qemu/hw/scsi/megasas.c
<<
>>
Prefs
   1/*
   2 * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation
   3 * Based on the linux driver code at drivers/scsi/megaraid
   4 *
   5 * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
   6 *
   7 * This library is free software; you can redistribute it and/or
   8 * modify it under the terms of the GNU Lesser General Public
   9 * License as published by the Free Software Foundation; either
  10 * version 2 of the License, or (at your option) any later version.
  11 *
  12 * This library is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15 * Lesser General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU Lesser General Public
  18 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21#include "hw/hw.h"
  22#include "hw/pci/pci.h"
  23#include "sysemu/dma.h"
  24#include "hw/pci/msix.h"
  25#include "qemu/iov.h"
  26#include "hw/scsi/scsi.h"
  27#include "block/scsi.h"
  28#include "trace.h"
  29
  30#include "mfi.h"
  31
  32#define MEGASAS_VERSION "1.70"
  33#define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */
  34#define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */
  35#define MEGASAS_MAX_SGE 128             /* Firmware limit */
  36#define MEGASAS_DEFAULT_SGE 80
  37#define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */
  38#define MEGASAS_MAX_ARRAYS 128
  39
  40#define MEGASAS_HBA_SERIAL "QEMU123456"
  41#define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
  42#define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
  43
  44#define MEGASAS_FLAG_USE_JBOD      0
  45#define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)
  46#define MEGASAS_FLAG_USE_MSIX      1
  47#define MEGASAS_MASK_USE_MSIX      (1 << MEGASAS_FLAG_USE_MSIX)
  48#define MEGASAS_FLAG_USE_QUEUE64   2
  49#define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)
  50
  51static const char *mfi_frame_desc[] = {
  52    "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",
  53    "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"};
  54
  55typedef struct MegasasCmd {
  56    uint32_t index;
  57    uint16_t flags;
  58    uint16_t count;
  59    uint64_t context;
  60
  61    hwaddr pa;
  62    hwaddr pa_size;
  63    union mfi_frame *frame;
  64    SCSIRequest *req;
  65    QEMUSGList qsg;
  66    void *iov_buf;
  67    size_t iov_size;
  68    size_t iov_offset;
  69    struct MegasasState *state;
  70} MegasasCmd;
  71
  72typedef struct MegasasState {
  73    /*< private >*/
  74    PCIDevice parent_obj;
  75    /*< public >*/
  76
  77    MemoryRegion mmio_io;
  78    MemoryRegion port_io;
  79    MemoryRegion queue_io;
  80    uint32_t frame_hi;
  81
  82    int fw_state;
  83    uint32_t fw_sge;
  84    uint32_t fw_cmds;
  85    uint32_t flags;
  86    int fw_luns;
  87    int intr_mask;
  88    int doorbell;
  89    int busy;
  90
  91    MegasasCmd *event_cmd;
  92    int event_locale;
  93    int event_class;
  94    int event_count;
  95    int shutdown_event;
  96    int boot_event;
  97
  98    uint64_t sas_addr;
  99    char *hba_serial;
 100
 101    uint64_t reply_queue_pa;
 102    void *reply_queue;
 103    int reply_queue_len;
 104    int reply_queue_head;
 105    int reply_queue_tail;
 106    uint64_t consumer_pa;
 107    uint64_t producer_pa;
 108
 109    MegasasCmd frames[MEGASAS_MAX_FRAMES];
 110
 111    SCSIBus bus;
 112} MegasasState;
 113
 114#define TYPE_MEGASAS "megasas"
 115
 116#define MEGASAS(obj) \
 117    OBJECT_CHECK(MegasasState, (obj), TYPE_MEGASAS)
 118
 119#define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
 120
 121static bool megasas_intr_enabled(MegasasState *s)
 122{
 123    if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=
 124        MEGASAS_INTR_DISABLED_MASK) {
 125        return true;
 126    }
 127    return false;
 128}
 129
 130static bool megasas_use_queue64(MegasasState *s)
 131{
 132    return s->flags & MEGASAS_MASK_USE_QUEUE64;
 133}
 134
 135static bool megasas_use_msix(MegasasState *s)
 136{
 137    return s->flags & MEGASAS_MASK_USE_MSIX;
 138}
 139
 140static bool megasas_is_jbod(MegasasState *s)
 141{
 142    return s->flags & MEGASAS_MASK_USE_JBOD;
 143}
 144
 145static void megasas_frame_set_cmd_status(unsigned long frame, uint8_t v)
 146{
 147    stb_phys(frame + offsetof(struct mfi_frame_header, cmd_status), v);
 148}
 149
 150static void megasas_frame_set_scsi_status(unsigned long frame, uint8_t v)
 151{
 152    stb_phys(frame + offsetof(struct mfi_frame_header, scsi_status), v);
 153}
 154
 155/*
 156 * Context is considered opaque, but the HBA firmware is running
 157 * in little endian mode. So convert it to little endian, too.
 158 */
 159static uint64_t megasas_frame_get_context(unsigned long frame)
 160{
 161    return ldq_le_phys(frame + offsetof(struct mfi_frame_header, context));
 162}
 163
 164static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)
 165{
 166    return cmd->flags & MFI_FRAME_IEEE_SGL;
 167}
 168
 169static bool megasas_frame_is_sgl64(MegasasCmd *cmd)
 170{
 171    return cmd->flags & MFI_FRAME_SGL64;
 172}
 173
 174static bool megasas_frame_is_sense64(MegasasCmd *cmd)
 175{
 176    return cmd->flags & MFI_FRAME_SENSE64;
 177}
 178
 179static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,
 180                                     union mfi_sgl *sgl)
 181{
 182    uint64_t addr;
 183
 184    if (megasas_frame_is_ieee_sgl(cmd)) {
 185        addr = le64_to_cpu(sgl->sg_skinny->addr);
 186    } else if (megasas_frame_is_sgl64(cmd)) {
 187        addr = le64_to_cpu(sgl->sg64->addr);
 188    } else {
 189        addr = le32_to_cpu(sgl->sg32->addr);
 190    }
 191    return addr;
 192}
 193
 194static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,
 195                                    union mfi_sgl *sgl)
 196{
 197    uint32_t len;
 198
 199    if (megasas_frame_is_ieee_sgl(cmd)) {
 200        len = le32_to_cpu(sgl->sg_skinny->len);
 201    } else if (megasas_frame_is_sgl64(cmd)) {
 202        len = le32_to_cpu(sgl->sg64->len);
 203    } else {
 204        len = le32_to_cpu(sgl->sg32->len);
 205    }
 206    return len;
 207}
 208
 209static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,
 210                                       union mfi_sgl *sgl)
 211{
 212    uint8_t *next = (uint8_t *)sgl;
 213
 214    if (megasas_frame_is_ieee_sgl(cmd)) {
 215        next += sizeof(struct mfi_sg_skinny);
 216    } else if (megasas_frame_is_sgl64(cmd)) {
 217        next += sizeof(struct mfi_sg64);
 218    } else {
 219        next += sizeof(struct mfi_sg32);
 220    }
 221
 222    if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {
 223        return NULL;
 224    }
 225    return (union mfi_sgl *)next;
 226}
 227
 228static void megasas_soft_reset(MegasasState *s);
 229
 230static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
 231{
 232    int i;
 233    int iov_count = 0;
 234    size_t iov_size = 0;
 235
 236    cmd->flags = le16_to_cpu(cmd->frame->header.flags);
 237    iov_count = cmd->frame->header.sge_count;
 238    if (iov_count > MEGASAS_MAX_SGE) {
 239        trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,
 240                                         MEGASAS_MAX_SGE);
 241        return iov_count;
 242    }
 243    pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), iov_count);
 244    for (i = 0; i < iov_count; i++) {
 245        dma_addr_t iov_pa, iov_size_p;
 246
 247        if (!sgl) {
 248            trace_megasas_iovec_sgl_underflow(cmd->index, i);
 249            goto unmap;
 250        }
 251        iov_pa = megasas_sgl_get_addr(cmd, sgl);
 252        iov_size_p = megasas_sgl_get_len(cmd, sgl);
 253        if (!iov_pa || !iov_size_p) {
 254            trace_megasas_iovec_sgl_invalid(cmd->index, i,
 255                                            iov_pa, iov_size_p);
 256            goto unmap;
 257        }
 258        qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);
 259        sgl = megasas_sgl_next(cmd, sgl);
 260        iov_size += (size_t)iov_size_p;
 261    }
 262    if (cmd->iov_size > iov_size) {
 263        trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
 264    } else if (cmd->iov_size < iov_size) {
 265        trace_megasas_iovec_underflow(cmd->iov_size, iov_size, cmd->iov_size);
 266    }
 267    cmd->iov_offset = 0;
 268    return 0;
 269unmap:
 270    qemu_sglist_destroy(&cmd->qsg);
 271    return iov_count - i;
 272}
 273
 274static void megasas_unmap_sgl(MegasasCmd *cmd)
 275{
 276    qemu_sglist_destroy(&cmd->qsg);
 277    cmd->iov_offset = 0;
 278}
 279
 280/*
 281 * passthrough sense and io sense are at the same offset
 282 */
 283static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,
 284    uint8_t sense_len)
 285{
 286    uint32_t pa_hi = 0, pa_lo;
 287    hwaddr pa;
 288
 289    if (sense_len > cmd->frame->header.sense_len) {
 290        sense_len = cmd->frame->header.sense_len;
 291    }
 292    if (sense_len) {
 293        pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);
 294        if (megasas_frame_is_sense64(cmd)) {
 295            pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);
 296        }
 297        pa = ((uint64_t) pa_hi << 32) | pa_lo;
 298        cpu_physical_memory_write(pa, sense_ptr, sense_len);
 299        cmd->frame->header.sense_len = sense_len;
 300    }
 301    return sense_len;
 302}
 303
 304static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)
 305{
 306    uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
 307    uint8_t sense_len = 18;
 308
 309    memset(sense_buf, 0, sense_len);
 310    sense_buf[0] = 0xf0;
 311    sense_buf[2] = sense.key;
 312    sense_buf[7] = 10;
 313    sense_buf[12] = sense.asc;
 314    sense_buf[13] = sense.ascq;
 315    megasas_build_sense(cmd, sense_buf, sense_len);
 316}
 317
 318static void megasas_copy_sense(MegasasCmd *cmd)
 319{
 320    uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
 321    uint8_t sense_len;
 322
 323    sense_len = scsi_req_get_sense(cmd->req, sense_buf,
 324                                   SCSI_SENSE_BUF_SIZE);
 325    megasas_build_sense(cmd, sense_buf, sense_len);
 326}
 327
 328/*
 329 * Format an INQUIRY CDB
 330 */
 331static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)
 332{
 333    memset(cdb, 0, 6);
 334    cdb[0] = INQUIRY;
 335    if (pg > 0) {
 336        cdb[1] = 0x1;
 337        cdb[2] = pg;
 338    }
 339    cdb[3] = (len >> 8) & 0xff;
 340    cdb[4] = (len & 0xff);
 341    return len;
 342}
 343
 344/*
 345 * Encode lba and len into a READ_16/WRITE_16 CDB
 346 */
 347static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,
 348                               uint32_t len, bool is_write)
 349{
 350    memset(cdb, 0x0, 16);
 351    if (is_write) {
 352        cdb[0] = WRITE_16;
 353    } else {
 354        cdb[0] = READ_16;
 355    }
 356    cdb[2] = (lba >> 56) & 0xff;
 357    cdb[3] = (lba >> 48) & 0xff;
 358    cdb[4] = (lba >> 40) & 0xff;
 359    cdb[5] = (lba >> 32) & 0xff;
 360    cdb[6] = (lba >> 24) & 0xff;
 361    cdb[7] = (lba >> 16) & 0xff;
 362    cdb[8] = (lba >> 8) & 0xff;
 363    cdb[9] = (lba) & 0xff;
 364    cdb[10] = (len >> 24) & 0xff;
 365    cdb[11] = (len >> 16) & 0xff;
 366    cdb[12] = (len >> 8) & 0xff;
 367    cdb[13] = (len) & 0xff;
 368}
 369
 370/*
 371 * Utility functions
 372 */
 373static uint64_t megasas_fw_time(void)
 374{
 375    struct tm curtime;
 376    uint64_t bcd_time;
 377
 378    qemu_get_timedate(&curtime, 0);
 379    bcd_time = ((uint64_t)curtime.tm_sec & 0xff) << 48 |
 380        ((uint64_t)curtime.tm_min & 0xff)  << 40 |
 381        ((uint64_t)curtime.tm_hour & 0xff) << 32 |
 382        ((uint64_t)curtime.tm_mday & 0xff) << 24 |
 383        ((uint64_t)curtime.tm_mon & 0xff)  << 16 |
 384        ((uint64_t)(curtime.tm_year + 1900) & 0xffff);
 385
 386    return bcd_time;
 387}
 388
 389/*
 390 * Default disk sata address
 391 * 0x1221 is the magic number as
 392 * present in real hardware,
 393 * so use it here, too.
 394 */
 395static uint64_t megasas_get_sata_addr(uint16_t id)
 396{
 397    uint64_t addr = (0x1221ULL << 48);
 398    return addr & (id << 24);
 399}
 400
 401/*
 402 * Frame handling
 403 */
 404static int megasas_next_index(MegasasState *s, int index, int limit)
 405{
 406    index++;
 407    if (index == limit) {
 408        index = 0;
 409    }
 410    return index;
 411}
 412
 413static MegasasCmd *megasas_lookup_frame(MegasasState *s,
 414    hwaddr frame)
 415{
 416    MegasasCmd *cmd = NULL;
 417    int num = 0, index;
 418
 419    index = s->reply_queue_head;
 420
 421    while (num < s->fw_cmds) {
 422        if (s->frames[index].pa && s->frames[index].pa == frame) {
 423            cmd = &s->frames[index];
 424            break;
 425        }
 426        index = megasas_next_index(s, index, s->fw_cmds);
 427        num++;
 428    }
 429
 430    return cmd;
 431}
 432
 433static MegasasCmd *megasas_next_frame(MegasasState *s,
 434    hwaddr frame)
 435{
 436    MegasasCmd *cmd = NULL;
 437    int num = 0, index;
 438
 439    cmd = megasas_lookup_frame(s, frame);
 440    if (cmd) {
 441        trace_megasas_qf_found(cmd->index, cmd->pa);
 442        return cmd;
 443    }
 444    index = s->reply_queue_head;
 445    num = 0;
 446    while (num < s->fw_cmds) {
 447        if (!s->frames[index].pa) {
 448            cmd = &s->frames[index];
 449            break;
 450        }
 451        index = megasas_next_index(s, index, s->fw_cmds);
 452        num++;
 453    }
 454    if (!cmd) {
 455        trace_megasas_qf_failed(frame);
 456    }
 457    trace_megasas_qf_new(index, cmd);
 458    return cmd;
 459}
 460
 461static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
 462    hwaddr frame, uint64_t context, int count)
 463{
 464    MegasasCmd *cmd = NULL;
 465    int frame_size = MFI_FRAME_SIZE * 16;
 466    hwaddr frame_size_p = frame_size;
 467
 468    cmd = megasas_next_frame(s, frame);
 469    /* All frames busy */
 470    if (!cmd) {
 471        return NULL;
 472    }
 473    if (!cmd->pa) {
 474        cmd->pa = frame;
 475        /* Map all possible frames */
 476        cmd->frame = cpu_physical_memory_map(frame, &frame_size_p, 0);
 477        if (frame_size_p != frame_size) {
 478            trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
 479            if (cmd->frame) {
 480                cpu_physical_memory_unmap(cmd->frame, frame_size_p, 0, 0);
 481                cmd->frame = NULL;
 482                cmd->pa = 0;
 483            }
 484            s->event_count++;
 485            return NULL;
 486        }
 487        cmd->pa_size = frame_size_p;
 488        cmd->context = context;
 489        if (!megasas_use_queue64(s)) {
 490            cmd->context &= (uint64_t)0xFFFFFFFF;
 491        }
 492    }
 493    cmd->count = count;
 494    s->busy++;
 495
 496    trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,
 497                             s->reply_queue_head, s->busy);
 498
 499    return cmd;
 500}
 501
 502static void megasas_complete_frame(MegasasState *s, uint64_t context)
 503{
 504    PCIDevice *pci_dev = PCI_DEVICE(s);
 505    int tail, queue_offset;
 506
 507    /* Decrement busy count */
 508    s->busy--;
 509
 510    if (s->reply_queue_pa) {
 511        /*
 512         * Put command on the reply queue.
 513         * Context is opaque, but emulation is running in
 514         * little endian. So convert it.
 515         */
 516        tail = s->reply_queue_head;
 517        if (megasas_use_queue64(s)) {
 518            queue_offset = tail * sizeof(uint64_t);
 519            stq_le_phys(s->reply_queue_pa + queue_offset, context);
 520        } else {
 521            queue_offset = tail * sizeof(uint32_t);
 522            stl_le_phys(s->reply_queue_pa + queue_offset, context);
 523        }
 524        s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
 525        trace_megasas_qf_complete(context, tail, queue_offset,
 526                                  s->busy, s->doorbell);
 527    }
 528
 529    if (megasas_intr_enabled(s)) {
 530        /* Notify HBA */
 531        s->doorbell++;
 532        if (s->doorbell == 1) {
 533            if (msix_enabled(pci_dev)) {
 534                trace_megasas_msix_raise(0);
 535                msix_notify(pci_dev, 0);
 536            } else {
 537                trace_megasas_irq_raise();
 538                qemu_irq_raise(pci_dev->irq[0]);
 539            }
 540        }
 541    } else {
 542        trace_megasas_qf_complete_noirq(context);
 543    }
 544}
 545
 546static void megasas_reset_frames(MegasasState *s)
 547{
 548    int i;
 549    MegasasCmd *cmd;
 550
 551    for (i = 0; i < s->fw_cmds; i++) {
 552        cmd = &s->frames[i];
 553        if (cmd->pa) {
 554            cpu_physical_memory_unmap(cmd->frame, cmd->pa_size, 0, 0);
 555            cmd->frame = NULL;
 556            cmd->pa = 0;
 557        }
 558    }
 559}
 560
 561static void megasas_abort_command(MegasasCmd *cmd)
 562{
 563    if (cmd->req) {
 564        scsi_req_cancel(cmd->req);
 565        cmd->req = NULL;
 566    }
 567}
 568
 569static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
 570{
 571    uint32_t pa_hi, pa_lo;
 572    hwaddr iq_pa, initq_size;
 573    struct mfi_init_qinfo *initq;
 574    uint32_t flags;
 575    int ret = MFI_STAT_OK;
 576
 577    pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);
 578    pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);
 579    iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);
 580    trace_megasas_init_firmware((uint64_t)iq_pa);
 581    initq_size = sizeof(*initq);
 582    initq = cpu_physical_memory_map(iq_pa, &initq_size, 0);
 583    if (!initq || initq_size != sizeof(*initq)) {
 584        trace_megasas_initq_map_failed(cmd->index);
 585        s->event_count++;
 586        ret = MFI_STAT_MEMORY_NOT_AVAILABLE;
 587        goto out;
 588    }
 589    s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;
 590    if (s->reply_queue_len > s->fw_cmds) {
 591        trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);
 592        s->event_count++;
 593        ret = MFI_STAT_INVALID_PARAMETER;
 594        goto out;
 595    }
 596    pa_lo = le32_to_cpu(initq->rq_addr_lo);
 597    pa_hi = le32_to_cpu(initq->rq_addr_hi);
 598    s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;
 599    pa_lo = le32_to_cpu(initq->ci_addr_lo);
 600    pa_hi = le32_to_cpu(initq->ci_addr_hi);
 601    s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
 602    pa_lo = le32_to_cpu(initq->pi_addr_lo);
 603    pa_hi = le32_to_cpu(initq->pi_addr_hi);
 604    s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
 605    s->reply_queue_head = ldl_le_phys(s->producer_pa);
 606    s->reply_queue_tail = ldl_le_phys(s->consumer_pa);
 607    flags = le32_to_cpu(initq->flags);
 608    if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
 609        s->flags |= MEGASAS_MASK_USE_QUEUE64;
 610    }
 611    trace_megasas_init_queue((unsigned long)s->reply_queue_pa,
 612                             s->reply_queue_len, s->reply_queue_head,
 613                             s->reply_queue_tail, flags);
 614    megasas_reset_frames(s);
 615    s->fw_state = MFI_FWSTATE_OPERATIONAL;
 616out:
 617    if (initq) {
 618        cpu_physical_memory_unmap(initq, initq_size, 0, 0);
 619    }
 620    return ret;
 621}
 622
 623static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
 624{
 625    dma_addr_t iov_pa, iov_size;
 626
 627    cmd->flags = le16_to_cpu(cmd->frame->header.flags);
 628    if (!cmd->frame->header.sge_count) {
 629        trace_megasas_dcmd_zero_sge(cmd->index);
 630        cmd->iov_size = 0;
 631        return 0;
 632    } else if (cmd->frame->header.sge_count > 1) {
 633        trace_megasas_dcmd_invalid_sge(cmd->index,
 634                                       cmd->frame->header.sge_count);
 635        cmd->iov_size = 0;
 636        return -1;
 637    }
 638    iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
 639    iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
 640    pci_dma_sglist_init(&cmd->qsg, PCI_DEVICE(s), 1);
 641    qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
 642    cmd->iov_size = iov_size;
 643    return cmd->iov_size;
 644}
 645
 646static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
 647{
 648    trace_megasas_finish_dcmd(cmd->index, iov_size);
 649
 650    if (cmd->frame->header.sge_count) {
 651        qemu_sglist_destroy(&cmd->qsg);
 652    }
 653    if (iov_size > cmd->iov_size) {
 654        if (megasas_frame_is_ieee_sgl(cmd)) {
 655            cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);
 656        } else if (megasas_frame_is_sgl64(cmd)) {
 657            cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);
 658        } else {
 659            cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);
 660        }
 661    }
 662    cmd->iov_size = 0;
 663}
 664
 665static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
 666{
 667    PCIDevice *pci_dev = PCI_DEVICE(s);
 668    struct mfi_ctrl_info info;
 669    size_t dcmd_size = sizeof(info);
 670    BusChild *kid;
 671    int num_ld_disks = 0;
 672    uint16_t sdev_id;
 673
 674    memset(&info, 0x0, cmd->iov_size);
 675    if (cmd->iov_size < dcmd_size) {
 676        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 677                                            dcmd_size);
 678        return MFI_STAT_INVALID_PARAMETER;
 679    }
 680
 681    info.pci.vendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);
 682    info.pci.device = cpu_to_le16(PCI_DEVICE_ID_LSI_SAS1078);
 683    info.pci.subvendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);
 684    info.pci.subdevice = cpu_to_le16(0x1013);
 685
 686    /*
 687     * For some reason the firmware supports
 688     * only up to 8 device ports.
 689     * Despite supporting a far larger number
 690     * of devices for the physical devices.
 691     * So just display the first 8 devices
 692     * in the device port list, independent
 693     * of how many logical devices are actually
 694     * present.
 695     */
 696    info.host.type = MFI_INFO_HOST_PCIE;
 697    info.device.type = MFI_INFO_DEV_SAS3G;
 698    info.device.port_count = 8;
 699    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 700        SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
 701
 702        if (num_ld_disks < 8) {
 703            sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
 704            info.device.port_addr[num_ld_disks] =
 705                cpu_to_le64(megasas_get_sata_addr(sdev_id));
 706        }
 707        num_ld_disks++;
 708    }
 709
 710    memcpy(info.product_name, "MegaRAID SAS 8708EM2", 20);
 711    snprintf(info.serial_number, 32, "%s", s->hba_serial);
 712    snprintf(info.package_version, 0x60, "%s-QEMU", QEMU_VERSION);
 713    memcpy(info.image_component[0].name, "APP", 3);
 714    memcpy(info.image_component[0].version, MEGASAS_VERSION "-QEMU", 9);
 715    memcpy(info.image_component[0].build_date, __DATE__, 11);
 716    memcpy(info.image_component[0].build_time, __TIME__, 8);
 717    info.image_component_count = 1;
 718    if (pci_dev->has_rom) {
 719        uint8_t biosver[32];
 720        uint8_t *ptr;
 721
 722        ptr = memory_region_get_ram_ptr(&pci_dev->rom);
 723        memcpy(biosver, ptr + 0x41, 31);
 724        memcpy(info.image_component[1].name, "BIOS", 4);
 725        memcpy(info.image_component[1].version, biosver,
 726               strlen((const char *)biosver));
 727        info.image_component_count++;
 728    }
 729    info.current_fw_time = cpu_to_le32(megasas_fw_time());
 730    info.max_arms = 32;
 731    info.max_spans = 8;
 732    info.max_arrays = MEGASAS_MAX_ARRAYS;
 733    info.max_lds = s->fw_luns;
 734    info.max_cmds = cpu_to_le16(s->fw_cmds);
 735    info.max_sg_elements = cpu_to_le16(s->fw_sge);
 736    info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);
 737    info.lds_present = cpu_to_le16(num_ld_disks);
 738    info.pd_present = cpu_to_le16(num_ld_disks);
 739    info.pd_disks_present = cpu_to_le16(num_ld_disks);
 740    info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |
 741                                   MFI_INFO_HW_MEM |
 742                                   MFI_INFO_HW_FLASH);
 743    info.memory_size = cpu_to_le16(512);
 744    info.nvram_size = cpu_to_le16(32);
 745    info.flash_size = cpu_to_le16(16);
 746    info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);
 747    info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |
 748                                    MFI_INFO_AOPS_SELF_DIAGNOSTIC |
 749                                    MFI_INFO_AOPS_MIXED_ARRAY);
 750    info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |
 751                               MFI_INFO_LDOPS_ACCESS_POLICY |
 752                               MFI_INFO_LDOPS_IO_POLICY |
 753                               MFI_INFO_LDOPS_WRITE_POLICY |
 754                               MFI_INFO_LDOPS_READ_POLICY);
 755    info.max_strips_per_io = cpu_to_le16(s->fw_sge);
 756    info.stripe_sz_ops.min = 3;
 757    info.stripe_sz_ops.max = ffs(MEGASAS_MAX_SECTORS + 1) - 1;
 758    info.properties.pred_fail_poll_interval = cpu_to_le16(300);
 759    info.properties.intr_throttle_cnt = cpu_to_le16(16);
 760    info.properties.intr_throttle_timeout = cpu_to_le16(50);
 761    info.properties.rebuild_rate = 30;
 762    info.properties.patrol_read_rate = 30;
 763    info.properties.bgi_rate = 30;
 764    info.properties.cc_rate = 30;
 765    info.properties.recon_rate = 30;
 766    info.properties.cache_flush_interval = 4;
 767    info.properties.spinup_drv_cnt = 2;
 768    info.properties.spinup_delay = 6;
 769    info.properties.ecc_bucket_size = 15;
 770    info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);
 771    info.properties.expose_encl_devices = 1;
 772    info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);
 773    info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |
 774                               MFI_INFO_PDOPS_FORCE_OFFLINE);
 775    info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |
 776                                       MFI_INFO_PDMIX_SATA |
 777                                       MFI_INFO_PDMIX_LD);
 778
 779    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 780    return MFI_STAT_OK;
 781}
 782
 783static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)
 784{
 785    struct mfi_defaults info;
 786    size_t dcmd_size = sizeof(struct mfi_defaults);
 787
 788    memset(&info, 0x0, dcmd_size);
 789    if (cmd->iov_size < dcmd_size) {
 790        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 791                                            dcmd_size);
 792        return MFI_STAT_INVALID_PARAMETER;
 793    }
 794
 795    info.sas_addr = cpu_to_le64(s->sas_addr);
 796    info.stripe_size = 3;
 797    info.flush_time = 4;
 798    info.background_rate = 30;
 799    info.allow_mix_in_enclosure = 1;
 800    info.allow_mix_in_ld = 1;
 801    info.direct_pd_mapping = 1;
 802    /* Enable for BIOS support */
 803    info.bios_enumerate_lds = 1;
 804    info.disable_ctrl_r = 1;
 805    info.expose_enclosure_devices = 1;
 806    info.disable_preboot_cli = 1;
 807    info.cluster_disable = 1;
 808
 809    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 810    return MFI_STAT_OK;
 811}
 812
 813static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)
 814{
 815    struct mfi_bios_data info;
 816    size_t dcmd_size = sizeof(info);
 817
 818    memset(&info, 0x0, dcmd_size);
 819    if (cmd->iov_size < dcmd_size) {
 820        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 821                                            dcmd_size);
 822        return MFI_STAT_INVALID_PARAMETER;
 823    }
 824    info.continue_on_error = 1;
 825    info.verbose = 1;
 826    if (megasas_is_jbod(s)) {
 827        info.expose_all_drives = 1;
 828    }
 829
 830    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 831    return MFI_STAT_OK;
 832}
 833
 834static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)
 835{
 836    uint64_t fw_time;
 837    size_t dcmd_size = sizeof(fw_time);
 838
 839    fw_time = cpu_to_le64(megasas_fw_time());
 840
 841    cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);
 842    return MFI_STAT_OK;
 843}
 844
 845static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)
 846{
 847    uint64_t fw_time;
 848
 849    /* This is a dummy; setting of firmware time is not allowed */
 850    memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));
 851
 852    trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);
 853    fw_time = cpu_to_le64(megasas_fw_time());
 854    return MFI_STAT_OK;
 855}
 856
 857static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)
 858{
 859    struct mfi_evt_log_state info;
 860    size_t dcmd_size = sizeof(info);
 861
 862    memset(&info, 0, dcmd_size);
 863
 864    info.newest_seq_num = cpu_to_le32(s->event_count);
 865    info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
 866    info.boot_seq_num = cpu_to_le32(s->boot_event);
 867
 868    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 869    return MFI_STAT_OK;
 870}
 871
 872static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
 873{
 874    union mfi_evt event;
 875
 876    if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {
 877        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 878                                            sizeof(struct mfi_evt_detail));
 879        return MFI_STAT_INVALID_PARAMETER;
 880    }
 881    s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);
 882    event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);
 883    s->event_locale = event.members.locale;
 884    s->event_class = event.members.class;
 885    s->event_cmd = cmd;
 886    /* Decrease busy count; event frame doesn't count here */
 887    s->busy--;
 888    cmd->iov_size = sizeof(struct mfi_evt_detail);
 889    return MFI_STAT_INVALID_STATUS;
 890}
 891
 892static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
 893{
 894    struct mfi_pd_list info;
 895    size_t dcmd_size = sizeof(info);
 896    BusChild *kid;
 897    uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
 898    uint16_t sdev_id;
 899
 900    memset(&info, 0, dcmd_size);
 901    offset = 8;
 902    dcmd_limit = offset + sizeof(struct mfi_pd_address);
 903    if (cmd->iov_size < dcmd_limit) {
 904        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 905                                            dcmd_limit);
 906        return MFI_STAT_INVALID_PARAMETER;
 907    }
 908
 909    max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);
 910    if (max_pd_disks > s->fw_luns) {
 911        max_pd_disks = s->fw_luns;
 912    }
 913
 914    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 915        SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
 916
 917        sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
 918        info.addr[num_pd_disks].device_id = cpu_to_le16(sdev_id);
 919        info.addr[num_pd_disks].encl_device_id = 0xFFFF;
 920        info.addr[num_pd_disks].encl_index = 0;
 921        info.addr[num_pd_disks].slot_number = (sdev->id & 0xFF);
 922        info.addr[num_pd_disks].scsi_dev_type = sdev->type;
 923        info.addr[num_pd_disks].connect_port_bitmap = 0x1;
 924        info.addr[num_pd_disks].sas_addr[0] =
 925            cpu_to_le64(megasas_get_sata_addr(sdev_id));
 926        num_pd_disks++;
 927        offset += sizeof(struct mfi_pd_address);
 928    }
 929    trace_megasas_dcmd_pd_get_list(cmd->index, num_pd_disks,
 930                                   max_pd_disks, offset);
 931
 932    info.size = cpu_to_le32(offset);
 933    info.count = cpu_to_le32(num_pd_disks);
 934
 935    cmd->iov_size -= dma_buf_read((uint8_t *)&info, offset, &cmd->qsg);
 936    return MFI_STAT_OK;
 937}
 938
 939static int megasas_dcmd_pd_list_query(MegasasState *s, MegasasCmd *cmd)
 940{
 941    uint16_t flags;
 942
 943    /* mbox0 contains flags */
 944    flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
 945    trace_megasas_dcmd_pd_list_query(cmd->index, flags);
 946    if (flags == MR_PD_QUERY_TYPE_ALL ||
 947        megasas_is_jbod(s)) {
 948        return megasas_dcmd_pd_get_list(s, cmd);
 949    }
 950
 951    return MFI_STAT_OK;
 952}
 953
 954static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun,
 955                                      MegasasCmd *cmd)
 956{
 957    struct mfi_pd_info *info = cmd->iov_buf;
 958    size_t dcmd_size = sizeof(struct mfi_pd_info);
 959    BlockConf *conf = &sdev->conf;
 960    uint64_t pd_size;
 961    uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (lun & 0xFF);
 962    uint8_t cmdbuf[6];
 963    SCSIRequest *req;
 964    size_t len, resid;
 965
 966    if (!cmd->iov_buf) {
 967        cmd->iov_buf = g_malloc(dcmd_size);
 968        memset(cmd->iov_buf, 0, dcmd_size);
 969        info = cmd->iov_buf;
 970        info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */
 971        info->vpd_page83[0] = 0x7f;
 972        megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data));
 973        req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
 974        if (!req) {
 975            trace_megasas_dcmd_req_alloc_failed(cmd->index,
 976                                                "PD get info std inquiry");
 977            g_free(cmd->iov_buf);
 978            cmd->iov_buf = NULL;
 979            return MFI_STAT_FLASH_ALLOC_FAIL;
 980        }
 981        trace_megasas_dcmd_internal_submit(cmd->index,
 982                                           "PD get info std inquiry", lun);
 983        len = scsi_req_enqueue(req);
 984        if (len > 0) {
 985            cmd->iov_size = len;
 986            scsi_req_continue(req);
 987        }
 988        return MFI_STAT_INVALID_STATUS;
 989    } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) {
 990        megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83));
 991        req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
 992        if (!req) {
 993            trace_megasas_dcmd_req_alloc_failed(cmd->index,
 994                                                "PD get info vpd inquiry");
 995            return MFI_STAT_FLASH_ALLOC_FAIL;
 996        }
 997        trace_megasas_dcmd_internal_submit(cmd->index,
 998                                           "PD get info vpd inquiry", lun);
 999        len = scsi_req_enqueue(req);
1000        if (len > 0) {
1001            cmd->iov_size = len;
1002            scsi_req_continue(req);
1003        }
1004        return MFI_STAT_INVALID_STATUS;
1005    }
1006    /* Finished, set FW state */
1007    if ((info->inquiry_data[0] >> 5) == 0) {
1008        if (megasas_is_jbod(cmd->state)) {
1009            info->fw_state = cpu_to_le16(MFI_PD_STATE_SYSTEM);
1010        } else {
1011            info->fw_state = cpu_to_le16(MFI_PD_STATE_ONLINE);
1012        }
1013    } else {
1014        info->fw_state = cpu_to_le16(MFI_PD_STATE_OFFLINE);
1015    }
1016
1017    info->ref.v.device_id = cpu_to_le16(sdev_id);
1018    info->state.ddf.pd_type = cpu_to_le16(MFI_PD_DDF_TYPE_IN_VD|
1019                                          MFI_PD_DDF_TYPE_INTF_SAS);
1020    bdrv_get_geometry(conf->bs, &pd_size);
1021    info->raw_size = cpu_to_le64(pd_size);
1022    info->non_coerced_size = cpu_to_le64(pd_size);
1023    info->coerced_size = cpu_to_le64(pd_size);
1024    info->encl_device_id = 0xFFFF;
1025    info->slot_number = (sdev->id & 0xFF);
1026    info->path_info.count = 1;
1027    info->path_info.sas_addr[0] =
1028        cpu_to_le64(megasas_get_sata_addr(sdev_id));
1029    info->connected_port_bitmap = 0x1;
1030    info->device_speed = 1;
1031    info->link_speed = 1;
1032    resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1033    g_free(cmd->iov_buf);
1034    cmd->iov_size = dcmd_size - resid;
1035    cmd->iov_buf = NULL;
1036    return MFI_STAT_OK;
1037}
1038
1039static int megasas_dcmd_pd_get_info(MegasasState *s, MegasasCmd *cmd)
1040{
1041    size_t dcmd_size = sizeof(struct mfi_pd_info);
1042    uint16_t pd_id;
1043    SCSIDevice *sdev = NULL;
1044    int retval = MFI_STAT_DEVICE_NOT_FOUND;
1045
1046    if (cmd->iov_size < dcmd_size) {
1047        return MFI_STAT_INVALID_PARAMETER;
1048    }
1049
1050    /* mbox0 has the ID */
1051    pd_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1052    sdev = scsi_device_find(&s->bus, 0, pd_id, 0);
1053    trace_megasas_dcmd_pd_get_info(cmd->index, pd_id);
1054
1055    if (sdev) {
1056        /* Submit inquiry */
1057        retval = megasas_pd_get_info_submit(sdev, pd_id, cmd);
1058    }
1059
1060    return retval;
1061}
1062
1063static int megasas_dcmd_ld_get_list(MegasasState *s, MegasasCmd *cmd)
1064{
1065    struct mfi_ld_list info;
1066    size_t dcmd_size = sizeof(info), resid;
1067    uint32_t num_ld_disks = 0, max_ld_disks = s->fw_luns;
1068    uint64_t ld_size;
1069    BusChild *kid;
1070
1071    memset(&info, 0, dcmd_size);
1072    if (cmd->iov_size < dcmd_size) {
1073        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1074                                            dcmd_size);
1075        return MFI_STAT_INVALID_PARAMETER;
1076    }
1077
1078    if (megasas_is_jbod(s)) {
1079        max_ld_disks = 0;
1080    }
1081    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1082        SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1083        BlockConf *conf = &sdev->conf;
1084
1085        if (num_ld_disks >= max_ld_disks) {
1086            break;
1087        }
1088        /* Logical device size is in blocks */
1089        bdrv_get_geometry(conf->bs, &ld_size);
1090        info.ld_list[num_ld_disks].ld.v.target_id = sdev->id;
1091        info.ld_list[num_ld_disks].ld.v.lun_id = sdev->lun;
1092        info.ld_list[num_ld_disks].state = MFI_LD_STATE_OPTIMAL;
1093        info.ld_list[num_ld_disks].size = cpu_to_le64(ld_size);
1094        num_ld_disks++;
1095    }
1096    info.ld_count = cpu_to_le32(num_ld_disks);
1097    trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1098
1099    resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1100    cmd->iov_size = dcmd_size - resid;
1101    return MFI_STAT_OK;
1102}
1103
1104static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun,
1105                                      MegasasCmd *cmd)
1106{
1107    struct mfi_ld_info *info = cmd->iov_buf;
1108    size_t dcmd_size = sizeof(struct mfi_ld_info);
1109    uint8_t cdb[6];
1110    SCSIRequest *req;
1111    ssize_t len, resid;
1112    BlockConf *conf = &sdev->conf;
1113    uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (lun & 0xFF);
1114    uint64_t ld_size;
1115
1116    if (!cmd->iov_buf) {
1117        cmd->iov_buf = g_malloc(dcmd_size);
1118        memset(cmd->iov_buf, 0x0, dcmd_size);
1119        info = cmd->iov_buf;
1120        megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83));
1121        req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd);
1122        if (!req) {
1123            trace_megasas_dcmd_req_alloc_failed(cmd->index,
1124                                                "LD get info vpd inquiry");
1125            g_free(cmd->iov_buf);
1126            cmd->iov_buf = NULL;
1127            return MFI_STAT_FLASH_ALLOC_FAIL;
1128        }
1129        trace_megasas_dcmd_internal_submit(cmd->index,
1130                                           "LD get info vpd inquiry", lun);
1131        len = scsi_req_enqueue(req);
1132        if (len > 0) {
1133            cmd->iov_size = len;
1134            scsi_req_continue(req);
1135        }
1136        return MFI_STAT_INVALID_STATUS;
1137    }
1138
1139    info->ld_config.params.state = MFI_LD_STATE_OPTIMAL;
1140    info->ld_config.properties.ld.v.target_id = lun;
1141    info->ld_config.params.stripe_size = 3;
1142    info->ld_config.params.num_drives = 1;
1143    info->ld_config.params.is_consistent = 1;
1144    /* Logical device size is in blocks */
1145    bdrv_get_geometry(conf->bs, &ld_size);
1146    info->size = cpu_to_le64(ld_size);
1147    memset(info->ld_config.span, 0, sizeof(info->ld_config.span));
1148    info->ld_config.span[0].start_block = 0;
1149    info->ld_config.span[0].num_blocks = info->size;
1150    info->ld_config.span[0].array_ref = cpu_to_le16(sdev_id);
1151
1152    resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1153    g_free(cmd->iov_buf);
1154    cmd->iov_size = dcmd_size - resid;
1155    cmd->iov_buf = NULL;
1156    return MFI_STAT_OK;
1157}
1158
1159static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
1160{
1161    struct mfi_ld_info info;
1162    size_t dcmd_size = sizeof(info);
1163    uint16_t ld_id;
1164    uint32_t max_ld_disks = s->fw_luns;
1165    SCSIDevice *sdev = NULL;
1166    int retval = MFI_STAT_DEVICE_NOT_FOUND;
1167
1168    if (cmd->iov_size < dcmd_size) {
1169        return MFI_STAT_INVALID_PARAMETER;
1170    }
1171
1172    /* mbox0 has the ID */
1173    ld_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1174    trace_megasas_dcmd_ld_get_info(cmd->index, ld_id);
1175
1176    if (megasas_is_jbod(s)) {
1177        return MFI_STAT_DEVICE_NOT_FOUND;
1178    }
1179
1180    if (ld_id < max_ld_disks) {
1181        sdev = scsi_device_find(&s->bus, 0, ld_id, 0);
1182    }
1183
1184    if (sdev) {
1185        retval = megasas_ld_get_info_submit(sdev, ld_id, cmd);
1186    }
1187
1188    return retval;
1189}
1190
1191static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
1192{
1193    uint8_t data[4096];
1194    struct mfi_config_data *info;
1195    int num_pd_disks = 0, array_offset, ld_offset;
1196    BusChild *kid;
1197
1198    if (cmd->iov_size > 4096) {
1199        return MFI_STAT_INVALID_PARAMETER;
1200    }
1201
1202    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1203        num_pd_disks++;
1204    }
1205    info = (struct mfi_config_data *)&data;
1206    /*
1207     * Array mapping:
1208     * - One array per SCSI device
1209     * - One logical drive per SCSI device
1210     *   spanning the entire device
1211     */
1212    info->array_count = num_pd_disks;
1213    info->array_size = sizeof(struct mfi_array) * num_pd_disks;
1214    info->log_drv_count = num_pd_disks;
1215    info->log_drv_size = sizeof(struct mfi_ld_config) * num_pd_disks;
1216    info->spares_count = 0;
1217    info->spares_size = sizeof(struct mfi_spare);
1218    info->size = sizeof(struct mfi_config_data) + info->array_size +
1219        info->log_drv_size;
1220    if (info->size > 4096) {
1221        return MFI_STAT_INVALID_PARAMETER;
1222    }
1223
1224    array_offset = sizeof(struct mfi_config_data);
1225    ld_offset = array_offset + sizeof(struct mfi_array) * num_pd_disks;
1226
1227    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1228        SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1229        BlockConf *conf = &sdev->conf;
1230        uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
1231        struct mfi_array *array;
1232        struct mfi_ld_config *ld;
1233        uint64_t pd_size;
1234        int i;
1235
1236        array = (struct mfi_array *)(data + array_offset);
1237        bdrv_get_geometry(conf->bs, &pd_size);
1238        array->size = cpu_to_le64(pd_size);
1239        array->num_drives = 1;
1240        array->array_ref = cpu_to_le16(sdev_id);
1241        array->pd[0].ref.v.device_id = cpu_to_le16(sdev_id);
1242        array->pd[0].ref.v.seq_num = 0;
1243        array->pd[0].fw_state = MFI_PD_STATE_ONLINE;
1244        array->pd[0].encl.pd = 0xFF;
1245        array->pd[0].encl.slot = (sdev->id & 0xFF);
1246        for (i = 1; i < MFI_MAX_ROW_SIZE; i++) {
1247            array->pd[i].ref.v.device_id = 0xFFFF;
1248            array->pd[i].ref.v.seq_num = 0;
1249            array->pd[i].fw_state = MFI_PD_STATE_UNCONFIGURED_GOOD;
1250            array->pd[i].encl.pd = 0xFF;
1251            array->pd[i].encl.slot = 0xFF;
1252        }
1253        array_offset += sizeof(struct mfi_array);
1254        ld = (struct mfi_ld_config *)(data + ld_offset);
1255        memset(ld, 0, sizeof(struct mfi_ld_config));
1256        ld->properties.ld.v.target_id = (sdev->id & 0xFF);
1257        ld->properties.default_cache_policy = MR_LD_CACHE_READ_AHEAD |
1258            MR_LD_CACHE_READ_ADAPTIVE;
1259        ld->properties.current_cache_policy = MR_LD_CACHE_READ_AHEAD |
1260            MR_LD_CACHE_READ_ADAPTIVE;
1261        ld->params.state = MFI_LD_STATE_OPTIMAL;
1262        ld->params.stripe_size = 3;
1263        ld->params.num_drives = 1;
1264        ld->params.span_depth = 1;
1265        ld->params.is_consistent = 1;
1266        ld->span[0].start_block = 0;
1267        ld->span[0].num_blocks = cpu_to_le64(pd_size);
1268        ld->span[0].array_ref = cpu_to_le16(sdev_id);
1269        ld_offset += sizeof(struct mfi_ld_config);
1270    }
1271
1272    cmd->iov_size -= dma_buf_read((uint8_t *)data, info->size, &cmd->qsg);
1273    return MFI_STAT_OK;
1274}
1275
1276static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
1277{
1278    struct mfi_ctrl_props info;
1279    size_t dcmd_size = sizeof(info);
1280
1281    memset(&info, 0x0, dcmd_size);
1282    if (cmd->iov_size < dcmd_size) {
1283        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1284                                            dcmd_size);
1285        return MFI_STAT_INVALID_PARAMETER;
1286    }
1287    info.pred_fail_poll_interval = cpu_to_le16(300);
1288    info.intr_throttle_cnt = cpu_to_le16(16);
1289    info.intr_throttle_timeout = cpu_to_le16(50);
1290    info.rebuild_rate = 30;
1291    info.patrol_read_rate = 30;
1292    info.bgi_rate = 30;
1293    info.cc_rate = 30;
1294    info.recon_rate = 30;
1295    info.cache_flush_interval = 4;
1296    info.spinup_drv_cnt = 2;
1297    info.spinup_delay = 6;
1298    info.ecc_bucket_size = 15;
1299    info.ecc_bucket_leak_rate = cpu_to_le16(1440);
1300    info.expose_encl_devices = 1;
1301
1302    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1303    return MFI_STAT_OK;
1304}
1305
1306static int megasas_cache_flush(MegasasState *s, MegasasCmd *cmd)
1307{
1308    bdrv_drain_all();
1309    return MFI_STAT_OK;
1310}
1311
1312static int megasas_ctrl_shutdown(MegasasState *s, MegasasCmd *cmd)
1313{
1314    s->fw_state = MFI_FWSTATE_READY;
1315    return MFI_STAT_OK;
1316}
1317
1318static int megasas_cluster_reset_ld(MegasasState *s, MegasasCmd *cmd)
1319{
1320    return MFI_STAT_INVALID_DCMD;
1321}
1322
1323static int megasas_dcmd_set_properties(MegasasState *s, MegasasCmd *cmd)
1324{
1325    struct mfi_ctrl_props info;
1326    size_t dcmd_size = sizeof(info);
1327
1328    if (cmd->iov_size < dcmd_size) {
1329        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1330                                            dcmd_size);
1331        return MFI_STAT_INVALID_PARAMETER;
1332    }
1333    dma_buf_write((uint8_t *)&info, cmd->iov_size, &cmd->qsg);
1334    trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
1335    return MFI_STAT_OK;
1336}
1337
1338static int megasas_dcmd_dummy(MegasasState *s, MegasasCmd *cmd)
1339{
1340    trace_megasas_dcmd_dummy(cmd->index, cmd->iov_size);
1341    return MFI_STAT_OK;
1342}
1343
1344static const struct dcmd_cmd_tbl_t {
1345    int opcode;
1346    const char *desc;
1347    int (*func)(MegasasState *s, MegasasCmd *cmd);
1348} dcmd_cmd_tbl[] = {
1349    { MFI_DCMD_CTRL_MFI_HOST_MEM_ALLOC, "CTRL_HOST_MEM_ALLOC",
1350      megasas_dcmd_dummy },
1351    { MFI_DCMD_CTRL_GET_INFO, "CTRL_GET_INFO",
1352      megasas_ctrl_get_info },
1353    { MFI_DCMD_CTRL_GET_PROPERTIES, "CTRL_GET_PROPERTIES",
1354      megasas_dcmd_get_properties },
1355    { MFI_DCMD_CTRL_SET_PROPERTIES, "CTRL_SET_PROPERTIES",
1356      megasas_dcmd_set_properties },
1357    { MFI_DCMD_CTRL_ALARM_GET, "CTRL_ALARM_GET",
1358      megasas_dcmd_dummy },
1359    { MFI_DCMD_CTRL_ALARM_ENABLE, "CTRL_ALARM_ENABLE",
1360      megasas_dcmd_dummy },
1361    { MFI_DCMD_CTRL_ALARM_DISABLE, "CTRL_ALARM_DISABLE",
1362      megasas_dcmd_dummy },
1363    { MFI_DCMD_CTRL_ALARM_SILENCE, "CTRL_ALARM_SILENCE",
1364      megasas_dcmd_dummy },
1365    { MFI_DCMD_CTRL_ALARM_TEST, "CTRL_ALARM_TEST",
1366      megasas_dcmd_dummy },
1367    { MFI_DCMD_CTRL_EVENT_GETINFO, "CTRL_EVENT_GETINFO",
1368      megasas_event_info },
1369    { MFI_DCMD_CTRL_EVENT_GET, "CTRL_EVENT_GET",
1370      megasas_dcmd_dummy },
1371    { MFI_DCMD_CTRL_EVENT_WAIT, "CTRL_EVENT_WAIT",
1372      megasas_event_wait },
1373    { MFI_DCMD_CTRL_SHUTDOWN, "CTRL_SHUTDOWN",
1374      megasas_ctrl_shutdown },
1375    { MFI_DCMD_HIBERNATE_STANDBY, "CTRL_STANDBY",
1376      megasas_dcmd_dummy },
1377    { MFI_DCMD_CTRL_GET_TIME, "CTRL_GET_TIME",
1378      megasas_dcmd_get_fw_time },
1379    { MFI_DCMD_CTRL_SET_TIME, "CTRL_SET_TIME",
1380      megasas_dcmd_set_fw_time },
1381    { MFI_DCMD_CTRL_BIOS_DATA_GET, "CTRL_BIOS_DATA_GET",
1382      megasas_dcmd_get_bios_info },
1383    { MFI_DCMD_CTRL_FACTORY_DEFAULTS, "CTRL_FACTORY_DEFAULTS",
1384      megasas_dcmd_dummy },
1385    { MFI_DCMD_CTRL_MFC_DEFAULTS_GET, "CTRL_MFC_DEFAULTS_GET",
1386      megasas_mfc_get_defaults },
1387    { MFI_DCMD_CTRL_MFC_DEFAULTS_SET, "CTRL_MFC_DEFAULTS_SET",
1388      megasas_dcmd_dummy },
1389    { MFI_DCMD_CTRL_CACHE_FLUSH, "CTRL_CACHE_FLUSH",
1390      megasas_cache_flush },
1391    { MFI_DCMD_PD_GET_LIST, "PD_GET_LIST",
1392      megasas_dcmd_pd_get_list },
1393    { MFI_DCMD_PD_LIST_QUERY, "PD_LIST_QUERY",
1394      megasas_dcmd_pd_list_query },
1395    { MFI_DCMD_PD_GET_INFO, "PD_GET_INFO",
1396      megasas_dcmd_pd_get_info },
1397    { MFI_DCMD_PD_STATE_SET, "PD_STATE_SET",
1398      megasas_dcmd_dummy },
1399    { MFI_DCMD_PD_REBUILD, "PD_REBUILD",
1400      megasas_dcmd_dummy },
1401    { MFI_DCMD_PD_BLINK, "PD_BLINK",
1402      megasas_dcmd_dummy },
1403    { MFI_DCMD_PD_UNBLINK, "PD_UNBLINK",
1404      megasas_dcmd_dummy },
1405    { MFI_DCMD_LD_GET_LIST, "LD_GET_LIST",
1406      megasas_dcmd_ld_get_list},
1407    { MFI_DCMD_LD_GET_INFO, "LD_GET_INFO",
1408      megasas_dcmd_ld_get_info },
1409    { MFI_DCMD_LD_GET_PROP, "LD_GET_PROP",
1410      megasas_dcmd_dummy },
1411    { MFI_DCMD_LD_SET_PROP, "LD_SET_PROP",
1412      megasas_dcmd_dummy },
1413    { MFI_DCMD_LD_DELETE, "LD_DELETE",
1414      megasas_dcmd_dummy },
1415    { MFI_DCMD_CFG_READ, "CFG_READ",
1416      megasas_dcmd_cfg_read },
1417    { MFI_DCMD_CFG_ADD, "CFG_ADD",
1418      megasas_dcmd_dummy },
1419    { MFI_DCMD_CFG_CLEAR, "CFG_CLEAR",
1420      megasas_dcmd_dummy },
1421    { MFI_DCMD_CFG_FOREIGN_READ, "CFG_FOREIGN_READ",
1422      megasas_dcmd_dummy },
1423    { MFI_DCMD_CFG_FOREIGN_IMPORT, "CFG_FOREIGN_IMPORT",
1424      megasas_dcmd_dummy },
1425    { MFI_DCMD_BBU_STATUS, "BBU_STATUS",
1426      megasas_dcmd_dummy },
1427    { MFI_DCMD_BBU_CAPACITY_INFO, "BBU_CAPACITY_INFO",
1428      megasas_dcmd_dummy },
1429    { MFI_DCMD_BBU_DESIGN_INFO, "BBU_DESIGN_INFO",
1430      megasas_dcmd_dummy },
1431    { MFI_DCMD_BBU_PROP_GET, "BBU_PROP_GET",
1432      megasas_dcmd_dummy },
1433    { MFI_DCMD_CLUSTER, "CLUSTER",
1434      megasas_dcmd_dummy },
1435    { MFI_DCMD_CLUSTER_RESET_ALL, "CLUSTER_RESET_ALL",
1436      megasas_dcmd_dummy },
1437    { MFI_DCMD_CLUSTER_RESET_LD, "CLUSTER_RESET_LD",
1438      megasas_cluster_reset_ld },
1439    { -1, NULL, NULL }
1440};
1441
1442static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)
1443{
1444    int opcode, len;
1445    int retval = 0;
1446    const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;
1447
1448    opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1449    trace_megasas_handle_dcmd(cmd->index, opcode);
1450    len = megasas_map_dcmd(s, cmd);
1451    if (len < 0) {
1452        return MFI_STAT_MEMORY_NOT_AVAILABLE;
1453    }
1454    while (cmdptr->opcode != -1 && cmdptr->opcode != opcode) {
1455        cmdptr++;
1456    }
1457    if (cmdptr->opcode == -1) {
1458        trace_megasas_dcmd_unhandled(cmd->index, opcode, len);
1459        retval = megasas_dcmd_dummy(s, cmd);
1460    } else {
1461        trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);
1462        retval = cmdptr->func(s, cmd);
1463    }
1464    if (retval != MFI_STAT_INVALID_STATUS) {
1465        megasas_finish_dcmd(cmd, len);
1466    }
1467    return retval;
1468}
1469
1470static int megasas_finish_internal_dcmd(MegasasCmd *cmd,
1471                                        SCSIRequest *req)
1472{
1473    int opcode;
1474    int retval = MFI_STAT_OK;
1475    int lun = req->lun;
1476
1477    opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1478    scsi_req_unref(req);
1479    trace_megasas_dcmd_internal_finish(cmd->index, opcode, lun);
1480    switch (opcode) {
1481    case MFI_DCMD_PD_GET_INFO:
1482        retval = megasas_pd_get_info_submit(req->dev, lun, cmd);
1483        break;
1484    case MFI_DCMD_LD_GET_INFO:
1485        retval = megasas_ld_get_info_submit(req->dev, lun, cmd);
1486        break;
1487    default:
1488        trace_megasas_dcmd_internal_invalid(cmd->index, opcode);
1489        retval = MFI_STAT_INVALID_DCMD;
1490        break;
1491    }
1492    if (retval != MFI_STAT_INVALID_STATUS) {
1493        megasas_finish_dcmd(cmd, cmd->iov_size);
1494    }
1495    return retval;
1496}
1497
1498static int megasas_enqueue_req(MegasasCmd *cmd, bool is_write)
1499{
1500    int len;
1501
1502    len = scsi_req_enqueue(cmd->req);
1503    if (len < 0) {
1504        len = -len;
1505    }
1506    if (len > 0) {
1507        if (len > cmd->iov_size) {
1508            if (is_write) {
1509                trace_megasas_iov_write_overflow(cmd->index, len,
1510                                                 cmd->iov_size);
1511            } else {
1512                trace_megasas_iov_read_overflow(cmd->index, len,
1513                                                cmd->iov_size);
1514            }
1515        }
1516        if (len < cmd->iov_size) {
1517            if (is_write) {
1518                trace_megasas_iov_write_underflow(cmd->index, len,
1519                                                  cmd->iov_size);
1520            } else {
1521                trace_megasas_iov_read_underflow(cmd->index, len,
1522                                                 cmd->iov_size);
1523            }
1524            cmd->iov_size = len;
1525        }
1526        scsi_req_continue(cmd->req);
1527    }
1528    return len;
1529}
1530
1531static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
1532                               bool is_logical)
1533{
1534    uint8_t *cdb;
1535    int len;
1536    bool is_write;
1537    struct SCSIDevice *sdev = NULL;
1538
1539    cdb = cmd->frame->pass.cdb;
1540
1541    if (cmd->frame->header.target_id < s->fw_luns) {
1542        sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1543                                cmd->frame->header.lun_id);
1544    }
1545    cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);
1546    trace_megasas_handle_scsi(mfi_frame_desc[cmd->frame->header.frame_cmd],
1547                              is_logical, cmd->frame->header.target_id,
1548                              cmd->frame->header.lun_id, sdev, cmd->iov_size);
1549
1550    if (!sdev || (megasas_is_jbod(s) && is_logical)) {
1551        trace_megasas_scsi_target_not_present(
1552            mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1553            cmd->frame->header.target_id, cmd->frame->header.lun_id);
1554        return MFI_STAT_DEVICE_NOT_FOUND;
1555    }
1556
1557    if (cmd->frame->header.cdb_len > 16) {
1558        trace_megasas_scsi_invalid_cdb_len(
1559                mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1560                cmd->frame->header.target_id, cmd->frame->header.lun_id,
1561                cmd->frame->header.cdb_len);
1562        megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1563        cmd->frame->header.scsi_status = CHECK_CONDITION;
1564        s->event_count++;
1565        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1566    }
1567
1568    if (megasas_map_sgl(s, cmd, &cmd->frame->pass.sgl)) {
1569        megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1570        cmd->frame->header.scsi_status = CHECK_CONDITION;
1571        s->event_count++;
1572        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1573    }
1574
1575    cmd->req = scsi_req_new(sdev, cmd->index,
1576                            cmd->frame->header.lun_id, cdb, cmd);
1577    if (!cmd->req) {
1578        trace_megasas_scsi_req_alloc_failed(
1579                mfi_frame_desc[cmd->frame->header.frame_cmd],
1580                cmd->frame->header.target_id, cmd->frame->header.lun_id);
1581        megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1582        cmd->frame->header.scsi_status = BUSY;
1583        s->event_count++;
1584        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1585    }
1586
1587    is_write = (cmd->req->cmd.mode == SCSI_XFER_TO_DEV);
1588    len = megasas_enqueue_req(cmd, is_write);
1589    if (len > 0) {
1590        if (is_write) {
1591            trace_megasas_scsi_write_start(cmd->index, len);
1592        } else {
1593            trace_megasas_scsi_read_start(cmd->index, len);
1594        }
1595    } else {
1596        trace_megasas_scsi_nodata(cmd->index);
1597    }
1598    return MFI_STAT_INVALID_STATUS;
1599}
1600
1601static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd)
1602{
1603    uint32_t lba_count, lba_start_hi, lba_start_lo;
1604    uint64_t lba_start;
1605    bool is_write = (cmd->frame->header.frame_cmd == MFI_CMD_LD_WRITE);
1606    uint8_t cdb[16];
1607    int len;
1608    struct SCSIDevice *sdev = NULL;
1609
1610    lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
1611    lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
1612    lba_start_hi = le32_to_cpu(cmd->frame->io.lba_hi);
1613    lba_start = ((uint64_t)lba_start_hi << 32) | lba_start_lo;
1614
1615    if (cmd->frame->header.target_id < s->fw_luns) {
1616        sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1617                                cmd->frame->header.lun_id);
1618    }
1619
1620    trace_megasas_handle_io(cmd->index,
1621                            mfi_frame_desc[cmd->frame->header.frame_cmd],
1622                            cmd->frame->header.target_id,
1623                            cmd->frame->header.lun_id,
1624                            (unsigned long)lba_start, (unsigned long)lba_count);
1625    if (!sdev) {
1626        trace_megasas_io_target_not_present(cmd->index,
1627            mfi_frame_desc[cmd->frame->header.frame_cmd],
1628            cmd->frame->header.target_id, cmd->frame->header.lun_id);
1629        return MFI_STAT_DEVICE_NOT_FOUND;
1630    }
1631
1632    if (cmd->frame->header.cdb_len > 16) {
1633        trace_megasas_scsi_invalid_cdb_len(
1634            mfi_frame_desc[cmd->frame->header.frame_cmd], 1,
1635            cmd->frame->header.target_id, cmd->frame->header.lun_id,
1636            cmd->frame->header.cdb_len);
1637        megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1638        cmd->frame->header.scsi_status = CHECK_CONDITION;
1639        s->event_count++;
1640        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1641    }
1642
1643    cmd->iov_size = lba_count * sdev->blocksize;
1644    if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
1645        megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1646        cmd->frame->header.scsi_status = CHECK_CONDITION;
1647        s->event_count++;
1648        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1649    }
1650
1651    megasas_encode_lba(cdb, lba_start, lba_count, is_write);
1652    cmd->req = scsi_req_new(sdev, cmd->index,
1653                            cmd->frame->header.lun_id, cdb, cmd);
1654    if (!cmd->req) {
1655        trace_megasas_scsi_req_alloc_failed(
1656            mfi_frame_desc[cmd->frame->header.frame_cmd],
1657            cmd->frame->header.target_id, cmd->frame->header.lun_id);
1658        megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1659        cmd->frame->header.scsi_status = BUSY;
1660        s->event_count++;
1661        return MFI_STAT_SCSI_DONE_WITH_ERROR;
1662    }
1663    len = megasas_enqueue_req(cmd, is_write);
1664    if (len > 0) {
1665        if (is_write) {
1666            trace_megasas_io_write_start(cmd->index, lba_start, lba_count, len);
1667        } else {
1668            trace_megasas_io_read_start(cmd->index, lba_start, lba_count, len);
1669        }
1670    }
1671    return MFI_STAT_INVALID_STATUS;
1672}
1673
1674static int megasas_finish_internal_command(MegasasCmd *cmd,
1675                                           SCSIRequest *req, size_t resid)
1676{
1677    int retval = MFI_STAT_INVALID_CMD;
1678
1679    if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1680        cmd->iov_size -= resid;
1681        retval = megasas_finish_internal_dcmd(cmd, req);
1682    }
1683    return retval;
1684}
1685
1686static QEMUSGList *megasas_get_sg_list(SCSIRequest *req)
1687{
1688    MegasasCmd *cmd = req->hba_private;
1689
1690    if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1691        return NULL;
1692    } else {
1693        return &cmd->qsg;
1694    }
1695}
1696
1697static void megasas_xfer_complete(SCSIRequest *req, uint32_t len)
1698{
1699    MegasasCmd *cmd = req->hba_private;
1700    uint8_t *buf;
1701    uint32_t opcode;
1702
1703    trace_megasas_io_complete(cmd->index, len);
1704
1705    if (cmd->frame->header.frame_cmd != MFI_CMD_DCMD) {
1706        scsi_req_continue(req);
1707        return;
1708    }
1709
1710    buf = scsi_req_get_buf(req);
1711    opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1712    if (opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) {
1713        struct mfi_pd_info *info = cmd->iov_buf;
1714
1715        if (info->inquiry_data[0] == 0x7f) {
1716            memset(info->inquiry_data, 0, sizeof(info->inquiry_data));
1717            memcpy(info->inquiry_data, buf, len);
1718        } else if (info->vpd_page83[0] == 0x7f) {
1719            memset(info->vpd_page83, 0, sizeof(info->vpd_page83));
1720            memcpy(info->vpd_page83, buf, len);
1721        }
1722        scsi_req_continue(req);
1723    } else if (opcode == MFI_DCMD_LD_GET_INFO) {
1724        struct mfi_ld_info *info = cmd->iov_buf;
1725
1726        if (cmd->iov_buf) {
1727            memcpy(info->vpd_page83, buf, sizeof(info->vpd_page83));
1728            scsi_req_continue(req);
1729        }
1730    }
1731}
1732
1733static void megasas_command_complete(SCSIRequest *req, uint32_t status,
1734                                     size_t resid)
1735{
1736    MegasasCmd *cmd = req->hba_private;
1737    uint8_t cmd_status = MFI_STAT_OK;
1738
1739    trace_megasas_command_complete(cmd->index, status, resid);
1740
1741    if (cmd->req != req) {
1742        /*
1743         * Internal command complete
1744         */
1745        cmd_status = megasas_finish_internal_command(cmd, req, resid);
1746        if (cmd_status == MFI_STAT_INVALID_STATUS) {
1747            return;
1748        }
1749    } else {
1750        req->status = status;
1751        trace_megasas_scsi_complete(cmd->index, req->status,
1752                                    cmd->iov_size, req->cmd.xfer);
1753        if (req->status != GOOD) {
1754            cmd_status = MFI_STAT_SCSI_DONE_WITH_ERROR;
1755        }
1756        if (req->status == CHECK_CONDITION) {
1757            megasas_copy_sense(cmd);
1758        }
1759
1760        megasas_unmap_sgl(cmd);
1761        cmd->frame->header.scsi_status = req->status;
1762        scsi_req_unref(cmd->req);
1763        cmd->req = NULL;
1764    }
1765    cmd->frame->header.cmd_status = cmd_status;
1766    megasas_complete_frame(cmd->state, cmd->context);
1767}
1768
1769static void megasas_command_cancel(SCSIRequest *req)
1770{
1771    MegasasCmd *cmd = req->hba_private;
1772
1773    if (cmd) {
1774        megasas_abort_command(cmd);
1775    } else {
1776        scsi_req_unref(req);
1777    }
1778}
1779
1780static int megasas_handle_abort(MegasasState *s, MegasasCmd *cmd)
1781{
1782    uint64_t abort_ctx = le64_to_cpu(cmd->frame->abort.abort_context);
1783    hwaddr abort_addr, addr_hi, addr_lo;
1784    MegasasCmd *abort_cmd;
1785
1786    addr_hi = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_hi);
1787    addr_lo = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_lo);
1788    abort_addr = ((uint64_t)addr_hi << 32) | addr_lo;
1789
1790    abort_cmd = megasas_lookup_frame(s, abort_addr);
1791    if (!abort_cmd) {
1792        trace_megasas_abort_no_cmd(cmd->index, abort_ctx);
1793        s->event_count++;
1794        return MFI_STAT_OK;
1795    }
1796    if (!megasas_use_queue64(s)) {
1797        abort_ctx &= (uint64_t)0xFFFFFFFF;
1798    }
1799    if (abort_cmd->context != abort_ctx) {
1800        trace_megasas_abort_invalid_context(cmd->index, abort_cmd->index,
1801                                            abort_cmd->context);
1802        s->event_count++;
1803        return MFI_STAT_ABORT_NOT_POSSIBLE;
1804    }
1805    trace_megasas_abort_frame(cmd->index, abort_cmd->index);
1806    megasas_abort_command(abort_cmd);
1807    if (!s->event_cmd || abort_cmd != s->event_cmd) {
1808        s->event_cmd = NULL;
1809    }
1810    s->event_count++;
1811    return MFI_STAT_OK;
1812}
1813
1814static void megasas_handle_frame(MegasasState *s, uint64_t frame_addr,
1815                                 uint32_t frame_count)
1816{
1817    uint8_t frame_status = MFI_STAT_INVALID_CMD;
1818    uint64_t frame_context;
1819    MegasasCmd *cmd;
1820
1821    /*
1822     * Always read 64bit context, top bits will be
1823     * masked out if required in megasas_enqueue_frame()
1824     */
1825    frame_context = megasas_frame_get_context(frame_addr);
1826
1827    cmd = megasas_enqueue_frame(s, frame_addr, frame_context, frame_count);
1828    if (!cmd) {
1829        /* reply queue full */
1830        trace_megasas_frame_busy(frame_addr);
1831        megasas_frame_set_scsi_status(frame_addr, BUSY);
1832        megasas_frame_set_cmd_status(frame_addr, MFI_STAT_SCSI_DONE_WITH_ERROR);
1833        megasas_complete_frame(s, frame_context);
1834        s->event_count++;
1835        return;
1836    }
1837    switch (cmd->frame->header.frame_cmd) {
1838    case MFI_CMD_INIT:
1839        frame_status = megasas_init_firmware(s, cmd);
1840        break;
1841    case MFI_CMD_DCMD:
1842        frame_status = megasas_handle_dcmd(s, cmd);
1843        break;
1844    case MFI_CMD_ABORT:
1845        frame_status = megasas_handle_abort(s, cmd);
1846        break;
1847    case MFI_CMD_PD_SCSI_IO:
1848        frame_status = megasas_handle_scsi(s, cmd, 0);
1849        break;
1850    case MFI_CMD_LD_SCSI_IO:
1851        frame_status = megasas_handle_scsi(s, cmd, 1);
1852        break;
1853    case MFI_CMD_LD_READ:
1854    case MFI_CMD_LD_WRITE:
1855        frame_status = megasas_handle_io(s, cmd);
1856        break;
1857    default:
1858        trace_megasas_unhandled_frame_cmd(cmd->index,
1859                                          cmd->frame->header.frame_cmd);
1860        s->event_count++;
1861        break;
1862    }
1863    if (frame_status != MFI_STAT_INVALID_STATUS) {
1864        if (cmd->frame) {
1865            cmd->frame->header.cmd_status = frame_status;
1866        } else {
1867            megasas_frame_set_cmd_status(frame_addr, frame_status);
1868        }
1869        megasas_complete_frame(s, cmd->context);
1870    }
1871}
1872
1873static uint64_t megasas_mmio_read(void *opaque, hwaddr addr,
1874                                  unsigned size)
1875{
1876    MegasasState *s = opaque;
1877    uint32_t retval = 0;
1878
1879    switch (addr) {
1880    case MFI_IDB:
1881        retval = 0;
1882        break;
1883    case MFI_OMSG0:
1884    case MFI_OSP0:
1885        retval = (megasas_use_msix(s) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |
1886            (s->fw_state & MFI_FWSTATE_MASK) |
1887            ((s->fw_sge & 0xff) << 16) |
1888            (s->fw_cmds & 0xFFFF);
1889        break;
1890    case MFI_OSTS:
1891        if (megasas_intr_enabled(s) && s->doorbell) {
1892            retval = MFI_1078_RM | 1;
1893        }
1894        break;
1895    case MFI_OMSK:
1896        retval = s->intr_mask;
1897        break;
1898    case MFI_ODCR0:
1899        retval = s->doorbell;
1900        break;
1901    default:
1902        trace_megasas_mmio_invalid_readl(addr);
1903        break;
1904    }
1905    trace_megasas_mmio_readl(addr, retval);
1906    return retval;
1907}
1908
1909static void megasas_mmio_write(void *opaque, hwaddr addr,
1910                               uint64_t val, unsigned size)
1911{
1912    MegasasState *s = opaque;
1913    PCIDevice *pci_dev = PCI_DEVICE(s);
1914    uint64_t frame_addr;
1915    uint32_t frame_count;
1916    int i;
1917
1918    trace_megasas_mmio_writel(addr, val);
1919    switch (addr) {
1920    case MFI_IDB:
1921        if (val & MFI_FWINIT_ABORT) {
1922            /* Abort all pending cmds */
1923            for (i = 0; i < s->fw_cmds; i++) {
1924                megasas_abort_command(&s->frames[i]);
1925            }
1926        }
1927        if (val & MFI_FWINIT_READY) {
1928            /* move to FW READY */
1929            megasas_soft_reset(s);
1930        }
1931        if (val & MFI_FWINIT_MFIMODE) {
1932            /* discard MFIs */
1933        }
1934        break;
1935    case MFI_OMSK:
1936        s->intr_mask = val;
1937        if (!megasas_intr_enabled(s) && !msix_enabled(pci_dev)) {
1938            trace_megasas_irq_lower();
1939            qemu_irq_lower(pci_dev->irq[0]);
1940        }
1941        if (megasas_intr_enabled(s)) {
1942            trace_megasas_intr_enabled();
1943        } else {
1944            trace_megasas_intr_disabled();
1945        }
1946        break;
1947    case MFI_ODCR0:
1948        s->doorbell = 0;
1949        if (s->producer_pa && megasas_intr_enabled(s)) {
1950            /* Update reply queue pointer */
1951            trace_megasas_qf_update(s->reply_queue_head, s->busy);
1952            stl_le_phys(s->producer_pa, s->reply_queue_head);
1953            if (!msix_enabled(pci_dev)) {
1954                trace_megasas_irq_lower();
1955                qemu_irq_lower(pci_dev->irq[0]);
1956            }
1957        }
1958        break;
1959    case MFI_IQPH:
1960        /* Received high 32 bits of a 64 bit MFI frame address */
1961        s->frame_hi = val;
1962        break;
1963    case MFI_IQPL:
1964        /* Received low 32 bits of a 64 bit MFI frame address */
1965    case MFI_IQP:
1966        /* Received 32 bit MFI frame address */
1967        frame_addr = (val & ~0x1F);
1968        /* Add possible 64 bit offset */
1969        frame_addr |= ((uint64_t)s->frame_hi << 32);
1970        s->frame_hi = 0;
1971        frame_count = (val >> 1) & 0xF;
1972        megasas_handle_frame(s, frame_addr, frame_count);
1973        break;
1974    default:
1975        trace_megasas_mmio_invalid_writel(addr, val);
1976        break;
1977    }
1978}
1979
1980static const MemoryRegionOps megasas_mmio_ops = {
1981    .read = megasas_mmio_read,
1982    .write = megasas_mmio_write,
1983    .endianness = DEVICE_LITTLE_ENDIAN,
1984    .impl = {
1985        .min_access_size = 8,
1986        .max_access_size = 8,
1987    }
1988};
1989
1990static uint64_t megasas_port_read(void *opaque, hwaddr addr,
1991                                  unsigned size)
1992{
1993    return megasas_mmio_read(opaque, addr & 0xff, size);
1994}
1995
1996static void megasas_port_write(void *opaque, hwaddr addr,
1997                               uint64_t val, unsigned size)
1998{
1999    megasas_mmio_write(opaque, addr & 0xff, val, size);
2000}
2001
2002static const MemoryRegionOps megasas_port_ops = {
2003    .read = megasas_port_read,
2004    .write = megasas_port_write,
2005    .endianness = DEVICE_LITTLE_ENDIAN,
2006    .impl = {
2007        .min_access_size = 4,
2008        .max_access_size = 4,
2009    }
2010};
2011
2012static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
2013                                   unsigned size)
2014{
2015    return 0;
2016}
2017
2018static const MemoryRegionOps megasas_queue_ops = {
2019    .read = megasas_queue_read,
2020    .endianness = DEVICE_LITTLE_ENDIAN,
2021    .impl = {
2022        .min_access_size = 8,
2023        .max_access_size = 8,
2024    }
2025};
2026
2027static void megasas_soft_reset(MegasasState *s)
2028{
2029    int i;
2030    MegasasCmd *cmd;
2031
2032    trace_megasas_reset();
2033    for (i = 0; i < s->fw_cmds; i++) {
2034        cmd = &s->frames[i];
2035        megasas_abort_command(cmd);
2036    }
2037    megasas_reset_frames(s);
2038    s->reply_queue_len = s->fw_cmds;
2039    s->reply_queue_pa = 0;
2040    s->consumer_pa = 0;
2041    s->producer_pa = 0;
2042    s->fw_state = MFI_FWSTATE_READY;
2043    s->doorbell = 0;
2044    s->intr_mask = MEGASAS_INTR_DISABLED_MASK;
2045    s->frame_hi = 0;
2046    s->flags &= ~MEGASAS_MASK_USE_QUEUE64;
2047    s->event_count++;
2048    s->boot_event = s->event_count;
2049}
2050
2051static void megasas_scsi_reset(DeviceState *dev)
2052{
2053    MegasasState *s = MEGASAS(dev);
2054
2055    megasas_soft_reset(s);
2056}
2057
2058static const VMStateDescription vmstate_megasas = {
2059    .name = "megasas",
2060    .version_id = 0,
2061    .minimum_version_id = 0,
2062    .minimum_version_id_old = 0,
2063    .fields      = (VMStateField[]) {
2064        VMSTATE_PCI_DEVICE(parent_obj, MegasasState),
2065
2066        VMSTATE_INT32(fw_state, MegasasState),
2067        VMSTATE_INT32(intr_mask, MegasasState),
2068        VMSTATE_INT32(doorbell, MegasasState),
2069        VMSTATE_UINT64(reply_queue_pa, MegasasState),
2070        VMSTATE_UINT64(consumer_pa, MegasasState),
2071        VMSTATE_UINT64(producer_pa, MegasasState),
2072        VMSTATE_END_OF_LIST()
2073    }
2074};
2075
2076static void megasas_scsi_uninit(PCIDevice *d)
2077{
2078    MegasasState *s = MEGASAS(d);
2079
2080#ifdef USE_MSIX
2081    msix_uninit(d, &s->mmio_io);
2082#endif
2083    memory_region_destroy(&s->mmio_io);
2084    memory_region_destroy(&s->port_io);
2085    memory_region_destroy(&s->queue_io);
2086}
2087
2088static const struct SCSIBusInfo megasas_scsi_info = {
2089    .tcq = true,
2090    .max_target = MFI_MAX_LD,
2091    .max_lun = 255,
2092
2093    .transfer_data = megasas_xfer_complete,
2094    .get_sg_list = megasas_get_sg_list,
2095    .complete = megasas_command_complete,
2096    .cancel = megasas_command_cancel,
2097};
2098
2099static int megasas_scsi_init(PCIDevice *dev)
2100{
2101    DeviceState *d = DEVICE(dev);
2102    MegasasState *s = MEGASAS(dev);
2103    uint8_t *pci_conf;
2104    int i, bar_type;
2105    Error *err = NULL;
2106
2107    pci_conf = dev->config;
2108
2109    /* PCI latency timer = 0 */
2110    pci_conf[PCI_LATENCY_TIMER] = 0;
2111    /* Interrupt pin 1 */
2112    pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2113
2114    memory_region_init_io(&s->mmio_io, OBJECT(s), &megasas_mmio_ops, s,
2115                          "megasas-mmio", 0x4000);
2116    memory_region_init_io(&s->port_io, OBJECT(s), &megasas_port_ops, s,
2117                          "megasas-io", 256);
2118    memory_region_init_io(&s->queue_io, OBJECT(s), &megasas_queue_ops, s,
2119                          "megasas-queue", 0x40000);
2120
2121#ifdef USE_MSIX
2122    /* MSI-X support is currently broken */
2123    if (megasas_use_msix(s) &&
2124        msix_init(dev, 15, &s->mmio_io, 0, 0x2000)) {
2125        s->flags &= ~MEGASAS_MASK_USE_MSIX;
2126    }
2127#else
2128    s->flags &= ~MEGASAS_MASK_USE_MSIX;
2129#endif
2130
2131    bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
2132    pci_register_bar(dev, 0, bar_type, &s->mmio_io);
2133    pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
2134    pci_register_bar(dev, 3, bar_type, &s->queue_io);
2135
2136    if (megasas_use_msix(s)) {
2137        msix_vector_use(dev, 0);
2138    }
2139
2140    if (!s->sas_addr) {
2141        s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
2142                       IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
2143        s->sas_addr |= (pci_bus_num(dev->bus) << 16);
2144        s->sas_addr |= (PCI_SLOT(dev->devfn) << 8);
2145        s->sas_addr |= PCI_FUNC(dev->devfn);
2146    }
2147    if (!s->hba_serial) {
2148        s->hba_serial = g_strdup(MEGASAS_HBA_SERIAL);
2149    }
2150    if (s->fw_sge >= MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE) {
2151        s->fw_sge = MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE;
2152    } else if (s->fw_sge >= 128 - MFI_PASS_FRAME_SIZE) {
2153        s->fw_sge = 128 - MFI_PASS_FRAME_SIZE;
2154    } else {
2155        s->fw_sge = 64 - MFI_PASS_FRAME_SIZE;
2156    }
2157    if (s->fw_cmds > MEGASAS_MAX_FRAMES) {
2158        s->fw_cmds = MEGASAS_MAX_FRAMES;
2159    }
2160    trace_megasas_init(s->fw_sge, s->fw_cmds,
2161                       megasas_use_msix(s) ? "MSI-X" : "INTx",
2162                       megasas_is_jbod(s) ? "jbod" : "raid");
2163    s->fw_luns = (MFI_MAX_LD > MAX_SCSI_DEVS) ?
2164        MAX_SCSI_DEVS : MFI_MAX_LD;
2165    s->producer_pa = 0;
2166    s->consumer_pa = 0;
2167    for (i = 0; i < s->fw_cmds; i++) {
2168        s->frames[i].index = i;
2169        s->frames[i].context = -1;
2170        s->frames[i].pa = 0;
2171        s->frames[i].state = s;
2172    }
2173
2174    scsi_bus_new(&s->bus, DEVICE(dev), &megasas_scsi_info, NULL);
2175    if (!d->hotplugged) {
2176        scsi_bus_legacy_handle_cmdline(&s->bus, &err);
2177        if (err != NULL) {
2178            error_free(err);
2179            return -1;
2180        }
2181    }
2182    return 0;
2183}
2184
2185static Property megasas_properties[] = {
2186    DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2187                       MEGASAS_DEFAULT_SGE),
2188    DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2189                       MEGASAS_DEFAULT_FRAMES),
2190    DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2191    DEFINE_PROP_HEX64("sas_address", MegasasState, sas_addr, 0),
2192#ifdef USE_MSIX
2193    DEFINE_PROP_BIT("use_msix", MegasasState, flags,
2194                    MEGASAS_FLAG_USE_MSIX, false),
2195#endif
2196    DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2197                    MEGASAS_FLAG_USE_JBOD, false),
2198    DEFINE_PROP_END_OF_LIST(),
2199};
2200
2201static void megasas_class_init(ObjectClass *oc, void *data)
2202{
2203    DeviceClass *dc = DEVICE_CLASS(oc);
2204    PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
2205
2206    pc->init = megasas_scsi_init;
2207    pc->exit = megasas_scsi_uninit;
2208    pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2209    pc->device_id = PCI_DEVICE_ID_LSI_SAS1078;
2210    pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2211    pc->subsystem_id = 0x1013;
2212    pc->class_id = PCI_CLASS_STORAGE_RAID;
2213    dc->props = megasas_properties;
2214    dc->reset = megasas_scsi_reset;
2215    dc->vmsd = &vmstate_megasas;
2216    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
2217    dc->desc = "LSI MegaRAID SAS 1078";
2218}
2219
2220static const TypeInfo megasas_info = {
2221    .name  = TYPE_MEGASAS,
2222    .parent = TYPE_PCI_DEVICE,
2223    .instance_size = sizeof(MegasasState),
2224    .class_init = megasas_class_init,
2225};
2226
2227static void megasas_register_types(void)
2228{
2229    type_register_static(&megasas_info);
2230}
2231
2232type_init(megasas_register_types)
2233