hw/scsi/megasas.c

   1 /*
   2  * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation
   3  * Based on the linux driver code at drivers/scsi/megaraid
   4  *
   5  * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "hw/hw.h"
  22 #include "hw/pci/pci.h"
  23 #include "sysemu/dma.h"
  24 #include "hw/pci/msix.h"
  25 #include "qemu/iov.h"
  26 #include "hw/scsi/scsi.h"
  27 #include "block/scsi.h"
  28 #include "trace.h"
  29
  30 #include "mfi.h"
  31
  32 #define MEGASAS_VERSION "1.70"
  33 #define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */
  34 #define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */
  35 #define MEGASAS_MAX_SGE 128             /* Firmware limit */
  36 #define MEGASAS_DEFAULT_SGE 80
  37 #define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */
  38 #define MEGASAS_MAX_ARRAYS 128
  39
  40 #define MEGASAS_HBA_SERIAL "QEMU123456"
  41 #define NAA_LOCALLY_ASSIGNED_ID 0x3ULL
  42 #define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400
  43
  44 #define MEGASAS_FLAG_USE_JBOD      0
  45 #define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)
  46 #define MEGASAS_FLAG_USE_MSIX      1
  47 #define MEGASAS_MASK_USE_MSIX      (1 << MEGASAS_FLAG_USE_MSIX)
  48 #define MEGASAS_FLAG_USE_QUEUE64   2
  49 #define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)
  50
  51 static const char *mfi_frame_desc[] = {
  52     "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",
  53     "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"};
  54
  55 typedef struct MegasasCmd {
  56     uint32_t index;
  57     uint16_t flags;
  58     uint16_t count;
  59     uint64_t context;
  60
  61     hwaddr pa;
  62     hwaddr pa_size;
  63     union mfi_frame *frame;
  64     SCSIRequest *req;
  65     QEMUSGList qsg;
  66     void *iov_buf;
  67     size_t iov_size;
  68     size_t iov_offset;
  69     struct MegasasState *state;
  70 } MegasasCmd;
  71
  72 typedef struct MegasasState {
  73     PCIDevice dev;
  74     MemoryRegion mmio_io;
  75     MemoryRegion port_io;
  76     MemoryRegion queue_io;
  77     uint32_t frame_hi;
  78
  79     int fw_state;
  80     uint32_t fw_sge;
  81     uint32_t fw_cmds;
  82     uint32_t flags;
  83     int fw_luns;
  84     int intr_mask;
  85     int doorbell;
  86     int busy;
  87
  88     MegasasCmd *event_cmd;
  89     int event_locale;
  90     int event_class;
  91     int event_count;
  92     int shutdown_event;
  93     int boot_event;
  94
  95     uint64_t sas_addr;
  96     char *hba_serial;
  97
  98     uint64_t reply_queue_pa;
  99     void *reply_queue;
 100     int reply_queue_len;
 101     int reply_queue_head;
 102     int reply_queue_tail;
 103     uint64_t consumer_pa;
 104     uint64_t producer_pa;
 105
 106     MegasasCmd frames[MEGASAS_MAX_FRAMES];
 107
 108     SCSIBus bus;
 109 } MegasasState;
 110
 111 #define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF
 112
 113 static bool megasas_intr_enabled(MegasasState *s)
 114 {
 115     if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=
 116         MEGASAS_INTR_DISABLED_MASK) {
 117         return true;
 118     }
 119     return false;
 120 }
 121
 122 static bool megasas_use_queue64(MegasasState *s)
 123 {
 124     return s->flags & MEGASAS_MASK_USE_QUEUE64;
 125 }
 126
 127 static bool megasas_use_msix(MegasasState *s)
 128 {
 129     return s->flags & MEGASAS_MASK_USE_MSIX;
 130 }
 131
 132 static bool megasas_is_jbod(MegasasState *s)
 133 {
 134     return s->flags & MEGASAS_MASK_USE_JBOD;
 135 }
 136
 137 static void megasas_frame_set_cmd_status(unsigned long frame, uint8_t v)
 138 {
 139     stb_phys(frame + offsetof(struct mfi_frame_header, cmd_status), v);
 140 }
 141
 142 static void megasas_frame_set_scsi_status(unsigned long frame, uint8_t v)
 143 {
 144     stb_phys(frame + offsetof(struct mfi_frame_header, scsi_status), v);
 145 }
 146
 147 /*
 148  * Context is considered opaque, but the HBA firmware is running
 149  * in little endian mode. So convert it to little endian, too.
 150  */
 151 static uint64_t megasas_frame_get_context(unsigned long frame)
 152 {
 153     return ldq_le_phys(frame + offsetof(struct mfi_frame_header, context));
 154 }
 155
 156 static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)
 157 {
 158     return cmd->flags & MFI_FRAME_IEEE_SGL;
 159 }
 160
 161 static bool megasas_frame_is_sgl64(MegasasCmd *cmd)
 162 {
 163     return cmd->flags & MFI_FRAME_SGL64;
 164 }
 165
 166 static bool megasas_frame_is_sense64(MegasasCmd *cmd)
 167 {
 168     return cmd->flags & MFI_FRAME_SENSE64;
 169 }
 170
 171 static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,
 172                                      union mfi_sgl *sgl)
 173 {
 174     uint64_t addr;
 175
 176     if (megasas_frame_is_ieee_sgl(cmd)) {
 177         addr = le64_to_cpu(sgl->sg_skinny->addr);
 178     } else if (megasas_frame_is_sgl64(cmd)) {
 179         addr = le64_to_cpu(sgl->sg64->addr);
 180     } else {
 181         addr = le32_to_cpu(sgl->sg32->addr);
 182     }
 183     return addr;
 184 }
 185
 186 static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,
 187                                     union mfi_sgl *sgl)
 188 {
 189     uint32_t len;
 190
 191     if (megasas_frame_is_ieee_sgl(cmd)) {
 192         len = le32_to_cpu(sgl->sg_skinny->len);
 193     } else if (megasas_frame_is_sgl64(cmd)) {
 194         len = le32_to_cpu(sgl->sg64->len);
 195     } else {
 196         len = le32_to_cpu(sgl->sg32->len);
 197     }
 198     return len;
 199 }
 200
 201 static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,
 202                                        union mfi_sgl *sgl)
 203 {
 204     uint8_t *next = (uint8_t *)sgl;
 205
 206     if (megasas_frame_is_ieee_sgl(cmd)) {
 207         next += sizeof(struct mfi_sg_skinny);
 208     } else if (megasas_frame_is_sgl64(cmd)) {
 209         next += sizeof(struct mfi_sg64);
 210     } else {
 211         next += sizeof(struct mfi_sg32);
 212     }
 213
 214     if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {
 215         return NULL;
 216     }
 217     return (union mfi_sgl *)next;
 218 }
 219
 220 static void megasas_soft_reset(MegasasState *s);
 221
 222 static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
 223 {
 224     int i;
 225     int iov_count = 0;
 226     size_t iov_size = 0;
 227
 228     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
 229     iov_count = cmd->frame->header.sge_count;
 230     if (iov_count > MEGASAS_MAX_SGE) {
 231         trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,
 232                                          MEGASAS_MAX_SGE);
 233         return iov_count;
 234     }
 235     pci_dma_sglist_init(&cmd->qsg, &s->dev, iov_count);
 236     for (i = 0; i < iov_count; i++) {
 237         dma_addr_t iov_pa, iov_size_p;
 238
 239         if (!sgl) {
 240             trace_megasas_iovec_sgl_underflow(cmd->index, i);
 241             goto unmap;
 242         }
 243         iov_pa = megasas_sgl_get_addr(cmd, sgl);
 244         iov_size_p = megasas_sgl_get_len(cmd, sgl);
 245         if (!iov_pa || !iov_size_p) {
 246             trace_megasas_iovec_sgl_invalid(cmd->index, i,
 247                                             iov_pa, iov_size_p);
 248             goto unmap;
 249         }
 250         qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);
 251         sgl = megasas_sgl_next(cmd, sgl);
 252         iov_size += (size_t)iov_size_p;
 253     }
 254     if (cmd->iov_size > iov_size) {
 255         trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
 256     } else if (cmd->iov_size < iov_size) {
 257         trace_megasas_iovec_underflow(cmd->iov_size, iov_size, cmd->iov_size);
 258     }
 259     cmd->iov_offset = 0;
 260     return 0;
 261 unmap:
 262     qemu_sglist_destroy(&cmd->qsg);
 263     return iov_count - i;
 264 }
 265
 266 static void megasas_unmap_sgl(MegasasCmd *cmd)
 267 {
 268     qemu_sglist_destroy(&cmd->qsg);
 269     cmd->iov_offset = 0;
 270 }
 271
 272 /*
 273  * passthrough sense and io sense are at the same offset
 274  */
 275 static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,
 276     uint8_t sense_len)
 277 {
 278     uint32_t pa_hi = 0, pa_lo;
 279     hwaddr pa;
 280
 281     if (sense_len > cmd->frame->header.sense_len) {
 282         sense_len = cmd->frame->header.sense_len;
 283     }
 284     if (sense_len) {
 285         pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);
 286         if (megasas_frame_is_sense64(cmd)) {
 287             pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);
 288         }
 289         pa = ((uint64_t) pa_hi << 32) | pa_lo;
 290         cpu_physical_memory_write(pa, sense_ptr, sense_len);
 291         cmd->frame->header.sense_len = sense_len;
 292     }
 293     return sense_len;
 294 }
 295
 296 static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)
 297 {
 298     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
 299     uint8_t sense_len = 18;
 300
 301     memset(sense_buf, 0, sense_len);
 302     sense_buf[0] = 0xf0;
 303     sense_buf[2] = sense.key;
 304     sense_buf[7] = 10;
 305     sense_buf[12] = sense.asc;
 306     sense_buf[13] = sense.ascq;
 307     megasas_build_sense(cmd, sense_buf, sense_len);
 308 }
 309
 310 static void megasas_copy_sense(MegasasCmd *cmd)
 311 {
 312     uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];
 313     uint8_t sense_len;
 314
 315     sense_len = scsi_req_get_sense(cmd->req, sense_buf,
 316                                    SCSI_SENSE_BUF_SIZE);
 317     megasas_build_sense(cmd, sense_buf, sense_len);
 318 }
 319
 320 /*
 321  * Format an INQUIRY CDB
 322  */
 323 static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)
 324 {
 325     memset(cdb, 0, 6);
 326     cdb[0] = INQUIRY;
 327     if (pg > 0) {
 328         cdb[1] = 0x1;
 329         cdb[2] = pg;
 330     }
 331     cdb[3] = (len >> 8) & 0xff;
 332     cdb[4] = (len & 0xff);
 333     return len;
 334 }
 335
 336 /*
 337  * Encode lba and len into a READ_16/WRITE_16 CDB
 338  */
 339 static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,
 340                                uint32_t len, bool is_write)
 341 {
 342     memset(cdb, 0x0, 16);
 343     if (is_write) {
 344         cdb[0] = WRITE_16;
 345     } else {
 346         cdb[0] = READ_16;
 347     }
 348     cdb[2] = (lba >> 56) & 0xff;
 349     cdb[3] = (lba >> 48) & 0xff;
 350     cdb[4] = (lba >> 40) & 0xff;
 351     cdb[5] = (lba >> 32) & 0xff;
 352     cdb[6] = (lba >> 24) & 0xff;
 353     cdb[7] = (lba >> 16) & 0xff;
 354     cdb[8] = (lba >> 8) & 0xff;
 355     cdb[9] = (lba) & 0xff;
 356     cdb[10] = (len >> 24) & 0xff;
 357     cdb[11] = (len >> 16) & 0xff;
 358     cdb[12] = (len >> 8) & 0xff;
 359     cdb[13] = (len) & 0xff;
 360 }
 361
 362 /*
 363  * Utility functions
 364  */
 365 static uint64_t megasas_fw_time(void)
 366 {
 367     struct tm curtime;
 368     uint64_t bcd_time;
 369
 370     qemu_get_timedate(&curtime, 0);
 371     bcd_time = ((uint64_t)curtime.tm_sec & 0xff) << 48 |
 372         ((uint64_t)curtime.tm_min & 0xff)  << 40 |
 373         ((uint64_t)curtime.tm_hour & 0xff) << 32 |
 374         ((uint64_t)curtime.tm_mday & 0xff) << 24 |
 375         ((uint64_t)curtime.tm_mon & 0xff)  << 16 |
 376         ((uint64_t)(curtime.tm_year + 1900) & 0xffff);
 377
 378     return bcd_time;
 379 }
 380
 381 /*
 382  * Default disk sata address
 383  * 0x1221 is the magic number as
 384  * present in real hardware,
 385  * so use it here, too.
 386  */
 387 static uint64_t megasas_get_sata_addr(uint16_t id)
 388 {
 389     uint64_t addr = (0x1221ULL << 48);
 390     return addr & (id << 24);
 391 }
 392
 393 /*
 394  * Frame handling
 395  */
 396 static int megasas_next_index(MegasasState *s, int index, int limit)
 397 {
 398     index++;
 399     if (index == limit) {
 400         index = 0;
 401     }
 402     return index;
 403 }
 404
 405 static MegasasCmd *megasas_lookup_frame(MegasasState *s,
 406     hwaddr frame)
 407 {
 408     MegasasCmd *cmd = NULL;
 409     int num = 0, index;
 410
 411     index = s->reply_queue_head;
 412
 413     while (num < s->fw_cmds) {
 414         if (s->frames[index].pa && s->frames[index].pa == frame) {
 415             cmd = &s->frames[index];
 416             break;
 417         }
 418         index = megasas_next_index(s, index, s->fw_cmds);
 419         num++;
 420     }
 421
 422     return cmd;
 423 }
 424
 425 static MegasasCmd *megasas_next_frame(MegasasState *s,
 426     hwaddr frame)
 427 {
 428     MegasasCmd *cmd = NULL;
 429     int num = 0, index;
 430
 431     cmd = megasas_lookup_frame(s, frame);
 432     if (cmd) {
 433         trace_megasas_qf_found(cmd->index, cmd->pa);
 434         return cmd;
 435     }
 436     index = s->reply_queue_head;
 437     num = 0;
 438     while (num < s->fw_cmds) {
 439         if (!s->frames[index].pa) {
 440             cmd = &s->frames[index];
 441             break;
 442         }
 443         index = megasas_next_index(s, index, s->fw_cmds);
 444         num++;
 445     }
 446     if (!cmd) {
 447         trace_megasas_qf_failed(frame);
 448     }
 449     trace_megasas_qf_new(index, cmd);
 450     return cmd;
 451 }
 452
 453 static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
 454     hwaddr frame, uint64_t context, int count)
 455 {
 456     MegasasCmd *cmd = NULL;
 457     int frame_size = MFI_FRAME_SIZE * 16;
 458     hwaddr frame_size_p = frame_size;
 459
 460     cmd = megasas_next_frame(s, frame);
 461     /* All frames busy */
 462     if (!cmd) {
 463         return NULL;
 464     }
 465     if (!cmd->pa) {
 466         cmd->pa = frame;
 467         /* Map all possible frames */
 468         cmd->frame = cpu_physical_memory_map(frame, &frame_size_p, 0);
 469         if (frame_size_p != frame_size) {
 470             trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
 471             if (cmd->frame) {
 472                 cpu_physical_memory_unmap(cmd->frame, frame_size_p, 0, 0);
 473                 cmd->frame = NULL;
 474                 cmd->pa = 0;
 475             }
 476             s->event_count++;
 477             return NULL;
 478         }
 479         cmd->pa_size = frame_size_p;
 480         cmd->context = context;
 481         if (!megasas_use_queue64(s)) {
 482             cmd->context &= (uint64_t)0xFFFFFFFF;
 483         }
 484     }
 485     cmd->count = count;
 486     s->busy++;
 487
 488     trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,
 489                              s->reply_queue_head, s->busy);
 490
 491     return cmd;
 492 }
 493
 494 static void megasas_complete_frame(MegasasState *s, uint64_t context)
 495 {
 496     int tail, queue_offset;
 497
 498     /* Decrement busy count */
 499     s->busy--;
 500
 501     if (s->reply_queue_pa) {
 502         /*
 503          * Put command on the reply queue.
 504          * Context is opaque, but emulation is running in
 505          * little endian. So convert it.
 506          */
 507         tail = s->reply_queue_head;
 508         if (megasas_use_queue64(s)) {
 509             queue_offset = tail * sizeof(uint64_t);
 510             stq_le_phys(s->reply_queue_pa + queue_offset, context);
 511         } else {
 512             queue_offset = tail * sizeof(uint32_t);
 513             stl_le_phys(s->reply_queue_pa + queue_offset, context);
 514         }
 515         s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);
 516         trace_megasas_qf_complete(context, tail, queue_offset,
 517                                   s->busy, s->doorbell);
 518     }
 519
 520     if (megasas_intr_enabled(s)) {
 521         /* Notify HBA */
 522         s->doorbell++;
 523         if (s->doorbell == 1) {
 524             if (msix_enabled(&s->dev)) {
 525                 trace_megasas_msix_raise(0);
 526                 msix_notify(&s->dev, 0);
 527             } else {
 528                 trace_megasas_irq_raise();
 529                 qemu_irq_raise(s->dev.irq[0]);
 530             }
 531         }
 532     } else {
 533         trace_megasas_qf_complete_noirq(context);
 534     }
 535 }
 536
 537 static void megasas_reset_frames(MegasasState *s)
 538 {
 539     int i;
 540     MegasasCmd *cmd;
 541
 542     for (i = 0; i < s->fw_cmds; i++) {
 543         cmd = &s->frames[i];
 544         if (cmd->pa) {
 545             cpu_physical_memory_unmap(cmd->frame, cmd->pa_size, 0, 0);
 546             cmd->frame = NULL;
 547             cmd->pa = 0;
 548         }
 549     }
 550 }
 551
 552 static void megasas_abort_command(MegasasCmd *cmd)
 553 {
 554     if (cmd->req) {
 555         scsi_req_cancel(cmd->req);
 556         cmd->req = NULL;
 557     }
 558 }
 559
 560 static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
 561 {
 562     uint32_t pa_hi, pa_lo;
 563     hwaddr iq_pa, initq_size;
 564     struct mfi_init_qinfo *initq;
 565     uint32_t flags;
 566     int ret = MFI_STAT_OK;
 567
 568     pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);
 569     pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);
 570     iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);
 571     trace_megasas_init_firmware((uint64_t)iq_pa);
 572     initq_size = sizeof(*initq);
 573     initq = cpu_physical_memory_map(iq_pa, &initq_size, 0);
 574     if (!initq || initq_size != sizeof(*initq)) {
 575         trace_megasas_initq_map_failed(cmd->index);
 576         s->event_count++;
 577         ret = MFI_STAT_MEMORY_NOT_AVAILABLE;
 578         goto out;
 579     }
 580     s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;
 581     if (s->reply_queue_len > s->fw_cmds) {
 582         trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);
 583         s->event_count++;
 584         ret = MFI_STAT_INVALID_PARAMETER;
 585         goto out;
 586     }
 587     pa_lo = le32_to_cpu(initq->rq_addr_lo);
 588     pa_hi = le32_to_cpu(initq->rq_addr_hi);
 589     s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;
 590     pa_lo = le32_to_cpu(initq->ci_addr_lo);
 591     pa_hi = le32_to_cpu(initq->ci_addr_hi);
 592     s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
 593     pa_lo = le32_to_cpu(initq->pi_addr_lo);
 594     pa_hi = le32_to_cpu(initq->pi_addr_hi);
 595     s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
 596     s->reply_queue_head = ldl_le_phys(s->producer_pa);
 597     s->reply_queue_tail = ldl_le_phys(s->consumer_pa);
 598     flags = le32_to_cpu(initq->flags);
 599     if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
 600         s->flags |= MEGASAS_MASK_USE_QUEUE64;
 601     }
 602     trace_megasas_init_queue((unsigned long)s->reply_queue_pa,
 603                              s->reply_queue_len, s->reply_queue_head,
 604                              s->reply_queue_tail, flags);
 605     megasas_reset_frames(s);
 606     s->fw_state = MFI_FWSTATE_OPERATIONAL;
 607 out:
 608     if (initq) {
 609         cpu_physical_memory_unmap(initq, initq_size, 0, 0);
 610     }
 611     return ret;
 612 }
 613
 614 static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)
 615 {
 616     dma_addr_t iov_pa, iov_size;
 617
 618     cmd->flags = le16_to_cpu(cmd->frame->header.flags);
 619     if (!cmd->frame->header.sge_count) {
 620         trace_megasas_dcmd_zero_sge(cmd->index);
 621         cmd->iov_size = 0;
 622         return 0;
 623     } else if (cmd->frame->header.sge_count > 1) {
 624         trace_megasas_dcmd_invalid_sge(cmd->index,
 625                                        cmd->frame->header.sge_count);
 626         cmd->iov_size = 0;
 627         return -1;
 628     }
 629     iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);
 630     iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);
 631     pci_dma_sglist_init(&cmd->qsg, &s->dev, 1);
 632     qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);
 633     cmd->iov_size = iov_size;
 634     return cmd->iov_size;
 635 }
 636
 637 static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)
 638 {
 639     trace_megasas_finish_dcmd(cmd->index, iov_size);
 640
 641     if (cmd->frame->header.sge_count) {
 642         qemu_sglist_destroy(&cmd->qsg);
 643     }
 644     if (iov_size > cmd->iov_size) {
 645         if (megasas_frame_is_ieee_sgl(cmd)) {
 646             cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);
 647         } else if (megasas_frame_is_sgl64(cmd)) {
 648             cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);
 649         } else {
 650             cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);
 651         }
 652     }
 653     cmd->iov_size = 0;
 654 }
 655
 656 static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
 657 {
 658     struct mfi_ctrl_info info;
 659     size_t dcmd_size = sizeof(info);
 660     BusChild *kid;
 661     int num_ld_disks = 0;
 662     uint16_t sdev_id;
 663
 664     memset(&info, 0x0, cmd->iov_size);
 665     if (cmd->iov_size < dcmd_size) {
 666         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 667                                             dcmd_size);
 668         return MFI_STAT_INVALID_PARAMETER;
 669     }
 670
 671     info.pci.vendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);
 672     info.pci.device = cpu_to_le16(PCI_DEVICE_ID_LSI_SAS1078);
 673     info.pci.subvendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);
 674     info.pci.subdevice = cpu_to_le16(0x1013);
 675
 676     /*
 677      * For some reason the firmware supports
 678      * only up to 8 device ports.
 679      * Despite supporting a far larger number
 680      * of devices for the physical devices.
 681      * So just display the first 8 devices
 682      * in the device port list, independent
 683      * of how many logical devices are actually
 684      * present.
 685      */
 686     info.host.type = MFI_INFO_HOST_PCIE;
 687     info.device.type = MFI_INFO_DEV_SAS3G;
 688     info.device.port_count = 8;
 689     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 690         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
 691
 692         if (num_ld_disks < 8) {
 693             sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
 694             info.device.port_addr[num_ld_disks] =
 695                 cpu_to_le64(megasas_get_sata_addr(sdev_id));
 696         }
 697         num_ld_disks++;
 698     }
 699
 700     memcpy(info.product_name, "MegaRAID SAS 8708EM2", 20);
 701     snprintf(info.serial_number, 32, "%s", s->hba_serial);
 702     snprintf(info.package_version, 0x60, "%s-QEMU", QEMU_VERSION);
 703     memcpy(info.image_component[0].name, "APP", 3);
 704     memcpy(info.image_component[0].version, MEGASAS_VERSION "-QEMU", 9);
 705     memcpy(info.image_component[0].build_date, __DATE__, 11);
 706     memcpy(info.image_component[0].build_time, __TIME__, 8);
 707     info.image_component_count = 1;
 708     if (s->dev.has_rom) {
 709         uint8_t biosver[32];
 710         uint8_t *ptr;
 711
 712         ptr = memory_region_get_ram_ptr(&s->dev.rom);
 713         memcpy(biosver, ptr + 0x41, 31);
 714         memcpy(info.image_component[1].name, "BIOS", 4);
 715         memcpy(info.image_component[1].version, biosver,
 716                strlen((const char *)biosver));
 717         info.image_component_count++;
 718     }
 719     info.current_fw_time = cpu_to_le32(megasas_fw_time());
 720     info.max_arms = 32;
 721     info.max_spans = 8;
 722     info.max_arrays = MEGASAS_MAX_ARRAYS;
 723     info.max_lds = s->fw_luns;
 724     info.max_cmds = cpu_to_le16(s->fw_cmds);
 725     info.max_sg_elements = cpu_to_le16(s->fw_sge);
 726     info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);
 727     info.lds_present = cpu_to_le16(num_ld_disks);
 728     info.pd_present = cpu_to_le16(num_ld_disks);
 729     info.pd_disks_present = cpu_to_le16(num_ld_disks);
 730     info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |
 731                                    MFI_INFO_HW_MEM |
 732                                    MFI_INFO_HW_FLASH);
 733     info.memory_size = cpu_to_le16(512);
 734     info.nvram_size = cpu_to_le16(32);
 735     info.flash_size = cpu_to_le16(16);
 736     info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);
 737     info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |
 738                                     MFI_INFO_AOPS_SELF_DIAGNOSTIC |
 739                                     MFI_INFO_AOPS_MIXED_ARRAY);
 740     info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |
 741                                MFI_INFO_LDOPS_ACCESS_POLICY |
 742                                MFI_INFO_LDOPS_IO_POLICY |
 743                                MFI_INFO_LDOPS_WRITE_POLICY |
 744                                MFI_INFO_LDOPS_READ_POLICY);
 745     info.max_strips_per_io = cpu_to_le16(s->fw_sge);
 746     info.stripe_sz_ops.min = 3;
 747     info.stripe_sz_ops.max = ffs(MEGASAS_MAX_SECTORS + 1) - 1;
 748     info.properties.pred_fail_poll_interval = cpu_to_le16(300);
 749     info.properties.intr_throttle_cnt = cpu_to_le16(16);
 750     info.properties.intr_throttle_timeout = cpu_to_le16(50);
 751     info.properties.rebuild_rate = 30;
 752     info.properties.patrol_read_rate = 30;
 753     info.properties.bgi_rate = 30;
 754     info.properties.cc_rate = 30;
 755     info.properties.recon_rate = 30;
 756     info.properties.cache_flush_interval = 4;
 757     info.properties.spinup_drv_cnt = 2;
 758     info.properties.spinup_delay = 6;
 759     info.properties.ecc_bucket_size = 15;
 760     info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);
 761     info.properties.expose_encl_devices = 1;
 762     info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);
 763     info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |
 764                                MFI_INFO_PDOPS_FORCE_OFFLINE);
 765     info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |
 766                                        MFI_INFO_PDMIX_SATA |
 767                                        MFI_INFO_PDMIX_LD);
 768
 769     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 770     return MFI_STAT_OK;
 771 }
 772
 773 static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)
 774 {
 775     struct mfi_defaults info;
 776     size_t dcmd_size = sizeof(struct mfi_defaults);
 777
 778     memset(&info, 0x0, dcmd_size);
 779     if (cmd->iov_size < dcmd_size) {
 780         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 781                                             dcmd_size);
 782         return MFI_STAT_INVALID_PARAMETER;
 783     }
 784
 785     info.sas_addr = cpu_to_le64(s->sas_addr);
 786     info.stripe_size = 3;
 787     info.flush_time = 4;
 788     info.background_rate = 30;
 789     info.allow_mix_in_enclosure = 1;
 790     info.allow_mix_in_ld = 1;
 791     info.direct_pd_mapping = 1;
 792     /* Enable for BIOS support */
 793     info.bios_enumerate_lds = 1;
 794     info.disable_ctrl_r = 1;
 795     info.expose_enclosure_devices = 1;
 796     info.disable_preboot_cli = 1;
 797     info.cluster_disable = 1;
 798
 799     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 800     return MFI_STAT_OK;
 801 }
 802
 803 static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)
 804 {
 805     struct mfi_bios_data info;
 806     size_t dcmd_size = sizeof(info);
 807
 808     memset(&info, 0x0, dcmd_size);
 809     if (cmd->iov_size < dcmd_size) {
 810         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 811                                             dcmd_size);
 812         return MFI_STAT_INVALID_PARAMETER;
 813     }
 814     info.continue_on_error = 1;
 815     info.verbose = 1;
 816     if (megasas_is_jbod(s)) {
 817         info.expose_all_drives = 1;
 818     }
 819
 820     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 821     return MFI_STAT_OK;
 822 }
 823
 824 static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)
 825 {
 826     uint64_t fw_time;
 827     size_t dcmd_size = sizeof(fw_time);
 828
 829     fw_time = cpu_to_le64(megasas_fw_time());
 830
 831     cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);
 832     return MFI_STAT_OK;
 833 }
 834
 835 static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)
 836 {
 837     uint64_t fw_time;
 838
 839     /* This is a dummy; setting of firmware time is not allowed */
 840     memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));
 841
 842     trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);
 843     fw_time = cpu_to_le64(megasas_fw_time());
 844     return MFI_STAT_OK;
 845 }
 846
 847 static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)
 848 {
 849     struct mfi_evt_log_state info;
 850     size_t dcmd_size = sizeof(info);
 851
 852     memset(&info, 0, dcmd_size);
 853
 854     info.newest_seq_num = cpu_to_le32(s->event_count);
 855     info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);
 856     info.boot_seq_num = cpu_to_le32(s->boot_event);
 857
 858     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
 859     return MFI_STAT_OK;
 860 }
 861
 862 static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)
 863 {
 864     union mfi_evt event;
 865
 866     if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {
 867         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 868                                             sizeof(struct mfi_evt_detail));
 869         return MFI_STAT_INVALID_PARAMETER;
 870     }
 871     s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);
 872     event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);
 873     s->event_locale = event.members.locale;
 874     s->event_class = event.members.class;
 875     s->event_cmd = cmd;
 876     /* Decrease busy count; event frame doesn't count here */
 877     s->busy--;
 878     cmd->iov_size = sizeof(struct mfi_evt_detail);
 879     return MFI_STAT_INVALID_STATUS;
 880 }
 881
 882 static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)
 883 {
 884     struct mfi_pd_list info;
 885     size_t dcmd_size = sizeof(info);
 886     BusChild *kid;
 887     uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;
 888     uint16_t sdev_id;
 889
 890     memset(&info, 0, dcmd_size);
 891     offset = 8;
 892     dcmd_limit = offset + sizeof(struct mfi_pd_address);
 893     if (cmd->iov_size < dcmd_limit) {
 894         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
 895                                             dcmd_limit);
 896         return MFI_STAT_INVALID_PARAMETER;
 897     }
 898
 899     max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);
 900     if (max_pd_disks > s->fw_luns) {
 901         max_pd_disks = s->fw_luns;
 902     }
 903
 904     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
 905         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
 906
 907         sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
 908         info.addr[num_pd_disks].device_id = cpu_to_le16(sdev_id);
 909         info.addr[num_pd_disks].encl_device_id = 0xFFFF;
 910         info.addr[num_pd_disks].encl_index = 0;
 911         info.addr[num_pd_disks].slot_number = (sdev->id & 0xFF);
 912         info.addr[num_pd_disks].scsi_dev_type = sdev->type;
 913         info.addr[num_pd_disks].connect_port_bitmap = 0x1;
 914         info.addr[num_pd_disks].sas_addr[0] =
 915             cpu_to_le64(megasas_get_sata_addr(sdev_id));
 916         num_pd_disks++;
 917         offset += sizeof(struct mfi_pd_address);
 918     }
 919     trace_megasas_dcmd_pd_get_list(cmd->index, num_pd_disks,
 920                                    max_pd_disks, offset);
 921
 922     info.size = cpu_to_le32(offset);
 923     info.count = cpu_to_le32(num_pd_disks);
 924
 925     cmd->iov_size -= dma_buf_read((uint8_t *)&info, offset, &cmd->qsg);
 926     return MFI_STAT_OK;
 927 }
 928
 929 static int megasas_dcmd_pd_list_query(MegasasState *s, MegasasCmd *cmd)
 930 {
 931     uint16_t flags;
 932
 933     /* mbox0 contains flags */
 934     flags = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
 935     trace_megasas_dcmd_pd_list_query(cmd->index, flags);
 936     if (flags == MR_PD_QUERY_TYPE_ALL ||
 937         megasas_is_jbod(s)) {
 938         return megasas_dcmd_pd_get_list(s, cmd);
 939     }
 940
 941     return MFI_STAT_OK;
 942 }
 943
 944 static int megasas_pd_get_info_submit(SCSIDevice *sdev, int lun,
 945                                       MegasasCmd *cmd)
 946 {
 947     struct mfi_pd_info *info = cmd->iov_buf;
 948     size_t dcmd_size = sizeof(struct mfi_pd_info);
 949     BlockConf *conf = &sdev->conf;
 950     uint64_t pd_size;
 951     uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (lun & 0xFF);
 952     uint8_t cmdbuf[6];
 953     SCSIRequest *req;
 954     size_t len, resid;
 955
 956     if (!cmd->iov_buf) {
 957         cmd->iov_buf = g_malloc(dcmd_size);
 958         memset(cmd->iov_buf, 0, dcmd_size);
 959         info = cmd->iov_buf;
 960         info->inquiry_data[0] = 0x7f; /* Force PQual 0x3, PType 0x1f */
 961         info->vpd_page83[0] = 0x7f;
 962         megasas_setup_inquiry(cmdbuf, 0, sizeof(info->inquiry_data));
 963         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
 964         if (!req) {
 965             trace_megasas_dcmd_req_alloc_failed(cmd->index,
 966                                                 "PD get info std inquiry");
 967             g_free(cmd->iov_buf);
 968             cmd->iov_buf = NULL;
 969             return MFI_STAT_FLASH_ALLOC_FAIL;
 970         }
 971         trace_megasas_dcmd_internal_submit(cmd->index,
 972                                            "PD get info std inquiry", lun);
 973         len = scsi_req_enqueue(req);
 974         if (len > 0) {
 975             cmd->iov_size = len;
 976             scsi_req_continue(req);
 977         }
 978         return MFI_STAT_INVALID_STATUS;
 979     } else if (info->inquiry_data[0] != 0x7f && info->vpd_page83[0] == 0x7f) {
 980         megasas_setup_inquiry(cmdbuf, 0x83, sizeof(info->vpd_page83));
 981         req = scsi_req_new(sdev, cmd->index, lun, cmdbuf, cmd);
 982         if (!req) {
 983             trace_megasas_dcmd_req_alloc_failed(cmd->index,
 984                                                 "PD get info vpd inquiry");
 985             return MFI_STAT_FLASH_ALLOC_FAIL;
 986         }
 987         trace_megasas_dcmd_internal_submit(cmd->index,
 988                                            "PD get info vpd inquiry", lun);
 989         len = scsi_req_enqueue(req);
 990         if (len > 0) {
 991             cmd->iov_size = len;
 992             scsi_req_continue(req);
 993         }
 994         return MFI_STAT_INVALID_STATUS;
 995     }
 996     /* Finished, set FW state */
 997     if ((info->inquiry_data[0] >> 5) == 0) {
 998         if (megasas_is_jbod(cmd->state)) {
 999             info->fw_state = cpu_to_le16(MFI_PD_STATE_SYSTEM);
1000         } else {
1001             info->fw_state = cpu_to_le16(MFI_PD_STATE_ONLINE);
1002         }
1003     } else {
1004         info->fw_state = cpu_to_le16(MFI_PD_STATE_OFFLINE);
1005     }
1006
1007     info->ref.v.device_id = cpu_to_le16(sdev_id);
1008     info->state.ddf.pd_type = cpu_to_le16(MFI_PD_DDF_TYPE_IN_VD|
1009                                           MFI_PD_DDF_TYPE_INTF_SAS);
1010     bdrv_get_geometry(conf->bs, &pd_size);
1011     info->raw_size = cpu_to_le64(pd_size);
1012     info->non_coerced_size = cpu_to_le64(pd_size);
1013     info->coerced_size = cpu_to_le64(pd_size);
1014     info->encl_device_id = 0xFFFF;
1015     info->slot_number = (sdev->id & 0xFF);
1016     info->path_info.count = 1;
1017     info->path_info.sas_addr[0] =
1018         cpu_to_le64(megasas_get_sata_addr(sdev_id));
1019     info->connected_port_bitmap = 0x1;
1020     info->device_speed = 1;
1021     info->link_speed = 1;
1022     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1023     g_free(cmd->iov_buf);
1024     cmd->iov_size = dcmd_size - resid;
1025     cmd->iov_buf = NULL;
1026     return MFI_STAT_OK;
1027 }
1028
1029 static int megasas_dcmd_pd_get_info(MegasasState *s, MegasasCmd *cmd)
1030 {
1031     size_t dcmd_size = sizeof(struct mfi_pd_info);
1032     uint16_t pd_id;
1033     SCSIDevice *sdev = NULL;
1034     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1035
1036     if (cmd->iov_size < dcmd_size) {
1037         return MFI_STAT_INVALID_PARAMETER;
1038     }
1039
1040     /* mbox0 has the ID */
1041     pd_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1042     sdev = scsi_device_find(&s->bus, 0, pd_id, 0);
1043     trace_megasas_dcmd_pd_get_info(cmd->index, pd_id);
1044
1045     if (sdev) {
1046         /* Submit inquiry */
1047         retval = megasas_pd_get_info_submit(sdev, pd_id, cmd);
1048     }
1049
1050     return retval;
1051 }
1052
1053 static int megasas_dcmd_ld_get_list(MegasasState *s, MegasasCmd *cmd)
1054 {
1055     struct mfi_ld_list info;
1056     size_t dcmd_size = sizeof(info), resid;
1057     uint32_t num_ld_disks = 0, max_ld_disks = s->fw_luns;
1058     uint64_t ld_size;
1059     BusChild *kid;
1060
1061     memset(&info, 0, dcmd_size);
1062     if (cmd->iov_size < dcmd_size) {
1063         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1064                                             dcmd_size);
1065         return MFI_STAT_INVALID_PARAMETER;
1066     }
1067
1068     if (megasas_is_jbod(s)) {
1069         max_ld_disks = 0;
1070     }
1071     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1072         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1073         BlockConf *conf = &sdev->conf;
1074
1075         if (num_ld_disks >= max_ld_disks) {
1076             break;
1077         }
1078         /* Logical device size is in blocks */
1079         bdrv_get_geometry(conf->bs, &ld_size);
1080         info.ld_list[num_ld_disks].ld.v.target_id = sdev->id;
1081         info.ld_list[num_ld_disks].ld.v.lun_id = sdev->lun;
1082         info.ld_list[num_ld_disks].state = MFI_LD_STATE_OPTIMAL;
1083         info.ld_list[num_ld_disks].size = cpu_to_le64(ld_size);
1084         num_ld_disks++;
1085     }
1086     info.ld_count = cpu_to_le32(num_ld_disks);
1087     trace_megasas_dcmd_ld_get_list(cmd->index, num_ld_disks, max_ld_disks);
1088
1089     resid = dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1090     cmd->iov_size = dcmd_size - resid;
1091     return MFI_STAT_OK;
1092 }
1093
1094 static int megasas_ld_get_info_submit(SCSIDevice *sdev, int lun,
1095                                       MegasasCmd *cmd)
1096 {
1097     struct mfi_ld_info *info = cmd->iov_buf;
1098     size_t dcmd_size = sizeof(struct mfi_ld_info);
1099     uint8_t cdb[6];
1100     SCSIRequest *req;
1101     ssize_t len, resid;
1102     BlockConf *conf = &sdev->conf;
1103     uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (lun & 0xFF);
1104     uint64_t ld_size;
1105
1106     if (!cmd->iov_buf) {
1107         cmd->iov_buf = g_malloc(dcmd_size);
1108         memset(cmd->iov_buf, 0x0, dcmd_size);
1109         info = cmd->iov_buf;
1110         megasas_setup_inquiry(cdb, 0x83, sizeof(info->vpd_page83));
1111         req = scsi_req_new(sdev, cmd->index, lun, cdb, cmd);
1112         if (!req) {
1113             trace_megasas_dcmd_req_alloc_failed(cmd->index,
1114                                                 "LD get info vpd inquiry");
1115             g_free(cmd->iov_buf);
1116             cmd->iov_buf = NULL;
1117             return MFI_STAT_FLASH_ALLOC_FAIL;
1118         }
1119         trace_megasas_dcmd_internal_submit(cmd->index,
1120                                            "LD get info vpd inquiry", lun);
1121         len = scsi_req_enqueue(req);
1122         if (len > 0) {
1123             cmd->iov_size = len;
1124             scsi_req_continue(req);
1125         }
1126         return MFI_STAT_INVALID_STATUS;
1127     }
1128
1129     info->ld_config.params.state = MFI_LD_STATE_OPTIMAL;
1130     info->ld_config.properties.ld.v.target_id = lun;
1131     info->ld_config.params.stripe_size = 3;
1132     info->ld_config.params.num_drives = 1;
1133     info->ld_config.params.is_consistent = 1;
1134     /* Logical device size is in blocks */
1135     bdrv_get_geometry(conf->bs, &ld_size);
1136     info->size = cpu_to_le64(ld_size);
1137     memset(info->ld_config.span, 0, sizeof(info->ld_config.span));
1138     info->ld_config.span[0].start_block = 0;
1139     info->ld_config.span[0].num_blocks = info->size;
1140     info->ld_config.span[0].array_ref = cpu_to_le16(sdev_id);
1141
1142     resid = dma_buf_read(cmd->iov_buf, dcmd_size, &cmd->qsg);
1143     g_free(cmd->iov_buf);
1144     cmd->iov_size = dcmd_size - resid;
1145     cmd->iov_buf = NULL;
1146     return MFI_STAT_OK;
1147 }
1148
1149 static int megasas_dcmd_ld_get_info(MegasasState *s, MegasasCmd *cmd)
1150 {
1151     struct mfi_ld_info info;
1152     size_t dcmd_size = sizeof(info);
1153     uint16_t ld_id;
1154     uint32_t max_ld_disks = s->fw_luns;
1155     SCSIDevice *sdev = NULL;
1156     int retval = MFI_STAT_DEVICE_NOT_FOUND;
1157
1158     if (cmd->iov_size < dcmd_size) {
1159         return MFI_STAT_INVALID_PARAMETER;
1160     }
1161
1162     /* mbox0 has the ID */
1163     ld_id = le16_to_cpu(cmd->frame->dcmd.mbox[0]);
1164     trace_megasas_dcmd_ld_get_info(cmd->index, ld_id);
1165
1166     if (megasas_is_jbod(s)) {
1167         return MFI_STAT_DEVICE_NOT_FOUND;
1168     }
1169
1170     if (ld_id < max_ld_disks) {
1171         sdev = scsi_device_find(&s->bus, 0, ld_id, 0);
1172     }
1173
1174     if (sdev) {
1175         retval = megasas_ld_get_info_submit(sdev, ld_id, cmd);
1176     }
1177
1178     return retval;
1179 }
1180
1181 static int megasas_dcmd_cfg_read(MegasasState *s, MegasasCmd *cmd)
1182 {
1183     uint8_t data[4096];
1184     struct mfi_config_data *info;
1185     int num_pd_disks = 0, array_offset, ld_offset;
1186     BusChild *kid;
1187
1188     if (cmd->iov_size > 4096) {
1189         return MFI_STAT_INVALID_PARAMETER;
1190     }
1191
1192     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1193         num_pd_disks++;
1194     }
1195     info = (struct mfi_config_data *)&data;
1196     /*
1197      * Array mapping:
1198      * - One array per SCSI device
1199      * - One logical drive per SCSI device
1200      *   spanning the entire device
1201      */
1202     info->array_count = num_pd_disks;
1203     info->array_size = sizeof(struct mfi_array) * num_pd_disks;
1204     info->log_drv_count = num_pd_disks;
1205     info->log_drv_size = sizeof(struct mfi_ld_config) * num_pd_disks;
1206     info->spares_count = 0;
1207     info->spares_size = sizeof(struct mfi_spare);
1208     info->size = sizeof(struct mfi_config_data) + info->array_size +
1209         info->log_drv_size;
1210     if (info->size > 4096) {
1211         return MFI_STAT_INVALID_PARAMETER;
1212     }
1213
1214     array_offset = sizeof(struct mfi_config_data);
1215     ld_offset = array_offset + sizeof(struct mfi_array) * num_pd_disks;
1216
1217     QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {
1218         SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);
1219         BlockConf *conf = &sdev->conf;
1220         uint16_t sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);
1221         struct mfi_array *array;
1222         struct mfi_ld_config *ld;
1223         uint64_t pd_size;
1224         int i;
1225
1226         array = (struct mfi_array *)(data + array_offset);
1227         bdrv_get_geometry(conf->bs, &pd_size);
1228         array->size = cpu_to_le64(pd_size);
1229         array->num_drives = 1;
1230         array->array_ref = cpu_to_le16(sdev_id);
1231         array->pd[0].ref.v.device_id = cpu_to_le16(sdev_id);
1232         array->pd[0].ref.v.seq_num = 0;
1233         array->pd[0].fw_state = MFI_PD_STATE_ONLINE;
1234         array->pd[0].encl.pd = 0xFF;
1235         array->pd[0].encl.slot = (sdev->id & 0xFF);
1236         for (i = 1; i < MFI_MAX_ROW_SIZE; i++) {
1237             array->pd[i].ref.v.device_id = 0xFFFF;
1238             array->pd[i].ref.v.seq_num = 0;
1239             array->pd[i].fw_state = MFI_PD_STATE_UNCONFIGURED_GOOD;
1240             array->pd[i].encl.pd = 0xFF;
1241             array->pd[i].encl.slot = 0xFF;
1242         }
1243         array_offset += sizeof(struct mfi_array);
1244         ld = (struct mfi_ld_config *)(data + ld_offset);
1245         memset(ld, 0, sizeof(struct mfi_ld_config));
1246         ld->properties.ld.v.target_id = (sdev->id & 0xFF);
1247         ld->properties.default_cache_policy = MR_LD_CACHE_READ_AHEAD |
1248             MR_LD_CACHE_READ_ADAPTIVE;
1249         ld->properties.current_cache_policy = MR_LD_CACHE_READ_AHEAD |
1250             MR_LD_CACHE_READ_ADAPTIVE;
1251         ld->params.state = MFI_LD_STATE_OPTIMAL;
1252         ld->params.stripe_size = 3;
1253         ld->params.num_drives = 1;
1254         ld->params.span_depth = 1;
1255         ld->params.is_consistent = 1;
1256         ld->span[0].start_block = 0;
1257         ld->span[0].num_blocks = cpu_to_le64(pd_size);
1258         ld->span[0].array_ref = cpu_to_le16(sdev_id);
1259         ld_offset += sizeof(struct mfi_ld_config);
1260     }
1261
1262     cmd->iov_size -= dma_buf_read((uint8_t *)data, info->size, &cmd->qsg);
1263     return MFI_STAT_OK;
1264 }
1265
1266 static int megasas_dcmd_get_properties(MegasasState *s, MegasasCmd *cmd)
1267 {
1268     struct mfi_ctrl_props info;
1269     size_t dcmd_size = sizeof(info);
1270
1271     memset(&info, 0x0, dcmd_size);
1272     if (cmd->iov_size < dcmd_size) {
1273         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1274                                             dcmd_size);
1275         return MFI_STAT_INVALID_PARAMETER;
1276     }
1277     info.pred_fail_poll_interval = cpu_to_le16(300);
1278     info.intr_throttle_cnt = cpu_to_le16(16);
1279     info.intr_throttle_timeout = cpu_to_le16(50);
1280     info.rebuild_rate = 30;
1281     info.patrol_read_rate = 30;
1282     info.bgi_rate = 30;
1283     info.cc_rate = 30;
1284     info.recon_rate = 30;
1285     info.cache_flush_interval = 4;
1286     info.spinup_drv_cnt = 2;
1287     info.spinup_delay = 6;
1288     info.ecc_bucket_size = 15;
1289     info.ecc_bucket_leak_rate = cpu_to_le16(1440);
1290     info.expose_encl_devices = 1;
1291
1292     cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);
1293     return MFI_STAT_OK;
1294 }
1295
1296 static int megasas_cache_flush(MegasasState *s, MegasasCmd *cmd)
1297 {
1298     bdrv_drain_all();
1299     return MFI_STAT_OK;
1300 }
1301
1302 static int megasas_ctrl_shutdown(MegasasState *s, MegasasCmd *cmd)
1303 {
1304     s->fw_state = MFI_FWSTATE_READY;
1305     return MFI_STAT_OK;
1306 }
1307
1308 static int megasas_cluster_reset_ld(MegasasState *s, MegasasCmd *cmd)
1309 {
1310     return MFI_STAT_INVALID_DCMD;
1311 }
1312
1313 static int megasas_dcmd_set_properties(MegasasState *s, MegasasCmd *cmd)
1314 {
1315     struct mfi_ctrl_props info;
1316     size_t dcmd_size = sizeof(info);
1317
1318     if (cmd->iov_size < dcmd_size) {
1319         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
1320                                             dcmd_size);
1321         return MFI_STAT_INVALID_PARAMETER;
1322     }
1323     dma_buf_write((uint8_t *)&info, cmd->iov_size, &cmd->qsg);
1324     trace_megasas_dcmd_unsupported(cmd->index, cmd->iov_size);
1325     return MFI_STAT_OK;
1326 }
1327
1328 static int megasas_dcmd_dummy(MegasasState *s, MegasasCmd *cmd)
1329 {
1330     trace_megasas_dcmd_dummy(cmd->index, cmd->iov_size);
1331     return MFI_STAT_OK;
1332 }
1333
1334 static const struct dcmd_cmd_tbl_t {
1335     int opcode;
1336     const char *desc;
1337     int (*func)(MegasasState *s, MegasasCmd *cmd);
1338 } dcmd_cmd_tbl[] = {
1339     { MFI_DCMD_CTRL_MFI_HOST_MEM_ALLOC, "CTRL_HOST_MEM_ALLOC",
1340       megasas_dcmd_dummy },
1341     { MFI_DCMD_CTRL_GET_INFO, "CTRL_GET_INFO",
1342       megasas_ctrl_get_info },
1343     { MFI_DCMD_CTRL_GET_PROPERTIES, "CTRL_GET_PROPERTIES",
1344       megasas_dcmd_get_properties },
1345     { MFI_DCMD_CTRL_SET_PROPERTIES, "CTRL_SET_PROPERTIES",
1346       megasas_dcmd_set_properties },
1347     { MFI_DCMD_CTRL_ALARM_GET, "CTRL_ALARM_GET",
1348       megasas_dcmd_dummy },
1349     { MFI_DCMD_CTRL_ALARM_ENABLE, "CTRL_ALARM_ENABLE",
1350       megasas_dcmd_dummy },
1351     { MFI_DCMD_CTRL_ALARM_DISABLE, "CTRL_ALARM_DISABLE",
1352       megasas_dcmd_dummy },
1353     { MFI_DCMD_CTRL_ALARM_SILENCE, "CTRL_ALARM_SILENCE",
1354       megasas_dcmd_dummy },
1355     { MFI_DCMD_CTRL_ALARM_TEST, "CTRL_ALARM_TEST",
1356       megasas_dcmd_dummy },
1357     { MFI_DCMD_CTRL_EVENT_GETINFO, "CTRL_EVENT_GETINFO",
1358       megasas_event_info },
1359     { MFI_DCMD_CTRL_EVENT_GET, "CTRL_EVENT_GET",
1360       megasas_dcmd_dummy },
1361     { MFI_DCMD_CTRL_EVENT_WAIT, "CTRL_EVENT_WAIT",
1362       megasas_event_wait },
1363     { MFI_DCMD_CTRL_SHUTDOWN, "CTRL_SHUTDOWN",
1364       megasas_ctrl_shutdown },
1365     { MFI_DCMD_HIBERNATE_STANDBY, "CTRL_STANDBY",
1366       megasas_dcmd_dummy },
1367     { MFI_DCMD_CTRL_GET_TIME, "CTRL_GET_TIME",
1368       megasas_dcmd_get_fw_time },
1369     { MFI_DCMD_CTRL_SET_TIME, "CTRL_SET_TIME",
1370       megasas_dcmd_set_fw_time },
1371     { MFI_DCMD_CTRL_BIOS_DATA_GET, "CTRL_BIOS_DATA_GET",
1372       megasas_dcmd_get_bios_info },
1373     { MFI_DCMD_CTRL_FACTORY_DEFAULTS, "CTRL_FACTORY_DEFAULTS",
1374       megasas_dcmd_dummy },
1375     { MFI_DCMD_CTRL_MFC_DEFAULTS_GET, "CTRL_MFC_DEFAULTS_GET",
1376       megasas_mfc_get_defaults },
1377     { MFI_DCMD_CTRL_MFC_DEFAULTS_SET, "CTRL_MFC_DEFAULTS_SET",
1378       megasas_dcmd_dummy },
1379     { MFI_DCMD_CTRL_CACHE_FLUSH, "CTRL_CACHE_FLUSH",
1380       megasas_cache_flush },
1381     { MFI_DCMD_PD_GET_LIST, "PD_GET_LIST",
1382       megasas_dcmd_pd_get_list },
1383     { MFI_DCMD_PD_LIST_QUERY, "PD_LIST_QUERY",
1384       megasas_dcmd_pd_list_query },
1385     { MFI_DCMD_PD_GET_INFO, "PD_GET_INFO",
1386       megasas_dcmd_pd_get_info },
1387     { MFI_DCMD_PD_STATE_SET, "PD_STATE_SET",
1388       megasas_dcmd_dummy },
1389     { MFI_DCMD_PD_REBUILD, "PD_REBUILD",
1390       megasas_dcmd_dummy },
1391     { MFI_DCMD_PD_BLINK, "PD_BLINK",
1392       megasas_dcmd_dummy },
1393     { MFI_DCMD_PD_UNBLINK, "PD_UNBLINK",
1394       megasas_dcmd_dummy },
1395     { MFI_DCMD_LD_GET_LIST, "LD_GET_LIST",
1396       megasas_dcmd_ld_get_list},
1397     { MFI_DCMD_LD_GET_INFO, "LD_GET_INFO",
1398       megasas_dcmd_ld_get_info },
1399     { MFI_DCMD_LD_GET_PROP, "LD_GET_PROP",
1400       megasas_dcmd_dummy },
1401     { MFI_DCMD_LD_SET_PROP, "LD_SET_PROP",
1402       megasas_dcmd_dummy },
1403     { MFI_DCMD_LD_DELETE, "LD_DELETE",
1404       megasas_dcmd_dummy },
1405     { MFI_DCMD_CFG_READ, "CFG_READ",
1406       megasas_dcmd_cfg_read },
1407     { MFI_DCMD_CFG_ADD, "CFG_ADD",
1408       megasas_dcmd_dummy },
1409     { MFI_DCMD_CFG_CLEAR, "CFG_CLEAR",
1410       megasas_dcmd_dummy },
1411     { MFI_DCMD_CFG_FOREIGN_READ, "CFG_FOREIGN_READ",
1412       megasas_dcmd_dummy },
1413     { MFI_DCMD_CFG_FOREIGN_IMPORT, "CFG_FOREIGN_IMPORT",
1414       megasas_dcmd_dummy },
1415     { MFI_DCMD_BBU_STATUS, "BBU_STATUS",
1416       megasas_dcmd_dummy },
1417     { MFI_DCMD_BBU_CAPACITY_INFO, "BBU_CAPACITY_INFO",
1418       megasas_dcmd_dummy },
1419     { MFI_DCMD_BBU_DESIGN_INFO, "BBU_DESIGN_INFO",
1420       megasas_dcmd_dummy },
1421     { MFI_DCMD_BBU_PROP_GET, "BBU_PROP_GET",
1422       megasas_dcmd_dummy },
1423     { MFI_DCMD_CLUSTER, "CLUSTER",
1424       megasas_dcmd_dummy },
1425     { MFI_DCMD_CLUSTER_RESET_ALL, "CLUSTER_RESET_ALL",
1426       megasas_dcmd_dummy },
1427     { MFI_DCMD_CLUSTER_RESET_LD, "CLUSTER_RESET_LD",
1428       megasas_cluster_reset_ld },
1429     { -1, NULL, NULL }
1430 };
1431
1432 static int megasas_handle_dcmd(MegasasState *s, MegasasCmd *cmd)
1433 {
1434     int opcode, len;
1435     int retval = 0;
1436     const struct dcmd_cmd_tbl_t *cmdptr = dcmd_cmd_tbl;
1437
1438     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1439     trace_megasas_handle_dcmd(cmd->index, opcode);
1440     len = megasas_map_dcmd(s, cmd);
1441     if (len < 0) {
1442         return MFI_STAT_MEMORY_NOT_AVAILABLE;
1443     }
1444     while (cmdptr->opcode != -1 && cmdptr->opcode != opcode) {
1445         cmdptr++;
1446     }
1447     if (cmdptr->opcode == -1) {
1448         trace_megasas_dcmd_unhandled(cmd->index, opcode, len);
1449         retval = megasas_dcmd_dummy(s, cmd);
1450     } else {
1451         trace_megasas_dcmd_enter(cmd->index, cmdptr->desc, len);
1452         retval = cmdptr->func(s, cmd);
1453     }
1454     if (retval != MFI_STAT_INVALID_STATUS) {
1455         megasas_finish_dcmd(cmd, len);
1456     }
1457     return retval;
1458 }
1459
1460 static int megasas_finish_internal_dcmd(MegasasCmd *cmd,
1461                                         SCSIRequest *req)
1462 {
1463     int opcode;
1464     int retval = MFI_STAT_OK;
1465     int lun = req->lun;
1466
1467     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1468     scsi_req_unref(req);
1469     trace_megasas_dcmd_internal_finish(cmd->index, opcode, lun);
1470     switch (opcode) {
1471     case MFI_DCMD_PD_GET_INFO:
1472         retval = megasas_pd_get_info_submit(req->dev, lun, cmd);
1473         break;
1474     case MFI_DCMD_LD_GET_INFO:
1475         retval = megasas_ld_get_info_submit(req->dev, lun, cmd);
1476         break;
1477     default:
1478         trace_megasas_dcmd_internal_invalid(cmd->index, opcode);
1479         retval = MFI_STAT_INVALID_DCMD;
1480         break;
1481     }
1482     if (retval != MFI_STAT_INVALID_STATUS) {
1483         megasas_finish_dcmd(cmd, cmd->iov_size);
1484     }
1485     return retval;
1486 }
1487
1488 static int megasas_enqueue_req(MegasasCmd *cmd, bool is_write)
1489 {
1490     int len;
1491
1492     len = scsi_req_enqueue(cmd->req);
1493     if (len < 0) {
1494         len = -len;
1495     }
1496     if (len > 0) {
1497         if (len > cmd->iov_size) {
1498             if (is_write) {
1499                 trace_megasas_iov_write_overflow(cmd->index, len,
1500                                                  cmd->iov_size);
1501             } else {
1502                 trace_megasas_iov_read_overflow(cmd->index, len,
1503                                                 cmd->iov_size);
1504             }
1505         }
1506         if (len < cmd->iov_size) {
1507             if (is_write) {
1508                 trace_megasas_iov_write_underflow(cmd->index, len,
1509                                                   cmd->iov_size);
1510             } else {
1511                 trace_megasas_iov_read_underflow(cmd->index, len,
1512                                                  cmd->iov_size);
1513             }
1514             cmd->iov_size = len;
1515         }
1516         scsi_req_continue(cmd->req);
1517     }
1518     return len;
1519 }
1520
1521 static int megasas_handle_scsi(MegasasState *s, MegasasCmd *cmd,
1522                                bool is_logical)
1523 {
1524     uint8_t *cdb;
1525     int len;
1526     bool is_write;
1527     struct SCSIDevice *sdev = NULL;
1528
1529     cdb = cmd->frame->pass.cdb;
1530
1531     if (cmd->frame->header.target_id < s->fw_luns) {
1532         sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1533                                 cmd->frame->header.lun_id);
1534     }
1535     cmd->iov_size = le32_to_cpu(cmd->frame->header.data_len);
1536     trace_megasas_handle_scsi(mfi_frame_desc[cmd->frame->header.frame_cmd],
1537                               is_logical, cmd->frame->header.target_id,
1538                               cmd->frame->header.lun_id, sdev, cmd->iov_size);
1539
1540     if (!sdev || (megasas_is_jbod(s) && is_logical)) {
1541         trace_megasas_scsi_target_not_present(
1542             mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1543             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1544         return MFI_STAT_DEVICE_NOT_FOUND;
1545     }
1546
1547     if (cmd->frame->header.cdb_len > 16) {
1548         trace_megasas_scsi_invalid_cdb_len(
1549                 mfi_frame_desc[cmd->frame->header.frame_cmd], is_logical,
1550                 cmd->frame->header.target_id, cmd->frame->header.lun_id,
1551                 cmd->frame->header.cdb_len);
1552         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1553         cmd->frame->header.scsi_status = CHECK_CONDITION;
1554         s->event_count++;
1555         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1556     }
1557
1558     if (megasas_map_sgl(s, cmd, &cmd->frame->pass.sgl)) {
1559         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1560         cmd->frame->header.scsi_status = CHECK_CONDITION;
1561         s->event_count++;
1562         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1563     }
1564
1565     cmd->req = scsi_req_new(sdev, cmd->index,
1566                             cmd->frame->header.lun_id, cdb, cmd);
1567     if (!cmd->req) {
1568         trace_megasas_scsi_req_alloc_failed(
1569                 mfi_frame_desc[cmd->frame->header.frame_cmd],
1570                 cmd->frame->header.target_id, cmd->frame->header.lun_id);
1571         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1572         cmd->frame->header.scsi_status = BUSY;
1573         s->event_count++;
1574         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1575     }
1576
1577     is_write = (cmd->req->cmd.mode == SCSI_XFER_TO_DEV);
1578     len = megasas_enqueue_req(cmd, is_write);
1579     if (len > 0) {
1580         if (is_write) {
1581             trace_megasas_scsi_write_start(cmd->index, len);
1582         } else {
1583             trace_megasas_scsi_read_start(cmd->index, len);
1584         }
1585     } else {
1586         trace_megasas_scsi_nodata(cmd->index);
1587     }
1588     return MFI_STAT_INVALID_STATUS;
1589 }
1590
1591 static int megasas_handle_io(MegasasState *s, MegasasCmd *cmd)
1592 {
1593     uint32_t lba_count, lba_start_hi, lba_start_lo;
1594     uint64_t lba_start;
1595     bool is_write = (cmd->frame->header.frame_cmd == MFI_CMD_LD_WRITE);
1596     uint8_t cdb[16];
1597     int len;
1598     struct SCSIDevice *sdev = NULL;
1599
1600     lba_count = le32_to_cpu(cmd->frame->io.header.data_len);
1601     lba_start_lo = le32_to_cpu(cmd->frame->io.lba_lo);
1602     lba_start_hi = le32_to_cpu(cmd->frame->io.lba_hi);
1603     lba_start = ((uint64_t)lba_start_hi << 32) | lba_start_lo;
1604
1605     if (cmd->frame->header.target_id < s->fw_luns) {
1606         sdev = scsi_device_find(&s->bus, 0, cmd->frame->header.target_id,
1607                                 cmd->frame->header.lun_id);
1608     }
1609
1610     trace_megasas_handle_io(cmd->index,
1611                             mfi_frame_desc[cmd->frame->header.frame_cmd],
1612                             cmd->frame->header.target_id,
1613                             cmd->frame->header.lun_id,
1614                             (unsigned long)lba_start, (unsigned long)lba_count);
1615     if (!sdev) {
1616         trace_megasas_io_target_not_present(cmd->index,
1617             mfi_frame_desc[cmd->frame->header.frame_cmd],
1618             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1619         return MFI_STAT_DEVICE_NOT_FOUND;
1620     }
1621
1622     if (cmd->frame->header.cdb_len > 16) {
1623         trace_megasas_scsi_invalid_cdb_len(
1624             mfi_frame_desc[cmd->frame->header.frame_cmd], 1,
1625             cmd->frame->header.target_id, cmd->frame->header.lun_id,
1626             cmd->frame->header.cdb_len);
1627         megasas_write_sense(cmd, SENSE_CODE(INVALID_OPCODE));
1628         cmd->frame->header.scsi_status = CHECK_CONDITION;
1629         s->event_count++;
1630         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1631     }
1632
1633     cmd->iov_size = lba_count * sdev->blocksize;
1634     if (megasas_map_sgl(s, cmd, &cmd->frame->io.sgl)) {
1635         megasas_write_sense(cmd, SENSE_CODE(TARGET_FAILURE));
1636         cmd->frame->header.scsi_status = CHECK_CONDITION;
1637         s->event_count++;
1638         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1639     }
1640
1641     megasas_encode_lba(cdb, lba_start, lba_count, is_write);
1642     cmd->req = scsi_req_new(sdev, cmd->index,
1643                             cmd->frame->header.lun_id, cdb, cmd);
1644     if (!cmd->req) {
1645         trace_megasas_scsi_req_alloc_failed(
1646             mfi_frame_desc[cmd->frame->header.frame_cmd],
1647             cmd->frame->header.target_id, cmd->frame->header.lun_id);
1648         megasas_write_sense(cmd, SENSE_CODE(NO_SENSE));
1649         cmd->frame->header.scsi_status = BUSY;
1650         s->event_count++;
1651         return MFI_STAT_SCSI_DONE_WITH_ERROR;
1652     }
1653     len = megasas_enqueue_req(cmd, is_write);
1654     if (len > 0) {
1655         if (is_write) {
1656             trace_megasas_io_write_start(cmd->index, lba_start, lba_count, len);
1657         } else {
1658             trace_megasas_io_read_start(cmd->index, lba_start, lba_count, len);
1659         }
1660     }
1661     return MFI_STAT_INVALID_STATUS;
1662 }
1663
1664 static int megasas_finish_internal_command(MegasasCmd *cmd,
1665                                            SCSIRequest *req, size_t resid)
1666 {
1667     int retval = MFI_STAT_INVALID_CMD;
1668
1669     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1670         cmd->iov_size -= resid;
1671         retval = megasas_finish_internal_dcmd(cmd, req);
1672     }
1673     return retval;
1674 }
1675
1676 static QEMUSGList *megasas_get_sg_list(SCSIRequest *req)
1677 {
1678     MegasasCmd *cmd = req->hba_private;
1679
1680     if (cmd->frame->header.frame_cmd == MFI_CMD_DCMD) {
1681         return NULL;
1682     } else {
1683         return &cmd->qsg;
1684     }
1685 }
1686
1687 static void megasas_xfer_complete(SCSIRequest *req, uint32_t len)
1688 {
1689     MegasasCmd *cmd = req->hba_private;
1690     uint8_t *buf;
1691     uint32_t opcode;
1692
1693     trace_megasas_io_complete(cmd->index, len);
1694
1695     if (cmd->frame->header.frame_cmd != MFI_CMD_DCMD) {
1696         scsi_req_continue(req);
1697         return;
1698     }
1699
1700     buf = scsi_req_get_buf(req);
1701     opcode = le32_to_cpu(cmd->frame->dcmd.opcode);
1702     if (opcode == MFI_DCMD_PD_GET_INFO && cmd->iov_buf) {
1703         struct mfi_pd_info *info = cmd->iov_buf;
1704
1705         if (info->inquiry_data[0] == 0x7f) {
1706             memset(info->inquiry_data, 0, sizeof(info->inquiry_data));
1707             memcpy(info->inquiry_data, buf, len);
1708         } else if (info->vpd_page83[0] == 0x7f) {
1709             memset(info->vpd_page83, 0, sizeof(info->vpd_page83));
1710             memcpy(info->vpd_page83, buf, len);
1711         }
1712         scsi_req_continue(req);
1713     } else if (opcode == MFI_DCMD_LD_GET_INFO) {
1714         struct mfi_ld_info *info = cmd->iov_buf;
1715
1716         if (cmd->iov_buf) {
1717             memcpy(info->vpd_page83, buf, sizeof(info->vpd_page83));
1718             scsi_req_continue(req);
1719         }
1720     }
1721 }
1722
1723 static void megasas_command_complete(SCSIRequest *req, uint32_t status,
1724                                      size_t resid)
1725 {
1726     MegasasCmd *cmd = req->hba_private;
1727     uint8_t cmd_status = MFI_STAT_OK;
1728
1729     trace_megasas_command_complete(cmd->index, status, resid);
1730
1731     if (cmd->req != req) {
1732         /*
1733          * Internal command complete
1734          */
1735         cmd_status = megasas_finish_internal_command(cmd, req, resid);
1736         if (cmd_status == MFI_STAT_INVALID_STATUS) {
1737             return;
1738         }
1739     } else {
1740         req->status = status;
1741         trace_megasas_scsi_complete(cmd->index, req->status,
1742                                     cmd->iov_size, req->cmd.xfer);
1743         if (req->status != GOOD) {
1744             cmd_status = MFI_STAT_SCSI_DONE_WITH_ERROR;
1745         }
1746         if (req->status == CHECK_CONDITION) {
1747             megasas_copy_sense(cmd);
1748         }
1749
1750         megasas_unmap_sgl(cmd);
1751         cmd->frame->header.scsi_status = req->status;
1752         scsi_req_unref(cmd->req);
1753         cmd->req = NULL;
1754     }
1755     cmd->frame->header.cmd_status = cmd_status;
1756     megasas_complete_frame(cmd->state, cmd->context);
1757 }
1758
1759 static void megasas_command_cancel(SCSIRequest *req)
1760 {
1761     MegasasCmd *cmd = req->hba_private;
1762
1763     if (cmd) {
1764         megasas_abort_command(cmd);
1765     } else {
1766         scsi_req_unref(req);
1767     }
1768 }
1769
1770 static int megasas_handle_abort(MegasasState *s, MegasasCmd *cmd)
1771 {
1772     uint64_t abort_ctx = le64_to_cpu(cmd->frame->abort.abort_context);
1773     hwaddr abort_addr, addr_hi, addr_lo;
1774     MegasasCmd *abort_cmd;
1775
1776     addr_hi = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_hi);
1777     addr_lo = le32_to_cpu(cmd->frame->abort.abort_mfi_addr_lo);
1778     abort_addr = ((uint64_t)addr_hi << 32) | addr_lo;
1779
1780     abort_cmd = megasas_lookup_frame(s, abort_addr);
1781     if (!abort_cmd) {
1782         trace_megasas_abort_no_cmd(cmd->index, abort_ctx);
1783         s->event_count++;
1784         return MFI_STAT_OK;
1785     }
1786     if (!megasas_use_queue64(s)) {
1787         abort_ctx &= (uint64_t)0xFFFFFFFF;
1788     }
1789     if (abort_cmd->context != abort_ctx) {
1790         trace_megasas_abort_invalid_context(cmd->index, abort_cmd->index,
1791                                             abort_cmd->context);
1792         s->event_count++;
1793         return MFI_STAT_ABORT_NOT_POSSIBLE;
1794     }
1795     trace_megasas_abort_frame(cmd->index, abort_cmd->index);
1796     megasas_abort_command(abort_cmd);
1797     if (!s->event_cmd || abort_cmd != s->event_cmd) {
1798         s->event_cmd = NULL;
1799     }
1800     s->event_count++;
1801     return MFI_STAT_OK;
1802 }
1803
1804 static void megasas_handle_frame(MegasasState *s, uint64_t frame_addr,
1805                                  uint32_t frame_count)
1806 {
1807     uint8_t frame_status = MFI_STAT_INVALID_CMD;
1808     uint64_t frame_context;
1809     MegasasCmd *cmd;
1810
1811     /*
1812      * Always read 64bit context, top bits will be
1813      * masked out if required in megasas_enqueue_frame()
1814      */
1815     frame_context = megasas_frame_get_context(frame_addr);
1816
1817     cmd = megasas_enqueue_frame(s, frame_addr, frame_context, frame_count);
1818     if (!cmd) {
1819         /* reply queue full */
1820         trace_megasas_frame_busy(frame_addr);
1821         megasas_frame_set_scsi_status(frame_addr, BUSY);
1822         megasas_frame_set_cmd_status(frame_addr, MFI_STAT_SCSI_DONE_WITH_ERROR);
1823         megasas_complete_frame(s, frame_context);
1824         s->event_count++;
1825         return;
1826     }
1827     switch (cmd->frame->header.frame_cmd) {
1828     case MFI_CMD_INIT:
1829         frame_status = megasas_init_firmware(s, cmd);
1830         break;
1831     case MFI_CMD_DCMD:
1832         frame_status = megasas_handle_dcmd(s, cmd);
1833         break;
1834     case MFI_CMD_ABORT:
1835         frame_status = megasas_handle_abort(s, cmd);
1836         break;
1837     case MFI_CMD_PD_SCSI_IO:
1838         frame_status = megasas_handle_scsi(s, cmd, 0);
1839         break;
1840     case MFI_CMD_LD_SCSI_IO:
1841         frame_status = megasas_handle_scsi(s, cmd, 1);
1842         break;
1843     case MFI_CMD_LD_READ:
1844     case MFI_CMD_LD_WRITE:
1845         frame_status = megasas_handle_io(s, cmd);
1846         break;
1847     default:
1848         trace_megasas_unhandled_frame_cmd(cmd->index,
1849                                           cmd->frame->header.frame_cmd);
1850         s->event_count++;
1851         break;
1852     }
1853     if (frame_status != MFI_STAT_INVALID_STATUS) {
1854         if (cmd->frame) {
1855             cmd->frame->header.cmd_status = frame_status;
1856         } else {
1857             megasas_frame_set_cmd_status(frame_addr, frame_status);
1858         }
1859         megasas_complete_frame(s, cmd->context);
1860     }
1861 }
1862
1863 static uint64_t megasas_mmio_read(void *opaque, hwaddr addr,
1864                                   unsigned size)
1865 {
1866     MegasasState *s = opaque;
1867     uint32_t retval = 0;
1868
1869     switch (addr) {
1870     case MFI_IDB:
1871         retval = 0;
1872         break;
1873     case MFI_OMSG0:
1874     case MFI_OSP0:
1875         retval = (megasas_use_msix(s) ? MFI_FWSTATE_MSIX_SUPPORTED : 0) |
1876             (s->fw_state & MFI_FWSTATE_MASK) |
1877             ((s->fw_sge & 0xff) << 16) |
1878             (s->fw_cmds & 0xFFFF);
1879         break;
1880     case MFI_OSTS:
1881         if (megasas_intr_enabled(s) && s->doorbell) {
1882             retval = MFI_1078_RM | 1;
1883         }
1884         break;
1885     case MFI_OMSK:
1886         retval = s->intr_mask;
1887         break;
1888     case MFI_ODCR0:
1889         retval = s->doorbell;
1890         break;
1891     default:
1892         trace_megasas_mmio_invalid_readl(addr);
1893         break;
1894     }
1895     trace_megasas_mmio_readl(addr, retval);
1896     return retval;
1897 }
1898
1899 static void megasas_mmio_write(void *opaque, hwaddr addr,
1900                                uint64_t val, unsigned size)
1901 {
1902     MegasasState *s = opaque;
1903     uint64_t frame_addr;
1904     uint32_t frame_count;
1905     int i;
1906
1907     trace_megasas_mmio_writel(addr, val);
1908     switch (addr) {
1909     case MFI_IDB:
1910         if (val & MFI_FWINIT_ABORT) {
1911             /* Abort all pending cmds */
1912             for (i = 0; i < s->fw_cmds; i++) {
1913                 megasas_abort_command(&s->frames[i]);
1914             }
1915         }
1916         if (val & MFI_FWINIT_READY) {
1917             /* move to FW READY */
1918             megasas_soft_reset(s);
1919         }
1920         if (val & MFI_FWINIT_MFIMODE) {
1921             /* discard MFIs */
1922         }
1923         break;
1924     case MFI_OMSK:
1925         s->intr_mask = val;
1926         if (!megasas_intr_enabled(s) && !msix_enabled(&s->dev)) {
1927             trace_megasas_irq_lower();
1928             qemu_irq_lower(s->dev.irq[0]);
1929         }
1930         if (megasas_intr_enabled(s)) {
1931             trace_megasas_intr_enabled();
1932         } else {
1933             trace_megasas_intr_disabled();
1934         }
1935         break;
1936     case MFI_ODCR0:
1937         s->doorbell = 0;
1938         if (s->producer_pa && megasas_intr_enabled(s)) {
1939             /* Update reply queue pointer */
1940             trace_megasas_qf_update(s->reply_queue_head, s->busy);
1941             stl_le_phys(s->producer_pa, s->reply_queue_head);
1942             if (!msix_enabled(&s->dev)) {
1943                 trace_megasas_irq_lower();
1944                 qemu_irq_lower(s->dev.irq[0]);
1945             }
1946         }
1947         break;
1948     case MFI_IQPH:
1949         /* Received high 32 bits of a 64 bit MFI frame address */
1950         s->frame_hi = val;
1951         break;
1952     case MFI_IQPL:
1953         /* Received low 32 bits of a 64 bit MFI frame address */
1954     case MFI_IQP:
1955         /* Received 32 bit MFI frame address */
1956         frame_addr = (val & ~0x1F);
1957         /* Add possible 64 bit offset */
1958         frame_addr |= ((uint64_t)s->frame_hi << 32);
1959         s->frame_hi = 0;
1960         frame_count = (val >> 1) & 0xF;
1961         megasas_handle_frame(s, frame_addr, frame_count);
1962         break;
1963     default:
1964         trace_megasas_mmio_invalid_writel(addr, val);
1965         break;
1966     }
1967 }
1968
1969 static const MemoryRegionOps megasas_mmio_ops = {
1970     .read = megasas_mmio_read,
1971     .write = megasas_mmio_write,
1972     .endianness = DEVICE_LITTLE_ENDIAN,
1973     .impl = {
1974         .min_access_size = 8,
1975         .max_access_size = 8,
1976     }
1977 };
1978
1979 static uint64_t megasas_port_read(void *opaque, hwaddr addr,
1980                                   unsigned size)
1981 {
1982     return megasas_mmio_read(opaque, addr & 0xff, size);
1983 }
1984
1985 static void megasas_port_write(void *opaque, hwaddr addr,
1986                                uint64_t val, unsigned size)
1987 {
1988     megasas_mmio_write(opaque, addr & 0xff, val, size);
1989 }
1990
1991 static const MemoryRegionOps megasas_port_ops = {
1992     .read = megasas_port_read,
1993     .write = megasas_port_write,
1994     .endianness = DEVICE_LITTLE_ENDIAN,
1995     .impl = {
1996         .min_access_size = 4,
1997         .max_access_size = 4,
1998     }
1999 };
2000
2001 static uint64_t megasas_queue_read(void *opaque, hwaddr addr,
2002                                    unsigned size)
2003 {
2004     return 0;
2005 }
2006
2007 static const MemoryRegionOps megasas_queue_ops = {
2008     .read = megasas_queue_read,
2009     .endianness = DEVICE_LITTLE_ENDIAN,
2010     .impl = {
2011         .min_access_size = 8,
2012         .max_access_size = 8,
2013     }
2014 };
2015
2016 static void megasas_soft_reset(MegasasState *s)
2017 {
2018     int i;
2019     MegasasCmd *cmd;
2020
2021     trace_megasas_reset();
2022     for (i = 0; i < s->fw_cmds; i++) {
2023         cmd = &s->frames[i];
2024         megasas_abort_command(cmd);
2025     }
2026     megasas_reset_frames(s);
2027     s->reply_queue_len = s->fw_cmds;
2028     s->reply_queue_pa = 0;
2029     s->consumer_pa = 0;
2030     s->producer_pa = 0;
2031     s->fw_state = MFI_FWSTATE_READY;
2032     s->doorbell = 0;
2033     s->intr_mask = MEGASAS_INTR_DISABLED_MASK;
2034     s->frame_hi = 0;
2035     s->flags &= ~MEGASAS_MASK_USE_QUEUE64;
2036     s->event_count++;
2037     s->boot_event = s->event_count;
2038 }
2039
2040 static void megasas_scsi_reset(DeviceState *dev)
2041 {
2042     MegasasState *s = DO_UPCAST(MegasasState, dev.qdev, dev);
2043
2044     megasas_soft_reset(s);
2045 }
2046
2047 static const VMStateDescription vmstate_megasas = {
2048     .name = "megasas",
2049     .version_id = 0,
2050     .minimum_version_id = 0,
2051     .minimum_version_id_old = 0,
2052     .fields      = (VMStateField[]) {
2053         VMSTATE_PCI_DEVICE(dev, MegasasState),
2054
2055         VMSTATE_INT32(fw_state, MegasasState),
2056         VMSTATE_INT32(intr_mask, MegasasState),
2057         VMSTATE_INT32(doorbell, MegasasState),
2058         VMSTATE_UINT64(reply_queue_pa, MegasasState),
2059         VMSTATE_UINT64(consumer_pa, MegasasState),
2060         VMSTATE_UINT64(producer_pa, MegasasState),
2061         VMSTATE_END_OF_LIST()
2062     }
2063 };
2064
2065 static void megasas_scsi_uninit(PCIDevice *d)
2066 {
2067     MegasasState *s = DO_UPCAST(MegasasState, dev, d);
2068
2069 #ifdef USE_MSIX
2070     msix_uninit(&s->dev, &s->mmio_io);
2071 #endif
2072     memory_region_destroy(&s->mmio_io);
2073     memory_region_destroy(&s->port_io);
2074     memory_region_destroy(&s->queue_io);
2075 }
2076
2077 static const struct SCSIBusInfo megasas_scsi_info = {
2078     .tcq = true,
2079     .max_target = MFI_MAX_LD,
2080     .max_lun = 255,
2081
2082     .transfer_data = megasas_xfer_complete,
2083     .get_sg_list = megasas_get_sg_list,
2084     .complete = megasas_command_complete,
2085     .cancel = megasas_command_cancel,
2086 };
2087
2088 static int megasas_scsi_init(PCIDevice *dev)
2089 {
2090     MegasasState *s = DO_UPCAST(MegasasState, dev, dev);
2091     uint8_t *pci_conf;
2092     int i, bar_type;
2093
2094     pci_conf = s->dev.config;
2095
2096     /* PCI latency timer = 0 */
2097     pci_conf[PCI_LATENCY_TIMER] = 0;
2098     /* Interrupt pin 1 */
2099     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
2100
2101     memory_region_init_io(&s->mmio_io, NULL, &megasas_mmio_ops, s,
2102                           "megasas-mmio", 0x4000);
2103     memory_region_init_io(&s->port_io, NULL, &megasas_port_ops, s,
2104                           "megasas-io", 256);
2105     memory_region_init_io(&s->queue_io, NULL, &megasas_queue_ops, s,
2106                           "megasas-queue", 0x40000);
2107
2108 #ifdef USE_MSIX
2109     /* MSI-X support is currently broken */
2110     if (megasas_use_msix(s) &&
2111         msix_init(&s->dev, 15, &s->mmio_io, 0, 0x2000)) {
2112         s->flags &= ~MEGASAS_MASK_USE_MSIX;
2113     }
2114 #else
2115     s->flags &= ~MEGASAS_MASK_USE_MSIX;
2116 #endif
2117
2118     bar_type = PCI_BASE_ADDRESS_SPACE_MEMORY | PCI_BASE_ADDRESS_MEM_TYPE_64;
2119     pci_register_bar(&s->dev, 0, bar_type, &s->mmio_io);
2120     pci_register_bar(&s->dev, 2, PCI_BASE_ADDRESS_SPACE_IO, &s->port_io);
2121     pci_register_bar(&s->dev, 3, bar_type, &s->queue_io);
2122
2123     if (megasas_use_msix(s)) {
2124         msix_vector_use(&s->dev, 0);
2125     }
2126
2127     if (!s->sas_addr) {
2128         s->sas_addr = ((NAA_LOCALLY_ASSIGNED_ID << 24) |
2129                        IEEE_COMPANY_LOCALLY_ASSIGNED) << 36;
2130         s->sas_addr |= (pci_bus_num(dev->bus) << 16);
2131         s->sas_addr |= (PCI_SLOT(dev->devfn) << 8);
2132         s->sas_addr |= PCI_FUNC(dev->devfn);
2133     }
2134     if (!s->hba_serial) {
2135         s->hba_serial = g_strdup(MEGASAS_HBA_SERIAL);
2136     }
2137     if (s->fw_sge >= MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE) {
2138         s->fw_sge = MEGASAS_MAX_SGE - MFI_PASS_FRAME_SIZE;
2139     } else if (s->fw_sge >= 128 - MFI_PASS_FRAME_SIZE) {
2140         s->fw_sge = 128 - MFI_PASS_FRAME_SIZE;
2141     } else {
2142         s->fw_sge = 64 - MFI_PASS_FRAME_SIZE;
2143     }
2144     if (s->fw_cmds > MEGASAS_MAX_FRAMES) {
2145         s->fw_cmds = MEGASAS_MAX_FRAMES;
2146     }
2147     trace_megasas_init(s->fw_sge, s->fw_cmds,
2148                        megasas_use_msix(s) ? "MSI-X" : "INTx",
2149                        megasas_is_jbod(s) ? "jbod" : "raid");
2150     s->fw_luns = (MFI_MAX_LD > MAX_SCSI_DEVS) ?
2151         MAX_SCSI_DEVS : MFI_MAX_LD;
2152     s->producer_pa = 0;
2153     s->consumer_pa = 0;
2154     for (i = 0; i < s->fw_cmds; i++) {
2155         s->frames[i].index = i;
2156         s->frames[i].context = -1;
2157         s->frames[i].pa = 0;
2158         s->frames[i].state = s;
2159     }
2160
2161     scsi_bus_new(&s->bus, &dev->qdev, &megasas_scsi_info, NULL);
2162     scsi_bus_legacy_handle_cmdline(&s->bus);
2163     return 0;
2164 }
2165
2166 static Property megasas_properties[] = {
2167     DEFINE_PROP_UINT32("max_sge", MegasasState, fw_sge,
2168                        MEGASAS_DEFAULT_SGE),
2169     DEFINE_PROP_UINT32("max_cmds", MegasasState, fw_cmds,
2170                        MEGASAS_DEFAULT_FRAMES),
2171     DEFINE_PROP_STRING("hba_serial", MegasasState, hba_serial),
2172     DEFINE_PROP_HEX64("sas_address", MegasasState, sas_addr, 0),
2173 #ifdef USE_MSIX
2174     DEFINE_PROP_BIT("use_msix", MegasasState, flags,
2175                     MEGASAS_FLAG_USE_MSIX, false),
2176 #endif
2177     DEFINE_PROP_BIT("use_jbod", MegasasState, flags,
2178                     MEGASAS_FLAG_USE_JBOD, false),
2179     DEFINE_PROP_END_OF_LIST(),
2180 };
2181
2182 static void megasas_class_init(ObjectClass *oc, void *data)
2183 {
2184     DeviceClass *dc = DEVICE_CLASS(oc);
2185     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
2186
2187     pc->init = megasas_scsi_init;
2188     pc->exit = megasas_scsi_uninit;
2189     pc->vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2190     pc->device_id = PCI_DEVICE_ID_LSI_SAS1078;
2191     pc->subsystem_vendor_id = PCI_VENDOR_ID_LSI_LOGIC;
2192     pc->subsystem_id = 0x1013;
2193     pc->class_id = PCI_CLASS_STORAGE_RAID;
2194     dc->props = megasas_properties;
2195     dc->reset = megasas_scsi_reset;
2196     dc->vmsd = &vmstate_megasas;
2197     dc->desc = "LSI MegaRAID SAS 1078";
2198 }
2199
2200 static const TypeInfo megasas_info = {
2201     .name  = "megasas",
2202     .parent = TYPE_PCI_DEVICE,
2203     .instance_size = sizeof(MegasasState),
2204     .class_init = megasas_class_init,
2205 };
2206
2207 static void megasas_register_types(void)
2208 {
2209     type_register_static(&megasas_info);
2210 }
2211
2212 type_init(megasas_register_types)