xref: /freebsd/sys/dev/mps/mps.c (revision 66e576525d35c68fcb86f142ebaa5a448555c0c7)
1 /*-
2  * Copyright (c) 2009 Yahoo! Inc.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 /* Communications core for LSI MPT2 */
31 
32 #include <sys/types.h>
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/kernel.h>
36 #include <sys/selinfo.h>
37 #include <sys/lock.h>
38 #include <sys/mutex.h>
39 #include <sys/module.h>
40 #include <sys/bus.h>
41 #include <sys/conf.h>
42 #include <sys/bio.h>
43 #include <sys/malloc.h>
44 #include <sys/uio.h>
45 #include <sys/sysctl.h>
46 
47 #include <machine/bus.h>
48 #include <machine/resource.h>
49 #include <sys/rman.h>
50 
51 #include <cam/scsi/scsi_all.h>
52 
53 #include <dev/mps/mpi/mpi2_type.h>
54 #include <dev/mps/mpi/mpi2.h>
55 #include <dev/mps/mpi/mpi2_ioc.h>
56 #include <dev/mps/mpi/mpi2_cnfg.h>
57 #include <dev/mps/mpsvar.h>
58 #include <dev/mps/mps_table.h>
59 
60 static void mps_startup(void *arg);
61 static void mps_startup_complete(struct mps_softc *sc, struct mps_command *cm);
62 static int mps_send_iocinit(struct mps_softc *sc);
63 static int mps_attach_log(struct mps_softc *sc);
64 static void mps_dispatch_event(struct mps_softc *sc, uintptr_t data, MPI2_EVENT_NOTIFICATION_REPLY *reply);
65 static void mps_config_complete(struct mps_softc *sc, struct mps_command *cm);
66 static void mps_periodic(void *);
67 
68 SYSCTL_NODE(_hw, OID_AUTO, mps, CTLFLAG_RD, 0, "MPS Driver Parameters");
69 
70 MALLOC_DEFINE(M_MPT2, "mps", "mpt2 driver memory");
71 
72 /*
73  * Do a "Diagnostic Reset" aka a hard reset.  This should get the chip out of
74  * any state and back to its initialization state machine.
75  */
76 static char mpt2_reset_magic[] = { 0x00, 0x0f, 0x04, 0x0b, 0x02, 0x07, 0x0d };
77 
78 static int
79 mps_hard_reset(struct mps_softc *sc)
80 {
81 	uint32_t reg;
82 	int i, error, tries = 0;
83 
84 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
85 
86 	/* Clear any pending interrupts */
87 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
88 
89 	/* Push the magic sequence */
90 	error = ETIMEDOUT;
91 	while (tries++ < 20) {
92 		for (i = 0; i < sizeof(mpt2_reset_magic); i++)
93 			mps_regwrite(sc, MPI2_WRITE_SEQUENCE_OFFSET,
94 			    mpt2_reset_magic[i]);
95 
96 		DELAY(100 * 1000);
97 
98 		reg = mps_regread(sc, MPI2_HOST_DIAGNOSTIC_OFFSET);
99 		if (reg & MPI2_DIAG_DIAG_WRITE_ENABLE) {
100 			error = 0;
101 			break;
102 		}
103 	}
104 	if (error)
105 		return (error);
106 
107 	/* Send the actual reset.  XXX need to refresh the reg? */
108 	mps_regwrite(sc, MPI2_HOST_DIAGNOSTIC_OFFSET,
109 	    reg | MPI2_DIAG_RESET_ADAPTER);
110 
111 	/* Wait up to 300 seconds in 50ms intervals */
112 	error = ETIMEDOUT;
113 	for (i = 0; i < 60000; i++) {
114 		DELAY(50000);
115 		reg = mps_regread(sc, MPI2_DOORBELL_OFFSET);
116 		if ((reg & MPI2_IOC_STATE_MASK) != MPI2_IOC_STATE_RESET) {
117 			error = 0;
118 			break;
119 		}
120 	}
121 	if (error)
122 		return (error);
123 
124 	mps_regwrite(sc, MPI2_WRITE_SEQUENCE_OFFSET, 0x0);
125 
126 	return (0);
127 }
128 
129 static int
130 mps_soft_reset(struct mps_softc *sc)
131 {
132 
133 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
134 
135 	mps_regwrite(sc, MPI2_DOORBELL_OFFSET,
136 	    MPI2_FUNCTION_IOC_MESSAGE_UNIT_RESET <<
137 	    MPI2_DOORBELL_FUNCTION_SHIFT);
138 	DELAY(50000);
139 
140 	return (0);
141 }
142 
143 static int
144 mps_transition_ready(struct mps_softc *sc)
145 {
146 	uint32_t reg, state;
147 	int error, tries = 0;
148 
149 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
150 
151 	error = 0;
152 	while (tries++ < 5) {
153 		reg = mps_regread(sc, MPI2_DOORBELL_OFFSET);
154 		mps_dprint(sc, MPS_INFO, "Doorbell= 0x%x\n", reg);
155 
156 		/*
157 		 * Ensure the IOC is ready to talk.  If it's not, try
158 		 * resetting it.
159 		 */
160 		if (reg & MPI2_DOORBELL_USED) {
161 			mps_hard_reset(sc);
162 			DELAY(50000);
163 			continue;
164 		}
165 
166 		/* Is the adapter owned by another peer? */
167 		if ((reg & MPI2_DOORBELL_WHO_INIT_MASK) ==
168 		    (MPI2_WHOINIT_PCI_PEER << MPI2_DOORBELL_WHO_INIT_SHIFT)) {
169 			device_printf(sc->mps_dev, "IOC is under the control "
170 			    "of another peer host, aborting initialization.\n");
171 			return (ENXIO);
172 		}
173 
174 		state = reg & MPI2_IOC_STATE_MASK;
175 		if (state == MPI2_IOC_STATE_READY) {
176 			/* Ready to go! */
177 			error = 0;
178 			break;
179 		} else if (state == MPI2_IOC_STATE_FAULT) {
180 			mps_dprint(sc, MPS_INFO, "IOC in fault state 0x%x\n",
181 			    state & MPI2_DOORBELL_FAULT_CODE_MASK);
182 			mps_hard_reset(sc);
183 		} else if (state == MPI2_IOC_STATE_OPERATIONAL) {
184 			/* Need to take ownership */
185 			mps_soft_reset(sc);
186 		} else if (state == MPI2_IOC_STATE_RESET) {
187 			/* Wait a bit, IOC might be in transition */
188 			mps_dprint(sc, MPS_FAULT,
189 			    "IOC in unexpected reset state\n");
190 		} else {
191 			mps_dprint(sc, MPS_FAULT,
192 			    "IOC in unknown state 0x%x\n", state);
193 			error = EINVAL;
194 			break;
195 		}
196 
197 		/* Wait 50ms for things to settle down. */
198 		DELAY(50000);
199 	}
200 
201 	if (error)
202 		device_printf(sc->mps_dev, "Cannot transition IOC to ready\n");
203 
204 	return (error);
205 }
206 
207 static int
208 mps_transition_operational(struct mps_softc *sc)
209 {
210 	uint32_t reg, state;
211 	int error;
212 
213 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
214 
215 	error = 0;
216 	reg = mps_regread(sc, MPI2_DOORBELL_OFFSET);
217 	mps_dprint(sc, MPS_INFO, "Doorbell= 0x%x\n", reg);
218 
219 	state = reg & MPI2_IOC_STATE_MASK;
220 	if (state != MPI2_IOC_STATE_READY) {
221 		if ((error = mps_transition_ready(sc)) != 0)
222 			return (error);
223 	}
224 
225 	error = mps_send_iocinit(sc);
226 	return (error);
227 }
228 
229 /* Wait for the chip to ACK a word that we've put into its FIFO */
230 static int
231 mps_wait_db_ack(struct mps_softc *sc)
232 {
233 	int retry;
234 
235 	for (retry = 0; retry < MPS_DB_MAX_WAIT; retry++) {
236 		if ((mps_regread(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET) &
237 		    MPI2_HIS_SYS2IOC_DB_STATUS) == 0)
238 			return (0);
239 		DELAY(2000);
240 	}
241 	return (ETIMEDOUT);
242 }
243 
244 /* Wait for the chip to signal that the next word in its FIFO can be fetched */
245 static int
246 mps_wait_db_int(struct mps_softc *sc)
247 {
248 	int retry;
249 
250 	for (retry = 0; retry < MPS_DB_MAX_WAIT; retry++) {
251 		if ((mps_regread(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET) &
252 		    MPI2_HIS_IOC2SYS_DB_STATUS) != 0)
253 			return (0);
254 		DELAY(2000);
255 	}
256 	return (ETIMEDOUT);
257 }
258 
259 /* Step through the synchronous command state machine, i.e. "Doorbell mode" */
260 static int
261 mps_request_sync(struct mps_softc *sc, void *req, MPI2_DEFAULT_REPLY *reply,
262     int req_sz, int reply_sz, int timeout)
263 {
264 	uint32_t *data32;
265 	uint16_t *data16;
266 	int i, count, ioc_sz, residual;
267 
268 	/* Step 1 */
269 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
270 
271 	/* Step 2 */
272 	if (mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_USED)
273 		return (EBUSY);
274 
275 	/* Step 3
276 	 * Announce that a message is coming through the doorbell.  Messages
277 	 * are pushed at 32bit words, so round up if needed.
278 	 */
279 	count = (req_sz + 3) / 4;
280 	mps_regwrite(sc, MPI2_DOORBELL_OFFSET,
281 	    (MPI2_FUNCTION_HANDSHAKE << MPI2_DOORBELL_FUNCTION_SHIFT) |
282 	    (count << MPI2_DOORBELL_ADD_DWORDS_SHIFT));
283 
284 	/* Step 4 */
285 	if (mps_wait_db_int(sc) ||
286 	    (mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_USED) == 0) {
287 		mps_dprint(sc, MPS_FAULT, "Doorbell failed to activate\n");
288 		return (ENXIO);
289 	}
290 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
291 	if (mps_wait_db_ack(sc) != 0) {
292 		mps_dprint(sc, MPS_FAULT, "Doorbell handshake failed\n");
293 		return (ENXIO);
294 	}
295 
296 	/* Step 5 */
297 	/* Clock out the message data synchronously in 32-bit dwords*/
298 	data32 = (uint32_t *)req;
299 	for (i = 0; i < count; i++) {
300 		mps_regwrite(sc, MPI2_DOORBELL_OFFSET, data32[i]);
301 		if (mps_wait_db_ack(sc) != 0) {
302 			mps_dprint(sc, MPS_FAULT,
303 			    "Timeout while writing doorbell\n");
304 			return (ENXIO);
305 		}
306 	}
307 
308 	/* Step 6 */
309 	/* Clock in the reply in 16-bit words.  The total length of the
310 	 * message is always in the 4th byte, so clock out the first 2 words
311 	 * manually, then loop the rest.
312 	 */
313 	data16 = (uint16_t *)reply;
314 	if (mps_wait_db_int(sc) != 0) {
315 		mps_dprint(sc, MPS_FAULT, "Timeout reading doorbell 0\n");
316 		return (ENXIO);
317 	}
318 	data16[0] =
319 	    mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_DATA_MASK;
320 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
321 	if (mps_wait_db_int(sc) != 0) {
322 		mps_dprint(sc, MPS_FAULT, "Timeout reading doorbell 1\n");
323 		return (ENXIO);
324 	}
325 	data16[1] =
326 	    mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_DATA_MASK;
327 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
328 
329 	/* Number of 32bit words in the message */
330 	ioc_sz = reply->MsgLength;
331 
332 	/*
333 	 * Figure out how many 16bit words to clock in without overrunning.
334 	 * The precision loss with dividing reply_sz can safely be
335 	 * ignored because the messages can only be multiples of 32bits.
336 	 */
337 	residual = 0;
338 	count = MIN((reply_sz / 4), ioc_sz) * 2;
339 	if (count < ioc_sz * 2) {
340 		residual = ioc_sz * 2 - count;
341 		mps_dprint(sc, MPS_FAULT, "Driver error, throwing away %d "
342 		    "residual message words\n", residual);
343 	}
344 
345 	for (i = 2; i < count; i++) {
346 		if (mps_wait_db_int(sc) != 0) {
347 			mps_dprint(sc, MPS_FAULT,
348 			    "Timeout reading doorbell %d\n", i);
349 			return (ENXIO);
350 		}
351 		data16[i] = mps_regread(sc, MPI2_DOORBELL_OFFSET) &
352 		    MPI2_DOORBELL_DATA_MASK;
353 		mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
354 	}
355 
356 	/*
357 	 * Pull out residual words that won't fit into the provided buffer.
358 	 * This keeps the chip from hanging due to a driver programming
359 	 * error.
360 	 */
361 	while (residual--) {
362 		if (mps_wait_db_int(sc) != 0) {
363 			mps_dprint(sc, MPS_FAULT,
364 			    "Timeout reading doorbell\n");
365 			return (ENXIO);
366 		}
367 		(void)mps_regread(sc, MPI2_DOORBELL_OFFSET);
368 		mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
369 	}
370 
371 	/* Step 7 */
372 	if (mps_wait_db_int(sc) != 0) {
373 		mps_dprint(sc, MPS_FAULT, "Timeout waiting to exit doorbell\n");
374 		return (ENXIO);
375 	}
376 	if (mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_USED)
377 		mps_dprint(sc, MPS_FAULT, "Warning, doorbell still active\n");
378 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
379 
380 	return (0);
381 }
382 
383 static void
384 mps_enqueue_request(struct mps_softc *sc, struct mps_command *cm)
385 {
386 
387 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
388 
389 	mps_regwrite(sc, MPI2_REQUEST_DESCRIPTOR_POST_LOW_OFFSET,
390 	    cm->cm_desc.Words.Low);
391 	mps_regwrite(sc, MPI2_REQUEST_DESCRIPTOR_POST_HIGH_OFFSET,
392 	    cm->cm_desc.Words.High);
393 }
394 
395 int
396 mps_request_polled(struct mps_softc *sc, struct mps_command *cm)
397 {
398 	int error, timeout = 0;
399 
400 	error = 0;
401 
402 	cm->cm_flags |= MPS_CM_FLAGS_POLLED;
403 	cm->cm_complete = NULL;
404 	mps_map_command(sc, cm);
405 
406 	while ((cm->cm_flags & MPS_CM_FLAGS_COMPLETE) == 0) {
407 		mps_intr(sc);
408 		DELAY(50 * 1000);
409 		if (timeout++ > 1000) {
410 			mps_dprint(sc, MPS_FAULT, "polling failed\n");
411 			error = ETIMEDOUT;
412 			break;
413 		}
414 	}
415 
416 	return (error);
417 }
418 
419 /*
420  * Just the FACTS, ma'am.
421  */
422 static int
423 mps_get_iocfacts(struct mps_softc *sc, MPI2_IOC_FACTS_REPLY *facts)
424 {
425 	MPI2_DEFAULT_REPLY *reply;
426 	MPI2_IOC_FACTS_REQUEST request;
427 	int error, req_sz, reply_sz;
428 
429 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
430 
431 	req_sz = sizeof(MPI2_IOC_FACTS_REQUEST);
432 	reply_sz = sizeof(MPI2_IOC_FACTS_REPLY);
433 	reply = (MPI2_DEFAULT_REPLY *)facts;
434 
435 	bzero(&request, req_sz);
436 	request.Function = MPI2_FUNCTION_IOC_FACTS;
437 	error = mps_request_sync(sc, &request, reply, req_sz, reply_sz, 5);
438 
439 	return (error);
440 }
441 
442 static int
443 mps_get_portfacts(struct mps_softc *sc, MPI2_PORT_FACTS_REPLY *facts, int port)
444 {
445 	MPI2_PORT_FACTS_REQUEST *request;
446 	MPI2_PORT_FACTS_REPLY *reply;
447 	struct mps_command *cm;
448 	int error;
449 
450 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
451 
452 	if ((cm = mps_alloc_command(sc)) == NULL)
453 		return (EBUSY);
454 	request = (MPI2_PORT_FACTS_REQUEST *)cm->cm_req;
455 	request->Function = MPI2_FUNCTION_PORT_FACTS;
456 	request->PortNumber = port;
457 	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
458 	cm->cm_data = NULL;
459 	error = mps_request_polled(sc, cm);
460 	reply = (MPI2_PORT_FACTS_REPLY *)cm->cm_reply;
461 	if ((reply->IOCStatus & MPI2_IOCSTATUS_MASK) != MPI2_IOCSTATUS_SUCCESS)
462 		error = ENXIO;
463 	bcopy(reply, facts, sizeof(MPI2_PORT_FACTS_REPLY));
464 	mps_free_command(sc, cm);
465 
466 	return (error);
467 }
468 
469 static int
470 mps_send_iocinit(struct mps_softc *sc)
471 {
472 	MPI2_IOC_INIT_REQUEST	init;
473 	MPI2_DEFAULT_REPLY	reply;
474 	int req_sz, reply_sz, error;
475 
476 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
477 
478 	req_sz = sizeof(MPI2_IOC_INIT_REQUEST);
479 	reply_sz = sizeof(MPI2_IOC_INIT_REPLY);
480 	bzero(&init, req_sz);
481 	bzero(&reply, reply_sz);
482 
483 	/*
484 	 * Fill in the init block.  Note that most addresses are
485 	 * deliberately in the lower 32bits of memory.  This is a micro-
486 	 * optimzation for PCI/PCIX, though it's not clear if it helps PCIe.
487 	 */
488 	init.Function = MPI2_FUNCTION_IOC_INIT;
489 	init.WhoInit = MPI2_WHOINIT_HOST_DRIVER;
490 	init.MsgVersion = MPI2_VERSION;
491 	init.HeaderVersion = MPI2_HEADER_VERSION;
492 	init.SystemRequestFrameSize = sc->facts->IOCRequestFrameSize;
493 	init.ReplyDescriptorPostQueueDepth = sc->pqdepth;
494 	init.ReplyFreeQueueDepth = sc->fqdepth;
495 	init.SenseBufferAddressHigh = 0;
496 	init.SystemReplyAddressHigh = 0;
497 	init.SystemRequestFrameBaseAddress.High = 0;
498 	init.SystemRequestFrameBaseAddress.Low = (uint32_t)sc->req_busaddr;
499 	init.ReplyDescriptorPostQueueAddress.High = 0;
500 	init.ReplyDescriptorPostQueueAddress.Low = (uint32_t)sc->post_busaddr;
501 	init.ReplyFreeQueueAddress.High = 0;
502 	init.ReplyFreeQueueAddress.Low = (uint32_t)sc->free_busaddr;
503 	init.TimeStamp.High = 0;
504 	init.TimeStamp.Low = (uint32_t)time_uptime;
505 
506 	error = mps_request_sync(sc, &init, &reply, req_sz, reply_sz, 5);
507 	if ((reply.IOCStatus & MPI2_IOCSTATUS_MASK) != MPI2_IOCSTATUS_SUCCESS)
508 		error = ENXIO;
509 
510 	mps_dprint(sc, MPS_INFO, "IOCInit status= 0x%x\n", reply.IOCStatus);
511 	return (error);
512 }
513 
514 static int
515 mps_send_portenable(struct mps_softc *sc)
516 {
517 	MPI2_PORT_ENABLE_REQUEST *request;
518 	struct mps_command *cm;
519 
520 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
521 
522 	if ((cm = mps_alloc_command(sc)) == NULL)
523 		return (EBUSY);
524 	request = (MPI2_PORT_ENABLE_REQUEST *)cm->cm_req;
525 	request->Function = MPI2_FUNCTION_PORT_ENABLE;
526 	request->MsgFlags = 0;
527 	request->VP_ID = 0;
528 	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
529 	cm->cm_complete = mps_startup_complete;
530 
531 	mps_enqueue_request(sc, cm);
532 	return (0);
533 }
534 
535 static int
536 mps_send_mur(struct mps_softc *sc)
537 {
538 
539 	/* Placeholder */
540 	return (0);
541 }
542 
543 void
544 mps_memaddr_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
545 {
546 	bus_addr_t *addr;
547 
548 	addr = arg;
549 	*addr = segs[0].ds_addr;
550 }
551 
552 static int
553 mps_alloc_queues(struct mps_softc *sc)
554 {
555 	bus_addr_t queues_busaddr;
556 	uint8_t *queues;
557 	int qsize, fqsize, pqsize;
558 
559 	/*
560 	 * The reply free queue contains 4 byte entries in multiples of 16 and
561 	 * aligned on a 16 byte boundary. There must always be an unused entry.
562 	 * This queue supplies fresh reply frames for the firmware to use.
563 	 *
564 	 * The reply descriptor post queue contains 8 byte entries in
565 	 * multiples of 16 and aligned on a 16 byte boundary.  This queue
566 	 * contains filled-in reply frames sent from the firmware to the host.
567 	 *
568 	 * These two queues are allocated together for simplicity.
569 	 */
570 	sc->fqdepth = roundup2((sc->num_replies + 1), 16);
571 	sc->pqdepth = roundup2((sc->num_replies + 1), 16);
572 	fqsize= sc->fqdepth * 4;
573 	pqsize = sc->pqdepth * 8;
574 	qsize = fqsize + pqsize;
575 
576         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
577 				16, 0,			/* algnmnt, boundary */
578 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
579 				BUS_SPACE_MAXADDR,	/* highaddr */
580 				NULL, NULL,		/* filter, filterarg */
581                                 qsize,			/* maxsize */
582                                 1,			/* nsegments */
583                                 qsize,			/* maxsegsize */
584                                 0,			/* flags */
585                                 NULL, NULL,		/* lockfunc, lockarg */
586                                 &sc->queues_dmat)) {
587 		device_printf(sc->mps_dev, "Cannot allocate queues DMA tag\n");
588 		return (ENOMEM);
589         }
590         if (bus_dmamem_alloc(sc->queues_dmat, (void **)&queues, BUS_DMA_NOWAIT,
591 	    &sc->queues_map)) {
592 		device_printf(sc->mps_dev, "Cannot allocate queues memory\n");
593 		return (ENOMEM);
594         }
595         bzero(queues, qsize);
596         bus_dmamap_load(sc->queues_dmat, sc->queues_map, queues, qsize,
597 	    mps_memaddr_cb, &queues_busaddr, 0);
598 
599 	sc->free_queue = (uint32_t *)queues;
600 	sc->free_busaddr = queues_busaddr;
601 	sc->post_queue = (MPI2_REPLY_DESCRIPTORS_UNION *)(queues + fqsize);
602 	sc->post_busaddr = queues_busaddr + fqsize;
603 
604 	return (0);
605 }
606 
607 static int
608 mps_alloc_replies(struct mps_softc *sc)
609 {
610 	int rsize;
611 
612 	rsize = sc->facts->ReplyFrameSize * sc->num_replies * 4;
613         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
614 				4, 0,			/* algnmnt, boundary */
615 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
616 				BUS_SPACE_MAXADDR,	/* highaddr */
617 				NULL, NULL,		/* filter, filterarg */
618                                 rsize,			/* maxsize */
619                                 1,			/* nsegments */
620                                 rsize,			/* maxsegsize */
621                                 0,			/* flags */
622                                 NULL, NULL,		/* lockfunc, lockarg */
623                                 &sc->reply_dmat)) {
624 		device_printf(sc->mps_dev, "Cannot allocate replies DMA tag\n");
625 		return (ENOMEM);
626         }
627         if (bus_dmamem_alloc(sc->reply_dmat, (void **)&sc->reply_frames,
628 	    BUS_DMA_NOWAIT, &sc->reply_map)) {
629 		device_printf(sc->mps_dev, "Cannot allocate replies memory\n");
630 		return (ENOMEM);
631         }
632         bzero(sc->reply_frames, rsize);
633         bus_dmamap_load(sc->reply_dmat, sc->reply_map, sc->reply_frames, rsize,
634 	    mps_memaddr_cb, &sc->reply_busaddr, 0);
635 
636 	return (0);
637 }
638 
639 static int
640 mps_alloc_requests(struct mps_softc *sc)
641 {
642 	struct mps_command *cm;
643 	struct mps_chain *chain;
644 	int i, rsize, nsegs;
645 
646 	rsize = sc->facts->IOCRequestFrameSize * sc->num_reqs * 4;
647         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
648 				16, 0,			/* algnmnt, boundary */
649 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
650 				BUS_SPACE_MAXADDR,	/* highaddr */
651 				NULL, NULL,		/* filter, filterarg */
652                                 rsize,			/* maxsize */
653                                 1,			/* nsegments */
654                                 rsize,			/* maxsegsize */
655                                 0,			/* flags */
656                                 NULL, NULL,		/* lockfunc, lockarg */
657                                 &sc->req_dmat)) {
658 		device_printf(sc->mps_dev, "Cannot allocate request DMA tag\n");
659 		return (ENOMEM);
660         }
661         if (bus_dmamem_alloc(sc->req_dmat, (void **)&sc->req_frames,
662 	    BUS_DMA_NOWAIT, &sc->req_map)) {
663 		device_printf(sc->mps_dev, "Cannot allocate request memory\n");
664 		return (ENOMEM);
665         }
666         bzero(sc->req_frames, rsize);
667         bus_dmamap_load(sc->req_dmat, sc->req_map, sc->req_frames, rsize,
668 	    mps_memaddr_cb, &sc->req_busaddr, 0);
669 
670 	rsize = sc->facts->IOCRequestFrameSize * MPS_CHAIN_FRAMES * 4;
671         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
672 				16, 0,			/* algnmnt, boundary */
673 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
674 				BUS_SPACE_MAXADDR,	/* highaddr */
675 				NULL, NULL,		/* filter, filterarg */
676                                 rsize,			/* maxsize */
677                                 1,			/* nsegments */
678                                 rsize,			/* maxsegsize */
679                                 0,			/* flags */
680                                 NULL, NULL,		/* lockfunc, lockarg */
681                                 &sc->chain_dmat)) {
682 		device_printf(sc->mps_dev, "Cannot allocate chain DMA tag\n");
683 		return (ENOMEM);
684         }
685         if (bus_dmamem_alloc(sc->chain_dmat, (void **)&sc->chain_frames,
686 	    BUS_DMA_NOWAIT, &sc->chain_map)) {
687 		device_printf(sc->mps_dev, "Cannot allocate chain memory\n");
688 		return (ENOMEM);
689         }
690         bzero(sc->chain_frames, rsize);
691         bus_dmamap_load(sc->chain_dmat, sc->chain_map, sc->chain_frames, rsize,
692 	    mps_memaddr_cb, &sc->chain_busaddr, 0);
693 
694 	rsize = MPS_SENSE_LEN * sc->num_reqs;
695         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
696 				1, 0,			/* algnmnt, boundary */
697 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
698 				BUS_SPACE_MAXADDR,	/* highaddr */
699 				NULL, NULL,		/* filter, filterarg */
700                                 rsize,			/* maxsize */
701                                 1,			/* nsegments */
702                                 rsize,			/* maxsegsize */
703                                 0,			/* flags */
704                                 NULL, NULL,		/* lockfunc, lockarg */
705                                 &sc->sense_dmat)) {
706 		device_printf(sc->mps_dev, "Cannot allocate sense DMA tag\n");
707 		return (ENOMEM);
708         }
709         if (bus_dmamem_alloc(sc->sense_dmat, (void **)&sc->sense_frames,
710 	    BUS_DMA_NOWAIT, &sc->sense_map)) {
711 		device_printf(sc->mps_dev, "Cannot allocate sense memory\n");
712 		return (ENOMEM);
713         }
714         bzero(sc->sense_frames, rsize);
715         bus_dmamap_load(sc->sense_dmat, sc->sense_map, sc->sense_frames, rsize,
716 	    mps_memaddr_cb, &sc->sense_busaddr, 0);
717 
718 	sc->chains = malloc(sizeof(struct mps_chain) * MPS_CHAIN_FRAMES,
719 	    M_MPT2, M_WAITOK | M_ZERO);
720 	for (i = 0; i < MPS_CHAIN_FRAMES; i++) {
721 		chain = &sc->chains[i];
722 		chain->chain = (MPI2_SGE_IO_UNION *)(sc->chain_frames +
723 		    i * sc->facts->IOCRequestFrameSize * 4);
724 		chain->chain_busaddr = sc->chain_busaddr +
725 		    i * sc->facts->IOCRequestFrameSize * 4;
726 		mps_free_chain(sc, chain);
727 	}
728 
729 	/* XXX Need to pick a more precise value */
730 	nsegs = (MAXPHYS / PAGE_SIZE) + 1;
731         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
732 				1, 0,			/* algnmnt, boundary */
733 				BUS_SPACE_MAXADDR,	/* lowaddr */
734 				BUS_SPACE_MAXADDR,	/* highaddr */
735 				NULL, NULL,		/* filter, filterarg */
736                                 BUS_SPACE_MAXSIZE_32BIT,/* maxsize */
737                                 nsegs,			/* nsegments */
738                                 BUS_SPACE_MAXSIZE_32BIT,/* maxsegsize */
739                                 BUS_DMA_ALLOCNOW,	/* flags */
740                                 busdma_lock_mutex,	/* lockfunc */
741 				&sc->mps_mtx,		/* lockarg */
742                                 &sc->buffer_dmat)) {
743 		device_printf(sc->mps_dev, "Cannot allocate sense DMA tag\n");
744 		return (ENOMEM);
745         }
746 
747 	/*
748 	 * SMID 0 cannot be used as a free command per the firmware spec.
749 	 * Just drop that command instead of risking accounting bugs.
750 	 */
751 	sc->commands = malloc(sizeof(struct mps_command) * sc->num_reqs,
752 	    M_MPT2, M_WAITOK | M_ZERO);
753 	for (i = 1; i < sc->num_reqs; i++) {
754 		cm = &sc->commands[i];
755 		cm->cm_req = sc->req_frames +
756 		    i * sc->facts->IOCRequestFrameSize * 4;
757 		cm->cm_req_busaddr = sc->req_busaddr +
758 		    i * sc->facts->IOCRequestFrameSize * 4;
759 		cm->cm_sense = &sc->sense_frames[i];
760 		cm->cm_sense_busaddr = sc->sense_busaddr + i * MPS_SENSE_LEN;
761 		cm->cm_desc.Default.SMID = i;
762 		cm->cm_sc = sc;
763 		TAILQ_INIT(&cm->cm_chain_list);
764 		callout_init(&cm->cm_callout, 1 /*MPSAFE*/);
765 
766 		/* XXX Is a failure here a critical problem? */
767 		if (bus_dmamap_create(sc->buffer_dmat, 0, &cm->cm_dmamap) == 0)
768 			mps_free_command(sc, cm);
769 		else {
770 			sc->num_reqs = i;
771 			break;
772 		}
773 	}
774 
775 	return (0);
776 }
777 
778 static int
779 mps_init_queues(struct mps_softc *sc)
780 {
781 	int i;
782 
783 	memset((uint8_t *)sc->post_queue, 0xff, sc->pqdepth * 8);
784 
785 	if (sc->num_replies >= sc->fqdepth)
786 		return (EINVAL);
787 
788 	for (i = 0; i < sc->num_replies; i++)
789 		sc->free_queue[i] = sc->reply_busaddr + i * sc->facts->ReplyFrameSize * 4;
790 	sc->replyfreeindex = sc->num_replies;
791 
792 	return (0);
793 }
794 
795 int
796 mps_attach(struct mps_softc *sc)
797 {
798 	int i, error;
799 	char tmpstr[80], tmpstr2[80];
800 
801 	/*
802 	 * Grab any tunable-set debug level so that tracing works as early
803 	 * as possible.
804 	 */
805 	snprintf(tmpstr, sizeof(tmpstr), "hw.mps.%d.debug_level",
806 	    device_get_unit(sc->mps_dev));
807 	TUNABLE_INT_FETCH(tmpstr, &sc->mps_debug);
808 
809 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
810 
811 	mtx_init(&sc->mps_mtx, "MPT2SAS lock", NULL, MTX_DEF);
812 	callout_init_mtx(&sc->periodic, &sc->mps_mtx, 0);
813 	TAILQ_INIT(&sc->event_list);
814 
815 	/*
816 	 * Setup the sysctl variable so the user can change the debug level
817 	 * on the fly.
818 	 */
819 	snprintf(tmpstr, sizeof(tmpstr), "MPS controller %d",
820 	    device_get_unit(sc->mps_dev));
821 	snprintf(tmpstr2, sizeof(tmpstr2), "%d", device_get_unit(sc->mps_dev));
822 
823 	sysctl_ctx_init(&sc->sysctl_ctx);
824 	sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
825 	    SYSCTL_STATIC_CHILDREN(_hw_mps), OID_AUTO, tmpstr2, CTLFLAG_RD,
826 	    0, tmpstr);
827 	if (sc->sysctl_tree == NULL)
828 		return (ENOMEM);
829 
830 	SYSCTL_ADD_INT(&sc->sysctl_ctx, SYSCTL_CHILDREN(sc->sysctl_tree),
831 	    OID_AUTO, "debug_level", CTLFLAG_RW, &sc->mps_debug, 0,
832 	    "mps debug level");
833 
834 	if ((error = mps_transition_ready(sc)) != 0)
835 		return (error);
836 
837 	sc->facts = malloc(sizeof(MPI2_IOC_FACTS_REPLY), M_MPT2,
838 	    M_ZERO|M_NOWAIT);
839 	if ((error = mps_get_iocfacts(sc, sc->facts)) != 0)
840 		return (error);
841 
842 	mps_print_iocfacts(sc, sc->facts);
843 
844 	mps_printf(sc, "Firmware: %02d.%02d.%02d.%02d\n",
845 	    sc->facts->FWVersion.Struct.Major,
846 	    sc->facts->FWVersion.Struct.Minor,
847 	    sc->facts->FWVersion.Struct.Unit,
848 	    sc->facts->FWVersion.Struct.Dev);
849 	mps_printf(sc, "IOCCapabilities: %b\n", sc->facts->IOCCapabilities,
850 	    "\20" "\3ScsiTaskFull" "\4DiagTrace" "\5SnapBuf" "\6ExtBuf"
851 	    "\7EEDP" "\10BiDirTarg" "\11Multicast" "\14TransRetry" "\15IR"
852 	    "\16EventReplay" "\17RaidAccel" "\20MSIXIndex" "\21HostDisc");
853 
854 	/*
855 	 * If the chip doesn't support event replay then a hard reset will be
856 	 * required to trigger a full discovery.  Do the reset here then
857 	 * retransition to Ready.  A hard reset might have already been done,
858 	 * but it doesn't hurt to do it again.
859 	 */
860 	if ((sc->facts->IOCCapabilities &
861 	    MPI2_IOCFACTS_CAPABILITY_EVENT_REPLAY) == 0) {
862 		mps_hard_reset(sc);
863 		if ((error = mps_transition_ready(sc)) != 0)
864 			return (error);
865 	}
866 
867 	/*
868 	 * Size the queues. Since the reply queues always need one free entry,
869 	 * we'll just deduct one reply message here.
870 	 */
871 	sc->num_reqs = MIN(MPS_REQ_FRAMES, sc->facts->RequestCredit);
872 	sc->num_replies = MIN(MPS_REPLY_FRAMES + MPS_EVT_REPLY_FRAMES,
873 	    sc->facts->MaxReplyDescriptorPostQueueDepth) - 1;
874 	TAILQ_INIT(&sc->req_list);
875 	TAILQ_INIT(&sc->chain_list);
876 
877 	if (((error = mps_alloc_queues(sc)) != 0) ||
878 	    ((error = mps_alloc_replies(sc)) != 0) ||
879 	    ((error = mps_alloc_requests(sc)) != 0)) {
880 		mps_free(sc);
881 		return (error);
882 	}
883 
884 	if (((error = mps_init_queues(sc)) != 0) ||
885 	    ((error = mps_transition_operational(sc)) != 0)) {
886 		mps_free(sc);
887 		return (error);
888 	}
889 
890 	/*
891 	 * Finish the queue initialization.
892 	 * These are set here instead of in mps_init_queues() because the
893 	 * IOC resets these values during the state transition in
894 	 * mps_transition_operational().  The free index is set to 1
895 	 * because the corresponding index in the IOC is set to 0, and the
896 	 * IOC treats the queues as full if both are set to the same value.
897 	 * Hence the reason that the queue can't hold all of the possible
898 	 * replies.
899 	 */
900 	sc->replypostindex = 0;
901 	sc->replycurindex = 0;
902 	mps_regwrite(sc, MPI2_REPLY_FREE_HOST_INDEX_OFFSET, sc->replyfreeindex);
903 	mps_regwrite(sc, MPI2_REPLY_POST_HOST_INDEX_OFFSET, 0);
904 
905 	sc->pfacts = malloc(sizeof(MPI2_PORT_FACTS_REPLY) *
906 	    sc->facts->NumberOfPorts, M_MPT2, M_ZERO|M_WAITOK);
907 	for (i = 0; i < sc->facts->NumberOfPorts; i++) {
908 		if ((error = mps_get_portfacts(sc, &sc->pfacts[i], i)) != 0) {
909 			mps_free(sc);
910 			return (error);
911 		}
912 		mps_print_portfacts(sc, &sc->pfacts[i]);
913 	}
914 
915 	/* Attach the subsystems so they can prepare their event masks. */
916 	/* XXX Should be dynamic so that IM/IR and user modules can attach */
917 	if (((error = mps_attach_log(sc)) != 0) ||
918 	    ((error = mps_attach_sas(sc)) != 0)) {
919 		mps_free(sc);
920 		return (error);
921 	}
922 
923 	if ((error = mps_pci_setup_interrupts(sc)) != 0) {
924 		mps_free(sc);
925 		return (error);
926 	}
927 
928 	/* Start the periodic watchdog check on the IOC Doorbell */
929 	mps_periodic(sc);
930 
931 	/*
932 	 * The portenable will kick off discovery events that will drive the
933 	 * rest of the initialization process.  The CAM/SAS module will
934 	 * hold up the boot sequence until discovery is complete.
935 	 */
936 	sc->mps_ich.ich_func = mps_startup;
937 	sc->mps_ich.ich_arg = sc;
938 	if (config_intrhook_establish(&sc->mps_ich) != 0) {
939 		mps_dprint(sc, MPS_FAULT, "Cannot establish MPS config hook\n");
940 		error = EINVAL;
941 	}
942 
943 	return (error);
944 }
945 
946 static void
947 mps_startup(void *arg)
948 {
949 	struct mps_softc *sc;
950 
951 	sc = (struct mps_softc *)arg;
952 
953 	mps_lock(sc);
954 	mps_unmask_intr(sc);
955 	mps_send_portenable(sc);
956 	mps_unlock(sc);
957 }
958 
959 /* Periodic watchdog.  Is called with the driver lock already held. */
960 static void
961 mps_periodic(void *arg)
962 {
963 	struct mps_softc *sc;
964 	uint32_t db;
965 
966 	sc = (struct mps_softc *)arg;
967 	if (sc->mps_flags & MPS_FLAGS_SHUTDOWN)
968 		return;
969 
970 	db = mps_regread(sc, MPI2_DOORBELL_OFFSET);
971 	if ((db & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) {
972 		device_printf(sc->mps_dev, "IOC Fault 0x%08x, Resetting\n", db);
973 		/* XXX Need to broaden this to re-initialize the chip */
974 		mps_hard_reset(sc);
975 		db = mps_regread(sc, MPI2_DOORBELL_OFFSET);
976 		if ((db & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) {
977 			device_printf(sc->mps_dev, "Second IOC Fault 0x%08x, "
978 			    "Giving up!\n", db);
979 			return;
980 		}
981 	}
982 
983 	callout_reset(&sc->periodic, MPS_PERIODIC_DELAY * hz, mps_periodic, sc);
984 }
985 
986 static void
987 mps_startup_complete(struct mps_softc *sc, struct mps_command *cm)
988 {
989 	MPI2_PORT_ENABLE_REPLY *reply;
990 
991 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
992 
993 	reply = (MPI2_PORT_ENABLE_REPLY *)cm->cm_reply;
994 	if ((reply->IOCStatus & MPI2_IOCSTATUS_MASK) != MPI2_IOCSTATUS_SUCCESS)
995 		mps_dprint(sc, MPS_FAULT, "Portenable failed\n");
996 
997 	mps_free_command(sc, cm);
998 	config_intrhook_disestablish(&sc->mps_ich);
999 
1000 }
1001 
1002 static void
1003 mps_log_evt_handler(struct mps_softc *sc, uintptr_t data,
1004     MPI2_EVENT_NOTIFICATION_REPLY *event)
1005 {
1006 	MPI2_EVENT_DATA_LOG_ENTRY_ADDED *entry;
1007 
1008 	mps_print_event(sc, event);
1009 
1010 	switch (event->Event) {
1011 	case MPI2_EVENT_LOG_DATA:
1012 		device_printf(sc->mps_dev, "MPI2_EVENT_LOG_DATA:\n");
1013 		hexdump(event->EventData, event->EventDataLength, NULL, 0);
1014 		break;
1015 	case MPI2_EVENT_LOG_ENTRY_ADDED:
1016 		entry = (MPI2_EVENT_DATA_LOG_ENTRY_ADDED *)event->EventData;
1017 		mps_dprint(sc, MPS_INFO, "MPI2_EVENT_LOG_ENTRY_ADDED event "
1018 		    "0x%x Sequence %d:\n", entry->LogEntryQualifier,
1019 		     entry->LogSequence);
1020 		break;
1021 	default:
1022 		break;
1023 	}
1024 	return;
1025 }
1026 
1027 static int
1028 mps_attach_log(struct mps_softc *sc)
1029 {
1030 	uint8_t events[16];
1031 
1032 	bzero(events, 16);
1033 	setbit(events, MPI2_EVENT_LOG_DATA);
1034 	setbit(events, MPI2_EVENT_LOG_ENTRY_ADDED);
1035 
1036 	mps_register_events(sc, events, mps_log_evt_handler, NULL,
1037 	    &sc->mps_log_eh);
1038 
1039 	return (0);
1040 }
1041 
1042 static int
1043 mps_detach_log(struct mps_softc *sc)
1044 {
1045 
1046 	if (sc->mps_log_eh != NULL)
1047 		mps_deregister_events(sc, sc->mps_log_eh);
1048 	return (0);
1049 }
1050 
1051 /*
1052  * Free all of the driver resources and detach submodules.  Should be called
1053  * without the lock held.
1054  */
1055 int
1056 mps_free(struct mps_softc *sc)
1057 {
1058 	struct mps_command *cm;
1059 	int i, error;
1060 
1061 	/* Turn off the watchdog */
1062 	mps_lock(sc);
1063 	sc->mps_flags |= MPS_FLAGS_SHUTDOWN;
1064 	mps_unlock(sc);
1065 	/* Lock must not be held for this */
1066 	callout_drain(&sc->periodic);
1067 
1068 	if (((error = mps_detach_log(sc)) != 0) ||
1069 	    ((error = mps_detach_sas(sc)) != 0))
1070 		return (error);
1071 
1072 	/* Put the IOC back in the READY state. */
1073 	mps_lock(sc);
1074 	if ((error = mps_send_mur(sc)) != 0) {
1075 		mps_unlock(sc);
1076 		return (error);
1077 	}
1078 	mps_unlock(sc);
1079 
1080 	if (sc->facts != NULL)
1081 		free(sc->facts, M_MPT2);
1082 
1083 	if (sc->pfacts != NULL)
1084 		free(sc->pfacts, M_MPT2);
1085 
1086 	if (sc->post_busaddr != 0)
1087 		bus_dmamap_unload(sc->queues_dmat, sc->queues_map);
1088 	if (sc->post_queue != NULL)
1089 		bus_dmamem_free(sc->queues_dmat, sc->post_queue,
1090 		    sc->queues_map);
1091 	if (sc->queues_dmat != NULL)
1092 		bus_dma_tag_destroy(sc->queues_dmat);
1093 
1094 	if (sc->chain_busaddr != 0)
1095 		bus_dmamap_unload(sc->chain_dmat, sc->chain_map);
1096 	if (sc->chain_frames != NULL)
1097 		bus_dmamem_free(sc->chain_dmat, sc->chain_frames,sc->chain_map);
1098 	if (sc->chain_dmat != NULL)
1099 		bus_dma_tag_destroy(sc->chain_dmat);
1100 
1101 	if (sc->sense_busaddr != 0)
1102 		bus_dmamap_unload(sc->sense_dmat, sc->sense_map);
1103 	if (sc->sense_frames != NULL)
1104 		bus_dmamem_free(sc->sense_dmat, sc->sense_frames,sc->sense_map);
1105 	if (sc->sense_dmat != NULL)
1106 		bus_dma_tag_destroy(sc->sense_dmat);
1107 
1108 	if (sc->reply_busaddr != 0)
1109 		bus_dmamap_unload(sc->reply_dmat, sc->reply_map);
1110 	if (sc->reply_frames != NULL)
1111 		bus_dmamem_free(sc->reply_dmat, sc->reply_frames,sc->reply_map);
1112 	if (sc->reply_dmat != NULL)
1113 		bus_dma_tag_destroy(sc->reply_dmat);
1114 
1115 	if (sc->req_busaddr != 0)
1116 		bus_dmamap_unload(sc->req_dmat, sc->req_map);
1117 	if (sc->req_frames != NULL)
1118 		bus_dmamem_free(sc->req_dmat, sc->req_frames, sc->req_map);
1119 	if (sc->req_dmat != NULL)
1120 		bus_dma_tag_destroy(sc->req_dmat);
1121 
1122 	if (sc->chains != NULL)
1123 		free(sc->chains, M_MPT2);
1124 	if (sc->commands != NULL) {
1125 		for (i = 1; i < sc->num_reqs; i++) {
1126 			cm = &sc->commands[i];
1127 			bus_dmamap_destroy(sc->buffer_dmat, cm->cm_dmamap);
1128 		}
1129 		free(sc->commands, M_MPT2);
1130 	}
1131 	if (sc->buffer_dmat != NULL)
1132 		bus_dma_tag_destroy(sc->buffer_dmat);
1133 
1134 	if (sc->sysctl_tree != NULL)
1135 		sysctl_ctx_free(&sc->sysctl_ctx);
1136 
1137 	mtx_destroy(&sc->mps_mtx);
1138 
1139 	return (0);
1140 }
1141 
1142 void
1143 mps_intr(void *data)
1144 {
1145 	struct mps_softc *sc;
1146 	uint32_t status;
1147 
1148 	sc = (struct mps_softc *)data;
1149 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
1150 
1151 	/*
1152 	 * Check interrupt status register to flush the bus.  This is
1153 	 * needed for both INTx interrupts and driver-driven polling
1154 	 */
1155 	status = mps_regread(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET);
1156 	if ((status & MPI2_HIS_REPLY_DESCRIPTOR_INTERRUPT) == 0)
1157 		return;
1158 
1159 	mps_lock(sc);
1160 	mps_intr_locked(data);
1161 	mps_unlock(sc);
1162 	return;
1163 }
1164 
1165 /*
1166  * In theory, MSI/MSIX interrupts shouldn't need to read any registers on the
1167  * chip.  Hopefully this theory is correct.
1168  */
1169 void
1170 mps_intr_msi(void *data)
1171 {
1172 	struct mps_softc *sc;
1173 
1174 	sc = (struct mps_softc *)data;
1175 	mps_lock(sc);
1176 	mps_intr_locked(data);
1177 	mps_unlock(sc);
1178 	return;
1179 }
1180 
1181 /*
1182  * The locking is overly broad and simplistic, but easy to deal with for now.
1183  */
1184 void
1185 mps_intr_locked(void *data)
1186 {
1187 	MPI2_REPLY_DESCRIPTORS_UNION *desc;
1188 	struct mps_softc *sc;
1189 	struct mps_command *cm = NULL;
1190 	uint8_t flags;
1191 	u_int pq;
1192 
1193 	sc = (struct mps_softc *)data;
1194 
1195 	pq = sc->replypostindex;
1196 
1197 	for ( ;; ) {
1198 		cm = NULL;
1199 		desc = &sc->post_queue[pq];
1200 		flags = desc->Default.ReplyFlags &
1201 		    MPI2_RPY_DESCRIPT_FLAGS_TYPE_MASK;
1202 		if (flags == MPI2_RPY_DESCRIPT_FLAGS_UNUSED)
1203 			break;
1204 
1205 		switch (flags) {
1206 		case MPI2_RPY_DESCRIPT_FLAGS_SCSI_IO_SUCCESS:
1207 			cm = &sc->commands[desc->SCSIIOSuccess.SMID];
1208 			cm->cm_reply = NULL;
1209 			break;
1210 		case MPI2_RPY_DESCRIPT_FLAGS_ADDRESS_REPLY:
1211 		{
1212 			uint32_t baddr;
1213 			uint8_t *reply;
1214 
1215 			reply = sc->reply_frames +
1216 			    sc->replycurindex * sc->facts->ReplyFrameSize * 4;
1217 			baddr = desc->AddressReply.ReplyFrameAddress;
1218 			if (desc->AddressReply.SMID == 0) {
1219 				mps_dispatch_event(sc, baddr,
1220 				   (MPI2_EVENT_NOTIFICATION_REPLY *) reply);
1221 			} else {
1222 				cm = &sc->commands[desc->AddressReply.SMID];
1223 				cm->cm_reply = reply;
1224 				cm->cm_reply_data =
1225 				    desc->AddressReply.ReplyFrameAddress;
1226 			}
1227 			if (++sc->replycurindex >= sc->fqdepth)
1228 				sc->replycurindex = 0;
1229 			break;
1230 		}
1231 		case MPI2_RPY_DESCRIPT_FLAGS_TARGETASSIST_SUCCESS:
1232 		case MPI2_RPY_DESCRIPT_FLAGS_TARGET_COMMAND_BUFFER:
1233 		case MPI2_RPY_DESCRIPT_FLAGS_RAID_ACCELERATOR_SUCCESS:
1234 		default:
1235 			/* Unhandled */
1236 			device_printf(sc->mps_dev, "Unhandled reply 0x%x\n",
1237 			    desc->Default.ReplyFlags);
1238 			cm = NULL;
1239 			break;
1240 		}
1241 
1242 		if (cm != NULL) {
1243 			if (cm->cm_flags & MPS_CM_FLAGS_POLLED)
1244 				cm->cm_flags |= MPS_CM_FLAGS_COMPLETE;
1245 
1246 			if (cm->cm_complete != NULL)
1247 				cm->cm_complete(sc, cm);
1248 
1249 			if (cm->cm_flags & MPS_CM_FLAGS_WAKEUP)
1250 				wakeup(cm);
1251 		}
1252 
1253 		desc->Words.Low = 0xffffffff;
1254 		desc->Words.High = 0xffffffff;
1255 		if (++pq >= sc->pqdepth)
1256 			pq = 0;
1257 	}
1258 
1259 	if (pq != sc->replypostindex) {
1260 		mps_dprint(sc, MPS_INFO, "writing postindex %d\n", pq);
1261 		mps_regwrite(sc, MPI2_REPLY_POST_HOST_INDEX_OFFSET, pq);
1262 		sc->replypostindex = pq;
1263 	}
1264 
1265 	return;
1266 }
1267 
1268 static void
1269 mps_dispatch_event(struct mps_softc *sc, uintptr_t data,
1270     MPI2_EVENT_NOTIFICATION_REPLY *reply)
1271 {
1272 	struct mps_event_handle *eh;
1273 	int event, handled = 0;;
1274 
1275 	event = reply->Event;
1276 	TAILQ_FOREACH(eh, &sc->event_list, eh_list) {
1277 		if (isset(eh->mask, event)) {
1278 			eh->callback(sc, data, reply);
1279 			handled++;
1280 		}
1281 	}
1282 
1283 	if (handled == 0)
1284 		device_printf(sc->mps_dev, "Unhandled event 0x%x\n", event);
1285 }
1286 
1287 /*
1288  * For both register_events and update_events, the caller supplies a bitmap
1289  * of events that it _wants_.  These functions then turn that into a bitmask
1290  * suitable for the controller.
1291  */
1292 int
1293 mps_register_events(struct mps_softc *sc, uint8_t *mask,
1294     mps_evt_callback_t *cb, void *data, struct mps_event_handle **handle)
1295 {
1296 	struct mps_event_handle *eh;
1297 	int error = 0;
1298 
1299 	eh = malloc(sizeof(struct mps_event_handle), M_MPT2, M_WAITOK|M_ZERO);
1300 	eh->callback = cb;
1301 	eh->data = data;
1302 	TAILQ_INSERT_TAIL(&sc->event_list, eh, eh_list);
1303 	if (mask != NULL)
1304 		error = mps_update_events(sc, eh, mask);
1305 	*handle = eh;
1306 
1307 	return (error);
1308 }
1309 
1310 int
1311 mps_update_events(struct mps_softc *sc, struct mps_event_handle *handle,
1312     uint8_t *mask)
1313 {
1314 	MPI2_EVENT_NOTIFICATION_REQUEST *evtreq;
1315 	MPI2_EVENT_NOTIFICATION_REPLY *reply;
1316 	struct mps_command *cm;
1317 	struct mps_event_handle *eh;
1318 	int error, i;
1319 
1320 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
1321 
1322 	if ((mask != NULL) && (handle != NULL))
1323 		bcopy(mask, &handle->mask[0], 16);
1324 	memset(sc->event_mask, 0xff, 16);
1325 
1326 	TAILQ_FOREACH(eh, &sc->event_list, eh_list) {
1327 		for (i = 0; i < 16; i++)
1328 			sc->event_mask[i] &= ~eh->mask[i];
1329 	}
1330 
1331 	if ((cm = mps_alloc_command(sc)) == NULL)
1332 		return (EBUSY);
1333 	evtreq = (MPI2_EVENT_NOTIFICATION_REQUEST *)cm->cm_req;
1334 	evtreq->Function = MPI2_FUNCTION_EVENT_NOTIFICATION;
1335 	evtreq->MsgFlags = 0;
1336 	evtreq->SASBroadcastPrimitiveMasks = 0;
1337 #ifdef MPS_DEBUG_ALL_EVENTS
1338 	{
1339 		u_char fullmask[16];
1340 		memset(fullmask, 0x00, 16);
1341 		bcopy(fullmask, (uint8_t *)&evtreq->EventMasks, 16);
1342 	}
1343 #else
1344 		bcopy(sc->event_mask, (uint8_t *)&evtreq->EventMasks, 16);
1345 #endif
1346 	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
1347 	cm->cm_data = NULL;
1348 
1349 	error = mps_request_polled(sc, cm);
1350 	reply = (MPI2_EVENT_NOTIFICATION_REPLY *)cm->cm_reply;
1351 	if ((reply->IOCStatus & MPI2_IOCSTATUS_MASK) != MPI2_IOCSTATUS_SUCCESS)
1352 		error = ENXIO;
1353 	mps_print_event(sc, reply);
1354 
1355 	mps_free_command(sc, cm);
1356 	return (error);
1357 }
1358 
1359 int
1360 mps_deregister_events(struct mps_softc *sc, struct mps_event_handle *handle)
1361 {
1362 
1363 	TAILQ_REMOVE(&sc->event_list, handle, eh_list);
1364 	free(handle, M_MPT2);
1365 	return (mps_update_events(sc, NULL, NULL));
1366 }
1367 
1368 static void
1369 mps_data_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1370 {
1371 	MPI2_SGE_SIMPLE64 *sge;
1372 	MPI2_SGE_CHAIN32 *sgc;
1373 	struct mps_softc *sc;
1374 	struct mps_command *cm;
1375 	struct mps_chain *chain;
1376 	u_int i, segsleft, sglspace, dir, flags, sflags;
1377 
1378 	cm = (struct mps_command *)arg;
1379 	sc = cm->cm_sc;
1380 
1381         segsleft = nsegs;
1382         sglspace = cm->cm_sglsize;
1383         sge = (MPI2_SGE_SIMPLE64 *)&cm->cm_sge->MpiSimple;
1384 
1385 	/*
1386 	 * Set up DMA direction flags.  Note no support for
1387 	 * bi-directional transactions.
1388 	 */
1389         sflags = MPI2_SGE_FLAGS_ADDRESS_SIZE;
1390         if (cm->cm_flags & MPS_CM_FLAGS_DATAOUT) {
1391                 sflags |= MPI2_SGE_FLAGS_DIRECTION;
1392 		dir = BUS_DMASYNC_PREWRITE;
1393 	} else
1394 		dir = BUS_DMASYNC_PREREAD;
1395 
1396 	/*
1397 	 * case 1: 1 more segment, enough room for it
1398 	 * case 2: 2 more segments, enough room for both
1399 	 * case 3: >=2 more segments, only enough room for 1 and a chain
1400 	 * case 4: >=1 more segment, enough room for only a chain
1401 	 * case 5: >=1 more segment, no room for anything (error)
1402 	 */
1403 
1404 	for (i = 0; i < nsegs; i++) {
1405 
1406 		/* Case 5 Error.  This should never happen. */
1407 		if (sglspace < MPS_SGC_SIZE) {
1408 			panic("MPS: Need SGE Error Code\n");
1409 		}
1410 
1411 		/*
1412 		 * Case 4, Fill in a chain element, allocate a chain,
1413 		 * fill in one SGE element, continue.
1414 		 */
1415 		if ((sglspace >= MPS_SGC_SIZE) && (sglspace < MPS_SGE64_SIZE)) {
1416 			chain = mps_alloc_chain(sc);
1417 			if (chain == NULL) {
1418 				/* Resource shortage, roll back! */
1419 				mps_printf(sc, "out of chain frames\n");
1420 				return;
1421 			}
1422 
1423 			/*
1424 			 * Note: a double-linked list is used to make it
1425 			 * easier to walk for debugging.
1426 			 */
1427 			TAILQ_INSERT_TAIL(&cm->cm_chain_list, chain,chain_link);
1428 
1429 			sgc = (MPI2_SGE_CHAIN32 *)sge;
1430 			sgc->Length = 128;
1431 			sgc->NextChainOffset = 0;
1432 			sgc->Flags = MPI2_SGE_FLAGS_CHAIN_ELEMENT;
1433 			sgc->Address = chain->chain_busaddr;
1434 
1435 			sge = (MPI2_SGE_SIMPLE64 *)&chain->chain->MpiSimple;
1436 			sglspace = 128;
1437 		}
1438 
1439 		flags = MPI2_SGE_FLAGS_SIMPLE_ELEMENT;
1440 		sge->FlagsLength = segs[i].ds_len |
1441 		   ((sflags | flags) << MPI2_SGE_FLAGS_SHIFT);
1442 		mps_from_u64(segs[i].ds_addr, &sge->Address);
1443 
1444 		/* Case 1, Fill in one SGE element and break */
1445 		if (segsleft == 1)
1446 			break;
1447 
1448 		sglspace -= MPS_SGE64_SIZE;
1449 		segsleft--;
1450 
1451 		/* Case 3, prepare for a chain on the next loop */
1452 		if ((segsleft > 0) && (sglspace < MPS_SGE64_SIZE))
1453 			sge->FlagsLength |=
1454 			    (MPI2_SGE_FLAGS_LAST_ELEMENT <<
1455 			    MPI2_SGE_FLAGS_SHIFT);
1456 
1457 		/* Advance to the next element to be filled in. */
1458 		sge++;
1459 	}
1460 
1461 	/* Last element of the last segment of the entire buffer */
1462 	flags = MPI2_SGE_FLAGS_LAST_ELEMENT |
1463 	    MPI2_SGE_FLAGS_END_OF_BUFFER |
1464 	    MPI2_SGE_FLAGS_END_OF_LIST;
1465 	sge->FlagsLength |= (flags << MPI2_SGE_FLAGS_SHIFT);
1466 
1467 	bus_dmamap_sync(sc->buffer_dmat, cm->cm_dmamap, dir);
1468 	mps_enqueue_request(sc, cm);
1469 
1470 	return;
1471 }
1472 
1473 int
1474 mps_map_command(struct mps_softc *sc, struct mps_command *cm)
1475 {
1476 	MPI2_SGE_SIMPLE32 *sge;
1477 	int error = 0;
1478 
1479 	if ((cm->cm_data != NULL) && (cm->cm_length != 0)) {
1480 		error = bus_dmamap_load(sc->buffer_dmat, cm->cm_dmamap,
1481 		    cm->cm_data, cm->cm_length, mps_data_cb, cm, 0);
1482 	} else {
1483 		/* Add a zero-length element as needed */
1484 		if (cm->cm_sge != NULL) {
1485 			sge = (MPI2_SGE_SIMPLE32 *)cm->cm_sge;
1486 			sge->FlagsLength = (MPI2_SGE_FLAGS_LAST_ELEMENT |
1487 			    MPI2_SGE_FLAGS_END_OF_BUFFER |
1488 			    MPI2_SGE_FLAGS_END_OF_LIST |
1489 			    MPI2_SGE_FLAGS_SIMPLE_ELEMENT) <<
1490 			    MPI2_SGE_FLAGS_SHIFT;
1491 			sge->Address = 0;
1492 		}
1493 		mps_enqueue_request(sc, cm);
1494 	}
1495 
1496 	return (error);
1497 }
1498 
1499 /*
1500  * The MPT driver had a verbose interface for config pages.  In this driver,
1501  * reduce it to much simplier terms, similar to the Linux driver.
1502  */
1503 int
1504 mps_read_config_page(struct mps_softc *sc, struct mps_config_params *params)
1505 {
1506 	MPI2_CONFIG_REQUEST *req;
1507 	struct mps_command *cm;
1508 	int error;
1509 
1510 	if (sc->mps_flags & MPS_FLAGS_BUSY) {
1511 		return (EBUSY);
1512 	}
1513 
1514 	cm = mps_alloc_command(sc);
1515 	if (cm == NULL) {
1516 		return (EBUSY);
1517 	}
1518 
1519 	req = (MPI2_CONFIG_REQUEST *)cm->cm_req;
1520 	req->Function = MPI2_FUNCTION_CONFIG;
1521 	req->Action = params->action;
1522 	req->SGLFlags = 0;
1523 	req->ChainOffset = 0;
1524 	req->PageAddress = params->page_address;
1525 	if (params->hdr.Ext.ExtPageType != 0) {
1526 		MPI2_CONFIG_EXTENDED_PAGE_HEADER *hdr;
1527 
1528 		hdr = &params->hdr.Ext;
1529 		req->ExtPageType = hdr->ExtPageType;
1530 		req->ExtPageLength = hdr->ExtPageLength;
1531 		req->Header.PageType = MPI2_CONFIG_PAGETYPE_EXTENDED;
1532 		req->Header.PageLength = 0; /* Must be set to zero */
1533 		req->Header.PageNumber = hdr->PageNumber;
1534 		req->Header.PageVersion = hdr->PageVersion;
1535 	} else {
1536 		MPI2_CONFIG_PAGE_HEADER *hdr;
1537 
1538 		hdr = &params->hdr.Struct;
1539 		req->Header.PageType = hdr->PageType;
1540 		req->Header.PageNumber = hdr->PageNumber;
1541 		req->Header.PageLength = hdr->PageLength;
1542 		req->Header.PageVersion = hdr->PageVersion;
1543 	}
1544 
1545 	cm->cm_data = params->buffer;
1546 	cm->cm_length = params->length;
1547 	cm->cm_sge = &req->PageBufferSGE;
1548 	cm->cm_sglsize = sizeof(MPI2_SGE_IO_UNION);
1549 	cm->cm_flags = MPS_CM_FLAGS_SGE_SIMPLE | MPS_CM_FLAGS_DATAIN;
1550 	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
1551 
1552 	if (params->callback != NULL) {
1553 		cm->cm_complete = mps_config_complete;
1554 		cm->cm_complete_data = params;
1555 		return (mps_map_command(sc, cm));
1556 	} else {
1557 		cm->cm_complete = NULL;
1558 		cm->cm_flags |= MPS_CM_FLAGS_WAKEUP;
1559 		if ((error = mps_map_command(sc, cm)) != 0)
1560 			return (error);
1561 		msleep(cm, &sc->mps_mtx, 0, "mpswait", 0);
1562 		mps_config_complete(sc, cm);
1563 	}
1564 
1565 	return (0);
1566 }
1567 
1568 int
1569 mps_write_config_page(struct mps_softc *sc, struct mps_config_params *params)
1570 {
1571 	return (EINVAL);
1572 }
1573 
1574 static void
1575 mps_config_complete(struct mps_softc *sc, struct mps_command *cm)
1576 {
1577 	MPI2_CONFIG_REPLY *reply;
1578 	struct mps_config_params *params;
1579 
1580 	params = cm->cm_complete_data;
1581 
1582 	if (cm->cm_data != NULL) {
1583 		bus_dmamap_sync(sc->buffer_dmat, cm->cm_dmamap,
1584 		    BUS_DMASYNC_POSTREAD);
1585 		bus_dmamap_unload(sc->buffer_dmat, cm->cm_dmamap);
1586 	}
1587 
1588 	reply = (MPI2_CONFIG_REPLY *)cm->cm_reply;
1589 	params->status = reply->IOCStatus;
1590 	if (params->hdr.Ext.ExtPageType != 0) {
1591 		params->hdr.Ext.ExtPageType = reply->ExtPageType;
1592 		params->hdr.Ext.ExtPageLength = reply->ExtPageLength;
1593 	} else {
1594 		params->hdr.Struct.PageType = reply->Header.PageType;
1595 		params->hdr.Struct.PageNumber = reply->Header.PageNumber;
1596 		params->hdr.Struct.PageLength = reply->Header.PageLength;
1597 		params->hdr.Struct.PageVersion = reply->Header.PageVersion;
1598 	}
1599 
1600 	mps_free_command(sc, cm);
1601 	if (params->callback != NULL)
1602 		params->callback(sc, params);
1603 
1604 	return;
1605 }
1606