xref: /freebsd/sys/dev/mps/mps.c (revision dadef94c7a762d05890e2891bc4a7d1dfe0cf758)
1 /*-
2  * Copyright (c) 2009 Yahoo! Inc.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 /* Communications core for LSI MPT2 */
31 
32 #include <sys/types.h>
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/kernel.h>
36 #include <sys/selinfo.h>
37 #include <sys/lock.h>
38 #include <sys/mutex.h>
39 #include <sys/module.h>
40 #include <sys/bus.h>
41 #include <sys/conf.h>
42 #include <sys/bio.h>
43 #include <sys/malloc.h>
44 #include <sys/uio.h>
45 #include <sys/sysctl.h>
46 
47 #include <machine/bus.h>
48 #include <machine/resource.h>
49 #include <sys/rman.h>
50 
51 #include <cam/scsi/scsi_all.h>
52 
53 #include <dev/mps/mpi/mpi2_type.h>
54 #include <dev/mps/mpi/mpi2.h>
55 #include <dev/mps/mpi/mpi2_ioc.h>
56 #include <dev/mps/mpi/mpi2_cnfg.h>
57 #include <dev/mps/mpsvar.h>
58 #include <dev/mps/mps_table.h>
59 
60 static void mps_startup(void *arg);
61 static void mps_startup_complete(struct mps_softc *sc, struct mps_command *cm);
62 static int mps_send_iocinit(struct mps_softc *sc);
63 static int mps_attach_log(struct mps_softc *sc);
64 static void mps_dispatch_event(struct mps_softc *sc, uintptr_t data, MPI2_EVENT_NOTIFICATION_REPLY *reply);
65 static void mps_config_complete(struct mps_softc *sc, struct mps_command *cm);
66 static void mps_periodic(void *);
67 
68 SYSCTL_NODE(_hw, OID_AUTO, mps, CTLFLAG_RD, 0, "MPS Driver Parameters");
69 
70 MALLOC_DEFINE(M_MPT2, "mps", "mpt2 driver memory");
71 
72 /*
73  * Do a "Diagnostic Reset" aka a hard reset.  This should get the chip out of
74  * any state and back to its initialization state machine.
75  */
76 static char mpt2_reset_magic[] = { 0x00, 0x0f, 0x04, 0x0b, 0x02, 0x07, 0x0d };
77 
78 static int
79 mps_hard_reset(struct mps_softc *sc)
80 {
81 	uint32_t reg;
82 	int i, error, tries = 0;
83 
84 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
85 
86 	/* Clear any pending interrupts */
87 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
88 
89 	/* Push the magic sequence */
90 	error = ETIMEDOUT;
91 	while (tries++ < 20) {
92 		for (i = 0; i < sizeof(mpt2_reset_magic); i++)
93 			mps_regwrite(sc, MPI2_WRITE_SEQUENCE_OFFSET,
94 			    mpt2_reset_magic[i]);
95 
96 		DELAY(100 * 1000);
97 
98 		reg = mps_regread(sc, MPI2_HOST_DIAGNOSTIC_OFFSET);
99 		if (reg & MPI2_DIAG_DIAG_WRITE_ENABLE) {
100 			error = 0;
101 			break;
102 		}
103 	}
104 	if (error)
105 		return (error);
106 
107 	/* Send the actual reset.  XXX need to refresh the reg? */
108 	mps_regwrite(sc, MPI2_HOST_DIAGNOSTIC_OFFSET,
109 	    reg | MPI2_DIAG_RESET_ADAPTER);
110 
111 	/* Wait up to 300 seconds in 50ms intervals */
112 	error = ETIMEDOUT;
113 	for (i = 0; i < 60000; i++) {
114 		DELAY(50000);
115 		reg = mps_regread(sc, MPI2_DOORBELL_OFFSET);
116 		if ((reg & MPI2_IOC_STATE_MASK) != MPI2_IOC_STATE_RESET) {
117 			error = 0;
118 			break;
119 		}
120 	}
121 	if (error)
122 		return (error);
123 
124 	mps_regwrite(sc, MPI2_WRITE_SEQUENCE_OFFSET, 0x0);
125 
126 	return (0);
127 }
128 
129 static int
130 mps_soft_reset(struct mps_softc *sc)
131 {
132 
133 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
134 
135 	mps_regwrite(sc, MPI2_DOORBELL_OFFSET,
136 	    MPI2_FUNCTION_IOC_MESSAGE_UNIT_RESET <<
137 	    MPI2_DOORBELL_FUNCTION_SHIFT);
138 	DELAY(50000);
139 
140 	return (0);
141 }
142 
143 static int
144 mps_transition_ready(struct mps_softc *sc)
145 {
146 	uint32_t reg, state;
147 	int error, tries = 0;
148 
149 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
150 
151 	error = 0;
152 	while (tries++ < 5) {
153 		reg = mps_regread(sc, MPI2_DOORBELL_OFFSET);
154 		mps_dprint(sc, MPS_INFO, "Doorbell= 0x%x\n", reg);
155 
156 		/*
157 		 * Ensure the IOC is ready to talk.  If it's not, try
158 		 * resetting it.
159 		 */
160 		if (reg & MPI2_DOORBELL_USED) {
161 			mps_hard_reset(sc);
162 			DELAY(50000);
163 			continue;
164 		}
165 
166 		/* Is the adapter owned by another peer? */
167 		if ((reg & MPI2_DOORBELL_WHO_INIT_MASK) ==
168 		    (MPI2_WHOINIT_PCI_PEER << MPI2_DOORBELL_WHO_INIT_SHIFT)) {
169 			device_printf(sc->mps_dev, "IOC is under the control "
170 			    "of another peer host, aborting initialization.\n");
171 			return (ENXIO);
172 		}
173 
174 		state = reg & MPI2_IOC_STATE_MASK;
175 		if (state == MPI2_IOC_STATE_READY) {
176 			/* Ready to go! */
177 			error = 0;
178 			break;
179 		} else if (state == MPI2_IOC_STATE_FAULT) {
180 			mps_dprint(sc, MPS_INFO, "IOC in fault state 0x%x\n",
181 			    state & MPI2_DOORBELL_FAULT_CODE_MASK);
182 			mps_hard_reset(sc);
183 		} else if (state == MPI2_IOC_STATE_OPERATIONAL) {
184 			/* Need to take ownership */
185 			mps_soft_reset(sc);
186 		} else if (state == MPI2_IOC_STATE_RESET) {
187 			/* Wait a bit, IOC might be in transition */
188 			mps_dprint(sc, MPS_FAULT,
189 			    "IOC in unexpected reset state\n");
190 		} else {
191 			mps_dprint(sc, MPS_FAULT,
192 			    "IOC in unknown state 0x%x\n", state);
193 			error = EINVAL;
194 			break;
195 		}
196 
197 		/* Wait 50ms for things to settle down. */
198 		DELAY(50000);
199 	}
200 
201 	if (error)
202 		device_printf(sc->mps_dev, "Cannot transition IOC to ready\n");
203 
204 	return (error);
205 }
206 
207 static int
208 mps_transition_operational(struct mps_softc *sc)
209 {
210 	uint32_t reg, state;
211 	int error;
212 
213 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
214 
215 	error = 0;
216 	reg = mps_regread(sc, MPI2_DOORBELL_OFFSET);
217 	mps_dprint(sc, MPS_INFO, "Doorbell= 0x%x\n", reg);
218 
219 	state = reg & MPI2_IOC_STATE_MASK;
220 	if (state != MPI2_IOC_STATE_READY) {
221 		if ((error = mps_transition_ready(sc)) != 0)
222 			return (error);
223 	}
224 
225 	error = mps_send_iocinit(sc);
226 	return (error);
227 }
228 
229 /* Wait for the chip to ACK a word that we've put into its FIFO */
230 static int
231 mps_wait_db_ack(struct mps_softc *sc)
232 {
233 	int retry;
234 
235 	for (retry = 0; retry < MPS_DB_MAX_WAIT; retry++) {
236 		if ((mps_regread(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET) &
237 		    MPI2_HIS_SYS2IOC_DB_STATUS) == 0)
238 			return (0);
239 		DELAY(2000);
240 	}
241 	return (ETIMEDOUT);
242 }
243 
244 /* Wait for the chip to signal that the next word in its FIFO can be fetched */
245 static int
246 mps_wait_db_int(struct mps_softc *sc)
247 {
248 	int retry;
249 
250 	for (retry = 0; retry < MPS_DB_MAX_WAIT; retry++) {
251 		if ((mps_regread(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET) &
252 		    MPI2_HIS_IOC2SYS_DB_STATUS) != 0)
253 			return (0);
254 		DELAY(2000);
255 	}
256 	return (ETIMEDOUT);
257 }
258 
259 /* Step through the synchronous command state machine, i.e. "Doorbell mode" */
260 static int
261 mps_request_sync(struct mps_softc *sc, void *req, MPI2_DEFAULT_REPLY *reply,
262     int req_sz, int reply_sz, int timeout)
263 {
264 	uint32_t *data32;
265 	uint16_t *data16;
266 	int i, count, ioc_sz, residual;
267 
268 	/* Step 1 */
269 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
270 
271 	/* Step 2 */
272 	if (mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_USED)
273 		return (EBUSY);
274 
275 	/* Step 3
276 	 * Announce that a message is coming through the doorbell.  Messages
277 	 * are pushed at 32bit words, so round up if needed.
278 	 */
279 	count = (req_sz + 3) / 4;
280 	mps_regwrite(sc, MPI2_DOORBELL_OFFSET,
281 	    (MPI2_FUNCTION_HANDSHAKE << MPI2_DOORBELL_FUNCTION_SHIFT) |
282 	    (count << MPI2_DOORBELL_ADD_DWORDS_SHIFT));
283 
284 	/* Step 4 */
285 	if (mps_wait_db_int(sc) ||
286 	    (mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_USED) == 0) {
287 		mps_dprint(sc, MPS_FAULT, "Doorbell failed to activate\n");
288 		return (ENXIO);
289 	}
290 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
291 	if (mps_wait_db_ack(sc) != 0) {
292 		mps_dprint(sc, MPS_FAULT, "Doorbell handshake failed\n");
293 		return (ENXIO);
294 	}
295 
296 	/* Step 5 */
297 	/* Clock out the message data synchronously in 32-bit dwords*/
298 	data32 = (uint32_t *)req;
299 	for (i = 0; i < count; i++) {
300 		mps_regwrite(sc, MPI2_DOORBELL_OFFSET, data32[i]);
301 		if (mps_wait_db_ack(sc) != 0) {
302 			mps_dprint(sc, MPS_FAULT,
303 			    "Timeout while writing doorbell\n");
304 			return (ENXIO);
305 		}
306 	}
307 
308 	/* Step 6 */
309 	/* Clock in the reply in 16-bit words.  The total length of the
310 	 * message is always in the 4th byte, so clock out the first 2 words
311 	 * manually, then loop the rest.
312 	 */
313 	data16 = (uint16_t *)reply;
314 	if (mps_wait_db_int(sc) != 0) {
315 		mps_dprint(sc, MPS_FAULT, "Timeout reading doorbell 0\n");
316 		return (ENXIO);
317 	}
318 	data16[0] =
319 	    mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_DATA_MASK;
320 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
321 	if (mps_wait_db_int(sc) != 0) {
322 		mps_dprint(sc, MPS_FAULT, "Timeout reading doorbell 1\n");
323 		return (ENXIO);
324 	}
325 	data16[1] =
326 	    mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_DATA_MASK;
327 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
328 
329 	/* Number of 32bit words in the message */
330 	ioc_sz = reply->MsgLength;
331 
332 	/*
333 	 * Figure out how many 16bit words to clock in without overrunning.
334 	 * The precision loss with dividing reply_sz can safely be
335 	 * ignored because the messages can only be multiples of 32bits.
336 	 */
337 	residual = 0;
338 	count = MIN((reply_sz / 4), ioc_sz) * 2;
339 	if (count < ioc_sz * 2) {
340 		residual = ioc_sz * 2 - count;
341 		mps_dprint(sc, MPS_FAULT, "Driver error, throwing away %d "
342 		    "residual message words\n", residual);
343 	}
344 
345 	for (i = 2; i < count; i++) {
346 		if (mps_wait_db_int(sc) != 0) {
347 			mps_dprint(sc, MPS_FAULT,
348 			    "Timeout reading doorbell %d\n", i);
349 			return (ENXIO);
350 		}
351 		data16[i] = mps_regread(sc, MPI2_DOORBELL_OFFSET) &
352 		    MPI2_DOORBELL_DATA_MASK;
353 		mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
354 	}
355 
356 	/*
357 	 * Pull out residual words that won't fit into the provided buffer.
358 	 * This keeps the chip from hanging due to a driver programming
359 	 * error.
360 	 */
361 	while (residual--) {
362 		if (mps_wait_db_int(sc) != 0) {
363 			mps_dprint(sc, MPS_FAULT,
364 			    "Timeout reading doorbell\n");
365 			return (ENXIO);
366 		}
367 		(void)mps_regread(sc, MPI2_DOORBELL_OFFSET);
368 		mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
369 	}
370 
371 	/* Step 7 */
372 	if (mps_wait_db_int(sc) != 0) {
373 		mps_dprint(sc, MPS_FAULT, "Timeout waiting to exit doorbell\n");
374 		return (ENXIO);
375 	}
376 	if (mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_USED)
377 		mps_dprint(sc, MPS_FAULT, "Warning, doorbell still active\n");
378 	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
379 
380 	return (0);
381 }
382 
383 void
384 mps_enqueue_request(struct mps_softc *sc, struct mps_command *cm)
385 {
386 
387 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
388 
389 	mps_regwrite(sc, MPI2_REQUEST_DESCRIPTOR_POST_LOW_OFFSET,
390 	    cm->cm_desc.Words.Low);
391 	mps_regwrite(sc, MPI2_REQUEST_DESCRIPTOR_POST_HIGH_OFFSET,
392 	    cm->cm_desc.Words.High);
393 }
394 
395 int
396 mps_request_polled(struct mps_softc *sc, struct mps_command *cm)
397 {
398 	int error, timeout = 0;
399 
400 	error = 0;
401 
402 	cm->cm_flags |= MPS_CM_FLAGS_POLLED;
403 	cm->cm_complete = NULL;
404 	mps_map_command(sc, cm);
405 
406 	while ((cm->cm_flags & MPS_CM_FLAGS_COMPLETE) == 0) {
407 		mps_intr(sc);
408 		DELAY(50 * 1000);
409 		if (timeout++ > 1000) {
410 			mps_dprint(sc, MPS_FAULT, "polling failed\n");
411 			error = ETIMEDOUT;
412 			break;
413 		}
414 	}
415 
416 	return (error);
417 }
418 
419 /*
420  * Just the FACTS, ma'am.
421  */
422 static int
423 mps_get_iocfacts(struct mps_softc *sc, MPI2_IOC_FACTS_REPLY *facts)
424 {
425 	MPI2_DEFAULT_REPLY *reply;
426 	MPI2_IOC_FACTS_REQUEST request;
427 	int error, req_sz, reply_sz;
428 
429 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
430 
431 	req_sz = sizeof(MPI2_IOC_FACTS_REQUEST);
432 	reply_sz = sizeof(MPI2_IOC_FACTS_REPLY);
433 	reply = (MPI2_DEFAULT_REPLY *)facts;
434 
435 	bzero(&request, req_sz);
436 	request.Function = MPI2_FUNCTION_IOC_FACTS;
437 	error = mps_request_sync(sc, &request, reply, req_sz, reply_sz, 5);
438 
439 	return (error);
440 }
441 
442 static int
443 mps_get_portfacts(struct mps_softc *sc, MPI2_PORT_FACTS_REPLY *facts, int port)
444 {
445 	MPI2_PORT_FACTS_REQUEST *request;
446 	MPI2_PORT_FACTS_REPLY *reply;
447 	struct mps_command *cm;
448 	int error;
449 
450 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
451 
452 	if ((cm = mps_alloc_command(sc)) == NULL)
453 		return (EBUSY);
454 	request = (MPI2_PORT_FACTS_REQUEST *)cm->cm_req;
455 	request->Function = MPI2_FUNCTION_PORT_FACTS;
456 	request->PortNumber = port;
457 	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
458 	cm->cm_data = NULL;
459 	error = mps_request_polled(sc, cm);
460 	reply = (MPI2_PORT_FACTS_REPLY *)cm->cm_reply;
461 	if ((reply->IOCStatus & MPI2_IOCSTATUS_MASK) != MPI2_IOCSTATUS_SUCCESS)
462 		error = ENXIO;
463 	bcopy(reply, facts, sizeof(MPI2_PORT_FACTS_REPLY));
464 	mps_free_command(sc, cm);
465 
466 	return (error);
467 }
468 
469 static int
470 mps_send_iocinit(struct mps_softc *sc)
471 {
472 	MPI2_IOC_INIT_REQUEST	init;
473 	MPI2_DEFAULT_REPLY	reply;
474 	int req_sz, reply_sz, error;
475 
476 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
477 
478 	req_sz = sizeof(MPI2_IOC_INIT_REQUEST);
479 	reply_sz = sizeof(MPI2_IOC_INIT_REPLY);
480 	bzero(&init, req_sz);
481 	bzero(&reply, reply_sz);
482 
483 	/*
484 	 * Fill in the init block.  Note that most addresses are
485 	 * deliberately in the lower 32bits of memory.  This is a micro-
486 	 * optimzation for PCI/PCIX, though it's not clear if it helps PCIe.
487 	 */
488 	init.Function = MPI2_FUNCTION_IOC_INIT;
489 	init.WhoInit = MPI2_WHOINIT_HOST_DRIVER;
490 	init.MsgVersion = MPI2_VERSION;
491 	init.HeaderVersion = MPI2_HEADER_VERSION;
492 	init.SystemRequestFrameSize = sc->facts->IOCRequestFrameSize;
493 	init.ReplyDescriptorPostQueueDepth = sc->pqdepth;
494 	init.ReplyFreeQueueDepth = sc->fqdepth;
495 	init.SenseBufferAddressHigh = 0;
496 	init.SystemReplyAddressHigh = 0;
497 	init.SystemRequestFrameBaseAddress.High = 0;
498 	init.SystemRequestFrameBaseAddress.Low = (uint32_t)sc->req_busaddr;
499 	init.ReplyDescriptorPostQueueAddress.High = 0;
500 	init.ReplyDescriptorPostQueueAddress.Low = (uint32_t)sc->post_busaddr;
501 	init.ReplyFreeQueueAddress.High = 0;
502 	init.ReplyFreeQueueAddress.Low = (uint32_t)sc->free_busaddr;
503 	init.TimeStamp.High = 0;
504 	init.TimeStamp.Low = (uint32_t)time_uptime;
505 
506 	error = mps_request_sync(sc, &init, &reply, req_sz, reply_sz, 5);
507 	if ((reply.IOCStatus & MPI2_IOCSTATUS_MASK) != MPI2_IOCSTATUS_SUCCESS)
508 		error = ENXIO;
509 
510 	mps_dprint(sc, MPS_INFO, "IOCInit status= 0x%x\n", reply.IOCStatus);
511 	return (error);
512 }
513 
514 static int
515 mps_send_portenable(struct mps_softc *sc)
516 {
517 	MPI2_PORT_ENABLE_REQUEST *request;
518 	struct mps_command *cm;
519 
520 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
521 
522 	if ((cm = mps_alloc_command(sc)) == NULL)
523 		return (EBUSY);
524 	request = (MPI2_PORT_ENABLE_REQUEST *)cm->cm_req;
525 	request->Function = MPI2_FUNCTION_PORT_ENABLE;
526 	request->MsgFlags = 0;
527 	request->VP_ID = 0;
528 	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
529 	cm->cm_complete = mps_startup_complete;
530 
531 	mps_enqueue_request(sc, cm);
532 	return (0);
533 }
534 
535 static int
536 mps_send_mur(struct mps_softc *sc)
537 {
538 
539 	/* Placeholder */
540 	return (0);
541 }
542 
543 void
544 mps_memaddr_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
545 {
546 	bus_addr_t *addr;
547 
548 	addr = arg;
549 	*addr = segs[0].ds_addr;
550 }
551 
552 static int
553 mps_alloc_queues(struct mps_softc *sc)
554 {
555 	bus_addr_t queues_busaddr;
556 	uint8_t *queues;
557 	int qsize, fqsize, pqsize;
558 
559 	/*
560 	 * The reply free queue contains 4 byte entries in multiples of 16 and
561 	 * aligned on a 16 byte boundary. There must always be an unused entry.
562 	 * This queue supplies fresh reply frames for the firmware to use.
563 	 *
564 	 * The reply descriptor post queue contains 8 byte entries in
565 	 * multiples of 16 and aligned on a 16 byte boundary.  This queue
566 	 * contains filled-in reply frames sent from the firmware to the host.
567 	 *
568 	 * These two queues are allocated together for simplicity.
569 	 */
570 	sc->fqdepth = roundup2((sc->num_replies + 1), 16);
571 	sc->pqdepth = roundup2((sc->num_replies + 1), 16);
572 	fqsize= sc->fqdepth * 4;
573 	pqsize = sc->pqdepth * 8;
574 	qsize = fqsize + pqsize;
575 
576         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
577 				16, 0,			/* algnmnt, boundary */
578 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
579 				BUS_SPACE_MAXADDR,	/* highaddr */
580 				NULL, NULL,		/* filter, filterarg */
581                                 qsize,			/* maxsize */
582                                 1,			/* nsegments */
583                                 qsize,			/* maxsegsize */
584                                 0,			/* flags */
585                                 NULL, NULL,		/* lockfunc, lockarg */
586                                 &sc->queues_dmat)) {
587 		device_printf(sc->mps_dev, "Cannot allocate queues DMA tag\n");
588 		return (ENOMEM);
589         }
590         if (bus_dmamem_alloc(sc->queues_dmat, (void **)&queues, BUS_DMA_NOWAIT,
591 	    &sc->queues_map)) {
592 		device_printf(sc->mps_dev, "Cannot allocate queues memory\n");
593 		return (ENOMEM);
594         }
595         bzero(queues, qsize);
596         bus_dmamap_load(sc->queues_dmat, sc->queues_map, queues, qsize,
597 	    mps_memaddr_cb, &queues_busaddr, 0);
598 
599 	sc->free_queue = (uint32_t *)queues;
600 	sc->free_busaddr = queues_busaddr;
601 	sc->post_queue = (MPI2_REPLY_DESCRIPTORS_UNION *)(queues + fqsize);
602 	sc->post_busaddr = queues_busaddr + fqsize;
603 
604 	return (0);
605 }
606 
607 static int
608 mps_alloc_replies(struct mps_softc *sc)
609 {
610 	int rsize;
611 
612 	rsize = sc->facts->ReplyFrameSize * sc->num_replies * 4;
613         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
614 				4, 0,			/* algnmnt, boundary */
615 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
616 				BUS_SPACE_MAXADDR,	/* highaddr */
617 				NULL, NULL,		/* filter, filterarg */
618                                 rsize,			/* maxsize */
619                                 1,			/* nsegments */
620                                 rsize,			/* maxsegsize */
621                                 0,			/* flags */
622                                 NULL, NULL,		/* lockfunc, lockarg */
623                                 &sc->reply_dmat)) {
624 		device_printf(sc->mps_dev, "Cannot allocate replies DMA tag\n");
625 		return (ENOMEM);
626         }
627         if (bus_dmamem_alloc(sc->reply_dmat, (void **)&sc->reply_frames,
628 	    BUS_DMA_NOWAIT, &sc->reply_map)) {
629 		device_printf(sc->mps_dev, "Cannot allocate replies memory\n");
630 		return (ENOMEM);
631         }
632         bzero(sc->reply_frames, rsize);
633         bus_dmamap_load(sc->reply_dmat, sc->reply_map, sc->reply_frames, rsize,
634 	    mps_memaddr_cb, &sc->reply_busaddr, 0);
635 
636 	return (0);
637 }
638 
639 static int
640 mps_alloc_requests(struct mps_softc *sc)
641 {
642 	struct mps_command *cm;
643 	struct mps_chain *chain;
644 	int i, rsize, nsegs;
645 
646 	rsize = sc->facts->IOCRequestFrameSize * sc->num_reqs * 4;
647         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
648 				16, 0,			/* algnmnt, boundary */
649 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
650 				BUS_SPACE_MAXADDR,	/* highaddr */
651 				NULL, NULL,		/* filter, filterarg */
652                                 rsize,			/* maxsize */
653                                 1,			/* nsegments */
654                                 rsize,			/* maxsegsize */
655                                 0,			/* flags */
656                                 NULL, NULL,		/* lockfunc, lockarg */
657                                 &sc->req_dmat)) {
658 		device_printf(sc->mps_dev, "Cannot allocate request DMA tag\n");
659 		return (ENOMEM);
660         }
661         if (bus_dmamem_alloc(sc->req_dmat, (void **)&sc->req_frames,
662 	    BUS_DMA_NOWAIT, &sc->req_map)) {
663 		device_printf(sc->mps_dev, "Cannot allocate request memory\n");
664 		return (ENOMEM);
665         }
666         bzero(sc->req_frames, rsize);
667         bus_dmamap_load(sc->req_dmat, sc->req_map, sc->req_frames, rsize,
668 	    mps_memaddr_cb, &sc->req_busaddr, 0);
669 
670 	rsize = sc->facts->IOCRequestFrameSize * MPS_CHAIN_FRAMES * 4;
671         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
672 				16, 0,			/* algnmnt, boundary */
673 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
674 				BUS_SPACE_MAXADDR,	/* highaddr */
675 				NULL, NULL,		/* filter, filterarg */
676                                 rsize,			/* maxsize */
677                                 1,			/* nsegments */
678                                 rsize,			/* maxsegsize */
679                                 0,			/* flags */
680                                 NULL, NULL,		/* lockfunc, lockarg */
681                                 &sc->chain_dmat)) {
682 		device_printf(sc->mps_dev, "Cannot allocate chain DMA tag\n");
683 		return (ENOMEM);
684         }
685         if (bus_dmamem_alloc(sc->chain_dmat, (void **)&sc->chain_frames,
686 	    BUS_DMA_NOWAIT, &sc->chain_map)) {
687 		device_printf(sc->mps_dev, "Cannot allocate chain memory\n");
688 		return (ENOMEM);
689         }
690         bzero(sc->chain_frames, rsize);
691         bus_dmamap_load(sc->chain_dmat, sc->chain_map, sc->chain_frames, rsize,
692 	    mps_memaddr_cb, &sc->chain_busaddr, 0);
693 
694 	rsize = MPS_SENSE_LEN * sc->num_reqs;
695         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
696 				1, 0,			/* algnmnt, boundary */
697 				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
698 				BUS_SPACE_MAXADDR,	/* highaddr */
699 				NULL, NULL,		/* filter, filterarg */
700                                 rsize,			/* maxsize */
701                                 1,			/* nsegments */
702                                 rsize,			/* maxsegsize */
703                                 0,			/* flags */
704                                 NULL, NULL,		/* lockfunc, lockarg */
705                                 &sc->sense_dmat)) {
706 		device_printf(sc->mps_dev, "Cannot allocate sense DMA tag\n");
707 		return (ENOMEM);
708         }
709         if (bus_dmamem_alloc(sc->sense_dmat, (void **)&sc->sense_frames,
710 	    BUS_DMA_NOWAIT, &sc->sense_map)) {
711 		device_printf(sc->mps_dev, "Cannot allocate sense memory\n");
712 		return (ENOMEM);
713         }
714         bzero(sc->sense_frames, rsize);
715         bus_dmamap_load(sc->sense_dmat, sc->sense_map, sc->sense_frames, rsize,
716 	    mps_memaddr_cb, &sc->sense_busaddr, 0);
717 
718 	sc->chains = malloc(sizeof(struct mps_chain) * MPS_CHAIN_FRAMES,
719 	    M_MPT2, M_WAITOK | M_ZERO);
720 	for (i = 0; i < MPS_CHAIN_FRAMES; i++) {
721 		chain = &sc->chains[i];
722 		chain->chain = (MPI2_SGE_IO_UNION *)(sc->chain_frames +
723 		    i * sc->facts->IOCRequestFrameSize * 4);
724 		chain->chain_busaddr = sc->chain_busaddr +
725 		    i * sc->facts->IOCRequestFrameSize * 4;
726 		mps_free_chain(sc, chain);
727 	}
728 
729 	/* XXX Need to pick a more precise value */
730 	nsegs = (MAXPHYS / PAGE_SIZE) + 1;
731         if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
732 				1, 0,			/* algnmnt, boundary */
733 				BUS_SPACE_MAXADDR,	/* lowaddr */
734 				BUS_SPACE_MAXADDR,	/* highaddr */
735 				NULL, NULL,		/* filter, filterarg */
736                                 BUS_SPACE_MAXSIZE_32BIT,/* maxsize */
737                                 nsegs,			/* nsegments */
738                                 BUS_SPACE_MAXSIZE_32BIT,/* maxsegsize */
739                                 BUS_DMA_ALLOCNOW,	/* flags */
740                                 busdma_lock_mutex,	/* lockfunc */
741 				&sc->mps_mtx,		/* lockarg */
742                                 &sc->buffer_dmat)) {
743 		device_printf(sc->mps_dev, "Cannot allocate sense DMA tag\n");
744 		return (ENOMEM);
745         }
746 
747 	/*
748 	 * SMID 0 cannot be used as a free command per the firmware spec.
749 	 * Just drop that command instead of risking accounting bugs.
750 	 */
751 	sc->commands = malloc(sizeof(struct mps_command) * sc->num_reqs,
752 	    M_MPT2, M_WAITOK | M_ZERO);
753 	for (i = 1; i < sc->num_reqs; i++) {
754 		cm = &sc->commands[i];
755 		cm->cm_req = sc->req_frames +
756 		    i * sc->facts->IOCRequestFrameSize * 4;
757 		cm->cm_req_busaddr = sc->req_busaddr +
758 		    i * sc->facts->IOCRequestFrameSize * 4;
759 		cm->cm_sense = &sc->sense_frames[i];
760 		cm->cm_sense_busaddr = sc->sense_busaddr + i * MPS_SENSE_LEN;
761 		cm->cm_desc.Default.SMID = i;
762 		cm->cm_sc = sc;
763 		TAILQ_INIT(&cm->cm_chain_list);
764 		callout_init(&cm->cm_callout, 1 /*MPSAFE*/);
765 
766 		/* XXX Is a failure here a critical problem? */
767 		if (bus_dmamap_create(sc->buffer_dmat, 0, &cm->cm_dmamap) == 0)
768 			mps_free_command(sc, cm);
769 		else {
770 			sc->num_reqs = i;
771 			break;
772 		}
773 	}
774 
775 	return (0);
776 }
777 
778 static int
779 mps_init_queues(struct mps_softc *sc)
780 {
781 	int i;
782 
783 	memset((uint8_t *)sc->post_queue, 0xff, sc->pqdepth * 8);
784 
785 	if (sc->num_replies >= sc->fqdepth)
786 		return (EINVAL);
787 
788 	for (i = 0; i < sc->num_replies; i++)
789 		sc->free_queue[i] = sc->reply_busaddr + i * sc->facts->ReplyFrameSize * 4;
790 	sc->replyfreeindex = sc->num_replies;
791 
792 	return (0);
793 }
794 
795 int
796 mps_attach(struct mps_softc *sc)
797 {
798 	int i, error;
799 	char tmpstr[80], tmpstr2[80];
800 
801 	/*
802 	 * Grab any tunable-set debug level so that tracing works as early
803 	 * as possible.
804 	 */
805 	snprintf(tmpstr, sizeof(tmpstr), "hw.mps.%d.debug_level",
806 	    device_get_unit(sc->mps_dev));
807 	TUNABLE_INT_FETCH(tmpstr, &sc->mps_debug);
808 	snprintf(tmpstr, sizeof(tmpstr), "hw.mps.%d.allow_multiple_tm_cmds",
809 	    device_get_unit(sc->mps_dev));
810 	TUNABLE_INT_FETCH(tmpstr, &sc->allow_multiple_tm_cmds);
811 
812 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
813 
814 	mtx_init(&sc->mps_mtx, "MPT2SAS lock", NULL, MTX_DEF);
815 	callout_init_mtx(&sc->periodic, &sc->mps_mtx, 0);
816 	TAILQ_INIT(&sc->event_list);
817 
818 	/*
819 	 * Setup the sysctl variable so the user can change the debug level
820 	 * on the fly.
821 	 */
822 	snprintf(tmpstr, sizeof(tmpstr), "MPS controller %d",
823 	    device_get_unit(sc->mps_dev));
824 	snprintf(tmpstr2, sizeof(tmpstr2), "%d", device_get_unit(sc->mps_dev));
825 
826 	sysctl_ctx_init(&sc->sysctl_ctx);
827 	sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
828 	    SYSCTL_STATIC_CHILDREN(_hw_mps), OID_AUTO, tmpstr2, CTLFLAG_RD,
829 	    0, tmpstr);
830 	if (sc->sysctl_tree == NULL)
831 		return (ENOMEM);
832 
833 	SYSCTL_ADD_INT(&sc->sysctl_ctx, SYSCTL_CHILDREN(sc->sysctl_tree),
834 	    OID_AUTO, "debug_level", CTLFLAG_RW, &sc->mps_debug, 0,
835 	    "mps debug level");
836 
837 	SYSCTL_ADD_INT(&sc->sysctl_ctx, SYSCTL_CHILDREN(sc->sysctl_tree),
838 	    OID_AUTO, "allow_multiple_tm_cmds", CTLFLAG_RW,
839 	    &sc->allow_multiple_tm_cmds, 0,
840 	    "allow multiple simultaneous task management cmds");
841 
842 	if ((error = mps_transition_ready(sc)) != 0)
843 		return (error);
844 
845 	sc->facts = malloc(sizeof(MPI2_IOC_FACTS_REPLY), M_MPT2,
846 	    M_ZERO|M_NOWAIT);
847 	if ((error = mps_get_iocfacts(sc, sc->facts)) != 0)
848 		return (error);
849 
850 	mps_print_iocfacts(sc, sc->facts);
851 
852 	mps_printf(sc, "Firmware: %02d.%02d.%02d.%02d\n",
853 	    sc->facts->FWVersion.Struct.Major,
854 	    sc->facts->FWVersion.Struct.Minor,
855 	    sc->facts->FWVersion.Struct.Unit,
856 	    sc->facts->FWVersion.Struct.Dev);
857 	mps_printf(sc, "IOCCapabilities: %b\n", sc->facts->IOCCapabilities,
858 	    "\20" "\3ScsiTaskFull" "\4DiagTrace" "\5SnapBuf" "\6ExtBuf"
859 	    "\7EEDP" "\10BiDirTarg" "\11Multicast" "\14TransRetry" "\15IR"
860 	    "\16EventReplay" "\17RaidAccel" "\20MSIXIndex" "\21HostDisc");
861 
862 	/*
863 	 * If the chip doesn't support event replay then a hard reset will be
864 	 * required to trigger a full discovery.  Do the reset here then
865 	 * retransition to Ready.  A hard reset might have already been done,
866 	 * but it doesn't hurt to do it again.
867 	 */
868 	if ((sc->facts->IOCCapabilities &
869 	    MPI2_IOCFACTS_CAPABILITY_EVENT_REPLAY) == 0) {
870 		mps_hard_reset(sc);
871 		if ((error = mps_transition_ready(sc)) != 0)
872 			return (error);
873 	}
874 
875 	/*
876 	 * Size the queues. Since the reply queues always need one free entry,
877 	 * we'll just deduct one reply message here.
878 	 */
879 	sc->num_reqs = MIN(MPS_REQ_FRAMES, sc->facts->RequestCredit);
880 	sc->num_replies = MIN(MPS_REPLY_FRAMES + MPS_EVT_REPLY_FRAMES,
881 	    sc->facts->MaxReplyDescriptorPostQueueDepth) - 1;
882 	TAILQ_INIT(&sc->req_list);
883 	TAILQ_INIT(&sc->chain_list);
884 	TAILQ_INIT(&sc->tm_list);
885 
886 	if (((error = mps_alloc_queues(sc)) != 0) ||
887 	    ((error = mps_alloc_replies(sc)) != 0) ||
888 	    ((error = mps_alloc_requests(sc)) != 0)) {
889 		mps_free(sc);
890 		return (error);
891 	}
892 
893 	if (((error = mps_init_queues(sc)) != 0) ||
894 	    ((error = mps_transition_operational(sc)) != 0)) {
895 		mps_free(sc);
896 		return (error);
897 	}
898 
899 	/*
900 	 * Finish the queue initialization.
901 	 * These are set here instead of in mps_init_queues() because the
902 	 * IOC resets these values during the state transition in
903 	 * mps_transition_operational().  The free index is set to 1
904 	 * because the corresponding index in the IOC is set to 0, and the
905 	 * IOC treats the queues as full if both are set to the same value.
906 	 * Hence the reason that the queue can't hold all of the possible
907 	 * replies.
908 	 */
909 	sc->replypostindex = 0;
910 	sc->replycurindex = 0;
911 	mps_regwrite(sc, MPI2_REPLY_FREE_HOST_INDEX_OFFSET, sc->replyfreeindex);
912 	mps_regwrite(sc, MPI2_REPLY_POST_HOST_INDEX_OFFSET, 0);
913 
914 	sc->pfacts = malloc(sizeof(MPI2_PORT_FACTS_REPLY) *
915 	    sc->facts->NumberOfPorts, M_MPT2, M_ZERO|M_WAITOK);
916 	for (i = 0; i < sc->facts->NumberOfPorts; i++) {
917 		if ((error = mps_get_portfacts(sc, &sc->pfacts[i], i)) != 0) {
918 			mps_free(sc);
919 			return (error);
920 		}
921 		mps_print_portfacts(sc, &sc->pfacts[i]);
922 	}
923 
924 	/* Attach the subsystems so they can prepare their event masks. */
925 	/* XXX Should be dynamic so that IM/IR and user modules can attach */
926 	if (((error = mps_attach_log(sc)) != 0) ||
927 	    ((error = mps_attach_sas(sc)) != 0) ||
928 	    ((error = mps_attach_user(sc)) != 0)) {
929 		mps_printf(sc, "%s failed to attach all subsystems: error %d\n",
930 		    __func__, error);
931 		mps_free(sc);
932 		return (error);
933 	}
934 
935 	if ((error = mps_pci_setup_interrupts(sc)) != 0) {
936 		mps_free(sc);
937 		return (error);
938 	}
939 
940 	/* Start the periodic watchdog check on the IOC Doorbell */
941 	mps_periodic(sc);
942 
943 	/*
944 	 * The portenable will kick off discovery events that will drive the
945 	 * rest of the initialization process.  The CAM/SAS module will
946 	 * hold up the boot sequence until discovery is complete.
947 	 */
948 	sc->mps_ich.ich_func = mps_startup;
949 	sc->mps_ich.ich_arg = sc;
950 	if (config_intrhook_establish(&sc->mps_ich) != 0) {
951 		mps_dprint(sc, MPS_FAULT, "Cannot establish MPS config hook\n");
952 		error = EINVAL;
953 	}
954 
955 	return (error);
956 }
957 
958 static void
959 mps_startup(void *arg)
960 {
961 	struct mps_softc *sc;
962 
963 	sc = (struct mps_softc *)arg;
964 
965 	mps_lock(sc);
966 	mps_unmask_intr(sc);
967 	mps_send_portenable(sc);
968 	mps_unlock(sc);
969 }
970 
971 /* Periodic watchdog.  Is called with the driver lock already held. */
972 static void
973 mps_periodic(void *arg)
974 {
975 	struct mps_softc *sc;
976 	uint32_t db;
977 
978 	sc = (struct mps_softc *)arg;
979 	if (sc->mps_flags & MPS_FLAGS_SHUTDOWN)
980 		return;
981 
982 	db = mps_regread(sc, MPI2_DOORBELL_OFFSET);
983 	if ((db & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) {
984 		device_printf(sc->mps_dev, "IOC Fault 0x%08x, Resetting\n", db);
985 		/* XXX Need to broaden this to re-initialize the chip */
986 		mps_hard_reset(sc);
987 		db = mps_regread(sc, MPI2_DOORBELL_OFFSET);
988 		if ((db & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) {
989 			device_printf(sc->mps_dev, "Second IOC Fault 0x%08x, "
990 			    "Giving up!\n", db);
991 			return;
992 		}
993 	}
994 
995 	callout_reset(&sc->periodic, MPS_PERIODIC_DELAY * hz, mps_periodic, sc);
996 }
997 
998 static void
999 mps_startup_complete(struct mps_softc *sc, struct mps_command *cm)
1000 {
1001 	MPI2_PORT_ENABLE_REPLY *reply;
1002 
1003 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
1004 
1005 	reply = (MPI2_PORT_ENABLE_REPLY *)cm->cm_reply;
1006 	if ((reply->IOCStatus & MPI2_IOCSTATUS_MASK) != MPI2_IOCSTATUS_SUCCESS)
1007 		mps_dprint(sc, MPS_FAULT, "Portenable failed\n");
1008 
1009 	mps_free_command(sc, cm);
1010 	config_intrhook_disestablish(&sc->mps_ich);
1011 
1012 }
1013 
1014 static void
1015 mps_log_evt_handler(struct mps_softc *sc, uintptr_t data,
1016     MPI2_EVENT_NOTIFICATION_REPLY *event)
1017 {
1018 	MPI2_EVENT_DATA_LOG_ENTRY_ADDED *entry;
1019 
1020 	mps_print_event(sc, event);
1021 
1022 	switch (event->Event) {
1023 	case MPI2_EVENT_LOG_DATA:
1024 		device_printf(sc->mps_dev, "MPI2_EVENT_LOG_DATA:\n");
1025 		hexdump(event->EventData, event->EventDataLength, NULL, 0);
1026 		break;
1027 	case MPI2_EVENT_LOG_ENTRY_ADDED:
1028 		entry = (MPI2_EVENT_DATA_LOG_ENTRY_ADDED *)event->EventData;
1029 		mps_dprint(sc, MPS_INFO, "MPI2_EVENT_LOG_ENTRY_ADDED event "
1030 		    "0x%x Sequence %d:\n", entry->LogEntryQualifier,
1031 		     entry->LogSequence);
1032 		break;
1033 	default:
1034 		break;
1035 	}
1036 	return;
1037 }
1038 
1039 static int
1040 mps_attach_log(struct mps_softc *sc)
1041 {
1042 	uint8_t events[16];
1043 
1044 	bzero(events, 16);
1045 	setbit(events, MPI2_EVENT_LOG_DATA);
1046 	setbit(events, MPI2_EVENT_LOG_ENTRY_ADDED);
1047 
1048 	mps_register_events(sc, events, mps_log_evt_handler, NULL,
1049 	    &sc->mps_log_eh);
1050 
1051 	return (0);
1052 }
1053 
1054 static int
1055 mps_detach_log(struct mps_softc *sc)
1056 {
1057 
1058 	if (sc->mps_log_eh != NULL)
1059 		mps_deregister_events(sc, sc->mps_log_eh);
1060 	return (0);
1061 }
1062 
1063 /*
1064  * Free all of the driver resources and detach submodules.  Should be called
1065  * without the lock held.
1066  */
1067 int
1068 mps_free(struct mps_softc *sc)
1069 {
1070 	struct mps_command *cm;
1071 	int i, error;
1072 
1073 	/* Turn off the watchdog */
1074 	mps_lock(sc);
1075 	sc->mps_flags |= MPS_FLAGS_SHUTDOWN;
1076 	mps_unlock(sc);
1077 	/* Lock must not be held for this */
1078 	callout_drain(&sc->periodic);
1079 
1080 	if (((error = mps_detach_log(sc)) != 0) ||
1081 	    ((error = mps_detach_sas(sc)) != 0))
1082 		return (error);
1083 
1084 	/* Put the IOC back in the READY state. */
1085 	mps_lock(sc);
1086 	if ((error = mps_send_mur(sc)) != 0) {
1087 		mps_unlock(sc);
1088 		return (error);
1089 	}
1090 	mps_unlock(sc);
1091 
1092 	if (sc->facts != NULL)
1093 		free(sc->facts, M_MPT2);
1094 
1095 	if (sc->pfacts != NULL)
1096 		free(sc->pfacts, M_MPT2);
1097 
1098 	if (sc->post_busaddr != 0)
1099 		bus_dmamap_unload(sc->queues_dmat, sc->queues_map);
1100 	if (sc->post_queue != NULL)
1101 		bus_dmamem_free(sc->queues_dmat, sc->post_queue,
1102 		    sc->queues_map);
1103 	if (sc->queues_dmat != NULL)
1104 		bus_dma_tag_destroy(sc->queues_dmat);
1105 
1106 	if (sc->chain_busaddr != 0)
1107 		bus_dmamap_unload(sc->chain_dmat, sc->chain_map);
1108 	if (sc->chain_frames != NULL)
1109 		bus_dmamem_free(sc->chain_dmat, sc->chain_frames,sc->chain_map);
1110 	if (sc->chain_dmat != NULL)
1111 		bus_dma_tag_destroy(sc->chain_dmat);
1112 
1113 	if (sc->sense_busaddr != 0)
1114 		bus_dmamap_unload(sc->sense_dmat, sc->sense_map);
1115 	if (sc->sense_frames != NULL)
1116 		bus_dmamem_free(sc->sense_dmat, sc->sense_frames,sc->sense_map);
1117 	if (sc->sense_dmat != NULL)
1118 		bus_dma_tag_destroy(sc->sense_dmat);
1119 
1120 	if (sc->reply_busaddr != 0)
1121 		bus_dmamap_unload(sc->reply_dmat, sc->reply_map);
1122 	if (sc->reply_frames != NULL)
1123 		bus_dmamem_free(sc->reply_dmat, sc->reply_frames,sc->reply_map);
1124 	if (sc->reply_dmat != NULL)
1125 		bus_dma_tag_destroy(sc->reply_dmat);
1126 
1127 	if (sc->req_busaddr != 0)
1128 		bus_dmamap_unload(sc->req_dmat, sc->req_map);
1129 	if (sc->req_frames != NULL)
1130 		bus_dmamem_free(sc->req_dmat, sc->req_frames, sc->req_map);
1131 	if (sc->req_dmat != NULL)
1132 		bus_dma_tag_destroy(sc->req_dmat);
1133 
1134 	if (sc->chains != NULL)
1135 		free(sc->chains, M_MPT2);
1136 	if (sc->commands != NULL) {
1137 		for (i = 1; i < sc->num_reqs; i++) {
1138 			cm = &sc->commands[i];
1139 			bus_dmamap_destroy(sc->buffer_dmat, cm->cm_dmamap);
1140 		}
1141 		free(sc->commands, M_MPT2);
1142 	}
1143 	if (sc->buffer_dmat != NULL)
1144 		bus_dma_tag_destroy(sc->buffer_dmat);
1145 
1146 	if (sc->sysctl_tree != NULL)
1147 		sysctl_ctx_free(&sc->sysctl_ctx);
1148 
1149 	mtx_destroy(&sc->mps_mtx);
1150 
1151 	return (0);
1152 }
1153 
1154 void
1155 mps_intr(void *data)
1156 {
1157 	struct mps_softc *sc;
1158 	uint32_t status;
1159 
1160 	sc = (struct mps_softc *)data;
1161 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
1162 
1163 	/*
1164 	 * Check interrupt status register to flush the bus.  This is
1165 	 * needed for both INTx interrupts and driver-driven polling
1166 	 */
1167 	status = mps_regread(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET);
1168 	if ((status & MPI2_HIS_REPLY_DESCRIPTOR_INTERRUPT) == 0)
1169 		return;
1170 
1171 	mps_lock(sc);
1172 	mps_intr_locked(data);
1173 	mps_unlock(sc);
1174 	return;
1175 }
1176 
1177 /*
1178  * In theory, MSI/MSIX interrupts shouldn't need to read any registers on the
1179  * chip.  Hopefully this theory is correct.
1180  */
1181 void
1182 mps_intr_msi(void *data)
1183 {
1184 	struct mps_softc *sc;
1185 
1186 	sc = (struct mps_softc *)data;
1187 	mps_lock(sc);
1188 	mps_intr_locked(data);
1189 	mps_unlock(sc);
1190 	return;
1191 }
1192 
1193 /*
1194  * The locking is overly broad and simplistic, but easy to deal with for now.
1195  */
1196 void
1197 mps_intr_locked(void *data)
1198 {
1199 	MPI2_REPLY_DESCRIPTORS_UNION *desc;
1200 	struct mps_softc *sc;
1201 	struct mps_command *cm = NULL;
1202 	uint8_t flags;
1203 	u_int pq;
1204 
1205 	sc = (struct mps_softc *)data;
1206 
1207 	pq = sc->replypostindex;
1208 
1209 	for ( ;; ) {
1210 		cm = NULL;
1211 		desc = &sc->post_queue[pq];
1212 		flags = desc->Default.ReplyFlags &
1213 		    MPI2_RPY_DESCRIPT_FLAGS_TYPE_MASK;
1214 		if (flags == MPI2_RPY_DESCRIPT_FLAGS_UNUSED)
1215 			break;
1216 
1217 		switch (flags) {
1218 		case MPI2_RPY_DESCRIPT_FLAGS_SCSI_IO_SUCCESS:
1219 			cm = &sc->commands[desc->SCSIIOSuccess.SMID];
1220 			cm->cm_reply = NULL;
1221 			break;
1222 		case MPI2_RPY_DESCRIPT_FLAGS_ADDRESS_REPLY:
1223 		{
1224 			uint32_t baddr;
1225 			uint8_t *reply;
1226 
1227 			reply = sc->reply_frames +
1228 			    sc->replycurindex * sc->facts->ReplyFrameSize * 4;
1229 			baddr = desc->AddressReply.ReplyFrameAddress;
1230 			if (desc->AddressReply.SMID == 0) {
1231 				mps_dispatch_event(sc, baddr,
1232 				   (MPI2_EVENT_NOTIFICATION_REPLY *) reply);
1233 			} else {
1234 				cm = &sc->commands[desc->AddressReply.SMID];
1235 				cm->cm_reply = reply;
1236 				cm->cm_reply_data =
1237 				    desc->AddressReply.ReplyFrameAddress;
1238 			}
1239 			if (++sc->replycurindex >= sc->fqdepth)
1240 				sc->replycurindex = 0;
1241 			break;
1242 		}
1243 		case MPI2_RPY_DESCRIPT_FLAGS_TARGETASSIST_SUCCESS:
1244 		case MPI2_RPY_DESCRIPT_FLAGS_TARGET_COMMAND_BUFFER:
1245 		case MPI2_RPY_DESCRIPT_FLAGS_RAID_ACCELERATOR_SUCCESS:
1246 		default:
1247 			/* Unhandled */
1248 			device_printf(sc->mps_dev, "Unhandled reply 0x%x\n",
1249 			    desc->Default.ReplyFlags);
1250 			cm = NULL;
1251 			break;
1252 		}
1253 
1254 		if (cm != NULL) {
1255 			if (cm->cm_flags & MPS_CM_FLAGS_POLLED)
1256 				cm->cm_flags |= MPS_CM_FLAGS_COMPLETE;
1257 
1258 			if (cm->cm_complete != NULL)
1259 				cm->cm_complete(sc, cm);
1260 
1261 			if (cm->cm_flags & MPS_CM_FLAGS_WAKEUP)
1262 				wakeup(cm);
1263 		}
1264 
1265 		desc->Words.Low = 0xffffffff;
1266 		desc->Words.High = 0xffffffff;
1267 		if (++pq >= sc->pqdepth)
1268 			pq = 0;
1269 	}
1270 
1271 	if (pq != sc->replypostindex) {
1272 		mps_dprint(sc, MPS_INFO, "writing postindex %d\n", pq);
1273 		mps_regwrite(sc, MPI2_REPLY_POST_HOST_INDEX_OFFSET, pq);
1274 		sc->replypostindex = pq;
1275 	}
1276 
1277 	return;
1278 }
1279 
1280 static void
1281 mps_dispatch_event(struct mps_softc *sc, uintptr_t data,
1282     MPI2_EVENT_NOTIFICATION_REPLY *reply)
1283 {
1284 	struct mps_event_handle *eh;
1285 	int event, handled = 0;;
1286 
1287 	event = reply->Event;
1288 	TAILQ_FOREACH(eh, &sc->event_list, eh_list) {
1289 		if (isset(eh->mask, event)) {
1290 			eh->callback(sc, data, reply);
1291 			handled++;
1292 		}
1293 	}
1294 
1295 	if (handled == 0)
1296 		device_printf(sc->mps_dev, "Unhandled event 0x%x\n", event);
1297 }
1298 
1299 /*
1300  * For both register_events and update_events, the caller supplies a bitmap
1301  * of events that it _wants_.  These functions then turn that into a bitmask
1302  * suitable for the controller.
1303  */
1304 int
1305 mps_register_events(struct mps_softc *sc, uint8_t *mask,
1306     mps_evt_callback_t *cb, void *data, struct mps_event_handle **handle)
1307 {
1308 	struct mps_event_handle *eh;
1309 	int error = 0;
1310 
1311 	eh = malloc(sizeof(struct mps_event_handle), M_MPT2, M_WAITOK|M_ZERO);
1312 	eh->callback = cb;
1313 	eh->data = data;
1314 	TAILQ_INSERT_TAIL(&sc->event_list, eh, eh_list);
1315 	if (mask != NULL)
1316 		error = mps_update_events(sc, eh, mask);
1317 	*handle = eh;
1318 
1319 	return (error);
1320 }
1321 
1322 int
1323 mps_update_events(struct mps_softc *sc, struct mps_event_handle *handle,
1324     uint8_t *mask)
1325 {
1326 	MPI2_EVENT_NOTIFICATION_REQUEST *evtreq;
1327 	MPI2_EVENT_NOTIFICATION_REPLY *reply;
1328 	struct mps_command *cm;
1329 	struct mps_event_handle *eh;
1330 	int error, i;
1331 
1332 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
1333 
1334 	if ((mask != NULL) && (handle != NULL))
1335 		bcopy(mask, &handle->mask[0], 16);
1336 	memset(sc->event_mask, 0xff, 16);
1337 
1338 	TAILQ_FOREACH(eh, &sc->event_list, eh_list) {
1339 		for (i = 0; i < 16; i++)
1340 			sc->event_mask[i] &= ~eh->mask[i];
1341 	}
1342 
1343 	if ((cm = mps_alloc_command(sc)) == NULL)
1344 		return (EBUSY);
1345 	evtreq = (MPI2_EVENT_NOTIFICATION_REQUEST *)cm->cm_req;
1346 	evtreq->Function = MPI2_FUNCTION_EVENT_NOTIFICATION;
1347 	evtreq->MsgFlags = 0;
1348 	evtreq->SASBroadcastPrimitiveMasks = 0;
1349 #ifdef MPS_DEBUG_ALL_EVENTS
1350 	{
1351 		u_char fullmask[16];
1352 		memset(fullmask, 0x00, 16);
1353 		bcopy(fullmask, (uint8_t *)&evtreq->EventMasks, 16);
1354 	}
1355 #else
1356 		bcopy(sc->event_mask, (uint8_t *)&evtreq->EventMasks, 16);
1357 #endif
1358 	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
1359 	cm->cm_data = NULL;
1360 
1361 	error = mps_request_polled(sc, cm);
1362 	reply = (MPI2_EVENT_NOTIFICATION_REPLY *)cm->cm_reply;
1363 	if ((reply->IOCStatus & MPI2_IOCSTATUS_MASK) != MPI2_IOCSTATUS_SUCCESS)
1364 		error = ENXIO;
1365 	mps_print_event(sc, reply);
1366 
1367 	mps_free_command(sc, cm);
1368 	return (error);
1369 }
1370 
1371 int
1372 mps_deregister_events(struct mps_softc *sc, struct mps_event_handle *handle)
1373 {
1374 
1375 	TAILQ_REMOVE(&sc->event_list, handle, eh_list);
1376 	free(handle, M_MPT2);
1377 	return (mps_update_events(sc, NULL, NULL));
1378 }
1379 
1380 /*
1381  * Add a chain element as the next SGE for the specified command.
1382  * Reset cm_sge and cm_sgesize to indicate all the available space.
1383  */
1384 static int
1385 mps_add_chain(struct mps_command *cm)
1386 {
1387 	MPI2_SGE_CHAIN32 *sgc;
1388 	struct mps_chain *chain;
1389 	int space;
1390 
1391 	if (cm->cm_sglsize < MPS_SGC_SIZE)
1392 		panic("MPS: Need SGE Error Code\n");
1393 
1394 	chain = mps_alloc_chain(cm->cm_sc);
1395 	if (chain == NULL)
1396 		return (ENOBUFS);
1397 
1398 	space = (int)cm->cm_sc->facts->IOCRequestFrameSize * 4;
1399 
1400 	/*
1401 	 * Note: a double-linked list is used to make it easier to
1402 	 * walk for debugging.
1403 	 */
1404 	TAILQ_INSERT_TAIL(&cm->cm_chain_list, chain, chain_link);
1405 
1406 	sgc = (MPI2_SGE_CHAIN32 *)&cm->cm_sge->MpiChain;
1407 	sgc->Length = space;
1408 	sgc->NextChainOffset = 0;
1409 	sgc->Flags = MPI2_SGE_FLAGS_CHAIN_ELEMENT;
1410 	sgc->Address = chain->chain_busaddr;
1411 
1412 	cm->cm_sge = (MPI2_SGE_IO_UNION *)&chain->chain->MpiSimple;
1413 	cm->cm_sglsize = space;
1414 	return (0);
1415 }
1416 
1417 /*
1418  * Add one scatter-gather element (chain, simple, transaction context)
1419  * to the scatter-gather list for a command.  Maintain cm_sglsize and
1420  * cm_sge as the remaining size and pointer to the next SGE to fill
1421  * in, respectively.
1422  */
1423 int
1424 mps_push_sge(struct mps_command *cm, void *sgep, size_t len, int segsleft)
1425 {
1426 	MPI2_SGE_TRANSACTION_UNION *tc = sgep;
1427 	MPI2_SGE_SIMPLE64 *sge = sgep;
1428 	int error, type;
1429 
1430 	type = (tc->Flags & MPI2_SGE_FLAGS_ELEMENT_MASK);
1431 
1432 #ifdef INVARIANTS
1433 	switch (type) {
1434 	case MPI2_SGE_FLAGS_TRANSACTION_ELEMENT: {
1435 		if (len != tc->DetailsLength + 4)
1436 			panic("TC %p length %u or %zu?", tc,
1437 			    tc->DetailsLength + 4, len);
1438 		}
1439 		break;
1440 	case MPI2_SGE_FLAGS_CHAIN_ELEMENT:
1441 		/* Driver only uses 32-bit chain elements */
1442 		if (len != MPS_SGC_SIZE)
1443 			panic("CHAIN %p length %u or %zu?", sgep,
1444 			    MPS_SGC_SIZE, len);
1445 		break;
1446 	case MPI2_SGE_FLAGS_SIMPLE_ELEMENT:
1447 		/* Driver only uses 64-bit SGE simple elements */
1448 		sge = sgep;
1449 		if (len != MPS_SGE64_SIZE)
1450 			panic("SGE simple %p length %u or %zu?", sge,
1451 			    MPS_SGE64_SIZE, len);
1452 		if (((sge->FlagsLength >> MPI2_SGE_FLAGS_SHIFT) &
1453 		    MPI2_SGE_FLAGS_ADDRESS_SIZE) == 0)
1454 			panic("SGE simple %p flags %02x not marked 64-bit?",
1455 			    sge, sge->FlagsLength >> MPI2_SGE_FLAGS_SHIFT);
1456 
1457 		break;
1458 	default:
1459 		panic("Unexpected SGE %p, flags %02x", tc, tc->Flags);
1460 	}
1461 #endif
1462 
1463 	/*
1464 	 * case 1: 1 more segment, enough room for it
1465 	 * case 2: 2 more segments, enough room for both
1466 	 * case 3: >=2 more segments, only enough room for 1 and a chain
1467 	 * case 4: >=1 more segment, enough room for only a chain
1468 	 * case 5: >=1 more segment, no room for anything (error)
1469          */
1470 
1471 	/*
1472 	 * There should be room for at least a chain element, or this
1473 	 * code is buggy.  Case (5).
1474 	 */
1475 	if (cm->cm_sglsize < MPS_SGC_SIZE)
1476 		panic("MPS: Need SGE Error Code\n");
1477 
1478 	if (segsleft >= 2 &&
1479 	    cm->cm_sglsize < len + MPS_SGC_SIZE + MPS_SGE64_SIZE) {
1480 		/*
1481 		 * There are 2 or more segments left to add, and only
1482 		 * enough room for 1 and a chain.  Case (3).
1483 		 *
1484 		 * Mark as last element in this chain if necessary.
1485 		 */
1486 		if (type == MPI2_SGE_FLAGS_SIMPLE_ELEMENT) {
1487 			sge->FlagsLength |=
1488 				(MPI2_SGE_FLAGS_LAST_ELEMENT << MPI2_SGE_FLAGS_SHIFT);
1489 		}
1490 
1491 		/*
1492 		 * Add the item then a chain.  Do the chain now,
1493 		 * rather than on the next iteration, to simplify
1494 		 * understanding the code.
1495 		 */
1496 		cm->cm_sglsize -= len;
1497 		bcopy(sgep, cm->cm_sge, len);
1498 		cm->cm_sge = (MPI2_SGE_IO_UNION *)((uintptr_t)cm->cm_sge + len);
1499 		return (mps_add_chain(cm));
1500 	}
1501 
1502 	if (segsleft >= 1 && cm->cm_sglsize < len + MPS_SGC_SIZE) {
1503 		/*
1504 		 * 1 or more segment, enough room for only a chain.
1505 		 * Hope the previous element wasn't a Simple entry
1506 		 * that needed to be marked with
1507 		 * MPI2_SGE_FLAGS_LAST_ELEMENT.  Case (4).
1508 		 */
1509 		if ((error = mps_add_chain(cm)) != 0)
1510 			return (error);
1511 	}
1512 
1513 #ifdef INVARIANTS
1514 	/* Case 1: 1 more segment, enough room for it. */
1515 	if (segsleft == 1 && cm->cm_sglsize < len)
1516 		panic("1 seg left and no room? %u versus %zu",
1517 		    cm->cm_sglsize, len);
1518 
1519 	/* Case 2: 2 more segments, enough room for both */
1520 	if (segsleft == 2 && cm->cm_sglsize < len + MPS_SGE64_SIZE)
1521 		panic("2 segs left and no room? %u versus %zu",
1522 		    cm->cm_sglsize, len);
1523 #endif
1524 
1525 	if (segsleft == 1 && type == MPI2_SGE_FLAGS_SIMPLE_ELEMENT) {
1526 		/*
1527 		 * Last element of the last segment of the entire
1528 		 * buffer.
1529 		 */
1530 		sge->FlagsLength |= ((MPI2_SGE_FLAGS_LAST_ELEMENT |
1531 		    MPI2_SGE_FLAGS_END_OF_BUFFER |
1532 		    MPI2_SGE_FLAGS_END_OF_LIST) << MPI2_SGE_FLAGS_SHIFT);
1533 	}
1534 
1535 	cm->cm_sglsize -= len;
1536 	bcopy(sgep, cm->cm_sge, len);
1537 	cm->cm_sge = (MPI2_SGE_IO_UNION *)((uintptr_t)cm->cm_sge + len);
1538 	return (0);
1539 }
1540 
1541 /*
1542  * Add one dma segment to the scatter-gather list for a command.
1543  */
1544 int
1545 mps_add_dmaseg(struct mps_command *cm, vm_paddr_t pa, size_t len, u_int flags,
1546     int segsleft)
1547 {
1548 	MPI2_SGE_SIMPLE64 sge;
1549 
1550 	/*
1551 	 * This driver always uses 64-bit address elements for
1552 	 * simplicity.
1553 	 */
1554 	flags |= MPI2_SGE_FLAGS_SIMPLE_ELEMENT | MPI2_SGE_FLAGS_ADDRESS_SIZE;
1555 	sge.FlagsLength = len | (flags << MPI2_SGE_FLAGS_SHIFT);
1556 	mps_from_u64(pa, &sge.Address);
1557 
1558 	return (mps_push_sge(cm, &sge, sizeof sge, segsleft));
1559 }
1560 
1561 static void
1562 mps_data_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1563 {
1564 	struct mps_softc *sc;
1565 	struct mps_command *cm;
1566 	u_int i, dir, sflags;
1567 
1568 	cm = (struct mps_command *)arg;
1569 	sc = cm->cm_sc;
1570 
1571 	/*
1572 	 * Set up DMA direction flags.  Note no support for
1573 	 * bi-directional transactions.
1574 	 */
1575 	sflags = 0;
1576 	if (cm->cm_flags & MPS_CM_FLAGS_DATAOUT) {
1577 		sflags |= MPI2_SGE_FLAGS_DIRECTION;
1578 		dir = BUS_DMASYNC_PREWRITE;
1579 	} else
1580 		dir = BUS_DMASYNC_PREREAD;
1581 
1582 	for (i = 0; i < nsegs; i++) {
1583 		error = mps_add_dmaseg(cm, segs[i].ds_addr, segs[i].ds_len,
1584 		    sflags, nsegs - i);
1585 		if (error != 0) {
1586 			/* Resource shortage, roll back! */
1587 			mps_printf(sc, "out of chain frames\n");
1588 			return;
1589 		}
1590 	}
1591 
1592 	bus_dmamap_sync(sc->buffer_dmat, cm->cm_dmamap, dir);
1593 	mps_enqueue_request(sc, cm);
1594 
1595 	return;
1596 }
1597 
1598 /*
1599  * Note that the only error path here is from bus_dmamap_load(), which can
1600  * return EINPROGRESS if it is waiting for resources.
1601  */
1602 int
1603 mps_map_command(struct mps_softc *sc, struct mps_command *cm)
1604 {
1605 	MPI2_SGE_SIMPLE32 *sge;
1606 	int error = 0;
1607 
1608 	if ((cm->cm_data != NULL) && (cm->cm_length != 0)) {
1609 		error = bus_dmamap_load(sc->buffer_dmat, cm->cm_dmamap,
1610 		    cm->cm_data, cm->cm_length, mps_data_cb, cm, 0);
1611 	} else {
1612 		/* Add a zero-length element as needed */
1613 		if (cm->cm_sge != NULL) {
1614 			sge = (MPI2_SGE_SIMPLE32 *)cm->cm_sge;
1615 			sge->FlagsLength = (MPI2_SGE_FLAGS_LAST_ELEMENT |
1616 			    MPI2_SGE_FLAGS_END_OF_BUFFER |
1617 			    MPI2_SGE_FLAGS_END_OF_LIST |
1618 			    MPI2_SGE_FLAGS_SIMPLE_ELEMENT) <<
1619 			    MPI2_SGE_FLAGS_SHIFT;
1620 			sge->Address = 0;
1621 		}
1622 		mps_enqueue_request(sc, cm);
1623 	}
1624 
1625 	return (error);
1626 }
1627 
1628 /*
1629  * The MPT driver had a verbose interface for config pages.  In this driver,
1630  * reduce it to much simplier terms, similar to the Linux driver.
1631  */
1632 int
1633 mps_read_config_page(struct mps_softc *sc, struct mps_config_params *params)
1634 {
1635 	MPI2_CONFIG_REQUEST *req;
1636 	struct mps_command *cm;
1637 	int error;
1638 
1639 	if (sc->mps_flags & MPS_FLAGS_BUSY) {
1640 		return (EBUSY);
1641 	}
1642 
1643 	cm = mps_alloc_command(sc);
1644 	if (cm == NULL) {
1645 		return (EBUSY);
1646 	}
1647 
1648 	req = (MPI2_CONFIG_REQUEST *)cm->cm_req;
1649 	req->Function = MPI2_FUNCTION_CONFIG;
1650 	req->Action = params->action;
1651 	req->SGLFlags = 0;
1652 	req->ChainOffset = 0;
1653 	req->PageAddress = params->page_address;
1654 	if (params->hdr.Ext.ExtPageType != 0) {
1655 		MPI2_CONFIG_EXTENDED_PAGE_HEADER *hdr;
1656 
1657 		hdr = &params->hdr.Ext;
1658 		req->ExtPageType = hdr->ExtPageType;
1659 		req->ExtPageLength = hdr->ExtPageLength;
1660 		req->Header.PageType = MPI2_CONFIG_PAGETYPE_EXTENDED;
1661 		req->Header.PageLength = 0; /* Must be set to zero */
1662 		req->Header.PageNumber = hdr->PageNumber;
1663 		req->Header.PageVersion = hdr->PageVersion;
1664 	} else {
1665 		MPI2_CONFIG_PAGE_HEADER *hdr;
1666 
1667 		hdr = &params->hdr.Struct;
1668 		req->Header.PageType = hdr->PageType;
1669 		req->Header.PageNumber = hdr->PageNumber;
1670 		req->Header.PageLength = hdr->PageLength;
1671 		req->Header.PageVersion = hdr->PageVersion;
1672 	}
1673 
1674 	cm->cm_data = params->buffer;
1675 	cm->cm_length = params->length;
1676 	cm->cm_sge = &req->PageBufferSGE;
1677 	cm->cm_sglsize = sizeof(MPI2_SGE_IO_UNION);
1678 	cm->cm_flags = MPS_CM_FLAGS_SGE_SIMPLE | MPS_CM_FLAGS_DATAIN;
1679 	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
1680 
1681 	cm->cm_complete_data = params;
1682 	if (params->callback != NULL) {
1683 		cm->cm_complete = mps_config_complete;
1684 		return (mps_map_command(sc, cm));
1685 	} else {
1686 		cm->cm_complete = NULL;
1687 		cm->cm_flags |= MPS_CM_FLAGS_WAKEUP;
1688 		if ((error = mps_map_command(sc, cm)) != 0)
1689 			return (error);
1690 		msleep(cm, &sc->mps_mtx, 0, "mpswait", 0);
1691 		mps_config_complete(sc, cm);
1692 	}
1693 
1694 	return (0);
1695 }
1696 
1697 int
1698 mps_write_config_page(struct mps_softc *sc, struct mps_config_params *params)
1699 {
1700 	return (EINVAL);
1701 }
1702 
1703 static void
1704 mps_config_complete(struct mps_softc *sc, struct mps_command *cm)
1705 {
1706 	MPI2_CONFIG_REPLY *reply;
1707 	struct mps_config_params *params;
1708 
1709 	params = cm->cm_complete_data;
1710 
1711 	if (cm->cm_data != NULL) {
1712 		bus_dmamap_sync(sc->buffer_dmat, cm->cm_dmamap,
1713 		    BUS_DMASYNC_POSTREAD);
1714 		bus_dmamap_unload(sc->buffer_dmat, cm->cm_dmamap);
1715 	}
1716 
1717 	reply = (MPI2_CONFIG_REPLY *)cm->cm_reply;
1718 	params->status = reply->IOCStatus;
1719 	if (params->hdr.Ext.ExtPageType != 0) {
1720 		params->hdr.Ext.ExtPageType = reply->ExtPageType;
1721 		params->hdr.Ext.ExtPageLength = reply->ExtPageLength;
1722 	} else {
1723 		params->hdr.Struct.PageType = reply->Header.PageType;
1724 		params->hdr.Struct.PageNumber = reply->Header.PageNumber;
1725 		params->hdr.Struct.PageLength = reply->Header.PageLength;
1726 		params->hdr.Struct.PageVersion = reply->Header.PageVersion;
1727 	}
1728 
1729 	mps_free_command(sc, cm);
1730 	if (params->callback != NULL)
1731 		params->callback(sc, params);
1732 
1733 	return;
1734 }
1735