xref: /openbmc/qemu/hw/scsi/megasas.c (revision f343346b)
1 /*
2  * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation
3  * Based on the linux driver code at drivers/scsi/megaraid
4  *
5  * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
6  *
7  * This library is free software; you can redistribute it and/or
8  * modify it under the terms of the GNU Lesser General Public
9  * License as published by the Free Software Foundation; either
10  * version 2 of the License, or (at your option) any later version.
11  *
12  * This library is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
15  * Lesser General Public License for more details.
16  *
17  * You should have received a copy of the GNU Lesser General Public
18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include "qemu/osdep.h"
22 #include "qemu-common.h"
23 #include "hw/pci/pci.h"
24 #include "hw/qdev-properties.h"
25 #include "sysemu/dma.h"
26 #include "sysemu/block-backend.h"
27 #include "hw/pci/msi.h"
28 #include "hw/pci/msix.h"
29 #include "qemu/iov.h"
30 #include "qemu/module.h"
31 #include "hw/scsi/scsi.h"
32 #include "scsi/constants.h"
33 #include "trace.h"
34 #include "qapi/error.h"
35 #include "mfi.h"
36 #include "migration/vmstate.h"
37 #include "qom/object.h"
38 
39 #define MEGASAS_VERSION_GEN1 "1.70"
40 #define MEGASAS_VERSION_GEN2 "1.80"
41 #define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */
42 #define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */
43 #define MEGASAS_GEN2_DEFAULT_FRAMES 1008     /* Windows requires this */
44 #define MEGASAS_MAX_SGE 128             /* Firmware limit */
45 #define MEGASAS_DEFAULT_SGE 80
46 #define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */
47 #define MEGASAS_MAX_ARRAYS 128
48 
49 #define MEGASAS_HBA_SERIAL "QEMU123456"
50 #define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
51 #define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
52 
53 #define MEGASAS_FLAG_USE_JBOD      0
54 #define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)
55 #define MEGASAS_FLAG_USE_QUEUE64   1
56 #define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)
57 
58 typedef struct MegasasCmd {
59     uint32_t index;
60     uint16_t flags;
61     uint16_t count;
62     uint64_t context;
63 
64     hwaddr pa;
65     hwaddr pa_size;
66     uint32_t dcmd_opcode;
67     union mfi_frame *frame;
68     SCSIRequest *req;
69     QEMUSGList qsg;
70     void *iov_buf;
71     size_t iov_size;
72     size_t iov_offset;
73     struct MegasasState *state;
74 } MegasasCmd;
75 
76 struct MegasasState {
77     /*< private >*/
78     PCIDevice parent_obj;
79     /*< public >*/
80 
81     MemoryRegion mmio_io;
82     MemoryRegion port_io;
83     MemoryRegion queue_io;
84     uint32_t frame_hi;
85 
86     uint32_t fw_state;
87     uint32_t fw_sge;
88     uint32_t fw_cmds;
89     uint32_t flags;
90     uint32_t fw_luns;
91     uint32_t intr_mask;
92     uint32_t doorbell;
93     uint32_t busy;
94     uint32_t diag;
95     uint32_t adp_reset;
96     OnOffAuto msi;
97     OnOffAuto msix;
98 
99     MegasasCmd *event_cmd;
100     uint16_t event_locale;
101     int event_class;
102     uint32_t event_count;
103     uint32_t shutdown_event;
104     uint32_t boot_event;
105 
106     uint64_t sas_addr;
107     char *hba_serial;
108 
109     uint64_t reply_queue_pa;
110     void *reply_queue;
111     uint16_t reply_queue_len;
112     uint16_t reply_queue_head;
113     uint16_t reply_queue_tail;
114     uint64_t consumer_pa;
115     uint64_t producer_pa;
116 
117     MegasasCmd frames[MEGASAS_MAX_FRAMES];
118     DECLARE_BITMAP(frame_map, MEGASAS_MAX_FRAMES);
119     SCSIBus bus;
120 };
121 typedef struct MegasasState MegasasState;
122 
123 struct MegasasBaseClass {
124     PCIDeviceClass parent_class;
125     const char *product_name;
126     const char *product_version;
127     int mmio_bar;
128     int ioport_bar;
129     int osts;
130 };
131 typedef struct MegasasBaseClass MegasasBaseClass;
132 
133 #define TYPE_MEGASAS_BASE "megasas-base"
134 #define TYPE_MEGASAS_GEN1 "megasas"
135 #define TYPE_MEGASAS_GEN2 "megasas-gen2"
136 
137 DECLARE_OBJ_CHECKERS(MegasasState, MegasasBaseClass,
138                      MEGASAS, TYPE_MEGASAS_BASE)
139 
140 
141 #define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
142 
143 static bool megasas_intr_enabled(MegasasState *s)
144 {
145     if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=
146         MEGASAS_INTR_DISABLED_MASK) {
147         return true;
148     }
149     return false;
150 }
151 
152 static bool megasas_use_queue64(MegasasState *s)
153 {
154     return s->flags & MEGASAS_MASK_USE_QUEUE64;
155 }
156 
157 static bool megasas_use_msix(MegasasState *s)
158 {
159     return s->msix != ON_OFF_AUTO_OFF;
160 }
161 
162 static bool megasas_is_jbod(MegasasState *s)
163 {
164     return s->flags & MEGASAS_MASK_USE_JBOD;
165 }
166 
167 static void megasas_frame_set_cmd_status(MegasasState *s,
168                                          unsigned long frame, uint8_t v)
169 {
170     PCIDevice *pci = &s->parent_obj;
171     stb_pci_dma(pci, frame + offsetof(struct mfi_frame_header, cmd_status), v);
172 }
173 
174 static void megasas_frame_set_scsi_status(MegasasState *s,
175                                           unsigned long frame, uint8_t v)
176 {
177     PCIDevice *pci = &s->parent_obj;
178     stb_pci_dma(pci, frame + offsetof(struct mfi_frame_header, scsi_status), v);
179 }
180 
181 static inline const char *mfi_frame_desc(unsigned int cmd)
182 {
183     static const char *mfi_frame_descs[] = {
184         "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",
185         "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"
186     };
187 
188     if (cmd < ARRAY_SIZE(mfi_frame_descs)) {
189         return mfi_frame_descs[cmd];
190     }
191 
192     return "Unknown";
193 }
194 
195 /*
196  * Context is considered opaque, but the HBA firmware is running
197  * in little endian mode. So convert it to little endian, too.
198  */
199 static uint64_t megasas_frame_get_context(MegasasState *s,
200                                           unsigned long frame)
201 {
202     PCIDevice *pci = &s->parent_obj;
203     return ldq_le_pci_dma(pci, frame + offsetof(struct mfi_frame_header, context));
204 }
205 
206 static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)
207 {
208     return cmd->flags & MFI_FRAME_IEEE_SGL;
209 }
210 
211 static bool megasas_frame_is_sgl64(MegasasCmd *cmd)
212 {
213     return cmd->flags & MFI_FRAME_SGL64;
214 }
215 
216 static bool megasas_frame_is_sense64(MegasasCmd *cmd)
217 {
218     return cmd->flags & MFI_FRAME_SENSE64;
219 }
220 
221 static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,
222                                      union mfi_sgl *sgl)
223 {
224     uint64_t addr;
225 
226     if (megasas_frame_is_ieee_sgl(cmd)) {
227         addr = le64_to_cpu(sgl->sg_skinny->addr);
228     } else if (megasas_frame_is_sgl64(cmd)) {
229         addr = le64_to_cpu(sgl->sg64->addr);
230     } else {
231         addr = le32_to_cpu(sgl->sg32->addr);
232     }
233     return addr;
234 }
235 
236 static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,
237                                     union mfi_sgl *sgl)
238 {
239     uint32_t len;
240 
241     if (megasas_frame_is_ieee_sgl(cmd)) {
242         len = le32_to_cpu(sgl->sg_skinny->len);
243     } else if (megasas_frame_is_sgl64(cmd)) {
244         len = le32_to_cpu(sgl->sg64->len);
245     } else {
246         len = le32_to_cpu(sgl->sg32->len);
247     }
248     return len;
249 }
250 
251 static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,
252                                        union mfi_sgl *sgl)
253 {
254     uint8_t *next = (uint8_t *)sgl;
255 
256     if (megasas_frame_is_ieee_sgl(cmd)) {
257         next += sizeof(struct mfi_sg_skinny);
258     } else if (megasas_frame_is_sgl64(cmd)) {
259         next += sizeof(struct mfi_sg64);
260     } else {
261         next += sizeof(struct mfi_sg32);
262     }
263 
264     if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {
265         return NULL;
266     }
267     return (union mfi_sgl *)next;
268 }
269 
270 static void megasas_soft_reset(MegasasState *s);
271 
272 static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
273 {
274     int i;
275     int iov_count = 0;
276     size_t iov_size = 0;
277 
278     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
279     iov_count = cmd->frame->header.sge_count;
280     if (!iov_count || iov_count > MEGASAS_MAX_SGE) {
281         trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,
282                                          MEGASAS_MAX_SGE);
283         return -1;
284     }
285     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), iov_count);
286     for (i = 0; i < iov_count; i++) {
287         dma_addr_t iov_pa, iov_size_p;
288 
289         if (!sgl) {
290             trace_megasas_iovec_sgl_underflow(cmd->index, i);
291             goto unmap;
292         }
293         iov_pa = megasas_sgl_get_addr(cmd, sgl);
294         iov_size_p = megasas_sgl_get_len(cmd, sgl);
295         if (!iov_pa || !iov_size_p) {
296             trace_megasas_iovec_sgl_invalid(cmd->index, i,
297                                             iov_pa, iov_size_p);
298             goto unmap;
299         }
300         qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);
301         sgl = megasas_sgl_next(cmd, sgl);
302         iov_size += (size_t)iov_size_p;
303     }
304     if (cmd->iov_size > iov_size) {
305         trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
306     } else if (cmd->iov_size < iov_size) {
307         trace_megasas_iovec_underflow(cmd->index, iov_size, cmd->iov_size);
308     }
309     cmd->iov_offset = 0;
310     return 0;
311 unmap:
312     qemu_sglist_destroy(&cmd->qsg);
313     return -1;
314 }
315 
316 /*
317  * passthrough sense and io sense are at the same offset
318  */
319 static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,
320     uint8_t sense_len)
321 {
322     PCIDevice *pcid = PCI_DEVICE(cmd->state);
323     uint32_t pa_hi = 0, pa_lo;
324     hwaddr pa;
325     int frame_sense_len;
326 
327     frame_sense_len = cmd->frame->header.sense_len;
328     if (sense_len > frame_sense_len) {
329         sense_len = frame_sense_len;
330     }
331     if (sense_len) {
332         pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);
333         if (megasas_frame_is_sense64(cmd)) {
334             pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);
335         }
336         pa = ((uint64_t) pa_hi << 32) | pa_lo;
337         pci_dma_write(pcid, pa, sense_ptr, sense_len);
338         cmd->frame->header.sense_len = sense_len;
339     }
340     return sense_len;
341 }
342 
343 static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)
344 {
345     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
346     uint8_t sense_len = 18;
347 
348     memset(sense_buf, 0, sense_len);
349     sense_buf[0] = 0xf0;
350     sense_buf[2] = sense.key;
351     sense_buf[7] = 10;
352     sense_buf[12] = sense.asc;
353     sense_buf[13] = sense.ascq;
354     megasas_build_sense(cmd, sense_buf, sense_len);
355 }
356 
357 static void megasas_copy_sense(MegasasCmd *cmd)
358 {
359     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
360     uint8_t sense_len;
361 
362     sense_len = scsi_req_get_sense(cmd->req, sense_buf,
363                                    SCSI_SENSE_BUF_SIZE);
364     megasas_build_sense(cmd, sense_buf, sense_len);
365 }
366 
367 /*
368  * Format an INQUIRY CDB
369  */
370 static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)
371 {
372     memset(cdb, 0, 6);
373     cdb[0] = INQUIRY;
374     if (pg > 0) {
375         cdb[1] = 0x1;
376         cdb[2] = pg;
377     }
378     cdb[3] = (len >> 8) & 0xff;
379     cdb[4] = (len & 0xff);
380     return len;
381 }
382 
383 /*
384  * Encode lba and len into a READ_16/WRITE_16 CDB
385  */
386 static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,
387                                uint32_t len, bool is_write)
388 {
389     memset(cdb, 0x0, 16);
390     if (is_write) {
391         cdb[0] = WRITE_16;
392     } else {
393         cdb[0] = READ_16;
394     }
395     cdb[2] = (lba >> 56) & 0xff;
396     cdb[3] = (lba >> 48) & 0xff;
397     cdb[4] = (lba >> 40) & 0xff;
398     cdb[5] = (lba >> 32) & 0xff;
399     cdb[6] = (lba >> 24) & 0xff;
400     cdb[7] = (lba >> 16) & 0xff;
401     cdb[8] = (lba >> 8) & 0xff;
402     cdb[9] = (lba) & 0xff;
403     cdb[10] = (len >> 24) & 0xff;
404     cdb[11] = (len >> 16) & 0xff;
405     cdb[12] = (len >> 8) & 0xff;
406     cdb[13] = (len) & 0xff;
407 }
408 
409 /*
410  * Utility functions
411  */
412 static uint64_t megasas_fw_time(void)
413 {
414     struct tm curtime;
415 
416     qemu_get_timedate(&curtime, 0);
417     return ((uint64_t)curtime.tm_sec & 0xff) << 48 |
418         ((uint64_t)curtime.tm_min & 0xff)  << 40 |
419         ((uint64_t)curtime.tm_hour & 0xff) << 32 |
420         ((uint64_t)curtime.tm_mday & 0xff) << 24 |
421         ((uint64_t)curtime.tm_mon & 0xff)  << 16 |
422         ((uint64_t)(curtime.tm_year + 1900) & 0xffff);
423 }
424 
425 /*
426  * Default disk sata address
427  * 0x1221 is the magic number as
428  * present in real hardware,
429  * so use it here, too.
430  */
431 static uint64_t megasas_get_sata_addr(uint16_t id)
432 {
433     uint64_t addr = (0x1221ULL << 48);
434     return addr | ((uint64_t)id << 24);
435 }
436 
437 /*
438  * Frame handling
439  */
440 static int megasas_next_index(MegasasState *s, int index, int limit)
441 {
442     index++;
443     if (index == limit) {
444         index = 0;
445     }
446     return index;
447 }
448 
449 static MegasasCmd *megasas_lookup_frame(MegasasState *s,
450     hwaddr frame)
451 {
452     MegasasCmd *cmd = NULL;
453     int num = 0, index;
454 
455     index = s->reply_queue_head;
456 
457     while (num < s->fw_cmds && index < MEGASAS_MAX_FRAMES) {
458         if (s->frames[index].pa && s->frames[index].pa == frame) {
459             cmd = &s->frames[index];
460             break;
461         }
462         index = megasas_next_index(s, index, s->fw_cmds);
463         num++;
464     }
465 
466     return cmd;
467 }
468 
469 static void megasas_unmap_frame(MegasasState *s, MegasasCmd *cmd)
470 {
471     PCIDevice *p = PCI_DEVICE(s);
472 
473     if (cmd->pa_size) {
474         pci_dma_unmap(p, cmd->frame, cmd->pa_size, 0, 0);
475     }
476     cmd->frame = NULL;
477     cmd->pa = 0;
478     cmd->pa_size = 0;
479     qemu_sglist_destroy(&cmd->qsg);
480     clear_bit(cmd->index, s->frame_map);
481 }
482 
483 /*
484  * This absolutely needs to be locked if
485  * qemu ever goes multithreaded.
486  */
487 static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
488     hwaddr frame, uint64_t context, int count)
489 {
490     PCIDevice *pcid = PCI_DEVICE(s);
491     MegasasCmd *cmd = NULL;
492     int frame_size = MEGASAS_MAX_SGE * sizeof(union mfi_sgl);
493     hwaddr frame_size_p = frame_size;
494     unsigned long index;
495 
496     index = 0;
497     while (index < s->fw_cmds) {
498         index = find_next_zero_bit(s->frame_map, s->fw_cmds, index);
499         if (!s->frames[index].pa)
500             break;
501         /* Busy frame found */
502         trace_megasas_qf_mapped(index);
503     }
504     if (index >= s->fw_cmds) {
505         /* All frames busy */
506         trace_megasas_qf_busy(frame);
507         return NULL;
508     }
509     cmd = &s->frames[index];
510     set_bit(index, s->frame_map);
511     trace_megasas_qf_new(index, frame);
512 
513     cmd->pa = frame;
514     /* Map all possible frames */
515     cmd->frame = pci_dma_map(pcid, frame, &frame_size_p, 0);
516     if (!cmd->frame || frame_size_p != frame_size) {
517         trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
518         if (cmd->frame) {
519             megasas_unmap_frame(s, cmd);
520         }
521         s->event_count++;
522         return NULL;
523     }
524     cmd->pa_size = frame_size_p;
525     cmd->context = context;
526     if (!megasas_use_queue64(s)) {
527         cmd->context &= (uint64_t)0xFFFFFFFF;
528     }
529     cmd->count = count;
530     cmd->dcmd_opcode = -1;
531     s->busy++;
532 
533     if (s->consumer_pa) {
534         s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa);
535     }
536     trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,
537                              s->reply_queue_head, s->reply_queue_tail, s->busy);
538 
539     return cmd;
540 }
541 
542 static void megasas_complete_frame(MegasasState *s, uint64_t context)
543 {
544     PCIDevice *pci_dev = PCI_DEVICE(s);
545     int tail, queue_offset;
546 
547     /* Decrement busy count */
548     s->busy--;
549     if (s->reply_queue_pa) {
550         /*
551          * Put command on the reply queue.
552          * Context is opaque, but emulation is running in
553          * little endian. So convert it.
554          */
555         if (megasas_use_queue64(s)) {
556             queue_offset = s->reply_queue_head * sizeof(uint64_t);
557             stq_le_pci_dma(pci_dev, s->reply_queue_pa + queue_offset, context);
558         } else {
559             queue_offset = s->reply_queue_head * sizeof(uint32_t);
560             stl_le_pci_dma(pci_dev, s->reply_queue_pa + queue_offset, context);
561         }
562         s->reply_queue_tail = ldl_le_pci_dma(pci_dev, s->consumer_pa);
563         trace_megasas_qf_complete(context, s->reply_queue_head,
564                                   s->reply_queue_tail, s->busy);
565     }
566 
567     if (megasas_intr_enabled(s)) {
568         /* Update reply queue pointer */
569         s->reply_queue_tail = ldl_le_pci_dma(pci_dev, s->consumer_pa);
570         tail = s->reply_queue_head;
571         s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
572         trace_megasas_qf_update(s->reply_queue_head, s->reply_queue_tail,
573                                 s->busy);
574         stl_le_pci_dma(pci_dev, s->producer_pa, s->reply_queue_head);
575         /* Notify HBA */
576         if (msix_enabled(pci_dev)) {
577             trace_megasas_msix_raise(0);
578             msix_notify(pci_dev, 0);
579         } else if (msi_enabled(pci_dev)) {
580             trace_megasas_msi_raise(0);
581             msi_notify(pci_dev, 0);
582         } else {
583             s->doorbell++;
584             if (s->doorbell == 1) {
585                 trace_megasas_irq_raise();
586                 pci_irq_assert(pci_dev);
587             }
588         }
589     } else {
590         trace_megasas_qf_complete_noirq(context);
591     }
592 }
593 
594 static void megasas_complete_command(MegasasCmd *cmd)
595 {
596     cmd->iov_size = 0;
597     cmd->iov_offset = 0;
598 
599     cmd->req->hba_private = NULL;
600     scsi_req_unref(cmd->req);
601     cmd->req = NULL;
602 
603     megasas_unmap_frame(cmd->state, cmd);
604     megasas_complete_frame(cmd->state, cmd->context);
605 }
606 
607 static void megasas_reset_frames(MegasasState *s)
608 {
609     int i;
610     MegasasCmd *cmd;
611 
612     for (i = 0; i < s->fw_cmds; i++) {
613         cmd = &s->frames[i];
614         if (cmd->pa) {
615             megasas_unmap_frame(s, cmd);
616         }
617     }
618     bitmap_zero(s->frame_map, MEGASAS_MAX_FRAMES);
619 }
620 
621 static void megasas_abort_command(MegasasCmd *cmd)
622 {
623     /* Never abort internal commands.  */
624     if (cmd->dcmd_opcode != -1) {
625         return;
626     }
627     if (cmd->req != NULL) {
628         scsi_req_cancel(cmd->req);
629     }
630 }
631 
632 static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
633 {
634     PCIDevice *pcid = PCI_DEVICE(s);
635     uint32_t pa_hi, pa_lo;
636     hwaddr iq_pa, initq_size = sizeof(struct mfi_init_qinfo);
637     struct mfi_init_qinfo *initq = NULL;
638     uint32_t flags;
639     int ret = MFI_STAT_OK;
640 
641     if (s->reply_queue_pa) {
642         trace_megasas_initq_mapped(s->reply_queue_pa);
643         goto out;
644     }
645     pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);
646     pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);
647     iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);
648     trace_megasas_init_firmware((uint64_t)iq_pa);
649     initq = pci_dma_map(pcid, iq_pa, &initq_size, 0);
650     if (!initq || initq_size != sizeof(*initq)) {
651         trace_megasas_initq_map_failed(cmd->index);
652         s->event_count++;
653         ret = MFI_STAT_MEMORY_NOT_AVAILABLE;
654         goto out;
655     }
656     s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;
657     if (s->reply_queue_len > s->fw_cmds) {
658         trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);
659         s->event_count++;
660         ret = MFI_STAT_INVALID_PARAMETER;
661         goto out;
662     }
663     pa_lo = le32_to_cpu(initq->rq_addr_lo);
664     pa_hi = le32_to_cpu(initq->rq_addr_hi);
665     s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;
666     pa_lo = le32_to_cpu(initq->ci_addr_lo);
667     pa_hi = le32_to_cpu(initq->ci_addr_hi);
668     s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
669     pa_lo = le32_to_cpu(initq->pi_addr_lo);
670     pa_hi = le32_to_cpu(initq->pi_addr_hi);
671     s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
672     s->reply_queue_head = ldl_le_pci_dma(pcid, s->producer_pa);
673     s->reply_queue_head %= MEGASAS_MAX_FRAMES;
674     s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa);
675     s->reply_queue_tail %= MEGASAS_MAX_FRAMES;
676     flags = le32_to_cpu(initq->flags);
677     if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
678         s->flags |= MEGASAS_MASK_USE_QUEUE64;
679     }
680     trace_megasas_init_queue((unsigned long)s->reply_queue_pa,
681                              s->reply_queue_len, s->reply_queue_head,
682                              s->reply_queue_tail, flags);
683     megasas_reset_frames(s);
684     s->fw_state = MFI_FWSTATE_OPERATIONAL;
685 out:
686     if (initq) {
687         pci_dma_unmap(pcid, initq, initq_size, 0, 0);
688     }
689     return ret;
690 }
691 
692 static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
693 {
694     dma_addr_t iov_pa, iov_size;
695     int iov_count;
696 
697     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
698     iov_count = cmd->frame->header.sge_count;
699     if (!iov_count) {
700         trace_megasas_dcmd_zero_sge(cmd->index);
701         cmd->iov_size = 0;
702         return 0;
703     } else if (iov_count > 1) {
704         trace_megasas_dcmd_invalid_sge(cmd->index, iov_count);
705         cmd->iov_size = 0;
706         return -EINVAL;
707     }
708     iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
709     iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
710     pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), 1);
711     qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
712     cmd->iov_size = iov_size;
713     return 0;
714 }
715 
716 static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
717 {
718     trace_megasas_finish_dcmd(cmd->index, iov_size);
719 
720     if (iov_size > cmd->iov_size) {
721         if (megasas_frame_is_ieee_sgl(cmd)) {
722             cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);
723         } else if (megasas_frame_is_sgl64(cmd)) {
724             cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);
725         } else {
726             cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);
727         }
728     }
729 }
730 
731 static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
732 {
733     PCIDevice *pci_dev = PCI_DEVICE(s);
734     PCIDeviceClass *pci_class = PCI_DEVICE_GET_CLASS(pci_dev);
735     MegasasBaseClass *base_class = MEGASAS_GET_CLASS(s);
736     struct mfi_ctrl_info info;
737     size_t dcmd_size = sizeof(info);
738     BusChild *kid;
739     int num_pd_disks = 0;
740 
741     memset(&info, 0x0, dcmd_size);
742     if (cmd->iov_size < dcmd_size) {
743         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
744                                             dcmd_size);
745         return MFI_STAT_INVALID_PARAMETER;
746     }
747 
748     info.pci.vendor = cpu_to_le16(pci_class->vendor_id);
749     info.pci.device = cpu_to_le16(pci_class->device_id);
750     info.pci.subvendor = cpu_to_le16(pci_class->subsystem_vendor_id);
751     info.pci.subdevice = cpu_to_le16(pci_class->subsystem_id);
752 
753     /*
754      * For some reason the firmware supports
755      * only up to 8 device ports.
756      * Despite supporting a far larger number
757      * of devices for the physical devices.
758      * So just display the first 8 devices
759      * in the device port list, independent
760      * of how many logical devices are actually
761      * present.
762      */
763     info.host.type = MFI_INFO_HOST_PCIE;
764     info.device.type = MFI_INFO_DEV_SAS3G;
765     info.device.port_count = 8;
766     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
767         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
768         uint16_t pd_id;
769 
770         if (num_pd_disks < 8) {
771             pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
772             info.device.port_addr[num_pd_disks] =
773                 cpu_to_le64(megasas_get_sata_addr(pd_id));
774         }
775         num_pd_disks++;
776     }
777 
778     memcpy(info.product_name, base_class->product_name, 24);
779     snprintf(info.serial_number, 32, "%s", s->hba_serial);
780     snprintf(info.package_version, 0x60, "%s-QEMU", qemu_hw_version());
781     memcpy(info.image_component[0].name, "APP", 3);
782     snprintf(info.image_component[0].version, 10, "%s-QEMU",
783              base_class->product_version);
784     memcpy(info.image_component[0].build_date, "Apr  1 2014", 11);
785     memcpy(info.image_component[0].build_time, "12:34:56", 8);
786     info.image_component_count = 1;
787     if (pci_dev->has_rom) {
788         uint8_t biosver[32];
789         uint8_t *ptr;
790 
791         ptr = memory_region_get_ram_ptr(&pci_dev->rom);
792         memcpy(biosver, ptr + 0x41, 31);
793         biosver[31] = 0;
794         memcpy(info.image_component[1].name, "BIOS", 4);
795         memcpy(info.image_component[1].version, biosver,
796                strlen((const char *)biosver));
797         info.image_component_count++;
798     }
799     info.current_fw_time = cpu_to_le32(megasas_fw_time());
800     info.max_arms = 32;
801     info.max_spans = 8;
802     info.max_arrays = MEGASAS_MAX_ARRAYS;
803     info.max_lds = MFI_MAX_LD;
804     info.max_cmds = cpu_to_le16(s->fw_cmds);
805     info.max_sg_elements = cpu_to_le16(s->fw_sge);
806     info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);
807     if (!megasas_is_jbod(s))
808         info.lds_present = cpu_to_le16(num_pd_disks);
809     info.pd_present = cpu_to_le16(num_pd_disks);
810     info.pd_disks_present = cpu_to_le16(num_pd_disks);
811     info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |
812                                    MFI_INFO_HW_MEM |
813                                    MFI_INFO_HW_FLASH);
814     info.memory_size = cpu_to_le16(512);
815     info.nvram_size = cpu_to_le16(32);
816     info.flash_size = cpu_to_le16(16);
817     info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);
818     info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |
819                                     MFI_INFO_AOPS_SELF_DIAGNOSTIC |
820                                     MFI_INFO_AOPS_MIXED_ARRAY);
821     info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |
822                                MFI_INFO_LDOPS_ACCESS_POLICY |
823                                MFI_INFO_LDOPS_IO_POLICY |
824                                MFI_INFO_LDOPS_WRITE_POLICY |
825                                MFI_INFO_LDOPS_READ_POLICY);
826     info.max_strips_per_io = cpu_to_le16(s->fw_sge);
827     info.stripe_sz_ops.min = 3;
828     info.stripe_sz_ops.max = ctz32(MEGASAS_MAX_SECTORS + 1);
829     info.properties.pred_fail_poll_interval = cpu_to_le16(300);
830     info.properties.intr_throttle_cnt = cpu_to_le16(16);
831     info.properties.intr_throttle_timeout = cpu_to_le16(50);
832     info.properties.rebuild_rate = 30;
833     info.properties.patrol_read_rate = 30;
834     info.properties.bgi_rate = 30;
835     info.properties.cc_rate = 30;
836     info.properties.recon_rate = 30;
837     info.properties.cache_flush_interval = 4;
838     info.properties.spinup_drv_cnt = 2;
839     info.properties.spinup_delay = 6;
840     info.properties.ecc_bucket_size = 15;
841     info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);
842     info.properties.expose_encl_devices = 1;
843     info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);
844     info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |
845                                MFI_INFO_PDOPS_FORCE_OFFLINE);
846     info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |
847                                        MFI_INFO_PDMIX_SATA |
848                                        MFI_INFO_PDMIX_LD);
849 
850     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
851     return MFI_STAT_OK;
852 }
853 
854 static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)
855 {
856     struct mfi_defaults info;
857     size_t dcmd_size = sizeof(struct mfi_defaults);
858 
859     memset(&info, 0x0, dcmd_size);
860     if (cmd->iov_size < dcmd_size) {
861         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
862                                             dcmd_size);
863         return MFI_STAT_INVALID_PARAMETER;
864     }
865 
866     info.sas_addr = cpu_to_le64(s->sas_addr);
867     info.stripe_size = 3;
868     info.flush_time = 4;
869     info.background_rate = 30;
870     info.allow_mix_in_enclosure = 1;
871     info.allow_mix_in_ld = 1;
872     info.direct_pd_mapping = 1;
873     /* Enable for BIOS support */
874     info.bios_enumerate_lds = 1;
875     info.disable_ctrl_r = 1;
876     info.expose_enclosure_devices = 1;
877     info.disable_preboot_cli = 1;
878     info.cluster_disable = 1;
879 
880     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
881     return MFI_STAT_OK;
882 }
883 
884 static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)
885 {
886     struct mfi_bios_data info;
887     size_t dcmd_size = sizeof(info);
888 
889     memset(&info, 0x0, dcmd_size);
890     if (cmd->iov_size < dcmd_size) {
891         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
892                                             dcmd_size);
893         return MFI_STAT_INVALID_PARAMETER;
894     }
895     info.continue_on_error = 1;
896     info.verbose = 1;
897     if (megasas_is_jbod(s)) {
898         info.expose_all_drives = 1;
899     }
900 
901     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
902     return MFI_STAT_OK;
903 }
904 
905 static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)
906 {
907     uint64_t fw_time;
908     size_t dcmd_size = sizeof(fw_time);
909 
910     fw_time = cpu_to_le64(megasas_fw_time());
911 
912     cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);
913     return MFI_STAT_OK;
914 }
915 
916 static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)
917 {
918     uint64_t fw_time;
919 
920     /* This is a dummy; setting of firmware time is not allowed */
921     memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));
922 
923     trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);
924     fw_time = cpu_to_le64(megasas_fw_time());
925     return MFI_STAT_OK;
926 }
927 
928 static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)
929 {
930     struct mfi_evt_log_state info;
931     size_t dcmd_size = sizeof(info);
932 
933     memset(&info, 0, dcmd_size);
934 
935     info.newest_seq_num = cpu_to_le32(s->event_count);
936     info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
937     info.boot_seq_num = cpu_to_le32(s->boot_event);
938 
939     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
940     return MFI_STAT_OK;
941 }
942 
943 static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
944 {
945     union mfi_evt event;
946 
947     if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {
948         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
949                                             sizeof(struct mfi_evt_detail));
950         return MFI_STAT_INVALID_PARAMETER;
951     }
952     s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);
953     event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);
954     s->event_locale = event.members.locale;
955     s->event_class = event.members.class;
956     s->event_cmd = cmd;
957     /* Decrease busy count; event frame doesn't count here */
958     s->busy--;
959     cmd->iov_size = sizeof(struct mfi_evt_detail);
960     return MFI_STAT_INVALID_STATUS;
961 }
962 
963 static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
964 {
965     struct mfi_pd_list info;
966     size_t dcmd_size = sizeof(info);
967     BusChild *kid;
968     uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
969 
970     memset(&info, 0, dcmd_size);
971     offset = 8;
972     dcmd_limit = offset + sizeof(struct mfi_pd_address);
973     if (cmd->iov_size < dcmd_limit) {
974         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
975                                             dcmd_limit);
976         return MFI_STAT_INVALID_PARAMETER;
977     }
978 
979     max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);
980     if (max_pd_disks > MFI_MAX_SYS_PDS) {
981         max_pd_disks = MFI_MAX_SYS_PDS;
982     }
983     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
984         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
985         uint16_t pd_id;
986 
987         if (num_pd_disks >= max_pd_disks)
988             break;
989 
990         pd_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
991         info.addr[num_pd_disks].device_id = cpu_to_le16(pd_id);
992         info.addr[num_pd_disks].encl_device_id = 0xFFFF;
993         info.addr[num_pd_disks].encl_index = 0;
994         info.addr[num_pd_disks].slot_number = sdev->id & 0xFF;
995         info.addr[num_pd_disks].scsi_dev_type = sdev->type;
996         info.addr[num_pd_disks].connect_port_bitmap = 0x1;
997         info.addr[num_pd_disks].sas_addr[0] =
998             cpu_to_le64(megasas_get_sata_addr(pd_id));
999         num_pd_disks++;
1000         offset += sizeof(struct mfi_pd_address);
1001     }
1002     trace_megasas_dcmd_pd_get_list(cmd->index, num_pd_disks,
1003                                    max_pd_disks, offset);
1004 
1005     info.size = cpu_to_le32(offset);
1006     info.count = cpu_to_le32(num_pd_disks);
1007 
1008     cmd->iov_size -= dma_buf_read((uint8_t *)&info, offset, &cmd->qsg);
1009     return MFI_STAT_OK;
1010 }
1011 
1012 static int megasas_dcmd_pd_list_query(MegasasState *s, MegasasCmd *cmd)
1013 {
1014     uint16_t flags;
1015 
1016     /* mbox0 contains flags */
1017     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1018     trace_megasas_dcmd_pd_list_query(cmd->index, flags);
1019     if (flags == MR_PD_QUERY_TYPE_ALL ||
1020         megasas_is_jbod(s)) {
1021         return megasas_dcmd_pd_get_list(s, cmd);
1022     }
1023 
1024     return MFI_STAT_OK;
1025 }
1026 
1027 static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun,
1028                                       MegasasCmd *cmd)
1029 {
1030     struct mfi_pd_info *info = cmd->iov_buf;
1031     size_t dcmd_size = sizeof(struct mfi_pd_info);
1032     uint64_t pd_size;
1033     uint16_t pd_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1034     uint8_t cmdbuf[6];
1035     size_t len, resid;
1036 
1037     if (!cmd->iov_buf) {
1038         cmd->iov_buf = g_malloc0(dcmd_size);
1039         info = cmd->iov_buf;
1040         info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */
1041         info->vpd_page83[0] = 0x7f;
1042         megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data));
1043         cmd->req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1044         if (!cmd->req) {
1045             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1046                                                 "PD get info std inquiry");
1047             g_free(cmd->iov_buf);
1048             cmd->iov_buf = NULL;
1049             return MFI_STAT_FLASH_ALLOC_FAIL;
1050         }
1051         trace_megasas_dcmd_internal_submit(cmd->index,
1052                                            "PD get info std inquiry", lun);
1053         len = scsi_req_enqueue(cmd->req);
1054         if (len > 0) {
1055             cmd->iov_size = len;
1056             scsi_req_continue(cmd->req);
1057         }
1058         return MFI_STAT_INVALID_STATUS;
1059     } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) {
1060         megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83));
1061         cmd->req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
1062         if (!cmd->req) {
1063             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1064                                                 "PD get info vpd inquiry");
1065             return MFI_STAT_FLASH_ALLOC_FAIL;
1066         }
1067         trace_megasas_dcmd_internal_submit(cmd->index,
1068                                            "PD get info vpd inquiry", lun);
1069         len = scsi_req_enqueue(cmd->req);
1070         if (len > 0) {
1071             cmd->iov_size = len;
1072             scsi_req_continue(cmd->req);
1073         }
1074         return MFI_STAT_INVALID_STATUS;
1075     }
1076     /* Finished, set FW state */
1077     if ((info->inquiry_data[0] >> 5) == 0) {
1078         if (megasas_is_jbod(cmd->state)) {
1079             info->fw_state = cpu_to_le16(MFI_PD_STATE_SYSTEM);
1080         } else {
1081             info->fw_state = cpu_to_le16(MFI_PD_STATE_ONLINE);
1082         }
1083     } else {
1084         info->fw_state = cpu_to_le16(MFI_PD_STATE_OFFLINE);
1085     }
1086 
1087     info->ref.v.device_id = cpu_to_le16(pd_id);
1088     info->state.ddf.pd_type = cpu_to_le16(MFI_PD_DDF_TYPE_IN_VD|
1089                                           MFI_PD_DDF_TYPE_INTF_SAS);
1090     blk_get_geometry(sdev->conf.blk, &pd_size);
1091     info->raw_size = cpu_to_le64(pd_size);
1092     info->non_coerced_size = cpu_to_le64(pd_size);
1093     info->coerced_size = cpu_to_le64(pd_size);
1094     info->encl_device_id = 0xFFFF;
1095     info->slot_number = (sdev->id & 0xFF);
1096     info->path_info.count = 1;
1097     info->path_info.sas_addr[0] =
1098         cpu_to_le64(megasas_get_sata_addr(pd_id));
1099     info->connected_port_bitmap = 0x1;
1100     info->device_speed = 1;
1101     info->link_speed = 1;
1102     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1103     g_free(cmd->iov_buf);
1104     cmd->iov_size = dcmd_size - resid;
1105     cmd->iov_buf = NULL;
1106     return MFI_STAT_OK;
1107 }
1108 
1109 static int megasas_dcmd_pd_get_info(MegasasState *s, MegasasCmd *cmd)
1110 {
1111     size_t dcmd_size = sizeof(struct mfi_pd_info);
1112     uint16_t pd_id;
1113     uint8_t target_id, lun_id;
1114     SCSIDevice *sdev = NULL;
1115     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1116 
1117     if (cmd->iov_size < dcmd_size) {
1118         return MFI_STAT_INVALID_PARAMETER;
1119     }
1120 
1121     /* mbox0 has the ID */
1122     pd_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1123     target_id = (pd_id >> 8) & 0xFF;
1124     lun_id = pd_id & 0xFF;
1125     sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
1126     trace_megasas_dcmd_pd_get_info(cmd->index, pd_id);
1127 
1128     if (sdev) {
1129         /* Submit inquiry */
1130         retval = megasas_pd_get_info_submit(sdev, pd_id, cmd);
1131     }
1132 
1133     return retval;
1134 }
1135 
1136 static int megasas_dcmd_ld_get_list(MegasasState *s, MegasasCmd *cmd)
1137 {
1138     struct mfi_ld_list info;
1139     size_t dcmd_size = sizeof(info), resid;
1140     uint32_t num_ld_disks = 0, max_ld_disks;
1141     uint64_t ld_size;
1142     BusChild *kid;
1143 
1144     memset(&info, 0, dcmd_size);
1145     if (cmd->iov_size > dcmd_size) {
1146         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1147                                             dcmd_size);
1148         return MFI_STAT_INVALID_PARAMETER;
1149     }
1150 
1151     max_ld_disks = (cmd->iov_size - 8) / 16;
1152     if (megasas_is_jbod(s)) {
1153         max_ld_disks = 0;
1154     }
1155     if (max_ld_disks > MFI_MAX_LD) {
1156         max_ld_disks = MFI_MAX_LD;
1157     }
1158     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1159         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1160 
1161         if (num_ld_disks >= max_ld_disks) {
1162             break;
1163         }
1164         /* Logical device size is in blocks */
1165         blk_get_geometry(sdev->conf.blk, &ld_size);
1166         info.ld_list[num_ld_disks].ld.v.target_id = sdev->id;
1167         info.ld_list[num_ld_disks].state = MFI_LD_STATE_OPTIMAL;
1168         info.ld_list[num_ld_disks].size = cpu_to_le64(ld_size);
1169         num_ld_disks++;
1170     }
1171     info.ld_count = cpu_to_le32(num_ld_disks);
1172     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1173 
1174     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1175     cmd->iov_size = dcmd_size - resid;
1176     return MFI_STAT_OK;
1177 }
1178 
1179 static int megasas_dcmd_ld_list_query(MegasasState *s, MegasasCmd *cmd)
1180 {
1181     uint16_t flags;
1182     struct mfi_ld_targetid_list info;
1183     size_t dcmd_size = sizeof(info), resid;
1184     uint32_t num_ld_disks = 0, max_ld_disks = s->fw_luns;
1185     BusChild *kid;
1186 
1187     /* mbox0 contains flags */
1188     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1189     trace_megasas_dcmd_ld_list_query(cmd->index, flags);
1190     if (flags != MR_LD_QUERY_TYPE_ALL &&
1191         flags != MR_LD_QUERY_TYPE_EXPOSED_TO_HOST) {
1192         max_ld_disks = 0;
1193     }
1194 
1195     memset(&info, 0, dcmd_size);
1196     if (cmd->iov_size < 12) {
1197         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1198                                             dcmd_size);
1199         return MFI_STAT_INVALID_PARAMETER;
1200     }
1201     dcmd_size = sizeof(uint32_t) * 2 + 3;
1202     max_ld_disks = cmd->iov_size - dcmd_size;
1203     if (megasas_is_jbod(s)) {
1204         max_ld_disks = 0;
1205     }
1206     if (max_ld_disks > MFI_MAX_LD) {
1207         max_ld_disks = MFI_MAX_LD;
1208     }
1209     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1210         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1211 
1212         if (num_ld_disks >= max_ld_disks) {
1213             break;
1214         }
1215         info.targetid[num_ld_disks] = sdev->lun;
1216         num_ld_disks++;
1217         dcmd_size++;
1218     }
1219     info.ld_count = cpu_to_le32(num_ld_disks);
1220     info.size = dcmd_size;
1221     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1222 
1223     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1224     cmd->iov_size = dcmd_size - resid;
1225     return MFI_STAT_OK;
1226 }
1227 
1228 static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun,
1229                                       MegasasCmd *cmd)
1230 {
1231     struct mfi_ld_info *info = cmd->iov_buf;
1232     size_t dcmd_size = sizeof(struct mfi_ld_info);
1233     uint8_t cdb[6];
1234     ssize_t len, resid;
1235     uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (lun & 0xFF);
1236     uint64_t ld_size;
1237 
1238     if (!cmd->iov_buf) {
1239         cmd->iov_buf = g_malloc0(dcmd_size);
1240         info = cmd->iov_buf;
1241         megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83));
1242         cmd->req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd);
1243         if (!cmd->req) {
1244             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1245                                                 "LD get info vpd inquiry");
1246             g_free(cmd->iov_buf);
1247             cmd->iov_buf = NULL;
1248             return MFI_STAT_FLASH_ALLOC_FAIL;
1249         }
1250         trace_megasas_dcmd_internal_submit(cmd->index,
1251                                            "LD get info vpd inquiry", lun);
1252         len = scsi_req_enqueue(cmd->req);
1253         if (len > 0) {
1254             cmd->iov_size = len;
1255             scsi_req_continue(cmd->req);
1256         }
1257         return MFI_STAT_INVALID_STATUS;
1258     }
1259 
1260     info->ld_config.params.state = MFI_LD_STATE_OPTIMAL;
1261     info->ld_config.properties.ld.v.target_id = lun;
1262     info->ld_config.params.stripe_size = 3;
1263     info->ld_config.params.num_drives = 1;
1264     info->ld_config.params.is_consistent = 1;
1265     /* Logical device size is in blocks */
1266     blk_get_geometry(sdev->conf.blk, &ld_size);
1267     info->size = cpu_to_le64(ld_size);
1268     memset(info->ld_config.span, 0, sizeof(info->ld_config.span));
1269     info->ld_config.span[0].start_block = 0;
1270     info->ld_config.span[0].num_blocks = info->size;
1271     info->ld_config.span[0].array_ref = cpu_to_le16(sdev_id);
1272 
1273     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1274     g_free(cmd->iov_buf);
1275     cmd->iov_size = dcmd_size - resid;
1276     cmd->iov_buf = NULL;
1277     return MFI_STAT_OK;
1278 }
1279 
1280 static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
1281 {
1282     struct mfi_ld_info info;
1283     size_t dcmd_size = sizeof(info);
1284     uint16_t ld_id;
1285     uint32_t max_ld_disks = s->fw_luns;
1286     SCSIDevice *sdev = NULL;
1287     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1288 
1289     if (cmd->iov_size < dcmd_size) {
1290         return MFI_STAT_INVALID_PARAMETER;
1291     }
1292 
1293     /* mbox0 has the ID */
1294     ld_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1295     trace_megasas_dcmd_ld_get_info(cmd->index, ld_id);
1296 
1297     if (megasas_is_jbod(s)) {
1298         return MFI_STAT_DEVICE_NOT_FOUND;
1299     }
1300 
1301     if (ld_id < max_ld_disks) {
1302         sdev = scsi_device_find(&s->bus, 0, ld_id, 0);
1303     }
1304 
1305     if (sdev) {
1306         retval = megasas_ld_get_info_submit(sdev, ld_id, cmd);
1307     }
1308 
1309     return retval;
1310 }
1311 
1312 static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
1313 {
1314     uint8_t data[4096] = { 0 };
1315     struct mfi_config_data *info;
1316     int num_pd_disks = 0, array_offset, ld_offset;
1317     BusChild *kid;
1318 
1319     if (cmd->iov_size > 4096) {
1320         return MFI_STAT_INVALID_PARAMETER;
1321     }
1322 
1323     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1324         num_pd_disks++;
1325     }
1326     info = (struct mfi_config_data *)&data;
1327     /*
1328      * Array mapping:
1329      * - One array per SCSI device
1330      * - One logical drive per SCSI device
1331      *   spanning the entire device
1332      */
1333     info->array_count = num_pd_disks;
1334     info->array_size = sizeof(struct mfi_array) * num_pd_disks;
1335     info->log_drv_count = num_pd_disks;
1336     info->log_drv_size = sizeof(struct mfi_ld_config) * num_pd_disks;
1337     info->spares_count = 0;
1338     info->spares_size = sizeof(struct mfi_spare);
1339     info->size = sizeof(struct mfi_config_data) + info->array_size +
1340         info->log_drv_size;
1341     if (info->size > 4096) {
1342         return MFI_STAT_INVALID_PARAMETER;
1343     }
1344 
1345     array_offset = sizeof(struct mfi_config_data);
1346     ld_offset = array_offset + sizeof(struct mfi_array) * num_pd_disks;
1347 
1348     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1349         SCSIDevice *sdev = SCSI_DEVICE(kid->child);
1350         uint16_t sdev_id = ((sdev->id & 0xFF) << 8) | (sdev->lun & 0xFF);
1351         struct mfi_array *array;
1352         struct mfi_ld_config *ld;
1353         uint64_t pd_size;
1354         int i;
1355 
1356         array = (struct mfi_array *)(data + array_offset);
1357         blk_get_geometry(sdev->conf.blk, &pd_size);
1358         array->size = cpu_to_le64(pd_size);
1359         array->num_drives = 1;
1360         array->array_ref = cpu_to_le16(sdev_id);
1361         array->pd[0].ref.v.device_id = cpu_to_le16(sdev_id);
1362         array->pd[0].ref.v.seq_num = 0;
1363         array->pd[0].fw_state = MFI_PD_STATE_ONLINE;
1364         array->pd[0].encl.pd = 0xFF;
1365         array->pd[0].encl.slot = (sdev->id & 0xFF);
1366         for (i = 1; i < MFI_MAX_ROW_SIZE; i++) {
1367             array->pd[i].ref.v.device_id = 0xFFFF;
1368             array->pd[i].ref.v.seq_num = 0;
1369             array->pd[i].fw_state = MFI_PD_STATE_UNCONFIGURED_GOOD;
1370             array->pd[i].encl.pd = 0xFF;
1371             array->pd[i].encl.slot = 0xFF;
1372         }
1373         array_offset += sizeof(struct mfi_array);
1374         ld = (struct mfi_ld_config *)(data + ld_offset);
1375         memset(ld, 0, sizeof(struct mfi_ld_config));
1376         ld->properties.ld.v.target_id = sdev->id;
1377         ld->properties.default_cache_policy = MR_LD_CACHE_READ_AHEAD |
1378             MR_LD_CACHE_READ_ADAPTIVE;
1379         ld->properties.current_cache_policy = MR_LD_CACHE_READ_AHEAD |
1380             MR_LD_CACHE_READ_ADAPTIVE;
1381         ld->params.state = MFI_LD_STATE_OPTIMAL;
1382         ld->params.stripe_size = 3;
1383         ld->params.num_drives = 1;
1384         ld->params.span_depth = 1;
1385         ld->params.is_consistent = 1;
1386         ld->span[0].start_block = 0;
1387         ld->span[0].num_blocks = cpu_to_le64(pd_size);
1388         ld->span[0].array_ref = cpu_to_le16(sdev_id);
1389         ld_offset += sizeof(struct mfi_ld_config);
1390     }
1391 
1392     cmd->iov_size -= dma_buf_read((uint8_t *)data, info->size, &cmd->qsg);
1393     return MFI_STAT_OK;
1394 }
1395 
1396 static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
1397 {
1398     struct mfi_ctrl_props info;
1399     size_t dcmd_size = sizeof(info);
1400 
1401     memset(&info, 0x0, dcmd_size);
1402     if (cmd->iov_size < dcmd_size) {
1403         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1404                                             dcmd_size);
1405         return MFI_STAT_INVALID_PARAMETER;
1406     }
1407     info.pred_fail_poll_interval = cpu_to_le16(300);
1408     info.intr_throttle_cnt = cpu_to_le16(16);
1409     info.intr_throttle_timeout = cpu_to_le16(50);
1410     info.rebuild_rate = 30;
1411     info.patrol_read_rate = 30;
1412     info.bgi_rate = 30;
1413     info.cc_rate = 30;
1414     info.recon_rate = 30;
1415     info.cache_flush_interval = 4;
1416     info.spinup_drv_cnt = 2;
1417     info.spinup_delay = 6;
1418     info.ecc_bucket_size = 15;
1419     info.ecc_bucket_leak_rate = cpu_to_le16(1440);
1420     info.expose_encl_devices = 1;
1421 
1422     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1423     return MFI_STAT_OK;
1424 }
1425 
1426 static int megasas_cache_flush(MegasasState *s, MegasasCmd *cmd)
1427 {
1428     blk_drain_all();
1429     return MFI_STAT_OK;
1430 }
1431 
1432 static int megasas_ctrl_shutdown(MegasasState *s, MegasasCmd *cmd)
1433 {
1434     s->fw_state = MFI_FWSTATE_READY;
1435     return MFI_STAT_OK;
1436 }
1437 
1438 /* Some implementations use CLUSTER RESET LD to simulate a device reset */
1439 static int megasas_cluster_reset_ld(MegasasState *s, MegasasCmd *cmd)
1440 {
1441     uint16_t target_id;
1442     int i;
1443 
1444     /* mbox0 contains the device index */
1445     target_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1446     trace_megasas_dcmd_reset_ld(cmd->index, target_id);
1447     for (i = 0; i < s->fw_cmds; i++) {
1448         MegasasCmd *tmp_cmd = &s->frames[i];
1449         if (tmp_cmd->req && tmp_cmd->req->dev->id == target_id) {
1450             SCSIDevice *d = tmp_cmd->req->dev;
1451             qdev_reset_all(&d->qdev);
1452         }
1453     }
1454     return MFI_STAT_OK;
1455 }
1456 
1457 static int megasas_dcmd_set_properties(MegasasState *s, MegasasCmd *cmd)
1458 {
1459     struct mfi_ctrl_props info;
1460     size_t dcmd_size = sizeof(info);
1461 
1462     if (cmd->iov_size < dcmd_size) {
1463         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1464                                             dcmd_size);
1465         return MFI_STAT_INVALID_PARAMETER;
1466     }
1467     dma_buf_write((uint8_t *)&info, dcmd_size, &cmd->qsg);
1468     trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
1469     return MFI_STAT_OK;
1470 }
1471 
1472 static int megasas_dcmd_dummy(MegasasState *s, MegasasCmd *cmd)
1473 {
1474     trace_megasas_dcmd_dummy(cmd->index, cmd->iov_size);
1475     return MFI_STAT_OK;
1476 }
1477 
1478 static const struct dcmd_cmd_tbl_t {
1479     int opcode;
1480     const char *desc;
1481     int (*func)(MegasasState *s, MegasasCmd *cmd);
1482 } dcmd_cmd_tbl[] = {
1483     { MFI_DCMD_CTRL_MFI_HOST_MEM_ALLOC, "CTRL_HOST_MEM_ALLOC",
1484       megasas_dcmd_dummy },
1485     { MFI_DCMD_CTRL_GET_INFO, "CTRL_GET_INFO",
1486       megasas_ctrl_get_info },
1487     { MFI_DCMD_CTRL_GET_PROPERTIES, "CTRL_GET_PROPERTIES",
1488       megasas_dcmd_get_properties },
1489     { MFI_DCMD_CTRL_SET_PROPERTIES, "CTRL_SET_PROPERTIES",
1490       megasas_dcmd_set_properties },
1491     { MFI_DCMD_CTRL_ALARM_GET, "CTRL_ALARM_GET",
1492       megasas_dcmd_dummy },
1493     { MFI_DCMD_CTRL_ALARM_ENABLE, "CTRL_ALARM_ENABLE",
1494       megasas_dcmd_dummy },
1495     { MFI_DCMD_CTRL_ALARM_DISABLE, "CTRL_ALARM_DISABLE",
1496       megasas_dcmd_dummy },
1497     { MFI_DCMD_CTRL_ALARM_SILENCE, "CTRL_ALARM_SILENCE",
1498       megasas_dcmd_dummy },
1499     { MFI_DCMD_CTRL_ALARM_TEST, "CTRL_ALARM_TEST",
1500       megasas_dcmd_dummy },
1501     { MFI_DCMD_CTRL_EVENT_GETINFO, "CTRL_EVENT_GETINFO",
1502       megasas_event_info },
1503     { MFI_DCMD_CTRL_EVENT_GET, "CTRL_EVENT_GET",
1504       megasas_dcmd_dummy },
1505     { MFI_DCMD_CTRL_EVENT_WAIT, "CTRL_EVENT_WAIT",
1506       megasas_event_wait },
1507     { MFI_DCMD_CTRL_SHUTDOWN, "CTRL_SHUTDOWN",
1508       megasas_ctrl_shutdown },
1509     { MFI_DCMD_HIBERNATE_STANDBY, "CTRL_STANDBY",
1510       megasas_dcmd_dummy },
1511     { MFI_DCMD_CTRL_GET_TIME, "CTRL_GET_TIME",
1512       megasas_dcmd_get_fw_time },
1513     { MFI_DCMD_CTRL_SET_TIME, "CTRL_SET_TIME",
1514       megasas_dcmd_set_fw_time },
1515     { MFI_DCMD_CTRL_BIOS_DATA_GET, "CTRL_BIOS_DATA_GET",
1516       megasas_dcmd_get_bios_info },
1517     { MFI_DCMD_CTRL_FACTORY_DEFAULTS, "CTRL_FACTORY_DEFAULTS",
1518       megasas_dcmd_dummy },
1519     { MFI_DCMD_CTRL_MFC_DEFAULTS_GET, "CTRL_MFC_DEFAULTS_GET",
1520       megasas_mfc_get_defaults },
1521     { MFI_DCMD_CTRL_MFC_DEFAULTS_SET, "CTRL_MFC_DEFAULTS_SET",
1522       megasas_dcmd_dummy },
1523     { MFI_DCMD_CTRL_CACHE_FLUSH, "CTRL_CACHE_FLUSH",
1524       megasas_cache_flush },
1525     { MFI_DCMD_PD_GET_LIST, "PD_GET_LIST",
1526       megasas_dcmd_pd_get_list },
1527     { MFI_DCMD_PD_LIST_QUERY, "PD_LIST_QUERY",
1528       megasas_dcmd_pd_list_query },
1529     { MFI_DCMD_PD_GET_INFO, "PD_GET_INFO",
1530       megasas_dcmd_pd_get_info },
1531     { MFI_DCMD_PD_STATE_SET, "PD_STATE_SET",
1532       megasas_dcmd_dummy },
1533     { MFI_DCMD_PD_REBUILD, "PD_REBUILD",
1534       megasas_dcmd_dummy },
1535     { MFI_DCMD_PD_BLINK, "PD_BLINK",
1536       megasas_dcmd_dummy },
1537     { MFI_DCMD_PD_UNBLINK, "PD_UNBLINK",
1538       megasas_dcmd_dummy },
1539     { MFI_DCMD_LD_GET_LIST, "LD_GET_LIST",
1540       megasas_dcmd_ld_get_list},
1541     { MFI_DCMD_LD_LIST_QUERY, "LD_LIST_QUERY",
1542       megasas_dcmd_ld_list_query },
1543     { MFI_DCMD_LD_GET_INFO, "LD_GET_INFO",
1544       megasas_dcmd_ld_get_info },
1545     { MFI_DCMD_LD_GET_PROP, "LD_GET_PROP",
1546       megasas_dcmd_dummy },
1547     { MFI_DCMD_LD_SET_PROP, "LD_SET_PROP",
1548       megasas_dcmd_dummy },
1549     { MFI_DCMD_LD_DELETE, "LD_DELETE",
1550       megasas_dcmd_dummy },
1551     { MFI_DCMD_CFG_READ, "CFG_READ",
1552       megasas_dcmd_cfg_read },
1553     { MFI_DCMD_CFG_ADD, "CFG_ADD",
1554       megasas_dcmd_dummy },
1555     { MFI_DCMD_CFG_CLEAR, "CFG_CLEAR",
1556       megasas_dcmd_dummy },
1557     { MFI_DCMD_CFG_FOREIGN_READ, "CFG_FOREIGN_READ",
1558       megasas_dcmd_dummy },
1559     { MFI_DCMD_CFG_FOREIGN_IMPORT, "CFG_FOREIGN_IMPORT",
1560       megasas_dcmd_dummy },
1561     { MFI_DCMD_BBU_STATUS, "BBU_STATUS",
1562       megasas_dcmd_dummy },
1563     { MFI_DCMD_BBU_CAPACITY_INFO, "BBU_CAPACITY_INFO",
1564       megasas_dcmd_dummy },
1565     { MFI_DCMD_BBU_DESIGN_INFO, "BBU_DESIGN_INFO",
1566       megasas_dcmd_dummy },
1567     { MFI_DCMD_BBU_PROP_GET, "BBU_PROP_GET",
1568       megasas_dcmd_dummy },
1569     { MFI_DCMD_CLUSTER, "CLUSTER",
1570       megasas_dcmd_dummy },
1571     { MFI_DCMD_CLUSTER_RESET_ALL, "CLUSTER_RESET_ALL",
1572       megasas_dcmd_dummy },
1573     { MFI_DCMD_CLUSTER_RESET_LD, "CLUSTER_RESET_LD",
1574       megasas_cluster_reset_ld },
1575     { -1, NULL, NULL }
1576 };
1577 
1578 static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)
1579 {
1580     int retval = 0;
1581     size_t len;
1582     const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;
1583 
1584     cmd->dcmd_opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1585     trace_megasas_handle_dcmd(cmd->index, cmd->dcmd_opcode);
1586     if (megasas_map_dcmd(s, cmd) < 0) {
1587         return MFI_STAT_MEMORY_NOT_AVAILABLE;
1588     }
1589     while (cmdptr->opcode != -1 && cmdptr->opcode != cmd->dcmd_opcode) {
1590         cmdptr++;
1591     }
1592     len = cmd->iov_size;
1593     if (cmdptr->opcode == -1) {
1594         trace_megasas_dcmd_unhandled(cmd->index, cmd->dcmd_opcode, len);
1595         retval = megasas_dcmd_dummy(s, cmd);
1596     } else {
1597         trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);
1598         retval = cmdptr->func(s, cmd);
1599     }
1600     if (retval != MFI_STAT_INVALID_STATUS) {
1601         megasas_finish_dcmd(cmd, len);
1602     }
1603     return retval;
1604 }
1605 
1606 static int megasas_finish_internal_dcmd(MegasasCmd *cmd,
1607                                         SCSIRequest *req, size_t resid)
1608 {
1609     int retval = MFI_STAT_OK;
1610     int lun = req->lun;
1611 
1612     trace_megasas_dcmd_internal_finish(cmd->index, cmd->dcmd_opcode, lun);
1613     cmd->iov_size -= resid;
1614     switch (cmd->dcmd_opcode) {
1615     case MFI_DCMD_PD_GET_INFO:
1616         retval = megasas_pd_get_info_submit(req->dev, lun, cmd);
1617         break;
1618     case MFI_DCMD_LD_GET_INFO:
1619         retval = megasas_ld_get_info_submit(req->dev, lun, cmd);
1620         break;
1621     default:
1622         trace_megasas_dcmd_internal_invalid(cmd->index, cmd->dcmd_opcode);
1623         retval = MFI_STAT_INVALID_DCMD;
1624         break;
1625     }
1626     if (retval != MFI_STAT_INVALID_STATUS) {
1627         megasas_finish_dcmd(cmd, cmd->iov_size);
1628     }
1629     return retval;
1630 }
1631 
1632 static int megasas_enqueue_req(MegasasCmd *cmd, bool is_write)
1633 {
1634     int len;
1635 
1636     len = scsi_req_enqueue(cmd->req);
1637     if (len < 0) {
1638         len = -len;
1639     }
1640     if (len > 0) {
1641         if (len > cmd->iov_size) {
1642             if (is_write) {
1643                 trace_megasas_iov_write_overflow(cmd->index, len,
1644                                                  cmd->iov_size);
1645             } else {
1646                 trace_megasas_iov_read_overflow(cmd->index, len,
1647                                                 cmd->iov_size);
1648             }
1649         }
1650         if (len < cmd->iov_size) {
1651             if (is_write) {
1652                 trace_megasas_iov_write_underflow(cmd->index, len,
1653                                                   cmd->iov_size);
1654             } else {
1655                 trace_megasas_iov_read_underflow(cmd->index, len,
1656                                                  cmd->iov_size);
1657             }
1658             cmd->iov_size = len;
1659         }
1660         scsi_req_continue(cmd->req);
1661     }
1662     return len;
1663 }
1664 
1665 static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
1666                                int frame_cmd)
1667 {
1668     uint8_t *cdb;
1669     int target_id, lun_id, cdb_len;
1670     bool is_write;
1671     struct SCSIDevice *sdev = NULL;
1672     bool is_logical = (frame_cmd == MFI_CMD_LD_SCSI_IO);
1673 
1674     cdb = cmd->frame->pass.cdb;
1675     target_id = cmd->frame->header.target_id;
1676     lun_id = cmd->frame->header.lun_id;
1677     cdb_len = cmd->frame->header.cdb_len;
1678 
1679     if (is_logical) {
1680         if (target_id >= MFI_MAX_LD || lun_id != 0) {
1681             trace_megasas_scsi_target_not_present(
1682                 mfi_frame_desc(frame_cmd), is_logical, target_id, lun_id);
1683             return MFI_STAT_DEVICE_NOT_FOUND;
1684         }
1685     }
1686     sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
1687 
1688     cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);
1689     trace_megasas_handle_scsi(mfi_frame_desc(frame_cmd), is_logical,
1690                               target_id, lun_id, sdev, cmd->iov_size);
1691 
1692     if (!sdev || (megasas_is_jbod(s) && is_logical)) {
1693         trace_megasas_scsi_target_not_present(
1694             mfi_frame_desc(frame_cmd), is_logical, target_id, lun_id);
1695         return MFI_STAT_DEVICE_NOT_FOUND;
1696     }
1697 
1698     if (cdb_len > 16) {
1699         trace_megasas_scsi_invalid_cdb_len(
1700                 mfi_frame_desc(frame_cmd), is_logical,
1701                 target_id, lun_id, cdb_len);
1702         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1703         cmd->frame->header.scsi_status = CHECK_CONDITION;
1704         s->event_count++;
1705         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1706     }
1707 
1708     if (megasas_map_sgl(s, cmd, &cmd->frame->pass.sgl)) {
1709         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1710         cmd->frame->header.scsi_status = CHECK_CONDITION;
1711         s->event_count++;
1712         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1713     }
1714 
1715     cmd->req = scsi_req_new(sdev, cmd->index, lun_id, cdb, cmd);
1716     if (!cmd->req) {
1717         trace_megasas_scsi_req_alloc_failed(
1718                 mfi_frame_desc(frame_cmd), target_id, lun_id);
1719         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1720         cmd->frame->header.scsi_status = BUSY;
1721         s->event_count++;
1722         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1723     }
1724 
1725     is_write = (cmd->req->cmd.mode == SCSI_XFER_TO_DEV);
1726     if (cmd->iov_size) {
1727         if (is_write) {
1728             trace_megasas_scsi_write_start(cmd->index, cmd->iov_size);
1729         } else {
1730             trace_megasas_scsi_read_start(cmd->index, cmd->iov_size);
1731         }
1732     } else {
1733         trace_megasas_scsi_nodata(cmd->index);
1734     }
1735     megasas_enqueue_req(cmd, is_write);
1736     return MFI_STAT_INVALID_STATUS;
1737 }
1738 
1739 static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd, int frame_cmd)
1740 {
1741     uint32_t lba_count, lba_start_hi, lba_start_lo;
1742     uint64_t lba_start;
1743     bool is_write = (frame_cmd == MFI_CMD_LD_WRITE);
1744     uint8_t cdb[16];
1745     int len;
1746     struct SCSIDevice *sdev = NULL;
1747     int target_id, lun_id, cdb_len;
1748 
1749     lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
1750     lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
1751     lba_start_hi = le32_to_cpu(cmd->frame->io.lba_hi);
1752     lba_start = ((uint64_t)lba_start_hi << 32) | lba_start_lo;
1753 
1754     target_id = cmd->frame->header.target_id;
1755     lun_id = cmd->frame->header.lun_id;
1756     cdb_len = cmd->frame->header.cdb_len;
1757 
1758     if (target_id < MFI_MAX_LD && lun_id == 0) {
1759         sdev = scsi_device_find(&s->bus, 0, target_id, lun_id);
1760     }
1761 
1762     trace_megasas_handle_io(cmd->index,
1763                             mfi_frame_desc(frame_cmd), target_id, lun_id,
1764                             (unsigned long)lba_start, (unsigned long)lba_count);
1765     if (!sdev) {
1766         trace_megasas_io_target_not_present(cmd->index,
1767             mfi_frame_desc(frame_cmd), target_id, lun_id);
1768         return MFI_STAT_DEVICE_NOT_FOUND;
1769     }
1770 
1771     if (cdb_len > 16) {
1772         trace_megasas_scsi_invalid_cdb_len(
1773             mfi_frame_desc(frame_cmd), 1, target_id, lun_id, cdb_len);
1774         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1775         cmd->frame->header.scsi_status = CHECK_CONDITION;
1776         s->event_count++;
1777         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1778     }
1779 
1780     cmd->iov_size = lba_count * sdev->blocksize;
1781     if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
1782         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1783         cmd->frame->header.scsi_status = CHECK_CONDITION;
1784         s->event_count++;
1785         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1786     }
1787 
1788     megasas_encode_lba(cdb, lba_start, lba_count, is_write);
1789     cmd->req = scsi_req_new(sdev, cmd->index,
1790                             lun_id, cdb, cmd);
1791     if (!cmd->req) {
1792         trace_megasas_scsi_req_alloc_failed(
1793             mfi_frame_desc(frame_cmd), target_id, lun_id);
1794         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1795         cmd->frame->header.scsi_status = BUSY;
1796         s->event_count++;
1797         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1798     }
1799     len = megasas_enqueue_req(cmd, is_write);
1800     if (len > 0) {
1801         if (is_write) {
1802             trace_megasas_io_write_start(cmd->index, lba_start, lba_count, len);
1803         } else {
1804             trace_megasas_io_read_start(cmd->index, lba_start, lba_count, len);
1805         }
1806     }
1807     return MFI_STAT_INVALID_STATUS;
1808 }
1809 
1810 static QEMUSGList *megasas_get_sg_list(SCSIRequest *req)
1811 {
1812     MegasasCmd *cmd = req->hba_private;
1813 
1814     if (cmd->dcmd_opcode != -1) {
1815         return NULL;
1816     } else {
1817         return &cmd->qsg;
1818     }
1819 }
1820 
1821 static void megasas_xfer_complete(SCSIRequest *req, uint32_t len)
1822 {
1823     MegasasCmd *cmd = req->hba_private;
1824     uint8_t *buf;
1825 
1826     trace_megasas_io_complete(cmd->index, len);
1827 
1828     if (cmd->dcmd_opcode != -1) {
1829         scsi_req_continue(req);
1830         return;
1831     }
1832 
1833     buf = scsi_req_get_buf(req);
1834     if (cmd->dcmd_opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) {
1835         struct mfi_pd_info *info = cmd->iov_buf;
1836 
1837         if (info->inquiry_data[0] == 0x7f) {
1838             memset(info->inquiry_data, 0, sizeof(info->inquiry_data));
1839             memcpy(info->inquiry_data, buf, len);
1840         } else if (info->vpd_page83[0] == 0x7f) {
1841             memset(info->vpd_page83, 0, sizeof(info->vpd_page83));
1842             memcpy(info->vpd_page83, buf, len);
1843         }
1844         scsi_req_continue(req);
1845     } else if (cmd->dcmd_opcode == MFI_DCMD_LD_GET_INFO) {
1846         struct mfi_ld_info *info = cmd->iov_buf;
1847 
1848         if (cmd->iov_buf) {
1849             memcpy(info->vpd_page83, buf, sizeof(info->vpd_page83));
1850             scsi_req_continue(req);
1851         }
1852     }
1853 }
1854 
1855 static void megasas_command_complete(SCSIRequest *req, uint32_t status,
1856                                      size_t resid)
1857 {
1858     MegasasCmd *cmd = req->hba_private;
1859     uint8_t cmd_status = MFI_STAT_OK;
1860 
1861     trace_megasas_command_complete(cmd->index, status, resid);
1862 
1863     if (req->io_canceled) {
1864         return;
1865     }
1866 
1867     if (cmd->dcmd_opcode != -1) {
1868         /*
1869          * Internal command complete
1870          */
1871         cmd_status = megasas_finish_internal_dcmd(cmd, req, resid);
1872         if (cmd_status == MFI_STAT_INVALID_STATUS) {
1873             return;
1874         }
1875     } else {
1876         req->status = status;
1877         trace_megasas_scsi_complete(cmd->index, req->status,
1878                                     cmd->iov_size, req->cmd.xfer);
1879         if (req->status != GOOD) {
1880             cmd_status = MFI_STAT_SCSI_DONE_WITH_ERROR;
1881         }
1882         if (req->status == CHECK_CONDITION) {
1883             megasas_copy_sense(cmd);
1884         }
1885 
1886         cmd->frame->header.scsi_status = req->status;
1887     }
1888     cmd->frame->header.cmd_status = cmd_status;
1889     megasas_complete_command(cmd);
1890 }
1891 
1892 static void megasas_command_cancelled(SCSIRequest *req)
1893 {
1894     MegasasCmd *cmd = req->hba_private;
1895 
1896     if (!cmd) {
1897         return;
1898     }
1899     cmd->frame->header.cmd_status = MFI_STAT_SCSI_IO_FAILED;
1900     megasas_complete_command(cmd);
1901 }
1902 
1903 static int megasas_handle_abort(MegasasState *s, MegasasCmd *cmd)
1904 {
1905     uint64_t abort_ctx = le64_to_cpu(cmd->frame->abort.abort_context);
1906     hwaddr abort_addr, addr_hi, addr_lo;
1907     MegasasCmd *abort_cmd;
1908 
1909     addr_hi = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_hi);
1910     addr_lo = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_lo);
1911     abort_addr = ((uint64_t)addr_hi << 32) | addr_lo;
1912 
1913     abort_cmd = megasas_lookup_frame(s, abort_addr);
1914     if (!abort_cmd) {
1915         trace_megasas_abort_no_cmd(cmd->index, abort_ctx);
1916         s->event_count++;
1917         return MFI_STAT_OK;
1918     }
1919     if (!megasas_use_queue64(s)) {
1920         abort_ctx &= (uint64_t)0xFFFFFFFF;
1921     }
1922     if (abort_cmd->context != abort_ctx) {
1923         trace_megasas_abort_invalid_context(cmd->index, abort_cmd->context,
1924                                             abort_cmd->index);
1925         s->event_count++;
1926         return MFI_STAT_ABORT_NOT_POSSIBLE;
1927     }
1928     trace_megasas_abort_frame(cmd->index, abort_cmd->index);
1929     megasas_abort_command(abort_cmd);
1930     if (!s->event_cmd || abort_cmd != s->event_cmd) {
1931         s->event_cmd = NULL;
1932     }
1933     s->event_count++;
1934     return MFI_STAT_OK;
1935 }
1936 
1937 static void megasas_handle_frame(MegasasState *s, uint64_t frame_addr,
1938                                  uint32_t frame_count)
1939 {
1940     uint8_t frame_status = MFI_STAT_INVALID_CMD;
1941     uint64_t frame_context;
1942     int frame_cmd;
1943     MegasasCmd *cmd;
1944 
1945     /*
1946      * Always read 64bit context, top bits will be
1947      * masked out if required in megasas_enqueue_frame()
1948      */
1949     frame_context = megasas_frame_get_context(s, frame_addr);
1950 
1951     cmd = megasas_enqueue_frame(s, frame_addr, frame_context, frame_count);
1952     if (!cmd) {
1953         /* reply queue full */
1954         trace_megasas_frame_busy(frame_addr);
1955         megasas_frame_set_scsi_status(s, frame_addr, BUSY);
1956         megasas_frame_set_cmd_status(s, frame_addr, MFI_STAT_SCSI_DONE_WITH_ERROR);
1957         megasas_complete_frame(s, frame_context);
1958         s->event_count++;
1959         return;
1960     }
1961     frame_cmd = cmd->frame->header.frame_cmd;
1962     switch (frame_cmd) {
1963     case MFI_CMD_INIT:
1964         frame_status = megasas_init_firmware(s, cmd);
1965         break;
1966     case MFI_CMD_DCMD:
1967         frame_status = megasas_handle_dcmd(s, cmd);
1968         break;
1969     case MFI_CMD_ABORT:
1970         frame_status = megasas_handle_abort(s, cmd);
1971         break;
1972     case MFI_CMD_PD_SCSI_IO:
1973     case MFI_CMD_LD_SCSI_IO:
1974         frame_status = megasas_handle_scsi(s, cmd, frame_cmd);
1975         break;
1976     case MFI_CMD_LD_READ:
1977     case MFI_CMD_LD_WRITE:
1978         frame_status = megasas_handle_io(s, cmd, frame_cmd);
1979         break;
1980     default:
1981         trace_megasas_unhandled_frame_cmd(cmd->index, frame_cmd);
1982         s->event_count++;
1983         break;
1984     }
1985     if (frame_status != MFI_STAT_INVALID_STATUS) {
1986         if (cmd->frame) {
1987             cmd->frame->header.cmd_status = frame_status;
1988         } else {
1989             megasas_frame_set_cmd_status(s, frame_addr, frame_status);
1990         }
1991         megasas_unmap_frame(s, cmd);
1992         megasas_complete_frame(s, cmd->context);
1993     }
1994 }
1995 
1996 static uint64_t megasas_mmio_read(void *opaque, hwaddr addr,
1997                                   unsigned size)
1998 {
1999     MegasasState *s = opaque;
2000     PCIDevice *pci_dev = PCI_DEVICE(s);
2001     MegasasBaseClass *base_class = MEGASAS_GET_CLASS(s);
2002     uint32_t retval = 0;
2003 
2004     switch (addr) {
2005     case MFI_IDB:
2006         retval = 0;
2007         trace_megasas_mmio_readl("MFI_IDB", retval);
2008         break;
2009     case MFI_OMSG0:
2010     case MFI_OSP0:
2011         retval = (msix_present(pci_dev) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |
2012             (s->fw_state & MFI_FWSTATE_MASK) |
2013             ((s->fw_sge & 0xff) << 16) |
2014             (s->fw_cmds & 0xFFFF);
2015         trace_megasas_mmio_readl(addr == MFI_OMSG0 ? "MFI_OMSG0" : "MFI_OSP0",
2016                                  retval);
2017         break;
2018     case MFI_OSTS:
2019         if (megasas_intr_enabled(s) && s->doorbell) {
2020             retval = base_class->osts;
2021         }
2022         trace_megasas_mmio_readl("MFI_OSTS", retval);
2023         break;
2024     case MFI_OMSK:
2025         retval = s->intr_mask;
2026         trace_megasas_mmio_readl("MFI_OMSK", retval);
2027         break;
2028     case MFI_ODCR0:
2029         retval = s->doorbell ? 1 : 0;
2030         trace_megasas_mmio_readl("MFI_ODCR0", retval);
2031         break;
2032     case MFI_DIAG:
2033         retval = s->diag;
2034         trace_megasas_mmio_readl("MFI_DIAG", retval);
2035         break;
2036     case MFI_OSP1:
2037         retval = 15;
2038         trace_megasas_mmio_readl("MFI_OSP1", retval);
2039         break;
2040     default:
2041         trace_megasas_mmio_invalid_readl(addr);
2042         break;
2043     }
2044     return retval;
2045 }
2046 
2047 static int adp_reset_seq[] = {0x00, 0x04, 0x0b, 0x02, 0x07, 0x0d};
2048 
2049 static void megasas_mmio_write(void *opaque, hwaddr addr,
2050                                uint64_t val, unsigned size)
2051 {
2052     MegasasState *s = opaque;
2053     PCIDevice *pci_dev = PCI_DEVICE(s);
2054     uint64_t frame_addr;
2055     uint32_t frame_count;
2056     int i;
2057 
2058     switch (addr) {
2059     case MFI_IDB:
2060         trace_megasas_mmio_writel("MFI_IDB", val);
2061         if (val & MFI_FWINIT_ABORT) {
2062             /* Abort all pending cmds */
2063             for (i = 0; i < s->fw_cmds; i++) {
2064                 megasas_abort_command(&s->frames[i]);
2065             }
2066         }
2067         if (val & MFI_FWINIT_READY) {
2068             /* move to FW READY */
2069             megasas_soft_reset(s);
2070         }
2071         if (val & MFI_FWINIT_MFIMODE) {
2072             /* discard MFIs */
2073         }
2074         if (val & MFI_FWINIT_STOP_ADP) {
2075             /* Terminal error, stop processing */
2076             s->fw_state = MFI_FWSTATE_FAULT;
2077         }
2078         break;
2079     case MFI_OMSK:
2080         trace_megasas_mmio_writel("MFI_OMSK", val);
2081         s->intr_mask = val;
2082         if (!megasas_intr_enabled(s) &&
2083             !msi_enabled(pci_dev) &&
2084             !msix_enabled(pci_dev)) {
2085             trace_megasas_irq_lower();
2086             pci_irq_deassert(pci_dev);
2087         }
2088         if (megasas_intr_enabled(s)) {
2089             if (msix_enabled(pci_dev)) {
2090                 trace_megasas_msix_enabled(0);
2091             } else if (msi_enabled(pci_dev)) {
2092                 trace_megasas_msi_enabled(0);
2093             } else {
2094                 trace_megasas_intr_enabled();
2095             }
2096         } else {
2097             trace_megasas_intr_disabled();
2098             megasas_soft_reset(s);
2099         }
2100         break;
2101     case MFI_ODCR0:
2102         trace_megasas_mmio_writel("MFI_ODCR0", val);
2103         s->doorbell = 0;
2104         if (megasas_intr_enabled(s)) {
2105             if (!msix_enabled(pci_dev) && !msi_enabled(pci_dev)) {
2106                 trace_megasas_irq_lower();
2107                 pci_irq_deassert(pci_dev);
2108             }
2109         }
2110         break;
2111     case MFI_IQPH:
2112         trace_megasas_mmio_writel("MFI_IQPH", val);
2113         /* Received high 32 bits of a 64 bit MFI frame address */
2114         s->frame_hi = val;
2115         break;
2116     case MFI_IQPL:
2117         trace_megasas_mmio_writel("MFI_IQPL", val);
2118         /* Received low 32 bits of a 64 bit MFI frame address */
2119         /* Fallthrough */
2120     case MFI_IQP:
2121         if (addr == MFI_IQP) {
2122             trace_megasas_mmio_writel("MFI_IQP", val);
2123             /* Received 64 bit MFI frame address */
2124             s->frame_hi = 0;
2125         }
2126         frame_addr = (val & ~0x1F);
2127         /* Add possible 64 bit offset */
2128         frame_addr |= ((uint64_t)s->frame_hi << 32);
2129         s->frame_hi = 0;
2130         frame_count = (val >> 1) & 0xF;
2131         megasas_handle_frame(s, frame_addr, frame_count);
2132         break;
2133     case MFI_SEQ:
2134         trace_megasas_mmio_writel("MFI_SEQ", val);
2135         /* Magic sequence to start ADP reset */
2136         if (adp_reset_seq[s->adp_reset++] == val) {
2137             if (s->adp_reset == 6) {
2138                 s->adp_reset = 0;
2139                 s->diag = MFI_DIAG_WRITE_ENABLE;
2140             }
2141         } else {
2142             s->adp_reset = 0;
2143             s->diag = 0;
2144         }
2145         break;
2146     case MFI_DIAG:
2147         trace_megasas_mmio_writel("MFI_DIAG", val);
2148         /* ADP reset */
2149         if ((s->diag & MFI_DIAG_WRITE_ENABLE) &&
2150             (val & MFI_DIAG_RESET_ADP)) {
2151             s->diag |= MFI_DIAG_RESET_ADP;
2152             megasas_soft_reset(s);
2153             s->adp_reset = 0;
2154             s->diag = 0;
2155         }
2156         break;
2157     default:
2158         trace_megasas_mmio_invalid_writel(addr, val);
2159         break;
2160     }
2161 }
2162 
2163 static const MemoryRegionOps megasas_mmio_ops = {
2164     .read = megasas_mmio_read,
2165     .write = megasas_mmio_write,
2166     .endianness = DEVICE_LITTLE_ENDIAN,
2167     .impl = {
2168         .min_access_size = 8,
2169         .max_access_size = 8,
2170     }
2171 };
2172 
2173 static uint64_t megasas_port_read(void *opaque, hwaddr addr,
2174                                   unsigned size)
2175 {
2176     return megasas_mmio_read(opaque, addr & 0xff, size);
2177 }
2178 
2179 static void megasas_port_write(void *opaque, hwaddr addr,
2180                                uint64_t val, unsigned size)
2181 {
2182     megasas_mmio_write(opaque, addr & 0xff, val, size);
2183 }
2184 
2185 static const MemoryRegionOps megasas_port_ops = {
2186     .read = megasas_port_read,
2187     .write = megasas_port_write,
2188     .endianness = DEVICE_LITTLE_ENDIAN,
2189     .impl = {
2190         .min_access_size = 4,
2191         .max_access_size = 4,
2192     }
2193 };
2194 
2195 static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
2196                                    unsigned size)
2197 {
2198     return 0;
2199 }
2200 
2201 static void megasas_queue_write(void *opaque, hwaddr addr,
2202                                uint64_t val, unsigned size)
2203 {
2204     return;
2205 }
2206 
2207 static const MemoryRegionOps megasas_queue_ops = {
2208     .read = megasas_queue_read,
2209     .write = megasas_queue_write,
2210     .endianness = DEVICE_LITTLE_ENDIAN,
2211     .impl = {
2212         .min_access_size = 8,
2213         .max_access_size = 8,
2214     }
2215 };
2216 
2217 static void megasas_soft_reset(MegasasState *s)
2218 {
2219     int i;
2220     MegasasCmd *cmd;
2221 
2222     trace_megasas_reset(s->fw_state);
2223     for (i = 0; i < s->fw_cmds; i++) {
2224         cmd = &s->frames[i];
2225         megasas_abort_command(cmd);
2226     }
2227     if (s->fw_state == MFI_FWSTATE_READY) {
2228         BusChild *kid;
2229 
2230         /*
2231          * The EFI firmware doesn't handle UA,
2232          * so we need to clear the Power On/Reset UA
2233          * after the initial reset.
2234          */
2235         QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
2236             SCSIDevice *sdev = SCSI_DEVICE(kid->child);
2237 
2238             sdev->unit_attention = SENSE_CODE(NO_SENSE);
2239             scsi_device_unit_attention_reported(sdev);
2240         }
2241     }
2242     megasas_reset_frames(s);
2243     s->reply_queue_len = s->fw_cmds;
2244     s->reply_queue_pa = 0;
2245     s->consumer_pa = 0;
2246     s->producer_pa = 0;
2247     s->fw_state = MFI_FWSTATE_READY;
2248     s->doorbell = 0;
2249     s->intr_mask = MEGASAS_INTR_DISABLED_MASK;
2250     s->frame_hi = 0;
2251     s->flags &= ~MEGASAS_MASK_USE_QUEUE64;
2252     s->event_count++;
2253     s->boot_event = s->event_count;
2254 }
2255 
2256 static void megasas_scsi_reset(DeviceState *dev)
2257 {
2258     MegasasState *s = MEGASAS(dev);
2259 
2260     megasas_soft_reset(s);
2261 }
2262 
2263 static const VMStateDescription vmstate_megasas_gen1 = {
2264     .name = "megasas",
2265     .version_id = 0,
2266     .minimum_version_id = 0,
2267     .fields = (VMStateField[]) {
2268         VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2269         VMSTATE_MSIX(parent_obj, MegasasState),
2270 
2271         VMSTATE_UINT32(fw_state, MegasasState),
2272         VMSTATE_UINT32(intr_mask, MegasasState),
2273         VMSTATE_UINT32(doorbell, MegasasState),
2274         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2275         VMSTATE_UINT64(consumer_pa, MegasasState),
2276         VMSTATE_UINT64(producer_pa, MegasasState),
2277         VMSTATE_END_OF_LIST()
2278     }
2279 };
2280 
2281 static const VMStateDescription vmstate_megasas_gen2 = {
2282     .name = "megasas-gen2",
2283     .version_id = 0,
2284     .minimum_version_id = 0,
2285     .minimum_version_id_old = 0,
2286     .fields      = (VMStateField[]) {
2287         VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2288         VMSTATE_MSIX(parent_obj, MegasasState),
2289 
2290         VMSTATE_UINT32(fw_state, MegasasState),
2291         VMSTATE_UINT32(intr_mask, MegasasState),
2292         VMSTATE_UINT32(doorbell, MegasasState),
2293         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2294         VMSTATE_UINT64(consumer_pa, MegasasState),
2295         VMSTATE_UINT64(producer_pa, MegasasState),
2296         VMSTATE_END_OF_LIST()
2297     }
2298 };
2299 
2300 static void megasas_scsi_uninit(PCIDevice *d)
2301 {
2302     MegasasState *s = MEGASAS(d);
2303 
2304     if (megasas_use_msix(s)) {
2305         msix_uninit(d, &s->mmio_io, &s->mmio_io);
2306     }
2307     msi_uninit(d);
2308 }
2309 
2310 static const struct SCSIBusInfo megasas_scsi_info = {
2311     .tcq = true,
2312     .max_target = MFI_MAX_LD,
2313     .max_lun = 255,
2314 
2315     .transfer_data = megasas_xfer_complete,
2316     .get_sg_list = megasas_get_sg_list,
2317     .complete = megasas_command_complete,
2318     .cancel = megasas_command_cancelled,
2319 };
2320 
2321 static void megasas_scsi_realize(PCIDevice *dev, Error **errp)
2322 {
2323     MegasasState *s = MEGASAS(dev);
2324     MegasasBaseClass *b = MEGASAS_GET_CLASS(s);
2325     uint8_t *pci_conf;
2326     int i, bar_type;
2327     Error *err = NULL;
2328     int ret;
2329 
2330     pci_conf = dev->config;
2331 
2332     /* PCI latency timer = 0 */
2333     pci_conf[PCI_LATENCY_TIMER] = 0;
2334     /* Interrupt pin 1 */
2335     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2336 
2337     if (s->msi != ON_OFF_AUTO_OFF) {
2338         ret = msi_init(dev, 0x50, 1, true, false, &err);
2339         /* Any error other than -ENOTSUP(board's MSI support is broken)
2340          * is a programming error */
2341         assert(!ret || ret == -ENOTSUP);
2342         if (ret && s->msi == ON_OFF_AUTO_ON) {
2343             /* Can't satisfy user's explicit msi=on request, fail */
2344             error_append_hint(&err, "You have to use msi=auto (default) or "
2345                     "msi=off with this machine type.\n");
2346             error_propagate(errp, err);
2347             return;
2348         } else if (ret) {
2349             /* With msi=auto, we fall back to MSI off silently */
2350             s->msi = ON_OFF_AUTO_OFF;
2351             error_free(err);
2352         }
2353     }
2354 
2355     memory_region_init_io(&s->mmio_io, OBJECT(s), &megasas_mmio_ops, s,
2356                           "megasas-mmio", 0x4000);
2357     memory_region_init_io(&s->port_io, OBJECT(s), &megasas_port_ops, s,
2358                           "megasas-io", 256);
2359     memory_region_init_io(&s->queue_io, OBJECT(s), &megasas_queue_ops, s,
2360                           "megasas-queue", 0x40000);
2361 
2362     if (megasas_use_msix(s) &&
2363         msix_init(dev, 15, &s->mmio_io, b->mmio_bar, 0x2000,
2364                   &s->mmio_io, b->mmio_bar, 0x3800, 0x68, NULL)) {
2365         /* TODO: check msix_init's error, and should fail on msix=on */
2366         s->msix = ON_OFF_AUTO_OFF;
2367     }
2368 
2369     if (pci_is_express(dev)) {
2370         pcie_endpoint_cap_init(dev, 0xa0);
2371     }
2372 
2373     bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
2374     pci_register_bar(dev, b->ioport_bar,
2375                      PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
2376     pci_register_bar(dev, b->mmio_bar, bar_type, &s->mmio_io);
2377     pci_register_bar(dev, 3, bar_type, &s->queue_io);
2378 
2379     if (megasas_use_msix(s)) {
2380         msix_vector_use(dev, 0);
2381     }
2382 
2383     s->fw_state = MFI_FWSTATE_READY;
2384     if (!s->sas_addr) {
2385         s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
2386                        IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
2387         s->sas_addr |= (pci_dev_bus_num(dev) << 16);
2388         s->sas_addr |= (PCI_SLOT(dev->devfn) << 8);
2389         s->sas_addr |= PCI_FUNC(dev->devfn);
2390     }
2391     if (!s->hba_serial) {
2392         s->hba_serial = g_strdup(MEGASAS_HBA_SERIAL);
2393     }
2394     if (s->fw_sge >= MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE) {
2395         s->fw_sge = MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE;
2396     } else if (s->fw_sge >= 128 - MFI_PASS_FRAME_SIZE) {
2397         s->fw_sge = 128 - MFI_PASS_FRAME_SIZE;
2398     } else {
2399         s->fw_sge = 64 - MFI_PASS_FRAME_SIZE;
2400     }
2401     if (s->fw_cmds > MEGASAS_MAX_FRAMES) {
2402         s->fw_cmds = MEGASAS_MAX_FRAMES;
2403     }
2404     trace_megasas_init(s->fw_sge, s->fw_cmds,
2405                        megasas_is_jbod(s) ? "jbod" : "raid");
2406 
2407     if (megasas_is_jbod(s)) {
2408         s->fw_luns = MFI_MAX_SYS_PDS;
2409     } else {
2410         s->fw_luns = MFI_MAX_LD;
2411     }
2412     s->producer_pa = 0;
2413     s->consumer_pa = 0;
2414     for (i = 0; i < s->fw_cmds; i++) {
2415         s->frames[i].index = i;
2416         s->frames[i].context = -1;
2417         s->frames[i].pa = 0;
2418         s->frames[i].state = s;
2419     }
2420 
2421     scsi_bus_new(&s->bus, sizeof(s->bus), DEVICE(dev),
2422                  &megasas_scsi_info, NULL);
2423 }
2424 
2425 static Property megasas_properties_gen1[] = {
2426     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2427                        MEGASAS_DEFAULT_SGE),
2428     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2429                        MEGASAS_DEFAULT_FRAMES),
2430     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2431     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2432     DEFINE_PROP_ON_OFF_AUTO("msi", MegasasState, msi, ON_OFF_AUTO_AUTO),
2433     DEFINE_PROP_ON_OFF_AUTO("msix", MegasasState, msix, ON_OFF_AUTO_AUTO),
2434     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2435                     MEGASAS_FLAG_USE_JBOD, false),
2436     DEFINE_PROP_END_OF_LIST(),
2437 };
2438 
2439 static Property megasas_properties_gen2[] = {
2440     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2441                        MEGASAS_DEFAULT_SGE),
2442     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2443                        MEGASAS_GEN2_DEFAULT_FRAMES),
2444     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2445     DEFINE_PROP_UINT64("sas_address", MegasasState, sas_addr, 0),
2446     DEFINE_PROP_ON_OFF_AUTO("msi", MegasasState, msi, ON_OFF_AUTO_AUTO),
2447     DEFINE_PROP_ON_OFF_AUTO("msix", MegasasState, msix, ON_OFF_AUTO_AUTO),
2448     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2449                     MEGASAS_FLAG_USE_JBOD, false),
2450     DEFINE_PROP_END_OF_LIST(),
2451 };
2452 
2453 typedef struct MegasasInfo {
2454     const char *name;
2455     const char *desc;
2456     const char *product_name;
2457     const char *product_version;
2458     uint16_t device_id;
2459     uint16_t subsystem_id;
2460     int ioport_bar;
2461     int mmio_bar;
2462     int osts;
2463     const VMStateDescription *vmsd;
2464     Property *props;
2465     InterfaceInfo *interfaces;
2466 } MegasasInfo;
2467 
2468 static struct MegasasInfo megasas_devices[] = {
2469     {
2470         .name = TYPE_MEGASAS_GEN1,
2471         .desc = "LSI MegaRAID SAS 1078",
2472         .product_name = "LSI MegaRAID SAS 8708EM2",
2473         .product_version = MEGASAS_VERSION_GEN1,
2474         .device_id = PCI_DEVICE_ID_LSI_SAS1078,
2475         .subsystem_id = 0x1013,
2476         .ioport_bar = 2,
2477         .mmio_bar = 0,
2478         .osts = MFI_1078_RM | 1,
2479         .vmsd = &vmstate_megasas_gen1,
2480         .props = megasas_properties_gen1,
2481         .interfaces = (InterfaceInfo[]) {
2482             { INTERFACE_CONVENTIONAL_PCI_DEVICE },
2483             { },
2484         },
2485     },{
2486         .name = TYPE_MEGASAS_GEN2,
2487         .desc = "LSI MegaRAID SAS 2108",
2488         .product_name = "LSI MegaRAID SAS 9260-8i",
2489         .product_version = MEGASAS_VERSION_GEN2,
2490         .device_id = PCI_DEVICE_ID_LSI_SAS0079,
2491         .subsystem_id = 0x9261,
2492         .ioport_bar = 0,
2493         .mmio_bar = 1,
2494         .osts = MFI_GEN2_RM,
2495         .vmsd = &vmstate_megasas_gen2,
2496         .props = megasas_properties_gen2,
2497         .interfaces = (InterfaceInfo[]) {
2498             { INTERFACE_PCIE_DEVICE },
2499             { }
2500         },
2501     }
2502 };
2503 
2504 static void megasas_class_init(ObjectClass *oc, void *data)
2505 {
2506     DeviceClass *dc = DEVICE_CLASS(oc);
2507     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
2508     MegasasBaseClass *e = MEGASAS_CLASS(oc);
2509     const MegasasInfo *info = data;
2510 
2511     pc->realize = megasas_scsi_realize;
2512     pc->exit = megasas_scsi_uninit;
2513     pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2514     pc->device_id = info->device_id;
2515     pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2516     pc->subsystem_id = info->subsystem_id;
2517     pc->class_id = PCI_CLASS_STORAGE_RAID;
2518     e->mmio_bar = info->mmio_bar;
2519     e->ioport_bar = info->ioport_bar;
2520     e->osts = info->osts;
2521     e->product_name = info->product_name;
2522     e->product_version = info->product_version;
2523     device_class_set_props(dc, info->props);
2524     dc->reset = megasas_scsi_reset;
2525     dc->vmsd = info->vmsd;
2526     set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2527     dc->desc = info->desc;
2528 }
2529 
2530 static const TypeInfo megasas_info = {
2531     .name  = TYPE_MEGASAS_BASE,
2532     .parent = TYPE_PCI_DEVICE,
2533     .instance_size = sizeof(MegasasState),
2534     .class_size = sizeof(MegasasBaseClass),
2535     .abstract = true,
2536 };
2537 
2538 static void megasas_register_types(void)
2539 {
2540     int i;
2541 
2542     type_register_static(&megasas_info);
2543     for (i = 0; i < ARRAY_SIZE(megasas_devices); i++) {
2544         const MegasasInfo *info = &megasas_devices[i];
2545         TypeInfo type_info = {};
2546 
2547         type_info.name = info->name;
2548         type_info.parent = TYPE_MEGASAS_BASE;
2549         type_info.class_data = (void *)info;
2550         type_info.class_init = megasas_class_init;
2551         type_info.interfaces = info->interfaces;
2552 
2553         type_register(&type_info);
2554     }
2555 }
2556 
2557 type_init(megasas_register_types)
2558