Archipelago » qemu

/*

 * QEMU MegaRAID SAS 8708EM2 Host Bus Adapter emulation

 * Based on the linux driver code at drivers/scsi/megaraid

 *

 * Copyright (c) 2009-2012 Hannes Reinecke, SUSE Labs

 *

 * This library is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public

 * License as published by the Free Software Foundation; either

 * version 2 of the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this library; if not, see <http://www.gnu.org/licenses/>.

 */

#include "hw.h"

#include "pci/pci.h"

#include "sysemu/dma.h"

#include "pci/msix.h"

#include "qemu/iov.h"

#include "scsi.h"

#include "scsi-defs.h"

#include "trace.h"

#include "mfi.h"

#define MEGASAS_VERSION "1.70"

#define MEGASAS_MAX_FRAMES 2048         /* Firmware limit at 65535 */

#define MEGASAS_DEFAULT_FRAMES 1000     /* Windows requires this */

#define MEGASAS_MAX_SGE 128             /* Firmware limit */

#define MEGASAS_DEFAULT_SGE 80

#define MEGASAS_MAX_SECTORS 0xFFFF      /* No real limit */

#define MEGASAS_MAX_ARRAYS 128

#define MEGASAS_HBA_SERIAL "QEMU123456"

#define NAA_LOCALLY_ASSIGNED_ID 0x3ULL

#define IEEE_COMPANY_LOCALLY_ASSIGNED 0x525400

#define MEGASAS_FLAG_USE_JBOD      0

#define MEGASAS_MASK_USE_JBOD      (1 << MEGASAS_FLAG_USE_JBOD)

#define MEGASAS_FLAG_USE_MSIX      1

#define MEGASAS_MASK_USE_MSIX      (1 << MEGASAS_FLAG_USE_MSIX)

#define MEGASAS_FLAG_USE_QUEUE64   2

#define MEGASAS_MASK_USE_QUEUE64   (1 << MEGASAS_FLAG_USE_QUEUE64)

static const char *mfi_frame_desc[] = {

    "MFI init", "LD Read", "LD Write", "LD SCSI", "PD SCSI",

    "MFI Doorbell", "MFI Abort", "MFI SMP", "MFI Stop"};

typedef struct MegasasCmd {

    uint32_t index;

    uint16_t flags;

    uint16_t count;

    uint64_t context;

    hwaddr pa;

    hwaddr pa_size;

    union mfi_frame *frame;

    SCSIRequest *req;

    QEMUSGList qsg;

    void *iov_buf;

    size_t iov_size;

    size_t iov_offset;

    struct MegasasState *state;

} MegasasCmd;

typedef struct MegasasState {

    PCIDevice dev;

    MemoryRegion mmio_io;

    MemoryRegion port_io;

    MemoryRegion queue_io;

    uint32_t frame_hi;

    int fw_state;

    uint32_t fw_sge;

    uint32_t fw_cmds;

    uint32_t flags;

    int fw_luns;

    int intr_mask;

    int doorbell;

    int busy;

    MegasasCmd *event_cmd;

    int event_locale;

    int event_class;

    int event_count;

    int shutdown_event;

    int boot_event;

    uint64_t sas_addr;

    char *hba_serial;

    uint64_t reply_queue_pa;

    void *reply_queue;

    int reply_queue_len;

    int reply_queue_head;

    int reply_queue_tail;

    uint64_t consumer_pa;

    uint64_t producer_pa;

    MegasasCmd frames[MEGASAS_MAX_FRAMES];

    SCSIBus bus;

} MegasasState;

#define MEGASAS_INTR_DISABLED_MASK 0xFFFFFFFF

static bool megasas_intr_enabled(MegasasState *s)

{

    if ((s->intr_mask & MEGASAS_INTR_DISABLED_MASK) !=

        MEGASAS_INTR_DISABLED_MASK) {

        return true;

    }

    return false;

}

static bool megasas_use_queue64(MegasasState *s)

{

    return s->flags & MEGASAS_MASK_USE_QUEUE64;

}

static bool megasas_use_msix(MegasasState *s)

{

    return s->flags & MEGASAS_MASK_USE_MSIX;

}

static bool megasas_is_jbod(MegasasState *s)

{

    return s->flags & MEGASAS_MASK_USE_JBOD;

}

static void megasas_frame_set_cmd_status(unsigned long frame, uint8_t v)

{

    stb_phys(frame + offsetof(struct mfi_frame_header, cmd_status), v);

}

static void megasas_frame_set_scsi_status(unsigned long frame, uint8_t v)

{

    stb_phys(frame + offsetof(struct mfi_frame_header, scsi_status), v);

}

/*

 * Context is considered opaque, but the HBA firmware is running

 * in little endian mode. So convert it to little endian, too.

 */

static uint64_t megasas_frame_get_context(unsigned long frame)

{

    return ldq_le_phys(frame + offsetof(struct mfi_frame_header, context));

}

static bool megasas_frame_is_ieee_sgl(MegasasCmd *cmd)

{

    return cmd->flags & MFI_FRAME_IEEE_SGL;

}

static bool megasas_frame_is_sgl64(MegasasCmd *cmd)

{

    return cmd->flags & MFI_FRAME_SGL64;

}

static bool megasas_frame_is_sense64(MegasasCmd *cmd)

{

    return cmd->flags & MFI_FRAME_SENSE64;

}

static uint64_t megasas_sgl_get_addr(MegasasCmd *cmd,

                                     union mfi_sgl *sgl)

{

    uint64_t addr;

    if (megasas_frame_is_ieee_sgl(cmd)) {

        addr = le64_to_cpu(sgl->sg_skinny->addr);

    } else if (megasas_frame_is_sgl64(cmd)) {

        addr = le64_to_cpu(sgl->sg64->addr);

    } else {

        addr = le32_to_cpu(sgl->sg32->addr);

    }

    return addr;

}

static uint32_t megasas_sgl_get_len(MegasasCmd *cmd,

                                    union mfi_sgl *sgl)

{

    uint32_t len;

    if (megasas_frame_is_ieee_sgl(cmd)) {

        len = le32_to_cpu(sgl->sg_skinny->len);

    } else if (megasas_frame_is_sgl64(cmd)) {

        len = le32_to_cpu(sgl->sg64->len);

    } else {

        len = le32_to_cpu(sgl->sg32->len);

    }

    return len;

}

static union mfi_sgl *megasas_sgl_next(MegasasCmd *cmd,

                                       union mfi_sgl *sgl)

{

    uint8_t *next = (uint8_t *)sgl;

    if (megasas_frame_is_ieee_sgl(cmd)) {

        next += sizeof(struct mfi_sg_skinny);

    } else if (megasas_frame_is_sgl64(cmd)) {

        next += sizeof(struct mfi_sg64);

    } else {

        next += sizeof(struct mfi_sg32);

    }

    if (next >= (uint8_t *)cmd->frame + cmd->pa_size) {

        return NULL;

    }

    return (union mfi_sgl *)next;

}

static void megasas_soft_reset(MegasasState *s);

static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)

{

    int i;

    int iov_count = 0;

    size_t iov_size = 0;

    cmd->flags = le16_to_cpu(cmd->frame->header.flags);

    iov_count = cmd->frame->header.sge_count;

    if (iov_count > MEGASAS_MAX_SGE) {

        trace_megasas_iovec_sgl_overflow(cmd->index, iov_count,

                                         MEGASAS_MAX_SGE);

        return iov_count;

    }

    qemu_sglist_init(&cmd->qsg, iov_count, pci_dma_context(&s->dev));

    for (i = 0; i < iov_count; i++) {

        dma_addr_t iov_pa, iov_size_p;

        if (!sgl) {

            trace_megasas_iovec_sgl_underflow(cmd->index, i);

            goto unmap;

        }

        iov_pa = megasas_sgl_get_addr(cmd, sgl);

        iov_size_p = megasas_sgl_get_len(cmd, sgl);

        if (!iov_pa || !iov_size_p) {

            trace_megasas_iovec_sgl_invalid(cmd->index, i,

                                            iov_pa, iov_size_p);

            goto unmap;

        }

        qemu_sglist_add(&cmd->qsg, iov_pa, iov_size_p);

        sgl = megasas_sgl_next(cmd, sgl);

        iov_size += (size_t)iov_size_p;

    }

    if (cmd->iov_size > iov_size) {

        trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);

    } else if (cmd->iov_size < iov_size) {

        trace_megasas_iovec_underflow(cmd->iov_size, iov_size, cmd->iov_size);

    }

    cmd->iov_offset = 0;

    return 0;

unmap:

    qemu_sglist_destroy(&cmd->qsg);

    return iov_count - i;

}

static void megasas_unmap_sgl(MegasasCmd *cmd)

{

    qemu_sglist_destroy(&cmd->qsg);

    cmd->iov_offset = 0;

}

/*

 * passthrough sense and io sense are at the same offset

 */

static int megasas_build_sense(MegasasCmd *cmd, uint8_t *sense_ptr,

    uint8_t sense_len)

{

    uint32_t pa_hi = 0, pa_lo;

    hwaddr pa;

    if (sense_len > cmd->frame->header.sense_len) {

        sense_len = cmd->frame->header.sense_len;

    }

    if (sense_len) {

        pa_lo = le32_to_cpu(cmd->frame->pass.sense_addr_lo);

        if (megasas_frame_is_sense64(cmd)) {

            pa_hi = le32_to_cpu(cmd->frame->pass.sense_addr_hi);

        }

        pa = ((uint64_t) pa_hi << 32) | pa_lo;

        cpu_physical_memory_write(pa, sense_ptr, sense_len);

        cmd->frame->header.sense_len = sense_len;

    }

    return sense_len;

}

static void megasas_write_sense(MegasasCmd *cmd, SCSISense sense)

{

    uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];

    uint8_t sense_len = 18;

    memset(sense_buf, 0, sense_len);

    sense_buf[0] = 0xf0;

    sense_buf[2] = sense.key;

    sense_buf[7] = 10;

    sense_buf[12] = sense.asc;

    sense_buf[13] = sense.ascq;

    megasas_build_sense(cmd, sense_buf, sense_len);

}

static void megasas_copy_sense(MegasasCmd *cmd)

{

    uint8_t sense_buf[SCSI_SENSE_BUF_SIZE];

    uint8_t sense_len;

    sense_len = scsi_req_get_sense(cmd->req, sense_buf,

                                   SCSI_SENSE_BUF_SIZE);

    megasas_build_sense(cmd, sense_buf, sense_len);

}

/*

 * Format an INQUIRY CDB

 */

static int megasas_setup_inquiry(uint8_t *cdb, int pg, int len)

{

    memset(cdb, 0, 6);

    cdb[0] = INQUIRY;

    if (pg > 0) {

        cdb[1] = 0x1;

        cdb[2] = pg;

    }

    cdb[3] = (len >> 8) & 0xff;

    cdb[4] = (len & 0xff);

    return len;

}

/*

 * Encode lba and len into a READ_16/WRITE_16 CDB

 */

static void megasas_encode_lba(uint8_t *cdb, uint64_t lba,

                               uint32_t len, bool is_write)

{

    memset(cdb, 0x0, 16);

    if (is_write) {

        cdb[0] = WRITE_16;

    } else {

        cdb[0] = READ_16;

    }

    cdb[2] = (lba >> 56) & 0xff;

    cdb[3] = (lba >> 48) & 0xff;

    cdb[4] = (lba >> 40) & 0xff;

    cdb[5] = (lba >> 32) & 0xff;

    cdb[6] = (lba >> 24) & 0xff;

    cdb[7] = (lba >> 16) & 0xff;

    cdb[8] = (lba >> 8) & 0xff;

    cdb[9] = (lba) & 0xff;

    cdb[10] = (len >> 24) & 0xff;

    cdb[11] = (len >> 16) & 0xff;

    cdb[12] = (len >> 8) & 0xff;

    cdb[13] = (len) & 0xff;

}

/*

 * Utility functions

 */

static uint64_t megasas_fw_time(void)

{

    struct tm curtime;

    uint64_t bcd_time;

    qemu_get_timedate(&curtime, 0);

    bcd_time = ((uint64_t)curtime.tm_sec & 0xff) << 48 |

        ((uint64_t)curtime.tm_min & 0xff)  << 40 |

        ((uint64_t)curtime.tm_hour & 0xff) << 32 |

        ((uint64_t)curtime.tm_mday & 0xff) << 24 |

        ((uint64_t)curtime.tm_mon & 0xff)  << 16 |

        ((uint64_t)(curtime.tm_year + 1900) & 0xffff);

    return bcd_time;

}

/*

 * Default disk sata address

 * 0x1221 is the magic number as

 * present in real hardware,

 * so use it here, too.

 */

static uint64_t megasas_get_sata_addr(uint16_t id)

{

    uint64_t addr = (0x1221ULL << 48);

    return addr & (id << 24);

}

/*

 * Frame handling

 */

static int megasas_next_index(MegasasState *s, int index, int limit)

{

    index++;

    if (index == limit) {

        index = 0;

    }

    return index;

}

static MegasasCmd *megasas_lookup_frame(MegasasState *s,

    hwaddr frame)

{

    MegasasCmd *cmd = NULL;

    int num = 0, index;

    index = s->reply_queue_head;

    while (num < s->fw_cmds) {

        if (s->frames[index].pa && s->frames[index].pa == frame) {

            cmd = &s->frames[index];

            break;

        }

        index = megasas_next_index(s, index, s->fw_cmds);

        num++;

    }

    return cmd;

}

static MegasasCmd *megasas_next_frame(MegasasState *s,

    hwaddr frame)

{

    MegasasCmd *cmd = NULL;

    int num = 0, index;

    cmd = megasas_lookup_frame(s, frame);

    if (cmd) {

        trace_megasas_qf_found(cmd->index, cmd->pa);

        return cmd;

    }

    index = s->reply_queue_head;

    num = 0;

    while (num < s->fw_cmds) {

        if (!s->frames[index].pa) {

            cmd = &s->frames[index];

            break;

        }

        index = megasas_next_index(s, index, s->fw_cmds);

        num++;

    }

    if (!cmd) {

        trace_megasas_qf_failed(frame);

    }

    trace_megasas_qf_new(index, cmd);

    return cmd;

}

static MegasasCmd *megasas_enqueue_frame(MegasasState *s,

    hwaddr frame, uint64_t context, int count)

{

    MegasasCmd *cmd = NULL;

    int frame_size = MFI_FRAME_SIZE * 16;

    hwaddr frame_size_p = frame_size;

    cmd = megasas_next_frame(s, frame);

    /* All frames busy */

    if (!cmd) {

        return NULL;

    }

    if (!cmd->pa) {

        cmd->pa = frame;

        /* Map all possible frames */

        cmd->frame = cpu_physical_memory_map(frame, &frame_size_p, 0);

        if (frame_size_p != frame_size) {

            trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);

            if (cmd->frame) {

                cpu_physical_memory_unmap(cmd->frame, frame_size_p, 0, 0);

                cmd->frame = NULL;

                cmd->pa = 0;

            }

            s->event_count++;

            return NULL;

        }

        cmd->pa_size = frame_size_p;

        cmd->context = context;

        if (!megasas_use_queue64(s)) {

            cmd->context &= (uint64_t)0xFFFFFFFF;

        }

    }

    cmd->count = count;

    s->busy++;

    trace_megasas_qf_enqueue(cmd->index, cmd->count, cmd->context,

                             s->reply_queue_head, s->busy);

    return cmd;

}

static void megasas_complete_frame(MegasasState *s, uint64_t context)

{

    int tail, queue_offset;

    /* Decrement busy count */

    s->busy--;

    if (s->reply_queue_pa) {

        /*

         * Put command on the reply queue.

         * Context is opaque, but emulation is running in

         * little endian. So convert it.

         */

        tail = s->reply_queue_head;

        if (megasas_use_queue64(s)) {

            queue_offset = tail * sizeof(uint64_t);

            stq_le_phys(s->reply_queue_pa + queue_offset, context);

        } else {

            queue_offset = tail * sizeof(uint32_t);

            stl_le_phys(s->reply_queue_pa + queue_offset, context);

        }

        s->reply_queue_head = megasas_next_index(s, tail, s->fw_cmds);

        trace_megasas_qf_complete(context, tail, queue_offset,

                                  s->busy, s->doorbell);

    }

    if (megasas_intr_enabled(s)) {

        /* Notify HBA */

        s->doorbell++;

        if (s->doorbell == 1) {

            if (msix_enabled(&s->dev)) {

                trace_megasas_msix_raise(0);

                msix_notify(&s->dev, 0);

            } else {

                trace_megasas_irq_raise();

                qemu_irq_raise(s->dev.irq[0]);

            }

        }

    } else {

        trace_megasas_qf_complete_noirq(context);

    }

}

static void megasas_reset_frames(MegasasState *s)

{

    int i;

    MegasasCmd *cmd;

    for (i = 0; i < s->fw_cmds; i++) {

        cmd = &s->frames[i];

        if (cmd->pa) {

            cpu_physical_memory_unmap(cmd->frame, cmd->pa_size, 0, 0);

            cmd->frame = NULL;

            cmd->pa = 0;

        }

    }

}

static void megasas_abort_command(MegasasCmd *cmd)

{

    if (cmd->req) {

        scsi_req_cancel(cmd->req);

        cmd->req = NULL;

    }

}

static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)

{

    uint32_t pa_hi, pa_lo;

    hwaddr iq_pa, initq_size;

    struct mfi_init_qinfo *initq;

    uint32_t flags;

    int ret = MFI_STAT_OK;

    pa_lo = le32_to_cpu(cmd->frame->init.qinfo_new_addr_lo);

    pa_hi = le32_to_cpu(cmd->frame->init.qinfo_new_addr_hi);

    iq_pa = (((uint64_t) pa_hi << 32) | pa_lo);

    trace_megasas_init_firmware((uint64_t)iq_pa);

    initq_size = sizeof(*initq);

    initq = cpu_physical_memory_map(iq_pa, &initq_size, 0);

    if (!initq || initq_size != sizeof(*initq)) {

        trace_megasas_initq_map_failed(cmd->index);

        s->event_count++;

        ret = MFI_STAT_MEMORY_NOT_AVAILABLE;

        goto out;

    }

    s->reply_queue_len = le32_to_cpu(initq->rq_entries) & 0xFFFF;

    if (s->reply_queue_len > s->fw_cmds) {

        trace_megasas_initq_mismatch(s->reply_queue_len, s->fw_cmds);

        s->event_count++;

        ret = MFI_STAT_INVALID_PARAMETER;

        goto out;

    }

    pa_lo = le32_to_cpu(initq->rq_addr_lo);

    pa_hi = le32_to_cpu(initq->rq_addr_hi);

    s->reply_queue_pa = ((uint64_t) pa_hi << 32) | pa_lo;

    pa_lo = le32_to_cpu(initq->ci_addr_lo);

    pa_hi = le32_to_cpu(initq->ci_addr_hi);

    s->consumer_pa = ((uint64_t) pa_hi << 32) | pa_lo;

    pa_lo = le32_to_cpu(initq->pi_addr_lo);

    pa_hi = le32_to_cpu(initq->pi_addr_hi);

    s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;

    s->reply_queue_head = ldl_le_phys(s->producer_pa);

    s->reply_queue_tail = ldl_le_phys(s->consumer_pa);

    flags = le32_to_cpu(initq->flags);

    if (flags & MFI_QUEUE_FLAG_CONTEXT64) {

        s->flags |= MEGASAS_MASK_USE_QUEUE64;

    }

    trace_megasas_init_queue((unsigned long)s->reply_queue_pa,

                             s->reply_queue_len, s->reply_queue_head,

                             s->reply_queue_tail, flags);

    megasas_reset_frames(s);

    s->fw_state = MFI_FWSTATE_OPERATIONAL;

out:

    if (initq) {

        cpu_physical_memory_unmap(initq, initq_size, 0, 0);

    }

    return ret;

}

static int megasas_map_dcmd(MegasasState *s, MegasasCmd *cmd)

{

    dma_addr_t iov_pa, iov_size;

    cmd->flags = le16_to_cpu(cmd->frame->header.flags);

    if (!cmd->frame->header.sge_count) {

        trace_megasas_dcmd_zero_sge(cmd->index);

        cmd->iov_size = 0;

        return 0;

    } else if (cmd->frame->header.sge_count > 1) {

        trace_megasas_dcmd_invalid_sge(cmd->index,

                                       cmd->frame->header.sge_count);

        cmd->iov_size = 0;

        return -1;

    }

    iov_pa = megasas_sgl_get_addr(cmd, &cmd->frame->dcmd.sgl);

    iov_size = megasas_sgl_get_len(cmd, &cmd->frame->dcmd.sgl);

    qemu_sglist_init(&cmd->qsg, 1, pci_dma_context(&s->dev));

    qemu_sglist_add(&cmd->qsg, iov_pa, iov_size);

    cmd->iov_size = iov_size;

    return cmd->iov_size;

}

static void megasas_finish_dcmd(MegasasCmd *cmd, uint32_t iov_size)

{

    trace_megasas_finish_dcmd(cmd->index, iov_size);

    if (cmd->frame->header.sge_count) {

        qemu_sglist_destroy(&cmd->qsg);

    }

    if (iov_size > cmd->iov_size) {

        if (megasas_frame_is_ieee_sgl(cmd)) {

            cmd->frame->dcmd.sgl.sg_skinny->len = cpu_to_le32(iov_size);

        } else if (megasas_frame_is_sgl64(cmd)) {

            cmd->frame->dcmd.sgl.sg64->len = cpu_to_le32(iov_size);

        } else {

            cmd->frame->dcmd.sgl.sg32->len = cpu_to_le32(iov_size);

        }

    }

    cmd->iov_size = 0;

}

static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)

{

    struct mfi_ctrl_info info;

    size_t dcmd_size = sizeof(info);

    BusChild *kid;

    int num_ld_disks = 0;

    uint16_t sdev_id;

    memset(&info, 0x0, cmd->iov_size);

    if (cmd->iov_size < dcmd_size) {

        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,

                                            dcmd_size);

        return MFI_STAT_INVALID_PARAMETER;

    }

    info.pci.vendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);

    info.pci.device = cpu_to_le16(PCI_DEVICE_ID_LSI_SAS1078);

    info.pci.subvendor = cpu_to_le16(PCI_VENDOR_ID_LSI_LOGIC);

    info.pci.subdevice = cpu_to_le16(0x1013);

    /*

     * For some reason the firmware supports

     * only up to 8 device ports.

     * Despite supporting a far larger number

     * of devices for the physical devices.

     * So just display the first 8 devices

     * in the device port list, independent

     * of how many logical devices are actually

     * present.

     */

    info.host.type = MFI_INFO_HOST_PCIE;

    info.device.type = MFI_INFO_DEV_SAS3G;

    info.device.port_count = 8;

    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {

        SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);

        if (num_ld_disks < 8) {

            sdev_id = ((sdev->id & 0xFF) >> 8) | (sdev->lun & 0xFF);

            info.device.port_addr[num_ld_disks] =

                cpu_to_le64(megasas_get_sata_addr(sdev_id));

        }

        num_ld_disks++;

    }

    memcpy(info.product_name, "MegaRAID SAS 8708EM2", 20);

    snprintf(info.serial_number, 32, "%s", s->hba_serial);

    snprintf(info.package_version, 0x60, "%s-QEMU", QEMU_VERSION);

    memcpy(info.image_component[0].name, "APP", 3);

    memcpy(info.image_component[0].version, MEGASAS_VERSION "-QEMU", 9);

    memcpy(info.image_component[0].build_date, __DATE__, 11);

    memcpy(info.image_component[0].build_time, __TIME__, 8);

    info.image_component_count = 1;

    if (s->dev.has_rom) {

        uint8_t biosver[32];

        uint8_t *ptr;

        ptr = memory_region_get_ram_ptr(&s->dev.rom);

        memcpy(biosver, ptr + 0x41, 31);

        qemu_put_ram_ptr(ptr);

        memcpy(info.image_component[1].name, "BIOS", 4);

        memcpy(info.image_component[1].version, biosver,

               strlen((const char *)biosver));

        info.image_component_count++;

    }

    info.current_fw_time = cpu_to_le32(megasas_fw_time());

    info.max_arms = 32;

    info.max_spans = 8;

    info.max_arrays = MEGASAS_MAX_ARRAYS;

    info.max_lds = s->fw_luns;

    info.max_cmds = cpu_to_le16(s->fw_cmds);

    info.max_sg_elements = cpu_to_le16(s->fw_sge);

    info.max_request_size = cpu_to_le32(MEGASAS_MAX_SECTORS);

    info.lds_present = cpu_to_le16(num_ld_disks);

    info.pd_present = cpu_to_le16(num_ld_disks);

    info.pd_disks_present = cpu_to_le16(num_ld_disks);

    info.hw_present = cpu_to_le32(MFI_INFO_HW_NVRAM |

                                   MFI_INFO_HW_MEM |

                                   MFI_INFO_HW_FLASH);

    info.memory_size = cpu_to_le16(512);

    info.nvram_size = cpu_to_le16(32);

    info.flash_size = cpu_to_le16(16);

    info.raid_levels = cpu_to_le32(MFI_INFO_RAID_0);

    info.adapter_ops = cpu_to_le32(MFI_INFO_AOPS_RBLD_RATE |

                                    MFI_INFO_AOPS_SELF_DIAGNOSTIC |

                                    MFI_INFO_AOPS_MIXED_ARRAY);

    info.ld_ops = cpu_to_le32(MFI_INFO_LDOPS_DISK_CACHE_POLICY |

                               MFI_INFO_LDOPS_ACCESS_POLICY |

                               MFI_INFO_LDOPS_IO_POLICY |

                               MFI_INFO_LDOPS_WRITE_POLICY |

                               MFI_INFO_LDOPS_READ_POLICY);

    info.max_strips_per_io = cpu_to_le16(s->fw_sge);

    info.stripe_sz_ops.min = 3;

    info.stripe_sz_ops.max = ffs(MEGASAS_MAX_SECTORS + 1) - 1;

    info.properties.pred_fail_poll_interval = cpu_to_le16(300);

    info.properties.intr_throttle_cnt = cpu_to_le16(16);

    info.properties.intr_throttle_timeout = cpu_to_le16(50);

    info.properties.rebuild_rate = 30;

    info.properties.patrol_read_rate = 30;

    info.properties.bgi_rate = 30;

    info.properties.cc_rate = 30;

    info.properties.recon_rate = 30;

    info.properties.cache_flush_interval = 4;

    info.properties.spinup_drv_cnt = 2;

    info.properties.spinup_delay = 6;

    info.properties.ecc_bucket_size = 15;

    info.properties.ecc_bucket_leak_rate = cpu_to_le16(1440);

    info.properties.expose_encl_devices = 1;

    info.properties.OnOffProperties = cpu_to_le32(MFI_CTRL_PROP_EnableJBOD);

    info.pd_ops = cpu_to_le32(MFI_INFO_PDOPS_FORCE_ONLINE |

                               MFI_INFO_PDOPS_FORCE_OFFLINE);

    info.pd_mix_support = cpu_to_le32(MFI_INFO_PDMIX_SAS |

                                       MFI_INFO_PDMIX_SATA |

                                       MFI_INFO_PDMIX_LD);

    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);

    return MFI_STAT_OK;

}

static int megasas_mfc_get_defaults(MegasasState *s, MegasasCmd *cmd)

{

    struct mfi_defaults info;

    size_t dcmd_size = sizeof(struct mfi_defaults);

    memset(&info, 0x0, dcmd_size);

    if (cmd->iov_size < dcmd_size) {

        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,

                                            dcmd_size);

        return MFI_STAT_INVALID_PARAMETER;

    }

    info.sas_addr = cpu_to_le64(s->sas_addr);

    info.stripe_size = 3;

    info.flush_time = 4;

    info.background_rate = 30;

    info.allow_mix_in_enclosure = 1;

    info.allow_mix_in_ld = 1;

    info.direct_pd_mapping = 1;

    /* Enable for BIOS support */

    info.bios_enumerate_lds = 1;

    info.disable_ctrl_r = 1;

    info.expose_enclosure_devices = 1;

    info.disable_preboot_cli = 1;

    info.cluster_disable = 1;

    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);

    return MFI_STAT_OK;

}

static int megasas_dcmd_get_bios_info(MegasasState *s, MegasasCmd *cmd)

{

    struct mfi_bios_data info;

    size_t dcmd_size = sizeof(info);

    memset(&info, 0x0, dcmd_size);

    if (cmd->iov_size < dcmd_size) {

        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,

                                            dcmd_size);

        return MFI_STAT_INVALID_PARAMETER;

    }

    info.continue_on_error = 1;

    info.verbose = 1;

    if (megasas_is_jbod(s)) {

        info.expose_all_drives = 1;

    }

    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);

    return MFI_STAT_OK;

}

static int megasas_dcmd_get_fw_time(MegasasState *s, MegasasCmd *cmd)

{

    uint64_t fw_time;

    size_t dcmd_size = sizeof(fw_time);

    fw_time = cpu_to_le64(megasas_fw_time());

    cmd->iov_size -= dma_buf_read((uint8_t *)&fw_time, dcmd_size, &cmd->qsg);

    return MFI_STAT_OK;

}

static int megasas_dcmd_set_fw_time(MegasasState *s, MegasasCmd *cmd)

{

    uint64_t fw_time;

    /* This is a dummy; setting of firmware time is not allowed */

    memcpy(&fw_time, cmd->frame->dcmd.mbox, sizeof(fw_time));

    trace_megasas_dcmd_set_fw_time(cmd->index, fw_time);

    fw_time = cpu_to_le64(megasas_fw_time());

    return MFI_STAT_OK;

}

static int megasas_event_info(MegasasState *s, MegasasCmd *cmd)

{

    struct mfi_evt_log_state info;

    size_t dcmd_size = sizeof(info);

    memset(&info, 0, dcmd_size);

    info.newest_seq_num = cpu_to_le32(s->event_count);

    info.shutdown_seq_num = cpu_to_le32(s->shutdown_event);

    info.boot_seq_num = cpu_to_le32(s->boot_event);

    cmd->iov_size -= dma_buf_read((uint8_t *)&info, dcmd_size, &cmd->qsg);

    return MFI_STAT_OK;

}

static int megasas_event_wait(MegasasState *s, MegasasCmd *cmd)

{

    union mfi_evt event;

    if (cmd->iov_size < sizeof(struct mfi_evt_detail)) {

        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,

                                            sizeof(struct mfi_evt_detail));

        return MFI_STAT_INVALID_PARAMETER;

    }

    s->event_count = cpu_to_le32(cmd->frame->dcmd.mbox[0]);

    event.word = cpu_to_le32(cmd->frame->dcmd.mbox[4]);

    s->event_locale = event.members.locale;

    s->event_class = event.members.class;

    s->event_cmd = cmd;

    /* Decrease busy count; event frame doesn't count here */

    s->busy--;

    cmd->iov_size = sizeof(struct mfi_evt_detail);

    return MFI_STAT_INVALID_STATUS;

}

static int megasas_dcmd_pd_get_list(MegasasState *s, MegasasCmd *cmd)

{

    struct mfi_pd_list info;

    size_t dcmd_size = sizeof(info);

    BusChild *kid;

    uint32_t offset, dcmd_limit, num_pd_disks = 0, max_pd_disks;

    uint16_t sdev_id;

    memset(&info, 0, dcmd_size);

    offset = 8;

    dcmd_limit = offset + sizeof(struct mfi_pd_address);

    if (cmd->iov_size < dcmd_limit) {

        trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,

                                            dcmd_limit);

        return MFI_STAT_INVALID_PARAMETER;

    }

    max_pd_disks = (cmd->iov_size - offset) / sizeof(struct mfi_pd_address);

    if (max_pd_disks > s->fw_luns) {

        max_pd_disks = s->fw_luns;

    }

    QTAILQ_FOREACH(kid, &s->bus.qbus.children, sibling) {

        SCSIDevice *sdev = DO_UPCAST(SCSIDevice, qdev, kid->child);