1/*-
2 * Copyright (c) 2009 Yahoo! Inc.
3 * Copyright (c) 2011-2015 LSI Corp.
4 * Copyright (c) 2013-2015 Avago Technologies
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 *
28 * Avago Technologies (LSI) MPT-Fusion Host Adapter FreeBSD
29 *
30 * $FreeBSD: stable/11/sys/dev/mps/mps.c 329189 2018-02-13 02:11:39Z mav $
31 */
32
33#include <sys/cdefs.h>
34__FBSDID("$FreeBSD: stable/11/sys/dev/mps/mps.c 329189 2018-02-13 02:11:39Z mav $");
35
36/* Communications core for Avago Technologies (LSI) MPT2 */
37
38/* TODO Move headers to mpsvar */
39#include <sys/types.h>
40#include <sys/param.h>
41#include <sys/systm.h>
42#include <sys/kernel.h>
43#include <sys/selinfo.h>
44#include <sys/lock.h>
45#include <sys/mutex.h>
46#include <sys/module.h>
47#include <sys/bus.h>
48#include <sys/conf.h>
49#include <sys/bio.h>
50#include <sys/malloc.h>
51#include <sys/uio.h>
52#include <sys/sysctl.h>
53#include <sys/queue.h>
54#include <sys/kthread.h>
55#include <sys/taskqueue.h>
56#include <sys/endian.h>
57#include <sys/eventhandler.h>
58
59#include <machine/bus.h>
60#include <machine/resource.h>
61#include <sys/rman.h>
62#include <sys/proc.h>
63
64#include <dev/pci/pcivar.h>
65
66#include <cam/cam.h>
67#include <cam/scsi/scsi_all.h>
68
69#include <dev/mps/mpi/mpi2_type.h>
70#include <dev/mps/mpi/mpi2.h>
71#include <dev/mps/mpi/mpi2_ioc.h>
72#include <dev/mps/mpi/mpi2_sas.h>
73#include <dev/mps/mpi/mpi2_cnfg.h>
74#include <dev/mps/mpi/mpi2_init.h>
75#include <dev/mps/mpi/mpi2_tool.h>
76#include <dev/mps/mps_ioctl.h>
77#include <dev/mps/mpsvar.h>
78#include <dev/mps/mps_table.h>
79
80static int mps_diag_reset(struct mps_softc *sc, int sleep_flag);
81static int mps_init_queues(struct mps_softc *sc);
82static int mps_message_unit_reset(struct mps_softc *sc, int sleep_flag);
83static int mps_transition_operational(struct mps_softc *sc);
84static int mps_iocfacts_allocate(struct mps_softc *sc, uint8_t attaching);
85static void mps_iocfacts_free(struct mps_softc *sc);
86static void mps_startup(void *arg);
87static int mps_send_iocinit(struct mps_softc *sc);
88static int mps_alloc_queues(struct mps_softc *sc);
89static int mps_alloc_replies(struct mps_softc *sc);
90static int mps_alloc_requests(struct mps_softc *sc);
91static int mps_attach_log(struct mps_softc *sc);
92static __inline void mps_complete_command(struct mps_softc *sc,
93    struct mps_command *cm);
94static void mps_dispatch_event(struct mps_softc *sc, uintptr_t data,
95    MPI2_EVENT_NOTIFICATION_REPLY *reply);
96static void mps_config_complete(struct mps_softc *sc, struct mps_command *cm);
97static void mps_periodic(void *);
98static int mps_reregister_events(struct mps_softc *sc);
99static void mps_enqueue_request(struct mps_softc *sc, struct mps_command *cm);
100static int mps_get_iocfacts(struct mps_softc *sc, MPI2_IOC_FACTS_REPLY *facts);
101static int mps_wait_db_ack(struct mps_softc *sc, int timeout, int sleep_flag);
102SYSCTL_NODE(_hw, OID_AUTO, mps, CTLFLAG_RD, 0, "MPS Driver Parameters");
103
104MALLOC_DEFINE(M_MPT2, "mps", "mpt2 driver memory");
105
106/*
107 * Do a "Diagnostic Reset" aka a hard reset.  This should get the chip out of
108 * any state and back to its initialization state machine.
109 */
110static char mpt2_reset_magic[] = { 0x00, 0x0f, 0x04, 0x0b, 0x02, 0x07, 0x0d };
111
112/* Added this union to smoothly convert le64toh cm->cm_desc.Words.
113 * Compiler only support unint64_t to be passed as argument.
114 * Otherwise it will through below error
115 * "aggregate value used where an integer was expected"
116 */
117
118typedef union _reply_descriptor {
119        u64 word;
120        struct {
121                u32 low;
122                u32 high;
123        } u;
124}reply_descriptor,address_descriptor;
125
126/* Rate limit chain-fail messages to 1 per minute */
127static struct timeval mps_chainfail_interval = { 60, 0 };
128
129/*
130 * sleep_flag can be either CAN_SLEEP or NO_SLEEP.
131 * If this function is called from process context, it can sleep
132 * and there is no harm to sleep, in case if this fuction is called
133 * from Interrupt handler, we can not sleep and need NO_SLEEP flag set.
134 * based on sleep flags driver will call either msleep, pause or DELAY.
135 * msleep and pause are of same variant, but pause is used when mps_mtx
136 * is not hold by driver.
137 *
138 */
139static int
140mps_diag_reset(struct mps_softc *sc,int sleep_flag)
141{
142	uint32_t reg;
143	int i, error, tries = 0;
144	uint8_t first_wait_done = FALSE;
145
146	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
147
148	/* Clear any pending interrupts */
149	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
150
151	/*Force NO_SLEEP for threads prohibited to sleep
152 	* e.a Thread from interrupt handler are prohibited to sleep.
153 	*/
154	if (curthread->td_no_sleeping != 0)
155		sleep_flag = NO_SLEEP;
156
157	/* Push the magic sequence */
158	error = ETIMEDOUT;
159	while (tries++ < 20) {
160		for (i = 0; i < sizeof(mpt2_reset_magic); i++)
161			mps_regwrite(sc, MPI2_WRITE_SEQUENCE_OFFSET,
162			    mpt2_reset_magic[i]);
163		/* wait 100 msec */
164		if (mtx_owned(&sc->mps_mtx) && sleep_flag == CAN_SLEEP)
165			msleep(&sc->msleep_fake_chan, &sc->mps_mtx, 0,
166			    "mpsdiag", hz/10);
167		else if (sleep_flag == CAN_SLEEP)
168			pause("mpsdiag", hz/10);
169		else
170			DELAY(100 * 1000);
171
172		reg = mps_regread(sc, MPI2_HOST_DIAGNOSTIC_OFFSET);
173		if (reg & MPI2_DIAG_DIAG_WRITE_ENABLE) {
174			error = 0;
175			break;
176		}
177	}
178	if (error)
179		return (error);
180
181	/* Send the actual reset.  XXX need to refresh the reg? */
182	mps_regwrite(sc, MPI2_HOST_DIAGNOSTIC_OFFSET,
183	    reg | MPI2_DIAG_RESET_ADAPTER);
184
185	/* Wait up to 300 seconds in 50ms intervals */
186	error = ETIMEDOUT;
187	for (i = 0; i < 6000; i++) {
188		/*
189		 * Wait 50 msec. If this is the first time through, wait 256
190		 * msec to satisfy Diag Reset timing requirements.
191		 */
192		if (first_wait_done) {
193			if (mtx_owned(&sc->mps_mtx) && sleep_flag == CAN_SLEEP)
194				msleep(&sc->msleep_fake_chan, &sc->mps_mtx, 0,
195				    "mpsdiag", hz/20);
196			else if (sleep_flag == CAN_SLEEP)
197				pause("mpsdiag", hz/20);
198			else
199				DELAY(50 * 1000);
200		} else {
201			DELAY(256 * 1000);
202			first_wait_done = TRUE;
203		}
204		/*
205		 * Check for the RESET_ADAPTER bit to be cleared first, then
206		 * wait for the RESET state to be cleared, which takes a little
207		 * longer.
208		 */
209		reg = mps_regread(sc, MPI2_HOST_DIAGNOSTIC_OFFSET);
210		if (reg & MPI2_DIAG_RESET_ADAPTER) {
211			continue;
212		}
213		reg = mps_regread(sc, MPI2_DOORBELL_OFFSET);
214		if ((reg & MPI2_IOC_STATE_MASK) != MPI2_IOC_STATE_RESET) {
215			error = 0;
216			break;
217		}
218	}
219	if (error)
220		return (error);
221
222	mps_regwrite(sc, MPI2_WRITE_SEQUENCE_OFFSET, 0x0);
223
224	return (0);
225}
226
227static int
228mps_message_unit_reset(struct mps_softc *sc, int sleep_flag)
229{
230
231	MPS_FUNCTRACE(sc);
232
233	mps_regwrite(sc, MPI2_DOORBELL_OFFSET,
234	    MPI2_FUNCTION_IOC_MESSAGE_UNIT_RESET <<
235	    MPI2_DOORBELL_FUNCTION_SHIFT);
236
237	if (mps_wait_db_ack(sc, 5, sleep_flag) != 0) {
238		mps_dprint(sc, MPS_FAULT, "Doorbell handshake failed : <%s>\n",
239				__func__);
240		return (ETIMEDOUT);
241	}
242
243	return (0);
244}
245
246static int
247mps_transition_ready(struct mps_softc *sc)
248{
249	uint32_t reg, state;
250	int error, tries = 0;
251	int sleep_flags;
252
253	MPS_FUNCTRACE(sc);
254	/* If we are in attach call, do not sleep */
255	sleep_flags = (sc->mps_flags & MPS_FLAGS_ATTACH_DONE)
256					? CAN_SLEEP:NO_SLEEP;
257	error = 0;
258	while (tries++ < 1200) {
259		reg = mps_regread(sc, MPI2_DOORBELL_OFFSET);
260		mps_dprint(sc, MPS_INIT, "Doorbell= 0x%x\n", reg);
261
262		/*
263		 * Ensure the IOC is ready to talk.  If it's not, try
264		 * resetting it.
265		 */
266		if (reg & MPI2_DOORBELL_USED) {
267			mps_diag_reset(sc, sleep_flags);
268			DELAY(50000);
269			continue;
270		}
271
272		/* Is the adapter owned by another peer? */
273		if ((reg & MPI2_DOORBELL_WHO_INIT_MASK) ==
274		    (MPI2_WHOINIT_PCI_PEER << MPI2_DOORBELL_WHO_INIT_SHIFT)) {
275			device_printf(sc->mps_dev, "IOC is under the control "
276			    "of another peer host, aborting initialization.\n");
277			return (ENXIO);
278		}
279
280		state = reg & MPI2_IOC_STATE_MASK;
281		if (state == MPI2_IOC_STATE_READY) {
282			/* Ready to go! */
283			error = 0;
284			break;
285		} else if (state == MPI2_IOC_STATE_FAULT) {
286			mps_dprint(sc, MPS_FAULT, "IOC in fault state 0x%x, resetting\n",
287			    state & MPI2_DOORBELL_FAULT_CODE_MASK);
288			mps_diag_reset(sc, sleep_flags);
289		} else if (state == MPI2_IOC_STATE_OPERATIONAL) {
290			/* Need to take ownership */
291			mps_message_unit_reset(sc, sleep_flags);
292		} else if (state == MPI2_IOC_STATE_RESET) {
293			/* Wait a bit, IOC might be in transition */
294			mps_dprint(sc, MPS_FAULT,
295			    "IOC in unexpected reset state\n");
296		} else {
297			mps_dprint(sc, MPS_FAULT,
298			    "IOC in unknown state 0x%x\n", state);
299			error = EINVAL;
300			break;
301		}
302
303		/* Wait 50ms for things to settle down. */
304		DELAY(50000);
305	}
306
307	if (error)
308		device_printf(sc->mps_dev, "Cannot transition IOC to ready\n");
309
310	return (error);
311}
312
313static int
314mps_transition_operational(struct mps_softc *sc)
315{
316	uint32_t reg, state;
317	int error;
318
319	MPS_FUNCTRACE(sc);
320
321	error = 0;
322	reg = mps_regread(sc, MPI2_DOORBELL_OFFSET);
323	mps_dprint(sc, MPS_INIT, "Doorbell= 0x%x\n", reg);
324
325	state = reg & MPI2_IOC_STATE_MASK;
326	if (state != MPI2_IOC_STATE_READY) {
327		if ((error = mps_transition_ready(sc)) != 0) {
328			mps_dprint(sc, MPS_FAULT,
329			    "%s failed to transition ready\n", __func__);
330			return (error);
331		}
332	}
333
334	error = mps_send_iocinit(sc);
335	return (error);
336}
337
338/*
339 * This is called during attach and when re-initializing due to a Diag Reset.
340 * IOC Facts is used to allocate many of the structures needed by the driver.
341 * If called from attach, de-allocation is not required because the driver has
342 * not allocated any structures yet, but if called from a Diag Reset, previously
343 * allocated structures based on IOC Facts will need to be freed and re-
344 * allocated bases on the latest IOC Facts.
345 */
346static int
347mps_iocfacts_allocate(struct mps_softc *sc, uint8_t attaching)
348{
349	int error;
350	Mpi2IOCFactsReply_t saved_facts;
351	uint8_t saved_mode, reallocating;
352
353	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
354
355	/* Save old IOC Facts and then only reallocate if Facts have changed */
356	if (!attaching) {
357		bcopy(sc->facts, &saved_facts, sizeof(MPI2_IOC_FACTS_REPLY));
358	}
359
360	/*
361	 * Get IOC Facts.  In all cases throughout this function, panic if doing
362	 * a re-initialization and only return the error if attaching so the OS
363	 * can handle it.
364	 */
365	if ((error = mps_get_iocfacts(sc, sc->facts)) != 0) {
366		if (attaching) {
367			mps_dprint(sc, MPS_FAULT, "%s failed to get IOC Facts "
368			    "with error %d\n", __func__, error);
369			return (error);
370		} else {
371			panic("%s failed to get IOC Facts with error %d\n",
372			    __func__, error);
373		}
374	}
375
376	MPS_DPRINT_PAGE(sc, MPS_XINFO, iocfacts, sc->facts);
377
378	snprintf(sc->fw_version, sizeof(sc->fw_version),
379	    "%02d.%02d.%02d.%02d",
380	    sc->facts->FWVersion.Struct.Major,
381	    sc->facts->FWVersion.Struct.Minor,
382	    sc->facts->FWVersion.Struct.Unit,
383	    sc->facts->FWVersion.Struct.Dev);
384
385	mps_printf(sc, "Firmware: %s, Driver: %s\n", sc->fw_version,
386	    MPS_DRIVER_VERSION);
387	mps_printf(sc, "IOCCapabilities: %b\n", sc->facts->IOCCapabilities,
388	    "\20" "\3ScsiTaskFull" "\4DiagTrace" "\5SnapBuf" "\6ExtBuf"
389	    "\7EEDP" "\10BiDirTarg" "\11Multicast" "\14TransRetry" "\15IR"
390	    "\16EventReplay" "\17RaidAccel" "\20MSIXIndex" "\21HostDisc");
391
392	/*
393	 * If the chip doesn't support event replay then a hard reset will be
394	 * required to trigger a full discovery.  Do the reset here then
395	 * retransition to Ready.  A hard reset might have already been done,
396	 * but it doesn't hurt to do it again.  Only do this if attaching, not
397	 * for a Diag Reset.
398	 */
399	if (attaching) {
400		if ((sc->facts->IOCCapabilities &
401		    MPI2_IOCFACTS_CAPABILITY_EVENT_REPLAY) == 0) {
402			mps_diag_reset(sc, NO_SLEEP);
403			if ((error = mps_transition_ready(sc)) != 0) {
404				mps_dprint(sc, MPS_FAULT, "%s failed to "
405				    "transition to ready with error %d\n",
406				    __func__, error);
407				return (error);
408			}
409		}
410	}
411
412	/*
413	 * Set flag if IR Firmware is loaded.  If the RAID Capability has
414	 * changed from the previous IOC Facts, log a warning, but only if
415	 * checking this after a Diag Reset and not during attach.
416	 */
417	saved_mode = sc->ir_firmware;
418	if (sc->facts->IOCCapabilities &
419	    MPI2_IOCFACTS_CAPABILITY_INTEGRATED_RAID)
420		sc->ir_firmware = 1;
421	if (!attaching) {
422		if (sc->ir_firmware != saved_mode) {
423			mps_dprint(sc, MPS_FAULT, "%s new IR/IT mode in IOC "
424			    "Facts does not match previous mode\n", __func__);
425		}
426	}
427
428	/* Only deallocate and reallocate if relevant IOC Facts have changed */
429	reallocating = FALSE;
430	sc->mps_flags &= ~MPS_FLAGS_REALLOCATED;
431
432	if ((!attaching) &&
433	    ((saved_facts.MsgVersion != sc->facts->MsgVersion) ||
434	    (saved_facts.HeaderVersion != sc->facts->HeaderVersion) ||
435	    (saved_facts.MaxChainDepth != sc->facts->MaxChainDepth) ||
436	    (saved_facts.RequestCredit != sc->facts->RequestCredit) ||
437	    (saved_facts.ProductID != sc->facts->ProductID) ||
438	    (saved_facts.IOCCapabilities != sc->facts->IOCCapabilities) ||
439	    (saved_facts.IOCRequestFrameSize !=
440	    sc->facts->IOCRequestFrameSize) ||
441	    (saved_facts.MaxTargets != sc->facts->MaxTargets) ||
442	    (saved_facts.MaxSasExpanders != sc->facts->MaxSasExpanders) ||
443	    (saved_facts.MaxEnclosures != sc->facts->MaxEnclosures) ||
444	    (saved_facts.HighPriorityCredit != sc->facts->HighPriorityCredit) ||
445	    (saved_facts.MaxReplyDescriptorPostQueueDepth !=
446	    sc->facts->MaxReplyDescriptorPostQueueDepth) ||
447	    (saved_facts.ReplyFrameSize != sc->facts->ReplyFrameSize) ||
448	    (saved_facts.MaxVolumes != sc->facts->MaxVolumes) ||
449	    (saved_facts.MaxPersistentEntries !=
450	    sc->facts->MaxPersistentEntries))) {
451		reallocating = TRUE;
452
453		/* Record that we reallocated everything */
454		sc->mps_flags |= MPS_FLAGS_REALLOCATED;
455	}
456
457	/*
458	 * Some things should be done if attaching or re-allocating after a Diag
459	 * Reset, but are not needed after a Diag Reset if the FW has not
460	 * changed.
461	 */
462	if (attaching || reallocating) {
463		/*
464		 * Check if controller supports FW diag buffers and set flag to
465		 * enable each type.
466		 */
467		if (sc->facts->IOCCapabilities &
468		    MPI2_IOCFACTS_CAPABILITY_DIAG_TRACE_BUFFER)
469			sc->fw_diag_buffer_list[MPI2_DIAG_BUF_TYPE_TRACE].
470			    enabled = TRUE;
471		if (sc->facts->IOCCapabilities &
472		    MPI2_IOCFACTS_CAPABILITY_SNAPSHOT_BUFFER)
473			sc->fw_diag_buffer_list[MPI2_DIAG_BUF_TYPE_SNAPSHOT].
474			    enabled = TRUE;
475		if (sc->facts->IOCCapabilities &
476		    MPI2_IOCFACTS_CAPABILITY_EXTENDED_BUFFER)
477			sc->fw_diag_buffer_list[MPI2_DIAG_BUF_TYPE_EXTENDED].
478			    enabled = TRUE;
479
480		/*
481		 * Set flag if EEDP is supported and if TLR is supported.
482		 */
483		if (sc->facts->IOCCapabilities & MPI2_IOCFACTS_CAPABILITY_EEDP)
484			sc->eedp_enabled = TRUE;
485		if (sc->facts->IOCCapabilities & MPI2_IOCFACTS_CAPABILITY_TLR)
486			sc->control_TLR = TRUE;
487
488		/*
489		 * Size the queues. Since the reply queues always need one free
490		 * entry, we'll just deduct one reply message here.
491		 */
492		sc->num_prireqs = MIN(MPS_PRI_REQ_FRAMES,
493		    sc->facts->HighPriorityCredit);
494		sc->num_reqs = MIN(MPS_REQ_FRAMES, sc->facts->RequestCredit) +
495		    sc->num_prireqs;
496		sc->num_replies = MIN(MPS_REPLY_FRAMES + MPS_EVT_REPLY_FRAMES,
497		    sc->facts->MaxReplyDescriptorPostQueueDepth) - 1;
498
499		/*
500		 * Initialize all Tail Queues
501		 */
502		TAILQ_INIT(&sc->req_list);
503		TAILQ_INIT(&sc->high_priority_req_list);
504		TAILQ_INIT(&sc->chain_list);
505		TAILQ_INIT(&sc->tm_list);
506	}
507
508	/*
509	 * If doing a Diag Reset and the FW is significantly different
510	 * (reallocating will be set above in IOC Facts comparison), then all
511	 * buffers based on the IOC Facts will need to be freed before they are
512	 * reallocated.
513	 */
514	if (reallocating) {
515		mps_iocfacts_free(sc);
516		mpssas_realloc_targets(sc, saved_facts.MaxTargets +
517		    saved_facts.MaxVolumes);
518	}
519
520	/*
521	 * Any deallocation has been completed.  Now start reallocating
522	 * if needed.  Will only need to reallocate if attaching or if the new
523	 * IOC Facts are different from the previous IOC Facts after a Diag
524	 * Reset. Targets have already been allocated above if needed.
525	 */
526	if (attaching || reallocating) {
527		if (((error = mps_alloc_queues(sc)) != 0) ||
528		    ((error = mps_alloc_replies(sc)) != 0) ||
529		    ((error = mps_alloc_requests(sc)) != 0)) {
530			if (attaching ) {
531				mps_dprint(sc, MPS_FAULT, "%s failed to alloc "
532				    "queues with error %d\n", __func__, error);
533				mps_free(sc);
534				return (error);
535			} else {
536				panic("%s failed to alloc queues with error "
537				    "%d\n", __func__, error);
538			}
539		}
540	}
541
542	/* Always initialize the queues */
543	bzero(sc->free_queue, sc->fqdepth * 4);
544	mps_init_queues(sc);
545
546	/*
547	 * Always get the chip out of the reset state, but only panic if not
548	 * attaching.  If attaching and there is an error, that is handled by
549	 * the OS.
550	 */
551	error = mps_transition_operational(sc);
552	if (error != 0) {
553		if (attaching) {
554			mps_printf(sc, "%s failed to transition to operational "
555			    "with error %d\n", __func__, error);
556			mps_free(sc);
557			return (error);
558		} else {
559			panic("%s failed to transition to operational with "
560			    "error %d\n", __func__, error);
561		}
562	}
563
564	/*
565	 * Finish the queue initialization.
566	 * These are set here instead of in mps_init_queues() because the
567	 * IOC resets these values during the state transition in
568	 * mps_transition_operational().  The free index is set to 1
569	 * because the corresponding index in the IOC is set to 0, and the
570	 * IOC treats the queues as full if both are set to the same value.
571	 * Hence the reason that the queue can't hold all of the possible
572	 * replies.
573	 */
574	sc->replypostindex = 0;
575	mps_regwrite(sc, MPI2_REPLY_FREE_HOST_INDEX_OFFSET, sc->replyfreeindex);
576	mps_regwrite(sc, MPI2_REPLY_POST_HOST_INDEX_OFFSET, 0);
577
578	/*
579	 * Attach the subsystems so they can prepare their event masks.
580	 */
581	/* XXX Should be dynamic so that IM/IR and user modules can attach */
582	if (attaching) {
583		if (((error = mps_attach_log(sc)) != 0) ||
584		    ((error = mps_attach_sas(sc)) != 0) ||
585		    ((error = mps_attach_user(sc)) != 0)) {
586			mps_printf(sc, "%s failed to attach all subsystems: "
587			    "error %d\n", __func__, error);
588			mps_free(sc);
589			return (error);
590		}
591
592		if ((error = mps_pci_setup_interrupts(sc)) != 0) {
593			mps_printf(sc, "%s failed to setup interrupts\n",
594			    __func__);
595			mps_free(sc);
596			return (error);
597		}
598	}
599
600	/*
601	 * Set flag if this is a WD controller.  This shouldn't ever change, but
602	 * reset it after a Diag Reset, just in case.
603	 */
604	sc->WD_available = FALSE;
605	if (pci_get_device(sc->mps_dev) == MPI2_MFGPAGE_DEVID_SSS6200)
606		sc->WD_available = TRUE;
607
608	return (error);
609}
610
611/*
612 * This is called if memory is being free (during detach for example) and when
613 * buffers need to be reallocated due to a Diag Reset.
614 */
615static void
616mps_iocfacts_free(struct mps_softc *sc)
617{
618	struct mps_command *cm;
619	int i;
620
621	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
622
623	if (sc->free_busaddr != 0)
624		bus_dmamap_unload(sc->queues_dmat, sc->queues_map);
625	if (sc->free_queue != NULL)
626		bus_dmamem_free(sc->queues_dmat, sc->free_queue,
627		    sc->queues_map);
628	if (sc->queues_dmat != NULL)
629		bus_dma_tag_destroy(sc->queues_dmat);
630
631	if (sc->chain_busaddr != 0)
632		bus_dmamap_unload(sc->chain_dmat, sc->chain_map);
633	if (sc->chain_frames != NULL)
634		bus_dmamem_free(sc->chain_dmat, sc->chain_frames,
635		    sc->chain_map);
636	if (sc->chain_dmat != NULL)
637		bus_dma_tag_destroy(sc->chain_dmat);
638
639	if (sc->sense_busaddr != 0)
640		bus_dmamap_unload(sc->sense_dmat, sc->sense_map);
641	if (sc->sense_frames != NULL)
642		bus_dmamem_free(sc->sense_dmat, sc->sense_frames,
643		    sc->sense_map);
644	if (sc->sense_dmat != NULL)
645		bus_dma_tag_destroy(sc->sense_dmat);
646
647	if (sc->reply_busaddr != 0)
648		bus_dmamap_unload(sc->reply_dmat, sc->reply_map);
649	if (sc->reply_frames != NULL)
650		bus_dmamem_free(sc->reply_dmat, sc->reply_frames,
651		    sc->reply_map);
652	if (sc->reply_dmat != NULL)
653		bus_dma_tag_destroy(sc->reply_dmat);
654
655	if (sc->req_busaddr != 0)
656		bus_dmamap_unload(sc->req_dmat, sc->req_map);
657	if (sc->req_frames != NULL)
658		bus_dmamem_free(sc->req_dmat, sc->req_frames, sc->req_map);
659	if (sc->req_dmat != NULL)
660		bus_dma_tag_destroy(sc->req_dmat);
661
662	if (sc->chains != NULL)
663		free(sc->chains, M_MPT2);
664	if (sc->commands != NULL) {
665		for (i = 1; i < sc->num_reqs; i++) {
666			cm = &sc->commands[i];
667			bus_dmamap_destroy(sc->buffer_dmat, cm->cm_dmamap);
668		}
669		free(sc->commands, M_MPT2);
670	}
671	if (sc->buffer_dmat != NULL)
672		bus_dma_tag_destroy(sc->buffer_dmat);
673}
674
675/*
676 * The terms diag reset and hard reset are used interchangeably in the MPI
677 * docs to mean resetting the controller chip.  In this code diag reset
678 * cleans everything up, and the hard reset function just sends the reset
679 * sequence to the chip.  This should probably be refactored so that every
680 * subsystem gets a reset notification of some sort, and can clean up
681 * appropriately.
682 */
683int
684mps_reinit(struct mps_softc *sc)
685{
686	int error;
687	struct mpssas_softc *sassc;
688
689	sassc = sc->sassc;
690
691	MPS_FUNCTRACE(sc);
692
693	mtx_assert(&sc->mps_mtx, MA_OWNED);
694
695	if (sc->mps_flags & MPS_FLAGS_DIAGRESET) {
696		mps_dprint(sc, MPS_INIT, "%s reset already in progress\n",
697			   __func__);
698		return 0;
699	}
700
701	mps_dprint(sc, MPS_INFO, "Reinitializing controller,\n");
702	/* make sure the completion callbacks can recognize they're getting
703	 * a NULL cm_reply due to a reset.
704	 */
705	sc->mps_flags |= MPS_FLAGS_DIAGRESET;
706
707	/*
708	 * Mask interrupts here.
709	 */
710	mps_dprint(sc, MPS_INIT, "%s mask interrupts\n", __func__);
711	mps_mask_intr(sc);
712
713	error = mps_diag_reset(sc, CAN_SLEEP);
714	if (error != 0) {
715		/* XXXSL No need to panic here */
716		panic("%s hard reset failed with error %d\n",
717		    __func__, error);
718	}
719
720	/* Restore the PCI state, including the MSI-X registers */
721	mps_pci_restore(sc);
722
723	/* Give the I/O subsystem special priority to get itself prepared */
724	mpssas_handle_reinit(sc);
725
726	/*
727	 * Get IOC Facts and allocate all structures based on this information.
728	 * The attach function will also call mps_iocfacts_allocate at startup.
729	 * If relevant values have changed in IOC Facts, this function will free
730	 * all of the memory based on IOC Facts and reallocate that memory.
731	 */
732	if ((error = mps_iocfacts_allocate(sc, FALSE)) != 0) {
733		panic("%s IOC Facts based allocation failed with error %d\n",
734		    __func__, error);
735	}
736
737	/*
738	 * Mapping structures will be re-allocated after getting IOC Page8, so
739	 * free these structures here.
740	 */
741	mps_mapping_exit(sc);
742
743	/*
744	 * The static page function currently read is IOC Page8.  Others can be
745	 * added in future.  It's possible that the values in IOC Page8 have
746	 * changed after a Diag Reset due to user modification, so always read
747	 * these.  Interrupts are masked, so unmask them before getting config
748	 * pages.
749	 */
750	mps_unmask_intr(sc);
751	sc->mps_flags &= ~MPS_FLAGS_DIAGRESET;
752	mps_base_static_config_pages(sc);
753
754	/*
755	 * Some mapping info is based in IOC Page8 data, so re-initialize the
756	 * mapping tables.
757	 */
758	mps_mapping_initialize(sc);
759
760	/*
761	 * Restart will reload the event masks clobbered by the reset, and
762	 * then enable the port.
763	 */
764	mps_reregister_events(sc);
765
766	/* the end of discovery will release the simq, so we're done. */
767	mps_dprint(sc, MPS_INFO, "%s finished sc %p post %u free %u\n",
768	    __func__, sc, sc->replypostindex, sc->replyfreeindex);
769
770	mpssas_release_simq_reinit(sassc);
771
772	return 0;
773}
774
775/* Wait for the chip to ACK a word that we've put into its FIFO
776 * Wait for <timeout> seconds. In single loop wait for busy loop
777 * for 500 microseconds.
778 * Total is [ 0.5 * (2000 * <timeout>) ] in miliseconds.
779 * */
780static int
781mps_wait_db_ack(struct mps_softc *sc, int timeout, int sleep_flag)
782{
783
784	u32 cntdn, count;
785	u32 int_status;
786	u32 doorbell;
787
788	count = 0;
789	cntdn = (sleep_flag == CAN_SLEEP) ? 1000*timeout : 2000*timeout;
790	do {
791		int_status = mps_regread(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET);
792		if (!(int_status & MPI2_HIS_SYS2IOC_DB_STATUS)) {
793			mps_dprint(sc, MPS_INIT,
794			"%s: successful count(%d), timeout(%d)\n",
795			__func__, count, timeout);
796		return 0;
797		} else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) {
798			doorbell = mps_regread(sc, MPI2_DOORBELL_OFFSET);
799			if ((doorbell & MPI2_IOC_STATE_MASK) ==
800				MPI2_IOC_STATE_FAULT) {
801				mps_dprint(sc, MPS_FAULT,
802					"fault_state(0x%04x)!\n", doorbell);
803				return (EFAULT);
804			}
805		} else if (int_status == 0xFFFFFFFF)
806			goto out;
807
808		/* If it can sleep, sleep for 1 milisecond, else busy loop for
809		* 0.5 milisecond */
810		if (mtx_owned(&sc->mps_mtx) && sleep_flag == CAN_SLEEP)
811			msleep(&sc->msleep_fake_chan, &sc->mps_mtx, 0,
812			"mpsdba", hz/1000);
813		else if (sleep_flag == CAN_SLEEP)
814			pause("mpsdba", hz/1000);
815		else
816			DELAY(500);
817		count++;
818	} while (--cntdn);
819
820	out:
821	mps_dprint(sc, MPS_FAULT, "%s: failed due to timeout count(%d), "
822		"int_status(%x)!\n", __func__, count, int_status);
823	return (ETIMEDOUT);
824
825}
826
827/* Wait for the chip to signal that the next word in its FIFO can be fetched */
828static int
829mps_wait_db_int(struct mps_softc *sc)
830{
831	int retry;
832
833	for (retry = 0; retry < MPS_DB_MAX_WAIT; retry++) {
834		if ((mps_regread(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET) &
835		    MPI2_HIS_IOC2SYS_DB_STATUS) != 0)
836			return (0);
837		DELAY(2000);
838	}
839	return (ETIMEDOUT);
840}
841
842/* Step through the synchronous command state machine, i.e. "Doorbell mode" */
843static int
844mps_request_sync(struct mps_softc *sc, void *req, MPI2_DEFAULT_REPLY *reply,
845    int req_sz, int reply_sz, int timeout)
846{
847	uint32_t *data32;
848	uint16_t *data16;
849	int i, count, ioc_sz, residual;
850	int sleep_flags = CAN_SLEEP;
851
852	if (curthread->td_no_sleeping != 0)
853		sleep_flags = NO_SLEEP;
854
855	/* Step 1 */
856	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
857
858	/* Step 2 */
859	if (mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_USED)
860		return (EBUSY);
861
862	/* Step 3
863	 * Announce that a message is coming through the doorbell.  Messages
864	 * are pushed at 32bit words, so round up if needed.
865	 */
866	count = (req_sz + 3) / 4;
867	mps_regwrite(sc, MPI2_DOORBELL_OFFSET,
868	    (MPI2_FUNCTION_HANDSHAKE << MPI2_DOORBELL_FUNCTION_SHIFT) |
869	    (count << MPI2_DOORBELL_ADD_DWORDS_SHIFT));
870
871	/* Step 4 */
872	if (mps_wait_db_int(sc) ||
873	    (mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_USED) == 0) {
874		mps_dprint(sc, MPS_FAULT, "Doorbell failed to activate\n");
875		return (ENXIO);
876	}
877	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
878	if (mps_wait_db_ack(sc, 5, sleep_flags) != 0) {
879		mps_dprint(sc, MPS_FAULT, "Doorbell handshake failed\n");
880		return (ENXIO);
881	}
882
883	/* Step 5 */
884	/* Clock out the message data synchronously in 32-bit dwords*/
885	data32 = (uint32_t *)req;
886	for (i = 0; i < count; i++) {
887		mps_regwrite(sc, MPI2_DOORBELL_OFFSET, htole32(data32[i]));
888		if (mps_wait_db_ack(sc, 5, sleep_flags) != 0) {
889			mps_dprint(sc, MPS_FAULT,
890			    "Timeout while writing doorbell\n");
891			return (ENXIO);
892		}
893	}
894
895	/* Step 6 */
896	/* Clock in the reply in 16-bit words.  The total length of the
897	 * message is always in the 4th byte, so clock out the first 2 words
898	 * manually, then loop the rest.
899	 */
900	data16 = (uint16_t *)reply;
901	if (mps_wait_db_int(sc) != 0) {
902		mps_dprint(sc, MPS_FAULT, "Timeout reading doorbell 0\n");
903		return (ENXIO);
904	}
905	data16[0] =
906	    mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_DATA_MASK;
907	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
908	if (mps_wait_db_int(sc) != 0) {
909		mps_dprint(sc, MPS_FAULT, "Timeout reading doorbell 1\n");
910		return (ENXIO);
911	}
912	data16[1] =
913	    mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_DATA_MASK;
914	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
915
916	/* Number of 32bit words in the message */
917	ioc_sz = reply->MsgLength;
918
919	/*
920	 * Figure out how many 16bit words to clock in without overrunning.
921	 * The precision loss with dividing reply_sz can safely be
922	 * ignored because the messages can only be multiples of 32bits.
923	 */
924	residual = 0;
925	count = MIN((reply_sz / 4), ioc_sz) * 2;
926	if (count < ioc_sz * 2) {
927		residual = ioc_sz * 2 - count;
928		mps_dprint(sc, MPS_ERROR, "Driver error, throwing away %d "
929		    "residual message words\n", residual);
930	}
931
932	for (i = 2; i < count; i++) {
933		if (mps_wait_db_int(sc) != 0) {
934			mps_dprint(sc, MPS_FAULT,
935			    "Timeout reading doorbell %d\n", i);
936			return (ENXIO);
937		}
938		data16[i] = mps_regread(sc, MPI2_DOORBELL_OFFSET) &
939		    MPI2_DOORBELL_DATA_MASK;
940		mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
941	}
942
943	/*
944	 * Pull out residual words that won't fit into the provided buffer.
945	 * This keeps the chip from hanging due to a driver programming
946	 * error.
947	 */
948	while (residual--) {
949		if (mps_wait_db_int(sc) != 0) {
950			mps_dprint(sc, MPS_FAULT,
951			    "Timeout reading doorbell\n");
952			return (ENXIO);
953		}
954		(void)mps_regread(sc, MPI2_DOORBELL_OFFSET);
955		mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
956	}
957
958	/* Step 7 */
959	if (mps_wait_db_int(sc) != 0) {
960		mps_dprint(sc, MPS_FAULT, "Timeout waiting to exit doorbell\n");
961		return (ENXIO);
962	}
963	if (mps_regread(sc, MPI2_DOORBELL_OFFSET) & MPI2_DOORBELL_USED)
964		mps_dprint(sc, MPS_FAULT, "Warning, doorbell still active\n");
965	mps_regwrite(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET, 0x0);
966
967	return (0);
968}
969
970static void
971mps_enqueue_request(struct mps_softc *sc, struct mps_command *cm)
972{
973	reply_descriptor rd;
974	MPS_FUNCTRACE(sc);
975	mps_dprint(sc, MPS_TRACE, "SMID %u cm %p ccb %p\n",
976	    cm->cm_desc.Default.SMID, cm, cm->cm_ccb);
977
978	if (sc->mps_flags & MPS_FLAGS_ATTACH_DONE && !(sc->mps_flags & MPS_FLAGS_SHUTDOWN))
979		mtx_assert(&sc->mps_mtx, MA_OWNED);
980
981	if (++sc->io_cmds_active > sc->io_cmds_highwater)
982		sc->io_cmds_highwater++;
983	rd.u.low = cm->cm_desc.Words.Low;
984	rd.u.high = cm->cm_desc.Words.High;
985	rd.word = htole64(rd.word);
986	/* TODO-We may need to make below regwrite atomic */
987	mps_regwrite(sc, MPI2_REQUEST_DESCRIPTOR_POST_LOW_OFFSET,
988	    rd.u.low);
989	mps_regwrite(sc, MPI2_REQUEST_DESCRIPTOR_POST_HIGH_OFFSET,
990	    rd.u.high);
991}
992
993/*
994 * Just the FACTS, ma'am.
995 */
996static int
997mps_get_iocfacts(struct mps_softc *sc, MPI2_IOC_FACTS_REPLY *facts)
998{
999	MPI2_DEFAULT_REPLY *reply;
1000	MPI2_IOC_FACTS_REQUEST request;
1001	int error, req_sz, reply_sz;
1002
1003	MPS_FUNCTRACE(sc);
1004
1005	req_sz = sizeof(MPI2_IOC_FACTS_REQUEST);
1006	reply_sz = sizeof(MPI2_IOC_FACTS_REPLY);
1007	reply = (MPI2_DEFAULT_REPLY *)facts;
1008
1009	bzero(&request, req_sz);
1010	request.Function = MPI2_FUNCTION_IOC_FACTS;
1011	error = mps_request_sync(sc, &request, reply, req_sz, reply_sz, 5);
1012
1013	return (error);
1014}
1015
1016static int
1017mps_send_iocinit(struct mps_softc *sc)
1018{
1019	MPI2_IOC_INIT_REQUEST	init;
1020	MPI2_DEFAULT_REPLY	reply;
1021	int req_sz, reply_sz, error;
1022	struct timeval now;
1023	uint64_t time_in_msec;
1024
1025	MPS_FUNCTRACE(sc);
1026
1027	req_sz = sizeof(MPI2_IOC_INIT_REQUEST);
1028	reply_sz = sizeof(MPI2_IOC_INIT_REPLY);
1029	bzero(&init, req_sz);
1030	bzero(&reply, reply_sz);
1031
1032	/*
1033	 * Fill in the init block.  Note that most addresses are
1034	 * deliberately in the lower 32bits of memory.  This is a micro-
1035	 * optimzation for PCI/PCIX, though it's not clear if it helps PCIe.
1036	 */
1037	init.Function = MPI2_FUNCTION_IOC_INIT;
1038	init.WhoInit = MPI2_WHOINIT_HOST_DRIVER;
1039	init.MsgVersion = htole16(MPI2_VERSION);
1040	init.HeaderVersion = htole16(MPI2_HEADER_VERSION);
1041	init.SystemRequestFrameSize = htole16(sc->facts->IOCRequestFrameSize);
1042	init.ReplyDescriptorPostQueueDepth = htole16(sc->pqdepth);
1043	init.ReplyFreeQueueDepth = htole16(sc->fqdepth);
1044	init.SenseBufferAddressHigh = 0;
1045	init.SystemReplyAddressHigh = 0;
1046	init.SystemRequestFrameBaseAddress.High = 0;
1047	init.SystemRequestFrameBaseAddress.Low = htole32((uint32_t)sc->req_busaddr);
1048	init.ReplyDescriptorPostQueueAddress.High = 0;
1049	init.ReplyDescriptorPostQueueAddress.Low = htole32((uint32_t)sc->post_busaddr);
1050	init.ReplyFreeQueueAddress.High = 0;
1051	init.ReplyFreeQueueAddress.Low = htole32((uint32_t)sc->free_busaddr);
1052	getmicrotime(&now);
1053	time_in_msec = (now.tv_sec * 1000 + now.tv_usec/1000);
1054	init.TimeStamp.High = htole32((time_in_msec >> 32) & 0xFFFFFFFF);
1055	init.TimeStamp.Low = htole32(time_in_msec & 0xFFFFFFFF);
1056
1057	error = mps_request_sync(sc, &init, &reply, req_sz, reply_sz, 5);
1058	if ((reply.IOCStatus & MPI2_IOCSTATUS_MASK) != MPI2_IOCSTATUS_SUCCESS)
1059		error = ENXIO;
1060
1061	mps_dprint(sc, MPS_INIT, "IOCInit status= 0x%x\n", reply.IOCStatus);
1062	return (error);
1063}
1064
1065void
1066mps_memaddr_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1067{
1068	bus_addr_t *addr;
1069
1070	addr = arg;
1071	*addr = segs[0].ds_addr;
1072}
1073
1074static int
1075mps_alloc_queues(struct mps_softc *sc)
1076{
1077	bus_addr_t queues_busaddr;
1078	uint8_t *queues;
1079	int qsize, fqsize, pqsize;
1080
1081	/*
1082	 * The reply free queue contains 4 byte entries in multiples of 16 and
1083	 * aligned on a 16 byte boundary. There must always be an unused entry.
1084	 * This queue supplies fresh reply frames for the firmware to use.
1085	 *
1086	 * The reply descriptor post queue contains 8 byte entries in
1087	 * multiples of 16 and aligned on a 16 byte boundary.  This queue
1088	 * contains filled-in reply frames sent from the firmware to the host.
1089	 *
1090	 * These two queues are allocated together for simplicity.
1091	 */
1092	sc->fqdepth = roundup2(sc->num_replies + 1, 16);
1093	sc->pqdepth = roundup2(sc->num_replies + 1, 16);
1094	fqsize= sc->fqdepth * 4;
1095	pqsize = sc->pqdepth * 8;
1096	qsize = fqsize + pqsize;
1097
1098        if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
1099				16, 0,			/* algnmnt, boundary */
1100				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
1101				BUS_SPACE_MAXADDR,	/* highaddr */
1102				NULL, NULL,		/* filter, filterarg */
1103                                qsize,			/* maxsize */
1104                                1,			/* nsegments */
1105                                qsize,			/* maxsegsize */
1106                                0,			/* flags */
1107                                NULL, NULL,		/* lockfunc, lockarg */
1108                                &sc->queues_dmat)) {
1109		device_printf(sc->mps_dev, "Cannot allocate queues DMA tag\n");
1110		return (ENOMEM);
1111        }
1112        if (bus_dmamem_alloc(sc->queues_dmat, (void **)&queues, BUS_DMA_NOWAIT,
1113	    &sc->queues_map)) {
1114		device_printf(sc->mps_dev, "Cannot allocate queues memory\n");
1115		return (ENOMEM);
1116        }
1117        bzero(queues, qsize);
1118        bus_dmamap_load(sc->queues_dmat, sc->queues_map, queues, qsize,
1119	    mps_memaddr_cb, &queues_busaddr, 0);
1120
1121	sc->free_queue = (uint32_t *)queues;
1122	sc->free_busaddr = queues_busaddr;
1123	sc->post_queue = (MPI2_REPLY_DESCRIPTORS_UNION *)(queues + fqsize);
1124	sc->post_busaddr = queues_busaddr + fqsize;
1125
1126	return (0);
1127}
1128
1129static int
1130mps_alloc_replies(struct mps_softc *sc)
1131{
1132	int rsize, num_replies;
1133
1134	/*
1135	 * sc->num_replies should be one less than sc->fqdepth.  We need to
1136	 * allocate space for sc->fqdepth replies, but only sc->num_replies
1137	 * replies can be used at once.
1138	 */
1139	num_replies = max(sc->fqdepth, sc->num_replies);
1140
1141	rsize = sc->facts->ReplyFrameSize * num_replies * 4;
1142        if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
1143				4, 0,			/* algnmnt, boundary */
1144				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
1145				BUS_SPACE_MAXADDR,	/* highaddr */
1146				NULL, NULL,		/* filter, filterarg */
1147                                rsize,			/* maxsize */
1148                                1,			/* nsegments */
1149                                rsize,			/* maxsegsize */
1150                                0,			/* flags */
1151                                NULL, NULL,		/* lockfunc, lockarg */
1152                                &sc->reply_dmat)) {
1153		device_printf(sc->mps_dev, "Cannot allocate replies DMA tag\n");
1154		return (ENOMEM);
1155        }
1156        if (bus_dmamem_alloc(sc->reply_dmat, (void **)&sc->reply_frames,
1157	    BUS_DMA_NOWAIT, &sc->reply_map)) {
1158		device_printf(sc->mps_dev, "Cannot allocate replies memory\n");
1159		return (ENOMEM);
1160        }
1161        bzero(sc->reply_frames, rsize);
1162        bus_dmamap_load(sc->reply_dmat, sc->reply_map, sc->reply_frames, rsize,
1163	    mps_memaddr_cb, &sc->reply_busaddr, 0);
1164
1165	return (0);
1166}
1167
1168static int
1169mps_alloc_requests(struct mps_softc *sc)
1170{
1171	struct mps_command *cm;
1172	struct mps_chain *chain;
1173	int i, rsize, nsegs;
1174
1175	rsize = sc->facts->IOCRequestFrameSize * sc->num_reqs * 4;
1176        if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
1177				16, 0,			/* algnmnt, boundary */
1178				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
1179				BUS_SPACE_MAXADDR,	/* highaddr */
1180				NULL, NULL,		/* filter, filterarg */
1181                                rsize,			/* maxsize */
1182                                1,			/* nsegments */
1183                                rsize,			/* maxsegsize */
1184                                0,			/* flags */
1185                                NULL, NULL,		/* lockfunc, lockarg */
1186                                &sc->req_dmat)) {
1187		device_printf(sc->mps_dev, "Cannot allocate request DMA tag\n");
1188		return (ENOMEM);
1189        }
1190        if (bus_dmamem_alloc(sc->req_dmat, (void **)&sc->req_frames,
1191	    BUS_DMA_NOWAIT, &sc->req_map)) {
1192		device_printf(sc->mps_dev, "Cannot allocate request memory\n");
1193		return (ENOMEM);
1194        }
1195        bzero(sc->req_frames, rsize);
1196        bus_dmamap_load(sc->req_dmat, sc->req_map, sc->req_frames, rsize,
1197	    mps_memaddr_cb, &sc->req_busaddr, 0);
1198
1199	rsize = sc->facts->IOCRequestFrameSize * sc->max_chains * 4;
1200        if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
1201				16, 0,			/* algnmnt, boundary */
1202				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
1203				BUS_SPACE_MAXADDR,	/* highaddr */
1204				NULL, NULL,		/* filter, filterarg */
1205                                rsize,			/* maxsize */
1206                                1,			/* nsegments */
1207                                rsize,			/* maxsegsize */
1208                                0,			/* flags */
1209                                NULL, NULL,		/* lockfunc, lockarg */
1210                                &sc->chain_dmat)) {
1211		device_printf(sc->mps_dev, "Cannot allocate chain DMA tag\n");
1212		return (ENOMEM);
1213        }
1214        if (bus_dmamem_alloc(sc->chain_dmat, (void **)&sc->chain_frames,
1215	    BUS_DMA_NOWAIT, &sc->chain_map)) {
1216		device_printf(sc->mps_dev, "Cannot allocate chain memory\n");
1217		return (ENOMEM);
1218        }
1219        bzero(sc->chain_frames, rsize);
1220        bus_dmamap_load(sc->chain_dmat, sc->chain_map, sc->chain_frames, rsize,
1221	    mps_memaddr_cb, &sc->chain_busaddr, 0);
1222
1223	rsize = MPS_SENSE_LEN * sc->num_reqs;
1224        if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
1225				1, 0,			/* algnmnt, boundary */
1226				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
1227				BUS_SPACE_MAXADDR,	/* highaddr */
1228				NULL, NULL,		/* filter, filterarg */
1229                                rsize,			/* maxsize */
1230                                1,			/* nsegments */
1231                                rsize,			/* maxsegsize */
1232                                0,			/* flags */
1233                                NULL, NULL,		/* lockfunc, lockarg */
1234                                &sc->sense_dmat)) {
1235		device_printf(sc->mps_dev, "Cannot allocate sense DMA tag\n");
1236		return (ENOMEM);
1237        }
1238        if (bus_dmamem_alloc(sc->sense_dmat, (void **)&sc->sense_frames,
1239	    BUS_DMA_NOWAIT, &sc->sense_map)) {
1240		device_printf(sc->mps_dev, "Cannot allocate sense memory\n");
1241		return (ENOMEM);
1242        }
1243        bzero(sc->sense_frames, rsize);
1244        bus_dmamap_load(sc->sense_dmat, sc->sense_map, sc->sense_frames, rsize,
1245	    mps_memaddr_cb, &sc->sense_busaddr, 0);
1246
1247	sc->chains = malloc(sizeof(struct mps_chain) * sc->max_chains, M_MPT2,
1248	    M_WAITOK | M_ZERO);
1249	if(!sc->chains) {
1250		device_printf(sc->mps_dev,
1251		"Cannot allocate chains memory %s %d\n",
1252		 __func__, __LINE__);
1253		return (ENOMEM);
1254	}
1255	for (i = 0; i < sc->max_chains; i++) {
1256		chain = &sc->chains[i];
1257		chain->chain = (MPI2_SGE_IO_UNION *)(sc->chain_frames +
1258		    i * sc->facts->IOCRequestFrameSize * 4);
1259		chain->chain_busaddr = sc->chain_busaddr +
1260		    i * sc->facts->IOCRequestFrameSize * 4;
1261		mps_free_chain(sc, chain);
1262		sc->chain_free_lowwater++;
1263	}
1264
1265	/* XXX Need to pick a more precise value */
1266	nsegs = (MAXPHYS / PAGE_SIZE) + 1;
1267        if (bus_dma_tag_create( sc->mps_parent_dmat,    /* parent */
1268				1, 0,			/* algnmnt, boundary */
1269				BUS_SPACE_MAXADDR,	/* lowaddr */
1270				BUS_SPACE_MAXADDR,	/* highaddr */
1271				NULL, NULL,		/* filter, filterarg */
1272                                BUS_SPACE_MAXSIZE_32BIT,/* maxsize */
1273                                nsegs,			/* nsegments */
1274                                BUS_SPACE_MAXSIZE_24BIT,/* maxsegsize */
1275                                BUS_DMA_ALLOCNOW,	/* flags */
1276                                busdma_lock_mutex,	/* lockfunc */
1277				&sc->mps_mtx,		/* lockarg */
1278                                &sc->buffer_dmat)) {
1279		device_printf(sc->mps_dev, "Cannot allocate buffer DMA tag\n");
1280		return (ENOMEM);
1281        }
1282
1283	/*
1284	 * SMID 0 cannot be used as a free command per the firmware spec.
1285	 * Just drop that command instead of risking accounting bugs.
1286	 */
1287	sc->commands = malloc(sizeof(struct mps_command) * sc->num_reqs,
1288	    M_MPT2, M_WAITOK | M_ZERO);
1289	if(!sc->commands) {
1290		device_printf(sc->mps_dev, "Cannot allocate memory %s %d\n",
1291		 __func__, __LINE__);
1292		return (ENOMEM);
1293	}
1294	for (i = 1; i < sc->num_reqs; i++) {
1295		cm = &sc->commands[i];
1296		cm->cm_req = sc->req_frames +
1297		    i * sc->facts->IOCRequestFrameSize * 4;
1298		cm->cm_req_busaddr = sc->req_busaddr +
1299		    i * sc->facts->IOCRequestFrameSize * 4;
1300		cm->cm_sense = &sc->sense_frames[i];
1301		cm->cm_sense_busaddr = sc->sense_busaddr + i * MPS_SENSE_LEN;
1302		cm->cm_desc.Default.SMID = i;
1303		cm->cm_sc = sc;
1304		TAILQ_INIT(&cm->cm_chain_list);
1305		callout_init_mtx(&cm->cm_callout, &sc->mps_mtx, 0);
1306
1307		/* XXX Is a failure here a critical problem? */
1308		if (bus_dmamap_create(sc->buffer_dmat, 0, &cm->cm_dmamap) == 0)
1309			if (i <= sc->num_prireqs)
1310				mps_free_high_priority_command(sc, cm);
1311			else
1312				mps_free_command(sc, cm);
1313		else {
1314			panic("failed to allocate command %d\n", i);
1315			sc->num_reqs = i;
1316			break;
1317		}
1318	}
1319
1320	return (0);
1321}
1322
1323static int
1324mps_init_queues(struct mps_softc *sc)
1325{
1326	int i;
1327
1328	memset((uint8_t *)sc->post_queue, 0xff, sc->pqdepth * 8);
1329
1330	/*
1331	 * According to the spec, we need to use one less reply than we
1332	 * have space for on the queue.  So sc->num_replies (the number we
1333	 * use) should be less than sc->fqdepth (allocated size).
1334	 */
1335	if (sc->num_replies >= sc->fqdepth)
1336		return (EINVAL);
1337
1338	/*
1339	 * Initialize all of the free queue entries.
1340	 */
1341	for (i = 0; i < sc->fqdepth; i++)
1342		sc->free_queue[i] = sc->reply_busaddr + (i * sc->facts->ReplyFrameSize * 4);
1343	sc->replyfreeindex = sc->num_replies;
1344
1345	return (0);
1346}
1347
1348/* Get the driver parameter tunables.  Lowest priority are the driver defaults.
1349 * Next are the global settings, if they exist.  Highest are the per-unit
1350 * settings, if they exist.
1351 */
1352void
1353mps_get_tunables(struct mps_softc *sc)
1354{
1355	char tmpstr[80];
1356
1357	/* XXX default to some debugging for now */
1358	sc->mps_debug = MPS_INFO|MPS_FAULT;
1359	sc->disable_msix = 0;
1360	sc->disable_msi = 0;
1361	sc->max_chains = MPS_CHAIN_FRAMES;
1362	sc->max_io_pages = MPS_MAXIO_PAGES;
1363	sc->enable_ssu = MPS_SSU_ENABLE_SSD_DISABLE_HDD;
1364	sc->spinup_wait_time = DEFAULT_SPINUP_WAIT;
1365	sc->use_phynum = 1;
1366
1367	/*
1368	 * Grab the global variables.
1369	 */
1370	TUNABLE_INT_FETCH("hw.mps.debug_level", &sc->mps_debug);
1371	TUNABLE_INT_FETCH("hw.mps.disable_msix", &sc->disable_msix);
1372	TUNABLE_INT_FETCH("hw.mps.disable_msi", &sc->disable_msi);
1373	TUNABLE_INT_FETCH("hw.mps.max_chains", &sc->max_chains);
1374	TUNABLE_INT_FETCH("hw.mps.max_io_pages", &sc->max_io_pages);
1375	TUNABLE_INT_FETCH("hw.mps.enable_ssu", &sc->enable_ssu);
1376	TUNABLE_INT_FETCH("hw.mps.spinup_wait_time", &sc->spinup_wait_time);
1377	TUNABLE_INT_FETCH("hw.mps.use_phy_num", &sc->use_phynum);
1378
1379	/* Grab the unit-instance variables */
1380	snprintf(tmpstr, sizeof(tmpstr), "dev.mps.%d.debug_level",
1381	    device_get_unit(sc->mps_dev));
1382	TUNABLE_INT_FETCH(tmpstr, &sc->mps_debug);
1383
1384	snprintf(tmpstr, sizeof(tmpstr), "dev.mps.%d.disable_msix",
1385	    device_get_unit(sc->mps_dev));
1386	TUNABLE_INT_FETCH(tmpstr, &sc->disable_msix);
1387
1388	snprintf(tmpstr, sizeof(tmpstr), "dev.mps.%d.disable_msi",
1389	    device_get_unit(sc->mps_dev));
1390	TUNABLE_INT_FETCH(tmpstr, &sc->disable_msi);
1391
1392	snprintf(tmpstr, sizeof(tmpstr), "dev.mps.%d.max_chains",
1393	    device_get_unit(sc->mps_dev));
1394	TUNABLE_INT_FETCH(tmpstr, &sc->max_chains);
1395
1396	snprintf(tmpstr, sizeof(tmpstr), "dev.mps.%d.max_io_pages",
1397	    device_get_unit(sc->mps_dev));
1398	TUNABLE_INT_FETCH(tmpstr, &sc->max_io_pages);
1399
1400	bzero(sc->exclude_ids, sizeof(sc->exclude_ids));
1401	snprintf(tmpstr, sizeof(tmpstr), "dev.mps.%d.exclude_ids",
1402	    device_get_unit(sc->mps_dev));
1403	TUNABLE_STR_FETCH(tmpstr, sc->exclude_ids, sizeof(sc->exclude_ids));
1404
1405	snprintf(tmpstr, sizeof(tmpstr), "dev.mps.%d.enable_ssu",
1406	    device_get_unit(sc->mps_dev));
1407	TUNABLE_INT_FETCH(tmpstr, &sc->enable_ssu);
1408
1409	snprintf(tmpstr, sizeof(tmpstr), "dev.mps.%d.spinup_wait_time",
1410	    device_get_unit(sc->mps_dev));
1411	TUNABLE_INT_FETCH(tmpstr, &sc->spinup_wait_time);
1412
1413	snprintf(tmpstr, sizeof(tmpstr), "dev.mps.%d.use_phy_num",
1414	    device_get_unit(sc->mps_dev));
1415	TUNABLE_INT_FETCH(tmpstr, &sc->use_phynum);
1416}
1417
1418static void
1419mps_setup_sysctl(struct mps_softc *sc)
1420{
1421	struct sysctl_ctx_list	*sysctl_ctx = NULL;
1422	struct sysctl_oid	*sysctl_tree = NULL;
1423	char tmpstr[80], tmpstr2[80];
1424
1425	/*
1426	 * Setup the sysctl variable so the user can change the debug level
1427	 * on the fly.
1428	 */
1429	snprintf(tmpstr, sizeof(tmpstr), "MPS controller %d",
1430	    device_get_unit(sc->mps_dev));
1431	snprintf(tmpstr2, sizeof(tmpstr2), "%d", device_get_unit(sc->mps_dev));
1432
1433	sysctl_ctx = device_get_sysctl_ctx(sc->mps_dev);
1434	if (sysctl_ctx != NULL)
1435		sysctl_tree = device_get_sysctl_tree(sc->mps_dev);
1436
1437	if (sysctl_tree == NULL) {
1438		sysctl_ctx_init(&sc->sysctl_ctx);
1439		sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
1440		    SYSCTL_STATIC_CHILDREN(_hw_mps), OID_AUTO, tmpstr2,
1441		    CTLFLAG_RD, 0, tmpstr);
1442		if (sc->sysctl_tree == NULL)
1443			return;
1444		sysctl_ctx = &sc->sysctl_ctx;
1445		sysctl_tree = sc->sysctl_tree;
1446	}
1447
1448	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1449	    OID_AUTO, "debug_level", CTLFLAG_RW, &sc->mps_debug, 0,
1450	    "mps debug level");
1451
1452	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1453	    OID_AUTO, "disable_msix", CTLFLAG_RD, &sc->disable_msix, 0,
1454	    "Disable the use of MSI-X interrupts");
1455
1456	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1457	    OID_AUTO, "disable_msi", CTLFLAG_RD, &sc->disable_msi, 0,
1458	    "Disable the use of MSI interrupts");
1459
1460	SYSCTL_ADD_STRING(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1461	    OID_AUTO, "firmware_version", CTLFLAG_RW, sc->fw_version,
1462	    strlen(sc->fw_version), "firmware version");
1463
1464	SYSCTL_ADD_STRING(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1465	    OID_AUTO, "driver_version", CTLFLAG_RW, MPS_DRIVER_VERSION,
1466	    strlen(MPS_DRIVER_VERSION), "driver version");
1467
1468	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1469	    OID_AUTO, "io_cmds_active", CTLFLAG_RD,
1470	    &sc->io_cmds_active, 0, "number of currently active commands");
1471
1472	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1473	    OID_AUTO, "io_cmds_highwater", CTLFLAG_RD,
1474	    &sc->io_cmds_highwater, 0, "maximum active commands seen");
1475
1476	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1477	    OID_AUTO, "chain_free", CTLFLAG_RD,
1478	    &sc->chain_free, 0, "number of free chain elements");
1479
1480	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1481	    OID_AUTO, "chain_free_lowwater", CTLFLAG_RD,
1482	    &sc->chain_free_lowwater, 0,"lowest number of free chain elements");
1483
1484	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1485	    OID_AUTO, "max_chains", CTLFLAG_RD,
1486	    &sc->max_chains, 0,"maximum chain frames that will be allocated");
1487
1488	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1489	    OID_AUTO, "max_io_pages", CTLFLAG_RD,
1490	    &sc->max_io_pages, 0,"maximum pages to allow per I/O (if <1 use "
1491	    "IOCFacts)");
1492
1493	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1494	    OID_AUTO, "enable_ssu", CTLFLAG_RW, &sc->enable_ssu, 0,
1495	    "enable SSU to SATA SSD/HDD at shutdown");
1496
1497	SYSCTL_ADD_UQUAD(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1498	    OID_AUTO, "chain_alloc_fail", CTLFLAG_RD,
1499	    &sc->chain_alloc_fail, "chain allocation failures");
1500
1501	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1502	    OID_AUTO, "spinup_wait_time", CTLFLAG_RD,
1503	    &sc->spinup_wait_time, DEFAULT_SPINUP_WAIT, "seconds to wait for "
1504	    "spinup after SATA ID error");
1505
1506	SYSCTL_ADD_PROC(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1507	    OID_AUTO, "mapping_table_dump", CTLTYPE_STRING | CTLFLAG_RD, sc, 0,
1508	    mps_mapping_dump, "A", "Mapping Table Dump");
1509
1510	SYSCTL_ADD_PROC(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1511	    OID_AUTO, "encl_table_dump", CTLTYPE_STRING | CTLFLAG_RD, sc, 0,
1512	    mps_mapping_encl_dump, "A", "Enclosure Table Dump");
1513
1514	SYSCTL_ADD_INT(sysctl_ctx, SYSCTL_CHILDREN(sysctl_tree),
1515	    OID_AUTO, "use_phy_num", CTLFLAG_RD, &sc->use_phynum, 0,
1516	    "Use the phy number for enumeration");
1517}
1518
1519int
1520mps_attach(struct mps_softc *sc)
1521{
1522	int error;
1523
1524	MPS_FUNCTRACE(sc);
1525
1526	mtx_init(&sc->mps_mtx, "MPT2SAS lock", NULL, MTX_DEF);
1527	callout_init_mtx(&sc->periodic, &sc->mps_mtx, 0);
1528	callout_init_mtx(&sc->device_check_callout, &sc->mps_mtx, 0);
1529	TAILQ_INIT(&sc->event_list);
1530	timevalclear(&sc->lastfail);
1531
1532	if ((error = mps_transition_ready(sc)) != 0) {
1533		mps_printf(sc, "%s failed to transition ready\n", __func__);
1534		return (error);
1535	}
1536
1537	sc->facts = malloc(sizeof(MPI2_IOC_FACTS_REPLY), M_MPT2,
1538	    M_ZERO|M_NOWAIT);
1539	if(!sc->facts) {
1540		device_printf(sc->mps_dev, "Cannot allocate memory %s %d\n",
1541		 __func__, __LINE__);
1542		return (ENOMEM);
1543	}
1544
1545	/*
1546	 * Get IOC Facts and allocate all structures based on this information.
1547	 * A Diag Reset will also call mps_iocfacts_allocate and re-read the IOC
1548	 * Facts. If relevant values have changed in IOC Facts, this function
1549	 * will free all of the memory based on IOC Facts and reallocate that
1550	 * memory.  If this fails, any allocated memory should already be freed.
1551	 */
1552	if ((error = mps_iocfacts_allocate(sc, TRUE)) != 0) {
1553		mps_dprint(sc, MPS_FAULT, "%s IOC Facts based allocation "
1554		    "failed with error %d\n", __func__, error);
1555		return (error);
1556	}
1557
1558	/* Start the periodic watchdog check on the IOC Doorbell */
1559	mps_periodic(sc);
1560
1561	/*
1562	 * The portenable will kick off discovery events that will drive the
1563	 * rest of the initialization process.  The CAM/SAS module will
1564	 * hold up the boot sequence until discovery is complete.
1565	 */
1566	sc->mps_ich.ich_func = mps_startup;
1567	sc->mps_ich.ich_arg = sc;
1568	if (config_intrhook_establish(&sc->mps_ich) != 0) {
1569		mps_dprint(sc, MPS_ERROR, "Cannot establish MPS config hook\n");
1570		error = EINVAL;
1571	}
1572
1573	/*
1574	 * Allow IR to shutdown gracefully when shutdown occurs.
1575	 */
1576	sc->shutdown_eh = EVENTHANDLER_REGISTER(shutdown_final,
1577	    mpssas_ir_shutdown, sc, SHUTDOWN_PRI_DEFAULT);
1578
1579	if (sc->shutdown_eh == NULL)
1580		mps_dprint(sc, MPS_ERROR, "shutdown event registration "
1581		    "failed\n");
1582
1583	mps_setup_sysctl(sc);
1584
1585	sc->mps_flags |= MPS_FLAGS_ATTACH_DONE;
1586
1587	return (error);
1588}
1589
1590/* Run through any late-start handlers. */
1591static void
1592mps_startup(void *arg)
1593{
1594	struct mps_softc *sc;
1595
1596	sc = (struct mps_softc *)arg;
1597
1598	mps_lock(sc);
1599	mps_unmask_intr(sc);
1600
1601	/* initialize device mapping tables */
1602	mps_base_static_config_pages(sc);
1603	mps_mapping_initialize(sc);
1604	mpssas_startup(sc);
1605	mps_unlock(sc);
1606}
1607
1608/* Periodic watchdog.  Is called with the driver lock already held. */
1609static void
1610mps_periodic(void *arg)
1611{
1612	struct mps_softc *sc;
1613	uint32_t db;
1614
1615	sc = (struct mps_softc *)arg;
1616	if (sc->mps_flags & MPS_FLAGS_SHUTDOWN)
1617		return;
1618
1619	db = mps_regread(sc, MPI2_DOORBELL_OFFSET);
1620	if ((db & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) {
1621		mps_dprint(sc, MPS_FAULT, "IOC Fault 0x%08x, Resetting\n", db);
1622		mps_reinit(sc);
1623	}
1624
1625	callout_reset(&sc->periodic, MPS_PERIODIC_DELAY * hz, mps_periodic, sc);
1626}
1627
1628static void
1629mps_log_evt_handler(struct mps_softc *sc, uintptr_t data,
1630    MPI2_EVENT_NOTIFICATION_REPLY *event)
1631{
1632	MPI2_EVENT_DATA_LOG_ENTRY_ADDED *entry;
1633
1634	MPS_DPRINT_EVENT(sc, generic, event);
1635
1636	switch (event->Event) {
1637	case MPI2_EVENT_LOG_DATA:
1638		mps_dprint(sc, MPS_EVENT, "MPI2_EVENT_LOG_DATA:\n");
1639		if (sc->mps_debug & MPS_EVENT)
1640			hexdump(event->EventData, event->EventDataLength, NULL, 0);
1641		break;
1642	case MPI2_EVENT_LOG_ENTRY_ADDED:
1643		entry = (MPI2_EVENT_DATA_LOG_ENTRY_ADDED *)event->EventData;
1644		mps_dprint(sc, MPS_EVENT, "MPI2_EVENT_LOG_ENTRY_ADDED event "
1645		    "0x%x Sequence %d:\n", entry->LogEntryQualifier,
1646		     entry->LogSequence);
1647		break;
1648	default:
1649		break;
1650	}
1651	return;
1652}
1653
1654static int
1655mps_attach_log(struct mps_softc *sc)
1656{
1657	u32 events[MPI2_EVENT_NOTIFY_EVENTMASK_WORDS];
1658
1659	bzero(events, 16);
1660	setbit(events, MPI2_EVENT_LOG_DATA);
1661	setbit(events, MPI2_EVENT_LOG_ENTRY_ADDED);
1662
1663	mps_register_events(sc, events, mps_log_evt_handler, NULL,
1664	    &sc->mps_log_eh);
1665
1666	return (0);
1667}
1668
1669static int
1670mps_detach_log(struct mps_softc *sc)
1671{
1672
1673	if (sc->mps_log_eh != NULL)
1674		mps_deregister_events(sc, sc->mps_log_eh);
1675	return (0);
1676}
1677
1678/*
1679 * Free all of the driver resources and detach submodules.  Should be called
1680 * without the lock held.
1681 */
1682int
1683mps_free(struct mps_softc *sc)
1684{
1685	int error;
1686
1687	/* Turn off the watchdog */
1688	mps_lock(sc);
1689	sc->mps_flags |= MPS_FLAGS_SHUTDOWN;
1690	mps_unlock(sc);
1691	/* Lock must not be held for this */
1692	callout_drain(&sc->periodic);
1693	callout_drain(&sc->device_check_callout);
1694
1695	if (((error = mps_detach_log(sc)) != 0) ||
1696	    ((error = mps_detach_sas(sc)) != 0))
1697		return (error);
1698
1699	mps_detach_user(sc);
1700
1701	/* Put the IOC back in the READY state. */
1702	mps_lock(sc);
1703	if ((error = mps_transition_ready(sc)) != 0) {
1704		mps_unlock(sc);
1705		return (error);
1706	}
1707	mps_unlock(sc);
1708
1709	if (sc->facts != NULL)
1710		free(sc->facts, M_MPT2);
1711
1712	/*
1713	 * Free all buffers that are based on IOC Facts.  A Diag Reset may need
1714	 * to free these buffers too.
1715	 */
1716	mps_iocfacts_free(sc);
1717
1718	if (sc->sysctl_tree != NULL)
1719		sysctl_ctx_free(&sc->sysctl_ctx);
1720
1721	/* Deregister the shutdown function */
1722	if (sc->shutdown_eh != NULL)
1723		EVENTHANDLER_DEREGISTER(shutdown_final, sc->shutdown_eh);
1724
1725	mtx_destroy(&sc->mps_mtx);
1726
1727	return (0);
1728}
1729
1730static __inline void
1731mps_complete_command(struct mps_softc *sc, struct mps_command *cm)
1732{
1733	MPS_FUNCTRACE(sc);
1734
1735	if (cm == NULL) {
1736		mps_dprint(sc, MPS_ERROR, "Completing NULL command\n");
1737		return;
1738	}
1739
1740	if (cm->cm_flags & MPS_CM_FLAGS_POLLED)
1741		cm->cm_flags |= MPS_CM_FLAGS_COMPLETE;
1742
1743	if (cm->cm_complete != NULL) {
1744		mps_dprint(sc, MPS_TRACE,
1745			   "%s cm %p calling cm_complete %p data %p reply %p\n",
1746			   __func__, cm, cm->cm_complete, cm->cm_complete_data,
1747			   cm->cm_reply);
1748		cm->cm_complete(sc, cm);
1749	}
1750
1751	if (cm->cm_flags & MPS_CM_FLAGS_WAKEUP) {
1752		mps_dprint(sc, MPS_TRACE, "waking up %p\n", cm);
1753		wakeup(cm);
1754	}
1755
1756	if (cm->cm_sc->io_cmds_active != 0) {
1757		cm->cm_sc->io_cmds_active--;
1758	} else {
1759		mps_dprint(sc, MPS_ERROR, "Warning: io_cmds_active is "
1760		    "out of sync - resynching to 0\n");
1761	}
1762}
1763
1764
1765static void
1766mps_sas_log_info(struct mps_softc *sc , u32 log_info)
1767{
1768	union loginfo_type {
1769		u32     loginfo;
1770		struct {
1771			u32     subcode:16;
1772			u32     code:8;
1773			u32     originator:4;
1774			u32     bus_type:4;
1775		} dw;
1776	};
1777	union loginfo_type sas_loginfo;
1778	char *originator_str = NULL;
1779
1780	sas_loginfo.loginfo = log_info;
1781	if (sas_loginfo.dw.bus_type != 3 /*SAS*/)
1782		return;
1783
1784	/* each nexus loss loginfo */
1785	if (log_info == 0x31170000)
1786		return;
1787
1788	/* eat the loginfos associated with task aborts */
1789	if ((log_info == 30050000 || log_info ==
1790	    0x31140000 || log_info == 0x31130000))
1791		return;
1792
1793	switch (sas_loginfo.dw.originator) {
1794	case 0:
1795		originator_str = "IOP";
1796		break;
1797	case 1:
1798		originator_str = "PL";
1799		break;
1800	case 2:
1801		originator_str = "IR";
1802		break;
1803}
1804
1805	mps_dprint(sc, MPS_LOG, "log_info(0x%08x): originator(%s), "
1806	"code(0x%02x), sub_code(0x%04x)\n", log_info,
1807	originator_str, sas_loginfo.dw.code,
1808	sas_loginfo.dw.subcode);
1809}
1810
1811static void
1812mps_display_reply_info(struct mps_softc *sc, uint8_t *reply)
1813{
1814	MPI2DefaultReply_t *mpi_reply;
1815	u16 sc_status;
1816
1817	mpi_reply = (MPI2DefaultReply_t*)reply;
1818	sc_status = le16toh(mpi_reply->IOCStatus);
1819	if (sc_status & MPI2_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE)
1820		mps_sas_log_info(sc, le32toh(mpi_reply->IOCLogInfo));
1821}
1822void
1823mps_intr(void *data)
1824{
1825	struct mps_softc *sc;
1826	uint32_t status;
1827
1828	sc = (struct mps_softc *)data;
1829	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
1830
1831	/*
1832	 * Check interrupt status register to flush the bus.  This is
1833	 * needed for both INTx interrupts and driver-driven polling
1834	 */
1835	status = mps_regread(sc, MPI2_HOST_INTERRUPT_STATUS_OFFSET);
1836	if ((status & MPI2_HIS_REPLY_DESCRIPTOR_INTERRUPT) == 0)
1837		return;
1838
1839	mps_lock(sc);
1840	mps_intr_locked(data);
1841	mps_unlock(sc);
1842	return;
1843}
1844
1845/*
1846 * In theory, MSI/MSIX interrupts shouldn't need to read any registers on the
1847 * chip.  Hopefully this theory is correct.
1848 */
1849void
1850mps_intr_msi(void *data)
1851{
1852	struct mps_softc *sc;
1853
1854	sc = (struct mps_softc *)data;
1855	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
1856	mps_lock(sc);
1857	mps_intr_locked(data);
1858	mps_unlock(sc);
1859	return;
1860}
1861
1862/*
1863 * The locking is overly broad and simplistic, but easy to deal with for now.
1864 */
1865void
1866mps_intr_locked(void *data)
1867{
1868	MPI2_REPLY_DESCRIPTORS_UNION *desc;
1869	struct mps_softc *sc;
1870	struct mps_command *cm = NULL;
1871	uint8_t flags;
1872	u_int pq;
1873	MPI2_DIAG_RELEASE_REPLY *rel_rep;
1874	mps_fw_diagnostic_buffer_t *pBuffer;
1875
1876	sc = (struct mps_softc *)data;
1877
1878	pq = sc->replypostindex;
1879	mps_dprint(sc, MPS_TRACE,
1880	    "%s sc %p starting with replypostindex %u\n",
1881	    __func__, sc, sc->replypostindex);
1882
1883	for ( ;; ) {
1884		cm = NULL;
1885		desc = &sc->post_queue[sc->replypostindex];
1886		flags = desc->Default.ReplyFlags &
1887		    MPI2_RPY_DESCRIPT_FLAGS_TYPE_MASK;
1888		if ((flags == MPI2_RPY_DESCRIPT_FLAGS_UNUSED)
1889		 || (le32toh(desc->Words.High) == 0xffffffff))
1890			break;
1891
1892		/* increment the replypostindex now, so that event handlers
1893		 * and cm completion handlers which decide to do a diag
1894		 * reset can zero it without it getting incremented again
1895		 * afterwards, and we break out of this loop on the next
1896		 * iteration since the reply post queue has been cleared to
1897		 * 0xFF and all descriptors look unused (which they are).
1898		 */
1899		if (++sc->replypostindex >= sc->pqdepth)
1900			sc->replypostindex = 0;
1901
1902		switch (flags) {
1903		case MPI2_RPY_DESCRIPT_FLAGS_SCSI_IO_SUCCESS:
1904			cm = &sc->commands[le16toh(desc->SCSIIOSuccess.SMID)];
1905			cm->cm_reply = NULL;
1906			break;
1907		case MPI2_RPY_DESCRIPT_FLAGS_ADDRESS_REPLY:
1908		{
1909			uint32_t baddr;
1910			uint8_t *reply;
1911
1912			/*
1913			 * Re-compose the reply address from the address
1914			 * sent back from the chip.  The ReplyFrameAddress
1915			 * is the lower 32 bits of the physical address of
1916			 * particular reply frame.  Convert that address to
1917			 * host format, and then use that to provide the
1918			 * offset against the virtual address base
1919			 * (sc->reply_frames).
1920			 */
1921			baddr = le32toh(desc->AddressReply.ReplyFrameAddress);
1922			reply = sc->reply_frames +
1923				(baddr - ((uint32_t)sc->reply_busaddr));
1924			/*
1925			 * Make sure the reply we got back is in a valid
1926			 * range.  If not, go ahead and panic here, since
1927			 * we'll probably panic as soon as we deference the
1928			 * reply pointer anyway.
1929			 */
1930			if ((reply < sc->reply_frames)
1931			 || (reply > (sc->reply_frames +
1932			     (sc->fqdepth * sc->facts->ReplyFrameSize * 4)))) {
1933				printf("%s: WARNING: reply %p out of range!\n",
1934				       __func__, reply);
1935				printf("%s: reply_frames %p, fqdepth %d, "
1936				       "frame size %d\n", __func__,
1937				       sc->reply_frames, sc->fqdepth,
1938				       sc->facts->ReplyFrameSize * 4);
1939				printf("%s: baddr %#x,\n", __func__, baddr);
1940				/* LSI-TODO. See Linux Code. Need Graceful exit*/
1941				panic("Reply address out of range");
1942			}
1943			if (le16toh(desc->AddressReply.SMID) == 0) {
1944				if (((MPI2_DEFAULT_REPLY *)reply)->Function ==
1945				    MPI2_FUNCTION_DIAG_BUFFER_POST) {
1946					/*
1947					 * If SMID is 0 for Diag Buffer Post,
1948					 * this implies that the reply is due to
1949					 * a release function with a status that
1950					 * the buffer has been released.  Set
1951					 * the buffer flags accordingly.
1952					 */
1953					rel_rep =
1954					    (MPI2_DIAG_RELEASE_REPLY *)reply;
1955					if ((le16toh(rel_rep->IOCStatus) &
1956					    MPI2_IOCSTATUS_MASK) ==
1957					    MPI2_IOCSTATUS_DIAGNOSTIC_RELEASED)
1958					{
1959						pBuffer =
1960						    &sc->fw_diag_buffer_list[
1961						    rel_rep->BufferType];
1962						pBuffer->valid_data = TRUE;
1963						pBuffer->owned_by_firmware =
1964						    FALSE;
1965						pBuffer->immediate = FALSE;
1966					}
1967				} else
1968					mps_dispatch_event(sc, baddr,
1969					    (MPI2_EVENT_NOTIFICATION_REPLY *)
1970					    reply);
1971			} else {
1972				cm = &sc->commands[le16toh(desc->AddressReply.SMID)];
1973				cm->cm_reply = reply;
1974				cm->cm_reply_data =
1975				    le32toh(desc->AddressReply.ReplyFrameAddress);
1976			}
1977			break;
1978		}
1979		case MPI2_RPY_DESCRIPT_FLAGS_TARGETASSIST_SUCCESS:
1980		case MPI2_RPY_DESCRIPT_FLAGS_TARGET_COMMAND_BUFFER:
1981		case MPI2_RPY_DESCRIPT_FLAGS_RAID_ACCELERATOR_SUCCESS:
1982		default:
1983			/* Unhandled */
1984			mps_dprint(sc, MPS_ERROR, "Unhandled reply 0x%x\n",
1985			    desc->Default.ReplyFlags);
1986			cm = NULL;
1987			break;
1988		}
1989
1990
1991		if (cm != NULL) {
1992			// Print Error reply frame
1993			if (cm->cm_reply)
1994				mps_display_reply_info(sc,cm->cm_reply);
1995			mps_complete_command(sc, cm);
1996		}
1997
1998		desc->Words.Low = 0xffffffff;
1999		desc->Words.High = 0xffffffff;
2000	}
2001
2002	if (pq != sc->replypostindex) {
2003		mps_dprint(sc, MPS_TRACE,
2004		    "%s sc %p writing postindex %d\n",
2005		    __func__, sc, sc->replypostindex);
2006		mps_regwrite(sc, MPI2_REPLY_POST_HOST_INDEX_OFFSET, sc->replypostindex);
2007	}
2008
2009	return;
2010}
2011
2012static void
2013mps_dispatch_event(struct mps_softc *sc, uintptr_t data,
2014    MPI2_EVENT_NOTIFICATION_REPLY *reply)
2015{
2016	struct mps_event_handle *eh;
2017	int event, handled = 0;
2018
2019	event = le16toh(reply->Event);
2020	TAILQ_FOREACH(eh, &sc->event_list, eh_list) {
2021		if (isset(eh->mask, event)) {
2022			eh->callback(sc, data, reply);
2023			handled++;
2024		}
2025	}
2026
2027	if (handled == 0)
2028		mps_dprint(sc, MPS_EVENT, "Unhandled event 0x%x\n", le16toh(event));
2029
2030	/*
2031	 * This is the only place that the event/reply should be freed.
2032	 * Anything wanting to hold onto the event data should have
2033	 * already copied it into their own storage.
2034	 */
2035	mps_free_reply(sc, data);
2036}
2037
2038static void
2039mps_reregister_events_complete(struct mps_softc *sc, struct mps_command *cm)
2040{
2041	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
2042
2043	if (cm->cm_reply)
2044		MPS_DPRINT_EVENT(sc, generic,
2045			(MPI2_EVENT_NOTIFICATION_REPLY *)cm->cm_reply);
2046
2047	mps_free_command(sc, cm);
2048
2049	/* next, send a port enable */
2050	mpssas_startup(sc);
2051}
2052
2053/*
2054 * For both register_events and update_events, the caller supplies a bitmap
2055 * of events that it _wants_.  These functions then turn that into a bitmask
2056 * suitable for the controller.
2057 */
2058int
2059mps_register_events(struct mps_softc *sc, u32 *mask,
2060    mps_evt_callback_t *cb, void *data, struct mps_event_handle **handle)
2061{
2062	struct mps_event_handle *eh;
2063	int error = 0;
2064
2065	eh = malloc(sizeof(struct mps_event_handle), M_MPT2, M_WAITOK|M_ZERO);
2066	if(!eh) {
2067		device_printf(sc->mps_dev, "Cannot allocate memory %s %d\n",
2068		 __func__, __LINE__);
2069		return (ENOMEM);
2070	}
2071	eh->callback = cb;
2072	eh->data = data;
2073	TAILQ_INSERT_TAIL(&sc->event_list, eh, eh_list);
2074	if (mask != NULL)
2075		error = mps_update_events(sc, eh, mask);
2076	*handle = eh;
2077
2078	return (error);
2079}
2080
2081int
2082mps_update_events(struct mps_softc *sc, struct mps_event_handle *handle,
2083    u32 *mask)
2084{
2085	MPI2_EVENT_NOTIFICATION_REQUEST *evtreq;
2086	MPI2_EVENT_NOTIFICATION_REPLY *reply = NULL;
2087	struct mps_command *cm;
2088	int error, i;
2089
2090	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
2091
2092	if ((mask != NULL) && (handle != NULL))
2093		bcopy(mask, &handle->mask[0], sizeof(u32) *
2094				MPI2_EVENT_NOTIFY_EVENTMASK_WORDS);
2095
2096	for (i = 0; i < MPI2_EVENT_NOTIFY_EVENTMASK_WORDS; i++)
2097		sc->event_mask[i] = -1;
2098
2099	for (i = 0; i < MPI2_EVENT_NOTIFY_EVENTMASK_WORDS; i++)
2100		sc->event_mask[i] &= ~handle->mask[i];
2101
2102
2103	if ((cm = mps_alloc_command(sc)) == NULL)
2104		return (EBUSY);
2105	evtreq = (MPI2_EVENT_NOTIFICATION_REQUEST *)cm->cm_req;
2106	evtreq->Function = MPI2_FUNCTION_EVENT_NOTIFICATION;
2107	evtreq->MsgFlags = 0;
2108	evtreq->SASBroadcastPrimitiveMasks = 0;
2109#ifdef MPS_DEBUG_ALL_EVENTS
2110	{
2111		u_char fullmask[16];
2112		memset(fullmask, 0x00, 16);
2113		bcopy(fullmask, &evtreq->EventMasks[0], sizeof(u32) *
2114				MPI2_EVENT_NOTIFY_EVENTMASK_WORDS);
2115	}
2116#else
2117        for (i = 0; i < MPI2_EVENT_NOTIFY_EVENTMASK_WORDS; i++)
2118                evtreq->EventMasks[i] =
2119                    htole32(sc->event_mask[i]);
2120#endif
2121	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
2122	cm->cm_data = NULL;
2123
2124	error = mps_wait_command(sc, &cm, 60, 0);
2125	if (cm != NULL)
2126		reply = (MPI2_EVENT_NOTIFICATION_REPLY *)cm->cm_reply;
2127	if ((reply == NULL) ||
2128	    (reply->IOCStatus & MPI2_IOCSTATUS_MASK) != MPI2_IOCSTATUS_SUCCESS)
2129		error = ENXIO;
2130
2131	if (reply)
2132		MPS_DPRINT_EVENT(sc, generic, reply);
2133
2134	mps_dprint(sc, MPS_TRACE, "%s finished error %d\n", __func__, error);
2135
2136	if (cm != NULL)
2137		mps_free_command(sc, cm);
2138	return (error);
2139}
2140
2141static int
2142mps_reregister_events(struct mps_softc *sc)
2143{
2144	MPI2_EVENT_NOTIFICATION_REQUEST *evtreq;
2145	struct mps_command *cm;
2146	struct mps_event_handle *eh;
2147	int error, i;
2148
2149	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
2150
2151	/* first, reregister events */
2152
2153	for (i = 0; i < MPI2_EVENT_NOTIFY_EVENTMASK_WORDS; i++)
2154		sc->event_mask[i] = -1;
2155
2156	TAILQ_FOREACH(eh, &sc->event_list, eh_list) {
2157		for (i = 0; i < MPI2_EVENT_NOTIFY_EVENTMASK_WORDS; i++)
2158			sc->event_mask[i] &= ~eh->mask[i];
2159	}
2160
2161	if ((cm = mps_alloc_command(sc)) == NULL)
2162		return (EBUSY);
2163	evtreq = (MPI2_EVENT_NOTIFICATION_REQUEST *)cm->cm_req;
2164	evtreq->Function = MPI2_FUNCTION_EVENT_NOTIFICATION;
2165	evtreq->MsgFlags = 0;
2166	evtreq->SASBroadcastPrimitiveMasks = 0;
2167#ifdef MPS_DEBUG_ALL_EVENTS
2168	{
2169		u_char fullmask[16];
2170		memset(fullmask, 0x00, 16);
2171		bcopy(fullmask, &evtreq->EventMasks[0], sizeof(u32) *
2172			MPI2_EVENT_NOTIFY_EVENTMASK_WORDS);
2173	}
2174#else
2175        for (i = 0; i < MPI2_EVENT_NOTIFY_EVENTMASK_WORDS; i++)
2176                evtreq->EventMasks[i] =
2177                    htole32(sc->event_mask[i]);
2178#endif
2179	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
2180	cm->cm_data = NULL;
2181	cm->cm_complete = mps_reregister_events_complete;
2182
2183	error = mps_map_command(sc, cm);
2184
2185	mps_dprint(sc, MPS_TRACE, "%s finished with error %d\n", __func__,
2186	    error);
2187	return (error);
2188}
2189
2190void
2191mps_deregister_events(struct mps_softc *sc, struct mps_event_handle *handle)
2192{
2193
2194	TAILQ_REMOVE(&sc->event_list, handle, eh_list);
2195	free(handle, M_MPT2);
2196}
2197
2198/*
2199 * Add a chain element as the next SGE for the specified command.
2200 * Reset cm_sge and cm_sgesize to indicate all the available space.
2201 */
2202static int
2203mps_add_chain(struct mps_command *cm)
2204{
2205	MPI2_SGE_CHAIN32 *sgc;
2206	struct mps_chain *chain;
2207	int space;
2208
2209	if (cm->cm_sglsize < MPS_SGC_SIZE)
2210		panic("MPS: Need SGE Error Code\n");
2211
2212	chain = mps_alloc_chain(cm->cm_sc);
2213	if (chain == NULL)
2214		return (ENOBUFS);
2215
2216	space = (int)cm->cm_sc->facts->IOCRequestFrameSize * 4;
2217
2218	/*
2219	 * Note: a double-linked list is used to make it easier to
2220	 * walk for debugging.
2221	 */
2222	TAILQ_INSERT_TAIL(&cm->cm_chain_list, chain, chain_link);
2223
2224	sgc = (MPI2_SGE_CHAIN32 *)&cm->cm_sge->MpiChain;
2225	sgc->Length = htole16(space);
2226	sgc->NextChainOffset = 0;
2227	/* TODO Looks like bug in Setting sgc->Flags.
2228	 *	sgc->Flags = ( MPI2_SGE_FLAGS_CHAIN_ELEMENT | MPI2_SGE_FLAGS_64_BIT_ADDRESSING |
2229	 *	            MPI2_SGE_FLAGS_SYSTEM_ADDRESS) << MPI2_SGE_FLAGS_SHIFT
2230	 *	This is fine.. because we are not using simple element. In case of
2231	 *	MPI2_SGE_CHAIN32, we have separate Length and Flags feild.
2232 	 */
2233	sgc->Flags = MPI2_SGE_FLAGS_CHAIN_ELEMENT;
2234	sgc->Address = htole32(chain->chain_busaddr);
2235
2236	cm->cm_sge = (MPI2_SGE_IO_UNION *)&chain->chain->MpiSimple;
2237	cm->cm_sglsize = space;
2238	return (0);
2239}
2240
2241/*
2242 * Add one scatter-gather element (chain, simple, transaction context)
2243 * to the scatter-gather list for a command.  Maintain cm_sglsize and
2244 * cm_sge as the remaining size and pointer to the next SGE to fill
2245 * in, respectively.
2246 */
2247int
2248mps_push_sge(struct mps_command *cm, void *sgep, size_t len, int segsleft)
2249{
2250	MPI2_SGE_TRANSACTION_UNION *tc = sgep;
2251	MPI2_SGE_SIMPLE64 *sge = sgep;
2252	int error, type;
2253	uint32_t saved_buf_len, saved_address_low, saved_address_high;
2254
2255	type = (tc->Flags & MPI2_SGE_FLAGS_ELEMENT_MASK);
2256
2257#ifdef INVARIANTS
2258	switch (type) {
2259	case MPI2_SGE_FLAGS_TRANSACTION_ELEMENT: {
2260		if (len != tc->DetailsLength + 4)
2261			panic("TC %p length %u or %zu?", tc,
2262			    tc->DetailsLength + 4, len);
2263		}
2264		break;
2265	case MPI2_SGE_FLAGS_CHAIN_ELEMENT:
2266		/* Driver only uses 32-bit chain elements */
2267		if (len != MPS_SGC_SIZE)
2268			panic("CHAIN %p length %u or %zu?", sgep,
2269			    MPS_SGC_SIZE, len);
2270		break;
2271	case MPI2_SGE_FLAGS_SIMPLE_ELEMENT:
2272		/* Driver only uses 64-bit SGE simple elements */
2273		if (len != MPS_SGE64_SIZE)
2274			panic("SGE simple %p length %u or %zu?", sge,
2275			    MPS_SGE64_SIZE, len);
2276		if (((le32toh(sge->FlagsLength) >> MPI2_SGE_FLAGS_SHIFT) &
2277		    MPI2_SGE_FLAGS_ADDRESS_SIZE) == 0)
2278			panic("SGE simple %p not marked 64-bit?", sge);
2279
2280		break;
2281	default:
2282		panic("Unexpected SGE %p, flags %02x", tc, tc->Flags);
2283	}
2284#endif
2285
2286	/*
2287	 * case 1: 1 more segment, enough room for it
2288	 * case 2: 2 more segments, enough room for both
2289	 * case 3: >=2 more segments, only enough room for 1 and a chain
2290	 * case 4: >=1 more segment, enough room for only a chain
2291	 * case 5: >=1 more segment, no room for anything (error)
2292         */
2293
2294	/*
2295	 * There should be room for at least a chain element, or this
2296	 * code is buggy.  Case (5).
2297	 */
2298	if (cm->cm_sglsize < MPS_SGC_SIZE)
2299		panic("MPS: Need SGE Error Code\n");
2300
2301	if (segsleft >= 2 &&
2302	    cm->cm_sglsize < len + MPS_SGC_SIZE + MPS_SGE64_SIZE) {
2303		/*
2304		 * There are 2 or more segments left to add, and only
2305		 * enough room for 1 and a chain.  Case (3).
2306		 *
2307		 * Mark as last element in this chain if necessary.
2308		 */
2309		if (type == MPI2_SGE_FLAGS_SIMPLE_ELEMENT) {
2310			sge->FlagsLength |= htole32(
2311			    MPI2_SGE_FLAGS_LAST_ELEMENT << MPI2_SGE_FLAGS_SHIFT);
2312		}
2313
2314		/*
2315		 * Add the item then a chain.  Do the chain now,
2316		 * rather than on the next iteration, to simplify
2317		 * understanding the code.
2318		 */
2319		cm->cm_sglsize -= len;
2320		bcopy(sgep, cm->cm_sge, len);
2321		cm->cm_sge = (MPI2_SGE_IO_UNION *)((uintptr_t)cm->cm_sge + len);
2322		return (mps_add_chain(cm));
2323	}
2324
2325	if (segsleft >= 1 && cm->cm_sglsize < len + MPS_SGC_SIZE) {
2326		/*
2327		 * 1 or more segment, enough room for only a chain.
2328		 * Hope the previous element wasn't a Simple entry
2329		 * that needed to be marked with
2330		 * MPI2_SGE_FLAGS_LAST_ELEMENT.  Case (4).
2331		 */
2332		if ((error = mps_add_chain(cm)) != 0)
2333			return (error);
2334	}
2335
2336#ifdef INVARIANTS
2337	/* Case 1: 1 more segment, enough room for it. */
2338	if (segsleft == 1 && cm->cm_sglsize < len)
2339		panic("1 seg left and no room? %u versus %zu",
2340		    cm->cm_sglsize, len);
2341
2342	/* Case 2: 2 more segments, enough room for both */
2343	if (segsleft == 2 && cm->cm_sglsize < len + MPS_SGE64_SIZE)
2344		panic("2 segs left and no room? %u versus %zu",
2345		    cm->cm_sglsize, len);
2346#endif
2347
2348	if (segsleft == 1 && type == MPI2_SGE_FLAGS_SIMPLE_ELEMENT) {
2349		/*
2350		 * If this is a bi-directional request, need to account for that
2351		 * here.  Save the pre-filled sge values.  These will be used
2352		 * either for the 2nd SGL or for a single direction SGL.  If
2353		 * cm_out_len is non-zero, this is a bi-directional request, so
2354		 * fill in the OUT SGL first, then the IN SGL, otherwise just
2355		 * fill in the IN SGL.  Note that at this time, when filling in
2356		 * 2 SGL's for a bi-directional request, they both use the same
2357		 * DMA buffer (same cm command).
2358		 */
2359		saved_buf_len = le32toh(sge->FlagsLength) & 0x00FFFFFF;
2360		saved_address_low = sge->Address.Low;
2361		saved_address_high = sge->Address.High;
2362		if (cm->cm_out_len) {
2363			sge->FlagsLength = htole32(cm->cm_out_len |
2364			    ((uint32_t)(MPI2_SGE_FLAGS_SIMPLE_ELEMENT |
2365			    MPI2_SGE_FLAGS_END_OF_BUFFER |
2366			    MPI2_SGE_FLAGS_HOST_TO_IOC |
2367			    MPI2_SGE_FLAGS_64_BIT_ADDRESSING) <<
2368			    MPI2_SGE_FLAGS_SHIFT));
2369			cm->cm_sglsize -= len;
2370			bcopy(sgep, cm->cm_sge, len);
2371			cm->cm_sge = (MPI2_SGE_IO_UNION *)((uintptr_t)cm->cm_sge
2372			    + len);
2373		}
2374		saved_buf_len |=
2375		    ((uint32_t)(MPI2_SGE_FLAGS_SIMPLE_ELEMENT |
2376		    MPI2_SGE_FLAGS_END_OF_BUFFER |
2377		    MPI2_SGE_FLAGS_LAST_ELEMENT |
2378		    MPI2_SGE_FLAGS_END_OF_LIST |
2379		    MPI2_SGE_FLAGS_64_BIT_ADDRESSING) <<
2380		    MPI2_SGE_FLAGS_SHIFT);
2381		if (cm->cm_flags & MPS_CM_FLAGS_DATAIN) {
2382			saved_buf_len |=
2383			    ((uint32_t)(MPI2_SGE_FLAGS_IOC_TO_HOST) <<
2384			    MPI2_SGE_FLAGS_SHIFT);
2385		} else {
2386			saved_buf_len |=
2387			    ((uint32_t)(MPI2_SGE_FLAGS_HOST_TO_IOC) <<
2388			    MPI2_SGE_FLAGS_SHIFT);
2389		}
2390		sge->FlagsLength = htole32(saved_buf_len);
2391		sge->Address.Low = saved_address_low;
2392		sge->Address.High = saved_address_high;
2393	}
2394
2395	cm->cm_sglsize -= len;
2396	bcopy(sgep, cm->cm_sge, len);
2397	cm->cm_sge = (MPI2_SGE_IO_UNION *)((uintptr_t)cm->cm_sge + len);
2398	return (0);
2399}
2400
2401/*
2402 * Add one dma segment to the scatter-gather list for a command.
2403 */
2404int
2405mps_add_dmaseg(struct mps_command *cm, vm_paddr_t pa, size_t len, u_int flags,
2406    int segsleft)
2407{
2408	MPI2_SGE_SIMPLE64 sge;
2409
2410	/*
2411	 * This driver always uses 64-bit address elements for simplicity.
2412	 */
2413	bzero(&sge, sizeof(sge));
2414	flags |= MPI2_SGE_FLAGS_SIMPLE_ELEMENT |
2415	    MPI2_SGE_FLAGS_64_BIT_ADDRESSING;
2416	sge.FlagsLength = htole32(len | (flags << MPI2_SGE_FLAGS_SHIFT));
2417	mps_from_u64(pa, &sge.Address);
2418
2419	return (mps_push_sge(cm, &sge, sizeof sge, segsleft));
2420}
2421
2422static void
2423mps_data_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
2424{
2425	struct mps_softc *sc;
2426	struct mps_command *cm;
2427	u_int i, dir, sflags;
2428
2429	cm = (struct mps_command *)arg;
2430	sc = cm->cm_sc;
2431
2432	/*
2433	 * In this case, just print out a warning and let the chip tell the
2434	 * user they did the wrong thing.
2435	 */
2436	if ((cm->cm_max_segs != 0) && (nsegs > cm->cm_max_segs)) {
2437		mps_dprint(sc, MPS_ERROR,
2438			   "%s: warning: busdma returned %d segments, "
2439			   "more than the %d allowed\n", __func__, nsegs,
2440			   cm->cm_max_segs);
2441	}
2442
2443	/*
2444	 * Set up DMA direction flags.  Bi-directional requests are also handled
2445	 * here.  In that case, both direction flags will be set.
2446	 */
2447	sflags = 0;
2448	if (cm->cm_flags & MPS_CM_FLAGS_SMP_PASS) {
2449		/*
2450		 * We have to add a special case for SMP passthrough, there
2451		 * is no easy way to generically handle it.  The first
2452		 * S/G element is used for the command (therefore the
2453		 * direction bit needs to be set).  The second one is used
2454		 * for the reply.  We'll leave it to the caller to make
2455		 * sure we only have two buffers.
2456		 */
2457		/*
2458		 * Even though the busdma man page says it doesn't make
2459		 * sense to have both direction flags, it does in this case.
2460		 * We have one s/g element being accessed in each direction.
2461		 */
2462		dir = BUS_DMASYNC_PREWRITE | BUS_DMASYNC_PREREAD;
2463
2464		/*
2465		 * Set the direction flag on the first buffer in the SMP
2466		 * passthrough request.  We'll clear it for the second one.
2467		 */
2468		sflags |= MPI2_SGE_FLAGS_DIRECTION |
2469			  MPI2_SGE_FLAGS_END_OF_BUFFER;
2470	} else if (cm->cm_flags & MPS_CM_FLAGS_DATAOUT) {
2471		sflags |= MPI2_SGE_FLAGS_HOST_TO_IOC;
2472		dir = BUS_DMASYNC_PREWRITE;
2473	} else
2474		dir = BUS_DMASYNC_PREREAD;
2475
2476	for (i = 0; i < nsegs; i++) {
2477		if ((cm->cm_flags & MPS_CM_FLAGS_SMP_PASS) && (i != 0)) {
2478			sflags &= ~MPI2_SGE_FLAGS_DIRECTION;
2479		}
2480		error = mps_add_dmaseg(cm, segs[i].ds_addr, segs[i].ds_len,
2481		    sflags, nsegs - i);
2482		if (error != 0) {
2483			/* Resource shortage, roll back! */
2484			if (ratecheck(&sc->lastfail, &mps_chainfail_interval))
2485				mps_dprint(sc, MPS_INFO, "Out of chain frames, "
2486				    "consider increasing hw.mps.max_chains.\n");
2487			cm->cm_flags |= MPS_CM_FLAGS_CHAIN_FAILED;
2488			mps_complete_command(sc, cm);
2489			return;
2490		}
2491	}
2492
2493	bus_dmamap_sync(sc->buffer_dmat, cm->cm_dmamap, dir);
2494	mps_enqueue_request(sc, cm);
2495
2496	return;
2497}
2498
2499static void
2500mps_data_cb2(void *arg, bus_dma_segment_t *segs, int nsegs, bus_size_t mapsize,
2501	     int error)
2502{
2503	mps_data_cb(arg, segs, nsegs, error);
2504}
2505
2506/*
2507 * This is the routine to enqueue commands ansynchronously.
2508 * Note that the only error path here is from bus_dmamap_load(), which can
2509 * return EINPROGRESS if it is waiting for resources.  Other than this, it's
2510 * assumed that if you have a command in-hand, then you have enough credits
2511 * to use it.
2512 */
2513int
2514mps_map_command(struct mps_softc *sc, struct mps_command *cm)
2515{
2516	int error = 0;
2517
2518	if (cm->cm_flags & MPS_CM_FLAGS_USE_UIO) {
2519		error = bus_dmamap_load_uio(sc->buffer_dmat, cm->cm_dmamap,
2520		    &cm->cm_uio, mps_data_cb2, cm, 0);
2521	} else if (cm->cm_flags & MPS_CM_FLAGS_USE_CCB) {
2522		error = bus_dmamap_load_ccb(sc->buffer_dmat, cm->cm_dmamap,
2523		    cm->cm_data, mps_data_cb, cm, 0);
2524	} else if ((cm->cm_data != NULL) && (cm->cm_length != 0)) {
2525		error = bus_dmamap_load(sc->buffer_dmat, cm->cm_dmamap,
2526		    cm->cm_data, cm->cm_length, mps_data_cb, cm, 0);
2527	} else {
2528		/* Add a zero-length element as needed */
2529		if (cm->cm_sge != NULL)
2530			mps_add_dmaseg(cm, 0, 0, 0, 1);
2531		mps_enqueue_request(sc, cm);
2532	}
2533
2534	return (error);
2535}
2536
2537/*
2538 * This is the routine to enqueue commands synchronously.  An error of
2539 * EINPROGRESS from mps_map_command() is ignored since the command will
2540 * be executed and enqueued automatically.  Other errors come from msleep().
2541 */
2542int
2543mps_wait_command(struct mps_softc *sc, struct mps_command **cmp, int timeout,
2544    int sleep_flag)
2545{
2546	int error, rc;
2547	struct timeval cur_time, start_time;
2548	struct mps_command *cm = *cmp;
2549
2550	if (sc->mps_flags & MPS_FLAGS_DIAGRESET)
2551		return  EBUSY;
2552
2553	cm->cm_complete = NULL;
2554	cm->cm_flags |= MPS_CM_FLAGS_POLLED;
2555	error = mps_map_command(sc, cm);
2556	if ((error != 0) && (error != EINPROGRESS))
2557		return (error);
2558
2559	/*
2560	 * Check for context and wait for 50 mSec at a time until time has
2561	 * expired or the command has finished.  If msleep can't be used, need
2562	 * to poll.
2563	 */
2564	if (curthread->td_no_sleeping != 0)
2565		sleep_flag = NO_SLEEP;
2566	getmicrouptime(&start_time);
2567	if (mtx_owned(&sc->mps_mtx) && sleep_flag == CAN_SLEEP) {
2568		cm->cm_flags |= MPS_CM_FLAGS_WAKEUP;
2569		error = msleep(cm, &sc->mps_mtx, 0, "mpswait", timeout*hz);
2570		if (error == EWOULDBLOCK) {
2571			/*
2572			 * Record the actual elapsed time in the case of a
2573			 * timeout for the message below.
2574			 */
2575			getmicrouptime(&cur_time);
2576			timevalsub(&cur_time, &start_time);
2577		}
2578	} else {
2579		while ((cm->cm_flags & MPS_CM_FLAGS_COMPLETE) == 0) {
2580			mps_intr_locked(sc);
2581			if (sleep_flag == CAN_SLEEP)
2582				pause("mpswait", hz/20);
2583			else
2584				DELAY(50000);
2585
2586			getmicrouptime(&cur_time);
2587			timevalsub(&cur_time, &start_time);
2588			if (cur_time.tv_sec > timeout) {
2589				error = EWOULDBLOCK;
2590				break;
2591			}
2592		}
2593	}
2594
2595	if (error == EWOULDBLOCK) {
2596		mps_dprint(sc, MPS_FAULT, "Calling Reinit from %s, timeout=%d,"
2597		    " elapsed=%jd\n", __func__, timeout,
2598		    (intmax_t)cur_time.tv_sec);
2599		rc = mps_reinit(sc);
2600		mps_dprint(sc, MPS_FAULT, "Reinit %s\n", (rc == 0) ? "success" :
2601		    "failed");
2602		if (sc->mps_flags & MPS_FLAGS_REALLOCATED) {
2603			/*
2604			 * Tell the caller that we freed the command in a
2605			 * reinit.
2606			 */
2607			*cmp = NULL;
2608		}
2609		error = ETIMEDOUT;
2610	}
2611	return (error);
2612}
2613
2614/*
2615 * The MPT driver had a verbose interface for config pages.  In this driver,
2616 * reduce it to much simpler terms, similar to the Linux driver.
2617 */
2618int
2619mps_read_config_page(struct mps_softc *sc, struct mps_config_params *params)
2620{
2621	MPI2_CONFIG_REQUEST *req;
2622	struct mps_command *cm;
2623	int error;
2624
2625	if (sc->mps_flags & MPS_FLAGS_BUSY) {
2626		return (EBUSY);
2627	}
2628
2629	cm = mps_alloc_command(sc);
2630	if (cm == NULL) {
2631		return (EBUSY);
2632	}
2633
2634	req = (MPI2_CONFIG_REQUEST *)cm->cm_req;
2635	req->Function = MPI2_FUNCTION_CONFIG;
2636	req->Action = params->action;
2637	req->SGLFlags = 0;
2638	req->ChainOffset = 0;
2639	req->PageAddress = params->page_address;
2640	if (params->hdr.Struct.PageType == MPI2_CONFIG_PAGETYPE_EXTENDED) {
2641		MPI2_CONFIG_EXTENDED_PAGE_HEADER *hdr;
2642
2643		hdr = &params->hdr.Ext;
2644		req->ExtPageType = hdr->ExtPageType;
2645		req->ExtPageLength = hdr->ExtPageLength;
2646		req->Header.PageType = MPI2_CONFIG_PAGETYPE_EXTENDED;
2647		req->Header.PageLength = 0; /* Must be set to zero */
2648		req->Header.PageNumber = hdr->PageNumber;
2649		req->Header.PageVersion = hdr->PageVersion;
2650	} else {
2651		MPI2_CONFIG_PAGE_HEADER *hdr;
2652
2653		hdr = &params->hdr.Struct;
2654		req->Header.PageType = hdr->PageType;
2655		req->Header.PageNumber = hdr->PageNumber;
2656		req->Header.PageLength = hdr->PageLength;
2657		req->Header.PageVersion = hdr->PageVersion;
2658	}
2659
2660	cm->cm_data = params->buffer;
2661	cm->cm_length = params->length;
2662	if (cm->cm_data != NULL) {
2663		cm->cm_sge = &req->PageBufferSGE;
2664		cm->cm_sglsize = sizeof(MPI2_SGE_IO_UNION);
2665		cm->cm_flags = MPS_CM_FLAGS_SGE_SIMPLE | MPS_CM_FLAGS_DATAIN;
2666	} else
2667		cm->cm_sge = NULL;
2668	cm->cm_desc.Default.RequestFlags = MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE;
2669
2670	cm->cm_complete_data = params;
2671	if (params->callback != NULL) {
2672		cm->cm_complete = mps_config_complete;
2673		return (mps_map_command(sc, cm));
2674	} else {
2675		error = mps_wait_command(sc, &cm, 0, CAN_SLEEP);
2676		if (error) {
2677			mps_dprint(sc, MPS_FAULT,
2678			    "Error %d reading config page\n", error);
2679			if (cm != NULL)
2680				mps_free_command(sc, cm);
2681			return (error);
2682		}
2683		mps_config_complete(sc, cm);
2684	}
2685
2686	return (0);
2687}
2688
2689int
2690mps_write_config_page(struct mps_softc *sc, struct mps_config_params *params)
2691{
2692	return (EINVAL);
2693}
2694
2695static void
2696mps_config_complete(struct mps_softc *sc, struct mps_command *cm)
2697{
2698	MPI2_CONFIG_REPLY *reply;
2699	struct mps_config_params *params;
2700
2701	MPS_FUNCTRACE(sc);
2702	params = cm->cm_complete_data;
2703
2704	if (cm->cm_data != NULL) {
2705		bus_dmamap_sync(sc->buffer_dmat, cm->cm_dmamap,
2706		    BUS_DMASYNC_POSTREAD);
2707		bus_dmamap_unload(sc->buffer_dmat, cm->cm_dmamap);
2708	}
2709
2710	/*
2711	 * XXX KDM need to do more error recovery?  This results in the
2712	 * device in question not getting probed.
2713	 */
2714	if ((cm->cm_flags & MPS_CM_FLAGS_ERROR_MASK) != 0) {
2715		params->status = MPI2_IOCSTATUS_BUSY;
2716		goto done;
2717	}
2718
2719	reply = (MPI2_CONFIG_REPLY *)cm->cm_reply;
2720	if (reply == NULL) {
2721		params->status = MPI2_IOCSTATUS_BUSY;
2722		goto done;
2723	}
2724	params->status = reply->IOCStatus;
2725	if (params->hdr.Struct.PageType == MPI2_CONFIG_PAGETYPE_EXTENDED) {
2726		params->hdr.Ext.ExtPageType = reply->ExtPageType;
2727		params->hdr.Ext.ExtPageLength = reply->ExtPageLength;
2728		params->hdr.Ext.PageType = reply->Header.PageType;
2729		params->hdr.Ext.PageNumber = reply->Header.PageNumber;
2730		params->hdr.Ext.PageVersion = reply->Header.PageVersion;
2731	} else {
2732		params->hdr.Struct.PageType = reply->Header.PageType;
2733		params->hdr.Struct.PageNumber = reply->Header.PageNumber;
2734		params->hdr.Struct.PageLength = reply->Header.PageLength;
2735		params->hdr.Struct.PageVersion = reply->Header.PageVersion;
2736	}
2737
2738done:
2739	mps_free_command(sc, cm);
2740	if (params->callback != NULL)
2741		params->callback(sc, params);
2742
2743	return;
2744}
2745