xref: /openbmc/qemu/hw/scsi/megasas.c (revision dd9fe29c) 
1 /*
2  * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation
3  * Based on the linux driver code at drivers/scsi/megaraid
4  *
5  * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
6  *
7  * This library is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2 of the License, or (at your option) any later version.
11  *
12  * This library is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "hw/hw.h"
22 #include "hw/pci/pci.h"
23 #include "sysemu/dma.h"
24 #include "sysemu/block-backend.h"
25 #include "hw/pci/msi.h"
26 #include "hw/pci/msix.h"
27 #include "qemu/iov.h"
28 #include "hw/scsi/scsi.h"
29 #include "block/scsi.h"
30 #include "trace.h"
31 
32 #include "mfi.h"
33 
34 #define MEGASAS_VERSION_GEN1 "1.70"
35 #define MEGASAS_VERSION_GEN2 "1.80"
36 #define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */
37 #define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */
38 #define MEGASAS_GEN2_DEFAULT_FRAMES 1008     /* Windows requires this */
39 #define MEGASAS_MAX_SGE 128             /* Firmware limit */
40 #define MEGASAS_DEFAULT_SGE 80
41 #define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */
42 #define MEGASAS_MAX_ARRAYS 128
43 
44 #define MEGASAS_HBA_SERIAL "QEMU123456"
45 #define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
46 #define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
47 
48 #define MEGASAS_FLAG_USE_JBOD      0
49 #define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)
50 #define MEGASAS_FLAG_USE_MSI       1
51 #define MEGASAS_MASK_USE_MSI       (1 << MEGASAS_FLAG_USE_MSI)
52 #define MEGASAS_FLAG_USE_MSIX      2
53 #define MEGASAS_MASK_USE_MSIX      (1 << MEGASAS_FLAG_USE_MSIX)
54 #define MEGASAS_FLAG_USE_QUEUE64   3
55 #define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)
56 
57 static const char *mfi_frame_desc[] = {
58     "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",
59     "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"};
60 
61 typedef struct MegasasCmd {
62     uint32_t index;
63     uint16_t flags;
64     uint16_t count;
65     uint64_t context;
66 
67     hwaddr pa;
68     hwaddr pa_size;
69     union mfi_frame *frame;
70     SCSIRequest *req;
71     QEMUSGList qsg;
72     void *iov_buf;
73     size_t iov_size;
74     size_t iov_offset;
75     struct MegasasState *state;
76 } MegasasCmd;
77 
78 typedef struct MegasasState {
79     /*< private >*/
80     PCIDevice parent_obj;
81     /*< public >*/
82 
83     MemoryRegion mmio_io;
84     MemoryRegion port_io;
85     MemoryRegion queue_io;
86     uint32_t frame_hi;
87 
88     int fw_state;
89     uint32_t fw_sge;
90     uint32_t fw_cmds;
91     uint32_t flags;
92     int fw_luns;
93     int intr_mask;
94     int doorbell;
95     int busy;
96     int diag;
97     int adp_reset;
98 
99     MegasasCmd *event_cmd;
100     int event_locale;
101     int event_class;
102     int event_count;
103     int shutdown_event;
104     int boot_event;
105 
106     uint64_t sas_addr;
107     char *hba_serial;
108 
109     uint64_t reply_queue_pa;
110     void *reply_queue;
111     int reply_queue_len;
112     int reply_queue_head;
113     int reply_queue_tail;
114     uint64_t consumer_pa;
115     uint64_t producer_pa;
116 
117     MegasasCmd frames[MEGASAS_MAX_FRAMES];
118     DECLARE_BITMAP(frame_map, MEGASAS_MAX_FRAMES);
119     SCSIBus bus;
120 } MegasasState;
121 
122 typedef struct MegasasBaseClass {
123     PCIDeviceClass parent_class;
124     const char *product_name;
125     const char *product_version;
126     int mmio_bar;
127     int ioport_bar;
128     int osts;
129 } MegasasBaseClass;
130 
131 #define TYPE_MEGASAS_BASE "megasas-base"
132 #define TYPE_MEGASAS_GEN1 "megasas"
133 #define TYPE_MEGASAS_GEN2 "megasas-gen2"
134 
135 #define MEGASAS(obj) \
136     OBJECT_CHECK(MegasasState, (obj), TYPE_MEGASAS_BASE)
137 
138 #define MEGASAS_DEVICE_CLASS(oc) \
139     OBJECT_CLASS_CHECK(MegasasBaseClass, (oc), TYPE_MEGASAS_BASE)
140 #define MEGASAS_DEVICE_GET_CLASS(oc) \
141     OBJECT_GET_CLASS(MegasasBaseClass, (oc), TYPE_MEGASAS_BASE)
142 
143 #define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
144 
145 static bool megasas_intr_enabled(MegasasState *s)
146 {
147     if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=
148         MEGASAS_INTR_DISABLED_MASK) {
149         return true;
150     }
151     return false;
152 }
153 
154 static bool megasas_use_queue64(MegasasState *s)
155 {
156     return s->flags & MEGASAS_MASK_USE_QUEUE64;
157 }
158 
159 static bool megasas_use_msi(MegasasState *s)
160 {
161     return s->flags & MEGASAS_MASK_USE_MSI;
162 }
163 
164 static bool megasas_use_msix(MegasasState *s)
165 {
166     return s->flags & MEGASAS_MASK_USE_MSIX;
167 }
168 
169 static bool megasas_is_jbod(MegasasState *s)
170 {
171     return s->flags & MEGASAS_MASK_USE_JBOD;
172 }
173 
174 static void megasas_frame_set_cmd_status(unsigned long frame, uint8_t v)
175 {
176     stb_phys(&address_space_memory,
177              frame + offsetof(struct mfi_frame_header, cmd_status), v);
178 }
179 
180 static void megasas_frame_set_scsi_status(unsigned long frame, uint8_t v)
181 {
182     stb_phys(&address_space_memory,
183              frame + offsetof(struct mfi_frame_header, scsi_status), v);
184 }
185 
186 /*
187  * Context is considered opaque, but the HBA firmware is running
188  * in little endian mode. So convert it to little endian, too.
189  */
190 static uint64_t megasas_frame_get_context(unsigned long frame)
191 {
192     return ldq_le_phys(&address_space_memory,
193                        frame + offsetof(struct mfi_frame_header, context));
194 }
195 
196 static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)
197 {
198     return cmd->flags & MFI_FRAME_IEEE_SGL;
199 }
200 
201 static bool megasas_frame_is_sgl64(MegasasCmd *cmd)
202 {
203     return cmd->flags & MFI_FRAME_SGL64;
204 }
205 
206 static bool megasas_frame_is_sense64(MegasasCmd *cmd)
207 {
208     return cmd->flags & MFI_FRAME_SENSE64;
209 }
210 
211 static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,
212                                      union mfi_sgl *sgl)
213 {
214     uint64_t addr;
215 
216     if (megasas_frame_is_ieee_sgl(cmd)) {
217         addr = le64_to_cpu(sgl->sg_skinny->addr);
218     } else if (megasas_frame_is_sgl64(cmd)) {
219         addr = le64_to_cpu(sgl->sg64->addr);
220     } else {
221         addr = le32_to_cpu(sgl->sg32->addr);
222     }
223     return addr;
224 }
225 
226 static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,
227                                     union mfi_sgl *sgl)
228 {
229     uint32_t len;
230 
231     if (megasas_frame_is_ieee_sgl(cmd)) {
232         len = le32_to_cpu(sgl->sg_skinny->len);
233     } else if (megasas_frame_is_sgl64(cmd)) {
234         len = le32_to_cpu(sgl->sg64->len);
235     } else {
236         len = le32_to_cpu(sgl->sg32->len);
237     }
238     return len;
239 }
240 
241 static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,
242                                        union mfi_sgl *sgl)
243 {
244     uint8_t *next = (uint8_t *)sgl;
245 
246     if (megasas_frame_is_ieee_sgl(cmd)) {
247         next += sizeof(struct mfi_sg_skinny);
248     } else if (megasas_frame_is_sgl64(cmd)) {
249         next += sizeof(struct mfi_sg64);
250     } else {
251         next += sizeof(struct mfi_sg32);
252     }
253 
254     if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {
255         return NULL;
256     }
257     return (union mfi_sgl *)next;
258 }
259 
260 static void megasas_soft_reset(MegasasState *s);
261 
262 static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
263 {
264     int i;
265     int iov_count = 0;
266     size_t iov_size = 0;
267 
268     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
269     iov_count = cmd->frame->header.sge_count;
270     if (iov_count > MEGASAS_MAX_SGE) {
271         trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,
272                                          MEGASAS_MAX_SGE);
273         return iov_count;
274     }
275     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), iov_count);
276     for (i = 0; i < iov_count; i++) {
277         dma_addr_t iov_pa, iov_size_p;
278 
279         if (!sgl) {
280             trace_megasas_iovec_sgl_underflow(cmd->index, i);
281             goto unmap;
282         }
283         iov_pa = megasas_sgl_get_addr(cmd, sgl);
284         iov_size_p = megasas_sgl_get_len(cmd, sgl);
285         if (!iov_pa || !iov_size_p) {
286             trace_megasas_iovec_sgl_invalid(cmd->index, i,
287                                             iov_pa, iov_size_p);
288             goto unmap;
289         }
290         qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);
291         sgl = megasas_sgl_next(cmd, sgl);
292         iov_size += (size_t)iov_size_p;
293     }
294     if (cmd->iov_size > iov_size) {
295         trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
296     } else if (cmd->iov_size < iov_size) {
297         trace_megasas_iovec_underflow(cmd->iov_size, iov_size, cmd->iov_size);
298     }
299     cmd->iov_offset = 0;
300     return 0;
301 unmap:
302     qemu_sglist_destroy(&cmd->qsg);
303     return iov_count - i;
304 }
305 
306 static void megasas_unmap_sgl(MegasasCmd *cmd)
307 {
308     qemu_sglist_destroy(&cmd->qsg);
309     cmd->iov_offset = 0;
310 }
311 
312 /*
313  * passthrough sense and io sense are at the same offset
314  */
315 static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,
316     uint8_t sense_len)
317 {
318     PCIDevice *pcid = PCI_DEVICE(cmd->state);
319     uint32_t pa_hi = 0, pa_lo;
320     hwaddr pa;
321 
322     if (sense_len > cmd->frame->header.sense_len) {
323         sense_len = cmd->frame->header.sense_len;
324     }
325     if (sense_len) {
326         pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);
327         if (megasas_frame_is_sense64(cmd)) {
328             pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);
329         }
330         pa = ((uint64_t) pa_hi << 32) | pa_lo;
331         pci_dma_write(pcid, pa, sense_ptr, sense_len);
332         cmd->frame->header.sense_len = sense_len;
333     }
334     return sense_len;
335 }
336 
337 static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)
338 {
339     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
340     uint8_t sense_len = 18;
341 
342     memset(sense_buf, 0, sense_len);
343     sense_buf[0] = 0xf0;
344     sense_buf[2] = sense.key;
345     sense_buf[7] = 10;
346     sense_buf[12] = sense.asc;
347     sense_buf[13] = sense.ascq;
348     megasas_build_sense(cmd, sense_buf, sense_len);
349 }
350 
351 static void megasas_copy_sense(MegasasCmd *cmd)
352 {
353     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
354     uint8_t sense_len;
355 
356     sense_len = scsi_req_get_sense(cmd->req, sense_buf,
357                                    SCSI_SENSE_BUF_SIZE);
358     megasas_build_sense(cmd, sense_buf, sense_len);
359 }
360 
361 /*
362  * Format an INQUIRY CDB
363  */
364 static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)
365 {
366     memset(cdb, 0, 6);
367     cdb[0] = INQUIRY;
368     if (pg > 0) {
369         cdb[1] = 0x1;
370         cdb[2] = pg;
371     }
372     cdb[3] = (len >> 8) & 0xff;
373     cdb[4] = (len & 0xff);
374     return len;
375 }
376 
377 /*
378  * Encode lba and len into a READ_16/WRITE_16 CDB
379  */
380 static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,
381                                uint32_t len, bool is_write)
382 {
383     memset(cdb, 0x0, 16);
384     if (is_write) {
385         cdb[0] = WRITE_16;
386     } else {
387         cdb[0] = READ_16;
388     }
389     cdb[2] = (lba >> 56) & 0xff;
390     cdb[3] = (lba >> 48) & 0xff;
391     cdb[4] = (lba >> 40) & 0xff;
392     cdb[5] = (lba >> 32) & 0xff;
393     cdb[6] = (lba >> 24) & 0xff;
394     cdb[7] = (lba >> 16) & 0xff;
395     cdb[8] = (lba >> 8) & 0xff;
396     cdb[9] = (lba) & 0xff;
397     cdb[10] = (len >> 24) & 0xff;
398     cdb[11] = (len >> 16) & 0xff;
399     cdb[12] = (len >> 8) & 0xff;
400     cdb[13] = (len) & 0xff;
401 }
402 
403 /*
404  * Utility functions
405  */
406 static uint64_t megasas_fw_time(void)
407 {
408     struct tm curtime;
409     uint64_t bcd_time;
410 
411     qemu_get_timedate(&curtime, 0);
412     bcd_time = ((uint64_t)curtime.tm_sec & 0xff) << 48 |
413         ((uint64_t)curtime.tm_min & 0xff)  << 40 |
414         ((uint64_t)curtime.tm_hour & 0xff) << 32 |
415         ((uint64_t)curtime.tm_mday & 0xff) << 24 |
416         ((uint64_t)curtime.tm_mon & 0xff)  << 16 |
417         ((uint64_t)(curtime.tm_year + 1900) & 0xffff);
418 
419     return bcd_time;
420 }
421 
422 /*
423  * Default disk sata address
424  * 0x1221 is the magic number as
425  * present in real hardware,
426  * so use it here, too.
427  */
428 static uint64_t megasas_get_sata_addr(uint16_t id)
429 {
430     uint64_t addr = (0x1221ULL << 48);
431     return addr & (id << 24);
432 }
433 
434 /*
435  * Frame handling
436  */
437 static int megasas_next_index(MegasasState *s, int index, int limit)
438 {
439     index++;
440     if (index == limit) {
441         index = 0;
442     }
443     return index;
444 }
445 
446 static MegasasCmd *megasas_lookup_frame(MegasasState *s,
447     hwaddr frame)
448 {
449     MegasasCmd *cmd = NULL;
450     int num = 0, index;
451 
452     index = s->reply_queue_head;
453 
454     while (num < s->fw_cmds) {
455         if (s->frames[index].pa && s->frames[index].pa == frame) {
456             cmd = &s->frames[index];
457             break;
458         }
459         index = megasas_next_index(s, index, s->fw_cmds);
460         num++;
461     }
462 
463     return cmd;
464 }
465 
466 static void megasas_unmap_frame(MegasasState *s, MegasasCmd *cmd)
467 {
468     PCIDevice *p = PCI_DEVICE(s);
469 
470     pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0);
471     cmd->frame = NULL;
472     cmd->pa = 0;
473     clear_bit(cmd->index, s->frame_map);
474 }
475 
476 /*
477  * This absolutely needs to be locked if
478  * qemu ever goes multithreaded.
479  */
480 static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
481     hwaddr frame, uint64_t context, int count)
482 {
483     PCIDevice *pcid = PCI_DEVICE(s);
484     MegasasCmd *cmd = NULL;
485     int frame_size = MFI_FRAME_SIZE * 16;
486     hwaddr frame_size_p = frame_size;
487     unsigned long index;
488 
489     index = 0;
490     while (index < s->fw_cmds) {
491         index = find_next_zero_bit(s->frame_map, s->fw_cmds, index);
492         if (!s->frames[index].pa)
493             break;
494         /* Busy frame found */
495         trace_megasas_qf_mapped(index);
496     }
497     if (index >= s->fw_cmds) {
498         /* All frames busy */
499         trace_megasas_qf_busy(frame);
500         return NULL;
501     }
502     cmd = &s->frames[index];
503     set_bit(index, s->frame_map);
504     trace_megasas_qf_new(index, frame);
505 
506     cmd->pa = frame;
507     /* Map all possible frames */
508     cmd->frame = pci_dma_map(pcid, frame, &frame_size_p, 0);
509     if (frame_size_p != frame_size) {
510         trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
511         if (cmd->frame) {
512             megasas_unmap_frame(s, cmd);
513         }
514         s->event_count++;
515         return NULL;
516     }
517     cmd->pa_size = frame_size_p;
518     cmd->context = context;
519     if (!megasas_use_queue64(s)) {
520         cmd->context &= (uint64_t)0xFFFFFFFF;
521     }
522     cmd->count = count;
523     s->busy++;
524 
525     if (s->consumer_pa) {
526         s->reply_queue_tail = ldl_le_phys(&address_space_memory,
527                                           s->consumer_pa);
528     }
529     trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,
530                              s->reply_queue_head, s->reply_queue_tail, s->busy);
531 
532     return cmd;
533 }
534 
535 static void megasas_complete_frame(MegasasState *s, uint64_t context)
536 {
537     PCIDevice *pci_dev = PCI_DEVICE(s);
538     int tail, queue_offset;
539 
540     /* Decrement busy count */
541     s->busy--;
542     if (s->reply_queue_pa) {
543         /*
544          * Put command on the reply queue.
545          * Context is opaque, but emulation is running in
546          * little endian. So convert it.
547          */
548         if (megasas_use_queue64(s)) {
549             queue_offset = s->reply_queue_head * sizeof(uint64_t);
550             stq_le_phys(&address_space_memory,
551                         s->reply_queue_pa + queue_offset, context);
552         } else {
553             queue_offset = s->reply_queue_head * sizeof(uint32_t);
554             stl_le_phys(&address_space_memory,
555                         s->reply_queue_pa + queue_offset, context);
556         }
557         s->reply_queue_tail = ldl_le_phys(&address_space_memory,
558                                           s->consumer_pa);
559         trace_megasas_qf_complete(context, s->reply_queue_head,
560                                   s->reply_queue_tail, s->busy);
561     }
562 
563     if (megasas_intr_enabled(s)) {
564         /* Update reply queue pointer */
565         s->reply_queue_tail = ldl_le_phys(&address_space_memory,
566                                           s->consumer_pa);
567         tail = s->reply_queue_head;
568         s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
569         trace_megasas_qf_update(s->reply_queue_head, s->reply_queue_tail,
570                                 s->busy);
571         stl_le_phys(&address_space_memory,
572                     s->producer_pa, s->reply_queue_head);
573         /* Notify HBA */
574         if (msix_enabled(pci_dev)) {
575             trace_megasas_msix_raise(0);
576             msix_notify(pci_dev, 0);
577         } else if (msi_enabled(pci_dev)) {
578             trace_megasas_msi_raise(0);
579             msi_notify(pci_dev, 0);
580         } else {
581             s->doorbell++;
582             if (s->doorbell == 1) {
583                 trace_megasas_irq_raise();
584                 pci_irq_assert(pci_dev);
585             }
586         }
587     } else {
588         trace_megasas_qf_complete_noirq(context);
589     }
590 }
591 
592 static void megasas_reset_frames(MegasasState *s)
593 {
594     int i;
595     MegasasCmd *cmd;
596 
597     for (i = 0; i < s->fw_cmds; i++) {
598         cmd = &s->frames[i];
599         if (cmd->pa) {
600             megasas_unmap_frame(s, cmd);
601         }
602     }
603     bitmap_zero(s->frame_map, MEGASAS_MAX_FRAMES);
604 }
605 
606 static void megasas_abort_command(MegasasCmd *cmd)
607 {
608     if (cmd->req) {
609         scsi_req_cancel(cmd->req);
610         cmd->req = NULL;
611     }
612 }
613 
614 static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
615 {
616     PCIDevice *pcid = PCI_DEVICE(s);
617     uint32_t pa_hi, pa_lo;
618     hwaddr iq_pa, initq_size = sizeof(struct mfi_init_qinfo);
619     struct mfi_init_qinfo *initq = NULL;
620     uint32_t flags;
621     int ret = MFI_STAT_OK;
622 
623     if (s->reply_queue_pa) {
624         trace_megasas_initq_mapped(s->reply_queue_pa);
625         goto out;
626     }
627     pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);
628     pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);
629     iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);
630     trace_megasas_init_firmware((uint64_t)iq_pa);
631     initq = pci_dma_map(pcid, iq_pa, &initq_size, 0);
632     if (!initq || initq_size != sizeof(*initq)) {
633         trace_megasas_initq_map_failed(cmd->index);
634         s->event_count++;
635         ret = MFI_STAT_MEMORY_NOT_AVAILABLE;
636         goto out;
637     }
638     s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;
639     if (s->reply_queue_len > s->fw_cmds) {
640         trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);
641         s->event_count++;
642         ret = MFI_STAT_INVALID_PARAMETER;
643         goto out;
644     }
645     pa_lo = le32_to_cpu(initq->rq_addr_lo);
646     pa_hi = le32_to_cpu(initq->rq_addr_hi);
647     s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;
648     pa_lo = le32_to_cpu(initq->ci_addr_lo);
649     pa_hi = le32_to_cpu(initq->ci_addr_hi);
650     s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
651     pa_lo = le32_to_cpu(initq->pi_addr_lo);
652     pa_hi = le32_to_cpu(initq->pi_addr_hi);
653     s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
654     s->reply_queue_head = ldl_le_phys(&address_space_memory, s->producer_pa);
655     s->reply_queue_tail = ldl_le_phys(&address_space_memory, s->consumer_pa);
656     flags = le32_to_cpu(initq->flags);
657     if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
658         s->flags |= MEGASAS_MASK_USE_QUEUE64;
659     }
660     trace_megasas_init_queue((unsigned long)s->reply_queue_pa,
661                              s->reply_queue_len, s->reply_queue_head,
662                              s->reply_queue_tail, flags);
663     megasas_reset_frames(s);
664     s->fw_state = MFI_FWSTATE_OPERATIONAL;
665 out:
666     if (initq) {
667         pci_dma_unmap(pcid, initq, initq_size, 0, 0);
668     }
669     return ret;
670 }
671 
672 static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
673 {
674     dma_addr_t iov_pa, iov_size;
675 
676     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
677     if (!cmd->frame->header.sge_count) {
678         trace_megasas_dcmd_zero_sge(cmd->index);
679         cmd->iov_size = 0;
680         return 0;
681     } else if (cmd->frame->header.sge_count > 1) {
682         trace_megasas_dcmd_invalid_sge(cmd->index,
683                                        cmd->frame->header.sge_count);
684         cmd->iov_size = 0;
685         return -1;
686     }
687     iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
688     iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
689     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), 1);
690     qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
691     cmd->iov_size = iov_size;
692     return cmd->iov_size;
693 }
694 
695 static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
696 {
697     trace_megasas_finish_dcmd(cmd->index, iov_size);
698 
699     if (cmd->frame->header.sge_count) {
700         qemu_sglist_destroy(&cmd->qsg);
701     }
702     if (iov_size > cmd->iov_size) {
703         if (megasas_frame_is_ieee_sgl(cmd)) {
704             cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);
705         } else if (megasas_frame_is_sgl64(cmd)) {
706             cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);
707         } else {
708             cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);
709         }
710     }
711     cmd->iov_size = 0;
712 }
713 
714 static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
715 {
716     PCIDevice *pci_dev = PCI_DEVICE(s);
717     PCIDeviceClass *pci_class = PCI_DEVICE_GET_CLASS(pci_dev);
718     MegasasBaseClass *base_class = MEGASAS_DEVICE_GET_CLASS(s);
719     struct mfi_ctrl_info info;
720     size_t dcmd_size = sizeof(info);
721     BusChild *kid;
722     int num_pd_disks = 0;
723 
724     memset(&info, 0x0, cmd->iov_size);
725     if (cmd->iov_size < dcmd_size) {
726         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
727                                             dcmd_size);
728         return MFI_STAT_INVALID_PARAMETER;
729     }
730 
731     info.pci.vendor = cpu_to_le16(pci_class->vendor_id);
732     info.pci.device = cpu_to_le16(pci_class->device_id);
733     info.pci.subvendor = cpu_to_le16(pci_class->subsystem_vendor_id);
734     info.pci.subdevice = cpu_to_le16(pci_class->subsystem_id);
735 
736     /*
737      * For some reason the firmware supports
738      * only up to 8 device ports.
739      * Despite supporting a far larger number
740      * of devices for the physical devices.
741      * So just display the first 8 devices
742      * in the device port list, independent
743      * of how many logical devices are actually
744      * present.
745      */
746     info.host.type = MFI_INFO_HOST_PCIE;
747     info.device.type = MFI_INFO_DEV_SAS3G;
748     info.device.port_count = 8;
749     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
750         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
751         uint16_t pd_id;
752 
753         if (num_pd_disks < 8) {
754             pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
755             info.device.port_addr[num_pd_disks] =
756                 cpu_to_le64(megasas_get_sata_addr(pd_id));
757         }
758         num_pd_disks++;
759     }
760 
761     memcpy(info.product_name, base_class->product_name, 24);
762     snprintf(info.serial_number, 32, "%s", s->hba_serial);
763     snprintf(info.package_version, 0x60, "%s-QEMU", QEMU_VERSION);
764     memcpy(info.image_component[0].name, "APP", 3);
765     snprintf(info.image_component[0].version, 10, "%s-QEMU",
766              base_class->product_version);
767     memcpy(info.image_component[0].build_date, "Apr  1 2014", 11);
768     memcpy(info.image_component[0].build_time, "12:34:56", 8);
769     info.image_component_count = 1;
770     if (pci_dev->has_rom) {
771         uint8_t biosver[32];
772         uint8_t *ptr;
773 
774         ptr = memory_region_get_ram_ptr(&pci_dev->rom);
775         memcpy(biosver, ptr + 0x41, 31);
776         memcpy(info.image_component[1].name, "BIOS", 4);
777         memcpy(info.image_component[1].version, biosver,
778                strlen((const char *)biosver));
779         info.image_component_count++;
780     }
781     info.current_fw_time = cpu_to_le32(megasas_fw_time());
782     info.max_arms = 32;
783     info.max_spans = 8;
784     info.max_arrays = MEGASAS_MAX_ARRAYS;
785     info.max_lds = MFI_MAX_LD;
786     info.max_cmds = cpu_to_le16(s->fw_cmds);
787     info.max_sg_elements = cpu_to_le16(s->fw_sge);
788     info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);
789     if (!megasas_is_jbod(s))
790         info.lds_present = cpu_to_le16(num_pd_disks);
791     info.pd_present = cpu_to_le16(num_pd_disks);
792     info.pd_disks_present = cpu_to_le16(num_pd_disks);
793     info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |
794                                    MFI_INFO_HW_MEM |
795                                    MFI_INFO_HW_FLASH);
796     info.memory_size = cpu_to_le16(512);
797     info.nvram_size = cpu_to_le16(32);
798     info.flash_size = cpu_to_le16(16);
799     info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);
800     info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |
801                                     MFI_INFO_AOPS_SELF_DIAGNOSTIC |
802                                     MFI_INFO_AOPS_MIXED_ARRAY);
803     info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |
804                                MFI_INFO_LDOPS_ACCESS_POLICY |
805                                MFI_INFO_LDOPS_IO_POLICY |
806                                MFI_INFO_LDOPS_WRITE_POLICY |
807                                MFI_INFO_LDOPS_READ_POLICY);
808     info.max_strips_per_io = cpu_to_le16(s->fw_sge);
809     info.stripe_sz_ops.min = 3;
810     info.stripe_sz_ops.max = ffs(MEGASAS_MAX_SECTORS + 1) - 1;
811     info.properties.pred_fail_poll_interval = cpu_to_le16(300);
812     info.properties.intr_throttle_cnt = cpu_to_le16(16);
813     info.properties.intr_throttle_timeout = cpu_to_le16(50);
814     info.properties.rebuild_rate = 30;
815     info.properties.patrol_read_rate = 30;
816     info.properties.bgi_rate = 30;
817     info.properties.cc_rate = 30;
818     info.properties.recon_rate = 30;
819     info.properties.cache_flush_interval = 4;
820     info.properties.spinup_drv_cnt = 2;
821     info.properties.spinup_delay = 6;
822     info.properties.ecc_bucket_size = 15;
823     info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);
824     info.properties.expose_encl_devices = 1;
825     info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);
826     info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |
827                                MFI_INFO_PDOPS_FORCE_OFFLINE);
828     info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |
829                                        MFI_INFO_PDMIX_SATA |
830                                        MFI_INFO_PDMIX_LD);
831 
832     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
833     return MFI_STAT_OK;
834 }
835 
836 static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)
837 {
838     struct mfi_defaults info;
839     size_t dcmd_size = sizeof(struct mfi_defaults);
840 
841     memset(&info, 0x0, dcmd_size);
842     if (cmd->iov_size < dcmd_size) {
843         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
844                                             dcmd_size);
845         return MFI_STAT_INVALID_PARAMETER;
846     }
847 
848     info.sas_addr = cpu_to_le64(s->sas_addr);
849     info.stripe_size = 3;
850     info.flush_time = 4;
851     info.background_rate = 30;
852     info.allow_mix_in_enclosure = 1;
853     info.allow_mix_in_ld = 1;
854     info.direct_pd_mapping = 1;
855     /* Enable for BIOS support */
856     info.bios_enumerate_lds = 1;
857     info.disable_ctrl_r = 1;
858     info.expose_enclosure_devices = 1;
859     info.disable_preboot_cli = 1;
860     info.cluster_disable = 1;
861 
862     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
863     return MFI_STAT_OK;
864 }
865 
866 static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)
867 {
868     struct mfi_bios_data info;
869     size_t dcmd_size = sizeof(info);
870 
871     memset(&info, 0x0, dcmd_size);
872     if (cmd->iov_size < dcmd_size) {
873         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
874                                             dcmd_size);
875         return MFI_STAT_INVALID_PARAMETER;
876     }
877     info.continue_on_error = 1;
878     info.verbose = 1;
879     if (megasas_is_jbod(s)) {
880         info.expose_all_drives = 1;
881     }
882 
883     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
884     return MFI_STAT_OK;
885 }
886 
887 static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)
888 {
889     uint64_t fw_time;
890     size_t dcmd_size = sizeof(fw_time);
891 
892     fw_time = cpu_to_le64(megasas_fw_time());
893 
894     cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);
895     return MFI_STAT_OK;
896 }
897 
898 static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)
899 {
900     uint64_t fw_time;
901 
902     /* This is a dummy; setting of firmware time is not allowed */
903     memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));
904 
905     trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);
906     fw_time = cpu_to_le64(megasas_fw_time());
907     return MFI_STAT_OK;
908 }
909 
910 static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)
911 {
912     struct mfi_evt_log_state info;
913     size_t dcmd_size = sizeof(info);
914 
915     memset(&info, 0, dcmd_size);
916 
917     info.newest_seq_num = cpu_to_le32(s->event_count);
918     info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
919     info.boot_seq_num = cpu_to_le32(s->boot_event);
920 
921     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
922     return MFI_STAT_OK;
923 }
924 
925 static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
926 {
927     union mfi_evt event;
928 
929     if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {
930         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
931                                             sizeof(struct mfi_evt_detail));
932         return MFI_STAT_INVALID_PARAMETER;
933     }
934     s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);
935     event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);
936     s->event_locale = event.members.locale;
937     s->event_class = event.members.class;
938     s->event_cmd = cmd;
939     /* Decrease busy count; event frame doesn't count here */
940     s->busy--;
941     cmd->iov_size = sizeof(struct mfi_evt_detail);
942     return MFI_STAT_INVALID_STATUS;
943 }
944 
945 static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
946 {
947     struct mfi_pd_list info;
948     size_t dcmd_size = sizeof(info);
949     BusChild *kid;
950     uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
951 
952     memset(&info, 0, dcmd_size);
953     offset = 8;
954     dcmd_limit = offset + sizeof(struct mfi_pd_address);
955     if (cmd->iov_size < dcmd_limit) {
956         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
957                                             dcmd_limit);
958         return MFI_STAT_INVALID_PARAMETER;
959     }
960 
961     max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);
962     if (max_pd_disks > MFI_MAX_SYS_PDS) {
963         max_pd_disks = MFI_MAX_SYS_PDS;
964     }
965     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
966         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
967         uint16_t pd_id;
968 
969         if (num_pd_disks >= max_pd_disks)
970             break;
971 
972         pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
973         info.addr[num_pd_disks].device_id = cpu_to_le16(pd_id);
974         info.addr[num_pd_disks].encl_device_id = 0xFFFF;
975         info.addr[num_pd_disks].encl_index = 0;
976         info.addr[num_pd_disks].slot_number = sdev->id & 0xFF;
977         info.addr[num_pd_disks].scsi_dev_type = sdev->type;
978         info.addr[num_pd_disks].connect_port_bitmap = 0x1;
979         info.addr[num_pd_disks].sas_addr[0] =
980             cpu_to_le64(megasas_get_sata_addr(pd_id));
981         num_pd_disks++;
982         offset += sizeof(struct mfi_pd_address);
983     }
984     trace_megasas_dcmd_pd_get_list(cmd->index, num_pd_disks,
985                                    max_pd_disks, offset);
986 
987     info.size = cpu_to_le32(offset);
988     info.count = cpu_to_le32(num_pd_disks);
989 
990     cmd->iov_size -= dma_buf_read((uint8_t *)&info, offset, &cmd->qsg);
991     return MFI_STAT_OK;
992 }
993 
994 static int megasas_dcmd_pd_list_query(MegasasState *s, MegasasCmd *cmd)
995 {
996     uint16_t flags;
997 
998     /* mbox0 contains flags */
999     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1000     trace_megasas_dcmd_pd_list_query(cmd->index, flags);
1001     if (flags == MR_PD_QUERY_TYPE_ALL ||
1002         megasas_is_jbod(s)) {
1003         return megasas_dcmd_pd_get_list(s, cmd);
1004     }
1005 
1006     return MFI_STAT_OK;
1007 }
1008 
1009 static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun,
1010                                       MegasasCmd *cmd)
1011 {
1012     struct mfi_pd_info *info = cmd->iov_buf;
1013     size_t dcmd_size = sizeof(struct mfi_pd_info);
1014     uint64_t pd_size;
1015     uint16_t pd_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1016     uint8_t cmdbuf[6];
1017     SCSIRequest *req;
1018     size_t len, resid;
1019 
1020     if (!cmd->iov_buf) {
1021         cmd->iov_buf = g_malloc0(dcmd_size);
1022         info = cmd->iov_buf;
1023         info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */
1024         info->vpd_page83[0] = 0x7f;
1025         megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data));
1026         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1027         if (!req) {
1028             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1029                                                 "PD get info std inquiry");
1030             g_free(cmd->iov_buf);
1031             cmd->iov_buf = NULL;
1032             return MFI_STAT_FLASH_ALLOC_FAIL;
1033         }
1034         trace_megasas_dcmd_internal_submit(cmd->index,
1035                                            "PD get info std inquiry", lun);
1036         len = scsi_req_enqueue(req);
1037         if (len > 0) {
1038             cmd->iov_size = len;
1039             scsi_req_continue(req);
1040         }
1041         return MFI_STAT_INVALID_STATUS;
1042     } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) {
1043         megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83));
1044         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1045         if (!req) {
1046             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1047                                                 "PD get info vpd inquiry");
1048             return MFI_STAT_FLASH_ALLOC_FAIL;
1049         }
1050         trace_megasas_dcmd_internal_submit(cmd->index,
1051                                            "PD get info vpd inquiry", lun);
1052         len = scsi_req_enqueue(req);
1053         if (len > 0) {
1054             cmd->iov_size = len;
1055             scsi_req_continue(req);
1056         }
1057         return MFI_STAT_INVALID_STATUS;
1058     }
1059     /* Finished, set FW state */
1060     if ((info->inquiry_data[0] >> 5) == 0) {
1061         if (megasas_is_jbod(cmd->state)) {
1062             info->fw_state = cpu_to_le16(MFI_PD_STATE_SYSTEM);
1063         } else {
1064             info->fw_state = cpu_to_le16(MFI_PD_STATE_ONLINE);
1065         }
1066     } else {
1067         info->fw_state = cpu_to_le16(MFI_PD_STATE_OFFLINE);
1068     }
1069 
1070     info->ref.v.device_id = cpu_to_le16(pd_id);
1071     info->state.ddf.pd_type = cpu_to_le16(MFI_PD_DDF_TYPE_IN_VD|
1072                                           MFI_PD_DDF_TYPE_INTF_SAS);
1073     blk_get_geometry(sdev->conf.blk, &pd_size);
1074     info->raw_size = cpu_to_le64(pd_size);
1075     info->non_coerced_size = cpu_to_le64(pd_size);
1076     info->coerced_size = cpu_to_le64(pd_size);
1077     info->encl_device_id = 0xFFFF;
1078     info->slot_number = (sdev->id & 0xFF);
1079     info->path_info.count = 1;
1080     info->path_info.sas_addr[0] =
1081         cpu_to_le64(megasas_get_sata_addr(pd_id));
1082     info->connected_port_bitmap = 0x1;
1083     info->device_speed = 1;
1084     info->link_speed = 1;
1085     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1086     g_free(cmd->iov_buf);
1087     cmd->iov_size = dcmd_size - resid;
1088     cmd->iov_buf = NULL;
1089     return MFI_STAT_OK;
1090 }
1091 
1092 static int megasas_dcmd_pd_get_info(MegasasState *s, MegasasCmd *cmd)
1093 {
1094     size_t dcmd_size = sizeof(struct mfi_pd_info);
1095     uint16_t pd_id;
1096     uint8_t target_id, lun_id;
1097     SCSIDevice *sdev = NULL;
1098     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1099 
1100     if (cmd->iov_size < dcmd_size) {
1101         return MFI_STAT_INVALID_PARAMETER;
1102     }
1103 
1104     /* mbox0 has the ID */
1105     pd_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1106     target_id = (pd_id >> 8) & 0xFF;
1107     lun_id = pd_id & 0xFF;
1108     sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
1109     trace_megasas_dcmd_pd_get_info(cmd->index, pd_id);
1110 
1111     if (sdev) {
1112         /* Submit inquiry */
1113         retval = megasas_pd_get_info_submit(sdev, pd_id, cmd);
1114     }
1115 
1116     return retval;
1117 }
1118 
1119 static int megasas_dcmd_ld_get_list(MegasasState *s, MegasasCmd *cmd)
1120 {
1121     struct mfi_ld_list info;
1122     size_t dcmd_size = sizeof(info), resid;
1123     uint32_t num_ld_disks = 0, max_ld_disks;
1124     uint64_t ld_size;
1125     BusChild *kid;
1126 
1127     memset(&info, 0, dcmd_size);
1128     if (cmd->iov_size > dcmd_size) {
1129         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1130                                             dcmd_size);
1131         return MFI_STAT_INVALID_PARAMETER;
1132     }
1133 
1134     max_ld_disks = (cmd->iov_size - 8) / 16;
1135     if (megasas_is_jbod(s)) {
1136         max_ld_disks = 0;
1137     }
1138     if (max_ld_disks > MFI_MAX_LD) {
1139         max_ld_disks = MFI_MAX_LD;
1140     }
1141     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1142         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1143 
1144         if (num_ld_disks >= max_ld_disks) {
1145             break;
1146         }
1147         /* Logical device size is in blocks */
1148         blk_get_geometry(sdev->conf.blk, &ld_size);
1149         info.ld_list[num_ld_disks].ld.v.target_id = sdev->id;
1150         info.ld_list[num_ld_disks].state = MFI_LD_STATE_OPTIMAL;
1151         info.ld_list[num_ld_disks].size = cpu_to_le64(ld_size);
1152         num_ld_disks++;
1153     }
1154     info.ld_count = cpu_to_le32(num_ld_disks);
1155     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1156 
1157     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1158     cmd->iov_size = dcmd_size - resid;
1159     return MFI_STAT_OK;
1160 }
1161 
1162 static int megasas_dcmd_ld_list_query(MegasasState *s, MegasasCmd *cmd)
1163 {
1164     uint16_t flags;
1165     struct mfi_ld_targetid_list info;
1166     size_t dcmd_size = sizeof(info), resid;
1167     uint32_t num_ld_disks = 0, max_ld_disks = s->fw_luns;
1168     BusChild *kid;
1169 
1170     /* mbox0 contains flags */
1171     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1172     trace_megasas_dcmd_ld_list_query(cmd->index, flags);
1173     if (flags != MR_LD_QUERY_TYPE_ALL &&
1174         flags != MR_LD_QUERY_TYPE_EXPOSED_TO_HOST) {
1175         max_ld_disks = 0;
1176     }
1177 
1178     memset(&info, 0, dcmd_size);
1179     if (cmd->iov_size < 12) {
1180         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1181                                             dcmd_size);
1182         return MFI_STAT_INVALID_PARAMETER;
1183     }
1184     dcmd_size = sizeof(uint32_t) * 2 + 3;
1185     max_ld_disks = cmd->iov_size - dcmd_size;
1186     if (megasas_is_jbod(s)) {
1187         max_ld_disks = 0;
1188     }
1189     if (max_ld_disks > MFI_MAX_LD) {
1190         max_ld_disks = MFI_MAX_LD;
1191     }
1192     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1193         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1194 
1195         if (num_ld_disks >= max_ld_disks) {
1196             break;
1197         }
1198         info.targetid[num_ld_disks] = sdev->lun;
1199         num_ld_disks++;
1200         dcmd_size++;
1201     }
1202     info.ld_count = cpu_to_le32(num_ld_disks);
1203     info.size = dcmd_size;
1204     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1205 
1206     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1207     cmd->iov_size = dcmd_size - resid;
1208     return MFI_STAT_OK;
1209 }
1210 
1211 static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun,
1212                                       MegasasCmd *cmd)
1213 {
1214     struct mfi_ld_info *info = cmd->iov_buf;
1215     size_t dcmd_size = sizeof(struct mfi_ld_info);
1216     uint8_t cdb[6];
1217     SCSIRequest *req;
1218     ssize_t len, resid;
1219     uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1220     uint64_t ld_size;
1221 
1222     if (!cmd->iov_buf) {
1223         cmd->iov_buf = g_malloc0(dcmd_size);
1224         info = cmd->iov_buf;
1225         megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83));
1226         req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd);
1227         if (!req) {
1228             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1229                                                 "LD get info vpd inquiry");
1230             g_free(cmd->iov_buf);
1231             cmd->iov_buf = NULL;
1232             return MFI_STAT_FLASH_ALLOC_FAIL;
1233         }
1234         trace_megasas_dcmd_internal_submit(cmd->index,
1235                                            "LD get info vpd inquiry", lun);
1236         len = scsi_req_enqueue(req);
1237         if (len > 0) {
1238             cmd->iov_size = len;
1239             scsi_req_continue(req);
1240         }
1241         return MFI_STAT_INVALID_STATUS;
1242     }
1243 
1244     info->ld_config.params.state = MFI_LD_STATE_OPTIMAL;
1245     info->ld_config.properties.ld.v.target_id = lun;
1246     info->ld_config.params.stripe_size = 3;
1247     info->ld_config.params.num_drives = 1;
1248     info->ld_config.params.is_consistent = 1;
1249     /* Logical device size is in blocks */
1250     blk_get_geometry(sdev->conf.blk, &ld_size);
1251     info->size = cpu_to_le64(ld_size);
1252     memset(info->ld_config.span, 0, sizeof(info->ld_config.span));
1253     info->ld_config.span[0].start_block = 0;
1254     info->ld_config.span[0].num_blocks = info->size;
1255     info->ld_config.span[0].array_ref = cpu_to_le16(sdev_id);
1256 
1257     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1258     g_free(cmd->iov_buf);
1259     cmd->iov_size = dcmd_size - resid;
1260     cmd->iov_buf = NULL;
1261     return MFI_STAT_OK;
1262 }
1263 
1264 static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
1265 {
1266     struct mfi_ld_info info;
1267     size_t dcmd_size = sizeof(info);
1268     uint16_t ld_id;
1269     uint32_t max_ld_disks = s->fw_luns;
1270     SCSIDevice *sdev = NULL;
1271     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1272 
1273     if (cmd->iov_size < dcmd_size) {
1274         return MFI_STAT_INVALID_PARAMETER;
1275     }
1276 
1277     /* mbox0 has the ID */
1278     ld_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1279     trace_megasas_dcmd_ld_get_info(cmd->index, ld_id);
1280 
1281     if (megasas_is_jbod(s)) {
1282         return MFI_STAT_DEVICE_NOT_FOUND;
1283     }
1284 
1285     if (ld_id < max_ld_disks) {
1286         sdev = scsi_device_find(&s->bus, 0, ld_id, 0);
1287     }
1288 
1289     if (sdev) {
1290         retval = megasas_ld_get_info_submit(sdev, ld_id, cmd);
1291     }
1292 
1293     return retval;
1294 }
1295 
1296 static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
1297 {
1298     uint8_t data[4096];
1299     struct mfi_config_data *info;
1300     int num_pd_disks = 0, array_offset, ld_offset;
1301     BusChild *kid;
1302 
1303     if (cmd->iov_size > 4096) {
1304         return MFI_STAT_INVALID_PARAMETER;
1305     }
1306 
1307     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1308         num_pd_disks++;
1309     }
1310     info = (struct mfi_config_data *)&data;
1311     /*
1312      * Array mapping:
1313      * - One array per SCSI device
1314      * - One logical drive per SCSI device
1315      *   spanning the entire device
1316      */
1317     info->array_count = num_pd_disks;
1318     info->array_size = sizeof(struct mfi_array) * num_pd_disks;
1319     info->log_drv_count = num_pd_disks;
1320     info->log_drv_size = sizeof(struct mfi_ld_config) * num_pd_disks;
1321     info->spares_count = 0;
1322     info->spares_size = sizeof(struct mfi_spare);
1323     info->size = sizeof(struct mfi_config_data) + info->array_size +
1324         info->log_drv_size;
1325     if (info->size > 4096) {
1326         return MFI_STAT_INVALID_PARAMETER;
1327     }
1328 
1329     array_offset = sizeof(struct mfi_config_data);
1330     ld_offset = array_offset + sizeof(struct mfi_array) * num_pd_disks;
1331 
1332     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1333         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1334         uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
1335         struct mfi_array *array;
1336         struct mfi_ld_config *ld;
1337         uint64_t pd_size;
1338         int i;
1339 
1340         array = (struct mfi_array *)(data + array_offset);
1341         blk_get_geometry(sdev->conf.blk, &pd_size);
1342         array->size = cpu_to_le64(pd_size);
1343         array->num_drives = 1;
1344         array->array_ref = cpu_to_le16(sdev_id);
1345         array->pd[0].ref.v.device_id = cpu_to_le16(sdev_id);
1346         array->pd[0].ref.v.seq_num = 0;
1347         array->pd[0].fw_state = MFI_PD_STATE_ONLINE;
1348         array->pd[0].encl.pd = 0xFF;
1349         array->pd[0].encl.slot = (sdev->id & 0xFF);
1350         for (i = 1; i < MFI_MAX_ROW_SIZE; i++) {
1351             array->pd[i].ref.v.device_id = 0xFFFF;
1352             array->pd[i].ref.v.seq_num = 0;
1353             array->pd[i].fw_state = MFI_PD_STATE_UNCONFIGURED_GOOD;
1354             array->pd[i].encl.pd = 0xFF;
1355             array->pd[i].encl.slot = 0xFF;
1356         }
1357         array_offset += sizeof(struct mfi_array);
1358         ld = (struct mfi_ld_config *)(data + ld_offset);
1359         memset(ld, 0, sizeof(struct mfi_ld_config));
1360         ld->properties.ld.v.target_id = sdev->id;
1361         ld->properties.default_cache_policy = MR_LD_CACHE_READ_AHEAD |
1362             MR_LD_CACHE_READ_ADAPTIVE;
1363         ld->properties.current_cache_policy = MR_LD_CACHE_READ_AHEAD |
1364             MR_LD_CACHE_READ_ADAPTIVE;
1365         ld->params.state = MFI_LD_STATE_OPTIMAL;
1366         ld->params.stripe_size = 3;
1367         ld->params.num_drives = 1;
1368         ld->params.span_depth = 1;
1369         ld->params.is_consistent = 1;
1370         ld->span[0].start_block = 0;
1371         ld->span[0].num_blocks = cpu_to_le64(pd_size);
1372         ld->span[0].array_ref = cpu_to_le16(sdev_id);
1373         ld_offset += sizeof(struct mfi_ld_config);
1374     }
1375 
1376     cmd->iov_size -= dma_buf_read((uint8_t *)data, info->size, &cmd->qsg);
1377     return MFI_STAT_OK;
1378 }
1379 
1380 static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
1381 {
1382     struct mfi_ctrl_props info;
1383     size_t dcmd_size = sizeof(info);
1384 
1385     memset(&info, 0x0, dcmd_size);
1386     if (cmd->iov_size < dcmd_size) {
1387         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1388                                             dcmd_size);
1389         return MFI_STAT_INVALID_PARAMETER;
1390     }
1391     info.pred_fail_poll_interval = cpu_to_le16(300);
1392     info.intr_throttle_cnt = cpu_to_le16(16);
1393     info.intr_throttle_timeout = cpu_to_le16(50);
1394     info.rebuild_rate = 30;
1395     info.patrol_read_rate = 30;
1396     info.bgi_rate = 30;
1397     info.cc_rate = 30;
1398     info.recon_rate = 30;
1399     info.cache_flush_interval = 4;
1400     info.spinup_drv_cnt = 2;
1401     info.spinup_delay = 6;
1402     info.ecc_bucket_size = 15;
1403     info.ecc_bucket_leak_rate = cpu_to_le16(1440);
1404     info.expose_encl_devices = 1;
1405 
1406     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1407     return MFI_STAT_OK;
1408 }
1409 
1410 static int megasas_cache_flush(MegasasState *s, MegasasCmd *cmd)
1411 {
1412     blk_drain_all();
1413     return MFI_STAT_OK;
1414 }
1415 
1416 static int megasas_ctrl_shutdown(MegasasState *s, MegasasCmd *cmd)
1417 {
1418     s->fw_state = MFI_FWSTATE_READY;
1419     return MFI_STAT_OK;
1420 }
1421 
1422 /* Some implementations use CLUSTER RESET LD to simulate a device reset */
1423 static int megasas_cluster_reset_ld(MegasasState *s, MegasasCmd *cmd)
1424 {
1425     uint16_t target_id;
1426     int i;
1427 
1428     /* mbox0 contains the device index */
1429     target_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1430     trace_megasas_dcmd_reset_ld(cmd->index, target_id);
1431     for (i = 0; i < s->fw_cmds; i++) {
1432         MegasasCmd *tmp_cmd = &s->frames[i];
1433         if (tmp_cmd->req && tmp_cmd->req->dev->id == target_id) {
1434             SCSIDevice *d = tmp_cmd->req->dev;
1435             qdev_reset_all(&d->qdev);
1436         }
1437     }
1438     return MFI_STAT_OK;
1439 }
1440 
1441 static int megasas_dcmd_set_properties(MegasasState *s, MegasasCmd *cmd)
1442 {
1443     struct mfi_ctrl_props info;
1444     size_t dcmd_size = sizeof(info);
1445 
1446     if (cmd->iov_size < dcmd_size) {
1447         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1448                                             dcmd_size);
1449         return MFI_STAT_INVALID_PARAMETER;
1450     }
1451     dma_buf_write((uint8_t *)&info, cmd->iov_size, &cmd->qsg);
1452     trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
1453     return MFI_STAT_OK;
1454 }
1455 
1456 static int megasas_dcmd_dummy(MegasasState *s, MegasasCmd *cmd)
1457 {
1458     trace_megasas_dcmd_dummy(cmd->index, cmd->iov_size);
1459     return MFI_STAT_OK;
1460 }
1461 
1462 static const struct dcmd_cmd_tbl_t {
1463     int opcode;
1464     const char *desc;
1465     int (*func)(MegasasState *s, MegasasCmd *cmd);
1466 } dcmd_cmd_tbl[] = {
1467     { MFI_DCMD_CTRL_MFI_HOST_MEM_ALLOC, "CTRL_HOST_MEM_ALLOC",
1468       megasas_dcmd_dummy },
1469     { MFI_DCMD_CTRL_GET_INFO, "CTRL_GET_INFO",
1470       megasas_ctrl_get_info },
1471     { MFI_DCMD_CTRL_GET_PROPERTIES, "CTRL_GET_PROPERTIES",
1472       megasas_dcmd_get_properties },
1473     { MFI_DCMD_CTRL_SET_PROPERTIES, "CTRL_SET_PROPERTIES",
1474       megasas_dcmd_set_properties },
1475     { MFI_DCMD_CTRL_ALARM_GET, "CTRL_ALARM_GET",
1476       megasas_dcmd_dummy },
1477     { MFI_DCMD_CTRL_ALARM_ENABLE, "CTRL_ALARM_ENABLE",
1478       megasas_dcmd_dummy },
1479     { MFI_DCMD_CTRL_ALARM_DISABLE, "CTRL_ALARM_DISABLE",
1480       megasas_dcmd_dummy },
1481     { MFI_DCMD_CTRL_ALARM_SILENCE, "CTRL_ALARM_SILENCE",
1482       megasas_dcmd_dummy },
1483     { MFI_DCMD_CTRL_ALARM_TEST, "CTRL_ALARM_TEST",
1484       megasas_dcmd_dummy },
1485     { MFI_DCMD_CTRL_EVENT_GETINFO, "CTRL_EVENT_GETINFO",
1486       megasas_event_info },
1487     { MFI_DCMD_CTRL_EVENT_GET, "CTRL_EVENT_GET",
1488       megasas_dcmd_dummy },
1489     { MFI_DCMD_CTRL_EVENT_WAIT, "CTRL_EVENT_WAIT",
1490       megasas_event_wait },
1491     { MFI_DCMD_CTRL_SHUTDOWN, "CTRL_SHUTDOWN",
1492       megasas_ctrl_shutdown },
1493     { MFI_DCMD_HIBERNATE_STANDBY, "CTRL_STANDBY",
1494       megasas_dcmd_dummy },
1495     { MFI_DCMD_CTRL_GET_TIME, "CTRL_GET_TIME",
1496       megasas_dcmd_get_fw_time },
1497     { MFI_DCMD_CTRL_SET_TIME, "CTRL_SET_TIME",
1498       megasas_dcmd_set_fw_time },
1499     { MFI_DCMD_CTRL_BIOS_DATA_GET, "CTRL_BIOS_DATA_GET",
1500       megasas_dcmd_get_bios_info },
1501     { MFI_DCMD_CTRL_FACTORY_DEFAULTS, "CTRL_FACTORY_DEFAULTS",
1502       megasas_dcmd_dummy },
1503     { MFI_DCMD_CTRL_MFC_DEFAULTS_GET, "CTRL_MFC_DEFAULTS_GET",
1504       megasas_mfc_get_defaults },
1505     { MFI_DCMD_CTRL_MFC_DEFAULTS_SET, "CTRL_MFC_DEFAULTS_SET",
1506       megasas_dcmd_dummy },
1507     { MFI_DCMD_CTRL_CACHE_FLUSH, "CTRL_CACHE_FLUSH",
1508       megasas_cache_flush },
1509     { MFI_DCMD_PD_GET_LIST, "PD_GET_LIST",
1510       megasas_dcmd_pd_get_list },
1511     { MFI_DCMD_PD_LIST_QUERY, "PD_LIST_QUERY",
1512       megasas_dcmd_pd_list_query },
1513     { MFI_DCMD_PD_GET_INFO, "PD_GET_INFO",
1514       megasas_dcmd_pd_get_info },
1515     { MFI_DCMD_PD_STATE_SET, "PD_STATE_SET",
1516       megasas_dcmd_dummy },
1517     { MFI_DCMD_PD_REBUILD, "PD_REBUILD",
1518       megasas_dcmd_dummy },
1519     { MFI_DCMD_PD_BLINK, "PD_BLINK",
1520       megasas_dcmd_dummy },
1521     { MFI_DCMD_PD_UNBLINK, "PD_UNBLINK",
1522       megasas_dcmd_dummy },
1523     { MFI_DCMD_LD_GET_LIST, "LD_GET_LIST",
1524       megasas_dcmd_ld_get_list},
1525     { MFI_DCMD_LD_LIST_QUERY, "LD_LIST_QUERY",
1526       megasas_dcmd_ld_list_query },
1527     { MFI_DCMD_LD_GET_INFO, "LD_GET_INFO",
1528       megasas_dcmd_ld_get_info },
1529     { MFI_DCMD_LD_GET_PROP, "LD_GET_PROP",
1530       megasas_dcmd_dummy },
1531     { MFI_DCMD_LD_SET_PROP, "LD_SET_PROP",
1532       megasas_dcmd_dummy },
1533     { MFI_DCMD_LD_DELETE, "LD_DELETE",
1534       megasas_dcmd_dummy },
1535     { MFI_DCMD_CFG_READ, "CFG_READ",
1536       megasas_dcmd_cfg_read },
1537     { MFI_DCMD_CFG_ADD, "CFG_ADD",
1538       megasas_dcmd_dummy },
1539     { MFI_DCMD_CFG_CLEAR, "CFG_CLEAR",
1540       megasas_dcmd_dummy },
1541     { MFI_DCMD_CFG_FOREIGN_READ, "CFG_FOREIGN_READ",
1542       megasas_dcmd_dummy },
1543     { MFI_DCMD_CFG_FOREIGN_IMPORT, "CFG_FOREIGN_IMPORT",
1544       megasas_dcmd_dummy },
1545     { MFI_DCMD_BBU_STATUS, "BBU_STATUS",
1546       megasas_dcmd_dummy },
1547     { MFI_DCMD_BBU_CAPACITY_INFO, "BBU_CAPACITY_INFO",
1548       megasas_dcmd_dummy },
1549     { MFI_DCMD_BBU_DESIGN_INFO, "BBU_DESIGN_INFO",
1550       megasas_dcmd_dummy },
1551     { MFI_DCMD_BBU_PROP_GET, "BBU_PROP_GET",
1552       megasas_dcmd_dummy },
1553     { MFI_DCMD_CLUSTER, "CLUSTER",
1554       megasas_dcmd_dummy },
1555     { MFI_DCMD_CLUSTER_RESET_ALL, "CLUSTER_RESET_ALL",
1556       megasas_dcmd_dummy },
1557     { MFI_DCMD_CLUSTER_RESET_LD, "CLUSTER_RESET_LD",
1558       megasas_cluster_reset_ld },
1559     { -1, NULL, NULL }
1560 };
1561 
1562 static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)
1563 {
1564     int opcode, len;
1565     int retval = 0;
1566     const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;
1567 
1568     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1569     trace_megasas_handle_dcmd(cmd->index, opcode);
1570     len = megasas_map_dcmd(s, cmd);
1571     if (len < 0) {
1572         return MFI_STAT_MEMORY_NOT_AVAILABLE;
1573     }
1574     while (cmdptr->opcode != -1 && cmdptr->opcode != opcode) {
1575         cmdptr++;
1576     }
1577     if (cmdptr->opcode == -1) {
1578         trace_megasas_dcmd_unhandled(cmd->index, opcode, len);
1579         retval = megasas_dcmd_dummy(s, cmd);
1580     } else {
1581         trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);
1582         retval = cmdptr->func(s, cmd);
1583     }
1584     if (retval != MFI_STAT_INVALID_STATUS) {
1585         megasas_finish_dcmd(cmd, len);
1586     }
1587     return retval;
1588 }
1589 
1590 static int megasas_finish_internal_dcmd(MegasasCmd *cmd,
1591                                         SCSIRequest *req)
1592 {
1593     int opcode;
1594     int retval = MFI_STAT_OK;
1595     int lun = req->lun;
1596 
1597     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1598     scsi_req_unref(req);
1599     trace_megasas_dcmd_internal_finish(cmd->index, opcode, lun);
1600     switch (opcode) {
1601     case MFI_DCMD_PD_GET_INFO:
1602         retval = megasas_pd_get_info_submit(req->dev, lun, cmd);
1603         break;
1604     case MFI_DCMD_LD_GET_INFO:
1605         retval = megasas_ld_get_info_submit(req->dev, lun, cmd);
1606         break;
1607     default:
1608         trace_megasas_dcmd_internal_invalid(cmd->index, opcode);
1609         retval = MFI_STAT_INVALID_DCMD;
1610         break;
1611     }
1612     if (retval != MFI_STAT_INVALID_STATUS) {
1613         megasas_finish_dcmd(cmd, cmd->iov_size);
1614     }
1615     return retval;
1616 }
1617 
1618 static int megasas_enqueue_req(MegasasCmd *cmd, bool is_write)
1619 {
1620     int len;
1621 
1622     len = scsi_req_enqueue(cmd->req);
1623     if (len < 0) {
1624         len = -len;
1625     }
1626     if (len > 0) {
1627         if (len > cmd->iov_size) {
1628             if (is_write) {
1629                 trace_megasas_iov_write_overflow(cmd->index, len,
1630                                                  cmd->iov_size);
1631             } else {
1632                 trace_megasas_iov_read_overflow(cmd->index, len,
1633                                                 cmd->iov_size);
1634             }
1635         }
1636         if (len < cmd->iov_size) {
1637             if (is_write) {
1638                 trace_megasas_iov_write_underflow(cmd->index, len,
1639                                                   cmd->iov_size);
1640             } else {
1641                 trace_megasas_iov_read_underflow(cmd->index, len,
1642                                                  cmd->iov_size);
1643             }
1644             cmd->iov_size = len;
1645         }
1646         scsi_req_continue(cmd->req);
1647     }
1648     return len;
1649 }
1650 
1651 static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
1652                                bool is_logical)
1653 {
1654     uint8_t *cdb;
1655     bool is_write;
1656     struct SCSIDevice *sdev = NULL;
1657 
1658     cdb = cmd->frame->pass.cdb;
1659 
1660     if (is_logical) {
1661         if (cmd->frame->header.target_id >= MFI_MAX_LD ||
1662             cmd->frame->header.lun_id != 0) {
1663             trace_megasas_scsi_target_not_present(
1664                 mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1665                 cmd->frame->header.target_id, cmd->frame->header.lun_id);
1666             return MFI_STAT_DEVICE_NOT_FOUND;
1667         }
1668     }
1669     sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1670                             cmd->frame->header.lun_id);
1671 
1672     cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);
1673     trace_megasas_handle_scsi(mfi_frame_desc[cmd->frame->header.frame_cmd],
1674                               is_logical, cmd->frame->header.target_id,
1675                               cmd->frame->header.lun_id, sdev, cmd->iov_size);
1676 
1677     if (!sdev || (megasas_is_jbod(s) && is_logical)) {
1678         trace_megasas_scsi_target_not_present(
1679             mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1680             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1681         return MFI_STAT_DEVICE_NOT_FOUND;
1682     }
1683 
1684     if (cmd->frame->header.cdb_len > 16) {
1685         trace_megasas_scsi_invalid_cdb_len(
1686                 mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1687                 cmd->frame->header.target_id, cmd->frame->header.lun_id,
1688                 cmd->frame->header.cdb_len);
1689         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1690         cmd->frame->header.scsi_status = CHECK_CONDITION;
1691         s->event_count++;
1692         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1693     }
1694 
1695     if (megasas_map_sgl(s, cmd, &cmd->frame->pass.sgl)) {
1696         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1697         cmd->frame->header.scsi_status = CHECK_CONDITION;
1698         s->event_count++;
1699         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1700     }
1701 
1702     cmd->req = scsi_req_new(sdev, cmd->index,
1703                             cmd->frame->header.lun_id, cdb, cmd);
1704     if (!cmd->req) {
1705         trace_megasas_scsi_req_alloc_failed(
1706                 mfi_frame_desc[cmd->frame->header.frame_cmd],
1707                 cmd->frame->header.target_id, cmd->frame->header.lun_id);
1708         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1709         cmd->frame->header.scsi_status = BUSY;
1710         s->event_count++;
1711         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1712     }
1713 
1714     is_write = (cmd->req->cmd.mode == SCSI_XFER_TO_DEV);
1715     if (cmd->iov_size) {
1716         if (is_write) {
1717             trace_megasas_scsi_write_start(cmd->index, cmd->iov_size);
1718         } else {
1719             trace_megasas_scsi_read_start(cmd->index, cmd->iov_size);
1720         }
1721     } else {
1722         trace_megasas_scsi_nodata(cmd->index);
1723     }
1724     megasas_enqueue_req(cmd, is_write);
1725     return MFI_STAT_INVALID_STATUS;
1726 }
1727 
1728 static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd)
1729 {
1730     uint32_t lba_count, lba_start_hi, lba_start_lo;
1731     uint64_t lba_start;
1732     bool is_write = (cmd->frame->header.frame_cmd == MFI_CMD_LD_WRITE);
1733     uint8_t cdb[16];
1734     int len;
1735     struct SCSIDevice *sdev = NULL;
1736 
1737     lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
1738     lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
1739     lba_start_hi = le32_to_cpu(cmd->frame->io.lba_hi);
1740     lba_start = ((uint64_t)lba_start_hi << 32) | lba_start_lo;
1741 
1742     if (cmd->frame->header.target_id < MFI_MAX_LD &&
1743         cmd->frame->header.lun_id == 0) {
1744         sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1745                                 cmd->frame->header.lun_id);
1746     }
1747 
1748     trace_megasas_handle_io(cmd->index,
1749                             mfi_frame_desc[cmd->frame->header.frame_cmd],
1750                             cmd->frame->header.target_id,
1751                             cmd->frame->header.lun_id,
1752                             (unsigned long)lba_start, (unsigned long)lba_count);
1753     if (!sdev) {
1754         trace_megasas_io_target_not_present(cmd->index,
1755             mfi_frame_desc[cmd->frame->header.frame_cmd],
1756             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1757         return MFI_STAT_DEVICE_NOT_FOUND;
1758     }
1759 
1760     if (cmd->frame->header.cdb_len > 16) {
1761         trace_megasas_scsi_invalid_cdb_len(
1762             mfi_frame_desc[cmd->frame->header.frame_cmd], 1,
1763             cmd->frame->header.target_id, cmd->frame->header.lun_id,
1764             cmd->frame->header.cdb_len);
1765         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1766         cmd->frame->header.scsi_status = CHECK_CONDITION;
1767         s->event_count++;
1768         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1769     }
1770 
1771     cmd->iov_size = lba_count * sdev->blocksize;
1772     if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
1773         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1774         cmd->frame->header.scsi_status = CHECK_CONDITION;
1775         s->event_count++;
1776         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1777     }
1778 
1779     megasas_encode_lba(cdb, lba_start, lba_count, is_write);
1780     cmd->req = scsi_req_new(sdev, cmd->index,
1781                             cmd->frame->header.lun_id, cdb, cmd);
1782     if (!cmd->req) {
1783         trace_megasas_scsi_req_alloc_failed(
1784             mfi_frame_desc[cmd->frame->header.frame_cmd],
1785             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1786         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1787         cmd->frame->header.scsi_status = BUSY;
1788         s->event_count++;
1789         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1790     }
1791     len = megasas_enqueue_req(cmd, is_write);
1792     if (len > 0) {
1793         if (is_write) {
1794             trace_megasas_io_write_start(cmd->index, lba_start, lba_count, len);
1795         } else {
1796             trace_megasas_io_read_start(cmd->index, lba_start, lba_count, len);
1797         }
1798     }
1799     return MFI_STAT_INVALID_STATUS;
1800 }
1801 
1802 static int megasas_finish_internal_command(MegasasCmd *cmd,
1803                                            SCSIRequest *req, size_t resid)
1804 {
1805     int retval = MFI_STAT_INVALID_CMD;
1806 
1807     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1808         cmd->iov_size -= resid;
1809         retval = megasas_finish_internal_dcmd(cmd, req);
1810     }
1811     return retval;
1812 }
1813 
1814 static QEMUSGList *megasas_get_sg_list(SCSIRequest *req)
1815 {
1816     MegasasCmd *cmd = req->hba_private;
1817 
1818     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1819         return NULL;
1820     } else {
1821         return &cmd->qsg;
1822     }
1823 }
1824 
1825 static void megasas_xfer_complete(SCSIRequest *req, uint32_t len)
1826 {
1827     MegasasCmd *cmd = req->hba_private;
1828     uint8_t *buf;
1829     uint32_t opcode;
1830 
1831     trace_megasas_io_complete(cmd->index, len);
1832 
1833     if (cmd->frame->header.frame_cmd != MFI_CMD_DCMD) {
1834         scsi_req_continue(req);
1835         return;
1836     }
1837 
1838     buf = scsi_req_get_buf(req);
1839     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1840     if (opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) {
1841         struct mfi_pd_info *info = cmd->iov_buf;
1842 
1843         if (info->inquiry_data[0] == 0x7f) {
1844             memset(info->inquiry_data, 0, sizeof(info->inquiry_data));
1845             memcpy(info->inquiry_data, buf, len);
1846         } else if (info->vpd_page83[0] == 0x7f) {
1847             memset(info->vpd_page83, 0, sizeof(info->vpd_page83));
1848             memcpy(info->vpd_page83, buf, len);
1849         }
1850         scsi_req_continue(req);
1851     } else if (opcode == MFI_DCMD_LD_GET_INFO) {
1852         struct mfi_ld_info *info = cmd->iov_buf;
1853 
1854         if (cmd->iov_buf) {
1855             memcpy(info->vpd_page83, buf, sizeof(info->vpd_page83));
1856             scsi_req_continue(req);
1857         }
1858     }
1859 }
1860 
1861 static void megasas_command_complete(SCSIRequest *req, uint32_t status,
1862                                      size_t resid)
1863 {
1864     MegasasCmd *cmd = req->hba_private;
1865     uint8_t cmd_status = MFI_STAT_OK;
1866 
1867     trace_megasas_command_complete(cmd->index, status, resid);
1868 
1869     if (cmd->req != req) {
1870         /*
1871          * Internal command complete
1872          */
1873         cmd_status = megasas_finish_internal_command(cmd, req, resid);
1874         if (cmd_status == MFI_STAT_INVALID_STATUS) {
1875             return;
1876         }
1877     } else {
1878         req->status = status;
1879         trace_megasas_scsi_complete(cmd->index, req->status,
1880                                     cmd->iov_size, req->cmd.xfer);
1881         if (req->status != GOOD) {
1882             cmd_status = MFI_STAT_SCSI_DONE_WITH_ERROR;
1883         }
1884         if (req->status == CHECK_CONDITION) {
1885             megasas_copy_sense(cmd);
1886         }
1887 
1888         megasas_unmap_sgl(cmd);
1889         cmd->frame->header.scsi_status = req->status;
1890         scsi_req_unref(cmd->req);
1891         cmd->req = NULL;
1892     }
1893     cmd->frame->header.cmd_status = cmd_status;
1894     megasas_unmap_frame(cmd->state, cmd);
1895     megasas_complete_frame(cmd->state, cmd->context);
1896 }
1897 
1898 static void megasas_command_cancel(SCSIRequest *req)
1899 {
1900     MegasasCmd *cmd = req->hba_private;
1901 
1902     if (cmd) {
1903         megasas_abort_command(cmd);
1904     } else {
1905         scsi_req_unref(req);
1906     }
1907 }
1908 
1909 static int megasas_handle_abort(MegasasState *s, MegasasCmd *cmd)
1910 {
1911     uint64_t abort_ctx = le64_to_cpu(cmd->frame->abort.abort_context);
1912     hwaddr abort_addr, addr_hi, addr_lo;
1913     MegasasCmd *abort_cmd;
1914 
1915     addr_hi = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_hi);
1916     addr_lo = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_lo);
1917     abort_addr = ((uint64_t)addr_hi << 32) | addr_lo;
1918 
1919     abort_cmd = megasas_lookup_frame(s, abort_addr);
1920     if (!abort_cmd) {
1921         trace_megasas_abort_no_cmd(cmd->index, abort_ctx);
1922         s->event_count++;
1923         return MFI_STAT_OK;
1924     }
1925     if (!megasas_use_queue64(s)) {
1926         abort_ctx &= (uint64_t)0xFFFFFFFF;
1927     }
1928     if (abort_cmd->context != abort_ctx) {
1929         trace_megasas_abort_invalid_context(cmd->index, abort_cmd->index,
1930                                             abort_cmd->context);
1931         s->event_count++;
1932         return MFI_STAT_ABORT_NOT_POSSIBLE;
1933     }
1934     trace_megasas_abort_frame(cmd->index, abort_cmd->index);
1935     megasas_abort_command(abort_cmd);
1936     if (!s->event_cmd || abort_cmd != s->event_cmd) {
1937         s->event_cmd = NULL;
1938     }
1939     s->event_count++;
1940     return MFI_STAT_OK;
1941 }
1942 
1943 static void megasas_handle_frame(MegasasState *s, uint64_t frame_addr,
1944                                  uint32_t frame_count)
1945 {
1946     uint8_t frame_status = MFI_STAT_INVALID_CMD;
1947     uint64_t frame_context;
1948     MegasasCmd *cmd;
1949 
1950     /*
1951      * Always read 64bit context, top bits will be
1952      * masked out if required in megasas_enqueue_frame()
1953      */
1954     frame_context = megasas_frame_get_context(frame_addr);
1955 
1956     cmd = megasas_enqueue_frame(s, frame_addr, frame_context, frame_count);
1957     if (!cmd) {
1958         /* reply queue full */
1959         trace_megasas_frame_busy(frame_addr);
1960         megasas_frame_set_scsi_status(frame_addr, BUSY);
1961         megasas_frame_set_cmd_status(frame_addr, MFI_STAT_SCSI_DONE_WITH_ERROR);
1962         megasas_complete_frame(s, frame_context);
1963         s->event_count++;
1964         return;
1965     }
1966     switch (cmd->frame->header.frame_cmd) {
1967     case MFI_CMD_INIT:
1968         frame_status = megasas_init_firmware(s, cmd);
1969         break;
1970     case MFI_CMD_DCMD:
1971         frame_status = megasas_handle_dcmd(s, cmd);
1972         break;
1973     case MFI_CMD_ABORT:
1974         frame_status = megasas_handle_abort(s, cmd);
1975         break;
1976     case MFI_CMD_PD_SCSI_IO:
1977         frame_status = megasas_handle_scsi(s, cmd, 0);
1978         break;
1979     case MFI_CMD_LD_SCSI_IO:
1980         frame_status = megasas_handle_scsi(s, cmd, 1);
1981         break;
1982     case MFI_CMD_LD_READ:
1983     case MFI_CMD_LD_WRITE:
1984         frame_status = megasas_handle_io(s, cmd);
1985         break;
1986     default:
1987         trace_megasas_unhandled_frame_cmd(cmd->index,
1988                                           cmd->frame->header.frame_cmd);
1989         s->event_count++;
1990         break;
1991     }
1992     if (frame_status != MFI_STAT_INVALID_STATUS) {
1993         if (cmd->frame) {
1994             cmd->frame->header.cmd_status = frame_status;
1995         } else {
1996             megasas_frame_set_cmd_status(frame_addr, frame_status);
1997         }
1998         megasas_unmap_frame(s, cmd);
1999         megasas_complete_frame(s, cmd->context);
2000     }
2001 }
2002 
2003 static uint64_t megasas_mmio_read(void *opaque, hwaddr addr,
2004                                   unsigned size)
2005 {
2006     MegasasState *s = opaque;
2007     PCIDevice *pci_dev = PCI_DEVICE(s);
2008     MegasasBaseClass *base_class = MEGASAS_DEVICE_GET_CLASS(s);
2009     uint32_t retval = 0;
2010 
2011     switch (addr) {
2012     case MFI_IDB:
2013         retval = 0;
2014         trace_megasas_mmio_readl("MFI_IDB", retval);
2015         break;
2016     case MFI_OMSG0:
2017     case MFI_OSP0:
2018         retval = (msix_present(pci_dev) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |
2019             (s->fw_state & MFI_FWSTATE_MASK) |
2020             ((s->fw_sge & 0xff) << 16) |
2021             (s->fw_cmds & 0xFFFF);
2022         trace_megasas_mmio_readl(addr == MFI_OMSG0 ? "MFI_OMSG0" : "MFI_OSP0",
2023                                  retval);
2024         break;
2025     case MFI_OSTS:
2026         if (megasas_intr_enabled(s) && s->doorbell) {
2027             retval = base_class->osts;
2028         }
2029         trace_megasas_mmio_readl("MFI_OSTS", retval);
2030         break;
2031     case MFI_OMSK:
2032         retval = s->intr_mask;
2033         trace_megasas_mmio_readl("MFI_OMSK", retval);
2034         break;
2035     case MFI_ODCR0:
2036         retval = s->doorbell ? 1 : 0;
2037         trace_megasas_mmio_readl("MFI_ODCR0", retval);
2038         break;
2039     case MFI_DIAG:
2040         retval = s->diag;
2041         trace_megasas_mmio_readl("MFI_DIAG", retval);
2042         break;
2043     case MFI_OSP1:
2044         retval = 15;
2045         trace_megasas_mmio_readl("MFI_OSP1", retval);
2046         break;
2047     default:
2048         trace_megasas_mmio_invalid_readl(addr);
2049         break;
2050     }
2051     return retval;
2052 }
2053 
2054 static int adp_reset_seq[] = {0x00, 0x04, 0x0b, 0x02, 0x07, 0x0d};
2055 
2056 static void megasas_mmio_write(void *opaque, hwaddr addr,
2057                                uint64_t val, unsigned size)
2058 {
2059     MegasasState *s = opaque;
2060     PCIDevice *pci_dev = PCI_DEVICE(s);
2061     uint64_t frame_addr;
2062     uint32_t frame_count;
2063     int i;
2064 
2065     switch (addr) {
2066     case MFI_IDB:
2067         trace_megasas_mmio_writel("MFI_IDB", val);
2068         if (val & MFI_FWINIT_ABORT) {
2069             /* Abort all pending cmds */
2070             for (i = 0; i < s->fw_cmds; i++) {
2071                 megasas_abort_command(&s->frames[i]);
2072             }
2073         }
2074         if (val & MFI_FWINIT_READY) {
2075             /* move to FW READY */
2076             megasas_soft_reset(s);
2077         }
2078         if (val & MFI_FWINIT_MFIMODE) {
2079             /* discard MFIs */
2080         }
2081         if (val & MFI_FWINIT_STOP_ADP) {
2082             /* Terminal error, stop processing */
2083             s->fw_state = MFI_FWSTATE_FAULT;
2084         }
2085         break;
2086     case MFI_OMSK:
2087         trace_megasas_mmio_writel("MFI_OMSK", val);
2088         s->intr_mask = val;
2089         if (!megasas_intr_enabled(s) &&
2090             !msi_enabled(pci_dev) &&
2091             !msix_enabled(pci_dev)) {
2092             trace_megasas_irq_lower();
2093             pci_irq_deassert(pci_dev);
2094         }
2095         if (megasas_intr_enabled(s)) {
2096             if (msix_enabled(pci_dev)) {
2097                 trace_megasas_msix_enabled(0);
2098             } else if (msi_enabled(pci_dev)) {
2099                 trace_megasas_msi_enabled(0);
2100             } else {
2101                 trace_megasas_intr_enabled();
2102             }
2103         } else {
2104             trace_megasas_intr_disabled();
2105             megasas_soft_reset(s);
2106         }
2107         break;
2108     case MFI_ODCR0:
2109         trace_megasas_mmio_writel("MFI_ODCR0", val);
2110         s->doorbell = 0;
2111         if (megasas_intr_enabled(s)) {
2112             if (!msix_enabled(pci_dev) && !msi_enabled(pci_dev)) {
2113                 trace_megasas_irq_lower();
2114                 pci_irq_deassert(pci_dev);
2115             }
2116         }
2117         break;
2118     case MFI_IQPH:
2119         trace_megasas_mmio_writel("MFI_IQPH", val);
2120         /* Received high 32 bits of a 64 bit MFI frame address */
2121         s->frame_hi = val;
2122         break;
2123     case MFI_IQPL:
2124         trace_megasas_mmio_writel("MFI_IQPL", val);
2125         /* Received low 32 bits of a 64 bit MFI frame address */
2126         /* Fallthrough */
2127     case MFI_IQP:
2128         if (addr == MFI_IQP) {
2129             trace_megasas_mmio_writel("MFI_IQP", val);
2130             /* Received 64 bit MFI frame address */
2131             s->frame_hi = 0;
2132         }
2133         frame_addr = (val & ~0x1F);
2134         /* Add possible 64 bit offset */
2135         frame_addr |= ((uint64_t)s->frame_hi << 32);
2136         s->frame_hi = 0;
2137         frame_count = (val >> 1) & 0xF;
2138         megasas_handle_frame(s, frame_addr, frame_count);
2139         break;
2140     case MFI_SEQ:
2141         trace_megasas_mmio_writel("MFI_SEQ", val);
2142         /* Magic sequence to start ADP reset */
2143         if (adp_reset_seq[s->adp_reset] == val) {
2144             s->adp_reset++;
2145         } else {
2146             s->adp_reset = 0;
2147             s->diag = 0;
2148         }
2149         if (s->adp_reset == 6) {
2150             s->diag = MFI_DIAG_WRITE_ENABLE;
2151         }
2152         break;
2153     case MFI_DIAG:
2154         trace_megasas_mmio_writel("MFI_DIAG", val);
2155         /* ADP reset */
2156         if ((s->diag & MFI_DIAG_WRITE_ENABLE) &&
2157             (val & MFI_DIAG_RESET_ADP)) {
2158             s->diag |= MFI_DIAG_RESET_ADP;
2159             megasas_soft_reset(s);
2160             s->adp_reset = 0;
2161             s->diag = 0;
2162         }
2163         break;
2164     default:
2165         trace_megasas_mmio_invalid_writel(addr, val);
2166         break;
2167     }
2168 }
2169 
2170 static const MemoryRegionOps megasas_mmio_ops = {
2171     .read = megasas_mmio_read,
2172     .write = megasas_mmio_write,
2173     .endianness = DEVICE_LITTLE_ENDIAN,
2174     .impl = {
2175         .min_access_size = 8,
2176         .max_access_size = 8,
2177     }
2178 };
2179 
2180 static uint64_t megasas_port_read(void *opaque, hwaddr addr,
2181                                   unsigned size)
2182 {
2183     return megasas_mmio_read(opaque, addr & 0xff, size);
2184 }
2185 
2186 static void megasas_port_write(void *opaque, hwaddr addr,
2187                                uint64_t val, unsigned size)
2188 {
2189     megasas_mmio_write(opaque, addr & 0xff, val, size);
2190 }
2191 
2192 static const MemoryRegionOps megasas_port_ops = {
2193     .read = megasas_port_read,
2194     .write = megasas_port_write,
2195     .endianness = DEVICE_LITTLE_ENDIAN,
2196     .impl = {
2197         .min_access_size = 4,
2198         .max_access_size = 4,
2199     }
2200 };
2201 
2202 static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
2203                                    unsigned size)
2204 {
2205     return 0;
2206 }
2207 
2208 static const MemoryRegionOps megasas_queue_ops = {
2209     .read = megasas_queue_read,
2210     .endianness = DEVICE_LITTLE_ENDIAN,
2211     .impl = {
2212         .min_access_size = 8,
2213         .max_access_size = 8,
2214     }
2215 };
2216 
2217 static void megasas_soft_reset(MegasasState *s)
2218 {
2219     int i;
2220     MegasasCmd *cmd;
2221 
2222     trace_megasas_reset(s->fw_state);
2223     for (i = 0; i < s->fw_cmds; i++) {
2224         cmd = &s->frames[i];
2225         megasas_abort_command(cmd);
2226     }
2227     if (s->fw_state == MFI_FWSTATE_READY) {
2228         BusChild *kid;
2229 
2230         /*
2231          * The EFI firmware doesn't handle UA,
2232          * so we need to clear the Power On/Reset UA
2233          * after the initial reset.
2234          */
2235         QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
2236             SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
2237 
2238             sdev->unit_attention = SENSE_CODE(NO_SENSE);
2239             scsi_device_unit_attention_reported(sdev);
2240         }
2241     }
2242     megasas_reset_frames(s);
2243     s->reply_queue_len = s->fw_cmds;
2244     s->reply_queue_pa = 0;
2245     s->consumer_pa = 0;
2246     s->producer_pa = 0;
2247     s->fw_state = MFI_FWSTATE_READY;
2248     s->doorbell = 0;
2249     s->intr_mask = MEGASAS_INTR_DISABLED_MASK;
2250     s->frame_hi = 0;
2251     s->flags &= ~MEGASAS_MASK_USE_QUEUE64;
2252     s->event_count++;
2253     s->boot_event = s->event_count;
2254 }
2255 
2256 static void megasas_scsi_reset(DeviceState *dev)
2257 {
2258     MegasasState *s = MEGASAS(dev);
2259 
2260     megasas_soft_reset(s);
2261 }
2262 
2263 static const VMStateDescription vmstate_megasas_gen1 = {
2264     .name = "megasas",
2265     .version_id = 0,
2266     .minimum_version_id = 0,
2267     .fields = (VMStateField[]) {
2268         VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2269         VMSTATE_MSIX(parent_obj, MegasasState),
2270 
2271         VMSTATE_INT32(fw_state, MegasasState),
2272         VMSTATE_INT32(intr_mask, MegasasState),
2273         VMSTATE_INT32(doorbell, MegasasState),
2274         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2275         VMSTATE_UINT64(consumer_pa, MegasasState),
2276         VMSTATE_UINT64(producer_pa, MegasasState),
2277         VMSTATE_END_OF_LIST()
2278     }
2279 };
2280 
2281 static const VMStateDescription vmstate_megasas_gen2 = {
2282     .name = "megasas-gen2",
2283     .version_id = 0,
2284     .minimum_version_id = 0,
2285     .minimum_version_id_old = 0,
2286     .fields      = (VMStateField[]) {
2287         VMSTATE_PCIE_DEVICE(parent_obj, MegasasState),
2288         VMSTATE_MSIX(parent_obj, MegasasState),
2289 
2290         VMSTATE_INT32(fw_state, MegasasState),
2291         VMSTATE_INT32(intr_mask, MegasasState),
2292         VMSTATE_INT32(doorbell, MegasasState),
2293         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2294         VMSTATE_UINT64(consumer_pa, MegasasState),
2295         VMSTATE_UINT64(producer_pa, MegasasState),
2296         VMSTATE_END_OF_LIST()
2297     }
2298 };
2299 
2300 static void megasas_scsi_uninit(PCIDevice *d)
2301 {
2302     MegasasState *s = MEGASAS(d);
2303 
2304     if (megasas_use_msix(s)) {
2305         msix_uninit(d, &s->mmio_io, &s->mmio_io);
2306     }
2307     if (megasas_use_msi(s)) {
2308         msi_uninit(d);
2309     }
2310 }
2311 
2312 static const struct SCSIBusInfo megasas_scsi_info = {
2313     .tcq = true,
2314     .max_target = MFI_MAX_LD,
2315     .max_lun = 255,
2316 
2317     .transfer_data = megasas_xfer_complete,
2318     .get_sg_list = megasas_get_sg_list,
2319     .complete = megasas_command_complete,
2320     .cancel = megasas_command_cancel,
2321 };
2322 
2323 static int megasas_scsi_init(PCIDevice *dev)
2324 {
2325     DeviceState *d = DEVICE(dev);
2326     MegasasState *s = MEGASAS(dev);
2327     MegasasBaseClass *b = MEGASAS_DEVICE_GET_CLASS(s);
2328     uint8_t *pci_conf;
2329     int i, bar_type;
2330     Error *err = NULL;
2331 
2332     pci_conf = dev->config;
2333 
2334     /* PCI latency timer = 0 */
2335     pci_conf[PCI_LATENCY_TIMER] = 0;
2336     /* Interrupt pin 1 */
2337     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2338 
2339     memory_region_init_io(&s->mmio_io, OBJECT(s), &megasas_mmio_ops, s,
2340                           "megasas-mmio", 0x4000);
2341     memory_region_init_io(&s->port_io, OBJECT(s), &megasas_port_ops, s,
2342                           "megasas-io", 256);
2343     memory_region_init_io(&s->queue_io, OBJECT(s), &megasas_queue_ops, s,
2344                           "megasas-queue", 0x40000);
2345 
2346     if (megasas_use_msi(s) &&
2347         msi_init(dev, 0x50, 1, true, false)) {
2348         s->flags &= ~MEGASAS_MASK_USE_MSI;
2349     }
2350     if (megasas_use_msix(s) &&
2351         msix_init(dev, 15, &s->mmio_io, b->mmio_bar, 0x2000,
2352                   &s->mmio_io, b->mmio_bar, 0x3800, 0x68)) {
2353         s->flags &= ~MEGASAS_MASK_USE_MSIX;
2354     }
2355     if (pci_is_express(dev)) {
2356         pcie_endpoint_cap_init(dev, 0xa0);
2357     }
2358 
2359     bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
2360     pci_register_bar(dev, b->ioport_bar,
2361                      PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
2362     pci_register_bar(dev, b->mmio_bar, bar_type, &s->mmio_io);
2363     pci_register_bar(dev, 3, bar_type, &s->queue_io);
2364 
2365     if (megasas_use_msix(s)) {
2366         msix_vector_use(dev, 0);
2367     }
2368 
2369     s->fw_state = MFI_FWSTATE_READY;
2370     if (!s->sas_addr) {
2371         s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
2372                        IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
2373         s->sas_addr |= (pci_bus_num(dev->bus) << 16);
2374         s->sas_addr |= (PCI_SLOT(dev->devfn) << 8);
2375         s->sas_addr |= PCI_FUNC(dev->devfn);
2376     }
2377     if (!s->hba_serial) {
2378         s->hba_serial = g_strdup(MEGASAS_HBA_SERIAL);
2379     }
2380     if (s->fw_sge >= MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE) {
2381         s->fw_sge = MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE;
2382     } else if (s->fw_sge >= 128 - MFI_PASS_FRAME_SIZE) {
2383         s->fw_sge = 128 - MFI_PASS_FRAME_SIZE;
2384     } else {
2385         s->fw_sge = 64 - MFI_PASS_FRAME_SIZE;
2386     }
2387     if (s->fw_cmds > MEGASAS_MAX_FRAMES) {
2388         s->fw_cmds = MEGASAS_MAX_FRAMES;
2389     }
2390     trace_megasas_init(s->fw_sge, s->fw_cmds,
2391                        megasas_is_jbod(s) ? "jbod" : "raid");
2392 
2393     if (megasas_is_jbod(s)) {
2394         s->fw_luns = MFI_MAX_SYS_PDS;
2395     } else {
2396         s->fw_luns = MFI_MAX_LD;
2397     }
2398     s->producer_pa = 0;
2399     s->consumer_pa = 0;
2400     for (i = 0; i < s->fw_cmds; i++) {
2401         s->frames[i].index = i;
2402         s->frames[i].context = -1;
2403         s->frames[i].pa = 0;
2404         s->frames[i].state = s;
2405     }
2406 
2407     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev),
2408                  &megasas_scsi_info, NULL);
2409     if (!d->hotplugged) {
2410         scsi_bus_legacy_handle_cmdline(&s->bus, &err);
2411         if (err != NULL) {
2412             error_free(err);
2413             return -1;
2414         }
2415     }
2416     return 0;
2417 }
2418 
2419 static void
2420 megasas_write_config(PCIDevice *pci, uint32_t addr, uint32_t val, int len)
2421 {
2422     pci_default_write_config(pci, addr, val, len);
2423     msi_write_config(pci, addr, val, len);
2424 }
2425 
2426 static Property megasas_properties_gen1[] = {
2427     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2428                        MEGASAS_DEFAULT_SGE),
2429     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2430                        MEGASAS_DEFAULT_FRAMES),
2431     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2432     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2433     DEFINE_PROP_BIT("use_msi", MegasasState, flags,
2434                     MEGASAS_FLAG_USE_MSI, false),
2435     DEFINE_PROP_BIT("use_msix", MegasasState, flags,
2436                     MEGASAS_FLAG_USE_MSIX, false),
2437     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2438                     MEGASAS_FLAG_USE_JBOD, false),
2439     DEFINE_PROP_END_OF_LIST(),
2440 };
2441 
2442 static Property megasas_properties_gen2[] = {
2443     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2444                        MEGASAS_DEFAULT_SGE),
2445     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2446                        MEGASAS_GEN2_DEFAULT_FRAMES),
2447     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2448     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2449     DEFINE_PROP_BIT("use_msi", MegasasState, flags,
2450                     MEGASAS_FLAG_USE_MSI, true),
2451     DEFINE_PROP_BIT("use_msix", MegasasState, flags,
2452                     MEGASAS_FLAG_USE_MSIX, true),
2453     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2454                     MEGASAS_FLAG_USE_JBOD, false),
2455     DEFINE_PROP_END_OF_LIST(),
2456 };
2457 
2458 typedef struct MegasasInfo {
2459     const char *name;
2460     const char *desc;
2461     const char *product_name;
2462     const char *product_version;
2463     uint16_t device_id;
2464     uint16_t subsystem_id;
2465     int ioport_bar;
2466     int mmio_bar;
2467     bool is_express;
2468     int osts;
2469     const VMStateDescription *vmsd;
2470     Property *props;
2471 } MegasasInfo;
2472 
2473 static struct MegasasInfo megasas_devices[] = {
2474     {
2475         .name = TYPE_MEGASAS_GEN1,
2476         .desc = "LSI MegaRAID SAS 1078",
2477         .product_name = "LSI MegaRAID SAS 8708EM2",
2478         .product_version = MEGASAS_VERSION_GEN1,
2479         .device_id = PCI_DEVICE_ID_LSI_SAS1078,
2480         .subsystem_id = 0x1013,
2481         .ioport_bar = 2,
2482         .mmio_bar = 0,
2483         .osts = MFI_1078_RM | 1,
2484         .is_express = false,
2485         .vmsd = &vmstate_megasas_gen1,
2486         .props = megasas_properties_gen1,
2487     },{
2488         .name = TYPE_MEGASAS_GEN2,
2489         .desc = "LSI MegaRAID SAS 2108",
2490         .product_name = "LSI MegaRAID SAS 9260-8i",
2491         .product_version = MEGASAS_VERSION_GEN2,
2492         .device_id = PCI_DEVICE_ID_LSI_SAS0079,
2493         .subsystem_id = 0x9261,
2494         .ioport_bar = 0,
2495         .mmio_bar = 1,
2496         .osts = MFI_GEN2_RM,
2497         .is_express = true,
2498         .vmsd = &vmstate_megasas_gen2,
2499         .props = megasas_properties_gen2,
2500     }
2501 };
2502 
2503 static void megasas_class_init(ObjectClass *oc, void *data)
2504 {
2505     DeviceClass *dc = DEVICE_CLASS(oc);
2506     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
2507     MegasasBaseClass *e = MEGASAS_DEVICE_CLASS(oc);
2508     const MegasasInfo *info = data;
2509 
2510     pc->init = megasas_scsi_init;
2511     pc->exit = megasas_scsi_uninit;
2512     pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2513     pc->device_id = info->device_id;
2514     pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2515     pc->subsystem_id = info->subsystem_id;
2516     pc->class_id = PCI_CLASS_STORAGE_RAID;
2517     pc->is_express = info->is_express;
2518     e->mmio_bar = info->mmio_bar;
2519     e->ioport_bar = info->ioport_bar;
2520     e->osts = info->osts;
2521     e->product_name = info->product_name;
2522     e->product_version = info->product_version;
2523     dc->props = info->props;
2524     dc->reset = megasas_scsi_reset;
2525     dc->vmsd = info->vmsd;
2526     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2527     dc->desc = info->desc;
2528     pc->config_write = megasas_write_config;
2529 }
2530 
2531 static const TypeInfo megasas_info = {
2532     .name  = TYPE_MEGASAS_BASE,
2533     .parent = TYPE_PCI_DEVICE,
2534     .instance_size = sizeof(MegasasState),
2535     .class_size = sizeof(MegasasBaseClass),
2536     .abstract = true,
2537 };
2538 
2539 static void megasas_register_types(void)
2540 {
2541     int i;
2542 
2543     type_register_static(&megasas_info);
2544     for (i = 0; i < ARRAY_SIZE(megasas_devices); i++) {
2545         const MegasasInfo *info = &megasas_devices[i];
2546         TypeInfo type_info = {};
2547 
2548         type_info.name = info->name;
2549         type_info.parent = TYPE_MEGASAS_BASE;
2550         type_info.class_data = (void *)info;
2551         type_info.class_init = megasas_class_init;
2552 
2553         type_register(&type_info);
2554     }
2555 }
2556 
2557 type_init(megasas_register_types)
2558