qemu/hw/scsi/mptsas.c
<<
>>
Prefs
   1/*
   2 * QEMU LSI SAS1068 Host Bus Adapter emulation
   3 * Based on the QEMU Megaraid emulator
   4 *
   5 * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
   6 * Copyright (c) 2012 Verizon, Inc.
   7 * Copyright (c) 2016 Red Hat, Inc.
   8 *
   9 * Authors: Don Slutz, Paolo Bonzini
  10 *
  11 * This library is free software; you can redistribute it and/or
  12 * modify it under the terms of the GNU Lesser General Public
  13 * License as published by the Free Software Foundation; either
  14 * version 2 of the License, or (at your option) any later version.
  15 *
  16 * This library is distributed in the hope that it will be useful,
  17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19 * Lesser General Public License for more details.
  20 *
  21 * You should have received a copy of the GNU Lesser General Public
  22 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25#include "qemu/osdep.h"
  26#include "hw/hw.h"
  27#include "hw/pci/pci.h"
  28#include "sysemu/dma.h"
  29#include "sysemu/block-backend.h"
  30#include "hw/pci/msi.h"
  31#include "qemu/iov.h"
  32#include "hw/scsi/scsi.h"
  33#include "scsi/constants.h"
  34#include "trace.h"
  35#include "qapi/error.h"
  36#include "mptsas.h"
  37#include "mpi.h"
  38
  39#define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
  40#define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
  41
  42#define TYPE_MPTSAS1068 "mptsas1068"
  43
  44#define MPT_SAS(obj) \
  45    OBJECT_CHECK(MPTSASState, (obj), TYPE_MPTSAS1068)
  46
  47#define MPTSAS1068_PRODUCT_ID                  \
  48    (MPI_FW_HEADER_PID_FAMILY_1068_SAS |       \
  49     MPI_FW_HEADER_PID_PROD_INITIATOR_SCSI |   \
  50     MPI_FW_HEADER_PID_TYPE_SAS)
  51
  52struct MPTSASRequest {
  53    MPIMsgSCSIIORequest scsi_io;
  54    SCSIRequest *sreq;
  55    QEMUSGList qsg;
  56    MPTSASState *dev;
  57
  58    QTAILQ_ENTRY(MPTSASRequest) next;
  59};
  60
  61static void mptsas_update_interrupt(MPTSASState *s)
  62{
  63    PCIDevice *pci = (PCIDevice *) s;
  64    uint32_t state = s->intr_status & ~(s->intr_mask | MPI_HIS_IOP_DOORBELL_STATUS);
  65
  66    if (msi_enabled(pci)) {
  67        if (state) {
  68            trace_mptsas_irq_msi(s);
  69            msi_notify(pci, 0);
  70        }
  71    }
  72
  73    trace_mptsas_irq_intx(s, !!state);
  74    pci_set_irq(pci, !!state);
  75}
  76
  77static void mptsas_set_fault(MPTSASState *s, uint32_t code)
  78{
  79    if ((s->state & MPI_IOC_STATE_FAULT) == 0) {
  80        s->state = MPI_IOC_STATE_FAULT | code;
  81    }
  82}
  83
  84#define MPTSAS_FIFO_INVALID(s, name)                     \
  85    ((s)->name##_head > ARRAY_SIZE((s)->name) ||         \
  86     (s)->name##_tail > ARRAY_SIZE((s)->name))
  87
  88#define MPTSAS_FIFO_EMPTY(s, name)                       \
  89    ((s)->name##_head == (s)->name##_tail)
  90
  91#define MPTSAS_FIFO_FULL(s, name)                        \
  92    ((s)->name##_head == ((s)->name##_tail + 1) % ARRAY_SIZE((s)->name))
  93
  94#define MPTSAS_FIFO_GET(s, name) ({                      \
  95    uint32_t _val = (s)->name[(s)->name##_head++];       \
  96    (s)->name##_head %= ARRAY_SIZE((s)->name);           \
  97    _val;                                                \
  98})
  99
 100#define MPTSAS_FIFO_PUT(s, name, val) do {       \
 101    (s)->name[(s)->name##_tail++] = (val);       \
 102    (s)->name##_tail %= ARRAY_SIZE((s)->name);   \
 103} while(0)
 104
 105static void mptsas_post_reply(MPTSASState *s, MPIDefaultReply *reply)
 106{
 107    PCIDevice *pci = (PCIDevice *) s;
 108    uint32_t addr_lo;
 109
 110    if (MPTSAS_FIFO_EMPTY(s, reply_free) || MPTSAS_FIFO_FULL(s, reply_post)) {
 111        mptsas_set_fault(s, MPI_IOCSTATUS_INSUFFICIENT_RESOURCES);
 112        return;
 113    }
 114
 115    addr_lo = MPTSAS_FIFO_GET(s, reply_free);
 116
 117    pci_dma_write(pci, addr_lo | s->host_mfa_high_addr, reply,
 118                  MIN(s->reply_frame_size, 4 * reply->MsgLength));
 119
 120    MPTSAS_FIFO_PUT(s, reply_post, MPI_ADDRESS_REPLY_A_BIT | (addr_lo >> 1));
 121
 122    s->intr_status |= MPI_HIS_REPLY_MESSAGE_INTERRUPT;
 123    if (s->doorbell_state == DOORBELL_WRITE) {
 124        s->doorbell_state = DOORBELL_NONE;
 125        s->intr_status |= MPI_HIS_DOORBELL_INTERRUPT;
 126    }
 127    mptsas_update_interrupt(s);
 128}
 129
 130void mptsas_reply(MPTSASState *s, MPIDefaultReply *reply)
 131{
 132    if (s->doorbell_state == DOORBELL_WRITE) {
 133        /* The reply is sent out in 16 bit chunks, while the size
 134         * in the reply is in 32 bit units.
 135         */
 136        s->doorbell_state = DOORBELL_READ;
 137        s->doorbell_reply_idx = 0;
 138        s->doorbell_reply_size = reply->MsgLength * 2;
 139        memcpy(s->doorbell_reply, reply, s->doorbell_reply_size * 2);
 140        s->intr_status |= MPI_HIS_DOORBELL_INTERRUPT;
 141        mptsas_update_interrupt(s);
 142    } else {
 143        mptsas_post_reply(s, reply);
 144    }
 145}
 146
 147static void mptsas_turbo_reply(MPTSASState *s, uint32_t msgctx)
 148{
 149    if (MPTSAS_FIFO_FULL(s, reply_post)) {
 150        mptsas_set_fault(s, MPI_IOCSTATUS_INSUFFICIENT_RESOURCES);
 151        return;
 152    }
 153
 154    /* The reply is just the message context ID (bit 31 = clear). */
 155    MPTSAS_FIFO_PUT(s, reply_post, msgctx);
 156
 157    s->intr_status |= MPI_HIS_REPLY_MESSAGE_INTERRUPT;
 158    mptsas_update_interrupt(s);
 159}
 160
 161#define MPTSAS_MAX_REQUEST_SIZE 52
 162
 163static const int mpi_request_sizes[] = {
 164    [MPI_FUNCTION_SCSI_IO_REQUEST]    = sizeof(MPIMsgSCSIIORequest),
 165    [MPI_FUNCTION_SCSI_TASK_MGMT]     = sizeof(MPIMsgSCSITaskMgmt),
 166    [MPI_FUNCTION_IOC_INIT]           = sizeof(MPIMsgIOCInit),
 167    [MPI_FUNCTION_IOC_FACTS]          = sizeof(MPIMsgIOCFacts),
 168    [MPI_FUNCTION_CONFIG]             = sizeof(MPIMsgConfig),
 169    [MPI_FUNCTION_PORT_FACTS]         = sizeof(MPIMsgPortFacts),
 170    [MPI_FUNCTION_PORT_ENABLE]        = sizeof(MPIMsgPortEnable),
 171    [MPI_FUNCTION_EVENT_NOTIFICATION] = sizeof(MPIMsgEventNotify),
 172};
 173
 174static dma_addr_t mptsas_ld_sg_base(MPTSASState *s, uint32_t flags_and_length,
 175                                    dma_addr_t *sgaddr)
 176{
 177    PCIDevice *pci = (PCIDevice *) s;
 178    dma_addr_t addr;
 179
 180    if (flags_and_length & MPI_SGE_FLAGS_64_BIT_ADDRESSING) {
 181        addr = ldq_le_pci_dma(pci, *sgaddr + 4);
 182        *sgaddr += 12;
 183    } else {
 184        addr = ldl_le_pci_dma(pci, *sgaddr + 4);
 185        *sgaddr += 8;
 186    }
 187    return addr;
 188}
 189
 190static int mptsas_build_sgl(MPTSASState *s, MPTSASRequest *req, hwaddr addr)
 191{
 192    PCIDevice *pci = (PCIDevice *) s;
 193    hwaddr next_chain_addr;
 194    uint32_t left;
 195    hwaddr sgaddr;
 196    uint32_t chain_offset;
 197
 198    chain_offset = req->scsi_io.ChainOffset;
 199    next_chain_addr = addr + chain_offset * sizeof(uint32_t);
 200    sgaddr = addr + sizeof(MPIMsgSCSIIORequest);
 201    pci_dma_sglist_init(&req->qsg, pci, 4);
 202    left = req->scsi_io.DataLength;
 203
 204    for(;;) {
 205        dma_addr_t addr, len;
 206        uint32_t flags_and_length;
 207
 208        flags_and_length = ldl_le_pci_dma(pci, sgaddr);
 209        len = flags_and_length & MPI_SGE_LENGTH_MASK;
 210        if ((flags_and_length & MPI_SGE_FLAGS_ELEMENT_TYPE_MASK)
 211            != MPI_SGE_FLAGS_SIMPLE_ELEMENT ||
 212            (!len &&
 213             !(flags_and_length & MPI_SGE_FLAGS_END_OF_LIST) &&
 214             !(flags_and_length & MPI_SGE_FLAGS_END_OF_BUFFER))) {
 215            return MPI_IOCSTATUS_INVALID_SGL;
 216        }
 217
 218        len = MIN(len, left);
 219        if (!len) {
 220            /* We reached the desired transfer length, ignore extra
 221             * elements of the s/g list.
 222             */
 223            break;
 224        }
 225
 226        addr = mptsas_ld_sg_base(s, flags_and_length, &sgaddr);
 227        qemu_sglist_add(&req->qsg, addr, len);
 228        left -= len;
 229
 230        if (flags_and_length & MPI_SGE_FLAGS_END_OF_LIST) {
 231            break;
 232        }
 233
 234        if (flags_and_length & MPI_SGE_FLAGS_LAST_ELEMENT) {
 235            if (!chain_offset) {
 236                break;
 237            }
 238
 239            flags_and_length = ldl_le_pci_dma(pci, next_chain_addr);
 240            if ((flags_and_length & MPI_SGE_FLAGS_ELEMENT_TYPE_MASK)
 241                != MPI_SGE_FLAGS_CHAIN_ELEMENT) {
 242                return MPI_IOCSTATUS_INVALID_SGL;
 243            }
 244
 245            sgaddr = mptsas_ld_sg_base(s, flags_and_length, &next_chain_addr);
 246            chain_offset =
 247                (flags_and_length & MPI_SGE_CHAIN_OFFSET_MASK) >> MPI_SGE_CHAIN_OFFSET_SHIFT;
 248            next_chain_addr = sgaddr + chain_offset * sizeof(uint32_t);
 249        }
 250    }
 251    return 0;
 252}
 253
 254static void mptsas_free_request(MPTSASRequest *req)
 255{
 256    MPTSASState *s = req->dev;
 257
 258    if (req->sreq != NULL) {
 259        req->sreq->hba_private = NULL;
 260        scsi_req_unref(req->sreq);
 261        req->sreq = NULL;
 262        QTAILQ_REMOVE(&s->pending, req, next);
 263    }
 264    qemu_sglist_destroy(&req->qsg);
 265    g_free(req);
 266}
 267
 268static int mptsas_scsi_device_find(MPTSASState *s, int bus, int target,
 269                                   uint8_t *lun, SCSIDevice **sdev)
 270{
 271    if (bus != 0) {
 272        return MPI_IOCSTATUS_SCSI_INVALID_BUS;
 273    }
 274
 275    if (target >= s->max_devices) {
 276        return MPI_IOCSTATUS_SCSI_INVALID_TARGETID;
 277    }
 278
 279    *sdev = scsi_device_find(&s->bus, bus, target, lun[1]);
 280    if (!*sdev) {
 281        return MPI_IOCSTATUS_SCSI_DEVICE_NOT_THERE;
 282    }
 283
 284    return 0;
 285}
 286
 287static int mptsas_process_scsi_io_request(MPTSASState *s,
 288                                          MPIMsgSCSIIORequest *scsi_io,
 289                                          hwaddr addr)
 290{
 291    MPTSASRequest *req;
 292    MPIMsgSCSIIOReply reply;
 293    SCSIDevice *sdev;
 294    int status;
 295
 296    mptsas_fix_scsi_io_endianness(scsi_io);
 297
 298    trace_mptsas_process_scsi_io_request(s, scsi_io->Bus, scsi_io->TargetID,
 299                                         scsi_io->LUN[1], scsi_io->DataLength);
 300
 301    status = mptsas_scsi_device_find(s, scsi_io->Bus, scsi_io->TargetID,
 302                                     scsi_io->LUN, &sdev);
 303    if (status) {
 304        goto bad;
 305    }
 306
 307    req = g_new0(MPTSASRequest, 1);
 308    QTAILQ_INSERT_TAIL(&s->pending, req, next);
 309    req->scsi_io = *scsi_io;
 310    req->dev = s;
 311
 312    status = mptsas_build_sgl(s, req, addr);
 313    if (status) {
 314        goto free_bad;
 315    }
 316
 317    if (req->qsg.size < scsi_io->DataLength) {
 318        trace_mptsas_sgl_overflow(s, scsi_io->MsgContext, scsi_io->DataLength,
 319                                  req->qsg.size);
 320        status = MPI_IOCSTATUS_INVALID_SGL;
 321        goto free_bad;
 322    }
 323
 324    req->sreq = scsi_req_new(sdev, scsi_io->MsgContext,
 325                            scsi_io->LUN[1], scsi_io->CDB, req);
 326
 327    if (req->sreq->cmd.xfer > scsi_io->DataLength) {
 328        goto overrun;
 329    }
 330    switch (scsi_io->Control & MPI_SCSIIO_CONTROL_DATADIRECTION_MASK) {
 331    case MPI_SCSIIO_CONTROL_NODATATRANSFER:
 332        if (req->sreq->cmd.mode != SCSI_XFER_NONE) {
 333            goto overrun;
 334        }
 335        break;
 336
 337    case MPI_SCSIIO_CONTROL_WRITE:
 338        if (req->sreq->cmd.mode != SCSI_XFER_TO_DEV) {
 339            goto overrun;
 340        }
 341        break;
 342
 343    case MPI_SCSIIO_CONTROL_READ:
 344        if (req->sreq->cmd.mode != SCSI_XFER_FROM_DEV) {
 345            goto overrun;
 346        }
 347        break;
 348    }
 349
 350    if (scsi_req_enqueue(req->sreq)) {
 351        scsi_req_continue(req->sreq);
 352    }
 353    return 0;
 354
 355overrun:
 356    trace_mptsas_scsi_overflow(s, scsi_io->MsgContext, req->sreq->cmd.xfer,
 357                               scsi_io->DataLength);
 358    status = MPI_IOCSTATUS_SCSI_DATA_OVERRUN;
 359free_bad:
 360    mptsas_free_request(req);
 361bad:
 362    memset(&reply, 0, sizeof(reply));
 363    reply.TargetID          = scsi_io->TargetID;
 364    reply.Bus               = scsi_io->Bus;
 365    reply.MsgLength         = sizeof(reply) / 4;
 366    reply.Function          = scsi_io->Function;
 367    reply.CDBLength         = scsi_io->CDBLength;
 368    reply.SenseBufferLength = scsi_io->SenseBufferLength;
 369    reply.MsgContext        = scsi_io->MsgContext;
 370    reply.SCSIState         = MPI_SCSI_STATE_NO_SCSI_STATUS;
 371    reply.IOCStatus         = status;
 372
 373    mptsas_fix_scsi_io_reply_endianness(&reply);
 374    mptsas_reply(s, (MPIDefaultReply *)&reply);
 375
 376    return 0;
 377}
 378
 379typedef struct {
 380    Notifier                notifier;
 381    MPTSASState             *s;
 382    MPIMsgSCSITaskMgmtReply *reply;
 383} MPTSASCancelNotifier;
 384
 385static void mptsas_cancel_notify(Notifier *notifier, void *data)
 386{
 387    MPTSASCancelNotifier *n = container_of(notifier,
 388                                           MPTSASCancelNotifier,
 389                                           notifier);
 390
 391    /* Abusing IOCLogInfo to store the expected number of requests... */
 392    if (++n->reply->TerminationCount == n->reply->IOCLogInfo) {
 393        n->reply->IOCLogInfo = 0;
 394        mptsas_fix_scsi_task_mgmt_reply_endianness(n->reply);
 395        mptsas_post_reply(n->s, (MPIDefaultReply *)n->reply);
 396        g_free(n->reply);
 397    }
 398    g_free(n);
 399}
 400
 401static void mptsas_process_scsi_task_mgmt(MPTSASState *s, MPIMsgSCSITaskMgmt *req)
 402{
 403    MPIMsgSCSITaskMgmtReply reply;
 404    MPIMsgSCSITaskMgmtReply *reply_async;
 405    int status, count;
 406    SCSIDevice *sdev;
 407    SCSIRequest *r, *next;
 408    BusChild *kid;
 409
 410    mptsas_fix_scsi_task_mgmt_endianness(req);
 411
 412    QEMU_BUILD_BUG_ON(MPTSAS_MAX_REQUEST_SIZE < sizeof(*req));
 413    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_msg) < sizeof(*req));
 414    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_reply) < sizeof(reply));
 415
 416    memset(&reply, 0, sizeof(reply));
 417    reply.TargetID   = req->TargetID;
 418    reply.Bus        = req->Bus;
 419    reply.MsgLength  = sizeof(reply) / 4;
 420    reply.Function   = req->Function;
 421    reply.TaskType   = req->TaskType;
 422    reply.MsgContext = req->MsgContext;
 423
 424    switch (req->TaskType) {
 425    case MPI_SCSITASKMGMT_TASKTYPE_ABORT_TASK:
 426    case MPI_SCSITASKMGMT_TASKTYPE_QUERY_TASK:
 427        status = mptsas_scsi_device_find(s, req->Bus, req->TargetID,
 428                                         req->LUN, &sdev);
 429        if (status) {
 430            reply.IOCStatus = status;
 431            goto out;
 432        }
 433        if (sdev->lun != req->LUN[1]) {
 434            reply.ResponseCode = MPI_SCSITASKMGMT_RSP_TM_INVALID_LUN;
 435            goto out;
 436        }
 437
 438        QTAILQ_FOREACH_SAFE(r, &sdev->requests, next, next) {
 439            MPTSASRequest *cmd_req = r->hba_private;
 440            if (cmd_req && cmd_req->scsi_io.MsgContext == req->TaskMsgContext) {
 441                break;
 442            }
 443        }
 444        if (r) {
 445            /*
 446             * Assert that the request has not been completed yet, we
 447             * check for it in the loop above.
 448             */
 449            assert(r->hba_private);
 450            if (req->TaskType == MPI_SCSITASKMGMT_TASKTYPE_QUERY_TASK) {
 451                /* "If the specified command is present in the task set, then
 452                 * return a service response set to FUNCTION SUCCEEDED".
 453                 */
 454                reply.ResponseCode = MPI_SCSITASKMGMT_RSP_TM_SUCCEEDED;
 455            } else {
 456                MPTSASCancelNotifier *notifier;
 457
 458                reply_async = g_memdup(&reply, sizeof(MPIMsgSCSITaskMgmtReply));
 459                reply_async->IOCLogInfo = INT_MAX;
 460
 461                count = 1;
 462                notifier = g_new(MPTSASCancelNotifier, 1);
 463                notifier->s = s;
 464                notifier->reply = reply_async;
 465                notifier->notifier.notify = mptsas_cancel_notify;
 466                scsi_req_cancel_async(r, &notifier->notifier);
 467                goto reply_maybe_async;
 468            }
 469        }
 470        break;
 471
 472    case MPI_SCSITASKMGMT_TASKTYPE_ABRT_TASK_SET:
 473    case MPI_SCSITASKMGMT_TASKTYPE_CLEAR_TASK_SET:
 474        status = mptsas_scsi_device_find(s, req->Bus, req->TargetID,
 475                                         req->LUN, &sdev);
 476        if (status) {
 477            reply.IOCStatus = status;
 478            goto out;
 479        }
 480        if (sdev->lun != req->LUN[1]) {
 481            reply.ResponseCode = MPI_SCSITASKMGMT_RSP_TM_INVALID_LUN;
 482            goto out;
 483        }
 484
 485        reply_async = g_memdup(&reply, sizeof(MPIMsgSCSITaskMgmtReply));
 486        reply_async->IOCLogInfo = INT_MAX;
 487
 488        count = 0;
 489        QTAILQ_FOREACH_SAFE(r, &sdev->requests, next, next) {
 490            if (r->hba_private) {
 491                MPTSASCancelNotifier *notifier;
 492
 493                count++;
 494                notifier = g_new(MPTSASCancelNotifier, 1);
 495                notifier->s = s;
 496                notifier->reply = reply_async;
 497                notifier->notifier.notify = mptsas_cancel_notify;
 498                scsi_req_cancel_async(r, &notifier->notifier);
 499            }
 500        }
 501
 502reply_maybe_async:
 503        if (reply_async->TerminationCount < count) {
 504            reply_async->IOCLogInfo = count;
 505            return;
 506        }
 507        g_free(reply_async);
 508        reply.TerminationCount = count;
 509        break;
 510
 511    case MPI_SCSITASKMGMT_TASKTYPE_LOGICAL_UNIT_RESET:
 512        status = mptsas_scsi_device_find(s, req->Bus, req->TargetID,
 513                                         req->LUN, &sdev);
 514        if (status) {
 515            reply.IOCStatus = status;
 516            goto out;
 517        }
 518        if (sdev->lun != req->LUN[1]) {
 519            reply.ResponseCode = MPI_SCSITASKMGMT_RSP_TM_INVALID_LUN;
 520            goto out;
 521        }
 522        qdev_reset_all(&sdev->qdev);
 523        break;
 524
 525    case MPI_SCSITASKMGMT_TASKTYPE_TARGET_RESET:
 526        if (req->Bus != 0) {
 527            reply.IOCStatus = MPI_IOCSTATUS_SCSI_INVALID_BUS;
 528            goto out;
 529        }
 530        if (req->TargetID > s->max_devices) {
 531            reply.IOCStatus = MPI_IOCSTATUS_SCSI_INVALID_TARGETID;
 532            goto out;
 533        }
 534
 535        QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 536            sdev = SCSI_DEVICE(kid->child);
 537            if (sdev->channel == 0 && sdev->id == req->TargetID) {
 538                qdev_reset_all(kid->child);
 539            }
 540        }
 541        break;
 542
 543    case MPI_SCSITASKMGMT_TASKTYPE_RESET_BUS:
 544        qbus_reset_all(&s->bus.qbus);
 545        break;
 546
 547    default:
 548        reply.ResponseCode = MPI_SCSITASKMGMT_RSP_TM_NOT_SUPPORTED;
 549        break;
 550    }
 551
 552out:
 553    mptsas_fix_scsi_task_mgmt_reply_endianness(&reply);
 554    mptsas_post_reply(s, (MPIDefaultReply *)&reply);
 555}
 556
 557static void mptsas_process_ioc_init(MPTSASState *s, MPIMsgIOCInit *req)
 558{
 559    MPIMsgIOCInitReply reply;
 560
 561    mptsas_fix_ioc_init_endianness(req);
 562
 563    QEMU_BUILD_BUG_ON(MPTSAS_MAX_REQUEST_SIZE < sizeof(*req));
 564    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_msg) < sizeof(*req));
 565    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_reply) < sizeof(reply));
 566
 567    s->who_init               = req->WhoInit;
 568    s->reply_frame_size       = req->ReplyFrameSize;
 569    s->max_buses              = req->MaxBuses;
 570    s->max_devices            = req->MaxDevices ? req->MaxDevices : 256;
 571    s->host_mfa_high_addr     = (hwaddr)req->HostMfaHighAddr << 32;
 572    s->sense_buffer_high_addr = (hwaddr)req->SenseBufferHighAddr << 32;
 573
 574    if (s->state == MPI_IOC_STATE_READY) {
 575        s->state = MPI_IOC_STATE_OPERATIONAL;
 576    }
 577
 578    memset(&reply, 0, sizeof(reply));
 579    reply.WhoInit    = s->who_init;
 580    reply.MsgLength  = sizeof(reply) / 4;
 581    reply.Function   = req->Function;
 582    reply.MaxDevices = s->max_devices;
 583    reply.MaxBuses   = s->max_buses;
 584    reply.MsgContext = req->MsgContext;
 585
 586    mptsas_fix_ioc_init_reply_endianness(&reply);
 587    mptsas_reply(s, (MPIDefaultReply *)&reply);
 588}
 589
 590static void mptsas_process_ioc_facts(MPTSASState *s,
 591                                     MPIMsgIOCFacts *req)
 592{
 593    MPIMsgIOCFactsReply reply;
 594
 595    mptsas_fix_ioc_facts_endianness(req);
 596
 597    QEMU_BUILD_BUG_ON(MPTSAS_MAX_REQUEST_SIZE < sizeof(*req));
 598    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_msg) < sizeof(*req));
 599    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_reply) < sizeof(reply));
 600
 601    memset(&reply, 0, sizeof(reply));
 602    reply.MsgVersion                 = 0x0105;
 603    reply.MsgLength                  = sizeof(reply) / 4;
 604    reply.Function                   = req->Function;
 605    reply.MsgContext                 = req->MsgContext;
 606    reply.MaxChainDepth              = MPTSAS_MAXIMUM_CHAIN_DEPTH;
 607    reply.WhoInit                    = s->who_init;
 608    reply.BlockSize                  = MPTSAS_MAX_REQUEST_SIZE / sizeof(uint32_t);
 609    reply.ReplyQueueDepth            = ARRAY_SIZE(s->reply_post) - 1;
 610    QEMU_BUILD_BUG_ON(ARRAY_SIZE(s->reply_post) != ARRAY_SIZE(s->reply_free));
 611
 612    reply.RequestFrameSize           = 128;
 613    reply.ProductID                  = MPTSAS1068_PRODUCT_ID;
 614    reply.CurrentHostMfaHighAddr     = s->host_mfa_high_addr >> 32;
 615    reply.GlobalCredits              = ARRAY_SIZE(s->request_post) - 1;
 616    reply.NumberOfPorts              = MPTSAS_NUM_PORTS;
 617    reply.CurrentSenseBufferHighAddr = s->sense_buffer_high_addr >> 32;
 618    reply.CurReplyFrameSize          = s->reply_frame_size;
 619    reply.MaxDevices                 = s->max_devices;
 620    reply.MaxBuses                   = s->max_buses;
 621    reply.FWVersionDev               = 0;
 622    reply.FWVersionUnit              = 0x92;
 623    reply.FWVersionMinor             = 0x32;
 624    reply.FWVersionMajor             = 0x1;
 625
 626    mptsas_fix_ioc_facts_reply_endianness(&reply);
 627    mptsas_reply(s, (MPIDefaultReply *)&reply);
 628}
 629
 630static void mptsas_process_port_facts(MPTSASState *s,
 631                                     MPIMsgPortFacts *req)
 632{
 633    MPIMsgPortFactsReply reply;
 634
 635    mptsas_fix_port_facts_endianness(req);
 636
 637    QEMU_BUILD_BUG_ON(MPTSAS_MAX_REQUEST_SIZE < sizeof(*req));
 638    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_msg) < sizeof(*req));
 639    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_reply) < sizeof(reply));
 640
 641    memset(&reply, 0, sizeof(reply));
 642    reply.MsgLength  = sizeof(reply) / 4;
 643    reply.Function   = req->Function;
 644    reply.PortNumber = req->PortNumber;
 645    reply.MsgContext = req->MsgContext;
 646
 647    if (req->PortNumber < MPTSAS_NUM_PORTS) {
 648        reply.PortType      = MPI_PORTFACTS_PORTTYPE_SAS;
 649        reply.MaxDevices    = MPTSAS_NUM_PORTS;
 650        reply.PortSCSIID    = MPTSAS_NUM_PORTS;
 651        reply.ProtocolFlags = MPI_PORTFACTS_PROTOCOL_LOGBUSADDR | MPI_PORTFACTS_PROTOCOL_INITIATOR;
 652    }
 653
 654    mptsas_fix_port_facts_reply_endianness(&reply);
 655    mptsas_reply(s, (MPIDefaultReply *)&reply);
 656}
 657
 658static void mptsas_process_port_enable(MPTSASState *s,
 659                                       MPIMsgPortEnable *req)
 660{
 661    MPIMsgPortEnableReply reply;
 662
 663    mptsas_fix_port_enable_endianness(req);
 664
 665    QEMU_BUILD_BUG_ON(MPTSAS_MAX_REQUEST_SIZE < sizeof(*req));
 666    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_msg) < sizeof(*req));
 667    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_reply) < sizeof(reply));
 668
 669    memset(&reply, 0, sizeof(reply));
 670    reply.MsgLength  = sizeof(reply) / 4;
 671    reply.PortNumber = req->PortNumber;
 672    reply.Function   = req->Function;
 673    reply.MsgContext = req->MsgContext;
 674
 675    mptsas_fix_port_enable_reply_endianness(&reply);
 676    mptsas_reply(s, (MPIDefaultReply *)&reply);
 677}
 678
 679static void mptsas_process_event_notification(MPTSASState *s,
 680                                              MPIMsgEventNotify *req)
 681{
 682    MPIMsgEventNotifyReply reply;
 683
 684    mptsas_fix_event_notification_endianness(req);
 685
 686    QEMU_BUILD_BUG_ON(MPTSAS_MAX_REQUEST_SIZE < sizeof(*req));
 687    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_msg) < sizeof(*req));
 688    QEMU_BUILD_BUG_ON(sizeof(s->doorbell_reply) < sizeof(reply));
 689
 690    /* Don't even bother storing whether event notification is enabled,
 691     * since it is not accessible.
 692     */
 693
 694    memset(&reply, 0, sizeof(reply));
 695    reply.EventDataLength = sizeof(reply.Data) / 4;
 696    reply.MsgLength       = sizeof(reply) / 4;
 697    reply.Function        = req->Function;
 698
 699    /* This is set because events are sent through the reply FIFOs.  */
 700    reply.MsgFlags        = MPI_MSGFLAGS_CONTINUATION_REPLY;
 701
 702    reply.MsgContext      = req->MsgContext;
 703    reply.Event           = MPI_EVENT_EVENT_CHANGE;
 704    reply.Data[0]         = !!req->Switch;
 705
 706    mptsas_fix_event_notification_reply_endianness(&reply);
 707    mptsas_reply(s, (MPIDefaultReply *)&reply);
 708}
 709
 710static void mptsas_process_message(MPTSASState *s, MPIRequestHeader *req)
 711{
 712    trace_mptsas_process_message(s, req->Function, req->MsgContext);
 713    switch (req->Function) {
 714    case MPI_FUNCTION_SCSI_TASK_MGMT:
 715        mptsas_process_scsi_task_mgmt(s, (MPIMsgSCSITaskMgmt *)req);
 716        break;
 717
 718    case MPI_FUNCTION_IOC_INIT:
 719        mptsas_process_ioc_init(s, (MPIMsgIOCInit *)req);
 720        break;
 721
 722    case MPI_FUNCTION_IOC_FACTS:
 723        mptsas_process_ioc_facts(s, (MPIMsgIOCFacts *)req);
 724        break;
 725
 726    case MPI_FUNCTION_PORT_FACTS:
 727        mptsas_process_port_facts(s, (MPIMsgPortFacts *)req);
 728        break;
 729
 730    case MPI_FUNCTION_PORT_ENABLE:
 731        mptsas_process_port_enable(s, (MPIMsgPortEnable *)req);
 732        break;
 733
 734    case MPI_FUNCTION_EVENT_NOTIFICATION:
 735        mptsas_process_event_notification(s, (MPIMsgEventNotify *)req);
 736        break;
 737
 738    case MPI_FUNCTION_CONFIG:
 739        mptsas_process_config(s, (MPIMsgConfig *)req);
 740        break;
 741
 742    default:
 743        trace_mptsas_unhandled_cmd(s, req->Function, 0);
 744        mptsas_set_fault(s, MPI_IOCSTATUS_INVALID_FUNCTION);
 745        break;
 746    }
 747}
 748
 749static void mptsas_fetch_request(MPTSASState *s)
 750{
 751    PCIDevice *pci = (PCIDevice *) s;
 752    char req[MPTSAS_MAX_REQUEST_SIZE];
 753    MPIRequestHeader *hdr = (MPIRequestHeader *)req;
 754    hwaddr addr;
 755    int size;
 756
 757    /* Read the message header from the guest first. */
 758    addr = s->host_mfa_high_addr | MPTSAS_FIFO_GET(s, request_post);
 759    pci_dma_read(pci, addr, req, sizeof(*hdr));
 760
 761    if (hdr->Function < ARRAY_SIZE(mpi_request_sizes) &&
 762        mpi_request_sizes[hdr->Function]) {
 763        /* Read the rest of the request based on the type.  Do not
 764         * reread everything, as that could cause a TOC/TOU mismatch
 765         * and leak data from the QEMU stack.
 766         */
 767        size = mpi_request_sizes[hdr->Function];
 768        assert(size <= MPTSAS_MAX_REQUEST_SIZE);
 769        pci_dma_read(pci, addr + sizeof(*hdr), &req[sizeof(*hdr)],
 770                     size - sizeof(*hdr));
 771    }
 772
 773    if (hdr->Function == MPI_FUNCTION_SCSI_IO_REQUEST) {
 774        /* SCSI I/O requests are separate from mptsas_process_message
 775         * because they cannot be sent through the doorbell yet.
 776         */
 777        mptsas_process_scsi_io_request(s, (MPIMsgSCSIIORequest *)req, addr);
 778    } else {
 779        mptsas_process_message(s, (MPIRequestHeader *)req);
 780    }
 781}
 782
 783static void mptsas_fetch_requests(void *opaque)
 784{
 785    MPTSASState *s = opaque;
 786
 787    if (s->state != MPI_IOC_STATE_OPERATIONAL) {
 788        mptsas_set_fault(s, MPI_IOCSTATUS_INVALID_STATE);
 789        return;
 790    }
 791    while (!MPTSAS_FIFO_EMPTY(s, request_post)) {
 792        mptsas_fetch_request(s);
 793    }
 794}
 795
 796static void mptsas_soft_reset(MPTSASState *s)
 797{
 798    uint32_t save_mask;
 799
 800    trace_mptsas_reset(s);
 801
 802    /* Temporarily disable interrupts */
 803    save_mask = s->intr_mask;
 804    s->intr_mask = MPI_HIM_DIM | MPI_HIM_RIM;
 805    mptsas_update_interrupt(s);
 806
 807    qbus_reset_all(&s->bus.qbus);
 808    s->intr_status = 0;
 809    s->intr_mask = save_mask;
 810
 811    s->reply_free_tail = 0;
 812    s->reply_free_head = 0;
 813    s->reply_post_tail = 0;
 814    s->reply_post_head = 0;
 815    s->request_post_tail = 0;
 816    s->request_post_head = 0;
 817    qemu_bh_cancel(s->request_bh);
 818
 819    s->state = MPI_IOC_STATE_READY;
 820}
 821
 822static uint32_t mptsas_doorbell_read(MPTSASState *s)
 823{
 824    uint32_t ret;
 825
 826    ret = (s->who_init << MPI_DOORBELL_WHO_INIT_SHIFT) & MPI_DOORBELL_WHO_INIT_MASK;
 827    ret |= s->state;
 828    switch (s->doorbell_state) {
 829    case DOORBELL_NONE:
 830        break;
 831
 832    case DOORBELL_WRITE:
 833        ret |= MPI_DOORBELL_ACTIVE;
 834        break;
 835
 836    case DOORBELL_READ:
 837        /* Get rid of the IOC fault code.  */
 838        ret &= ~MPI_DOORBELL_DATA_MASK;
 839
 840        assert(s->intr_status & MPI_HIS_DOORBELL_INTERRUPT);
 841        assert(s->doorbell_reply_idx <= s->doorbell_reply_size);
 842
 843        ret |= MPI_DOORBELL_ACTIVE;
 844        if (s->doorbell_reply_idx < s->doorbell_reply_size) {
 845            /* For more information about this endian switch, see the
 846             * commit message for commit 36b62ae ("fw_cfg: fix endianness in
 847             * fw_cfg_data_mem_read() / _write()", 2015-01-16).
 848             */
 849            ret |= le16_to_cpu(s->doorbell_reply[s->doorbell_reply_idx++]);
 850        }
 851        break;
 852
 853    default:
 854        abort();
 855    }
 856
 857    return ret;
 858}
 859
 860static void mptsas_doorbell_write(MPTSASState *s, uint32_t val)
 861{
 862    if (s->doorbell_state == DOORBELL_WRITE) {
 863        if (s->doorbell_idx < s->doorbell_cnt) {
 864            /* For more information about this endian switch, see the
 865             * commit message for commit 36b62ae ("fw_cfg: fix endianness in
 866             * fw_cfg_data_mem_read() / _write()", 2015-01-16).
 867             */
 868            s->doorbell_msg[s->doorbell_idx++] = cpu_to_le32(val);
 869            if (s->doorbell_idx == s->doorbell_cnt) {
 870                mptsas_process_message(s, (MPIRequestHeader *)s->doorbell_msg);
 871            }
 872        }
 873        return;
 874    }
 875
 876    switch ((val & MPI_DOORBELL_FUNCTION_MASK) >> MPI_DOORBELL_FUNCTION_SHIFT) {
 877    case MPI_FUNCTION_IOC_MESSAGE_UNIT_RESET:
 878        mptsas_soft_reset(s);
 879        break;
 880    case MPI_FUNCTION_IO_UNIT_RESET:
 881        break;
 882    case MPI_FUNCTION_HANDSHAKE:
 883        s->doorbell_state = DOORBELL_WRITE;
 884        s->doorbell_idx = 0;
 885        s->doorbell_cnt = (val & MPI_DOORBELL_ADD_DWORDS_MASK)
 886            >> MPI_DOORBELL_ADD_DWORDS_SHIFT;
 887        s->intr_status |= MPI_HIS_DOORBELL_INTERRUPT;
 888        mptsas_update_interrupt(s);
 889        break;
 890    default:
 891        trace_mptsas_unhandled_doorbell_cmd(s, val);
 892        break;
 893    }
 894}
 895
 896static void mptsas_write_sequence_write(MPTSASState *s, uint32_t val)
 897{
 898    /* If the diagnostic register is enabled, any write to this register
 899     * will disable it.  Otherwise, the guest has to do a magic five-write
 900     * sequence.
 901     */
 902    if (s->diagnostic & MPI_DIAG_DRWE) {
 903        goto disable;
 904    }
 905
 906    switch (s->diagnostic_idx) {
 907    case 0:
 908        if ((val & MPI_WRSEQ_KEY_VALUE_MASK) != MPI_WRSEQ_1ST_KEY_VALUE) {
 909            goto disable;
 910        }
 911        break;
 912    case 1:
 913        if ((val & MPI_WRSEQ_KEY_VALUE_MASK) != MPI_WRSEQ_2ND_KEY_VALUE) {
 914            goto disable;
 915        }
 916        break;
 917    case 2:
 918        if ((val & MPI_WRSEQ_KEY_VALUE_MASK) != MPI_WRSEQ_3RD_KEY_VALUE) {
 919            goto disable;
 920        }
 921        break;
 922    case 3:
 923        if ((val & MPI_WRSEQ_KEY_VALUE_MASK) != MPI_WRSEQ_4TH_KEY_VALUE) {
 924            goto disable;
 925        }
 926        break;
 927    case 4:
 928        if ((val & MPI_WRSEQ_KEY_VALUE_MASK) != MPI_WRSEQ_5TH_KEY_VALUE) {
 929            goto disable;
 930        }
 931        /* Prepare Spaceball One for departure, and change the
 932         * combination on my luggage!
 933         */
 934        s->diagnostic |= MPI_DIAG_DRWE;
 935        break;
 936    }
 937    s->diagnostic_idx++;
 938    return;
 939
 940disable:
 941    s->diagnostic &= ~MPI_DIAG_DRWE;
 942    s->diagnostic_idx = 0;
 943}
 944
 945static int mptsas_hard_reset(MPTSASState *s)
 946{
 947    mptsas_soft_reset(s);
 948
 949    s->intr_mask = MPI_HIM_DIM | MPI_HIM_RIM;
 950
 951    s->host_mfa_high_addr = 0;
 952    s->sense_buffer_high_addr = 0;
 953    s->reply_frame_size = 0;
 954    s->max_devices = MPTSAS_NUM_PORTS;
 955    s->max_buses = 1;
 956
 957    return 0;
 958}
 959
 960static void mptsas_interrupt_status_write(MPTSASState *s)
 961{
 962    switch (s->doorbell_state) {
 963    case DOORBELL_NONE:
 964    case DOORBELL_WRITE:
 965        s->intr_status &= ~MPI_HIS_DOORBELL_INTERRUPT;
 966        break;
 967
 968    case DOORBELL_READ:
 969        /* The reply can be read continuously, so leave the interrupt up.  */
 970        assert(s->intr_status & MPI_HIS_DOORBELL_INTERRUPT);
 971        if (s->doorbell_reply_idx == s->doorbell_reply_size) {
 972            s->doorbell_state = DOORBELL_NONE;
 973        }
 974        break;
 975
 976    default:
 977        abort();
 978    }
 979    mptsas_update_interrupt(s);
 980}
 981
 982static uint32_t mptsas_reply_post_read(MPTSASState *s)
 983{
 984    uint32_t ret;
 985
 986    if (!MPTSAS_FIFO_EMPTY(s, reply_post)) {
 987        ret = MPTSAS_FIFO_GET(s, reply_post);
 988    } else {
 989        ret = -1;
 990        s->intr_status &= ~MPI_HIS_REPLY_MESSAGE_INTERRUPT;
 991        mptsas_update_interrupt(s);
 992    }
 993
 994    return ret;
 995}
 996
 997static uint64_t mptsas_mmio_read(void *opaque, hwaddr addr,
 998                                  unsigned size)
 999{
1000    MPTSASState *s = opaque;
1001    uint32_t ret = 0;
1002
1003    switch (addr & ~3) {
1004    case MPI_DOORBELL_OFFSET:
1005        ret = mptsas_doorbell_read(s);
1006        break;
1007
1008    case MPI_DIAGNOSTIC_OFFSET:
1009        ret = s->diagnostic;
1010        break;
1011
1012    case MPI_HOST_INTERRUPT_STATUS_OFFSET:
1013        ret = s->intr_status;
1014        break;
1015
1016    case MPI_HOST_INTERRUPT_MASK_OFFSET:
1017        ret = s->intr_mask;
1018        break;
1019
1020    case MPI_REPLY_POST_FIFO_OFFSET:
1021        ret = mptsas_reply_post_read(s);
1022        break;
1023
1024    default:
1025        trace_mptsas_mmio_unhandled_read(s, addr);
1026        break;
1027    }
1028    trace_mptsas_mmio_read(s, addr, ret);
1029    return ret;
1030}
1031
1032static void mptsas_mmio_write(void *opaque, hwaddr addr,
1033                               uint64_t val, unsigned size)
1034{
1035    MPTSASState *s = opaque;
1036
1037    trace_mptsas_mmio_write(s, addr, val);
1038    switch (addr) {
1039    case MPI_DOORBELL_OFFSET:
1040        mptsas_doorbell_write(s, val);
1041        break;
1042
1043    case MPI_WRITE_SEQUENCE_OFFSET:
1044        mptsas_write_sequence_write(s, val);
1045        break;
1046
1047    case MPI_DIAGNOSTIC_OFFSET:
1048        if (val & MPI_DIAG_RESET_ADAPTER) {
1049            mptsas_hard_reset(s);
1050        }
1051        break;
1052
1053    case MPI_HOST_INTERRUPT_STATUS_OFFSET:
1054        mptsas_interrupt_status_write(s);
1055        break;
1056
1057    case MPI_HOST_INTERRUPT_MASK_OFFSET:
1058        s->intr_mask = val & (MPI_HIM_RIM | MPI_HIM_DIM);
1059        mptsas_update_interrupt(s);
1060        break;
1061
1062    case MPI_REQUEST_POST_FIFO_OFFSET:
1063        if (MPTSAS_FIFO_FULL(s, request_post)) {
1064            mptsas_set_fault(s, MPI_IOCSTATUS_INSUFFICIENT_RESOURCES);
1065        } else {
1066            MPTSAS_FIFO_PUT(s, request_post, val & ~0x03);
1067            qemu_bh_schedule(s->request_bh);
1068        }
1069        break;
1070
1071    case MPI_REPLY_FREE_FIFO_OFFSET:
1072        if (MPTSAS_FIFO_FULL(s, reply_free)) {
1073            mptsas_set_fault(s, MPI_IOCSTATUS_INSUFFICIENT_RESOURCES);
1074        } else {
1075            MPTSAS_FIFO_PUT(s, reply_free, val);
1076        }
1077        break;
1078
1079    default:
1080        trace_mptsas_mmio_unhandled_write(s, addr, val);
1081        break;
1082    }
1083}
1084
1085static const MemoryRegionOps mptsas_mmio_ops = {
1086    .read = mptsas_mmio_read,
1087    .write = mptsas_mmio_write,
1088    .endianness = DEVICE_LITTLE_ENDIAN,
1089    .impl = {
1090        .min_access_size = 4,
1091        .max_access_size = 4,
1092    }
1093};
1094
1095static const MemoryRegionOps mptsas_port_ops = {
1096    .read = mptsas_mmio_read,
1097    .write = mptsas_mmio_write,
1098    .endianness = DEVICE_LITTLE_ENDIAN,
1099    .impl = {
1100        .min_access_size = 4,
1101        .max_access_size = 4,
1102    }
1103};
1104
1105static uint64_t mptsas_diag_read(void *opaque, hwaddr addr,
1106                                   unsigned size)
1107{
1108    MPTSASState *s = opaque;
1109    trace_mptsas_diag_read(s, addr, 0);
1110    return 0;
1111}
1112
1113static void mptsas_diag_write(void *opaque, hwaddr addr,
1114                               uint64_t val, unsigned size)
1115{
1116    MPTSASState *s = opaque;
1117    trace_mptsas_diag_write(s, addr, val);
1118}
1119
1120static const MemoryRegionOps mptsas_diag_ops = {
1121    .read = mptsas_diag_read,
1122    .write = mptsas_diag_write,
1123    .endianness = DEVICE_LITTLE_ENDIAN,
1124    .impl = {
1125        .min_access_size = 4,
1126        .max_access_size = 4,
1127    }
1128};
1129
1130static QEMUSGList *mptsas_get_sg_list(SCSIRequest *sreq)
1131{
1132    MPTSASRequest *req = sreq->hba_private;
1133
1134    return &req->qsg;
1135}
1136
1137static void mptsas_command_complete(SCSIRequest *sreq,
1138        uint32_t status, size_t resid)
1139{
1140    MPTSASRequest *req = sreq->hba_private;
1141    MPTSASState *s = req->dev;
1142    uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
1143    uint8_t sense_len;
1144
1145    hwaddr sense_buffer_addr = req->dev->sense_buffer_high_addr |
1146            req->scsi_io.SenseBufferLowAddr;
1147
1148    trace_mptsas_command_complete(s, req->scsi_io.MsgContext, status, resid);
1149
1150    sense_len = scsi_req_get_sense(sreq, sense_buf, SCSI_SENSE_BUF_SIZE);
1151    if (sense_len > 0) {
1152        pci_dma_write(PCI_DEVICE(s), sense_buffer_addr, sense_buf,
1153                      MIN(req->scsi_io.SenseBufferLength, sense_len));
1154    }
1155
1156    if (sreq->status != GOOD || resid ||
1157        req->dev->doorbell_state == DOORBELL_WRITE) {
1158        MPIMsgSCSIIOReply reply;
1159
1160        memset(&reply, 0, sizeof(reply));
1161        reply.TargetID          = req->scsi_io.TargetID;
1162        reply.Bus               = req->scsi_io.Bus;
1163        reply.MsgLength         = sizeof(reply) / 4;
1164        reply.Function          = req->scsi_io.Function;
1165        reply.CDBLength         = req->scsi_io.CDBLength;
1166        reply.SenseBufferLength = req->scsi_io.SenseBufferLength;
1167        reply.MsgFlags          = req->scsi_io.MsgFlags;
1168        reply.MsgContext        = req->scsi_io.MsgContext;
1169        reply.SCSIStatus        = sreq->status;
1170        if (sreq->status == GOOD) {
1171            reply.TransferCount = req->scsi_io.DataLength - resid;
1172            if (resid) {
1173                reply.IOCStatus     = MPI_IOCSTATUS_SCSI_DATA_UNDERRUN;
1174            }
1175        } else {
1176            reply.SCSIState     = MPI_SCSI_STATE_AUTOSENSE_VALID;
1177            reply.SenseCount    = sense_len;
1178            reply.IOCStatus     = MPI_IOCSTATUS_SCSI_DATA_UNDERRUN;
1179        }
1180
1181        mptsas_fix_scsi_io_reply_endianness(&reply);
1182        mptsas_post_reply(req->dev, (MPIDefaultReply *)&reply);
1183    } else {
1184        mptsas_turbo_reply(req->dev, req->scsi_io.MsgContext);
1185    }
1186
1187    mptsas_free_request(req);
1188}
1189
1190static void mptsas_request_cancelled(SCSIRequest *sreq)
1191{
1192    MPTSASRequest *req = sreq->hba_private;
1193    MPIMsgSCSIIOReply reply;
1194
1195    memset(&reply, 0, sizeof(reply));
1196    reply.TargetID          = req->scsi_io.TargetID;
1197    reply.Bus               = req->scsi_io.Bus;
1198    reply.MsgLength         = sizeof(reply) / 4;
1199    reply.Function          = req->scsi_io.Function;
1200    reply.CDBLength         = req->scsi_io.CDBLength;
1201    reply.SenseBufferLength = req->scsi_io.SenseBufferLength;
1202    reply.MsgFlags          = req->scsi_io.MsgFlags;
1203    reply.MsgContext        = req->scsi_io.MsgContext;
1204    reply.SCSIState         = MPI_SCSI_STATE_NO_SCSI_STATUS;
1205    reply.IOCStatus         = MPI_IOCSTATUS_SCSI_TASK_TERMINATED;
1206
1207    mptsas_fix_scsi_io_reply_endianness(&reply);
1208    mptsas_post_reply(req->dev, (MPIDefaultReply *)&reply);
1209    mptsas_free_request(req);
1210}
1211
1212static void mptsas_save_request(QEMUFile *f, SCSIRequest *sreq)
1213{
1214    MPTSASRequest *req = sreq->hba_private;
1215    int i;
1216
1217    qemu_put_buffer(f, (unsigned char *)&req->scsi_io, sizeof(req->scsi_io));
1218    qemu_put_be32(f, req->qsg.nsg);
1219    for (i = 0; i < req->qsg.nsg; i++) {
1220        qemu_put_be64(f, req->qsg.sg[i].base);
1221        qemu_put_be64(f, req->qsg.sg[i].len);
1222    }
1223}
1224
1225static void *mptsas_load_request(QEMUFile *f, SCSIRequest *sreq)
1226{
1227    SCSIBus *bus = sreq->bus;
1228    MPTSASState *s = container_of(bus, MPTSASState, bus);
1229    PCIDevice *pci = PCI_DEVICE(s);
1230    MPTSASRequest *req;
1231    int i, n;
1232
1233    req = g_new(MPTSASRequest, 1);
1234    qemu_get_buffer(f, (unsigned char *)&req->scsi_io, sizeof(req->scsi_io));
1235
1236    n = qemu_get_be32(f);
1237    /* TODO: add a way for SCSIBusInfo's load_request to fail,
1238     * and fail migration instead of asserting here.
1239     * This is just one thing (there are probably more) that must be
1240     * fixed before we can allow NDEBUG compilation.
1241     */
1242    assert(n >= 0);
1243
1244    pci_dma_sglist_init(&req->qsg, pci, n);
1245    for (i = 0; i < n; i++) {
1246        uint64_t base = qemu_get_be64(f);
1247        uint64_t len = qemu_get_be64(f);
1248        qemu_sglist_add(&req->qsg, base, len);
1249    }
1250
1251    scsi_req_ref(sreq);
1252    req->sreq = sreq;
1253    req->dev = s;
1254
1255    return req;
1256}
1257
1258static const struct SCSIBusInfo mptsas_scsi_info = {
1259    .tcq = true,
1260    .max_target = MPTSAS_NUM_PORTS,
1261    .max_lun = 1,
1262
1263    .get_sg_list = mptsas_get_sg_list,
1264    .complete = mptsas_command_complete,
1265    .cancel = mptsas_request_cancelled,
1266    .save_request = mptsas_save_request,
1267    .load_request = mptsas_load_request,
1268};
1269
1270static void mptsas_scsi_realize(PCIDevice *dev, Error **errp)
1271{
1272    MPTSASState *s = MPT_SAS(dev);
1273    Error *err = NULL;
1274    int ret;
1275
1276    dev->config[PCI_LATENCY_TIMER] = 0;
1277    dev->config[PCI_INTERRUPT_PIN] = 0x01;
1278
1279    if (s->msi != ON_OFF_AUTO_OFF) {
1280        ret = msi_init(dev, 0, 1, true, false, &err);
1281        /* Any error other than -ENOTSUP(board's MSI support is broken)
1282         * is a programming error */
1283        assert(!ret || ret == -ENOTSUP);
1284        if (ret && s->msi == ON_OFF_AUTO_ON) {
1285            /* Can't satisfy user's explicit msi=on request, fail */
1286            error_append_hint(&err, "You have to use msi=auto (default) or "
1287                    "msi=off with this machine type.\n");
1288            error_propagate(errp, err);
1289            return;
1290        }
1291        assert(!err || s->msi == ON_OFF_AUTO_AUTO);
1292        /* With msi=auto, we fall back to MSI off silently */
1293        error_free(err);
1294
1295        /* Only used for migration.  */
1296        s->msi_in_use = (ret == 0);
1297    }
1298
1299    memory_region_init_io(&s->mmio_io, OBJECT(s), &mptsas_mmio_ops, s,
1300                          "mptsas-mmio", 0x4000);
1301    memory_region_init_io(&s->port_io, OBJECT(s), &mptsas_port_ops, s,
1302                          "mptsas-io", 256);
1303    memory_region_init_io(&s->diag_io, OBJECT(s), &mptsas_diag_ops, s,
1304                          "mptsas-diag", 0x10000);
1305
1306    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
1307    pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY |
1308                                 PCI_BASE_ADDRESS_MEM_TYPE_32, &s->mmio_io);
1309    pci_register_bar(dev, 2, PCI_BASE_ADDRESS_SPACE_MEMORY |
1310                                 PCI_BASE_ADDRESS_MEM_TYPE_32, &s->diag_io);
1311
1312    if (!s->sas_addr) {
1313        s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
1314                       IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
1315        s->sas_addr |= (pci_bus_num(dev->bus) << 16);
1316        s->sas_addr |= (PCI_SLOT(dev->devfn) << 8);
1317        s->sas_addr |= PCI_FUNC(dev->devfn);
1318    }
1319    s->max_devices = MPTSAS_NUM_PORTS;
1320
1321    s->request_bh = qemu_bh_new(mptsas_fetch_requests, s);
1322
1323    QTAILQ_INIT(&s->pending);
1324
1325    scsi_bus_new(&s->bus, sizeof(s->bus), &dev->qdev, &mptsas_scsi_info, NULL);
1326}
1327
1328static void mptsas_scsi_uninit(PCIDevice *dev)
1329{
1330    MPTSASState *s = MPT_SAS(dev);
1331
1332    qemu_bh_delete(s->request_bh);
1333    msi_uninit(dev);
1334}
1335
1336static void mptsas_reset(DeviceState *dev)
1337{
1338    MPTSASState *s = MPT_SAS(dev);
1339
1340    mptsas_hard_reset(s);
1341}
1342
1343static int mptsas_post_load(void *opaque, int version_id)
1344{
1345    MPTSASState *s = opaque;
1346
1347    if (s->doorbell_idx > s->doorbell_cnt ||
1348        s->doorbell_cnt > ARRAY_SIZE(s->doorbell_msg) ||
1349        s->doorbell_reply_idx > s->doorbell_reply_size ||
1350        s->doorbell_reply_size > ARRAY_SIZE(s->doorbell_reply) ||
1351        MPTSAS_FIFO_INVALID(s, request_post) ||
1352        MPTSAS_FIFO_INVALID(s, reply_post) ||
1353        MPTSAS_FIFO_INVALID(s, reply_free) ||
1354        s->diagnostic_idx > 4) {
1355        return -EINVAL;
1356    }
1357
1358    return 0;
1359}
1360
1361static const VMStateDescription vmstate_mptsas = {
1362    .name = "mptsas",
1363    .version_id = 0,
1364    .minimum_version_id = 0,
1365    .minimum_version_id_old = 0,
1366    .post_load = mptsas_post_load,
1367    .fields      = (VMStateField[]) {
1368        VMSTATE_PCI_DEVICE(dev, MPTSASState),
1369        VMSTATE_BOOL(msi_in_use, MPTSASState),
1370        VMSTATE_UINT32(state, MPTSASState),
1371        VMSTATE_UINT8(who_init, MPTSASState),
1372        VMSTATE_UINT8(doorbell_state, MPTSASState),
1373        VMSTATE_UINT32_ARRAY(doorbell_msg, MPTSASState, 256),
1374        VMSTATE_INT32(doorbell_idx, MPTSASState),
1375        VMSTATE_INT32(doorbell_cnt, MPTSASState),
1376
1377        VMSTATE_UINT16_ARRAY(doorbell_reply, MPTSASState, 256),
1378        VMSTATE_INT32(doorbell_reply_idx, MPTSASState),
1379        VMSTATE_INT32(doorbell_reply_size, MPTSASState),
1380
1381        VMSTATE_UINT32(diagnostic, MPTSASState),
1382        VMSTATE_UINT8(diagnostic_idx, MPTSASState),
1383
1384        VMSTATE_UINT32(intr_status, MPTSASState),
1385        VMSTATE_UINT32(intr_mask, MPTSASState),
1386
1387        VMSTATE_UINT32_ARRAY(request_post, MPTSASState,
1388                             MPTSAS_REQUEST_QUEUE_DEPTH + 1),
1389        VMSTATE_UINT16(request_post_head, MPTSASState),
1390        VMSTATE_UINT16(request_post_tail, MPTSASState),
1391
1392        VMSTATE_UINT32_ARRAY(reply_post, MPTSASState,
1393                             MPTSAS_REPLY_QUEUE_DEPTH + 1),
1394        VMSTATE_UINT16(reply_post_head, MPTSASState),
1395        VMSTATE_UINT16(reply_post_tail, MPTSASState),
1396
1397        VMSTATE_UINT32_ARRAY(reply_free, MPTSASState,
1398                             MPTSAS_REPLY_QUEUE_DEPTH + 1),
1399        VMSTATE_UINT16(reply_free_head, MPTSASState),
1400        VMSTATE_UINT16(reply_free_tail, MPTSASState),
1401
1402        VMSTATE_UINT16(max_buses, MPTSASState),
1403        VMSTATE_UINT16(max_devices, MPTSASState),
1404        VMSTATE_UINT16(reply_frame_size, MPTSASState),
1405        VMSTATE_UINT64(host_mfa_high_addr, MPTSASState),
1406        VMSTATE_UINT64(sense_buffer_high_addr, MPTSASState),
1407        VMSTATE_END_OF_LIST()
1408    }
1409};
1410
1411static Property mptsas_properties[] = {
1412    DEFINE_PROP_UINT64("sas_address", MPTSASState, sas_addr, 0),
1413    /* TODO: test MSI support under Windows */
1414    DEFINE_PROP_ON_OFF_AUTO("msi", MPTSASState, msi, ON_OFF_AUTO_AUTO),
1415    DEFINE_PROP_END_OF_LIST(),
1416};
1417
1418static void mptsas1068_class_init(ObjectClass *oc, void *data)
1419{
1420    DeviceClass *dc = DEVICE_CLASS(oc);
1421    PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
1422
1423    pc->realize = mptsas_scsi_realize;
1424    pc->exit = mptsas_scsi_uninit;
1425    pc->romfile = 0;
1426    pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
1427    pc->device_id = PCI_DEVICE_ID_LSI_SAS1068;
1428    pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
1429    pc->subsystem_id = 0x8000;
1430    pc->class_id = PCI_CLASS_STORAGE_SCSI;
1431    dc->props = mptsas_properties;
1432    dc->reset = mptsas_reset;
1433    dc->vmsd = &vmstate_mptsas;
1434    dc->desc = "LSI SAS 1068";
1435}
1436
1437static const TypeInfo mptsas_info = {
1438    .name = TYPE_MPTSAS1068,
1439    .parent = TYPE_PCI_DEVICE,
1440    .instance_size = sizeof(MPTSASState),
1441    .class_init = mptsas1068_class_init,
1442    .interfaces = (InterfaceInfo[]) {
1443        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
1444        { },
1445    },
1446};
1447
1448static void mptsas_register_types(void)
1449{
1450    type_register(&mptsas_info);
1451}
1452
1453type_init(mptsas_register_types)
1454