xref: /freebsd/sys/dev/mfi/mfi.c (revision 0c927cdd8e6e05387fc5a9ffcb5dbe128d4ad749)
1 /*-
2  * Copyright (c) 2006 IronPort Systems
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include "opt_mfi.h"
31 
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/sysctl.h>
35 #include <sys/malloc.h>
36 #include <sys/kernel.h>
37 #include <sys/poll.h>
38 #include <sys/selinfo.h>
39 #include <sys/bus.h>
40 #include <sys/conf.h>
41 #include <sys/eventhandler.h>
42 #include <sys/rman.h>
43 #include <sys/bus_dma.h>
44 #include <sys/bio.h>
45 #include <sys/ioccom.h>
46 #include <sys/uio.h>
47 #include <sys/proc.h>
48 #include <sys/signalvar.h>
49 
50 #include <machine/bus.h>
51 #include <machine/resource.h>
52 
53 #include <dev/mfi/mfireg.h>
54 #include <dev/mfi/mfi_ioctl.h>
55 #include <dev/mfi/mfivar.h>
56 
57 static int	mfi_alloc_commands(struct mfi_softc *);
58 static int	mfi_comms_init(struct mfi_softc *);
59 static int	mfi_wait_command(struct mfi_softc *, struct mfi_command *);
60 static int	mfi_get_controller_info(struct mfi_softc *);
61 static int	mfi_get_log_state(struct mfi_softc *,
62 		    struct mfi_evt_log_state **);
63 static int	mfi_get_entry(struct mfi_softc *, int);
64 static int	mfi_dcmd_command(struct mfi_softc *, struct mfi_command **,
65 		    uint32_t, void **, size_t);
66 static void	mfi_data_cb(void *, bus_dma_segment_t *, int, int);
67 static void	mfi_startup(void *arg);
68 static void	mfi_intr(void *arg);
69 static void	mfi_enable_intr(struct mfi_softc *sc);
70 static void	mfi_ldprobe(struct mfi_softc *sc);
71 static int	mfi_aen_register(struct mfi_softc *sc, int seq, int locale);
72 static void	mfi_aen_complete(struct mfi_command *);
73 static int	mfi_aen_setup(struct mfi_softc *, uint32_t);
74 static int	mfi_add_ld(struct mfi_softc *sc, int);
75 static void	mfi_add_ld_complete(struct mfi_command *);
76 static struct mfi_command * mfi_bio_command(struct mfi_softc *);
77 static void	mfi_bio_complete(struct mfi_command *);
78 static int	mfi_mapcmd(struct mfi_softc *, struct mfi_command *);
79 static int	mfi_send_frame(struct mfi_softc *, struct mfi_command *);
80 static void	mfi_complete(struct mfi_softc *, struct mfi_command *);
81 static int	mfi_abort(struct mfi_softc *, struct mfi_command *);
82 static int	mfi_linux_ioctl_int(struct cdev *, u_long, caddr_t, int, d_thread_t *);
83 static void	mfi_timeout(void *);
84 
85 
86 SYSCTL_NODE(_hw, OID_AUTO, mfi, CTLFLAG_RD, 0, "MFI driver parameters");
87 static int	mfi_event_locale = MFI_EVT_LOCALE_ALL;
88 TUNABLE_INT("hw.mfi.event_locale", &mfi_event_locale);
89 SYSCTL_INT(_hw_mfi, OID_AUTO, event_locale, CTLFLAG_RW, &mfi_event_locale,
90             0, "event message locale");
91 
92 static int	mfi_event_class = MFI_EVT_CLASS_INFO;
93 TUNABLE_INT("hw.mfi.event_class", &mfi_event_class);
94 SYSCTL_INT(_hw_mfi, OID_AUTO, event_class, CTLFLAG_RW, &mfi_event_class,
95           0, "event message class");
96 
97 /* Management interface */
98 static d_open_t		mfi_open;
99 static d_close_t	mfi_close;
100 static d_ioctl_t	mfi_ioctl;
101 static d_poll_t		mfi_poll;
102 
103 static struct cdevsw mfi_cdevsw = {
104 	.d_version = 	D_VERSION,
105 	.d_flags =	0,
106 	.d_open = 	mfi_open,
107 	.d_close =	mfi_close,
108 	.d_ioctl =	mfi_ioctl,
109 	.d_poll =	mfi_poll,
110 	.d_name =	"mfi",
111 };
112 
113 MALLOC_DEFINE(M_MFIBUF, "mfibuf", "Buffers for the MFI driver");
114 
115 #define MFI_INQ_LENGTH SHORT_INQUIRY_LENGTH
116 
117 static int
118 mfi_transition_firmware(struct mfi_softc *sc)
119 {
120 	int32_t fw_state, cur_state;
121 	int max_wait, i;
122 
123 	fw_state = MFI_READ4(sc, MFI_OMSG0) & MFI_FWSTATE_MASK;
124 	while (fw_state != MFI_FWSTATE_READY) {
125 		if (bootverbose)
126 			device_printf(sc->mfi_dev, "Waiting for firmware to "
127 			    "become ready\n");
128 		cur_state = fw_state;
129 		switch (fw_state) {
130 		case MFI_FWSTATE_FAULT:
131 			device_printf(sc->mfi_dev, "Firmware fault\n");
132 			return (ENXIO);
133 		case MFI_FWSTATE_WAIT_HANDSHAKE:
134 			MFI_WRITE4(sc, MFI_IDB, MFI_FWINIT_CLEAR_HANDSHAKE);
135 			max_wait = 2;
136 			break;
137 		case MFI_FWSTATE_OPERATIONAL:
138 			MFI_WRITE4(sc, MFI_IDB, MFI_FWINIT_READY);
139 			max_wait = 10;
140 			break;
141 		case MFI_FWSTATE_UNDEFINED:
142 		case MFI_FWSTATE_BB_INIT:
143 			max_wait = 2;
144 			break;
145 		case MFI_FWSTATE_FW_INIT:
146 		case MFI_FWSTATE_DEVICE_SCAN:
147 		case MFI_FWSTATE_FLUSH_CACHE:
148 			max_wait = 20;
149 			break;
150 		default:
151 			device_printf(sc->mfi_dev,"Unknown firmware state %d\n",
152 			    fw_state);
153 			return (ENXIO);
154 		}
155 		for (i = 0; i < (max_wait * 10); i++) {
156 			fw_state = MFI_READ4(sc, MFI_OMSG0) & MFI_FWSTATE_MASK;
157 			if (fw_state == cur_state)
158 				DELAY(100000);
159 			else
160 				break;
161 		}
162 		if (fw_state == cur_state) {
163 			device_printf(sc->mfi_dev, "firmware stuck in state "
164 			    "%#x\n", fw_state);
165 			return (ENXIO);
166 		}
167 	}
168 	return (0);
169 }
170 
171 static void
172 mfi_addr32_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
173 {
174 	uint32_t *addr;
175 
176 	addr = arg;
177 	*addr = segs[0].ds_addr;
178 }
179 
180 int
181 mfi_attach(struct mfi_softc *sc)
182 {
183 	uint32_t status;
184 	int error, commsz, framessz, sensesz;
185 	int frames, unit, max_fw_sge;
186 
187 	mtx_init(&sc->mfi_io_lock, "MFI I/O lock", NULL, MTX_DEF);
188 	TAILQ_INIT(&sc->mfi_ld_tqh);
189 	TAILQ_INIT(&sc->mfi_aen_pids);
190 	TAILQ_INIT(&sc->mfi_cam_ccbq);
191 
192 	mfi_initq_free(sc);
193 	mfi_initq_ready(sc);
194 	mfi_initq_busy(sc);
195 	mfi_initq_bio(sc);
196 
197 	/* Before we get too far, see if the firmware is working */
198 	if ((error = mfi_transition_firmware(sc)) != 0) {
199 		device_printf(sc->mfi_dev, "Firmware not in READY state, "
200 		    "error %d\n", error);
201 		return (ENXIO);
202 	}
203 
204 	/*
205 	 * Get information needed for sizing the contiguous memory for the
206 	 * frame pool.  Size down the sgl parameter since we know that
207 	 * we will never need more than what's required for MAXPHYS.
208 	 * It would be nice if these constants were available at runtime
209 	 * instead of compile time.
210 	 */
211 	status = MFI_READ4(sc, MFI_OMSG0);
212 	sc->mfi_max_fw_cmds = status & MFI_FWSTATE_MAXCMD_MASK;
213 	max_fw_sge = (status & MFI_FWSTATE_MAXSGL_MASK) >> 16;
214 	sc->mfi_max_sge = min(max_fw_sge, ((MAXPHYS / PAGE_SIZE) + 1));
215 
216 	/*
217 	 * Create the dma tag for data buffers.  Used both for block I/O
218 	 * and for various internal data queries.
219 	 */
220 	if (bus_dma_tag_create( sc->mfi_parent_dmat,	/* parent */
221 				1, 0,			/* algnmnt, boundary */
222 				BUS_SPACE_MAXADDR,	/* lowaddr */
223 				BUS_SPACE_MAXADDR,	/* highaddr */
224 				NULL, NULL,		/* filter, filterarg */
225 				BUS_SPACE_MAXSIZE_32BIT,/* maxsize */
226 				sc->mfi_max_sge,	/* nsegments */
227 				BUS_SPACE_MAXSIZE_32BIT,/* maxsegsize */
228 				BUS_DMA_ALLOCNOW,	/* flags */
229 				busdma_lock_mutex,	/* lockfunc */
230 				&sc->mfi_io_lock,	/* lockfuncarg */
231 				&sc->mfi_buffer_dmat)) {
232 		device_printf(sc->mfi_dev, "Cannot allocate buffer DMA tag\n");
233 		return (ENOMEM);
234 	}
235 
236 	/*
237 	 * Allocate DMA memory for the comms queues.  Keep it under 4GB for
238 	 * efficiency.  The mfi_hwcomms struct includes space for 1 reply queue
239 	 * entry, so the calculated size here will be will be 1 more than
240 	 * mfi_max_fw_cmds.  This is apparently a requirement of the hardware.
241 	 */
242 	commsz = (sizeof(uint32_t) * sc->mfi_max_fw_cmds) +
243 	    sizeof(struct mfi_hwcomms);
244 	if (bus_dma_tag_create( sc->mfi_parent_dmat,	/* parent */
245 				1, 0,			/* algnmnt, boundary */
246 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
247 				BUS_SPACE_MAXADDR,	/* highaddr */
248 				NULL, NULL,		/* filter, filterarg */
249 				commsz,			/* maxsize */
250 				1,			/* msegments */
251 				commsz,			/* maxsegsize */
252 				0,			/* flags */
253 				NULL, NULL,		/* lockfunc, lockarg */
254 				&sc->mfi_comms_dmat)) {
255 		device_printf(sc->mfi_dev, "Cannot allocate comms DMA tag\n");
256 		return (ENOMEM);
257 	}
258 	if (bus_dmamem_alloc(sc->mfi_comms_dmat, (void **)&sc->mfi_comms,
259 	    BUS_DMA_NOWAIT, &sc->mfi_comms_dmamap)) {
260 		device_printf(sc->mfi_dev, "Cannot allocate comms memory\n");
261 		return (ENOMEM);
262 	}
263 	bzero(sc->mfi_comms, commsz);
264 	bus_dmamap_load(sc->mfi_comms_dmat, sc->mfi_comms_dmamap,
265 	    sc->mfi_comms, commsz, mfi_addr32_cb, &sc->mfi_comms_busaddr, 0);
266 
267 	/*
268 	 * Allocate DMA memory for the command frames.  Keep them in the
269 	 * lower 4GB for efficiency.  Calculate the size of the commands at
270 	 * the same time; each command is one 64 byte frame plus a set of
271          * additional frames for holding sg lists or other data.
272 	 * The assumption here is that the SG list will start at the second
273 	 * frame and not use the unused bytes in the first frame.  While this
274 	 * isn't technically correct, it simplifies the calculation and allows
275 	 * for command frames that might be larger than an mfi_io_frame.
276 	 */
277 	if (sizeof(bus_addr_t) == 8) {
278 		sc->mfi_sge_size = sizeof(struct mfi_sg64);
279 		sc->mfi_flags |= MFI_FLAGS_SG64;
280 	} else {
281 		sc->mfi_sge_size = sizeof(struct mfi_sg32);
282 	}
283 	frames = (sc->mfi_sge_size * sc->mfi_max_sge - 1) / MFI_FRAME_SIZE + 2;
284 	sc->mfi_cmd_size = frames * MFI_FRAME_SIZE;
285 	framessz = sc->mfi_cmd_size * sc->mfi_max_fw_cmds;
286 	if (bus_dma_tag_create( sc->mfi_parent_dmat,	/* parent */
287 				64, 0,			/* algnmnt, boundary */
288 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
289 				BUS_SPACE_MAXADDR,	/* highaddr */
290 				NULL, NULL,		/* filter, filterarg */
291 				framessz,		/* maxsize */
292 				1,			/* nsegments */
293 				framessz,		/* maxsegsize */
294 				0,			/* flags */
295 				NULL, NULL,		/* lockfunc, lockarg */
296 				&sc->mfi_frames_dmat)) {
297 		device_printf(sc->mfi_dev, "Cannot allocate frame DMA tag\n");
298 		return (ENOMEM);
299 	}
300 	if (bus_dmamem_alloc(sc->mfi_frames_dmat, (void **)&sc->mfi_frames,
301 	    BUS_DMA_NOWAIT, &sc->mfi_frames_dmamap)) {
302 		device_printf(sc->mfi_dev, "Cannot allocate frames memory\n");
303 		return (ENOMEM);
304 	}
305 	bzero(sc->mfi_frames, framessz);
306 	bus_dmamap_load(sc->mfi_frames_dmat, sc->mfi_frames_dmamap,
307 	    sc->mfi_frames, framessz, mfi_addr32_cb, &sc->mfi_frames_busaddr,0);
308 
309 	/*
310 	 * Allocate DMA memory for the frame sense data.  Keep them in the
311 	 * lower 4GB for efficiency
312 	 */
313 	sensesz = sc->mfi_max_fw_cmds * MFI_SENSE_LEN;
314 	if (bus_dma_tag_create( sc->mfi_parent_dmat,	/* parent */
315 				4, 0,			/* algnmnt, boundary */
316 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
317 				BUS_SPACE_MAXADDR,	/* highaddr */
318 				NULL, NULL,		/* filter, filterarg */
319 				sensesz,		/* maxsize */
320 				1,			/* nsegments */
321 				sensesz,		/* maxsegsize */
322 				0,			/* flags */
323 				NULL, NULL,		/* lockfunc, lockarg */
324 				&sc->mfi_sense_dmat)) {
325 		device_printf(sc->mfi_dev, "Cannot allocate sense DMA tag\n");
326 		return (ENOMEM);
327 	}
328 	if (bus_dmamem_alloc(sc->mfi_sense_dmat, (void **)&sc->mfi_sense,
329 	    BUS_DMA_NOWAIT, &sc->mfi_sense_dmamap)) {
330 		device_printf(sc->mfi_dev, "Cannot allocate sense memory\n");
331 		return (ENOMEM);
332 	}
333 	bus_dmamap_load(sc->mfi_sense_dmat, sc->mfi_sense_dmamap,
334 	    sc->mfi_sense, sensesz, mfi_addr32_cb, &sc->mfi_sense_busaddr, 0);
335 
336 	if ((error = mfi_alloc_commands(sc)) != 0)
337 		return (error);
338 
339 	if ((error = mfi_comms_init(sc)) != 0)
340 		return (error);
341 
342 	if ((error = mfi_get_controller_info(sc)) != 0)
343 		return (error);
344 
345 	mtx_lock(&sc->mfi_io_lock);
346 	if ((error = mfi_aen_setup(sc, 0), 0) != 0) {
347 		mtx_unlock(&sc->mfi_io_lock);
348 		return (error);
349 	}
350 	mtx_unlock(&sc->mfi_io_lock);
351 
352 	/*
353 	 * Set up the interrupt handler.  XXX This should happen in
354 	 * mfi_pci.c
355 	 */
356 	sc->mfi_irq_rid = 0;
357 	if ((sc->mfi_irq = bus_alloc_resource_any(sc->mfi_dev, SYS_RES_IRQ,
358 	    &sc->mfi_irq_rid, RF_SHAREABLE | RF_ACTIVE)) == NULL) {
359 		device_printf(sc->mfi_dev, "Cannot allocate interrupt\n");
360 		return (EINVAL);
361 	}
362 	if (bus_setup_intr(sc->mfi_dev, sc->mfi_irq, INTR_MPSAFE|INTR_TYPE_BIO,
363 	    NULL, mfi_intr, sc, &sc->mfi_intr)) {
364 		device_printf(sc->mfi_dev, "Cannot set up interrupt\n");
365 		return (EINVAL);
366 	}
367 
368 	/* Register a config hook to probe the bus for arrays */
369 	sc->mfi_ich.ich_func = mfi_startup;
370 	sc->mfi_ich.ich_arg = sc;
371 	if (config_intrhook_establish(&sc->mfi_ich) != 0) {
372 		device_printf(sc->mfi_dev, "Cannot establish configuration "
373 		    "hook\n");
374 		return (EINVAL);
375 	}
376 
377 	/*
378 	 * Register a shutdown handler.
379 	 */
380 	if ((sc->mfi_eh = EVENTHANDLER_REGISTER(shutdown_final, mfi_shutdown,
381 	    sc, SHUTDOWN_PRI_DEFAULT)) == NULL) {
382 		device_printf(sc->mfi_dev, "Warning: shutdown event "
383 		    "registration failed\n");
384 	}
385 
386 	/*
387 	 * Create the control device for doing management
388 	 */
389 	unit = device_get_unit(sc->mfi_dev);
390 	sc->mfi_cdev = make_dev(&mfi_cdevsw, unit, UID_ROOT, GID_OPERATOR,
391 	    0640, "mfi%d", unit);
392 	if (unit == 0)
393 		make_dev_alias(sc->mfi_cdev, "megaraid_sas_ioctl_node");
394 	if (sc->mfi_cdev != NULL)
395 		sc->mfi_cdev->si_drv1 = sc;
396 
397 	device_add_child(sc->mfi_dev, "mfip", -1);
398 	bus_generic_attach(sc->mfi_dev);
399 
400 	/* Start the timeout watchdog */
401 	callout_init(&sc->mfi_watchdog_callout, 1);
402 	callout_reset(&sc->mfi_watchdog_callout, MFI_CMD_TIMEOUT * hz,
403 	    mfi_timeout, sc);
404 
405 	return (0);
406 }
407 
408 static int
409 mfi_alloc_commands(struct mfi_softc *sc)
410 {
411 	struct mfi_command *cm;
412 	int i, ncmds;
413 
414 	/*
415 	 * XXX Should we allocate all the commands up front, or allocate on
416 	 * demand later like 'aac' does?
417 	 */
418 	ncmds = sc->mfi_max_fw_cmds;
419 	sc->mfi_commands = malloc(sizeof(struct mfi_command) * ncmds, M_MFIBUF,
420 	    M_WAITOK | M_ZERO);
421 
422 	for (i = 0; i < ncmds; i++) {
423 		cm = &sc->mfi_commands[i];
424 		cm->cm_frame = (union mfi_frame *)((uintptr_t)sc->mfi_frames +
425 		    sc->mfi_cmd_size * i);
426 		cm->cm_frame_busaddr = sc->mfi_frames_busaddr +
427 		    sc->mfi_cmd_size * i;
428 		cm->cm_frame->header.context = i;
429 		cm->cm_sense = &sc->mfi_sense[i];
430 		cm->cm_sense_busaddr= sc->mfi_sense_busaddr + MFI_SENSE_LEN * i;
431 		cm->cm_sc = sc;
432 		cm->cm_index = i;
433 		if (bus_dmamap_create(sc->mfi_buffer_dmat, 0,
434 		    &cm->cm_dmamap) == 0)
435 			mfi_release_command(cm);
436 		else
437 			break;
438 		sc->mfi_total_cmds++;
439 	}
440 
441 	return (0);
442 }
443 
444 void
445 mfi_release_command(struct mfi_command *cm)
446 {
447 	struct mfi_frame_header *hdr;
448 	uint32_t *hdr_data;
449 
450 	/*
451 	 * Zero out the important fields of the frame, but make sure the
452 	 * context field is preserved.  For efficiency, handle the fields
453 	 * as 32 bit words.  Clear out the first S/G entry too for safety.
454 	 */
455 	hdr = &cm->cm_frame->header;
456 	if (hdr->sg_count) {
457 		cm->cm_sg->sg32[0].len = 0;
458 		cm->cm_sg->sg32[0].addr = 0;
459 	}
460 
461 	hdr_data = (uint32_t *)cm->cm_frame;
462 	hdr_data[0] = 0;	/* cmd, sense_len, cmd_status, scsi_status */
463 	hdr_data[1] = 0;	/* target_id, lun_id, cdb_len, sg_count */
464 	hdr_data[4] = 0;	/* flags, timeout */
465 	hdr_data[5] = 0;	/* data_len */
466 
467 	cm->cm_extra_frames = 0;
468 	cm->cm_flags = 0;
469 	cm->cm_complete = NULL;
470 	cm->cm_private = NULL;
471 	cm->cm_data = NULL;
472 	cm->cm_sg = 0;
473 	cm->cm_total_frame_size = 0;
474 
475 	mfi_enqueue_free(cm);
476 }
477 
478 static int
479 mfi_dcmd_command(struct mfi_softc *sc, struct mfi_command **cmp, uint32_t opcode,
480     void **bufp, size_t bufsize)
481 {
482 	struct mfi_command *cm;
483 	struct mfi_dcmd_frame *dcmd;
484 	void *buf = NULL;
485 
486 	mtx_assert(&sc->mfi_io_lock, MA_OWNED);
487 
488 	cm = mfi_dequeue_free(sc);
489 	if (cm == NULL)
490 		return (EBUSY);
491 
492 	if ((bufsize > 0) && (bufp != NULL)) {
493 		if (*bufp == NULL) {
494 			buf = malloc(bufsize, M_MFIBUF, M_NOWAIT|M_ZERO);
495 			if (buf == NULL) {
496 				mfi_release_command(cm);
497 				return (ENOMEM);
498 			}
499 			*bufp = buf;
500 		} else {
501 			buf = *bufp;
502 		}
503 	}
504 
505 	dcmd =  &cm->cm_frame->dcmd;
506 	bzero(dcmd->mbox, MFI_MBOX_SIZE);
507 	dcmd->header.cmd = MFI_CMD_DCMD;
508 	dcmd->header.timeout = 0;
509 	dcmd->header.flags = 0;
510 	dcmd->header.data_len = bufsize;
511 	dcmd->opcode = opcode;
512 	cm->cm_sg = &dcmd->sgl;
513 	cm->cm_total_frame_size = MFI_DCMD_FRAME_SIZE;
514 	cm->cm_flags = 0;
515 	cm->cm_data = buf;
516 	cm->cm_private = buf;
517 	cm->cm_len = bufsize;
518 
519 	*cmp = cm;
520 	if ((bufp != NULL) && (*bufp == NULL) && (buf != NULL))
521 		*bufp = buf;
522 	return (0);
523 }
524 
525 static int
526 mfi_comms_init(struct mfi_softc *sc)
527 {
528 	struct mfi_command *cm;
529 	struct mfi_init_frame *init;
530 	struct mfi_init_qinfo *qinfo;
531 	int error;
532 
533 	mtx_lock(&sc->mfi_io_lock);
534 	if ((cm = mfi_dequeue_free(sc)) == NULL)
535 		return (EBUSY);
536 
537 	/*
538 	 * Abuse the SG list area of the frame to hold the init_qinfo
539 	 * object;
540 	 */
541 	init = &cm->cm_frame->init;
542 	qinfo = (struct mfi_init_qinfo *)((uintptr_t)init + MFI_FRAME_SIZE);
543 
544 	bzero(qinfo, sizeof(struct mfi_init_qinfo));
545 	qinfo->rq_entries = sc->mfi_max_fw_cmds + 1;
546 	qinfo->rq_addr_lo = sc->mfi_comms_busaddr +
547 	    offsetof(struct mfi_hwcomms, hw_reply_q);
548 	qinfo->pi_addr_lo = sc->mfi_comms_busaddr +
549 	    offsetof(struct mfi_hwcomms, hw_pi);
550 	qinfo->ci_addr_lo = sc->mfi_comms_busaddr +
551 	    offsetof(struct mfi_hwcomms, hw_ci);
552 
553 	init->header.cmd = MFI_CMD_INIT;
554 	init->header.data_len = sizeof(struct mfi_init_qinfo);
555 	init->qinfo_new_addr_lo = cm->cm_frame_busaddr + MFI_FRAME_SIZE;
556 	cm->cm_data = NULL;
557 	cm->cm_flags = MFI_CMD_POLLED;
558 
559 	if ((error = mfi_mapcmd(sc, cm)) != 0) {
560 		device_printf(sc->mfi_dev, "failed to send init command\n");
561 		mtx_unlock(&sc->mfi_io_lock);
562 		return (error);
563 	}
564 	mfi_release_command(cm);
565 	mtx_unlock(&sc->mfi_io_lock);
566 
567 	return (0);
568 }
569 
570 static int
571 mfi_get_controller_info(struct mfi_softc *sc)
572 {
573 	struct mfi_command *cm = NULL;
574 	struct mfi_ctrl_info *ci = NULL;
575 	uint32_t max_sectors_1, max_sectors_2;
576 	int error;
577 
578 	mtx_lock(&sc->mfi_io_lock);
579 	error = mfi_dcmd_command(sc, &cm, MFI_DCMD_CTRL_GETINFO,
580 	    (void **)&ci, sizeof(*ci));
581 	if (error)
582 		goto out;
583 	cm->cm_flags = MFI_CMD_DATAIN | MFI_CMD_POLLED;
584 
585 	if ((error = mfi_mapcmd(sc, cm)) != 0) {
586 		device_printf(sc->mfi_dev, "Failed to get controller info\n");
587 		sc->mfi_max_io = (sc->mfi_max_sge - 1) * PAGE_SIZE /
588 		    MFI_SECTOR_LEN;
589 		error = 0;
590 		goto out;
591 	}
592 
593 	bus_dmamap_sync(sc->mfi_buffer_dmat, cm->cm_dmamap,
594 	    BUS_DMASYNC_POSTREAD);
595 	bus_dmamap_unload(sc->mfi_buffer_dmat, cm->cm_dmamap);
596 
597 	max_sectors_1 = (1 << ci->stripe_sz_ops.min) * ci->max_strips_per_io;
598 	max_sectors_2 = ci->max_request_size;
599 	sc->mfi_max_io = min(max_sectors_1, max_sectors_2);
600 
601 out:
602 	if (ci)
603 		free(ci, M_MFIBUF);
604 	if (cm)
605 		mfi_release_command(cm);
606 	mtx_unlock(&sc->mfi_io_lock);
607 	return (error);
608 }
609 
610 static int
611 mfi_get_log_state(struct mfi_softc *sc, struct mfi_evt_log_state **log_state)
612 {
613 	struct mfi_command *cm = NULL;
614 	int error;
615 
616 	error = mfi_dcmd_command(sc, &cm, MFI_DCMD_CTRL_EVENT_GETINFO,
617 	    (void **)log_state, sizeof(**log_state));
618 	if (error)
619 		goto out;
620 	cm->cm_flags = MFI_CMD_DATAIN | MFI_CMD_POLLED;
621 
622 	if ((error = mfi_mapcmd(sc, cm)) != 0) {
623 		device_printf(sc->mfi_dev, "Failed to get log state\n");
624 		goto out;
625 	}
626 
627 	bus_dmamap_sync(sc->mfi_buffer_dmat, cm->cm_dmamap,
628 	    BUS_DMASYNC_POSTREAD);
629 	bus_dmamap_unload(sc->mfi_buffer_dmat, cm->cm_dmamap);
630 
631 out:
632 	if (cm)
633 		mfi_release_command(cm);
634 
635 	return (error);
636 }
637 
638 static int
639 mfi_aen_setup(struct mfi_softc *sc, uint32_t seq_start)
640 {
641 	struct mfi_evt_log_state *log_state = NULL;
642 	union mfi_evt class_locale;
643 	int error = 0;
644 	uint32_t seq;
645 
646 	class_locale.members.reserved = 0;
647 	class_locale.members.locale = mfi_event_locale;
648 	class_locale.members.class  = mfi_event_class;
649 
650 	if (seq_start == 0) {
651 		error = mfi_get_log_state(sc, &log_state);
652 		if (error) {
653 			if (log_state)
654 				free(log_state, M_MFIBUF);
655 			return (error);
656 		}
657 		/*
658 		 * Don't run them yet since we can't parse them.
659 		 * We can indirectly get the contents from
660 		 * the AEN mechanism via setting it lower then
661 		 * current.  The firmware will iterate through them.
662 		 */
663 		for (seq = log_state->shutdown_seq_num;
664 		     seq <= log_state->newest_seq_num; seq++) {
665 			mfi_get_entry(sc, seq);
666 		}
667 	} else
668 		seq = seq_start;
669 	mfi_aen_register(sc, seq, class_locale.word);
670 	free(log_state, M_MFIBUF);
671 
672 	return 0;
673 }
674 
675 static int
676 mfi_wait_command(struct mfi_softc *sc, struct mfi_command *cm)
677 {
678 
679 	mtx_assert(&sc->mfi_io_lock, MA_OWNED);
680 	cm->cm_complete = NULL;
681 
682 
683 	/*
684 	 * MegaCli can issue a DCMD of 0.  In this case do nothing
685 	 * and return 0 to it as status
686 	 */
687 	if (cm->cm_frame->dcmd.opcode == 0) {
688 		cm->cm_frame->header.cmd_status = MFI_STAT_OK;
689 		cm->cm_error = 0;
690 		return (cm->cm_error);
691 	}
692 	mfi_enqueue_ready(cm);
693 	mfi_startio(sc);
694 	if ((cm->cm_flags & MFI_CMD_COMPLETED) == 0)
695 		msleep(cm, &sc->mfi_io_lock, PRIBIO, "mfiwait", 0);
696 	return (cm->cm_error);
697 }
698 
699 void
700 mfi_free(struct mfi_softc *sc)
701 {
702 	struct mfi_command *cm;
703 	int i;
704 
705 	callout_drain(&sc->mfi_watchdog_callout);
706 
707 	if (sc->mfi_cdev != NULL)
708 		destroy_dev(sc->mfi_cdev);
709 
710 	if (sc->mfi_total_cmds != 0) {
711 		for (i = 0; i < sc->mfi_total_cmds; i++) {
712 			cm = &sc->mfi_commands[i];
713 			bus_dmamap_destroy(sc->mfi_buffer_dmat, cm->cm_dmamap);
714 		}
715 		free(sc->mfi_commands, M_MFIBUF);
716 	}
717 
718 	if (sc->mfi_intr)
719 		bus_teardown_intr(sc->mfi_dev, sc->mfi_irq, sc->mfi_intr);
720 	if (sc->mfi_irq != NULL)
721 		bus_release_resource(sc->mfi_dev, SYS_RES_IRQ, sc->mfi_irq_rid,
722 		    sc->mfi_irq);
723 
724 	if (sc->mfi_sense_busaddr != 0)
725 		bus_dmamap_unload(sc->mfi_sense_dmat, sc->mfi_sense_dmamap);
726 	if (sc->mfi_sense != NULL)
727 		bus_dmamem_free(sc->mfi_sense_dmat, sc->mfi_sense,
728 		    sc->mfi_sense_dmamap);
729 	if (sc->mfi_sense_dmat != NULL)
730 		bus_dma_tag_destroy(sc->mfi_sense_dmat);
731 
732 	if (sc->mfi_frames_busaddr != 0)
733 		bus_dmamap_unload(sc->mfi_frames_dmat, sc->mfi_frames_dmamap);
734 	if (sc->mfi_frames != NULL)
735 		bus_dmamem_free(sc->mfi_frames_dmat, sc->mfi_frames,
736 		    sc->mfi_frames_dmamap);
737 	if (sc->mfi_frames_dmat != NULL)
738 		bus_dma_tag_destroy(sc->mfi_frames_dmat);
739 
740 	if (sc->mfi_comms_busaddr != 0)
741 		bus_dmamap_unload(sc->mfi_comms_dmat, sc->mfi_comms_dmamap);
742 	if (sc->mfi_comms != NULL)
743 		bus_dmamem_free(sc->mfi_comms_dmat, sc->mfi_comms,
744 		    sc->mfi_comms_dmamap);
745 	if (sc->mfi_comms_dmat != NULL)
746 		bus_dma_tag_destroy(sc->mfi_comms_dmat);
747 
748 	if (sc->mfi_buffer_dmat != NULL)
749 		bus_dma_tag_destroy(sc->mfi_buffer_dmat);
750 	if (sc->mfi_parent_dmat != NULL)
751 		bus_dma_tag_destroy(sc->mfi_parent_dmat);
752 
753 	if (mtx_initialized(&sc->mfi_io_lock))
754 		mtx_destroy(&sc->mfi_io_lock);
755 
756 	return;
757 }
758 
759 static void
760 mfi_startup(void *arg)
761 {
762 	struct mfi_softc *sc;
763 
764 	sc = (struct mfi_softc *)arg;
765 
766 	config_intrhook_disestablish(&sc->mfi_ich);
767 
768 	mfi_enable_intr(sc);
769 	mtx_lock(&sc->mfi_io_lock);
770 	mfi_ldprobe(sc);
771 	mtx_unlock(&sc->mfi_io_lock);
772 }
773 
774 static void
775 mfi_intr(void *arg)
776 {
777 	struct mfi_softc *sc;
778 	struct mfi_command *cm;
779 	uint32_t status, pi, ci, context;
780 
781 	sc = (struct mfi_softc *)arg;
782 
783 	status = MFI_READ4(sc, MFI_OSTS);
784 	if ((status & MFI_OSTS_INTR_VALID) == 0)
785 		return;
786 
787 	MFI_WRITE4(sc, MFI_OSTS, status);
788 
789 	pi = sc->mfi_comms->hw_pi;
790 	ci = sc->mfi_comms->hw_ci;
791 	mtx_lock(&sc->mfi_io_lock);
792 	while (ci != pi) {
793 		context = sc->mfi_comms->hw_reply_q[ci];
794 		if (context < sc->mfi_max_fw_cmds) {
795 			cm = &sc->mfi_commands[context];
796 			mfi_remove_busy(cm);
797 			cm->cm_error = 0;
798 			mfi_complete(sc, cm);
799 		}
800 		if (++ci == (sc->mfi_max_fw_cmds + 1)) {
801 			ci = 0;
802 		}
803 	}
804 
805 	sc->mfi_comms->hw_ci = ci;
806 
807 	/* Give defered I/O a chance to run */
808 	if (sc->mfi_flags & MFI_FLAGS_QFRZN)
809 		sc->mfi_flags &= ~MFI_FLAGS_QFRZN;
810 	mfi_startio(sc);
811 	mtx_unlock(&sc->mfi_io_lock);
812 
813 	return;
814 }
815 
816 int
817 mfi_shutdown(struct mfi_softc *sc)
818 {
819 	struct mfi_dcmd_frame *dcmd;
820 	struct mfi_command *cm;
821 	int error;
822 
823 	mtx_lock(&sc->mfi_io_lock);
824 	error = mfi_dcmd_command(sc, &cm, MFI_DCMD_CTRL_SHUTDOWN, NULL, 0);
825 	if (error) {
826 		mtx_unlock(&sc->mfi_io_lock);
827 		return (error);
828 	}
829 
830 	if (sc->mfi_aen_cm != NULL)
831 		mfi_abort(sc, sc->mfi_aen_cm);
832 
833 	dcmd = &cm->cm_frame->dcmd;
834 	dcmd->header.flags = MFI_FRAME_DIR_NONE;
835 	cm->cm_flags = MFI_CMD_POLLED;
836 	cm->cm_data = NULL;
837 
838 	if ((error = mfi_mapcmd(sc, cm)) != 0) {
839 		device_printf(sc->mfi_dev, "Failed to shutdown controller\n");
840 	}
841 
842 	mfi_release_command(cm);
843 	mtx_unlock(&sc->mfi_io_lock);
844 	return (error);
845 }
846 
847 static void
848 mfi_enable_intr(struct mfi_softc *sc)
849 {
850 
851 	MFI_WRITE4(sc, MFI_OMSK, 0x01);
852 }
853 
854 static void
855 mfi_ldprobe(struct mfi_softc *sc)
856 {
857 	struct mfi_frame_header *hdr;
858 	struct mfi_command *cm = NULL;
859 	struct mfi_ld_list *list = NULL;
860 	int error, i;
861 
862 	mtx_assert(&sc->mfi_io_lock, MA_OWNED);
863 
864 	error = mfi_dcmd_command(sc, &cm, MFI_DCMD_LD_GET_LIST,
865 	    (void **)&list, sizeof(*list));
866 	if (error)
867 		goto out;
868 
869 	cm->cm_flags = MFI_CMD_DATAIN;
870 	if (mfi_wait_command(sc, cm) != 0) {
871 		device_printf(sc->mfi_dev, "Failed to get device listing\n");
872 		goto out;
873 	}
874 
875 	hdr = &cm->cm_frame->header;
876 	if (hdr->cmd_status != MFI_STAT_OK) {
877 		device_printf(sc->mfi_dev, "MFI_DCMD_LD_GET_LIST failed %x\n",
878 		    hdr->cmd_status);
879 		goto out;
880 	}
881 
882 	for (i = 0; i < list->ld_count; i++)
883 		mfi_add_ld(sc, list->ld_list[i].ld.v.target_id);
884 out:
885 	if (list)
886 		free(list, M_MFIBUF);
887 	if (cm)
888 		mfi_release_command(cm);
889 
890 	return;
891 }
892 
893 static void
894 mfi_decode_evt(struct mfi_softc *sc, struct mfi_evt_detail *detail)
895 {
896 	switch (detail->arg_type) {
897 	case MR_EVT_ARGS_NONE:
898 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - %s\n",
899 		    detail->seq,
900 		    detail->time,
901 		    detail->class.members.locale,
902 		    detail->class.members.class,
903 		    detail->description
904 		    );
905 		break;
906 	case MR_EVT_ARGS_CDB_SENSE:
907 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - PD %02d(e%d/s%d) CDB %*D"
908 		    "Sense %*D\n: %s\n",
909 		    detail->seq,
910 		    detail->time,
911 		    detail->class.members.locale,
912 		    detail->class.members.class,
913 		    detail->args.cdb_sense.pd.device_id,
914 		    detail->args.cdb_sense.pd.enclosure_index,
915 		    detail->args.cdb_sense.pd.slot_number,
916 		    detail->args.cdb_sense.cdb_len,
917 		    detail->args.cdb_sense.cdb,
918 		    ":",
919 		    detail->args.cdb_sense.sense_len,
920 		    detail->args.cdb_sense.sense,
921 		    ":",
922 		    detail->description
923 		    );
924 		break;
925 	case MR_EVT_ARGS_LD:
926 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - VD %02d/%d "
927 		    "event: %s\n",
928 		    detail->seq,
929 		    detail->time,
930 		    detail->class.members.locale,
931 		    detail->class.members.class,
932 		    detail->args.ld.ld_index,
933 		    detail->args.ld.target_id,
934 		    detail->description
935 		    );
936 		break;
937 	case MR_EVT_ARGS_LD_COUNT:
938 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - VD %02d/%d "
939 		    "count %lld: %s\n",
940 		    detail->seq,
941 		    detail->time,
942 		    detail->class.members.locale,
943 		    detail->class.members.class,
944 		    detail->args.ld_count.ld.ld_index,
945 		    detail->args.ld_count.ld.target_id,
946 		    (long long)detail->args.ld_count.count,
947 		    detail->description
948 		    );
949 		break;
950 	case MR_EVT_ARGS_LD_LBA:
951 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - VD %02d/%d "
952 		    "lba %lld: %s\n",
953 		    detail->seq,
954 		    detail->time,
955 		    detail->class.members.locale,
956 		    detail->class.members.class,
957 		    detail->args.ld_lba.ld.ld_index,
958 		    detail->args.ld_lba.ld.target_id,
959 		    (long long)detail->args.ld_lba.lba,
960 		    detail->description
961 		    );
962 		break;
963 	case MR_EVT_ARGS_LD_OWNER:
964 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - VD %02d/%d "
965 		    "owner changed: prior %d, new %d: %s\n",
966 		    detail->seq,
967 		    detail->time,
968 		    detail->class.members.locale,
969 		    detail->class.members.class,
970 		    detail->args.ld_owner.ld.ld_index,
971 		    detail->args.ld_owner.ld.target_id,
972 		    detail->args.ld_owner.pre_owner,
973 		    detail->args.ld_owner.new_owner,
974 		    detail->description
975 		    );
976 		break;
977 	case MR_EVT_ARGS_LD_LBA_PD_LBA:
978 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - VD %02d/%d "
979 		    "lba %lld, physical drive PD %02d(e%d/s%d) lba %lld: %s\n",
980 		    detail->seq,
981 		    detail->time,
982 		    detail->class.members.locale,
983 		    detail->class.members.class,
984 		    detail->args.ld_lba_pd_lba.ld.ld_index,
985 		    detail->args.ld_lba_pd_lba.ld.target_id,
986 		    (long long)detail->args.ld_lba_pd_lba.ld_lba,
987 		    detail->args.ld_lba_pd_lba.pd.device_id,
988 		    detail->args.ld_lba_pd_lba.pd.enclosure_index,
989 		    detail->args.ld_lba_pd_lba.pd.slot_number,
990 		    (long long)detail->args.ld_lba_pd_lba.pd_lba,
991 		    detail->description
992 		    );
993 		break;
994 	case MR_EVT_ARGS_LD_PROG:
995 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - VD %02d/%d "
996 		    "progress %d%% in %ds: %s\n",
997 		    detail->seq,
998 		    detail->time,
999 		    detail->class.members.locale,
1000 		    detail->class.members.class,
1001 		    detail->args.ld_prog.ld.ld_index,
1002 		    detail->args.ld_prog.ld.target_id,
1003 		    detail->args.ld_prog.prog.progress/655,
1004 		    detail->args.ld_prog.prog.elapsed_seconds,
1005 		    detail->description
1006 		    );
1007 		break;
1008 	case MR_EVT_ARGS_LD_STATE:
1009 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - VD %02d/%d "
1010 		    "state prior %d new %d: %s\n",
1011 		    detail->seq,
1012 		    detail->time,
1013 		    detail->class.members.locale,
1014 		    detail->class.members.class,
1015 		    detail->args.ld_state.ld.ld_index,
1016 		    detail->args.ld_state.ld.target_id,
1017 		    detail->args.ld_state.prev_state,
1018 		    detail->args.ld_state.new_state,
1019 		    detail->description
1020 		    );
1021 		break;
1022 	case MR_EVT_ARGS_LD_STRIP:
1023 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - VD %02d/%d "
1024 		    "strip %lld: %s\n",
1025 		    detail->seq,
1026 		    detail->time,
1027 		    detail->class.members.locale,
1028 		    detail->class.members.class,
1029 		    detail->args.ld_strip.ld.ld_index,
1030 		    detail->args.ld_strip.ld.target_id,
1031 		    (long long)detail->args.ld_strip.strip,
1032 		    detail->description
1033 		    );
1034 		break;
1035 	case MR_EVT_ARGS_PD:
1036 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - PD %02d(e%d/s%d) "
1037 		    "event: %s\n",
1038 		    detail->seq,
1039 		    detail->time,
1040 		    detail->class.members.locale,
1041 		    detail->class.members.class,
1042 		    detail->args.pd.device_id,
1043 		    detail->args.pd.enclosure_index,
1044 		    detail->args.pd.slot_number,
1045 		    detail->description
1046 		    );
1047 		break;
1048 	case MR_EVT_ARGS_PD_ERR:
1049 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - PD %02d(e%d/s%d) "
1050 		    "err %d: %s\n",
1051 		    detail->seq,
1052 		    detail->time,
1053 		    detail->class.members.locale,
1054 		    detail->class.members.class,
1055 		    detail->args.pd_err.pd.device_id,
1056 		    detail->args.pd_err.pd.enclosure_index,
1057 		    detail->args.pd_err.pd.slot_number,
1058 		    detail->args.pd_err.err,
1059 		    detail->description
1060 		    );
1061 		break;
1062 	case MR_EVT_ARGS_PD_LBA:
1063 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - PD %02d(e%d/s%d) "
1064 		    "lba %lld: %s\n",
1065 		    detail->seq,
1066 		    detail->time,
1067 		    detail->class.members.locale,
1068 		    detail->class.members.class,
1069 		    detail->args.pd_lba.pd.device_id,
1070 		    detail->args.pd_lba.pd.enclosure_index,
1071 		    detail->args.pd_lba.pd.slot_number,
1072 		    (long long)detail->args.pd_lba.lba,
1073 		    detail->description
1074 		    );
1075 		break;
1076 	case MR_EVT_ARGS_PD_LBA_LD:
1077 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - PD %02d(e%d/s%d) "
1078 		    "lba %lld VD %02d/%d: %s\n",
1079 		    detail->seq,
1080 		    detail->time,
1081 		    detail->class.members.locale,
1082 		    detail->class.members.class,
1083 		    detail->args.pd_lba_ld.pd.device_id,
1084 		    detail->args.pd_lba_ld.pd.enclosure_index,
1085 		    detail->args.pd_lba_ld.pd.slot_number,
1086 		    (long long)detail->args.pd_lba.lba,
1087 		    detail->args.pd_lba_ld.ld.ld_index,
1088 		    detail->args.pd_lba_ld.ld.target_id,
1089 		    detail->description
1090 		    );
1091 		break;
1092 	case MR_EVT_ARGS_PD_PROG:
1093 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - PD %02d(e%d/s%d) "
1094 		    "progress %d%% seconds %ds: %s\n",
1095 		    detail->seq,
1096 		    detail->time,
1097 		    detail->class.members.locale,
1098 		    detail->class.members.class,
1099 		    detail->args.pd_prog.pd.device_id,
1100 		    detail->args.pd_prog.pd.enclosure_index,
1101 		    detail->args.pd_prog.pd.slot_number,
1102 		    detail->args.pd_prog.prog.progress/655,
1103 		    detail->args.pd_prog.prog.elapsed_seconds,
1104 		    detail->description
1105 		    );
1106 		break;
1107 	case MR_EVT_ARGS_PD_STATE:
1108 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - PD %02d(e%d/s%d) "
1109 		    "state prior %d new %d: %s\n",
1110 		    detail->seq,
1111 		    detail->time,
1112 		    detail->class.members.locale,
1113 		    detail->class.members.class,
1114 		    detail->args.pd_prog.pd.device_id,
1115 		    detail->args.pd_prog.pd.enclosure_index,
1116 		    detail->args.pd_prog.pd.slot_number,
1117 		    detail->args.pd_state.prev_state,
1118 		    detail->args.pd_state.new_state,
1119 		    detail->description
1120 		    );
1121 		break;
1122 	case MR_EVT_ARGS_PCI:
1123 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - PCI 0x04%x 0x04%x "
1124 		    "0x04%x 0x04%x: %s\n",
1125 		    detail->seq,
1126 		    detail->time,
1127 		    detail->class.members.locale,
1128 		    detail->class.members.class,
1129 		    detail->args.pci.venderId,
1130 		    detail->args.pci.deviceId,
1131 		    detail->args.pci.subVenderId,
1132 		    detail->args.pci.subDeviceId,
1133 		    detail->description
1134 		    );
1135 		break;
1136 	case MR_EVT_ARGS_RATE:
1137 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - Rebuild rate %d: %s\n",
1138 		    detail->seq,
1139 		    detail->time,
1140 		    detail->class.members.locale,
1141 		    detail->class.members.class,
1142 		    detail->args.rate,
1143 		    detail->description
1144 		    );
1145 		break;
1146 	case MR_EVT_ARGS_TIME:
1147 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - Adapter ticks %d "
1148 		    "elapsed %ds: %s\n",
1149 		    detail->seq,
1150 		    detail->time,
1151 		    detail->class.members.locale,
1152 		    detail->class.members.class,
1153 		    detail->args.time.rtc,
1154 		    detail->args.time.elapsedSeconds,
1155 		    detail->description
1156 		    );
1157 		break;
1158 	case MR_EVT_ARGS_ECC:
1159 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - Adapter ECC %x,%x: %s: %s\n",
1160 		    detail->seq,
1161 		    detail->time,
1162 		    detail->class.members.locale,
1163 		    detail->class.members.class,
1164 		    detail->args.ecc.ecar,
1165 		    detail->args.ecc.elog,
1166 		    detail->args.ecc.str,
1167 		    detail->description
1168 		    );
1169 		break;
1170 	default:
1171 		device_printf(sc->mfi_dev, "%d (%us/0x%04x/%d) - Type %d: %s\n",
1172 		    detail->seq,
1173 		    detail->time,
1174 		    detail->class.members.locale,
1175 		    detail->class.members.class,
1176 		    detail->arg_type, detail->description
1177 		    );
1178 	}
1179 }
1180 
1181 static int
1182 mfi_aen_register(struct mfi_softc *sc, int seq, int locale)
1183 {
1184 	struct mfi_command *cm;
1185 	struct mfi_dcmd_frame *dcmd;
1186 	union mfi_evt current_aen, prior_aen;
1187 	struct mfi_evt_detail *ed = NULL;
1188 	int error = 0;
1189 
1190 	current_aen.word = locale;
1191 	if (sc->mfi_aen_cm != NULL) {
1192 		prior_aen.word =
1193 		    ((uint32_t *)&sc->mfi_aen_cm->cm_frame->dcmd.mbox)[1];
1194 		if (prior_aen.members.class <= current_aen.members.class &&
1195 		    !((prior_aen.members.locale & current_aen.members.locale)
1196 		    ^current_aen.members.locale)) {
1197 			return (0);
1198 		} else {
1199 			prior_aen.members.locale |= current_aen.members.locale;
1200 			if (prior_aen.members.class
1201 			    < current_aen.members.class)
1202 				current_aen.members.class =
1203 				    prior_aen.members.class;
1204 			mfi_abort(sc, sc->mfi_aen_cm);
1205 		}
1206 	}
1207 
1208 	error = mfi_dcmd_command(sc, &cm, MFI_DCMD_CTRL_EVENT_WAIT,
1209 	    (void **)&ed, sizeof(*ed));
1210 	if (error) {
1211 		goto out;
1212 	}
1213 
1214 	dcmd = &cm->cm_frame->dcmd;
1215 	((uint32_t *)&dcmd->mbox)[0] = seq;
1216 	((uint32_t *)&dcmd->mbox)[1] = locale;
1217 	cm->cm_flags = MFI_CMD_DATAIN;
1218 	cm->cm_complete = mfi_aen_complete;
1219 
1220 	sc->mfi_aen_cm = cm;
1221 
1222 	mfi_enqueue_ready(cm);
1223 	mfi_startio(sc);
1224 
1225 out:
1226 	return (error);
1227 }
1228 
1229 static void
1230 mfi_aen_complete(struct mfi_command *cm)
1231 {
1232 	struct mfi_frame_header *hdr;
1233 	struct mfi_softc *sc;
1234 	struct mfi_evt_detail *detail;
1235 	struct mfi_aen *mfi_aen_entry, *tmp;
1236 	int seq = 0, aborted = 0;
1237 
1238 	sc = cm->cm_sc;
1239 	hdr = &cm->cm_frame->header;
1240 
1241 	if (sc->mfi_aen_cm == NULL)
1242 		return;
1243 
1244 	if (sc->mfi_aen_cm->cm_aen_abort || hdr->cmd_status == 0xff) {
1245 		sc->mfi_aen_cm->cm_aen_abort = 0;
1246 		aborted = 1;
1247 	} else {
1248 		sc->mfi_aen_triggered = 1;
1249 		if (sc->mfi_poll_waiting) {
1250 			sc->mfi_poll_waiting = 0;
1251 			selwakeup(&sc->mfi_select);
1252 		}
1253 		detail = cm->cm_data;
1254 		/*
1255 		 * XXX If this function is too expensive or is recursive, then
1256 		 * events should be put onto a queue and processed later.
1257 		 */
1258 		mtx_unlock(&sc->mfi_io_lock);
1259 		mfi_decode_evt(sc, detail);
1260 		mtx_lock(&sc->mfi_io_lock);
1261 		seq = detail->seq + 1;
1262 		TAILQ_FOREACH_SAFE(mfi_aen_entry, &sc->mfi_aen_pids, aen_link, tmp) {
1263 			TAILQ_REMOVE(&sc->mfi_aen_pids, mfi_aen_entry,
1264 			    aen_link);
1265 			PROC_LOCK(mfi_aen_entry->p);
1266 			psignal(mfi_aen_entry->p, SIGIO);
1267 			PROC_UNLOCK(mfi_aen_entry->p);
1268 			free(mfi_aen_entry, M_MFIBUF);
1269 		}
1270 	}
1271 
1272 	free(cm->cm_data, M_MFIBUF);
1273 	sc->mfi_aen_cm = NULL;
1274 	wakeup(&sc->mfi_aen_cm);
1275 	mfi_release_command(cm);
1276 
1277 	/* set it up again so the driver can catch more events */
1278 	if (!aborted) {
1279 		mfi_aen_setup(sc, seq);
1280 	}
1281 }
1282 
1283 /* Only do one event for now so we can easily iterate through them */
1284 #define MAX_EVENTS 1
1285 static int
1286 mfi_get_entry(struct mfi_softc *sc, int seq)
1287 {
1288 	struct mfi_command *cm;
1289 	struct mfi_dcmd_frame *dcmd;
1290 	struct mfi_evt_list *el;
1291 	int error;
1292 	int i;
1293 	int size;
1294 
1295 	if ((cm = mfi_dequeue_free(sc)) == NULL) {
1296 		return (EBUSY);
1297 	}
1298 
1299 	size = sizeof(struct mfi_evt_list) + sizeof(struct mfi_evt_detail)
1300 		* (MAX_EVENTS - 1);
1301 	el = malloc(size, M_MFIBUF, M_NOWAIT | M_ZERO);
1302 	if (el == NULL) {
1303 		mfi_release_command(cm);
1304 		return (ENOMEM);
1305 	}
1306 
1307 	dcmd = &cm->cm_frame->dcmd;
1308 	bzero(dcmd->mbox, MFI_MBOX_SIZE);
1309 	dcmd->header.cmd = MFI_CMD_DCMD;
1310 	dcmd->header.timeout = 0;
1311 	dcmd->header.data_len = size;
1312 	dcmd->opcode = MFI_DCMD_CTRL_EVENT_GET;
1313 	((uint32_t *)&dcmd->mbox)[0] = seq;
1314 	((uint32_t *)&dcmd->mbox)[1] = MFI_EVT_LOCALE_ALL;
1315 	cm->cm_sg = &dcmd->sgl;
1316 	cm->cm_total_frame_size = MFI_DCMD_FRAME_SIZE;
1317 	cm->cm_flags = MFI_CMD_DATAIN | MFI_CMD_POLLED;
1318 	cm->cm_data = el;
1319 	cm->cm_len = size;
1320 
1321 	if ((error = mfi_mapcmd(sc, cm)) != 0) {
1322 		device_printf(sc->mfi_dev, "Failed to get controller entry\n");
1323 		sc->mfi_max_io = (sc->mfi_max_sge - 1) * PAGE_SIZE /
1324 		    MFI_SECTOR_LEN;
1325 		free(el, M_MFIBUF);
1326 		mfi_release_command(cm);
1327 		return (0);
1328 	}
1329 
1330 	bus_dmamap_sync(sc->mfi_buffer_dmat, cm->cm_dmamap,
1331 	    BUS_DMASYNC_POSTREAD);
1332 	bus_dmamap_unload(sc->mfi_buffer_dmat, cm->cm_dmamap);
1333 
1334 	if (dcmd->header.cmd_status != MFI_STAT_NOT_FOUND) {
1335 		for (i = 0; i < el->count; i++) {
1336 			if (seq + i == el->event[i].seq)
1337 				mfi_decode_evt(sc, &el->event[i]);
1338 		}
1339 	}
1340 
1341 	free(cm->cm_data, M_MFIBUF);
1342 	mfi_release_command(cm);
1343 	return (0);
1344 }
1345 
1346 static int
1347 mfi_add_ld(struct mfi_softc *sc, int id)
1348 {
1349 	struct mfi_command *cm;
1350 	struct mfi_dcmd_frame *dcmd = NULL;
1351 	struct mfi_ld_info *ld_info = NULL;
1352 	int error;
1353 
1354 	mtx_assert(&sc->mfi_io_lock, MA_OWNED);
1355 
1356 	error = mfi_dcmd_command(sc, &cm, MFI_DCMD_LD_GET_INFO,
1357 	    (void **)&ld_info, sizeof(*ld_info));
1358 	if (error) {
1359 		device_printf(sc->mfi_dev,
1360 		    "Failed to allocate for MFI_DCMD_LD_GET_INFO %d\n", error);
1361 		if (ld_info)
1362 			free(ld_info, M_MFIBUF);
1363 		return (error);
1364 	}
1365 	cm->cm_flags = MFI_CMD_DATAIN;
1366 	dcmd = &cm->cm_frame->dcmd;
1367 	dcmd->mbox[0] = id;
1368 	if (mfi_wait_command(sc, cm) != 0) {
1369 		device_printf(sc->mfi_dev,
1370 		    "Failed to get logical drive: %d\n", id);
1371 		free(ld_info, M_MFIBUF);
1372 		return (0);
1373 	}
1374 
1375 	mfi_add_ld_complete(cm);
1376 	return (0);
1377 }
1378 
1379 static void
1380 mfi_add_ld_complete(struct mfi_command *cm)
1381 {
1382 	struct mfi_frame_header *hdr;
1383 	struct mfi_ld_info *ld_info;
1384 	struct mfi_softc *sc;
1385 	device_t child;
1386 
1387 	sc = cm->cm_sc;
1388 	hdr = &cm->cm_frame->header;
1389 	ld_info = cm->cm_private;
1390 
1391 	if (hdr->cmd_status != MFI_STAT_OK) {
1392 		free(ld_info, M_MFIBUF);
1393 		mfi_release_command(cm);
1394 		return;
1395 	}
1396 	mfi_release_command(cm);
1397 
1398 	mtx_unlock(&sc->mfi_io_lock);
1399 	mtx_lock(&Giant);
1400 	if ((child = device_add_child(sc->mfi_dev, "mfid", -1)) == NULL) {
1401 		device_printf(sc->mfi_dev, "Failed to add logical disk\n");
1402 		free(ld_info, M_MFIBUF);
1403 		mtx_unlock(&Giant);
1404 		mtx_lock(&sc->mfi_io_lock);
1405 		return;
1406 	}
1407 
1408 	device_set_ivars(child, ld_info);
1409 	device_set_desc(child, "MFI Logical Disk");
1410 	bus_generic_attach(sc->mfi_dev);
1411 	mtx_unlock(&Giant);
1412 	mtx_lock(&sc->mfi_io_lock);
1413 }
1414 
1415 static struct mfi_command *
1416 mfi_bio_command(struct mfi_softc *sc)
1417 {
1418 	struct mfi_io_frame *io;
1419 	struct mfi_command *cm;
1420 	struct bio *bio;
1421 	int flags, blkcount;
1422 
1423 	if ((cm = mfi_dequeue_free(sc)) == NULL)
1424 		return (NULL);
1425 
1426 	if ((bio = mfi_dequeue_bio(sc)) == NULL) {
1427 		mfi_release_command(cm);
1428 		return (NULL);
1429 	}
1430 
1431 	io = &cm->cm_frame->io;
1432 	switch (bio->bio_cmd & 0x03) {
1433 	case BIO_READ:
1434 		io->header.cmd = MFI_CMD_LD_READ;
1435 		flags = MFI_CMD_DATAIN;
1436 		break;
1437 	case BIO_WRITE:
1438 		io->header.cmd = MFI_CMD_LD_WRITE;
1439 		flags = MFI_CMD_DATAOUT;
1440 		break;
1441 	default:
1442 		panic("Invalid bio command");
1443 	}
1444 
1445 	/* Cheat with the sector length to avoid a non-constant division */
1446 	blkcount = (bio->bio_bcount + MFI_SECTOR_LEN - 1) / MFI_SECTOR_LEN;
1447 	io->header.target_id = (uintptr_t)bio->bio_driver1;
1448 	io->header.timeout = 0;
1449 	io->header.flags = 0;
1450 	io->header.sense_len = MFI_SENSE_LEN;
1451 	io->header.data_len = blkcount;
1452 	io->sense_addr_lo = cm->cm_sense_busaddr;
1453 	io->sense_addr_hi = 0;
1454 	io->lba_hi = (bio->bio_pblkno & 0xffffffff00000000) >> 32;
1455 	io->lba_lo = bio->bio_pblkno & 0xffffffff;
1456 	cm->cm_complete = mfi_bio_complete;
1457 	cm->cm_private = bio;
1458 	cm->cm_data = bio->bio_data;
1459 	cm->cm_len = bio->bio_bcount;
1460 	cm->cm_sg = &io->sgl;
1461 	cm->cm_total_frame_size = MFI_IO_FRAME_SIZE;
1462 	cm->cm_flags = flags;
1463 	return (cm);
1464 }
1465 
1466 static void
1467 mfi_bio_complete(struct mfi_command *cm)
1468 {
1469 	struct bio *bio;
1470 	struct mfi_frame_header *hdr;
1471 	struct mfi_softc *sc;
1472 
1473 	bio = cm->cm_private;
1474 	hdr = &cm->cm_frame->header;
1475 	sc = cm->cm_sc;
1476 
1477 	if ((hdr->cmd_status != 0) || (hdr->scsi_status != 0)) {
1478 		bio->bio_flags |= BIO_ERROR;
1479 		bio->bio_error = EIO;
1480 		device_printf(sc->mfi_dev, "I/O error, status= %d "
1481 		    "scsi_status= %d\n", hdr->cmd_status, hdr->scsi_status);
1482 		mfi_print_sense(cm->cm_sc, cm->cm_sense);
1483 	}
1484 
1485 	mfi_release_command(cm);
1486 	mfi_disk_complete(bio);
1487 }
1488 
1489 void
1490 mfi_startio(struct mfi_softc *sc)
1491 {
1492 	struct mfi_command *cm;
1493 	struct ccb_hdr *ccbh;
1494 
1495 	for (;;) {
1496 		/* Don't bother if we're short on resources */
1497 		if (sc->mfi_flags & MFI_FLAGS_QFRZN)
1498 			break;
1499 
1500 		/* Try a command that has already been prepared */
1501 		cm = mfi_dequeue_ready(sc);
1502 
1503 		if (cm == NULL) {
1504 			if ((ccbh = TAILQ_FIRST(&sc->mfi_cam_ccbq)) != NULL)
1505 				cm = sc->mfi_cam_start(ccbh);
1506 		}
1507 
1508 		/* Nope, so look for work on the bioq */
1509 		if (cm == NULL)
1510 			cm = mfi_bio_command(sc);
1511 
1512 		/* No work available, so exit */
1513 		if (cm == NULL)
1514 			break;
1515 
1516 		/* Send the command to the controller */
1517 		if (mfi_mapcmd(sc, cm) != 0) {
1518 			mfi_requeue_ready(cm);
1519 			break;
1520 		}
1521 	}
1522 }
1523 
1524 static int
1525 mfi_mapcmd(struct mfi_softc *sc, struct mfi_command *cm)
1526 {
1527 	int error, polled;
1528 
1529 	mtx_assert(&sc->mfi_io_lock, MA_OWNED);
1530 
1531 	if (cm->cm_data != NULL) {
1532 		polled = (cm->cm_flags & MFI_CMD_POLLED) ? BUS_DMA_NOWAIT : 0;
1533 		error = bus_dmamap_load(sc->mfi_buffer_dmat, cm->cm_dmamap,
1534 		    cm->cm_data, cm->cm_len, mfi_data_cb, cm, polled);
1535 		if (error == EINPROGRESS) {
1536 			sc->mfi_flags |= MFI_FLAGS_QFRZN;
1537 			return (0);
1538 		}
1539 	} else {
1540 		error = mfi_send_frame(sc, cm);
1541 	}
1542 
1543 	return (error);
1544 }
1545 
1546 static void
1547 mfi_data_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1548 {
1549 	struct mfi_frame_header *hdr;
1550 	struct mfi_command *cm;
1551 	union mfi_sgl *sgl;
1552 	struct mfi_softc *sc;
1553 	int i, dir;
1554 
1555 	cm = (struct mfi_command *)arg;
1556 	sc = cm->cm_sc;
1557 	hdr = &cm->cm_frame->header;
1558 	sgl = cm->cm_sg;
1559 
1560 	if (error) {
1561 		printf("error %d in callback\n", error);
1562 		cm->cm_error = error;
1563 		mfi_complete(sc, cm);
1564 		return;
1565 	}
1566 
1567 	if ((sc->mfi_flags & MFI_FLAGS_SG64) == 0) {
1568 		for (i = 0; i < nsegs; i++) {
1569 			sgl->sg32[i].addr = segs[i].ds_addr;
1570 			sgl->sg32[i].len = segs[i].ds_len;
1571 		}
1572 	} else {
1573 		for (i = 0; i < nsegs; i++) {
1574 			sgl->sg64[i].addr = segs[i].ds_addr;
1575 			sgl->sg64[i].len = segs[i].ds_len;
1576 		}
1577 		hdr->flags |= MFI_FRAME_SGL64;
1578 	}
1579 	hdr->sg_count = nsegs;
1580 
1581 	dir = 0;
1582 	if (cm->cm_flags & MFI_CMD_DATAIN) {
1583 		dir |= BUS_DMASYNC_PREREAD;
1584 		hdr->flags |= MFI_FRAME_DIR_READ;
1585 	}
1586 	if (cm->cm_flags & MFI_CMD_DATAOUT) {
1587 		dir |= BUS_DMASYNC_PREWRITE;
1588 		hdr->flags |= MFI_FRAME_DIR_WRITE;
1589 	}
1590 	bus_dmamap_sync(sc->mfi_buffer_dmat, cm->cm_dmamap, dir);
1591 	cm->cm_flags |= MFI_CMD_MAPPED;
1592 
1593 	/*
1594 	 * Instead of calculating the total number of frames in the
1595 	 * compound frame, it's already assumed that there will be at
1596 	 * least 1 frame, so don't compensate for the modulo of the
1597 	 * following division.
1598 	 */
1599 	cm->cm_total_frame_size += (sc->mfi_sge_size * nsegs);
1600 	cm->cm_extra_frames = (cm->cm_total_frame_size - 1) / MFI_FRAME_SIZE;
1601 
1602 	mfi_send_frame(sc, cm);
1603 
1604 	return;
1605 }
1606 
1607 static int
1608 mfi_send_frame(struct mfi_softc *sc, struct mfi_command *cm)
1609 {
1610 	struct mfi_frame_header *hdr;
1611 	int tm = MFI_POLL_TIMEOUT_SECS * 1000;
1612 
1613 	hdr = &cm->cm_frame->header;
1614 
1615 	if ((cm->cm_flags & MFI_CMD_POLLED) == 0) {
1616 		cm->cm_timestamp = time_uptime;
1617 		mfi_enqueue_busy(cm);
1618 	} else {
1619 		hdr->cmd_status = 0xff;
1620 		hdr->flags |= MFI_FRAME_DONT_POST_IN_REPLY_QUEUE;
1621 	}
1622 
1623 	/*
1624 	 * The bus address of the command is aligned on a 64 byte boundary,
1625 	 * leaving the least 6 bits as zero.  For whatever reason, the
1626 	 * hardware wants the address shifted right by three, leaving just
1627 	 * 3 zero bits.  These three bits are then used as a prefetching
1628 	 * hint for the hardware to predict how many frames need to be
1629 	 * fetched across the bus.  If a command has more than 8 frames
1630 	 * then the 3 bits are set to 0x7 and the firmware uses other
1631 	 * information in the command to determine the total amount to fetch.
1632 	 * However, FreeBSD doesn't support I/O larger than 128K, so 8 frames
1633 	 * is enough for both 32bit and 64bit systems.
1634 	 */
1635 	if (cm->cm_extra_frames > 7)
1636 		cm->cm_extra_frames = 7;
1637 
1638 	MFI_WRITE4(sc, MFI_IQP, (cm->cm_frame_busaddr >> 3) |
1639 	    cm->cm_extra_frames);
1640 
1641 	if ((cm->cm_flags & MFI_CMD_POLLED) == 0)
1642 		return (0);
1643 
1644 	/* This is a polled command, so busy-wait for it to complete. */
1645 	while (hdr->cmd_status == 0xff) {
1646 		DELAY(1000);
1647 		tm -= 1;
1648 		if (tm <= 0)
1649 			break;
1650 	}
1651 
1652 	if (hdr->cmd_status == 0xff) {
1653 		device_printf(sc->mfi_dev, "Frame %p timed out "
1654 			      "command 0x%X\n", hdr, cm->cm_frame->dcmd.opcode);
1655 		return (ETIMEDOUT);
1656 	}
1657 
1658 	return (0);
1659 }
1660 
1661 static void
1662 mfi_complete(struct mfi_softc *sc, struct mfi_command *cm)
1663 {
1664 	int dir;
1665 
1666 	if ((cm->cm_flags & MFI_CMD_MAPPED) != 0) {
1667 		dir = 0;
1668 		if (cm->cm_flags & MFI_CMD_DATAIN)
1669 			dir |= BUS_DMASYNC_POSTREAD;
1670 		if (cm->cm_flags & MFI_CMD_DATAOUT)
1671 			dir |= BUS_DMASYNC_POSTWRITE;
1672 
1673 		bus_dmamap_sync(sc->mfi_buffer_dmat, cm->cm_dmamap, dir);
1674 		bus_dmamap_unload(sc->mfi_buffer_dmat, cm->cm_dmamap);
1675 		cm->cm_flags &= ~MFI_CMD_MAPPED;
1676 	}
1677 
1678 	cm->cm_flags |= MFI_CMD_COMPLETED;
1679 
1680 	if (cm->cm_complete != NULL)
1681 		cm->cm_complete(cm);
1682 	else
1683 		wakeup(cm);
1684 }
1685 
1686 static int
1687 mfi_abort(struct mfi_softc *sc, struct mfi_command *cm_abort)
1688 {
1689 	struct mfi_command *cm;
1690 	struct mfi_abort_frame *abort;
1691 	int i = 0;
1692 
1693 	mtx_assert(&sc->mfi_io_lock, MA_OWNED);
1694 
1695 	if ((cm = mfi_dequeue_free(sc)) == NULL) {
1696 		return (EBUSY);
1697 	}
1698 
1699 	abort = &cm->cm_frame->abort;
1700 	abort->header.cmd = MFI_CMD_ABORT;
1701 	abort->header.flags = 0;
1702 	abort->abort_context = cm_abort->cm_frame->header.context;
1703 	abort->abort_mfi_addr_lo = cm_abort->cm_frame_busaddr;
1704 	abort->abort_mfi_addr_hi = 0;
1705 	cm->cm_data = NULL;
1706 	cm->cm_flags = MFI_CMD_POLLED;
1707 
1708 	sc->mfi_aen_cm->cm_aen_abort = 1;
1709 	mfi_mapcmd(sc, cm);
1710 	mfi_release_command(cm);
1711 
1712 	while (i < 5 && sc->mfi_aen_cm != NULL) {
1713 		msleep(&sc->mfi_aen_cm, &sc->mfi_io_lock, 0, "mfiabort", 5 * hz);
1714 		i++;
1715 	}
1716 
1717 	return (0);
1718 }
1719 
1720 int
1721 mfi_dump_blocks(struct mfi_softc *sc, int id, uint64_t lba, void *virt, int len)
1722 {
1723 	struct mfi_command *cm;
1724 	struct mfi_io_frame *io;
1725 	int error;
1726 
1727 	if ((cm = mfi_dequeue_free(sc)) == NULL)
1728 		return (EBUSY);
1729 
1730 	io = &cm->cm_frame->io;
1731 	io->header.cmd = MFI_CMD_LD_WRITE;
1732 	io->header.target_id = id;
1733 	io->header.timeout = 0;
1734 	io->header.flags = 0;
1735 	io->header.sense_len = MFI_SENSE_LEN;
1736 	io->header.data_len = (len + MFI_SECTOR_LEN - 1) / MFI_SECTOR_LEN;
1737 	io->sense_addr_lo = cm->cm_sense_busaddr;
1738 	io->sense_addr_hi = 0;
1739 	io->lba_hi = (lba & 0xffffffff00000000) >> 32;
1740 	io->lba_lo = lba & 0xffffffff;
1741 	cm->cm_data = virt;
1742 	cm->cm_len = len;
1743 	cm->cm_sg = &io->sgl;
1744 	cm->cm_total_frame_size = MFI_IO_FRAME_SIZE;
1745 	cm->cm_flags = MFI_CMD_POLLED | MFI_CMD_DATAOUT;
1746 
1747 	error = mfi_mapcmd(sc, cm);
1748 	bus_dmamap_sync(sc->mfi_buffer_dmat, cm->cm_dmamap,
1749 	    BUS_DMASYNC_POSTWRITE);
1750 	bus_dmamap_unload(sc->mfi_buffer_dmat, cm->cm_dmamap);
1751 	mfi_release_command(cm);
1752 
1753 	return (error);
1754 }
1755 
1756 static int
1757 mfi_open(struct cdev *dev, int flags, int fmt, d_thread_t *td)
1758 {
1759 	struct mfi_softc *sc;
1760 
1761 	sc = dev->si_drv1;
1762 
1763 	mtx_lock(&sc->mfi_io_lock);
1764 	sc->mfi_flags |= MFI_FLAGS_OPEN;
1765 	mtx_unlock(&sc->mfi_io_lock);
1766 
1767 	return (0);
1768 }
1769 
1770 static int
1771 mfi_close(struct cdev *dev, int flags, int fmt, d_thread_t *td)
1772 {
1773 	struct mfi_softc *sc;
1774 	struct mfi_aen *mfi_aen_entry, *tmp;
1775 
1776 	sc = dev->si_drv1;
1777 
1778 	mtx_lock(&sc->mfi_io_lock);
1779 	sc->mfi_flags &= ~MFI_FLAGS_OPEN;
1780 
1781 	TAILQ_FOREACH_SAFE(mfi_aen_entry, &sc->mfi_aen_pids, aen_link, tmp) {
1782 		if (mfi_aen_entry->p == curproc) {
1783 			TAILQ_REMOVE(&sc->mfi_aen_pids, mfi_aen_entry,
1784 			    aen_link);
1785 			free(mfi_aen_entry, M_MFIBUF);
1786 		}
1787 	}
1788 	mtx_unlock(&sc->mfi_io_lock);
1789 	return (0);
1790 }
1791 
1792 static int
1793 mfi_ioctl(struct cdev *dev, u_long cmd, caddr_t arg, int flag, d_thread_t *td)
1794 {
1795 	struct mfi_softc *sc;
1796 	union mfi_statrequest *ms;
1797 	struct mfi_ioc_packet *ioc;
1798 	struct mfi_ioc_aen *aen;
1799 	struct mfi_command *cm = NULL;
1800 	uint32_t context;
1801 	uint8_t *sense_ptr;
1802 	uint8_t *data = NULL, *temp;
1803 	int i;
1804 	int error;
1805 
1806 	sc = dev->si_drv1;
1807 	error = 0;
1808 
1809 	switch (cmd) {
1810 	case MFIIO_STATS:
1811 		ms = (union mfi_statrequest *)arg;
1812 		switch (ms->ms_item) {
1813 		case MFIQ_FREE:
1814 		case MFIQ_BIO:
1815 		case MFIQ_READY:
1816 		case MFIQ_BUSY:
1817 			bcopy(&sc->mfi_qstat[ms->ms_item], &ms->ms_qstat,
1818 			    sizeof(struct mfi_qstat));
1819 			break;
1820 		default:
1821 			error = ENOIOCTL;
1822 			break;
1823 		}
1824 		break;
1825 	case MFIIO_QUERY_DISK:
1826 	{
1827 		struct mfi_query_disk *qd;
1828 		struct mfi_disk *ld;
1829 
1830 		qd = (struct mfi_query_disk *)arg;
1831 		mtx_lock(&sc->mfi_io_lock);
1832 		TAILQ_FOREACH(ld, &sc->mfi_ld_tqh, ld_link) {
1833 			if (ld->ld_id == qd->array_id)
1834 				break;
1835 		}
1836 		if (ld == NULL) {
1837 			qd->present = 0;
1838 			mtx_unlock(&sc->mfi_io_lock);
1839 			return (0);
1840 		}
1841 		qd->present = 1;
1842 		if (ld->ld_flags & MFI_DISK_FLAGS_OPEN)
1843 			qd->open = 1;
1844 		bzero(qd->devname, SPECNAMELEN + 1);
1845 		snprintf(qd->devname, SPECNAMELEN, "mfid%d", ld->ld_unit);
1846 		mtx_unlock(&sc->mfi_io_lock);
1847 		break;
1848 	}
1849 	case MFI_CMD:
1850 		ioc = (struct mfi_ioc_packet *)arg;
1851 
1852 		mtx_lock(&sc->mfi_io_lock);
1853 		if ((cm = mfi_dequeue_free(sc)) == NULL) {
1854 			mtx_unlock(&sc->mfi_io_lock);
1855 			return (EBUSY);
1856 		}
1857 		mtx_unlock(&sc->mfi_io_lock);
1858 
1859 		/*
1860 		 * save off original context since copying from user
1861 		 * will clobber some data
1862 		 */
1863 		context = cm->cm_frame->header.context;
1864 
1865 		bcopy(ioc->mfi_frame.raw, cm->cm_frame,
1866 		      ioc->mfi_sgl_off); /* Linux can do 2 frames ? */
1867 		cm->cm_total_frame_size = ioc->mfi_sgl_off;
1868 		cm->cm_sg =
1869 		    (union mfi_sgl *)&cm->cm_frame->bytes[ioc->mfi_sgl_off];
1870 		cm->cm_flags = MFI_CMD_DATAIN | MFI_CMD_DATAOUT;
1871 		cm->cm_len = cm->cm_frame->header.data_len;
1872 		cm->cm_data = data = malloc(cm->cm_len, M_MFIBUF,
1873 					    M_WAITOK | M_ZERO);
1874 		if (cm->cm_data == NULL) {
1875 			device_printf(sc->mfi_dev, "Malloc failed\n");
1876 			goto out;
1877 		}
1878 
1879 		/* restore header context */
1880 		cm->cm_frame->header.context = context;
1881 
1882 		temp = data;
1883 		for (i = 0; i < ioc->mfi_sge_count; i++) {
1884 			error = copyin(ioc->mfi_sgl[i].iov_base,
1885 			       temp,
1886 			       ioc->mfi_sgl[i].iov_len);
1887 			if (error != 0) {
1888 				device_printf(sc->mfi_dev,
1889 				    "Copy in failed\n");
1890 				goto out;
1891 			}
1892 			temp = &temp[ioc->mfi_sgl[i].iov_len];
1893 		}
1894 
1895 		mtx_lock(&sc->mfi_io_lock);
1896 		if ((error = mfi_wait_command(sc, cm)) != 0) {
1897 			device_printf(sc->mfi_dev,
1898 			    "Controller polled failed\n");
1899 			mtx_unlock(&sc->mfi_io_lock);
1900 			goto out;
1901 		}
1902 
1903 		mtx_unlock(&sc->mfi_io_lock);
1904 
1905 		temp = data;
1906 		for (i = 0; i < ioc->mfi_sge_count; i++) {
1907 			error = copyout(temp,
1908 				ioc->mfi_sgl[i].iov_base,
1909 				ioc->mfi_sgl[i].iov_len);
1910 			if (error != 0) {
1911 				device_printf(sc->mfi_dev,
1912 				    "Copy out failed\n");
1913 				goto out;
1914 			}
1915 			temp = &temp[ioc->mfi_sgl[i].iov_len];
1916 		}
1917 
1918 		if (ioc->mfi_sense_len) {
1919 			/* copy out sense */
1920 			sense_ptr = &((struct mfi_ioc_packet*)arg)
1921 			    ->mfi_frame.raw[0];
1922 			error = copyout(cm->cm_sense, sense_ptr,
1923 			    ioc->mfi_sense_len);
1924 			if (error != 0) {
1925 				device_printf(sc->mfi_dev,
1926 				    "Copy out failed\n");
1927 				goto out;
1928 			}
1929 		}
1930 
1931 		ioc->mfi_frame.hdr.cmd_status = cm->cm_frame->header.cmd_status;
1932 		if (cm->cm_frame->header.cmd_status == MFI_STAT_OK) {
1933 			switch (cm->cm_frame->dcmd.opcode) {
1934 			case MFI_DCMD_CFG_CLEAR:
1935 			case MFI_DCMD_CFG_ADD:
1936 /*
1937 				mfi_ldrescan(sc);
1938 */
1939 				break;
1940 			}
1941 		}
1942 out:
1943 		if (data)
1944 			free(data, M_MFIBUF);
1945 		if (cm) {
1946 			mtx_lock(&sc->mfi_io_lock);
1947 			mfi_release_command(cm);
1948 			mtx_unlock(&sc->mfi_io_lock);
1949 		}
1950 
1951 		break;
1952 	case MFI_SET_AEN:
1953 		aen = (struct mfi_ioc_aen *)arg;
1954 		error = mfi_aen_register(sc, aen->aen_seq_num,
1955 		    aen->aen_class_locale);
1956 
1957 		break;
1958 	case MFI_LINUX_CMD_2: /* Firmware Linux ioctl shim */
1959 		{
1960 			devclass_t devclass;
1961 			struct mfi_linux_ioc_packet l_ioc;
1962 			int adapter;
1963 
1964 			devclass = devclass_find("mfi");
1965 			if (devclass == NULL)
1966 				return (ENOENT);
1967 
1968 			error = copyin(arg, &l_ioc, sizeof(l_ioc));
1969 			if (error)
1970 				return (error);
1971 			adapter = l_ioc.lioc_adapter_no;
1972 			sc = devclass_get_softc(devclass, adapter);
1973 			if (sc == NULL)
1974 				return (ENOENT);
1975 			return (mfi_linux_ioctl_int(sc->mfi_cdev,
1976 			    cmd, arg, flag, td));
1977 			break;
1978 		}
1979 	case MFI_LINUX_SET_AEN_2: /* AEN Linux ioctl shim */
1980 		{
1981 			devclass_t devclass;
1982 			struct mfi_linux_ioc_aen l_aen;
1983 			int adapter;
1984 
1985 			devclass = devclass_find("mfi");
1986 			if (devclass == NULL)
1987 				return (ENOENT);
1988 
1989 			error = copyin(arg, &l_aen, sizeof(l_aen));
1990 			if (error)
1991 				return (error);
1992 			adapter = l_aen.laen_adapter_no;
1993 			sc = devclass_get_softc(devclass, adapter);
1994 			if (sc == NULL)
1995 				return (ENOENT);
1996 			return (mfi_linux_ioctl_int(sc->mfi_cdev,
1997 			    cmd, arg, flag, td));
1998 			break;
1999 		}
2000 	default:
2001 		device_printf(sc->mfi_dev, "IOCTL 0x%lx not handled\n", cmd);
2002 		error = ENOENT;
2003 		break;
2004 	}
2005 
2006 	return (error);
2007 }
2008 
2009 static int
2010 mfi_linux_ioctl_int(struct cdev *dev, u_long cmd, caddr_t arg, int flag, d_thread_t *td)
2011 {
2012 	struct mfi_softc *sc;
2013 	struct mfi_linux_ioc_packet l_ioc;
2014 	struct mfi_linux_ioc_aen l_aen;
2015 	struct mfi_command *cm = NULL;
2016 	struct mfi_aen *mfi_aen_entry;
2017 	uint8_t *sense_ptr;
2018 	uint32_t context;
2019 	uint8_t *data = NULL, *temp;
2020 	void *temp_convert;
2021 	int i;
2022 	int error;
2023 
2024 	sc = dev->si_drv1;
2025 	error = 0;
2026 	switch (cmd) {
2027 	case MFI_LINUX_CMD_2: /* Firmware Linux ioctl shim */
2028 		error = copyin(arg, &l_ioc, sizeof(l_ioc));
2029 		if (error != 0)
2030 			return (error);
2031 
2032 		if (l_ioc.lioc_sge_count > MAX_LINUX_IOCTL_SGE) {
2033 			return (EINVAL);
2034 		}
2035 
2036 		mtx_lock(&sc->mfi_io_lock);
2037 		if ((cm = mfi_dequeue_free(sc)) == NULL) {
2038 			mtx_unlock(&sc->mfi_io_lock);
2039 			return (EBUSY);
2040 		}
2041 		mtx_unlock(&sc->mfi_io_lock);
2042 
2043 		/*
2044 		 * save off original context since copying from user
2045 		 * will clobber some data
2046 		 */
2047 		context = cm->cm_frame->header.context;
2048 
2049 		bcopy(l_ioc.lioc_frame.raw, cm->cm_frame,
2050 		      l_ioc.lioc_sgl_off); /* Linux can do 2 frames ? */
2051 		cm->cm_total_frame_size = l_ioc.lioc_sgl_off;
2052 		cm->cm_sg =
2053 		    (union mfi_sgl *)&cm->cm_frame->bytes[l_ioc.lioc_sgl_off];
2054 		cm->cm_flags = MFI_CMD_DATAIN | MFI_CMD_DATAOUT;
2055 		cm->cm_len = cm->cm_frame->header.data_len;
2056 		cm->cm_data = data = malloc(cm->cm_len, M_MFIBUF,
2057 					    M_WAITOK | M_ZERO);
2058 
2059 		/* restore header context */
2060 		cm->cm_frame->header.context = context;
2061 
2062 		temp = data;
2063 		for (i = 0; i < l_ioc.lioc_sge_count; i++) {
2064 			temp_convert =
2065 			    (void *)(uintptr_t)l_ioc.lioc_sgl[i].iov_base;
2066 			error = copyin(temp_convert,
2067 			       temp,
2068 			       l_ioc.lioc_sgl[i].iov_len);
2069 			if (error != 0) {
2070 				device_printf(sc->mfi_dev,
2071 				    "Copy in failed\n");
2072 				goto out;
2073 			}
2074 			temp = &temp[l_ioc.lioc_sgl[i].iov_len];
2075 		}
2076 
2077 		mtx_lock(&sc->mfi_io_lock);
2078 		if ((error = mfi_wait_command(sc, cm)) != 0) {
2079 			device_printf(sc->mfi_dev,
2080 			    "Controller polled failed\n");
2081 			mtx_unlock(&sc->mfi_io_lock);
2082 			goto out;
2083 		}
2084 
2085 		mtx_unlock(&sc->mfi_io_lock);
2086 
2087 		temp = data;
2088 		for (i = 0; i < l_ioc.lioc_sge_count; i++) {
2089 			temp_convert =
2090 			    (void *)(uintptr_t)l_ioc.lioc_sgl[i].iov_base;
2091 			error = copyout(temp,
2092 				temp_convert,
2093 				l_ioc.lioc_sgl[i].iov_len);
2094 			if (error != 0) {
2095 				device_printf(sc->mfi_dev,
2096 				    "Copy out failed\n");
2097 				goto out;
2098 			}
2099 			temp = &temp[l_ioc.lioc_sgl[i].iov_len];
2100 		}
2101 
2102 		if (l_ioc.lioc_sense_len) {
2103 			/* copy out sense */
2104 			sense_ptr = &((struct mfi_linux_ioc_packet*)arg)
2105 			    ->lioc_frame.raw[0];
2106 			error = copyout(cm->cm_sense, sense_ptr,
2107 			    l_ioc.lioc_sense_len);
2108 			if (error != 0) {
2109 				device_printf(sc->mfi_dev,
2110 				    "Copy out failed\n");
2111 				goto out;
2112 			}
2113 		}
2114 
2115 		error = copyout(&cm->cm_frame->header.cmd_status,
2116 			&((struct mfi_linux_ioc_packet*)arg)
2117 			->lioc_frame.hdr.cmd_status,
2118 			1);
2119 		if (error != 0) {
2120 			device_printf(sc->mfi_dev,
2121 				      "Copy out failed\n");
2122 			goto out;
2123 		}
2124 
2125 		if (cm->cm_frame->header.cmd_status == MFI_STAT_OK) {
2126 			switch (cm->cm_frame->dcmd.opcode) {
2127 			case MFI_DCMD_CFG_CLEAR:
2128 			case MFI_DCMD_CFG_ADD:
2129 				/* mfi_ldrescan(sc); */
2130 				break;
2131 			}
2132 		}
2133 out:
2134 		if (data)
2135 			free(data, M_MFIBUF);
2136 		if (cm) {
2137 			mtx_lock(&sc->mfi_io_lock);
2138 			mfi_release_command(cm);
2139 			mtx_unlock(&sc->mfi_io_lock);
2140 		}
2141 
2142 		return (error);
2143 	case MFI_LINUX_SET_AEN_2: /* AEN Linux ioctl shim */
2144 		error = copyin(arg, &l_aen, sizeof(l_aen));
2145 		if (error != 0)
2146 			return (error);
2147 		printf("AEN IMPLEMENTED for pid %d\n", curproc->p_pid);
2148 		mfi_aen_entry = malloc(sizeof(struct mfi_aen), M_MFIBUF,
2149 		    M_WAITOK);
2150 		mtx_lock(&sc->mfi_io_lock);
2151 		if (mfi_aen_entry != NULL) {
2152 			mfi_aen_entry->p = curproc;
2153 			TAILQ_INSERT_TAIL(&sc->mfi_aen_pids, mfi_aen_entry,
2154 			    aen_link);
2155 		}
2156 		error = mfi_aen_register(sc, l_aen.laen_seq_num,
2157 		    l_aen.laen_class_locale);
2158 
2159 		if (error != 0) {
2160 			TAILQ_REMOVE(&sc->mfi_aen_pids, mfi_aen_entry,
2161 			    aen_link);
2162 			free(mfi_aen_entry, M_MFIBUF);
2163 		}
2164 		mtx_unlock(&sc->mfi_io_lock);
2165 
2166 		return (error);
2167 	default:
2168 		device_printf(sc->mfi_dev, "IOCTL 0x%lx not handled\n", cmd);
2169 		error = ENOENT;
2170 		break;
2171 	}
2172 
2173 	return (error);
2174 }
2175 
2176 static int
2177 mfi_poll(struct cdev *dev, int poll_events, struct thread *td)
2178 {
2179 	struct mfi_softc *sc;
2180 	int revents = 0;
2181 
2182 	sc = dev->si_drv1;
2183 
2184 	if (poll_events & (POLLIN | POLLRDNORM)) {
2185 		if (sc->mfi_aen_triggered != 0) {
2186 			revents |= poll_events & (POLLIN | POLLRDNORM);
2187 			sc->mfi_aen_triggered = 0;
2188 		}
2189 		if (sc->mfi_aen_triggered == 0 && sc->mfi_aen_cm == NULL) {
2190 			revents |= POLLERR;
2191 		}
2192 	}
2193 
2194 	if (revents == 0) {
2195 		if (poll_events & (POLLIN | POLLRDNORM)) {
2196 			sc->mfi_poll_waiting = 1;
2197 			selrecord(td, &sc->mfi_select);
2198 		}
2199 	}
2200 
2201 	return revents;
2202 }
2203 
2204 
2205 static void
2206 mfi_dump_all(void)
2207 {
2208 	struct mfi_softc *sc;
2209 	struct mfi_command *cm;
2210 	devclass_t dc;
2211 	time_t deadline;
2212 	int timedout;
2213 	int i;
2214 
2215 	dc = devclass_find("mfi");
2216 	if (dc == NULL) {
2217 		printf("No mfi dev class\n");
2218 		return;
2219 	}
2220 
2221 	for (i = 0; ; i++) {
2222 		sc = devclass_get_softc(dc, i);
2223 		if (sc == NULL)
2224 			break;
2225 		device_printf(sc->mfi_dev, "Dumping\n\n");
2226 		timedout = 0;
2227 		deadline = time_uptime - MFI_CMD_TIMEOUT;
2228 		mtx_lock(&sc->mfi_io_lock);
2229 		TAILQ_FOREACH(cm, &sc->mfi_busy, cm_link) {
2230 			if (cm->cm_timestamp < deadline) {
2231 				device_printf(sc->mfi_dev,
2232 				    "COMMAND %p TIMEOUT AFTER %d SECONDS\n", cm,
2233 				    (int)(time_uptime - cm->cm_timestamp));
2234 				MFI_PRINT_CMD(cm);
2235 				timedout++;
2236 			}
2237 		}
2238 
2239 #if 0
2240 		if (timedout)
2241 			MFI_DUMP_CMDS(SC);
2242 #endif
2243 
2244 		mtx_unlock(&sc->mfi_io_lock);
2245 	}
2246 
2247 	return;
2248 }
2249 
2250 static void
2251 mfi_timeout(void *data)
2252 {
2253 	struct mfi_softc *sc = (struct mfi_softc *)data;
2254 	struct mfi_command *cm;
2255 	time_t deadline;
2256 	int timedout = 0;
2257 
2258 	deadline = time_uptime - MFI_CMD_TIMEOUT;
2259 	mtx_lock(&sc->mfi_io_lock);
2260 	TAILQ_FOREACH(cm, &sc->mfi_busy, cm_link) {
2261 		if (sc->mfi_aen_cm == cm)
2262 			continue;
2263 		if ((sc->mfi_aen_cm != cm) && (cm->cm_timestamp < deadline)) {
2264 			device_printf(sc->mfi_dev,
2265 			    "COMMAND %p TIMEOUT AFTER %d SECONDS\n", cm,
2266 			    (int)(time_uptime - cm->cm_timestamp));
2267 			MFI_PRINT_CMD(cm);
2268 			MFI_VALIDATE_CMD(sc, cm);
2269 			timedout++;
2270 		}
2271 	}
2272 
2273 #if 0
2274 	if (timedout)
2275 		MFI_DUMP_CMDS(SC);
2276 #endif
2277 
2278 	mtx_unlock(&sc->mfi_io_lock);
2279 
2280 	callout_reset(&sc->mfi_watchdog_callout, MFI_CMD_TIMEOUT * hz,
2281 	    mfi_timeout, sc);
2282 
2283 	if (0)
2284 		mfi_dump_all();
2285 	return;
2286 }
2287