/usr/src/sys/dev/pci/mpii.c

Bug Summary

File:	dev/pci/mpii.c
Warning:	line 821, column 16 Access to field 'sg_flags' results in a dereference of an undefined pointer value (loaded from variable 'sge')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name mpii.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/dev/pci/mpii.c
1/*	$OpenBSD: mpii.c,v 1.147 2023/11/29 06:54:09 jmatthew Exp $	*/
2/*
* Copyright (c) 2010, 2012 Mike Belopuhov
* Copyright (c) 2009 James Giannoules
* Copyright (c) 2005 - 2010 David Gwynne <dlg@openbsd.org>
* Copyright (c) 2005 - 2010 Marco Peereboom <marco@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

21#include "bio.h"

23#include <sys/param.h>
24#include <sys/systm.h>
25#include <sys/device.h>
26#include <sys/ioctl.h>
27#include <sys/malloc.h>
28#include <sys/kernel.h>
29#include <sys/rwlock.h>
30#include <sys/sensors.h>
31#include <sys/dkio.h>
32#include <sys/tree.h>
33#include <sys/task.h>

35#include <machine/bus.h>

37#include <dev/pci/pcireg.h>
38#include <dev/pci/pcivar.h>
39#include <dev/pci/pcidevs.h>

41#include <scsi/scsi_all.h>
42#include <scsi/scsiconf.h>

44#include <dev/biovar.h>

46#include <dev/pci/mpiireg.h>

48/* #define MPII_DEBUG */
49#ifdef MPII_DEBUG
50#define DPRINTF(x...)		do { if (mpii_debug) printf(x); } while(0)
51#define DNPRINTF(n,x...)	do { if (mpii_debug & (n)) printf(x); } while(0)
52#define	MPII_D_CMD		(0x0001)
53#define	MPII_D_INTR		(0x0002)
54#define	MPII_D_MISC		(0x0004)
55#define	MPII_D_DMA		(0x0008)
56#define	MPII_D_IOCTL		(0x0010)
57#define	MPII_D_RW		(0x0020)
58#define	MPII_D_MEM		(0x0040)
59#define	MPII_D_CCB		(0x0080)
60#define	MPII_D_PPR		(0x0100)
61#define	MPII_D_RAID		(0x0200)
62#define	MPII_D_EVT		(0x0400)
63#define MPII_D_CFG		(0x0800)
64#define MPII_D_MAP		(0x1000)

66u_int32_t  mpii_debug = 0
| MPII_D_CMD
| MPII_D_INTR
| MPII_D_MISC
| MPII_D_DMA
| MPII_D_IOCTL
| MPII_D_RW
| MPII_D_MEM
| MPII_D_CCB
| MPII_D_PPR
| MPII_D_RAID
| MPII_D_EVT
| MPII_D_CFG
| MPII_D_MAP
;
81#else
82#define DPRINTF(x...)
83#define DNPRINTF(n,x...)
84#endif

86#define MPII_REQUEST_SIZE(512)		(512)
87#define MPII_REQUEST_CREDIT(128)		(128)

89struct mpii_dmamem {
bus_dmamap_t		mdm_map;
bus_dma_segment_t	mdm_seg;
size_t			mdm_size;
caddr_t			mdm_kva;
94};
95#define MPII_DMA_MAP(_mdm)((_mdm)->mdm_map) ((_mdm)->mdm_map)
96#define MPII_DMA_DVA(_mdm)((u_int64_t)(_mdm)->mdm_map->dm_segs[0].ds_addr) ((u_int64_t)(_mdm)->mdm_map->dm_segs[0].ds_addr)
97#define MPII_DMA_KVA(_mdm)((void *)(_mdm)->mdm_kva) ((void *)(_mdm)->mdm_kva)

99struct mpii_softc;

101struct mpii_rcb {
SIMPLEQ_ENTRY(mpii_rcb)struct { struct mpii_rcb *sqe_next; }	rcb_link;
void			*rcb_reply;
u_int32_t		rcb_reply_dva;
105};

107SIMPLEQ_HEAD(mpii_rcb_list, mpii_rcb)struct mpii_rcb_list { struct mpii_rcb *sqh_first; struct mpii_rcb
 **sqh_last; };

109struct mpii_device {
int			flags;
111#define MPII_DF_ATTACH(0x0001)		(0x0001)
112#define MPII_DF_DETACH(0x0002)		(0x0002)
113#define MPII_DF_HIDDEN(0x0004)		(0x0004)
114#define MPII_DF_UNUSED(0x0008)		(0x0008)
115#define MPII_DF_VOLUME(0x0010)		(0x0010)
116#define MPII_DF_VOLUME_DISK(0x0020)	(0x0020)
117#define MPII_DF_HOT_SPARE(0x0040)	(0x0040)
short			slot;
short			percent;
u_int16_t		dev_handle;
u_int16_t		enclosure;
u_int16_t		expander;
u_int8_t		phy_num;
u_int8_t		physical_port;
125};

127struct mpii_ccb {
struct mpii_softc	*ccb_sc;

void *			ccb_cookie;
bus_dmamap_t		ccb_dmamap;

bus_addr_t		ccb_offset;
void			*ccb_cmd;
bus_addr_t		ccb_cmd_dva;
u_int16_t		ccb_dev_handle;
u_int16_t		ccb_smid;

volatile enum {
MPII_CCB_FREE,
MPII_CCB_READY,
MPII_CCB_QUEUED,
MPII_CCB_TIMEOUT
}			ccb_state;

void			(*ccb_done)(struct mpii_ccb *);
struct mpii_rcb		*ccb_rcb;

SIMPLEQ_ENTRY(mpii_ccb)struct { struct mpii_ccb *sqe_next; }	ccb_link;
150};

152SIMPLEQ_HEAD(mpii_ccb_list, mpii_ccb)struct mpii_ccb_list { struct mpii_ccb *sqh_first; struct mpii_ccb
 **sqh_last; };

154struct mpii_softc {
struct device		sc_dev;

pci_chipset_tag_t	sc_pc;
pcitag_t		sc_tag;

void			*sc_ih;

int			sc_flags;
163#define MPII_F_RAID(1<<1)		(1<<1)
164#define MPII_F_SAS3(1<<2)		(1<<2)
165#define MPII_F_AERO(1<<3)		(1<<3)

struct scsibus_softc	*sc_scsibus;
unsigned int		sc_pending;

struct mpii_device	**sc_devs;

bus_space_tag_t		sc_iot;
bus_space_handle_t	sc_ioh;
bus_size_t		sc_ios;
bus_dma_tag_t		sc_dmat;

struct mutex		sc_req_mtx;
struct mutex		sc_rep_mtx;

ushort			sc_reply_size;
ushort			sc_request_size;

ushort			sc_max_cmds;
ushort			sc_num_reply_frames;
u_int			sc_reply_free_qdepth;
u_int			sc_reply_post_qdepth;

ushort			sc_chain_sge;
ushort			sc_max_sgl;
int			sc_max_chain;

u_int8_t		sc_ioc_event_replay;

u_int8_t		sc_porttype;
u_int8_t		sc_max_volumes;
u_int16_t		sc_max_devices;
u_int16_t		sc_vd_count;
u_int16_t		sc_vd_id_low;
u_int16_t		sc_pd_id_start;
int			sc_ioc_number;
u_int8_t		sc_vf_id;

struct mpii_ccb		*sc_ccbs;
struct mpii_ccb_list	sc_ccb_free;
struct mutex		sc_ccb_free_mtx;

struct mutex		sc_ccb_mtx;
		/*
		 * this protects the ccb state and list entry
		 * between mpii_scsi_cmd and scsidone.
		 */

struct mpii_ccb_list	sc_ccb_tmos;
struct scsi_iohandler	sc_ccb_tmo_handler;

struct scsi_iopool	sc_iopool;

struct mpii_dmamem	*sc_requests;

struct mpii_dmamem	*sc_replies;
struct mpii_rcb		*sc_rcbs;

struct mpii_dmamem	*sc_reply_postq;
struct mpii_reply_descr	*sc_reply_postq_kva;
u_int			sc_reply_post_host_index;

struct mpii_dmamem	*sc_reply_freeq;
u_int			sc_reply_free_host_index;

struct mpii_rcb_list	sc_evt_sas_queue;
struct mutex		sc_evt_sas_mtx;
struct task		sc_evt_sas_task;

struct mpii_rcb_list	sc_evt_ack_queue;
struct mutex		sc_evt_ack_mtx;
struct scsi_iohandler	sc_evt_ack_handler;

/* scsi ioctl from sd device */
int			(*sc_ioctl)(struct device *, u_long, caddr_t);

int			sc_nsensors;
struct ksensor		*sc_sensors;
struct ksensordev	sc_sensordev;
244};

246int	mpii_match(struct device *, void *, void *);
247void	mpii_attach(struct device *, struct device *, void *);
248int	mpii_detach(struct device *, int);

250int	mpii_intr(void *);

252const struct cfattach mpii_ca = {
sizeof(struct mpii_softc),
mpii_match,
mpii_attach,
mpii_detach
257};

259struct cfdriver mpii_cd = {
NULL((void *)0),
"mpii",
DV_DULL
263};

265void		mpii_scsi_cmd(struct scsi_xfer *);
266void		mpii_scsi_cmd_done(struct mpii_ccb *);
267int		mpii_scsi_probe(struct scsi_link *);
268int		mpii_scsi_ioctl(struct scsi_link *, u_long, caddr_t, int);

270const struct scsi_adapter mpii_switch = {
mpii_scsi_cmd, NULL((void *)0), mpii_scsi_probe, NULL((void *)0), mpii_scsi_ioctl
272};

274struct mpii_dmamem *
mpii_dmamem_alloc(struct mpii_softc *, size_t);
276void		mpii_dmamem_free(struct mpii_softc *,
    struct mpii_dmamem *);
278int		mpii_alloc_ccbs(struct mpii_softc *);
279void *		mpii_get_ccb(void *);
280void		mpii_put_ccb(void *, void *);
281int		mpii_alloc_replies(struct mpii_softc *);
282int		mpii_alloc_queues(struct mpii_softc *);
283void		mpii_push_reply(struct mpii_softc *, struct mpii_rcb *);
284void		mpii_push_replies(struct mpii_softc *);

286void		mpii_scsi_cmd_tmo(void *);
287void		mpii_scsi_cmd_tmo_handler(void *, void *);
288void		mpii_scsi_cmd_tmo_done(struct mpii_ccb *);

290int		mpii_insert_dev(struct mpii_softc *, struct mpii_device *);
291int		mpii_remove_dev(struct mpii_softc *, struct mpii_device *);
292struct mpii_device *
mpii_find_dev(struct mpii_softc *, u_int16_t);

295void		mpii_start(struct mpii_softc *, struct mpii_ccb *);
296int		mpii_poll(struct mpii_softc *, struct mpii_ccb *);
297void		mpii_poll_done(struct mpii_ccb *);
298struct mpii_rcb *
mpii_reply(struct mpii_softc *, struct mpii_reply_descr *);

301void		mpii_wait(struct mpii_softc *, struct mpii_ccb *);
302void		mpii_wait_done(struct mpii_ccb *);

304void		mpii_init_queues(struct mpii_softc *);

306int		mpii_load_xs(struct mpii_ccb *);
307int		mpii_load_xs_sas3(struct mpii_ccb *);

309u_int32_t	mpii_read(struct mpii_softc *, bus_size_t);
310void		mpii_write(struct mpii_softc *, bus_size_t, u_int32_t);
311int		mpii_wait_eq(struct mpii_softc *, bus_size_t, u_int32_t,
    u_int32_t);
313int		mpii_wait_ne(struct mpii_softc *, bus_size_t, u_int32_t,
    u_int32_t);

316int		mpii_init(struct mpii_softc *);
317int		mpii_reset_soft(struct mpii_softc *);
318int		mpii_reset_hard(struct mpii_softc *);

320int		mpii_handshake_send(struct mpii_softc *, void *, size_t);
321int		mpii_handshake_recv_dword(struct mpii_softc *,
    u_int32_t *);
323int		mpii_handshake_recv(struct mpii_softc *, void *, size_t);

325void		mpii_empty_done(struct mpii_ccb *);

327int		mpii_iocinit(struct mpii_softc *);
328int		mpii_iocfacts(struct mpii_softc *);
329int		mpii_portfacts(struct mpii_softc *);
330int		mpii_portenable(struct mpii_softc *);
331int		mpii_cfg_coalescing(struct mpii_softc *);
332int		mpii_board_info(struct mpii_softc *);
333int		mpii_target_map(struct mpii_softc *);

335int		mpii_eventnotify(struct mpii_softc *);
336void		mpii_eventnotify_done(struct mpii_ccb *);
337void		mpii_eventack(void *, void *);
338void		mpii_eventack_done(struct mpii_ccb *);
339void		mpii_event_process(struct mpii_softc *, struct mpii_rcb *);
340void		mpii_event_done(struct mpii_softc *, struct mpii_rcb *);
341void		mpii_event_sas(void *);
342void		mpii_event_raid(struct mpii_softc *,
    struct mpii_msg_event_reply *);
344void		mpii_event_discovery(struct mpii_softc *,
    struct mpii_msg_event_reply *);

347void		mpii_sas_remove_device(struct mpii_softc *, u_int16_t);

349int		mpii_req_cfg_header(struct mpii_softc *, u_int8_t,
    u_int8_t, u_int32_t, int, void *);
351int		mpii_req_cfg_page(struct mpii_softc *, u_int32_t, int,
    void *, int, void *, size_t);

354int		mpii_ioctl_cache(struct scsi_link *, u_long, struct dk_cache *);

356#if NBIO1 > 0
357int		mpii_ioctl(struct device *, u_long, caddr_t);
358int		mpii_ioctl_inq(struct mpii_softc *, struct bioc_inq *);
359int		mpii_ioctl_vol(struct mpii_softc *, struct bioc_vol *);
360int		mpii_ioctl_disk(struct mpii_softc *, struct bioc_disk *);
361int		mpii_bio_hs(struct mpii_softc *, struct bioc_disk *, int,
    int, int *);
363int		mpii_bio_disk(struct mpii_softc *, struct bioc_disk *,
    u_int8_t);
365struct mpii_device *
mpii_find_vol(struct mpii_softc *, int);
367#ifndef SMALL_KERNEL
int		mpii_bio_volstate(struct mpii_softc *, struct bioc_vol *);
369int		mpii_create_sensors(struct mpii_softc *);
370void		mpii_refresh_sensors(void *);
371#endif /* SMALL_KERNEL */
372#endif /* NBIO > 0 */

374#define DEVNAME(s)((s)->sc_dev.dv_xname)		((s)->sc_dev.dv_xname)

376#define dwordsof(s)(sizeof(s) / sizeof(u_int32_t))		(sizeof(s) / sizeof(u_int32_t))

378#define mpii_read_db(s)mpii_read((s), (0x00))		mpii_read((s), MPII_DOORBELL(0x00))
379#define mpii_write_db(s, v)mpii_write((s), (0x00), (v))	mpii_write((s), MPII_DOORBELL(0x00), (v))
380#define mpii_read_intr(s)mpii_read((s), (0x30))	mpii_read((s), MPII_INTR_STATUS(0x30))
381#define mpii_write_intr(s, v)mpii_write((s), (0x30), (v))	mpii_write((s), MPII_INTR_STATUS(0x30), (v))
382#define mpii_reply_waiting(s)((mpii_read(((s)), (0x30)) & (1<<3)) == (1<<3
))	((mpii_read_intr((s))mpii_read(((s)), (0x30)) & MPII_INTR_STATUS_REPLY(1<<3))\
		    == MPII_INTR_STATUS_REPLY(1<<3))

385#define mpii_write_reply_free(s, v)(((s)->sc_iot)->write_4(((s)->sc_ioh), ((0x48)), ((v
)))) \
  bus_space_write_4((s)->sc_iot, (s)->sc_ioh, \(((s)->sc_iot)->write_4(((s)->sc_ioh), ((0x48)), ((v
))))
  MPII_REPLY_FREE_HOST_INDEX, (v))(((s)->sc_iot)->write_4(((s)->sc_ioh), ((0x48)), ((v
))))
388#define mpii_write_reply_post(s, v)(((s)->sc_iot)->write_4(((s)->sc_ioh), ((0x6c)), ((v
)))) \
  bus_space_write_4((s)->sc_iot, (s)->sc_ioh, \(((s)->sc_iot)->write_4(((s)->sc_ioh), ((0x6c)), ((v
))))
  MPII_REPLY_POST_HOST_INDEX, (v))(((s)->sc_iot)->write_4(((s)->sc_ioh), ((0x6c)), ((v
))))

392#define mpii_wait_db_int(s)mpii_wait_ne((s), (0x30), (1<<0), 0)	mpii_wait_ne((s), MPII_INTR_STATUS(0x30), \
		    MPII_INTR_STATUS_IOC2SYSDB(1<<0), 0)
394#define mpii_wait_db_ack(s)mpii_wait_eq((s), (0x30), (1<<31), 0)	mpii_wait_eq((s), MPII_INTR_STATUS(0x30), \
		    MPII_INTR_STATUS_SYS2IOCDB(1<<31), 0)

397static inline void
398mpii_dvatosge(struct mpii_sge *sge, u_int64_t dva)
399{
htolem32(&sge->sg_addr_lo, dva)(*(__uint32_t *)(&sge->sg_addr_lo) = ((__uint32_t)(dva
)));
htolem32(&sge->sg_addr_hi, dva >> 32)(*(__uint32_t *)(&sge->sg_addr_hi) = ((__uint32_t)(dva
 >> 32)));
402}

404#define MPII_PG_EXTENDED(1<<0)	(1<<0)
405#define MPII_PG_POLL(1<<1)		(1<<1)
406#define MPII_PG_FMT"\020" "\002POLL" "\001EXTENDED"		"\020" "\002POLL" "\001EXTENDED"

408static const struct pci_matchid mpii_devices[] = {
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS20040x0070 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS20080x0072 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SSS62000x007e },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2108_30x0074 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2108_40x0076 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2108_50x0077 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2116_10x0064 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2116_20x0065 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2208_10x0080 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2208_20x0081 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2208_30x0082 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2208_40x0083 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2208_50x0084 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2208_60x0085 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2308_10x0086 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2308_20x0087 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS2308_30x006e },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS30040x0096 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS30080x0097 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS3108_10x0090 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS3108_20x0091 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS3108_30x0094 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS3108_40x0095 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS34080x00af },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS34160x00ac },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS35080x00ad },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS3508_10x00ae },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS35160x00aa },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS3516_10x00ab },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS38XX0x00e5 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS38XX_10x00e6 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS39XX0x00e1 },
{ PCI_VENDOR_SYMBIOS0x1000,	PCI_PRODUCT_SYMBIOS_SAS39XX_10x00e2 },
442};

444int
445mpii_match(struct device *parent, void *match, void *aux)
446{
return (pci_matchbyid(aux, mpii_devices, nitems(mpii_devices)(sizeof((mpii_devices)) / sizeof((mpii_devices)[0]))));
448}

450void
451mpii_attach(struct device *parent, struct device *self, void *aux)
452{
struct mpii_softc		*sc = (struct mpii_softc *)self;
struct pci_attach_args		*pa = aux;
pcireg_t			memtype;
int				r;
pci_intr_handle_t		ih;
struct scsibus_attach_args	saa;
struct mpii_ccb			*ccb;

sc->sc_pc = pa->pa_pc;
sc->sc_tag = pa->pa_tag;
sc->sc_dmat = pa->pa_dmat;

mtx_init(&sc->sc_req_mtx, IPL_BIO)do { (void)(((void *)0)); (void)(0); __mtx_init((&sc->
sc_req_mtx), ((((0x3)) > 0x0 && ((0x3)) < 0x9) ?
 0x9 : ((0x3)))); } while (0);
mtx_init(&sc->sc_rep_mtx, IPL_BIO)do { (void)(((void *)0)); (void)(0); __mtx_init((&sc->
sc_rep_mtx), ((((0x3)) > 0x0 && ((0x3)) < 0x9) ?
 0x9 : ((0x3)))); } while (0);

/* find the appropriate memory base */
for (r = PCI_MAPREG_START0x10; r < PCI_MAPREG_END0x28; r += sizeof(memtype)) {
memtype = pci_mapreg_type(sc->sc_pc, sc->sc_tag, r);
if ((memtype & PCI_MAPREG_TYPE_MASK0x00000001) == PCI_MAPREG_TYPE_MEM0x00000000)
	break;
}
if (r >= PCI_MAPREG_END0x28) {
printf(": unable to locate system interface registers\n");
return;
}

if (pci_mapreg_map(pa, r, memtype, 0, &sc->sc_iot, &sc->sc_ioh,
   NULL((void *)0), &sc->sc_ios, 0xFF) != 0) {
printf(": unable to map system interface registers\n");
return;
}

/* disable the expansion rom */
pci_conf_write(sc->sc_pc, sc->sc_tag, PCI_ROM_REG0x30,
   pci_conf_read(sc->sc_pc, sc->sc_tag, PCI_ROM_REG0x30) &
   ~PCI_ROM_ENABLE0x00000001);

/* disable interrupts */
mpii_write(sc, MPII_INTR_MASK(0x34),
   MPII_INTR_MASK_RESET(1<<30) | MPII_INTR_MASK_REPLY(1<<3) |
   MPII_INTR_MASK_DOORBELL(1<<0));

/* hook up the interrupt */
if (pci_intr_map_msi(pa, &ih) != 0 && pci_intr_map(pa, &ih) != 0) {
printf(": unable to map interrupt\n");
goto unmap;
}
printf(": %s\n", pci_intr_string(sc->sc_pc, ih));

switch (PCI_PRODUCT(pa->pa_id)(((pa->pa_id) >> 16) & 0xffff)) {
case PCI_PRODUCT_SYMBIOS_SAS38XX0x00e5:
case PCI_PRODUCT_SYMBIOS_SAS38XX_10x00e6:
case PCI_PRODUCT_SYMBIOS_SAS39XX0x00e1:
case PCI_PRODUCT_SYMBIOS_SAS39XX_10x00e2:
SET(sc->sc_flags, MPII_F_AERO)((sc->sc_flags) |= ((1<<3)));
break;
}

if (mpii_iocfacts(sc) != 0) {
printf("%s: unable to get iocfacts\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto unmap;
}

if (mpii_init(sc) != 0) {
printf("%s: unable to initialize ioc\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto unmap;
}

if (mpii_alloc_ccbs(sc) != 0) {
/* error already printed */
goto unmap;
}

if (mpii_alloc_replies(sc) != 0) {
printf("%s: unable to allocated reply space\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_ccbs;
}

if (mpii_alloc_queues(sc) != 0) {
printf("%s: unable to allocate reply queues\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_replies;
}

if (mpii_iocinit(sc) != 0) {
printf("%s: unable to send iocinit\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_queues;
}

if (mpii_wait_eq(sc, MPII_DOORBELL(0x00), MPII_DOORBELL_STATE(0xf<<28),
   MPII_DOORBELL_STATE_OPER(0x2<<28)) != 0) {
printf("%s: state: 0x%08x\n", DEVNAME(sc)((sc)->sc_dev.dv_xname),
	mpii_read_db(sc)mpii_read((sc), (0x00)) & MPII_DOORBELL_STATE(0xf<<28));
printf("%s: operational state timeout\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_queues;
}

mpii_push_replies(sc);
mpii_init_queues(sc);

if (mpii_board_info(sc) != 0) {
printf("%s: unable to get manufacturing page 0\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_queues;
}

if (mpii_portfacts(sc) != 0) {
printf("%s: unable to get portfacts\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_queues;
}

if (mpii_target_map(sc) != 0) {
printf("%s: unable to setup target mappings\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_queues;
}

if (mpii_cfg_coalescing(sc) != 0) {
printf("%s: unable to configure coalescing\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_queues;
}

/* XXX bail on unsupported porttype? */
if ((sc->sc_porttype == MPII_PORTFACTS_PORTTYPE_SAS_PHYSICAL(0x30)) ||
   (sc->sc_porttype == MPII_PORTFACTS_PORTTYPE_SAS_VIRTUAL(0x31)) ||
   (sc->sc_porttype == MPII_PORTFACTS_PORTTYPE_TRI_MODE(0x40))) {
if (mpii_eventnotify(sc) != 0) {
	printf("%s: unable to enable events\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
	goto free_queues;
}
}

sc->sc_devs = mallocarray(sc->sc_max_devices,
   sizeof(struct mpii_device *), M_DEVBUF2, M_NOWAIT0x0002 | M_ZERO0x0008);
if (sc->sc_devs == NULL((void *)0)) {
printf("%s: unable to allocate memory for mpii_device\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_queues;
}

if (mpii_portenable(sc) != 0) {
printf("%s: unable to enable port\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_devs;
}

sc->sc_ih = pci_intr_establish(sc->sc_pc, ih, IPL_BIO0x3,
   mpii_intr, sc, sc->sc_dev.dv_xname);
if (sc->sc_ih == NULL((void *)0))
goto free_devs;

/* force autoconf to wait for the first sas discovery to complete */
sc->sc_pending = 1;
config_pending_incr();

saa.saa_adapter = &mpii_switch;
saa.saa_adapter_softc = sc;
saa.saa_adapter_target = SDEV_NO_ADAPTER_TARGET0xffff;
saa.saa_adapter_buswidth = sc->sc_max_devices;
saa.saa_luns = 1;
saa.saa_openings = sc->sc_max_cmds - 1;
saa.saa_pool = &sc->sc_iopool;
saa.saa_quirks = saa.saa_flags = 0;
saa.saa_wwpn = saa.saa_wwnn = 0;

sc->sc_scsibus = (struct scsibus_softc *) config_found(&sc->sc_dev,config_found_sm((&sc->sc_dev), (&saa), (scsiprint)
, ((void *)0))
   &saa, scsiprint)config_found_sm((&sc->sc_dev), (&saa), (scsiprint)
, ((void *)0));

/* enable interrupts */
mpii_write(sc, MPII_INTR_MASK(0x34), MPII_INTR_MASK_DOORBELL(1<<0)
   | MPII_INTR_MASK_RESET(1<<30));

622#if NBIO1 > 0
if (ISSET(sc->sc_flags, MPII_F_RAID)((sc->sc_flags) & ((1<<1)))) {
if (bio_register(&sc->sc_dev, mpii_ioctl) != 0)
	panic("%s: controller registration failed",
	    DEVNAME(sc)((sc)->sc_dev.dv_xname));
else
	sc->sc_ioctl = mpii_ioctl;

630#ifndef SMALL_KERNEL
if (mpii_create_sensors(sc) != 0)
	printf("%s: unable to create sensors\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
633#endif
}
635#endif

return;

639free_devs:
free(sc->sc_devs, M_DEVBUF2, 0);
sc->sc_devs = NULL((void *)0);

643free_queues:
bus_dmamap_sync(sc->sc_dmat, MPII_DMA_MAP(sc->sc_reply_freeq),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_freeq)->mdm_map)), (0), (sc->sc_reply_free_qdepth
 * 4), (0x02))
   0, sc->sc_reply_free_qdepth * 4, BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_freeq)->mdm_map)), (0), (sc->sc_reply_free_qdepth
 * 4), (0x02));
mpii_dmamem_free(sc, sc->sc_reply_freeq);

bus_dmamap_sync(sc->sc_dmat, MPII_DMA_MAP(sc->sc_reply_postq),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (0), (sc->sc_reply_post_qdepth
 * 8), (0x02))
   0, sc->sc_reply_post_qdepth * 8, BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (0), (sc->sc_reply_post_qdepth
 * 8), (0x02));
mpii_dmamem_free(sc, sc->sc_reply_postq);

652free_replies:
bus_dmamap_sync(sc->sc_dmat, MPII_DMA_MAP(sc->sc_replies),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (0), ((1 << 12)), (0x02))
0, PAGE_SIZE, BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (0), ((1 << 12)), (0x02));
mpii_dmamem_free(sc, sc->sc_replies);

657free_ccbs:
while ((ccb = mpii_get_ccb(sc)) != NULL((void *)0))
bus_dmamap_destroy(sc->sc_dmat, ccb->ccb_dmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (ccb
->ccb_dmamap));
mpii_dmamem_free(sc, sc->sc_requests);
free(sc->sc_ccbs, M_DEVBUF2, 0);

663unmap:
bus_space_unmap(sc->sc_iot, sc->sc_ioh, sc->sc_ios);
sc->sc_ios = 0;
666}

668int
669mpii_detach(struct device *self, int flags)
670{
struct mpii_softc		*sc = (struct mpii_softc *)self;

if (sc->sc_ih != NULL((void *)0)) {
pci_intr_disestablish(sc->sc_pc, sc->sc_ih);
sc->sc_ih = NULL((void *)0);
}
if (sc->sc_ios != 0) {
bus_space_unmap(sc->sc_iot, sc->sc_ioh, sc->sc_ios);
sc->sc_ios = 0;
}

return (0);
683}

685int
686mpii_intr(void *arg)
687{
struct mpii_rcb_list		evts = SIMPLEQ_HEAD_INITIALIZER(evts){ ((void *)0), &(evts).sqh_first };
struct mpii_ccb_list		ccbs = SIMPLEQ_HEAD_INITIALIZER(ccbs){ ((void *)0), &(ccbs).sqh_first };
struct mpii_softc		*sc = arg;
struct mpii_reply_descr		*postq = sc->sc_reply_postq_kva, *rdp;
struct mpii_ccb			*ccb;
struct mpii_rcb			*rcb;
int				smid;
u_int				idx;
int				rv = 0;

mtx_enter(&sc->sc_rep_mtx);
bus_dmamap_sync(sc->sc_dmat,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (0), (sc->sc_reply_post_qdepth
 * sizeof(*rdp)), (0x02 | 0x08))
   MPII_DMA_MAP(sc->sc_reply_postq),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (0), (sc->sc_reply_post_qdepth
 * sizeof(*rdp)), (0x02 | 0x08))
   0, sc->sc_reply_post_qdepth * sizeof(*rdp),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (0), (sc->sc_reply_post_qdepth
 * sizeof(*rdp)), (0x02 | 0x08))
   BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (0), (sc->sc_reply_post_qdepth
 * sizeof(*rdp)), (0x02 | 0x08));

idx = sc->sc_reply_post_host_index;
for (;;) {
rdp = &postq[idx];
if ((rdp->reply_flags & MPII_REPLY_DESCR_TYPE_MASK(0x0f)) ==
    MPII_REPLY_DESCR_UNUSED(0x0f))
	break;
if (rdp->data == 0xffffffff) {
	/*
	 * ioc is still writing to the reply post queue
	 * race condition - bail!
	 */
	break;
}

smid = lemtoh16(&rdp->smid)((__uint16_t)(*(__uint16_t *)(&rdp->smid)));
rcb = mpii_reply(sc, rdp);

if (smid) {
	ccb = &sc->sc_ccbs[smid - 1];
	ccb->ccb_state = MPII_CCB_READY;
	ccb->ccb_rcb = rcb;
	SIMPLEQ_INSERT_TAIL(&ccbs, ccb, ccb_link)do { (ccb)->ccb_link.sqe_next = ((void *)0); *(&ccbs)->
sqh_last = (ccb); (&ccbs)->sqh_last = &(ccb)->ccb_link
.sqe_next; } while (0);
} else
	SIMPLEQ_INSERT_TAIL(&evts, rcb, rcb_link)do { (rcb)->rcb_link.sqe_next = ((void *)0); *(&evts)->
sqh_last = (rcb); (&evts)->sqh_last = &(rcb)->rcb_link
.sqe_next; } while (0);

if (++idx >= sc->sc_reply_post_qdepth)
	idx = 0;

rv = 1;
}

bus_dmamap_sync(sc->sc_dmat,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (0), (sc->sc_reply_post_qdepth
 * sizeof(*rdp)), (0x01 | 0x04))
   MPII_DMA_MAP(sc->sc_reply_postq),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (0), (sc->sc_reply_post_qdepth
 * sizeof(*rdp)), (0x01 | 0x04))
   0, sc->sc_reply_post_qdepth * sizeof(*rdp),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (0), (sc->sc_reply_post_qdepth
 * sizeof(*rdp)), (0x01 | 0x04))
   BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (0), (sc->sc_reply_post_qdepth
 * sizeof(*rdp)), (0x01 | 0x04));

if (rv)
mpii_write_reply_post(sc, sc->sc_reply_post_host_index = idx)(((sc)->sc_iot)->write_4(((sc)->sc_ioh), ((0x6c)), (
(sc->sc_reply_post_host_index = idx))));

mtx_leave(&sc->sc_rep_mtx);

if (rv == 0)
return (0);

while ((ccb = SIMPLEQ_FIRST(&ccbs)((&ccbs)->sqh_first)) != NULL((void *)0)) {
SIMPLEQ_REMOVE_HEAD(&ccbs, ccb_link)do { if (((&ccbs)->sqh_first = (&ccbs)->sqh_first
->ccb_link.sqe_next) == ((void *)0)) (&ccbs)->sqh_last
 = &(&ccbs)->sqh_first; } while (0);
ccb->ccb_done(ccb);
}
while ((rcb = SIMPLEQ_FIRST(&evts)((&evts)->sqh_first)) != NULL((void *)0)) {
SIMPLEQ_REMOVE_HEAD(&evts, rcb_link)do { if (((&evts)->sqh_first = (&evts)->sqh_first
->rcb_link.sqe_next) == ((void *)0)) (&evts)->sqh_last
 = &(&evts)->sqh_first; } while (0);
mpii_event_process(sc, rcb);
}

return (1);
758}

760int
761mpii_load_xs_sas3(struct mpii_ccb *ccb)
762{
struct mpii_softc	*sc = ccb->ccb_sc;
struct scsi_xfer	*xs = ccb->ccb_cookie;
struct mpii_msg_scsi_io	*io = ccb->ccb_cmd;
struct mpii_ieee_sge	*csge, *nsge, *sge;
11
←
'sge' declared without an initial value→
bus_dmamap_t		dmap = ccb->ccb_dmamap;
int			i, error;

/* Request frame structure is described in the mpii_iocfacts */
nsge = (struct mpii_ieee_sge *)(io + 1);

/* zero length transfer still requires an SGE */
if (xs->datalen == 0) {
12
←
Assuming field 'datalen' is not equal to 0→
13
←
Taking false branch→
nsge->sg_flags = MPII_IEEE_SGE_END_OF_LIST(0x40);
return (0);
}

error = bus_dmamap_load(sc->sc_dmat, dmap, xs->data, xs->datalen, NULL,(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (dmap)
, (xs->data), (xs->datalen), (((void *)0)), ((xs->flags
 & 0x00001) ? 0x0001 : 0x0000))
14
←
Assuming the condition is false→
15
←
'?' condition is false→
   (xs->flags & SCSI_NOSLEEP) ? BUS_DMA_NOWAIT : BUS_DMA_WAITOK)(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (dmap)
, (xs->data), (xs->datalen), (((void *)0)), ((xs->flags
 & 0x00001) ? 0x0001 : 0x0000));
if (error) {
16
←
Assuming 'error' is 0→
17
←
Taking false branch→
printf("%s: error %d loading dmamap\n", DEVNAME(sc)((sc)->sc_dev.dv_xname), error);
return (1);
}

csge = NULL((void *)0);
if (dmap->dm_nsegs > sc->sc_chain_sge) {
18
←
Assuming field 'dm_nsegs' is <= field 'sc_chain_sge'→
19
←
Taking false branch→
csge = nsge + sc->sc_chain_sge;

/* offset to the chain sge from the beginning */
io->chain_offset = ((caddr_t)csge - (caddr_t)io) / sizeof(*sge);
}

for (i = 0; i < dmap->dm_nsegs; i++, nsge++) {
20
←
Assuming 'i' is >= field 'dm_nsegs'→
21
←
Loop condition is false. Execution continues on line 821→
if (nsge == csge) {
	nsge++;

	/* address of the next sge */
	htolem64(&csge->sg_addr, ccb->ccb_cmd_dva +(*(__uint64_t *)(&csge->sg_addr) = ((__uint64_t)(ccb->
ccb_cmd_dva + ((caddr_t)nsge - (caddr_t)io))))
	    ((caddr_t)nsge - (caddr_t)io))(*(__uint64_t *)(&csge->sg_addr) = ((__uint64_t)(ccb->
ccb_cmd_dva + ((caddr_t)nsge - (caddr_t)io))));
	htolem32(&csge->sg_len, (dmap->dm_nsegs - i) *(*(__uint32_t *)(&csge->sg_len) = ((__uint32_t)((dmap->
dm_nsegs - i) * sizeof(*sge))))
	    sizeof(*sge))(*(__uint32_t *)(&csge->sg_len) = ((__uint32_t)((dmap->
dm_nsegs - i) * sizeof(*sge))));
	csge->sg_next_chain_offset = 0;
	csge->sg_flags = MPII_IEEE_SGE_CHAIN_ELEMENT(0x80) |
	    MPII_IEEE_SGE_ADDR_SYSTEM(0x00);

	if ((dmap->dm_nsegs - i) > sc->sc_max_chain) {
		csge->sg_next_chain_offset = sc->sc_max_chain;
		csge += sc->sc_max_chain;
	}
}

sge = nsge;
sge->sg_flags = MPII_IEEE_SGE_ADDR_SYSTEM(0x00);
sge->sg_next_chain_offset = 0;
htolem32(&sge->sg_len, dmap->dm_segs[i].ds_len)(*(__uint32_t *)(&sge->sg_len) = ((__uint32_t)(dmap->
dm_segs[i].ds_len)));
htolem64(&sge->sg_addr, dmap->dm_segs[i].ds_addr)(*(__uint64_t *)(&sge->sg_addr) = ((__uint64_t)(dmap->
dm_segs[i].ds_addr)));
}

/* terminate list */
sge->sg_flags |= MPII_IEEE_SGE_END_OF_LIST(0x40);
22
←
Access to field 'sg_flags' results in a dereference of an undefined pointer value (loaded from variable 'sge')

bus_dmamap_sync(sc->sc_dmat, dmap, 0, dmap->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x01 : 0x04))
   (xs->flags & SCSI_DATA_IN) ? BUS_DMASYNC_PREREAD :(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x01 : 0x04))
   BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x01 : 0x04));

return (0);
828}

830int
831mpii_load_xs(struct mpii_ccb *ccb)
832{
struct mpii_softc	*sc = ccb->ccb_sc;
struct scsi_xfer	*xs = ccb->ccb_cookie;
struct mpii_msg_scsi_io	*io = ccb->ccb_cmd;
struct mpii_sge		*csge, *nsge, *sge;
bus_dmamap_t		dmap = ccb->ccb_dmamap;
u_int32_t		flags;
u_int16_t		len;
int			i, error;

/* Request frame structure is described in the mpii_iocfacts */
nsge = (struct mpii_sge *)(io + 1);
csge = nsge + sc->sc_chain_sge;

/* zero length transfer still requires an SGE */
if (xs->datalen == 0) {
nsge->sg_hdr = htole32(MPII_SGE_FL_TYPE_SIMPLE |((__uint32_t)((0x1<<28) | (0x1<<31) | (0x1<<
30) | (0x1<<24)))
    MPII_SGE_FL_LAST | MPII_SGE_FL_EOB | MPII_SGE_FL_EOL)((__uint32_t)((0x1<<28) | (0x1<<31) | (0x1<<
30) | (0x1<<24)));
return (0);
}

error = bus_dmamap_load(sc->sc_dmat, dmap, xs->data, xs->datalen, NULL,(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (dmap)
, (xs->data), (xs->datalen), (((void *)0)), ((xs->flags
 & 0x00001) ? 0x0001 : 0x0000))
   (xs->flags & SCSI_NOSLEEP) ? BUS_DMA_NOWAIT : BUS_DMA_WAITOK)(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (dmap)
, (xs->data), (xs->datalen), (((void *)0)), ((xs->flags
 & 0x00001) ? 0x0001 : 0x0000));
if (error) {
printf("%s: error %d loading dmamap\n", DEVNAME(sc)((sc)->sc_dev.dv_xname), error);
return (1);
}

/* safe default starting flags */
flags = MPII_SGE_FL_TYPE_SIMPLE(0x1<<28) | MPII_SGE_FL_SIZE_64(0x1<<25);
if (xs->flags & SCSI_DATA_OUT0x01000)
flags |= MPII_SGE_FL_DIR_OUT(0x1<<26);

for (i = 0; i < dmap->dm_nsegs; i++, nsge++) {
if (nsge == csge) {
	nsge++;
	/* offset to the chain sge from the beginning */
	io->chain_offset = ((caddr_t)csge - (caddr_t)io) / 4;
	/* length of the sgl segment we're pointing to */
	len = (dmap->dm_nsegs - i) * sizeof(*sge);
	htolem32(&csge->sg_hdr, MPII_SGE_FL_TYPE_CHAIN |(*(__uint32_t *)(&csge->sg_hdr) = ((__uint32_t)((0x3<<
28) | (0x1<<25) | len)))
	    MPII_SGE_FL_SIZE_64 | len)(*(__uint32_t *)(&csge->sg_hdr) = ((__uint32_t)((0x3<<
28) | (0x1<<25) | len)));
	/* address of the next sge */
	mpii_dvatosge(csge, ccb->ccb_cmd_dva +
	    ((caddr_t)nsge - (caddr_t)io));
}

sge = nsge;
htolem32(&sge->sg_hdr, flags | dmap->dm_segs[i].ds_len)(*(__uint32_t *)(&sge->sg_hdr) = ((__uint32_t)(flags |
 dmap->dm_segs[i].ds_len)));
mpii_dvatosge(sge, dmap->dm_segs[i].ds_addr);
}

/* terminate list */
sge->sg_hdr |= htole32(MPII_SGE_FL_LAST | MPII_SGE_FL_EOB |((__uint32_t)((0x1<<31) | (0x1<<30) | (0x1<<
24)))
   MPII_SGE_FL_EOL)((__uint32_t)((0x1<<31) | (0x1<<30) | (0x1<<
24)));

bus_dmamap_sync(sc->sc_dmat, dmap, 0, dmap->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x01 : 0x04))
   (xs->flags & SCSI_DATA_IN) ? BUS_DMASYNC_PREREAD :(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x01 : 0x04))
   BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x01 : 0x04));

return (0);
893}

895int
896mpii_scsi_probe(struct scsi_link *link)
897{
struct mpii_softc *sc = link->bus->sb_adapter_softc;
struct mpii_cfg_sas_dev_pg0 pg0;
struct mpii_ecfg_hdr ehdr;
struct mpii_device *dev;
uint32_t address;
int flags;

if ((sc->sc_porttype != MPII_PORTFACTS_PORTTYPE_SAS_PHYSICAL(0x30)) &&
   (sc->sc_porttype != MPII_PORTFACTS_PORTTYPE_SAS_VIRTUAL(0x31)) &&
   (sc->sc_porttype != MPII_PORTFACTS_PORTTYPE_TRI_MODE(0x40)))
return (ENXIO6);

dev = sc->sc_devs[link->target];
if (dev == NULL((void *)0))
return (1);

flags = dev->flags;
if (ISSET(flags, MPII_DF_HIDDEN)((flags) & ((0x0004))) || ISSET(flags, MPII_DF_UNUSED)((flags) & ((0x0008))))
return (1);

if (ISSET(flags, MPII_DF_VOLUME)((flags) & ((0x0010)))) {
struct mpii_cfg_hdr hdr;
struct mpii_cfg_raid_vol_pg1 vpg;
size_t pagelen;

address = MPII_CFG_RAID_VOL_ADDR_HANDLE(1<<28) | dev->dev_handle;

if (mpii_req_cfg_header(sc, MPII_CONFIG_REQ_PAGE_TYPE_RAID_VOL(0x08),
    1, address, MPII_PG_POLL(1<<1), &hdr) != 0)
	return (EINVAL22);

memset(&vpg, 0, sizeof(vpg))__builtin_memset((&vpg), (0), (sizeof(vpg)));
/* avoid stack trash on future page growth */
pagelen = min(sizeof(vpg), hdr.page_length * 4);

if (mpii_req_cfg_page(sc, address, MPII_PG_POLL(1<<1), &hdr, 1,
    &vpg, pagelen) != 0)
	return (EINVAL22);

link->port_wwn = letoh64(vpg.wwid)((__uint64_t)(vpg.wwid));
/*
 * WWIDs generated by LSI firmware are not IEEE NAA compliant
 * and historical practise in OBP on sparc64 is to set the top
 * nibble to 3 to indicate that this is a RAID volume.
 */
link->port_wwn &= 0x0fffffffffffffff;
link->port_wwn |= 0x3000000000000000;

return (0);
}

memset(&ehdr, 0, sizeof(ehdr))__builtin_memset((&ehdr), (0), (sizeof(ehdr)));
ehdr.page_type = MPII_CONFIG_REQ_PAGE_TYPE_EXTENDED(0x0f);
ehdr.page_number = 0;
ehdr.page_version = 0;
ehdr.ext_page_type = MPII_CONFIG_REQ_EXTPAGE_TYPE_SAS_DEVICE(0x12);
ehdr.ext_page_length = htole16(sizeof(pg0) / 4)((__uint16_t)(sizeof(pg0) / 4)); /* dwords */

address = MPII_PGAD_SAS_DEVICE_FORM_HANDLE(0x20000000) | (uint32_t)dev->dev_handle;
if (mpii_req_cfg_page(sc, address, MPII_PG_EXTENDED(1<<0),
   &ehdr, 1, &pg0, sizeof(pg0)) != 0) {
printf("%s: unable to fetch SAS device page 0 for target %u\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname), link->target);

return (0); /* the handle should still work */
}

link->port_wwn = letoh64(pg0.sas_addr)((__uint64_t)(pg0.sas_addr));
link->node_wwn = letoh64(pg0.device_name)((__uint64_t)(pg0.device_name));

if (ISSET(lemtoh32(&pg0.device_info),((((__uint32_t)(*(__uint32_t *)(&pg0.device_info)))) &
 ((1<<13)))
   MPII_CFG_SAS_DEV_0_DEVINFO_ATAPI_DEVICE)((((__uint32_t)(*(__uint32_t *)(&pg0.device_info)))) &
 ((1<<13)))) {
link->flags |= SDEV_ATAPI0x0200;
}

return (0);
974}

976u_int32_t
977mpii_read(struct mpii_softc *sc, bus_size_t r)
978{
u_int32_t			rv;
int				i;

if (ISSET(sc->sc_flags, MPII_F_AERO)((sc->sc_flags) & ((1<<3)))) {
i = 0;
do {
	if (i > 0)
		DNPRINTF(MPII_D_RW, "%s: mpii_read retry %d\n",
		    DEVNAME(sc), i);
	bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
	    BUS_SPACE_BARRIER_READ0x01);
	rv = bus_space_read_4(sc->sc_iot, sc->sc_ioh, r)((sc->sc_iot)->read_4((sc->sc_ioh), (r)));
	i++;
} while (rv == 0 && i < 3);
} else {
bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
    BUS_SPACE_BARRIER_READ0x01);
rv = bus_space_read_4(sc->sc_iot, sc->sc_ioh, r)((sc->sc_iot)->read_4((sc->sc_ioh), (r)));
}

DNPRINTF(MPII_D_RW, "%s: mpii_read %#lx %#x\n", DEVNAME(sc), r, rv);

return (rv);
1002}

1004void
1005mpii_write(struct mpii_softc *sc, bus_size_t r, u_int32_t v)
1006{
DNPRINTF(MPII_D_RW, "%s: mpii_write %#lx %#x\n", DEVNAME(sc), r, v);

bus_space_write_4(sc->sc_iot, sc->sc_ioh, r, v)((sc->sc_iot)->write_4((sc->sc_ioh), (r), (v)));
bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
   BUS_SPACE_BARRIER_WRITE0x02);
1012}


1015int
1016mpii_wait_eq(struct mpii_softc *sc, bus_size_t r, u_int32_t mask,
  u_int32_t target)
1018{
int			i;

DNPRINTF(MPII_D_RW, "%s: mpii_wait_eq %#lx %#x %#x\n", DEVNAME(sc), r,
   mask, target);

for (i = 0; i < 15000; i++) {
if ((mpii_read(sc, r) & mask) == target)
	return (0);
delay(1000)(*delay_func)(1000);
}

return (1);
1031}

1033int
1034mpii_wait_ne(struct mpii_softc *sc, bus_size_t r, u_int32_t mask,
  u_int32_t target)
1036{
int			i;

DNPRINTF(MPII_D_RW, "%s: mpii_wait_ne %#lx %#x %#x\n", DEVNAME(sc), r,
   mask, target);

for (i = 0; i < 15000; i++) {
if ((mpii_read(sc, r) & mask) != target)
	return (0);
delay(1000)(*delay_func)(1000);
}

return (1);
1049}

1051int
1052mpii_init(struct mpii_softc *sc)
1053{
u_int32_t		db;
int			i;

/* spin until the ioc leaves the reset state */
if (mpii_wait_ne(sc, MPII_DOORBELL(0x00), MPII_DOORBELL_STATE(0xf<<28),
   MPII_DOORBELL_STATE_RESET(0x0<<28)) != 0) {
DNPRINTF(MPII_D_MISC, "%s: mpii_init timeout waiting to leave "
    "reset state\n", DEVNAME(sc));
return (1);
}

/* check current ownership */
db = mpii_read_db(sc)mpii_read((sc), (0x00));
if ((db & MPII_DOORBELL_WHOINIT(0x7<<24)) == MPII_DOORBELL_WHOINIT_PCIPEER(0x3<<24)) {
DNPRINTF(MPII_D_MISC, "%s: mpii_init initialised by pci peer\n",
    DEVNAME(sc));
return (0);
}

for (i = 0; i < 5; i++) {
switch (db & MPII_DOORBELL_STATE(0xf<<28)) {
case MPII_DOORBELL_STATE_READY(0x1<<28):
	DNPRINTF(MPII_D_MISC, "%s: mpii_init ioc is ready\n",
	    DEVNAME(sc));
	return (0);

case MPII_DOORBELL_STATE_OPER(0x2<<28):
	DNPRINTF(MPII_D_MISC, "%s: mpii_init ioc is oper\n",
	    DEVNAME(sc));
	if (sc->sc_ioc_event_replay)
		mpii_reset_soft(sc);
	else
		mpii_reset_hard(sc);
	break;

case MPII_DOORBELL_STATE_FAULT(0x4<<28):
	DNPRINTF(MPII_D_MISC, "%s: mpii_init ioc is being "
	    "reset hard\n" , DEVNAME(sc));
	mpii_reset_hard(sc);
	break;

case MPII_DOORBELL_STATE_RESET(0x0<<28):
	DNPRINTF(MPII_D_MISC, "%s: mpii_init waiting to come "
	    "out of reset\n", DEVNAME(sc));
	if (mpii_wait_ne(sc, MPII_DOORBELL(0x00), MPII_DOORBELL_STATE(0xf<<28),
	    MPII_DOORBELL_STATE_RESET(0x0<<28)) != 0)
		return (1);
	break;
}
db = mpii_read_db(sc)mpii_read((sc), (0x00));
}

return (1);
1107}

1109int
1110mpii_reset_soft(struct mpii_softc *sc)
1111{
DNPRINTF(MPII_D_MISC, "%s: mpii_reset_soft\n", DEVNAME(sc));

if (mpii_read_db(sc)mpii_read((sc), (0x00)) & MPII_DOORBELL_INUSE(0x1<<27)) {
return (1);
}

mpii_write_db(sc,mpii_write((sc), (0x00), (((((0x40)) << (24)) & (0xff
 << (24)))))
   MPII_DOORBELL_FUNCTION(MPII_FUNCTION_IOC_MESSAGE_UNIT_RESET))mpii_write((sc), (0x00), (((((0x40)) << (24)) & (0xff
 << (24)))));

/* XXX LSI waits 15 sec */
if (mpii_wait_db_ack(sc)mpii_wait_eq((sc), (0x30), (1<<31), 0) != 0)
return (1);

/* XXX LSI waits 15 sec */
if (mpii_wait_eq(sc, MPII_DOORBELL(0x00), MPII_DOORBELL_STATE(0xf<<28),
   MPII_DOORBELL_STATE_READY(0x1<<28)) != 0)
return (1);

/* XXX wait for Sys2IOCDB bit to clear in HIS?? */

return (0);
1133}

1135int
1136mpii_reset_hard(struct mpii_softc *sc)
1137{
u_int16_t		i;

DNPRINTF(MPII_D_MISC, "%s: mpii_reset_hard\n", DEVNAME(sc));

mpii_write_intr(sc, 0)mpii_write((sc), (0x30), (0));

/* enable diagnostic register */
mpii_write(sc, MPII_WRITESEQ(0x04), MPII_WRITESEQ_FLUSH(0x00));
mpii_write(sc, MPII_WRITESEQ(0x04), MPII_WRITESEQ_1(0x0f));
mpii_write(sc, MPII_WRITESEQ(0x04), MPII_WRITESEQ_2(0x04));
mpii_write(sc, MPII_WRITESEQ(0x04), MPII_WRITESEQ_3(0x0b));
mpii_write(sc, MPII_WRITESEQ(0x04), MPII_WRITESEQ_4(0x02));
mpii_write(sc, MPII_WRITESEQ(0x04), MPII_WRITESEQ_5(0x07));
mpii_write(sc, MPII_WRITESEQ(0x04), MPII_WRITESEQ_6(0x0d));

delay(100)(*delay_func)(100);

if ((mpii_read(sc, MPII_HOSTDIAG(0x08)) & MPII_HOSTDIAG_DWRE(1<<7)) == 0) {
DNPRINTF(MPII_D_MISC, "%s: mpii_reset_hard failure to enable "
    "diagnostic read/write\n", DEVNAME(sc));
return(1);
}

/* reset ioc */
mpii_write(sc, MPII_HOSTDIAG(0x08), MPII_HOSTDIAG_RESET_ADAPTER(1<<2));

/* 240 milliseconds */
delay(240000)(*delay_func)(240000);


/* XXX this whole function should be more robust */

/* XXX  read the host diagnostic reg until reset adapter bit clears ? */
for (i = 0; i < 30000; i++) {
if ((mpii_read(sc, MPII_HOSTDIAG(0x08)) &
    MPII_HOSTDIAG_RESET_ADAPTER(1<<2)) == 0)
	break;
delay(10000)(*delay_func)(10000);
}

/* disable diagnostic register */
mpii_write(sc, MPII_WRITESEQ(0x04), 0xff);

/* XXX what else? */

DNPRINTF(MPII_D_MISC, "%s: done with mpii_reset_hard\n", DEVNAME(sc));

return(0);
1186}

1188int
1189mpii_handshake_send(struct mpii_softc *sc, void *buf, size_t dwords)
1190{
u_int32_t		*query = buf;
int			i;

/* make sure the doorbell is not in use. */
if (mpii_read_db(sc)mpii_read((sc), (0x00)) & MPII_DOORBELL_INUSE(0x1<<27))
return (1);

/* clear pending doorbell interrupts */
if (mpii_read_intr(sc)mpii_read((sc), (0x30)) & MPII_INTR_STATUS_IOC2SYSDB(1<<0))
mpii_write_intr(sc, 0)mpii_write((sc), (0x30), (0));

/*
* first write the doorbell with the handshake function and the
* dword count.
*/
mpii_write_db(sc, MPII_DOORBELL_FUNCTION(MPII_FUNCTION_HANDSHAKE) |mpii_write((sc), (0x00), (((((0x42)) << (24)) & (0xff
 << (24))) | (((dwords) << 16) & (0xff <<
 16))))
   MPII_DOORBELL_DWORDS(dwords))mpii_write((sc), (0x00), (((((0x42)) << (24)) & (0xff
 << (24))) | (((dwords) << 16) & (0xff <<
 16))));

/*
* the doorbell used bit will be set because a doorbell function has
* started. wait for the interrupt and then ack it.
*/
if (mpii_wait_db_int(sc)mpii_wait_ne((sc), (0x30), (1<<0), 0) != 0)
return (1);
mpii_write_intr(sc, 0)mpii_write((sc), (0x30), (0));

/* poll for the acknowledgement. */
if (mpii_wait_db_ack(sc)mpii_wait_eq((sc), (0x30), (1<<31), 0) != 0)
return (1);

/* write the query through the doorbell. */
for (i = 0; i < dwords; i++) {
mpii_write_db(sc, htole32(query[i]))mpii_write((sc), (0x00), (((__uint32_t)(query[i]))));
if (mpii_wait_db_ack(sc)mpii_wait_eq((sc), (0x30), (1<<31), 0) != 0)
	return (1);
}

return (0);
1229}

1231int
1232mpii_handshake_recv_dword(struct mpii_softc *sc, u_int32_t *dword)
1233{
u_int16_t		*words = (u_int16_t *)dword;
int			i;

for (i = 0; i < 2; i++) {
if (mpii_wait_db_int(sc)mpii_wait_ne((sc), (0x30), (1<<0), 0) != 0)
	return (1);
words[i] = letoh16(mpii_read_db(sc) & MPII_DOORBELL_DATA_MASK)((__uint16_t)(mpii_read((sc), (0x00)) & (0xffff)));
mpii_write_intr(sc, 0)mpii_write((sc), (0x30), (0));
}

return (0);
1245}

1247int
1248mpii_handshake_recv(struct mpii_softc *sc, void *buf, size_t dwords)
1249{
struct mpii_msg_reply	*reply = buf;
u_int32_t		*dbuf = buf, dummy;
int			i;

/* get the first dword so we can read the length out of the header. */
if (mpii_handshake_recv_dword(sc, &dbuf[0]) != 0)
return (1);

DNPRINTF(MPII_D_CMD, "%s: mpii_handshake_recv dwords: %lu reply: %d\n",
   DEVNAME(sc), dwords, reply->msg_length);

/*
* the total length, in dwords, is in the message length field of the
* reply header.
*/
for (i = 1; i < MIN(dwords, reply->msg_length)(((dwords)<(reply->msg_length))?(dwords):(reply->msg_length
)); i++) {
if (mpii_handshake_recv_dword(sc, &dbuf[i]) != 0)
	return (1);
}

/* if there's extra stuff to come off the ioc, discard it */
while (i++ < reply->msg_length) {
if (mpii_handshake_recv_dword(sc, &dummy) != 0)
	return (1);
DNPRINTF(MPII_D_CMD, "%s: mpii_handshake_recv dummy read: "
    "0x%08x\n", DEVNAME(sc), dummy);
}

/* wait for the doorbell used bit to be reset and clear the intr */
if (mpii_wait_db_int(sc)mpii_wait_ne((sc), (0x30), (1<<0), 0) != 0)
return (1);

if (mpii_wait_eq(sc, MPII_DOORBELL(0x00), MPII_DOORBELL_INUSE(0x1<<27), 0) != 0)
return (1);

mpii_write_intr(sc, 0)mpii_write((sc), (0x30), (0));

return (0);
1288}

1290void
1291mpii_empty_done(struct mpii_ccb *ccb)
1292{
/* nothing to do */
1294}

1296int
1297mpii_iocfacts(struct mpii_softc *sc)
1298{
struct mpii_msg_iocfacts_request	ifq;
struct mpii_msg_iocfacts_reply		ifp;
int					irs;
int					sge_size;
u_int					qdepth;

DNPRINTF(MPII_D_MISC, "%s: mpii_iocfacts\n", DEVNAME(sc));

memset(&ifq, 0, sizeof(ifq))__builtin_memset((&ifq), (0), (sizeof(ifq)));
memset(&ifp, 0, sizeof(ifp))__builtin_memset((&ifp), (0), (sizeof(ifp)));

ifq.function = MPII_FUNCTION_IOC_FACTS(0x03);

if (mpii_handshake_send(sc, &ifq, dwordsof(ifq)(sizeof(ifq) / sizeof(u_int32_t))) != 0) {
DNPRINTF(MPII_D_MISC, "%s: mpii_iocfacts send failed\n",
    DEVNAME(sc));
return (1);
}

if (mpii_handshake_recv(sc, &ifp, dwordsof(ifp)(sizeof(ifp) / sizeof(u_int32_t))) != 0) {
DNPRINTF(MPII_D_MISC, "%s: mpii_iocfacts recv failed\n",
    DEVNAME(sc));
return (1);
}

sc->sc_ioc_number = ifp.ioc_number;
sc->sc_vf_id = ifp.vf_id;

sc->sc_max_volumes = ifp.max_volumes;
sc->sc_max_devices = ifp.max_volumes + lemtoh16(&ifp.max_targets)((__uint16_t)(*(__uint16_t *)(&ifp.max_targets)));

if (ISSET(lemtoh32(&ifp.ioc_capabilities),((((__uint32_t)(*(__uint32_t *)(&ifp.ioc_capabilities))))
 & ((1<<12)))
   MPII_IOCFACTS_CAPABILITY_INTEGRATED_RAID)((((__uint32_t)(*(__uint32_t *)(&ifp.ioc_capabilities))))
 & ((1<<12))))
SET(sc->sc_flags, MPII_F_RAID)((sc->sc_flags) |= ((1<<1)));
if (ISSET(lemtoh32(&ifp.ioc_capabilities),((((__uint32_t)(*(__uint32_t *)(&ifp.ioc_capabilities))))
 & ((1<<13)))
   MPII_IOCFACTS_CAPABILITY_EVENT_REPLAY)((((__uint32_t)(*(__uint32_t *)(&ifp.ioc_capabilities))))
 & ((1<<13))))
sc->sc_ioc_event_replay = 1;

sc->sc_max_cmds = MIN(lemtoh16(&ifp.request_credit),(((((__uint16_t)(*(__uint16_t *)(&ifp.request_credit))))<
((128)))?(((__uint16_t)(*(__uint16_t *)(&ifp.request_credit
)))):((128)))
   MPII_REQUEST_CREDIT)(((((__uint16_t)(*(__uint16_t *)(&ifp.request_credit))))<
((128)))?(((__uint16_t)(*(__uint16_t *)(&ifp.request_credit
)))):((128)));

/* SAS3 and 3.5 controllers have different sgl layouts */
if (ifp.msg_version_maj == 2 && ((ifp.msg_version_min == 5)
   || (ifp.msg_version_min == 6)))
SET(sc->sc_flags, MPII_F_SAS3)((sc->sc_flags) |= ((1<<2)));

/*
* The host driver must ensure that there is at least one
* unused entry in the Reply Free Queue. One way to ensure
* that this requirement is met is to never allocate a number
* of reply frames that is a multiple of 16.
*/
sc->sc_num_reply_frames = sc->sc_max_cmds + 32;
if (!(sc->sc_num_reply_frames % 16))
sc->sc_num_reply_frames--;

/* must be multiple of 16 */
sc->sc_reply_post_qdepth = sc->sc_max_cmds +
   sc->sc_num_reply_frames;
sc->sc_reply_post_qdepth += 16 - (sc->sc_reply_post_qdepth % 16);

qdepth = lemtoh16(&ifp.max_reply_descriptor_post_queue_depth)((__uint16_t)(*(__uint16_t *)(&ifp.max_reply_descriptor_post_queue_depth
)));
if (sc->sc_reply_post_qdepth > qdepth) {
sc->sc_reply_post_qdepth = qdepth;
if (sc->sc_reply_post_qdepth < 16) {
	printf("%s: RDPQ is too shallow\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
	return (1);
}
sc->sc_max_cmds = sc->sc_reply_post_qdepth / 2 - 4;
sc->sc_num_reply_frames = sc->sc_max_cmds + 4;
}

sc->sc_reply_free_qdepth = sc->sc_num_reply_frames +
   16 - (sc->sc_num_reply_frames % 16);

/*
* Our request frame for an I/O operation looks like this:
*
* +-------------------+ -.
* | mpii_msg_scsi_io  |  |
* +-------------------|  |
* | mpii_sge          |  |
* + - - - - - - - - - +  |
* | ...               |  > ioc_request_frame_size
* + - - - - - - - - - +  |
* | mpii_sge (tail)   |  |
* + - - - - - - - - - +  |
* | mpii_sge (csge)   |  | --.
* + - - - - - - - - - + -'   | chain sge points to the next sge
* | mpii_sge          |<-----'
* + - - - - - - - - - +
* | ...               |
* + - - - - - - - - - +
* | mpii_sge (tail)   |
* +-------------------+
* |                   |
* ~~~~~~~~~~~~~~~~~~~~~
* |                   |
* +-------------------+ <- sc_request_size - sizeof(scsi_sense_data)
* | scsi_sense_data   |
* +-------------------+
*
* If the controller gives us a maximum chain size, there can be
* multiple chain sges, each of which points to the sge following it.
* Otherwise, there will only be one chain sge.
*/

/* both sizes are in 32-bit words */
sc->sc_reply_size = ifp.reply_frame_size * 4;
irs = lemtoh16(&ifp.ioc_request_frame_size)((__uint16_t)(*(__uint16_t *)(&ifp.ioc_request_frame_size
))) * 4;
sc->sc_request_size = MPII_REQUEST_SIZE(512);
/* make sure we have enough space for scsi sense data */
if (irs > sc->sc_request_size) {
sc->sc_request_size = irs + sizeof(struct scsi_sense_data);
sc->sc_request_size += 16 - (sc->sc_request_size % 16);
}

if (ISSET(sc->sc_flags, MPII_F_SAS3)((sc->sc_flags) & ((1<<2)))) {
sge_size = sizeof(struct mpii_ieee_sge);
} else {
sge_size = sizeof(struct mpii_sge);
}

/* offset to the chain sge */
sc->sc_chain_sge = (irs - sizeof(struct mpii_msg_scsi_io)) /
   sge_size - 1;

sc->sc_max_chain = lemtoh16(&ifp.ioc_max_chain_seg_size)((__uint16_t)(*(__uint16_t *)(&ifp.ioc_max_chain_seg_size
)));

/*
* A number of simple scatter-gather elements we can fit into the
* request buffer after the I/O command minus the chain element(s).
*/
sc->sc_max_sgl = (sc->sc_request_size -
    sizeof(struct mpii_msg_scsi_io) - sizeof(struct scsi_sense_data)) /
   sge_size - 1;
if (sc->sc_max_chain > 0) {
sc->sc_max_sgl -= (sc->sc_max_sgl - sc->sc_chain_sge) /
    sc->sc_max_chain;
}

return (0);
1441}

1443int
1444mpii_iocinit(struct mpii_softc *sc)
1445{
struct mpii_msg_iocinit_request		iiq;
struct mpii_msg_iocinit_reply		iip;

DNPRINTF(MPII_D_MISC, "%s: mpii_iocinit\n", DEVNAME(sc));

memset(&iiq, 0, sizeof(iiq))__builtin_memset((&iiq), (0), (sizeof(iiq)));
memset(&iip, 0, sizeof(iip))__builtin_memset((&iip), (0), (sizeof(iip)));

iiq.function = MPII_FUNCTION_IOC_INIT(0x02);
iiq.whoinit = MPII_WHOINIT_HOST_DRIVER(0x04);

/* XXX JPG do something about vf_id */
iiq.vf_id = 0;

iiq.msg_version_maj = 0x02;
iiq.msg_version_min = 0x00;

/* XXX JPG ensure compliance with some level and hard-code? */
iiq.hdr_version_unit = 0x00;
iiq.hdr_version_dev = 0x00;

htolem16(&iiq.system_request_frame_size, sc->sc_request_size / 4)(*(__uint16_t *)(&iiq.system_request_frame_size) = ((__uint16_t
)(sc->sc_request_size / 4)));

htolem16(&iiq.reply_descriptor_post_queue_depth,(*(__uint16_t *)(&iiq.reply_descriptor_post_queue_depth) =
 ((__uint16_t)(sc->sc_reply_post_qdepth)))
   sc->sc_reply_post_qdepth)(*(__uint16_t *)(&iiq.reply_descriptor_post_queue_depth) =
 ((__uint16_t)(sc->sc_reply_post_qdepth)));

htolem16(&iiq.reply_free_queue_depth, sc->sc_reply_free_qdepth)(*(__uint16_t *)(&iiq.reply_free_queue_depth) = ((__uint16_t
)(sc->sc_reply_free_qdepth)));

htolem32(&iiq.sense_buffer_address_high,(*(__uint32_t *)(&iiq.sense_buffer_address_high) = ((__uint32_t
)(((u_int64_t)(sc->sc_requests)->mdm_map->dm_segs[0]
.ds_addr) >> 32)))
   MPII_DMA_DVA(sc->sc_requests) >> 32)(*(__uint32_t *)(&iiq.sense_buffer_address_high) = ((__uint32_t
)(((u_int64_t)(sc->sc_requests)->mdm_map->dm_segs[0]
.ds_addr) >> 32)));

htolem32(&iiq.system_reply_address_high,(*(__uint32_t *)(&iiq.system_reply_address_high) = ((__uint32_t
)(((u_int64_t)(sc->sc_replies)->mdm_map->dm_segs[0].
ds_addr) >> 32)))
   MPII_DMA_DVA(sc->sc_replies) >> 32)(*(__uint32_t *)(&iiq.system_reply_address_high) = ((__uint32_t
)(((u_int64_t)(sc->sc_replies)->mdm_map->dm_segs[0].
ds_addr) >> 32)));

htolem32(&iiq.system_request_frame_base_address_lo,(*(__uint32_t *)(&iiq.system_request_frame_base_address_lo
) = ((__uint32_t)(((u_int64_t)(sc->sc_requests)->mdm_map
->dm_segs[0].ds_addr))))
   MPII_DMA_DVA(sc->sc_requests))(*(__uint32_t *)(&iiq.system_request_frame_base_address_lo
) = ((__uint32_t)(((u_int64_t)(sc->sc_requests)->mdm_map
->dm_segs[0].ds_addr))));
htolem32(&iiq.system_request_frame_base_address_hi,(*(__uint32_t *)(&iiq.system_request_frame_base_address_hi
) = ((__uint32_t)(((u_int64_t)(sc->sc_requests)->mdm_map
->dm_segs[0].ds_addr) >> 32)))
   MPII_DMA_DVA(sc->sc_requests) >> 32)(*(__uint32_t *)(&iiq.system_request_frame_base_address_hi
) = ((__uint32_t)(((u_int64_t)(sc->sc_requests)->mdm_map
->dm_segs[0].ds_addr) >> 32)));

htolem32(&iiq.reply_descriptor_post_queue_address_lo,(*(__uint32_t *)(&iiq.reply_descriptor_post_queue_address_lo
) = ((__uint32_t)(((u_int64_t)(sc->sc_reply_postq)->mdm_map
->dm_segs[0].ds_addr))))
   MPII_DMA_DVA(sc->sc_reply_postq))(*(__uint32_t *)(&iiq.reply_descriptor_post_queue_address_lo
) = ((__uint32_t)(((u_int64_t)(sc->sc_reply_postq)->mdm_map
->dm_segs[0].ds_addr))));
htolem32(&iiq.reply_descriptor_post_queue_address_hi,(*(__uint32_t *)(&iiq.reply_descriptor_post_queue_address_hi
) = ((__uint32_t)(((u_int64_t)(sc->sc_reply_postq)->mdm_map
->dm_segs[0].ds_addr) >> 32)))
   MPII_DMA_DVA(sc->sc_reply_postq) >> 32)(*(__uint32_t *)(&iiq.reply_descriptor_post_queue_address_hi
) = ((__uint32_t)(((u_int64_t)(sc->sc_reply_postq)->mdm_map
->dm_segs[0].ds_addr) >> 32)));

htolem32(&iiq.reply_free_queue_address_lo,(*(__uint32_t *)(&iiq.reply_free_queue_address_lo) = ((__uint32_t
)(((u_int64_t)(sc->sc_reply_freeq)->mdm_map->dm_segs
[0].ds_addr))))
   MPII_DMA_DVA(sc->sc_reply_freeq))(*(__uint32_t *)(&iiq.reply_free_queue_address_lo) = ((__uint32_t
)(((u_int64_t)(sc->sc_reply_freeq)->mdm_map->dm_segs
[0].ds_addr))));
htolem32(&iiq.reply_free_queue_address_hi,(*(__uint32_t *)(&iiq.reply_free_queue_address_hi) = ((__uint32_t
)(((u_int64_t)(sc->sc_reply_freeq)->mdm_map->dm_segs
[0].ds_addr) >> 32)))
   MPII_DMA_DVA(sc->sc_reply_freeq) >> 32)(*(__uint32_t *)(&iiq.reply_free_queue_address_hi) = ((__uint32_t
)(((u_int64_t)(sc->sc_reply_freeq)->mdm_map->dm_segs
[0].ds_addr) >> 32)));

if (mpii_handshake_send(sc, &iiq, dwordsof(iiq)(sizeof(iiq) / sizeof(u_int32_t))) != 0) {
DNPRINTF(MPII_D_MISC, "%s: mpii_iocinit send failed\n",
    DEVNAME(sc));
return (1);
}

if (mpii_handshake_recv(sc, &iip, dwordsof(iip)(sizeof(iip) / sizeof(u_int32_t))) != 0) {
DNPRINTF(MPII_D_MISC, "%s: mpii_iocinit recv failed\n",
    DEVNAME(sc));
return (1);
}

DNPRINTF(MPII_D_MISC, "%s:  function: 0x%02x msg_length: %d "
   "whoinit: 0x%02x\n", DEVNAME(sc), iip.function,
   iip.msg_length, iip.whoinit);
DNPRINTF(MPII_D_MISC, "%s:  msg_flags: 0x%02x\n", DEVNAME(sc),
   iip.msg_flags);
DNPRINTF(MPII_D_MISC, "%s:  vf_id: 0x%02x vp_id: 0x%02x\n", DEVNAME(sc),
   iip.vf_id, iip.vp_id);
DNPRINTF(MPII_D_MISC, "%s:  ioc_status: 0x%04x\n", DEVNAME(sc),
   lemtoh16(&iip.ioc_status));
DNPRINTF(MPII_D_MISC, "%s:  ioc_loginfo: 0x%08x\n", DEVNAME(sc),
   lemtoh32(&iip.ioc_loginfo));

if (lemtoh16(&iip.ioc_status)((__uint16_t)(*(__uint16_t *)(&iip.ioc_status))) != MPII_IOCSTATUS_SUCCESS(0x0000) ||
   lemtoh32(&iip.ioc_loginfo)((__uint32_t)(*(__uint32_t *)(&iip.ioc_loginfo))))
return (1);

return (0);
1524}

1526void
1527mpii_push_reply(struct mpii_softc *sc, struct mpii_rcb *rcb)
1528{
u_int32_t		*rfp;
u_int			idx;

if (rcb == NULL((void *)0))
return;

idx = sc->sc_reply_free_host_index;

rfp = MPII_DMA_KVA(sc->sc_reply_freeq)((void *)(sc->sc_reply_freeq)->mdm_kva);
htolem32(&rfp[idx], rcb->rcb_reply_dva)(*(__uint32_t *)(&rfp[idx]) = ((__uint32_t)(rcb->rcb_reply_dva
)));

if (++idx >= sc->sc_reply_free_qdepth)
idx = 0;

mpii_write_reply_free(sc, sc->sc_reply_free_host_index = idx)(((sc)->sc_iot)->write_4(((sc)->sc_ioh), ((0x48)), (
(sc->sc_reply_free_host_index = idx))));
1544}

1546int
1547mpii_portfacts(struct mpii_softc *sc)
1548{
struct mpii_msg_portfacts_request	*pfq;
struct mpii_msg_portfacts_reply		*pfp;
struct mpii_ccb				*ccb;
int					rv = 1;

DNPRINTF(MPII_D_MISC, "%s: mpii_portfacts\n", DEVNAME(sc));

ccb = scsi_io_get(&sc->sc_iopool, 0);
if (ccb == NULL((void *)0)) {
DNPRINTF(MPII_D_MISC, "%s: mpii_portfacts mpii_get_ccb fail\n",
    DEVNAME(sc));
return (rv);
}

ccb->ccb_done = mpii_empty_done;
pfq = ccb->ccb_cmd;

memset(pfq, 0, sizeof(*pfq))__builtin_memset((pfq), (0), (sizeof(*pfq)));

pfq->function = MPII_FUNCTION_PORT_FACTS(0x05);
pfq->chain_offset = 0;
pfq->msg_flags = 0;
pfq->port_number = 0;
pfq->vp_id = 0;
pfq->vf_id = 0;

if (mpii_poll(sc, ccb) != 0) {
DNPRINTF(MPII_D_MISC, "%s: mpii_portfacts poll\n",
    DEVNAME(sc));
goto err;
}

if (ccb->ccb_rcb == NULL((void *)0)) {
DNPRINTF(MPII_D_MISC, "%s: empty portfacts reply\n",
    DEVNAME(sc));
goto err;
}

pfp = ccb->ccb_rcb->rcb_reply;
sc->sc_porttype = pfp->port_type;

mpii_push_reply(sc, ccb->ccb_rcb);
rv = 0;
1592err:
scsi_io_put(&sc->sc_iopool, ccb);

return (rv);
1596}

1598void
1599mpii_eventack(void *cookie, void *io)
1600{
struct mpii_softc			*sc = cookie;
struct mpii_ccb				*ccb = io;
struct mpii_rcb				*rcb, *next;
struct mpii_msg_event_reply		*enp;
struct mpii_msg_eventack_request	*eaq;

mtx_enter(&sc->sc_evt_ack_mtx);
rcb = SIMPLEQ_FIRST(&sc->sc_evt_ack_queue)((&sc->sc_evt_ack_queue)->sqh_first);
if (rcb != NULL((void *)0)) {
next = SIMPLEQ_NEXT(rcb, rcb_link)((rcb)->rcb_link.sqe_next);
SIMPLEQ_REMOVE_HEAD(&sc->sc_evt_ack_queue, rcb_link)do { if (((&sc->sc_evt_ack_queue)->sqh_first = (&
sc->sc_evt_ack_queue)->sqh_first->rcb_link.sqe_next)
 == ((void *)0)) (&sc->sc_evt_ack_queue)->sqh_last =
 &(&sc->sc_evt_ack_queue)->sqh_first; } while (
0);
}
mtx_leave(&sc->sc_evt_ack_mtx);

if (rcb == NULL((void *)0)) {
scsi_io_put(&sc->sc_iopool, ccb);
return;
}

enp = (struct mpii_msg_event_reply *)rcb->rcb_reply;

ccb->ccb_done = mpii_eventack_done;
eaq = ccb->ccb_cmd;

eaq->function = MPII_FUNCTION_EVENT_ACK(0x08);

eaq->event = enp->event;
eaq->event_context = enp->event_context;

mpii_push_reply(sc, rcb);

mpii_start(sc, ccb);

if (next != NULL((void *)0))
scsi_ioh_add(&sc->sc_evt_ack_handler);
1636}

1638void
1639mpii_eventack_done(struct mpii_ccb *ccb)
1640{
struct mpii_softc			*sc = ccb->ccb_sc;

DNPRINTF(MPII_D_EVT, "%s: event ack done\n", DEVNAME(sc));

mpii_push_reply(sc, ccb->ccb_rcb);
scsi_io_put(&sc->sc_iopool, ccb);
1647}

1649int
1650mpii_portenable(struct mpii_softc *sc)
1651{
struct mpii_msg_portenable_request	*peq;
struct mpii_ccb				*ccb;

DNPRINTF(MPII_D_MISC, "%s: mpii_portenable\n", DEVNAME(sc));

ccb = scsi_io_get(&sc->sc_iopool, 0);
if (ccb == NULL((void *)0)) {
DNPRINTF(MPII_D_MISC, "%s: mpii_portenable ccb_get\n",
    DEVNAME(sc));
return (1);
}

ccb->ccb_done = mpii_empty_done;
peq = ccb->ccb_cmd;

peq->function = MPII_FUNCTION_PORT_ENABLE(0x06);
peq->vf_id = sc->sc_vf_id;

if (mpii_poll(sc, ccb) != 0) {
DNPRINTF(MPII_D_MISC, "%s: mpii_portenable poll\n",
    DEVNAME(sc));
return (1);
}

if (ccb->ccb_rcb == NULL((void *)0)) {
DNPRINTF(MPII_D_MISC, "%s: empty portenable reply\n",
    DEVNAME(sc));
return (1);
}

mpii_push_reply(sc, ccb->ccb_rcb);
scsi_io_put(&sc->sc_iopool, ccb);

return (0);
1686}

1688int
1689mpii_cfg_coalescing(struct mpii_softc *sc)
1690{
struct mpii_cfg_hdr			hdr;
struct mpii_cfg_ioc_pg1			ipg;

hdr.page_version = 0;
hdr.page_length = sizeof(ipg) / 4;
hdr.page_number = 1;
hdr.page_type = MPII_CONFIG_REQ_PAGE_TYPE_IOC(0x01);
memset(&ipg, 0, sizeof(ipg))__builtin_memset((&ipg), (0), (sizeof(ipg)));
if (mpii_req_cfg_page(sc, 0, MPII_PG_POLL(1<<1), &hdr, 1, &ipg,
   sizeof(ipg)) != 0) {
DNPRINTF(MPII_D_MISC, "%s: unable to fetch IOC page 1\n"
    "page 1\n", DEVNAME(sc));
return (1);
}

if (!ISSET(lemtoh32(&ipg.flags), MPII_CFG_IOC_1_REPLY_COALESCING)((((__uint32_t)(*(__uint32_t *)(&ipg.flags)))) & ((1<<
0))))
return (0);

/* Disable coalescing */
CLR(ipg.flags, htole32(MPII_CFG_IOC_1_REPLY_COALESCING))((ipg.flags) &= ~(((__uint32_t)((1<<0)))));
if (mpii_req_cfg_page(sc, 0, MPII_PG_POLL(1<<1), &hdr, 0, &ipg,
   sizeof(ipg)) != 0) {
DNPRINTF(MPII_D_MISC, "%s: unable to clear coalescing\n",
    DEVNAME(sc));
return (1);
}

return (0);
1719}

1721#define MPII_EVENT_MASKALL(enq)do { enq->event_masks[0] = 0xffffffff; enq->event_masks
[1] = 0xffffffff; enq->event_masks[2] = 0xffffffff; enq->
event_masks[3] = 0xffffffff; } while (0)		do {			\
enq->event_masks[0] = 0xffffffff;		\
enq->event_masks[1] = 0xffffffff;		\
enq->event_masks[2] = 0xffffffff;		\
enq->event_masks[3] = 0xffffffff;		\
} while (0)

1728#define MPII_EVENT_UNMASK(enq, evt)do { enq->event_masks[evt / 32] &= ((__uint32_t)(~(1 <<
 (evt % 32)))); } while (0)	do {			\
enq->event_masks[evt / 32] &=			\
    htole32(~(1 << (evt % 32)))((__uint32_t)(~(1 << (evt % 32))));		\
} while (0)

1733int
1734mpii_eventnotify(struct mpii_softc *sc)
1735{
struct mpii_msg_event_request		*enq;
struct mpii_ccb				*ccb;

ccb = scsi_io_get(&sc->sc_iopool, 0);
if (ccb == NULL((void *)0)) {
DNPRINTF(MPII_D_MISC, "%s: mpii_eventnotify ccb_get\n",
    DEVNAME(sc));
return (1);
}

SIMPLEQ_INIT(&sc->sc_evt_sas_queue)do { (&sc->sc_evt_sas_queue)->sqh_first = ((void *)
0); (&sc->sc_evt_sas_queue)->sqh_last = &(&
sc->sc_evt_sas_queue)->sqh_first; } while (0);
mtx_init(&sc->sc_evt_sas_mtx, IPL_BIO)do { (void)(((void *)0)); (void)(0); __mtx_init((&sc->
sc_evt_sas_mtx), ((((0x3)) > 0x0 && ((0x3)) < 0x9
) ? 0x9 : ((0x3)))); } while (0);
task_set(&sc->sc_evt_sas_task, mpii_event_sas, sc);

SIMPLEQ_INIT(&sc->sc_evt_ack_queue)do { (&sc->sc_evt_ack_queue)->sqh_first = ((void *)
0); (&sc->sc_evt_ack_queue)->sqh_last = &(&
sc->sc_evt_ack_queue)->sqh_first; } while (0);
mtx_init(&sc->sc_evt_ack_mtx, IPL_BIO)do { (void)(((void *)0)); (void)(0); __mtx_init((&sc->
sc_evt_ack_mtx), ((((0x3)) > 0x0 && ((0x3)) < 0x9
) ? 0x9 : ((0x3)))); } while (0);
scsi_ioh_set(&sc->sc_evt_ack_handler, &sc->sc_iopool,
   mpii_eventack, sc);

ccb->ccb_done = mpii_eventnotify_done;
enq = ccb->ccb_cmd;

enq->function = MPII_FUNCTION_EVENT_NOTIFICATION(0x07);

/*
* Enable reporting of the following events:
*
* MPII_EVENT_SAS_DISCOVERY
* MPII_EVENT_SAS_TOPOLOGY_CHANGE_LIST
* MPII_EVENT_SAS_DEVICE_STATUS_CHANGE
* MPII_EVENT_SAS_ENCL_DEVICE_STATUS_CHANGE
* MPII_EVENT_IR_CONFIGURATION_CHANGE_LIST
* MPII_EVENT_IR_VOLUME
* MPII_EVENT_IR_PHYSICAL_DISK
* MPII_EVENT_IR_OPERATION_STATUS
*/

MPII_EVENT_MASKALL(enq)do { enq->event_masks[0] = 0xffffffff; enq->event_masks
[1] = 0xffffffff; enq->event_masks[2] = 0xffffffff; enq->
event_masks[3] = 0xffffffff; } while (0);
MPII_EVENT_UNMASK(enq, MPII_EVENT_SAS_DISCOVERY)do { enq->event_masks[(0x16) / 32] &= ((__uint32_t)(~(
<< ((0x16) % 32)))); } while (0);
MPII_EVENT_UNMASK(enq, MPII_EVENT_SAS_TOPOLOGY_CHANGE_LIST)do { enq->event_masks[(0x1c) / 32] &= ((__uint32_t)(~(
<< ((0x1c) % 32)))); } while (0);
MPII_EVENT_UNMASK(enq, MPII_EVENT_SAS_DEVICE_STATUS_CHANGE)do { enq->event_masks[(0x0f) / 32] &= ((__uint32_t)(~(
<< ((0x0f) % 32)))); } while (0);
MPII_EVENT_UNMASK(enq, MPII_EVENT_SAS_ENCL_DEVICE_STATUS_CHANGE)do { enq->event_masks[(0x1d) / 32] &= ((__uint32_t)(~(
<< ((0x1d) % 32)))); } while (0);
MPII_EVENT_UNMASK(enq, MPII_EVENT_IR_CONFIGURATION_CHANGE_LIST)do { enq->event_masks[(0x20) / 32] &= ((__uint32_t)(~(
<< ((0x20) % 32)))); } while (0);
MPII_EVENT_UNMASK(enq, MPII_EVENT_IR_VOLUME)do { enq->event_masks[(0x1e) / 32] &= ((__uint32_t)(~(
<< ((0x1e) % 32)))); } while (0);
MPII_EVENT_UNMASK(enq, MPII_EVENT_IR_PHYSICAL_DISK)do { enq->event_masks[(0x1f) / 32] &= ((__uint32_t)(~(
<< ((0x1f) % 32)))); } while (0);
MPII_EVENT_UNMASK(enq, MPII_EVENT_IR_OPERATION_STATUS)do { enq->event_masks[(0x14) / 32] &= ((__uint32_t)(~(
<< ((0x14) % 32)))); } while (0);

mpii_start(sc, ccb);

return (0);
1786}

1788void
1789mpii_eventnotify_done(struct mpii_ccb *ccb)
1790{
struct mpii_softc			*sc = ccb->ccb_sc;
struct mpii_rcb				*rcb = ccb->ccb_rcb;

DNPRINTF(MPII_D_EVT, "%s: mpii_eventnotify_done\n", DEVNAME(sc));

scsi_io_put(&sc->sc_iopool, ccb);
mpii_event_process(sc, rcb);
1798}

1800void
1801mpii_event_raid(struct mpii_softc *sc, struct mpii_msg_event_reply *enp)
1802{
struct mpii_evt_ir_cfg_change_list	*ccl;
struct mpii_evt_ir_cfg_element		*ce;
struct mpii_device			*dev;
u_int16_t				type;
int					i;

ccl = (struct mpii_evt_ir_cfg_change_list *)(enp + 1);
if (ccl->num_elements == 0)
return;

if (ISSET(lemtoh32(&ccl->flags), MPII_EVT_IR_CFG_CHANGE_LIST_FOREIGN)((((__uint32_t)(*(__uint32_t *)(&ccl->flags)))) & (
(0x1)))) {
/* bail on foreign configurations */
return;
}

ce = (struct mpii_evt_ir_cfg_element *)(ccl + 1);

for (i = 0; i < ccl->num_elements; i++, ce++) {
type = (lemtoh16(&ce->element_flags)((__uint16_t)(*(__uint16_t *)(&ce->element_flags))) &
    MPII_EVT_IR_CFG_ELEMENT_TYPE_MASK(0xf));

switch (type) {
case MPII_EVT_IR_CFG_ELEMENT_TYPE_VOLUME(0x0):
	switch (ce->reason_code) {
	case MPII_EVT_IR_CFG_ELEMENT_RC_ADDED(0x01):
	case MPII_EVT_IR_CFG_ELEMENT_RC_VOLUME_CREATED(0x06):
		if (mpii_find_dev(sc,
		    lemtoh16(&ce->vol_dev_handle)((__uint16_t)(*(__uint16_t *)(&ce->vol_dev_handle))))) {
			printf("%s: device %#x is already "
			    "configured\n", DEVNAME(sc)((sc)->sc_dev.dv_xname),
			    lemtoh16(&ce->vol_dev_handle)((__uint16_t)(*(__uint16_t *)(&ce->vol_dev_handle))));
			break;
		}
		dev = malloc(sizeof(*dev), M_DEVBUF2,
		    M_NOWAIT0x0002 | M_ZERO0x0008);
		if (!dev) {
			printf("%s: failed to allocate a "
			    "device structure\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
			break;
		}
		SET(dev->flags, MPII_DF_VOLUME)((dev->flags) |= ((0x0010)));
		dev->slot = sc->sc_vd_id_low;
		dev->dev_handle = lemtoh16(&ce->vol_dev_handle)((__uint16_t)(*(__uint16_t *)(&ce->vol_dev_handle)));
		if (mpii_insert_dev(sc, dev)) {
			free(dev, M_DEVBUF2, sizeof *dev);
			break;
		}
		sc->sc_vd_count++;
		break;
	case MPII_EVT_IR_CFG_ELEMENT_RC_REMOVED(0x02):
	case MPII_EVT_IR_CFG_ELEMENT_RC_VOLUME_DELETED(0x07):
		if (!(dev = mpii_find_dev(sc,
		    lemtoh16(&ce->vol_dev_handle)((__uint16_t)(*(__uint16_t *)(&ce->vol_dev_handle))))))
			break;
		mpii_remove_dev(sc, dev);
		sc->sc_vd_count--;
		break;
	}
	break;
case MPII_EVT_IR_CFG_ELEMENT_TYPE_VOLUME_DISK(0x1):
	if (ce->reason_code ==
	    MPII_EVT_IR_CFG_ELEMENT_RC_PD_CREATED(0x08) ||
	    ce->reason_code ==
	    MPII_EVT_IR_CFG_ELEMENT_RC_HIDE(0x04)) {
		/* there should be an underlying sas drive */
		if (!(dev = mpii_find_dev(sc,
		    lemtoh16(&ce->phys_disk_dev_handle)((__uint16_t)(*(__uint16_t *)(&ce->phys_disk_dev_handle
))))))
			break;
		/* promoted from a hot spare? */
		CLR(dev->flags, MPII_DF_HOT_SPARE)((dev->flags) &= ~((0x0040)));
		SET(dev->flags, MPII_DF_VOLUME_DISK |((dev->flags) |= ((0x0020) | (0x0004)))
		    MPII_DF_HIDDEN)((dev->flags) |= ((0x0020) | (0x0004)));
	}
	break;
case MPII_EVT_IR_CFG_ELEMENT_TYPE_HOT_SPARE(0x2):
	if (ce->reason_code ==
	    MPII_EVT_IR_CFG_ELEMENT_RC_HIDE(0x04)) {
		/* there should be an underlying sas drive */
		if (!(dev = mpii_find_dev(sc,
		    lemtoh16(&ce->phys_disk_dev_handle)((__uint16_t)(*(__uint16_t *)(&ce->phys_disk_dev_handle
))))))
			break;
		SET(dev->flags, MPII_DF_HOT_SPARE |((dev->flags) |= ((0x0040) | (0x0004)))
		    MPII_DF_HIDDEN)((dev->flags) |= ((0x0040) | (0x0004)));
	}
	break;
}
}
1890}

1892void
1893mpii_event_sas(void *xsc)
1894{
struct mpii_softc *sc = xsc;
struct mpii_rcb *rcb, *next;
struct mpii_msg_event_reply *enp;
struct mpii_evt_sas_tcl		*tcl;
struct mpii_evt_phy_entry	*pe;
struct mpii_device		*dev;
int				i;
u_int16_t			handle;

mtx_enter(&sc->sc_evt_sas_mtx);
rcb = SIMPLEQ_FIRST(&sc->sc_evt_sas_queue)((&sc->sc_evt_sas_queue)->sqh_first);
if (rcb != NULL((void *)0)) {
next = SIMPLEQ_NEXT(rcb, rcb_link)((rcb)->rcb_link.sqe_next);
SIMPLEQ_REMOVE_HEAD(&sc->sc_evt_sas_queue, rcb_link)do { if (((&sc->sc_evt_sas_queue)->sqh_first = (&
sc->sc_evt_sas_queue)->sqh_first->rcb_link.sqe_next)
 == ((void *)0)) (&sc->sc_evt_sas_queue)->sqh_last =
 &(&sc->sc_evt_sas_queue)->sqh_first; } while (
0);
}
mtx_leave(&sc->sc_evt_sas_mtx);

if (rcb == NULL((void *)0))
return;
if (next != NULL((void *)0))
task_add(systq, &sc->sc_evt_sas_task);

enp = (struct mpii_msg_event_reply *)rcb->rcb_reply;
switch (lemtoh16(&enp->event)((__uint16_t)(*(__uint16_t *)(&enp->event)))) {
case MPII_EVENT_SAS_DISCOVERY(0x16):
mpii_event_discovery(sc, enp);
goto done;
case MPII_EVENT_SAS_TOPOLOGY_CHANGE_LIST(0x1c):
/* handle below */
break;
default:
panic("%s: unexpected event %#x in sas event queue",
    DEVNAME(sc)((sc)->sc_dev.dv_xname), lemtoh16(&enp->event)((__uint16_t)(*(__uint16_t *)(&enp->event))));
/* NOTREACHED */
}

tcl = (struct mpii_evt_sas_tcl *)(enp + 1);
pe = (struct mpii_evt_phy_entry *)(tcl + 1);

for (i = 0; i < tcl->num_entries; i++, pe++) {
switch (pe->phy_status & MPII_EVENT_SAS_TOPO_PS_RC_MASK(0x0f)) {
case MPII_EVENT_SAS_TOPO_PS_RC_ADDED(0x01):
	handle = lemtoh16(&pe->dev_handle)((__uint16_t)(*(__uint16_t *)(&pe->dev_handle)));
	if (mpii_find_dev(sc, handle)) {
		printf("%s: device %#x is already "
		    "configured\n", DEVNAME(sc)((sc)->sc_dev.dv_xname), handle);
		break;
	}

	dev = malloc(sizeof(*dev), M_DEVBUF2, M_WAITOK0x0001 | M_ZERO0x0008);
	dev->slot = sc->sc_pd_id_start + tcl->start_phy_num + i;
	dev->dev_handle = handle;
	dev->phy_num = tcl->start_phy_num + i;
	if (tcl->enclosure_handle)
		dev->physical_port = tcl->physical_port;
	dev->enclosure = lemtoh16(&tcl->enclosure_handle)((__uint16_t)(*(__uint16_t *)(&tcl->enclosure_handle))
);
	dev->expander = lemtoh16(&tcl->expander_handle)((__uint16_t)(*(__uint16_t *)(&tcl->expander_handle)));

	if (mpii_insert_dev(sc, dev)) {
		free(dev, M_DEVBUF2, sizeof *dev);
		break;
	}

	if (sc->sc_scsibus != NULL((void *)0))
		scsi_probe_target(sc->sc_scsibus, dev->slot);
	break;

case MPII_EVENT_SAS_TOPO_PS_RC_MISSING(0x02):
	dev = mpii_find_dev(sc, lemtoh16(&pe->dev_handle)((__uint16_t)(*(__uint16_t *)(&pe->dev_handle))));
	if (dev == NULL((void *)0))
		break;

	mpii_remove_dev(sc, dev);
	mpii_sas_remove_device(sc, dev->dev_handle);
	if (sc->sc_scsibus != NULL((void *)0) &&
	    !ISSET(dev->flags, MPII_DF_HIDDEN)((dev->flags) & ((0x0004)))) {
		scsi_activate(sc->sc_scsibus, dev->slot, -1,
		    DVACT_DEACTIVATE1);
		scsi_detach_target(sc->sc_scsibus, dev->slot,
		    DETACH_FORCE0x01);
	}

	free(dev, M_DEVBUF2, sizeof *dev);
	break;
}
}

1982done:
mpii_event_done(sc, rcb);
1984}

1986void
1987mpii_event_discovery(struct mpii_softc *sc, struct mpii_msg_event_reply *enp)
1988{
struct mpii_evt_sas_discovery *esd =
   (struct mpii_evt_sas_discovery *)(enp + 1);

if (sc->sc_pending == 0)
return;

switch (esd->reason_code) {
case MPII_EVENT_SAS_DISC_REASON_CODE_STARTED(0x01):
++sc->sc_pending;
break;
case MPII_EVENT_SAS_DISC_REASON_CODE_COMPLETED(0x02):
if (--sc->sc_pending == 1) {
	sc->sc_pending = 0;
	config_pending_decr();
}
break;
}
2006}

2008void
2009mpii_event_process(struct mpii_softc *sc, struct mpii_rcb *rcb)
2010{
struct mpii_msg_event_reply		*enp;

enp = (struct mpii_msg_event_reply *)rcb->rcb_reply;

DNPRINTF(MPII_D_EVT, "%s: mpii_event_process: %#x\n", DEVNAME(sc),
   lemtoh16(&enp->event));

switch (lemtoh16(&enp->event)((__uint16_t)(*(__uint16_t *)(&enp->event)))) {
case MPII_EVENT_EVENT_CHANGE(0x0a):
/* should be properly ignored */
break;
case MPII_EVENT_SAS_DISCOVERY(0x16):
case MPII_EVENT_SAS_TOPOLOGY_CHANGE_LIST(0x1c):
mtx_enter(&sc->sc_evt_sas_mtx);
SIMPLEQ_INSERT_TAIL(&sc->sc_evt_sas_queue, rcb, rcb_link)do { (rcb)->rcb_link.sqe_next = ((void *)0); *(&sc->
sc_evt_sas_queue)->sqh_last = (rcb); (&sc->sc_evt_sas_queue
)->sqh_last = &(rcb)->rcb_link.sqe_next; } while (0
);
mtx_leave(&sc->sc_evt_sas_mtx);
task_add(systq, &sc->sc_evt_sas_task);
return;
case MPII_EVENT_SAS_DEVICE_STATUS_CHANGE(0x0f):
break;
case MPII_EVENT_SAS_ENCL_DEVICE_STATUS_CHANGE(0x1d):
break;
case MPII_EVENT_IR_VOLUME(0x1e): {
struct mpii_evt_ir_volume	*evd =
    (struct mpii_evt_ir_volume *)(enp + 1);
struct mpii_device		*dev;
2037#if NBIO1 > 0
const char *vol_states[] = {
	BIOC_SVINVALID_S"Invalid",
	BIOC_SVOFFLINE_S"Offline",
	BIOC_SVBUILDING_S"Building",
	BIOC_SVONLINE_S"Online",
	BIOC_SVDEGRADED_S"Degraded",
	BIOC_SVONLINE_S"Online",
};
2046#endif

if (cold)
	break;
KERNEL_LOCK()_kernel_lock();
dev = mpii_find_dev(sc, lemtoh16(&evd->vol_dev_handle)((__uint16_t)(*(__uint16_t *)(&evd->vol_dev_handle))));
KERNEL_UNLOCK()_kernel_unlock();
if (dev == NULL((void *)0))
	break;
2055#if NBIO1 > 0
if (evd->reason_code == MPII_EVENT_IR_VOL_RC_STATE_CHANGED(0x03))
	printf("%s: volume %d state changed from %s to %s\n",
	    DEVNAME(sc)((sc)->sc_dev.dv_xname), dev->slot - sc->sc_vd_id_low,
	    vol_states[evd->prev_value],
	    vol_states[evd->new_value]);
2061#endif
if (evd->reason_code == MPII_EVENT_IR_VOL_RC_STATUS_CHANGED(0x02) &&
    ISSET(evd->new_value, MPII_CFG_RAID_VOL_0_STATUS_RESYNC)((evd->new_value) & ((1<<16))) &&
    !ISSET(evd->prev_value, MPII_CFG_RAID_VOL_0_STATUS_RESYNC)((evd->prev_value) & ((1<<16))))
	printf("%s: started resync on a volume %d\n",
	    DEVNAME(sc)((sc)->sc_dev.dv_xname), dev->slot - sc->sc_vd_id_low);
}
break;
case MPII_EVENT_IR_PHYSICAL_DISK(0x1f):
break;
case MPII_EVENT_IR_CONFIGURATION_CHANGE_LIST(0x20):
mpii_event_raid(sc, enp);
break;
case MPII_EVENT_IR_OPERATION_STATUS(0x14): {
struct mpii_evt_ir_status	*evs =
    (struct mpii_evt_ir_status *)(enp + 1);
struct mpii_device		*dev;

KERNEL_LOCK()_kernel_lock();
dev = mpii_find_dev(sc, lemtoh16(&evs->vol_dev_handle)((__uint16_t)(*(__uint16_t *)(&evs->vol_dev_handle))));
KERNEL_UNLOCK()_kernel_unlock();
if (dev != NULL((void *)0) &&
    evs->operation == MPII_EVENT_IR_RAIDOP_RESYNC(0x00))
	dev->percent = evs->percent;
break;
}
default:
DNPRINTF(MPII_D_EVT, "%s:  unhandled event 0x%02x\n",
    DEVNAME(sc), lemtoh16(&enp->event));
}

mpii_event_done(sc, rcb);
2093}

2095void
2096mpii_event_done(struct mpii_softc *sc, struct mpii_rcb *rcb)
2097{
struct mpii_msg_event_reply *enp = rcb->rcb_reply;

if (enp->ack_required) {
mtx_enter(&sc->sc_evt_ack_mtx);
SIMPLEQ_INSERT_TAIL(&sc->sc_evt_ack_queue, rcb, rcb_link)do { (rcb)->rcb_link.sqe_next = ((void *)0); *(&sc->
sc_evt_ack_queue)->sqh_last = (rcb); (&sc->sc_evt_ack_queue
)->sqh_last = &(rcb)->rcb_link.sqe_next; } while (0
);
mtx_leave(&sc->sc_evt_ack_mtx);
scsi_ioh_add(&sc->sc_evt_ack_handler);
} else
mpii_push_reply(sc, rcb);
2107}

2109void
2110mpii_sas_remove_device(struct mpii_softc *sc, u_int16_t handle)
2111{
struct mpii_msg_scsi_task_request	*stq;
struct mpii_msg_sas_oper_request	*soq;
struct mpii_ccb				*ccb;

ccb = scsi_io_get(&sc->sc_iopool, 0);
if (ccb == NULL((void *)0))
return;

stq = ccb->ccb_cmd;
stq->function = MPII_FUNCTION_SCSI_TASK_MGMT(0x01);
stq->task_type = MPII_SCSI_TASK_TARGET_RESET(0x03);
htolem16(&stq->dev_handle, handle)(*(__uint16_t *)(&stq->dev_handle) = ((__uint16_t)(handle
)));

ccb->ccb_done = mpii_empty_done;
mpii_wait(sc, ccb);

if (ccb->ccb_rcb != NULL((void *)0))
mpii_push_reply(sc, ccb->ccb_rcb);

/* reuse a ccb */
ccb->ccb_state = MPII_CCB_READY;
ccb->ccb_rcb = NULL((void *)0);

soq = ccb->ccb_cmd;
memset(soq, 0, sizeof(*soq))__builtin_memset((soq), (0), (sizeof(*soq)));
soq->function = MPII_FUNCTION_SAS_IO_UNIT_CONTROL(0x1b);
soq->operation = MPII_SAS_OP_REMOVE_DEVICE(0x0d);
htolem16(&soq->dev_handle, handle)(*(__uint16_t *)(&soq->dev_handle) = ((__uint16_t)(handle
)));

ccb->ccb_done = mpii_empty_done;
mpii_wait(sc, ccb);
if (ccb->ccb_rcb != NULL((void *)0))
mpii_push_reply(sc, ccb->ccb_rcb);

scsi_io_put(&sc->sc_iopool, ccb);
2147}

2149int
2150mpii_board_info(struct mpii_softc *sc)
2151{
struct mpii_msg_iocfacts_request	ifq;
struct mpii_msg_iocfacts_reply		ifp;
struct mpii_cfg_manufacturing_pg0	mpg;
struct mpii_cfg_hdr			hdr;

memset(&ifq, 0, sizeof(ifq))__builtin_memset((&ifq), (0), (sizeof(ifq)));
memset(&ifp, 0, sizeof(ifp))__builtin_memset((&ifp), (0), (sizeof(ifp)));

ifq.function = MPII_FUNCTION_IOC_FACTS(0x03);

if (mpii_handshake_send(sc, &ifq, dwordsof(ifq)(sizeof(ifq) / sizeof(u_int32_t))) != 0) {
DNPRINTF(MPII_D_MISC, "%s: failed to request ioc facts\n",
    DEVNAME(sc));
return (1);
}

if (mpii_handshake_recv(sc, &ifp, dwordsof(ifp)(sizeof(ifp) / sizeof(u_int32_t))) != 0) {
DNPRINTF(MPII_D_MISC, "%s: failed to receive ioc facts\n",
    DEVNAME(sc));
return (1);
}

hdr.page_version = 0;
hdr.page_length = sizeof(mpg) / 4;
hdr.page_number = 0;
hdr.page_type = MPII_CONFIG_REQ_PAGE_TYPE_MANUFACTURING(0x09);
memset(&mpg, 0, sizeof(mpg))__builtin_memset((&mpg), (0), (sizeof(mpg)));
if (mpii_req_cfg_page(sc, 0, MPII_PG_POLL(1<<1), &hdr, 1, &mpg,
   sizeof(mpg)) != 0) {
printf("%s: unable to fetch manufacturing page 0\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (EINVAL22);
}

printf("%s: %s, firmware %u.%u.%u.%u%s, MPI %u.%u\n", DEVNAME(sc)((sc)->sc_dev.dv_xname),
   mpg.board_name, ifp.fw_version_maj, ifp.fw_version_min,
   ifp.fw_version_unit, ifp.fw_version_dev,
   ISSET(sc->sc_flags, MPII_F_RAID)((sc->sc_flags) & ((1<<1))) ? " IR" : "",
   ifp.msg_version_maj, ifp.msg_version_min);

return (0);
2193}

2195int
2196mpii_target_map(struct mpii_softc *sc)
2197{
struct mpii_cfg_hdr			hdr;
struct mpii_cfg_ioc_pg8			ipg;
int					flags, pad = 0;

hdr.page_version = 0;
hdr.page_length = sizeof(ipg) / 4;
hdr.page_number = 8;
hdr.page_type = MPII_CONFIG_REQ_PAGE_TYPE_IOC(0x01);
memset(&ipg, 0, sizeof(ipg))__builtin_memset((&ipg), (0), (sizeof(ipg)));
if (mpii_req_cfg_page(sc, 0, MPII_PG_POLL(1<<1), &hdr, 1, &ipg,
   sizeof(ipg)) != 0) {
printf("%s: unable to fetch ioc page 8\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (EINVAL22);
}

if (lemtoh16(&ipg.flags)((__uint16_t)(*(__uint16_t *)(&ipg.flags))) & MPII_IOC_PG8_FLAGS_RESERVED_TARGETID_0(1<<4))
pad = 1;

flags = lemtoh16(&ipg.ir_volume_mapping_flags)((__uint16_t)(*(__uint16_t *)(&ipg.ir_volume_mapping_flags
))) &
   MPII_IOC_PG8_IRFLAGS_VOLUME_MAPPING_MODE_MASK(0x00000003);
if (ISSET(sc->sc_flags, MPII_F_RAID)((sc->sc_flags) & ((1<<1)))) {
if (flags == MPII_IOC_PG8_IRFLAGS_LOW_VOLUME_MAPPING(0<<0)) {
	sc->sc_vd_id_low += pad;
	pad = sc->sc_max_volumes; /* for sc_pd_id_start */
} else
	sc->sc_vd_id_low = sc->sc_max_devices -
	    sc->sc_max_volumes;
}

sc->sc_pd_id_start += pad;

return (0);
2231}

2233int
2234mpii_req_cfg_header(struct mpii_softc *sc, u_int8_t type, u_int8_t number,
  u_int32_t address, int flags, void *p)
2236{
struct mpii_msg_config_request		*cq;
struct mpii_msg_config_reply		*cp;
struct mpii_ccb				*ccb;
struct mpii_cfg_hdr			*hdr = p;
struct mpii_ecfg_hdr			*ehdr = p;
int					etype = 0;
int					rv = 0;

DNPRINTF(MPII_D_MISC, "%s: mpii_req_cfg_header type: %#x number: %x "
   "address: 0x%08x flags: 0x%b\n", DEVNAME(sc), type, number,
   address, flags, MPII_PG_FMT);

ccb = scsi_io_get(&sc->sc_iopool,
   ISSET(flags, MPII_PG_POLL)((flags) & ((1<<1))) ? SCSI_NOSLEEP0x00001 : 0);
if (ccb == NULL((void *)0)) {
DNPRINTF(MPII_D_MISC, "%s: mpii_cfg_header ccb_get\n",
    DEVNAME(sc));
return (1);
}

if (ISSET(flags, MPII_PG_EXTENDED)((flags) & ((1<<0)))) {
etype = type;
type = MPII_CONFIG_REQ_PAGE_TYPE_EXTENDED(0x0f);
}

cq = ccb->ccb_cmd;

cq->function = MPII_FUNCTION_CONFIG(0x04);

cq->action = MPII_CONFIG_REQ_ACTION_PAGE_HEADER(0x00);

cq->config_header.page_number = number;
cq->config_header.page_type = type;
cq->ext_page_type = etype;
htolem32(&cq->page_address, address)(*(__uint32_t *)(&cq->page_address) = ((__uint32_t)(address
)));
htolem32(&cq->page_buffer.sg_hdr, MPII_SGE_FL_TYPE_SIMPLE |(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24))))
   MPII_SGE_FL_LAST | MPII_SGE_FL_EOB | MPII_SGE_FL_EOL)(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24))));

ccb->ccb_done = mpii_empty_done;
if (ISSET(flags, MPII_PG_POLL)((flags) & ((1<<1)))) {
if (mpii_poll(sc, ccb) != 0) {
	DNPRINTF(MPII_D_MISC, "%s: mpii_cfg_header poll\n",
	    DEVNAME(sc));
	return (1);
}
} else
mpii_wait(sc, ccb);

if (ccb->ccb_rcb == NULL((void *)0)) {
scsi_io_put(&sc->sc_iopool, ccb);
return (1);
}
cp = ccb->ccb_rcb->rcb_reply;

DNPRINTF(MPII_D_MISC, "%s:  action: 0x%02x sgl_flags: 0x%02x "
   "msg_length: %d function: 0x%02x\n", DEVNAME(sc), cp->action,
   cp->sgl_flags, cp->msg_length, cp->function);
DNPRINTF(MPII_D_MISC, "%s:  ext_page_length: %d ext_page_type: 0x%02x "
   "msg_flags: 0x%02x\n", DEVNAME(sc),
   lemtoh16(&cp->ext_page_length), cp->ext_page_type,
   cp->msg_flags);
DNPRINTF(MPII_D_MISC, "%s:  vp_id: 0x%02x vf_id: 0x%02x\n", DEVNAME(sc),
   cp->vp_id, cp->vf_id);
DNPRINTF(MPII_D_MISC, "%s:  ioc_status: 0x%04x\n", DEVNAME(sc),
   lemtoh16(&cp->ioc_status));
DNPRINTF(MPII_D_MISC, "%s:  ioc_loginfo: 0x%08x\n", DEVNAME(sc),
   lemtoh32(&cp->ioc_loginfo));
DNPRINTF(MPII_D_MISC, "%s:  page_version: 0x%02x page_length: %d "
   "page_number: 0x%02x page_type: 0x%02x\n", DEVNAME(sc),
   cp->config_header.page_version,
   cp->config_header.page_length,
   cp->config_header.page_number,
   cp->config_header.page_type);

if (lemtoh16(&cp->ioc_status)((__uint16_t)(*(__uint16_t *)(&cp->ioc_status))) != MPII_IOCSTATUS_SUCCESS(0x0000))
rv = 1;
else if (ISSET(flags, MPII_PG_EXTENDED)((flags) & ((1<<0)))) {
memset(ehdr, 0, sizeof(*ehdr))__builtin_memset((ehdr), (0), (sizeof(*ehdr)));
ehdr->page_version = cp->config_header.page_version;
ehdr->page_number = cp->config_header.page_number;
ehdr->page_type = cp->config_header.page_type;
ehdr->ext_page_length = cp->ext_page_length;
ehdr->ext_page_type = cp->ext_page_type;
} else
*hdr = cp->config_header;

mpii_push_reply(sc, ccb->ccb_rcb);
scsi_io_put(&sc->sc_iopool, ccb);

return (rv);
2327}

2329int
2330mpii_req_cfg_page(struct mpii_softc *sc, u_int32_t address, int flags,
  void *p, int read, void *page, size_t len)
2332{
struct mpii_msg_config_request		*cq;
struct mpii_msg_config_reply		*cp;
struct mpii_ccb				*ccb;
struct mpii_cfg_hdr			*hdr = p;
struct mpii_ecfg_hdr			*ehdr = p;
caddr_t					kva;
int					page_length;
int					rv = 0;

DNPRINTF(MPII_D_MISC, "%s: mpii_cfg_page address: %d read: %d "
   "type: %x\n", DEVNAME(sc), address, read, hdr->page_type);

page_length = ISSET(flags, MPII_PG_EXTENDED)((flags) & ((1<<0))) ?
   lemtoh16(&ehdr->ext_page_length)((__uint16_t)(*(__uint16_t *)(&ehdr->ext_page_length))
) : hdr->page_length;

if (len > sc->sc_request_size - sizeof(*cq) || len < page_length * 4)
return (1);

ccb = scsi_io_get(&sc->sc_iopool,
   ISSET(flags, MPII_PG_POLL)((flags) & ((1<<1))) ? SCSI_NOSLEEP0x00001 : 0);
if (ccb == NULL((void *)0)) {
DNPRINTF(MPII_D_MISC, "%s: mpii_cfg_page ccb_get\n",
    DEVNAME(sc));
return (1);
}

cq = ccb->ccb_cmd;

cq->function = MPII_FUNCTION_CONFIG(0x04);

cq->action = (read ? MPII_CONFIG_REQ_ACTION_PAGE_READ_CURRENT(0x01) :
   MPII_CONFIG_REQ_ACTION_PAGE_WRITE_CURRENT(0x02));

if (ISSET(flags, MPII_PG_EXTENDED)((flags) & ((1<<0)))) {
cq->config_header.page_version = ehdr->page_version;
cq->config_header.page_number = ehdr->page_number;
cq->config_header.page_type = ehdr->page_type;
cq->ext_page_len = ehdr->ext_page_length;
cq->ext_page_type = ehdr->ext_page_type;
} else
cq->config_header = *hdr;
cq->config_header.page_type &= MPII_CONFIG_REQ_PAGE_TYPE_MASK(0x0f);
htolem32(&cq->page_address, address)(*(__uint32_t *)(&cq->page_address) = ((__uint32_t)(address
)));
htolem32(&cq->page_buffer.sg_hdr, MPII_SGE_FL_TYPE_SIMPLE |(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24) | (0x1<<25) | (page_length * 4) | (read ? (0x0<<
26) : (0x1<<26)))))
   MPII_SGE_FL_LAST | MPII_SGE_FL_EOB | MPII_SGE_FL_EOL |(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24) | (0x1<<25) | (page_length * 4) | (read ? (0x0<<
26) : (0x1<<26)))))
   MPII_SGE_FL_SIZE_64 | (page_length * 4) |(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24) | (0x1<<25) | (page_length * 4) | (read ? (0x0<<
26) : (0x1<<26)))))
   (read ? MPII_SGE_FL_DIR_IN : MPII_SGE_FL_DIR_OUT))(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24) | (0x1<<25) | (page_length * 4) | (read ? (0x0<<
26) : (0x1<<26)))));

/* bounce the page via the request space to avoid more bus_dma games */
mpii_dvatosge(&cq->page_buffer, ccb->ccb_cmd_dva +
   sizeof(struct mpii_msg_config_request));

kva = ccb->ccb_cmd;
kva += sizeof(struct mpii_msg_config_request);

if (!read)
memcpy(kva, page, len)__builtin_memcpy((kva), (page), (len));

ccb->ccb_done = mpii_empty_done;
if (ISSET(flags, MPII_PG_POLL)((flags) & ((1<<1)))) {
if (mpii_poll(sc, ccb) != 0) {
	DNPRINTF(MPII_D_MISC, "%s: mpii_cfg_header poll\n",
	    DEVNAME(sc));
	return (1);
}
} else
mpii_wait(sc, ccb);

if (ccb->ccb_rcb == NULL((void *)0)) {
scsi_io_put(&sc->sc_iopool, ccb);
return (1);
}
cp = ccb->ccb_rcb->rcb_reply;

DNPRINTF(MPII_D_MISC, "%s:  action: 0x%02x msg_length: %d "
   "function: 0x%02x\n", DEVNAME(sc), cp->action, cp->msg_length,
   cp->function);
DNPRINTF(MPII_D_MISC, "%s:  ext_page_length: %d ext_page_type: 0x%02x "
   "msg_flags: 0x%02x\n", DEVNAME(sc),
   lemtoh16(&cp->ext_page_length), cp->ext_page_type,
   cp->msg_flags);
DNPRINTF(MPII_D_MISC, "%s:  vp_id: 0x%02x vf_id: 0x%02x\n", DEVNAME(sc),
   cp->vp_id, cp->vf_id);
DNPRINTF(MPII_D_MISC, "%s:  ioc_status: 0x%04x\n", DEVNAME(sc),
   lemtoh16(&cp->ioc_status));
DNPRINTF(MPII_D_MISC, "%s:  ioc_loginfo: 0x%08x\n", DEVNAME(sc),
   lemtoh32(&cp->ioc_loginfo));
DNPRINTF(MPII_D_MISC, "%s:  page_version: 0x%02x page_length: %d "
   "page_number: 0x%02x page_type: 0x%02x\n", DEVNAME(sc),
   cp->config_header.page_version,
   cp->config_header.page_length,
   cp->config_header.page_number,
   cp->config_header.page_type);

if (lemtoh16(&cp->ioc_status)((__uint16_t)(*(__uint16_t *)(&cp->ioc_status))) != MPII_IOCSTATUS_SUCCESS(0x0000))
rv = 1;
else if (read)
memcpy(page, kva, len)__builtin_memcpy((page), (kva), (len));

mpii_push_reply(sc, ccb->ccb_rcb);
scsi_io_put(&sc->sc_iopool, ccb);

return (rv);
2436}

2438struct mpii_rcb *
2439mpii_reply(struct mpii_softc *sc, struct mpii_reply_descr *rdp)
2440{
struct mpii_rcb		*rcb = NULL((void *)0);
u_int32_t		rfid;

DNPRINTF(MPII_D_INTR, "%s: mpii_reply\n", DEVNAME(sc));

if ((rdp->reply_flags & MPII_REPLY_DESCR_TYPE_MASK(0x0f)) ==
   MPII_REPLY_DESCR_ADDRESS_REPLY(0x01)) {
rfid = (lemtoh32(&rdp->frame_addr)((__uint32_t)(*(__uint32_t *)(&rdp->frame_addr))) -
    (u_int32_t)MPII_DMA_DVA(sc->sc_replies)((u_int64_t)(sc->sc_replies)->mdm_map->dm_segs[0].ds_addr
)) /
    sc->sc_reply_size;

bus_dmamap_sync(sc->sc_dmat,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (sc->sc_reply_size * rfid), (sc
->sc_reply_size), (0x02))
    MPII_DMA_MAP(sc->sc_replies), sc->sc_reply_size * rfid,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (sc->sc_reply_size * rfid), (sc
->sc_reply_size), (0x02))
    sc->sc_reply_size, BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (sc->sc_reply_size * rfid), (sc
->sc_reply_size), (0x02));

rcb = &sc->sc_rcbs[rfid];
}

memset(rdp, 0xff, sizeof(*rdp))__builtin_memset((rdp), (0xff), (sizeof(*rdp)));

bus_dmamap_sync(sc->sc_dmat, MPII_DMA_MAP(sc->sc_reply_postq),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (8 * sc->sc_reply_post_host_index
), (8), (0x02 | 0x08))
   8 * sc->sc_reply_post_host_index, 8,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (8 * sc->sc_reply_post_host_index
), (8), (0x02 | 0x08))
   BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_reply_postq)->mdm_map)), (8 * sc->sc_reply_post_host_index
), (8), (0x02 | 0x08));

return (rcb);
2466}

2468struct mpii_dmamem *
2469mpii_dmamem_alloc(struct mpii_softc *sc, size_t size)
2470{
struct mpii_dmamem	*mdm;
int			nsegs;

mdm = malloc(sizeof(*mdm), M_DEVBUF2, M_NOWAIT0x0002 | M_ZERO0x0008);
if (mdm == NULL((void *)0))
return (NULL((void *)0));

mdm->mdm_size = size;

if (bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size
), (1), (size), (0), (0x0001 | 0x0002), (&mdm->mdm_map
))
   BUS_DMA_NOWAIT | BUS_DMA_ALLOCNOW, &mdm->mdm_map)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size
), (1), (size), (0), (0x0001 | 0x0002), (&mdm->mdm_map
)) != 0)
goto mdmfree;

if (bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE, 0, &mdm->mdm_seg,(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size
), ((1 << 12)), (0), (&mdm->mdm_seg), (1), (&
nsegs), (0x0001 | 0x1000))
   1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO)(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size
), ((1 << 12)), (0), (&mdm->mdm_seg), (1), (&
nsegs), (0x0001 | 0x1000)) != 0)
goto destroy;

if (bus_dmamem_map(sc->sc_dmat, &mdm->mdm_seg, nsegs, size,(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&mdm
->mdm_seg), (nsegs), (size), (&mdm->mdm_kva), (0x0001
))
   &mdm->mdm_kva, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&mdm
->mdm_seg), (nsegs), (size), (&mdm->mdm_kva), (0x0001
)) != 0)
goto free;

if (bus_dmamap_load(sc->sc_dmat, mdm->mdm_map, mdm->mdm_kva, size,(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (mdm->
mdm_map), (mdm->mdm_kva), (size), (((void *)0)), (0x0001))
   NULL, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (mdm->
mdm_map), (mdm->mdm_kva), (size), (((void *)0)), (0x0001)) != 0)
goto unmap;

return (mdm);

2498unmap:
bus_dmamem_unmap(sc->sc_dmat, mdm->mdm_kva, size)(*(sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), (mdm->
mdm_kva), (size));
2500free:
bus_dmamem_free(sc->sc_dmat, &mdm->mdm_seg, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
mdm->mdm_seg), (1));
2502destroy:
bus_dmamap_destroy(sc->sc_dmat, mdm->mdm_map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (mdm
->mdm_map));
2504mdmfree:
free(mdm, M_DEVBUF2, sizeof *mdm);

return (NULL((void *)0));
2508}

2510void
2511mpii_dmamem_free(struct mpii_softc *sc, struct mpii_dmamem *mdm)
2512{
DNPRINTF(MPII_D_MEM, "%s: mpii_dmamem_free %p\n", DEVNAME(sc), mdm);

bus_dmamap_unload(sc->sc_dmat, mdm->mdm_map)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (mdm
->mdm_map));
bus_dmamem_unmap(sc->sc_dmat, mdm->mdm_kva, mdm->mdm_size)(*(sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), (mdm->
mdm_kva), (mdm->mdm_size));
bus_dmamem_free(sc->sc_dmat, &mdm->mdm_seg, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
mdm->mdm_seg), (1));
bus_dmamap_destroy(sc->sc_dmat, mdm->mdm_map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (mdm
->mdm_map));
free(mdm, M_DEVBUF2, sizeof *mdm);
2520}

2522int
2523mpii_insert_dev(struct mpii_softc *sc, struct mpii_device *dev)
2524{
int		slot;	/* initial hint */

if (dev == NULL((void *)0) || dev->slot < 0)
return (1);
slot = dev->slot;

while (slot < sc->sc_max_devices && sc->sc_devs[slot] != NULL((void *)0))
slot++;

if (slot >= sc->sc_max_devices)
return (1);

dev->slot = slot;
sc->sc_devs[slot] = dev;

return (0);
2541}

2543int
2544mpii_remove_dev(struct mpii_softc *sc, struct mpii_device *dev)
2545{
int			i;

if (dev == NULL((void *)0))
return (1);

for (i = 0; i < sc->sc_max_devices; i++) {
if (sc->sc_devs[i] == NULL((void *)0))
	continue;

if (sc->sc_devs[i]->dev_handle == dev->dev_handle) {
	sc->sc_devs[i] = NULL((void *)0);
	return (0);
}
}

return (1);
2562}

2564struct mpii_device *
2565mpii_find_dev(struct mpii_softc *sc, u_int16_t handle)
2566{
int			i;

for (i = 0; i < sc->sc_max_devices; i++) {
if (sc->sc_devs[i] == NULL((void *)0))
	continue;

if (sc->sc_devs[i]->dev_handle == handle)
	return (sc->sc_devs[i]);
}

return (NULL((void *)0));
2578}

2580int
2581mpii_alloc_ccbs(struct mpii_softc *sc)
2582{
struct mpii_ccb		*ccb;
u_int8_t		*cmd;
int			i;

SIMPLEQ_INIT(&sc->sc_ccb_free)do { (&sc->sc_ccb_free)->sqh_first = ((void *)0); (
&sc->sc_ccb_free)->sqh_last = &(&sc->sc_ccb_free
)->sqh_first; } while (0);
SIMPLEQ_INIT(&sc->sc_ccb_tmos)do { (&sc->sc_ccb_tmos)->sqh_first = ((void *)0); (
&sc->sc_ccb_tmos)->sqh_last = &(&sc->sc_ccb_tmos
)->sqh_first; } while (0);
mtx_init(&sc->sc_ccb_free_mtx, IPL_BIO)do { (void)(((void *)0)); (void)(0); __mtx_init((&sc->
sc_ccb_free_mtx), ((((0x3)) > 0x0 && ((0x3)) < 0x9
) ? 0x9 : ((0x3)))); } while (0);
mtx_init(&sc->sc_ccb_mtx, IPL_BIO)do { (void)(((void *)0)); (void)(0); __mtx_init((&sc->
sc_ccb_mtx), ((((0x3)) > 0x0 && ((0x3)) < 0x9) ?
 0x9 : ((0x3)))); } while (0);
scsi_ioh_set(&sc->sc_ccb_tmo_handler, &sc->sc_iopool,
   mpii_scsi_cmd_tmo_handler, sc);

sc->sc_ccbs = mallocarray((sc->sc_max_cmds-1), sizeof(*ccb),
   M_DEVBUF2, M_NOWAIT0x0002 | M_ZERO0x0008);
if (sc->sc_ccbs == NULL((void *)0)) {
printf("%s: unable to allocate ccbs\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (1);
}

sc->sc_requests = mpii_dmamem_alloc(sc,
   sc->sc_request_size * sc->sc_max_cmds);
if (sc->sc_requests == NULL((void *)0)) {
printf("%s: unable to allocate ccb dmamem\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_ccbs;
}
cmd = MPII_DMA_KVA(sc->sc_requests)((void *)(sc->sc_requests)->mdm_kva);

/*
* we have sc->sc_max_cmds system request message
* frames, but smid zero cannot be used. so we then
* have (sc->sc_max_cmds - 1) number of ccbs
*/
for (i = 1; i < sc->sc_max_cmds; i++) {
ccb = &sc->sc_ccbs[i - 1];

if (bus_dmamap_create(sc->sc_dmat, MAXPHYS, sc->sc_max_sgl,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((64
 * 1024)), (sc->sc_max_sgl), ((64 * 1024)), (0), (0x0001 |
 0x0002 | 0x2000), (&ccb->ccb_dmamap))
    MAXPHYS, 0,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((64
 * 1024)), (sc->sc_max_sgl), ((64 * 1024)), (0), (0x0001 |
 0x0002 | 0x2000), (&ccb->ccb_dmamap))
    BUS_DMA_NOWAIT | BUS_DMA_ALLOCNOW | BUS_DMA_64BIT,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((64
 * 1024)), (sc->sc_max_sgl), ((64 * 1024)), (0), (0x0001 |
 0x0002 | 0x2000), (&ccb->ccb_dmamap))
    &ccb->ccb_dmamap)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((64
 * 1024)), (sc->sc_max_sgl), ((64 * 1024)), (0), (0x0001 |
 0x0002 | 0x2000), (&ccb->ccb_dmamap)) != 0) {
	printf("%s: unable to create dma map\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
	goto free_maps;
}

ccb->ccb_sc = sc;
htolem16(&ccb->ccb_smid, i)(*(__uint16_t *)(&ccb->ccb_smid) = ((__uint16_t)(i)));
ccb->ccb_offset = sc->sc_request_size * i;

ccb->ccb_cmd = &cmd[ccb->ccb_offset];
ccb->ccb_cmd_dva = (u_int32_t)MPII_DMA_DVA(sc->sc_requests)((u_int64_t)(sc->sc_requests)->mdm_map->dm_segs[0].ds_addr
) +
    ccb->ccb_offset;

DNPRINTF(MPII_D_CCB, "%s: mpii_alloc_ccbs(%d) ccb: %p map: %p "
    "sc: %p smid: %#x offs: %#lx cmd: %p dva: %#lx\n",
    DEVNAME(sc), i, ccb, ccb->ccb_dmamap, ccb->ccb_sc,
    ccb->ccb_smid, ccb->ccb_offset, ccb->ccb_cmd,
    ccb->ccb_cmd_dva);

mpii_put_ccb(sc, ccb);
}

scsi_iopool_init(&sc->sc_iopool, sc, mpii_get_ccb, mpii_put_ccb);

return (0);

2646free_maps:
while ((ccb = mpii_get_ccb(sc)) != NULL((void *)0))
bus_dmamap_destroy(sc->sc_dmat, ccb->ccb_dmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (ccb
->ccb_dmamap));

mpii_dmamem_free(sc, sc->sc_requests);
2651free_ccbs:
free(sc->sc_ccbs, M_DEVBUF2, (sc->sc_max_cmds-1) * sizeof(*ccb));

return (1);
2655}

2657void
2658mpii_put_ccb(void *cookie, void *io)
2659{
struct mpii_softc	*sc = cookie;
struct mpii_ccb		*ccb = io;

DNPRINTF(MPII_D_CCB, "%s: mpii_put_ccb %p\n", DEVNAME(sc), ccb);

ccb->ccb_state = MPII_CCB_FREE;
ccb->ccb_cookie = NULL((void *)0);
ccb->ccb_done = NULL((void *)0);
ccb->ccb_rcb = NULL((void *)0);
memset(ccb->ccb_cmd, 0, sc->sc_request_size)__builtin_memset((ccb->ccb_cmd), (0), (sc->sc_request_size
));

KERNEL_UNLOCK()_kernel_unlock();
mtx_enter(&sc->sc_ccb_free_mtx);
SIMPLEQ_INSERT_HEAD(&sc->sc_ccb_free, ccb, ccb_link)do { if (((ccb)->ccb_link.sqe_next = (&sc->sc_ccb_free
)->sqh_first) == ((void *)0)) (&sc->sc_ccb_free)->
sqh_last = &(ccb)->ccb_link.sqe_next; (&sc->sc_ccb_free
)->sqh_first = (ccb); } while (0);
mtx_leave(&sc->sc_ccb_free_mtx);
KERNEL_LOCK()_kernel_lock();
2676}

2678void *
2679mpii_get_ccb(void *cookie)
2680{
struct mpii_softc	*sc = cookie;
struct mpii_ccb		*ccb;

KERNEL_UNLOCK()_kernel_unlock();

mtx_enter(&sc->sc_ccb_free_mtx);
ccb = SIMPLEQ_FIRST(&sc->sc_ccb_free)((&sc->sc_ccb_free)->sqh_first);
if (ccb != NULL((void *)0)) {
SIMPLEQ_REMOVE_HEAD(&sc->sc_ccb_free, ccb_link)do { if (((&sc->sc_ccb_free)->sqh_first = (&sc->
sc_ccb_free)->sqh_first->ccb_link.sqe_next) == ((void *
)0)) (&sc->sc_ccb_free)->sqh_last = &(&sc->
sc_ccb_free)->sqh_first; } while (0);
ccb->ccb_state = MPII_CCB_READY;
}
mtx_leave(&sc->sc_ccb_free_mtx);

KERNEL_LOCK()_kernel_lock();

DNPRINTF(MPII_D_CCB, "%s: mpii_get_ccb %p\n", DEVNAME(sc), ccb);

return (ccb);
2699}

2701int
2702mpii_alloc_replies(struct mpii_softc *sc)
2703{
DNPRINTF(MPII_D_MISC, "%s: mpii_alloc_replies\n", DEVNAME(sc));

sc->sc_rcbs = mallocarray(sc->sc_num_reply_frames,
   sizeof(struct mpii_rcb), M_DEVBUF2, M_NOWAIT0x0002);
if (sc->sc_rcbs == NULL((void *)0))
return (1);

sc->sc_replies = mpii_dmamem_alloc(sc, sc->sc_reply_size *
   sc->sc_num_reply_frames);
if (sc->sc_replies == NULL((void *)0)) {
free(sc->sc_rcbs, M_DEVBUF2,
    sc->sc_num_reply_frames * sizeof(struct mpii_rcb));
return (1);
}

return (0);
2720}

2722void
2723mpii_push_replies(struct mpii_softc *sc)
2724{
struct mpii_rcb		*rcb;
caddr_t			kva = MPII_DMA_KVA(sc->sc_replies)((void *)(sc->sc_replies)->mdm_kva);
int			i;

bus_dmamap_sync(sc->sc_dmat, MPII_DMA_MAP(sc->sc_replies),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (0), (sc->sc_reply_size * sc->
sc_num_reply_frames), (0x01))
   0, sc->sc_reply_size * sc->sc_num_reply_frames,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (0), (sc->sc_reply_size * sc->
sc_num_reply_frames), (0x01))
   BUS_DMASYNC_PREREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (0), (sc->sc_reply_size * sc->
sc_num_reply_frames), (0x01));

for (i = 0; i < sc->sc_num_reply_frames; i++) {
rcb = &sc->sc_rcbs[i];

rcb->rcb_reply = kva + sc->sc_reply_size * i;
rcb->rcb_reply_dva = (u_int32_t)MPII_DMA_DVA(sc->sc_replies)((u_int64_t)(sc->sc_replies)->mdm_map->dm_segs[0].ds_addr
) +
    sc->sc_reply_size * i;
mpii_push_reply(sc, rcb);
}
2741}

2743void
2744mpii_start(struct mpii_softc *sc, struct mpii_ccb *ccb)
2745{
struct mpii_request_header	*rhp;
struct mpii_request_descr	descr;
u_long				 *rdp = (u_long *)&descr;

DNPRINTF(MPII_D_RW, "%s: mpii_start %#lx\n", DEVNAME(sc),
   ccb->ccb_cmd_dva);

bus_dmamap_sync(sc->sc_dmat, MPII_DMA_MAP(sc->sc_requests),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_requests)->mdm_map)), (ccb->ccb_offset), (sc->sc_request_size
), (0x01 | 0x04))
   ccb->ccb_offset, sc->sc_request_size,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_requests)->mdm_map)), (ccb->ccb_offset), (sc->sc_request_size
), (0x01 | 0x04))
   BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_requests)->mdm_map)), (ccb->ccb_offset), (sc->sc_request_size
), (0x01 | 0x04));

ccb->ccb_state = MPII_CCB_QUEUED;

rhp = ccb->ccb_cmd;

memset(&descr, 0, sizeof(descr))__builtin_memset((&descr), (0), (sizeof(descr)));

switch (rhp->function) {
case MPII_FUNCTION_SCSI_IO_REQUEST(0x00):
descr.request_flags = MPII_REQ_DESCR_SCSI_IO(0x00);
descr.dev_handle = htole16(ccb->ccb_dev_handle)((__uint16_t)(ccb->ccb_dev_handle));
break;
case MPII_FUNCTION_SCSI_TASK_MGMT(0x01):
descr.request_flags = MPII_REQ_DESCR_HIGH_PRIORITY(0x06);
break;
default:
descr.request_flags = MPII_REQ_DESCR_DEFAULT(0x08);
}

descr.vf_id = sc->sc_vf_id;
descr.smid = ccb->ccb_smid;

DNPRINTF(MPII_D_RW, "%s:   MPII_REQ_DESCR_POST_LOW (0x%08x) write "
   "0x%08lx\n", DEVNAME(sc), MPII_REQ_DESCR_POST_LOW, *rdp);

DNPRINTF(MPII_D_RW, "%s:   MPII_REQ_DESCR_POST_HIGH (0x%08x) write "
   "0x%08lx\n", DEVNAME(sc), MPII_REQ_DESCR_POST_HIGH, *(rdp+1));

2784#if defined(__LP64__1)
bus_space_write_raw_8(sc->sc_iot, sc->sc_ioh,((sc->sc_iot)->write_8((sc->sc_ioh), ((0xc0)), (*rdp
)))
   MPII_REQ_DESCR_POST_LOW, *rdp)((sc->sc_iot)->write_8((sc->sc_ioh), ((0xc0)), (*rdp
)));
2787#else
mtx_enter(&sc->sc_req_mtx);
bus_space_write_raw_4(sc->sc_iot, sc->sc_ioh,((sc->sc_iot)->write_4((sc->sc_ioh), ((0xc0)), (rdp[
0])))
   MPII_REQ_DESCR_POST_LOW, rdp[0])((sc->sc_iot)->write_4((sc->sc_ioh), ((0xc0)), (rdp[
0])));
bus_space_barrier(sc->sc_iot, sc->sc_ioh,
   MPII_REQ_DESCR_POST_LOW(0xc0), 8, BUS_SPACE_BARRIER_WRITE0x02);

bus_space_write_raw_4(sc->sc_iot, sc->sc_ioh,((sc->sc_iot)->write_4((sc->sc_ioh), ((0xc4)), (rdp[
1])))
   MPII_REQ_DESCR_POST_HIGH, rdp[1])((sc->sc_iot)->write_4((sc->sc_ioh), ((0xc4)), (rdp[
1])));
bus_space_barrier(sc->sc_iot, sc->sc_ioh,
   MPII_REQ_DESCR_POST_LOW(0xc0), 8, BUS_SPACE_BARRIER_WRITE0x02);
mtx_leave(&sc->sc_req_mtx);
2799#endif
2800}

2802int
2803mpii_poll(struct mpii_softc *sc, struct mpii_ccb *ccb)
2804{
void				(*done)(struct mpii_ccb *);
void				*cookie;
int				rv = 1;

DNPRINTF(MPII_D_INTR, "%s: mpii_poll\n", DEVNAME(sc));

done = ccb->ccb_done;
cookie = ccb->ccb_cookie;

ccb->ccb_done = mpii_poll_done;
ccb->ccb_cookie = &rv;

mpii_start(sc, ccb);

while (rv == 1) {
/* avoid excessive polling */
if (mpii_reply_waiting(sc)((mpii_read(((sc)), (0x30)) & (1<<3)) == (1<<
3)))
	mpii_intr(sc);
else
	delay(10)(*delay_func)(10);
}

ccb->ccb_cookie = cookie;
done(ccb);

return (0);
2831}

2833void
2834mpii_poll_done(struct mpii_ccb *ccb)
2835{
int				*rv = ccb->ccb_cookie;

*rv = 0;
2839}

2841int
2842mpii_alloc_queues(struct mpii_softc *sc)
2843{
u_int32_t		*rfp;
int			i;

DNPRINTF(MPII_D_MISC, "%s: mpii_alloc_queues\n", DEVNAME(sc));

sc->sc_reply_freeq = mpii_dmamem_alloc(sc,
   sc->sc_reply_free_qdepth * sizeof(*rfp));
if (sc->sc_reply_freeq == NULL((void *)0))
return (1);
rfp = MPII_DMA_KVA(sc->sc_reply_freeq)((void *)(sc->sc_reply_freeq)->mdm_kva);
for (i = 0; i < sc->sc_num_reply_frames; i++) {
rfp[i] = (u_int32_t)MPII_DMA_DVA(sc->sc_replies)((u_int64_t)(sc->sc_replies)->mdm_map->dm_segs[0].ds_addr
) +
    sc->sc_reply_size * i;
}

sc->sc_reply_postq = mpii_dmamem_alloc(sc,
   sc->sc_reply_post_qdepth * sizeof(struct mpii_reply_descr));
if (sc->sc_reply_postq == NULL((void *)0))
goto free_reply_freeq;
sc->sc_reply_postq_kva = MPII_DMA_KVA(sc->sc_reply_postq)((void *)(sc->sc_reply_postq)->mdm_kva);
memset(sc->sc_reply_postq_kva, 0xff, sc->sc_reply_post_qdepth *__builtin_memset((sc->sc_reply_postq_kva), (0xff), (sc->
sc_reply_post_qdepth * sizeof(struct mpii_reply_descr)))
   sizeof(struct mpii_reply_descr))__builtin_memset((sc->sc_reply_postq_kva), (0xff), (sc->
sc_reply_post_qdepth * sizeof(struct mpii_reply_descr)));

return (0);

2869free_reply_freeq:
mpii_dmamem_free(sc, sc->sc_reply_freeq);
return (1);
2872}

2874void
2875mpii_init_queues(struct mpii_softc *sc)
2876{
DNPRINTF(MPII_D_MISC, "%s:  mpii_init_queues\n", DEVNAME(sc));

sc->sc_reply_free_host_index = sc->sc_reply_free_qdepth - 1;
sc->sc_reply_post_host_index = 0;
mpii_write_reply_free(sc, sc->sc_reply_free_host_index)(((sc)->sc_iot)->write_4(((sc)->sc_ioh), ((0x48)), (
(sc->sc_reply_free_host_index))));
mpii_write_reply_post(sc, sc->sc_reply_post_host_index)(((sc)->sc_iot)->write_4(((sc)->sc_ioh), ((0x6c)), (
(sc->sc_reply_post_host_index))));
2883}

2885void
2886mpii_wait(struct mpii_softc *sc, struct mpii_ccb *ccb)
2887{
struct mutex		mtx;
void			(*done)(struct mpii_ccb *);
void			*cookie;

mtx_init(&mtx, IPL_BIO)do { (void)(((void *)0)); (void)(0); __mtx_init((&mtx), (
(((0x3)) > 0x0 && ((0x3)) < 0x9) ? 0x9 : ((0x3)
))); } while (0);

done = ccb->ccb_done;
cookie = ccb->ccb_cookie;

ccb->ccb_done = mpii_wait_done;
ccb->ccb_cookie = &mtx;

/* XXX this will wait forever for the ccb to complete */

mpii_start(sc, ccb);

mtx_enter(&mtx);
while (ccb->ccb_cookie != NULL((void *)0))
msleep_nsec(ccb, &mtx, PRIBIO16, "mpiiwait", INFSLP0xffffffffffffffffULL);
mtx_leave(&mtx);

ccb->ccb_cookie = cookie;
done(ccb);
2911}

2913void
2914mpii_wait_done(struct mpii_ccb *ccb)
2915{
struct mutex		*mtx = ccb->ccb_cookie;

mtx_enter(mtx);
ccb->ccb_cookie = NULL((void *)0);
mtx_leave(mtx);

wakeup_one(ccb)wakeup_n((ccb), 1);
2923}

2925void
2926mpii_scsi_cmd(struct scsi_xfer *xs)
2927{
struct scsi_link	*link = xs->sc_link;
struct mpii_softc	*sc = link->bus->sb_adapter_softc;
struct mpii_ccb		*ccb = xs->io;
struct mpii_msg_scsi_io	*io;
struct mpii_device	*dev;
int			 ret;

DNPRINTF(MPII_D_CMD, "%s: mpii_scsi_cmd\n", DEVNAME(sc));

if (xs->cmdlen > MPII_CDB_LEN(32)) {
1
Assuming field 'cmdlen' is <= MPII_CDB_LEN→
2
←
Taking false branch→
DNPRINTF(MPII_D_CMD, "%s: CDB too big %d\n",
    DEVNAME(sc), xs->cmdlen);
memset(&xs->sense, 0, sizeof(xs->sense))__builtin_memset((&xs->sense), (0), (sizeof(xs->sense
)));
xs->sense.error_code = SSD_ERRCODE_VALID0x80 | 0x70;
xs->sense.flags = SKEY_ILLEGAL_REQUEST0x05;
xs->sense.add_sense_code = 0x20;
xs->error = XS_SENSE1;
scsi_done(xs);
return;
}

if ((dev = sc->sc_devs[link->target]) == NULL((void *)0)) {
3
←
Assuming the condition is false→
4
←
Taking false branch→
/* device no longer exists */
xs->error = XS_SELTIMEOUT3;
scsi_done(xs);
return;
}

KERNEL_UNLOCK()_kernel_unlock();

DNPRINTF(MPII_D_CMD, "%s: ccb_smid: %d xs->flags: 0x%x\n",
   DEVNAME(sc), ccb->ccb_smid, xs->flags);

ccb->ccb_cookie = xs;
ccb->ccb_done = mpii_scsi_cmd_done;
ccb->ccb_dev_handle = dev->dev_handle;

io = ccb->ccb_cmd;
memset(io, 0, sizeof(*io))__builtin_memset((io), (0), (sizeof(*io)));
io->function = MPII_FUNCTION_SCSI_IO_REQUEST(0x00);
io->sense_buffer_length = sizeof(xs->sense);
io->sgl_offset0 = sizeof(struct mpii_msg_scsi_io) / 4;
htolem16(&io->io_flags, xs->cmdlen)(*(__uint16_t *)(&io->io_flags) = ((__uint16_t)(xs->
cmdlen)));
htolem16(&io->dev_handle, ccb->ccb_dev_handle)(*(__uint16_t *)(&io->dev_handle) = ((__uint16_t)(ccb->
ccb_dev_handle)));
htobem16(&io->lun[0], link->lun)(*(__uint16_t *)(&io->lun[0]) = (__uint16_t)(__builtin_constant_p
(link->lun) ? (__uint16_t)(((__uint16_t)(link->lun) &
 0xffU) << 8 | ((__uint16_t)(link->lun) & 0xff00U
) >> 8) : __swap16md(link->lun)));
5
←
'?' condition is false→

switch (xs->flags & (SCSI_DATA_IN0x00800 | SCSI_DATA_OUT0x01000)) {
6
←
Control jumps to the 'default' case at line 2981→
case SCSI_DATA_IN0x00800:
io->direction = MPII_SCSIIO_DIR_READ(0x2);
break;
case SCSI_DATA_OUT0x01000:
io->direction = MPII_SCSIIO_DIR_WRITE(0x1);
break;
default:
io->direction = MPII_SCSIIO_DIR_NONE(0x0);
break;
}

io->tagging = MPII_SCSIIO_ATTR_SIMPLE_Q(0x0);
7
←
 Execution continues on line 2986→

memcpy(io->cdb, &xs->cmd, xs->cmdlen)__builtin_memcpy((io->cdb), (&xs->cmd), (xs->cmdlen
));

htolem32(&io->data_length, xs->datalen)(*(__uint32_t *)(&io->data_length) = ((__uint32_t)(xs->
datalen)));

/* sense data is at the end of a request */
htolem32(&io->sense_buffer_low_address, ccb->ccb_cmd_dva +(*(__uint32_t *)(&io->sense_buffer_low_address) = ((__uint32_t
)(ccb->ccb_cmd_dva + sc->sc_request_size - sizeof(struct
 scsi_sense_data))))
   sc->sc_request_size - sizeof(struct scsi_sense_data))(*(__uint32_t *)(&io->sense_buffer_low_address) = ((__uint32_t
)(ccb->ccb_cmd_dva + sc->sc_request_size - sizeof(struct
 scsi_sense_data))));

if (ISSET(sc->sc_flags, MPII_F_SAS3)((sc->sc_flags) & ((1<<2))))
8
←
Assuming the condition is true→
9
←
Taking true branch→
ret = mpii_load_xs_sas3(ccb);
10
←
Calling 'mpii_load_xs_sas3'→
else
ret = mpii_load_xs(ccb);

if (ret != 0) {
xs->error = XS_DRIVER_STUFFUP2;
goto done;
}

timeout_set(&xs->stimeout, mpii_scsi_cmd_tmo, ccb);
if (xs->flags & SCSI_POLL0x00002) {
if (mpii_poll(sc, ccb) != 0) {
	xs->error = XS_DRIVER_STUFFUP2;
	goto done;
}
} else {
timeout_add_msec(&xs->stimeout, xs->timeout);
mpii_start(sc, ccb);
}

KERNEL_LOCK()_kernel_lock();
return;

3020done:
KERNEL_LOCK()_kernel_lock();
scsi_done(xs);
3023}

3025void
3026mpii_scsi_cmd_tmo(void *xccb)
3027{
struct mpii_ccb		*ccb = xccb;
struct mpii_softc	*sc = ccb->ccb_sc;

printf("%s: mpii_scsi_cmd_tmo (0x%08x)\n", DEVNAME(sc)((sc)->sc_dev.dv_xname),
   mpii_read_db(sc)mpii_read((sc), (0x00)));

mtx_enter(&sc->sc_ccb_mtx);
if (ccb->ccb_state == MPII_CCB_QUEUED) {
ccb->ccb_state = MPII_CCB_TIMEOUT;
SIMPLEQ_INSERT_HEAD(&sc->sc_ccb_tmos, ccb, ccb_link)do { if (((ccb)->ccb_link.sqe_next = (&sc->sc_ccb_tmos
)->sqh_first) == ((void *)0)) (&sc->sc_ccb_tmos)->
sqh_last = &(ccb)->ccb_link.sqe_next; (&sc->sc_ccb_tmos
)->sqh_first = (ccb); } while (0);
}
mtx_leave(&sc->sc_ccb_mtx);

scsi_ioh_add(&sc->sc_ccb_tmo_handler);
3042}

3044void
3045mpii_scsi_cmd_tmo_handler(void *cookie, void *io)
3046{
struct mpii_softc			*sc = cookie;
struct mpii_ccb				*tccb = io;
struct mpii_ccb				*ccb;
struct mpii_msg_scsi_task_request	*stq;

mtx_enter(&sc->sc_ccb_mtx);
ccb = SIMPLEQ_FIRST(&sc->sc_ccb_tmos)((&sc->sc_ccb_tmos)->sqh_first);
if (ccb != NULL((void *)0)) {
SIMPLEQ_REMOVE_HEAD(&sc->sc_ccb_tmos, ccb_link)do { if (((&sc->sc_ccb_tmos)->sqh_first = (&sc->
sc_ccb_tmos)->sqh_first->ccb_link.sqe_next) == ((void *
)0)) (&sc->sc_ccb_tmos)->sqh_last = &(&sc->
sc_ccb_tmos)->sqh_first; } while (0);
ccb->ccb_state = MPII_CCB_QUEUED;
}
/* should remove any other ccbs for the same dev handle */
mtx_leave(&sc->sc_ccb_mtx);

if (ccb == NULL((void *)0)) {
scsi_io_put(&sc->sc_iopool, tccb);
return;
}

stq = tccb->ccb_cmd;
stq->function = MPII_FUNCTION_SCSI_TASK_MGMT(0x01);
stq->task_type = MPII_SCSI_TASK_TARGET_RESET(0x03);
htolem16(&stq->dev_handle, ccb->ccb_dev_handle)(*(__uint16_t *)(&stq->dev_handle) = ((__uint16_t)(ccb
->ccb_dev_handle)));

tccb->ccb_done = mpii_scsi_cmd_tmo_done;
mpii_start(sc, tccb);
3073}

3075void
3076mpii_scsi_cmd_tmo_done(struct mpii_ccb *tccb)
3077{
mpii_scsi_cmd_tmo_handler(tccb->ccb_sc, tccb);
3079}

3081void
3082mpii_scsi_cmd_done(struct mpii_ccb *ccb)
3083{
struct mpii_ccb		*tccb;
struct mpii_msg_scsi_io_error	*sie;
struct mpii_softc	*sc = ccb->ccb_sc;
struct scsi_xfer	*xs = ccb->ccb_cookie;
struct scsi_sense_data	*sense;
bus_dmamap_t		dmap = ccb->ccb_dmamap;

timeout_del(&xs->stimeout);
mtx_enter(&sc->sc_ccb_mtx);
if (ccb->ccb_state == MPII_CCB_TIMEOUT) {
/* ENOSIMPLEQ_REMOVE :( */
if (ccb == SIMPLEQ_FIRST(&sc->sc_ccb_tmos)((&sc->sc_ccb_tmos)->sqh_first))
	SIMPLEQ_REMOVE_HEAD(&sc->sc_ccb_tmos, ccb_link)do { if (((&sc->sc_ccb_tmos)->sqh_first = (&sc->
sc_ccb_tmos)->sqh_first->ccb_link.sqe_next) == ((void *
)0)) (&sc->sc_ccb_tmos)->sqh_last = &(&sc->
sc_ccb_tmos)->sqh_first; } while (0);
else {
	SIMPLEQ_FOREACH(tccb, &sc->sc_ccb_tmos, ccb_link)for((tccb) = ((&sc->sc_ccb_tmos)->sqh_first); (tccb
) != ((void *)0); (tccb) = ((tccb)->ccb_link.sqe_next)) {
		if (SIMPLEQ_NEXT(tccb, ccb_link)((tccb)->ccb_link.sqe_next) == ccb) {
			SIMPLEQ_REMOVE_AFTER(&sc->sc_ccb_tmos,do { if (((tccb)->ccb_link.sqe_next = (tccb)->ccb_link.
sqe_next->ccb_link.sqe_next) == ((void *)0)) (&sc->
sc_ccb_tmos)->sqh_last = &(tccb)->ccb_link.sqe_next
; } while (0)
			    tccb, ccb_link)do { if (((tccb)->ccb_link.sqe_next = (tccb)->ccb_link.
sqe_next->ccb_link.sqe_next) == ((void *)0)) (&sc->
sc_ccb_tmos)->sqh_last = &(tccb)->ccb_link.sqe_next
; } while (0);
			break;
		}
	}
}
}

ccb->ccb_state = MPII_CCB_READY;
mtx_leave(&sc->sc_ccb_mtx);

if (xs->datalen != 0) {
bus_dmamap_sync(sc->sc_dmat, dmap, 0, dmap->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x02 : 0x08))
    (xs->flags & SCSI_DATA_IN) ? BUS_DMASYNC_POSTREAD :(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x02 : 0x08))
    BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x02 : 0x08));

bus_dmamap_unload(sc->sc_dmat, dmap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (dmap
));
}

xs->error = XS_NOERROR0;
xs->resid = 0;

if (ccb->ccb_rcb == NULL((void *)0)) {
/* no scsi error, we're ok so drop out early */
xs->status = SCSI_OK0x00;
goto done;
}

sie = ccb->ccb_rcb->rcb_reply;

DNPRINTF(MPII_D_CMD, "%s: mpii_scsi_cmd_done xs cmd: 0x%02x len: %d "
   "flags 0x%x\n", DEVNAME(sc), xs->cmd.opcode, xs->datalen,
   xs->flags);
DNPRINTF(MPII_D_CMD, "%s:  dev_handle: %d msg_length: %d "
   "function: 0x%02x\n", DEVNAME(sc), lemtoh16(&sie->dev_handle),
   sie->msg_length, sie->function);
DNPRINTF(MPII_D_CMD, "%s:  vp_id: 0x%02x vf_id: 0x%02x\n", DEVNAME(sc),
   sie->vp_id, sie->vf_id);
DNPRINTF(MPII_D_CMD, "%s:  scsi_status: 0x%02x scsi_state: 0x%02x "
   "ioc_status: 0x%04x\n", DEVNAME(sc), sie->scsi_status,
   sie->scsi_state, lemtoh16(&sie->ioc_status));
DNPRINTF(MPII_D_CMD, "%s:  ioc_loginfo: 0x%08x\n", DEVNAME(sc),
   lemtoh32(&sie->ioc_loginfo));
DNPRINTF(MPII_D_CMD, "%s:  transfer_count: %d\n", DEVNAME(sc),
   lemtoh32(&sie->transfer_count));
DNPRINTF(MPII_D_CMD, "%s:  sense_count: %d\n", DEVNAME(sc),
   lemtoh32(&sie->sense_count));
DNPRINTF(MPII_D_CMD, "%s:  response_info: 0x%08x\n", DEVNAME(sc),
   lemtoh32(&sie->response_info));
DNPRINTF(MPII_D_CMD, "%s:  task_tag: 0x%04x\n", DEVNAME(sc),
   lemtoh16(&sie->task_tag));
DNPRINTF(MPII_D_CMD, "%s:  bidirectional_transfer_count: 0x%08x\n",
   DEVNAME(sc), lemtoh32(&sie->bidirectional_transfer_count));

if (sie->scsi_state & MPII_SCSIIO_STATE_NO_SCSI_STATUS(1<<2))
xs->status = SCSI_TERMINATED0x22;
else
xs->status = sie->scsi_status;
xs->resid = 0;

switch (lemtoh16(&sie->ioc_status)((__uint16_t)(*(__uint16_t *)(&sie->ioc_status))) & MPII_IOCSTATUS_MASK(0x7fff)) {
case MPII_IOCSTATUS_SCSI_DATA_UNDERRUN(0x0045):
xs->resid = xs->datalen - lemtoh32(&sie->transfer_count)((__uint32_t)(*(__uint32_t *)(&sie->transfer_count)));
/* FALLTHROUGH */

case MPII_IOCSTATUS_SUCCESS(0x0000):
case MPII_IOCSTATUS_SCSI_RECOVERED_ERROR(0x0040):
switch (xs->status) {
case SCSI_OK0x00:
	xs->error = XS_NOERROR0;
	break;

case SCSI_CHECK0x02:
	xs->error = XS_SENSE1;
	break;

case SCSI_BUSY0x08:
case SCSI_QUEUE_FULL0x28:
	xs->error = XS_BUSY5;
	break;

default:
	xs->error = XS_DRIVER_STUFFUP2;
}
break;

case MPII_IOCSTATUS_BUSY(0x0002):
case MPII_IOCSTATUS_INSUFFICIENT_RESOURCES(0x0006):
xs->error = XS_BUSY5;
break;

case MPII_IOCSTATUS_SCSI_IOC_TERMINATED(0x004b):
case MPII_IOCSTATUS_SCSI_TASK_TERMINATED(0x0048):
xs->error = XS_RESET8;
break;

case MPII_IOCSTATUS_SCSI_INVALID_DEVHANDLE(0x0042):
case MPII_IOCSTATUS_SCSI_DEVICE_NOT_THERE(0x0043):
xs->error = XS_SELTIMEOUT3;
break;

default:
xs->error = XS_DRIVER_STUFFUP2;
break;
}

sense = (struct scsi_sense_data *)((caddr_t)ccb->ccb_cmd +
   sc->sc_request_size - sizeof(*sense));
if (sie->scsi_state & MPII_SCSIIO_STATE_AUTOSENSE_VALID(1<<0))
memcpy(&xs->sense, sense, sizeof(xs->sense))__builtin_memcpy((&xs->sense), (sense), (sizeof(xs->
sense)));

DNPRINTF(MPII_D_CMD, "%s:  xs err: %d status: %#x\n", DEVNAME(sc),
   xs->error, xs->status);

mpii_push_reply(sc, ccb->ccb_rcb);
3215done:
KERNEL_LOCK()_kernel_lock();
scsi_done(xs);
KERNEL_UNLOCK()_kernel_unlock();
3219}

3221int
3222mpii_scsi_ioctl(struct scsi_link *link, u_long cmd, caddr_t addr, int flag)
3223{
struct mpii_softc	*sc = link->bus->sb_adapter_softc;
struct mpii_device	*dev = sc->sc_devs[link->target];

DNPRINTF(MPII_D_IOCTL, "%s: mpii_scsi_ioctl\n", DEVNAME(sc));

switch (cmd) {
case DIOCGCACHE((unsigned long)0x40000000 | ((sizeof(struct dk_cache) & 0x1fff
) << 16) | ((('d')) << 8) | ((117))):
case DIOCSCACHE((unsigned long)0x80000000 | ((sizeof(struct dk_cache) & 0x1fff
) << 16) | ((('d')) << 8) | ((118))):
if (dev != NULL((void *)0) && ISSET(dev->flags, MPII_DF_VOLUME)((dev->flags) & ((0x0010)))) {
	return (mpii_ioctl_cache(link, cmd,
	    (struct dk_cache *)addr));
}
break;

default:
if (sc->sc_ioctl)
	return (sc->sc_ioctl(&sc->sc_dev, cmd, addr));

break;
}

return (ENOTTY25);
3246}

3248int
3249mpii_ioctl_cache(struct scsi_link *link, u_long cmd, struct dk_cache *dc)
3250{
struct mpii_softc *sc = link->bus->sb_adapter_softc;
struct mpii_device *dev = sc->sc_devs[link->target];
struct mpii_cfg_raid_vol_pg0 *vpg;
struct mpii_msg_raid_action_request *req;
struct mpii_msg_raid_action_reply *rep;
struct mpii_cfg_hdr hdr;
struct mpii_ccb	*ccb;
u_int32_t addr = MPII_CFG_RAID_VOL_ADDR_HANDLE(1<<28) | dev->dev_handle;
size_t pagelen;
int rv = 0;
int enabled;

if (mpii_req_cfg_header(sc, MPII_CONFIG_REQ_PAGE_TYPE_RAID_VOL(0x08), 0,
   addr, MPII_PG_POLL(1<<1), &hdr) != 0)
return (EINVAL22);

pagelen = hdr.page_length * 4;
vpg = malloc(pagelen, M_TEMP127, M_WAITOK0x0001 | M_CANFAIL0x0004 | M_ZERO0x0008);
if (vpg == NULL((void *)0))
return (ENOMEM12);

if (mpii_req_cfg_page(sc, addr, MPII_PG_POLL(1<<1), &hdr, 1,
   vpg, pagelen) != 0) {
rv = EINVAL22;
goto done;
}

enabled = ((lemtoh16(&vpg->volume_settings)((__uint16_t)(*(__uint16_t *)(&vpg->volume_settings))) &
   MPII_CFG_RAID_VOL_0_SETTINGS_CACHE_MASK(0x3<<0)) ==
   MPII_CFG_RAID_VOL_0_SETTINGS_CACHE_ENABLED(0x2<<0)) ? 1 : 0;

if (cmd == DIOCGCACHE((unsigned long)0x40000000 | ((sizeof(struct dk_cache) & 0x1fff
) << 16) | ((('d')) << 8) | ((117)))) {
dc->wrcache = enabled;
dc->rdcache = 0;
goto done;
} /* else DIOCSCACHE */

if (dc->rdcache) {
rv = EOPNOTSUPP45;
goto done;
}

if (((dc->wrcache) ? 1 : 0) == enabled)
goto done;

ccb = scsi_io_get(&sc->sc_iopool, SCSI_POLL0x00002);
if (ccb == NULL((void *)0)) {
rv = ENOMEM12;
goto done;
}

ccb->ccb_done = mpii_empty_done;

req = ccb->ccb_cmd;
memset(req, 0, sizeof(*req))__builtin_memset((req), (0), (sizeof(*req)));
req->function = MPII_FUNCTION_RAID_ACTION(0x15);
req->action = MPII_RAID_ACTION_CHANGE_VOL_WRITE_CACHE(0x17);
htolem16(&req->vol_dev_handle, dev->dev_handle)(*(__uint16_t *)(&req->vol_dev_handle) = ((__uint16_t)
(dev->dev_handle)));
htolem32(&req->action_data, dc->wrcache ?(*(__uint32_t *)(&req->action_data) = ((__uint32_t)(dc
->wrcache ? (0x02) : (0x01))))
   MPII_RAID_VOL_WRITE_CACHE_ENABLE :(*(__uint32_t *)(&req->action_data) = ((__uint32_t)(dc
->wrcache ? (0x02) : (0x01))))
   MPII_RAID_VOL_WRITE_CACHE_DISABLE)(*(__uint32_t *)(&req->action_data) = ((__uint32_t)(dc
->wrcache ? (0x02) : (0x01))));

if (mpii_poll(sc, ccb) != 0) {
rv = EIO5;
goto done;
}

if (ccb->ccb_rcb != NULL((void *)0)) {
rep = ccb->ccb_rcb->rcb_reply;
if ((rep->ioc_status != MPII_IOCSTATUS_SUCCESS(0x0000)) ||
    ((rep->action_data[0] &
     MPII_RAID_VOL_WRITE_CACHE_MASK(0x03)) !=
    (dc->wrcache ? MPII_RAID_VOL_WRITE_CACHE_ENABLE(0x02) :
     MPII_RAID_VOL_WRITE_CACHE_DISABLE(0x01))))
	rv = EINVAL22;
mpii_push_reply(sc, ccb->ccb_rcb);
}

scsi_io_put(&sc->sc_iopool, ccb);

3331done:
free(vpg, M_TEMP127, pagelen);
return (rv);
3334}

3336#if NBIO1 > 0
3337int
3338mpii_ioctl(struct device *dev, u_long cmd, caddr_t addr)
3339{
struct mpii_softc	*sc = (struct mpii_softc *)dev;
int			error = 0;

DNPRINTF(MPII_D_IOCTL, "%s: mpii_ioctl ", DEVNAME(sc));

switch (cmd) {
case BIOCINQ(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct bioc_inq) & 0x1fff) << 16) | ((('B')) <<
 8) | ((32))):
DNPRINTF(MPII_D_IOCTL, "inq\n");
error = mpii_ioctl_inq(sc, (struct bioc_inq *)addr);
break;
case BIOCVOL(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct bioc_vol) & 0x1fff) << 16) | ((('B')) <<
 8) | ((34))):
DNPRINTF(MPII_D_IOCTL, "vol\n");
error = mpii_ioctl_vol(sc, (struct bioc_vol *)addr);
break;
case BIOCDISK(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct bioc_disk) & 0x1fff) << 16) | ((('B')) <<
 8) | ((33))):
DNPRINTF(MPII_D_IOCTL, "disk\n");
error = mpii_ioctl_disk(sc, (struct bioc_disk *)addr);
break;
default:
DNPRINTF(MPII_D_IOCTL, " invalid ioctl\n");
error = ENOTTY25;
}

return (error);
3364}

3366int
3367mpii_ioctl_inq(struct mpii_softc *sc, struct bioc_inq *bi)
3368{
int			i;

DNPRINTF(MPII_D_IOCTL, "%s: mpii_ioctl_inq\n", DEVNAME(sc));

strlcpy(bi->bi_dev, DEVNAME(sc)((sc)->sc_dev.dv_xname), sizeof(bi->bi_dev));
for (i = 0; i < sc->sc_max_devices; i++)
if (sc->sc_devs[i] &&
    ISSET(sc->sc_devs[i]->flags, MPII_DF_VOLUME)((sc->sc_devs[i]->flags) & ((0x0010))))
	bi->bi_novol++;
return (0);
3379}

3381int
3382mpii_ioctl_vol(struct mpii_softc *sc, struct bioc_vol *bv)
3383{
struct mpii_cfg_raid_vol_pg0	*vpg;
struct mpii_cfg_hdr		hdr;
struct mpii_device		*dev;
struct scsi_link		*lnk;
struct device			*scdev;
size_t				pagelen;
u_int16_t			volh;
int				rv, hcnt = 0;

DNPRINTF(MPII_D_IOCTL, "%s: mpii_ioctl_vol %d\n",
   DEVNAME(sc), bv->bv_volid);

if ((dev = mpii_find_vol(sc, bv->bv_volid)) == NULL((void *)0))
return (ENODEV19);
volh = dev->dev_handle;

if (mpii_req_cfg_header(sc, MPII_CONFIG_REQ_PAGE_TYPE_RAID_VOL(0x08), 0,
   MPII_CFG_RAID_VOL_ADDR_HANDLE(1<<28) | volh, 0, &hdr) != 0) {
printf("%s: unable to fetch header for raid volume page 0\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (EINVAL22);
}

pagelen = hdr.page_length * 4;
vpg = malloc(pagelen, M_TEMP127, M_WAITOK0x0001 | M_CANFAIL0x0004 | M_ZERO0x0008);
if (vpg == NULL((void *)0)) {
printf("%s: unable to allocate space for raid "
    "volume page 0\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (ENOMEM12);
}

if (mpii_req_cfg_page(sc, MPII_CFG_RAID_VOL_ADDR_HANDLE(1<<28) | volh, 0,
   &hdr, 1, vpg, pagelen) != 0) {
printf("%s: unable to fetch raid volume page 0\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
free(vpg, M_TEMP127, pagelen);
return (EINVAL22);
}

switch (vpg->volume_state) {
case MPII_CFG_RAID_VOL_0_STATE_ONLINE(0x03):
case MPII_CFG_RAID_VOL_0_STATE_OPTIMAL(0x05):
bv->bv_status = BIOC_SVONLINE0x00;
break;
case MPII_CFG_RAID_VOL_0_STATE_DEGRADED(0x04):
if (ISSET(lemtoh32(&vpg->volume_status),((((__uint32_t)(*(__uint32_t *)(&vpg->volume_status)))
) & ((1<<16)))
    MPII_CFG_RAID_VOL_0_STATUS_RESYNC)((((__uint32_t)(*(__uint32_t *)(&vpg->volume_status)))
) & ((1<<16)))) {
	bv->bv_status = BIOC_SVREBUILD0x05;
	bv->bv_percent = dev->percent;
} else
	bv->bv_status = BIOC_SVDEGRADED0x02;
break;
case MPII_CFG_RAID_VOL_0_STATE_FAILED(0x01):
bv->bv_status = BIOC_SVOFFLINE0x01;
break;
case MPII_CFG_RAID_VOL_0_STATE_INITIALIZING(0x02):
bv->bv_status = BIOC_SVBUILDING0x03;
break;
case MPII_CFG_RAID_VOL_0_STATE_MISSING(0x00):
default:
bv->bv_status = BIOC_SVINVALID0xff;
break;
}

switch (vpg->volume_type) {
case MPII_CFG_RAID_VOL_0_TYPE_RAID0(0x00):
bv->bv_level = 0;
break;
case MPII_CFG_RAID_VOL_0_TYPE_RAID1(0x02):
bv->bv_level = 1;
break;
case MPII_CFG_RAID_VOL_0_TYPE_RAID1E(0x01):
bv->bv_level = 0x1E;
break;
case MPII_CFG_RAID_VOL_0_TYPE_RAID10(0x05):
bv->bv_level = 10;
break;
default:
bv->bv_level = -1;
}

if ((rv = mpii_bio_hs(sc, NULL((void *)0), 0, vpg->hot_spare_pool, &hcnt)) != 0) {
free(vpg, M_TEMP127, pagelen);
return (rv);
}

bv->bv_nodisk = vpg->num_phys_disks + hcnt;

bv->bv_size = letoh64(vpg->max_lba)((__uint64_t)(vpg->max_lba)) * lemtoh16(&vpg->block_size)((__uint16_t)(*(__uint16_t *)(&vpg->block_size)));

lnk = scsi_get_link(sc->sc_scsibus, dev->slot, 0);
if (lnk != NULL((void *)0)) {
scdev = lnk->device_softc;
strlcpy(bv->bv_dev, scdev->dv_xname, sizeof(bv->bv_dev));
}

free(vpg, M_TEMP127, pagelen);
return (0);
3482}

3484int
3485mpii_ioctl_disk(struct mpii_softc *sc, struct bioc_disk *bd)
3486{
struct mpii_cfg_raid_vol_pg0		*vpg;
struct mpii_cfg_raid_vol_pg0_physdisk	*pd;
struct mpii_cfg_hdr			hdr;
struct mpii_device			*dev;
size_t					pagelen;
u_int16_t				volh;
u_int8_t				dn;

DNPRINTF(MPII_D_IOCTL, "%s: mpii_ioctl_disk %d/%d\n",
   DEVNAME(sc), bd->bd_volid, bd->bd_diskid);

if ((dev = mpii_find_vol(sc, bd->bd_volid)) == NULL((void *)0))
return (ENODEV19);
volh = dev->dev_handle;

if (mpii_req_cfg_header(sc, MPII_CONFIG_REQ_PAGE_TYPE_RAID_VOL(0x08), 0,
   MPII_CFG_RAID_VOL_ADDR_HANDLE(1<<28) | volh, 0, &hdr) != 0) {
printf("%s: unable to fetch header for raid volume page 0\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (EINVAL22);
}

pagelen = hdr.page_length * 4;
vpg = malloc(pagelen, M_TEMP127, M_WAITOK0x0001 | M_CANFAIL0x0004 | M_ZERO0x0008);
if (vpg == NULL((void *)0)) {
printf("%s: unable to allocate space for raid "
    "volume page 0\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (ENOMEM12);
}

if (mpii_req_cfg_page(sc, MPII_CFG_RAID_VOL_ADDR_HANDLE(1<<28) | volh, 0,
   &hdr, 1, vpg, pagelen) != 0) {
printf("%s: unable to fetch raid volume page 0\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
free(vpg, M_TEMP127, pagelen);
return (EINVAL22);
}

if (bd->bd_diskid >= vpg->num_phys_disks) {
int		nvdsk = vpg->num_phys_disks;
int		hsmap = vpg->hot_spare_pool;

free(vpg, M_TEMP127, pagelen);
return (mpii_bio_hs(sc, bd, nvdsk, hsmap, NULL((void *)0)));
}

pd = (struct mpii_cfg_raid_vol_pg0_physdisk *)(vpg + 1) +
   bd->bd_diskid;
dn = pd->phys_disk_num;

free(vpg, M_TEMP127, pagelen);
return (mpii_bio_disk(sc, bd, dn));
3539}

3541int
3542mpii_bio_hs(struct mpii_softc *sc, struct bioc_disk *bd, int nvdsk,
   int hsmap, int *hscnt)
3544{
struct mpii_cfg_raid_config_pg0	*cpg;
struct mpii_raid_config_element	*el;
struct mpii_ecfg_hdr		ehdr;
size_t				pagelen;
int				i, nhs = 0;

if (bd)
DNPRINTF(MPII_D_IOCTL, "%s: mpii_bio_hs %d\n", DEVNAME(sc),
    bd->bd_diskid - nvdsk);
else
DNPRINTF(MPII_D_IOCTL, "%s: mpii_bio_hs\n", DEVNAME(sc));

if (mpii_req_cfg_header(sc, MPII_CONFIG_REQ_PAGE_TYPE_RAID_CONFIG(0x16),
   0, MPII_CFG_RAID_CONFIG_ACTIVE_CONFIG(2<<28), MPII_PG_EXTENDED(1<<0),
   &ehdr) != 0) {
printf("%s: unable to fetch header for raid config page 0\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (EINVAL22);
}

pagelen = lemtoh16(&ehdr.ext_page_length)((__uint16_t)(*(__uint16_t *)(&ehdr.ext_page_length))) * 4;
cpg = malloc(pagelen, M_TEMP127, M_WAITOK0x0001 | M_CANFAIL0x0004 | M_ZERO0x0008);
if (cpg == NULL((void *)0)) {
printf("%s: unable to allocate space for raid config page 0\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (ENOMEM12);
}

if (mpii_req_cfg_page(sc, MPII_CFG_RAID_CONFIG_ACTIVE_CONFIG(2<<28),
   MPII_PG_EXTENDED(1<<0), &ehdr, 1, cpg, pagelen) != 0) {
printf("%s: unable to fetch raid config page 0\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
free(cpg, M_TEMP127, pagelen);
return (EINVAL22);
}

el = (struct mpii_raid_config_element *)(cpg + 1);
for (i = 0; i < cpg->num_elements; i++, el++) {
if (ISSET(lemtoh16(&el->element_flags),((((__uint16_t)(*(__uint16_t *)(&el->element_flags))))
 & ((0x2)))
    MPII_RAID_CONFIG_ELEMENT_FLAG_HSP_PHYS_DISK)((((__uint16_t)(*(__uint16_t *)(&el->element_flags))))
 & ((0x2))) &&
    el->hot_spare_pool == hsmap) {
	/*
	 * diskid comparison is based on the idea that all
	 * disks are counted by the bio(4) in sequence, thus
	 * subtracting the number of disks in the volume
	 * from the diskid yields us a "relative" hotspare
	 * number, which is good enough for us.
	 */
	if (bd != NULL((void *)0) && bd->bd_diskid == nhs + nvdsk) {
		u_int8_t dn = el->phys_disk_num;

		free(cpg, M_TEMP127, pagelen);
		return (mpii_bio_disk(sc, bd, dn));
	}
	nhs++;
}
}

if (hscnt)
*hscnt = nhs;

free(cpg, M_TEMP127, pagelen);
return (0);
3608}

3610int
3611mpii_bio_disk(struct mpii_softc *sc, struct bioc_disk *bd, u_int8_t dn)
3612{
struct mpii_cfg_raid_physdisk_pg0	*ppg;
struct mpii_cfg_hdr			hdr;
struct mpii_device			*dev;
int					len;

DNPRINTF(MPII_D_IOCTL, "%s: mpii_bio_disk %d\n", DEVNAME(sc),
   bd->bd_diskid);

ppg = malloc(sizeof(*ppg), M_TEMP127, M_WAITOK0x0001 | M_CANFAIL0x0004 | M_ZERO0x0008);
if (ppg == NULL((void *)0)) {
printf("%s: unable to allocate space for raid physical disk "
    "page 0\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (ENOMEM12);
}

hdr.page_version = 0;
hdr.page_length = sizeof(*ppg) / 4;
hdr.page_number = 0;
hdr.page_type = MPII_CONFIG_REQ_PAGE_TYPE_RAID_PD(0x0a);

if (mpii_req_cfg_page(sc, MPII_CFG_RAID_PHYS_DISK_ADDR_NUMBER(1<<28) | dn, 0,
   &hdr, 1, ppg, sizeof(*ppg)) != 0) {
printf("%s: unable to fetch raid drive page 0\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname));
free(ppg, M_TEMP127, sizeof(*ppg));
return (EINVAL22);
}

bd->bd_target = ppg->phys_disk_num;

if ((dev = mpii_find_dev(sc, lemtoh16(&ppg->dev_handle)((__uint16_t)(*(__uint16_t *)(&ppg->dev_handle))))) == NULL((void *)0)) {
bd->bd_status = BIOC_SDINVALID0xff;
free(ppg, M_TEMP127, sizeof(*ppg));
return (0);
}

switch (ppg->phys_disk_state) {
case MPII_CFG_RAID_PHYDISK_0_STATE_ONLINE(0x03):
case MPII_CFG_RAID_PHYDISK_0_STATE_OPTIMAL(0x07):
bd->bd_status = BIOC_SDONLINE0x00;
break;
case MPII_CFG_RAID_PHYDISK_0_STATE_OFFLINE(0x02):
if (ppg->offline_reason ==
    MPII_CFG_RAID_PHYDISK_0_OFFLINE_FAILED(0x03) ||
    ppg->offline_reason ==
    MPII_CFG_RAID_PHYDISK_0_OFFLINE_FAILEDREQ(0x06))
	bd->bd_status = BIOC_SDFAILED0x02;
else
	bd->bd_status = BIOC_SDOFFLINE0x01;
break;
case MPII_CFG_RAID_PHYDISK_0_STATE_DEGRADED(0x05):
bd->bd_status = BIOC_SDFAILED0x02;
break;
case MPII_CFG_RAID_PHYDISK_0_STATE_REBUILDING(0x06):
bd->bd_status = BIOC_SDREBUILD0x03;
break;
case MPII_CFG_RAID_PHYDISK_0_STATE_HOTSPARE(0x04):
bd->bd_status = BIOC_SDHOTSPARE0x04;
break;
case MPII_CFG_RAID_PHYDISK_0_STATE_NOTCONFIGURED(0x00):
bd->bd_status = BIOC_SDUNUSED0x05;
break;
case MPII_CFG_RAID_PHYDISK_0_STATE_NOTCOMPATIBLE(0x01):
default:
bd->bd_status = BIOC_SDINVALID0xff;
break;
}

bd->bd_size = letoh64(ppg->dev_max_lba)((__uint64_t)(ppg->dev_max_lba)) * lemtoh16(&ppg->block_size)((__uint16_t)(*(__uint16_t *)(&ppg->block_size)));

scsi_strvis(bd->bd_vendor, ppg->vendor_id, sizeof(ppg->vendor_id));
len = strlen(bd->bd_vendor);
bd->bd_vendor[len] = ' ';
scsi_strvis(&bd->bd_vendor[len + 1], ppg->product_id,
   sizeof(ppg->product_id));
scsi_strvis(bd->bd_serial, ppg->serial, sizeof(ppg->serial));

free(ppg, M_TEMP127, sizeof(*ppg));
return (0);
3692}

3694struct mpii_device *
3695mpii_find_vol(struct mpii_softc *sc, int volid)
3696{
struct mpii_device	*dev = NULL((void *)0);

if (sc->sc_vd_id_low + volid >= sc->sc_max_devices)
return (NULL((void *)0));
dev = sc->sc_devs[sc->sc_vd_id_low + volid];
if (dev && ISSET(dev->flags, MPII_DF_VOLUME)((dev->flags) & ((0x0010))))
return (dev);
return (NULL((void *)0));
3705}

3707#ifndef SMALL_KERNEL
3708/*
* Non-sleeping lightweight version of the mpii_ioctl_vol
*/
3711int
3712mpii_bio_volstate(struct mpii_softc *sc, struct bioc_vol *bv)
3713{
struct mpii_cfg_raid_vol_pg0	*vpg;
struct mpii_cfg_hdr		hdr;
struct mpii_device		*dev = NULL((void *)0);
size_t				pagelen;
u_int16_t			volh;

if ((dev = mpii_find_vol(sc, bv->bv_volid)) == NULL((void *)0))
return (ENODEV19);
volh = dev->dev_handle;

if (mpii_req_cfg_header(sc, MPII_CONFIG_REQ_PAGE_TYPE_RAID_VOL(0x08), 0,
   MPII_CFG_RAID_VOL_ADDR_HANDLE(1<<28) | volh, MPII_PG_POLL(1<<1), &hdr) != 0) {
DNPRINTF(MPII_D_MISC, "%s: unable to fetch header for raid "
    "volume page 0\n", DEVNAME(sc));
return (EINVAL22);
}

pagelen = hdr.page_length * 4;
vpg = malloc(pagelen, M_TEMP127, M_NOWAIT0x0002 | M_ZERO0x0008);
if (vpg == NULL((void *)0)) {
DNPRINTF(MPII_D_MISC, "%s: unable to allocate space for raid "
    "volume page 0\n", DEVNAME(sc));
return (ENOMEM12);
}

if (mpii_req_cfg_page(sc, MPII_CFG_RAID_VOL_ADDR_HANDLE(1<<28) | volh,
   MPII_PG_POLL(1<<1), &hdr, 1, vpg, pagelen) != 0) {
DNPRINTF(MPII_D_MISC, "%s: unable to fetch raid volume "
    "page 0\n", DEVNAME(sc));
free(vpg, M_TEMP127, pagelen);
return (EINVAL22);
}

switch (vpg->volume_state) {
case MPII_CFG_RAID_VOL_0_STATE_ONLINE(0x03):
case MPII_CFG_RAID_VOL_0_STATE_OPTIMAL(0x05):
bv->bv_status = BIOC_SVONLINE0x00;
break;
case MPII_CFG_RAID_VOL_0_STATE_DEGRADED(0x04):
if (ISSET(lemtoh32(&vpg->volume_status),((((__uint32_t)(*(__uint32_t *)(&vpg->volume_status)))
) & ((1<<16)))
    MPII_CFG_RAID_VOL_0_STATUS_RESYNC)((((__uint32_t)(*(__uint32_t *)(&vpg->volume_status)))
) & ((1<<16))))
	bv->bv_status = BIOC_SVREBUILD0x05;
else
	bv->bv_status = BIOC_SVDEGRADED0x02;
break;
case MPII_CFG_RAID_VOL_0_STATE_FAILED(0x01):
bv->bv_status = BIOC_SVOFFLINE0x01;
break;
case MPII_CFG_RAID_VOL_0_STATE_INITIALIZING(0x02):
bv->bv_status = BIOC_SVBUILDING0x03;
break;
case MPII_CFG_RAID_VOL_0_STATE_MISSING(0x00):
default:
bv->bv_status = BIOC_SVINVALID0xff;
break;
}

free(vpg, M_TEMP127, pagelen);
return (0);
3773}

3775int
3776mpii_create_sensors(struct mpii_softc *sc)
3777{
struct scsibus_softc	*ssc = sc->sc_scsibus;
struct device		*dev;
struct scsi_link	*link;
int			i;

sc->sc_sensors = mallocarray(sc->sc_vd_count, sizeof(struct ksensor),
   M_DEVBUF2, M_NOWAIT0x0002 | M_ZERO0x0008);
if (sc->sc_sensors == NULL((void *)0))
return (1);
sc->sc_nsensors = sc->sc_vd_count;

strlcpy(sc->sc_sensordev.xname, DEVNAME(sc)((sc)->sc_dev.dv_xname),
   sizeof(sc->sc_sensordev.xname));

for (i = 0; i < sc->sc_vd_count; i++) {
link = scsi_get_link(ssc, i + sc->sc_vd_id_low, 0);
if (link == NULL((void *)0))
	goto bad;

dev = link->device_softc;

sc->sc_sensors[i].type = SENSOR_DRIVE;
sc->sc_sensors[i].status = SENSOR_S_UNKNOWN;

strlcpy(sc->sc_sensors[i].desc, dev->dv_xname,
    sizeof(sc->sc_sensors[i].desc));

sensor_attach(&sc->sc_sensordev, &sc->sc_sensors[i]);
}

if (sensor_task_register(sc, mpii_refresh_sensors, 10) == NULL((void *)0))
goto bad;

sensordev_install(&sc->sc_sensordev);

return (0);

3815bad:
free(sc->sc_sensors, M_DEVBUF2, 0);

return (1);
3819}

3821void
3822mpii_refresh_sensors(void *arg)
3823{
struct mpii_softc	*sc = arg;
struct bioc_vol		bv;
int			i;

for (i = 0; i < sc->sc_nsensors; i++) {
memset(&bv, 0, sizeof(bv))__builtin_memset((&bv), (0), (sizeof(bv)));
bv.bv_volid = i;
if (mpii_bio_volstate(sc, &bv))
	return;
switch(bv.bv_status) {
case BIOC_SVOFFLINE0x01:
	sc->sc_sensors[i].value = SENSOR_DRIVE_FAIL9;
	sc->sc_sensors[i].status = SENSOR_S_CRIT;
	break;
case BIOC_SVDEGRADED0x02:
	sc->sc_sensors[i].value = SENSOR_DRIVE_PFAIL10;
	sc->sc_sensors[i].status = SENSOR_S_WARN;
	break;
case BIOC_SVREBUILD0x05:
	sc->sc_sensors[i].value = SENSOR_DRIVE_REBUILD7;
	sc->sc_sensors[i].status = SENSOR_S_WARN;
	break;
case BIOC_SVONLINE0x00:
	sc->sc_sensors[i].value = SENSOR_DRIVE_ONLINE4;
	sc->sc_sensors[i].status = SENSOR_S_OK;
	break;
case BIOC_SVINVALID0xff:
	/* FALLTHROUGH */
default:
	sc->sc_sensors[i].value = 0; /* unknown */
	sc->sc_sensors[i].status = SENSOR_S_UNKNOWN;
}
}
3857}
3858#endif /* SMALL_KERNEL */
3859#endif /* NBIO > 0 */