1698 
1699     cmd->req = scsi_req_new(sdev, cmd->index,
1700                             cmd->frame->header.lun_id, cdb, cmd);
1701     if (!cmd->req) {
1702         trace_megasas_scsi_req_alloc_failed(
1703                 mfi_frame_desc[cmd->frame->header.frame_cmd],
1704                 cmd->frame->header.target_id, cmd->frame->header.lun_id);
1705         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1706         cmd->frame->header.scsi_status = BUSY;
1707         s->event_count++;
1708         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1709     }
1710 
1711     is_write = (cmd->req->cmd.mode == SCSI_XFER_TO_DEV);
1712     if (cmd->iov_size) {
1713         if (is_write) {
1714             trace_megasas_scsi_write_start(cmd->index, cmd->iov_size);
1715         } else {
1716             trace_megasas_scsi_read_start(cmd->index, cmd->iov_size);
1717         }
1718     } else {
1719         trace_megasas_scsi_nodata(cmd->index);
1720     }
1721     megasas_enqueue_req(cmd, is_write);
1722     return MFI_STAT_INVALID_STATUS;
1723 }
1724 
1725 static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd)
1726 {
1727     uint32_t lba_count, lba_start_hi, lba_start_lo;
1728     uint64_t lba_start;
1729     bool is_write = (cmd->frame->header.frame_cmd == MFI_CMD_LD_WRITE);
1730     uint8_t cdb[16];
1731     int len;
1732     struct SCSIDevice *sdev = NULL;
1733 
1734     lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
1735     lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
1736     lba_start_hi = le32_to_cpu(cmd->frame->io.lba_hi);
1737     lba_start = ((uint64_t)lba_start_hi << 32) | lba_start_lo;
1738 
1739     if (cmd->frame->header.target_id < MFI_MAX_LD &&
1740         cmd->frame->header.lun_id == 0) {
1741         sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1742                                 cmd->frame->header.lun_id);
1743     }
1744 
1745     trace_megasas_handle_io(cmd->index,
1746                             mfi_frame_desc[cmd->frame->header.frame_cmd],
1747                             cmd->frame->header.target_id,
1748                             cmd->frame->header.lun_id,
1749                             (unsigned long)lba_start, (unsigned long)lba_count);
1750     if (!sdev) {
1751         trace_megasas_io_target_not_present(cmd->index,
1752             mfi_frame_desc[cmd->frame->header.frame_cmd],
1753             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1754         return MFI_STAT_DEVICE_NOT_FOUND;
1755     }
1756 
1757     if (cmd->frame->header.cdb_len > 16) {
1758         trace_megasas_scsi_invalid_cdb_len(
1759             mfi_frame_desc[cmd->frame->header.frame_cmd], 1,
1760             cmd->frame->header.target_id, cmd->frame->header.lun_id,
1761             cmd->frame->header.cdb_len);
1762         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1763         cmd->frame->header.scsi_status = CHECK_CONDITION;
1764         s->event_count++;
1765         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1766     }
1767 
1768     cmd->iov_size = lba_count * sdev->blocksize;
1769     if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
1770         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1771         cmd->frame->header.scsi_status = CHECK_CONDITION;
1772         s->event_count++;
1773         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1774     }
1775 
1776     megasas_encode_lba(cdb, lba_start, lba_count, is_write);
1777     cmd->req = scsi_req_new(sdev, cmd->index,
1778                             cmd->frame->header.lun_id, cdb, cmd);
1779     if (!cmd->req) {
1780         trace_megasas_scsi_req_alloc_failed(
1781             mfi_frame_desc[cmd->frame->header.frame_cmd],
1782             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1783         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1784         cmd->frame->header.scsi_status = BUSY;
1785         s->event_count++;
1786         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1787     }
1788     len = megasas_enqueue_req(cmd, is_write);
1789     if (len > 0) {
1790         if (is_write) {
1791             trace_megasas_io_write_start(cmd->index, lba_start, lba_count, len);
1792         } else {
1793             trace_megasas_io_read_start(cmd->index, lba_start, lba_count, len);
1794         }
1795     }
1796     return MFI_STAT_INVALID_STATUS;
1797 }
1798 
1799 static int megasas_finish_internal_command(MegasasCmd *cmd,
1800                                            SCSIRequest *req, size_t resid)
1801 {
1802     int retval = MFI_STAT_INVALID_CMD;
1803 
1804     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1805         cmd->iov_size -= resid;
1806         retval = megasas_finish_internal_dcmd(cmd, req);
1807     }
1808     return retval;
1809 }
1810 
1811 static QEMUSGList *megasas_get_sg_list(SCSIRequest *req)
1812 {
1813     MegasasCmd *cmd = req->hba_private;
1814 
1815     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1816         return NULL;
1817     } else {
1818         return &cmd->qsg;
1819     }
1820 }
1821 
1822 static void megasas_xfer_complete(SCSIRequest *req, uint32_t len)
1823 {
1824     MegasasCmd *cmd = req->hba_private;
1825     uint8_t *buf;
1826     uint32_t opcode;
1827 
1828     trace_megasas_io_complete(cmd->index, len);
1829 
1830     if (cmd->frame->header.frame_cmd != MFI_CMD_DCMD) {
1831         scsi_req_continue(req);
1832         return;
1833     }
1834 
1835     buf = scsi_req_get_buf(req);
1836     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1837     if (opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) {
1838         struct mfi_pd_info *info = cmd->iov_buf;
1839 
1840         if (info->inquiry_data[0] == 0x7f) {
1841             memset(info->inquiry_data, 0, sizeof(info->inquiry_data));
1842             memcpy(info->inquiry_data, buf, len);
1843         } else if (info->vpd_page83[0] == 0x7f) {
1844             memset(info->vpd_page83, 0, sizeof(info->vpd_page83));
1845             memcpy(info->vpd_page83, buf, len);
1846         }
1847         scsi_req_continue(req);
1848     } else if (opcode == MFI_DCMD_LD_GET_INFO) {
1849         struct mfi_ld_info *info = cmd->iov_buf;
1850 
1851         if (cmd->iov_buf) {
1852             memcpy(info->vpd_page83, buf, sizeof(info->vpd_page83));
1853             scsi_req_continue(req);
1854         }
1855     }
1856 }
1857 
1858 static void megasas_command_complete(SCSIRequest *req, uint32_t status,
1859                                      size_t resid)
1860 {
1861     MegasasCmd *cmd = req->hba_private;
1862     uint8_t cmd_status = MFI_STAT_OK;
1863 
1864     trace_megasas_command_complete(cmd->index, status, resid);
1865 
1866     if (cmd->req != req) {
1867         /*
1868          * Internal command complete
1869          */
1870         cmd_status = megasas_finish_internal_command(cmd, req, resid);
1871         if (cmd_status == MFI_STAT_INVALID_STATUS) {
1872             return;
1873         }
1874     } else {
1875         req->status = status;
1876         trace_megasas_scsi_complete(cmd->index, req->status,
1877                                     cmd->iov_size, req->cmd.xfer);
1878         if (req->status != GOOD) {
1879             cmd_status = MFI_STAT_SCSI_DONE_WITH_ERROR;
1880         }
1881         if (req->status == CHECK_CONDITION) {
1882             megasas_copy_sense(cmd);
1883         }
1884 
1885         megasas_unmap_sgl(cmd);
1886         cmd->frame->header.scsi_status = req->status;
1887         scsi_req_unref(cmd->req);
1888         cmd->req = NULL;
1889     }
1890     cmd->frame->header.cmd_status = cmd_status;
1891     megasas_unmap_frame(cmd->state, cmd);
1892     megasas_complete_frame(cmd->state, cmd->context);
1893 }
1894 
1895 static void megasas_command_cancel(SCSIRequest *req)
1896 {
1897     MegasasCmd *cmd = req->hba_private;
1898 
1899     if (cmd) {
1900         megasas_abort_command(cmd);
1901     } else {
1902         scsi_req_unref(req);
1903     }
1904 }
1905 
1906 static int megasas_handle_abort(MegasasState *s, MegasasCmd *cmd)
1907 {
1908     uint64_t abort_ctx = le64_to_cpu(cmd->frame->abort.abort_context);
1909     hwaddr abort_addr, addr_hi, addr_lo;
1910     MegasasCmd *abort_cmd;
1911 
1912     addr_hi = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_hi);
1913     addr_lo = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_lo);
1914     abort_addr = ((uint64_t)addr_hi << 32) | addr_lo;
1915 
1916     abort_cmd = megasas_lookup_frame(s, abort_addr);
1917     if (!abort_cmd) {
1918         trace_megasas_abort_no_cmd(cmd->index, abort_ctx);
1919         s->event_count++;
1920         return MFI_STAT_OK;
1921     }
1922     if (!megasas_use_queue64(s)) {
1923         abort_ctx &= (uint64_t)0xFFFFFFFF;
1924     }
1925     if (abort_cmd->context != abort_ctx) {
1926         trace_megasas_abort_invalid_context(cmd->index, abort_cmd->index,
1927                                             abort_cmd->context);
1928         s->event_count++;
1929         return MFI_STAT_ABORT_NOT_POSSIBLE;
1930     }
1931     trace_megasas_abort_frame(cmd->index, abort_cmd->index);
1932     megasas_abort_command(abort_cmd);
1933     if (!s->event_cmd || abort_cmd != s->event_cmd) {
1934         s->event_cmd = NULL;
1935     }
1936     s->event_count++;
1937     return MFI_STAT_OK;
1938 }
1939 
1940 static void megasas_handle_frame(MegasasState *s, uint64_t frame_addr,
1941                                  uint32_t frame_count)
1942 {
1943     uint8_t frame_status = MFI_STAT_INVALID_CMD;
1944     uint64_t frame_context;
1945     MegasasCmd *cmd;
1946 
1947     /*
1948      * Always read 64bit context, top bits will be
1949      * masked out if required in megasas_enqueue_frame()
1950      */
1951     frame_context = megasas_frame_get_context(s, frame_addr);
1952 
1953     cmd = megasas_enqueue_frame(s, frame_addr, frame_context, frame_count);
1954     if (!cmd) {
1955         /* reply queue full */
1956         trace_megasas_frame_busy(frame_addr);
1957         megasas_frame_set_scsi_status(s, frame_addr, BUSY);
1958         megasas_frame_set_cmd_status(s, frame_addr, MFI_STAT_SCSI_DONE_WITH_ERROR);
1959         megasas_complete_frame(s, frame_context);
1960         s->event_count++;
1961         return;
1962     }
1963     switch (cmd->frame->header.frame_cmd) {
1964     case MFI_CMD_INIT:
1965         frame_status = megasas_init_firmware(s, cmd);
1966         break;
1967     case MFI_CMD_DCMD:
1968         frame_status = megasas_handle_dcmd(s, cmd);
1969         break;
1970     case MFI_CMD_ABORT:
1971         frame_status = megasas_handle_abort(s, cmd);
1972         break;
1973     case MFI_CMD_PD_SCSI_IO:
1974         frame_status = megasas_handle_scsi(s, cmd, 0);
1975         break;
1976     case MFI_CMD_LD_SCSI_IO:
1977         frame_status = megasas_handle_scsi(s, cmd, 1);
1978         break;
1979     case MFI_CMD_LD_READ:
1980     case MFI_CMD_LD_WRITE:
1981         frame_status = megasas_handle_io(s, cmd);
1982         break;
1983     default:
1984         trace_megasas_unhandled_frame_cmd(cmd->index,
1985                                           cmd->frame->header.frame_cmd);
1986         s->event_count++;
1987         break;
1988     }
1989     if (frame_status != MFI_STAT_INVALID_STATUS) {
1990         if (cmd->frame) {
1991             cmd->frame->header.cmd_status = frame_status;
1992         } else {
1993             megasas_frame_set_cmd_status(s, frame_addr, frame_status);
1994         }
1995         megasas_unmap_frame(s, cmd);
1996         megasas_complete_frame(s, cmd->context);
1997     }
1998 }
1999 
2000 static uint64_t megasas_mmio_read(void *opaque, hwaddr addr,
2001                                   unsigned size)
2002 {
2003     MegasasState *s = opaque;
2004     PCIDevice *pci_dev = PCI_DEVICE(s);
2005     MegasasBaseClass *base_class = MEGASAS_DEVICE_GET_CLASS(s);
2006     uint32_t retval = 0;
2007 
2008     switch (addr) {
2009     case MFI_IDB:
2010         retval = 0;
2011         trace_megasas_mmio_readl("MFI_IDB", retval);
2012         break;
2013     case MFI_OMSG0:
2014     case MFI_OSP0:
2015         retval = (msix_present(pci_dev) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |
2016             (s->fw_state & MFI_FWSTATE_MASK) |
2017             ((s->fw_sge & 0xff) << 16) |
2018             (s->fw_cmds & 0xFFFF);
2019         trace_megasas_mmio_readl(addr == MFI_OMSG0 ? "MFI_OMSG0" : "MFI_OSP0",
2020                                  retval);
2021         break;
2022     case MFI_OSTS:
2023         if (megasas_intr_enabled(s) && s->doorbell) {
2024             retval = base_class->osts;
2025         }
2026         trace_megasas_mmio_readl("MFI_OSTS", retval);
2027         break;
2028     case MFI_OMSK:
2029         retval = s->intr_mask;
2030         trace_megasas_mmio_readl("MFI_OMSK", retval);
2031         break;
2032     case MFI_ODCR0:
2033         retval = s->doorbell ? 1 : 0;
2034         trace_megasas_mmio_readl("MFI_ODCR0", retval);
2035         break;
2036     case MFI_DIAG:
2037         retval = s->diag;
2038         trace_megasas_mmio_readl("MFI_DIAG", retval);
2039         break;
2040     case MFI_OSP1:
2041         retval = 15;
2042         trace_megasas_mmio_readl("MFI_OSP1", retval);
2043         break;
2044     default:
2045         trace_megasas_mmio_invalid_readl(addr);
2046         break;
2047     }
2048     return retval;
2049 }
2050 
2051 static int adp_reset_seq[] = {0x00, 0x04, 0x0b, 0x02, 0x07, 0x0d};
2052 
2053 static void megasas_mmio_write(void *opaque, hwaddr addr,
2054                                uint64_t val, unsigned size)
2055 {
2056     MegasasState *s = opaque;
2057     PCIDevice *pci_dev = PCI_DEVICE(s);
2058     uint64_t frame_addr;
2059     uint32_t frame_count;
2060     int i;
2061 
2062     switch (addr) {
2063     case MFI_IDB:
2064         trace_megasas_mmio_writel("MFI_IDB", val);
2065         if (val & MFI_FWINIT_ABORT) {
2066             /* Abort all pending cmds */
2067             for (i = 0; i < s->fw_cmds; i++) {
2068                 megasas_abort_command(&s->frames[i]);
2069             }
2070         }
2071         if (val & MFI_FWINIT_READY) {
2072             /* move to FW READY */
2073             megasas_soft_reset(s);
2074         }
2075         if (val & MFI_FWINIT_MFIMODE) {
2076             /* discard MFIs */
2077         }
2078         if (val & MFI_FWINIT_STOP_ADP) {
2079             /* Terminal error, stop processing */
2080             s->fw_state = MFI_FWSTATE_FAULT;
2081         }
2082         break;
2083     case MFI_OMSK:
2084         trace_megasas_mmio_writel("MFI_OMSK", val);
2085         s->intr_mask = val;
2086         if (!megasas_intr_enabled(s) &&
2087             !msi_enabled(pci_dev) &&
2088             !msix_enabled(pci_dev)) {
2089             trace_megasas_irq_lower();
2090             pci_irq_deassert(pci_dev);
2091         }
2092         if (megasas_intr_enabled(s)) {
2093             if (msix_enabled(pci_dev)) {
2094                 trace_megasas_msix_enabled(0);
2095             } else if (msi_enabled(pci_dev)) {
2096                 trace_megasas_msi_enabled(0);
2097             } else {
2098                 trace_megasas_intr_enabled();
2099             }
2100         } else {
2101             trace_megasas_intr_disabled();
2102             megasas_soft_reset(s);
2103         }
2104         break;
2105     case MFI_ODCR0:
2106         trace_megasas_mmio_writel("MFI_ODCR0", val);
2107         s->doorbell = 0;
2108         if (megasas_intr_enabled(s)) {
2109             if (!msix_enabled(pci_dev) && !msi_enabled(pci_dev)) {
2110                 trace_megasas_irq_lower();
2111                 pci_irq_deassert(pci_dev);
2112             }
2113         }
2114         break;
2115     case MFI_IQPH:
2116         trace_megasas_mmio_writel("MFI_IQPH", val);
2117         /* Received high 32 bits of a 64 bit MFI frame address */
2118         s->frame_hi = val;
2119         break;
2120     case MFI_IQPL:
2121         trace_megasas_mmio_writel("MFI_IQPL", val);
2122         /* Received low 32 bits of a 64 bit MFI frame address */
2123         /* Fallthrough */
2124     case MFI_IQP:
2125         if (addr == MFI_IQP) {
2126             trace_megasas_mmio_writel("MFI_IQP", val);
2127             /* Received 64 bit MFI frame address */
2128             s->frame_hi = 0;
2129         }
2130         frame_addr = (val & ~0x1F);
2131         /* Add possible 64 bit offset */
2132         frame_addr |= ((uint64_t)s->frame_hi << 32);
2133         s->frame_hi = 0;
2134         frame_count = (val >> 1) & 0xF;
2135         megasas_handle_frame(s, frame_addr, frame_count);
2136         break;
2137     case MFI_SEQ:
2138         trace_megasas_mmio_writel("MFI_SEQ", val);
2139         /* Magic sequence to start ADP reset */
2140         if (adp_reset_seq[s->adp_reset] == val) {
2141             s->adp_reset++;
2142         } else {
2143             s->adp_reset = 0;
2144             s->diag = 0;
2145         }
2146         if (s->adp_reset == 6) {
2147             s->diag = MFI_DIAG_WRITE_ENABLE;
2148         }
2149         break;
2150     case MFI_DIAG:
2151         trace_megasas_mmio_writel("MFI_DIAG", val);
2152         /* ADP reset */
2153         if ((s->diag & MFI_DIAG_WRITE_ENABLE) &&
2154             (val & MFI_DIAG_RESET_ADP)) {
2155             s->diag |= MFI_DIAG_RESET_ADP;
2156             megasas_soft_reset(s);
2157             s->adp_reset = 0;
2158             s->diag = 0;
2159         }
2160         break;
2161     default:
2162         trace_megasas_mmio_invalid_writel(addr, val);
2163         break;
2164     }
2165 }
2166 
2167 static const MemoryRegionOps megasas_mmio_ops = {
2168     .read = megasas_mmio_read,
2169     .write = megasas_mmio_write,
2170     .endianness = DEVICE_LITTLE_ENDIAN,
2171     .impl = {
2172         .min_access_size = 8,
2173         .max_access_size = 8,
2174     }
2175 };
2176 
2177 static uint64_t megasas_port_read(void *opaque, hwaddr addr,
2178                                   unsigned size)
2179 {
2180     return megasas_mmio_read(opaque, addr & 0xff, size);
2181 }
2182 
2183 static void megasas_port_write(void *opaque, hwaddr addr,
2184                                uint64_t val, unsigned size)
2185 {
2186     megasas_mmio_write(opaque, addr & 0xff, val, size);
2187 }
2188 
2189 static const MemoryRegionOps megasas_port_ops = {
2190     .read = megasas_port_read,
2191     .write = megasas_port_write,
2192     .endianness = DEVICE_LITTLE_ENDIAN,
2193     .impl = {
2194         .min_access_size = 4,
2195         .max_access_size = 4,
2196     }
2197 };
2198 
2199 static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
2200                                    unsigned size)
2201 {
2202     return 0;
2203 }
2204 
2205 static void megasas_queue_write(void *opaque, hwaddr addr,
2206                                uint64_t val, unsigned size)
2207 {
2208     return;
2209 }
2210 
2211 static const MemoryRegionOps megasas_queue_ops = {
2212     .read = megasas_queue_read,
2213     .write = megasas_queue_write,
2214     .endianness = DEVICE_LITTLE_ENDIAN,
2215     .impl = {
2216         .min_access_size = 8,
2217         .max_access_size = 8,
2218     }
2219 };
2220 
2221 static void megasas_soft_reset(MegasasState *s)
2222 {
2223     int i;
2224     MegasasCmd *cmd;
2225 
2226     trace_megasas_reset(s->fw_state);
2227     for (i = 0; i < s->fw_cmds; i++) {
2228         cmd = &s->frames[i];
2229         megasas_abort_command(cmd);
2230     }
2231     if (s->fw_state == MFI_FWSTATE_READY) {
2232         BusChild *kid;
2233 
2234         /*
2235          * The EFI firmware doesn't handle UA,
2236          * so we need to clear the Power On/Reset UA
2237          * after the initial reset.
2238          */
2239         QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
2240             SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
2241 
2242             sdev->unit_attention = SENSE_CODE(NO_SENSE);
2243             scsi_device_unit_attention_reported(sdev);
2244         }
2245     }
2246     megasas_reset_frames(s);
2247     s->reply_queue_len = s->fw_cmds;
2248     s->reply_queue_pa = 0;
2249     s->consumer_pa = 0;
2250     s->producer_pa = 0;
2251     s->fw_state = MFI_FWSTATE_READY;
2252     s->doorbell = 0;
2253     s->intr_mask = MEGASAS_INTR_DISABLED_MASK;
2254     s->frame_hi = 0;
2255     s->flags &= ~MEGASAS_MASK_USE_QUEUE64;
2256     s->event_count++;
2257     s->boot_event = s->event_count;
2258 }
2259 
2260 static void megasas_scsi_reset(DeviceState *dev)
2261 {
2262     MegasasState *s = MEGASAS(dev);
2263 
2264     megasas_soft_reset(s);
2265 }
2266 
2267 static const VMStateDescription vmstate_megasas_gen1 = {
2268     .name = "megasas",
2269     .version_id = 0,
2270     .minimum_version_id = 0,
2271     .fields = (VMStateField[]) {
2272         VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2273         VMSTATE_MSIX(parent_obj, MegasasState),
2274 
2275         VMSTATE_INT32(fw_state, MegasasState),
2276         VMSTATE_INT32(intr_mask, MegasasState),
2277         VMSTATE_INT32(doorbell, MegasasState),
2278         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2279         VMSTATE_UINT64(consumer_pa, MegasasState),
2280         VMSTATE_UINT64(producer_pa, MegasasState),
2281         VMSTATE_END_OF_LIST()
2282     }
2283 };
2284 
2285 static const VMStateDescription vmstate_megasas_gen2 = {
2286     .name = "megasas-gen2",
2287     .version_id = 0,
2288     .minimum_version_id = 0,
2289     .minimum_version_id_old = 0,
2290     .fields      = (VMStateField[]) {
2291         VMSTATE_PCIE_DEVICE(parent_obj, MegasasState),
2292         VMSTATE_MSIX(parent_obj, MegasasState),
2293 
2294         VMSTATE_INT32(fw_state, MegasasState),
2295         VMSTATE_INT32(intr_mask, MegasasState),
2296         VMSTATE_INT32(doorbell, MegasasState),
2297         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2298         VMSTATE_UINT64(consumer_pa, MegasasState),
2299         VMSTATE_UINT64(producer_pa, MegasasState),
2300         VMSTATE_END_OF_LIST()
2301     }
2302 };
2303 
2304 static void megasas_scsi_uninit(PCIDevice *d)
2305 {
2306     MegasasState *s = MEGASAS(d);
2307 
2308     if (megasas_use_msix(s)) {
2309         msix_uninit(d, &s->mmio_io, &s->mmio_io);
2310     }
2311     if (megasas_use_msi(s)) {
2312         msi_uninit(d);
2313     }
2314 }
2315 
2316 static const struct SCSIBusInfo megasas_scsi_info = {
2317     .tcq = true,
2318     .max_target = MFI_MAX_LD,
2319     .max_lun = 255,
2320 
2321     .transfer_data = megasas_xfer_complete,
2322     .get_sg_list = megasas_get_sg_list,
2323     .complete = megasas_command_complete,
2324     .cancel = megasas_command_cancel,
2325 };
2326 
2327 static void megasas_scsi_realize(PCIDevice *dev, Error **errp)
2328 {
2329     DeviceState *d = DEVICE(dev);
2330     MegasasState *s = MEGASAS(dev);
2331     MegasasBaseClass *b = MEGASAS_DEVICE_GET_CLASS(s);
2332     uint8_t *pci_conf;
2333     int i, bar_type;
2334 
2335     pci_conf = dev->config;
2336 
2337     /* PCI latency timer = 0 */
2338     pci_conf[PCI_LATENCY_TIMER] = 0;
2339     /* Interrupt pin 1 */
2340     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2341 
2342     memory_region_init_io(&s->mmio_io, OBJECT(s), &megasas_mmio_ops, s,
2343                           "megasas-mmio", 0x4000);
2344     memory_region_init_io(&s->port_io, OBJECT(s), &megasas_port_ops, s,
2345                           "megasas-io", 256);
2346     memory_region_init_io(&s->queue_io, OBJECT(s), &megasas_queue_ops, s,
2347                           "megasas-queue", 0x40000);
2348 
2349     if (megasas_use_msi(s) &&
2350         msi_init(dev, 0x50, 1, true, false)) {
2351         s->flags &= ~MEGASAS_MASK_USE_MSI;
2352     }
2353     if (megasas_use_msix(s) &&
2354         msix_init(dev, 15, &s->mmio_io, b->mmio_bar, 0x2000,
2355                   &s->mmio_io, b->mmio_bar, 0x3800, 0x68)) {
2356         s->flags &= ~MEGASAS_MASK_USE_MSIX;
2357     }
2358     if (pci_is_express(dev)) {
2359         pcie_endpoint_cap_init(dev, 0xa0);
2360     }
2361 
2362     bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
2363     pci_register_bar(dev, b->ioport_bar,
2364                      PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
2365     pci_register_bar(dev, b->mmio_bar, bar_type, &s->mmio_io);
2366     pci_register_bar(dev, 3, bar_type, &s->queue_io);
2367 
2368     if (megasas_use_msix(s)) {
2369         msix_vector_use(dev, 0);
2370     }
2371 
2372     s->fw_state = MFI_FWSTATE_READY;
2373     if (!s->sas_addr) {
2374         s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
2375                        IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
2376         s->sas_addr |= (pci_bus_num(dev->bus) << 16);
2377         s->sas_addr |= (PCI_SLOT(dev->devfn) << 8);
2378         s->sas_addr |= PCI_FUNC(dev->devfn);
2379     }
2380     if (!s->hba_serial) {
2381         s->hba_serial = g_strdup(MEGASAS_HBA_SERIAL);
2382     }
2383     if (s->fw_sge >= MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE) {
2384         s->fw_sge = MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE;
2385     } else if (s->fw_sge >= 128 - MFI_PASS_FRAME_SIZE) {
2386         s->fw_sge = 128 - MFI_PASS_FRAME_SIZE;
2387     } else {
2388         s->fw_sge = 64 - MFI_PASS_FRAME_SIZE;
2389     }
2390     if (s->fw_cmds > MEGASAS_MAX_FRAMES) {
2391         s->fw_cmds = MEGASAS_MAX_FRAMES;
2392     }
2393     trace_megasas_init(s->fw_sge, s->fw_cmds,
2394                        megasas_is_jbod(s) ? "jbod" : "raid");
2395 
2396     if (megasas_is_jbod(s)) {
2397         s->fw_luns = MFI_MAX_SYS_PDS;
2398     } else {
2399         s->fw_luns = MFI_MAX_LD;
2400     }
2401     s->producer_pa = 0;
2402     s->consumer_pa = 0;
2403     for (i = 0; i < s->fw_cmds; i++) {
2404         s->frames[i].index = i;
2405         s->frames[i].context = -1;
2406         s->frames[i].pa = 0;
2407         s->frames[i].state = s;
2408     }
2409 
2410     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev),
2411                  &megasas_scsi_info, NULL);
2412     if (!d->hotplugged) {
2413         scsi_bus_legacy_handle_cmdline(&s->bus, errp);
2414     }
2415 }
2416 
2417 static Property megasas_properties_gen1[] = {
2418     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2419                        MEGASAS_DEFAULT_SGE),
2420     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2421                        MEGASAS_DEFAULT_FRAMES),
2422     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2423     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2424     DEFINE_PROP_BIT("use_msi", MegasasState, flags,
2425                     MEGASAS_FLAG_USE_MSI, false),
2426     DEFINE_PROP_BIT("use_msix", MegasasState, flags,
2427                     MEGASAS_FLAG_USE_MSIX, false),
2428     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2429                     MEGASAS_FLAG_USE_JBOD, false),
2430     DEFINE_PROP_END_OF_LIST(),
2431 };
2432 
2433 static Property megasas_properties_gen2[] = {
2434     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2435                        MEGASAS_DEFAULT_SGE),
2436     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2437                        MEGASAS_GEN2_DEFAULT_FRAMES),
2438     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2439     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2440     DEFINE_PROP_BIT("use_msi", MegasasState, flags,
2441                     MEGASAS_FLAG_USE_MSI, true),
2442     DEFINE_PROP_BIT("use_msix", MegasasState, flags,
2443                     MEGASAS_FLAG_USE_MSIX, true),
2444     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2445                     MEGASAS_FLAG_USE_JBOD, false),
2446     DEFINE_PROP_END_OF_LIST(),
2447 };
2448 
2449 typedef struct MegasasInfo {
2450     const char *name;
2451     const char *desc;
2452     const char *product_name;
2453     const char *product_version;
2454     uint16_t device_id;
2455     uint16_t subsystem_id;
2456     int ioport_bar;
2457     int mmio_bar;
2458     bool is_express;
2459     int osts;
2460     const VMStateDescription *vmsd;
2461     Property *props;
2462 } MegasasInfo;
2463 
2464 static struct MegasasInfo megasas_devices[] = {
2465     {
2466         .name = TYPE_MEGASAS_GEN1,
2467         .desc = "LSI MegaRAID SAS 1078",
2468         .product_name = "LSI MegaRAID SAS 8708EM2",
2469         .product_version = MEGASAS_VERSION_GEN1,
2470         .device_id = PCI_DEVICE_ID_LSI_SAS1078,
2471         .subsystem_id = 0x1013,
2472         .ioport_bar = 2,
2473         .mmio_bar = 0,
2474         .osts = MFI_1078_RM | 1,
2475         .is_express = false,
2476         .vmsd = &vmstate_megasas_gen1,
2477         .props = megasas_properties_gen1,
2478     },{
2479         .name = TYPE_MEGASAS_GEN2,
2480         .desc = "LSI MegaRAID SAS 2108",
2481         .product_name = "LSI MegaRAID SAS 9260-8i",
2482         .product_version = MEGASAS_VERSION_GEN2,
2483         .device_id = PCI_DEVICE_ID_LSI_SAS0079,
2484         .subsystem_id = 0x9261,
2485         .ioport_bar = 0,
2486         .mmio_bar = 1,
2487         .osts = MFI_GEN2_RM,
2488         .is_express = true,
2489         .vmsd = &vmstate_megasas_gen2,
2490         .props = megasas_properties_gen2,
2491     }
2492 };
2493 
2494 static void megasas_class_init(ObjectClass *oc, void *data)
2495 {
2496     DeviceClass *dc = DEVICE_CLASS(oc);
2497     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
2498     MegasasBaseClass *e = MEGASAS_DEVICE_CLASS(oc);
2499     const MegasasInfo *info = data;
2500 
2501     pc->realize = megasas_scsi_realize;
2502     pc->exit = megasas_scsi_uninit;
2503     pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2504     pc->device_id = info->device_id;
2505     pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2506     pc->subsystem_id = info->subsystem_id;
2507     pc->class_id = PCI_CLASS_STORAGE_RAID;
2508     pc->is_express = info->is_express;
2509     e->mmio_bar = info->mmio_bar;
2510     e->ioport_bar = info->ioport_bar;
2511     e->osts = info->osts;
2512     e->product_name = info->product_name;
2513     e->product_version = info->product_version;
2514     dc->props = info->props;
2515     dc->reset = megasas_scsi_reset;
2516     dc->vmsd = info->vmsd;
2517     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2518     dc->desc = info->desc;
2519 }
2520 
2521 static const TypeInfo megasas_info = {
2522     .name  = TYPE_MEGASAS_BASE,
2523     .parent = TYPE_PCI_DEVICE,
2524     .instance_size = sizeof(MegasasState),
2525     .class_size = sizeof(MegasasBaseClass),
2526     .abstract = true,
2527 };
2528 
2529 static void megasas_register_types(void)
2530 {
2531     int i;
2532 
2533     type_register_static(&megasas_info);
2534     for (i = 0; i < ARRAY_SIZE(megasas_devices); i++) {
2535         const MegasasInfo *info = &megasas_devices[i];
2536         TypeInfo type_info = {};
2537 
2538         type_info.name = info->name;
2539         type_info.parent = TYPE_MEGASAS_BASE;
2540         type_info.class_data = (void *)info;
2541         type_info.class_init = megasas_class_init;
2542 
2543         type_register(&type_info);
2544     }
2545 }
2546 
2547 type_init(megasas_register_types)
2548