qemu/hw/scsi/megasas.c
<<
>>
Prefs
   1/*
   2 * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation
   3 * Based on the linux driver code at drivers/scsi/megaraid
   4 *
   5 * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
   6 *
   7 * This library is free software; you can redistribute it and/or
   8 * modify it under the terms of the GNU Lesser General Public
   9 * License as published by the Free Software Foundation; either
  10 * version 2 of the License, or (at your option) any later version.
  11 *
  12 * This library is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15 * Lesser General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU Lesser General Public
  18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21#include "hw/hw.h"
  22#include "hw/pci/pci.h"
  23#include "sysemu/dma.h"
  24#include "hw/pci/msix.h"
  25#include "qemu/iov.h"
  26#include "hw/scsi/scsi.h"
  27#include "block/scsi.h"
  28#include "trace.h"
  29
  30#include "mfi.h"
  31
  32#define MEGASAS_VERSION "1.70"
  33#define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */
  34#define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */
  35#define MEGASAS_MAX_SGE 128             /* Firmware limit */
  36#define MEGASAS_DEFAULT_SGE 80
  37#define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */
  38#define MEGASAS_MAX_ARRAYS 128
  39
  40#define MEGASAS_HBA_SERIAL "QEMU123456"
  41#define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
  42#define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
  43
  44#define MEGASAS_FLAG_USE_JBOD      0
  45#define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)
  46#define MEGASAS_FLAG_USE_MSIX      1
  47#define MEGASAS_MASK_USE_MSIX      (1 << MEGASAS_FLAG_USE_MSIX)
  48#define MEGASAS_FLAG_USE_QUEUE64   2
  49#define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)
  50
  51static const char *mfi_frame_desc[] = {
  52    "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",
  53    "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"};
  54
  55typedef struct MegasasCmd {
  56    uint32_t index;
  57    uint16_t flags;
  58    uint16_t count;
  59    uint64_t context;
  60
  61    hwaddr pa;
  62    hwaddr pa_size;
  63    union mfi_frame *frame;
  64    SCSIRequest *req;
  65    QEMUSGList qsg;
  66    void *iov_buf;
  67    size_t iov_size;
  68    size_t iov_offset;
  69    struct MegasasState *state;
  70} MegasasCmd;
  71
  72typedef struct MegasasState {
  73    PCIDevice dev;
  74    MemoryRegion mmio_io;
  75    MemoryRegion port_io;
  76    MemoryRegion queue_io;
  77    uint32_t frame_hi;
  78
  79    int fw_state;
  80    uint32_t fw_sge;
  81    uint32_t fw_cmds;
  82    uint32_t flags;
  83    int fw_luns;
  84    int intr_mask;
  85    int doorbell;
  86    int busy;
  87
  88    MegasasCmd *event_cmd;
  89    int event_locale;
  90    int event_class;
  91    int event_count;
  92    int shutdown_event;
  93    int boot_event;
  94
  95    uint64_t sas_addr;
  96    char *hba_serial;
  97
  98    uint64_t reply_queue_pa;
  99    void *reply_queue;
 100    int reply_queue_len;
 101    int reply_queue_head;
 102    int reply_queue_tail;
 103    uint64_t consumer_pa;
 104    uint64_t producer_pa;
 105
 106    MegasasCmd frames[MEGASAS_MAX_FRAMES];
 107
 108    SCSIBus bus;
 109} MegasasState;
 110
 111#define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
 112
 113static bool megasas_intr_enabled(MegasasState *s)
 114{
 115    if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=
 116        MEGASAS_INTR_DISABLED_MASK) {
 117        return true;
 118    }
 119    return false;
 120}
 121
 122static bool megasas_use_queue64(MegasasState *s)
 123{
 124    return s->flags & MEGASAS_MASK_USE_QUEUE64;
 125}
 126
 127static bool megasas_use_msix(MegasasState *s)
 128{
 129    return s->flags & MEGASAS_MASK_USE_MSIX;
 130}
 131
 132static bool megasas_is_jbod(MegasasState *s)
 133{
 134    return s->flags & MEGASAS_MASK_USE_JBOD;
 135}
 136
 137static void megasas_frame_set_cmd_status(unsigned long frame, uint8_t v)
 138{
 139    stb_phys(frame + offsetof(struct mfi_frame_header, cmd_status), v);
 140}
 141
 142static void megasas_frame_set_scsi_status(unsigned long frame, uint8_t v)
 143{
 144    stb_phys(frame + offsetof(struct mfi_frame_header, scsi_status), v);
 145}
 146
 147/*
 148 * Context is considered opaque, but the HBA firmware is running
 149 * in little endian mode. So convert it to little endian, too.
 150 */
 151static uint64_t megasas_frame_get_context(unsigned long frame)
 152{
 153    return ldq_le_phys(frame + offsetof(struct mfi_frame_header, context));
 154}
 155
 156static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)
 157{
 158    return cmd->flags & MFI_FRAME_IEEE_SGL;
 159}
 160
 161static bool megasas_frame_is_sgl64(MegasasCmd *cmd)
 162{
 163    return cmd->flags & MFI_FRAME_SGL64;
 164}
 165
 166static bool megasas_frame_is_sense64(MegasasCmd *cmd)
 167{
 168    return cmd->flags & MFI_FRAME_SENSE64;
 169}
 170
 171static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,
 172                                     union mfi_sgl *sgl)
 173{
 174    uint64_t addr;
 175
 176    if (megasas_frame_is_ieee_sgl(cmd)) {
 177        addr = le64_to_cpu(sgl->sg_skinny->addr);
 178    } else if (megasas_frame_is_sgl64(cmd)) {
 179        addr = le64_to_cpu(sgl->sg64->addr);
 180    } else {
 181        addr = le32_to_cpu(sgl->sg32->addr);
 182    }
 183    return addr;
 184}
 185
 186static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,
 187                                    union mfi_sgl *sgl)
 188{
 189    uint32_t len;
 190
 191    if (megasas_frame_is_ieee_sgl(cmd)) {
 192        len = le32_to_cpu(sgl->sg_skinny->len);
 193    } else if (megasas_frame_is_sgl64(cmd)) {
 194        len = le32_to_cpu(sgl->sg64->len);
 195    } else {
 196        len = le32_to_cpu(sgl->sg32->len);
 197    }
 198    return len;
 199}
 200
 201static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,
 202                                       union mfi_sgl *sgl)
 203{
 204    uint8_t *next = (uint8_t *)sgl;
 205
 206    if (megasas_frame_is_ieee_sgl(cmd)) {
 207        next += sizeof(struct mfi_sg_skinny);
 208    } else if (megasas_frame_is_sgl64(cmd)) {
 209        next += sizeof(struct mfi_sg64);
 210    } else {
 211        next += sizeof(struct mfi_sg32);
 212    }
 213
 214    if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {
 215        return NULL;
 216    }
 217    return (union mfi_sgl *)next;
 218}
 219
 220static void megasas_soft_reset(MegasasState *s);
 221
 222static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
 223{
 224    int i;
 225    int iov_count = 0;
 226    size_t iov_size = 0;
 227
 228    cmd->flags = le16_to_cpu(cmd->frame->header.flags);
 229    iov_count = cmd->frame->header.sge_count;
 230    if (iov_count > MEGASAS_MAX_SGE) {
 231        trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,
 232                                         MEGASAS_MAX_SGE);
 233        return iov_count;
 234    }
 235    qemu_sglist_init(&cmd->qsg, iov_count, pci_dma_context(&s->dev));
 236    for (i = 0; i < iov_count; i++) {
 237        dma_addr_t iov_pa, iov_size_p;
 238
 239        if (!sgl) {
 240            trace_megasas_iovec_sgl_underflow(cmd->index, i);
 241            goto unmap;
 242        }
 243        iov_pa = megasas_sgl_get_addr(cmd, sgl);
 244        iov_size_p = megasas_sgl_get_len(cmd, sgl);
 245        if (!iov_pa || !iov_size_p) {
 246            trace_megasas_iovec_sgl_invalid(cmd->index, i,
 247                                            iov_pa, iov_size_p);
 248            goto unmap;
 249        }
 250        qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);
 251        sgl = megasas_sgl_next(cmd, sgl);
 252        iov_size += (size_t)iov_size_p;
 253    }
 254    if (cmd->iov_size > iov_size) {
 255        trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
 256    } else if (cmd->iov_size < iov_size) {
 257        trace_megasas_iovec_underflow(cmd->iov_size, iov_size, cmd->iov_size);
 258    }
 259    cmd->iov_offset = 0;
 260    return 0;
 261unmap:
 262    qemu_sglist_destroy(&cmd->qsg);
 263    return iov_count - i;
 264}
 265
 266static void megasas_unmap_sgl(MegasasCmd *cmd)
 267{
 268    qemu_sglist_destroy(&cmd->qsg);
 269    cmd->iov_offset = 0;
 270}
 271
 272/*
 273 * passthrough sense and io sense are at the same offset
 274 */
 275static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,
 276    uint8_t sense_len)
 277{
 278    uint32_t pa_hi = 0, pa_lo;
 279    hwaddr pa;
 280
 281    if (sense_len > cmd->frame->header.sense_len) {
 282        sense_len = cmd->frame->header.sense_len;
 283    }
 284    if (sense_len) {
 285        pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);
 286        if (megasas_frame_is_sense64(cmd)) {
 287            pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);
 288        }
 289        pa = ((uint64_t) pa_hi << 32) | pa_lo;
 290        cpu_physical_memory_write(pa, sense_ptr, sense_len);
 291        cmd->frame->header.sense_len = sense_len;
 292    }
 293    return sense_len;
 294}
 295
 296static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)
 297{
 298    uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
 299    uint8_t sense_len = 18;
 300
 301    memset(sense_buf, 0, sense_len);
 302    sense_buf[0] = 0xf0;
 303    sense_buf[2] = sense.key;
 304    sense_buf[7] = 10;
 305    sense_buf[12] = sense.asc;
 306    sense_buf[13] = sense.ascq;
 307    megasas_build_sense(cmd, sense_buf, sense_len);
 308}
 309
 310static void megasas_copy_sense(MegasasCmd *cmd)
 311{
 312    uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
 313    uint8_t sense_len;
 314
 315    sense_len = scsi_req_get_sense(cmd->req, sense_buf,
 316                                   SCSI_SENSE_BUF_SIZE);
 317    megasas_build_sense(cmd, sense_buf, sense_len);
 318}
 319
 320/*
 321 * Format an INQUIRY CDB
 322 */
 323static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)
 324{
 325    memset(cdb, 0, 6);
 326    cdb[0] = INQUIRY;
 327    if (pg > 0) {
 328        cdb[1] = 0x1;
 329        cdb[2] = pg;
 330    }
 331    cdb[3] = (len >> 8) & 0xff;
 332    cdb[4] = (len & 0xff);
 333    return len;
 334}
 335
 336/*
 337 * Encode lba and len into a READ_16/WRITE_16 CDB
 338 */
 339static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,
 340                               uint32_t len, bool is_write)
 341{
 342    memset(cdb, 0x0, 16);
 343    if (is_write) {
 344        cdb[0] = WRITE_16;
 345    } else {
 346        cdb[0] = READ_16;
 347    }
 348    cdb[2] = (lba >> 56) & 0xff;
 349    cdb[3] = (lba >> 48) & 0xff;
 350    cdb[4] = (lba >> 40) & 0xff;
 351    cdb[5] = (lba >> 32) & 0xff;
 352    cdb[6] = (lba >> 24) & 0xff;
 353    cdb[7] = (lba >> 16) & 0xff;
 354    cdb[8] = (lba >> 8) & 0xff;
 355    cdb[9] = (lba) & 0xff;
 356    cdb[10] = (len >> 24) & 0xff;
 357    cdb[11] = (len >> 16) & 0xff;
 358    cdb[12] = (len >> 8) & 0xff;
 359    cdb[13] = (len) & 0xff;
 360}
 361
 362/*
 363 * Utility functions
 364 */
 365static uint64_t megasas_fw_time(void)
 366{
 367    struct tm curtime;
 368    uint64_t bcd_time;
 369
 370    qemu_get_timedate(&curtime, 0);
 371    bcd_time = ((uint64_t)curtime.tm_sec & 0xff) << 48 |
 372        ((uint64_t)curtime.tm_min & 0xff)  << 40 |
 373        ((uint64_t)curtime.tm_hour & 0xff) << 32 |
 374        ((uint64_t)curtime.tm_mday & 0xff) << 24 |
 375        ((uint64_t)curtime.tm_mon & 0xff)  << 16 |
 376        ((uint64_t)(curtime.tm_year + 1900) & 0xffff);
 377
 378    return bcd_time;
 379}
 380
 381/*
 382 * Default disk sata address
 383 * 0x1221 is the magic number as
 384 * present in real hardware,
 385 * so use it here, too.
 386 */
 387static uint64_t megasas_get_sata_addr(uint16_t id)
 388{
 389    uint64_t addr = (0x1221ULL << 48);
 390    return addr & (id << 24);
 391}
 392
 393/*
 394 * Frame handling
 395 */
 396static int megasas_next_index(MegasasState *s, int index, int limit)
 397{
 398    index++;
 399    if (index == limit) {
 400        index = 0;
 401    }
 402    return index;
 403}
 404
 405static MegasasCmd *megasas_lookup_frame(MegasasState *s,
 406    hwaddr frame)
 407{
 408    MegasasCmd *cmd = NULL;
 409    int num = 0, index;
 410
 411    index = s->reply_queue_head;
 412
 413    while (num < s->fw_cmds) {
 414        if (s->frames[index].pa && s->frames[index].pa == frame) {
 415            cmd = &s->frames[index];
 416            break;
 417        }
 418        index = megasas_next_index(s, index, s->fw_cmds);
 419        num++;
 420    }
 421
 422    return cmd;
 423}
 424
 425static MegasasCmd *megasas_next_frame(MegasasState *s,
 426    hwaddr frame)
 427{
 428    MegasasCmd *cmd = NULL;
 429    int num = 0, index;
 430
 431    cmd = megasas_lookup_frame(s, frame);
 432    if (cmd) {
 433        trace_megasas_qf_found(cmd->index, cmd->pa);
 434        return cmd;
 435    }
 436    index = s->reply_queue_head;
 437    num = 0;
 438    while (num < s->fw_cmds) {
 439        if (!s->frames[index].pa) {
 440            cmd = &s->frames[index];
 441            break;
 442        }
 443        index = megasas_next_index(s, index, s->fw_cmds);
 444        num++;
 445    }
 446    if (!cmd) {
 447        trace_megasas_qf_failed(frame);
 448    }
 449    trace_megasas_qf_new(index, cmd);
 450    return cmd;
 451}
 452
 453static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
 454    hwaddr frame, uint64_t context, int count)
 455{
 456    MegasasCmd *cmd = NULL;
 457    int frame_size = MFI_FRAME_SIZE * 16;
 458    hwaddr frame_size_p = frame_size;
 459
 460    cmd = megasas_next_frame(s, frame);
 461    /* All frames busy */
 462    if (!cmd) {
 463        return NULL;
 464    }
 465    if (!cmd->pa) {
 466        cmd->pa = frame;
 467        /* Map all possible frames */
 468        cmd->frame = cpu_physical_memory_map(frame, &frame_size_p, 0);
 469        if (frame_size_p != frame_size) {
 470            trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
 471            if (cmd->frame) {
 472                cpu_physical_memory_unmap(cmd->frame, frame_size_p, 0, 0);
 473                cmd->frame = NULL;
 474                cmd->pa = 0;
 475            }
 476            s->event_count++;
 477            return NULL;
 478        }
 479        cmd->pa_size = frame_size_p;
 480        cmd->context = context;
 481        if (!megasas_use_queue64(s)) {
 482            cmd->context &= (uint64_t)0xFFFFFFFF;
 483        }
 484    }
 485    cmd->count = count;
 486    s->busy++;
 487
 488    trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,
 489                             s->reply_queue_head, s->busy);
 490
 491    return cmd;
 492}
 493
 494static void megasas_complete_frame(MegasasState *s, uint64_t context)
 495{
 496    int tail, queue_offset;
 497
 498    /* Decrement busy count */
 499    s->busy--;
 500
 501    if (s->reply_queue_pa) {
 502        /*
 503         * Put command on the reply queue.
 504         * Context is opaque, but emulation is running in
 505         * little endian. So convert it.
 506         */
 507        tail = s->reply_queue_head;
 508        if (megasas_use_queue64(s)) {
 509            queue_offset = tail * sizeof(uint64_t);
 510            stq_le_phys(s->reply_queue_pa + queue_offset, context);
 511        } else {
 512            queue_offset = tail * sizeof(uint32_t);
 513            stl_le_phys(s->reply_queue_pa + queue_offset, context);
 514        }
 515        s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
 516        trace_megasas_qf_complete(context, tail, queue_offset,
 517                                  s->busy, s->doorbell);
 518    }
 519
 520    if (megasas_intr_enabled(s)) {
 521        /* Notify HBA */
 522        s->doorbell++;
 523        if (s->doorbell == 1) {
 524            if (msix_enabled(&s->dev)) {
 525                trace_megasas_msix_raise(0);
 526                msix_notify(&s->dev, 0);
 527            } else {
 528                trace_megasas_irq_raise();
 529                qemu_irq_raise(s->dev.irq[0]);
 530            }
 531        }
 532    } else {
 533        trace_megasas_qf_complete_noirq(context);
 534    }
 535}
 536
 537static void megasas_reset_frames(MegasasState *s)
 538{
 539    int i;
 540    MegasasCmd *cmd;
 541
 542    for (i = 0; i < s->fw_cmds; i++) {
 543        cmd = &s->frames[i];
 544        if (cmd->pa) {
 545            cpu_physical_memory_unmap(cmd->frame, cmd->pa_size, 0, 0);
 546            cmd->frame = NULL;
 547            cmd->pa = 0;
 548        }
 549    }
 550}
 551
 552static void megasas_abort_command(MegasasCmd *cmd)
 553{
 554    if (cmd->req) {
 555        scsi_req_cancel(cmd->req);
 556        cmd->req = NULL;
 557    }
 558}
 559
 560static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
 561{
 562    uint32_t pa_hi, pa_lo;
 563    hwaddr iq_pa, initq_size;
 564    struct mfi_init_qinfo *initq;
 565    uint32_t flags;
 566    int ret = MFI_STAT_OK;
 567
 568    pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);
 569    pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);
 570    iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);
 571    trace_megasas_init_firmware((uint64_t)iq_pa);
 572    initq_size = sizeof(*initq);
 573    initq = cpu_physical_memory_map(iq_pa, &initq_size, 0);
 574    if (!initq || initq_size != sizeof(*initq)) {
 575        trace_megasas_initq_map_failed(cmd->index);
 576        s->event_count++;
 577        ret = MFI_STAT_MEMORY_NOT_AVAILABLE;
 578        goto out;
 579    }
 580    s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;
 581    if (s->reply_queue_len > s->fw_cmds) {
 582        trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);
 583        s->event_count++;
 584        ret = MFI_STAT_INVALID_PARAMETER;
 585        goto out;
 586    }
 587    pa_lo = le32_to_cpu(initq->rq_addr_lo);
 588    pa_hi = le32_to_cpu(initq->rq_addr_hi);
 589    s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;
 590    pa_lo = le32_to_cpu(initq->ci_addr_lo);
 591    pa_hi = le32_to_cpu(initq->ci_addr_hi);
 592    s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
 593    pa_lo = le32_to_cpu(initq->pi_addr_lo);
 594    pa_hi = le32_to_cpu(initq->pi_addr_hi);
 595    s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
 596    s->reply_queue_head = ldl_le_phys(s->producer_pa);
 597    s->reply_queue_tail = ldl_le_phys(s->consumer_pa);
 598    flags = le32_to_cpu(initq->flags);
 599    if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
 600        s->flags |= MEGASAS_MASK_USE_QUEUE64;
 601    }
 602    trace_megasas_init_queue((unsigned long)s->reply_queue_pa,
 603                             s->reply_queue_len, s->reply_queue_head,
 604                             s->reply_queue_tail, flags);
 605    megasas_reset_frames(s);
 606    s->fw_state = MFI_FWSTATE_OPERATIONAL;
 607out:
 608    if (initq) {
 609        cpu_physical_memory_unmap(initq, initq_size, 0, 0);
 610    }
 611    return ret;
 612}
 613
 614static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
 615{
 616    dma_addr_t iov_pa, iov_size;
 617
 618    cmd->flags = le16_to_cpu(cmd->frame->header.flags);
 619    if (!cmd->frame->header.sge_count) {
 620        trace_megasas_dcmd_zero_sge(cmd->index);
 621        cmd->iov_size = 0;
 622        return 0;
 623    } else if (cmd->frame->header.sge_count > 1) {
 624        trace_megasas_dcmd_invalid_sge(cmd->index,
 625                                       cmd->frame->header.sge_count);
 626        cmd->iov_size = 0;
 627        return -1;
 628    }
 629    iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
 630    iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
 631    qemu_sglist_init(&cmd->qsg, 1, pci_dma_context(&s->dev));
 632    qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
 633    cmd->iov_size = iov_size;
 634    return cmd->iov_size;
 635}
 636
 637static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
 638{
 639    trace_megasas_finish_dcmd(cmd->index, iov_size);
 640
 641    if (cmd->frame->header.sge_count) {
 642        qemu_sglist_destroy(&cmd->qsg);
 643    }
 644    if (iov_size > cmd->iov_size) {
 645        if (megasas_frame_is_ieee_sgl(cmd)) {
 646            cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);
 647        } else if (megasas_frame_is_sgl64(cmd)) {
 648            cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);
 649        } else {
 650            cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);
 651        }
 652    }
 653    cmd->iov_size = 0;
 654}
 655
 656static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
 657{
 658    struct mfi_ctrl_info info;
 659    size_t dcmd_size = sizeof(info);
 660    BusChild *kid;
 661    int num_ld_disks = 0;
 662    uint16_t sdev_id;
 663
 664    memset(&info, 0x0, cmd->iov_size);
 665    if (cmd->iov_size < dcmd_size) {
 666        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 667                                            dcmd_size);
 668        return MFI_STAT_INVALID_PARAMETER;
 669    }
 670
 671    info.pci.vendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);
 672    info.pci.device = cpu_to_le16(PCI_DEVICE_ID_LSI_SAS1078);
 673    info.pci.subvendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);
 674    info.pci.subdevice = cpu_to_le16(0x1013);
 675
 676    /*
 677     * For some reason the firmware supports
 678     * only up to 8 device ports.
 679     * Despite supporting a far larger number
 680     * of devices for the physical devices.
 681     * So just display the first 8 devices
 682     * in the device port list, independent
 683     * of how many logical devices are actually
 684     * present.
 685     */
 686    info.host.type = MFI_INFO_HOST_PCIE;
 687    info.device.type = MFI_INFO_DEV_SAS3G;
 688    info.device.port_count = 8;
 689    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 690        SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
 691
 692        if (num_ld_disks < 8) {
 693            sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
 694            info.device.port_addr[num_ld_disks] =
 695                cpu_to_le64(megasas_get_sata_addr(sdev_id));
 696        }
 697        num_ld_disks++;
 698    }
 699
 700    memcpy(info.product_name, "MegaRAID SAS 8708EM2", 20);
 701    snprintf(info.serial_number, 32, "%s", s->hba_serial);
 702    snprintf(info.package_version, 0x60, "%s-QEMU", QEMU_VERSION);
 703    memcpy(info.image_component[0].name, "APP", 3);
 704    memcpy(info.image_component[0].version, MEGASAS_VERSION "-QEMU", 9);
 705    memcpy(info.image_component[0].build_date, __DATE__, 11);
 706    memcpy(info.image_component[0].build_time, __TIME__, 8);
 707    info.image_component_count = 1;
 708    if (s->dev.has_rom) {
 709        uint8_t biosver[32];
 710        uint8_t *ptr;
 711
 712        ptr = memory_region_get_ram_ptr(&s->dev.rom);
 713        memcpy(biosver, ptr + 0x41, 31);
 714        qemu_put_ram_ptr(ptr);
 715        memcpy(info.image_component[1].name, "BIOS", 4);
 716        memcpy(info.image_component[1].version, biosver,
 717               strlen((const char *)biosver));
 718        info.image_component_count++;
 719    }
 720    info.current_fw_time = cpu_to_le32(megasas_fw_time());
 721    info.max_arms = 32;
 722    info.max_spans = 8;
 723    info.max_arrays = MEGASAS_MAX_ARRAYS;
 724    info.max_lds = s->fw_luns;
 725    info.max_cmds = cpu_to_le16(s->fw_cmds);
 726    info.max_sg_elements = cpu_to_le16(s->fw_sge);
 727    info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);
 728    info.lds_present = cpu_to_le16(num_ld_disks);
 729    info.pd_present = cpu_to_le16(num_ld_disks);
 730    info.pd_disks_present = cpu_to_le16(num_ld_disks);
 731    info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |
 732                                   MFI_INFO_HW_MEM |
 733                                   MFI_INFO_HW_FLASH);
 734    info.memory_size = cpu_to_le16(512);
 735    info.nvram_size = cpu_to_le16(32);
 736    info.flash_size = cpu_to_le16(16);
 737    info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);
 738    info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |
 739                                    MFI_INFO_AOPS_SELF_DIAGNOSTIC |
 740                                    MFI_INFO_AOPS_MIXED_ARRAY);
 741    info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |
 742                               MFI_INFO_LDOPS_ACCESS_POLICY |
 743                               MFI_INFO_LDOPS_IO_POLICY |
 744                               MFI_INFO_LDOPS_WRITE_POLICY |
 745                               MFI_INFO_LDOPS_READ_POLICY);
 746    info.max_strips_per_io = cpu_to_le16(s->fw_sge);
 747    info.stripe_sz_ops.min = 3;
 748    info.stripe_sz_ops.max = ffs(MEGASAS_MAX_SECTORS + 1) - 1;
 749    info.properties.pred_fail_poll_interval = cpu_to_le16(300);
 750    info.properties.intr_throttle_cnt = cpu_to_le16(16);
 751    info.properties.intr_throttle_timeout = cpu_to_le16(50);
 752    info.properties.rebuild_rate = 30;
 753    info.properties.patrol_read_rate = 30;
 754    info.properties.bgi_rate = 30;
 755    info.properties.cc_rate = 30;
 756    info.properties.recon_rate = 30;
 757    info.properties.cache_flush_interval = 4;
 758    info.properties.spinup_drv_cnt = 2;
 759    info.properties.spinup_delay = 6;
 760    info.properties.ecc_bucket_size = 15;
 761    info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);
 762    info.properties.expose_encl_devices = 1;
 763    info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);
 764    info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |
 765                               MFI_INFO_PDOPS_FORCE_OFFLINE);
 766    info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |
 767                                       MFI_INFO_PDMIX_SATA |
 768                                       MFI_INFO_PDMIX_LD);
 769
 770    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 771    return MFI_STAT_OK;
 772}
 773
 774static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)
 775{
 776    struct mfi_defaults info;
 777    size_t dcmd_size = sizeof(struct mfi_defaults);
 778
 779    memset(&info, 0x0, dcmd_size);
 780    if (cmd->iov_size < dcmd_size) {
 781        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 782                                            dcmd_size);
 783        return MFI_STAT_INVALID_PARAMETER;
 784    }
 785
 786    info.sas_addr = cpu_to_le64(s->sas_addr);
 787    info.stripe_size = 3;
 788    info.flush_time = 4;
 789    info.background_rate = 30;
 790    info.allow_mix_in_enclosure = 1;
 791    info.allow_mix_in_ld = 1;
 792    info.direct_pd_mapping = 1;
 793    /* Enable for BIOS support */
 794    info.bios_enumerate_lds = 1;
 795    info.disable_ctrl_r = 1;
 796    info.expose_enclosure_devices = 1;
 797    info.disable_preboot_cli = 1;
 798    info.cluster_disable = 1;
 799
 800    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 801    return MFI_STAT_OK;
 802}
 803
 804static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)
 805{
 806    struct mfi_bios_data info;
 807    size_t dcmd_size = sizeof(info);
 808
 809    memset(&info, 0x0, dcmd_size);
 810    if (cmd->iov_size < dcmd_size) {
 811        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 812                                            dcmd_size);
 813        return MFI_STAT_INVALID_PARAMETER;
 814    }
 815    info.continue_on_error = 1;
 816    info.verbose = 1;
 817    if (megasas_is_jbod(s)) {
 818        info.expose_all_drives = 1;
 819    }
 820
 821    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 822    return MFI_STAT_OK;
 823}
 824
 825static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)
 826{
 827    uint64_t fw_time;
 828    size_t dcmd_size = sizeof(fw_time);
 829
 830    fw_time = cpu_to_le64(megasas_fw_time());
 831
 832    cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);
 833    return MFI_STAT_OK;
 834}
 835
 836static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)
 837{
 838    uint64_t fw_time;
 839
 840    /* This is a dummy; setting of firmware time is not allowed */
 841    memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));
 842
 843    trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);
 844    fw_time = cpu_to_le64(megasas_fw_time());
 845    return MFI_STAT_OK;
 846}
 847
 848static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)
 849{
 850    struct mfi_evt_log_state info;
 851    size_t dcmd_size = sizeof(info);
 852
 853    memset(&info, 0, dcmd_size);
 854
 855    info.newest_seq_num = cpu_to_le32(s->event_count);
 856    info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
 857    info.boot_seq_num = cpu_to_le32(s->boot_event);
 858
 859    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 860    return MFI_STAT_OK;
 861}
 862
 863static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
 864{
 865    union mfi_evt event;
 866
 867    if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {
 868        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 869                                            sizeof(struct mfi_evt_detail));
 870        return MFI_STAT_INVALID_PARAMETER;
 871    }
 872    s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);
 873    event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);
 874    s->event_locale = event.members.locale;
 875    s->event_class = event.members.class;
 876    s->event_cmd = cmd;
 877    /* Decrease busy count; event frame doesn't count here */
 878    s->busy--;
 879    cmd->iov_size = sizeof(struct mfi_evt_detail);
 880    return MFI_STAT_INVALID_STATUS;
 881}
 882
 883static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
 884{
 885    struct mfi_pd_list info;
 886    size_t dcmd_size = sizeof(info);
 887    BusChild *kid;
 888    uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
 889    uint16_t sdev_id;
 890
 891    memset(&info, 0, dcmd_size);
 892    offset = 8;
 893    dcmd_limit = offset + sizeof(struct mfi_pd_address);
 894    if (cmd->iov_size < dcmd_limit) {
 895        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 896                                            dcmd_limit);
 897        return MFI_STAT_INVALID_PARAMETER;
 898    }
 899
 900    max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);
 901    if (max_pd_disks > s->fw_luns) {
 902        max_pd_disks = s->fw_luns;
 903    }
 904
 905    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 906        SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
 907
 908        sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
 909        info.addr[num_pd_disks].device_id = cpu_to_le16(sdev_id);
 910        info.addr[num_pd_disks].encl_device_id = 0xFFFF;
 911        info.addr[num_pd_disks].encl_index = 0;
 912        info.addr[num_pd_disks].slot_number = (sdev->id & 0xFF);
 913        info.addr[num_pd_disks].scsi_dev_type = sdev->type;
 914        info.addr[num_pd_disks].connect_port_bitmap = 0x1;
 915        info.addr[num_pd_disks].sas_addr[0] =
 916            cpu_to_le64(megasas_get_sata_addr(sdev_id));
 917        num_pd_disks++;
 918        offset += sizeof(struct mfi_pd_address);
 919    }
 920    trace_megasas_dcmd_pd_get_list(cmd->index, num_pd_disks,
 921                                   max_pd_disks, offset);
 922
 923    info.size = cpu_to_le32(offset);
 924    info.count = cpu_to_le32(num_pd_disks);
 925
 926    cmd->iov_size -= dma_buf_read((uint8_t *)&info, offset, &cmd->qsg);
 927    return MFI_STAT_OK;
 928}
 929
 930static int megasas_dcmd_pd_list_query(MegasasState *s, MegasasCmd *cmd)
 931{
 932    uint16_t flags;
 933
 934    /* mbox0 contains flags */
 935    flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
 936    trace_megasas_dcmd_pd_list_query(cmd->index, flags);
 937    if (flags == MR_PD_QUERY_TYPE_ALL ||
 938        megasas_is_jbod(s)) {
 939        return megasas_dcmd_pd_get_list(s, cmd);
 940    }
 941
 942    return MFI_STAT_OK;
 943}
 944
 945static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun,
 946                                      MegasasCmd *cmd)
 947{
 948    struct mfi_pd_info *info = cmd->iov_buf;
 949    size_t dcmd_size = sizeof(struct mfi_pd_info);
 950    BlockConf *conf = &sdev->conf;
 951    uint64_t pd_size;
 952    uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (lun & 0xFF);
 953    uint8_t cmdbuf[6];
 954    SCSIRequest *req;
 955    size_t len, resid;
 956
 957    if (!cmd->iov_buf) {
 958        cmd->iov_buf = g_malloc(dcmd_size);
 959        memset(cmd->iov_buf, 0, dcmd_size);
 960        info = cmd->iov_buf;
 961        info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */
 962        info->vpd_page83[0] = 0x7f;
 963        megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data));
 964        req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
 965        if (!req) {
 966            trace_megasas_dcmd_req_alloc_failed(cmd->index,
 967                                                "PD get info std inquiry");
 968            g_free(cmd->iov_buf);
 969            cmd->iov_buf = NULL;
 970            return MFI_STAT_FLASH_ALLOC_FAIL;
 971        }
 972        trace_megasas_dcmd_internal_submit(cmd->index,
 973                                           "PD get info std inquiry", lun);
 974        len = scsi_req_enqueue(req);
 975        if (len > 0) {
 976            cmd->iov_size = len;
 977            scsi_req_continue(req);
 978        }
 979        return MFI_STAT_INVALID_STATUS;
 980    } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) {
 981        megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83));
 982        req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
 983        if (!req) {
 984            trace_megasas_dcmd_req_alloc_failed(cmd->index,
 985                                                "PD get info vpd inquiry");
 986            return MFI_STAT_FLASH_ALLOC_FAIL;
 987        }
 988        trace_megasas_dcmd_internal_submit(cmd->index,
 989                                           "PD get info vpd inquiry", lun);
 990        len = scsi_req_enqueue(req);
 991        if (len > 0) {
 992            cmd->iov_size = len;
 993            scsi_req_continue(req);
 994        }
 995        return MFI_STAT_INVALID_STATUS;
 996    }
 997    /* Finished, set FW state */
 998    if ((info->inquiry_data[0] >> 5) == 0) {
 999        if (megasas_is_jbod(cmd->state)) {
1000            info->fw_state = cpu_to_le16(MFI_PD_STATE_SYSTEM);
1001        } else {
1002            info->fw_state = cpu_to_le16(MFI_PD_STATE_ONLINE);
1003        }
1004    } else {
1005        info->fw_state = cpu_to_le16(MFI_PD_STATE_OFFLINE);
1006    }
1007
1008    info->ref.v.device_id = cpu_to_le16(sdev_id);
1009    info->state.ddf.pd_type = cpu_to_le16(MFI_PD_DDF_TYPE_IN_VD|
1010                                          MFI_PD_DDF_TYPE_INTF_SAS);
1011    bdrv_get_geometry(conf->bs, &pd_size);
1012    info->raw_size = cpu_to_le64(pd_size);
1013    info->non_coerced_size = cpu_to_le64(pd_size);
1014    info->coerced_size = cpu_to_le64(pd_size);
1015    info->encl_device_id = 0xFFFF;
1016    info->slot_number = (sdev->id & 0xFF);
1017    info->path_info.count = 1;
1018    info->path_info.sas_addr[0] =
1019        cpu_to_le64(megasas_get_sata_addr(sdev_id));
1020    info->connected_port_bitmap = 0x1;
1021    info->device_speed = 1;
1022    info->link_speed = 1;
1023    resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1024    g_free(cmd->iov_buf);
1025    cmd->iov_size = dcmd_size - resid;
1026    cmd->iov_buf = NULL;
1027    return MFI_STAT_OK;
1028}
1029
1030static int megasas_dcmd_pd_get_info(MegasasState *s, MegasasCmd *cmd)
1031{
1032    size_t dcmd_size = sizeof(struct mfi_pd_info);
1033    uint16_t pd_id;
1034    SCSIDevice *sdev = NULL;
1035    int retval = MFI_STAT_DEVICE_NOT_FOUND;
1036
1037    if (cmd->iov_size < dcmd_size) {
1038        return MFI_STAT_INVALID_PARAMETER;
1039    }
1040
1041    /* mbox0 has the ID */
1042    pd_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1043    sdev = scsi_device_find(&s->bus, 0, pd_id, 0);
1044    trace_megasas_dcmd_pd_get_info(cmd->index, pd_id);
1045
1046    if (sdev) {
1047        /* Submit inquiry */
1048        retval = megasas_pd_get_info_submit(sdev, pd_id, cmd);
1049    }
1050
1051    return retval;
1052}
1053
1054static int megasas_dcmd_ld_get_list(MegasasState *s, MegasasCmd *cmd)
1055{
1056    struct mfi_ld_list info;
1057    size_t dcmd_size = sizeof(info), resid;
1058    uint32_t num_ld_disks = 0, max_ld_disks = s->fw_luns;
1059    uint64_t ld_size;
1060    BusChild *kid;
1061
1062    memset(&info, 0, dcmd_size);
1063    if (cmd->iov_size < dcmd_size) {
1064        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1065                                            dcmd_size);
1066        return MFI_STAT_INVALID_PARAMETER;
1067    }
1068
1069    if (megasas_is_jbod(s)) {
1070        max_ld_disks = 0;
1071    }
1072    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1073        SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1074        BlockConf *conf = &sdev->conf;
1075
1076        if (num_ld_disks >= max_ld_disks) {
1077            break;
1078        }
1079        /* Logical device size is in blocks */
1080        bdrv_get_geometry(conf->bs, &ld_size);
1081        info.ld_list[num_ld_disks].ld.v.target_id = sdev->id;
1082        info.ld_list[num_ld_disks].ld.v.lun_id = sdev->lun;
1083        info.ld_list[num_ld_disks].state = MFI_LD_STATE_OPTIMAL;
1084        info.ld_list[num_ld_disks].size = cpu_to_le64(ld_size);
1085        num_ld_disks++;
1086    }
1087    info.ld_count = cpu_to_le32(num_ld_disks);
1088    trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1089
1090    resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1091    cmd->iov_size = dcmd_size - resid;
1092    return MFI_STAT_OK;
1093}
1094
1095static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun,
1096                                      MegasasCmd *cmd)
1097{
1098    struct mfi_ld_info *info = cmd->iov_buf;
1099    size_t dcmd_size = sizeof(struct mfi_ld_info);
1100    uint8_t cdb[6];
1101    SCSIRequest *req;
1102    ssize_t len, resid;
1103    BlockConf *conf = &sdev->conf;
1104    uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (lun & 0xFF);
1105    uint64_t ld_size;
1106
1107    if (!cmd->iov_buf) {
1108        cmd->iov_buf = g_malloc(dcmd_size);
1109        memset(cmd->iov_buf, 0x0, dcmd_size);
1110        info = cmd->iov_buf;
1111        megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83));
1112        req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd);
1113        if (!req) {
1114            trace_megasas_dcmd_req_alloc_failed(cmd->index,
1115                                                "LD get info vpd inquiry");
1116            g_free(cmd->iov_buf);
1117            cmd->iov_buf = NULL;
1118            return MFI_STAT_FLASH_ALLOC_FAIL;
1119        }
1120        trace_megasas_dcmd_internal_submit(cmd->index,
1121                                           "LD get info vpd inquiry", lun);
1122        len = scsi_req_enqueue(req);
1123        if (len > 0) {
1124            cmd->iov_size = len;
1125            scsi_req_continue(req);
1126        }
1127        return MFI_STAT_INVALID_STATUS;
1128    }
1129
1130    info->ld_config.params.state = MFI_LD_STATE_OPTIMAL;
1131    info->ld_config.properties.ld.v.target_id = lun;
1132    info->ld_config.params.stripe_size = 3;
1133    info->ld_config.params.num_drives = 1;
1134    info->ld_config.params.is_consistent = 1;
1135    /* Logical device size is in blocks */
1136    bdrv_get_geometry(conf->bs, &ld_size);
1137    info->size = cpu_to_le64(ld_size);
1138    memset(info->ld_config.span, 0, sizeof(info->ld_config.span));
1139    info->ld_config.span[0].start_block = 0;
1140    info->ld_config.span[0].num_blocks = info->size;
1141    info->ld_config.span[0].array_ref = cpu_to_le16(sdev_id);
1142
1143    resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1144    g_free(cmd->iov_buf);
1145    cmd->iov_size = dcmd_size - resid;
1146    cmd->iov_buf = NULL;
1147    return MFI_STAT_OK;
1148}
1149
1150static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
1151{
1152    struct mfi_ld_info info;
1153    size_t dcmd_size = sizeof(info);
1154    uint16_t ld_id;
1155    uint32_t max_ld_disks = s->fw_luns;
1156    SCSIDevice *sdev = NULL;
1157    int retval = MFI_STAT_DEVICE_NOT_FOUND;
1158
1159    if (cmd->iov_size < dcmd_size) {
1160        return MFI_STAT_INVALID_PARAMETER;
1161    }
1162
1163    /* mbox0 has the ID */
1164    ld_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1165    trace_megasas_dcmd_ld_get_info(cmd->index, ld_id);
1166
1167    if (megasas_is_jbod(s)) {
1168        return MFI_STAT_DEVICE_NOT_FOUND;
1169    }
1170
1171    if (ld_id < max_ld_disks) {
1172        sdev = scsi_device_find(&s->bus, 0, ld_id, 0);
1173    }
1174
1175    if (sdev) {
1176        retval = megasas_ld_get_info_submit(sdev, ld_id, cmd);
1177    }
1178
1179    return retval;
1180}
1181
1182static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
1183{
1184    uint8_t data[4096];
1185    struct mfi_config_data *info;
1186    int num_pd_disks = 0, array_offset, ld_offset;
1187    BusChild *kid;
1188
1189    if (cmd->iov_size > 4096) {
1190        return MFI_STAT_INVALID_PARAMETER;
1191    }
1192
1193    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1194        num_pd_disks++;
1195    }
1196    info = (struct mfi_config_data *)&data;
1197    /*
1198     * Array mapping:
1199     * - One array per SCSI device
1200     * - One logical drive per SCSI device
1201     *   spanning the entire device
1202     */
1203    info->array_count = num_pd_disks;
1204    info->array_size = sizeof(struct mfi_array) * num_pd_disks;
1205    info->log_drv_count = num_pd_disks;
1206    info->log_drv_size = sizeof(struct mfi_ld_config) * num_pd_disks;
1207    info->spares_count = 0;
1208    info->spares_size = sizeof(struct mfi_spare);
1209    info->size = sizeof(struct mfi_config_data) + info->array_size +
1210        info->log_drv_size;
1211    if (info->size > 4096) {
1212        return MFI_STAT_INVALID_PARAMETER;
1213    }
1214
1215    array_offset = sizeof(struct mfi_config_data);
1216    ld_offset = array_offset + sizeof(struct mfi_array) * num_pd_disks;
1217
1218    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1219        SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1220        BlockConf *conf = &sdev->conf;
1221        uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
1222        struct mfi_array *array;
1223        struct mfi_ld_config *ld;
1224        uint64_t pd_size;
1225        int i;
1226
1227        array = (struct mfi_array *)(data + array_offset);
1228        bdrv_get_geometry(conf->bs, &pd_size);
1229        array->size = cpu_to_le64(pd_size);
1230        array->num_drives = 1;
1231        array->array_ref = cpu_to_le16(sdev_id);
1232        array->pd[0].ref.v.device_id = cpu_to_le16(sdev_id);
1233        array->pd[0].ref.v.seq_num = 0;
1234        array->pd[0].fw_state = MFI_PD_STATE_ONLINE;
1235        array->pd[0].encl.pd = 0xFF;
1236        array->pd[0].encl.slot = (sdev->id & 0xFF);
1237        for (i = 1; i < MFI_MAX_ROW_SIZE; i++) {
1238            array->pd[i].ref.v.device_id = 0xFFFF;
1239            array->pd[i].ref.v.seq_num = 0;
1240            array->pd[i].fw_state = MFI_PD_STATE_UNCONFIGURED_GOOD;
1241            array->pd[i].encl.pd = 0xFF;
1242            array->pd[i].encl.slot = 0xFF;
1243        }
1244        array_offset += sizeof(struct mfi_array);
1245        ld = (struct mfi_ld_config *)(data + ld_offset);
1246        memset(ld, 0, sizeof(struct mfi_ld_config));
1247        ld->properties.ld.v.target_id = (sdev->id & 0xFF);
1248        ld->properties.default_cache_policy = MR_LD_CACHE_READ_AHEAD |
1249            MR_LD_CACHE_READ_ADAPTIVE;
1250        ld->properties.current_cache_policy = MR_LD_CACHE_READ_AHEAD |
1251            MR_LD_CACHE_READ_ADAPTIVE;
1252        ld->params.state = MFI_LD_STATE_OPTIMAL;
1253        ld->params.stripe_size = 3;
1254        ld->params.num_drives = 1;
1255        ld->params.span_depth = 1;
1256        ld->params.is_consistent = 1;
1257        ld->span[0].start_block = 0;
1258        ld->span[0].num_blocks = cpu_to_le64(pd_size);
1259        ld->span[0].array_ref = cpu_to_le16(sdev_id);
1260        ld_offset += sizeof(struct mfi_ld_config);
1261    }
1262
1263    cmd->iov_size -= dma_buf_read((uint8_t *)data, info->size, &cmd->qsg);
1264    return MFI_STAT_OK;
1265}
1266
1267static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
1268{
1269    struct mfi_ctrl_props info;
1270    size_t dcmd_size = sizeof(info);
1271
1272    memset(&info, 0x0, dcmd_size);
1273    if (cmd->iov_size < dcmd_size) {
1274        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1275                                            dcmd_size);
1276        return MFI_STAT_INVALID_PARAMETER;
1277    }
1278    info.pred_fail_poll_interval = cpu_to_le16(300);
1279    info.intr_throttle_cnt = cpu_to_le16(16);
1280    info.intr_throttle_timeout = cpu_to_le16(50);
1281    info.rebuild_rate = 30;
1282    info.patrol_read_rate = 30;
1283    info.bgi_rate = 30;
1284    info.cc_rate = 30;
1285    info.recon_rate = 30;
1286    info.cache_flush_interval = 4;
1287    info.spinup_drv_cnt = 2;
1288    info.spinup_delay = 6;
1289    info.ecc_bucket_size = 15;
1290    info.ecc_bucket_leak_rate = cpu_to_le16(1440);
1291    info.expose_encl_devices = 1;
1292
1293    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1294    return MFI_STAT_OK;
1295}
1296
1297static int megasas_cache_flush(MegasasState *s, MegasasCmd *cmd)
1298{
1299    bdrv_drain_all();
1300    return MFI_STAT_OK;
1301}
1302
1303static int megasas_ctrl_shutdown(MegasasState *s, MegasasCmd *cmd)
1304{
1305    s->fw_state = MFI_FWSTATE_READY;
1306    return MFI_STAT_OK;
1307}
1308
1309static int megasas_cluster_reset_ld(MegasasState *s, MegasasCmd *cmd)
1310{
1311    return MFI_STAT_INVALID_DCMD;
1312}
1313
1314static int megasas_dcmd_set_properties(MegasasState *s, MegasasCmd *cmd)
1315{
1316    struct mfi_ctrl_props info;
1317    size_t dcmd_size = sizeof(info);
1318
1319    if (cmd->iov_size < dcmd_size) {
1320        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1321                                            dcmd_size);
1322        return MFI_STAT_INVALID_PARAMETER;
1323    }
1324    dma_buf_write((uint8_t *)&info, cmd->iov_size, &cmd->qsg);
1325    trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
1326    return MFI_STAT_OK;
1327}
1328
1329static int megasas_dcmd_dummy(MegasasState *s, MegasasCmd *cmd)
1330{
1331    trace_megasas_dcmd_dummy(cmd->index, cmd->iov_size);
1332    return MFI_STAT_OK;
1333}
1334
1335static const struct dcmd_cmd_tbl_t {
1336    int opcode;
1337    const char *desc;
1338    int (*func)(MegasasState *s, MegasasCmd *cmd);
1339} dcmd_cmd_tbl[] = {
1340    { MFI_DCMD_CTRL_MFI_HOST_MEM_ALLOC, "CTRL_HOST_MEM_ALLOC",
1341      megasas_dcmd_dummy },
1342    { MFI_DCMD_CTRL_GET_INFO, "CTRL_GET_INFO",
1343      megasas_ctrl_get_info },
1344    { MFI_DCMD_CTRL_GET_PROPERTIES, "CTRL_GET_PROPERTIES",
1345      megasas_dcmd_get_properties },
1346    { MFI_DCMD_CTRL_SET_PROPERTIES, "CTRL_SET_PROPERTIES",
1347      megasas_dcmd_set_properties },
1348    { MFI_DCMD_CTRL_ALARM_GET, "CTRL_ALARM_GET",
1349      megasas_dcmd_dummy },
1350    { MFI_DCMD_CTRL_ALARM_ENABLE, "CTRL_ALARM_ENABLE",
1351      megasas_dcmd_dummy },
1352    { MFI_DCMD_CTRL_ALARM_DISABLE, "CTRL_ALARM_DISABLE",
1353      megasas_dcmd_dummy },
1354    { MFI_DCMD_CTRL_ALARM_SILENCE, "CTRL_ALARM_SILENCE",
1355      megasas_dcmd_dummy },
1356    { MFI_DCMD_CTRL_ALARM_TEST, "CTRL_ALARM_TEST",
1357      megasas_dcmd_dummy },
1358    { MFI_DCMD_CTRL_EVENT_GETINFO, "CTRL_EVENT_GETINFO",
1359      megasas_event_info },
1360    { MFI_DCMD_CTRL_EVENT_GET, "CTRL_EVENT_GET",
1361      megasas_dcmd_dummy },
1362    { MFI_DCMD_CTRL_EVENT_WAIT, "CTRL_EVENT_WAIT",
1363      megasas_event_wait },
1364    { MFI_DCMD_CTRL_SHUTDOWN, "CTRL_SHUTDOWN",
1365      megasas_ctrl_shutdown },
1366    { MFI_DCMD_HIBERNATE_STANDBY, "CTRL_STANDBY",
1367      megasas_dcmd_dummy },
1368    { MFI_DCMD_CTRL_GET_TIME, "CTRL_GET_TIME",
1369      megasas_dcmd_get_fw_time },
1370    { MFI_DCMD_CTRL_SET_TIME, "CTRL_SET_TIME",
1371      megasas_dcmd_set_fw_time },
1372    { MFI_DCMD_CTRL_BIOS_DATA_GET, "CTRL_BIOS_DATA_GET",
1373      megasas_dcmd_get_bios_info },
1374    { MFI_DCMD_CTRL_FACTORY_DEFAULTS, "CTRL_FACTORY_DEFAULTS",
1375      megasas_dcmd_dummy },
1376    { MFI_DCMD_CTRL_MFC_DEFAULTS_GET, "CTRL_MFC_DEFAULTS_GET",
1377      megasas_mfc_get_defaults },
1378    { MFI_DCMD_CTRL_MFC_DEFAULTS_SET, "CTRL_MFC_DEFAULTS_SET",
1379      megasas_dcmd_dummy },
1380    { MFI_DCMD_CTRL_CACHE_FLUSH, "CTRL_CACHE_FLUSH",
1381      megasas_cache_flush },
1382    { MFI_DCMD_PD_GET_LIST, "PD_GET_LIST",
1383      megasas_dcmd_pd_get_list },
1384    { MFI_DCMD_PD_LIST_QUERY, "PD_LIST_QUERY",
1385      megasas_dcmd_pd_list_query },
1386    { MFI_DCMD_PD_GET_INFO, "PD_GET_INFO",
1387      megasas_dcmd_pd_get_info },
1388    { MFI_DCMD_PD_STATE_SET, "PD_STATE_SET",
1389      megasas_dcmd_dummy },
1390    { MFI_DCMD_PD_REBUILD, "PD_REBUILD",
1391      megasas_dcmd_dummy },
1392    { MFI_DCMD_PD_BLINK, "PD_BLINK",
1393      megasas_dcmd_dummy },
1394    { MFI_DCMD_PD_UNBLINK, "PD_UNBLINK",
1395      megasas_dcmd_dummy },
1396    { MFI_DCMD_LD_GET_LIST, "LD_GET_LIST",
1397      megasas_dcmd_ld_get_list},
1398    { MFI_DCMD_LD_GET_INFO, "LD_GET_INFO",
1399      megasas_dcmd_ld_get_info },
1400    { MFI_DCMD_LD_GET_PROP, "LD_GET_PROP",
1401      megasas_dcmd_dummy },
1402    { MFI_DCMD_LD_SET_PROP, "LD_SET_PROP",
1403      megasas_dcmd_dummy },
1404    { MFI_DCMD_LD_DELETE, "LD_DELETE",
1405      megasas_dcmd_dummy },
1406    { MFI_DCMD_CFG_READ, "CFG_READ",
1407      megasas_dcmd_cfg_read },
1408    { MFI_DCMD_CFG_ADD, "CFG_ADD",
1409      megasas_dcmd_dummy },
1410    { MFI_DCMD_CFG_CLEAR, "CFG_CLEAR",
1411      megasas_dcmd_dummy },
1412    { MFI_DCMD_CFG_FOREIGN_READ, "CFG_FOREIGN_READ",
1413      megasas_dcmd_dummy },
1414    { MFI_DCMD_CFG_FOREIGN_IMPORT, "CFG_FOREIGN_IMPORT",
1415      megasas_dcmd_dummy },
1416    { MFI_DCMD_BBU_STATUS, "BBU_STATUS",
1417      megasas_dcmd_dummy },
1418    { MFI_DCMD_BBU_CAPACITY_INFO, "BBU_CAPACITY_INFO",
1419      megasas_dcmd_dummy },
1420    { MFI_DCMD_BBU_DESIGN_INFO, "BBU_DESIGN_INFO",
1421      megasas_dcmd_dummy },
1422    { MFI_DCMD_BBU_PROP_GET, "BBU_PROP_GET",
1423      megasas_dcmd_dummy },
1424    { MFI_DCMD_CLUSTER, "CLUSTER",
1425      megasas_dcmd_dummy },
1426    { MFI_DCMD_CLUSTER_RESET_ALL, "CLUSTER_RESET_ALL",
1427      megasas_dcmd_dummy },
1428    { MFI_DCMD_CLUSTER_RESET_LD, "CLUSTER_RESET_LD",
1429      megasas_cluster_reset_ld },
1430    { -1, NULL, NULL }
1431};
1432
1433static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)
1434{
1435    int opcode, len;
1436    int retval = 0;
1437    const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;
1438
1439    opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1440    trace_megasas_handle_dcmd(cmd->index, opcode);
1441    len = megasas_map_dcmd(s, cmd);
1442    if (len < 0) {
1443        return MFI_STAT_MEMORY_NOT_AVAILABLE;
1444    }
1445    while (cmdptr->opcode != -1 && cmdptr->opcode != opcode) {
1446        cmdptr++;
1447    }
1448    if (cmdptr->opcode == -1) {
1449        trace_megasas_dcmd_unhandled(cmd->index, opcode, len);
1450        retval = megasas_dcmd_dummy(s, cmd);
1451    } else {
1452        trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);
1453        retval = cmdptr->func(s, cmd);
1454    }
1455    if (retval != MFI_STAT_INVALID_STATUS) {
1456        megasas_finish_dcmd(cmd, len);
1457    }
1458    return retval;
1459}
1460
1461static int megasas_finish_internal_dcmd(MegasasCmd *cmd,
1462                                        SCSIRequest *req)
1463{
1464    int opcode;
1465    int retval = MFI_STAT_OK;
1466    int lun = req->lun;
1467
1468    opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1469    scsi_req_unref(req);
1470    trace_megasas_dcmd_internal_finish(cmd->index, opcode, lun);
1471    switch (opcode) {
1472    case MFI_DCMD_PD_GET_INFO:
1473        retval = megasas_pd_get_info_submit(req->dev, lun, cmd);
1474        break;
1475    case MFI_DCMD_LD_GET_INFO:
1476        retval = megasas_ld_get_info_submit(req->dev, lun, cmd);
1477        break;
1478    default:
1479        trace_megasas_dcmd_internal_invalid(cmd->index, opcode);
1480        retval = MFI_STAT_INVALID_DCMD;
1481        break;
1482    }
1483    if (retval != MFI_STAT_INVALID_STATUS) {
1484        megasas_finish_dcmd(cmd, cmd->iov_size);
1485    }
1486    return retval;
1487}
1488
1489static int megasas_enqueue_req(MegasasCmd *cmd, bool is_write)
1490{
1491    int len;
1492
1493    len = scsi_req_enqueue(cmd->req);
1494    if (len < 0) {
1495        len = -len;
1496    }
1497    if (len > 0) {
1498        if (len > cmd->iov_size) {
1499            if (is_write) {
1500                trace_megasas_iov_write_overflow(cmd->index, len,
1501                                                 cmd->iov_size);
1502            } else {
1503                trace_megasas_iov_read_overflow(cmd->index, len,
1504                                                cmd->iov_size);
1505            }
1506        }
1507        if (len < cmd->iov_size) {
1508            if (is_write) {
1509                trace_megasas_iov_write_underflow(cmd->index, len,
1510                                                  cmd->iov_size);
1511            } else {
1512                trace_megasas_iov_read_underflow(cmd->index, len,
1513                                                 cmd->iov_size);
1514            }
1515            cmd->iov_size = len;
1516        }
1517        scsi_req_continue(cmd->req);
1518    }
1519    return len;
1520}
1521
1522static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
1523                               bool is_logical)
1524{
1525    uint8_t *cdb;
1526    int len;
1527    bool is_write;
1528    struct SCSIDevice *sdev = NULL;
1529
1530    cdb = cmd->frame->pass.cdb;
1531
1532    if (cmd->frame->header.target_id < s->fw_luns) {
1533        sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1534                                cmd->frame->header.lun_id);
1535    }
1536    cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);
1537    trace_megasas_handle_scsi(mfi_frame_desc[cmd->frame->header.frame_cmd],
1538                              is_logical, cmd->frame->header.target_id,
1539                              cmd->frame->header.lun_id, sdev, cmd->iov_size);
1540
1541    if (!sdev || (megasas_is_jbod(s) && is_logical)) {
1542        trace_megasas_scsi_target_not_present(
1543            mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1544            cmd->frame->header.target_id, cmd->frame->header.lun_id);
1545        return MFI_STAT_DEVICE_NOT_FOUND;
1546    }
1547
1548    if (cmd->frame->header.cdb_len > 16) {
1549        trace_megasas_scsi_invalid_cdb_len(
1550                mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1551                cmd->frame->header.target_id, cmd->frame->header.lun_id,
1552                cmd->frame->header.cdb_len);
1553        megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1554        cmd->frame->header.scsi_status = CHECK_CONDITION;
1555        s->event_count++;
1556        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1557    }
1558
1559    if (megasas_map_sgl(s, cmd, &cmd->frame->pass.sgl)) {
1560        megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1561        cmd->frame->header.scsi_status = CHECK_CONDITION;
1562        s->event_count++;
1563        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1564    }
1565
1566    cmd->req = scsi_req_new(sdev, cmd->index,
1567                            cmd->frame->header.lun_id, cdb, cmd);
1568    if (!cmd->req) {
1569        trace_megasas_scsi_req_alloc_failed(
1570                mfi_frame_desc[cmd->frame->header.frame_cmd],
1571                cmd->frame->header.target_id, cmd->frame->header.lun_id);
1572        megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1573        cmd->frame->header.scsi_status = BUSY;
1574        s->event_count++;
1575        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1576    }
1577
1578    is_write = (cmd->req->cmd.mode == SCSI_XFER_TO_DEV);
1579    len = megasas_enqueue_req(cmd, is_write);
1580    if (len > 0) {
1581        if (is_write) {
1582            trace_megasas_scsi_write_start(cmd->index, len);
1583        } else {
1584            trace_megasas_scsi_read_start(cmd->index, len);
1585        }
1586    } else {
1587        trace_megasas_scsi_nodata(cmd->index);
1588    }
1589    return MFI_STAT_INVALID_STATUS;
1590}
1591
1592static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd)
1593{
1594    uint32_t lba_count, lba_start_hi, lba_start_lo;
1595    uint64_t lba_start;
1596    bool is_write = (cmd->frame->header.frame_cmd == MFI_CMD_LD_WRITE);
1597    uint8_t cdb[16];
1598    int len;
1599    struct SCSIDevice *sdev = NULL;
1600
1601    lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
1602    lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
1603    lba_start_hi = le32_to_cpu(cmd->frame->io.lba_hi);
1604    lba_start = ((uint64_t)lba_start_hi << 32) | lba_start_lo;
1605
1606    if (cmd->frame->header.target_id < s->fw_luns) {
1607        sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1608                                cmd->frame->header.lun_id);
1609    }
1610
1611    trace_megasas_handle_io(cmd->index,
1612                            mfi_frame_desc[cmd->frame->header.frame_cmd],
1613                            cmd->frame->header.target_id,
1614                            cmd->frame->header.lun_id,
1615                            (unsigned long)lba_start, (unsigned long)lba_count);
1616    if (!sdev) {
1617        trace_megasas_io_target_not_present(cmd->index,
1618            mfi_frame_desc[cmd->frame->header.frame_cmd],
1619            cmd->frame->header.target_id, cmd->frame->header.lun_id);
1620        return MFI_STAT_DEVICE_NOT_FOUND;
1621    }
1622
1623    if (cmd->frame->header.cdb_len > 16) {
1624        trace_megasas_scsi_invalid_cdb_len(
1625            mfi_frame_desc[cmd->frame->header.frame_cmd], 1,
1626            cmd->frame->header.target_id, cmd->frame->header.lun_id,
1627            cmd->frame->header.cdb_len);
1628        megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1629        cmd->frame->header.scsi_status = CHECK_CONDITION;
1630        s->event_count++;
1631        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1632    }
1633
1634    cmd->iov_size = lba_count * sdev->blocksize;
1635    if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
1636        megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1637        cmd->frame->header.scsi_status = CHECK_CONDITION;
1638        s->event_count++;
1639        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1640    }
1641
1642    megasas_encode_lba(cdb, lba_start, lba_count, is_write);
1643    cmd->req = scsi_req_new(sdev, cmd->index,
1644                            cmd->frame->header.lun_id, cdb, cmd);
1645    if (!cmd->req) {
1646        trace_megasas_scsi_req_alloc_failed(
1647            mfi_frame_desc[cmd->frame->header.frame_cmd],
1648            cmd->frame->header.target_id, cmd->frame->header.lun_id);
1649        megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1650        cmd->frame->header.scsi_status = BUSY;
1651        s->event_count++;
1652        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1653    }
1654    len = megasas_enqueue_req(cmd, is_write);
1655    if (len > 0) {
1656        if (is_write) {
1657            trace_megasas_io_write_start(cmd->index, lba_start, lba_count, len);
1658        } else {
1659            trace_megasas_io_read_start(cmd->index, lba_start, lba_count, len);
1660        }
1661    }
1662    return MFI_STAT_INVALID_STATUS;
1663}
1664
1665static int megasas_finish_internal_command(MegasasCmd *cmd,
1666                                           SCSIRequest *req, size_t resid)
1667{
1668    int retval = MFI_STAT_INVALID_CMD;
1669
1670    if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1671        cmd->iov_size -= resid;
1672        retval = megasas_finish_internal_dcmd(cmd, req);
1673    }
1674    return retval;
1675}
1676
1677static QEMUSGList *megasas_get_sg_list(SCSIRequest *req)
1678{
1679    MegasasCmd *cmd = req->hba_private;
1680
1681    if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1682        return NULL;
1683    } else {
1684        return &cmd->qsg;
1685    }
1686}
1687
1688static void megasas_xfer_complete(SCSIRequest *req, uint32_t len)
1689{
1690    MegasasCmd *cmd = req->hba_private;
1691    uint8_t *buf;
1692    uint32_t opcode;
1693
1694    trace_megasas_io_complete(cmd->index, len);
1695
1696    if (cmd->frame->header.frame_cmd != MFI_CMD_DCMD) {
1697        scsi_req_continue(req);
1698        return;
1699    }
1700
1701    buf = scsi_req_get_buf(req);
1702    opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1703    if (opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) {
1704        struct mfi_pd_info *info = cmd->iov_buf;
1705
1706        if (info->inquiry_data[0] == 0x7f) {
1707            memset(info->inquiry_data, 0, sizeof(info->inquiry_data));
1708            memcpy(info->inquiry_data, buf, len);
1709        } else if (info->vpd_page83[0] == 0x7f) {
1710            memset(info->vpd_page83, 0, sizeof(info->vpd_page83));
1711            memcpy(info->vpd_page83, buf, len);
1712        }
1713        scsi_req_continue(req);
1714    } else if (opcode == MFI_DCMD_LD_GET_INFO) {
1715        struct mfi_ld_info *info = cmd->iov_buf;
1716
1717        if (cmd->iov_buf) {
1718            memcpy(info->vpd_page83, buf, sizeof(info->vpd_page83));
1719            scsi_req_continue(req);
1720        }
1721    }
1722}
1723
1724static void megasas_command_complete(SCSIRequest *req, uint32_t status,
1725                                     size_t resid)
1726{
1727    MegasasCmd *cmd = req->hba_private;
1728    uint8_t cmd_status = MFI_STAT_OK;
1729
1730    trace_megasas_command_complete(cmd->index, status, resid);
1731
1732    if (cmd->req != req) {
1733        /*
1734         * Internal command complete
1735         */
1736        cmd_status = megasas_finish_internal_command(cmd, req, resid);
1737        if (cmd_status == MFI_STAT_INVALID_STATUS) {
1738            return;
1739        }
1740    } else {
1741        req->status = status;
1742        trace_megasas_scsi_complete(cmd->index, req->status,
1743                                    cmd->iov_size, req->cmd.xfer);
1744        if (req->status != GOOD) {
1745            cmd_status = MFI_STAT_SCSI_DONE_WITH_ERROR;
1746        }
1747        if (req->status == CHECK_CONDITION) {
1748            megasas_copy_sense(cmd);
1749        }
1750
1751        megasas_unmap_sgl(cmd);
1752        cmd->frame->header.scsi_status = req->status;
1753        scsi_req_unref(cmd->req);
1754        cmd->req = NULL;
1755    }
1756    cmd->frame->header.cmd_status = cmd_status;
1757    megasas_complete_frame(cmd->state, cmd->context);
1758}
1759
1760static void megasas_command_cancel(SCSIRequest *req)
1761{
1762    MegasasCmd *cmd = req->hba_private;
1763
1764    if (cmd) {
1765        megasas_abort_command(cmd);
1766    } else {
1767        scsi_req_unref(req);
1768    }
1769}
1770
1771static int megasas_handle_abort(MegasasState *s, MegasasCmd *cmd)
1772{
1773    uint64_t abort_ctx = le64_to_cpu(cmd->frame->abort.abort_context);
1774    hwaddr abort_addr, addr_hi, addr_lo;
1775    MegasasCmd *abort_cmd;
1776
1777    addr_hi = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_hi);
1778    addr_lo = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_lo);
1779    abort_addr = ((uint64_t)addr_hi << 32) | addr_lo;
1780
1781    abort_cmd = megasas_lookup_frame(s, abort_addr);
1782    if (!abort_cmd) {
1783        trace_megasas_abort_no_cmd(cmd->index, abort_ctx);
1784        s->event_count++;
1785        return MFI_STAT_OK;
1786    }
1787    if (!megasas_use_queue64(s)) {
1788        abort_ctx &= (uint64_t)0xFFFFFFFF;
1789    }
1790    if (abort_cmd->context != abort_ctx) {
1791        trace_megasas_abort_invalid_context(cmd->index, abort_cmd->index,
1792                                            abort_cmd->context);
1793        s->event_count++;
1794        return MFI_STAT_ABORT_NOT_POSSIBLE;
1795    }
1796    trace_megasas_abort_frame(cmd->index, abort_cmd->index);
1797    megasas_abort_command(abort_cmd);
1798    if (!s->event_cmd || abort_cmd != s->event_cmd) {
1799        s->event_cmd = NULL;
1800    }
1801    s->event_count++;
1802    return MFI_STAT_OK;
1803}
1804
1805static void megasas_handle_frame(MegasasState *s, uint64_t frame_addr,
1806                                 uint32_t frame_count)
1807{
1808    uint8_t frame_status = MFI_STAT_INVALID_CMD;
1809    uint64_t frame_context;
1810    MegasasCmd *cmd;
1811
1812    /*
1813     * Always read 64bit context, top bits will be
1814     * masked out if required in megasas_enqueue_frame()
1815     */
1816    frame_context = megasas_frame_get_context(frame_addr);
1817
1818    cmd = megasas_enqueue_frame(s, frame_addr, frame_context, frame_count);
1819    if (!cmd) {
1820        /* reply queue full */
1821        trace_megasas_frame_busy(frame_addr);
1822        megasas_frame_set_scsi_status(frame_addr, BUSY);
1823        megasas_frame_set_cmd_status(frame_addr, MFI_STAT_SCSI_DONE_WITH_ERROR);
1824        megasas_complete_frame(s, frame_context);
1825        s->event_count++;
1826        return;
1827    }
1828    switch (cmd->frame->header.frame_cmd) {
1829    case MFI_CMD_INIT:
1830        frame_status = megasas_init_firmware(s, cmd);
1831        break;
1832    case MFI_CMD_DCMD:
1833        frame_status = megasas_handle_dcmd(s, cmd);
1834        break;
1835    case MFI_CMD_ABORT:
1836        frame_status = megasas_handle_abort(s, cmd);
1837        break;
1838    case MFI_CMD_PD_SCSI_IO:
1839        frame_status = megasas_handle_scsi(s, cmd, 0);
1840        break;
1841    case MFI_CMD_LD_SCSI_IO:
1842        frame_status = megasas_handle_scsi(s, cmd, 1);
1843        break;
1844    case MFI_CMD_LD_READ:
1845    case MFI_CMD_LD_WRITE:
1846        frame_status = megasas_handle_io(s, cmd);
1847        break;
1848    default:
1849        trace_megasas_unhandled_frame_cmd(cmd->index,
1850                                          cmd->frame->header.frame_cmd);
1851        s->event_count++;
1852        break;
1853    }
1854    if (frame_status != MFI_STAT_INVALID_STATUS) {
1855        if (cmd->frame) {
1856            cmd->frame->header.cmd_status = frame_status;
1857        } else {
1858            megasas_frame_set_cmd_status(frame_addr, frame_status);
1859        }
1860        megasas_complete_frame(s, cmd->context);
1861    }
1862}
1863
1864static uint64_t megasas_mmio_read(void *opaque, hwaddr addr,
1865                                  unsigned size)
1866{
1867    MegasasState *s = opaque;
1868    uint32_t retval = 0;
1869
1870    switch (addr) {
1871    case MFI_IDB:
1872        retval = 0;
1873        break;
1874    case MFI_OMSG0:
1875    case MFI_OSP0:
1876        retval = (megasas_use_msix(s) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |
1877            (s->fw_state & MFI_FWSTATE_MASK) |
1878            ((s->fw_sge & 0xff) << 16) |
1879            (s->fw_cmds & 0xFFFF);
1880        break;
1881    case MFI_OSTS:
1882        if (megasas_intr_enabled(s) && s->doorbell) {
1883            retval = MFI_1078_RM | 1;
1884        }
1885        break;
1886    case MFI_OMSK:
1887        retval = s->intr_mask;
1888        break;
1889    case MFI_ODCR0:
1890        retval = s->doorbell;
1891        break;
1892    default:
1893        trace_megasas_mmio_invalid_readl(addr);
1894        break;
1895    }
1896    trace_megasas_mmio_readl(addr, retval);
1897    return retval;
1898}
1899
1900static void megasas_mmio_write(void *opaque, hwaddr addr,
1901                               uint64_t val, unsigned size)
1902{
1903    MegasasState *s = opaque;
1904    uint64_t frame_addr;
1905    uint32_t frame_count;
1906    int i;
1907
1908    trace_megasas_mmio_writel(addr, val);
1909    switch (addr) {
1910    case MFI_IDB:
1911        if (val & MFI_FWINIT_ABORT) {
1912            /* Abort all pending cmds */
1913            for (i = 0; i < s->fw_cmds; i++) {
1914                megasas_abort_command(&s->frames[i]);
1915            }
1916        }
1917        if (val & MFI_FWINIT_READY) {
1918            /* move to FW READY */
1919            megasas_soft_reset(s);
1920        }
1921        if (val & MFI_FWINIT_MFIMODE) {
1922            /* discard MFIs */
1923        }
1924        break;
1925    case MFI_OMSK:
1926        s->intr_mask = val;
1927        if (!megasas_intr_enabled(s) && !msix_enabled(&s->dev)) {
1928            trace_megasas_irq_lower();
1929            qemu_irq_lower(s->dev.irq[0]);
1930        }
1931        if (megasas_intr_enabled(s)) {
1932            trace_megasas_intr_enabled();
1933        } else {
1934            trace_megasas_intr_disabled();
1935        }
1936        break;
1937    case MFI_ODCR0:
1938        s->doorbell = 0;
1939        if (s->producer_pa && megasas_intr_enabled(s)) {
1940            /* Update reply queue pointer */
1941            trace_megasas_qf_update(s->reply_queue_head, s->busy);
1942            stl_le_phys(s->producer_pa, s->reply_queue_head);
1943            if (!msix_enabled(&s->dev)) {
1944                trace_megasas_irq_lower();
1945                qemu_irq_lower(s->dev.irq[0]);
1946            }
1947        }
1948        break;
1949    case MFI_IQPH:
1950        /* Received high 32 bits of a 64 bit MFI frame address */
1951        s->frame_hi = val;
1952        break;
1953    case MFI_IQPL:
1954        /* Received low 32 bits of a 64 bit MFI frame address */
1955    case MFI_IQP:
1956        /* Received 32 bit MFI frame address */
1957        frame_addr = (val & ~0x1F);
1958        /* Add possible 64 bit offset */
1959        frame_addr |= ((uint64_t)s->frame_hi << 32);
1960        s->frame_hi = 0;
1961        frame_count = (val >> 1) & 0xF;
1962        megasas_handle_frame(s, frame_addr, frame_count);
1963        break;
1964    default:
1965        trace_megasas_mmio_invalid_writel(addr, val);
1966        break;
1967    }
1968}
1969
1970static const MemoryRegionOps megasas_mmio_ops = {
1971    .read = megasas_mmio_read,
1972    .write = megasas_mmio_write,
1973    .endianness = DEVICE_LITTLE_ENDIAN,
1974    .impl = {
1975        .min_access_size = 8,
1976        .max_access_size = 8,
1977    }
1978};
1979
1980static uint64_t megasas_port_read(void *opaque, hwaddr addr,
1981                                  unsigned size)
1982{
1983    return megasas_mmio_read(opaque, addr & 0xff, size);
1984}
1985
1986static void megasas_port_write(void *opaque, hwaddr addr,
1987                               uint64_t val, unsigned size)
1988{
1989    megasas_mmio_write(opaque, addr & 0xff, val, size);
1990}
1991
1992static const MemoryRegionOps megasas_port_ops = {
1993    .read = megasas_port_read,
1994    .write = megasas_port_write,
1995    .endianness = DEVICE_LITTLE_ENDIAN,
1996    .impl = {
1997        .min_access_size = 4,
1998        .max_access_size = 4,
1999    }
2000};
2001
2002static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
2003                                   unsigned size)
2004{
2005    return 0;
2006}
2007
2008static const MemoryRegionOps megasas_queue_ops = {
2009    .read = megasas_queue_read,
2010    .endianness = DEVICE_LITTLE_ENDIAN,
2011    .impl = {
2012        .min_access_size = 8,
2013        .max_access_size = 8,
2014    }
2015};
2016
2017static void megasas_soft_reset(MegasasState *s)
2018{
2019    int i;
2020    MegasasCmd *cmd;
2021
2022    trace_megasas_reset();
2023    for (i = 0; i < s->fw_cmds; i++) {
2024        cmd = &s->frames[i];
2025        megasas_abort_command(cmd);
2026    }
2027    megasas_reset_frames(s);
2028    s->reply_queue_len = s->fw_cmds;
2029    s->reply_queue_pa = 0;
2030    s->consumer_pa = 0;
2031    s->producer_pa = 0;
2032    s->fw_state = MFI_FWSTATE_READY;
2033    s->doorbell = 0;
2034    s->intr_mask = MEGASAS_INTR_DISABLED_MASK;
2035    s->frame_hi = 0;
2036    s->flags &= ~MEGASAS_MASK_USE_QUEUE64;
2037    s->event_count++;
2038    s->boot_event = s->event_count;
2039}
2040
2041static void megasas_scsi_reset(DeviceState *dev)
2042{
2043    MegasasState *s = DO_UPCAST(MegasasState, dev.qdev, dev);
2044
2045    megasas_soft_reset(s);
2046}
2047
2048static const VMStateDescription vmstate_megasas = {
2049    .name = "megasas",
2050    .version_id = 0,
2051    .minimum_version_id = 0,
2052    .minimum_version_id_old = 0,
2053    .fields      = (VMStateField[]) {
2054        VMSTATE_PCI_DEVICE(dev, MegasasState),
2055
2056        VMSTATE_INT32(fw_state, MegasasState),
2057        VMSTATE_INT32(intr_mask, MegasasState),
2058        VMSTATE_INT32(doorbell, MegasasState),
2059        VMSTATE_UINT64(reply_queue_pa, MegasasState),
2060        VMSTATE_UINT64(consumer_pa, MegasasState),
2061        VMSTATE_UINT64(producer_pa, MegasasState),
2062        VMSTATE_END_OF_LIST()
2063    }
2064};
2065
2066static void megasas_scsi_uninit(PCIDevice *d)
2067{
2068    MegasasState *s = DO_UPCAST(MegasasState, dev, d);
2069
2070#ifdef USE_MSIX
2071    msix_uninit(&s->dev, &s->mmio_io);
2072#endif
2073    memory_region_destroy(&s->mmio_io);
2074    memory_region_destroy(&s->port_io);
2075    memory_region_destroy(&s->queue_io);
2076}
2077
2078static const struct SCSIBusInfo megasas_scsi_info = {
2079    .tcq = true,
2080    .max_target = MFI_MAX_LD,
2081    .max_lun = 255,
2082
2083    .transfer_data = megasas_xfer_complete,
2084    .get_sg_list = megasas_get_sg_list,
2085    .complete = megasas_command_complete,
2086    .cancel = megasas_command_cancel,
2087};
2088
2089static int megasas_scsi_init(PCIDevice *dev)
2090{
2091    MegasasState *s = DO_UPCAST(MegasasState, dev, dev);
2092    uint8_t *pci_conf;
2093    int i, bar_type;
2094
2095    pci_conf = s->dev.config;
2096
2097    /* PCI latency timer = 0 */
2098    pci_conf[PCI_LATENCY_TIMER] = 0;
2099    /* Interrupt pin 1 */
2100    pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2101
2102    memory_region_init_io(&s->mmio_io, &megasas_mmio_ops, s,
2103                          "megasas-mmio", 0x4000);
2104    memory_region_init_io(&s->port_io, &megasas_port_ops, s,
2105                          "megasas-io", 256);
2106    memory_region_init_io(&s->queue_io, &megasas_queue_ops, s,
2107                          "megasas-queue", 0x40000);
2108
2109#ifdef USE_MSIX
2110    /* MSI-X support is currently broken */
2111    if (megasas_use_msix(s) &&
2112        msix_init(&s->dev, 15, &s->mmio_io, 0, 0x2000)) {
2113        s->flags &= ~MEGASAS_MASK_USE_MSIX;
2114    }
2115#else
2116    s->flags &= ~MEGASAS_MASK_USE_MSIX;
2117#endif
2118
2119    bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
2120    pci_register_bar(&s->dev, 0, bar_type, &s->mmio_io);
2121    pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
2122    pci_register_bar(&s->dev, 3, bar_type, &s->queue_io);
2123
2124    if (megasas_use_msix(s)) {
2125        msix_vector_use(&s->dev, 0);
2126    }
2127
2128    if (!s->sas_addr) {
2129        s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
2130                       IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
2131        s->sas_addr |= (pci_bus_num(dev->bus) << 16);
2132        s->sas_addr |= (PCI_SLOT(dev->devfn) << 8);
2133        s->sas_addr |= PCI_FUNC(dev->devfn);
2134    }
2135    if (!s->hba_serial) {
2136        s->hba_serial = g_strdup(MEGASAS_HBA_SERIAL);
2137    }
2138    if (s->fw_sge >= MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE) {
2139        s->fw_sge = MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE;
2140    } else if (s->fw_sge >= 128 - MFI_PASS_FRAME_SIZE) {
2141        s->fw_sge = 128 - MFI_PASS_FRAME_SIZE;
2142    } else {
2143        s->fw_sge = 64 - MFI_PASS_FRAME_SIZE;
2144    }
2145    if (s->fw_cmds > MEGASAS_MAX_FRAMES) {
2146        s->fw_cmds = MEGASAS_MAX_FRAMES;
2147    }
2148    trace_megasas_init(s->fw_sge, s->fw_cmds,
2149                       megasas_use_msix(s) ? "MSI-X" : "INTx",
2150                       megasas_is_jbod(s) ? "jbod" : "raid");
2151    s->fw_luns = (MFI_MAX_LD > MAX_SCSI_DEVS) ?
2152        MAX_SCSI_DEVS : MFI_MAX_LD;
2153    s->producer_pa = 0;
2154    s->consumer_pa = 0;
2155    for (i = 0; i < s->fw_cmds; i++) {
2156        s->frames[i].index = i;
2157        s->frames[i].context = -1;
2158        s->frames[i].pa = 0;
2159        s->frames[i].state = s;
2160    }
2161
2162    scsi_bus_new(&s->bus, &dev->qdev, &megasas_scsi_info, NULL);
2163    scsi_bus_legacy_handle_cmdline(&s->bus);
2164    return 0;
2165}
2166
2167static Property megasas_properties[] = {
2168    DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2169                       MEGASAS_DEFAULT_SGE),
2170    DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2171                       MEGASAS_DEFAULT_FRAMES),
2172    DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2173    DEFINE_PROP_HEX64("sas_address", MegasasState, sas_addr, 0),
2174#ifdef USE_MSIX
2175    DEFINE_PROP_BIT("use_msix", MegasasState, flags,
2176                    MEGASAS_FLAG_USE_MSIX, false),
2177#endif
2178    DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2179                    MEGASAS_FLAG_USE_JBOD, false),
2180    DEFINE_PROP_END_OF_LIST(),
2181};
2182
2183static void megasas_class_init(ObjectClass *oc, void *data)
2184{
2185    DeviceClass *dc = DEVICE_CLASS(oc);
2186    PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
2187
2188    pc->init = megasas_scsi_init;
2189    pc->exit = megasas_scsi_uninit;
2190    pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2191    pc->device_id = PCI_DEVICE_ID_LSI_SAS1078;
2192    pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2193    pc->subsystem_id = 0x1013;
2194    pc->class_id = PCI_CLASS_STORAGE_RAID;
2195    dc->props = megasas_properties;
2196    dc->reset = megasas_scsi_reset;
2197    dc->vmsd = &vmstate_megasas;
2198    dc->desc = "LSI MegaRAID SAS 1078";
2199}
2200
2201static const TypeInfo megasas_info = {
2202    .name  = "megasas",
2203    .parent = TYPE_PCI_DEVICE,
2204    .instance_size = sizeof(MegasasState),
2205    .class_init = megasas_class_init,
2206};
2207
2208static void megasas_register_types(void)
2209{
2210    type_register_static(&megasas_info);
2211}
2212
2213type_init(megasas_register_types)
2214