/usr/src/sys/dev/ic/mpi.c

Bug Summary

File:	dev/ic/mpi.c
Warning:	line 1559, column 16 Access to field 'sg_hdr' results in a dereference of a null pointer (loaded from variable 'sge')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name mpi.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -D CONFIG_DRM_AMD_DC_DCN3_0 -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /usr/obj/sys/arch/amd64/compile/GENERIC.MP/scan-build/2022-01-12-131800-47421-1 -x c /usr/src/sys/dev/ic/mpi.c
1/*	$OpenBSD: mpi.c,v 1.223 2020/09/22 19:32:52 krw Exp $ */

3/*
* Copyright (c) 2005, 2006, 2009 David Gwynne <dlg@openbsd.org>
* Copyright (c) 2005, 2008, 2009 Marco Peereboom <marco@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

20#include "bio.h"

22#include <sys/param.h>
23#include <sys/systm.h>
24#include <sys/buf.h>
25#include <sys/device.h>
26#include <sys/malloc.h>
27#include <sys/kernel.h>
28#include <sys/mutex.h>
29#include <sys/rwlock.h>
30#include <sys/sensors.h>
31#include <sys/dkio.h>
32#include <sys/task.h>

34#include <machine/bus.h>

36#include <scsi/scsi_all.h>
37#include <scsi/scsiconf.h>

39#include <dev/biovar.h>
40#include <dev/ic/mpireg.h>
41#include <dev/ic/mpivar.h>

43#ifdef MPI_DEBUG
44uint32_t	mpi_debug = 0
45/*		    | MPI_D_CMD */
46/*		    | MPI_D_INTR */
47/*		    | MPI_D_MISC */
48/*		    | MPI_D_DMA */
49/*		    | MPI_D_IOCTL */
50/*		    | MPI_D_RW */
51/*		    | MPI_D_MEM */
52/*		    | MPI_D_CCB */
53/*		    | MPI_D_PPR */
54/*		    | MPI_D_RAID */
55/*		    | MPI_D_EVT */
;
57#endif

59struct cfdriver mpi_cd = {
NULL((void *)0),
"mpi",
DV_DULL
63};

65void			mpi_scsi_cmd(struct scsi_xfer *);
66void			mpi_scsi_cmd_done(struct mpi_ccb *);
67int			mpi_scsi_probe(struct scsi_link *);
68int			mpi_scsi_ioctl(struct scsi_link *, u_long, caddr_t,
	    int);

71struct scsi_adapter mpi_switch = {
mpi_scsi_cmd, NULL((void *)0), mpi_scsi_probe, NULL((void *)0), mpi_scsi_ioctl
73};

75struct mpi_dmamem	*mpi_dmamem_alloc(struct mpi_softc *, size_t);
76void			mpi_dmamem_free(struct mpi_softc *,
	    struct mpi_dmamem *);
78int			mpi_alloc_ccbs(struct mpi_softc *);
79void			*mpi_get_ccb(void *);
80void			mpi_put_ccb(void *, void *);
81int			mpi_alloc_replies(struct mpi_softc *);
82void			mpi_push_replies(struct mpi_softc *);
83void			mpi_push_reply(struct mpi_softc *, struct mpi_rcb *);

85void			mpi_start(struct mpi_softc *, struct mpi_ccb *);
86int			mpi_poll(struct mpi_softc *, struct mpi_ccb *, int);
87void			mpi_poll_done(struct mpi_ccb *);
88void			mpi_reply(struct mpi_softc *, u_int32_t);

90void			mpi_wait(struct mpi_softc *sc, struct mpi_ccb *);
91void			mpi_wait_done(struct mpi_ccb *);

93int			mpi_cfg_spi_port(struct mpi_softc *);
94void			mpi_squash_ppr(struct mpi_softc *);
95void			mpi_run_ppr(struct mpi_softc *);
96int			mpi_ppr(struct mpi_softc *, struct scsi_link *,
	    struct mpi_cfg_raid_physdisk *, int, int, int);
98int			mpi_inq(struct mpi_softc *, u_int16_t, int);

100int			mpi_cfg_sas(struct mpi_softc *);
101int			mpi_cfg_fc(struct mpi_softc *);

103void			mpi_timeout_xs(void *);
104int			mpi_load_xs(struct mpi_ccb *);

106u_int32_t		mpi_read(struct mpi_softc *, bus_size_t);
107void			mpi_write(struct mpi_softc *, bus_size_t, u_int32_t);
108int			mpi_wait_eq(struct mpi_softc *, bus_size_t, u_int32_t,
	    u_int32_t);
110int			mpi_wait_ne(struct mpi_softc *, bus_size_t, u_int32_t,
	    u_int32_t);

113int			mpi_init(struct mpi_softc *);
114int			mpi_reset_soft(struct mpi_softc *);
115int			mpi_reset_hard(struct mpi_softc *);

117int			mpi_handshake_send(struct mpi_softc *, void *, size_t);
118int			mpi_handshake_recv_dword(struct mpi_softc *,
	    u_int32_t *);
120int			mpi_handshake_recv(struct mpi_softc *, void *, size_t);

122void			mpi_empty_done(struct mpi_ccb *);

124int			mpi_iocinit(struct mpi_softc *);
125int			mpi_iocfacts(struct mpi_softc *);
126int			mpi_portfacts(struct mpi_softc *);
127int			mpi_portenable(struct mpi_softc *);
128int			mpi_cfg_coalescing(struct mpi_softc *);
129void			mpi_get_raid(struct mpi_softc *);
130int			mpi_fwupload(struct mpi_softc *);
131int			mpi_manufacturing(struct mpi_softc *);
132int			mpi_scsi_probe_virtual(struct scsi_link *);

134int			mpi_eventnotify(struct mpi_softc *);
135void			mpi_eventnotify_done(struct mpi_ccb *);
136void			mpi_eventnotify_free(struct mpi_softc *,
	    struct mpi_rcb *);
138void			mpi_eventack(void *, void *);
139void			mpi_eventack_done(struct mpi_ccb *);
140int			mpi_evt_sas(struct mpi_softc *, struct mpi_rcb *);
141void			mpi_evt_sas_detach(void *, void *);
142void			mpi_evt_sas_detach_done(struct mpi_ccb *);
143void			mpi_fc_rescan(void *);

145int			mpi_req_cfg_header(struct mpi_softc *, u_int8_t,
	    u_int8_t, u_int32_t, int, void *);
147int			mpi_req_cfg_page(struct mpi_softc *, u_int32_t, int,
	    void *, int, void *, size_t);

150int			mpi_ioctl_cache(struct scsi_link *, u_long,
	    struct dk_cache *);

153#if NBIO1 > 0
154int		mpi_bio_get_pg0_raid(struct mpi_softc *, int);
155int		mpi_ioctl(struct device *, u_long, caddr_t);
156int		mpi_ioctl_inq(struct mpi_softc *, struct bioc_inq *);
157int		mpi_ioctl_vol(struct mpi_softc *, struct bioc_vol *);
158int		mpi_ioctl_disk(struct mpi_softc *, struct bioc_disk *);
159int		mpi_ioctl_setstate(struct mpi_softc *, struct bioc_setstate *);
160#ifndef SMALL_KERNEL
161int		mpi_create_sensors(struct mpi_softc *);
162void		mpi_refresh_sensors(void *);
163#endif /* SMALL_KERNEL */
164#endif /* NBIO > 0 */

166#define DEVNAME(s)((s)->sc_dev.dv_xname)		((s)->sc_dev.dv_xname)

168#define	dwordsof(s)(sizeof(s) / sizeof(u_int32_t))		(sizeof(s) / sizeof(u_int32_t))

170#define mpi_read_db(s)mpi_read((s), 0x00)		mpi_read((s), MPI_DOORBELL0x00)
171#define mpi_write_db(s, v)mpi_write((s), 0x00, (v))	mpi_write((s), MPI_DOORBELL0x00, (v))
172#define mpi_read_intr(s)(((s)->sc_iot)->read_4(((s)->sc_ioh), (0x30)))	bus_space_read_4((s)->sc_iot, (s)->sc_ioh, \(((s)->sc_iot)->read_4(((s)->sc_ioh), (0x30)))
		    MPI_INTR_STATUS)(((s)->sc_iot)->read_4(((s)->sc_ioh), (0x30)))
174#define mpi_write_intr(s, v)mpi_write((s), 0x30, (v))	mpi_write((s), MPI_INTR_STATUS0x30, (v))
175#define mpi_pop_reply(s)(((s)->sc_iot)->read_4(((s)->sc_ioh), (0x44)))	bus_space_read_4((s)->sc_iot, (s)->sc_ioh, \(((s)->sc_iot)->read_4(((s)->sc_ioh), (0x44)))
		    MPI_REPLY_QUEUE)(((s)->sc_iot)->read_4(((s)->sc_ioh), (0x44)))
177#define mpi_push_reply_db(s, v)(((s)->sc_iot)->write_4(((s)->sc_ioh), (0x44), ((v))
)) bus_space_write_4((s)->sc_iot, (s)->sc_ioh, \(((s)->sc_iot)->write_4(((s)->sc_ioh), (0x44), ((v))
))
		    MPI_REPLY_QUEUE, (v))(((s)->sc_iot)->write_4(((s)->sc_ioh), (0x44), ((v))
))

180#define mpi_wait_db_int(s)mpi_wait_ne((s), 0x30, (1<<0), 0)	mpi_wait_ne((s), MPI_INTR_STATUS0x30, \
		    MPI_INTR_STATUS_DOORBELL(1<<0), 0)
182#define mpi_wait_db_ack(s)mpi_wait_eq((s), 0x30, (1<<31), 0)	mpi_wait_eq((s), MPI_INTR_STATUS0x30, \
		    MPI_INTR_STATUS_IOCDOORBELL(1<<31), 0)

185#define MPI_PG_EXTENDED(1<<0)		(1<<0)
186#define MPI_PG_POLL(1<<1)		(1<<1)
187#define MPI_PG_FMT"\020" "\002POLL" "\001EXTENDED"		"\020" "\002POLL" "\001EXTENDED"

189#define mpi_cfg_header(_s, _t, _n, _a, _h)mpi_req_cfg_header((_s), (_t), (_n), (_a), (1<<1), (_h)
) \
mpi_req_cfg_header((_s), (_t), (_n), (_a), \
   MPI_PG_POLL(1<<1), (_h))
192#define mpi_ecfg_header(_s, _t, _n, _a, _h)mpi_req_cfg_header((_s), (_t), (_n), (_a), (1<<1)|(1<<
0), (_h)) \
mpi_req_cfg_header((_s), (_t), (_n), (_a), \
   MPI_PG_POLL(1<<1)|MPI_PG_EXTENDED(1<<0), (_h))

196#define mpi_cfg_page(_s, _a, _h, _r, _p, _l)mpi_req_cfg_page((_s), (_a), (1<<1), (_h), (_r), (_p), (
_l)) \
mpi_req_cfg_page((_s), (_a), MPI_PG_POLL(1<<1), \
   (_h), (_r), (_p), (_l))
199#define mpi_ecfg_page(_s, _a, _h, _r, _p, _l)mpi_req_cfg_page((_s), (_a), (1<<1)|(1<<0), (_h),
 (_r), (_p), (_l)) \
mpi_req_cfg_page((_s), (_a), MPI_PG_POLL(1<<1)|MPI_PG_EXTENDED(1<<0), \
   (_h), (_r), (_p), (_l))

203static inline void
204mpi_dvatosge(struct mpi_sge *sge, u_int64_t dva)
205{
htolem32(&sge->sg_addr_lo, dva)(*(__uint32_t *)(&sge->sg_addr_lo) = ((__uint32_t)(dva
)));
htolem32(&sge->sg_addr_hi, dva >> 32)(*(__uint32_t *)(&sge->sg_addr_hi) = ((__uint32_t)(dva
 >> 32)));
208}

210int
211mpi_attach(struct mpi_softc *sc)
212{
struct scsibus_attach_args	saa;
struct mpi_ccb			*ccb;

printf("\n");

rw_init(&sc->sc_lock, "mpi_lock")_rw_init_flags(&sc->sc_lock, "mpi_lock", 0, ((void *)0
));
task_set(&sc->sc_evt_rescan, mpi_fc_rescan, sc);

/* disable interrupts */
mpi_write(sc, MPI_INTR_MASK0x34,
   MPI_INTR_MASK_REPLY(1<<3) | MPI_INTR_MASK_DOORBELL(1<<0));

if (mpi_init(sc) != 0) {
printf("%s: unable to initialise\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (1);
}

if (mpi_iocfacts(sc) != 0) {
printf("%s: unable to get iocfacts\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (1);
}

if (mpi_alloc_ccbs(sc) != 0) {
/* error already printed */
return (1);
}

if (mpi_alloc_replies(sc) != 0) {
printf("%s: unable to allocate reply space\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_ccbs;
}

if (mpi_iocinit(sc) != 0) {
printf("%s: unable to send iocinit\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_ccbs;
}

/* spin until we're operational */
if (mpi_wait_eq(sc, MPI_DOORBELL0x00, MPI_DOORBELL_STATE(0xf<<28),
   MPI_DOORBELL_STATE_OPER(0x2<<28)) != 0) {
printf("%s: state: 0x%08x\n", DEVNAME(sc)((sc)->sc_dev.dv_xname),
    mpi_read_db(sc)mpi_read((sc), 0x00) & MPI_DOORBELL_STATE(0xf<<28));
printf("%s: operational state timeout\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_ccbs;
}

mpi_push_replies(sc);

if (mpi_portfacts(sc) != 0) {
printf("%s: unable to get portfacts\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_replies;
}

if (mpi_cfg_coalescing(sc) != 0) {
printf("%s: unable to configure coalescing\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_replies;
}

switch (sc->sc_porttype) {
case MPI_PORTFACTS_PORTTYPE_SAS0x30:
SIMPLEQ_INIT(&sc->sc_evt_scan_queue)do { (&sc->sc_evt_scan_queue)->sqh_first = ((void *
)0); (&sc->sc_evt_scan_queue)->sqh_last = &(&
sc->sc_evt_scan_queue)->sqh_first; } while (0);
mtx_init(&sc->sc_evt_scan_mtx, IPL_BIO)do { (void)(((void *)0)); (void)(0); __mtx_init((&sc->
sc_evt_scan_mtx), ((((0x6)) > 0x0 && ((0x6)) < 0x9
) ? 0x9 : ((0x6)))); } while (0);
scsi_ioh_set(&sc->sc_evt_scan_handler, &sc->sc_iopool,
    mpi_evt_sas_detach, sc);
/* FALLTHROUGH */
case MPI_PORTFACTS_PORTTYPE_FC0x10:
if (mpi_eventnotify(sc) != 0) {
	printf("%s: unable to enable events\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
	goto free_replies;
}
break;
}

if (mpi_portenable(sc) != 0) {
printf("%s: unable to enable port\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_replies;
}

if (mpi_fwupload(sc) != 0) {
printf("%s: unable to upload firmware\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_replies;
}

if (mpi_manufacturing(sc) != 0) {
printf("%s: unable to fetch manufacturing info\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_replies;
}

switch (sc->sc_porttype) {
case MPI_PORTFACTS_PORTTYPE_SCSI0x01:
if (mpi_cfg_spi_port(sc) != 0) {
	printf("%s: unable to configure spi\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
	goto free_replies;
}
mpi_squash_ppr(sc);
break;
case MPI_PORTFACTS_PORTTYPE_SAS0x30:
if (mpi_cfg_sas(sc) != 0) {
	printf("%s: unable to configure sas\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
	goto free_replies;
}
break;
case MPI_PORTFACTS_PORTTYPE_FC0x10:
if (mpi_cfg_fc(sc) != 0) {
	printf("%s: unable to configure fc\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
	goto free_replies;
}
break;
}

/* get raid pages */
mpi_get_raid(sc);
325#if NBIO1 > 0
if (sc->sc_flags & MPI_F_RAID(1<<1)) {
if (bio_register(&sc->sc_dev, mpi_ioctl) != 0)
	panic("%s: controller registration failed",
	    DEVNAME(sc)((sc)->sc_dev.dv_xname));
else {
	if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_IOC,mpi_req_cfg_header((sc), ((0x01)), (2), (0), (1<<1), (&
sc->sc_cfg_hdr))
	    2, 0, &sc->sc_cfg_hdr)mpi_req_cfg_header((sc), ((0x01)), (2), (0), (1<<1), (&
sc->sc_cfg_hdr)) != 0) {
		panic("%s: can't get IOC page 2 hdr",
		    DEVNAME(sc)((sc)->sc_dev.dv_xname));
	}

	sc->sc_vol_page = mallocarray(sc->sc_cfg_hdr.page_length,
	    4, M_TEMP127, M_WAITOK0x0001 | M_CANFAIL0x0004);
	if (sc->sc_vol_page == NULL((void *)0)) {
		panic("%s: can't get memory for IOC page 2, "
		    "bio disabled", DEVNAME(sc)((sc)->sc_dev.dv_xname));
	}

	if (mpi_cfg_page(sc, 0, &sc->sc_cfg_hdr, 1,mpi_req_cfg_page((sc), (0), (1<<1), (&sc->sc_cfg_hdr
), (1), (sc->sc_vol_page), (sc->sc_cfg_hdr.page_length *
 4))
	    sc->sc_vol_page,mpi_req_cfg_page((sc), (0), (1<<1), (&sc->sc_cfg_hdr
), (1), (sc->sc_vol_page), (sc->sc_cfg_hdr.page_length *
 4))
	    sc->sc_cfg_hdr.page_length * 4)mpi_req_cfg_page((sc), (0), (1<<1), (&sc->sc_cfg_hdr
), (1), (sc->sc_vol_page), (sc->sc_cfg_hdr.page_length *
 4)) != 0) {
		panic("%s: can't get IOC page 2", DEVNAME(sc)((sc)->sc_dev.dv_xname));
	}

	sc->sc_vol_list = (struct mpi_cfg_raid_vol *)
	    (sc->sc_vol_page + 1);

	sc->sc_ioctl = mpi_ioctl;
}
}
356#endif /* NBIO > 0 */

saa.saa_adapter = &mpi_switch;
saa.saa_adapter_softc = sc;
saa.saa_adapter_target = sc->sc_target;
saa.saa_adapter_buswidth = sc->sc_buswidth;
saa.saa_luns = 8;
saa.saa_openings = MAX(sc->sc_maxcmds / sc->sc_buswidth, 16)(((sc->sc_maxcmds / sc->sc_buswidth)>(16))?(sc->sc_maxcmds
 / sc->sc_buswidth):(16));
saa.saa_pool = &sc->sc_iopool;
saa.saa_wwpn = sc->sc_port_wwn;
saa.saa_wwnn = sc->sc_node_wwn;
saa.saa_quirks = saa.saa_flags = 0;

sc->sc_scsibus = (struct scsibus_softc *)config_found(&sc->sc_dev,config_found_sm((&sc->sc_dev), (&saa), (scsiprint)
, ((void *)0))
   &saa, scsiprint)config_found_sm((&sc->sc_dev), (&saa), (scsiprint)
, ((void *)0));

/* do domain validation */
if (sc->sc_porttype == MPI_PORTFACTS_PORTTYPE_SCSI0x01)
mpi_run_ppr(sc);

/* enable interrupts */
mpi_write(sc, MPI_INTR_MASK0x34, MPI_INTR_MASK_DOORBELL(1<<0));

379#if NBIO1 > 0
380#ifndef SMALL_KERNEL
mpi_create_sensors(sc);
382#endif /* SMALL_KERNEL */
383#endif /* NBIO > 0 */

return (0);

387free_replies:
bus_dmamap_sync(sc->sc_dmat, MPI_DMA_MAP(sc->sc_replies), 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (0), (sc->sc_repq * 80), (0x02)
)
   sc->sc_repq * MPI_REPLY_SIZE, BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (0), (sc->sc_repq * 80), (0x02)
);
mpi_dmamem_free(sc, sc->sc_replies);
391free_ccbs:
while ((ccb = mpi_get_ccb(sc)) != NULL((void *)0))
bus_dmamap_destroy(sc->sc_dmat, ccb->ccb_dmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (ccb
->ccb_dmamap));
mpi_dmamem_free(sc, sc->sc_requests);
free(sc->sc_ccbs, M_DEVBUF2, 0);

return(1);
398}

400int
401mpi_cfg_spi_port(struct mpi_softc *sc)
402{
struct mpi_cfg_hdr		hdr;
struct mpi_cfg_spi_port_pg1	port;

if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_SCSI_SPI_PORT, 1, 0x0,mpi_req_cfg_header((sc), ((0x03)), (1), (0x0), (1<<1), (
&hdr))
   &hdr)mpi_req_cfg_header((sc), ((0x03)), (1), (0x0), (1<<1), (
&hdr)) != 0)
return (1);

if (mpi_cfg_page(sc, 0x0, &hdr, 1, &port, sizeof(port))mpi_req_cfg_page((sc), (0x0), (1<<1), (&hdr), (1), (
&port), (sizeof(port))) != 0)
return (1);

DNPRINTF(MPI_D_MISC, "%s: mpi_cfg_spi_port_pg1\n", DEVNAME(sc));
DNPRINTF(MPI_D_MISC, "%s:  port_scsi_id: %d port_resp_ids 0x%04x\n",
   DEVNAME(sc), port.port_scsi_id, letoh16(port.port_resp_ids));
DNPRINTF(MPI_D_MISC, "%s:  on_bus_timer_value: 0x%08x\n", DEVNAME(sc),
   letoh32(port.port_scsi_id));
DNPRINTF(MPI_D_MISC, "%s:  target_config: 0x%02x id_config: 0x%04x\n",
   DEVNAME(sc), port.target_config, letoh16(port.id_config));

if (port.port_scsi_id == sc->sc_target &&
   port.port_resp_ids == htole16(1 << sc->sc_target)((__uint16_t)(1 << sc->sc_target)) &&
   port.on_bus_timer_value != htole32(0x0)((__uint32_t)(0x0)))
return (0);

DNPRINTF(MPI_D_MISC, "%s: setting port scsi id to %d\n", DEVNAME(sc),
   sc->sc_target);
port.port_scsi_id = sc->sc_target;
port.port_resp_ids = htole16(1 << sc->sc_target)((__uint16_t)(1 << sc->sc_target));
port.on_bus_timer_value = htole32(0x07000000)((__uint32_t)(0x07000000)); /* XXX magic */

if (mpi_cfg_page(sc, 0x0, &hdr, 0, &port, sizeof(port))mpi_req_cfg_page((sc), (0x0), (1<<1), (&hdr), (0), (
&port), (sizeof(port))) != 0) {
printf("%s: unable to configure port scsi id\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (1);
}

return (0);
438}

440void
441mpi_squash_ppr(struct mpi_softc *sc)
442{
struct mpi_cfg_hdr		hdr;
struct mpi_cfg_spi_dev_pg1	page;
int				i;

DNPRINTF(MPI_D_PPR, "%s: mpi_squash_ppr\n", DEVNAME(sc));

for (i = 0; i < sc->sc_buswidth; i++) {
if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_SCSI_SPI_DEV,mpi_req_cfg_header((sc), ((0x04)), (1), (i), (1<<1), (&
hdr))
    1, i, &hdr)mpi_req_cfg_header((sc), ((0x04)), (1), (i), (1<<1), (&
hdr)) != 0)
	return;

if (mpi_cfg_page(sc, i, &hdr, 1, &page, sizeof(page))mpi_req_cfg_page((sc), (i), (1<<1), (&hdr), (1), (&
page), (sizeof(page))) != 0)
	return;

DNPRINTF(MPI_D_PPR, "%s:  target: %d req_params1: 0x%02x "
    "req_offset: 0x%02x req_period: 0x%02x "
    "req_params2: 0x%02x conf: 0x%08x\n", DEVNAME(sc), i,
    page.req_params1, page.req_offset, page.req_period,
    page.req_params2, letoh32(page.configuration));

page.req_params1 = 0x0;
page.req_offset = 0x0;
page.req_period = 0x0;
page.req_params2 = 0x0;
page.configuration = htole32(0x0)((__uint32_t)(0x0));

if (mpi_cfg_page(sc, i, &hdr, 0, &page, sizeof(page))mpi_req_cfg_page((sc), (i), (1<<1), (&hdr), (0), (&
page), (sizeof(page))) != 0)
	return;
}
472}

474void
475mpi_run_ppr(struct mpi_softc *sc)
476{
struct mpi_cfg_hdr		hdr;
struct mpi_cfg_spi_port_pg0	port_pg;
struct mpi_cfg_ioc_pg3		*physdisk_pg;
struct mpi_cfg_raid_physdisk	*physdisk_list, *physdisk;
size_t				pagelen;
struct scsi_link		*link;
int				i, tries;

if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_SCSI_SPI_PORT, 0, 0x0,mpi_req_cfg_header((sc), ((0x03)), (0), (0x0), (1<<1), (
&hdr))
   &hdr)mpi_req_cfg_header((sc), ((0x03)), (0), (0x0), (1<<1), (
&hdr)) != 0) {
DNPRINTF(MPI_D_PPR, "%s: mpi_run_ppr unable to fetch header\n",
    DEVNAME(sc));
return;
}

if (mpi_cfg_page(sc, 0x0, &hdr, 1, &port_pg, sizeof(port_pg))mpi_req_cfg_page((sc), (0x0), (1<<1), (&hdr), (1), (
&port_pg), (sizeof(port_pg))) != 0) {
DNPRINTF(MPI_D_PPR, "%s: mpi_run_ppr unable to fetch page\n",
    DEVNAME(sc));
return;
}

for (i = 0; i < sc->sc_buswidth; i++) {
link = scsi_get_link(sc->sc_scsibus, i, 0);
if (link == NULL((void *)0))
	continue;

/* do not ppr volumes */
if (link->flags & SDEV_VIRTUAL0x0800)
	continue;

tries = 0;
while (mpi_ppr(sc, link, NULL((void *)0), port_pg.min_period,
    port_pg.max_offset, tries) == EAGAIN35)
	tries++;
}

if ((sc->sc_flags & MPI_F_RAID(1<<1)) == 0)
return;

if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_IOC, 3, 0x0,mpi_req_cfg_header((sc), ((0x01)), (3), (0x0), (1<<1), (
&hdr))
   &hdr)mpi_req_cfg_header((sc), ((0x01)), (3), (0x0), (1<<1), (
&hdr)) != 0) {
DNPRINTF(MPI_D_RAID|MPI_D_PPR, "%s: mpi_run_ppr unable to "
    "fetch ioc pg 3 header\n", DEVNAME(sc));
return;
}

pagelen = hdr.page_length * 4; /* dwords to bytes */
physdisk_pg = malloc(pagelen, M_TEMP127, M_WAITOK0x0001|M_CANFAIL0x0004);
if (physdisk_pg == NULL((void *)0)) {
DNPRINTF(MPI_D_RAID|MPI_D_PPR, "%s: mpi_run_ppr unable to "
    "allocate ioc pg 3\n", DEVNAME(sc));
return;
}
physdisk_list = (struct mpi_cfg_raid_physdisk *)(physdisk_pg + 1);

if (mpi_cfg_page(sc, 0, &hdr, 1, physdisk_pg, pagelen)mpi_req_cfg_page((sc), (0), (1<<1), (&hdr), (1), (physdisk_pg
), (pagelen)) != 0) {
DNPRINTF(MPI_D_PPR|MPI_D_PPR, "%s: mpi_run_ppr unable to "
    "fetch ioc page 3\n", DEVNAME(sc));
goto out;
}

DNPRINTF(MPI_D_PPR|MPI_D_PPR, "%s:  no_phys_disks: %d\n", DEVNAME(sc),
   physdisk_pg->no_phys_disks);

for (i = 0; i < physdisk_pg->no_phys_disks; i++) {
physdisk = &physdisk_list[i];

DNPRINTF(MPI_D_PPR|MPI_D_PPR, "%s:  id: %d bus: %d ioc: %d "
    "num: %d\n", DEVNAME(sc), physdisk->phys_disk_id,
    physdisk->phys_disk_bus, physdisk->phys_disk_ioc,
    physdisk->phys_disk_num);

if (physdisk->phys_disk_ioc != sc->sc_ioc_number)
	continue;

tries = 0;
while (mpi_ppr(sc, NULL((void *)0), physdisk, port_pg.min_period,
    port_pg.max_offset, tries) == EAGAIN35)
	tries++;
}

558out:
free(physdisk_pg, M_TEMP127, pagelen);
560}

562int
563mpi_ppr(struct mpi_softc *sc, struct scsi_link *link,
  struct mpi_cfg_raid_physdisk *physdisk, int period, int offset, int try)
565{
struct mpi_cfg_hdr		hdr0, hdr1;
struct mpi_cfg_spi_dev_pg0	pg0;
struct mpi_cfg_spi_dev_pg1	pg1;
u_int32_t			address;
int				id;
int				raid = 0;

DNPRINTF(MPI_D_PPR, "%s: mpi_ppr period: %d offset: %d try: %d "
   "link quirks: 0x%x\n", DEVNAME(sc), period, offset, try,
   link->quirks);

if (try >= 3)
return (EIO5);

if (physdisk == NULL((void *)0)) {
if ((link->inqdata.device & SID_TYPE0x1f) == T_PROCESSOR0x03)
	return (EIO5);

address = link->target;
id = link->target;
} else {
raid = 1;
address = (physdisk->phys_disk_bus << 8) |
    (physdisk->phys_disk_id);
id = physdisk->phys_disk_num;
}

if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_SCSI_SPI_DEV, 0,mpi_req_cfg_header((sc), ((0x04)), (0), (address), (1<<
1), (&hdr0))
   address, &hdr0)mpi_req_cfg_header((sc), ((0x04)), (0), (address), (1<<
1), (&hdr0)) != 0) {
DNPRINTF(MPI_D_PPR, "%s: mpi_ppr unable to fetch header 0\n",
    DEVNAME(sc));
return (EIO5);
}

if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_SCSI_SPI_DEV, 1,mpi_req_cfg_header((sc), ((0x04)), (1), (address), (1<<
1), (&hdr1))
   address, &hdr1)mpi_req_cfg_header((sc), ((0x04)), (1), (address), (1<<
1), (&hdr1)) != 0) {
DNPRINTF(MPI_D_PPR, "%s: mpi_ppr unable to fetch header 1\n",
    DEVNAME(sc));
return (EIO5);
}

607#ifdef MPI_DEBUG
if (mpi_cfg_page(sc, address, &hdr0, 1, &pg0, sizeof(pg0))mpi_req_cfg_page((sc), (address), (1<<1), (&hdr0), (
1), (&pg0), (sizeof(pg0))) != 0) {
DNPRINTF(MPI_D_PPR, "%s: mpi_ppr unable to fetch page 0\n",
    DEVNAME(sc));
return (EIO5);
}

DNPRINTF(MPI_D_PPR, "%s: mpi_ppr dev pg 0 neg_params1: 0x%02x "
   "neg_offset: %d neg_period: 0x%02x neg_params2: 0x%02x "
   "info: 0x%08x\n", DEVNAME(sc), pg0.neg_params1, pg0.neg_offset,
   pg0.neg_period, pg0.neg_params2, letoh32(pg0.information));
618#endif

if (mpi_cfg_page(sc, address, &hdr1, 1, &pg1, sizeof(pg1))mpi_req_cfg_page((sc), (address), (1<<1), (&hdr1), (
1), (&pg1), (sizeof(pg1))) != 0) {
DNPRINTF(MPI_D_PPR, "%s: mpi_ppr unable to fetch page 1\n",
    DEVNAME(sc));
return (EIO5);
}

DNPRINTF(MPI_D_PPR, "%s: mpi_ppr dev pg 1 req_params1: 0x%02x "
   "req_offset: 0x%02x req_period: 0x%02x req_params2: 0x%02x "
   "conf: 0x%08x\n", DEVNAME(sc), pg1.req_params1, pg1.req_offset,
   pg1.req_period, pg1.req_params2, letoh32(pg1.configuration));

pg1.req_params1 = 0;
pg1.req_offset = offset;
pg1.req_period = period;
pg1.req_params2 &= ~MPI_CFG_SPI_DEV_1_REQPARAMS_WIDTH(1<<5);

if (raid || !(link->quirks & SDEV_NOSYNC0x0002)) {
pg1.req_params2 |= MPI_CFG_SPI_DEV_1_REQPARAMS_WIDTH_WIDE(1<<5);

switch (try) {
case 0: /* U320 */
	break;
case 1: /* U160 */
	pg1.req_period = 0x09;
	break;
case 2: /* U80 */
	pg1.req_period = 0x0a;
	break;
}

if (pg1.req_period < 0x09) {
	/* Ultra320: enable QAS & PACKETIZED */
	pg1.req_params1 |= MPI_CFG_SPI_DEV_1_REQPARAMS_QAS(1<<2) |
	    MPI_CFG_SPI_DEV_1_REQPARAMS_PACKETIZED(1<<0);
}
if (pg1.req_period < 0xa) {
	/* >= Ultra160: enable dual xfers */
	pg1.req_params1 |=
	    MPI_CFG_SPI_DEV_1_REQPARAMS_DUALXFERS(1<<1);
}
}

DNPRINTF(MPI_D_PPR, "%s: mpi_ppr dev pg 1 req_params1: 0x%02x "
   "req_offset: 0x%02x req_period: 0x%02x req_params2: 0x%02x "
   "conf: 0x%08x\n", DEVNAME(sc), pg1.req_params1, pg1.req_offset,
   pg1.req_period, pg1.req_params2, letoh32(pg1.configuration));

if (mpi_cfg_page(sc, address, &hdr1, 0, &pg1, sizeof(pg1))mpi_req_cfg_page((sc), (address), (1<<1), (&hdr1), (
0), (&pg1), (sizeof(pg1))) != 0) {
DNPRINTF(MPI_D_PPR, "%s: mpi_ppr unable to write page 1\n",
    DEVNAME(sc));
return (EIO5);
}

if (mpi_cfg_page(sc, address, &hdr1, 1, &pg1, sizeof(pg1))mpi_req_cfg_page((sc), (address), (1<<1), (&hdr1), (
1), (&pg1), (sizeof(pg1))) != 0) {
DNPRINTF(MPI_D_PPR, "%s: mpi_ppr unable to read page 1\n",
    DEVNAME(sc));
return (EIO5);
}

DNPRINTF(MPI_D_PPR, "%s: mpi_ppr dev pg 1 req_params1: 0x%02x "
   "req_offset: 0x%02x req_period: 0x%02x req_params2: 0x%02x "
   "conf: 0x%08x\n", DEVNAME(sc), pg1.req_params1, pg1.req_offset,
   pg1.req_period, pg1.req_params2, letoh32(pg1.configuration));

if (mpi_inq(sc, id, raid) != 0) {
DNPRINTF(MPI_D_PPR, "%s: mpi_ppr unable to do inquiry against "
    "target %d\n", DEVNAME(sc), link->target);
return (EIO5);
}

if (mpi_cfg_page(sc, address, &hdr0, 1, &pg0, sizeof(pg0))mpi_req_cfg_page((sc), (address), (1<<1), (&hdr0), (
1), (&pg0), (sizeof(pg0))) != 0) {
DNPRINTF(MPI_D_PPR, "%s: mpi_ppr unable to read page 0 after "
    "inquiry\n", DEVNAME(sc));
return (EIO5);
}

DNPRINTF(MPI_D_PPR, "%s: mpi_ppr dev pg 0 neg_params1: 0x%02x "
   "neg_offset: %d neg_period: 0x%02x neg_params2: 0x%02x "
   "info: 0x%08x\n", DEVNAME(sc), pg0.neg_params1, pg0.neg_offset,
   pg0.neg_period, pg0.neg_params2, letoh32(pg0.information));

if (!(lemtoh32(&pg0.information)((__uint32_t)(*(__uint32_t *)(&pg0.information))) & 0x07) && (try == 0)) {
DNPRINTF(MPI_D_PPR, "%s: mpi_ppr U320 ppr rejected\n",
    DEVNAME(sc));
return (EAGAIN35);
}

if ((((lemtoh32(&pg0.information)((__uint32_t)(*(__uint32_t *)(&pg0.information))) >> 8) & 0xff) > 0x09) && (try == 1)) {
DNPRINTF(MPI_D_PPR, "%s: mpi_ppr U160 ppr rejected\n",
    DEVNAME(sc));
return (EAGAIN35);
}

if (lemtoh32(&pg0.information)((__uint32_t)(*(__uint32_t *)(&pg0.information))) & 0x0e) {
DNPRINTF(MPI_D_PPR, "%s: mpi_ppr ppr rejected: %0x\n",
    DEVNAME(sc), lemtoh32(&pg0.information));
return (EAGAIN35);
}

switch(pg0.neg_period) {
case 0x08:
period = 160;
break;
case 0x09:
period = 80;
break;
case 0x0a:
period = 40;
break;
case 0x0b:
period = 20;
break;
case 0x0c:
period = 10;
break;
default:
period = 0;
break;
}

printf("%s: %s %d %s at %dMHz width %dbit offset %d "
   "QAS %d DT %d IU %d\n", DEVNAME(sc)((sc)->sc_dev.dv_xname), raid ? "phys disk" : "target",
   id, period ? "Sync" : "Async", period,
   (pg0.neg_params2 & MPI_CFG_SPI_DEV_0_NEGPARAMS_WIDTH_WIDE(1<<5)) ? 16 : 8,
   pg0.neg_offset,
   (pg0.neg_params1 & MPI_CFG_SPI_DEV_0_NEGPARAMS_QAS(1<<2)) ? 1 : 0,
   (pg0.neg_params1 & MPI_CFG_SPI_DEV_0_NEGPARAMS_DUALXFERS(1<<1)) ? 1 : 0,
   (pg0.neg_params1 & MPI_CFG_SPI_DEV_0_NEGPARAMS_PACKETIZED(1<<0)) ? 1 : 0);

return (0);
750}

752int
753mpi_inq(struct mpi_softc *sc, u_int16_t target, int physdisk)
754{
struct mpi_ccb			*ccb;
struct scsi_inquiry		inq;
struct inq_bundle {
struct mpi_msg_scsi_io		io;
struct mpi_sge			sge;
struct scsi_inquiry_data	inqbuf;
struct scsi_sense_data		sense;
} __packed__attribute__((__packed__))			*bundle;
struct mpi_msg_scsi_io		*io;
struct mpi_sge			*sge;

DNPRINTF(MPI_D_PPR, "%s: mpi_inq\n", DEVNAME(sc));

memset(&inq, 0, sizeof(inq))__builtin_memset((&inq), (0), (sizeof(inq)));
inq.opcode = INQUIRY0x12;
_lto2b(sizeof(struct scsi_inquiry_data), inq.length);

ccb = scsi_io_get(&sc->sc_iopool, SCSI_NOSLEEP0x00001);
if (ccb == NULL((void *)0))
return (1);

ccb->ccb_done = mpi_empty_done;

bundle = ccb->ccb_cmd;
io = &bundle->io;
sge = &bundle->sge;

io->function = physdisk ? MPI_FUNCTION_RAID_SCSI_IO_PASSTHROUGH(0x16) :
   MPI_FUNCTION_SCSI_IO_REQUEST(0x00);
/*
* bus is always 0
* io->bus = htole16(sc->sc_bus);
*/
io->target_id = target;

io->cdb_length = sizeof(inq);
io->sense_buf_len = sizeof(struct scsi_sense_data);
io->msg_flags = MPI_SCSIIO_SENSE_BUF_ADDR_WIDTH_64(1<<0);

/*
* always lun 0
* io->lun[0] = htobe16(link->lun);
*/

io->direction = MPI_SCSIIO_DIR_READ(0x2);
io->tagging = MPI_SCSIIO_ATTR_NO_DISCONNECT(0x7);

memcpy(io->cdb, &inq, sizeof(inq))__builtin_memcpy((io->cdb), (&inq), (sizeof(inq)));

htolem32(&io->data_length, sizeof(struct scsi_inquiry_data))(*(__uint32_t *)(&io->data_length) = ((__uint32_t)(sizeof
(struct scsi_inquiry_data))));

htolem32(&io->sense_buf_low_addr, ccb->ccb_cmd_dva +(*(__uint32_t *)(&io->sense_buf_low_addr) = ((__uint32_t
)(ccb->ccb_cmd_dva + __builtin_offsetof(struct inq_bundle,
 sense))))
   offsetof(struct inq_bundle, sense))(*(__uint32_t *)(&io->sense_buf_low_addr) = ((__uint32_t
)(ccb->ccb_cmd_dva + __builtin_offsetof(struct inq_bundle,
 sense))));

htolem32(&sge->sg_hdr, MPI_SGE_FL_TYPE_SIMPLE | MPI_SGE_FL_SIZE_64 |(*(__uint32_t *)(&sge->sg_hdr) = ((__uint32_t)((0x1<<
28) | (0x1<<25) | (0x1<<31) | (0x1<<30) | (
0x1<<24) | (u_int32_t)sizeof(inq))))
   MPI_SGE_FL_LAST | MPI_SGE_FL_EOB | MPI_SGE_FL_EOL |(*(__uint32_t *)(&sge->sg_hdr) = ((__uint32_t)((0x1<<
28) | (0x1<<25) | (0x1<<31) | (0x1<<30) | (
0x1<<24) | (u_int32_t)sizeof(inq))))
   (u_int32_t)sizeof(inq))(*(__uint32_t *)(&sge->sg_hdr) = ((__uint32_t)((0x1<<
28) | (0x1<<25) | (0x1<<31) | (0x1<<30) | (
0x1<<24) | (u_int32_t)sizeof(inq))));

mpi_dvatosge(sge, ccb->ccb_cmd_dva +
   offsetof(struct inq_bundle, inqbuf)__builtin_offsetof(struct inq_bundle, inqbuf));

if (mpi_poll(sc, ccb, 5000) != 0)
return (1);

if (ccb->ccb_rcb != NULL((void *)0))
mpi_push_reply(sc, ccb->ccb_rcb);

scsi_io_put(&sc->sc_iopool, ccb);

return (0);
825}

827int
828mpi_cfg_sas(struct mpi_softc *sc)
829{
struct mpi_ecfg_hdr		ehdr;
struct mpi_cfg_sas_iou_pg1	*pg;
size_t				pagelen;
int				rv = 0;

if (mpi_ecfg_header(sc, MPI_CONFIG_REQ_EXTPAGE_TYPE_SAS_IO_UNIT, 1, 0,mpi_req_cfg_header((sc), ((0x10)), (1), (0), (1<<1)|(1<<
0), (&ehdr))
   &ehdr)mpi_req_cfg_header((sc), ((0x10)), (1), (0), (1<<1)|(1<<
0), (&ehdr)) != 0)
return (0);

pagelen = lemtoh16(&ehdr.ext_page_length)((__uint16_t)(*(__uint16_t *)(&ehdr.ext_page_length))) * 4;
pg = malloc(pagelen, M_TEMP127, M_NOWAIT0x0002 | M_ZERO0x0008);
if (pg == NULL((void *)0))
return (ENOMEM12);

if (mpi_ecfg_page(sc, 0, &ehdr, 1, pg, pagelen)mpi_req_cfg_page((sc), (0), (1<<1)|(1<<0), (&
ehdr), (1), (pg), (pagelen)) != 0)
goto out;

if (pg->max_sata_q_depth != 32) {
pg->max_sata_q_depth = 32;

if (mpi_ecfg_page(sc, 0, &ehdr, 0, pg, pagelen)mpi_req_cfg_page((sc), (0), (1<<1)|(1<<0), (&
ehdr), (0), (pg), (pagelen)) != 0)
	goto out;
}

854out:
free(pg, M_TEMP127, pagelen);
return (rv);
857}

859int
860mpi_cfg_fc(struct mpi_softc *sc)
861{
struct mpi_cfg_hdr		hdr;
struct mpi_cfg_fc_port_pg0	pg0;
struct mpi_cfg_fc_port_pg1	pg1;

if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_FC_PORT, 0, 0,mpi_req_cfg_header((sc), ((0x05)), (0), (0), (1<<1), (&
hdr))
   &hdr)mpi_req_cfg_header((sc), ((0x05)), (0), (0), (1<<1), (&
hdr)) != 0) {
printf("%s: unable to fetch FC port header 0\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (1);
}

if (mpi_cfg_page(sc, 0, &hdr, 1, &pg0, sizeof(pg0))mpi_req_cfg_page((sc), (0), (1<<1), (&hdr), (1), (&
pg0), (sizeof(pg0))) != 0) {
printf("%s: unable to fetch FC port page 0\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (1);
}

sc->sc_port_wwn = letoh64(pg0.wwpn)((__uint64_t)(pg0.wwpn));
sc->sc_node_wwn = letoh64(pg0.wwnn)((__uint64_t)(pg0.wwnn));

/* configure port config more to our liking */
if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_FC_PORT, 1, 0,mpi_req_cfg_header((sc), ((0x05)), (1), (0), (1<<1), (&
hdr))
   &hdr)mpi_req_cfg_header((sc), ((0x05)), (1), (0), (1<<1), (&
hdr)) != 0) {
printf("%s: unable to fetch FC port header 1\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (1);
}

if (mpi_cfg_page(sc, 0, &hdr, 1, &pg1, sizeof(pg1))mpi_req_cfg_page((sc), (0), (1<<1), (&hdr), (1), (&
pg1), (sizeof(pg1))) != 0) {
printf("%s: unable to fetch FC port page 1\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (1);
}

SET(pg1.flags, htole32(MPI_CFG_FC_PORT_0_FLAGS_IMMEDIATE_ERROR |((pg1.flags) |= (((__uint32_t)((1<<26) | (1<<24))
)))
   MPI_CFG_FC_PORT_0_FLAGS_VERBOSE_RESCAN))((pg1.flags) |= (((__uint32_t)((1<<26) | (1<<24))
)));

if (mpi_cfg_page(sc, 0, &hdr, 0, &pg1, sizeof(pg1))mpi_req_cfg_page((sc), (0), (1<<1), (&hdr), (0), (&
pg1), (sizeof(pg1))) != 0) {
printf("%s: unable to set FC port page 1\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (1);
}

return (0);
901}

903void
904mpi_detach(struct mpi_softc *sc)
905{

907}

909int
910mpi_intr(void *arg)
911{
struct mpi_softc		*sc = arg;
u_int32_t			reg;
int				rv = 0;

if ((mpi_read_intr(sc)(((sc)->sc_iot)->read_4(((sc)->sc_ioh), (0x30))) & MPI_INTR_STATUS_REPLY(1<<3)) == 0)
return (rv);

while ((reg = mpi_pop_reply(sc)(((sc)->sc_iot)->read_4(((sc)->sc_ioh), (0x44)))) != 0xffffffff) {
mpi_reply(sc, reg);
rv = 1;
}

return (rv);
925}

927void
928mpi_reply(struct mpi_softc *sc, u_int32_t reg)
929{
struct mpi_ccb			*ccb;
struct mpi_rcb			*rcb = NULL((void *)0);
struct mpi_msg_reply		*reply = NULL((void *)0);
u_int32_t			reply_dva;
int				id;
int				i;

DNPRINTF(MPI_D_INTR, "%s: mpi_reply reg: 0x%08x\n", DEVNAME(sc), reg);

if (reg & MPI_REPLY_QUEUE_ADDRESS(1<<31)) {
reply_dva = (reg & MPI_REPLY_QUEUE_ADDRESS_MASK0x7fffffff) << 1;
i = (reply_dva - (u_int32_t)MPI_DMA_DVA(sc->sc_replies)((u_int64_t)(sc->sc_replies)->mdm_map->dm_segs[0].ds_addr
)) /
    MPI_REPLY_SIZE80;
rcb = &sc->sc_rcbs[i];

bus_dmamap_sync(sc->sc_dmat,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (rcb->rcb_offset), (80), (0x02)
)
    MPI_DMA_MAP(sc->sc_replies), rcb->rcb_offset,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (rcb->rcb_offset), (80), (0x02)
)
    MPI_REPLY_SIZE, BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (rcb->rcb_offset), (80), (0x02)
);

reply = rcb->rcb_reply;

id = lemtoh32(&reply->msg_context)((__uint32_t)(*(__uint32_t *)(&reply->msg_context)));
} else {
switch (reg & MPI_REPLY_QUEUE_TYPE_MASK(3<<29)) {
case MPI_REPLY_QUEUE_TYPE_INIT(0<<29):
	id = reg & MPI_REPLY_QUEUE_CONTEXT0x1fffffff;
	break;

default:
	panic("%s: unsupported context reply",
	    DEVNAME(sc)((sc)->sc_dev.dv_xname));
}
}

DNPRINTF(MPI_D_INTR, "%s: mpi_reply id: %d reply: %p\n",
   DEVNAME(sc), id, reply);

ccb = &sc->sc_ccbs[id];

bus_dmamap_sync(sc->sc_dmat, MPI_DMA_MAP(sc->sc_requests),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_requests)->mdm_map)), (ccb->ccb_offset), (512), (0x02
 | 0x08))
   ccb->ccb_offset, MPI_REQUEST_SIZE,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_requests)->mdm_map)), (ccb->ccb_offset), (512), (0x02
 | 0x08))
   BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_requests)->mdm_map)), (ccb->ccb_offset), (512), (0x02
 | 0x08));
ccb->ccb_state = MPI_CCB_READY;
ccb->ccb_rcb = rcb;

ccb->ccb_done(ccb);
976}

978struct mpi_dmamem *
979mpi_dmamem_alloc(struct mpi_softc *sc, size_t size)
980{
struct mpi_dmamem		*mdm;
int				nsegs;

mdm = malloc(sizeof(struct mpi_dmamem), M_DEVBUF2, M_NOWAIT0x0002 | M_ZERO0x0008);
if (mdm == NULL((void *)0))
return (NULL((void *)0));

mdm->mdm_size = size;

if (bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size
), (1), (size), (0), (0x0001 | 0x0002), (&mdm->mdm_map
))
   BUS_DMA_NOWAIT | BUS_DMA_ALLOCNOW, &mdm->mdm_map)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size
), (1), (size), (0), (0x0001 | 0x0002), (&mdm->mdm_map
)) != 0)
goto mdmfree;

if (bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE, 0, &mdm->mdm_seg,(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size
), ((1 << 12)), (0), (&mdm->mdm_seg), (1), (&
nsegs), (0x0001 | 0x1000))
   1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO)(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size
), ((1 << 12)), (0), (&mdm->mdm_seg), (1), (&
nsegs), (0x0001 | 0x1000)) != 0)
goto destroy;

if (bus_dmamem_map(sc->sc_dmat, &mdm->mdm_seg, nsegs, size,(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&mdm
->mdm_seg), (nsegs), (size), (&mdm->mdm_kva), (0x0001
))
   &mdm->mdm_kva, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&mdm
->mdm_seg), (nsegs), (size), (&mdm->mdm_kva), (0x0001
)) != 0)
goto free;

if (bus_dmamap_load(sc->sc_dmat, mdm->mdm_map, mdm->mdm_kva, size,(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (mdm->
mdm_map), (mdm->mdm_kva), (size), (((void *)0)), (0x0001))
   NULL, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (mdm->
mdm_map), (mdm->mdm_kva), (size), (((void *)0)), (0x0001)) != 0)
goto unmap;

DNPRINTF(MPI_D_MEM, "%s: mpi_dmamem_alloc size: %d mdm: %#x "
   "map: %#x nsegs: %d segs: %#x kva: %x\n",
   DEVNAME(sc), size, mdm->mdm_map, nsegs, mdm->mdm_seg, mdm->mdm_kva);

return (mdm);

1012unmap:
bus_dmamem_unmap(sc->sc_dmat, mdm->mdm_kva, size)(*(sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), (mdm->
mdm_kva), (size));
1014free:
bus_dmamem_free(sc->sc_dmat, &mdm->mdm_seg, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
mdm->mdm_seg), (1));
1016destroy:
bus_dmamap_destroy(sc->sc_dmat, mdm->mdm_map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (mdm
->mdm_map));
1018mdmfree:
free(mdm, M_DEVBUF2, sizeof *mdm);

return (NULL((void *)0));
1022}

1024void
1025mpi_dmamem_free(struct mpi_softc *sc, struct mpi_dmamem *mdm)
1026{
DNPRINTF(MPI_D_MEM, "%s: mpi_dmamem_free %#x\n", DEVNAME(sc), mdm);

bus_dmamap_unload(sc->sc_dmat, mdm->mdm_map)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (mdm
->mdm_map));
bus_dmamem_unmap(sc->sc_dmat, mdm->mdm_kva, mdm->mdm_size)(*(sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), (mdm->
mdm_kva), (mdm->mdm_size));
bus_dmamem_free(sc->sc_dmat, &mdm->mdm_seg, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
mdm->mdm_seg), (1));
bus_dmamap_destroy(sc->sc_dmat, mdm->mdm_map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (mdm
->mdm_map));
free(mdm, M_DEVBUF2, sizeof *mdm);
1034}

1036int
1037mpi_alloc_ccbs(struct mpi_softc *sc)
1038{
struct mpi_ccb			*ccb;
u_int8_t			*cmd;
int				i;

SLIST_INIT(&sc->sc_ccb_free){ ((&sc->sc_ccb_free)->slh_first) = ((void *)0); };
mtx_init(&sc->sc_ccb_mtx, IPL_BIO)do { (void)(((void *)0)); (void)(0); __mtx_init((&sc->
sc_ccb_mtx), ((((0x6)) > 0x0 && ((0x6)) < 0x9) ?
 0x9 : ((0x6)))); } while (0);

sc->sc_ccbs = mallocarray(sc->sc_maxcmds, sizeof(struct mpi_ccb),
   M_DEVBUF2, M_WAITOK0x0001 | M_CANFAIL0x0004 | M_ZERO0x0008);
if (sc->sc_ccbs == NULL((void *)0)) {
printf("%s: unable to allocate ccbs\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
return (1);
}

sc->sc_requests = mpi_dmamem_alloc(sc,
   MPI_REQUEST_SIZE512 * sc->sc_maxcmds);
if (sc->sc_requests == NULL((void *)0)) {
printf("%s: unable to allocate ccb dmamem\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto free_ccbs;
}
cmd = MPI_DMA_KVA(sc->sc_requests)((void *)(sc->sc_requests)->mdm_kva);
memset(cmd, 0, MPI_REQUEST_SIZE * sc->sc_maxcmds)__builtin_memset((cmd), (0), (512 * sc->sc_maxcmds));

for (i = 0; i < sc->sc_maxcmds; i++) {
ccb = &sc->sc_ccbs[i];

if (bus_dmamap_create(sc->sc_dmat, MAXPHYS,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((64
 * 1024)), (sc->sc_max_sgl_len), ((64 * 1024)), (0), (0x0001
 | 0x0002), (&ccb->ccb_dmamap))
    sc->sc_max_sgl_len, MAXPHYS, 0,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((64
 * 1024)), (sc->sc_max_sgl_len), ((64 * 1024)), (0), (0x0001
 | 0x0002), (&ccb->ccb_dmamap))
    BUS_DMA_NOWAIT | BUS_DMA_ALLOCNOW,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((64
 * 1024)), (sc->sc_max_sgl_len), ((64 * 1024)), (0), (0x0001
 | 0x0002), (&ccb->ccb_dmamap))
    &ccb->ccb_dmamap)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((64
 * 1024)), (sc->sc_max_sgl_len), ((64 * 1024)), (0), (0x0001
 | 0x0002), (&ccb->ccb_dmamap)) != 0) {
	printf("%s: unable to create dma map\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
	goto free_maps;
}

ccb->ccb_sc = sc;
ccb->ccb_id = i;
ccb->ccb_offset = MPI_REQUEST_SIZE512 * i;
ccb->ccb_state = MPI_CCB_READY;

ccb->ccb_cmd = &cmd[ccb->ccb_offset];
ccb->ccb_cmd_dva = (u_int32_t)MPI_DMA_DVA(sc->sc_requests)((u_int64_t)(sc->sc_requests)->mdm_map->dm_segs[0].ds_addr
) +
    ccb->ccb_offset;

DNPRINTF(MPI_D_CCB, "%s: mpi_alloc_ccbs(%d) ccb: %#x map: %#x "
    "sc: %#x id: %#x offs: %#x cmd: %#x dva: %#x\n",
    DEVNAME(sc), i, ccb, ccb->ccb_dmamap, ccb->ccb_sc,
    ccb->ccb_id, ccb->ccb_offset, ccb->ccb_cmd,
    ccb->ccb_cmd_dva);

mpi_put_ccb(sc, ccb);
}

scsi_iopool_init(&sc->sc_iopool, sc, mpi_get_ccb, mpi_put_ccb);

return (0);

1095free_maps:
while ((ccb = mpi_get_ccb(sc)) != NULL((void *)0))
bus_dmamap_destroy(sc->sc_dmat, ccb->ccb_dmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (ccb
->ccb_dmamap));

mpi_dmamem_free(sc, sc->sc_requests);
1100free_ccbs:
free(sc->sc_ccbs, M_DEVBUF2, 0);

return (1);
1104}

1106void *
1107mpi_get_ccb(void *xsc)
1108{
struct mpi_softc		*sc = xsc;
struct mpi_ccb			*ccb;

mtx_enter(&sc->sc_ccb_mtx);
ccb = SLIST_FIRST(&sc->sc_ccb_free)((&sc->sc_ccb_free)->slh_first);
if (ccb != NULL((void *)0)) {
SLIST_REMOVE_HEAD(&sc->sc_ccb_free, ccb_link)do { (&sc->sc_ccb_free)->slh_first = (&sc->sc_ccb_free
)->slh_first->ccb_link.sle_next; } while (0);
ccb->ccb_state = MPI_CCB_READY;
}
mtx_leave(&sc->sc_ccb_mtx);

DNPRINTF(MPI_D_CCB, "%s: mpi_get_ccb %p\n", DEVNAME(sc), ccb);

return (ccb);
1123}

1125void
1126mpi_put_ccb(void *xsc, void *io)
1127{
struct mpi_softc		*sc = xsc;
struct mpi_ccb			*ccb = io;

DNPRINTF(MPI_D_CCB, "%s: mpi_put_ccb %p\n", DEVNAME(sc), ccb);

1133#ifdef DIAGNOSTIC1
if (ccb->ccb_state == MPI_CCB_FREE)
panic("mpi_put_ccb: double free");
1136#endif

ccb->ccb_state = MPI_CCB_FREE;
ccb->ccb_cookie = NULL((void *)0);
ccb->ccb_done = NULL((void *)0);
memset(ccb->ccb_cmd, 0, MPI_REQUEST_SIZE)__builtin_memset((ccb->ccb_cmd), (0), (512));
mtx_enter(&sc->sc_ccb_mtx);
SLIST_INSERT_HEAD(&sc->sc_ccb_free, ccb, ccb_link)do { (ccb)->ccb_link.sle_next = (&sc->sc_ccb_free)->
slh_first; (&sc->sc_ccb_free)->slh_first = (ccb); }
 while (0);
mtx_leave(&sc->sc_ccb_mtx);
1145}

1147int
1148mpi_alloc_replies(struct mpi_softc *sc)
1149{
DNPRINTF(MPI_D_MISC, "%s: mpi_alloc_replies\n", DEVNAME(sc));

sc->sc_rcbs = mallocarray(sc->sc_repq, sizeof(struct mpi_rcb), M_DEVBUF2,
   M_WAITOK0x0001|M_CANFAIL0x0004);
if (sc->sc_rcbs == NULL((void *)0))
return (1);

sc->sc_replies = mpi_dmamem_alloc(sc, sc->sc_repq * MPI_REPLY_SIZE80);
if (sc->sc_replies == NULL((void *)0)) {
free(sc->sc_rcbs, M_DEVBUF2, 0);
return (1);
}

return (0);
1164}

1166void
1167mpi_push_reply(struct mpi_softc *sc, struct mpi_rcb *rcb)
1168{
bus_dmamap_sync(sc->sc_dmat, MPI_DMA_MAP(sc->sc_replies),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (rcb->rcb_offset), (80), (0x01)
)
   rcb->rcb_offset, MPI_REPLY_SIZE, BUS_DMASYNC_PREREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (rcb->rcb_offset), (80), (0x01)
);
mpi_push_reply_db(sc, rcb->rcb_reply_dva)(((sc)->sc_iot)->write_4(((sc)->sc_ioh), (0x44), ((rcb
->rcb_reply_dva))));
1172}

1174void
1175mpi_push_replies(struct mpi_softc *sc)
1176{
struct mpi_rcb			*rcb;
char				*kva = MPI_DMA_KVA(sc->sc_replies)((void *)(sc->sc_replies)->mdm_kva);
int				i;

bus_dmamap_sync(sc->sc_dmat, MPI_DMA_MAP(sc->sc_replies), 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (0), (sc->sc_repq * 80), (0x01)
)
   sc->sc_repq * MPI_REPLY_SIZE, BUS_DMASYNC_PREREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_replies)->mdm_map)), (0), (sc->sc_repq * 80), (0x01)
);

for (i = 0; i < sc->sc_repq; i++) {
rcb = &sc->sc_rcbs[i];

rcb->rcb_reply = kva + MPI_REPLY_SIZE80 * i;
rcb->rcb_offset = MPI_REPLY_SIZE80 * i;
rcb->rcb_reply_dva = (u_int32_t)MPI_DMA_DVA(sc->sc_replies)((u_int64_t)(sc->sc_replies)->mdm_map->dm_segs[0].ds_addr
) +
    MPI_REPLY_SIZE80 * i;
mpi_push_reply_db(sc, rcb->rcb_reply_dva)(((sc)->sc_iot)->write_4(((sc)->sc_ioh), (0x44), ((rcb
->rcb_reply_dva))));
}
1193}

1195void
1196mpi_start(struct mpi_softc *sc, struct mpi_ccb *ccb)
1197{
struct mpi_msg_request *msg;

DNPRINTF(MPI_D_RW, "%s: mpi_start %#x\n", DEVNAME(sc),
   ccb->ccb_cmd_dva);

msg = ccb->ccb_cmd;
htolem32(&msg->msg_context, ccb->ccb_id)(*(__uint32_t *)(&msg->msg_context) = ((__uint32_t)(ccb
->ccb_id)));

bus_dmamap_sync(sc->sc_dmat, MPI_DMA_MAP(sc->sc_requests),(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_requests)->mdm_map)), (ccb->ccb_offset), (512), (0x01
 | 0x04))
   ccb->ccb_offset, MPI_REQUEST_SIZE,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_requests)->mdm_map)), (ccb->ccb_offset), (512), (0x01
 | 0x04))
   BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (((sc->
sc_requests)->mdm_map)), (ccb->ccb_offset), (512), (0x01
 | 0x04));

ccb->ccb_state = MPI_CCB_QUEUED;
bus_space_write_4(sc->sc_iot, sc->sc_ioh,((sc->sc_iot)->write_4((sc->sc_ioh), (0x40), (ccb->
ccb_cmd_dva)))
   MPI_REQ_QUEUE, ccb->ccb_cmd_dva)((sc->sc_iot)->write_4((sc->sc_ioh), (0x40), (ccb->
ccb_cmd_dva)));
1213}

1215int
1216mpi_poll(struct mpi_softc *sc, struct mpi_ccb *ccb, int timeout)
1217{
void				(*done)(struct mpi_ccb *);
void				*cookie;
int				rv = 1;
u_int32_t			reg;

DNPRINTF(MPI_D_INTR, "%s: mpi_poll timeout %d\n", DEVNAME(sc),
   timeout);

done = ccb->ccb_done;
cookie = ccb->ccb_cookie;

ccb->ccb_done = mpi_poll_done;
ccb->ccb_cookie = &rv;

mpi_start(sc, ccb);
while (rv == 1) {
reg = mpi_pop_reply(sc)(((sc)->sc_iot)->read_4(((sc)->sc_ioh), (0x44)));
if (reg == 0xffffffff) {
	if (timeout-- == 0) {
		printf("%s: timeout\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
		goto timeout;
	}

	delay(1000)(*delay_func)(1000);
	continue;
}

mpi_reply(sc, reg);
}

ccb->ccb_cookie = cookie;
done(ccb);

1251timeout:
return (rv);
1253}

1255void
1256mpi_poll_done(struct mpi_ccb *ccb)
1257{
int				*rv = ccb->ccb_cookie;

*rv = 0;
1261}

1263void
1264mpi_wait(struct mpi_softc *sc, struct mpi_ccb *ccb)
1265{
struct mutex			cookie = MUTEX_INITIALIZER(IPL_BIO){ ((void *)0), ((((0x6)) > 0x0 && ((0x6)) < 0x9
) ? 0x9 : ((0x6))), 0x0 };
void				(*done)(struct mpi_ccb *);

done = ccb->ccb_done;
ccb->ccb_done = mpi_wait_done;
ccb->ccb_cookie = &cookie;

/* XXX this will wait forever for the ccb to complete */

mpi_start(sc, ccb);

mtx_enter(&cookie);
while (ccb->ccb_cookie != NULL((void *)0))
msleep_nsec(ccb, &cookie, PRIBIO16, "mpiwait", INFSLP0xffffffffffffffffULL);
mtx_leave(&cookie);

done(ccb);
1283}

1285void
1286mpi_wait_done(struct mpi_ccb *ccb)
1287{
struct mutex			*cookie = ccb->ccb_cookie;

mtx_enter(cookie);
ccb->ccb_cookie = NULL((void *)0);
wakeup_one(ccb)wakeup_n((ccb), 1);
mtx_leave(cookie);
1294}

1296void
1297mpi_scsi_cmd(struct scsi_xfer *xs)
1298{
struct scsi_link		*link = xs->sc_link;
struct mpi_softc		*sc = link->bus->sb_adapter_softc;
struct mpi_ccb			*ccb;
struct mpi_ccb_bundle		*mcb;
struct mpi_msg_scsi_io		*io;

DNPRINTF(MPI_D_CMD, "%s: mpi_scsi_cmd\n", DEVNAME(sc));

KERNEL_UNLOCK()_kernel_unlock();

if (xs->cmdlen > MPI_CDB_LEN16) {
1
Assuming field 'cmdlen' is <= MPI_CDB_LEN→
2
←
Taking false branch→
DNPRINTF(MPI_D_CMD, "%s: CBD too big %d\n",
    DEVNAME(sc), xs->cmdlen);
memset(&xs->sense, 0, sizeof(xs->sense))__builtin_memset((&xs->sense), (0), (sizeof(xs->sense
)));
xs->sense.error_code = SSD_ERRCODE_VALID0x80 | SSD_ERRCODE_CURRENT0x70;
xs->sense.flags = SKEY_ILLEGAL_REQUEST0x05;
xs->sense.add_sense_code = 0x20;
xs->error = XS_SENSE1;
goto done;
}

ccb = xs->io;

DNPRINTF(MPI_D_CMD, "%s: ccb_id: %d xs->flags: 0x%x\n",
   DEVNAME(sc), ccb->ccb_id, xs->flags);

ccb->ccb_cookie = xs;
ccb->ccb_done = mpi_scsi_cmd_done;

mcb = ccb->ccb_cmd;
io = &mcb->mcb_io;

io->function = MPI_FUNCTION_SCSI_IO_REQUEST(0x00);
/*
* bus is always 0
* io->bus = htole16(sc->sc_bus);
*/
io->target_id = link->target;

io->cdb_length = xs->cmdlen;
io->sense_buf_len = sizeof(xs->sense);
io->msg_flags = MPI_SCSIIO_SENSE_BUF_ADDR_WIDTH_64(1<<0);

htobem16(&io->lun[0], link->lun)(*(__uint16_t *)(&io->lun[0]) = (__uint16_t)(__builtin_constant_p
(link->lun) ? (__uint16_t)(((__uint16_t)(link->lun) &
 0xffU) << 8 | ((__uint16_t)(link->lun) & 0xff00U
) >> 8) : __swap16md(link->lun)));
3
←
'?' condition is false→

switch (xs->flags & (SCSI_DATA_IN0x00800 | SCSI_DATA_OUT0x01000)) {
4
←
Control jumps to the 'default' case at line 1351→
case SCSI_DATA_IN0x00800:
io->direction = MPI_SCSIIO_DIR_READ(0x2);
break;
case SCSI_DATA_OUT0x01000:
io->direction = MPI_SCSIIO_DIR_WRITE(0x1);
break;
default:
io->direction = MPI_SCSIIO_DIR_NONE(0x0);
break;
5
←
 Execution continues on line 1356→
}

if (sc->sc_porttype != MPI_PORTFACTS_PORTTYPE_SCSI0x01 &&
6
←
Assuming field 'sc_porttype' is equal to MPI_PORTFACTS_PORTTYPE_SCSI→
   (link->quirks & SDEV_NOTAGS0x0008))
io->tagging = MPI_SCSIIO_ATTR_UNTAGGED(0x5);
else 
io->tagging = MPI_SCSIIO_ATTR_SIMPLE_Q(0x0);

memcpy(io->cdb, &xs->cmd, xs->cmdlen)__builtin_memcpy((io->cdb), (&xs->cmd), (xs->cmdlen
));

htolem32(&io->data_length, xs->datalen)(*(__uint32_t *)(&io->data_length) = ((__uint32_t)(xs->
datalen)));

htolem32(&io->sense_buf_low_addr, ccb->ccb_cmd_dva +(*(__uint32_t *)(&io->sense_buf_low_addr) = ((__uint32_t
)(ccb->ccb_cmd_dva + __builtin_offsetof(struct mpi_ccb_bundle
, mcb_sense))))
   offsetof(struct mpi_ccb_bundle, mcb_sense))(*(__uint32_t *)(&io->sense_buf_low_addr) = ((__uint32_t
)(ccb->ccb_cmd_dva + __builtin_offsetof(struct mpi_ccb_bundle
, mcb_sense))));

if (mpi_load_xs(ccb) != 0)
7
←
Calling 'mpi_load_xs'→
goto stuffup;

timeout_set(&xs->stimeout, mpi_timeout_xs, ccb);

if (xs->flags & SCSI_POLL0x00002) {
if (mpi_poll(sc, ccb, xs->timeout) != 0)
	goto stuffup;
} else
mpi_start(sc, ccb);

KERNEL_LOCK()_kernel_lock();
return;

1383stuffup:
xs->error = XS_DRIVER_STUFFUP2;
1385done:
KERNEL_LOCK()_kernel_lock();
scsi_done(xs);
1388}

1390void
1391mpi_scsi_cmd_done(struct mpi_ccb *ccb)
1392{
struct mpi_softc		*sc = ccb->ccb_sc;
struct scsi_xfer		*xs = ccb->ccb_cookie;
struct mpi_ccb_bundle		*mcb = ccb->ccb_cmd;
bus_dmamap_t			dmap = ccb->ccb_dmamap;
struct mpi_msg_scsi_io_error	*sie;

if (xs->datalen != 0) {
bus_dmamap_sync(sc->sc_dmat, dmap, 0, dmap->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x02 : 0x08))
    (xs->flags & SCSI_DATA_IN) ? BUS_DMASYNC_POSTREAD :(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x02 : 0x08))
    BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x02 : 0x08));

bus_dmamap_unload(sc->sc_dmat, dmap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (dmap
));
}

/* timeout_del */
xs->error = XS_NOERROR0;
xs->resid = 0;

if (ccb->ccb_rcb == NULL((void *)0)) {
/* no scsi error, we're ok so drop out early */
xs->status = SCSI_OK0x00;
KERNEL_LOCK()_kernel_lock();
scsi_done(xs);
KERNEL_UNLOCK()_kernel_unlock();
return;
}

sie = ccb->ccb_rcb->rcb_reply;

DNPRINTF(MPI_D_CMD, "%s: mpi_scsi_cmd_done xs cmd: 0x%02x len: %d "
   "flags 0x%x\n", DEVNAME(sc), xs->cmd.opcode, xs->datalen,
   xs->flags);
DNPRINTF(MPI_D_CMD, "%s:  target_id: %d bus: %d msg_length: %d "
   "function: 0x%02x\n", DEVNAME(sc), sie->target_id, sie->bus,
   sie->msg_length, sie->function);
DNPRINTF(MPI_D_CMD, "%s:  cdb_length: %d sense_buf_length: %d "
   "msg_flags: 0x%02x\n", DEVNAME(sc), sie->cdb_length,
   sie->sense_buf_len, sie->msg_flags);
DNPRINTF(MPI_D_CMD, "%s:  msg_context: 0x%08x\n", DEVNAME(sc),
   letoh32(sie->msg_context));
DNPRINTF(MPI_D_CMD, "%s:  scsi_status: 0x%02x scsi_state: 0x%02x "
   "ioc_status: 0x%04x\n", DEVNAME(sc), sie->scsi_status,
   sie->scsi_state, letoh16(sie->ioc_status));
DNPRINTF(MPI_D_CMD, "%s:  ioc_loginfo: 0x%08x\n", DEVNAME(sc),
   letoh32(sie->ioc_loginfo));
DNPRINTF(MPI_D_CMD, "%s:  transfer_count: %d\n", DEVNAME(sc),
   letoh32(sie->transfer_count));
DNPRINTF(MPI_D_CMD, "%s:  sense_count: %d\n", DEVNAME(sc),
   letoh32(sie->sense_count));
DNPRINTF(MPI_D_CMD, "%s:  response_info: 0x%08x\n", DEVNAME(sc),
   letoh32(sie->response_info));
DNPRINTF(MPI_D_CMD, "%s:  tag: 0x%04x\n", DEVNAME(sc),
   letoh16(sie->tag));

if (sie->scsi_state & MPI_SCSIIO_ERR_STATE_NO_SCSI_STATUS(1<<3))
xs->status = SCSI_TERMINATED0x22;
else
xs->status = sie->scsi_status;
xs->resid = 0;

switch (lemtoh16(&sie->ioc_status)((__uint16_t)(*(__uint16_t *)(&sie->ioc_status)))) {
case MPI_IOCSTATUS_SCSI_DATA_UNDERRUN(0x0045):
xs->resid = xs->datalen - lemtoh32(&sie->transfer_count)((__uint32_t)(*(__uint32_t *)(&sie->transfer_count)));
/* FALLTHROUGH */
case MPI_IOCSTATUS_SUCCESS(0x0000):
case MPI_IOCSTATUS_SCSI_RECOVERED_ERROR(0x0040):
switch (xs->status) {
case SCSI_OK0x00:
	xs->error = XS_NOERROR0;
	break;

case SCSI_CHECK0x02:
	xs->error = XS_SENSE1;
	break;

case SCSI_BUSY0x08:
case SCSI_QUEUE_FULL0x28:
	xs->error = XS_BUSY5;
	break;

default:
	xs->error = XS_DRIVER_STUFFUP2;
	break;
}
break;

case MPI_IOCSTATUS_BUSY(0x0002):
case MPI_IOCSTATUS_INSUFFICIENT_RESOURCES(0x0006):
xs->error = XS_BUSY5;
break;

case MPI_IOCSTATUS_SCSI_INVALID_BUS(0x0041):
case MPI_IOCSTATUS_SCSI_INVALID_TARGETID(0x0042):
case MPI_IOCSTATUS_SCSI_DEVICE_NOT_THERE(0x0043):
xs->error = XS_SELTIMEOUT3;
break;

case MPI_IOCSTATUS_SCSI_IOC_TERMINATED(0x004B):
case MPI_IOCSTATUS_SCSI_EXT_TERMINATED(0x004C):
xs->error = XS_RESET8;
break;

default:
xs->error = XS_DRIVER_STUFFUP2;
break;
}

if (sie->scsi_state & MPI_SCSIIO_ERR_STATE_AUTOSENSE_VALID(1<<0))
memcpy(&xs->sense, &mcb->mcb_sense, sizeof(xs->sense))__builtin_memcpy((&xs->sense), (&mcb->mcb_sense
), (sizeof(xs->sense)));

DNPRINTF(MPI_D_CMD, "%s:  xs err: 0x%02x status: %d\n", DEVNAME(sc),
   xs->error, xs->status);

mpi_push_reply(sc, ccb->ccb_rcb);
KERNEL_LOCK()_kernel_lock();
scsi_done(xs);
KERNEL_UNLOCK()_kernel_unlock();
1510}

1512void
1513mpi_timeout_xs(void *arg)
1514{
/* XXX */
1516}

1518int
1519mpi_load_xs(struct mpi_ccb *ccb)
1520{
struct mpi_softc		*sc = ccb->ccb_sc;
struct scsi_xfer		*xs = ccb->ccb_cookie;
struct mpi_ccb_bundle		*mcb = ccb->ccb_cmd;
struct mpi_msg_scsi_io		*io = &mcb->mcb_io;
struct mpi_sge			*sge = NULL((void *)0);
8
←
'sge' initialized to a null pointer value→
struct mpi_sge			*nsge = &mcb->mcb_sgl[0];
struct mpi_sge			*ce = NULL((void *)0), *nce;
bus_dmamap_t			dmap = ccb->ccb_dmamap;
u_int32_t			addr, flags;
int				i, error;

if (xs->datalen == 0) {
9
←
Assuming field 'datalen' is not equal to 0→
10
←
Taking false branch→
htolem32(&nsge->sg_hdr, MPI_SGE_FL_TYPE_SIMPLE |(*(__uint32_t *)(&nsge->sg_hdr) = ((__uint32_t)((0x1<<
28) | (0x1<<31) | (0x1<<30) | (0x1<<24))))
    MPI_SGE_FL_LAST | MPI_SGE_FL_EOB | MPI_SGE_FL_EOL)(*(__uint32_t *)(&nsge->sg_hdr) = ((__uint32_t)((0x1<<
28) | (0x1<<31) | (0x1<<30) | (0x1<<24))));
return (0);
}

error = bus_dmamap_load(sc->sc_dmat, dmap,(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (dmap)
, (xs->data), (xs->datalen), (((void *)0)), (0x0100 | (
(xs->flags & 0x00001) ? 0x0001 : 0x0000)))
11
←
Assuming the condition is false→
12
←
'?' condition is false→
   xs->data, xs->datalen, NULL, BUS_DMA_STREAMING |(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (dmap)
, (xs->data), (xs->datalen), (((void *)0)), (0x0100 | (
(xs->flags & 0x00001) ? 0x0001 : 0x0000)))
   ((xs->flags & SCSI_NOSLEEP) ? BUS_DMA_NOWAIT : BUS_DMA_WAITOK))(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (dmap)
, (xs->data), (xs->datalen), (((void *)0)), (0x0100 | (
(xs->flags & 0x00001) ? 0x0001 : 0x0000)));
if (error) {
13
←
Assuming 'error' is 0→
14
←
Taking false branch→
printf("%s: error %d loading dmamap\n", DEVNAME(sc)((sc)->sc_dev.dv_xname), error);
return (1);
}

flags = MPI_SGE_FL_TYPE_SIMPLE(0x1<<28) | MPI_SGE_FL_SIZE_64(0x1<<25);
if (xs->flags & SCSI_DATA_OUT0x01000)
15
←
Assuming the condition is false→
16
←
Taking false branch→
flags |= MPI_SGE_FL_DIR_OUT(0x1<<26);

if (dmap->dm_nsegs > sc->sc_first_sgl_len) {
17
←
Assuming field 'dm_nsegs' is > field 'sc_first_sgl_len'→
18
←
Taking true branch→
ce = &mcb->mcb_sgl[sc->sc_first_sgl_len - 1];
io->chain_offset = (u_int32_t *)ce - (u_int32_t *)io;
}

for (i = 0; i < dmap->dm_nsegs; i++) {
19
←
Assuming 'i' is < field 'dm_nsegs'→
20
←
Loop condition is true.  Entering loop body→

if (nsge == ce) {
21
←
Assuming 'nsge' is equal to 'ce'→
22
←
Taking true branch→
	nsge++;
	sge->sg_hdr |= htole32(MPI_SGE_FL_LAST)((__uint32_t)((0x1<<31)));
23
←
Access to field 'sg_hdr' results in a dereference of a null pointer (loaded from variable 'sge')

	if ((dmap->dm_nsegs - i) > sc->sc_chain_len) {
		nce = &nsge[sc->sc_chain_len - 1];
		addr = (u_int32_t *)nce - (u_int32_t *)nsge;
		addr = addr << 16 |
		    sizeof(struct mpi_sge) * sc->sc_chain_len;
	} else {
		nce = NULL((void *)0);
		addr = sizeof(struct mpi_sge) *
		    (dmap->dm_nsegs - i);
	}

	ce->sg_hdr = htole32(MPI_SGE_FL_TYPE_CHAIN |((__uint32_t)((0x3<<28) | (0x1<<25) | addr))
	    MPI_SGE_FL_SIZE_64 | addr)((__uint32_t)((0x3<<28) | (0x1<<25) | addr));

	mpi_dvatosge(ce, ccb->ccb_cmd_dva +
	    ((u_int8_t *)nsge - (u_int8_t *)mcb));

	ce = nce;
}

DNPRINTF(MPI_D_DMA, "%s:  %d: %d 0x%016llx\n", DEVNAME(sc),
    i, dmap->dm_segs[i].ds_len,
    (u_int64_t)dmap->dm_segs[i].ds_addr);

sge = nsge++;

sge->sg_hdr = htole32(flags | dmap->dm_segs[i].ds_len)((__uint32_t)(flags | dmap->dm_segs[i].ds_len));
mpi_dvatosge(sge, dmap->dm_segs[i].ds_addr);
}

/* terminate list */
sge->sg_hdr |= htole32(MPI_SGE_FL_LAST | MPI_SGE_FL_EOB |((__uint32_t)((0x1<<31) | (0x1<<30) | (0x1<<
24)))
   MPI_SGE_FL_EOL)((__uint32_t)((0x1<<31) | (0x1<<30) | (0x1<<
24)));

bus_dmamap_sync(sc->sc_dmat, dmap, 0, dmap->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x01 : 0x04))
   (xs->flags & SCSI_DATA_IN) ? BUS_DMASYNC_PREREAD :(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x01 : 0x04))
   BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (dmap)
, (0), (dmap->dm_mapsize), ((xs->flags & 0x00800) ?
 0x01 : 0x04));

return (0);
1600}

1602int
1603mpi_scsi_probe_virtual(struct scsi_link *link)
1604{
struct mpi_softc		*sc = link->bus->sb_adapter_softc;
struct mpi_cfg_hdr		hdr;
struct mpi_cfg_raid_vol_pg0	*rp0;
int				len;
int				rv;

if (!ISSET(sc->sc_flags, MPI_F_RAID)((sc->sc_flags) & ((1<<1))))
return (0);

if (link->lun > 0)
return (0);

rv = mpi_req_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_RAID_VOL(0x08),
   0, link->target, MPI_PG_POLL(1<<1), &hdr);
if (rv != 0)
return (0);

len = hdr.page_length * 4;
rp0 = malloc(len, M_TEMP127, M_NOWAIT0x0002);
if (rp0 == NULL((void *)0))
return (ENOMEM12);

rv = mpi_req_cfg_page(sc, link->target, MPI_PG_POLL(1<<1), &hdr, 1, rp0, len);
if (rv == 0)
SET(link->flags, SDEV_VIRTUAL)((link->flags) |= (0x0800));

free(rp0, M_TEMP127, len);
return (0);
1633}

1635int
1636mpi_scsi_probe(struct scsi_link *link)
1637{
struct mpi_softc		*sc = link->bus->sb_adapter_softc;
struct mpi_ecfg_hdr		ehdr;
struct mpi_cfg_sas_dev_pg0	pg0;
u_int32_t			address;
int				rv;

rv = mpi_scsi_probe_virtual(link);
if (rv != 0)
return (rv);

if (ISSET(link->flags, SDEV_VIRTUAL)((link->flags) & (0x0800)))
return (0);

if (sc->sc_porttype != MPI_PORTFACTS_PORTTYPE_SAS0x30)
return (0);

address = MPI_CFG_SAS_DEV_ADDR_BUS(1<<28) | link->target;

if (mpi_ecfg_header(sc, MPI_CONFIG_REQ_EXTPAGE_TYPE_SAS_DEVICE, 0,mpi_req_cfg_header((sc), ((0x12)), (0), (address), (1<<
1)|(1<<0), (&ehdr))
   address, &ehdr)mpi_req_cfg_header((sc), ((0x12)), (0), (address), (1<<
1)|(1<<0), (&ehdr)) != 0)
return (EIO5);

if (mpi_ecfg_page(sc, address, &ehdr, 1, &pg0, sizeof(pg0))mpi_req_cfg_page((sc), (address), (1<<1)|(1<<0), (
&ehdr), (1), (&pg0), (sizeof(pg0))) != 0)
return (0);

DNPRINTF(MPI_D_MISC, "%s: mpi_scsi_probe sas dev pg 0 for target %d:\n",
   DEVNAME(sc), link->target);
DNPRINTF(MPI_D_MISC, "%s:  slot: 0x%04x enc_handle: 0x%04x\n",
   DEVNAME(sc), letoh16(pg0.slot), letoh16(pg0.enc_handle));
DNPRINTF(MPI_D_MISC, "%s:  sas_addr: 0x%016llx\n", DEVNAME(sc),
   letoh64(pg0.sas_addr));
DNPRINTF(MPI_D_MISC, "%s:  parent_dev_handle: 0x%04x phy_num: 0x%02x "
   "access_status: 0x%02x\n", DEVNAME(sc),
   letoh16(pg0.parent_dev_handle), pg0.phy_num, pg0.access_status);
DNPRINTF(MPI_D_MISC, "%s:  dev_handle: 0x%04x "
   "bus: 0x%02x target: 0x%02x\n", DEVNAME(sc),
   letoh16(pg0.dev_handle), pg0.bus, pg0.target);
DNPRINTF(MPI_D_MISC, "%s:  device_info: 0x%08x\n", DEVNAME(sc),
   letoh32(pg0.device_info));
DNPRINTF(MPI_D_MISC, "%s:  flags: 0x%04x physical_port: 0x%02x\n",
   DEVNAME(sc), letoh16(pg0.flags), pg0.physical_port);

if (ISSET(lemtoh32(&pg0.device_info),((((__uint32_t)(*(__uint32_t *)(&pg0.device_info)))) &
 ((1<<13)))
   MPI_CFG_SAS_DEV_0_DEVINFO_ATAPI_DEVICE)((((__uint32_t)(*(__uint32_t *)(&pg0.device_info)))) &
 ((1<<13)))) {
DNPRINTF(MPI_D_MISC, "%s: target %d is an ATAPI device\n",
    DEVNAME(sc), link->target);
link->flags |= SDEV_ATAPI0x0200;
}

return (0);
1688}

1690u_int32_t
1691mpi_read(struct mpi_softc *sc, bus_size_t r)
1692{
u_int32_t			rv;

bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
   BUS_SPACE_BARRIER_READ0x01);
rv = bus_space_read_4(sc->sc_iot, sc->sc_ioh, r)((sc->sc_iot)->read_4((sc->sc_ioh), (r)));

DNPRINTF(MPI_D_RW, "%s: mpi_read %#x %#x\n", DEVNAME(sc), r, rv);

return (rv);
1702}

1704void
1705mpi_write(struct mpi_softc *sc, bus_size_t r, u_int32_t v)
1706{
DNPRINTF(MPI_D_RW, "%s: mpi_write %#x %#x\n", DEVNAME(sc), r, v);

bus_space_write_4(sc->sc_iot, sc->sc_ioh, r, v)((sc->sc_iot)->write_4((sc->sc_ioh), (r), (v)));
bus_space_barrier(sc->sc_iot, sc->sc_ioh, r, 4,
   BUS_SPACE_BARRIER_WRITE0x02);
1712}

1714int
1715mpi_wait_eq(struct mpi_softc *sc, bus_size_t r, u_int32_t mask,
  u_int32_t target)
1717{
int				i;

DNPRINTF(MPI_D_RW, "%s: mpi_wait_eq %#x %#x %#x\n", DEVNAME(sc), r,
   mask, target);

for (i = 0; i < 10000; i++) {
if ((mpi_read(sc, r) & mask) == target)
	return (0);
delay(1000)(*delay_func)(1000);
}

return (1);
1730}

1732int
1733mpi_wait_ne(struct mpi_softc *sc, bus_size_t r, u_int32_t mask,
  u_int32_t target)
1735{
int				i;

DNPRINTF(MPI_D_RW, "%s: mpi_wait_ne %#x %#x %#x\n", DEVNAME(sc), r,
   mask, target);

for (i = 0; i < 10000; i++) {
if ((mpi_read(sc, r) & mask) != target)
	return (0);
delay(1000)(*delay_func)(1000);
}

return (1);
1748}

1750int
1751mpi_init(struct mpi_softc *sc)
1752{
u_int32_t			db;
int				i;

/* spin until the IOC leaves the RESET state */
if (mpi_wait_ne(sc, MPI_DOORBELL0x00, MPI_DOORBELL_STATE(0xf<<28),
   MPI_DOORBELL_STATE_RESET(0x0<<28)) != 0) {
DNPRINTF(MPI_D_MISC, "%s: mpi_init timeout waiting to leave "
    "reset state\n", DEVNAME(sc));
return (1);
}

/* check current ownership */
db = mpi_read_db(sc)mpi_read((sc), 0x00);
if ((db & MPI_DOORBELL_WHOINIT(0x7<<24)) == MPI_DOORBELL_WHOINIT_PCIPEER(0x3<<24)) {
DNPRINTF(MPI_D_MISC, "%s: mpi_init initialised by pci peer\n",
    DEVNAME(sc));
return (0);
}

for (i = 0; i < 5; i++) {
switch (db & MPI_DOORBELL_STATE(0xf<<28)) {
case MPI_DOORBELL_STATE_READY(0x1<<28):
	DNPRINTF(MPI_D_MISC, "%s: mpi_init ioc is ready\n",
	    DEVNAME(sc));
	return (0);

case MPI_DOORBELL_STATE_OPER(0x2<<28):
case MPI_DOORBELL_STATE_FAULT(0x4<<28):
	DNPRINTF(MPI_D_MISC, "%s: mpi_init ioc is being "
	    "reset\n" , DEVNAME(sc));
	if (mpi_reset_soft(sc) != 0)
		mpi_reset_hard(sc);
	break;

case MPI_DOORBELL_STATE_RESET(0x0<<28):
	DNPRINTF(MPI_D_MISC, "%s: mpi_init waiting to come "
	    "out of reset\n", DEVNAME(sc));
	if (mpi_wait_ne(sc, MPI_DOORBELL0x00, MPI_DOORBELL_STATE(0xf<<28),
	    MPI_DOORBELL_STATE_RESET(0x0<<28)) != 0)
		return (1);
	break;
}
db = mpi_read_db(sc)mpi_read((sc), 0x00);
}

return (1);
1799}

1801int
1802mpi_reset_soft(struct mpi_softc *sc)
1803{
DNPRINTF(MPI_D_MISC, "%s: mpi_reset_soft\n", DEVNAME(sc));

if (mpi_read_db(sc)mpi_read((sc), 0x00) & MPI_DOORBELL_INUSE(0x1<<27))
return (1);

mpi_write_db(sc,mpi_write((sc), 0x00, (((((0x40)) << 24) & (0xff <<
 24))))
   MPI_DOORBELL_FUNCTION(MPI_FUNCTION_IOC_MESSAGE_UNIT_RESET))mpi_write((sc), 0x00, (((((0x40)) << 24) & (0xff <<
 24))));
if (mpi_wait_eq(sc, MPI_INTR_STATUS0x30,
   MPI_INTR_STATUS_IOCDOORBELL(1<<31), 0) != 0)
return (1);

if (mpi_wait_eq(sc, MPI_DOORBELL0x00, MPI_DOORBELL_STATE(0xf<<28),
   MPI_DOORBELL_STATE_READY(0x1<<28)) != 0)
return (1);

return (0);
1820}

1822int
1823mpi_reset_hard(struct mpi_softc *sc)
1824{
DNPRINTF(MPI_D_MISC, "%s: mpi_reset_hard\n", DEVNAME(sc));

/* enable diagnostic register */
mpi_write(sc, MPI_WRITESEQ0x04, 0xff);
mpi_write(sc, MPI_WRITESEQ0x04, MPI_WRITESEQ_10x04);
mpi_write(sc, MPI_WRITESEQ0x04, MPI_WRITESEQ_20x0b);
mpi_write(sc, MPI_WRITESEQ0x04, MPI_WRITESEQ_30x02);
mpi_write(sc, MPI_WRITESEQ0x04, MPI_WRITESEQ_40x07);
mpi_write(sc, MPI_WRITESEQ0x04, MPI_WRITESEQ_50x0d);

/* reset ioc */
mpi_write(sc, MPI_HOSTDIAG0x08, MPI_HOSTDIAG_RESET_ADAPTER(1<<2));

delay(10000)(*delay_func)(10000);

/* disable diagnostic register */
mpi_write(sc, MPI_WRITESEQ0x04, 0xff);

/* restore pci bits? */

/* firmware bits? */
return (0);
1847}

1849int
1850mpi_handshake_send(struct mpi_softc *sc, void *buf, size_t dwords)
1851{
u_int32_t				*query = buf;
int					i;

/* make sure the doorbell is not in use. */
if (mpi_read_db(sc)mpi_read((sc), 0x00) & MPI_DOORBELL_INUSE(0x1<<27))
return (1);

/* clear pending doorbell interrupts */
if (mpi_read_intr(sc)(((sc)->sc_iot)->read_4(((sc)->sc_ioh), (0x30))) & MPI_INTR_STATUS_DOORBELL(1<<0))
mpi_write_intr(sc, 0)mpi_write((sc), 0x30, (0));

/*
* first write the doorbell with the handshake function and the
* dword count.
*/
mpi_write_db(sc, MPI_DOORBELL_FUNCTION(MPI_FUNCTION_HANDSHAKE) |mpi_write((sc), 0x00, (((((0x42)) << 24) & (0xff <<
 24)) | (((dwords) << 16) & (0xff << 16))))
   MPI_DOORBELL_DWORDS(dwords))mpi_write((sc), 0x00, (((((0x42)) << 24) & (0xff <<
 24)) | (((dwords) << 16) & (0xff << 16))));

/*
* the doorbell used bit will be set because a doorbell function has
* started. Wait for the interrupt and then ack it.
*/
if (mpi_wait_db_int(sc)mpi_wait_ne((sc), 0x30, (1<<0), 0) != 0)
return (1);
mpi_write_intr(sc, 0)mpi_write((sc), 0x30, (0));

/* poll for the acknowledgement. */
if (mpi_wait_db_ack(sc)mpi_wait_eq((sc), 0x30, (1<<31), 0) != 0)
return (1);

/* write the query through the doorbell. */
for (i = 0; i < dwords; i++) {
mpi_write_db(sc, htole32(query[i]))mpi_write((sc), 0x00, (((__uint32_t)(query[i]))));
if (mpi_wait_db_ack(sc)mpi_wait_eq((sc), 0x30, (1<<31), 0) != 0)
	return (1);
}

return (0);
1890}

1892int
1893mpi_handshake_recv_dword(struct mpi_softc *sc, u_int32_t *dword)
1894{
u_int16_t				*words = (u_int16_t *)dword;
int					i;

for (i = 0; i < 2; i++) {
if (mpi_wait_db_int(sc)mpi_wait_ne((sc), 0x30, (1<<0), 0) != 0)
	return (1);
words[i] = letoh16(mpi_read_db(sc) & MPI_DOORBELL_DATA_MASK)((__uint16_t)(mpi_read((sc), 0x00) & 0xffff));
mpi_write_intr(sc, 0)mpi_write((sc), 0x30, (0));
}

return (0);
1906}

1908int
1909mpi_handshake_recv(struct mpi_softc *sc, void *buf, size_t dwords)
1910{
struct mpi_msg_reply			*reply = buf;
u_int32_t				*dbuf = buf, dummy;
int					i;

/* get the first dword so we can read the length out of the header. */
if (mpi_handshake_recv_dword(sc, &dbuf[0]) != 0)
return (1);

DNPRINTF(MPI_D_CMD, "%s: mpi_handshake_recv dwords: %d reply: %d\n",
   DEVNAME(sc), dwords, reply->msg_length);

/*
* the total length, in dwords, is in the message length field of the
* reply header.
*/
for (i = 1; i < MIN(dwords, reply->msg_length)(((dwords)<(reply->msg_length))?(dwords):(reply->msg_length
)); i++) {
if (mpi_handshake_recv_dword(sc, &dbuf[i]) != 0)
	return (1);
}

/* if there's extra stuff to come off the ioc, discard it */
while (i++ < reply->msg_length) {
if (mpi_handshake_recv_dword(sc, &dummy) != 0)
	return (1);
DNPRINTF(MPI_D_CMD, "%s: mpi_handshake_recv dummy read: "
    "0x%08x\n", DEVNAME(sc), dummy);
}

/* wait for the doorbell used bit to be reset and clear the intr */
if (mpi_wait_db_int(sc)mpi_wait_ne((sc), 0x30, (1<<0), 0) != 0)
return (1);
mpi_write_intr(sc, 0)mpi_write((sc), 0x30, (0));

return (0);
1945}

1947void
1948mpi_empty_done(struct mpi_ccb *ccb)
1949{
/* nothing to do */
1951}

1953int
1954mpi_iocfacts(struct mpi_softc *sc)
1955{
struct mpi_msg_iocfacts_request		ifq;
struct mpi_msg_iocfacts_reply		ifp;

DNPRINTF(MPI_D_MISC, "%s: mpi_iocfacts\n", DEVNAME(sc));

memset(&ifq, 0, sizeof(ifq))__builtin_memset((&ifq), (0), (sizeof(ifq)));
memset(&ifp, 0, sizeof(ifp))__builtin_memset((&ifp), (0), (sizeof(ifp)));

ifq.function = MPI_FUNCTION_IOC_FACTS(0x03);
ifq.chain_offset = 0;
ifq.msg_flags = 0;
ifq.msg_context = htole32(0xdeadbeef)((__uint32_t)(0xdeadbeef));

if (mpi_handshake_send(sc, &ifq, dwordsof(ifq)(sizeof(ifq) / sizeof(u_int32_t))) != 0) {
DNPRINTF(MPI_D_MISC, "%s: mpi_iocfacts send failed\n",
    DEVNAME(sc));
return (1);
}

if (mpi_handshake_recv(sc, &ifp, dwordsof(ifp)(sizeof(ifp) / sizeof(u_int32_t))) != 0) {
DNPRINTF(MPI_D_MISC, "%s: mpi_iocfacts recv failed\n",
    DEVNAME(sc));
return (1);
}

DNPRINTF(MPI_D_MISC, "%s:  func: 0x%02x len: %d msgver: %d.%d\n",
   DEVNAME(sc), ifp.function, ifp.msg_length,
   ifp.msg_version_maj, ifp.msg_version_min);
DNPRINTF(MPI_D_MISC, "%s:  msgflags: 0x%02x iocnumber: 0x%02x "
   "hdrver: %d.%d\n", DEVNAME(sc), ifp.msg_flags,
   ifp.ioc_number, ifp.header_version_maj,
   ifp.header_version_min);
DNPRINTF(MPI_D_MISC, "%s:  message context: 0x%08x\n", DEVNAME(sc),
   letoh32(ifp.msg_context));
DNPRINTF(MPI_D_MISC, "%s:  iocstatus: 0x%04x ioexcept: 0x%04x\n",
   DEVNAME(sc), letoh16(ifp.ioc_status),
   letoh16(ifp.ioc_exceptions));
DNPRINTF(MPI_D_MISC, "%s:  iocloginfo: 0x%08x\n", DEVNAME(sc),
   letoh32(ifp.ioc_loginfo));
DNPRINTF(MPI_D_MISC, "%s:  flags: 0x%02x blocksize: %d whoinit: 0x%02x "
   "maxchdepth: %d\n", DEVNAME(sc), ifp.flags,
   ifp.block_size, ifp.whoinit, ifp.max_chain_depth);
DNPRINTF(MPI_D_MISC, "%s:  reqfrsize: %d replyqdepth: %d\n",
   DEVNAME(sc), letoh16(ifp.request_frame_size),
   letoh16(ifp.reply_queue_depth));
DNPRINTF(MPI_D_MISC, "%s:  productid: 0x%04x\n", DEVNAME(sc),
   letoh16(ifp.product_id));
DNPRINTF(MPI_D_MISC, "%s:  hostmfahiaddr: 0x%08x\n", DEVNAME(sc),
   letoh32(ifp.current_host_mfa_hi_addr));
DNPRINTF(MPI_D_MISC, "%s:  event_state: 0x%02x number_of_ports: %d "
   "global_credits: %d\n",
   DEVNAME(sc), ifp.event_state, ifp.number_of_ports,
   letoh16(ifp.global_credits));
DNPRINTF(MPI_D_MISC, "%s:  sensebufhiaddr: 0x%08x\n", DEVNAME(sc),
   letoh32(ifp.current_sense_buffer_hi_addr));
DNPRINTF(MPI_D_MISC, "%s:  maxbus: %d maxdev: %d replyfrsize: %d\n",
   DEVNAME(sc), ifp.max_buses, ifp.max_devices,
   letoh16(ifp.current_reply_frame_size));
DNPRINTF(MPI_D_MISC, "%s:  fw_image_size: %d\n", DEVNAME(sc),
   letoh32(ifp.fw_image_size));
DNPRINTF(MPI_D_MISC, "%s:  ioc_capabilities: 0x%08x\n", DEVNAME(sc),
   letoh32(ifp.ioc_capabilities));
DNPRINTF(MPI_D_MISC, "%s:  fw_version: %d.%d fw_version_unit: 0x%02x "
   "fw_version_dev: 0x%02x\n", DEVNAME(sc),
   ifp.fw_version_maj, ifp.fw_version_min,
   ifp.fw_version_unit, ifp.fw_version_dev);
DNPRINTF(MPI_D_MISC, "%s:  hi_priority_queue_depth: 0x%04x\n",
   DEVNAME(sc), letoh16(ifp.hi_priority_queue_depth));
DNPRINTF(MPI_D_MISC, "%s:  host_page_buffer_sge: hdr: 0x%08x "
   "addr 0x%08lx%08lx\n", DEVNAME(sc),
   letoh32(ifp.host_page_buffer_sge.sg_hdr),
   letoh32(ifp.host_page_buffer_sge.sg_addr_hi),
   letoh32(ifp.host_page_buffer_sge.sg_addr_lo));

sc->sc_fw_maj = ifp.fw_version_maj;
sc->sc_fw_min = ifp.fw_version_min;
sc->sc_fw_unit = ifp.fw_version_unit;
sc->sc_fw_dev = ifp.fw_version_dev;

sc->sc_maxcmds = lemtoh16(&ifp.global_credits)((__uint16_t)(*(__uint16_t *)(&ifp.global_credits)));
sc->sc_maxchdepth = ifp.max_chain_depth;
sc->sc_ioc_number = ifp.ioc_number;
if (sc->sc_flags & MPI_F_SPI(1<<0))
sc->sc_buswidth = 16;
else
sc->sc_buswidth =
    (ifp.max_devices == 0) ? 256 : ifp.max_devices;
if (ifp.flags & MPI_IOCFACTS_FLAGS_FW_DOWNLOAD_BOOT(1<<0))
sc->sc_fw_len = lemtoh32(&ifp.fw_image_size)((__uint32_t)(*(__uint32_t *)(&ifp.fw_image_size)));

sc->sc_repq = MIN(MPI_REPLYQ_DEPTH, lemtoh16(&ifp.reply_queue_depth))(((128)<(((__uint16_t)(*(__uint16_t *)(&ifp.reply_queue_depth
)))))?(128):(((__uint16_t)(*(__uint16_t *)(&ifp.reply_queue_depth
)))));

/*
* you can fit sg elements on the end of the io cmd if they fit in the
* request frame size.
*/
sc->sc_first_sgl_len = ((lemtoh16(&ifp.request_frame_size)((__uint16_t)(*(__uint16_t *)(&ifp.request_frame_size))) * 4) -
   sizeof(struct mpi_msg_scsi_io)) / sizeof(struct mpi_sge);
DNPRINTF(MPI_D_MISC, "%s:   first sgl len: %d\n", DEVNAME(sc),
   sc->sc_first_sgl_len);

sc->sc_chain_len = (lemtoh16(&ifp.request_frame_size)((__uint16_t)(*(__uint16_t *)(&ifp.request_frame_size))) * 4) /
   sizeof(struct mpi_sge);
DNPRINTF(MPI_D_MISC, "%s:   chain len: %d\n", DEVNAME(sc),
   sc->sc_chain_len);

/* the sgl tailing the io cmd loses an entry to the chain element. */
sc->sc_max_sgl_len = MPI_MAX_SGL36 - 1;
/* the sgl chains lose an entry for each chain element */
sc->sc_max_sgl_len -= (MPI_MAX_SGL36 - sc->sc_first_sgl_len) /
   sc->sc_chain_len;
DNPRINTF(MPI_D_MISC, "%s:   max sgl len: %d\n", DEVNAME(sc),
   sc->sc_max_sgl_len);

/* XXX we're ignoring the max chain depth */

return (0);
2073}

2075int
2076mpi_iocinit(struct mpi_softc *sc)
2077{
struct mpi_msg_iocinit_request		iiq;
struct mpi_msg_iocinit_reply		iip;
u_int32_t				hi_addr;

DNPRINTF(MPI_D_MISC, "%s: mpi_iocinit\n", DEVNAME(sc));

memset(&iiq, 0, sizeof(iiq))__builtin_memset((&iiq), (0), (sizeof(iiq)));
memset(&iip, 0, sizeof(iip))__builtin_memset((&iip), (0), (sizeof(iip)));

iiq.function = MPI_FUNCTION_IOC_INIT(0x02);
iiq.whoinit = MPI_WHOINIT_HOST_DRIVER0x04;

iiq.max_devices = (sc->sc_buswidth == 256) ? 0 : sc->sc_buswidth;
iiq.max_buses = 1;

iiq.msg_context = htole32(0xd00fd00f)((__uint32_t)(0xd00fd00f));

iiq.reply_frame_size = htole16(MPI_REPLY_SIZE)((__uint16_t)(80));

hi_addr = (u_int32_t)(MPI_DMA_DVA(sc->sc_requests)((u_int64_t)(sc->sc_requests)->mdm_map->dm_segs[0].ds_addr
) >> 32);
htolem32(&iiq.host_mfa_hi_addr, hi_addr)(*(__uint32_t *)(&iiq.host_mfa_hi_addr) = ((__uint32_t)(hi_addr
)));
htolem32(&iiq.sense_buffer_hi_addr, hi_addr)(*(__uint32_t *)(&iiq.sense_buffer_hi_addr) = ((__uint32_t
)(hi_addr)));

iiq.msg_version_maj = 0x01;
iiq.msg_version_min = 0x02;

iiq.hdr_version_unit = 0x0d;
iiq.hdr_version_dev = 0x00;

if (mpi_handshake_send(sc, &iiq, dwordsof(iiq)(sizeof(iiq) / sizeof(u_int32_t))) != 0) {
DNPRINTF(MPI_D_MISC, "%s: mpi_iocinit send failed\n",
    DEVNAME(sc));
return (1);
}

if (mpi_handshake_recv(sc, &iip, dwordsof(iip)(sizeof(iip) / sizeof(u_int32_t))) != 0) {
DNPRINTF(MPI_D_MISC, "%s: mpi_iocinit recv failed\n",
    DEVNAME(sc));
return (1);
}

DNPRINTF(MPI_D_MISC, "%s:  function: 0x%02x msg_length: %d "
   "whoinit: 0x%02x\n", DEVNAME(sc), iip.function,
   iip.msg_length, iip.whoinit);
DNPRINTF(MPI_D_MISC, "%s:  msg_flags: 0x%02x max_buses: %d "
   "max_devices: %d flags: 0x%02x\n", DEVNAME(sc), iip.msg_flags,
   iip.max_buses, iip.max_devices, iip.flags);
DNPRINTF(MPI_D_MISC, "%s:  msg_context: 0x%08x\n", DEVNAME(sc),
   letoh32(iip.msg_context));
DNPRINTF(MPI_D_MISC, "%s:  ioc_status: 0x%04x\n", DEVNAME(sc),
   letoh16(iip.ioc_status));
DNPRINTF(MPI_D_MISC, "%s:  ioc_loginfo: 0x%08x\n", DEVNAME(sc),
   letoh32(iip.ioc_loginfo));

return (0);
2133}

2135int
2136mpi_portfacts(struct mpi_softc *sc)
2137{
struct mpi_ccb				*ccb;
struct mpi_msg_portfacts_request	*pfq;
volatile struct mpi_msg_portfacts_reply	*pfp;
int					rv = 1;

DNPRINTF(MPI_D_MISC, "%s: mpi_portfacts\n", DEVNAME(sc));

ccb = scsi_io_get(&sc->sc_iopool, SCSI_NOSLEEP0x00001);
if (ccb == NULL((void *)0)) {
DNPRINTF(MPI_D_MISC, "%s: mpi_portfacts ccb_get\n",
    DEVNAME(sc));
return (rv);
}

ccb->ccb_done = mpi_empty_done;
pfq = ccb->ccb_cmd;

pfq->function = MPI_FUNCTION_PORT_FACTS(0x05);
pfq->chain_offset = 0;
pfq->msg_flags = 0;
pfq->port_number = 0;

if (mpi_poll(sc, ccb, 50000) != 0) {
DNPRINTF(MPI_D_MISC, "%s: mpi_portfacts poll\n", DEVNAME(sc));
goto err;
}

if (ccb->ccb_rcb == NULL((void *)0)) {
DNPRINTF(MPI_D_MISC, "%s: empty portfacts reply\n",
    DEVNAME(sc));
goto err;
}
pfp = ccb->ccb_rcb->rcb_reply;

DNPRINTF(MPI_D_MISC, "%s:  function: 0x%02x msg_length: %d\n",
   DEVNAME(sc), pfp->function, pfp->msg_length);
DNPRINTF(MPI_D_MISC, "%s:  msg_flags: 0x%02x port_number: %d\n",
   DEVNAME(sc), pfp->msg_flags, pfp->port_number);
DNPRINTF(MPI_D_MISC, "%s:  msg_context: 0x%08x\n", DEVNAME(sc),
   letoh32(pfp->msg_context));
DNPRINTF(MPI_D_MISC, "%s:  ioc_status: 0x%04x\n", DEVNAME(sc),
   letoh16(pfp->ioc_status));
DNPRINTF(MPI_D_MISC, "%s:  ioc_loginfo: 0x%08x\n", DEVNAME(sc),
   letoh32(pfp->ioc_loginfo));
DNPRINTF(MPI_D_MISC, "%s:  max_devices: %d port_type: 0x%02x\n",
   DEVNAME(sc), letoh16(pfp->max_devices), pfp->port_type);
DNPRINTF(MPI_D_MISC, "%s:  protocol_flags: 0x%04x port_scsi_id: %d\n",
   DEVNAME(sc), letoh16(pfp->protocol_flags),
   letoh16(pfp->port_scsi_id));
DNPRINTF(MPI_D_MISC, "%s:  max_persistent_ids: %d "
   "max_posted_cmd_buffers: %d\n", DEVNAME(sc),
   letoh16(pfp->max_persistent_ids),
   letoh16(pfp->max_posted_cmd_buffers));
DNPRINTF(MPI_D_MISC, "%s:  max_lan_buckets: %d\n", DEVNAME(sc),
   letoh16(pfp->max_lan_buckets));

sc->sc_porttype = pfp->port_type;
if (sc->sc_target == -1)
sc->sc_target = lemtoh16(&pfp->port_scsi_id)((__uint16_t)(*(__uint16_t *)(&pfp->port_scsi_id)));

mpi_push_reply(sc, ccb->ccb_rcb);
rv = 0;
2200err:
scsi_io_put(&sc->sc_iopool, ccb);

return (rv);
2204}

2206int
2207mpi_cfg_coalescing(struct mpi_softc *sc)
2208{
struct mpi_cfg_hdr		hdr;
struct mpi_cfg_ioc_pg1		pg;
u_int32_t			flags;

if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_IOC, 1, 0, &hdr)mpi_req_cfg_header((sc), ((0x01)), (1), (0), (1<<1), (&
hdr)) != 0) {
DNPRINTF(MPI_D_MISC, "%s: unable to fetch IOC page 1 header\n",
    DEVNAME(sc));
return (1);
}

if (mpi_cfg_page(sc, 0, &hdr, 1, &pg, sizeof(pg))mpi_req_cfg_page((sc), (0), (1<<1), (&hdr), (1), (&
pg), (sizeof(pg))) != 0) {
DNPRINTF(MPI_D_MISC, "%s: unable to fetch IOC page 1\n",
    DEVNAME(sc));
return (1);
}

DNPRINTF(MPI_D_MISC, "%s: IOC page 1\n", DEVNAME(sc));
DNPRINTF(MPI_D_MISC, "%s:  flags: 0x%08x\n", DEVNAME(sc),
   letoh32(pg.flags));
DNPRINTF(MPI_D_MISC, "%s:  coalescing_timeout: %d\n", DEVNAME(sc),
   letoh32(pg.coalescing_timeout));
DNPRINTF(MPI_D_MISC, "%s:  coalescing_depth: %d pci_slot_num: %d\n",
   DEVNAME(sc), pg.coalescing_depth, pg.pci_slot_num);

flags = lemtoh32(&pg.flags)((__uint32_t)(*(__uint32_t *)(&pg.flags)));
if (!ISSET(flags, MPI_CFG_IOC_1_REPLY_COALESCING)((flags) & ((1<<0))))
return (0);

CLR(pg.flags, htole32(MPI_CFG_IOC_1_REPLY_COALESCING))((pg.flags) &= ~(((__uint32_t)((1<<0)))));
if (mpi_cfg_page(sc, 0, &hdr, 0, &pg, sizeof(pg))mpi_req_cfg_page((sc), (0), (1<<1), (&hdr), (0), (&
pg), (sizeof(pg))) != 0) {
DNPRINTF(MPI_D_MISC, "%s: unable to clear coalescing\n",
    DEVNAME(sc));
return (1);
}

return (0);
2245}

2247int
2248mpi_eventnotify(struct mpi_softc *sc)
2249{
struct mpi_ccb				*ccb;
struct mpi_msg_event_request		*enq;

ccb = scsi_io_get(&sc->sc_iopool, SCSI_NOSLEEP0x00001);
if (ccb == NULL((void *)0)) {
DNPRINTF(MPI_D_MISC, "%s: mpi_eventnotify ccb_get\n",
    DEVNAME(sc));
return (1);
}

sc->sc_evt_ccb = ccb;
SIMPLEQ_INIT(&sc->sc_evt_ack_queue)do { (&sc->sc_evt_ack_queue)->sqh_first = ((void *)
0); (&sc->sc_evt_ack_queue)->sqh_last = &(&
sc->sc_evt_ack_queue)->sqh_first; } while (0);
mtx_init(&sc->sc_evt_ack_mtx, IPL_BIO)do { (void)(((void *)0)); (void)(0); __mtx_init((&sc->
sc_evt_ack_mtx), ((((0x6)) > 0x0 && ((0x6)) < 0x9
) ? 0x9 : ((0x6)))); } while (0);
scsi_ioh_set(&sc->sc_evt_ack_handler, &sc->sc_iopool,
   mpi_eventack, sc);

ccb->ccb_done = mpi_eventnotify_done;
enq = ccb->ccb_cmd;

enq->function = MPI_FUNCTION_EVENT_NOTIFICATION(0x07);
enq->chain_offset = 0;
enq->event_switch = MPI_EVENT_SWITCH_ON(0x01);

mpi_start(sc, ccb);
return (0);
2275}

2277void
2278mpi_eventnotify_done(struct mpi_ccb *ccb)
2279{
struct mpi_softc			*sc = ccb->ccb_sc;
struct mpi_rcb				*rcb = ccb->ccb_rcb;
struct mpi_msg_event_reply		*enp = rcb->rcb_reply;

DNPRINTF(MPI_D_EVT, "%s: mpi_eventnotify_done\n", DEVNAME(sc));

DNPRINTF(MPI_D_EVT, "%s:  function: 0x%02x msg_length: %d "
   "data_length: %d\n", DEVNAME(sc), enp->function, enp->msg_length,
   letoh16(enp->data_length));
DNPRINTF(MPI_D_EVT, "%s:  ack_required: %d msg_flags 0x%02x\n",
   DEVNAME(sc), enp->ack_required, enp->msg_flags);
DNPRINTF(MPI_D_EVT, "%s:  msg_context: 0x%08x\n", DEVNAME(sc),
   letoh32(enp->msg_context));
DNPRINTF(MPI_D_EVT, "%s:  ioc_status: 0x%04x\n", DEVNAME(sc),
   letoh16(enp->ioc_status));
DNPRINTF(MPI_D_EVT, "%s:  ioc_loginfo: 0x%08x\n", DEVNAME(sc),
   letoh32(enp->ioc_loginfo));
DNPRINTF(MPI_D_EVT, "%s:  event: 0x%08x\n", DEVNAME(sc),
   letoh32(enp->event));
DNPRINTF(MPI_D_EVT, "%s:  event_context: 0x%08x\n", DEVNAME(sc),
   letoh32(enp->event_context));

switch (lemtoh32(&enp->event)((__uint32_t)(*(__uint32_t *)(&enp->event)))) {
/* ignore these */
case MPI_EVENT_EVENT_CHANGE0x0a:
case MPI_EVENT_SAS_PHY_LINK_STATUS0x12:
break;

case MPI_EVENT_SAS_DEVICE_STATUS_CHANGE0x0f:
if (sc->sc_scsibus == NULL((void *)0))
	break;

if (mpi_evt_sas(sc, rcb) != 0) {
	/* reply is freed later on */
	return;
}
break;

case MPI_EVENT_RESCAN0x06:
if (sc->sc_scsibus != NULL((void *)0) &&
    sc->sc_porttype == MPI_PORTFACTS_PORTTYPE_FC0x10)
	task_add(systq, &sc->sc_evt_rescan);
break;

default:
DNPRINTF(MPI_D_EVT, "%s:  unhandled event 0x%02x\n",
    DEVNAME(sc), lemtoh32(&enp->event));
break;
}

mpi_eventnotify_free(sc, rcb);
2331}

2333void
2334mpi_eventnotify_free(struct mpi_softc *sc, struct mpi_rcb *rcb)
2335{
struct mpi_msg_event_reply		*enp = rcb->rcb_reply;

if (enp->ack_required) {
mtx_enter(&sc->sc_evt_ack_mtx);
SIMPLEQ_INSERT_TAIL(&sc->sc_evt_ack_queue, rcb, rcb_link)do { (rcb)->rcb_link.sqe_next = ((void *)0); *(&sc->
sc_evt_ack_queue)->sqh_last = (rcb); (&sc->sc_evt_ack_queue
)->sqh_last = &(rcb)->rcb_link.sqe_next; } while (0
);
mtx_leave(&sc->sc_evt_ack_mtx);
scsi_ioh_add(&sc->sc_evt_ack_handler);
} else
mpi_push_reply(sc, rcb);
2345}

2347int
2348mpi_evt_sas(struct mpi_softc *sc, struct mpi_rcb *rcb)
2349{
struct mpi_evt_sas_change		*ch;
u_int8_t				*data;

data = rcb->rcb_reply;
data += sizeof(struct mpi_msg_event_reply);
ch = (struct mpi_evt_sas_change *)data;

if (ch->bus != 0)
return (0);

switch (ch->reason) {
case MPI_EVT_SASCH_REASON_ADDED0x03:
case MPI_EVT_SASCH_REASON_NO_PERSIST_ADDED0x06:
KERNEL_LOCK()_kernel_lock();
if (scsi_req_probe(sc->sc_scsibus, ch->target, -1) != 0) {
	printf("%s: unable to request attach of %d\n",
	    DEVNAME(sc)((sc)->sc_dev.dv_xname), ch->target);
}
KERNEL_UNLOCK()_kernel_unlock();
break;

case MPI_EVT_SASCH_REASON_NOT_RESPONDING0x04:
KERNEL_LOCK()_kernel_lock();
scsi_activate(sc->sc_scsibus, ch->target, -1, DVACT_DEACTIVATE1);
KERNEL_UNLOCK()_kernel_unlock();

mtx_enter(&sc->sc_evt_scan_mtx);
SIMPLEQ_INSERT_TAIL(&sc->sc_evt_scan_queue, rcb, rcb_link)do { (rcb)->rcb_link.sqe_next = ((void *)0); *(&sc->
sc_evt_scan_queue)->sqh_last = (rcb); (&sc->sc_evt_scan_queue
)->sqh_last = &(rcb)->rcb_link.sqe_next; } while (0
);
mtx_leave(&sc->sc_evt_scan_mtx);
scsi_ioh_add(&sc->sc_evt_scan_handler);

/* we'll handle event ack later on */
return (1);

case MPI_EVT_SASCH_REASON_SMART_DATA0x05:
case MPI_EVT_SASCH_REASON_UNSUPPORTED0x07:
case MPI_EVT_SASCH_REASON_INTERNAL_RESET0x08:
break;
default:
printf("%s: unknown reason for SAS device status change: "
    "0x%02x\n", DEVNAME(sc)((sc)->sc_dev.dv_xname), ch->reason);
break;
}

return (0);
2395}

2397void
2398mpi_evt_sas_detach(void *cookie, void *io)
2399{
struct mpi_softc			*sc = cookie;
struct mpi_ccb				*ccb = io;
struct mpi_rcb				*rcb, *next;
struct mpi_msg_event_reply		*enp;
struct mpi_evt_sas_change		*ch;
struct mpi_msg_scsi_task_request	*str;

DNPRINTF(MPI_D_EVT, "%s: event sas detach handler\n", DEVNAME(sc));

mtx_enter(&sc->sc_evt_scan_mtx);
rcb = SIMPLEQ_FIRST(&sc->sc_evt_scan_queue)((&sc->sc_evt_scan_queue)->sqh_first);
if (rcb != NULL((void *)0)) {
next = SIMPLEQ_NEXT(rcb, rcb_link)((rcb)->rcb_link.sqe_next);
SIMPLEQ_REMOVE_HEAD(&sc->sc_evt_scan_queue, rcb_link)do { if (((&sc->sc_evt_scan_queue)->sqh_first = (&
sc->sc_evt_scan_queue)->sqh_first->rcb_link.sqe_next
) == ((void *)0)) (&sc->sc_evt_scan_queue)->sqh_last
 = &(&sc->sc_evt_scan_queue)->sqh_first; } while
 (0);
}
mtx_leave(&sc->sc_evt_scan_mtx);

if (rcb == NULL((void *)0)) {
scsi_io_put(&sc->sc_iopool, ccb);
return;
}

enp = rcb->rcb_reply;
ch = (struct mpi_evt_sas_change *)(enp + 1);

ccb->ccb_done = mpi_evt_sas_detach_done;
str = ccb->ccb_cmd;

str->target_id = ch->target;
str->bus = 0;
str->function = MPI_FUNCTION_SCSI_TASK_MGMT(0x01);

str->task_type = MPI_MSG_SCSI_TASK_TYPE_TARGET_RESET(0x03);

mpi_eventnotify_free(sc, rcb);

mpi_start(sc, ccb);

if (next != NULL((void *)0))
scsi_ioh_add(&sc->sc_evt_scan_handler);
2440}

2442void
2443mpi_evt_sas_detach_done(struct mpi_ccb *ccb)
2444{
struct mpi_softc			*sc = ccb->ccb_sc;
struct mpi_msg_scsi_task_reply		*r = ccb->ccb_rcb->rcb_reply;

KERNEL_LOCK()_kernel_lock();
if (scsi_req_detach(sc->sc_scsibus, r->target_id, -1,
   DETACH_FORCE0x01) != 0) {
printf("%s: unable to request detach of %d\n",
    DEVNAME(sc)((sc)->sc_dev.dv_xname), r->target_id);
}
KERNEL_UNLOCK()_kernel_unlock();

mpi_push_reply(sc, ccb->ccb_rcb);
scsi_io_put(&sc->sc_iopool, ccb);
2458}

2460void
2461mpi_fc_rescan(void *xsc)
2462{
struct mpi_softc			*sc = xsc;
struct mpi_cfg_hdr			hdr;
struct mpi_cfg_fc_device_pg0		pg;
struct scsi_link			*link;
u_int8_t				devmap[256 / NBBY8];
u_int32_t				id = 0xffffff;
int					i;

memset(devmap, 0, sizeof(devmap))__builtin_memset((devmap), (0), (sizeof(devmap)));

do {
if (mpi_req_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_FC_DEV(0x06), 0,
    id, 0, &hdr) != 0) {
	printf("%s: header get for rescan of 0x%08x failed\n",
	    DEVNAME(sc)((sc)->sc_dev.dv_xname), id);
	return;
}

memset(&pg, 0, sizeof(pg))__builtin_memset((&pg), (0), (sizeof(pg)));
if (mpi_req_cfg_page(sc, id, 0, &hdr, 1, &pg, sizeof(pg)) != 0)
	break;

if (ISSET(pg.flags, MPI_CFG_FC_DEV_0_FLAGS_BUSADDR_VALID)((pg.flags) & ((1<<0))) &&
    pg.current_bus == 0)
	setbit(devmap, pg.current_target_id)((devmap)[(pg.current_target_id)>>3] |= 1<<((pg.current_target_id
)&(8 -1)));

id = lemtoh32(&pg.port_id)((__uint32_t)(*(__uint32_t *)(&pg.port_id)));
} while (id <= 0xff0000);

for (i = 0; i < sc->sc_buswidth; i++) {
link = scsi_get_link(sc->sc_scsibus, i, 0);

if (isset(devmap, i)((devmap)[(i)>>3] & (1<<((i)&(8 -1))))) {
	if (link == NULL((void *)0))
		scsi_probe_target(sc->sc_scsibus, i);
} else {
	if (link != NULL((void *)0)) {
		scsi_activate(sc->sc_scsibus, i, -1,
		    DVACT_DEACTIVATE1);
		scsi_detach_target(sc->sc_scsibus, i,
		    DETACH_FORCE0x01);
	}
}
}
2507}

2509void
2510mpi_eventack(void *cookie, void *io)
2511{
struct mpi_softc			*sc = cookie;
struct mpi_ccb				*ccb = io;
struct mpi_rcb				*rcb, *next;
struct mpi_msg_event_reply		*enp;
struct mpi_msg_eventack_request		*eaq;

DNPRINTF(MPI_D_EVT, "%s: event ack\n", DEVNAME(sc));

mtx_enter(&sc->sc_evt_ack_mtx);
rcb = SIMPLEQ_FIRST(&sc->sc_evt_ack_queue)((&sc->sc_evt_ack_queue)->sqh_first);
if (rcb != NULL((void *)0)) {
next = SIMPLEQ_NEXT(rcb, rcb_link)((rcb)->rcb_link.sqe_next);
SIMPLEQ_REMOVE_HEAD(&sc->sc_evt_ack_queue, rcb_link)do { if (((&sc->sc_evt_ack_queue)->sqh_first = (&
sc->sc_evt_ack_queue)->sqh_first->rcb_link.sqe_next)
 == ((void *)0)) (&sc->sc_evt_ack_queue)->sqh_last =
 &(&sc->sc_evt_ack_queue)->sqh_first; } while (
0);
}
mtx_leave(&sc->sc_evt_ack_mtx);

if (rcb == NULL((void *)0)) {
scsi_io_put(&sc->sc_iopool, ccb);
return;
}

enp = rcb->rcb_reply;

ccb->ccb_done = mpi_eventack_done;
eaq = ccb->ccb_cmd;

eaq->function = MPI_FUNCTION_EVENT_ACK(0x08);

eaq->event = enp->event;
eaq->event_context = enp->event_context;

mpi_push_reply(sc, rcb);
mpi_start(sc, ccb);

if (next != NULL((void *)0))
scsi_ioh_add(&sc->sc_evt_ack_handler);
2548}

2550void
2551mpi_eventack_done(struct mpi_ccb *ccb)
2552{
struct mpi_softc			*sc = ccb->ccb_sc;

DNPRINTF(MPI_D_EVT, "%s: event ack done\n", DEVNAME(sc));

mpi_push_reply(sc, ccb->ccb_rcb);
scsi_io_put(&sc->sc_iopool, ccb);
2559}

2561int
2562mpi_portenable(struct mpi_softc *sc)
2563{
struct mpi_ccb				*ccb;
struct mpi_msg_portenable_request	*peq;
int					rv = 0;

DNPRINTF(MPI_D_MISC, "%s: mpi_portenable\n", DEVNAME(sc));

ccb = scsi_io_get(&sc->sc_iopool, SCSI_NOSLEEP0x00001);
if (ccb == NULL((void *)0)) {
DNPRINTF(MPI_D_MISC, "%s: mpi_portenable ccb_get\n",
    DEVNAME(sc));
return (1);
}

ccb->ccb_done = mpi_empty_done;
peq = ccb->ccb_cmd;

peq->function = MPI_FUNCTION_PORT_ENABLE(0x06);
peq->port_number = 0;

if (mpi_poll(sc, ccb, 50000) != 0) {
DNPRINTF(MPI_D_MISC, "%s: mpi_portenable poll\n", DEVNAME(sc));
return (1);
}

if (ccb->ccb_rcb == NULL((void *)0)) {
DNPRINTF(MPI_D_MISC, "%s: empty portenable reply\n",
    DEVNAME(sc));
rv = 1;
} else
mpi_push_reply(sc, ccb->ccb_rcb);

scsi_io_put(&sc->sc_iopool, ccb);

return (rv);
2598}

2600int
2601mpi_fwupload(struct mpi_softc *sc)
2602{
struct mpi_ccb				*ccb;
struct {
struct mpi_msg_fwupload_request		req;
struct mpi_sge				sge;
} __packed__attribute__((__packed__))				*bundle;
struct mpi_msg_fwupload_reply		*upp;
int					rv = 0;

if (sc->sc_fw_len == 0)
return (0);

DNPRINTF(MPI_D_MISC, "%s: mpi_fwupload\n", DEVNAME(sc));

sc->sc_fw = mpi_dmamem_alloc(sc, sc->sc_fw_len);
if (sc->sc_fw == NULL((void *)0)) {
DNPRINTF(MPI_D_MISC, "%s: mpi_fwupload unable to allocate %d\n",
    DEVNAME(sc), sc->sc_fw_len);
return (1);
}

ccb = scsi_io_get(&sc->sc_iopool, SCSI_NOSLEEP0x00001);
if (ccb == NULL((void *)0)) {
DNPRINTF(MPI_D_MISC, "%s: mpi_fwupload ccb_get\n",
    DEVNAME(sc));
goto err;
}

ccb->ccb_done = mpi_empty_done;
bundle = ccb->ccb_cmd;

bundle->req.function = MPI_FUNCTION_FW_UPLOAD(0x12);

bundle->req.image_type = MPI_FWUPLOAD_IMAGETYPE_IOC_FW(0x00);

bundle->req.tce.details_length = 12;
htolem32(&bundle->req.tce.image_size, sc->sc_fw_len)(*(__uint32_t *)(&bundle->req.tce.image_size) = ((__uint32_t
)(sc->sc_fw_len)));

htolem32(&bundle->sge.sg_hdr, MPI_SGE_FL_TYPE_SIMPLE |(*(__uint32_t *)(&bundle->sge.sg_hdr) = ((__uint32_t)(
(0x1<<28) | (0x1<<25) | (0x1<<31) | (0x1<<
30) | (0x1<<24) | (u_int32_t)sc->sc_fw_len)))
   MPI_SGE_FL_SIZE_64 | MPI_SGE_FL_LAST | MPI_SGE_FL_EOB |(*(__uint32_t *)(&bundle->sge.sg_hdr) = ((__uint32_t)(
(0x1<<28) | (0x1<<25) | (0x1<<31) | (0x1<<
30) | (0x1<<24) | (u_int32_t)sc->sc_fw_len)))
   MPI_SGE_FL_EOL | (u_int32_t)sc->sc_fw_len)(*(__uint32_t *)(&bundle->sge.sg_hdr) = ((__uint32_t)(
(0x1<<28) | (0x1<<25) | (0x1<<31) | (0x1<<
30) | (0x1<<24) | (u_int32_t)sc->sc_fw_len)));
mpi_dvatosge(&bundle->sge, MPI_DMA_DVA(sc->sc_fw)((u_int64_t)(sc->sc_fw)->mdm_map->dm_segs[0].ds_addr
));

if (mpi_poll(sc, ccb, 50000) != 0) {
DNPRINTF(MPI_D_MISC, "%s: mpi_cfg_header poll\n", DEVNAME(sc));
goto err;
}

if (ccb->ccb_rcb == NULL((void *)0))
panic("%s: unable to do fw upload", DEVNAME(sc)((sc)->sc_dev.dv_xname));
upp = ccb->ccb_rcb->rcb_reply;

if (lemtoh16(&upp->ioc_status)((__uint16_t)(*(__uint16_t *)(&upp->ioc_status))) != MPI_IOCSTATUS_SUCCESS(0x0000))
rv = 1;

mpi_push_reply(sc, ccb->ccb_rcb);
scsi_io_put(&sc->sc_iopool, ccb);

return (rv);

2662err:
mpi_dmamem_free(sc, sc->sc_fw);
return (1);
2665}

2667int
2668mpi_manufacturing(struct mpi_softc *sc)
2669{
char board_name[33];
struct mpi_cfg_hdr hdr;
struct mpi_cfg_manufacturing_pg0 *pg;
size_t pagelen;
int rv = 1;

if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_MANUFACTURING,mpi_req_cfg_header((sc), ((0x09)), (0), (0), (1<<1), (&
hdr))
   0, 0, &hdr)mpi_req_cfg_header((sc), ((0x09)), (0), (0), (1<<1), (&
hdr)) != 0)
return (1);

pagelen = hdr.page_length * 4; /* dwords to bytes */
if (pagelen < sizeof(*pg))
return (1);

pg = malloc(pagelen, M_TEMP127, M_WAITOK0x0001|M_CANFAIL0x0004);
if (pg == NULL((void *)0))
return (1);

if (mpi_cfg_page(sc, 0, &hdr, 1, pg, pagelen)mpi_req_cfg_page((sc), (0), (1<<1), (&hdr), (1), (pg
), (pagelen)) != 0)
goto out;

scsi_strvis(board_name, pg->board_name, sizeof(pg->board_name));

printf("%s: %s, firmware %d.%d.%d.%d\n", DEVNAME(sc)((sc)->sc_dev.dv_xname), board_name,
   sc->sc_fw_maj, sc->sc_fw_min, sc->sc_fw_unit, sc->sc_fw_dev);

rv = 0;

2698out:
free(pg, M_TEMP127, pagelen);
return (rv);
2701}

2703void
2704mpi_get_raid(struct mpi_softc *sc)
2705{
struct mpi_cfg_hdr		hdr;
struct mpi_cfg_ioc_pg2		*vol_page;
size_t				pagelen;
u_int32_t			capabilities;

DNPRINTF(MPI_D_RAID, "%s: mpi_get_raid\n", DEVNAME(sc));

if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_IOC, 2, 0, &hdr)mpi_req_cfg_header((sc), ((0x01)), (2), (0), (1<<1), (&
hdr)) != 0) {
DNPRINTF(MPI_D_RAID, "%s: mpi_get_raid unable to fetch header"
    "for IOC page 2\n", DEVNAME(sc));
return;
}

pagelen = hdr.page_length * 4; /* dwords to bytes */
vol_page = malloc(pagelen, M_TEMP127, M_WAITOK0x0001|M_CANFAIL0x0004);
if (vol_page == NULL((void *)0)) {
DNPRINTF(MPI_D_RAID, "%s: mpi_get_raid unable to allocate "
    "space for ioc config page 2\n", DEVNAME(sc));
return;
}

if (mpi_cfg_page(sc, 0, &hdr, 1, vol_page, pagelen)mpi_req_cfg_page((sc), (0), (1<<1), (&hdr), (1), (vol_page
), (pagelen)) != 0) {
DNPRINTF(MPI_D_RAID, "%s: mpi_get_raid unable to fetch IOC "
    "page 2\n", DEVNAME(sc));
goto out;
}

capabilities = lemtoh32(&vol_page->capabilities)((__uint32_t)(*(__uint32_t *)(&vol_page->capabilities)
));

DNPRINTF(MPI_D_RAID, "%s:  capabilities: 0x08%x\n", DEVNAME(sc),
   letoh32(vol_page->capabilities));
DNPRINTF(MPI_D_RAID, "%s:  active_vols: %d max_vols: %d "
   "active_physdisks: %d max_physdisks: %d\n", DEVNAME(sc),
   vol_page->active_vols, vol_page->max_vols,
   vol_page->active_physdisks, vol_page->max_physdisks);

/* don't walk list if there are no RAID capability */
if (capabilities == 0xdeadbeef) {
printf("%s: deadbeef in raid configuration\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto out;
}

if (ISSET(capabilities, MPI_CFG_IOC_2_CAPABILITIES_RAID)((capabilities) & (( (1<<0) | (1<<1) | (1<<
2)))))
sc->sc_flags |= MPI_F_RAID(1<<1);

2751out:
free(vol_page, M_TEMP127, pagelen);
2753}

2755int
2756mpi_req_cfg_header(struct mpi_softc *sc, u_int8_t type, u_int8_t number,
  u_int32_t address, int flags, void *p)
2758{
struct mpi_ccb				*ccb;
struct mpi_msg_config_request		*cq;
struct mpi_msg_config_reply		*cp;
struct mpi_cfg_hdr			*hdr = p;
struct mpi_ecfg_hdr			*ehdr = p;
int					etype = 0;
int					rv = 0;

DNPRINTF(MPI_D_MISC, "%s: mpi_req_cfg_header type: %#x number: %x "
   "address: 0x%08x flags: 0x%b\n", DEVNAME(sc), type, number,
   address, flags, MPI_PG_FMT);

ccb = scsi_io_get(&sc->sc_iopool,
   ISSET(flags, MPI_PG_POLL)((flags) & ((1<<1))) ? SCSI_NOSLEEP0x00001 : 0);
if (ccb == NULL((void *)0)) {
DNPRINTF(MPI_D_MISC, "%s: mpi_cfg_header ccb_get\n",
    DEVNAME(sc));
return (1);
}

if (ISSET(flags, MPI_PG_EXTENDED)((flags) & ((1<<0)))) {
etype = type;
type = MPI_CONFIG_REQ_PAGE_TYPE_EXTENDED(0x0F);
}

cq = ccb->ccb_cmd;

cq->function = MPI_FUNCTION_CONFIG(0x04);

cq->action = MPI_CONFIG_REQ_ACTION_PAGE_HEADER(0x00);

cq->config_header.page_number = number;
cq->config_header.page_type = type;
cq->ext_page_type = etype;
htolem32(&cq->page_address, address)(*(__uint32_t *)(&cq->page_address) = ((__uint32_t)(address
)));
htolem32(&cq->page_buffer.sg_hdr, MPI_SGE_FL_TYPE_SIMPLE |(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24))))
   MPI_SGE_FL_LAST | MPI_SGE_FL_EOB | MPI_SGE_FL_EOL)(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24))));

ccb->ccb_done = mpi_empty_done;
if (ISSET(flags, MPI_PG_POLL)((flags) & ((1<<1)))) {
if (mpi_poll(sc, ccb, 50000) != 0) {
	DNPRINTF(MPI_D_MISC, "%s: mpi_cfg_header poll\n",
	    DEVNAME(sc));
	return (1);
}
} else
mpi_wait(sc, ccb);

if (ccb->ccb_rcb == NULL((void *)0))
panic("%s: unable to fetch config header", DEVNAME(sc)((sc)->sc_dev.dv_xname));
cp = ccb->ccb_rcb->rcb_reply;

DNPRINTF(MPI_D_MISC, "%s:  action: 0x%02x msg_length: %d function: "
   "0x%02x\n", DEVNAME(sc), cp->action, cp->msg_length, cp->function);
DNPRINTF(MPI_D_MISC, "%s:  ext_page_length: %d ext_page_type: 0x%02x "
   "msg_flags: 0x%02x\n", DEVNAME(sc),
   letoh16(cp->ext_page_length), cp->ext_page_type,
   cp->msg_flags);
DNPRINTF(MPI_D_MISC, "%s:  msg_context: 0x%08x\n", DEVNAME(sc),
   letoh32(cp->msg_context));
DNPRINTF(MPI_D_MISC, "%s:  ioc_status: 0x%04x\n", DEVNAME(sc),
   letoh16(cp->ioc_status));
DNPRINTF(MPI_D_MISC, "%s:  ioc_loginfo: 0x%08x\n", DEVNAME(sc),
   letoh32(cp->ioc_loginfo));
DNPRINTF(MPI_D_MISC, "%s:  page_version: 0x%02x page_length: %d "
   "page_number: 0x%02x page_type: 0x%02x\n", DEVNAME(sc),
   cp->config_header.page_version,
   cp->config_header.page_length,
   cp->config_header.page_number,
   cp->config_header.page_type);

if (lemtoh16(&cp->ioc_status)((__uint16_t)(*(__uint16_t *)(&cp->ioc_status))) != MPI_IOCSTATUS_SUCCESS(0x0000))
rv = 1;
else if (ISSET(flags, MPI_PG_EXTENDED)((flags) & ((1<<0)))) {
memset(ehdr, 0, sizeof(*ehdr))__builtin_memset((ehdr), (0), (sizeof(*ehdr)));
ehdr->page_version = cp->config_header.page_version;
ehdr->page_number = cp->config_header.page_number;
ehdr->page_type = cp->config_header.page_type;
ehdr->ext_page_length = cp->ext_page_length;
ehdr->ext_page_type = cp->ext_page_type;
} else
*hdr = cp->config_header;

mpi_push_reply(sc, ccb->ccb_rcb);
scsi_io_put(&sc->sc_iopool, ccb);

return (rv);
2846}

2848int
2849mpi_req_cfg_page(struct mpi_softc *sc, u_int32_t address, int flags,
  void *p, int read, void *page, size_t len)
2851{
struct mpi_ccb				*ccb;
struct mpi_msg_config_request		*cq;
struct mpi_msg_config_reply		*cp;
struct mpi_cfg_hdr			*hdr = p;
struct mpi_ecfg_hdr			*ehdr = p;
char					*kva;
int					page_length;
int					rv = 0;

DNPRINTF(MPI_D_MISC, "%s: mpi_cfg_page address: %d read: %d type: %x\n",
   DEVNAME(sc), address, read, hdr->page_type);

page_length = ISSET(flags, MPI_PG_EXTENDED)((flags) & ((1<<0))) ?
   lemtoh16(&ehdr->ext_page_length)((__uint16_t)(*(__uint16_t *)(&ehdr->ext_page_length))
) : hdr->page_length;

if (len > MPI_REQUEST_SIZE512 - sizeof(struct mpi_msg_config_request) ||
   len < page_length * 4)
return (1);

ccb = scsi_io_get(&sc->sc_iopool,
   ISSET(flags, MPI_PG_POLL)((flags) & ((1<<1))) ? SCSI_NOSLEEP0x00001 : 0);
if (ccb == NULL((void *)0)) {
DNPRINTF(MPI_D_MISC, "%s: mpi_cfg_page ccb_get\n", DEVNAME(sc));
return (1);
}

cq = ccb->ccb_cmd;

cq->function = MPI_FUNCTION_CONFIG(0x04);

cq->action = (read ? MPI_CONFIG_REQ_ACTION_PAGE_READ_CURRENT(0x01) :
   MPI_CONFIG_REQ_ACTION_PAGE_WRITE_CURRENT(0x02));

if (ISSET(flags, MPI_PG_EXTENDED)((flags) & ((1<<0)))) {
cq->config_header.page_version = ehdr->page_version;
cq->config_header.page_number = ehdr->page_number;
cq->config_header.page_type = ehdr->page_type;
cq->ext_page_len = ehdr->ext_page_length;
cq->ext_page_type = ehdr->ext_page_type;
} else
cq->config_header = *hdr;
cq->config_header.page_type &= MPI_CONFIG_REQ_PAGE_TYPE_MASK(0x0f);
htolem32(&cq->page_address, address)(*(__uint32_t *)(&cq->page_address) = ((__uint32_t)(address
)));
htolem32(&cq->page_buffer.sg_hdr, MPI_SGE_FL_TYPE_SIMPLE |(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24) | (page_length * 4) | (read ? (0x0<<26) : (0x1<<
26)))))
   MPI_SGE_FL_LAST | MPI_SGE_FL_EOB | MPI_SGE_FL_EOL |(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24) | (page_length * 4) | (read ? (0x0<<26) : (0x1<<
26)))))
   (page_length * 4) |(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24) | (page_length * 4) | (read ? (0x0<<26) : (0x1<<
26)))))
   (read ? MPI_SGE_FL_DIR_IN : MPI_SGE_FL_DIR_OUT))(*(__uint32_t *)(&cq->page_buffer.sg_hdr) = ((__uint32_t
)((0x1<<28) | (0x1<<31) | (0x1<<30) | (0x1<<
24) | (page_length * 4) | (read ? (0x0<<26) : (0x1<<
26)))));

/* bounce the page via the request space to avoid more bus_dma games */
mpi_dvatosge(&cq->page_buffer, ccb->ccb_cmd_dva +
   sizeof(struct mpi_msg_config_request));

kva = ccb->ccb_cmd;
kva += sizeof(struct mpi_msg_config_request);
if (!read)
memcpy(kva, page, len)__builtin_memcpy((kva), (page), (len));

ccb->ccb_done = mpi_empty_done;
if (ISSET(flags, MPI_PG_POLL)((flags) & ((1<<1)))) {
if (mpi_poll(sc, ccb, 50000) != 0) {
	DNPRINTF(MPI_D_MISC, "%s: mpi_cfg_header poll\n",
	    DEVNAME(sc));
	return (1);
}
} else
mpi_wait(sc, ccb);

if (ccb->ccb_rcb == NULL((void *)0)) {
scsi_io_put(&sc->sc_iopool, ccb);
return (1);
}
cp = ccb->ccb_rcb->rcb_reply;

DNPRINTF(MPI_D_MISC, "%s:  action: 0x%02x msg_length: %d function: "
   "0x%02x\n", DEVNAME(sc), cp->action, cp->msg_length, cp->function);
DNPRINTF(MPI_D_MISC, "%s:  ext_page_length: %d ext_page_type: 0x%02x "
   "msg_flags: 0x%02x\n", DEVNAME(sc),
   letoh16(cp->ext_page_length), cp->ext_page_type,
   cp->msg_flags);
DNPRINTF(MPI_D_MISC, "%s:  msg_context: 0x%08x\n", DEVNAME(sc),
   letoh32(cp->msg_context));
DNPRINTF(MPI_D_MISC, "%s:  ioc_status: 0x%04x\n", DEVNAME(sc),
   letoh16(cp->ioc_status));
DNPRINTF(MPI_D_MISC, "%s:  ioc_loginfo: 0x%08x\n", DEVNAME(sc),
   letoh32(cp->ioc_loginfo));
DNPRINTF(MPI_D_MISC, "%s:  page_version: 0x%02x page_length: %d "
   "page_number: 0x%02x page_type: 0x%02x\n", DEVNAME(sc),
   cp->config_header.page_version,
   cp->config_header.page_length,
   cp->config_header.page_number,
   cp->config_header.page_type);

if (lemtoh16(&cp->ioc_status)((__uint16_t)(*(__uint16_t *)(&cp->ioc_status))) != MPI_IOCSTATUS_SUCCESS(0x0000))
rv = 1;
else if (read)
memcpy(page, kva, len)__builtin_memcpy((page), (kva), (len));

mpi_push_reply(sc, ccb->ccb_rcb);
scsi_io_put(&sc->sc_iopool, ccb);

return (rv);
2953}

2955int
2956mpi_scsi_ioctl(struct scsi_link *link, u_long cmd, caddr_t addr, int flag)
2957{
struct mpi_softc	*sc = link->bus->sb_adapter_softc;

DNPRINTF(MPI_D_IOCTL, "%s: mpi_scsi_ioctl\n", DEVNAME(sc));

switch (cmd) {
case DIOCGCACHE((unsigned long)0x40000000 | ((sizeof(struct dk_cache) & 0x1fff
) << 16) | ((('d')) << 8) | ((117))):
case DIOCSCACHE((unsigned long)0x80000000 | ((sizeof(struct dk_cache) & 0x1fff
) << 16) | ((('d')) << 8) | ((118))):
if (ISSET(link->flags, SDEV_VIRTUAL)((link->flags) & (0x0800))) {
	return (mpi_ioctl_cache(link, cmd,
	    (struct dk_cache *)addr));
}
break;

default:
if (sc->sc_ioctl)
	return (sc->sc_ioctl(&sc->sc_dev, cmd, addr));

break;
}

return (ENOTTY25);
2979}

2981int
2982mpi_ioctl_cache(struct scsi_link *link, u_long cmd, struct dk_cache *dc)
2983{
struct mpi_softc	*sc = link->bus->sb_adapter_softc;
struct mpi_ccb		*ccb;
int			len, rv;
struct mpi_cfg_hdr	hdr;
struct mpi_cfg_raid_vol_pg0 *rpg0;
int			enabled;
struct mpi_msg_raid_action_request *req;
struct mpi_msg_raid_action_reply *rep;
struct mpi_raid_settings settings;

rv = mpi_req_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_RAID_VOL(0x08), 0,
   link->target, MPI_PG_POLL(1<<1), &hdr);
if (rv != 0)
return (EIO5);

len = sizeof(*rpg0) + sc->sc_vol_page->max_physdisks *
   sizeof(struct mpi_cfg_raid_vol_pg0_physdisk);
rpg0 = malloc(len, M_TEMP127, M_NOWAIT0x0002);
if (rpg0 == NULL((void *)0))
return (ENOMEM12);

if (mpi_req_cfg_page(sc, link->target, MPI_PG_POLL(1<<1), &hdr, 1,
   rpg0, len) != 0) {
DNPRINTF(MPI_D_RAID, "%s: can't get RAID vol cfg page 0\n",
    DEVNAME(sc));
rv = EIO5;
goto done;
}

enabled = ISSET(lemtoh16(&rpg0->settings.volume_settings),((((__uint16_t)(*(__uint16_t *)(&rpg0->settings.volume_settings
)))) & ((1<<0)))
   MPI_CFG_RAID_VOL_0_SETTINGS_WRITE_CACHE_EN)((((__uint16_t)(*(__uint16_t *)(&rpg0->settings.volume_settings
)))) & ((1<<0))) ? 1 : 0;

if (cmd == DIOCGCACHE((unsigned long)0x40000000 | ((sizeof(struct dk_cache) & 0x1fff
) << 16) | ((('d')) << 8) | ((117)))) {
dc->wrcache = enabled;
dc->rdcache = 0;
goto done;
} /* else DIOCSCACHE */

if (dc->rdcache) {
rv = EOPNOTSUPP45;
goto done;
}

if (((dc->wrcache) ? 1 : 0) == enabled)
goto done;

settings = rpg0->settings;
if (dc->wrcache) {
SET(settings.volume_settings,((settings.volume_settings) |= (((__uint16_t)((1<<0))))
)
    htole16(MPI_CFG_RAID_VOL_0_SETTINGS_WRITE_CACHE_EN))((settings.volume_settings) |= (((__uint16_t)((1<<0))))
);
} else {
CLR(settings.volume_settings,((settings.volume_settings) &= ~(((__uint16_t)((1<<
0)))))
    htole16(MPI_CFG_RAID_VOL_0_SETTINGS_WRITE_CACHE_EN))((settings.volume_settings) &= ~(((__uint16_t)((1<<
0)))));
}

ccb = scsi_io_get(&sc->sc_iopool, SCSI_NOSLEEP0x00001);
if (ccb == NULL((void *)0)) {
rv = ENOMEM12;
goto done;
}

req = ccb->ccb_cmd;
req->function = MPI_FUNCTION_RAID_ACTION(0x15);
req->action = MPI_MSG_RAID_ACTION_CH_VOL_SETTINGS(0x08);
req->vol_id = rpg0->volume_id;
req->vol_bus = rpg0->volume_bus;

memcpy(&req->data_word, &settings, sizeof(req->data_word))__builtin_memcpy((&req->data_word), (&settings), (
sizeof(req->data_word)));
ccb->ccb_done = mpi_empty_done;
if (mpi_poll(sc, ccb, 50000) != 0) {
rv = EIO5;
goto done;
}

rep = (struct mpi_msg_raid_action_reply *)ccb->ccb_rcb;
if (rep == NULL((void *)0))
panic("%s: raid volume settings change failed", DEVNAME(sc)((sc)->sc_dev.dv_xname));

switch (lemtoh16(&rep->action_status)((__uint16_t)(*(__uint16_t *)(&rep->action_status)))) {
case MPI_RAID_ACTION_STATUS_OK(0x0000):
rv = 0;
break;
default:
rv = EIO5;
break;
}

mpi_push_reply(sc, ccb->ccb_rcb);
scsi_io_put(&sc->sc_iopool, ccb);

3074done:
free(rpg0, M_TEMP127, len);
return (rv);
3077}

3079#if NBIO1 > 0
3080int
3081mpi_bio_get_pg0_raid(struct mpi_softc *sc, int id)
3082{
int			len, rv = EINVAL22;
u_int32_t		address;
struct mpi_cfg_hdr	hdr;
struct mpi_cfg_raid_vol_pg0 *rpg0;

/* get IOC page 2 */
if (mpi_req_cfg_page(sc, 0, 0, &sc->sc_cfg_hdr, 1, sc->sc_vol_page,
   sc->sc_cfg_hdr.page_length * 4) != 0) {
DNPRINTF(MPI_D_IOCTL, "%s: mpi_bio_get_pg0_raid unable to "
    "fetch IOC page 2\n", DEVNAME(sc));
goto done;
}

/* XXX return something else than EINVAL to indicate within hs range */
if (id > sc->sc_vol_page->active_vols) {
DNPRINTF(MPI_D_IOCTL, "%s: mpi_bio_get_pg0_raid invalid vol "
    "id: %d\n", DEVNAME(sc), id);
goto done;
}

/* replace current buffer with new one */
len = sizeof *rpg0 + sc->sc_vol_page->max_physdisks *
   sizeof(struct mpi_cfg_raid_vol_pg0_physdisk);
rpg0 = malloc(len, M_DEVBUF2, M_WAITOK0x0001 | M_CANFAIL0x0004);
if (rpg0 == NULL((void *)0)) {
printf("%s: can't get memory for RAID page 0, "
    "bio disabled\n", DEVNAME(sc)((sc)->sc_dev.dv_xname));
goto done;
}
if (sc->sc_rpg0)
free(sc->sc_rpg0, M_DEVBUF2, 0);
sc->sc_rpg0 = rpg0;

/* get raid vol page 0 */
address = sc->sc_vol_list[id].vol_id |
   (sc->sc_vol_list[id].vol_bus << 8);
if (mpi_req_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_RAID_VOL(0x08), 0,
   address, 0, &hdr) != 0)
goto done;
if (mpi_req_cfg_page(sc, address, 0, &hdr, 1, rpg0, len)) {
DNPRINTF(MPI_D_RAID, "%s: can't get RAID vol cfg page 0\n",
    DEVNAME(sc));
goto done;
}

rv = 0;
3129done:
return (rv);
3131}

3133int
3134mpi_ioctl(struct device *dev, u_long cmd, caddr_t addr)
3135{
struct mpi_softc	*sc = (struct mpi_softc *)dev;
int error = 0;

DNPRINTF(MPI_D_IOCTL, "%s: mpi_ioctl ", DEVNAME(sc));

/* make sure we have bio enabled */
if (sc->sc_ioctl != mpi_ioctl)
return (EINVAL22);

rw_enter_write(&sc->sc_lock);

switch (cmd) {
case BIOCINQ(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct bioc_inq) & 0x1fff) << 16) | ((('B')) <<
 8) | ((32))):
DNPRINTF(MPI_D_IOCTL, "inq\n");
error = mpi_ioctl_inq(sc, (struct bioc_inq *)addr);
break;

case BIOCVOL(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct bioc_vol) & 0x1fff) << 16) | ((('B')) <<
 8) | ((34))):
DNPRINTF(MPI_D_IOCTL, "vol\n");
error = mpi_ioctl_vol(sc, (struct bioc_vol *)addr);
break;

case BIOCDISK(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct bioc_disk) & 0x1fff) << 16) | ((('B')) <<
 8) | ((33))):
DNPRINTF(MPI_D_IOCTL, "disk\n");
error = mpi_ioctl_disk(sc, (struct bioc_disk *)addr);
break;

case BIOCALARM(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct bioc_alarm) & 0x1fff) << 16) | ((('B')) <<
 8) | ((35))):
DNPRINTF(MPI_D_IOCTL, "alarm\n");
break;

case BIOCBLINK(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct bioc_blink) & 0x1fff) << 16) | ((('B')) <<
 8) | ((36))):
DNPRINTF(MPI_D_IOCTL, "blink\n");
break;

case BIOCSETSTATE(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct bioc_setstate) & 0x1fff) << 16) | ((('B')) <<
 8) | ((37))):
DNPRINTF(MPI_D_IOCTL, "setstate\n");
error = mpi_ioctl_setstate(sc, (struct bioc_setstate *)addr);
break;

default:
DNPRINTF(MPI_D_IOCTL, " invalid ioctl\n");
error = ENOTTY25;
}

rw_exit_write(&sc->sc_lock);

return (error);
3184}

3186int
3187mpi_ioctl_inq(struct mpi_softc *sc, struct bioc_inq *bi)
3188{
if (!(sc->sc_flags & MPI_F_RAID(1<<1))) {
bi->bi_novol = 0;
bi->bi_nodisk = 0;
}

if (mpi_cfg_page(sc, 0, &sc->sc_cfg_hdr, 1, sc->sc_vol_page,mpi_req_cfg_page((sc), (0), (1<<1), (&sc->sc_cfg_hdr
), (1), (sc->sc_vol_page), (sc->sc_cfg_hdr.page_length *
 4))
   sc->sc_cfg_hdr.page_length * 4)mpi_req_cfg_page((sc), (0), (1<<1), (&sc->sc_cfg_hdr
), (1), (sc->sc_vol_page), (sc->sc_cfg_hdr.page_length *
 4)) != 0) {
DNPRINTF(MPI_D_IOCTL, "%s: mpi_get_raid unable to fetch IOC "
    "page 2\n", DEVNAME(sc));
return (EINVAL22);
}

DNPRINTF(MPI_D_IOCTL, "%s:  active_vols: %d max_vols: %d "
   "active_physdisks: %d max_physdisks: %d\n", DEVNAME(sc),
   sc->sc_vol_page->active_vols, sc->sc_vol_page->max_vols,
   sc->sc_vol_page->active_physdisks, sc->sc_vol_page->max_physdisks);

bi->bi_novol = sc->sc_vol_page->active_vols;
bi->bi_nodisk = sc->sc_vol_page->active_physdisks;
strlcpy(bi->bi_dev, DEVNAME(sc)((sc)->sc_dev.dv_xname), sizeof(bi->bi_dev));

return (0);
3211}

3213int
3214mpi_ioctl_vol(struct mpi_softc *sc, struct bioc_vol *bv)
3215{
int			i, vol, id, rv = EINVAL22;
struct device		*dev;
struct scsi_link	*link;
struct mpi_cfg_raid_vol_pg0 *rpg0;
char			*vendp;

id = bv->bv_volid;
if (mpi_bio_get_pg0_raid(sc, id))
goto done;

if (id > sc->sc_vol_page->active_vols)
return (EINVAL22); /* XXX deal with hot spares */

rpg0 = sc->sc_rpg0;
if (rpg0 == NULL((void *)0))
goto done;

/* determine status */
switch (rpg0->volume_state) {
case MPI_CFG_RAID_VOL_0_STATE_OPTIMAL(0x00):
bv->bv_status = BIOC_SVONLINE0x00;
break;
case MPI_CFG_RAID_VOL_0_STATE_DEGRADED(0x01):
bv->bv_status = BIOC_SVDEGRADED0x02;
break;
case MPI_CFG_RAID_VOL_0_STATE_FAILED(0x02):
case MPI_CFG_RAID_VOL_0_STATE_MISSING(0x03):
bv->bv_status = BIOC_SVOFFLINE0x01;
break;
default:
bv->bv_status = BIOC_SVINVALID0xff;
}

/* override status if scrubbing or something */
if (rpg0->volume_status & MPI_CFG_RAID_VOL_0_STATUS_RESYNCING(1<<2))
bv->bv_status = BIOC_SVREBUILD0x05;

bv->bv_size = (uint64_t)lemtoh32(&rpg0->max_lba)((__uint32_t)(*(__uint32_t *)(&rpg0->max_lba))) * 512;

switch (sc->sc_vol_list[id].vol_type) {
case MPI_CFG_RAID_TYPE_RAID_IS(0x00):
bv->bv_level = 0;
break;
case MPI_CFG_RAID_TYPE_RAID_IME(0x01):
case MPI_CFG_RAID_TYPE_RAID_IM(0x02):
bv->bv_level = 1;
break;
case MPI_CFG_RAID_TYPE_RAID_5(0x03):
bv->bv_level = 5;
break;
case MPI_CFG_RAID_TYPE_RAID_6(0x04):
bv->bv_level = 6;
break;
case MPI_CFG_RAID_TYPE_RAID_10(0x05):
bv->bv_level = 10;
break;
case MPI_CFG_RAID_TYPE_RAID_50(0x06):
bv->bv_level = 50;
break;
default:
bv->bv_level = -1;
}

bv->bv_nodisk = rpg0->num_phys_disks;

for (i = 0, vol = -1; i < sc->sc_buswidth; i++) {
link = scsi_get_link(sc->sc_scsibus, i, 0);
if (link == NULL((void *)0))
	continue;

/* skip if not a virtual disk */
if (!(link->flags & SDEV_VIRTUAL0x0800))
	continue;

vol++;
/* are we it? */
if (vol == bv->bv_volid) {
	dev = link->device_softc;
	vendp = link->inqdata.vendor;
	memcpy(bv->bv_vendor, vendp, sizeof bv->bv_vendor)__builtin_memcpy((bv->bv_vendor), (vendp), (sizeof bv->
bv_vendor));
	bv->bv_vendor[sizeof(bv->bv_vendor) - 1] = '\0';
	strlcpy(bv->bv_dev, dev->dv_xname, sizeof bv->bv_dev);
	break;
}
}
rv = 0;
3302done:
return (rv);
3304}

3306int
3307mpi_ioctl_disk(struct mpi_softc *sc, struct bioc_disk *bd)
3308{
int			pdid, id, rv = EINVAL22;
u_int32_t		address;
struct mpi_cfg_hdr	hdr;
struct mpi_cfg_raid_vol_pg0 *rpg0;
struct mpi_cfg_raid_vol_pg0_physdisk *physdisk;
struct mpi_cfg_raid_physdisk_pg0 pdpg0;

id = bd->bd_volid;
if (mpi_bio_get_pg0_raid(sc, id))
goto done;

if (id > sc->sc_vol_page->active_vols)
return (EINVAL22); /* XXX deal with hot spares */

rpg0 = sc->sc_rpg0;
if (rpg0 == NULL((void *)0))
goto done;

pdid = bd->bd_diskid;
if (pdid > rpg0->num_phys_disks)
goto done;
physdisk = (struct mpi_cfg_raid_vol_pg0_physdisk *)(rpg0 + 1);
physdisk += pdid;

/* get raid phys disk page 0 */
address = physdisk->phys_disk_num;
if (mpi_cfg_header(sc, MPI_CONFIG_REQ_PAGE_TYPE_RAID_PD, 0, address,mpi_req_cfg_header((sc), ((0x0A)), (0), (address), (1<<
1), (&hdr))
   &hdr)mpi_req_cfg_header((sc), ((0x0A)), (0), (address), (1<<
1), (&hdr)) != 0)
goto done;
if (mpi_cfg_page(sc, address, &hdr, 1, &pdpg0, sizeof pdpg0)mpi_req_cfg_page((sc), (address), (1<<1), (&hdr), (
1), (&pdpg0), (sizeof pdpg0))) {
bd->bd_status = BIOC_SDFAILED0x02;
return (0);
}
bd->bd_channel = pdpg0.phys_disk_bus;
bd->bd_target = pdpg0.phys_disk_id;
bd->bd_lun = 0;
bd->bd_size = (uint64_t)lemtoh32(&pdpg0.max_lba)((__uint32_t)(*(__uint32_t *)(&pdpg0.max_lba))) * 512;
strlcpy(bd->bd_vendor, (char *)pdpg0.vendor_id, sizeof(bd->bd_vendor));

switch (pdpg0.phys_disk_state) {
case MPI_CFG_RAID_PHYDISK_0_STATE_ONLINE(0x00):
bd->bd_status = BIOC_SDONLINE0x00;
break;
case MPI_CFG_RAID_PHYDISK_0_STATE_MISSING(0x01):
case MPI_CFG_RAID_PHYDISK_0_STATE_FAILED(0x03):
bd->bd_status = BIOC_SDFAILED0x02;
break;
case MPI_CFG_RAID_PHYDISK_0_STATE_HOSTFAIL(0x06):
case MPI_CFG_RAID_PHYDISK_0_STATE_OTHER(0xff):
case MPI_CFG_RAID_PHYDISK_0_STATE_OFFLINE(0x05):
bd->bd_status = BIOC_SDOFFLINE0x01;
break;
case MPI_CFG_RAID_PHYDISK_0_STATE_INIT(0x04):
bd->bd_status = BIOC_SDSCRUB0x06;
break;
case MPI_CFG_RAID_PHYDISK_0_STATE_INCOMPAT(0x02):
default:
bd->bd_status = BIOC_SDINVALID0xff;
break;
}

/* XXX figure this out */
/* bd_serial[32]; */
/* bd_procdev[16]; */

rv = 0;
3375done:
return (rv);
3377}

3379int
3380mpi_ioctl_setstate(struct mpi_softc *sc, struct bioc_setstate *bs)
3381{
return (ENOTTY25);
3383}

3385#ifndef SMALL_KERNEL
3386int
3387mpi_create_sensors(struct mpi_softc *sc)
3388{
struct device		*dev;
struct scsi_link	*link;
int			i, vol, nsensors;

/* count volumes */
for (i = 0, vol = 0; i < sc->sc_buswidth; i++) {
link = scsi_get_link(sc->sc_scsibus, i, 0);
if (link == NULL((void *)0))
	continue;
/* skip if not a virtual disk */
if (!(link->flags & SDEV_VIRTUAL0x0800))
	continue;

vol++;
}
if (vol == 0)
return (0);

sc->sc_sensors = mallocarray(vol, sizeof(struct ksensor),
   M_DEVBUF2, M_NOWAIT0x0002 | M_ZERO0x0008);
if (sc->sc_sensors == NULL((void *)0))
return (1);
nsensors = vol;

strlcpy(sc->sc_sensordev.xname, DEVNAME(sc)((sc)->sc_dev.dv_xname),
   sizeof(sc->sc_sensordev.xname));

for (i = 0, vol= 0; i < sc->sc_buswidth; i++) {
link = scsi_get_link(sc->sc_scsibus, i, 0);
if (link == NULL((void *)0))
	continue;
/* skip if not a virtual disk */
if (!(link->flags & SDEV_VIRTUAL0x0800))
	continue;

dev = link->device_softc;
strlcpy(sc->sc_sensors[vol].desc, dev->dv_xname,
    sizeof(sc->sc_sensors[vol].desc));
sc->sc_sensors[vol].type = SENSOR_DRIVE;
sc->sc_sensors[vol].status = SENSOR_S_UNKNOWN;
sensor_attach(&sc->sc_sensordev, &sc->sc_sensors[vol]);

vol++;
}

if (sensor_task_register(sc, mpi_refresh_sensors, 10) == NULL((void *)0))
goto bad;

sensordev_install(&sc->sc_sensordev);

return (0);

3441bad:
free(sc->sc_sensors, M_DEVBUF2, nsensors * sizeof(struct ksensor));
return (1);
3444}

3446void
3447mpi_refresh_sensors(void *arg)
3448{
int			i, vol;
struct scsi_link	*link;
struct mpi_softc	*sc = arg;
struct mpi_cfg_raid_vol_pg0 *rpg0;

rw_enter_write(&sc->sc_lock);

for (i = 0, vol = 0; i < sc->sc_buswidth; i++) {
link = scsi_get_link(sc->sc_scsibus, i, 0);
if (link == NULL((void *)0))
	continue;
/* skip if not a virtual disk */
if (!(link->flags & SDEV_VIRTUAL0x0800))
	continue;

if (mpi_bio_get_pg0_raid(sc, vol))
	continue;

rpg0 = sc->sc_rpg0;
if (rpg0 == NULL((void *)0))
	goto done;

/* determine status */
switch (rpg0->volume_state) {
case MPI_CFG_RAID_VOL_0_STATE_OPTIMAL(0x00):
	sc->sc_sensors[vol].value = SENSOR_DRIVE_ONLINE4;
	sc->sc_sensors[vol].status = SENSOR_S_OK;
	break;
case MPI_CFG_RAID_VOL_0_STATE_DEGRADED(0x01):
	sc->sc_sensors[vol].value = SENSOR_DRIVE_PFAIL10;
	sc->sc_sensors[vol].status = SENSOR_S_WARN;
	break;
case MPI_CFG_RAID_VOL_0_STATE_FAILED(0x02):
case MPI_CFG_RAID_VOL_0_STATE_MISSING(0x03):
	sc->sc_sensors[vol].value = SENSOR_DRIVE_FAIL9;
	sc->sc_sensors[vol].status = SENSOR_S_CRIT;
	break;
default:
	sc->sc_sensors[vol].value = 0; /* unknown */
	sc->sc_sensors[vol].status = SENSOR_S_UNKNOWN;
}

/* override status if scrubbing or something */
if (rpg0->volume_status & MPI_CFG_RAID_VOL_0_STATUS_RESYNCING(1<<2)) {
	sc->sc_sensors[vol].value = SENSOR_DRIVE_REBUILD7;
	sc->sc_sensors[vol].status = SENSOR_S_WARN;
}

vol++;
}
3499done:
rw_exit_write(&sc->sc_lock);
3501}
3502#endif /* SMALL_KERNEL */
3503#endif /* NBIO > 0 */