From: Peter Avalos Date: Tue, 10 Apr 2012 16:51:20 +0000 (-0700) Subject: Merge remote-tracking branch 'origin/master' X-Git-Tag: v3.2.0~1167 X-Git-Url: https://gitweb.dragonflybsd.org/~nant/dragonfly.git/commitdiff_plain/4c986ba71501e58e2d468c985b211e5405eeae2d?hp=ca7b1affc72ea13d603d710a9c0356fc3859bf98 Merge remote-tracking branch 'origin/master' --- diff --git a/Makefile_upgrade.inc b/Makefile_upgrade.inc index 55ea141ac4..871d5f7665 100644 --- a/Makefile_upgrade.inc +++ b/Makefile_upgrade.inc @@ -1984,6 +1984,10 @@ TO_REMOVE+=/usr/lib/profile/libtinfo.aa TO_REMOVE+=/usr/bin/kzip TO_REMOVE+=/usr/share/man/cat8/kzip.8.gz TO_REMOVE+=/usr/share/man/man8/kzip.8.gz +TO_REMOVE+=/usr/share/man/cat4/i386/aic.4.gz +TO_REMOVE+=/usr/share/man/man4/i386/aic.4.gz +TO_REMOVE+=/usr/share/man/cat3/lintf.3.gz +TO_REMOVE+=/usr/share/man/man3/lintf.3.gz TO_REMOVE+=/usr/include/openssl/e_os.h TO_REMOVE+=/usr/include/openssl/eng_int.h TO_REMOVE+=/usr/include/openssl/ui_locl.h diff --git a/games/fortune/fortune/fortune.c b/games/fortune/fortune/fortune.c index c02b0ec64a..76b2427535 100644 --- a/games/fortune/fortune/fortune.c +++ b/games/fortune/fortune/fortune.c @@ -33,8 +33,6 @@ * @(#)fortune.c 8.1 (Berkeley) 5/31/93 * $FreeBSD: src/games/fortune/fortune/fortune.c,v 1.18.2.1 2001/07/02 00:35:27 dd Exp $ */ -/* $FreeBSD: src/games/fortune/fortune/fortune.c,v 1.18.2.1 2001/07/02 00:35:27 dd Exp $ */ -/* $DragonFly: src/games/fortune/fortune/fortune.c,v 1.6 2006/08/08 16:58:59 pavalos Exp $ */ #include #include @@ -951,9 +949,8 @@ get_fort(void) " skip \"%s\", %d%% (choice = %d)\n", fp->name, fp->percent, choice)); } - DPRINTF(1, (stderr, - "using \"%s\", %d%% (choice = %d)\n", - fp->name, fp->percent, choice)); + DPRINTF(1, (stderr, "using \"%s\", %d%% (choice = %d)\n", + fp->name, fp->percent, choice)); } if (fp->percent != NO_PROB) get_tbl(fp); diff --git a/include/dlfcn.h b/include/dlfcn.h index c2a88d6abd..908cc53c20 100644 --- a/include/dlfcn.h +++ b/include/dlfcn.h @@ -117,6 +117,7 @@ void *dlopen(const char *, int); void *dlsym(void * __restrict, const char * __restrict); #if __BSD_VISIBLE +void *fdlopen(int, int); int dladdr(const void * __restrict, Dl_info * __restrict); dlfunc_t dlfunc(void * __restrict, const char * __restrict); int dlinfo(void * __restrict, int, void * __restrict); diff --git a/lib/libc/gen/Makefile.inc b/lib/libc/gen/Makefile.inc index 976fd20028..3313c9711a 100644 --- a/lib/libc/gen/Makefile.inc +++ b/lib/libc/gen/Makefile.inc @@ -87,6 +87,7 @@ MLINKS+=directory.3 closedir.3 directory.3 dirfd.3 directory.3 opendir.3 \ directory.3 readdir.3 directory.3 readdir_r.3 directory.3 rewinddir.3 \ directory.3 seekdir.3 directory.3 telldir.3 directory.3 fdopendir.3 MLINKS+=dlsym.3 dlfunc.3 +MLINKS+=dlopen.3 fdlopen.3 MLINKS+=devname.3 devname_r.3 devname.3 fdevname.3 devname.3 fdevname_r.3 MLINKS+=endutxent.3 getutxent.3 endutxent.3 getutxid.3 \ endutxent.3 getutxline.3 endutxent.3 pututxline.3 \ diff --git a/lib/libc/gen/dlfcn.3 b/lib/libc/gen/dlfcn.3 index fd263ce500..249f0a96c3 100644 --- a/lib/libc/gen/dlfcn.3 +++ b/lib/libc/gen/dlfcn.3 @@ -27,11 +27,12 @@ .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE .\" POSSIBILITY OF SUCH DAMAGE. .\" -.Dd April 28, 2011 +.Dd April 6, 2012 .Dt DLFCN 3 .Os .Sh NAME .Nm dlopen , +.Nm fdlopen , .Nm dlclose , .Nm dlinfo , .Nm dladdr , @@ -48,6 +49,8 @@ It is included in every dynamically linked program automatically. .In dlfcn.h .Ft "void *" .Fn dlopen "const char *name" "int mode" +.Ft "void *" +.Fn fdlopen "int fd" "int mode" .Ft int .Fn dlclose "void *handle" .Ft int @@ -82,6 +85,7 @@ under program control. .Xr dlopen 3 , .Xr dlsym 3 , .Xr dlvsym 3 , +.Xr fdlopen 3 , .Xr link 5 .Sh HISTORY Some of the diff --git a/lib/libc/gen/dlfcn.c b/lib/libc/gen/dlfcn.c index e5f06451cf..138a13516f 100644 --- a/lib/libc/gen/dlfcn.c +++ b/lib/libc/gen/dlfcn.c @@ -174,6 +174,14 @@ dl_iterate_phdr(int (*callback)(struct dl_phdr_info *, size_t, void *), return callback(&phdr_info, sizeof(phdr_info), data); } +#pragma weak fdlopen +void * +fdlopen(int fd, int mode) +{ + _rtld_error(sorry); + return NULL; +} + #pragma weak _rtld_addr_phdr int _rtld_addr_phdr(const void *addr, struct dl_phdr_info *phdr_info) diff --git a/lib/libc/gen/dlopen.3 b/lib/libc/gen/dlopen.3 index 8261068962..899bb66c08 100644 --- a/lib/libc/gen/dlopen.3 +++ b/lib/libc/gen/dlopen.3 @@ -32,11 +32,12 @@ .\" @(#) dlopen.3 1.6 90/01/31 SMI .\" $FreeBSD: head/lib/libc/gen/dlopen.3 211397 2010-08-16 15:18:30Z joel $ .\" -.Dd April 28, 2011 +.Dd April 6, 2012 .Dt DLOPEN 3 .Os .Sh NAME -.Nm dlopen +.Nm dlopen , +.Nm fdlopen .Nd returns handle to dynamically loaded shared object .Sh LIBRARY This function is not in a library. @@ -45,12 +46,14 @@ It is included in every dynamically linked program automatically. .In dlfcn.h .Ft void * .Fn dlopen "const char *name" "int mode" +.Ft void * +.Fn fdlopen "int fd" "int mode" .Sh DESCRIPTION The .Fn dlopen function provides access to the shared object in -.Fa path , +.Fa name , returning a descriptor that can be used for later references to the object in calls to other dl functions. If @@ -128,19 +131,52 @@ The same behaviour may be requested by option of the static linker .Xr ld 1 . .It Dv RTLD_NOLOAD -Ony return valid handle for the object if it is already loaded in +Only return valid handle for the object if it is already loaded in the process address space, otherwise .Dv NULL is returned. Other mode flags may be specified, which will be applied for promotion for the found object. .El -.Sh RETURN VALUE -The +.Pp +If .Fn dlopen -function -returns a null pointer in the event of an error. +fails, it returns a null pointer, and sets an error condition which may +be interrogated with +.Fn dlerror . +.Pp The +.Fn fdlopen +function is similar to +.Fn dlopen , +but it takes the file descriptor argument +.Fa fd , +which is used for the file operations needed to load an object +into the address space. +The file descriptor +.Fa fd +is not closed by the function regardless a result of execution, +but a duplicate of the file descriptor is. +This may be important if a +.Xr lockf 3 +lock is held on the passed descriptor. +The +.Fa fd +argument -1 is interpreted as a reference to the main +executable of the process, similar to +.Va NULL +value for the +.Fa name +argument to +.Fn dlopen . +The +.Fn fdlopen +function can be used by the code that needs to perform +additional checks on the loaded objects, to prevent races with +symlinking or renames. +.El +.Sh RETURN VALUE +The functions return a null pointer in the event of an error. Whenever an error has been detected, a message detailing it can be retrieved via a call to .Fn dlerror . diff --git a/lib/libc/gen/ualarm.c b/lib/libc/gen/ualarm.c index 77e4615976..881b922e0b 100644 --- a/lib/libc/gen/ualarm.c +++ b/lib/libc/gen/ualarm.c @@ -31,7 +31,6 @@ * SUCH DAMAGE. * * @(#)ualarm.c 8.1 (Berkeley) 6/4/93 - * $DragonFly: src/lib/libc/gen/ualarm.c,v 1.4 2005/11/13 00:07:42 swildner Exp $ */ #include @@ -57,6 +56,6 @@ ualarm(unsigned usecs, unsigned reload) if (setitimer(ITIMER_REAL, &new, &old) == 0) return (old.it_value.tv_sec * USPS + old.it_value.tv_usec); - /* else */ - return (-1); + + return (-1); } diff --git a/lib/libm/man/Makefile.inc b/lib/libm/man/Makefile.inc index 2bd703378a..3c279a782f 100644 --- a/lib/libm/man/Makefile.inc +++ b/lib/libm/man/Makefile.inc @@ -70,7 +70,7 @@ MLINKS+=remainder.3 remainderf.3 remainder.3 remainderl.3 MLINKS+=remainder.3 remquo.3 remainder.3 remquof.3 remainder.3 remquol.3 MLINKS+=finite.3 finitef.3 MLINKS+=fma.3 fmaf.3 fma.3 fmal.3 -MLINKS+=lrint.3 lintf.3 lrint.3 lrintl.3 +MLINKS+=lrint.3 lrintf.3 lrint.3 lrintl.3 MLINKS+=lrint.3 llrint.3 lrint.3 llrintf.3 lrint.3 llrintl.3 MLINKS+=lround.3 lroundf.3 lround.3 lroundl.3 MLINKS+=lround.3 llround.3 lround.3 llroundf.3 lround.3 llroundl.3 diff --git a/lib/libpuffs/puffs_framebuf.3 b/lib/libpuffs/puffs_framebuf.3 index b9f581f671..80f30b5201 100644 --- a/lib/libpuffs/puffs_framebuf.3 +++ b/lib/libpuffs/puffs_framebuf.3 @@ -85,7 +85,7 @@ .Ft void .Fo puffs_framev_enqueue_cb .Fa "struct puffs_usermount *pu" "int fd" "struct puffs_framebuf *pufbuf" -.Fa "puffs_framebuf_cb fcb" "void *fcb_arg" "int flags" +.Fa "puffs_framev_cb fcb" "void *fcb_arg" "int flags" .Fc .Ft void .Fo puffs_framev_enqueue_justsend diff --git a/lib/libpuffs/puffs_ops.3 b/lib/libpuffs/puffs_ops.3 index 0e8bc13bfb..af88c0cbe0 100644 --- a/lib/libpuffs/puffs_ops.3 +++ b/lib/libpuffs/puffs_ops.3 @@ -196,7 +196,7 @@ .Ft int .Fo puffs_node_listextattr .Fa "struct puffs_usermount *pu" "puffs_cookie_t opc" "int attrnamespace" -.Fa "size_t *attrssize" "uint8_t *attrs" "iint flag" "size_t *resid" +.Fa "size_t *attrssize" "uint8_t *attrs" "int flag" "size_t *resid" .Fa "const struct puffs_cred *pcr" .Fc .Ft int diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c index 74752d861e..17528fc775 100644 --- a/libexec/rtld-elf/rtld.c +++ b/libexec/rtld-elf/rtld.c @@ -86,7 +86,7 @@ static void digest_dynamic2(Obj_Entry *, const Elf_Dyn *, const Elf_Dyn *, static void digest_dynamic(Obj_Entry *, int); static Obj_Entry *digest_phdr(const Elf_Phdr *, int, caddr_t, const char *); static Obj_Entry *dlcheck(void *); -static Obj_Entry *dlopen_object(const char *name, Obj_Entry *refobj, +static Obj_Entry *dlopen_object(const char *name, int fd, Obj_Entry *refobj, int lo_flags, int mode); static Obj_Entry *do_load_object(int, const char *, char *, struct stat *, int); static int do_search_info(const Obj_Entry *obj, int, struct dl_serinfo *); @@ -107,7 +107,7 @@ static void load_filtees(Obj_Entry *, int flags, RtldLockState *); static void unload_filtees(Obj_Entry *); static int load_needed_objects(Obj_Entry *, int); static int load_preload_objects(void); -static Obj_Entry *load_object(const char *, const Obj_Entry *, int); +static Obj_Entry *load_object(const char *, int fd, const Obj_Entry *, int); static void map_stacks_exec(RtldLockState *); static Obj_Entry *obj_from_addr(const void *); static void objlist_call_fini(Objlist *, Obj_Entry *, RtldLockState *); @@ -126,6 +126,7 @@ static int resolve_objects_ifunc(Obj_Entry *first, bool bind_now, int flags, RtldLockState *lockstate); static int rtld_dirname(const char *, char *); static int rtld_dirname_abs(const char *, char *); +static void *rtld_dlopen(const char *name, int fd, int mode); static void rtld_exit(void); static char *search_library_path(const char *, const char *); static const void **get_program_var_addr(const char *, RtldLockState *); @@ -230,6 +231,7 @@ static func_ptr_type exports[] = { (func_ptr_type) &dlclose, (func_ptr_type) &dlerror, (func_ptr_type) &dlopen, + (func_ptr_type) &fdlopen, (func_ptr_type) &dlfunc, (func_ptr_type) &dlsym, (func_ptr_type) &dlvsym, @@ -796,9 +798,10 @@ _rtld_bind(Obj_Entry *obj, Elf_Size reloff, void *stack) if (rtld_functrace(obj->path, defobj->path, defobj->strtab + def->st_name, - stack)) - lock_release(rtld_bind_lock, &lockstate); - return target; + stack)) { + lock_release(rtld_bind_lock, &lockstate); + return target; + } } /* @@ -1946,7 +1949,7 @@ load_filtee1(Obj_Entry *obj, Needed_Entry *needed, int flags) { for (; needed != NULL; needed = needed->next) { - needed->obj = dlopen_object(obj->strtab + needed->name, obj, + needed->obj = dlopen_object(obj->strtab + needed->name, -1, obj, flags, ((ld_loadfltr || obj->z_loadfltr) ? RTLD_NOW : RTLD_LAZY) | RTLD_LOCAL); } @@ -1970,7 +1973,7 @@ process_needed(Obj_Entry *obj, Needed_Entry *needed, int flags) Obj_Entry *obj1; for (; needed != NULL; needed = needed->next) { - obj1 = needed->obj = load_object(obj->strtab + needed->name, obj, + obj1 = needed->obj = load_object(obj->strtab + needed->name, -1, obj, flags & ~RTLD_LO_NOLOAD); if (obj1 == NULL && !ld_tracing && (flags & RTLD_LO_FILTEES) == 0) return (-1); @@ -2020,7 +2023,7 @@ load_preload_objects(void) savech = p[len]; p[len] = '\0'; - obj = load_object(p, NULL, 0); + obj = load_object(p, -1, NULL, 0); if (obj == NULL) return -1; /* XXX - cleanup */ p[len] = savech; @@ -2040,43 +2043,68 @@ load_preload_objects(void) return 0; } +static const char * +printable_path(const char *path) +{ + + return (path == NULL ? "" : path); +} + /* - * Load a shared object into memory, if it is not already loaded. + * Load a shared object into memory, if it is not already loaded. The + * object may be specified by name or by user-supplied file descriptor + * fd_u. In the later case, the fd_u descriptor is not closed, but its + * duplicate is. * * Returns a pointer to the Obj_Entry for the object. Returns NULL * on failure. */ static Obj_Entry * -load_object(const char *name, const Obj_Entry *refobj, int flags) +load_object(const char *name, int fd_u, const Obj_Entry *refobj, int flags) { Obj_Entry *obj; - int fd = -1; + int fd; struct stat sb; char *path; - for (obj = obj_list->next; obj != NULL; obj = obj->next) - if (object_match_name(obj, name)) - return obj; + if (name != NULL) { + for (obj = obj_list->next; obj != NULL; obj = obj->next) { + if (object_match_name(obj, name)) + return (obj); + } - path = find_library(name, refobj); - if (path == NULL) - return NULL; + path = find_library(name, refobj); + if (path == NULL) + return (NULL); + } else + path = NULL; /* - * If we didn't find a match by pathname, open the file and check - * again by device and inode. This avoids false mismatches caused - * by multiple links or ".." in pathnames. + * If we didn't find a match by pathname, or the name is not + * supplied, open the file and check again by device and inode. + * This avoids false mismatches caused by multiple links or ".." + * in pathnames. * * To avoid a race, we open the file and use fstat() rather than * using stat(). */ - if ((fd = open(path, O_RDONLY)) == -1) { - _rtld_error("Cannot open \"%s\"", path); - free(path); - return NULL; + fd = -1; + if (fd_u == -1) { + if ((fd = open(path, O_RDONLY)) == -1) { + _rtld_error("Cannot open \"%s\"", path); + free(path); + return (NULL); + } + } else { + fd = dup(fd_u); + if (fd == -1) { + _rtld_error("Cannot dup fd"); + free(path); + return (NULL); + } } if (fstat(fd, &sb) == -1) { - _rtld_error("Cannot fstat \"%s\"", path); + _rtld_error("Cannot fstat \"%s\"", printable_path(path)); close(fd); free(path); return NULL; @@ -2084,7 +2112,7 @@ load_object(const char *name, const Obj_Entry *refobj, int flags) for (obj = obj_list->next; obj != NULL; obj = obj->next) if (obj->ino == sb.st_ino && obj->dev == sb.st_dev) break; - if (obj != NULL) { + if (obj != NULL && name != NULL) { object_add_name(obj, name); free(path); close(fd); @@ -2118,7 +2146,7 @@ do_load_object(int fd, const char *name, char *path, struct stat *sbp, */ if (dangerous_ld_env) { if (fstatfs(fd, &fs) != 0) { - _rtld_error("Cannot fstatfs \"%s\"", path); + _rtld_error("Cannot fstatfs \"%s\"", printable_path(path)); return NULL; } if (fs.f_flags & MNT_NOEXEC) { @@ -2126,12 +2154,17 @@ do_load_object(int fd, const char *name, char *path, struct stat *sbp, return NULL; } } - dbg("loading \"%s\"", path); - obj = map_object(fd, path, sbp); + dbg("loading \"%s\"", printable_path(path)); + obj = map_object(fd, printable_path(path), sbp); if (obj == NULL) return NULL; - object_add_name(obj, name); + /* + * If DT_SONAME is present in the object, digest_dynamic2 already + * added it to the object names. + */ + if (name != NULL) + object_add_name(obj, name); obj->path = path; digest_dynamic(obj, 0); if (obj->z_noopen && (flags & (RTLD_LO_DLOPEN | RTLD_LO_TRACE)) == @@ -2703,6 +2736,20 @@ dlerror(void) void * dlopen(const char *name, int mode) +{ + + return (rtld_dlopen(name, -1, mode)); +} + +void * +fdlopen(int fd, int mode) +{ + + return (rtld_dlopen(NULL, fd, mode)); +} + +static void * +rtld_dlopen(const char *name, int fd, int mode) { RtldLockState lockstate; int lo_flags; @@ -2724,7 +2771,7 @@ dlopen(const char *name, int mode) if (ld_tracing != NULL) lo_flags |= RTLD_LO_TRACE; - return (dlopen_object(name, obj_main, lo_flags, + return (dlopen_object(name, fd, obj_main, lo_flags, mode & (RTLD_MODEMASK | RTLD_GLOBAL))); } @@ -2739,7 +2786,8 @@ dlopen_cleanup(Obj_Entry *obj) } static Obj_Entry * -dlopen_object(const char *name, Obj_Entry *refobj, int lo_flags, int mode) +dlopen_object(const char *name, int fd, Obj_Entry *refobj, int lo_flags, + int mode) { Obj_Entry **old_obj_tail; Obj_Entry *obj; @@ -2754,11 +2802,11 @@ dlopen_object(const char *name, Obj_Entry *refobj, int lo_flags, int mode) old_obj_tail = obj_tail; obj = NULL; - if (name == NULL) { + if (name == NULL && fd == -1) { obj = obj_main; obj->refcount++; } else { - obj = load_object(name, refobj, lo_flags); + obj = load_object(name, fd, refobj, lo_flags); } if (obj) { @@ -4377,6 +4425,10 @@ rtld_verify_object_versions(Obj_Entry *obj) const Obj_Entry *depobj; int maxvernum, vernum; + if (obj->ver_checked) + return (0); + obj->ver_checked = true; + maxvernum = 0; /* * Walk over defined and required version records and figure out diff --git a/libexec/rtld-elf/rtld.h b/libexec/rtld-elf/rtld.h index 3870177eea..718cf0e7ce 100644 --- a/libexec/rtld-elf/rtld.h +++ b/libexec/rtld-elf/rtld.h @@ -228,6 +228,7 @@ typedef struct Struct_Obj_Entry { bool mainprog : 1; /* True if this is the main program */ bool rtld : 1; /* True if this is the dynamic linker */ bool relocated : 1; /* True if processed by relocate_objects() */ + bool ver_checked : 1; /* True if processed by rtld_verify_object_versions */ bool textrel : 1; /* True if there are relocations to text seg */ bool symbolic : 1; /* True if generated with "-Bsymbolic" */ bool bind_now : 1; /* True if all relocations should be made first */ diff --git a/sbin/ip6fw/ip6fw.c b/sbin/ip6fw/ip6fw.c index 0d0ddf3e81..751aade7b3 100644 --- a/sbin/ip6fw/ip6fw.c +++ b/sbin/ip6fw/ip6fw.c @@ -1176,7 +1176,7 @@ ip6fw_main(int ac, char **av) do_force = !isatty(STDIN_FILENO); while ((ch = getopt(ac, av ,"afqtN")) != -1) - switch(ch) { + switch(ch) { case 'a': do_acct=1; break; @@ -1194,7 +1194,7 @@ ip6fw_main(int ac, char **av) break; default: show_usage(NULL); - } + } ac -= optind; if (*(av+=optind)==NULL) { diff --git a/share/examples/scsi_target/scsi_target.c b/share/examples/scsi_target/scsi_target.c index d59ceda151..5867fc00fe 100644 --- a/share/examples/scsi_target/scsi_target.c +++ b/share/examples/scsi_target/scsi_target.c @@ -110,7 +110,7 @@ main(int argc, char *argv[]) targ_fd = file_fd = kq_fd = -1; num_ctios = 0; sector_size = SECTOR_SIZE; - buf_size = DFLTPHYS; + buf_size = MAXPHYS; /* Prepare resource pools */ TAILQ_INIT(&pending_queue); diff --git a/share/man/man4/Makefile b/share/man/man4/Makefile index 096f38c77e..e559054a06 100644 --- a/share/man/man4/Makefile +++ b/share/man/man4/Makefile @@ -23,6 +23,7 @@ MAN= aac.4 \ ahci.4 \ ahd.4 \ aibs.4 \ + aic.4 \ alc.4 \ ale.4 \ alpm.4 \ diff --git a/share/man/man4/ahci.4 b/share/man/man4/ahci.4 index 9f9aa60b6c..32a0c2fd99 100644 --- a/share/man/man4/ahci.4 +++ b/share/man/man4/ahci.4 @@ -14,7 +14,7 @@ .\" TORTIOUS ACTION, ARISING OUT OF .\" PERFORMANCE OF THIS SOFTWARE. .\" -.Dd August 3, 2009 +.Dd April 7, 2012 .Dt AHCI 4 .Os .Sh NAME @@ -91,6 +91,12 @@ some devices might not properly implement. hint.ahci.force150=1 hint.ahci.nofeatures=1 .Ed +.Pp +By default, the driver will use MSI if it is supported. +This behavior can be turned off by setting the following tunable: +.Bd -literal -offset indent +hw.ahci.msi.enable=0 +.Ed .Sh SYSCTL VARIABLES Link power management can be set with the sysctl .Va hw.ahci%d.%d.link_pwr_mgmt diff --git a/share/man/man4/man4.i386/aic.4 b/share/man/man4/aic.4 similarity index 68% rename from share/man/man4/man4.i386/aic.4 rename to share/man/man4/aic.4 index eff9df3d49..a6892e4212 100644 --- a/share/man/man4/man4.i386/aic.4 +++ b/share/man/man4/aic.4 @@ -21,48 +21,24 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $FreeBSD: src/share/man/man4/man4.i386/aic.4,v 1.6.2.3 2001/07/21 09:16:51 schweikh Exp $ +.\" $FreeBSD: src/share/man/man4/man4.i386/aic.4,v 1.16 2005/01/21 08:36:38 ru Exp $ .\" -.Dd November 8, 2003 -.Dt AIC 4 i386 +.Dd March 31, 2012 +.Dt AIC 4 .Os .Sh NAME .Nm aic .Nd Adaptec AIC-6260 and AIC-6360 SCSI driver .Sh SYNOPSIS -.Cd "device aic0 at isa? port 0x340 irq 11" +.Cd "device aic" .Sh DESCRIPTION The .Nm -driver provides support for the Adaptec AIC-6260 and AIC-6360 SCSI +driver provides support for the Adaptec AHA-1460, AHA-1460B, AHA-1460C, and +AHA-1460D PC Card adapters based on the Adaptec AIC-6260 and AIC-6360 SCSI controller chips. Many systems that use these controller chips do not have a boot ROM and therefore cannot be booted from. -.Sh HARDWARE -The adapters supported by the -.Nm -driver include: -.Pp -.Bl -bullet -compact -.It -Adaptec AHA-1505 (ISA) -.It -Adaptec AHA-1510A, AHA-1510B (ISA) -.It -Adaptec AHA-1520A, AHA-1520B (ISA) -.It -Adaptec AHA-1522A, AHA-1522B (ISA) -.It -Adaptec AHA-1535 (ISA) -.It -Creative Labs SoundBlaster SCSI host adapter (ISA) -.It -Adaptec AHA-1460, AHA-1460B, AHA-1460C, AHA-1460D (PC Card) -.It -Adaptec AHA-1030B, AHA-1030P (PC98) -.It -NEC PC-9801-100 (PC98) -.El .Sh SEE ALSO .Xr ahc 4 , .Xr cd 4 , @@ -74,5 +50,3 @@ NEC PC-9801-100 (PC98) The driver does not work well with multiple devices on the SCSI bus. The driver works well with devices like CDROMs and Tape drives. The driver works not so well with disk drives. -The PC Card version appears to work better than the ISA version, but -that may be due to differing levels of testing of the devices. diff --git a/share/man/man4/arcmsr.4 b/share/man/man4/arcmsr.4 index 3c498eef0b..3711495fae 100644 --- a/share/man/man4/arcmsr.4 +++ b/share/man/man4/arcmsr.4 @@ -24,7 +24,7 @@ .\" .\" $FreeBSD: src/share/man/man4/arcmsr.4,v 1.6 2008/03/28 23:25:58 brueffer Exp $ .\" -.Dd September 6, 2010 +.Dd April 7, 2012 .Dt ARCMSR 4 .Os .Sh NAME @@ -65,6 +65,12 @@ A management interface is also present via the .Pa /dev/arcmsr? device node. Management tools for i386 and amd64 are available from Areca. +.Sh LOADER TUNABLES +.Bl -tag -width indent +.It Va hw.arcmsr.msi.enable +By default, the driver will use MSI if it is supported. +This behavior can be turned off by setting this tunable to 0. +.El .Sh HARDWARE The .Nm diff --git a/share/man/man4/bce.4 b/share/man/man4/bce.4 index 61363ad60c..570edf6b98 100644 --- a/share/man/man4/bce.4 +++ b/share/man/man4/bce.4 @@ -27,9 +27,8 @@ .\" THE POSSIBILITY OF SUCH DAMAGE. .\" .\" $FreeBSD: src/share/man/man4/bce.4,v 1.7 2007/02/09 18:26:13 brueffer Exp $ -.\" $DragonFly: src/share/man/man4/bce.4,v 1.5 2008/07/22 11:49:22 sephe Exp $ .\" -.Dd May 29, 2008 +.Dd April 7, 2012 .Dt BCE 4 .Os .Sh NAME @@ -185,6 +184,9 @@ How often status block should be updated by the device during host interrupt processing, due to receiving packets. Default value is 18 (microseconds). +.It Va hw.bce.msi.enable +By default, the driver will use MSI if it is supported. +This behavior can be turned off by setting this tunable to 0. .El .Sh HARDWARE The diff --git a/share/man/man4/em.4 b/share/man/man4/em.4 index 2f99fb5757..1321499c26 100644 --- a/share/man/man4/em.4 +++ b/share/man/man4/em.4 @@ -30,9 +30,8 @@ .\" * Other names and brands may be claimed as the property of others. .\" .\" $FreeBSD: src/share/man/man4/em.4,v 1.30 2008/10/06 21:55:53 simon Exp $ -.\" $DragonFly: src/share/man/man4/em.4,v 1.12 2008/07/11 10:38:50 thomas Exp $ .\" -.Dd February 27, 2009 +.Dd April 7, 2012 .Dt EM 4 .Os .Sh NAME @@ -221,6 +220,9 @@ If is not used on the hardware and the major part of the transmitted data are bulk data, this value could safely be set to 1/2 of the number of transmit descriptors. +.It Va hw.em.msi.enable +By default, the driver will use MSI if it is supported. +This behavior can be turned off by setting this tunable to 0. .El .Sh DIAGNOSTICS .Bl -diag diff --git a/share/man/man4/isa.4 b/share/man/man4/isa.4 index 9a72df01e9..751b88d553 100644 --- a/share/man/man4/isa.4 +++ b/share/man/man4/isa.4 @@ -60,8 +60,6 @@ Note that not all architectures support all devices. .Bl -tag -width 12n -offset indent -compact .It Xr adv 4 Advansys SCSI host adapter driver -.It Xr aic 4 -Adaptec AIC-6260 and AIC-6360 SCSI driver .It Xr bt 4 Buslogic/Mylex MultiMaster SCSI host adapter driver .It Xr stg 4 diff --git a/share/man/man4/isp.4 b/share/man/man4/isp.4 index 6ca513095a..93349e59ac 100644 --- a/share/man/man4/isp.4 +++ b/share/man/man4/isp.4 @@ -29,7 +29,7 @@ .\" .\" $FreeBSD: src/share/man/man4/isp.4,v 1.29 2010/10/08 12:40:16 uqs Exp $ .\" -.Dd January 3, 2012 +.Dd April 7, 2012 .Dt ISP 4 .Os .Sh NAME @@ -198,6 +198,12 @@ A hint value for a driver debug level (see the file .Pa /usr/src/sys/dev/isp/ispvar.h for the values. .El +.Pp +By default, the driver will use MSI if it is supported. +This behavior can be turned off by setting the following tunable: +.Bd -literal -offset indent +hw.isp.msi.enable=0 +.Ed .Sh SYSCTL OPTIONS .Bl -tag -width indent .It Va dev.isp.N.loop_down_limit diff --git a/share/man/man4/jme.4 b/share/man/man4/jme.4 index ca3bc29528..b2c0c0f8fd 100644 --- a/share/man/man4/jme.4 +++ b/share/man/man4/jme.4 @@ -23,9 +23,8 @@ .\" SUCH DAMAGE. .\" .\" $FreeBSD: src/share/man/man4/jme.4,v 1.1 2008/05/27 01:59:17 yongari Exp $ -.\" $DragonFly: src/share/man/man4/jme.4,v 1.3 2008/07/27 19:38:58 swildner Exp $ .\" -.Dd July 26, 2008 +.Dd April 7, 2012 .Dt JME 4 .Os .Sh NAME @@ -101,6 +100,12 @@ The .Nm driver supports .Xr polling 4 . +.Ss Loader Tunables +By default, the driver will use MSI if it is supported. +This behavior can be turned off by setting the following tunable: +.Bd -literal -offset indent +hw.jme.msi.enable=0 +.Ed .Ss MIB Variables A number of per-interface variables are implemented in the .Va hw.jme Ns Em X diff --git a/share/man/man4/man4.i386/Makefile b/share/man/man4/man4.i386/Makefile index 92cfe352d0..b24cb7ca01 100644 --- a/share/man/man4/man4.i386/Makefile +++ b/share/man/man4/man4.i386/Makefile @@ -1,6 +1,6 @@ # $FreeBSD: src/share/man/man4/man4.i386/Makefile,v 1.122.2.12 2003/04/15 17:23:32 fjoe Exp $ -MAN= aic.4 apm.4 ar.4 \ +MAN= apm.4 ar.4 \ cs.4 cy.4 \ digi.4 en.4 ep.4 ex.4 fe.4 glxsb.4 \ io.4 linux.4 lnc.4 longrun.4 \ diff --git a/share/man/man4/mfi.4 b/share/man/man4/mfi.4 index ffad85e590..6d0e796345 100644 --- a/share/man/man4/mfi.4 +++ b/share/man/man4/mfi.4 @@ -24,7 +24,7 @@ .\" .\" $FreeBSD: src/share/man/man4/mfi.4,v 1.13 2010/05/12 17:12:38 brueffer Exp $ .\" -.Dd August 11, 2011 +.Dd April 7, 2012 .Dt MFI 4 .Os .Sh NAME @@ -86,6 +86,12 @@ If the sysctl .Va dev.mfi.%d.delete_busy_volumes is set to 1, then the driver will allow mounted volumes to be removed. +.Sh LOADER TUNABLES +.Bl -tag -width indent +.It Va hw.mfi.msi.enable +By default, the driver will use MSI if it is supported. +This behavior can be turned off by setting this tunable to 0. +.El .Sh HARDWARE The .Nm @@ -127,6 +133,22 @@ Dell PERC5 .It Dell PERC6 .It +Dell PERC H710 Embedded +.It +Dell PERC H710 Adapter +.It +Dell PERC H710 Mini (blades) +.It +Dell PERC H710 Mini (monolithics) +.It +Dell PERC H710P Adapter +.It +Dell PERC H710P Mini (blades) +.It +Dell PERC H710P Mini (monolithics) +.It +Dell PERC H810 Adapter +.It IBM ServeRAID M1015 SAS/SATA .It IBM ServeRAID M5015 SAS/SATA @@ -134,6 +156,10 @@ IBM ServeRAID M5015 SAS/SATA IBM ServeRAID-MR10i .It Intel RAID Controller SROMBSAS18E +.It +Intel RAID Controller RS25DB080 +.It +Intel RAID Controller RS25NB008 .El .Sh FILES .Bl -tag -width ".Pa /dev/mfisyspd?" -compact diff --git a/share/man/man4/snd_hda.4 b/share/man/man4/snd_hda.4 index 5f0970d643..6ce4e602b6 100644 --- a/share/man/man4/snd_hda.4 +++ b/share/man/man4/snd_hda.4 @@ -23,9 +23,8 @@ .\" SUCH DAMAGE. .\" .\" $FreeBSD: src/share/man/man4/snd_hda.4,v 1.10.2.1 2007/05/15 18:40:22 joel Exp $ -.\" $DragonFly: src/share/man/man4/snd_hda.4,v 1.2 2007/06/16 17:44:33 hasso Exp $ .\" -.Dd May 5, 2007 +.Dd April 7, 2012 .Dt SND_HDA 4 .Os .Sh NAME @@ -89,6 +88,12 @@ Polling is disabled by default. Do not enable it unless you are facing weird interrupt problems or if the device cannot generate interrupts at all. .El +.Sh LOADER TUNABLES +.Bl -tag -width indent +.It Va hw.snd.hdac.msi.enable +By default, the driver will use MSI if it is supported. +This behavior can be turned off by setting this tunable to 0. +.El .Sh HARDWARE The .Nm diff --git a/share/man/man9/dsched.9 b/share/man/man9/dsched.9 index 1597a8e9aa..5d61aa941e 100644 --- a/share/man/man9/dsched.9 +++ b/share/man/man9/dsched.9 @@ -338,8 +338,8 @@ the .Fa done routine can also calculate the time passed from dispatch to completion by getting the current time again (via -.Fn getmicrotime ) and -calculating the timeval difference to the value stored in +.Fn getmicrotime ) +and calculating the timeval difference to the value stored in .Fa bio->bio_caller_info3.tv . At the end of the .Fa done diff --git a/share/man/man9/physio.9 b/share/man/man9/physio.9 index 3a08a86394..4cc6b51760 100644 --- a/share/man/man9/physio.9 +++ b/share/man/man9/physio.9 @@ -104,7 +104,7 @@ and functions is determined by the maximum I/O size supported by the device .Fa dev , otherwise the value of -.Dv DFLTPHYS +.Dv MAXPHYS is used. Until the I/O operation is complete, the calling process or thread is put to sleep with the wait message set to diff --git a/share/misc/pci_vendors b/share/misc/pci_vendors index f2a8ba7279..27618a6db0 100644 --- a/share/misc/pci_vendors +++ b/share/misc/pci_vendors @@ -1,8 +1,8 @@ # # List of PCI ID's # -# Version: 2012.02.27 -# Date: 2012-02-27 03:15:01 +# Version: 2012.04.04 +# Date: 2012-04-04 03:15:01 # # Maintained by Martin Mares and other volunteers from the # PCI ID Project at http://pci-ids.ucw.cz/. @@ -383,6 +383,7 @@ 1028 1f35 PERC H710 Adapter 1028 1f37 PERC H710 Mini (for blades) 1028 1f38 PERC H710 Mini (for monolithics) + 8086 3513 RMS25PB080 RAID Controller 005c SAS1064A PCI-X Fusion-MPT SAS 005d MegaRAID SAS-3 3108 [Invader] 005e SAS1066 PCI-X Fusion-MPT SAS @@ -500,6 +501,7 @@ 0085 SAS2208 PCI-Express Fusion-MPT SAS-2 0086 SAS2308 PCI-Express Fusion-MPT SAS-2 0087 SAS2308 PCI-Express Fusion-MPT SAS-2 + 1590 0044 H220i 008f 53c875J 1092 8000 FirePort 40 SCSI Controller 1092 8760 FirePort 40 Dual SCSI Host Adapter @@ -1486,6 +1488,7 @@ 5e6d RV410 [Radeon X700 (PCIE)] (Secondary) 148c 2117 PowerColor Bravo X700 5f57 R423 [Radeon X800XT (PCIE)] + 6707 Cayman LE GL [FirePro V5900] 6718 Cayman XT [Radeon HD 6970] 6719 Cayman PRO [Radeon HD 6950] 671d Antilles [AMD Radeon HD 6990] @@ -1498,6 +1501,7 @@ 6741 Whistler [AMD Radeon HD 6600M Series] 6742 Whistler LE [AMD Radeon HD 6625M Graphics] 6743 Whistler [Radeon E6760] + 6749 Turks [FirePro V4900] 6750 Turks [AMD Radeon HD 6570] 6751 Turks [Radeon HD 7600A Series] 6758 Turks [Radeon HD 6670] @@ -1516,6 +1520,9 @@ 6798 Tahiti XT [Radeon HD 7970] 6799 New Zealand [Radeon HD 7990] 679a Tahiti PRO [Radeon HD 7950] + 6800 WIMBLEDON XT [Radeon HD 7970M] + 6818 PITCAIRN [Radeon HD 7800] + 6819 PITCAIRN PRO [Radeon HD 7800 Series] 6840 Thames XT/GL [Radeon HD 7600M Series] 6841 Thames [Radeon 7500M/7600M Series] 6843 Thames [Radeon HD 7670M] @@ -2275,7 +2282,7 @@ 1014 033b PCIe2 6Gb SAS RAID Adapter Quad-port (57B4) 1014 0355 PCIe2 3.6GB Cache 6Gb SAS RAID Adapter Quad-port (57B1) 1014 0357 PCIe2 6Gb SAS Adapter Quad-port (57C6) - 1014 035d PCIe2 3.6GB Cache 6Gb SAS RAID & SSD Adapter (575D) + 1014 035d PCIe3 1.8GB Cache RAID SAS Adapter Quad-port 6GB (57C8) 1014 035e PCIe2 3.6GB Cache 6Gb SAS RAID Adapter Quad-port (57CE) 3022 QLA3022 Network Adapter 4022 QLA3022 Network Adapter @@ -2703,7 +2710,7 @@ 00cf AIC-7899P U160/m 1028 0106 PowerEdge 4600 1028 0121 PowerEdge 2650 -102b Matrox Graphics, Inc. +102b Matrox Electronics Systems Ltd. # DJ: I've a suspicion that 0010 is a duplicate of 0d10. 0010 MGA-I [Impression?] 0100 MGA 1064SG [Mystique] @@ -2944,10 +2951,46 @@ 102b 0101 Millenium P690 PCI 102b 0140 Millenium P690 LP PCIe x1 102b 0180 Display Wall IP Decode 128 MB + 4164 Morphis QxT frame grabber + 43b4 Morphis Qxt encoding engine + 4510 Morphis COM port 4536 VIA Framegrabber - 4cdc Morphis Vision System Jpeg2000 - 4fc5 Morphis Vision System - 5e10 Morphis Vision System Aux/IO + 4686 Concord GX (customized Intel 82541) + 475b Solios eCL/XCL-B frame grabber + 475d Vio frame grabber family + 102b 4b90 Vio Duo frame grabber (single channel) + 102b 4b91 Vio Duo frame grabber + 102b 4b92 Vio Analog frame grabber + 102b 4b93 Vio SDI Frame Grabber + 102b 4b94 Vio DVI-A frame grabber + 475f Solios (single-Full) CL frame grabber + 102b 475f Solios eCL/XCL-F frame grabber + 102b 4d5f Solios eV-CL (single-Full) frame grabber + 102b 4e5f Solios eM-CL (single-Full) frame grabber + 47a1 Solios eA/XA frame grabber + 102b 4be0 Solios eA/XA (single) frame grabber + 102b 4be1 Solios eA/XA (dual) frame grabber + 102b 4be2 Solios eA/XA (quad) frame grabber + 47a2 Solios COM port + 47c1 Solios (dual-Base/single-Medium) CL frame grabber + 102b 0000 Solios frame grabber + 102b 4b80 Solios eCL/XCL (single-Medium) frame grabber + 102b 4b81 Solios eCL/XCL (dual-Base) frame grabber + 102b 4d80 Solios eV-CL (single-Medium) frame grabber + 102b 4d81 Solios eV-CL (dual-Base) frame grabber + 102b 4e80 Solios eM-CL (single-Medium) frame grabber + 102b 4e81 Solios eM-CL (dual-Base) frame grabber + 47c2 Solios COM port + 4949 Radient frame grabber family + 102b 0010 Radient eCL (Single-full) frame grabber + 102b 0020 Radient eCL (Dual-base) frame grabber + 102b 0030 Radient eCL (Dual-full) frame grabber + 102b 0040 Radient eCL (Quad-base) frame grabber + 102b 0050 Radient eCL (Golden) frame grabber + 4cdc Morphis JPEG2000 accelerator + 4f54 Morphis (e)Quad frame grabber + 4fc5 Morphis (e)Dual frame grabber + 5e10 Morphis aux I/O 6573 Shark 10/100 Multiport SwitchNIC 102c Chips and Technologies 00b8 F64310 @@ -4910,6 +4953,9 @@ 8664 PEX 8664 64-lane, 16-Port PCI Express Gen 2 (5.0 GT/s) Switch 8680 PEX 8680 80-lane, 20-Port PCI Express Gen 2 (5.0 GT/s) Multi-Root Switch 8696 PEX 8696 96-lane, 24-Port PCI Express Gen 2 (5.0 GT/s) Multi-Root Switch + 8732 PEX 8732 32-lane, 8-Port PCI Express Gen 3 (8.0 GT/s) Switch +# This is the Non-Transparent-Bridge Virtualized Port as presented by the PLX PEX 8732 chip, the physical bridges show up at 10b5:8732 + 87b0 PEX 8732 32-lane, 8-Port PCI Express Gen 3 (8.0 GT/s) Switch 9016 PLX 9016 8-port serial controller 9030 PCI9030 32-bit 33MHz PCI <-> IOBus Bridge 10b5 2695 Hilscher CIF50-PB Profibus Master Board @@ -6890,7 +6936,8 @@ 19da a123 IONITX-F-E 087e ION LE VGA 087f ION LE VGA - 08a4 GT216 [GeForce 320M] + 08a3 MCP89 [GeForce 320M] + 08a4 MCP89 [GeForce 320M] 0a20 GT216 [GeForce GT 220] 1043 8311 ENGT220/DI/1GD3(LP)/V2 0a23 GT218 [GeForce 210] @@ -7055,15 +7102,18 @@ 0df2 GF108 [GeForce GT 435M] 0df4 GF108 [GeForce GT 540M] 0df5 GF108 [GeForce GT 540M] + 0df7 GF108 [GeForce GT 520M] 0df8 GF108 [Quadro 600] 0dfa GF108 [Quadro 1000M] 0e08 HDMI Audio stub 0e09 GF110 High Definition Audio Controller + 0e0a GK104 [Geforce GTX680] 0e0c GF110 High Definition Audio Controller 0e22 GF104 [GeForce GTX 460] 1462 2322 N460GTX Cyclone 1GD5/OC 0e3a GF104 [Quadro 3000M] 0e3b GF104 [Quadro 4000M] + 0fd2 GK107 [GeForce GT 640M] 1040 GF119 [GeForce GT 520] 1050 GF119 [GeForce GT 520M] 1051 GF119 [GeForce GT 520MX] @@ -7081,6 +7131,7 @@ 10de 066d G98 [GeForce 8400GS] 10c5 Dell M116N [GeForce 405] 10d8 GT218 [NVS 300] + 1180 GK104 [GeForce GTX 680] 1200 GF110 [GeForce GTX 560 Ti] 1201 GF114 [GeForce GTX 560] 1205 GF114 [GeForce GTX 460 v2] @@ -7233,8 +7284,9 @@ 0885 Realtek 885 High Definition Audio 0888 Realtek 888 High Definition Audio 1028 020d Inspiron 530 - 5209 RTS5116 PCI Express Card Reader - 5288 PCI Express Card Reader + 5209 RTS5209 PCI Express Card Reader + 5229 RTS5229 PCI Express Card Reader + 5288 Barossa PCI Express Card Reader 8029 RTL-8029(AS) 10b8 2011 EZ-Card (SMC1208) 10ec 8029 RTL-8029(AS) @@ -7362,11 +7414,11 @@ 0007 Default PCIe endpoint ID 0205 Wildcard TE205P 0210 Wildcard TE210P - 0300 Active Silicon Phoenix Frame Grabbers + 0300 Spartan 3 Designs (Xilinx IP) 0314 Wildcard TE405P/TE410P (1st Gen) 0405 Wildcard TE405P (2nd Gen) 0410 Wildcard TE410P (2nd Gen) - 0600 Active Silicon Firebird Frame Grabbers + 0600 Xilinx 6 Designs (Xilinx IP) 2b00 Zomojo Zcard 3fc0 RME Digi96 3fc1 RME Digi96/8 @@ -7525,6 +7577,12 @@ 2340 RocketRAID 2340 16 Port SATA-II Controller 2640 RocketRAID 2640 SAS/SATA Controller 2722 RocketRAID 2722 +# SFF-8087 Mini-SAS 16 port internal + 2740 RocketRAID 2740 +# SFF-8088 Mini-SAS 16 port external + 2744 RocketRaid 2744 +# SFF-8088 8 port external / SFF-8087 24 port internal + 2782 RocketRAID 2782 3120 RocketRAID 3120 3220 RocketRAID 3220 3320 RocketRAID 3320 @@ -9165,6 +9223,7 @@ 1028 040b Latitude E6510 e832 R5C832 PCIe IEEE 1394 Controller 1028 040b Latitude E6510 + e852 PCIe xD-Picture Card Controller 1181 Telmatics International 1183 Fujikura Ltd 1184 Forks Inc @@ -9464,6 +9523,7 @@ 4368 88EC034 Ethernet Controller 4369 88EC042 Ethernet Controller 436a 88E8058 PCI-E Gigabit Ethernet Controller + 11ab 00ba Imac 8,1 Wired Ethernet Adapter 436b 88E8071 PCI-E Gigabit Ethernet Controller 436c 88E8072 PCI-E Gigabit Ethernet Controller 436d 88E8055 PCI-E Gigabit Ethernet Controller @@ -9906,6 +9966,7 @@ 1217 O2 Micro, Inc. 00f7 Firewire (IEEE 1394) 1179 ff50 Satellite P305D-S8995E + 10f7 1394 OHCI Compliant Host Controller 11f7 OZ600 1394a-2000 Controller 13f7 1394 OHCI Compliant Host Controller 6729 OZ6729 @@ -9943,6 +10004,8 @@ 103c 0890 NC6000 laptop 10cf 11c4 Lifebook P5020D Laptop 7233 OZ711MP3/MS3 4-in-1 MemoryCardBus Controller + 8120 Integrated MMC/SD Controller + 8130 Integrated MS/MSPRO/xD Controller 8321 Integrated MMC/SD controller 8331 O2 Flash Memory Card 1218 Hybricon Corp. @@ -9994,7 +10057,7 @@ 0057 Voodoo 3/3000 [Avenger] 121b Advanced Telecommunications Modules 121c Nippon Texaco., Ltd -121d Lippert Automationstechnik GmbH +121d LiPPERT ADLINK Technology GmbH 121e CSPI 0201 Myrinet 2000 Scalable Cluster Interconnect 121f Arcus Technology, Inc. @@ -12399,9 +12462,16 @@ 167f NetLink BCM5787F Fast Ethernet PCI Express 1680 NetXtreme BCM5761e Gigabit Ethernet PCIe 1681 NetXtreme BCM5761 Gigabit Ethernet PCIe + 1682 NetXtreme BCM57762 Gigabit Ethernet PCIe 1684 NetXtreme BCM5764M Gigabit Ethernet PCIe 1685 NetXtreme II BCM57500S Gigabit Ethernet - 168a NetXtreme II BCM57800 10 Gigabit Ethernet + 1686 NetXtreme BCM57766 Gigabit Ethernet PCIe +# The Broadcom 57800 device has two 1Gig ports and two 10Gig ports. The subsystem information can be used to differentiate. + 168a NetXtreme II BCM57800 1/10 Gigabit Ethernet + 1028 1f5c BCM57800 10-Gigabit Ethernet + 1028 1f5d BCM57800 10-Gigabit Ethernet + 1028 1f67 BCM57800 1-Gigabit Ethernet + 1028 1f68 BCM57800 1-Gigabit Ethernet 168d NetXtreme II BCM57840 10/20 Gigabit Ethernet 168e NetXtreme II BCM57810 10 Gigabit Ethernet 1690 NetXtreme BCM57760 Gigabit Ethernet PCIe @@ -12427,7 +12497,12 @@ 1462 590c KT6 Delta-FIS2R (MS-6590) 169d NetLink BCM5789 Gigabit Ethernet PCI Express 16a0 NetLink BCM5785 Fast Ethernet - 16a5 NetXtreme II BCM57800 10 Gigabit Ethernet Multi Function +# The Broadcom 57800 device has two 1Gig ports and two 10Gig ports. The subsystem information can be used to differentiate. + 16a5 NetXtreme II BCM57800 1/10 Gigabit Ethernet Multi Function + 1028 1f5c NetXtreme II BCM57800 10-Gigabit Ethernet Multi Function + 1028 1f5d NetXtreme II BCM57800 10-Gigabit Ethernet Multi Function + 1028 1f67 NetXtreme II BCM57800 1-Gigabit Ethernet Multi Function + 1028 1f68 NetXtreme II BCM57800 1-Gigabit Ethernet Multi Function 16a6 NetXtreme BCM5702X Gigabit Ethernet 0e11 00bb NC7760 Gigabit Server Adapter (PCI-X, 10/100/1000-T) 1028 0126 BCM5702 1000Base-T @@ -12446,7 +12521,12 @@ 10a9 8014 Dual Port Gigabit Ethernet (PCI-X,Fiber) 10a9 801c Quad Port Gigabit Ethernet (PCI-E,Fiber) 10b7 2001 3C998-SX Dual Port 1000-SX PCI-X - 16a9 NetXtreme II BCM57800 10 Gigabit Ethernet Virtual Function +# The Broadcom 57800 device has two 1Gig ports and two 10Gig ports. The subsystem information can be used to differentiate. + 16a9 NetXtreme II BCM57800 1/10 Gigabit Ethernet Virtual Function + 1028 1f5c NetXtreme II BCM57800 10-Gigabit Ethernet Virtual Function + 1028 1f5d NetXtreme II BCM57800 10-Gigabit Ethernet Virtual Function + 1028 1f67 NetXtreme II BCM57800 1-Gigabit Ethernet Virtual Function + 1028 1f68 NetXtreme II BCM57800 1-Gigabit Ethernet Virtual Function 16aa NetXtreme II BCM5706S Gigabit Ethernet 103c 3102 NC370F MultifuNCtion Gigabit Server Adapter 103c 310c NC370i Multifunction Gigabit Server Adapter @@ -12465,9 +12545,11 @@ 16b0 NetXtreme BCM57761 Gigabit Ethernet PCIe 16b1 NetLink BCM57781 Gigabit Ethernet PCIe 16b2 NetLink BCM57791 Gigabit Ethernet PCIe + 16b3 NetXtreme BCM57786 Gigabit Ethernet PCIe 16b4 NetXtreme BCM57765 Gigabit Ethernet PCIe 16b5 NetLink BCM57785 Gigabit Ethernet PCIe 16b6 NetLink BCM57795 Gigabit Ethernet PCIe + 16b7 NetXtreme BCM57782 Gigabit Ethernet PCIe 16bc NetXtreme BCM57765 Memory Card Reader 16c6 NetXtreme BCM5702A3 Gigabit Ethernet 10b7 1100 3C1000B-T 10/100/1000 PCI @@ -13860,6 +13942,7 @@ 5702 PMC-SLX150-1M: Reconfigurable Spartan-6 FPGA with plug-in I/O 5801 XMC-VLX85 Reconfigurable Virtex-5 FPGA with plug-in I/O 5802 XMC-VLX110 Reconfigurable Virtex-5 FPGA with plug-in I/O + 5803 XMC-VSX95 Reconfigurable Virtex-5 FPGA with plug-in I/O 5804 XMC-VLX155 Reconfigurable Virtex-5 FPGA with plug-in I/O 5807 XMC-SLX150: Reconfigurable Spartan-6 FPGA with plug-in I/O 5808 XMC-SLX150-1M: Reconfigurable Spartan-6 FPGA with plug-in I/O @@ -14113,6 +14196,7 @@ 0200 RT2500 802.11g PCI [PC54G2] 0201 RT2500 Wireless 802.11bg 1043 130f WL-130g + 1186 3c00 DWL-G650X Wireless 11g CardBus Adapter 1371 001e CWC-854 Wireless-G CardBus Adapter 1371 001f CWM-854 Wireless-G Mini PCI Adapter 1371 0020 CWP-854 Wireless-G PCI Adapter @@ -14126,6 +14210,7 @@ 1814 2560 RT2500 Wireless 802.11bg 182d 9073 WL-115 Wireless Network PCI Adapter 185f 22a0 CN-WF513 Wireless Cardbus Adapter + 18eb 5312 Tornado 122 IEEE 802.11g PCI Card-EU 1948 3c00 C54RC v1 Wireless 11g CardBus Adapter 1948 3c01 C54Ri v1 Wireless 11g PCI Adapter 0300 Wireless Adapter Canyon CN-WF511 @@ -14154,7 +14239,7 @@ 0601 RT2800 802.11n PCI 1799 801c F5D8011 v3 802.11n N1 Wireless Notebook Card 187e 3412 NWD-310N 802.11n Wireless PCI Adapter - 0681 RT2860 Wireless 802.11n PCIe + 0681 RT2890 Wireless 802.11n PCIe 1458 e939 GN-WS30N-RH 802.11bgn Mini PCIe Card 0701 RT2760 Wireless 802.11n 1T/2R 1737 0074 WMP110 v2 802.11n RangePlus Wireless PCI Adapter @@ -14166,6 +14251,7 @@ 13bd 1057 GN-WS32L-RH Half-size Mini PCIe Card 3091 RT3091 Wireless 802.11n 1T/2R PCIe 3092 RT3092 Wireless 802.11n 2T/2R PCIe + 5360 RT5360 5390 RT5390 Wireless 802.11n 1T/1R PCIe 103c 1636 U98Z077.00 Half-size Mini PCIe Card 539f RT5390 [802.11 b/g/n 1T1R G-band PCI Express Single Chip] @@ -14545,6 +14631,7 @@ 0111 P1022 0118 P1013E 0119 P1013 + 0128 P1010 0400 P4080E 0401 P4080 0408 P4040E @@ -14640,6 +14727,8 @@ 8001 RapidFile 198a Nallatech Ltd. 1993 Innominate Security Technologies AG +1999 A-Logics + a900 AM-7209 Video Processor 199a Pulse-LINK, Inc. 199d Xsigo Systems 8209 Virtual NIC Device @@ -14746,11 +14835,11 @@ 1a76 Wavesat 1a77 Lightfleet Corporation 1a78 Virident Systems Inc. - 0031 Virident tachIOn Drive - 1a78 0034 tachIOn PCIe SSD [rev 3] - 1a78 0037 tachIOn PCIe SSD [rev 3D] - 1a78 0038 tachIOn PCIe SSD [rev 4] - 1a78 0039 tachIOn PCIe SSD [rev 4D] + 0031 Virident FlashMAX Drive + 1a78 0034 FlashMAX PCIe SSD [rev 3] + 1a78 0037 FlashMAX PCIe SSD [rev 3D] + 1a78 0038 FlashMAX PCIe SSD [rev 4] + 1a78 0039 FlashMAX PCIe SSD [rev 4D] 1a78 0040 FlashMAX PCIe SSD [LP Z1] 1a84 Commex Technologies 0001 Vulcan SP HT6210 10-Gigabit Ethernet (rev 02) @@ -14767,6 +14856,7 @@ 1ab6 CalDigit, Inc. 6201 RAID Card 1ab9 Espia Srl +1acc Point of View B.V 1ad7 Spectracom Corporation 8000 TSync-PCIe Time Code Processor 9100 TPRO-PCI-66U Timecode Reader/Generator @@ -14860,6 +14950,8 @@ 5308 BC-H08240A 8 port H.264 video and audio encoder / decoder 5310 BC-H16480A 16 port H.264 video and audio encoder / decoder 1bb5 Quantenna Communications, Inc. +1bbf Maxeler Technologies Ltd. + 0003 MAX3 1bf4 VTI Instruments Corporation 1c1c Symphony 0001 82C101 @@ -15397,6 +15489,8 @@ 1092 5a55 Viper II Z200 1092 5a57 Viper II Z200 ca00 SonicVibes +53c1 SC1-ALLEGRO + 0cd1 CD1-OPERA 5431 AuzenTech, Inc. 544c Teralogic Inc 0350 TL880-based HDTV/ATSC tuner @@ -16164,6 +16258,8 @@ 8086 0001 Gigabit CT2 Desktop Adapter 8086 a01f Gigabit CT Desktop Adapter e4bf 50c1 PC1-GROOVE + e4bf 50c2 PC2-LIMBO + 10d4 Matrox Concord GE (customized Intel 82574) 10d5 82571PT Gigabit PT Quad Port Server ExpressModule 10d6 82575GB Gigabit Network Connection 8086 10d6 Gigabit VT Quad Port Server Adapter @@ -16475,6 +16571,7 @@ 1511 82580 Gigabit SFP Connection 1514 82599EB 10 Gigabit KX4 Network Connection 8086 000b Ethernet X520 10GbE Dual Port KX4 Mezz + 1515 X540 Ethernet Controller Virtual Function 1516 82580 Gigabit Network Connection 8086 12b1 Ethernet Server Adapter I340-T2 8086 12b2 Ethernet Server Adapter I340-T2 @@ -16483,6 +16580,7 @@ 1518 82576NS SerDes Gigabit Network Connection 151c 82599EB 10 Gigabit TN Network Connection 108e 7b13 Dual 10GBASE-T LP + 1520 I350 Ethernet Controller Virtual Function 1521 I350 Gigabit Network Connection 1028 1f60 Intel GbE 4P I350crNDC 1028 1f62 Intel GbE 2P I350crNDC @@ -16519,7 +16617,7 @@ 1527 82580 Gigabit Fiber Network Connection 8086 0001 Ethernet Server Adapter I340-F4 8086 0002 Ethernet Server Adapter I340-F4 - 1528 Ethernet Controller 10 Gigabit X540-AT2 + 1528 Ethernet Controller 10-Gigabit X540-AT2 108e 7b14 Sun Dual Port 10 GbE PCIe 2.0 ExpressModule, Base-T 108e 7b15 Sun Dual Port 10 GbE PCIe 2.0 Low Profile Adapter, Base-T 8086 0001 Ethernet Converged Network Adapter X540-T2 @@ -16663,70 +16761,70 @@ 1c5d 6 Series/C200 Series Chipset Family LPC Controller 1c5e 6 Series/C200 Series Chipset Family LPC Controller 1c5f 6 Series/C200 Series Chipset Family LPC Controller - 1d00 X79 series chipset 4-Port SATA IDE Controller - 1d02 X79 series chipset 6-Port SATA AHCI Controller - 1d04 X79 series chipset SATA RAID Controller - 1d06 Patsburg SATA Premium RAID Controller - 1d08 X79 series chipset 2-Port SATA IDE Controller - 1d10 X79 series chipset PCI Express Root Port 1 - 1d11 X79 series chipset PCI Express Root Port 1 - 1d12 X79 series chipset PCI Express Root Port 2 - 1d13 X79 series chipset PCI Express Root Port 2 - 1d14 X79 series chipset PCI Express Root Port 3 - 1d15 X79 series chipset PCI Express Root Port 3 - 1d16 X79 series chipset PCI Express Root Port 4 - 1d17 X79 series chipset PCI Express Root Port 4 - 1d18 X79 series chipset PCI Express Root Port 5 - 1d19 X79 series chipset PCI Express Root Port 5 - 1d1a X79 series chipset PCI Express Root Port 6 - 1d1b X79 series chipset PCI Express Root Port 6 - 1d1c X79 series chipset PCI Express Root Port 7 - 1d1d X79 series chipset PCI Express Root Port 7 - 1d1e X79 series chipset PCI Express Root Port 8 - 1d1f X79 series chipset PCI Express Root Port 8 - 1d20 X79 series chipset High Definition Audio Controller - 1d22 X79 series chipset SMBus Host Controller - 1d24 X79 series chipset Thermal Management Controller - 1d25 X79 series chipset DMI to PCI Bridge - 1d26 X79 series chipset USB2 Enhanced Host Controller #1 - 1d2d X79 series chipset USB2 Enhanced Host Controller #2 - 1d33 X79 series chipset LAN Controller - 1d35 Patsburg VECI Controller - 1d3a X79 series chipset HECI Controller #2 - 1d3b X79 series chipset IDE-r Controller - 1d3d X79 series chipset KT Controller - 1d3e Patsburg PCI Express Virtual Root Port - 1d3f Patsburg PCI Express Virtual Switch Port - 1d40 X79 series chipset LPC Controller - 1d41 X79 series chipset LPC Controller - 1d50 Patsburg Dual 4-Port SATA/SAS Storage Control Unit - 1d54 Patsburg Dual 4-Port SATA/SAS Storage Control Unit - 1d55 X79 series chipset 4-Port SATA/SAS Storage Control Unit - 1d58 Patsburg Dual 4-Port SATA/SAS Storage Control Unit - 1d59 X79 series chipset 4-Port SATA/SAS Storage Control Unit - 1d5a Patsburg Dual 4-Port SATA Storage Control Unit - 1d5b Patsburg 4-Port SATA Storage Control Unit - 1d5c Patsburg Dual 4-Port SATA/SAS Storage Control Unit - 1d5d Patsburg 4-Port SATA/SAS Storage Control Unit - 1d5e Patsburg Dual 4-Port SATA Storage Control Unit - 1d5f Patsburg 4-Port SATA Storage Control Unit - 1d60 Patsburg Dual 4-Port SATA/SAS Storage Control Unit - 1d64 Patsburg Dual 4-Port SATA/SAS Storage Control Unit - 1d65 X79 series chipset 4-Port SATA/SAS Storage Control Unit - 1d68 Patsburg Dual 4-Port SATA/SAS Storage Control Unit - 1d69 X79 series chipset 4-Port SATA/SAS Storage Control Unit - 1d6a Patsburg Dual 4-Port SATA Storage Control Unit - 1d6b Patsburg 4-Port SATA Storage Control Unit - 1d6c Patsburg Dual 4-Port SATA/SAS Storage Control Unit - 1d6d Patsburg 4-Port SATA/SAS Storage Control Unit - 1d6e Patsburg Dual 4-Port SATA Storage Control Unit - 1d6f Patsburg 4-Port SATA Storage Control Unit - 1d70 X79 series chipset SMBus Controller 0 - 1d71 Patsburg SMBus Controller 1 - 1d72 Patsburg SMBus Controller 2 - 1d73 Patsburg Integrated NVSRAM Controller - 1d74 Patsburg PCI Express Upstream Port - 1d76 Patsburg Multi-Function Glue + 1d00 C600/X79 series chipset 4-Port SATA IDE Controller + 1d02 C600/X79 series chipset 6-Port SATA AHCI Controller + 1d04 C600/X79 series chipset SATA RAID Controller + 1d06 C600/X79 series chipset SATA Premium RAID Controller + 1d08 C600/X79 series chipset 2-Port SATA IDE Controller + 1d10 C600/X79 series chipset PCI Express Root Port 1 + 1d11 C600/X79 series chipset PCI Express Root Port 1 + 1d12 C600/X79 series chipset PCI Express Root Port 2 + 1d13 C600/X79 series chipset PCI Express Root Port 2 + 1d14 C600/X79 series chipset PCI Express Root Port 3 + 1d15 C600/X79 series chipset PCI Express Root Port 3 + 1d16 C600/X79 series chipset PCI Express Root Port 4 + 1d17 C600/X79 series chipset PCI Express Root Port 4 + 1d18 C600/X79 series chipset PCI Express Root Port 5 + 1d19 C600/X79 series chipset PCI Express Root Port 5 + 1d1a C600/X79 series chipset PCI Express Root Port 6 + 1d1b C600/X79 series chipset PCI Express Root Port 6 + 1d1c C600/X79 series chipset PCI Express Root Port 7 + 1d1d C600/X79 series chipset PCI Express Root Port 7 + 1d1e C600/X79 series chipset PCI Express Root Port 8 + 1d1f C600/X79 series chipset PCI Express Root Port 8 + 1d20 C600/X79 series chipset High Definition Audio Controller + 1d22 C600/X79 series chipset SMBus Host Controller + 1d24 C600/X79 series chipset Thermal Management Controller + 1d25 C600/X79 series chipset DMI to PCI Bridge + 1d26 C600/X79 series chipset USB2 Enhanced Host Controller #1 + 1d2d C600/X79 series chipset USB2 Enhanced Host Controller #2 + 1d33 C600/X79 series chipset LAN Controller + 1d35 C600/X79 series chipset VECI Controller + 1d3a C600/X79 series chipset MEI Controller #1 + 1d3b C600/X79 series chipset MEI Controller #2 + 1d3c C600/X79 series chipset IDE-r Controller + 1d3d C600/X79 series chipset KT Controller + 1d3e C600/X79 series chipset PCI Express Virtual Root Port + 1d3f C608/C606/X79 series chipset PCI Express Virtual Switch Port + 1d40 C600/X79 series chipset LPC Controller + 1d41 C600/X79 series chipset LPC Controller + 1d50 C608 chipset Dual 4-Port SATA/SAS Storage Control Unit + 1d54 C600/X79 series chipset Dual 4-Port SATA/SAS Storage Control Unit + 1d55 C600/X79 series chipset 4-Port SATA/SAS Storage Control Unit + 1d58 C606 chipset Dual 4-Port SATA/SAS Storage Control Unit + 1d59 C604/X79 series chipset 4-Port SATA/SAS Storage Control Unit + 1d5a C600/X79 series chipset Dual 4-Port SATA Storage Control Unit + 1d5b C602 chipset 4-Port SATA Storage Control Unit + 1d5c C600/X79 series chipset Dual 4-Port SATA/SAS Storage Control Unit + 1d5d C600/X79 series chipset 4-Port SATA/SAS Storage Control Unit + 1d5e C600/X79 series chipset Dual 4-Port SATA Storage Control Unit + 1d5f C600/X79 series chipset 4-Port SATA Storage Control Unit + 1d60 C608 chipset Dual 4-Port SATA/SAS Storage Control Unit + 1d64 C600/X79 series chipset Dual 4-Port SATA/SAS Storage Control Unit + 1d65 C600/X79 series chipset 4-Port SATA/SAS Storage Control Unit + 1d68 C606 chipset Dual 4-Port SATA/SAS Storage Control Unit + 1d69 C604/X79 series chipset 4-Port SATA/SAS Storage Control Unit + 1d6a C600/X79 series chipset Dual 4-Port SATA Storage Control Unit + 1d6b C602 chipset 4-Port SATA Storage Control Unit + 1d6c C600/X79 series chipset Dual 4-Port SATA/SAS Storage Control Unit + 1d6d C600/X79 series chipset 4-Port SATA/SAS Storage Control Unit + 1d6e C600/X79 series chipset Dual 4-Port SATA Storage Control Unit + 1d6f C600/X79 series chipset 4-Port SATA Storage Control Unit + 1d70 C600/X79 series chipset SMBus Controller 0 + 1d71 C608/C606/X79 series chipset SMBus Controller 1 + 1d72 C608 chipset SMBus Controller 2 + 1d74 C608/C606/X79 series chipset PCI Express Upstream Port + 1d76 C600/X79 series chipset Multi-Function Glue 1e00 Panther Point 4 port SATA Controller [IDE mode] 1e01 Panther Point 4 port SATA Controller [IDE mode] 1e02 Panther Point 6 port SATA Controller [AHCI mode] @@ -17781,6 +17879,7 @@ 15d9 8680 X7DVL-E-O motherboard 8086 3476 Intel S5000PSLSATA Server Board 2682 631xESB/632xESB SATA RAID Controller + 103c 31fe Adaptec Serial ATA HostRAID 2683 631xESB/632xESB SATA RAID Controller 2688 631xESB/632xESB/3100 Chipset UHCI USB Controller #1 1028 01bb PowerEdge 1955 onboard USB @@ -18112,7 +18211,7 @@ 2825 82801HR/HO/HH (ICH8R/DO/DH) 2 port SATA Controller [IDE mode] 1028 01da OptiPlex 745 1462 7235 P965 Neo MS-7235 mainboard - 2826 Patsburg SATA RAID Controller + 2826 C600/X79 series chipset SATA RAID Controller 2828 82801HM/HEM (ICH8M/ICH8M-E) SATA Controller [IDE mode] 1028 01f3 Inspiron 1420 103c 30c0 Compaq 6710b @@ -18920,14 +19019,14 @@ 3515 6310ESB PCI Express Downstream Port E2 3518 6311ESB/6321ESB PCI Express Downstream Port E3 3519 6310ESB PCI Express Downstream Port E3 - 3575 82830 830 Chipset Host Bridge + 3575 82830M/MG/MP Host Bridge 0e11 0030 Evo N600c 1014 021d ThinkPad A/T/X Series 104d 80e7 VAIO PCG-GR214EP/GR214MP/GR215MP/GR314MP/GR315MP - 3576 82830 830 Chipset AGP Bridge - 3577 82830 CGC [Chipset Graphics Controller] + 3576 82830M/MP AGP Bridge + 3577 82830M/MG Integrated Graphics Controller 1014 0513 ThinkPad A/T/X Series - 3578 82830 830 Chipset Host Bridge + 3578 82830M/MG/MP Host Bridge 3580 82852/82855 GM/GME/PM/GMV Processor to I/O Controller 1014 055c ThinkPad R50e 1028 0139 Latitude D400 @@ -19281,85 +19380,81 @@ 3b66 5 Series/3400 Series Chipset PT IDER Controller 3b67 5 Series/3400 Series Chipset KT Controller e4bf 50c1 PC1-GROOVE - 3c00 Sandy Bridge DMI2 - 3c01 Sandy Bridge DMI2 in PCI Express Mode - 3c02 Sandy Bridge IIO PCI Express Root Port 1a - 3c03 Sandy Bridge IIO PCI Express Root Port 1b - 3c04 Sandy Bridge IIO PCI Express Root Port 2a - 3c05 Sandy Bridge IIO PCI Express Root Port 2b - 3c06 Sandy Bridge IIO PCI Express Root Port 2c - 3c07 Sandy Bridge IIO PCI Express Root Port 2d - 3c08 Sandy Bridge IIO PCI Express Root Port 3a in PCI Express Mode - 3c09 Sandy Bridge IIO PCI Express Root Port 3b - 3c0a Sandy Bridge IIO PCI Express Root Port 3c - 3c0b Sandy Bridge IIO PCI Express Root Port 3d - 3c0d Sandy Bridge Non-Transparent Bridge - 3c0e Sandy Bridge Non-Transparent Bridge - 3c0f Sandy Bridge Non-Transparent Bridge - 3c20 Sandy Bridge DMA Channel 0 - 3c21 Sandy Bridge DMA Channel 1 - 3c22 Sandy Bridge DMA Channel 2 - 3c23 Sandy Bridge DMA Channel 3 - 3c24 Sandy Bridge DMA Channel 4 - 3c25 Sandy Bridge DMA Channel 5 - 3c26 Sandy Bridge DMA Channel 6 - 3c27 Sandy Bridge DMA Channel 7 - 3c28 Sandy Bridge Address Map, VTd_Misc, System Management - 3c2a Sandy Bridge Control Status and Global Errors - 3c2c Sandy Bridge I/O APIC - 3c2e Sandy Bridge DMA - 3c2f Sandy Bridge DMA - 3c40 Sandy Bridge IIO Switch and IRP Performance Monitor - 3c41 Sandy Bridge QPI Port 0 Performance Monitor - 3c42 Sandy Bridge QPI Port 1 Performance Monitor - 3c43 Sandy Bridge Ring to PCI Express Performance Monitor - 3c44 Sandy Bridge Ring to QuickPath Interconnect Link 0 Performance Monitor - 3c45 Sandy Bridge Ring to QuickPath Interconnect Link 1 Performance Monitor - 3c46 Sandy Bridge Processor Home Agent Performance Monitoring - 3c71 Sandy Bridge Integrated Memory Controller RAS Registers - 3c80 Sandy Bridge QPI Link 0 - 3c83 Sandy Bridge QPI Link Reut 0 - 3c84 Sandy Bridge QPI Link Reut 0 - 3c86 Sandy Bridge QPI Port 0 DFX Link - 3c90 Sandy Bridge QPI Link 1 - 3c93 Sandy Bridge QPI Link Reut 1 - 3c94 Sandy Bridge QPI Link Reut 1 - 3c96 Sandy Bridge QPI Port 1 DFX Link - 3ca0 Sandy Bridge Processor Home Agent - 3ca8 Sandy Bridge Integrated Memory Controller Registers - 3caa Sandy Bridge Integrated Memory Controller Target Address Decoder 0 - 3cab Sandy Bridge Integrated Memory Controller Target Address Decoder 1 - 3cac Sandy Bridge Integrated Memory Controller Target Address Decoder 2 - 3cad Sandy Bridge Integrated Memory Controller Target Address Decoder 3 - 3cae Sandy Bridge Integrated Memory Controller Target Address Decoder 4 - 3cb0 Sandy Bridge Integrated Memory Controller Channel 0-3 Thermal Control 0 - 3cb1 Sandy Bridge Integrated Memory Controller Channel 0-3 Thermal Control 1 - 3cb2 Sandy Bridge Integrated Memory Controller ERROR Registers 0 - 3cb3 Sandy Bridge Integrated Memory Controller ERROR Registers 1 - 3cb4 Sandy Bridge Integrated Memory Controller Channel 0-3 Thermal Control 2 - 3cb5 Sandy Bridge Integrated Memory Controller Channel 0-3 Thermal Control 3 - 3cb6 Sandy Bridge Integrated Memory Controller ERROR Registers 2 - 3cb7 Sandy Bridge Integrated Memory Controller ERROR Registers 3 - 3cb8 Sandy Bridge DDRIO - 3cc0 Sandy Bridge Power Control Unit 0 - 3cc1 Sandy Bridge Power Control Unit 1 - 3cc2 Sandy Bridge Power Control Unit 2 - 3cd0 Sandy Bridge Power Control Unit 3 - 3ce0 Sandy Bridge Interrupt Control Registers - 3ce3 Sandy Bridge Semaphore and Scratchpad Configuration Registers - 3ce4 Sandy Bridge R2PCIe - 3ce6 Sandy Bridge QuickPath Interconnect Agent Ring Registers - 3ce8 Sandy Bridge Unicast Register 0 - 3ce9 Sandy Bridge Unicast Register 5 - 3cea Sandy Bridge Unicast Register 1 - 3ceb Sandy Bridge Unicast Register 6 - 3cec Sandy Bridge Unicast Register 3 - 3ced Sandy Bridge Unicast Register 7 - 3cee Sandy Bridge Unicast Register 4 - 3cef Sandy Bridge Unicast Register 8 - 3cf4 Sandy Bridge Integrated Memory Controller System Address Decoder 0 - 3cf5 Sandy Bridge Integrated Memory Controller System Address Decoder 1 - 3cf6 Sandy Bridge System Address Decoder + 3c00 Xeon E5/Core i7 DMI2 + 3c01 Xeon E5/Core i7 DMI2 in PCI Express Mode + 3c02 Xeon E5/Core i7 IIO PCI Express Root Port 1a + 3c03 Xeon E5/Core i7 IIO PCI Express Root Port 1b + 3c04 Xeon E5/Core i7 IIO PCI Express Root Port 2a + 3c05 Xeon E5/Core i7 IIO PCI Express Root Port 2b + 3c06 Xeon E5/Core i7 IIO PCI Express Root Port 2c + 3c07 Xeon E5/Core i7 IIO PCI Express Root Port 2d + 3c08 Xeon E5/Core i7 IIO PCI Express Root Port 3a in PCI Express Mode + 3c09 Xeon E5/Core i7 IIO PCI Express Root Port 3b + 3c0a Xeon E5/Core i7 IIO PCI Express Root Port 3c + 3c0b Xeon E5/Core i7 IIO PCI Express Root Port 3d + 3c0d Xeon E5/Core i7 Non-Transparent Bridge + 3c0e Xeon E5/Core i7 Non-Transparent Bridge + 3c0f Xeon E5/Core i7 Non-Transparent Bridge + 3c20 Xeon E5/Core i7 DMA Channel 0 + 3c21 Xeon E5/Core i7 DMA Channel 1 + 3c22 Xeon E5/Core i7 DMA Channel 2 + 3c23 Xeon E5/Core i7 DMA Channel 3 + 3c24 Xeon E5/Core i7 DMA Channel 4 + 3c25 Xeon E5/Core i7 DMA Channel 5 + 3c26 Xeon E5/Core i7 DMA Channel 6 + 3c27 Xeon E5/Core i7 DMA Channel 7 + 3c28 Xeon E5/Core i7 Address Map, VTd_Misc, System Management + 3c2a Xeon E5/Core i7 Control Status and Global Errors + 3c2c Xeon E5/Core i7 I/O APIC + 3c2e Xeon E5/Core i7 DMA + 3c2f Xeon E5/Core i7 DMA + 3c40 Xeon E5/Core i7 IIO Switch and IRP Performance Monitor + 3c43 Xeon E5/Core i7 Ring to PCI Express Performance Monitor + 3c44 Xeon E5/Core i7 Ring to QuickPath Interconnect Link 0 Performance Monitor + 3c45 Xeon E5/Core i7 Ring to QuickPath Interconnect Link 1 Performance Monitor + 3c46 Xeon E5/Core i7 Processor Home Agent Performance Monitoring + 3c71 Xeon E5/Core i7 Integrated Memory Controller RAS Registers + 3c80 Xeon E5/Core i7 QPI Link 0 + 3c83 Xeon E5/Core i7 QPI Link Reut 0 + 3c84 Xeon E5/Core i7 QPI Link Reut 0 + 3c90 Xeon E5/Core i7 QPI Link 1 + 3c93 Xeon E5/Core i7 QPI Link Reut 1 + 3c94 Xeon E5/Core i7 QPI Link Reut 1 + 3ca0 Xeon E5/Core i7 Processor Home Agent + 3ca8 Xeon E5/Core i7 Integrated Memory Controller Registers + 3caa Xeon E5/Core i7 Integrated Memory Controller Target Address Decoder 0 + 3cab Xeon E5/Core i7 Integrated Memory Controller Target Address Decoder 1 + 3cac Xeon E5/Core i7 Integrated Memory Controller Target Address Decoder 2 + 3cad Xeon E5/Core i7 Integrated Memory Controller Target Address Decoder 3 + 3cae Xeon E5/Core i7 Integrated Memory Controller Target Address Decoder 4 + 3cb0 Xeon E5/Core i7 Integrated Memory Controller Channel 0-3 Thermal Control 0 + 3cb1 Xeon E5/Core i7 Integrated Memory Controller Channel 0-3 Thermal Control 1 + 3cb2 Xeon E5/Core i7 Integrated Memory Controller ERROR Registers 0 + 3cb3 Xeon E5/Core i7 Integrated Memory Controller ERROR Registers 1 + 3cb4 Xeon E5/Core i7 Integrated Memory Controller Channel 0-3 Thermal Control 2 + 3cb5 Xeon E5/Core i7 Integrated Memory Controller Channel 0-3 Thermal Control 3 + 3cb6 Xeon E5/Core i7 Integrated Memory Controller ERROR Registers 2 + 3cb7 Xeon E5/Core i7 Integrated Memory Controller ERROR Registers 3 + 3cb8 Xeon E5/Core i7 DDRIO + 3cc0 Xeon E5/Core i7 Power Control Unit 0 + 3cc1 Xeon E5/Core i7 Power Control Unit 1 + 3cc2 Xeon E5/Core i7 Power Control Unit 2 + 3cd0 Xeon E5/Core i7 Power Control Unit 3 + 3ce0 Xeon E5/Core i7 Interrupt Control Registers + 3ce3 Xeon E5/Core i7 Semaphore and Scratchpad Configuration Registers + 3ce4 Xeon E5/Core i7 R2PCIe + 3ce6 Xeon E5/Core i7 QuickPath Interconnect Agent Ring Registers + 3ce8 Xeon E5/Core i7 Unicast Register 0 + 3ce9 Xeon E5/Core i7 Unicast Register 5 + 3cea Xeon E5/Core i7 Unicast Register 1 + 3ceb Xeon E5/Core i7 Unicast Register 6 + 3cec Xeon E5/Core i7 Unicast Register 3 + 3ced Xeon E5/Core i7 Unicast Register 7 + 3cee Xeon E5/Core i7 Unicast Register 4 + 3cef Xeon E5/Core i7 Unicast Register 8 + 3cf4 Xeon E5/Core i7 Integrated Memory Controller System Address Decoder 0 + 3cf5 Xeon E5/Core i7 Integrated Memory Controller System Address Decoder 1 + 3cf6 Xeon E5/Core i7 System Address Decoder 4000 5400 Chipset Memory Controller Hub 4001 5400 Chipset Memory Controller Hub 4003 5400 Chipset Memory Controller Hub @@ -20341,6 +20436,15 @@ e159 Tiger Jet Network Inc. 0002 Tiger100APC ISDN chipset e1c5 Elcus e4bf EKF Elektronik GmbH + 0ccd CCD-CALYPSO + 0cd1 CD1-OPERA + 0cd2 CD2-BEBOP + 0cd3 CD3-JIVE + 50c1 PC1-GROOVE + 50c2 PC2-LIMBO + 53c1 SC1-ALLEGRO + cc47 CCG-RUMBA + cc4d CCM-BOOGIE e55e Essence Technology, Inc. ea01 Eagle Technology 000a PCI-773 Temperature Card diff --git a/share/zoneinfo/africa b/share/zoneinfo/africa index 5a8b17237f..dd7e771291 100644 --- a/share/zoneinfo/africa +++ b/share/zoneinfo/africa @@ -1,5 +1,5 @@ # 
-# @(#)africa	8.33
+# @(#)africa	8.35
 # This file is in the public domain, so clarified as of
 # 2009-05-17 by Arthur David Olson.
 
@@ -768,6 +768,37 @@ Zone	Indian/Mayotte	3:00:56 -	LMT	1911 Jul	# Mamoutzou
 # wall clock time (i.e. 11pm UTC), but that's what I would assume. It has
 # also been like that in the past.
 
+# From Alexander Krivenyshev (2012-03-09):
+# According to Infomédiaire web site from Morocco (infomediaire.ma),
+# on March 9, 2012, (in French) Heure légale:
+# Le Maroc adopte officiellement l'heure d'été
+# 
+# http://www.infomediaire.ma/news/maroc/heure-l%C3%A9gale-le-maroc-adopte-officiellement-lheure-d%C3%A9t%C3%A9
+# 
+# Governing Council adopted draft decree, that Morocco DST starts on
+# the last Sunday of March (March 25, 2012) and ends on
+# last Sunday of September (September 30, 2012)
+# except the month of Ramadan.
+# or (brief)
+# 
+# http://www.worldtimezone.com/dst_news/dst_news_morocco06.html
+# 
+
+# From Arthur David Olson (2012-03-10):
+# The infomediaire.ma source indicates that the system is to be in
+# effect every year. It gives 03H00 as the "fall back" time of day;
+# it lacks a "spring forward" time of day; assume 2:00 XXX.
+# Wait on specifying the Ramadan exception for details about
+# start date, start time of day, end date, and end time of day XXX.
+
+# From Christophe Tropamer (2012-03-16):
+# Seen Morocco change again:
+# 
+# http://www.le2uminutes.com/actualite.php
+# 
+# "...à partir du dernier dimance d'avril et non fins mars,
+# comme annoncé précédemment."
+
 # RULE	NAME	FROM	TO	TYPE	IN	ON	AT	SAVE	LETTER/S
 
 Rule	Morocco	1939	only	-	Sep	12	 0:00	1:00	S
@@ -793,6 +824,9 @@ Rule	Morocco	2010	only	-	May	 2	 0:00	1:00	S
 Rule	Morocco	2010	only	-	Aug	 8	 0:00	0	-
 Rule	Morocco	2011	only	-	Apr	 3	 0:00	1:00	S
 Rule	Morocco	2011	only	-	Jul	 31	 0	0	-
+Rule	Morocco	2012	max	-	Apr	 lastSun 2:00	1:00	S
+Rule	Morocco	2012	max	-	Sep	 lastSun 3:00	0	-
+
 # Zone	NAME		GMTOFF	RULES	FORMAT	[UNTIL]
 Zone Africa/Casablanca	-0:30:20 -	LMT	1913 Oct 26
 			 0:00	Morocco	WE%sT	1984 Mar 16
diff --git a/share/zoneinfo/asia b/share/zoneinfo/asia
index 1e6b4b1680..e844971637 100644
--- a/share/zoneinfo/asia
+++ b/share/zoneinfo/asia
@@ -1,4 +1,5 @@
-# @(#)asia	8.70
+# 
+# @(#)asia	8.73
 # This file is in the public domain, so clarified as of
 # 2009-05-17 by Arthur David Olson.
 
@@ -2247,6 +2248,29 @@ Zone	Asia/Karachi	4:28:12 -	LMT	1907
 # http://www.maannews.net/eng/ViewDetails.aspx?ID=424808
 # 
 
+# From Steffen Thorsen (2012-03-26):
+# Palestinian news sources tell that both Gaza and West Bank will start DST
+# on Friday (Thursday midnight, 2012-03-29 24:00).
+# Some of many sources in Arabic:
+# 
+# http://www.samanews.com/index.php?act=Show&id=122638
+# 
+#
+# 
+# http://safa.ps/details/news/74352/%D8%A8%D8%AF%D8%A1-%D8%A7%D9%84%D8%AA%D9%88%D9%82%D9%8A%D8%AA-%D8%A7%D9%84%D8%B5%D9%8A%D9%81%D9%8A-%D8%A8%D8%A7%D9%84%D8%B6%D9%81%D8%A9-%D9%88%D8%BA%D8%B2%D8%A9-%D9%84%D9%8A%D9%84%D8%A9-%D8%A7%D9%84%D8%AC%D9%85%D8%B9%D8%A9.html
+# 
+#
+# Our brief summary:
+# 
+# http://www.timeanddate.com/news/time/gaza-west-bank-dst-2012.html
+# 
+
+# From Arthur David Olson (2012-03-27):
+# The timeanddate article for 2012 says that "the end date has not yet been
+# announced" and that "Last year, both...paused daylight saving time during...
+# Ramadan. It is not yet known [for] 2012."
+# For now, assume both switch back on the last Friday in September. XXX
+
 # Rule	NAME	FROM	TO	TYPE	IN	ON	AT	SAVE	LETTER/S
 Rule EgyptAsia	1957	only	-	May	10	0:00	1:00	S
 Rule EgyptAsia	1957	1958	-	Oct	 1	0:00	0	-
@@ -2279,6 +2303,8 @@ Zone	Asia/Gaza	2:17:52	-	LMT	1900 Oct
 			2:00	Jordan	EE%sT	1999
 			2:00 Palestine	EE%sT	2011 Apr  2 12:01
 			2:00	1:00	EEST	2011 Aug  1
+			2:00	-	EET	2012 Mar 30
+			2:00	1:00	EEST	2012 Sep 28
 			2:00	-	EET
 
 Zone	Asia/Hebron	2:20:23	-	LMT	1900 Oct
@@ -2292,6 +2318,8 @@ Zone	Asia/Hebron	2:20:23	-	LMT	1900 Oct
 			2:00	1:00	EEST	2011 Aug  1
 			2:00	-	EET	2011 Aug 30
 			2:00	1:00	EEST	2011 Sep 30 3:00
+			2:00	-	EET	2012 Mar 30
+			2:00	1:00	EEST	2012 Sep 28 3:00
 			2:00	-	EET
 
 # Paracel Is
@@ -2583,10 +2611,28 @@ Rule	Syria	2007	only	-	Nov	 Fri>=1	0:00	0	-
 # http://sns.sy/sns/?path=news/read/11421 (Arabic)
 # 
 
+# From Steffen Thorsen (2012-03-26):
+# Today, Syria's government announced that they will start DST early on Friday
+# (00:00). This is a bit earlier than the past two years.
+#
+# From Syrian Arab News Agency, in Arabic:
+# 
+# http://www.sana.sy/ara/2/2012/03/26/408215.htm
+# 
+#
+# Our brief summary:
+# 
+# http://www.timeanddate.com/news/time/syria-dst-2012.html
+# 
+
+# From Arthur David Olson (2012-03-27):
+# Assume last Friday in March going forward XXX.
+
 Rule	Syria	2008	only	-	Apr	Fri>=1	0:00	1:00	S
 Rule	Syria	2008	only	-	Nov	1	0:00	0	-
 Rule	Syria	2009	only	-	Mar	lastFri	0:00	1:00	S
-Rule	Syria	2010	max	-	Apr	Fri>=1	0:00	1:00	S
+Rule	Syria	2010	2011	-	Apr	Fri>=1	0:00	1:00	S
+Rule	Syria	2012	max	-	Mar	lastFri	0:00	1:00	S
 Rule	Syria	2009	max	-	Oct	lastFri	0:00	0	-
 
 # Zone	NAME		GMTOFF	RULES	FORMAT	[UNTIL]
diff --git a/share/zoneinfo/northamerica b/share/zoneinfo/northamerica
index e60c72868c..0096d59401 100644
--- a/share/zoneinfo/northamerica
+++ b/share/zoneinfo/northamerica
@@ -1,5 +1,5 @@
 # 
-# @(#)northamerica	8.53
+# @(#)northamerica	8.54
 # This file is in the public domain, so clarified as of
 # 2009-05-17 by Arthur David Olson.
 
@@ -2970,6 +2970,29 @@ Zone America/Guatemala	-6:02:04 -	LMT	1918 Oct 5
 # From Stephen Colebourne (2007-02-22):
 # Some IATA info: Haiti won't be having DST in 2007.
 
+# From Steffen Thorsen (2012-03-11):
+# According to several news sources, Haiti will observe DST this year,
+# apparently using the same start and end date as USA/Canada.
+# So this means they have already changed their time.
+#
+# (Sources in French):
+# 
+# http://www.alterpresse.org/spip.php?article12510
+# 
+# 
+# http://radiovision2000haiti.net/home/?p=13253
+# 
+#
+# Our coverage:
+# 
+# http://www.timeanddate.com/news/time/haiti-dst-2012.html
+# 
+
+# From Arthur David Olson (2012-03-11):
+# The alterpresse.org source seems to show a US-style leap from 2:00 a.m. to
+# 3:00 a.m. rather than the traditional Haitian jump at midnight.
+# Assume a US-style fall back as well XXX.
+# Do not yet assume that the change carries forward past 2012 XXX.
 
 # Rule	NAME	FROM	TO	TYPE	IN	ON	AT	SAVE	LETTER/S
 Rule	Haiti	1983	only	-	May	8	0:00	1:00	D
@@ -2981,6 +3004,8 @@ Rule	Haiti	1988	1997	-	Apr	Sun>=1	1:00s	1:00	D
 Rule	Haiti	1988	1997	-	Oct	lastSun	1:00s	0	S
 Rule	Haiti	2005	2006	-	Apr	Sun>=1	0:00	1:00	D
 Rule	Haiti	2005	2006	-	Oct	lastSun	0:00	0	S
+Rule	Haiti	2012	only	-	Mar	Sun>=8	2:00	1:00	D
+Rule	Haiti	2012	only	-	Nov	Sun>=1	2:00	0	S
 # Zone	NAME		GMTOFF	RULES	FORMAT	[UNTIL]
 Zone America/Port-au-Prince -4:49:20 -	LMT	1890
 			-4:49	-	PPMT	1917 Jan 24 12:00 # P-a-P MT
diff --git a/sys/bus/cam/cam_periph.c b/sys/bus/cam/cam_periph.c
index 49cdf4591b..4f8b069a8a 100644
--- a/sys/bus/cam/cam_periph.c
+++ b/sys/bus/cam/cam_periph.c
@@ -664,12 +664,12 @@ cam_periph_mapmem(union ccb *ccb, struct cam_periph_map_info *mapinfo)
 		 * boundary.
 		 */
 		if ((lengths[i] +
-		    (((vm_offset_t)(*data_ptrs[i])) & PAGE_MASK)) > DFLTPHYS){
+		    (((vm_offset_t)(*data_ptrs[i])) & PAGE_MASK)) > MAXPHYS){
 			kprintf("cam_periph_mapmem: attempt to map %lu bytes, "
-			       "which is greater than DFLTPHYS(%d)\n",
+			       "which is greater than MAXPHYS(%d)\n",
 			       (long)(lengths[i] +
 			       (((vm_offset_t)(*data_ptrs[i])) & PAGE_MASK)),
-			       DFLTPHYS);
+			       MAXPHYS);
 			return(E2BIG);
 		}
 
diff --git a/sys/bus/firewire/fwmem.c b/sys/bus/firewire/fwmem.c
index e945a4234f..2aa5757a6a 100644
--- a/sys/bus/firewire/fwmem.c
+++ b/sys/bus/firewire/fwmem.c
@@ -283,7 +283,7 @@ fwmem_open (struct dev_open_args *ap)
 							M_FWMEM, M_WAITOK);
 		bcopy(&fwmem_eui64, &fms->eui, sizeof(struct fw_eui64));
 		dev->si_drv1 = (void *)fms;
-		dev->si_iosize_max = DFLTPHYS;
+		dev->si_iosize_max = min(MAXPHYS,64*1024);
 		fms->refcount = 1;
 	}
 	if (fwmem_debug)
diff --git a/sys/bus/pci/pci.c b/sys/bus/pci/pci.c
index 3091e10f21..125ec847bf 100644
--- a/sys/bus/pci/pci.c
+++ b/sys/bus/pci/pci.c
@@ -1919,8 +1919,8 @@ pci_alloc_msi_method(device_t dev, device_t child, int *rid, int count,
 
 	if (bootverbose) {
 		device_printf(child,
-		    "attempting to allocate %d MSI vectors (%d supported)\n",
-		    count, cfg->msi.msi_msgnum);
+		    "attempting to allocate %d MSI vector%s (%d supported)\n",
+		    count, count > 1 ? "s" : "", cfg->msi.msi_msgnum);
 	}
 
 	if (start_cpuid < 0)
diff --git a/sys/bus/usb/usb.c b/sys/bus/usb/usb.c
index 5669c20024..49b0530346 100644
--- a/sys/bus/usb/usb.c
+++ b/sys/bus/usb/usb.c
@@ -358,7 +358,7 @@ usb_create_event_thread(device_t self)
 			taskq->name = taskq_names[i];
 			TAILQ_INIT(&taskq->tasks);
 			if (kthread_create(usb_task_thread, taskq,
-			    &taskq->task_thread_proc, taskq->name)) {
+			    &taskq->task_thread_proc, "%s", taskq->name)) {
 				kprintf("unable to create task thread\n");
 				panic("usb_create_event_thread task");
 			}
diff --git a/sys/conf/files b/sys/conf/files
index e9f24743af..ceff74676e 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -578,6 +578,7 @@ dev/raid/mfi/mfi_debug.c	optional mfi
 dev/raid/mfi/mfi_pci.c		optional mfi pci
 dev/raid/mfi/mfi_disk.c		optional mfi
 dev/raid/mfi/mfi_syspd.c	optional mfi
+dev/raid/mfi/mfi_tbolt.c	optional mfi
 dev/raid/mfi/mfi_linux.c	optional mfi compat_linux
 dev/raid/mfi/mfi_cam.c		optional mfip scbus
 dev/netif/mii_layer/mii.c		optional miibus
diff --git a/sys/config/GENERIC b/sys/config/GENERIC
index d9fadbdedc..c4e3ed3bda 100644
--- a/sys/config/GENERIC
+++ b/sys/config/GENERIC
@@ -126,7 +126,7 @@ options 	SYM_SETUP_LP_PROBE_MAP=0x40
 device		adv0	at isa?
 device		adw
 device		bt0	at isa?
-device		aic0	at isa?
+device		aic
 
 device		ncv		# NCR 53C500
 device		nsp		# Workbit Ninja SCSI-3
diff --git a/sys/config/LINT b/sys/config/LINT
index 6f0280e3b2..29fcc265f5 100644
--- a/sys/config/LINT
+++ b/sys/config/LINT
@@ -1177,16 +1177,12 @@ device		npx0	at nexus? port IO_NPX flags 0x0 irq 13
 #
 
 #
-# Optional ISA devices:
-#
-
-#
-# SCSI host adapters: `aic' and `bt'
+# SCSI host adapters: `bt'
 #
 # adv: All Narrow SCSI bus AdvanSys controllers.
 # adw: Second Generation AdvanSys controllers including the ADV940UW.
 # ahc: Adaptec 274x/284x/294x
-# aic: Adaptec 152x
+# aic: Adaptec 1460
 # bt: Most Buslogic controllers
 # ncv: NCR 53C500 based SCSI host adapters.
 # nsp: Workbit Ninja SCSI-3 based PC Card SCSI host adapters.
@@ -1199,7 +1195,7 @@ device		npx0	at nexus? port IO_NPX flags 0x0 irq 13
 device		bt0	at isa? port IO_BT0
 device		adv0	at isa?
 device		adw
-device		aic0	at isa?
+device		aic
 device		ncv
 device		nsp
 device		stg0	at isa? port 0x140 irq 11
diff --git a/sys/config/LINT64 b/sys/config/LINT64
index bcc60df05a..b3555179fe 100644
--- a/sys/config/LINT64
+++ b/sys/config/LINT64
@@ -995,16 +995,12 @@ options 	SC_TWOBUTTON_MOUSE
 #options 	SC_NO_SYSMOUSE
 
 #
-# Optional ISA devices:
-#
-
-#
-# SCSI host adapters: `aic' and `bt'
+# SCSI host adapters: `bt'
 #
 # adv: All Narrow SCSI bus AdvanSys controllers.
 # adw: Second Generation AdvanSys controllers including the ADV940UW.
 # ahc: Adaptec 274x/284x/294x
-# aic: Adaptec 152x
+# aic: Adaptec 1460
 # bt: Most Buslogic controllers
 # ncv: NCR 53C500 based SCSI host adapters.
 # nsp: Workbit Ninja SCSI-3 based PC Card SCSI host adapters.
@@ -1017,7 +1013,7 @@ options 	SC_TWOBUTTON_MOUSE
 device		bt0	at isa? port IO_BT0
 device		adv0	at isa?
 device		adw
-device		aic0	at isa?
+device		aic
 device		ncv
 device		nsp
 device		stg0	at isa? port 0x140 irq 11
diff --git a/sys/config/X86_64_GENERIC b/sys/config/X86_64_GENERIC
index cdb8332af4..7c2228a150 100644
--- a/sys/config/X86_64_GENERIC
+++ b/sys/config/X86_64_GENERIC
@@ -112,7 +112,7 @@ options 	SYM_SETUP_LP_PROBE_MAP=0x40
 device		adv0	at isa?
 device		adw
 device		bt0	at isa?
-device		aic0	at isa?
+device		aic
 
 device		ncv		# NCR 53C500
 device		nsp		# Workbit Ninja SCSI-3
diff --git a/sys/cpu/i386/include/param.h b/sys/cpu/i386/include/param.h
index cb90e4b6ee..d792843aaa 100644
--- a/sys/cpu/i386/include/param.h
+++ b/sys/cpu/i386/include/param.h
@@ -127,7 +127,7 @@
 #endif
 #define DFLTPHYS	(64 * 1024)	/* default max raw I/O transfer size */
 #define MAXPHYS		(128 * 1024)	/* max raw I/O transfer size */
-#define MAXDUMPPGS	(DFLTPHYS/PAGE_SIZE)
+#define MAXDUMPPGS	(MAXPHYS/PAGE_SIZE)
 
 #define IOPAGES	2		/* pages of i/o permission bitmap */
 #define UPAGES	4		/* pages of u-area */
diff --git a/sys/cpu/x86_64/include/param.h b/sys/cpu/x86_64/include/param.h
index d23ae694a7..0c506254ce 100644
--- a/sys/cpu/x86_64/include/param.h
+++ b/sys/cpu/x86_64/include/param.h
@@ -142,7 +142,7 @@
 #endif
 #define DFLTPHYS	(64 * 1024)	/* default max raw I/O transfer size */
 #define MAXPHYS		(128 * 1024)	/* max raw I/O transfer size */
-#define MAXDUMPPGS	(DFLTPHYS/PAGE_SIZE)
+#define MAXDUMPPGS	(MAXPHYS/PAGE_SIZE)
 
 #define IOPAGES	2		/* pages of i/o permission bitmap */
 #define UPAGES	4		/* pages of u-area */
diff --git a/sys/dev/acpica5/Osd/OsdSchedule.c b/sys/dev/acpica5/Osd/OsdSchedule.c
index 3a43c79efa..087e68933e 100644
--- a/sys/dev/acpica5/Osd/OsdSchedule.c
+++ b/sys/dev/acpica5/Osd/OsdSchedule.c
@@ -25,7 +25,6 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/sys/dev/acpica/Osd/OsdSchedule.c,v 1.28 2004/05/06 02:18:58 njl Exp $
- * $DragonFly: src/sys/dev/acpica5/Osd/OsdSchedule.c,v 1.10 2008/06/05 18:06:31 swildner Exp $
  */
 
 /*
@@ -83,8 +82,7 @@ int
 acpi_task_thread_init(void)
 {
     lwkt_initport_replyonly(&acpi_afree_rport, acpi_autofree_reply);
-    kthread_create(acpi_task_thread, NULL, &acpi_task_td,
-			0, 0, "acpi_task");
+    kthread_create(acpi_task_thread, NULL, &acpi_task_td, "acpi_task");
     return (0);
 }
 
diff --git a/sys/dev/acpica5/acpi_asus/acpi_asus.c b/sys/dev/acpica5/acpi_asus/acpi_asus.c
index d30161684b..14101a2a8b 100644
--- a/sys/dev/acpica5/acpi_asus/acpi_asus.c
+++ b/sys/dev/acpica5/acpi_asus/acpi_asus.c
@@ -715,7 +715,7 @@ good:
 	sbuf_printf(sb, "Unsupported Asus laptop: %s\n", Obj->String.Pointer);
 	sbuf_finish(sb);
 
-	device_printf(dev, sbuf_data(sb));
+	device_printf(dev, "%s", sbuf_data(sb));
 
 	sbuf_delete(sb);
 	AcpiOsFree(Buf.Pointer);
diff --git a/sys/dev/acpica5/acpi_hp/acpi_hp.c b/sys/dev/acpica5/acpi_hp/acpi_hp.c
index 0c6bffe36f..0ba8948d50 100644
--- a/sys/dev/acpica5/acpi_hp/acpi_hp.c
+++ b/sys/dev/acpica5/acpi_hp/acpi_hp.c
@@ -821,7 +821,7 @@ acpi_hp_notify(ACPI_HANDLE h, UINT32 notify, void *context)
 	ACPI_OBJECT *obj;
 	ACPI_WMI_GET_EVENT_DATA(sc->wmi_dev, notify, &response);
 	obj = (ACPI_OBJECT*) response.Pointer;
-	if (!obj || obj->Type != ACPI_TYPE_PACKAGE) {
+	if (obj && obj->Type == ACPI_TYPE_BUFFER && obj->Buffer.Length == 8) {
 		if (*((UINT8 *) obj->Buffer.Pointer) == 0x5) {
 			acpi_hp_evaluate_auto_on_off(sc);
 		}
@@ -920,7 +920,7 @@ acpi_hp_get_cmi_block(device_t wmi_dev, const char* guid, UINT8 instance,
 		return (-EINVAL);
 	}
 	obj = out.Pointer;
-	if (!obj && obj->Type != ACPI_TYPE_PACKAGE) {
+	if (!obj || obj->Type != ACPI_TYPE_PACKAGE) {
 		acpi_hp_free_buffer(&out);
 		return (-EINVAL);
 	}
diff --git a/sys/dev/acpica5/acpi_thermal.c b/sys/dev/acpica5/acpi_thermal.c
index a51b287357..f3319962da 100644
--- a/sys/dev/acpica5/acpi_thermal.c
+++ b/sys/dev/acpica5/acpi_thermal.c
@@ -317,7 +317,7 @@ acpi_tz_attach(device_t dev)
 	acpi_tz_power_profile, sc, 0);
     if (acpi_tz_td == NULL) {
 	error = kthread_create(acpi_tz_thread, NULL, &acpi_tz_td,
-	    RFHIGHPID, 0, "acpi_thermal");
+	    "acpi_thermal");
 	if (error != 0) {
 	    device_printf(sc->tz_dev, "could not create thread - %d", error);
 	    goto out;
@@ -1200,7 +1200,6 @@ static int
 acpi_tz_cooling_thread_start(struct acpi_tz_softc *sc)
 {
     int error;
-    char name[16];
 
     ACPI_LOCK(thermal);
     if (sc->tz_cooling_proc_running) {
@@ -1211,10 +1210,9 @@ acpi_tz_cooling_thread_start(struct acpi_tz_softc *sc)
     ACPI_UNLOCK(thermal);
     error = 0;
     if (sc->tz_cooling_proc == NULL) {
-	ksnprintf(name, sizeof(name), "acpi_cooling%d",
-	    device_get_unit(sc->tz_dev));
 	error = kthread_create(acpi_tz_cooling_thread, sc,
-	    &sc->tz_cooling_proc, RFHIGHPID, 0, name);
+	    &sc->tz_cooling_proc,
+	    "acpi_cooling%d", device_get_unit(sc->tz_dev));
 	if (error != 0) {
 	    device_printf(sc->tz_dev, "could not create thread - %d", error);
 	    ACPI_LOCK(thermal);
diff --git a/sys/dev/acpica5/acpivar.h b/sys/dev/acpica5/acpivar.h
index 86474979b3..4673118c69 100644
--- a/sys/dev/acpica5/acpivar.h
+++ b/sys/dev/acpica5/acpivar.h
@@ -346,7 +346,6 @@ void		acpi_UserNotify(const char *subsystem, ACPI_HANDLE h,
 int		acpi_bus_alloc_gas(device_t dev, int *type, int *rid,
 		    ACPI_GENERIC_ADDRESS *gas, struct resource **res,
 		    u_int flags);
-# define kthread_create(a, b, c, d, e, f) kthread_create(a, b, c, f)
 
 struct acpi_parse_resource_set {
     void	(*set_init)(device_t dev, void *arg, void **context);
diff --git a/sys/dev/disk/aic/Makefile b/sys/dev/disk/aic/Makefile
index 105fbba371..aebe2dabb6 100644
--- a/sys/dev/disk/aic/Makefile
+++ b/sys/dev/disk/aic/Makefile
@@ -1,8 +1,8 @@
 # $FreeBSD: src/sys/modules/aic/Makefile,v 1.6 2004/05/26 00:53:00 imp Exp $
 
 KMOD=	aic
-SRCS=	aic.c aic_isa.c aic_pccard.c
-SRCS+=	device_if.h bus_if.h pci_if.h isa_if.h card_if.h
+SRCS=	aic.c aic_pccard.c
+SRCS+=	device_if.h bus_if.h pci_if.h card_if.h
 SRCS+=	opt_cam.h opt_scsi.h
 
 .include 
diff --git a/sys/dev/disk/aic/aic.c b/sys/dev/disk/aic/aic.c
index 0bb02f5183..bcaaf261c3 100644
--- a/sys/dev/disk/aic/aic.c
+++ b/sys/dev/disk/aic/aic.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD: src/sys/dev/aic/aic.c,v 1.8 2000/01/14 23:42:35 imp Exp $
+ * $FreeBSD: src/sys/dev/aic/aic.c,v 1.28 2009/05/13 22:31:25 des Exp $
  */
 
 #include 
@@ -43,26 +43,26 @@
 #include "aic6360reg.h"
 #include "aicvar.h"
 
-static void aic_action (struct cam_sim *sim, union ccb *ccb);
-static void aic_execute_scb (void *arg, bus_dma_segment_t *dm_segs,
+static void aic_action(struct cam_sim *sim, union ccb *ccb);
+static void aic_execute_scb(void *arg, bus_dma_segment_t *dm_segs,
 				int nseg, int error);
-static void aic_start (struct aic_softc *aic);
-static void aic_select (struct aic_softc *aic);
-static void aic_selected (struct aic_softc *aic);
-static void aic_reselected (struct aic_softc *aic);
-static void aic_reconnect (struct aic_softc *aic, int tag);
-static void aic_cmd (struct aic_softc *aic);
-static void aic_msgin (struct aic_softc *aic);
-static void aic_handle_msgin (struct aic_softc *aic);
-static void aic_msgout (struct aic_softc *aic);
-static void aic_datain (struct aic_softc *aic);
-static void aic_dataout (struct aic_softc *aic);
-static void aic_done (struct aic_softc *aic, struct aic_scb *scb);
-static void aic_poll (struct cam_sim *sim);
-static void aic_timeout (void *arg);
-static void aic_scsi_reset (struct aic_softc *aic);
-static void aic_chip_reset (struct aic_softc *aic);
-static void aic_reset (struct aic_softc *aic, int initiate_reset);
+static void aic_start(struct aic_softc *aic);
+static void aic_select(struct aic_softc *aic);
+static void aic_selected(struct aic_softc *aic);
+static void aic_reselected(struct aic_softc *aic);
+static void aic_reconnect(struct aic_softc *aic, int tag);
+static void aic_cmd(struct aic_softc *aic);
+static void aic_msgin(struct aic_softc *aic);
+static void aic_handle_msgin(struct aic_softc *aic);
+static void aic_msgout(struct aic_softc *aic);
+static void aic_datain(struct aic_softc *aic);
+static void aic_dataout(struct aic_softc *aic);
+static void aic_done(struct aic_softc *aic, struct aic_scb *scb);
+static void aic_poll(struct cam_sim *sim);
+static void aic_timeout(void *arg);
+static void aic_scsi_reset(struct aic_softc *aic);
+static void aic_chip_reset(struct aic_softc *aic);
+static void aic_reset(struct aic_softc *aic, int initiate_reset);
 
 devclass_t aic_devclass;
 
@@ -167,7 +167,7 @@ aic_action(struct cam_sim *sim, union ccb *ccb)
 	}
 	case XPT_SET_TRAN_SETTINGS:
 	{
-		struct ccb_trans_settings *cts = cts = &ccb->cts;
+		struct ccb_trans_settings *cts = &ccb->cts;
 		struct aic_tinfo *ti = &aic->tinfo[ccb->ccb_h.target_id];
 		struct ccb_trans_settings_scsi *scsi =
 		    &cts->proto_specific.scsi;
diff --git a/sys/dev/disk/aic/aic6360reg.h b/sys/dev/disk/aic/aic6360reg.h
index 6a8a55314f..84a7bcac0e 100644
--- a/sys/dev/disk/aic/aic6360reg.h
+++ b/sys/dev/disk/aic/aic6360reg.h
@@ -29,8 +29,7 @@
  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $FreeBSD: src/sys/dev/aic/aic6360reg.h,v 1.1 1999/10/21 08:56:52 luoqi Exp $
- * $DragonFly: src/sys/dev/disk/aic/aic6360reg.h,v 1.3 2008/01/05 07:27:09 pavalos Exp $
+ * $FreeBSD: src/sys/dev/aic/aic6360reg.h,v 1.4 2005/01/06 01:42:25 imp Exp $
  */
 
 #define SCSISEQ		0x00	/* SCSI sequence control */
diff --git a/sys/dev/disk/aic/aic_isa.c b/sys/dev/disk/aic/aic_isa.c
deleted file mode 100644
index 521b7b6a57..0000000000
--- a/sys/dev/disk/aic/aic_isa.c
+++ /dev/null
@@ -1,239 +0,0 @@
-/*-
- * Copyright (c) 1999 Luoqi Chen.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * $FreeBSD: src/sys/dev/aic/aic_isa.c,v 1.3 2000/01/14 23:42:35 imp Exp $
- */
-
-#include 
-#include 
-#include 
-#include 
-#include 
-#include 
-
-#include 
-#include "aic6360reg.h"
-#include "aicvar.h"
-  
-struct aic_isa_softc {
-	struct	aic_softc sc_aic;
-	struct	resource *sc_port;
-	struct	resource *sc_irq;
-	struct	resource *sc_drq;
-	void	*sc_ih;
-};
-
-static int aic_isa_alloc_resources (device_t);
-static void aic_isa_release_resources (device_t);
-static int aic_isa_probe (device_t);
-static int aic_isa_attach (device_t);
-
-static u_int aic_isa_ports[] = { 0x340, 0x140 };
-#define	AIC_ISA_NUMPORTS NELEM(aic_isa_ports)
-#define	AIC_ISA_PORTSIZE 0x20
-
-static struct isa_pnp_id aic_ids[] = {
-	{ 0x15309004, "Adaptec AHA-1530P" },
-	{ 0x15209004, "Adaptec AHA-1520P" },
-	{ 0 }
-};
-
-static int
-aic_isa_alloc_resources(device_t dev)
-{
-	struct aic_isa_softc *sc = device_get_softc(dev);
-	int rid;
-
-	sc->sc_port = sc->sc_irq = sc->sc_drq = NULL;
-
-	rid = 0;
-	sc->sc_port = bus_alloc_resource(dev, SYS_RES_IOPORT, &rid,
-					0ul, ~0ul, AIC_ISA_PORTSIZE, RF_ACTIVE);
-	if (!sc->sc_port) {
-		device_printf(dev, "I/O port allocation failed\n");
-		return (ENOMEM);
-	}
-
-	if (isa_get_irq(dev) != -1) {
-		rid = 0;
-		sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid,
-						    RF_ACTIVE);
-		if (!sc->sc_irq) {
-			device_printf(dev, "IRQ allocation failed\n");
-			aic_isa_release_resources(dev);
-			return (ENOMEM);
-		}
-	}
-
-	if (isa_get_drq(dev) != -1) {
-		rid = 0;
-		sc->sc_drq = bus_alloc_resource_any(dev, SYS_RES_DRQ, &rid,
-						    RF_ACTIVE);
-		if (!sc->sc_drq) {
-			device_printf(dev, "DRQ allocation failed\n");
-			aic_isa_release_resources(dev);
-			return (ENOMEM);
-		}
-	}
-
-	sc->sc_aic.unit = device_get_unit(dev);
-	sc->sc_aic.tag = rman_get_bustag(sc->sc_port);
-	sc->sc_aic.bsh = rman_get_bushandle(sc->sc_port);
-	return (0);
-}
-
-static void
-aic_isa_release_resources(device_t dev)
-{
-	struct aic_isa_softc *sc = device_get_softc(dev);
-
-	if (sc->sc_port)
-		bus_release_resource(dev, SYS_RES_IOPORT, 0, sc->sc_port);
-	if (sc->sc_irq)
-		bus_release_resource(dev, SYS_RES_IRQ, 0, sc->sc_irq);
-	if (sc->sc_drq)
-		bus_release_resource(dev, SYS_RES_DRQ, 0, sc->sc_drq);
-	sc->sc_port = sc->sc_irq = sc->sc_drq = NULL;
-}
-
-static int
-aic_isa_probe(device_t dev)
-{
-	struct aic_isa_softc *sc = device_get_softc(dev);
-	struct aic_softc *aic = &sc->sc_aic;
-	int numports, i;
-	u_int port, *ports;
-	u_int8_t porta;
-
-	if (ISA_PNP_PROBE(device_get_parent(dev), dev, aic_ids) == ENXIO)
-		return (ENXIO);
-
-	port = isa_get_port(dev);
-	if (port != -1) {
-		ports = &port;
-		numports = 1;
-	} else {
-		ports = aic_isa_ports;
-		numports = AIC_ISA_NUMPORTS;
-	}
-
-	for (i = 0; i < numports; i++) {
-		if (bus_set_resource(dev, SYS_RES_IOPORT, 0, ports[i],
-				     AIC_ISA_PORTSIZE, -1))
-			continue;
-		if (aic_isa_alloc_resources(dev))
-			continue;
-		if (!aic_probe(aic)) {
-			aic_isa_release_resources(dev);
-			break;
-		}
-		aic_isa_release_resources(dev);
-	}
-
-	if (i == numports)
-		return (ENXIO);
-
-	porta = aic_inb(aic, PORTA);
-	if (isa_get_irq(dev) == -1) {
-		int irq = PORTA_IRQ(porta);
-
-		bus_set_resource(dev, SYS_RES_IRQ, 0, irq, 1,
-		    machintr_legacy_intr_cpuid(irq));
-	}
-	if ((aic->flags & AIC_DMA_ENABLE) && isa_get_drq(dev) == -1)
-		bus_set_resource(dev, SYS_RES_DRQ, 0, PORTA_DRQ(porta), 1, -1);
-	device_set_desc(dev, "Adaptec 6260/6360 SCSI controller");
-	return (0);
-}
-
-static int
-aic_isa_attach(device_t dev)
-{
-	struct aic_isa_softc *sc = device_get_softc(dev);
-	struct aic_softc *aic = &sc->sc_aic;
-	int error;
-
-	error = aic_isa_alloc_resources(dev);
-	if (error) {
-		device_printf(dev, "resource allocation failed\n");
-		return (error);
-	}
-
-	error = aic_attach(aic);
-	if (error) {
-		device_printf(dev, "attach failed\n");
-		aic_isa_release_resources(dev);
-		return (error);
-	}
-
-	error = bus_setup_intr(dev, sc->sc_irq, 0, aic_intr,
-				aic, &sc->sc_ih, NULL);
-	if (error) {
-		device_printf(dev, "failed to register interrupt handler\n");
-		aic_isa_release_resources(dev);
-		return (error);
-	}
-	return (0);
-}
-
-static int
-aic_isa_detach(device_t dev)
-{
-	struct aic_isa_softc *sc = device_get_softc(dev);
-	struct aic_softc *aic = &sc->sc_aic;
-	int error;
-
-	error = aic_detach(aic);
-	if (error) {
-		device_printf(dev, "detach failed\n");
-		return (error);
-	}
-
-	error = bus_teardown_intr(dev, sc->sc_irq, sc->sc_ih);
-	if (error) {
-		device_printf(dev, "failed to unregister interrupt handler\n");
-	}
-
-	aic_isa_release_resources(dev);
-	return (0);
-}
-
-static device_method_t aic_isa_methods[] = {
-	/* Device interface */
-	DEVMETHOD(device_probe,		aic_isa_probe),
-	DEVMETHOD(device_attach,	aic_isa_attach),
-	DEVMETHOD(device_detach,	aic_isa_detach),
-	{ 0, 0 }
-};
-
-static driver_t aic_isa_driver = {
-	"aic",
-	aic_isa_methods, sizeof(struct aic_isa_softc),
-};
-
-extern devclass_t aic_devclass;
-
-MODULE_DEPEND(aic, cam, 1,1,1);
-DRIVER_MODULE(aic, isa, aic_isa_driver, aic_devclass, NULL, NULL);
diff --git a/sys/dev/disk/aic/aic_pccard.c b/sys/dev/disk/aic/aic_pccard.c
index 2f7e861b22..0c9032dd86 100644
--- a/sys/dev/disk/aic/aic_pccard.c
+++ b/sys/dev/disk/aic/aic_pccard.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD: src/sys/dev/aic/aic_pccard.c,v 1.1 2000/01/14 23:42:36 imp Exp $
+ * $FreeBSD: src/sys/dev/aic/aic_pccard.c,v 1.20 2007/06/17 05:55:46 scottl Exp $
  */
 
 #include 
@@ -46,10 +46,10 @@ struct aic_pccard_softc {
 	void	*sc_ih;
 };
 
-static int aic_pccard_alloc_resources (device_t);
-static void aic_pccard_release_resources (device_t);
-static int aic_pccard_probe (device_t);
-static int aic_pccard_attach (device_t);
+static int aic_pccard_alloc_resources(device_t);
+static void aic_pccard_release_resources(device_t);
+static int aic_pccard_probe(device_t);
+static int aic_pccard_attach(device_t);
 
 static const struct pccard_product aic_pccard_products[] = {
 	PCMCIA_CARD(ADAPTEC, APA1460, 0),
@@ -83,6 +83,7 @@ aic_pccard_alloc_resources(device_t dev)
 		return (ENOMEM);
 	}
 
+	sc->sc_aic.dev = dev;
 	sc->sc_aic.unit = device_get_unit(dev);
 	sc->sc_aic.tag = rman_get_bustag(sc->sc_port);
 	sc->sc_aic.bsh = rman_get_bushandle(sc->sc_port);
@@ -112,7 +113,7 @@ aic_pccard_probe(device_t dev)
 			device_set_desc(dev, pp->pp_name);
 		return 0;
 	}
-	return ENXIO;
+	return EIO;
 }
 
 static int
@@ -188,3 +189,4 @@ extern devclass_t aic_devclass;
 
 MODULE_DEPEND(aic, cam, 1,1,1);
 DRIVER_MODULE(aic, pccard, aic_pccard_driver, aic_devclass, NULL, NULL);
+MODULE_VERSION(aic, 1);
diff --git a/sys/dev/disk/aic/aicvar.h b/sys/dev/disk/aic/aicvar.h
index 5e045ab314..2faa1b74bb 100644
--- a/sys/dev/disk/aic/aicvar.h
+++ b/sys/dev/disk/aic/aicvar.h
@@ -23,8 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $FreeBSD: src/sys/dev/aic/aicvar.h,v 1.2.2.1 2000/08/08 23:51:23 peter Exp $
- * $DragonFly: src/sys/dev/disk/aic/aicvar.h,v 1.4 2008/01/05 07:27:09 pavalos Exp $
+ * $FreeBSD: src/sys/dev/aic/aicvar.h,v 1.9 2007/06/17 05:55:46 scottl Exp $
  */
 
 struct aic_transinfo {
@@ -70,6 +69,7 @@ struct aic_scb {
 enum { AIC6260, AIC6360, AIC6370, GM82C700 };
 
 struct aic_softc {
+	device_t		dev;
 	int			unit;
 	bus_space_tag_t		tag;
 	bus_space_handle_t	bsh;
@@ -154,7 +154,7 @@ struct aic_softc {
 	bus_space_write_multi_4((aic)->tag, (aic)->bsh, (port), \
 		(u_int32_t *)(addr), (count))
 
-extern int aic_probe (struct aic_softc *);
-extern int aic_attach (struct aic_softc *);
-extern int aic_detach (struct aic_softc *);
-extern void aic_intr (void *);
+extern int aic_probe(struct aic_softc *);
+extern int aic_attach(struct aic_softc *);
+extern int aic_detach(struct aic_softc *);
+extern void aic_intr(void *);
diff --git a/sys/dev/disk/isp/isp_freebsd.c b/sys/dev/disk/isp/isp_freebsd.c
index ad59b93bb0..1d343554c8 100644
--- a/sys/dev/disk/isp/isp_freebsd.c
+++ b/sys/dev/disk/isp/isp_freebsd.c
@@ -3518,24 +3518,12 @@ isp_target_thread(ispsoftc_t *isp, int chan)
 			disk_size = 50 << 20;
 		}
 		disk_data = kmalloc(disk_size, M_ISPTARG, M_WAITOK | M_ZERO);
-		if (disk_data == NULL) {
-			isp_prt(isp, ISP_LOGERR, "%s: could not allocate disk data", __func__);
-			goto out;
-		}
 		isp_prt(isp, ISP_LOGINFO, "allocated a %ju MiB disk", (uintmax_t) (disk_size >> 20));
 	}
 	junk_data = kmalloc(JUNK_SIZE, M_ISPTARG, M_WAITOK | M_ZERO);
-	if (junk_data == NULL) {
-		isp_prt(isp, ISP_LOGERR, "%s: could not allocate junk", __func__);
-		goto out;
-	}
 
 
 	softc = kmalloc(sizeof (*softc), M_ISPTARG, M_WAITOK | M_ZERO);
-	if (softc == NULL) {
-		isp_prt(isp, ISP_LOGERR, "%s: could not allocate softc", __func__);
-		goto out;
-	}
 	TAILQ_INIT(&softc->work_queue);
 	TAILQ_INIT(&softc->rework_queue);
 	TAILQ_INIT(&softc->running_queue);
diff --git a/sys/dev/disk/md/md.c b/sys/dev/disk/md/md.c
index c3f65987b4..b81ad2a08b 100644
--- a/sys/dev/disk/md/md.c
+++ b/sys/dev/disk/md/md.c
@@ -404,7 +404,7 @@ mdcreate(unsigned length)
 		DEVSTAT_PRIORITY_OTHER);
 	sc->dev = disk_create(sc->unit, &sc->disk, &md_ops);
 	sc->dev->si_drv1 = sc;
-	sc->dev->si_iosize_max = DFLTPHYS;
+	sc->dev->si_iosize_max = MAXPHYS;
 	disk_setdisktype(&sc->disk, "memory");
 
 	bzero(&info, sizeof(info));
diff --git a/sys/dev/disk/nata/ata-disk.c b/sys/dev/disk/nata/ata-disk.c
index 6d42920d8f..fe48d3ea7f 100644
--- a/sys/dev/disk/nata/ata-disk.c
+++ b/sys/dev/disk/nata/ata-disk.c
@@ -154,7 +154,7 @@ ad_attach(device_t dev)
     if (ch->dma)
         cdev->si_iosize_max = ch->dma->max_iosize;
     else
-        cdev->si_iosize_max = DFLTPHYS;
+        cdev->si_iosize_max = min(MAXPHYS,64*1024);
     adp->cdev = cdev;
 
     bzero(&info, sizeof(info));
diff --git a/sys/dev/disk/nata/atapi-cd.c b/sys/dev/disk/nata/atapi-cd.c
index c9b8162d81..7001b2b39b 100644
--- a/sys/dev/disk/nata/atapi-cd.c
+++ b/sys/dev/disk/nata/atapi-cd.c
@@ -958,7 +958,7 @@ acd_set_ioparm(device_t dev)
     if (ch->dma)
 	cdp->iomax = min(ch->dma->max_iosize, 65534);
     else
-	cdp->iomax = min(DFLTPHYS, 65534);
+	cdp->iomax = min(MAXPHYS, 65534);
 
     cdp->cdev->si_iosize_max = (cdp->iomax / cdp->block_size) * cdp->block_size;
     cdp->cdev->si_bsize_phys = cdp->block_size;
diff --git a/sys/dev/disk/nata/atapi-fd.c b/sys/dev/disk/nata/atapi-fd.c
index 11457680d8..2f117533a4 100644
--- a/sys/dev/disk/nata/atapi-fd.c
+++ b/sys/dev/disk/nata/atapi-fd.c
@@ -113,7 +113,7 @@ afd_attach(device_t dev)
     if (ch->dma)
 	cdev->si_iosize_max = ch->dma->max_iosize;
     else
-	cdev->si_iosize_max = DFLTPHYS;
+	cdev->si_iosize_max = min(MAXPHYS,64*1024);
     fdp->cdev = cdev;
 
     /* announce we are here */
diff --git a/sys/dev/disk/nata/atapi-tape.c b/sys/dev/disk/nata/atapi-tape.c
index 705ae77522..614f1ce3a1 100644
--- a/sys/dev/disk/nata/atapi-tape.c
+++ b/sys/dev/disk/nata/atapi-tape.c
@@ -142,7 +142,7 @@ ast_attach(device_t dev)
     if (ch->dma)
 	cdev->si_iosize_max = ch->dma->max_iosize;
     else
-	cdev->si_iosize_max = DFLTPHYS;
+	cdev->si_iosize_max = min(MAXPHYS,64*1024);
     stp->cdev1 = cdev;
     cdev = make_dev(&ast_ops, 2 * device_get_unit(dev) + 1, UID_ROOT,
 		    GID_OPERATOR, 0640, "nast%d", device_get_unit(dev));
@@ -151,7 +151,7 @@ ast_attach(device_t dev)
     if (ch->dma)
 	cdev->si_iosize_max = ch->dma->max_iosize;
     else
-	cdev->si_iosize_max = DFLTPHYS;
+	cdev->si_iosize_max = min(MAXPHYS,64*1024);
     stp->cdev2 = cdev;
 
     /* announce we are here and ready */
diff --git a/sys/dev/disk/sili/sili.c b/sys/dev/disk/sili/sili.c
index 6809bf5c91..23cc996494 100644
--- a/sys/dev/disk/sili/sili.c
+++ b/sys/dev/disk/sili/sili.c
@@ -210,12 +210,6 @@ sili_port_alloc(struct sili_softc *sc, u_int port)
 	 */
 	ap->ap_ccbs = kmalloc(sizeof(struct sili_ccb) * sc->sc_ncmds, M_DEVBUF,
 			      M_WAITOK | M_ZERO);
-	if (ap->ap_ccbs == NULL) {
-		device_printf(sc->sc_dev,
-			      "unable to allocate command list for port %d\n",
-			      port);
-		goto freeport;
-	}
 
 	/*
 	 * Most structures are in the port BAR.  Assign convenient
diff --git a/sys/dev/misc/dcons/dcons_os.c b/sys/dev/misc/dcons/dcons_os.c
index 8fcd3afffb..95c736287e 100644
--- a/sys/dev/misc/dcons/dcons_os.c
+++ b/sys/dev/misc/dcons/dcons_os.c
@@ -570,8 +570,8 @@ dcons_attach_port(int port, char *name, int flags)
 	ASSERT_LWKT_TOKEN_HELD(&tty_token);
 	dc = &sc[port];
 	dc->flags = flags;
-	dev = make_dev(&dcons_ops, port,
-			UID_ROOT, GID_WHEEL, 0600, name);
+	dev = make_dev(&dcons_ops, port, UID_ROOT, GID_WHEEL, 0600, "%s",
+	    name);
 	dc->dev = (void *)dev;
 	tp = ttymalloc(NULL);
 
diff --git a/sys/dev/netif/e1000/if_igb.c b/sys/dev/netif/e1000/if_igb.c
index 4d2329ebb9..91bf9e4a16 100644
--- a/sys/dev/netif/e1000/if_igb.c
+++ b/sys/dev/netif/e1000/if_igb.c
@@ -636,12 +636,6 @@ igb_detach(device_t dev)
 
 	INIT_DEBUGOUT("igb_detach: begin");
 
-	/* Make sure VLANS are not using driver */
-	if (adapter->ifp->if_vlantrunks != NULL) {
-		device_printf(dev,"Vlan in use, detach first\n");
-		return (EBUSY);
-	}
-
 	IGB_CORE_LOCK(adapter);
 	adapter->in_detach = 1;
 	igb_stop(adapter);
@@ -3918,9 +3912,9 @@ igb_initialize_receive_units(struct adapter *adapter)
 
 		/* Set maximum packet len */
 		psize = adapter->max_frame_size;
-		/* are we on a vlan? */
-		if (adapter->ifp->if_vlantrunks != NULL)
-			psize += VLAN_TAG_SIZE;
+
+		/* Prepare for VLAN */
+		psize += VLAN_TAG_SIZE;
 		E1000_WRITE_REG(&adapter->hw, E1000_RLPML, psize);
 	} else {
 		rctl &= ~E1000_RCTL_LPE;
diff --git a/sys/dev/netif/en_pci/if_en_pci.c b/sys/dev/netif/en_pci/if_en_pci.c
index 35a61d061d..a7693ea0d5 100644
--- a/sys/dev/netif/en_pci/if_en_pci.c
+++ b/sys/dev/netif/en_pci/if_en_pci.c
@@ -32,7 +32,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * $FreeBSD: src/sys/pci/if_en_pci.c,v 1.12 1999/08/21 22:10:49 msmith Exp $
- * $DragonFly: src/sys/dev/netif/en_pci/if_en_pci.c,v 1.16 2007/07/11 23:46:58 dillon Exp $
  */
 
 /*
@@ -236,7 +235,8 @@ en_pci_attach(pcici_t config_id, int unit)
   en_cd.cd_devs[unit] = sc;		/* fake a cfdriver structure */
   en_cd.cd_ndevs = NEN;
   if_initname(&(sc->enif), "en", unit);
-  ksnprintf(sc->sc_dev.dv_xname, sizeof(sc->sc_dev.dv_xname), sc->enif.if_xname);
+  ksnprintf(sc->sc_dev.dv_xname, sizeof(sc->sc_dev.dv_xname), "%s",
+      sc->enif.if_xname);
   scp->en_confid = config_id;
 
   /*
diff --git a/sys/dev/netif/iwi/if_iwi.c b/sys/dev/netif/iwi/if_iwi.c
index 1342879d96..8876bf70cf 100644
--- a/sys/dev/netif/iwi/if_iwi.c
+++ b/sys/dev/netif/iwi/if_iwi.c
@@ -660,11 +660,6 @@ iwi_alloc_tx_ring(struct iwi_softc *sc, struct iwi_tx_ring *ring, int count,
 
 	ring->data = kmalloc(count * sizeof (struct iwi_tx_data), M_DEVBUF,
 	    M_WAITOK | M_ZERO);
-	if (ring->data == NULL) {
-		device_printf(sc->sc_dev, "could not allocate soft data\n");
-		error = ENOMEM;
-		goto fail;
-	}
 
 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IWI_MAX_NSEG,
@@ -768,11 +763,6 @@ iwi_alloc_rx_ring(struct iwi_softc *sc, struct iwi_rx_ring *ring, int count)
 
 	ring->data = kmalloc(count * sizeof (struct iwi_rx_data), M_DEVBUF,
 	    M_WAITOK | M_ZERO);
-	if (ring->data == NULL) {
-		device_printf(sc->sc_dev, "could not allocate soft data\n");
-		error = ENOMEM;
-		goto fail;
-	}
 
 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES,
diff --git a/sys/dev/netif/lgue/if_lgue.c b/sys/dev/netif/lgue/if_lgue.c
index ccebe839ab..6e1a211051 100644
--- a/sys/dev/netif/lgue/if_lgue.c
+++ b/sys/dev/netif/lgue/if_lgue.c
@@ -379,12 +379,14 @@ lgue_intreof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status
 	ifp = &sc->lgue_arpcom.ac_if;
 	lwkt_serialize_enter(ifp->if_serializer);
 	if (status != USBD_NORMAL_COMPLETION) {
-		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
+		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED) {
 			lwkt_serialize_exit(ifp->if_serializer);
 			return;
+		}
+		if_printf(ifp, "usb error on intr: %s\n", usbd_errstr(status));
 		if (status == USBD_STALLED)
 			usbd_clear_endpoint_stall(sc->lgue_ep[LGUE_ENDPT_INTR]);
-			lwkt_serialize_exit(ifp->if_serializer);
+		lwkt_serialize_exit(ifp->if_serializer);
 		return;
 	}
 	lgue_intrstart(ifp);
@@ -675,10 +677,6 @@ lgue_init(void *xsc)
 		}
 	}
 	sc->lgue_tx_buf = kmalloc(LGUE_BUFSZ, M_USBDEV, M_WAITOK);
-	if (sc->lgue_tx_buf == NULL) {
-		if_printf(ifp, "tx internal buffer allocate failed\n");
-		return;
-	}
 
 	if (sc->lgue_rx_xfer == NULL) {
 		sc->lgue_rx_xfer = usbd_alloc_xfer(sc->lgue_udev);
@@ -688,10 +686,6 @@ lgue_init(void *xsc)
 		}
 	}
 	sc->lgue_rx_buf = kmalloc(LGUE_BUFSZ, M_USBDEV, M_WAITOK);
-	if (sc->lgue_rx_buf == NULL) {
-		if_printf(ifp, "rx internal buffer allocate failed\n");
-		return;
-	}
 
 	/* Create INTR buf */
 	if (sc->lgue_intr_xfer == NULL) {
diff --git a/sys/dev/netif/mxge/if_mxge.c b/sys/dev/netif/mxge/if_mxge.c
index b4448900d9..c80a6b4e5d 100644
--- a/sys/dev/netif/mxge/if_mxge.c
+++ b/sys/dev/netif/mxge/if_mxge.c
@@ -3186,24 +3186,16 @@ mxge_alloc_slice_rings(struct mxge_slice_state *ss, int rx_ring_entries,
 	/* allocate the rx shadow rings */
 	bytes = rx_ring_entries * sizeof (*ss->rx_small.shadow);
 	ss->rx_small.shadow = kmalloc(bytes, M_DEVBUF, M_ZERO|M_WAITOK);
-	if (ss->rx_small.shadow == NULL)
-		return err;;
 
 	bytes = rx_ring_entries * sizeof (*ss->rx_big.shadow);
 	ss->rx_big.shadow = kmalloc(bytes, M_DEVBUF, M_ZERO|M_WAITOK);
-	if (ss->rx_big.shadow == NULL)
-		return err;;
 
 	/* allocate the rx host info rings */
 	bytes = rx_ring_entries * sizeof (*ss->rx_small.info);
 	ss->rx_small.info = kmalloc(bytes, M_DEVBUF, M_ZERO|M_WAITOK);
-	if (ss->rx_small.info == NULL)
-		return err;;
 
 	bytes = rx_ring_entries * sizeof (*ss->rx_big.info);
 	ss->rx_big.info = kmalloc(bytes, M_DEVBUF, M_ZERO|M_WAITOK);
-	if (ss->rx_big.info == NULL)
-		return err;;
 
 	/* allocate the rx busdma resources */
 	err = bus_dma_tag_create(sc->parent_dmat,	/* parent */
@@ -3298,8 +3290,6 @@ mxge_alloc_slice_rings(struct mxge_slice_state *ss, int rx_ring_entries,
 	bytes = 8 + 
 		sizeof (*ss->tx.req_list) * (ss->tx.max_desc + 4);
 	ss->tx.req_bytes = kmalloc(bytes, M_DEVBUF, M_WAITOK);
-	if (ss->tx.req_bytes == NULL)
-		return err;;
 	/* ensure req_list entries are aligned to 8 bytes */
 	ss->tx.req_list = (mcp_kreq_ether_send_t *)
 		((unsigned long)(ss->tx.req_bytes + 7) & ~7UL);
@@ -3314,8 +3304,6 @@ mxge_alloc_slice_rings(struct mxge_slice_state *ss, int rx_ring_entries,
 	/* allocate the tx host info ring */
 	bytes = tx_ring_entries * sizeof (*ss->tx.info);
 	ss->tx.info = kmalloc(bytes, M_DEVBUF, M_ZERO|M_WAITOK);
-	if (ss->tx.info == NULL)
-		return err;;
 	
 	/* allocate the tx busdma resources */
 	err = bus_dma_tag_create(sc->parent_dmat,	/* parent */
diff --git a/sys/dev/netif/pcn/if_pcn.c b/sys/dev/netif/pcn/if_pcn.c
index ccfe9f2f41..503b4b60d4 100644
--- a/sys/dev/netif/pcn/if_pcn.c
+++ b/sys/dev/netif/pcn/if_pcn.c
@@ -888,10 +888,11 @@ pcn_tick(void *xsc)
 	if (!sc->pcn_link) {
 		mii_pollstat(mii);
 		if (mii->mii_media_status & IFM_ACTIVE &&
-		    IFM_SUBTYPE(mii->mii_media_active) != IFM_NONE)
+		    IFM_SUBTYPE(mii->mii_media_active) != IFM_NONE) {
 			sc->pcn_link++;
 			if (!ifq_is_empty(&ifp->if_snd))
 				if_devstart(ifp);
+		}
 	}
 	callout_reset(&sc->pcn_stat_timer, hz, pcn_tick, sc);
 
diff --git a/sys/dev/raid/aac/aac_debug.c b/sys/dev/raid/aac/aac_debug.c
index 7165419dfb..e1168b7e69 100644
--- a/sys/dev/raid/aac/aac_debug.c
+++ b/sys/dev/raid/aac/aac_debug.c
@@ -156,7 +156,7 @@ void
 aac_panic(struct aac_softc *sc, char *reason)
 {
 	aac_print_queues(sc);
-	panic(reason);
+	panic("%s", reason);
 }
 
 /*
diff --git a/sys/dev/raid/arcmsr/arcmsr.c b/sys/dev/raid/arcmsr/arcmsr.c
index eea4f51cca..ea6533bd5b 100644
--- a/sys/dev/raid/arcmsr/arcmsr.c
+++ b/sys/dev/raid/arcmsr/arcmsr.c
@@ -196,6 +196,7 @@ static driver_t arcmsr_driver={
 
 static devclass_t arcmsr_devclass;
 DRIVER_MODULE(arcmsr, pci, arcmsr_driver, arcmsr_devclass, NULL, NULL);
+MODULE_VERSION(arcmsr, 1);
 MODULE_DEPEND(arcmsr, pci, 1, 1, 1);
 MODULE_DEPEND(arcmsr, cam, 1, 1, 1);
 #ifndef BUS_DMA_COHERENT
@@ -209,6 +210,10 @@ static struct dev_ops arcmsr_ops = {
 	.d_ioctl =	arcmsr_ioctl,		        /* ioctl    */
 };
 
+static int	arcmsr_msi_enable = 1;
+TUNABLE_INT("hw.arcmsr.msi.enable", &arcmsr_msi_enable);
+
+
 /*
 **************************************************************************
 **************************************************************************
@@ -3510,6 +3515,7 @@ static int arcmsr_attach(device_t dev)
 	struct cam_devq	*devq;	/* Device Queue to use for this SIM */
 	struct resource	*irqres;
 	int	rid;
+	u_int irq_flags;
 
 	if(acb == NULL) {
 		kprintf("arcmsr%d: cannot allocate softc\n", unit);
@@ -3523,7 +3529,10 @@ static int arcmsr_attach(device_t dev)
 	}
 	/* After setting up the adapter, map our interrupt */
 	rid=0;
-	irqres=bus_alloc_resource(dev, SYS_RES_IRQ, &rid, 0ul, ~0ul, 1, RF_SHAREABLE | RF_ACTIVE);
+	acb->irq_type = pci_alloc_1intr(dev, arcmsr_msi_enable, &rid,
+	    &irq_flags);
+	irqres=bus_alloc_resource(dev, SYS_RES_IRQ, &rid, 0ul, ~0ul, 1,
+	    irq_flags);
 	if(irqres == NULL ||
 		bus_setup_intr(dev, irqres, INTR_MPSAFE, arcmsr_intr_handler, acb, &acb->ih, NULL)) {
 		arcmsr_free_resource(acb);
@@ -3544,6 +3553,8 @@ static int arcmsr_attach(device_t dev)
 	if(devq == NULL) {
 	    arcmsr_free_resource(acb);
 		bus_release_resource(dev, SYS_RES_IRQ, 0, acb->irqres);
+		if (acb->irq_type == PCI_INTR_TYPE_MSI)
+			pci_release_msi(dev);
 		ARCMSR_LOCK_DESTROY(&acb->qbuffer_lock);
 		kprintf("arcmsr%d: cam_simq_alloc failure!\n", unit);
 		return ENXIO;
@@ -3552,6 +3563,8 @@ static int arcmsr_attach(device_t dev)
 	if(acb->psim == NULL) {
 		arcmsr_free_resource(acb);
 		bus_release_resource(dev, SYS_RES_IRQ, 0, acb->irqres);
+		if (acb->irq_type == PCI_INTR_TYPE_MSI)
+			pci_release_msi(dev);
 		cam_simq_release(devq);
 		ARCMSR_LOCK_DESTROY(&acb->qbuffer_lock);
 		kprintf("arcmsr%d: cam_sim_alloc failure!\n", unit);
@@ -3561,6 +3574,8 @@ static int arcmsr_attach(device_t dev)
 	if(xpt_bus_register(acb->psim, 0) != CAM_SUCCESS) {
 		arcmsr_free_resource(acb);
 		bus_release_resource(dev, SYS_RES_IRQ, 0, acb->irqres);
+		if (acb->irq_type == PCI_INTR_TYPE_MSI)
+			pci_release_msi(dev);
 		cam_sim_free(acb->psim);
 		ARCMSR_LOCK_DESTROY(&acb->qbuffer_lock);
 		kprintf("arcmsr%d: xpt_bus_register failure!\n", unit);
@@ -3569,6 +3584,8 @@ static int arcmsr_attach(device_t dev)
 	if(xpt_create_path(&acb->ppath, /* periph */ NULL, cam_sim_path(acb->psim), CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
 		arcmsr_free_resource(acb);
 		bus_release_resource(dev, SYS_RES_IRQ, 0, acb->irqres);
+		if (acb->irq_type == PCI_INTR_TYPE_MSI)
+			pci_release_msi(dev);
 		xpt_bus_deregister(cam_sim_path(acb->psim));
 		cam_sim_free(acb->psim);
 		ARCMSR_LOCK_DESTROY(&acb->qbuffer_lock);
@@ -3707,6 +3724,8 @@ static int arcmsr_detach(device_t dev)
 		bus_release_resource(dev, SYS_RES_MEMORY, PCIR_BAR(i), acb->sys_res_arcmsr[i]);
 	}
 	bus_release_resource(dev, SYS_RES_IRQ, 0, acb->irqres);
+	if (acb->irq_type == PCI_INTR_TYPE_MSI)
+		pci_release_msi(dev);
 	ARCMSR_LOCK_ACQUIRE(&acb->qbuffer_lock);
 	xpt_async(AC_LOST_DEVICE, acb->ppath, NULL);
 	xpt_free_path(acb->ppath);
diff --git a/sys/dev/raid/arcmsr/arcmsr.h b/sys/dev/raid/arcmsr/arcmsr.h
index 2544069e15..6b99853c87 100644
--- a/sys/dev/raid/arcmsr/arcmsr.h
+++ b/sys/dev/raid/arcmsr/arcmsr.h
@@ -781,6 +781,7 @@ struct AdapterControlBlock {
 	struct resource *				sys_res_arcmsr[2];
 	struct resource *				irqres;
 	void *						ih;                                    /* interrupt handle */
+	int						irq_type;
 
 	/* Hooks into the CAM XPT */
 	struct						cam_sim *psim;
diff --git a/sys/dev/raid/asr/asr.c b/sys/dev/raid/asr/asr.c
index 6666464a18..154f4cd36b 100644
--- a/sys/dev/raid/asr/asr.c
+++ b/sys/dev/raid/asr/asr.c
@@ -3620,9 +3620,10 @@ asr_ioctl(struct dev_ioctl_args *ap)
 	int		j;
 #endif /* ASR_IOCTL_COMPAT */
 
-	if (sc != NULL)
-	switch(cmd) {
+	if (sc == NULL)
+		return (EINVAL);
 
+	switch(cmd) {
 	case DPT_SIGNATURE:
 #ifdef ASR_IOCTL_COMPAT
 #if (dsDescription_size != 50)
diff --git a/sys/dev/raid/hptiop/hptiop.c b/sys/dev/raid/hptiop/hptiop.c
index ffbd4a24eb..dd6de20aa5 100644
--- a/sys/dev/raid/hptiop/hptiop.c
+++ b/sys/dev/raid/hptiop/hptiop.c
@@ -1155,10 +1155,11 @@ static int hptiop_internal_memalloc_mv(struct hpt_iop_hba *hba)
 			MVIOP_IOCTLCFG_SIZE,
 			hptiop_mv_map_ctlcfg, hba, 0)) {
 		device_printf(hba->pcidev, "bus_dmamap_load failed!\n");
-		if (hba->ctlcfg_dmat)
+		if (hba->ctlcfg_dmat) {
 			bus_dmamem_free(hba->ctlcfg_dmat,
 				hba->ctlcfg_ptr, hba->ctlcfg_dmamap);
 			bus_dma_tag_destroy(hba->ctlcfg_dmat);
+		}
 		return -1;
 	}
 
diff --git a/sys/dev/raid/ida/ida_disk.c b/sys/dev/raid/ida/ida_disk.c
index e067a6f0f0..7caf0ad1dc 100644
--- a/sys/dev/raid/ida/ida_disk.c
+++ b/sys/dev/raid/ida/ida_disk.c
@@ -278,7 +278,7 @@ idad_attach(device_t dev)
 	dsk = disk_create(drv->unit, &drv->disk, &id_ops);
 
 	dsk->si_drv1 = drv;
-	dsk->si_iosize_max = DFLTPHYS;		/* XXX guess? */
+	dsk->si_iosize_max = min(MAXPHYS,64*1024);		/* XXX guess? */
 
 	/*
 	 * Set disk info, as it appears that all needed data is available already.
diff --git a/sys/dev/raid/mfi/Makefile b/sys/dev/raid/mfi/Makefile
index 809eac3af3..62557da25a 100644
--- a/sys/dev/raid/mfi/Makefile
+++ b/sys/dev/raid/mfi/Makefile
@@ -8,7 +8,7 @@ SUBDIR+= mfi_linux
 .endif
 
 KMOD=	mfi
-SRCS=	mfi.c mfi_pci.c mfi_disk.c mfi_debug.c mfi_syspd.c
+SRCS=	mfi.c mfi_pci.c mfi_disk.c mfi_debug.c mfi_syspd.c mfi_tbolt.c
 SRCS+=	opt_mfi.h opt_cam.h
 SRCS+=	device_if.h bus_if.h pci_if.h
 
diff --git a/sys/dev/raid/mfi/mfi.c b/sys/dev/raid/mfi/mfi.c
index 843f6d77ce..ad3bbaadd3 100644
--- a/sys/dev/raid/mfi/mfi.c
+++ b/sys/dev/raid/mfi/mfi.c
@@ -48,38 +48,9 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- */
-/*-
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *            Copyright 1994-2009 The FreeBSD Project.
- *            All rights reserved.
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- *    THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FREEBSD PROJECT OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY,OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION)HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * The views and conclusions contained in the software and documentation
- * are those of the authors and should not be interpreted as representing
- * official policies,either expressed or implied, of the FreeBSD Project.
  *
  * $FreeBSD: src/sys/dev/mfi/mfi.c,v 1.62 2011/11/09 21:53:49 delphij Exp $
+ * FreeBSD projects/head_mfi/ r233016
  */
 
 #include "opt_mfi.h"
@@ -99,6 +70,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #include 
 
@@ -110,7 +82,6 @@
 
 static int	mfi_alloc_commands(struct mfi_softc *);
 static int	mfi_comms_init(struct mfi_softc *);
-static int	mfi_wait_command(struct mfi_softc *, struct mfi_command *);
 static int	mfi_get_controller_info(struct mfi_softc *);
 static int	mfi_get_log_state(struct mfi_softc *,
 		    struct mfi_evt_log_state **);
@@ -122,33 +93,39 @@ static void	mfi_startup(void *arg);
 static void	mfi_intr(void *arg);
 static void	mfi_ldprobe(struct mfi_softc *sc);
 static void	mfi_syspdprobe(struct mfi_softc *sc);
+static void	mfi_handle_evt(void *context, int pending);
 static int	mfi_aen_register(struct mfi_softc *sc, int seq, int locale);
 static void	mfi_aen_complete(struct mfi_command *);
-static int	mfi_aen_setup(struct mfi_softc *, uint32_t);
 static int	mfi_add_ld(struct mfi_softc *sc, int);
 static void	mfi_add_ld_complete(struct mfi_command *);
 static int	mfi_add_sys_pd(struct mfi_softc *sc, int);
 static void	mfi_add_sys_pd_complete(struct mfi_command *);
-static struct mfi_command * mfi_bio_command(struct mfi_softc *);
+static struct mfi_command *mfi_bio_command(struct mfi_softc *);
 static void	mfi_bio_complete(struct mfi_command *);
-static struct mfi_command * mfi_build_ldio(struct mfi_softc *,struct bio*);
-static struct mfi_command * mfi_build_syspdio(struct mfi_softc *,struct bio*);
-static int	mfi_mapcmd(struct mfi_softc *, struct mfi_command *);
+static struct mfi_command *mfi_build_ldio(struct mfi_softc *,struct bio*);
+static struct mfi_command *mfi_build_syspdio(struct mfi_softc *,struct bio*);
 static int	mfi_send_frame(struct mfi_softc *, struct mfi_command *);
-static void	mfi_complete(struct mfi_softc *, struct mfi_command *);
 static int	mfi_abort(struct mfi_softc *, struct mfi_command *);
 static int	mfi_linux_ioctl_int(struct cdev *, u_long, caddr_t, int);
 static void	mfi_timeout(void *);
 static int	mfi_user_command(struct mfi_softc *,
 		    struct mfi_ioc_passthru *);
-static void 	mfi_enable_intr_xscale(struct mfi_softc *sc);
-static void 	mfi_enable_intr_ppc(struct mfi_softc *sc);
-static int32_t 	mfi_read_fw_status_xscale(struct mfi_softc *sc);
-static int32_t 	mfi_read_fw_status_ppc(struct mfi_softc *sc);
-static int 	mfi_check_clear_intr_xscale(struct mfi_softc *sc);
-static int 	mfi_check_clear_intr_ppc(struct mfi_softc *sc);
-static void 	mfi_issue_cmd_xscale(struct mfi_softc *sc,uint32_t bus_add,uint32_t frame_cnt);
-static void 	mfi_issue_cmd_ppc(struct mfi_softc *sc,uint32_t bus_add,uint32_t frame_cnt);
+static void	mfi_enable_intr_xscale(struct mfi_softc *sc);
+static void	mfi_enable_intr_ppc(struct mfi_softc *sc);
+static int32_t	mfi_read_fw_status_xscale(struct mfi_softc *sc);
+static int32_t	mfi_read_fw_status_ppc(struct mfi_softc *sc);
+static int	mfi_check_clear_intr_xscale(struct mfi_softc *sc);
+static int	mfi_check_clear_intr_ppc(struct mfi_softc *sc);
+static void	mfi_issue_cmd_xscale(struct mfi_softc *sc, bus_addr_t bus_add,
+		    uint32_t frame_cnt);
+static void	mfi_issue_cmd_ppc(struct mfi_softc *sc, bus_addr_t bus_add,
+		    uint32_t frame_cnt);
+static int mfi_config_lock(struct mfi_softc *sc, uint32_t opcode);
+static void mfi_config_unlock(struct mfi_softc *sc, int locked);
+static int mfi_check_command_pre(struct mfi_softc *sc, struct mfi_command *cm);
+static void mfi_check_command_post(struct mfi_softc *sc, struct mfi_command *cm);
+static int mfi_check_for_sscd(struct mfi_softc *sc, struct mfi_command *cm);
+
 static void	mfi_filter_detach(struct knote *);
 static int	mfi_filter_read(struct knote *, long);
 static int	mfi_filter_write(struct knote *, long);
@@ -169,8 +146,10 @@ TUNABLE_INT("hw.mfi.max_cmds", &mfi_max_cmds);
 SYSCTL_INT(_hw_mfi, OID_AUTO, max_cmds, CTLFLAG_RD, &mfi_max_cmds,
 	   0, "Max commands");
 
-static int	mfi_msi_enable = 1;
-TUNABLE_INT("hw.mfi.msi.enable", &mfi_msi_enable);
+static int	mfi_detect_jbod_change = 1;
+TUNABLE_INT("hw.mfi.detect_jbod_change", &mfi_detect_jbod_change);
+SYSCTL_INT(_hw_mfi, OID_AUTO, detect_jbod_change, CTLFLAG_RW,
+	   &mfi_detect_jbod_change, 0, "Detect a change to a JBOD");
 
 /* Management interface */
 static d_open_t		mfi_open;
@@ -180,7 +159,7 @@ static d_kqfilter_t	mfi_kqfilter;
 
 static struct dev_ops mfi_ops = {
 	{ "mfi", 0, 0 },
-	.d_open = 	mfi_open,
+	.d_open =	mfi_open,
 	.d_close =	mfi_close,
 	.d_ioctl =	mfi_ioctl,
 	.d_kqfilter =	mfi_kqfilter,
@@ -194,6 +173,7 @@ static struct filterops mfi_write_filterops =
 MALLOC_DEFINE(M_MFIBUF, "mfibuf", "Buffers for the MFI driver");
 
 #define MFI_INQ_LENGTH SHORT_INQUIRY_LENGTH
+struct mfi_skinny_dma_info mfi_skinny;
 
 static void
 mfi_enable_intr_xscale(struct mfi_softc *sc)
@@ -261,13 +241,13 @@ mfi_check_clear_intr_ppc(struct mfi_softc *sc)
 }
 
 static void
-mfi_issue_cmd_xscale(struct mfi_softc *sc,uint32_t bus_add,uint32_t frame_cnt)
+mfi_issue_cmd_xscale(struct mfi_softc *sc, bus_addr_t bus_add, uint32_t frame_cnt)
 {
 	MFI_WRITE4(sc, MFI_IQP,(bus_add >>3) | frame_cnt);
 }
 
 static void
-mfi_issue_cmd_ppc(struct mfi_softc *sc,uint32_t bus_add,uint32_t frame_cnt)
+mfi_issue_cmd_ppc(struct mfi_softc *sc, bus_addr_t bus_add, uint32_t frame_cnt)
 {
 	if (sc->mfi_flags & MFI_FLAGS_SKINNY) {
 		MFI_WRITE4(sc, MFI_IQPL, (bus_add | frame_cnt << 1) | 1);
@@ -277,18 +257,16 @@ mfi_issue_cmd_ppc(struct mfi_softc *sc,uint32_t bus_add,uint32_t frame_cnt)
 	}
 }
 
-static int
+int
 mfi_transition_firmware(struct mfi_softc *sc)
 {
 	uint32_t fw_state, cur_state;
 	int max_wait, i;
 	uint32_t cur_abs_reg_val = 0;
 	uint32_t prev_abs_reg_val = 0;
-	bus_space_handle_t idb;
 
 	cur_abs_reg_val = sc->mfi_read_fw_status(sc);
 	fw_state = cur_abs_reg_val & MFI_FWSTATE_MASK;
-	idb = sc->mfi_flags & MFI_FLAGS_SKINNY ? MFI_SKINNY_IDB : MFI_IDB;
 	while (fw_state != MFI_FWSTATE_READY) {
 		if (bootverbose)
 			device_printf(sc->mfi_dev, "Waiting for firmware to "
@@ -299,31 +277,43 @@ mfi_transition_firmware(struct mfi_softc *sc)
 			device_printf(sc->mfi_dev, "Firmware fault\n");
 			return (ENXIO);
 		case MFI_FWSTATE_WAIT_HANDSHAKE:
-			MFI_WRITE4(sc, idb, MFI_FWINIT_CLEAR_HANDSHAKE);
-			max_wait = 2;
+			if (sc->mfi_flags & MFI_FLAGS_SKINNY || sc->mfi_flags & MFI_FLAGS_TBOLT)
+			    MFI_WRITE4(sc, MFI_SKINNY_IDB, MFI_FWINIT_CLEAR_HANDSHAKE);
+			else
+			    MFI_WRITE4(sc, MFI_IDB, MFI_FWINIT_CLEAR_HANDSHAKE);
+			max_wait = MFI_RESET_WAIT_TIME;
 			break;
 		case MFI_FWSTATE_OPERATIONAL:
-			MFI_WRITE4(sc, idb, MFI_FWINIT_READY);
-			max_wait = 10;
+			if (sc->mfi_flags & MFI_FLAGS_SKINNY || sc->mfi_flags & MFI_FLAGS_TBOLT)
+			    MFI_WRITE4(sc, MFI_SKINNY_IDB, 7);
+			else
+			    MFI_WRITE4(sc, MFI_IDB, MFI_FWINIT_READY);
+			max_wait = MFI_RESET_WAIT_TIME;
 			break;
 		case MFI_FWSTATE_UNDEFINED:
 		case MFI_FWSTATE_BB_INIT:
-			max_wait = 2;
+			max_wait = MFI_RESET_WAIT_TIME;
+			break;
+		case MFI_FWSTATE_FW_INIT_2:
+			max_wait = MFI_RESET_WAIT_TIME;
 			break;
 		case MFI_FWSTATE_FW_INIT:
 		case MFI_FWSTATE_FLUSH_CACHE:
-			max_wait = 20;
+			max_wait = MFI_RESET_WAIT_TIME;
 			break;
 		case MFI_FWSTATE_DEVICE_SCAN:
-			max_wait = 180; /* wait for 180 seconds */
+			max_wait = MFI_RESET_WAIT_TIME; /* wait for 180 seconds */
 			prev_abs_reg_val = cur_abs_reg_val;
 			break;
 		case MFI_FWSTATE_BOOT_MESSAGE_PENDING:
-			MFI_WRITE4(sc, idb, MFI_FWINIT_HOTPLUG);
-			max_wait = 10;
+			if (sc->mfi_flags & MFI_FLAGS_SKINNY || sc->mfi_flags & MFI_FLAGS_TBOLT)
+			    MFI_WRITE4(sc, MFI_SKINNY_IDB, MFI_FWINIT_HOTPLUG);
+			else
+			    MFI_WRITE4(sc, MFI_IDB, MFI_FWINIT_HOTPLUG);
+			max_wait = MFI_RESET_WAIT_TIME;
 			break;
 		default:
-			device_printf(sc->mfi_dev,"Unknown firmware state %#x\n",
+			device_printf(sc->mfi_dev, "Unknown firmware state %#x\n",
 			    fw_state);
 			return (ENXIO);
 		}
@@ -349,25 +339,14 @@ mfi_transition_firmware(struct mfi_softc *sc)
 	return (0);
 }
 
-#if defined(__x86_64__)
 static void
-mfi_addr64_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
+mfi_addr_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 {
-	uint64_t *addr;
+	bus_addr_t *addr;
 
 	addr = arg;
 	*addr = segs[0].ds_addr;
 }
-#else
-static void
-mfi_addr32_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
-{
-	uint32_t *addr;
-
-	addr = arg;
-	*addr = segs[0].ds_addr;
-}
-#endif
 
 int
 mfi_attach(struct mfi_softc *sc)
@@ -375,14 +354,20 @@ mfi_attach(struct mfi_softc *sc)
 	uint32_t status;
 	int error, commsz, framessz, sensesz;
 	int frames, unit, max_fw_sge;
-	u_int irq_flags;
+	uint32_t tb_mem_size = 0;
 
-	device_printf(sc->mfi_dev, "Megaraid SAS driver Ver 3.981\n");
+	if (sc == NULL)
+		return EINVAL;
+
+	device_printf(sc->mfi_dev, "Megaraid SAS driver Ver %s \n",
+	    MEGASAS_VERSION);
 
 	lockinit(&sc->mfi_io_lock, "MFI I/O lock", 0, LK_CANRECURSE);
 	lockinit(&sc->mfi_config_lock, "MFI config", 0, LK_CANRECURSE);
 	TAILQ_INIT(&sc->mfi_ld_tqh);
 	TAILQ_INIT(&sc->mfi_syspd_tqh);
+	TAILQ_INIT(&sc->mfi_evt_queue);
+	TASK_INIT(&sc->mfi_evt_task, 0, mfi_handle_evt, sc);
 	TAILQ_INIT(&sc->mfi_aen_pids);
 	TAILQ_INIT(&sc->mfi_cam_ccbq);
 
@@ -391,11 +376,26 @@ mfi_attach(struct mfi_softc *sc)
 	mfi_initq_busy(sc);
 	mfi_initq_bio(sc);
 
+	sc->adpreset = 0;
+	sc->last_seq_num = 0;
+	sc->disableOnlineCtrlReset = 1;
+	sc->issuepend_done = 1;
+	sc->hw_crit_error = 0;
+
 	if (sc->mfi_flags & MFI_FLAGS_1064R) {
 		sc->mfi_enable_intr = mfi_enable_intr_xscale;
 		sc->mfi_read_fw_status = mfi_read_fw_status_xscale;
 		sc->mfi_check_clear_intr = mfi_check_clear_intr_xscale;
 		sc->mfi_issue_cmd = mfi_issue_cmd_xscale;
+	} else if (sc->mfi_flags & MFI_FLAGS_TBOLT) {
+		sc->mfi_enable_intr = mfi_tbolt_enable_intr_ppc;
+		sc->mfi_disable_intr = mfi_tbolt_disable_intr_ppc;
+		sc->mfi_read_fw_status = mfi_tbolt_read_fw_status_ppc;
+		sc->mfi_check_clear_intr = mfi_tbolt_check_clear_intr_ppc;
+		sc->mfi_issue_cmd = mfi_tbolt_issue_cmd_ppc;
+		sc->mfi_adp_reset = mfi_tbolt_adp_reset;
+		sc->mfi_tbolt = 1;
+		TAILQ_INIT(&sc->mfi_cmd_tbolt_tqh);
 	} else {
 		sc->mfi_enable_intr =  mfi_enable_intr_ppc;
 		sc->mfi_read_fw_status = mfi_read_fw_status_ppc;
@@ -411,6 +411,31 @@ mfi_attach(struct mfi_softc *sc)
 		return (ENXIO);
 	}
 
+	/* Start: LSIP200113393 */
+	if (bus_dma_tag_create( sc->mfi_parent_dmat,	/* parent */
+				1, 0,			/* algnmnt, boundary */
+				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
+				BUS_SPACE_MAXADDR,	/* highaddr */
+				NULL, NULL,		/* filter, filterarg */
+				MEGASAS_MAX_NAME*sizeof(bus_addr_t),			/* maxsize */
+				1,			/* msegments */
+				MEGASAS_MAX_NAME*sizeof(bus_addr_t),			/* maxsegsize */
+				0,			/* flags */
+				&sc->verbuf_h_dmat)) {
+		device_printf(sc->mfi_dev, "Cannot allocate verbuf_h_dmat DMA tag\n");
+		return (ENOMEM);
+	}
+	if (bus_dmamem_alloc(sc->verbuf_h_dmat, (void **)&sc->verbuf,
+	    BUS_DMA_NOWAIT, &sc->verbuf_h_dmamap)) {
+		device_printf(sc->mfi_dev, "Cannot allocate verbuf_h_dmamap memory\n");
+		return (ENOMEM);
+	}
+	bzero(sc->verbuf, MEGASAS_MAX_NAME*sizeof(bus_addr_t));
+	bus_dmamap_load(sc->verbuf_h_dmat, sc->verbuf_h_dmamap,
+	    sc->verbuf, MEGASAS_MAX_NAME*sizeof(bus_addr_t),
+	    mfi_addr_cb, &sc->verbuf_h_busaddr, 0);
+	/* End: LSIP200113393 */
+
 	/*
 	 * Get information needed for sizing the contiguous memory for the
 	 * frame pool.  Size down the sgl parameter since we know that
@@ -423,6 +448,97 @@ mfi_attach(struct mfi_softc *sc)
 	max_fw_sge = (status & MFI_FWSTATE_MAXSGL_MASK) >> 16;
 	sc->mfi_max_sge = min(max_fw_sge, ((MFI_MAXPHYS / PAGE_SIZE) + 1));
 
+	/* ThunderBolt Support get the contiguous memory */
+
+	if (sc->mfi_flags & MFI_FLAGS_TBOLT) {
+		mfi_tbolt_init_globals(sc);
+		device_printf(sc->mfi_dev, "MaxCmd = %x MaxSgl = %x state = %x \n",
+		    sc->mfi_max_fw_cmds, sc->mfi_max_sge, status);
+		tb_mem_size = mfi_tbolt_get_memory_requirement(sc);
+
+		if (bus_dma_tag_create( sc->mfi_parent_dmat,	/* parent */
+				1, 0,			/* algnmnt, boundary */
+				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
+				BUS_SPACE_MAXADDR,	/* highaddr */
+				NULL, NULL,		/* filter, filterarg */
+				tb_mem_size,		/* maxsize */
+				1,			/* msegments */
+				tb_mem_size,		/* maxsegsize */
+				0,			/* flags */
+				&sc->mfi_tb_dmat)) {
+			device_printf(sc->mfi_dev, "Cannot allocate comms DMA tag\n");
+			return (ENOMEM);
+		}
+		if (bus_dmamem_alloc(sc->mfi_tb_dmat, (void **)&sc->request_message_pool,
+		BUS_DMA_NOWAIT, &sc->mfi_tb_dmamap)) {
+			device_printf(sc->mfi_dev, "Cannot allocate comms memory\n");
+			return (ENOMEM);
+		}
+		bzero(sc->request_message_pool, tb_mem_size);
+		bus_dmamap_load(sc->mfi_tb_dmat, sc->mfi_tb_dmamap,
+		sc->request_message_pool, tb_mem_size, mfi_addr_cb, &sc->mfi_tb_busaddr, 0);
+
+		/* For ThunderBolt memory init */
+		if (bus_dma_tag_create( sc->mfi_parent_dmat,	/* parent */
+				0x100, 0,		/* alignmnt, boundary */
+				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
+				BUS_SPACE_MAXADDR,	/* highaddr */
+				NULL, NULL,		/* filter, filterarg */
+				MFI_FRAME_SIZE,		/* maxsize */
+				1,			/* msegments */
+				MFI_FRAME_SIZE,		/* maxsegsize */
+				0,			/* flags */
+				&sc->mfi_tb_init_dmat)) {
+		device_printf(sc->mfi_dev, "Cannot allocate init DMA tag\n");
+		return (ENOMEM);
+		}
+		if (bus_dmamem_alloc(sc->mfi_tb_init_dmat, (void **)&sc->mfi_tb_init,
+		    BUS_DMA_NOWAIT, &sc->mfi_tb_init_dmamap)) {
+			device_printf(sc->mfi_dev, "Cannot allocate init memory\n");
+			return (ENOMEM);
+		}
+		bzero(sc->mfi_tb_init, MFI_FRAME_SIZE);
+		bus_dmamap_load(sc->mfi_tb_init_dmat, sc->mfi_tb_init_dmamap,
+		sc->mfi_tb_init, MFI_FRAME_SIZE, mfi_addr_cb,
+		    &sc->mfi_tb_init_busaddr, 0);
+		if (mfi_tbolt_init_desc_pool(sc, sc->request_message_pool,
+		    tb_mem_size)) {
+			device_printf(sc->mfi_dev,
+			    "Thunderbolt pool preparation error\n");
+			return 0;
+		}
+
+		/*
+		  Allocate DMA memory mapping for MPI2 IOC Init descriptor,
+		  we are taking it diffrent from what we have allocated for Request
+		  and reply descriptors to avoid confusion later
+		*/
+		tb_mem_size = sizeof(struct MPI2_IOC_INIT_REQUEST);
+		if (bus_dma_tag_create( sc->mfi_parent_dmat,	/* parent */
+				1, 0,			/* algnmnt, boundary */
+				BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
+				BUS_SPACE_MAXADDR,	/* highaddr */
+				NULL, NULL,		/* filter, filterarg */
+				tb_mem_size,		/* maxsize */
+				1,			/* msegments */
+				tb_mem_size,		/* maxsegsize */
+				0,			/* flags */
+				&sc->mfi_tb_ioc_init_dmat)) {
+			device_printf(sc->mfi_dev,
+			    "Cannot allocate comms DMA tag\n");
+			return (ENOMEM);
+		}
+		if (bus_dmamem_alloc(sc->mfi_tb_ioc_init_dmat,
+		    (void **)&sc->mfi_tb_ioc_init_desc,
+		    BUS_DMA_NOWAIT, &sc->mfi_tb_ioc_init_dmamap)) {
+			device_printf(sc->mfi_dev, "Cannot allocate comms memory\n");
+			return (ENOMEM);
+		}
+		bzero(sc->mfi_tb_ioc_init_desc, tb_mem_size);
+		bus_dmamap_load(sc->mfi_tb_ioc_init_dmat, sc->mfi_tb_ioc_init_dmamap,
+		sc->mfi_tb_ioc_init_desc, tb_mem_size, mfi_addr_cb,
+		    &sc->mfi_tb_ioc_init_busaddr, 0);
+	}
 	/*
 	 * Create the dma tag for data buffers.  Used both for block I/O
 	 * and for various internal data queries.
@@ -468,14 +584,8 @@ mfi_attach(struct mfi_softc *sc)
 		return (ENOMEM);
 	}
 	bzero(sc->mfi_comms, commsz);
-#if defined(__x86_64__)
-	bus_dmamap_load(sc->mfi_comms_dmat, sc->mfi_comms_dmamap,
-	    sc->mfi_comms, commsz, mfi_addr64_cb, &sc->mfi_comms_busaddr, 0);
-#else
 	bus_dmamap_load(sc->mfi_comms_dmat, sc->mfi_comms_dmamap,
-	    sc->mfi_comms, commsz, mfi_addr32_cb, &sc->mfi_comms_busaddr, 0);
-#endif
-
+	    sc->mfi_comms, commsz, mfi_addr_cb, &sc->mfi_comms_busaddr, 0);
 	/*
 	 * Allocate DMA memory for the command frames.  Keep them in the
 	 * lower 4GB for efficiency.  Calculate the size of the commands at
@@ -516,14 +626,8 @@ mfi_attach(struct mfi_softc *sc)
 		return (ENOMEM);
 	}
 	bzero(sc->mfi_frames, framessz);
-#if defined(__x86_64__)
-	bus_dmamap_load(sc->mfi_frames_dmat, sc->mfi_frames_dmamap,
-	    sc->mfi_frames, framessz, mfi_addr64_cb, &sc->mfi_frames_busaddr,0);
-#else
 	bus_dmamap_load(sc->mfi_frames_dmat, sc->mfi_frames_dmamap,
-	    sc->mfi_frames, framessz, mfi_addr32_cb, &sc->mfi_frames_busaddr,0);
-#endif
-
+	    sc->mfi_frames, framessz, mfi_addr_cb, &sc->mfi_frames_busaddr,0);
 	/*
 	 * Allocate DMA memory for the frame sense data.  Keep them in the
 	 * lower 4GB for efficiency
@@ -547,47 +651,48 @@ mfi_attach(struct mfi_softc *sc)
 		device_printf(sc->mfi_dev, "Cannot allocate sense memory\n");
 		return (ENOMEM);
 	}
-#if defined(__x86_64__)
 	bus_dmamap_load(sc->mfi_sense_dmat, sc->mfi_sense_dmamap,
-	    sc->mfi_sense, sensesz, mfi_addr64_cb, &sc->mfi_sense_busaddr, 0);
-#else
-	bus_dmamap_load(sc->mfi_sense_dmat, sc->mfi_sense_dmamap,
-	    sc->mfi_sense, sensesz, mfi_addr32_cb, &sc->mfi_sense_busaddr, 0);
-#endif
-
+	    sc->mfi_sense, sensesz, mfi_addr_cb, &sc->mfi_sense_busaddr, 0);
 	if ((error = mfi_alloc_commands(sc)) != 0)
 		return (error);
 
-	if ((error = mfi_comms_init(sc)) != 0)
-		return (error);
+	/*
+	 * Before moving the FW to operational state, check whether
+	 * hostmemory is required by the FW or not
+	 */
 
-	if ((error = mfi_get_controller_info(sc)) != 0)
-		return (error);
+	/* ThunderBolt MFI_IOC2 INIT */
+	if (sc->mfi_flags & MFI_FLAGS_TBOLT) {
+		sc->mfi_disable_intr(sc);
+		if ((error = mfi_tbolt_init_MFI_queue(sc)) != 0) {
+			device_printf(sc->mfi_dev,
+			    "TB Init has failed with error %d\n",error);
+			return error;
+		}
 
-	lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
-	if ((error = mfi_aen_setup(sc, 0), 0) != 0) {
-		lockmgr(&sc->mfi_io_lock, LK_RELEASE);
-		return (error);
-	}
-	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+		if ((error = mfi_tbolt_alloc_cmd(sc)) != 0)
+			return error;
+		if (bus_setup_intr(sc->mfi_dev, sc->mfi_irq, INTR_MPSAFE,
+			mfi_intr_tbolt, sc, &sc->mfi_intr, NULL)) {
+			device_printf(sc->mfi_dev, "Cannot set up interrupt\n");
+			return (EINVAL);
+		}
+		sc->mfi_enable_intr(sc);
+		sc->map_id = 0;
+	} else {
+		if ((error = mfi_comms_init(sc)) != 0)
+			return (error);
 
-	/*
-	 * Set up the interrupt handler.  XXX This should happen in
-	 * mfi_pci.c
-	 */
-	sc->mfi_irq_rid = 0;
-	sc->mfi_irq_type = pci_alloc_1intr(sc->mfi_dev, mfi_msi_enable,
-	    &sc->mfi_irq_rid, &irq_flags);
-	if ((sc->mfi_irq = bus_alloc_resource_any(sc->mfi_dev, SYS_RES_IRQ,
-	    &sc->mfi_irq_rid, irq_flags)) == NULL) {
-		device_printf(sc->mfi_dev, "Cannot allocate interrupt\n");
-		return (EINVAL);
-	}
-	if (bus_setup_intr(sc->mfi_dev, sc->mfi_irq, INTR_MPSAFE,
-	    mfi_intr, sc, &sc->mfi_intr, NULL)) {
-		device_printf(sc->mfi_dev, "Cannot set up interrupt\n");
-		return (EINVAL);
+		if (bus_setup_intr(sc->mfi_dev, sc->mfi_irq, INTR_MPSAFE,
+			mfi_intr, sc, &sc->mfi_intr, NULL)) {
+			device_printf(sc->mfi_dev, "Cannot set up interrupt\n");
+			return (EINVAL);
+		}
+		sc->mfi_enable_intr(sc);
 	}
+	if ((error = mfi_get_controller_info(sc)) != 0)
+		return (error);
+	sc->disableOnlineCtrlReset = 0;
 
 	/* Register a config hook to probe the bus for arrays */
 	sc->mfi_ich.ich_func = mfi_startup;
@@ -597,6 +702,10 @@ mfi_attach(struct mfi_softc *sc)
 		    "hook\n");
 		return (EINVAL);
 	}
+	if ((error = mfi_aen_setup(sc, 0), 0) != 0) {
+		lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+		return (error);
+	}
 
 	/*
 	 * Register a shutdown handler.
@@ -676,8 +785,11 @@ mfi_alloc_commands(struct mfi_softc *sc)
 		cm->cm_sc = sc;
 		cm->cm_index = i;
 		if (bus_dmamap_create(sc->mfi_buffer_dmat, 0,
-		    &cm->cm_dmamap) == 0)
+		    &cm->cm_dmamap) == 0) {
+			lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 			mfi_release_command(cm);
+			lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+		}
 		else
 			break;
 		sc->mfi_total_cmds++;
@@ -692,6 +804,8 @@ mfi_release_command(struct mfi_command *cm)
 	struct mfi_frame_header *hdr;
 	uint32_t *hdr_data;
 
+	KKASSERT(lockstatus(&cm->cm_sc->mfi_io_lock, curthread) != 0);
+
 	/*
 	 * Zero out the important fields of the frame, but make sure the
 	 * context field is preserved.  For efficiency, handle the fields
@@ -716,13 +830,14 @@ mfi_release_command(struct mfi_command *cm)
 	cm->cm_data = NULL;
 	cm->cm_sg = 0;
 	cm->cm_total_frame_size = 0;
+	cm->retry_for_fw_reset = 0;
 
 	mfi_enqueue_free(cm);
 }
 
 static int
-mfi_dcmd_command(struct mfi_softc *sc, struct mfi_command **cmp, uint32_t opcode,
-    void **bufp, size_t bufsize)
+mfi_dcmd_command(struct mfi_softc *sc, struct mfi_command **cmp,
+    uint32_t opcode, void **bufp, size_t bufsize)
 {
 	struct mfi_command *cm;
 	struct mfi_dcmd_frame *dcmd;
@@ -852,9 +967,11 @@ mfi_get_controller_info(struct mfi_softc *sc)
 	    BUS_DMASYNC_POSTREAD);
 	bus_dmamap_unload(sc->mfi_buffer_dmat, cm->cm_dmamap);
 
-	max_sectors_1 = (1 << ci->stripe_sz_ops.min) * ci->max_strips_per_io;
+	max_sectors_1 = (1 << ci->stripe_sz_ops.max) * ci->max_strips_per_io;
 	max_sectors_2 = ci->max_request_size;
 	sc->mfi_max_io = min(max_sectors_1, max_sectors_2);
+	sc->disableOnlineCtrlReset =
+	    ci->properties.OnOffProperties.disableOnlineCtrlReset;
 
 out:
 	if (ci)
@@ -871,6 +988,7 @@ mfi_get_log_state(struct mfi_softc *sc, struct mfi_evt_log_state **log_state)
 	struct mfi_command *cm = NULL;
 	int error;
 
+	lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 	error = mfi_dcmd_command(sc, &cm, MFI_DCMD_CTRL_EVENT_GETINFO,
 	    (void **)log_state, sizeof(**log_state));
 	if (error)
@@ -889,11 +1007,12 @@ mfi_get_log_state(struct mfi_softc *sc, struct mfi_evt_log_state **log_state)
 out:
 	if (cm)
 		mfi_release_command(cm);
+	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 
 	return (error);
 }
 
-static int
+int
 mfi_aen_setup(struct mfi_softc *sc, uint32_t seq_start)
 {
 	struct mfi_evt_log_state *log_state = NULL;
@@ -907,6 +1026,7 @@ mfi_aen_setup(struct mfi_softc *sc, uint32_t seq_start)
 
 	if (seq_start == 0) {
 		error = mfi_get_log_state(sc, &log_state);
+		sc->mfi_boot_seq_num = log_state->boot_seq_num;
 		if (error) {
 			if (log_state)
 				kfree(log_state, M_MFIBUF);
@@ -929,7 +1049,7 @@ mfi_aen_setup(struct mfi_softc *sc, uint32_t seq_start)
 	return 0;
 }
 
-static int
+int
 mfi_wait_command(struct mfi_softc *sc, struct mfi_command *cm)
 {
 
@@ -978,8 +1098,7 @@ mfi_free(struct mfi_softc *sc)
 	if (sc->mfi_irq != NULL)
 		bus_release_resource(sc->mfi_dev, SYS_RES_IRQ, sc->mfi_irq_rid,
 		    sc->mfi_irq);
-	if (sc->mfi_irq_type == PCI_INTR_TYPE_MSI)
-		pci_release_msi(sc->mfi_dev);
+
 	if (sc->mfi_sense_busaddr != 0)
 		bus_dmamap_unload(sc->mfi_sense_dmat, sc->mfi_sense_dmamap);
 	if (sc->mfi_sense != NULL)
@@ -1004,6 +1123,64 @@ mfi_free(struct mfi_softc *sc)
 	if (sc->mfi_comms_dmat != NULL)
 		bus_dma_tag_destroy(sc->mfi_comms_dmat);
 
+	/* ThunderBolt contiguous memory free here */
+	if (sc->mfi_flags & MFI_FLAGS_TBOLT) {
+		if (sc->mfi_tb_busaddr != 0)
+			bus_dmamap_unload(sc->mfi_tb_dmat, sc->mfi_tb_dmamap);
+		if (sc->request_message_pool != NULL)
+			bus_dmamem_free(sc->mfi_tb_dmat, sc->request_message_pool,
+			    sc->mfi_tb_dmamap);
+		if (sc->mfi_tb_dmat != NULL)
+			bus_dma_tag_destroy(sc->mfi_tb_dmat);
+
+		/* Version buffer memory free */
+		/* Start LSIP200113393 */
+		if (sc->verbuf_h_busaddr != 0)
+			bus_dmamap_unload(sc->verbuf_h_dmat, sc->verbuf_h_dmamap);
+		if (sc->verbuf != NULL)
+			bus_dmamem_free(sc->verbuf_h_dmat, sc->verbuf,
+			    sc->verbuf_h_dmamap);
+		if (sc->verbuf_h_dmat != NULL)
+			bus_dma_tag_destroy(sc->verbuf_h_dmat);
+
+		/* End LSIP200113393 */
+		/* ThunderBolt INIT packet memory Free */
+		if (sc->mfi_tb_init_busaddr != 0)
+			bus_dmamap_unload(sc->mfi_tb_init_dmat, sc->mfi_tb_init_dmamap);
+		if (sc->mfi_tb_init != NULL)
+			bus_dmamem_free(sc->mfi_tb_init_dmat, sc->mfi_tb_init,
+			    sc->mfi_tb_init_dmamap);
+		if (sc->mfi_tb_init_dmat != NULL)
+			bus_dma_tag_destroy(sc->mfi_tb_init_dmat);
+
+		/* ThunderBolt IOC Init Desc memory free here */
+		if (sc->mfi_tb_ioc_init_busaddr != 0)
+			bus_dmamap_unload(sc->mfi_tb_ioc_init_dmat,
+			    sc->mfi_tb_ioc_init_dmamap);
+		if (sc->mfi_tb_ioc_init_desc != NULL)
+			bus_dmamem_free(sc->mfi_tb_ioc_init_dmat,
+			    sc->mfi_tb_ioc_init_desc,
+			    sc->mfi_tb_ioc_init_dmamap);
+		if (sc->mfi_tb_ioc_init_dmat != NULL)
+			bus_dma_tag_destroy(sc->mfi_tb_ioc_init_dmat);
+		for (int i = 0; i < sc->mfi_max_fw_cmds; i++) {
+			if (sc->mfi_cmd_pool_tbolt != NULL) {
+				if (sc->mfi_cmd_pool_tbolt[i] != NULL) {
+					kfree(sc->mfi_cmd_pool_tbolt[i],
+					    M_MFIBUF);
+					sc->mfi_cmd_pool_tbolt[i] = NULL;
+				}
+			}
+		}
+		if (sc->mfi_cmd_pool_tbolt != NULL) {
+			kfree(sc->mfi_cmd_pool_tbolt, M_MFIBUF);
+			sc->mfi_cmd_pool_tbolt = NULL;
+		}
+		if (sc->request_desc_pool != NULL) {
+			kfree(sc->request_desc_pool, M_MFIBUF);
+			sc->request_desc_pool = NULL;
+		}
+	}
 	if (sc->mfi_buffer_dmat != NULL)
 		bus_dma_tag_destroy(sc->mfi_buffer_dmat);
 	if (sc->mfi_parent_dmat != NULL)
@@ -1054,12 +1231,7 @@ mfi_intr(void *arg)
 	if (sc->mfi_check_clear_intr(sc))
 		return;
 
-	/*
-	 * Do a dummy read to flush the interrupt ACK that we just performed,
-	 * ensuring that everything is really, truly consistent.
-	 */
-	(void)sc->mfi_read_fw_status(sc);
-
+restart:
 	pi = sc->mfi_comms->hw_pi;
 	ci = sc->mfi_comms->hw_ci;
 	lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
@@ -1084,6 +1256,14 @@ mfi_intr(void *arg)
 	mfi_startio(sc);
 	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 
+	/*
+	 * Dummy read to flush the bus; this ensures that the indexes are up
+	 * to date.  Restart processing if more commands have come it.
+	 */
+	(void)sc->mfi_read_fw_status(sc);
+	if (pi != sc->mfi_comms->hw_pi)
+		goto restart;
+
 	return;
 }
 
@@ -1104,6 +1284,9 @@ mfi_shutdown(struct mfi_softc *sc)
 	if (sc->mfi_aen_cm != NULL)
 		mfi_abort(sc, sc->mfi_aen_cm);
 
+	if (sc->map_update_cmd != NULL)
+		mfi_abort(sc, sc->map_update_cmd);
+
 	dcmd = &cm->cm_frame->dcmd;
 	dcmd->header.flags = MFI_FRAME_DIR_NONE;
 	cm->cm_flags = MFI_CMD_POLLED;
@@ -1117,14 +1300,15 @@ mfi_shutdown(struct mfi_softc *sc)
 	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 	return (error);
 }
+
 static void
 mfi_syspdprobe(struct mfi_softc *sc)
 {
 	struct mfi_frame_header *hdr;
 	struct mfi_command *cm = NULL;
 	struct mfi_pd_list *pdlist = NULL;
-	struct mfi_system_pd *syspd;
-	int error, i;
+	struct mfi_system_pd *syspd, *tmp;
+	int error, i, found;
 
 	KKASSERT(lockstatus(&sc->mfi_config_lock, curthread) != 0);
 	KKASSERT(lockstatus(&sc->mfi_io_lock, curthread) != 0);
@@ -1132,7 +1316,8 @@ mfi_syspdprobe(struct mfi_softc *sc)
 	error = mfi_dcmd_command(sc, &cm, MFI_DCMD_PD_LIST_QUERY,
 	    (void **)&pdlist, sizeof(*pdlist));
 	if (error) {
-		device_printf(sc->mfi_dev,"Error while forming syspd list\n");
+		device_printf(sc->mfi_dev,
+		    "Error while forming SYSTEM PD list\n");
 		goto out;
 	}
 
@@ -1140,7 +1325,8 @@ mfi_syspdprobe(struct mfi_softc *sc)
 	cm->cm_frame->dcmd.mbox[0] = MR_PD_QUERY_TYPE_EXPOSED_TO_HOST;
 	cm->cm_frame->dcmd.mbox[1] = 0;
 	if (mfi_mapcmd(sc, cm) != 0) {
-		device_printf(sc->mfi_dev, "Failed to get syspd device list\n");
+		device_printf(sc->mfi_dev,
+		    "Failed to get syspd device listing\n");
 		goto out;
 	}
 	bus_dmamap_sync(sc->mfi_buffer_dmat,cm->cm_dmamap,
@@ -1148,36 +1334,37 @@ mfi_syspdprobe(struct mfi_softc *sc)
 	bus_dmamap_unload(sc->mfi_buffer_dmat, cm->cm_dmamap);
 	hdr = &cm->cm_frame->header;
 	if (hdr->cmd_status != MFI_STAT_OK) {
-		device_printf(sc->mfi_dev, "MFI_DCMD_PD_LIST_QUERY failed %x\n",
-		    hdr->cmd_status);
+		device_printf(sc->mfi_dev,
+		    "MFI_DCMD_PD_LIST_QUERY failed %x\n", hdr->cmd_status);
 		goto out;
 	}
+	/* Get each PD and add it to the system */
 	for (i = 0; i < pdlist->count; i++) {
-		if (pdlist->addr[i].device_id == pdlist->addr[i].encl_device_id)
-			goto skip_sys_pd_add;
-		/* Get each PD and add it to the system */
-		if (!TAILQ_EMPTY(&sc->mfi_syspd_tqh)) {
-			TAILQ_FOREACH(syspd, &sc->mfi_syspd_tqh,pd_link) {
-				if (syspd->pd_id == pdlist->addr[i].device_id)
-					goto skip_sys_pd_add;
-			}
+		if (pdlist->addr[i].device_id ==
+		    pdlist->addr[i].encl_device_id)
+			continue;
+		found = 0;
+		TAILQ_FOREACH(syspd, &sc->mfi_syspd_tqh, pd_link) {
+			if (syspd->pd_id == pdlist->addr[i].device_id)
+				found = 1;
 		}
-		mfi_add_sys_pd(sc,pdlist->addr[i].device_id);
-skip_sys_pd_add:
-		;
+		if (found == 0)
+			mfi_add_sys_pd(sc, pdlist->addr[i].device_id);
 	}
 	/* Delete SYSPD's whose state has been changed */
-	if (!TAILQ_EMPTY(&sc->mfi_syspd_tqh)) {
-		TAILQ_FOREACH(syspd, &sc->mfi_syspd_tqh,pd_link) {
-			for (i=0;icount;i++) {
-				if (syspd->pd_id == pdlist->addr[i].device_id)
-					goto skip_sys_pd_delete;
-			}
+	TAILQ_FOREACH_MUTABLE(syspd, &sc->mfi_syspd_tqh, pd_link, tmp) {
+		found = 0;
+		for (i = 0; i < pdlist->count; i++) {
+			if (syspd->pd_id == pdlist->addr[i].device_id)
+				found = 1;
+		}
+		if (found == 0) {
+			kprintf("DELETE\n");
+			lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 			get_mplock();
-			device_delete_child(sc->mfi_dev,syspd->pd_dev);
+			device_delete_child(sc->mfi_dev, syspd->pd_dev);
 			rel_mplock();
-skip_sys_pd_delete:
-			;
+			lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 		}
 	}
 out:
@@ -1281,10 +1468,125 @@ format_class(int8_t class)
 static void
 mfi_decode_evt(struct mfi_softc *sc, struct mfi_evt_detail *detail)
 {
+	struct mfi_system_pd *syspd = NULL;
 
 	device_printf(sc->mfi_dev, "%d (%s/0x%04x/%s) - %s\n", detail->seq,
 	    format_timestamp(detail->time), detail->evt_class.members.locale,
-	    format_class(detail->evt_class.members.evt_class), detail->description);
+	    format_class(detail->evt_class.members.evt_class),
+	    detail->description);
+
+	/* Don't act on old AEN's or while shutting down */
+	if (detail->seq < sc->mfi_boot_seq_num || sc->mfi_detaching)
+		return;
+
+	switch (detail->arg_type) {
+	case MR_EVT_ARGS_NONE:
+		if (detail->code == MR_EVT_CTRL_HOST_BUS_SCAN_REQUESTED) {
+		    device_printf(sc->mfi_dev, "HostBus scan raised\n");
+			if (mfi_detect_jbod_change) {
+				/*
+				 * Probe for new SYSPD's and Delete
+				 * invalid SYSPD's
+				 */
+				lockmgr(&sc->mfi_config_lock, LK_EXCLUSIVE);
+				lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
+				mfi_syspdprobe(sc);
+				lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+				lockmgr(&sc->mfi_config_lock, LK_RELEASE);
+			}
+		}
+		break;
+	case MR_EVT_ARGS_LD_STATE:
+		/*
+		 * During load time driver reads all the events starting
+		 * from the one that has been logged after shutdown. Avoid
+		 * these old events.
+		 */
+		if (detail->args.ld_state.new_state == MFI_LD_STATE_OFFLINE ) {
+			/* Remove the LD */
+			struct mfi_disk *ld;
+			TAILQ_FOREACH(ld, &sc->mfi_ld_tqh, ld_link) {
+				if (ld->ld_id ==
+				    detail->args.ld_state.ld.target_id)
+					break;
+			}
+			/*
+			Fix: for kernel panics when SSCD is removed
+			KASSERT(ld != NULL, ("volume dissappeared"));
+			*/
+			if (ld != NULL) {
+				get_mplock();
+				device_delete_child(sc->mfi_dev, ld->ld_dev);
+				rel_mplock();
+			}
+		}
+		break;
+	case MR_EVT_ARGS_PD:
+		if (detail->code == MR_EVT_PD_REMOVED) {
+			if (mfi_detect_jbod_change) {
+				/*
+				 * If the removed device is a SYSPD then
+				 * delete it
+				 */
+				TAILQ_FOREACH(syspd, &sc->mfi_syspd_tqh,
+				    pd_link) {
+					if (syspd->pd_id ==
+					    detail->args.pd.device_id) {
+						get_mplock();
+						device_delete_child(
+						    sc->mfi_dev,
+						    syspd->pd_dev);
+						rel_mplock();
+						break;
+					}
+				}
+			}
+		}
+		if (detail->code == MR_EVT_PD_INSERTED) {
+			if (mfi_detect_jbod_change) {
+				/* Probe for new SYSPD's */
+				lockmgr(&sc->mfi_config_lock, LK_EXCLUSIVE);
+				lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
+				mfi_syspdprobe(sc);
+				lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+				lockmgr(&sc->mfi_config_lock, LK_RELEASE);
+			}
+		}
+		break;
+	}
+}
+
+static void
+mfi_queue_evt(struct mfi_softc *sc, struct mfi_evt_detail *detail)
+{
+	struct mfi_evt_queue_elm *elm;
+
+	KKASSERT(lockstatus(&sc->mfi_io_lock, curthread) != 0);
+	elm = kmalloc(sizeof(*elm), M_MFIBUF, M_NOWAIT | M_ZERO);
+	if (elm == NULL)
+		return;
+	memcpy(&elm->detail, detail, sizeof(*detail));
+	TAILQ_INSERT_TAIL(&sc->mfi_evt_queue, elm, link);
+	taskqueue_enqueue(taskqueue_swi, &sc->mfi_evt_task);
+}
+
+static void
+mfi_handle_evt(void *context, int pending)
+{
+	TAILQ_HEAD(,mfi_evt_queue_elm) queue;
+	struct mfi_softc *sc;
+	struct mfi_evt_queue_elm *elm;
+
+	sc = context;
+	TAILQ_INIT(&queue);
+	lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
+	TAILQ_CONCAT(&queue, &sc->mfi_evt_queue, link);
+	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+	while ((elm = TAILQ_FIRST(&queue)) != NULL) {
+		TAILQ_REMOVE(&queue, elm, link);
+		mfi_decode_evt(sc, &elm->detail);
+		kfree(elm, M_MFIBUF);
+	}
 }
 
 static int
@@ -1310,12 +1612,16 @@ mfi_aen_register(struct mfi_softc *sc, int seq, int locale)
 			    < current_aen.members.evt_class)
 				current_aen.members.evt_class =
 				    prior_aen.members.evt_class;
+			lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 			mfi_abort(sc, sc->mfi_aen_cm);
+			lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 		}
 	}
 
+	lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 	error = mfi_dcmd_command(sc, &cm, MFI_DCMD_CTRL_EVENT_WAIT,
 	    (void **)&ed, sizeof(*ed));
+	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 	if (error) {
 		goto out;
 	}
@@ -1326,10 +1632,13 @@ mfi_aen_register(struct mfi_softc *sc, int seq, int locale)
 	cm->cm_flags = MFI_CMD_DATAIN;
 	cm->cm_complete = mfi_aen_complete;
 
+	sc->last_seq_num = seq;
 	sc->mfi_aen_cm = cm;
 
+	lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 	mfi_enqueue_ready(cm);
 	mfi_startio(sc);
+	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 
 out:
 	return (error);
@@ -1345,6 +1654,8 @@ mfi_aen_complete(struct mfi_command *cm)
 	int seq = 0, aborted = 0;
 
 	sc = cm->cm_sc;
+	KKASSERT(lockstatus(&sc->mfi_io_lock, curthread) != 0);
+
 	hdr = &cm->cm_frame->header;
 
 	if (sc->mfi_aen_cm == NULL)
@@ -1361,13 +1672,10 @@ mfi_aen_complete(struct mfi_command *cm)
 			KNOTE(&sc->mfi_kq.ki_note, 0);
 		}
 		detail = cm->cm_data;
-		/*
-		 * XXX If this function is too expensive or is recursive, then
-		 * events should be put onto a queue and processed later.
-		 */
-		mfi_decode_evt(sc, detail);
+		mfi_queue_evt(sc, detail);
 		seq = detail->seq + 1;
-		TAILQ_FOREACH_MUTABLE(mfi_aen_entry, &sc->mfi_aen_pids, aen_link, tmp) {
+		TAILQ_FOREACH_MUTABLE(mfi_aen_entry, &sc->mfi_aen_pids,
+		    aen_link, tmp) {
 			TAILQ_REMOVE(&sc->mfi_aen_pids, mfi_aen_entry,
 			    aen_link);
 			lwkt_gettoken(&proc_token);
@@ -1384,7 +1692,9 @@ mfi_aen_complete(struct mfi_command *cm)
 
 	/* set it up again so the driver can catch more events */
 	if (!aborted) {
+		lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 		mfi_aen_setup(sc, seq);
+		lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 	}
 }
 
@@ -1398,7 +1708,6 @@ mfi_parse_entries(struct mfi_softc *sc, int start_seq, int stop_seq)
 	struct mfi_evt_list *el;
 	union mfi_evt class_locale;
 	int error, i, seq, size;
-	uint32_t context = 0;
 
 	class_locale.members.reserved = 0;
 	class_locale.members.locale = mfi_event_locale;
@@ -1411,22 +1720,20 @@ mfi_parse_entries(struct mfi_softc *sc, int start_seq, int stop_seq)
 		return (ENOMEM);
 
 	for (seq = start_seq;;) {
+		lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 		if ((cm = mfi_dequeue_free(sc)) == NULL) {
 			kfree(el, M_MFIBUF);
+			lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 			return (EBUSY);
 		}
 
-		/* Zero out the MFI frame */
-		context = cm->cm_frame->header.context;
-		bzero(cm->cm_frame, sizeof(union mfi_frame));
-		cm->cm_frame->header.context = context;
+		lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 
 		dcmd = &cm->cm_frame->dcmd;
 		bzero(dcmd->mbox, MFI_MBOX_SIZE);
 		dcmd->header.cmd = MFI_CMD_DCMD;
 		dcmd->header.timeout = 0;
 		dcmd->header.data_len = size;
-		dcmd->header.scsi_status = 0;
 		dcmd->opcode = MFI_DCMD_CTRL_EVENT_GET;
 		((uint32_t *)&dcmd->mbox)[0] = seq;
 		((uint32_t *)&dcmd->mbox)[1] = class_locale.word;
@@ -1436,29 +1743,38 @@ mfi_parse_entries(struct mfi_softc *sc, int start_seq, int stop_seq)
 		cm->cm_data = el;
 		cm->cm_len = size;
 
+		lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 		if ((error = mfi_mapcmd(sc, cm)) != 0) {
 			device_printf(sc->mfi_dev,
 			    "Failed to get controller entries\n");
 			mfi_release_command(cm);
+			lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 			break;
 		}
 
+		lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 		bus_dmamap_sync(sc->mfi_buffer_dmat, cm->cm_dmamap,
 		    BUS_DMASYNC_POSTREAD);
 		bus_dmamap_unload(sc->mfi_buffer_dmat, cm->cm_dmamap);
 
 		if (dcmd->header.cmd_status == MFI_STAT_NOT_FOUND) {
+			lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 			mfi_release_command(cm);
+			lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 			break;
 		}
 		if (dcmd->header.cmd_status != MFI_STAT_OK) {
 			device_printf(sc->mfi_dev,
 			    "Error %d fetching controller entries\n",
 			    dcmd->header.cmd_status);
+			lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 			mfi_release_command(cm);
+			lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 			break;
 		}
+		lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 		mfi_release_command(cm);
+		lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 
 		for (i = 0; i < el->count; i++) {
 			/*
@@ -1474,7 +1790,9 @@ mfi_parse_entries(struct mfi_softc *sc, int start_seq, int stop_seq)
 				else if (el->event[i].seq < start_seq)
 					break;
 			}
-			mfi_decode_evt(sc, &el->event[i]);
+			lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
+			mfi_queue_evt(sc, &el->event[i]);
+			lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 		}
 		seq = el->event[el->count - 1].seq + 1;
 	}
@@ -1515,7 +1833,7 @@ mfi_add_ld(struct mfi_softc *sc, int id)
 		mfi_add_ld_complete(cm);
 	} else {
 		mfi_release_command(cm);
-		if(ld_info)		/* SSCD drives ld_info free here */
+		if (ld_info)		/* SSCD drives ld_info free here */
 			kfree(ld_info, M_MFIBUF);
 	}
 	return (0);
@@ -1558,7 +1876,7 @@ mfi_add_ld_complete(struct mfi_command *cm)
 }
 
 static int
-mfi_add_sys_pd(struct mfi_softc *sc,int id)
+mfi_add_sys_pd(struct mfi_softc *sc, int id)
 {
 	struct mfi_command *cm;
 	struct mfi_dcmd_frame *dcmd = NULL;
@@ -1567,13 +1885,14 @@ mfi_add_sys_pd(struct mfi_softc *sc,int id)
 
 	KKASSERT(lockstatus(&sc->mfi_io_lock, curthread) != 0);
 
-	error = mfi_dcmd_command(sc,&cm,MFI_DCMD_PD_GET_INFO,
+	error = mfi_dcmd_command(sc, &cm, MFI_DCMD_PD_GET_INFO,
 	    (void **)&pd_info, sizeof(*pd_info));
 	if (error) {
 		device_printf(sc->mfi_dev,
-		    "Failed to allocated for MFI_DCMD_PD_GET_INFO %d\n", error);
+		    "Failed to allocated for MFI_DCMD_PD_GET_INFO %d\n",
+		    error);
 		if (pd_info)
-			kfree(pd_info,M_MFIBUF);
+			kfree(pd_info, M_MFIBUF);
 		return (error);
 	}
 	cm->cm_flags = MFI_CMD_DATAIN | MFI_CMD_POLLED;
@@ -1584,12 +1903,12 @@ mfi_add_sys_pd(struct mfi_softc *sc,int id)
 	if (mfi_mapcmd(sc, cm) != 0) {
 		device_printf(sc->mfi_dev,
 		    "Failed to get physical drive info %d\n", id);
-		kfree(pd_info,M_MFIBUF);
+		kfree(pd_info, M_MFIBUF);
 		return (0);
 	}
 	bus_dmamap_sync(sc->mfi_buffer_dmat, cm->cm_dmamap,
 	    BUS_DMASYNC_POSTREAD);
-	bus_dmamap_unload(sc->mfi_buffer_dmat,cm->cm_dmamap);
+	bus_dmamap_unload(sc->mfi_buffer_dmat, cm->cm_dmamap);
 	mfi_add_sys_pd_complete(cm);
 	return (0);
 }
@@ -1612,7 +1931,7 @@ mfi_add_sys_pd_complete(struct mfi_command *cm)
 		return;
 	}
 	if (pd_info->fw_state != MFI_PD_STATE_SYSTEM) {
-		device_printf(sc->mfi_dev,"PD=%x is not SYSTEM PD\n",
+		device_printf(sc->mfi_dev, "PD=%x is not SYSTEM PD\n",
 		    pd_info->ref.v.device_id);
 		kfree(pd_info, M_MFIBUF);
 		mfi_release_command(cm);
@@ -1655,7 +1974,7 @@ mfi_bio_command(struct mfi_softc *sc)
 	else
 		cm = mfi_build_ldio(sc, bio);
 	if (!cm)
-		mfi_enqueue_bio(sc,bio);
+		mfi_enqueue_bio(sc, bio);
 	return cm;
 }
 
@@ -1666,7 +1985,7 @@ mfi_build_syspdio(struct mfi_softc *sc, struct bio *bio)
 	struct buf *bp;
 	struct mfi_system_pd *disk;
 	struct mfi_pass_frame *pass;
-	int flags = 0,blkcount = 0;
+	int flags = 0, blkcount = 0;
 	uint32_t context = 0;
 
 	if ((cm = mfi_dequeue_free(sc)) == NULL)
@@ -1710,13 +2029,8 @@ mfi_build_syspdio(struct mfi_softc *sc, struct bio *bio)
 	pass->header.sense_len = MFI_SENSE_LEN;
 	pass->header.data_len = bp->b_bcount;
 	pass->header.cdb_len = 10;
-#if defined(__x86_64__)
-	pass->sense_addr_lo = (cm->cm_sense_busaddr & 0xFFFFFFFF);
-	pass->sense_addr_hi = (cm->cm_sense_busaddr & 0xFFFFFFFF00000000) >> 32;
-#else
-	pass->sense_addr_lo = cm->cm_sense_busaddr;
-	pass->sense_addr_hi = 0;
-#endif
+	pass->sense_addr_lo = (uint32_t)cm->cm_sense_busaddr;
+	pass->sense_addr_hi = (uint32_t)((uint64_t)cm->cm_sense_busaddr >> 32);
 	cm->cm_complete = mfi_bio_complete;
 	cm->cm_private = bio;
 	cm->cm_data = bp->b_data;
@@ -1728,7 +2042,7 @@ mfi_build_syspdio(struct mfi_softc *sc, struct bio *bio)
 }
 
 static struct mfi_command *
-mfi_build_ldio(struct mfi_softc *sc,struct bio *bio)
+mfi_build_ldio(struct mfi_softc *sc, struct bio *bio)
 {
 	struct mfi_io_frame *io;
 	struct buf *bp;
@@ -1742,7 +2056,7 @@ mfi_build_ldio(struct mfi_softc *sc,struct bio *bio)
 
 	/* Zero out the MFI frame */
 	context = cm->cm_frame->header.context;
-	bzero(cm->cm_frame,sizeof(union mfi_frame));
+	bzero(cm->cm_frame, sizeof(union mfi_frame));
 	cm->cm_frame->header.context = context;
 	bp = bio->bio_buf;
 	io = &cm->cm_frame->io;
@@ -1768,13 +2082,8 @@ mfi_build_ldio(struct mfi_softc *sc,struct bio *bio)
 	io->header.scsi_status = 0;
 	io->header.sense_len = MFI_SENSE_LEN;
 	io->header.data_len = blkcount;
-#if defined(__x86_64__)
-	io->sense_addr_lo = (cm->cm_sense_busaddr & 0xFFFFFFFF);
-	io->sense_addr_hi = (cm->cm_sense_busaddr & 0xFFFFFFFF00000000) >> 32;
-#else
-	io->sense_addr_lo = cm->cm_sense_busaddr;
-	io->sense_addr_hi = 0;
-#endif
+	io->sense_addr_lo = (uint32_t)cm->cm_sense_busaddr;
+	io->sense_addr_hi = (uint32_t)((uint64_t)cm->cm_sense_busaddr >> 32);
 	io->lba_hi = ((bio->bio_offset / MFI_SECTOR_LEN) & 0xffffffff00000000) >> 32;
 	io->lba_lo = (bio->bio_offset / MFI_SECTOR_LEN) & 0xffffffff;
 	cm->cm_complete = mfi_bio_complete;
@@ -1849,14 +2158,14 @@ mfi_startio(struct mfi_softc *sc)
 	}
 }
 
-static int
+int
 mfi_mapcmd(struct mfi_softc *sc, struct mfi_command *cm)
 {
 	int error, polled;
 
 	KKASSERT(lockstatus(&sc->mfi_io_lock, curthread) != 0);
 
-	if (cm->cm_data != NULL) {
+	if ((cm->cm_data != NULL) && (cm->cm_frame->header.cmd != MFI_CMD_STP)) {
 		polled = (cm->cm_flags & MFI_CMD_POLLED) ? BUS_DMA_NOWAIT : 0;
 		error = bus_dmamap_load(sc->mfi_buffer_dmat, cm->cm_dmamap,
 		    cm->cm_data, cm->cm_len, mfi_data_cb, cm, polled);
@@ -1865,7 +2174,10 @@ mfi_mapcmd(struct mfi_softc *sc, struct mfi_command *cm)
 			return (0);
 		}
 	} else {
-		error = mfi_send_frame(sc, cm);
+		if (sc->MFA_enabled)
+			error = mfi_tbolt_send_frame(sc, cm);
+		else
+			error = mfi_send_frame(sc, cm);
 	}
 
 	return (error);
@@ -1879,8 +2191,7 @@ mfi_data_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 	union mfi_sgl *sgl;
 	struct mfi_softc *sc;
 	int i, j, first, dir;
-	int sgl_mapped = 0;
-	int sge_size = 0;
+	int sge_size;
 
 	cm = (struct mfi_command *)arg;
 	sc = cm->cm_sc;
@@ -1910,10 +2221,9 @@ mfi_data_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 			sgl->sg_skinny[i].flag = 0;
 		}
 		hdr->flags |= MFI_FRAME_IEEE_SGL | MFI_FRAME_SGL64;
-		sgl_mapped = 1;
 		sge_size = sizeof(struct mfi_sg_skinny);
-	}
-	if (!sgl_mapped) {
+		hdr->sg_count = nsegs;
+	} else {
 		j = 0;
 		if (cm->cm_frame->header.cmd == MFI_CMD_STP) {
 			first = cm->cm_stp_len;
@@ -1932,7 +2242,6 @@ mfi_data_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 				sgl->sg32[j++].len = segs[i].ds_len - first;
 				first = 0;
 			}
-			sge_size = sizeof(struct mfi_sg32);
 		} else {
 			for (i = 0; i < nsegs; i++) {
 				sgl->sg64[j].addr = segs[i].ds_addr + first;
@@ -1940,11 +2249,10 @@ mfi_data_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 				first = 0;
 			}
 			hdr->flags |= MFI_FRAME_SGL64;
-			sge_size = sizeof(struct mfi_sg64);
 		}
 		hdr->sg_count = j;
-	} else
-		hdr->sg_count = nsegs;
+		sge_size = sc->mfi_sge_size;
+	}
 
 	dir = 0;
 	if (cm->cm_flags & MFI_CMD_DATAIN) {
@@ -1955,8 +2263,6 @@ mfi_data_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 		dir |= BUS_DMASYNC_PREWRITE;
 		hdr->flags |= MFI_FRAME_DIR_WRITE;
 	}
-	if (cm->cm_frame->header.cmd == MFI_CMD_STP)
-		dir |= BUS_DMASYNC_PREWRITE;
 	bus_dmamap_sync(sc->mfi_buffer_dmat, cm->cm_dmamap, dir);
 	cm->cm_flags |= MFI_CMD_MAPPED;
 
@@ -1966,10 +2272,13 @@ mfi_data_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 	 * least 1 frame, so don't compensate for the modulo of the
 	 * following division.
 	 */
-	cm->cm_total_frame_size += (sge_size * nsegs);
+	cm->cm_total_frame_size += (sc->mfi_sge_size * nsegs);
 	cm->cm_extra_frames = (cm->cm_total_frame_size - 1) / MFI_FRAME_SIZE;
 
-	mfi_send_frame(sc, cm);
+	if (sc->MFA_enabled)
+		mfi_tbolt_send_frame(sc, cm);
+	else
+		mfi_send_frame(sc, cm);
 }
 
 static int
@@ -2003,7 +2312,7 @@ mfi_send_frame(struct mfi_softc *sc, struct mfi_command *cm)
 	if (cm->cm_extra_frames > 7)
 		cm->cm_extra_frames = 7;
 
-	sc->mfi_issue_cmd(sc,cm->cm_frame_busaddr,cm->cm_extra_frames);
+	sc->mfi_issue_cmd(sc, cm->cm_frame_busaddr, cm->cm_extra_frames);
 
 	if ((cm->cm_flags & MFI_CMD_POLLED) == 0)
 		return (0);
@@ -2018,14 +2327,14 @@ mfi_send_frame(struct mfi_softc *sc, struct mfi_command *cm)
 
 	if (hdr->cmd_status == MFI_STAT_INVALID_STATUS) {
 		device_printf(sc->mfi_dev, "Frame %p timed out "
-			      "command 0x%X\n", hdr, cm->cm_frame->dcmd.opcode);
+		    "command 0x%X\n", hdr, cm->cm_frame->dcmd.opcode);
 		return (ETIMEDOUT);
 	}
 
 	return (0);
 }
 
-static void
+void
 mfi_complete(struct mfi_softc *sc, struct mfi_command *cm)
 {
 	int dir;
@@ -2075,22 +2384,20 @@ mfi_abort(struct mfi_softc *sc, struct mfi_command *cm_abort)
 	abort->header.flags = 0;
 	abort->header.scsi_status = 0;
 	abort->abort_context = cm_abort->cm_frame->header.context;
-#if defined(__x86_64__)
-	abort->abort_mfi_addr_lo = cm_abort->cm_frame_busaddr & 0xFFFFFFFF;
-	abort->abort_mfi_addr_hi = (cm_abort->cm_frame_busaddr & 0xFFFFFFFF00000000 ) >> 32  ;
-#else
-	abort->abort_mfi_addr_lo = cm_abort->cm_frame_busaddr;
-	abort->abort_mfi_addr_hi = 0;
-#endif
+	abort->abort_mfi_addr_lo = (uint32_t)cm_abort->cm_frame_busaddr;
+	abort->abort_mfi_addr_hi =
+	    (uint32_t)((uint64_t)cm_abort->cm_frame_busaddr >> 32);
 	cm->cm_data = NULL;
 	cm->cm_flags = MFI_CMD_POLLED;
 
-	sc->mfi_aen_cm->cm_aen_abort = 1;
+	if (sc->mfi_aen_cm)
+		sc->mfi_aen_cm->cm_aen_abort = 1;
 	mfi_mapcmd(sc, cm);
 	mfi_release_command(cm);
 
 	while (i < 5 && sc->mfi_aen_cm != NULL) {
-		lksleep(&sc->mfi_aen_cm, &sc->mfi_io_lock, 0, "mfiabort", 5 * hz);
+		lksleep(&sc->mfi_aen_cm, &sc->mfi_io_lock, 0, "mfiabort",
+		    5 * hz);
 		i++;
 	}
 
@@ -2098,7 +2405,8 @@ mfi_abort(struct mfi_softc *sc, struct mfi_command *cm_abort)
 }
 
 int
-mfi_dump_blocks(struct mfi_softc *sc, int id, uint64_t lba, void *virt, int len)
+mfi_dump_blocks(struct mfi_softc *sc, int id, uint64_t lba, void *virt,
+    int len)
 {
 	struct mfi_command *cm;
 	struct mfi_io_frame *io;
@@ -2121,13 +2429,8 @@ mfi_dump_blocks(struct mfi_softc *sc, int id, uint64_t lba, void *virt, int len)
 	io->header.scsi_status = 0;
 	io->header.sense_len = MFI_SENSE_LEN;
 	io->header.data_len = (len + MFI_SECTOR_LEN - 1) / MFI_SECTOR_LEN;
-#if defined(__x86_64__)
-	io->sense_addr_lo = (cm->cm_sense_busaddr & 0xFFFFFFFF);
-	io->sense_addr_hi = (cm->cm_sense_busaddr & 0xFFFFFFFF00000000 ) >> 32;
-#else
-	io->sense_addr_lo = cm->cm_sense_busaddr;
-	io->sense_addr_hi = 0;
-#endif
+	io->sense_addr_lo = (uint32_t)cm->cm_sense_busaddr;
+	io->sense_addr_hi = (uint32_t)((uint64_t)cm->cm_sense_busaddr >> 32);
 	io->lba_hi = (lba & 0xffffffff00000000) >> 32;
 	io->lba_lo = lba & 0xffffffff;
 	cm->cm_data = virt;
@@ -2175,13 +2478,8 @@ mfi_dump_syspd_blocks(struct mfi_softc *sc, int id, uint64_t lba, void *virt,
 	pass->header.sense_len = MFI_SENSE_LEN;
 	pass->header.data_len = len;
 	pass->header.cdb_len = 10;
-#if defined(__x86_64__)
-	pass->sense_addr_lo = (cm->cm_sense_busaddr & 0xFFFFFFFF);
-	pass->sense_addr_hi = (cm->cm_sense_busaddr & 0xFFFFFFFF00000000 ) >> 32;
-#else
-	pass->sense_addr_lo = cm->cm_sense_busaddr;
-	pass->sense_addr_hi = 0;
-#endif
+	pass->sense_addr_lo = (uint32_t)cm->cm_sense_busaddr;
+	pass->sense_addr_hi = (uint32_t)((uint64_t)cm->cm_sense_busaddr >> 32);
 	cm->cm_data = virt;
 	cm->cm_len = len;
 	cm->cm_sg = &pass->sgl;
@@ -2264,7 +2562,10 @@ mfi_config_unlock(struct mfi_softc *sc, int locked)
 		lockmgr(&sc->mfi_config_lock, LK_RELEASE);
 }
 
-/* Perform pre-issue checks on commands from userland and possibly veto them. */
+/*
+ * Perform pre-issue checks on commands from userland and possibly veto
+ * them.
+ */
 static int
 mfi_check_command_pre(struct mfi_softc *sc, struct mfi_command *cm)
 {
@@ -2305,16 +2606,14 @@ mfi_check_command_pre(struct mfi_softc *sc, struct mfi_command *cm)
 		mbox = (uint16_t *)cm->cm_frame->dcmd.mbox;
 		syspd_id = mbox[0];
 		if (mbox[2] == MFI_PD_STATE_UNCONFIGURED_GOOD) {
-			if (!TAILQ_EMPTY(&sc->mfi_syspd_tqh)) {
-				TAILQ_FOREACH(syspd, &sc->mfi_syspd_tqh, pd_link) {
-					if (syspd->pd_id == syspd_id)
-						break;
-				}
+			TAILQ_FOREACH(syspd, &sc->mfi_syspd_tqh, pd_link) {
+				if (syspd->pd_id == syspd_id)
+					break;
 			}
 		} else {
 			break;
 		}
-		if(syspd)
+		if (syspd)
 			error = mfi_syspd_disable(syspd);
 		break;
 	default:
@@ -2372,22 +2671,153 @@ mfi_check_command_post(struct mfi_softc *sc, struct mfi_command *cm)
 		mbox = (uint16_t *)cm->cm_frame->dcmd.mbox;
 		syspd_id = mbox[0];
 		if (mbox[2] == MFI_PD_STATE_UNCONFIGURED_GOOD) {
-			if (!TAILQ_EMPTY(&sc->mfi_syspd_tqh)) {
-				TAILQ_FOREACH(syspd,&sc->mfi_syspd_tqh,pd_link) {
-					if (syspd->pd_id == syspd_id)
-						break;
-				}
+			TAILQ_FOREACH(syspd, &sc->mfi_syspd_tqh, pd_link) {
+				if (syspd->pd_id == syspd_id)
+					break;
 			}
 		} else {
 			break;
 		}
 		/* If the transition fails then enable the syspd again */
-		if(syspd && cm->cm_frame->header.cmd_status != MFI_STAT_OK)
+		if (syspd && cm->cm_frame->header.cmd_status != MFI_STAT_OK)
 			mfi_syspd_enable(syspd);
 		break;
 	}
 }
 
+static int
+mfi_check_for_sscd(struct mfi_softc *sc, struct mfi_command *cm)
+{
+	struct mfi_config_data *conf_data = cm->cm_data;
+	struct mfi_command *ld_cm = NULL;
+	struct mfi_ld_info *ld_info = NULL;
+	int error = 0;
+
+	if ((cm->cm_frame->dcmd.opcode == MFI_DCMD_CFG_ADD) &&
+	    (conf_data->ld[0].params.isSSCD == 1)) {
+		error = 1;
+	} else if (cm->cm_frame->dcmd.opcode == MFI_DCMD_LD_DELETE) {
+		error = mfi_dcmd_command(sc, &ld_cm, MFI_DCMD_LD_GET_INFO,
+		    (void **)&ld_info, sizeof(*ld_info));
+		if (error) {
+			device_printf(sc->mfi_dev, "Failed to allocate"
+			    "MFI_DCMD_LD_GET_INFO %d", error);
+			if (ld_info)
+				kfree(ld_info, M_MFIBUF);
+			return 0;
+		}
+		ld_cm->cm_flags = MFI_CMD_DATAIN;
+		ld_cm->cm_frame->dcmd.mbox[0]= cm->cm_frame->dcmd.mbox[0];
+		ld_cm->cm_frame->header.target_id = cm->cm_frame->dcmd.mbox[0];
+		if (mfi_wait_command(sc, ld_cm) != 0) {
+			device_printf(sc->mfi_dev, "failed to get log drv\n");
+			mfi_release_command(ld_cm);
+			kfree(ld_info, M_MFIBUF);
+			return 0;
+		}
+
+		if (ld_cm->cm_frame->header.cmd_status != MFI_STAT_OK) {
+			kfree(ld_info, M_MFIBUF);
+			mfi_release_command(ld_cm);
+			return 0;
+		} else {
+			ld_info = (struct mfi_ld_info *)ld_cm->cm_private;
+		}
+
+		if (ld_info->ld_config.params.isSSCD == 1)
+			error = 1;
+
+		mfi_release_command(ld_cm);
+		kfree(ld_info, M_MFIBUF);
+	}
+	return error;
+}
+
+static int
+mfi_stp_cmd(struct mfi_softc *sc, struct mfi_command *cm,caddr_t arg)
+{
+	uint8_t i;
+	struct mfi_ioc_packet *ioc;
+	ioc = (struct mfi_ioc_packet *)arg;
+	int sge_size, error;
+	struct megasas_sge *kern_sge;
+
+	memset(sc->kbuff_arr, 0, sizeof(sc->kbuff_arr));
+	kern_sge =(struct megasas_sge *) ((uintptr_t)cm->cm_frame + ioc->mfi_sgl_off);
+	cm->cm_frame->header.sg_count = ioc->mfi_sge_count;
+
+	if (sizeof(bus_addr_t) == 8) {
+		cm->cm_frame->header.flags |= MFI_FRAME_SGL64;
+		cm->cm_extra_frames = 2;
+		sge_size = sizeof(struct mfi_sg64);
+	} else {
+		cm->cm_extra_frames =  (cm->cm_total_frame_size - 1) / MFI_FRAME_SIZE;
+		sge_size = sizeof(struct mfi_sg32);
+	}
+
+	cm->cm_total_frame_size += (sge_size * ioc->mfi_sge_count);
+	for (i = 0; i < ioc->mfi_sge_count; i++) {
+			if (bus_dma_tag_create( sc->mfi_parent_dmat,	/* parent */
+			1, 0,			/* algnmnt, boundary */
+			BUS_SPACE_MAXADDR_32BIT,/* lowaddr */
+			BUS_SPACE_MAXADDR,	/* highaddr */
+			NULL, NULL,		/* filter, filterarg */
+			ioc->mfi_sgl[i].iov_len,/* maxsize */
+			2,			/* nsegments */
+			ioc->mfi_sgl[i].iov_len,/* maxsegsize */
+			BUS_DMA_ALLOCNOW,	/* flags */
+			&sc->mfi_kbuff_arr_dmat[i])) {
+			device_printf(sc->mfi_dev,
+			    "Cannot allocate mfi_kbuff_arr_dmat tag\n");
+			return (ENOMEM);
+		}
+
+		if (bus_dmamem_alloc(sc->mfi_kbuff_arr_dmat[i],
+		    (void **)&sc->kbuff_arr[i], BUS_DMA_NOWAIT,
+		    &sc->mfi_kbuff_arr_dmamap[i])) {
+			device_printf(sc->mfi_dev,
+			    "Cannot allocate mfi_kbuff_arr_dmamap memory\n");
+			return (ENOMEM);
+		}
+
+		bus_dmamap_load(sc->mfi_kbuff_arr_dmat[i],
+		    sc->mfi_kbuff_arr_dmamap[i], sc->kbuff_arr[i],
+		    ioc->mfi_sgl[i].iov_len, mfi_addr_cb,
+		    &sc->mfi_kbuff_arr_busaddr[i], 0);
+
+		if (!sc->kbuff_arr[i]) {
+			device_printf(sc->mfi_dev,
+			    "Could not allocate memory for kbuff_arr info\n");
+			return -1;
+		}
+		kern_sge[i].phys_addr = sc->mfi_kbuff_arr_busaddr[i];
+		kern_sge[i].length = ioc->mfi_sgl[i].iov_len;
+
+		if (sizeof(bus_addr_t) == 8) {
+			cm->cm_frame->stp.sgl.sg64[i].addr =
+			    kern_sge[i].phys_addr;
+			cm->cm_frame->stp.sgl.sg64[i].len =
+			    ioc->mfi_sgl[i].iov_len;
+		} else {
+			cm->cm_frame->stp.sgl.sg32[i].len =
+			    kern_sge[i].phys_addr;
+			cm->cm_frame->stp.sgl.sg32[i].len =
+			    ioc->mfi_sgl[i].iov_len;
+		}
+
+		error = copyin(ioc->mfi_sgl[i].iov_base,
+		    sc->kbuff_arr[i],
+		    ioc->mfi_sgl[i].iov_len);
+		if (error != 0) {
+			device_printf(sc->mfi_dev, "Copy in failed\n");
+			return error;
+		}
+	}
+
+	cm->cm_flags |=MFI_CMD_MAPPED;
+	return 0;
+}
+
 static int
 mfi_user_command(struct mfi_softc *sc, struct mfi_ioc_passthru *ioc)
 {
@@ -2453,59 +2883,7 @@ out:
 	return (error);
 }
 
-#ifdef __x86_64__
 #define	PTRIN(p)		((void *)(uintptr_t)(p))
-#else
-#define	PTRIN(p)		(p)
-#endif
-
-static int
-mfi_check_for_sscd(struct mfi_softc *sc, struct mfi_command *cm)
-{
-	struct mfi_config_data *conf_data = cm->cm_data;
-	struct mfi_command *ld_cm = NULL;
-	struct mfi_ld_info *ld_info = NULL;
-	int error = 0;
-
-	if ((cm->cm_frame->dcmd.opcode == MFI_DCMD_CFG_ADD) &&
-	    (conf_data->ld[0].params.isSSCD == 1)) {
-		error = 1;
-	} else if (cm->cm_frame->dcmd.opcode == MFI_DCMD_LD_DELETE) {
-		error = mfi_dcmd_command(sc, &ld_cm, MFI_DCMD_LD_GET_INFO,
-		    (void **)&ld_info, sizeof(*ld_info));
-		if (error) {
-			device_printf(sc->mfi_dev,"Failed to allocate "
-			    "MFI_DCMD_LD_GET_INFO %d", error);
-			if (ld_info)
-				kfree(ld_info, M_MFIBUF);
-			return 0;
-		}
-		ld_cm->cm_flags = MFI_CMD_DATAIN;
-		ld_cm->cm_frame->dcmd.mbox[0]= cm->cm_frame->dcmd.mbox[0];
-		ld_cm->cm_frame->header.target_id = cm->cm_frame->dcmd.mbox[0];
-		if (mfi_wait_command(sc, ld_cm) != 0) {
-			device_printf(sc->mfi_dev, "failed to get log drv\n");
-			mfi_release_command(ld_cm);
-			kfree(ld_info, M_MFIBUF);
-			return 0;
-		}
-
-		if (ld_cm->cm_frame->header.cmd_status != MFI_STAT_OK) {
-			kfree(ld_info, M_MFIBUF);
-			mfi_release_command(ld_cm);
-			return 0;
-		} else {
-			ld_info = (struct mfi_ld_info *)ld_cm->cm_private;
-		}
-
-		if (ld_info->ld_config.params.isSSCD == 1)
-			error = 1;
-
-		mfi_release_command(ld_cm);
-		kfree(ld_info, M_MFIBUF);
-	}
-	return error;
-}
 
 static int
 mfi_ioctl(struct dev_ioctl_args *ap)
@@ -2517,26 +2895,29 @@ mfi_ioctl(struct dev_ioctl_args *ap)
 	struct mfi_softc *sc;
 	union mfi_statrequest *ms;
 	struct mfi_ioc_packet *ioc;
-#ifdef __x86_64__
-	struct mfi_ioc_packet32 *ioc32;
-#endif
 	struct mfi_ioc_aen *aen;
 	struct mfi_command *cm = NULL;
 	uint32_t context;
 	union mfi_sense_ptr sense_ptr;
 	uint8_t *data = NULL, *temp, *addr, skip_pre_post = 0;
 	size_t len;
-	int i;
+	int i, res;
 	struct mfi_ioc_passthru *iop = (struct mfi_ioc_passthru *)arg;
-#ifdef __x86_64__
-	struct mfi_ioc_passthru32 *iop32 = (struct mfi_ioc_passthru32 *)arg;
-	struct mfi_ioc_passthru iop_swab;
-#endif
 	int error, locked;
+	union mfi_sgl *sgl;
 
 	sc = dev->si_drv1;
 	error = 0;
 
+	if (sc->adpreset)
+		return EBUSY;
+
+	if (sc->hw_crit_error)
+		return EBUSY;
+
+	if (sc->issuepend_done == 0)
+		return EBUSY;
+
 	switch (cmd) {
 	case MFIIO_STATS:
 		ms = (union mfi_statrequest *)arg;
@@ -2578,9 +2959,6 @@ mfi_ioctl(struct dev_ioctl_args *ap)
 		break;
 	}
 	case MFI_CMD:
-#ifdef __x86_64__
-	case MFI_CMD32:
-#endif
 		{
 		devclass_t devclass;
 		ioc = (struct mfi_ioc_packet *)arg;
@@ -2604,9 +2982,10 @@ mfi_ioctl(struct dev_ioctl_args *ap)
 		 * will clobber some data
 		 */
 		context = cm->cm_frame->header.context;
+		cm->cm_frame->header.context = cm->cm_index;
 
 		bcopy(ioc->mfi_frame.raw, cm->cm_frame,
-		    2 * MFI_DCMD_FRAME_SIZE);  /* this isn't quite right */
+		    2 * MEGAMFI_FRAME_SIZE);
 		cm->cm_total_frame_size = (sizeof(union mfi_sgl)
 		    * ioc->mfi_sge_count) + ioc->mfi_sgl_off;
 		cm->cm_frame->header.scsi_status = 0;
@@ -2615,6 +2994,7 @@ mfi_ioctl(struct dev_ioctl_args *ap)
 			cm->cm_sg =
 			    (union mfi_sgl *)&cm->cm_frame->bytes[ioc->mfi_sgl_off];
 		}
+		sgl = cm->cm_sg;
 		cm->cm_flags = 0;
 		if (cm->cm_frame->header.flags & MFI_FRAME_DATAIN)
 			cm->cm_flags |= MFI_CMD_DATAIN;
@@ -2625,18 +3005,7 @@ mfi_ioctl(struct dev_ioctl_args *ap)
 			cm->cm_flags |= MFI_CMD_DATAIN | MFI_CMD_DATAOUT;
 		cm->cm_len = cm->cm_frame->header.data_len;
 		if (cm->cm_frame->header.cmd == MFI_CMD_STP) {
-#ifdef __x86_64__
-			if (cmd == MFI_CMD) {
-#endif
-				/* Native */
-				cm->cm_stp_len = ioc->mfi_sgl[0].iov_len;
-#ifdef __x86_64__
-			} else {
-				/* 32bit on 64bit */
-				ioc32 = (struct mfi_ioc_packet32 *)ioc;
-				cm->cm_stp_len = ioc32->mfi_sgl[0].iov_len;
-			}
-#endif
+			cm->cm_stp_len = ioc->mfi_sgl[0].iov_len;
 			cm->cm_len += cm->cm_stp_len;
 		}
 		if (cm->cm_len &&
@@ -2650,49 +3019,38 @@ mfi_ioctl(struct dev_ioctl_args *ap)
 		/* restore header context */
 		cm->cm_frame->header.context = context;
 
-		temp = data;
-		if ((cm->cm_flags & MFI_CMD_DATAOUT) ||
-		    (cm->cm_frame->header.cmd == MFI_CMD_STP)) {
-			for (i = 0; i < ioc->mfi_sge_count; i++) {
-#ifdef __x86_64__
-				if (cmd == MFI_CMD) {
-#endif
-					/* Native */
+		if (cm->cm_frame->header.cmd == MFI_CMD_STP) {
+			res = mfi_stp_cmd(sc, cm, arg);
+			if (res != 0)
+				goto out;
+		} else {
+			temp = data;
+			if ((cm->cm_flags & MFI_CMD_DATAOUT) ||
+			    (cm->cm_frame->header.cmd == MFI_CMD_STP)) {
+				for (i = 0; i < ioc->mfi_sge_count; i++) {
 					addr = ioc->mfi_sgl[i].iov_base;
 					len = ioc->mfi_sgl[i].iov_len;
-#ifdef __x86_64__
-				} else {
-					/* 32bit on 64bit */
-					ioc32 = (struct mfi_ioc_packet32 *)ioc;
-					addr = PTRIN(ioc32->mfi_sgl[i].iov_base);
-					len = ioc32->mfi_sgl[i].iov_len;
+					error = copyin(addr, temp, len);
+					if (error != 0) {
+						device_printf(sc->mfi_dev,
+						    "Copy in failed\n");
+						goto out;
+					}
+					temp = &temp[len];
 				}
-#endif
-				error = copyin(addr, temp, len);
-				if (error != 0) {
-					device_printf(sc->mfi_dev,
-					    "Copy in failed\n");
-					goto out;
-				}
-				temp = &temp[len];
 			}
 		}
 
 		if (cm->cm_frame->header.cmd == MFI_CMD_DCMD)
-			locked = mfi_config_lock(sc, cm->cm_frame->dcmd.opcode);
+			locked = mfi_config_lock(sc,
+			     cm->cm_frame->dcmd.opcode);
 
 		if (cm->cm_frame->header.cmd == MFI_CMD_PD_SCSI_IO) {
-#if defined(__x86_64__)
 			cm->cm_frame->pass.sense_addr_lo =
-			    (cm->cm_sense_busaddr & 0xFFFFFFFF);
+			    (uint32_t)cm->cm_sense_busaddr;
 			cm->cm_frame->pass.sense_addr_hi =
-			    (cm->cm_sense_busaddr& 0xFFFFFFFF00000000) >> 32;
-#else
-			cm->cm_frame->pass.sense_addr_lo = cm->cm_sense_busaddr;
-			cm->cm_frame->pass.sense_addr_hi = 0;
-#endif
+			    (uint32_t)((uint64_t)cm->cm_sense_busaddr >> 32);
 		}
-
 		lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 		skip_pre_post = mfi_check_for_sscd(sc, cm);
 		if (!skip_pre_post) {
@@ -2714,31 +3072,21 @@ mfi_ioctl(struct dev_ioctl_args *ap)
 			mfi_check_command_post(sc, cm);
 		lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 
-		temp = data;
-		if ((cm->cm_flags & MFI_CMD_DATAIN) ||
-		    (cm->cm_frame->header.cmd == MFI_CMD_STP)) {
-			for (i = 0; i < ioc->mfi_sge_count; i++) {
-#ifdef __x86_64__
-				if (cmd == MFI_CMD) {
-#endif
-					/* Native */
+		if (cm->cm_frame->header.cmd != MFI_CMD_STP) {
+			temp = data;
+			if ((cm->cm_flags & MFI_CMD_DATAIN) ||
+			    (cm->cm_frame->header.cmd == MFI_CMD_STP)) {
+				for (i = 0; i < ioc->mfi_sge_count; i++) {
 					addr = ioc->mfi_sgl[i].iov_base;
 					len = ioc->mfi_sgl[i].iov_len;
-#ifdef __x86_64__
-				} else {
-					/* 32bit on 64bit */
-					ioc32 = (struct mfi_ioc_packet32 *)ioc;
-					addr = PTRIN(ioc32->mfi_sgl[i].iov_base);
-					len = ioc32->mfi_sgl[i].iov_len;
+					error = copyout(temp, addr, len);
+					if (error != 0) {
+						device_printf(sc->mfi_dev,
+						    "Copy out failed\n");
+						goto out;
+					}
+					temp = &temp[len];
 				}
-#endif
-				error = copyout(temp, addr, len);
-				if (error != 0) {
-					device_printf(sc->mfi_dev,
-					    "Copy out failed\n");
-					goto out;
-				}
-				temp = &temp[len];
 			}
 		}
 
@@ -2747,14 +3095,6 @@ mfi_ioctl(struct dev_ioctl_args *ap)
 			bcopy(&ioc->mfi_frame.raw[ioc->mfi_sense_off],
 			    &sense_ptr.sense_ptr_data[0],
 			    sizeof(sense_ptr.sense_ptr_data));
-#ifdef __x86_64__
-			if (cmd != MFI_CMD) {
-				/*
-				 * not 64bit native so zero out any address
-				 * over 32bit */
-				sense_ptr.addr.high = 0;
-			}
-#endif
 			error = copyout(cm->cm_sense, sense_ptr.user_space,
 			    ioc->mfi_sense_len);
 			if (error != 0) {
@@ -2769,6 +3109,26 @@ out:
 		mfi_config_unlock(sc, locked);
 		if (data)
 			kfree(data, M_MFIBUF);
+		if (cm->cm_frame->header.cmd == MFI_CMD_STP) {
+			for (i = 0; i < 2; i++) {
+				if (sc->kbuff_arr[i]) {
+					if (sc->mfi_kbuff_arr_busaddr != 0)
+						bus_dmamap_unload(
+						    sc->mfi_kbuff_arr_dmat[i],
+						    sc->mfi_kbuff_arr_dmamap[i]
+						    );
+					if (sc->kbuff_arr[i] != NULL)
+						bus_dmamem_free(
+						    sc->mfi_kbuff_arr_dmat[i],
+						    sc->kbuff_arr[i],
+						    sc->mfi_kbuff_arr_dmamap[i]
+						    );
+					if (sc->mfi_kbuff_arr_dmat[i] != NULL)
+						bus_dma_tag_destroy(
+						    sc->mfi_kbuff_arr_dmat[i]);
+				}
+			}
+		}
 		if (cm) {
 			lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 			mfi_release_command(cm);
@@ -2825,20 +3185,8 @@ out:
 			    cmd, arg, flag));
 			break;
 		}
-#ifdef __x86_64__
-	case MFIIO_PASSTHRU32:
-		iop_swab.ioc_frame	= iop32->ioc_frame;
-		iop_swab.buf_size	= iop32->buf_size;
-		iop_swab.buf		= PTRIN(iop32->buf);
-		iop			= &iop_swab;
-		/* FALLTHROUGH */
-#endif
 	case MFIIO_PASSTHRU:
 		error = mfi_user_command(sc, iop);
-#ifdef __x86_64__
-		if (cmd == MFIIO_PASSTHRU32)
-			iop32->ioc_frame = iop_swab.ioc_frame;
-#endif
 		break;
 	default:
 		device_printf(sc->mfi_dev, "IOCTL 0x%lx not handled\n", cmd);
@@ -2934,15 +3282,10 @@ mfi_linux_ioctl_int(struct cdev *dev, u_long cmd, caddr_t arg, int flag)
 			locked = mfi_config_lock(sc, cm->cm_frame->dcmd.opcode);
 
 		if (cm->cm_frame->header.cmd == MFI_CMD_PD_SCSI_IO) {
-#if defined(__x86_64__)
 			cm->cm_frame->pass.sense_addr_lo =
-			    (cm->cm_sense_busaddr & 0xFFFFFFFF);
+			    (uint32_t)cm->cm_sense_busaddr;
 			cm->cm_frame->pass.sense_addr_hi =
-			    (cm->cm_sense_busaddr & 0xFFFFFFFF00000000) >> 32;
-#else
-			cm->cm_frame->pass.sense_addr_lo = cm->cm_sense_busaddr;
-			cm->cm_frame->pass.sense_addr_hi = 0;
-#endif
+			    (uint32_t)((uint64_t)cm->cm_sense_busaddr >> 32);
 		}
 
 		lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
@@ -3145,8 +3488,8 @@ mfi_dump_all(void)
 		TAILQ_FOREACH(cm, &sc->mfi_busy, cm_link) {
 			if (cm->cm_timestamp < deadline) {
 				device_printf(sc->mfi_dev,
-				    "COMMAND %p TIMEOUT AFTER %d SECONDS\n", cm,
-				    (int)(time_second - cm->cm_timestamp));
+				    "COMMAND %p TIMEOUT AFTER %d SECONDS\n",
+				    cm, (int)(time_second - cm->cm_timestamp));
 				MFI_PRINT_CMD(cm);
 				timedout++;
 			}
@@ -3172,17 +3515,28 @@ mfi_timeout(void *data)
 	int timedout = 0;
 
 	deadline = time_second - MFI_CMD_TIMEOUT;
+	if (sc->adpreset == 0) {
+		if (!mfi_tbolt_reset(sc)) {
+			callout_reset(&sc->mfi_watchdog_callout,
+			    MFI_CMD_TIMEOUT * hz, mfi_timeout, sc);
+			return;
+		}
+	}
 	lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
 	TAILQ_FOREACH(cm, &sc->mfi_busy, cm_link) {
 		if (sc->mfi_aen_cm == cm)
 			continue;
 		if ((sc->mfi_aen_cm != cm) && (cm->cm_timestamp < deadline)) {
-			device_printf(sc->mfi_dev,
-			    "COMMAND %p TIMEOUT AFTER %d SECONDS\n", cm,
-			    (int)(time_second - cm->cm_timestamp));
-			MFI_PRINT_CMD(cm);
-			MFI_VALIDATE_CMD(sc, cm);
-			timedout++;
+			if (sc->adpreset != 0 && sc->issuepend_done == 0) {
+				cm->cm_timestamp = time_second;
+			} else {
+				device_printf(sc->mfi_dev,
+				    "COMMAND %p TIMEOUT AFTER %d SECONDS\n",
+				     cm, (int)(time_second - cm->cm_timestamp));
+				MFI_PRINT_CMD(cm);
+				MFI_VALIDATE_CMD(sc, cm);
+				timedout++;
+			}
 		}
 	}
 
diff --git a/sys/dev/raid/mfi/mfi_cam.c b/sys/dev/raid/mfi/mfi_cam.c
index d4fc2c08f0..b7a8ca259d 100644
--- a/sys/dev/raid/mfi/mfi_cam.c
+++ b/sys/dev/raid/mfi/mfi_cam.c
@@ -22,38 +22,9 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- */
-/*-
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *            Copyright 1994-2009 The FreeBSD Project.
- *            All rights reserved.
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- *    THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FREEBSD PROJECT OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY,OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION)HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * The views and conclusions contained in the software and documentation
- * are those of the authors and should not be interpreted as representing
- * official policies,either expressed or implied, of the FreeBSD Project.
  *
  * $FreeBSD: src/sys/dev/mfi/mfi_cam.c,v 1.7 2011/10/13 20:06:19 marius Exp $
+ * FreeBSD projects/head_mfi/ r232949
  */
 
 #include "opt_mfi.h"
@@ -151,6 +122,7 @@ mfip_attach(device_t dev)
 				device_get_unit(dev), &mfisc->mfi_io_lock, 1,
 				MFI_SCSI_MAX_CMDS, sc->devq);
 	if (sc->sim == NULL) {
+		cam_simq_release(sc->devq);
 		device_printf(dev, "CAM SIM attach failed\n");
 		return (EINVAL);
 	}
@@ -159,6 +131,7 @@ mfip_attach(device_t dev)
 	if (xpt_bus_register(sc->sim, 0) != 0) {
 		device_printf(dev, "XPT bus registration failed\n");
 		cam_sim_free(sc->sim);
+		cam_simq_release(sc->devq);
 		lockmgr(&mfisc->mfi_io_lock, LK_RELEASE);
 		return (EINVAL);
 	}
@@ -183,6 +156,9 @@ mfip_detach(device_t dev)
 		lockmgr(&sc->mfi_sc->mfi_io_lock, LK_RELEASE);
 	}
 
+	if (sc->devq != NULL)
+		cam_simq_release(sc->devq);
+
 	return (0);
 }
 
diff --git a/sys/dev/raid/mfi/mfi_debug.c b/sys/dev/raid/mfi/mfi_debug.c
index e3b5e741a6..648f855a48 100644
--- a/sys/dev/raid/mfi/mfi_debug.c
+++ b/sys/dev/raid/mfi/mfi_debug.c
@@ -24,6 +24,7 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/sys/dev/mfi/mfi_debug.c,v 1.3 2006/10/16 04:18:38 scottl Exp $
+ * FreeBSD projects/head_mfi/ r228320
  */
 
 #include "opt_mfi.h"
@@ -58,7 +59,8 @@ mfi_print_frame_flags(device_t dev, uint32_t flags)
 	    "\2SGL64"
 	    "\3SENSE64"
 	    "\4WRITE"
-	    "\5READ");
+	    "\5READ"
+	    "\6IEEESGL");
 }
 
 static void
@@ -68,7 +70,15 @@ mfi_print_sgl(struct mfi_frame_header *hdr, union mfi_sgl *sgl, int count)
 
 	kprintf("SG List:\n");
 	for (i = 0; i < count; i++) {
-		if (hdr->flags & MFI_FRAME_SGL64) {
+		if (hdr->flags & MFI_FRAME_IEEE_SGL) {
+			kprintf("0x%lx:%06d ", (u_long)sgl->sg_skinny[i].addr,
+			    sgl->sg_skinny[i].len);
+			columns += 26;
+			if (columns > 77) {
+				kprintf("\n");
+				columns = 0;
+			}
+		} else if (hdr->flags & MFI_FRAME_SGL64) {
 			kprintf("0x%lx:%06d ", (u_long)sgl->sg64[i].addr,
 			    sgl->sg64[i].len);
 			columns += 26;
@@ -235,7 +245,12 @@ mfi_validate_sg(struct mfi_softc *sc, struct mfi_command *cm,
 	hdr = &cm->cm_frame->header;
 	count = 0;
 	for (i = 0; i < hdr->sg_count; i++) {
-		count += cm->cm_sg->sg32[i].len;
+		if (hdr->flags & MFI_FRAME_IEEE_SGL)
+			count += cm->cm_sg->sg_skinny[i].len;
+		else if (hdr->flags & MFI_FRAME_SGL64)
+			count += cm->cm_sg->sg64[i].len;
+		else
+			count += cm->cm_sg->sg32[i].len;
 	}
 	/*
 	count++;
diff --git a/sys/dev/raid/mfi/mfi_disk.c b/sys/dev/raid/mfi/mfi_disk.c
index 53534b16c7..eeef124bf3 100644
--- a/sys/dev/raid/mfi/mfi_disk.c
+++ b/sys/dev/raid/mfi/mfi_disk.c
@@ -22,38 +22,9 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- */
-/*-
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *            Copyright 1994-2009 The FreeBSD Project.
- *            All rights reserved.
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- *    THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FREEBSD PROJECT OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY,OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION)HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * The views and conclusions contained in the software and documentation
- * are those of the authors and should not be interpreted as representing
- * official policies,either expressed or implied, of the FreeBSD Project.
  *
  * $FreeBSD: src/sys/dev/mfi/mfi_disk.c,v 1.8 2008/11/17 23:30:19 jhb Exp $
+ * FreeBSD projects/head_mfi/ r232888
  */
 
 #include "opt_mfi.h"
@@ -281,7 +252,7 @@ mfi_disk_strategy(struct dev_strategy_args *ap)
 	struct bio *bio = ap->a_bio;
 	struct buf *bp = bio->bio_buf;
 	struct mfi_disk *sc = ap->a_head.a_dev->si_drv1;
-	struct mfi_softc *controller;
+	struct mfi_softc *controller = sc->ld_controller;
 
 	if (sc == NULL) {
 		bp->b_error = EINVAL;
@@ -291,6 +262,16 @@ mfi_disk_strategy(struct dev_strategy_args *ap)
 		return (0);
 	}
 
+	if (controller->hw_crit_error) {
+		bp->b_error = EBUSY;
+		return (0);
+	}
+
+	if (controller->issuepend_done == 0) {
+		bp->b_error = EBUSY;
+		return (0);
+	}
+
 	/*
 	 * XXX swildner
 	 *
@@ -310,7 +291,6 @@ mfi_disk_strategy(struct dev_strategy_args *ap)
 		return (0);
 	}
 
-	controller = sc->ld_controller;
 	bio->bio_driver_info = sc;
 	lockmgr(&controller->mfi_io_lock, LK_EXCLUSIVE);
 	mfi_enqueue_bio(controller, bio);
diff --git a/sys/dev/raid/mfi/mfi_ioctl.h b/sys/dev/raid/mfi/mfi_ioctl.h
index 8450495493..15eea40ce8 100644
--- a/sys/dev/raid/mfi/mfi_ioctl.h
+++ b/sys/dev/raid/mfi/mfi_ioctl.h
@@ -24,18 +24,25 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/sys/dev/mfi/mfi_ioctl.h,v 1.9 2009/08/13 23:18:45 scottl Exp $
+ * FreeBSD projects/head_mfi/ r227612
  */
 
 #include 
 
+#include 
+
 #include 
 
-#if defined(__x86_64__) /* Assume amd64 wants 32 bit Linux */
 struct iovec32 {
 	u_int32_t	iov_base;
 	int		iov_len;
 };
-#endif
+
+struct megasas_sge
+{
+	bus_addr_t phys_addr;
+	uint32_t length;
+};
 
 #define MFIQ_FREE	0
 #define MFIQ_BIO	1
@@ -80,23 +87,6 @@ struct mfi_ioc_packet {
 	struct iovec mfi_sgl[MAX_IOCTL_SGE];
 } __packed;
 
-#ifdef __x86_64__
-struct mfi_ioc_packet32 {
-	uint16_t	mfi_adapter_no;
-	uint16_t	mfi_pad1;
-	uint32_t	mfi_sgl_off;
-	uint32_t	mfi_sge_count;
-	uint32_t	mfi_sense_off;
-	uint32_t	mfi_sense_len;
-	union {
-		uint8_t raw[128];
-		struct mfi_frame_header hdr;
-	} mfi_frame;
-
-	struct iovec32 mfi_sgl[MAX_IOCTL_SGE];
-} __packed;
-#endif
-
 struct mfi_ioc_aen {
 	uint16_t	aen_adapter_no;
 	uint16_t	aen_pad1;
@@ -105,9 +95,6 @@ struct mfi_ioc_aen {
 } __packed;
 
 #define MFI_CMD		_IOWR('M', 1, struct mfi_ioc_packet)
-#ifdef __x86_64__
-#define MFI_CMD32	_IOWR('M', 1, struct mfi_ioc_packet32)
-#endif
 #define MFI_SET_AEN	_IOW('M', 3, struct mfi_ioc_aen)
 
 #define MAX_LINUX_IOCTL_SGE	16
@@ -137,19 +124,8 @@ struct mfi_ioc_passthru {
 	uint8_t			*buf;
 } __packed;
 
-#ifdef __x86_64__
-struct mfi_ioc_passthru32 {
-	struct mfi_dcmd_frame	ioc_frame;
-	uint32_t		buf_size;
-	uint32_t		buf;
-} __packed;
-#endif
-
 #define MFIIO_STATS	_IOWR('Q', 101, union mfi_statrequest)
 #define MFIIO_PASSTHRU	_IOWR('C', 102, struct mfi_ioc_passthru)
-#ifdef __x86_64__
-#define MFIIO_PASSTHRU32	_IOWR('C', 102, struct mfi_ioc_passthru32)
-#endif
 
 struct mfi_linux_ioc_aen {
 	uint16_t	laen_adapter_no;
diff --git a/sys/dev/raid/mfi/mfi_pci.c b/sys/dev/raid/mfi/mfi_pci.c
index cb3163d6b3..629537e7fc 100644
--- a/sys/dev/raid/mfi/mfi_pci.c
+++ b/sys/dev/raid/mfi/mfi_pci.c
@@ -48,38 +48,9 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- */
-/*-
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *            Copyright 1994-2009 The FreeBSD Project.
- *            All rights reserved.
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- *    THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FREEBSD PROJECT OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY,OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION)HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * The views and conclusions contained in the software and documentation
- * are those of the authors and should not be interpreted as representing
- * official policies,either expressed or implied, of the FreeBSD Project.
  *
  * $FreeBSD: src/sys/dev/mfi/mfi_pci.c,v 1.16 2010/03/02 17:34:11 kib Exp $
+ * FreeBSD projects/head_mfi/ r232888
  */
 
 /* PCI/PCI-X/PCIe bus interface for the LSI MegaSAS controllers */
@@ -96,7 +67,6 @@
 #include 
 #include 
 #include 
-
 #include 
 
 #include 
@@ -134,6 +104,9 @@ static devclass_t	mfi_devclass;
 DRIVER_MODULE(mfi, pci, mfi_pci_driver, mfi_devclass, NULL, NULL);
 MODULE_VERSION(mfi, 1);
 
+static int	mfi_msi_enable = 1;
+TUNABLE_INT("hw.mfi.msi.enable", &mfi_msi_enable);
+
 struct mfi_ident {
 	uint16_t	vendor;
 	uint16_t	device;
@@ -142,6 +115,17 @@ struct mfi_ident {
 	int		flags;
 	const char	*desc;
 } mfi_identifiers[] = {
+	{0x1000, 0x005b, 0x1028, 0x1f2d, MFI_FLAGS_SKINNY| MFI_FLAGS_TBOLT, "Dell PERC H810 Adapter"},
+	{0x1000, 0x005b, 0x1028, 0x1f30, MFI_FLAGS_SKINNY| MFI_FLAGS_TBOLT, "Dell PERC H710 Embedded"},
+	{0x1000, 0x005b, 0x1028, 0x1f31, MFI_FLAGS_SKINNY| MFI_FLAGS_TBOLT, "Dell PERC H710P Adapter"},
+	{0x1000, 0x005b, 0x1028, 0x1f33, MFI_FLAGS_SKINNY| MFI_FLAGS_TBOLT, "Dell PERC H710P Mini (blades)"},
+	{0x1000, 0x005b, 0x1028, 0x1f34, MFI_FLAGS_SKINNY| MFI_FLAGS_TBOLT, "Dell PERC H710P Mini (monolithics)"},
+	{0x1000, 0x005b, 0x1028, 0x1f35, MFI_FLAGS_SKINNY| MFI_FLAGS_TBOLT, "Dell PERC H710 Adapter"},
+	{0x1000, 0x005b, 0x1028, 0x1f37, MFI_FLAGS_SKINNY| MFI_FLAGS_TBOLT, "Dell PERC H710 Mini (blades)"},
+	{0x1000, 0x005b, 0x1028, 0x1f38, MFI_FLAGS_SKINNY| MFI_FLAGS_TBOLT, "Dell PERC H710 Mini (monolithics)"},
+	{0x1000, 0x005b, 0x8086, 0x9265, MFI_FLAGS_SKINNY| MFI_FLAGS_TBOLT, "Intel (R) RAID Controller RS25DB080"},
+	{0x1000, 0x005b, 0x8086, 0x9285, MFI_FLAGS_SKINNY| MFI_FLAGS_TBOLT, "Intel (R) RAID Controller RS25NB008"},
+	{0x1000, 0x005b, 0xffff, 0xffff, MFI_FLAGS_SKINNY| MFI_FLAGS_TBOLT, "ThunderBolt"},
 	{0x1000, 0x0060, 0x1028, 0xffff, MFI_FLAGS_1078,  "Dell PERC 6"},
 	{0x1000, 0x0060, 0xffff, 0xffff, MFI_FLAGS_1078,  "LSI MegaSAS 1078"},
 	{0x1000, 0x0071, 0xffff, 0xffff, MFI_FLAGS_SKINNY, "Drake Skinny"},
@@ -200,6 +184,7 @@ mfi_pci_attach(device_t dev)
 	struct mfi_ident *m;
 	uint32_t command;
 	int error;
+	u_int irq_flags;
 
 	sc = device_get_softc(dev);
 	bzero(sc, sizeof(*sc));
@@ -227,7 +212,8 @@ mfi_pci_attach(device_t dev)
 		/* 1068/1078: Memory mapped BAR is at offset 0x10 */
 		sc->mfi_regs_rid = PCIR_BAR(0);
 	} else if ((sc->mfi_flags & MFI_FLAGS_GEN2) ||
-		   (sc->mfi_flags & MFI_FLAGS_SKINNY)) {
+		   (sc->mfi_flags & MFI_FLAGS_SKINNY) ||
+		   (sc->mfi_flags & MFI_FLAGS_TBOLT)) {
 		/* GEN2/Skinny: Memory mapped BAR is at offset 0x14 */
 		sc->mfi_regs_rid = PCIR_BAR(1);
 	}
@@ -256,6 +242,16 @@ mfi_pci_attach(device_t dev)
 		goto out;
 	}
 
+	/* Allocate IRQ resource. */
+	sc->mfi_irq_rid = 0;
+	sc->mfi_irq_type = pci_alloc_1intr(sc->mfi_dev, mfi_msi_enable,
+	    &sc->mfi_irq_rid, &irq_flags);
+	if ((sc->mfi_irq = bus_alloc_resource_any(sc->mfi_dev, SYS_RES_IRQ,
+	    &sc->mfi_irq_rid, irq_flags)) == NULL) {
+		device_printf(sc->mfi_dev, "Cannot allocate interrupt\n");
+		return (EINVAL);
+	}
+
 	error = mfi_attach(sc);
 out:
 	if (error) {
@@ -270,9 +266,8 @@ static int
 mfi_pci_detach(device_t dev)
 {
 	struct mfi_softc *sc;
-	struct mfi_disk *ld;
-	struct mfi_system_pd *syspd = NULL;
-	int error;
+	device_t *devlist;
+	int error, devcount, i;
 
 	sc = device_get_softc(dev);
 
@@ -286,20 +281,13 @@ mfi_pci_detach(device_t dev)
 	sc->mfi_detaching = 1;
 	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
 
-	while ((ld = TAILQ_FIRST(&sc->mfi_ld_tqh)) != NULL) {
-		if ((error = device_delete_child(dev, ld->ld_dev)) != 0) {
-			sc->mfi_detaching = 0;
-			lockmgr(&sc->mfi_config_lock, LK_RELEASE);
-			return (error);
-		}
-	}
-	while ((syspd = TAILQ_FIRST(&sc->mfi_syspd_tqh)) != NULL) {
-		if ((error = device_delete_child(dev,syspd->pd_dev)) != 0) {
-			sc->mfi_detaching = 0;
-			lockmgr(&sc->mfi_config_lock, LK_RELEASE);
-			return (error);
-		}
+	if ((error = device_get_children(sc->mfi_dev, &devlist, &devcount)) != 0) {
+		lockmgr(&sc->mfi_config_lock, LK_RELEASE);
+		return error;
 	}
+	for (i = 0; i < devcount; i++)
+		device_delete_child(sc->mfi_dev, devlist[i]);
+	kfree(devlist, M_TEMP);
 	lockmgr(&sc->mfi_config_lock, LK_RELEASE);
 
 	EVENTHANDLER_DEREGISTER(shutdown_final, sc->mfi_eh);
@@ -318,8 +306,8 @@ mfi_pci_free(struct mfi_softc *sc)
 		bus_release_resource(sc->mfi_dev, SYS_RES_MEMORY,
 		    sc->mfi_regs_rid, sc->mfi_regs_resource);
 	}
-
-	return;
+	if (sc->mfi_irq_type == PCI_INTR_TYPE_MSI)
+		pci_release_msi(sc->mfi_dev);
 }
 
 static int
diff --git a/sys/dev/raid/mfi/mfi_syspd.c b/sys/dev/raid/mfi/mfi_syspd.c
index b929de126b..f56a80335e 100644
--- a/sys/dev/raid/mfi/mfi_syspd.c
+++ b/sys/dev/raid/mfi/mfi_syspd.c
@@ -29,6 +29,7 @@
  * official policies,either expressed or implied, of the FreeBSD Project.
  *
  * $FreeBSD: src/sys/dev/mfi/mfi_pddisk.c,v 1.2.2.6 2007/08/24 17:29:18 jhb Exp $
+ * FreeBSD projects/head_mfi/ r232888
  */
 
 #include "opt_mfi.h"
@@ -212,7 +213,8 @@ mfi_syspd_disable(struct mfi_system_pd *sc)
 	if (sc->pd_flags & MFI_DISK_FLAGS_OPEN) {
 		if (sc->pd_controller->mfi_delete_busy_volumes)
 			return (0);
-		device_printf(sc->pd_dev, "Unable to delete busy syspd device\n");
+		device_printf(sc->pd_dev,
+		    "Unable to delete busy syspd device\n");
 		return (EBUSY);
 	}
 	sc->pd_flags |= MFI_DISK_FLAGS_DISABLED;
@@ -233,7 +235,7 @@ mfi_syspd_strategy(struct dev_strategy_args *ap)
 	struct bio *bio = ap->a_bio;
 	struct buf *bp = bio->bio_buf;
 	struct mfi_system_pd *sc = ap->a_head.a_dev->si_drv1;
-	struct mfi_softc *controller;
+	struct mfi_softc *controller = sc->pd_controller;
 
 	if (sc == NULL) {
 		bp->b_error = EINVAL;
@@ -243,6 +245,16 @@ mfi_syspd_strategy(struct dev_strategy_args *ap)
 		return (0);
 	}
 
+	if (controller->hw_crit_error) {
+		bp->b_error = EBUSY;
+		return (0);
+	}
+
+	if (controller->issuepend_done == 0) {
+		bp->b_error = EBUSY;
+		return (0);
+	}
+
 	/*
 	 * XXX swildner
 	 *
@@ -262,7 +274,6 @@ mfi_syspd_strategy(struct dev_strategy_args *ap)
 		return (0);
 	}
 
-	controller = sc->pd_controller;
 	bio->bio_driver_info = sc;
 	lockmgr(&controller->mfi_io_lock, LK_EXCLUSIVE);
 	mfi_enqueue_bio(controller, bio);
@@ -272,26 +283,6 @@ mfi_syspd_strategy(struct dev_strategy_args *ap)
 	return (0);
 }
 
-#if 0
-void
-mfi_disk_complete(struct bio *bio)
-{
-	struct mfi_system_pd *sc = bio->bio_driver_info;
-	struct buf *bp = bio->bio_buf;
-
-	devstat_end_transaction_buf(&sc->pd_devstat, bp);
-	if (bio->b_flags & B_ERROR) {
-		if (bp->b_error == 0)
-			bp->b_error = EIO;
-		diskerr(bio, sc->pd_disk.d_cdev, "hard error", -1, 1);
-		kprintf("\n");
-	} else {
-		bp->b_resid = 0;
-	}
-	biodone(bio);
-}
-#endif
-
 static int
 mfi_syspd_dump(struct dev_dump_args *ap)
 {
@@ -307,8 +298,8 @@ mfi_syspd_dump(struct dev_dump_args *ap)
 	parent_sc = sc->pd_controller;
 
 	if (len > 0) {
-		if ((error = mfi_dump_syspd_blocks(parent_sc, sc->pd_id, offset /
-		    MFI_SECTOR_LEN, virt, len)) != 0)
+		if ((error = mfi_dump_syspd_blocks(parent_sc,
+		    sc->pd_id, offset / MFI_SECTOR_LEN, virt, len)) != 0)
 			return (error);
 	} else {
 		/* mfi_sync_cache(parent_sc, sc->ld_id); */
diff --git a/sys/dev/raid/mfi/mfi_tbolt.c b/sys/dev/raid/mfi/mfi_tbolt.c
new file mode 100644
index 0000000000..b1e317bd15
--- /dev/null
+++ b/sys/dev/raid/mfi/mfi_tbolt.c
@@ -0,0 +1,1340 @@
+/*-
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *            Copyright 1994-2009 The FreeBSD Project.
+ *            All rights reserved.
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FREEBSD PROJECT OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY,OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION)HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * The views and conclusions contained in the software and documentation
+ * are those of the authors and should not be interpreted as representing
+ * official policies,either expressed or implied, of the FreeBSD Project.
+ *
+ * $FreeBSD: src/sys/dev/mfi/mfi_tbolt.c,v 1.00 2010/06/30 16:00:00 Bharat Gusain Exp $
+ * FreeBSD projects/head_mfi/ r232949
+ */
+
+#include "opt_mfi.h"
+
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+#include 
+
+#include 
+#include 
+#include 
+
+struct mfi_cmd_tbolt *mfi_tbolt_get_cmd(struct mfi_softc *sc);
+union mfi_mpi2_request_descriptor *
+mfi_tbolt_get_request_descriptor(struct mfi_softc *sc, uint16_t index);
+void mfi_tbolt_complete_cmd(struct mfi_softc *sc);
+int mfi_tbolt_build_io(struct mfi_softc *sc, struct mfi_command *mfi_cmd,
+    struct mfi_cmd_tbolt *cmd);
+static inline void mfi_tbolt_return_cmd(struct mfi_softc *sc,
+    struct mfi_cmd_tbolt *cmd);
+union mfi_mpi2_request_descriptor *mfi_tbolt_build_mpt_cmd(struct mfi_softc
+    *sc, struct mfi_command *cmd);
+uint8_t
+mfi_build_mpt_pass_thru(struct mfi_softc *sc, struct mfi_command *mfi_cmd);
+union mfi_mpi2_request_descriptor *mfi_build_and_issue_cmd(struct mfi_softc
+    *sc, struct mfi_command *mfi_cmd);
+int mfi_tbolt_is_ldio(struct mfi_command *mfi_cmd);
+void mfi_tbolt_build_ldio(struct mfi_softc *sc, struct mfi_command *mfi_cmd,
+    struct mfi_cmd_tbolt *cmd);
+static int mfi_tbolt_make_sgl(struct mfi_softc *sc, struct mfi_command
+    *mfi_cmd, pMpi25IeeeSgeChain64_t sgl_ptr, struct mfi_cmd_tbolt *cmd);
+static int mfi_tbolt_build_cdb(struct mfi_softc *sc, struct mfi_command
+    *mfi_cmd, uint8_t *cdb);
+void
+map_tbolt_cmd_status(struct mfi_command *mfi_cmd, uint8_t status,
+     uint8_t ext_status);
+static void mfi_issue_pending_cmds_again (struct mfi_softc *sc);
+static void mfi_kill_hba (struct mfi_softc *sc);
+static void mfi_process_fw_state_chg_isr(void *arg);
+uint8_t mfi_tbolt_get_map_info(struct mfi_softc *sc);
+
+#define MFI_FUSION_ENABLE_INTERRUPT_MASK	(0x00000008)
+
+void
+mfi_tbolt_enable_intr_ppc(struct mfi_softc *sc)
+{
+	MFI_WRITE4(sc, MFI_OMSK, ~MFI_FUSION_ENABLE_INTERRUPT_MASK);
+	MFI_READ4(sc, MFI_OMSK);
+}
+
+void
+mfi_tbolt_disable_intr_ppc(struct mfi_softc *sc)
+{
+	MFI_WRITE4(sc, MFI_OMSK, 0xFFFFFFFF);
+	MFI_READ4(sc, MFI_OMSK);
+}
+
+int32_t
+mfi_tbolt_read_fw_status_ppc(struct mfi_softc *sc)
+{
+	return MFI_READ4(sc, MFI_OSP0);
+}
+
+int32_t
+mfi_tbolt_check_clear_intr_ppc(struct mfi_softc *sc)
+{
+	int32_t status, mfi_status = 0;
+
+	status = MFI_READ4(sc, MFI_OSTS);
+
+	if (status & 1) {
+		MFI_WRITE4(sc, MFI_OSTS, status);
+		MFI_READ4(sc, MFI_OSTS);
+		if (status & MFI_STATE_CHANGE_INTERRUPT) {
+			mfi_status |= MFI_FIRMWARE_STATE_CHANGE;
+		}
+
+		return mfi_status;
+	}
+	if (!(status & MFI_FUSION_ENABLE_INTERRUPT_MASK))
+		return 1;
+
+	MFI_READ4(sc, MFI_OSTS);
+	return 0;
+}
+
+
+void
+mfi_tbolt_issue_cmd_ppc(struct mfi_softc *sc, bus_addr_t bus_add,
+   uint32_t frame_cnt)
+{
+	bus_add |= (MFI_REQ_DESCRIPT_FLAGS_MFA
+	    << MFI_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
+	MFI_WRITE4(sc, MFI_IQPL, (uint32_t)bus_add);
+	MFI_WRITE4(sc, MFI_IQPH, (uint32_t)((uint64_t)bus_add >> 32));
+}
+
+/**
+ * mfi_tbolt_adp_reset - For controller reset
+ * @regs: MFI register set
+ */
+int mfi_tbolt_adp_reset(struct mfi_softc *sc)
+{
+	int retry = 0, i = 0;
+	int HostDiag;
+
+	MFI_WRITE4(sc, MFI_WSR, 0xF);
+	MFI_WRITE4(sc, MFI_WSR, 4);
+	MFI_WRITE4(sc, MFI_WSR, 0xB);
+	MFI_WRITE4(sc, MFI_WSR, 2);
+	MFI_WRITE4(sc, MFI_WSR, 7);
+	MFI_WRITE4(sc, MFI_WSR, 0xD);
+
+	for (i = 0; i < 10000; i++) ;
+
+	HostDiag = (uint32_t)MFI_READ4(sc, MFI_HDR);
+
+	while (!( HostDiag & DIAG_WRITE_ENABLE)) {
+		for (i = 0; i < 1000; i++);
+		HostDiag = (uint32_t)MFI_READ4(sc, MFI_HDR);
+		device_printf(sc->mfi_dev, "ADP_RESET_TBOLT: retry time=%x, "
+		    "hostdiag=%x\n", retry, HostDiag);
+
+		if (retry++ >= 100)
+			return 1;
+	}
+
+	device_printf(sc->mfi_dev, "ADP_RESET_TBOLT: HostDiag=%x\n", HostDiag);
+
+	MFI_WRITE4(sc, MFI_HDR, (HostDiag | DIAG_RESET_ADAPTER));
+
+	for (i=0; i < 10; i++) {
+		for (i = 0; i < 10000; i++);
+	}
+
+	HostDiag = (uint32_t)MFI_READ4(sc, MFI_RSR);
+	while (HostDiag & DIAG_RESET_ADAPTER) {
+		for (i = 0; i < 1000; i++) ;
+		HostDiag = (uint32_t)MFI_READ4(sc, MFI_RSR);
+		device_printf(sc->mfi_dev, "ADP_RESET_TBOLT: retry time=%x, "
+		    "hostdiag=%x\n", retry, HostDiag);
+
+		if (retry++ >= 1000)
+			return 1;
+	}
+	return 0;
+}
+
+/*
+ *******************************************************************************************
+ * Description:
+ *      This routine initialize Thunderbolt specific device information
+ *******************************************************************************************
+ */
+void mfi_tbolt_init_globals(struct mfi_softc *sc)
+{
+	/* Initialize single reply size and Message size */
+	sc->reply_size = MEGASAS_THUNDERBOLT_REPLY_SIZE;
+	sc->raid_io_msg_size = MEGASAS_THUNDERBOLT_NEW_MSG_SIZE;
+
+	/*
+	 * Calculating how many SGEs allowed in a allocated main message
+	 * (size of the Message - Raid SCSI IO message size(except SGE))
+	 * / size of SGE
+	 * (0x100 - (0x90 - 0x10)) / 0x10 = 8
+	 */
+	sc->max_SGEs_in_main_message =
+	    (uint8_t)((sc->raid_io_msg_size
+	    - (sizeof(struct mfi_mpi2_request_raid_scsi_io)
+	    - sizeof(MPI2_SGE_IO_UNION))) / sizeof(MPI2_SGE_IO_UNION));
+	/*
+	 * (Command frame size allocaed in SRB ext - Raid SCSI IO message size)
+	 * / size of SGL ;
+	 * (1280 - 256) / 16 = 64
+	 */
+	sc->max_SGEs_in_chain_message = (MR_COMMAND_SIZE
+	    - sc->raid_io_msg_size) / sizeof(MPI2_SGE_IO_UNION);
+	/*
+	 * (0x08-1) + 0x40 = 0x47 - 0x01 = 0x46  one is left for command
+	 * colscing
+	*/
+	sc->mfi_max_sge = (sc->max_SGEs_in_main_message - 1)
+	    + sc->max_SGEs_in_chain_message - 1;
+	/*
+	* This is the offset in number of 4 * 32bit words to the next chain
+	* (0x100 - 0x10)/0x10 = 0xF(15)
+	*/
+	sc->chain_offset_value_for_main_message = (sc->raid_io_msg_size
+	    - sizeof(MPI2_SGE_IO_UNION))/16;
+	sc->chain_offset_value_for_mpt_ptmsg
+	    = offsetof(struct mfi_mpi2_request_raid_scsi_io, SGL)/16;
+	sc->mfi_cmd_pool_tbolt = NULL;
+	sc->request_desc_pool = NULL;
+}
+
+/*
+ ****************************************************************************
+ * Description:
+ *      This function calculates the memory requirement for Thunderbolt
+ *      controller
+ * Return Value:
+ *      Total required memory in bytes
+ ****************************************************************************
+ */
+
+uint32_t mfi_tbolt_get_memory_requirement(struct mfi_softc *sc)
+{
+	uint32_t size;
+
+	size = MEGASAS_THUNDERBOLT_MSG_ALLIGNMENT;	/* for Alignment */
+	size += sc->raid_io_msg_size * (sc->mfi_max_fw_cmds + 1);
+	size += sc->reply_size * sc->mfi_max_fw_cmds;
+	/* this is for SGL's */
+	size += MEGASAS_MAX_SZ_CHAIN_FRAME * sc->mfi_max_fw_cmds;
+	return size;
+}
+
+/*
+ ****************************************************************************
+ * Description:
+ *      This function will prepare message pools for the Thunderbolt controller
+ * Arguments:
+ *      DevExt - HBA miniport driver's adapter data storage structure
+ *      pMemLocation - start of the memory allocated for Thunderbolt.
+ * Return Value:
+ *      TRUE if successful
+ *      FALSE if failed
+ ****************************************************************************
+ */
+int mfi_tbolt_init_desc_pool(struct mfi_softc *sc, uint8_t* mem_location,
+    uint32_t tbolt_contg_length)
+{
+	uint32_t     offset = 0;
+	uint8_t      *addr = mem_location;
+
+	/* Request Descriptor Base physical Address */
+
+	/* For Request Decriptors Virtual Memory */
+	/* Initialise the aligned IO Frames Virtual Memory Pointer */
+	if (((uintptr_t)addr) & (0xFF)) {
+		addr = &addr[sc->raid_io_msg_size];
+		addr = (uint8_t *)((uintptr_t)addr & (~0xFF));
+		sc->request_message_pool_align = addr;
+	} else
+		sc->request_message_pool_align = addr;
+
+	offset = sc->request_message_pool_align - sc->request_message_pool;
+	sc->request_msg_busaddr = sc->mfi_tb_busaddr + offset;
+
+	/* DJA XXX should this be bus dma ??? */
+	/* Skip request message pool */
+	addr = &addr[sc->raid_io_msg_size * (sc->mfi_max_fw_cmds + 1)];
+	/* Reply Frame Pool is initialized */
+	sc->reply_frame_pool = (struct mfi_mpi2_reply_header *) addr;
+	if (((uintptr_t)addr) & (0xFF)) {
+		addr = &addr[sc->reply_size];
+		addr = (uint8_t *)((uintptr_t)addr & (~0xFF));
+	}
+	sc->reply_frame_pool_align
+		    = (struct mfi_mpi2_reply_header *)addr;
+
+	offset = (uintptr_t)sc->reply_frame_pool_align
+	    - (uintptr_t)sc->request_message_pool;
+	sc->reply_frame_busaddr = sc->mfi_tb_busaddr + offset;
+
+	/* Skip Reply Frame Pool */
+	addr += sc->reply_size * sc->mfi_max_fw_cmds;
+	sc->reply_pool_limit = addr;
+
+	/* initializing reply address to 0xFFFFFFFF */
+	memset((uint8_t *)sc->reply_frame_pool, 0xFF,
+	       (sc->reply_size * sc->mfi_max_fw_cmds));
+
+	offset = sc->reply_size * sc->mfi_max_fw_cmds;
+	sc->sg_frame_busaddr = sc->reply_frame_busaddr + offset;
+	/* initialize the last_reply_idx to 0 */
+	sc->last_reply_idx = 0;
+	offset = (sc->sg_frame_busaddr + (MEGASAS_MAX_SZ_CHAIN_FRAME *
+	    sc->mfi_max_fw_cmds)) - sc->mfi_tb_busaddr;
+	if (offset > tbolt_contg_length)
+		device_printf(sc->mfi_dev, "Error:Initialized more than "
+		    "allocated\n");
+	return 0;
+}
+
+/*
+ ****************************************************************************
+ * Description:
+ *   This routine prepare and issue INIT2 frame to the Firmware
+ ****************************************************************************
+ */
+
+int
+mfi_tbolt_init_MFI_queue(struct mfi_softc *sc)
+{
+	struct MPI2_IOC_INIT_REQUEST   *mpi2IocInit;
+	struct mfi_init_frame	*mfi_init;
+	uintptr_t			offset = 0;
+	bus_addr_t			phyAddress;
+	MFI_ADDRESS			*mfiAddressTemp;
+	struct mfi_command *cm;
+	int error;
+
+	mpi2IocInit = (struct MPI2_IOC_INIT_REQUEST *)sc->mfi_tb_ioc_init_desc;
+	/* Check if initialization is already completed */
+	if (sc->MFA_enabled) {
+		return 1;
+	}
+
+	lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
+	if ((cm = mfi_dequeue_free(sc)) == NULL) {
+		lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+		return (EBUSY);
+	}
+	cm->cm_frame = (union mfi_frame *)((uintptr_t)sc->mfi_tb_init);
+	cm->cm_frame_busaddr = sc->mfi_tb_init_busaddr;
+	cm->cm_dmamap = sc->mfi_tb_init_dmamap;
+	cm->cm_frame->header.context = 0;
+	cm->cm_sc = sc;
+	cm->cm_index = 0;
+
+	/*
+	 * Abuse the SG list area of the frame to hold the init_qinfo
+	 * object;
+	 */
+	mfi_init = &cm->cm_frame->init;
+
+	bzero(mpi2IocInit, sizeof(struct MPI2_IOC_INIT_REQUEST));
+	mpi2IocInit->Function  = MPI2_FUNCTION_IOC_INIT;
+	mpi2IocInit->WhoInit   = MPI2_WHOINIT_HOST_DRIVER;
+
+	/* set MsgVersion and HeaderVersion host driver was built with */
+	mpi2IocInit->MsgVersion = MPI2_VERSION;
+	mpi2IocInit->HeaderVersion = MPI2_HEADER_VERSION;
+	mpi2IocInit->SystemRequestFrameSize = sc->raid_io_msg_size/4;
+	mpi2IocInit->ReplyDescriptorPostQueueDepth
+	    = (uint16_t)sc->mfi_max_fw_cmds;
+	mpi2IocInit->ReplyFreeQueueDepth = 0; /* Not supported by MR. */
+
+	/* Get physical address of reply frame pool */
+	offset = (uintptr_t) sc->reply_frame_pool_align
+	    - (uintptr_t)sc->request_message_pool;
+	phyAddress = sc->mfi_tb_busaddr + offset;
+	mfiAddressTemp =
+	    (MFI_ADDRESS *)&mpi2IocInit->ReplyDescriptorPostQueueAddress;
+	mfiAddressTemp->u.addressLow = (uint32_t)phyAddress;
+	mfiAddressTemp->u.addressHigh = (uint32_t)((uint64_t)phyAddress >> 32);
+
+	/* Get physical address of request message pool */
+	offset = sc->request_message_pool_align - sc->request_message_pool;
+	phyAddress =  sc->mfi_tb_busaddr + offset;
+	mfiAddressTemp = (MFI_ADDRESS *)&mpi2IocInit->SystemRequestFrameBaseAddress;
+	mfiAddressTemp->u.addressLow = (uint32_t)phyAddress;
+	mfiAddressTemp->u.addressHigh = (uint32_t)((uint64_t)phyAddress >> 32);
+	mpi2IocInit->ReplyFreeQueueAddress =  0; /* Not supported by MR. */
+	mpi2IocInit->TimeStamp = time_second;
+
+	if (sc->verbuf) {
+		ksnprintf((char *)sc->verbuf, strlen(MEGASAS_VERSION) + 2, "%s\n",
+                MEGASAS_VERSION);
+		mfi_init->driver_ver_lo = (uint32_t)sc->verbuf_h_busaddr;
+		mfi_init->driver_ver_hi =
+		    (uint32_t)((uint64_t)sc->verbuf_h_busaddr >> 32);
+	}
+	/* Get the physical address of the mpi2 ioc init command */
+	phyAddress =  sc->mfi_tb_ioc_init_busaddr;
+	mfi_init->qinfo_new_addr_lo = (uint32_t)phyAddress;
+	mfi_init->qinfo_new_addr_hi = (uint32_t)((uint64_t)phyAddress >> 32);
+	mfi_init->header.flags |= MFI_FRAME_DONT_POST_IN_REPLY_QUEUE;
+
+	mfi_init->header.cmd = MFI_CMD_INIT;
+	mfi_init->header.data_len = sizeof(struct MPI2_IOC_INIT_REQUEST);
+	mfi_init->header.cmd_status = MFI_STAT_INVALID_STATUS;
+
+	cm->cm_data = NULL;
+	cm->cm_flags |= MFI_CMD_POLLED;
+	cm->cm_timestamp = time_second;
+	if ((error = mfi_mapcmd(sc, cm)) != 0) {
+		device_printf(sc->mfi_dev, "failed to send IOC init2 "
+		    "command %d at %lx\n", error, (long)cm->cm_frame_busaddr);
+		mfi_release_command(cm);
+		lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+		return (error);
+	}
+	mfi_release_command(cm);
+	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+
+	if (mfi_init->header.cmd_status == 0) {
+		sc->MFA_enabled = 1;
+	}
+	else {
+		device_printf(sc->mfi_dev, "Init command Failed %x\n",
+		    mfi_init->header.cmd_status);
+		return 1;
+	}
+
+	return 0;
+
+}
+
+int mfi_tbolt_alloc_cmd(struct mfi_softc *sc)
+{
+	struct mfi_cmd_tbolt *cmd;
+	bus_addr_t io_req_base_phys;
+	uint8_t *io_req_base;
+	int i = 0, j = 0, offset = 0;
+
+	/*
+	 * sc->mfi_cmd_pool_tbolt is an array of struct mfi_cmd_tbolt pointers.
+	 * Allocate the dynamic array first and then allocate individual
+	 * commands.
+	 */
+	sc->request_desc_pool = kmalloc(sizeof(
+	    union mfi_mpi2_request_descriptor) * sc->mfi_max_fw_cmds,
+	    M_MFIBUF, M_NOWAIT|M_ZERO);
+	sc->mfi_cmd_pool_tbolt = kmalloc(sizeof(struct mfi_cmd_tbolt*)
+	    * sc->mfi_max_fw_cmds, M_MFIBUF, M_NOWAIT|M_ZERO);
+
+	if (!sc->mfi_cmd_pool_tbolt) {
+		device_printf(sc->mfi_dev, "out of memory. Could not alloc "
+		    "memory for cmd_list_fusion\n");
+		return 1;
+	}
+
+	for (i = 0; i < sc->mfi_max_fw_cmds; i++) {
+		sc->mfi_cmd_pool_tbolt[i] = kmalloc(sizeof(
+		    struct mfi_cmd_tbolt),M_MFIBUF, M_NOWAIT|M_ZERO);
+
+		if (!sc->mfi_cmd_pool_tbolt[i]) {
+			device_printf(sc->mfi_dev, "Could not alloc cmd list "
+			    "fusion\n");
+
+			for (j = 0; j < i; j++)
+				kfree(sc->mfi_cmd_pool_tbolt[j], M_MFIBUF);
+
+			kfree(sc->mfi_cmd_pool_tbolt, M_MFIBUF);
+			sc->mfi_cmd_pool_tbolt = NULL;
+		}
+	}
+
+	/*
+	 * The first 256 bytes (SMID 0) is not used. Don't add to the cmd
+	 *list
+	 */
+	io_req_base = sc->request_message_pool_align
+		+ MEGASAS_THUNDERBOLT_NEW_MSG_SIZE;
+	io_req_base_phys = sc->request_msg_busaddr
+		+ MEGASAS_THUNDERBOLT_NEW_MSG_SIZE;
+
+	/*
+	 * Add all the commands to command pool (instance->cmd_pool)
+	 */
+	/* SMID 0 is reserved. Set SMID/index from 1 */
+
+	for (i = 0; i < sc->mfi_max_fw_cmds; i++) {
+		cmd = sc->mfi_cmd_pool_tbolt[i];
+		offset = MEGASAS_THUNDERBOLT_NEW_MSG_SIZE * i;
+		cmd->index = i + 1;
+		cmd->request_desc = (union mfi_mpi2_request_descriptor *)
+		    (sc->request_desc_pool + i);
+		cmd->io_request = (struct mfi_mpi2_request_raid_scsi_io *)
+		    (io_req_base + offset);
+		cmd->io_request_phys_addr = io_req_base_phys + offset;
+		cmd->sg_frame = (MPI2_SGE_IO_UNION *)(sc->reply_pool_limit
+		    + i * MEGASAS_MAX_SZ_CHAIN_FRAME);
+		cmd->sg_frame_phys_addr = sc->sg_frame_busaddr + i
+		    * MEGASAS_MAX_SZ_CHAIN_FRAME;
+
+		TAILQ_INSERT_TAIL(&(sc->mfi_cmd_tbolt_tqh), cmd, next);
+	}
+	return 0;
+}
+
+int mfi_tbolt_reset(struct mfi_softc *sc)
+{
+	uint32_t fw_state;
+
+	lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
+	if (atomic_read(&sc->fw_reset_no_pci_access)) {
+		device_printf(sc->mfi_dev, "NO PCI ACCESS\n");
+		lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+		return 1;
+	}
+
+	if (sc->hw_crit_error) {
+		device_printf(sc->mfi_dev, "HW CRITICAL ERROR\n");
+		lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+		return 1;
+	}
+
+	if (sc->mfi_flags & MFI_FLAGS_TBOLT) {
+		fw_state = sc->mfi_read_fw_status(sc);
+		if ((fw_state & MFI_FWSTATE_FAULT) == MFI_FWSTATE_FAULT) {
+			if ((sc->disableOnlineCtrlReset == 0)
+			    && (sc->adpreset == 0)) {
+				device_printf(sc->mfi_dev, "Adapter RESET "
+				    "condition is detected\n");
+				sc->adpreset = 1;
+				sc->issuepend_done = 0;
+				sc->MFA_enabled = 0;
+				sc->last_reply_idx = 0;
+				mfi_process_fw_state_chg_isr((void *) sc);
+			}
+			lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+			return 0;
+		}
+	}
+	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+	return 1;
+}
+
+/*
+ * mfi_intr_tbolt - isr entry point
+ */
+void mfi_intr_tbolt(void *arg)
+{
+	struct mfi_softc *sc = (struct mfi_softc *)arg;
+
+	if (sc->mfi_check_clear_intr(sc) == 1) {
+		return;
+	}
+	if (sc->mfi_detaching)
+		return;
+	lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
+	mfi_tbolt_complete_cmd(sc);
+	if (sc->mfi_flags & MFI_FLAGS_QFRZN)
+		sc->mfi_flags &= ~MFI_FLAGS_QFRZN;
+	mfi_startio(sc);
+	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+	return;
+}
+
+/**
+ * map_cmd_status -	Maps FW cmd status to OS cmd status
+ * @cmd :		Pointer to cmd
+ * @status :		status of cmd returned by FW
+ * @ext_status :	ext status of cmd returned by FW
+ */
+
+void
+map_tbolt_cmd_status(struct mfi_command *mfi_cmd, uint8_t status,
+    uint8_t ext_status)
+{
+
+	switch (status) {
+
+		case MFI_STAT_OK:
+			mfi_cmd->cm_frame->header.cmd_status = 0;
+			mfi_cmd->cm_frame->dcmd.header.cmd_status = 0;
+			break;
+
+		case MFI_STAT_SCSI_IO_FAILED:
+		case MFI_STAT_LD_INIT_IN_PROGRESS:
+			mfi_cmd->cm_frame->header.cmd_status = status;
+			mfi_cmd->cm_frame->header.scsi_status = ext_status;
+			mfi_cmd->cm_frame->dcmd.header.cmd_status = status;
+			mfi_cmd->cm_frame->dcmd.header.scsi_status
+			    = ext_status;
+			break;
+
+		case MFI_STAT_SCSI_DONE_WITH_ERROR:
+			mfi_cmd->cm_frame->header.cmd_status = ext_status;
+			mfi_cmd->cm_frame->dcmd.header.cmd_status = ext_status;
+			break;
+
+		case MFI_STAT_LD_OFFLINE:
+		case MFI_STAT_DEVICE_NOT_FOUND:
+			mfi_cmd->cm_frame->header.cmd_status = status;
+			mfi_cmd->cm_frame->dcmd.header.cmd_status = status;
+			break;
+
+		default:
+			mfi_cmd->cm_frame->header.cmd_status = status;
+			mfi_cmd->cm_frame->dcmd.header.cmd_status = status;
+			break;
+		}
+}
+
+/**
+ * mfi_tbolt_return_cmd -	Return a cmd to free command pool
+ * @instance:		Adapter soft state
+ * @cmd:		Command packet to be returned to free command pool
+ */
+static inline void
+mfi_tbolt_return_cmd(struct mfi_softc *sc, struct mfi_cmd_tbolt *cmd)
+{
+	KKASSERT(lockstatus(&sc->mfi_io_lock, curthread) != 0);
+
+	TAILQ_INSERT_TAIL(&sc->mfi_cmd_tbolt_tqh, cmd, next);
+}
+
+void mfi_tbolt_complete_cmd(struct mfi_softc *sc)
+{
+	struct mfi_mpi2_reply_header *desc, *reply_desc;
+	struct mfi_command *cmd_mfi;	/* For MFA Cmds */
+	struct mfi_cmd_tbolt *cmd_tbolt;
+	uint16_t smid;
+	uint8_t reply_descript_type;
+	struct mfi_mpi2_request_raid_scsi_io  *scsi_io_req;
+	uint32_t status, extStatus;
+	uint16_t num_completed;
+	union desc_value val;
+
+	desc = (struct mfi_mpi2_reply_header *)
+		((uintptr_t)sc->reply_frame_pool_align
+		+ sc->last_reply_idx * sc->reply_size);
+	reply_desc = desc;
+
+	if (!reply_desc)
+		device_printf(sc->mfi_dev, "reply desc is NULL!!\n");
+
+	reply_descript_type = reply_desc->ReplyFlags
+	     & MPI2_RPY_DESCRIPT_FLAGS_TYPE_MASK;
+	if (reply_descript_type == MPI2_RPY_DESCRIPT_FLAGS_UNUSED)
+		return;
+
+	num_completed = 0;
+	val.word = ((union mfi_mpi2_reply_descriptor *)desc)->words;
+
+	/* Read Reply descriptor */
+	while ((val.u.low != 0xFFFFFFFF) && (val.u.high != 0xFFFFFFFF)) {
+
+		smid = reply_desc->SMID;
+		if (!smid || smid > sc->mfi_max_fw_cmds + 1) {
+			device_printf(sc->mfi_dev, "smid is %x. Cannot "
+			    "proceed. Returning \n", smid);
+			return;
+		}
+
+		cmd_tbolt = sc->mfi_cmd_pool_tbolt[smid - 1];
+		cmd_mfi = &sc->mfi_commands[cmd_tbolt->sync_cmd_idx];
+		scsi_io_req = cmd_tbolt->io_request;
+
+		/* Check if internal commands */
+		status = cmd_mfi->cm_frame->dcmd.header.cmd_status;
+		extStatus = cmd_mfi->cm_frame->dcmd.header.scsi_status;
+
+		switch (scsi_io_req->Function) {
+		case MPI2_FUNCTION_LD_IO_REQUEST:
+			/* Regular Path IO. */
+			/* Map the Fw Error Status. */
+			map_tbolt_cmd_status(cmd_mfi, status,
+			    extStatus);
+			if ((cmd_mfi->cm_frame->dcmd.opcode
+			    == MFI_DCMD_LD_MAP_GET_INFO)
+			    && (cmd_mfi->cm_frame->dcmd.mbox[1] == 1)) {
+					if (cmd_mfi->cm_frame->header.cmd_status
+					    != 0)
+						device_printf(sc->mfi_dev,
+						    "map sync failed\n");
+					else {
+						sc->map_id++;
+						device_printf(sc->mfi_dev,
+						    "map sync completed\n");
+						mfi_release_command(cmd_mfi);
+					}
+				}
+			if ((cmd_mfi->cm_flags & MFI_ON_MFIQ_BUSY)
+			    == MFI_ON_MFIQ_BUSY
+			    && (cmd_mfi->cm_flags & MFI_CMD_POLLED) == 0) {
+				/* BHARAT poll workaround */
+				mfi_remove_busy(cmd_mfi);
+				cmd_mfi->cm_error = 0;
+				mfi_complete(sc, cmd_mfi);
+			}
+			mfi_tbolt_return_cmd(sc, cmd_tbolt);
+			break;
+		case MPI2_FUNCTION_PASSTHRU_IO_REQUEST:
+			map_tbolt_cmd_status(cmd_mfi, status, extStatus);
+			if ((cmd_mfi->cm_frame->dcmd.opcode
+			    == MFI_DCMD_LD_MAP_GET_INFO)
+			    && (cmd_mfi->cm_frame->dcmd.mbox[1] == 1)) {
+				if (cmd_mfi->cm_frame->header.cmd_status != 0)
+					device_printf(sc->mfi_dev,
+					    "map sync failed\n");
+				else {
+					sc->map_id++;
+					device_printf(sc->mfi_dev,
+					    "map sync completed\n");
+					mfi_release_command(cmd_mfi);
+				}
+			}
+			if ((cmd_mfi->cm_flags & MFI_ON_MFIQ_BUSY)
+			    == MFI_ON_MFIQ_BUSY
+			    && (cmd_mfi->cm_flags & MFI_CMD_POLLED) == 0) {
+				/* BHARAT poll workaround */
+				mfi_remove_busy(cmd_mfi);
+				cmd_mfi->cm_error = 0;
+				mfi_complete(sc, cmd_mfi);
+			}
+			mfi_tbolt_return_cmd(sc, cmd_tbolt);
+			break;
+		}
+
+		sc->last_reply_idx++;
+		if (sc->last_reply_idx >= sc->mfi_max_fw_cmds) {
+			MFI_WRITE4(sc, MFI_RPI, sc->last_reply_idx);
+			sc->last_reply_idx = 0;
+		}
+		/*set it back to all 0xfff.*/
+		((union mfi_mpi2_reply_descriptor*)desc)->words =
+			~((uint64_t)0x00);
+
+		num_completed++;
+
+		/* Get the next reply descriptor */
+		desc = (struct mfi_mpi2_reply_header *)
+		    ((uintptr_t)sc->reply_frame_pool_align
+		    + sc->last_reply_idx * sc->reply_size);
+		reply_desc = desc;
+		val.word = ((union mfi_mpi2_reply_descriptor*)desc)->words;
+		reply_descript_type = reply_desc->ReplyFlags
+		    & MPI2_RPY_DESCRIPT_FLAGS_TYPE_MASK;
+		if (reply_descript_type == MPI2_RPY_DESCRIPT_FLAGS_UNUSED)
+			break;
+	}
+
+	if (!num_completed)
+		return;
+
+	/* update replyIndex to FW */
+	if (sc->last_reply_idx)
+		MFI_WRITE4(sc, MFI_RPI, sc->last_reply_idx);
+
+	return;
+}
+
+/**
+ * mfi_get_cmd -	Get a command from the free pool
+ * @instance:		Adapter soft state
+ *
+ * Returns a free command from the pool
+ */
+
+struct mfi_cmd_tbolt *mfi_tbolt_get_cmd(struct mfi_softc
+						  *sc)
+{
+	struct mfi_cmd_tbolt *cmd = NULL;
+
+	KKASSERT(lockstatus(&sc->mfi_io_lock, curthread) != 0);
+
+	cmd = TAILQ_FIRST(&sc->mfi_cmd_tbolt_tqh);
+	TAILQ_REMOVE(&sc->mfi_cmd_tbolt_tqh, cmd, next);
+	memset((uint8_t *)cmd->sg_frame, 0, MEGASAS_MAX_SZ_CHAIN_FRAME);
+	memset((uint8_t *)cmd->io_request, 0,
+	    MEGASAS_THUNDERBOLT_NEW_MSG_SIZE);
+	return cmd;
+}
+
+union mfi_mpi2_request_descriptor *
+mfi_tbolt_get_request_descriptor(struct mfi_softc *sc, uint16_t index)
+{
+	uint8_t *p;
+
+	if (index >= sc->mfi_max_fw_cmds) {
+		device_printf(sc->mfi_dev, "Invalid SMID (0x%x)request "
+		    "for descriptor\n", index);
+		return NULL;
+	}
+	p = sc->request_desc_pool + sizeof(union mfi_mpi2_request_descriptor)
+	    * index;
+	memset(p, 0, sizeof(union mfi_mpi2_request_descriptor));
+	return (union mfi_mpi2_request_descriptor *)p;
+}
+
+
+/* Used to build IOCTL cmd */
+uint8_t
+mfi_build_mpt_pass_thru(struct mfi_softc *sc, struct mfi_command *mfi_cmd)
+{
+	MPI25_IEEE_SGE_CHAIN64 *mpi25_ieee_chain;
+	struct mfi_mpi2_request_raid_scsi_io *io_req;
+	struct mfi_cmd_tbolt *cmd;
+
+	cmd = mfi_tbolt_get_cmd(sc);
+	if (!cmd)
+		return EBUSY;
+	mfi_cmd->cm_extra_frames = cmd->index; /* Frame count used as SMID */
+	cmd->sync_cmd_idx = mfi_cmd->cm_index;
+	io_req = cmd->io_request;
+	mpi25_ieee_chain = (MPI25_IEEE_SGE_CHAIN64 *)&io_req->SGL.IeeeChain;
+
+	io_req->Function = MPI2_FUNCTION_PASSTHRU_IO_REQUEST;
+	io_req->SGLOffset0 = offsetof(struct mfi_mpi2_request_raid_scsi_io,
+	    SGL) / 4;
+	io_req->ChainOffset = sc->chain_offset_value_for_mpt_ptmsg;
+
+	mpi25_ieee_chain->Address = mfi_cmd->cm_frame_busaddr;
+
+	/*
+	  In MFI pass thru, nextChainOffset will always be zero to
+	  indicate the end of the chain.
+	*/
+	mpi25_ieee_chain->Flags= MPI2_IEEE_SGE_FLAGS_CHAIN_ELEMENT
+		| MPI2_IEEE_SGE_FLAGS_IOCPLBNTA_ADDR;
+
+	/* setting the length to the maximum length */
+	mpi25_ieee_chain->Length = 1024;
+
+	return 0;
+}
+
+void
+mfi_tbolt_build_ldio(struct mfi_softc *sc, struct mfi_command *mfi_cmd,
+    struct mfi_cmd_tbolt *cmd)
+{
+	uint32_t start_lba_lo = 0, start_lba_hi = 0, device_id;
+	struct mfi_mpi2_request_raid_scsi_io	*io_request;
+	struct IO_REQUEST_INFO io_info;
+
+	device_id = mfi_cmd->cm_frame->io.header.target_id;
+	io_request = cmd->io_request;
+	io_request->RaidContext.TargetID = device_id;
+	io_request->RaidContext.Status = 0;
+	io_request->RaidContext.exStatus =0;
+
+	start_lba_lo = mfi_cmd->cm_frame->io.lba_lo;
+	start_lba_hi = mfi_cmd->cm_frame->io.lba_hi;
+
+	memset(&io_info, 0, sizeof(struct IO_REQUEST_INFO));
+	io_info.ldStartBlock = ((uint64_t)start_lba_hi << 32) | start_lba_lo;
+	io_info.numBlocks = mfi_cmd->cm_frame->io.header.data_len;
+	io_info.ldTgtId = device_id;
+	if ((mfi_cmd->cm_frame->header.flags & MFI_FRAME_DIR_READ) ==
+	    MFI_FRAME_DIR_READ)
+		io_info.isRead = 1;
+
+	io_request->RaidContext.timeoutValue = MFI_FUSION_FP_DEFAULT_TIMEOUT;
+	io_request->Function = MPI2_FUNCTION_LD_IO_REQUEST;
+	io_request->DevHandle = device_id;
+	cmd->request_desc->header.RequestFlags =
+	    (MFI_REQ_DESCRIPT_FLAGS_LD_IO << MFI_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
+	if ((io_request->IoFlags == 6) && (io_info.numBlocks == 0))
+		io_request->RaidContext.RegLockLength = 0x100;
+	io_request->DataLength = mfi_cmd->cm_frame->io.header.data_len
+	    * MFI_SECTOR_LEN;
+}
+
+int mfi_tbolt_is_ldio(struct mfi_command *mfi_cmd)
+{
+	if (mfi_cmd->cm_frame->header.cmd == MFI_CMD_LD_READ
+	    || mfi_cmd->cm_frame->header.cmd == MFI_CMD_LD_WRITE)
+		return 1;
+	else
+		return 0;
+}
+
+int
+mfi_tbolt_build_io(struct mfi_softc *sc, struct mfi_command *mfi_cmd, struct mfi_cmd_tbolt *cmd)
+{
+	uint32_t device_id;
+	uint32_t sge_count;
+	uint8_t cdb[32], cdb_len;
+
+	memset(cdb, 0, 32);
+	struct mfi_mpi2_request_raid_scsi_io *io_request = cmd->io_request;
+
+	device_id = mfi_cmd->cm_frame->header.target_id;
+
+	/* Have to build CDB here for TB as BSD don't have a scsi layer */
+	if ((cdb_len = mfi_tbolt_build_cdb(sc, mfi_cmd, cdb)) == 1)
+		return 1;
+
+	/* Just the CDB length,rest of the Flags are zero */
+	io_request->IoFlags = cdb_len;
+	memcpy(io_request->CDB.CDB32, cdb, 32);
+
+	if (mfi_tbolt_is_ldio(mfi_cmd))
+		mfi_tbolt_build_ldio(sc, mfi_cmd , cmd);
+	else
+		return 1;
+
+	/*
+	 * Construct SGL
+	 */
+	sge_count = mfi_tbolt_make_sgl(sc, mfi_cmd,
+	    (pMpi25IeeeSgeChain64_t) &io_request->SGL, cmd);
+	if (sge_count > sc->mfi_max_sge) {
+		device_printf(sc->mfi_dev, "Error. sge_count (0x%x) exceeds "
+		    "max (0x%x) allowed\n", sge_count, sc->mfi_max_sge);
+		return 1;
+	}
+	io_request->RaidContext.numSGE = sge_count;
+	io_request->SGLFlags = MPI2_SGE_FLAGS_64_BIT_ADDRESSING;
+
+	if (mfi_cmd->cm_frame->header.cmd == MFI_CMD_LD_WRITE)
+		io_request->Control = MPI2_SCSIIO_CONTROL_WRITE;
+	else
+		io_request->Control = MPI2_SCSIIO_CONTROL_READ;
+
+	io_request->SGLOffset0 = offsetof(
+	    struct mfi_mpi2_request_raid_scsi_io, SGL)/4;
+
+	io_request->SenseBufferLowAddress = mfi_cmd->cm_sense_busaddr;
+	io_request->SenseBufferLength = MFI_SENSE_LEN;
+	return 0;
+}
+
+static int
+mfi_tbolt_build_cdb(struct mfi_softc *sc, struct mfi_command *mfi_cmd,
+    uint8_t *cdb)
+{
+	uint32_t lba_lo, lba_hi, num_lba;
+	uint8_t cdb_len;
+
+	if (mfi_cmd == NULL || cdb == NULL)
+		return 1;
+	num_lba = mfi_cmd->cm_frame->io.header.data_len;
+	lba_lo = mfi_cmd->cm_frame->io.lba_lo;
+	lba_hi = mfi_cmd->cm_frame->io.lba_hi;
+
+	if ((num_lba <= 0xFF) && (lba_lo <= 0x1FFFFF)) {
+		if (mfi_cmd->cm_frame->header.cmd == MFI_CMD_LD_WRITE)
+			/* Read 6 or Write 6 */
+			cdb[0] = (uint8_t) (0x0A);
+		else
+			cdb[0] = (uint8_t) (0x08);
+
+		cdb[4] = (uint8_t) num_lba;
+		cdb[3] = (uint8_t) (lba_lo & 0xFF);
+		cdb[2] = (uint8_t) (lba_lo >> 8);
+		cdb[1] = (uint8_t) ((lba_lo >> 16) & 0x1F);
+		cdb_len = 6;
+	} else if ((num_lba <= 0xFFFF) && (lba_lo <= 0xFFFFFFFF)) {
+		if (mfi_cmd->cm_frame->header.cmd == MFI_CMD_LD_WRITE)
+			/* Read 10 or Write 10 */
+			cdb[0] = (uint8_t) (0x2A);
+		else
+			cdb[0] = (uint8_t) (0x28);
+		cdb[8] = (uint8_t) (num_lba & 0xFF);
+		cdb[7] = (uint8_t) (num_lba >> 8);
+		cdb[5] = (uint8_t) (lba_lo & 0xFF);
+		cdb[4] = (uint8_t) (lba_lo >> 8);
+		cdb[3] = (uint8_t) (lba_lo >> 16);
+		cdb[2] = (uint8_t) (lba_lo >> 24);
+		cdb_len = 10;
+	} else if ((num_lba > 0xFFFF) && (lba_hi == 0)) {
+		if (mfi_cmd->cm_frame->header.cmd == MFI_CMD_LD_WRITE)
+			/* Read 12 or Write 12 */
+			cdb[0] = (uint8_t) (0xAA);
+		else
+			cdb[0] = (uint8_t) (0xA8);
+		cdb[9] = (uint8_t) (num_lba & 0xFF);
+		cdb[8] = (uint8_t) (num_lba >> 8);
+		cdb[7] = (uint8_t) (num_lba >> 16);
+		cdb[6] = (uint8_t) (num_lba >> 24);
+		cdb[5] = (uint8_t) (lba_lo & 0xFF);
+		cdb[4] = (uint8_t) (lba_lo >> 8);
+		cdb[3] = (uint8_t) (lba_lo >> 16);
+		cdb[2] = (uint8_t) (lba_lo >> 24);
+		cdb_len = 12;
+	} else {
+		if (mfi_cmd->cm_frame->header.cmd == MFI_CMD_LD_WRITE)
+			cdb[0] = (uint8_t) (0x8A);
+		else
+			cdb[0] = (uint8_t) (0x88);
+		cdb[13] = (uint8_t) (num_lba & 0xFF);
+		cdb[12] = (uint8_t) (num_lba >> 8);
+		cdb[11] = (uint8_t) (num_lba >> 16);
+		cdb[10] = (uint8_t) (num_lba >> 24);
+		cdb[9] = (uint8_t) (lba_lo & 0xFF);
+		cdb[8] = (uint8_t) (lba_lo >> 8);
+		cdb[7] = (uint8_t) (lba_lo >> 16);
+		cdb[6] = (uint8_t) (lba_lo >> 24);
+		cdb[5] = (uint8_t) (lba_hi & 0xFF);
+		cdb[4] = (uint8_t) (lba_hi >> 8);
+		cdb[3] = (uint8_t) (lba_hi >> 16);
+		cdb[2] = (uint8_t) (lba_hi >> 24);
+		cdb_len = 16;
+	}
+	return cdb_len;
+}
+
+static int
+mfi_tbolt_make_sgl(struct mfi_softc *sc, struct mfi_command *mfi_cmd,
+		   pMpi25IeeeSgeChain64_t sgl_ptr, struct mfi_cmd_tbolt *cmd)
+{
+	uint8_t i, sg_processed, sg_to_process;
+	uint8_t sge_count, sge_idx;
+	union mfi_sgl *os_sgl;
+
+	/*
+	 * Return 0 if there is no data transfer
+	 */
+	if (!mfi_cmd->cm_sg || !mfi_cmd->cm_len) {
+		device_printf(sc->mfi_dev, "Buffer empty \n");
+		return 0;
+	}
+	os_sgl = mfi_cmd->cm_sg;
+	sge_count = mfi_cmd->cm_frame->header.sg_count;
+
+	if (sge_count > sc->mfi_max_sge) {
+		device_printf(sc->mfi_dev, "sgl ptr %p sg_cnt %d \n",
+		    os_sgl, sge_count);
+		return sge_count;
+	}
+
+	if (sge_count > sc->max_SGEs_in_main_message)
+		/* One element to store the chain info */
+		sge_idx = sc->max_SGEs_in_main_message - 1;
+	else
+		sge_idx = sge_count;
+
+	for (i = 0; i < sge_idx; i++) {
+		/*
+		 * For 32bit BSD we are getting 32 bit SGL's from OS
+		 * but FW only take 64 bit SGL's so copying from 32 bit
+		 * SGL's to 64.
+		 */
+		if (sc->mfi_flags & MFI_FLAGS_SKINNY) {
+			sgl_ptr->Length = os_sgl->sg_skinny[i].len;
+			sgl_ptr->Address = os_sgl->sg_skinny[i].addr;
+		} else {
+			sgl_ptr->Length = os_sgl->sg32[i].len;
+			sgl_ptr->Address = os_sgl->sg32[i].addr;
+		}
+		sgl_ptr->Flags = 0;
+		sgl_ptr++;
+		cmd->io_request->ChainOffset = 0;
+	}
+
+	sg_processed = i;
+
+	if (sg_processed < sge_count) {
+		pMpi25IeeeSgeChain64_t sg_chain;
+		sg_to_process = sge_count - sg_processed;
+		cmd->io_request->ChainOffset =
+		    sc->chain_offset_value_for_main_message;
+		sg_chain = sgl_ptr;
+		/* Prepare chain element */
+		sg_chain->NextChainOffset = 0;
+		sg_chain->Flags = (MPI2_IEEE_SGE_FLAGS_CHAIN_ELEMENT |
+		    MPI2_IEEE_SGE_FLAGS_IOCPLBNTA_ADDR);
+		sg_chain->Length =  (sizeof(MPI2_SGE_IO_UNION) *
+		    (sge_count - sg_processed));
+		sg_chain->Address = cmd->sg_frame_phys_addr;
+		sgl_ptr = (pMpi25IeeeSgeChain64_t)cmd->sg_frame;
+		for (; i < sge_count; i++) {
+			if (sc->mfi_flags & MFI_FLAGS_SKINNY) {
+				sgl_ptr->Length = os_sgl->sg_skinny[i].len;
+				sgl_ptr->Address = os_sgl->sg_skinny[i].addr;
+			} else {
+				sgl_ptr->Length = os_sgl->sg32[i].len;
+				sgl_ptr->Address = os_sgl->sg32[i].addr;
+			}
+			sgl_ptr->Flags = 0;
+			sgl_ptr++;
+		}
+	}
+	return sge_count;
+}
+
+union mfi_mpi2_request_descriptor *
+mfi_build_and_issue_cmd(struct mfi_softc *sc, struct mfi_command *mfi_cmd)
+{
+	struct mfi_cmd_tbolt *cmd;
+	union mfi_mpi2_request_descriptor *req_desc = NULL;
+	uint16_t index;
+	cmd = mfi_tbolt_get_cmd(sc);
+	if (!cmd)
+		return NULL;
+	mfi_cmd->cm_extra_frames = cmd->index;
+	cmd->sync_cmd_idx = mfi_cmd->cm_index;
+
+	index = cmd->index;
+	req_desc = mfi_tbolt_get_request_descriptor(sc, index-1);
+	if (mfi_tbolt_build_io(sc, mfi_cmd, cmd))
+		return NULL;
+	req_desc->header.SMID = index;
+	return req_desc;
+}
+
+union mfi_mpi2_request_descriptor *
+mfi_tbolt_build_mpt_cmd(struct mfi_softc *sc, struct mfi_command *cmd)
+{
+	union mfi_mpi2_request_descriptor *req_desc = NULL;
+	uint16_t index;
+	if (mfi_build_mpt_pass_thru(sc, cmd)) {
+		device_printf(sc->mfi_dev, "Couldn't build MFI pass thru "
+		    "cmd\n");
+		return NULL;
+	}
+	/* For fusion the frame_count variable is used for SMID */
+	index = cmd->cm_extra_frames;
+
+	req_desc = mfi_tbolt_get_request_descriptor(sc, index - 1);
+	if (!req_desc)
+		return NULL;
+
+	bzero(req_desc, sizeof(req_desc));
+	req_desc->header.RequestFlags = (MPI2_REQ_DESCRIPT_FLAGS_SCSI_IO <<
+	    MFI_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
+	req_desc->header.SMID = index;
+	return req_desc;
+}
+
+int
+mfi_tbolt_send_frame(struct mfi_softc *sc, struct mfi_command *cm)
+{
+	struct mfi_frame_header *hdr;
+	uint8_t *cdb;
+	union mfi_mpi2_request_descriptor *req_desc = NULL;
+	int tm = MFI_POLL_TIMEOUT_SECS * 1000;
+
+	hdr = &cm->cm_frame->header;
+	cdb = cm->cm_frame->pass.cdb;
+	if (sc->adpreset)
+		return 1;
+	if ((cm->cm_flags & MFI_CMD_POLLED) == 0) {
+		cm->cm_timestamp = time_second;
+		mfi_enqueue_busy(cm);
+	}
+	else {
+		hdr->cmd_status = 0xff;
+		hdr->flags |= MFI_FRAME_DONT_POST_IN_REPLY_QUEUE;
+	}
+
+	if (hdr->cmd == MFI_CMD_PD_SCSI_IO) {
+		/* check for inquiry commands coming from CLI */
+		if (cdb[0] != 0x28 || cdb[0] != 0x2A) {
+			if ((req_desc = mfi_tbolt_build_mpt_cmd(sc, cm)) ==
+			    NULL) {
+				device_printf(sc->mfi_dev, "Mapping from MFI "
+				    "to MPT Failed \n");
+				return 1;
+			}
+		}
+		else
+			device_printf(sc->mfi_dev, "DJA NA XXX SYSPDIO\n");
+	}
+	else if (hdr->cmd == MFI_CMD_LD_SCSI_IO ||
+	    hdr->cmd == MFI_CMD_LD_READ || hdr->cmd == MFI_CMD_LD_WRITE) {
+		if ((req_desc = mfi_build_and_issue_cmd(sc, cm)) == NULL) {
+			device_printf(sc->mfi_dev, "LDIO Failed \n");
+			return 1;
+		}
+	} else
+		if ((req_desc = mfi_tbolt_build_mpt_cmd(sc, cm)) == NULL) {
+			device_printf(sc->mfi_dev, "Mapping from MFI to MPT "
+			    "Failed\n");
+			return 1;
+		}
+	MFI_WRITE4(sc, MFI_ILQP, (req_desc->words & 0xFFFFFFFF));
+	MFI_WRITE4(sc, MFI_IHQP, (req_desc->words >>0x20));
+
+	if ((cm->cm_flags & MFI_CMD_POLLED) == 0)
+		return 0;
+
+	/* This is a polled command, so busy-wait for it to complete. */
+	while (hdr->cmd_status == 0xff) {
+		DELAY(1000);
+		tm -= 1;
+		if (tm <= 0)
+			break;
+	}
+
+	if (hdr->cmd_status == 0xff) {
+		device_printf(sc->mfi_dev, "Frame %p timed out "
+		      "command 0x%X\n", hdr, cm->cm_frame->dcmd.opcode);
+		return (ETIMEDOUT);
+	}
+	return 0;
+}
+
+static void mfi_issue_pending_cmds_again (struct mfi_softc *sc)
+{
+	struct mfi_command *cm, *tmp;
+
+	KKASSERT(lockstatus(&sc->mfi_io_lock, curthread) != 0);
+	TAILQ_FOREACH_REVERSE_MUTABLE(cm, &sc->mfi_busy, BUSYQ, cm_link, tmp) {
+
+		cm->retry_for_fw_reset++;
+
+		/*
+		 * If a command has continuously been tried multiple times
+		 * and causing a FW reset condition, no further recoveries
+		 * should be performed on the controller
+		 */
+		if (cm->retry_for_fw_reset == 3) {
+			device_printf(sc->mfi_dev, "megaraid_sas: command %d "
+			    "was tried multiple times during adapter reset"
+			    "Shutting down the HBA\n", cm->cm_index);
+			mfi_kill_hba(sc);
+			sc->hw_crit_error = 1;
+			return;
+		}
+
+		if ((cm->cm_flags & MFI_ON_MFIQ_BUSY) != 0) {
+			struct mfi_cmd_tbolt *cmd;
+			mfi_remove_busy(cm);
+			cmd = sc->mfi_cmd_pool_tbolt[cm->cm_extra_frames -
+			    1 ];
+			mfi_tbolt_return_cmd(sc, cmd);
+			if ((cm->cm_flags & MFI_ON_MFIQ_MASK) == 0) {
+				if (cm->cm_frame->dcmd.opcode !=
+				    MFI_DCMD_CTRL_EVENT_WAIT) {
+					device_printf(sc->mfi_dev,
+					    "APJ ****requeue command %d \n",
+					    cm->cm_index);
+					mfi_requeue_ready(cm);
+				}
+			}
+			else
+				mfi_release_command(cm);
+		}
+	}
+	mfi_startio(sc);
+}
+
+static void mfi_kill_hba (struct mfi_softc *sc)
+{
+	if (sc->mfi_flags & MFI_FLAGS_TBOLT)
+		MFI_WRITE4 (sc, 0x00,MFI_STOP_ADP);
+	else
+		MFI_WRITE4 (sc, MFI_IDB,MFI_STOP_ADP);
+}
+
+static void mfi_process_fw_state_chg_isr(void *arg)
+{
+	struct mfi_softc *sc= (struct mfi_softc *)arg;
+	struct mfi_cmd_tbolt *cmd;
+	int error, status;
+
+	if (sc->adpreset == 1) {
+		device_printf(sc->mfi_dev, "First stage of FW reset "
+		     "initiated...\n");
+
+		sc->mfi_adp_reset(sc);
+		sc->mfi_enable_intr(sc);
+
+		device_printf(sc->mfi_dev, "First stage of reset complete, "
+		    "second stage initiated...\n");
+
+		sc->adpreset = 2;
+
+		/* waiting for about 20 second before start the second init */
+		for (int wait = 0; wait < 20000; wait++)
+			DELAY(1000);
+		device_printf(sc->mfi_dev, "Second stage of FW reset "
+		     "initiated...\n");
+		while ((status = MFI_READ4(sc, MFI_RSR)) & 0x04);
+
+		sc->mfi_disable_intr(sc);
+
+		/* We expect the FW state to be READY */
+		if (mfi_transition_firmware(sc)) {
+			device_printf(sc->mfi_dev, "controller is not in "
+			    "ready state\n");
+			mfi_kill_hba(sc);
+			sc->hw_crit_error= 1;
+			return ;
+		}
+		if ((error = mfi_tbolt_init_MFI_queue(sc)) != 0)
+				return;
+
+		lockmgr(&sc->mfi_io_lock, LK_EXCLUSIVE);
+
+		sc->mfi_enable_intr(sc);
+		sc->adpreset = 0;
+		kfree(sc->mfi_aen_cm->cm_data, M_MFIBUF);
+		mfi_remove_busy(sc->mfi_aen_cm);
+		cmd = sc->mfi_cmd_pool_tbolt[sc->mfi_aen_cm->cm_extra_frames
+		    - 1];
+		mfi_tbolt_return_cmd(sc, cmd);
+		if (sc->mfi_aen_cm) {
+			mfi_release_command(sc->mfi_aen_cm);
+			sc->mfi_aen_cm = NULL;
+		}
+		if (sc->map_update_cmd) {
+			mfi_release_command(sc->map_update_cmd);
+			sc->map_update_cmd = NULL;
+		}
+		mfi_issue_pending_cmds_again(sc);
+
+		/*
+		 * Issue pending command can result in adapter being marked
+		 * dead because of too many re-tries. Check for that
+		 * condition before clearing the reset condition on the FW
+		 */
+		if (!sc->hw_crit_error) {
+			/*
+			 * Initiate AEN (Asynchronous Event Notification)
+			 */
+			mfi_aen_setup(sc, sc->last_seq_num);
+			sc->issuepend_done = 1;
+			device_printf(sc->mfi_dev, "second stage of reset "
+			    "complete, FW is ready now.\n");
+		} else {
+			device_printf(sc->mfi_dev, "second stage of reset "
+			     "never completed, hba was marked offline.\n");
+		}
+	} else {
+		device_printf(sc->mfi_dev, "mfi_process_fw_state_chg_isr "
+		    "called with unhandled value:%d\n", sc->adpreset);
+	}
+	lockmgr(&sc->mfi_io_lock, LK_RELEASE);
+}
diff --git a/sys/dev/raid/mfi/mfireg.h b/sys/dev/raid/mfi/mfireg.h
index d64af712f6..c331497a40 100644
--- a/sys/dev/raid/mfi/mfireg.h
+++ b/sys/dev/raid/mfi/mfireg.h
@@ -48,38 +48,9 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- */
-/*-
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *            Copyright 1994-2009 The FreeBSD Project.
- *            All rights reserved.
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- *    THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FREEBSD PROJECT OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY,OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION)HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * The views and conclusions contained in the software and documentation
- * are those of the authors and should not be interpreted as representing
- * official policies,either expressed or implied, of the FreeBSD Project.
  *
  * $FreeBSD: src/sys/dev/mfi/mfireg.h,v 1.16 2011/07/14 20:20:33 jhb Exp $
+ * FreeBSD projects/head_mfi/ r232888
  */
 
 #ifndef _MFIREG_H
@@ -94,6 +65,8 @@
  * seems to also call this interface 'MFI', so that will be used here.
  */
 
+#define MEGAMFI_FRAME_SIZE              64
+
 /*
  * Start with the register set.  All registers are 32 bits wide.
  * The usual Intel IOP style setup.
@@ -111,6 +84,14 @@
 #define MFI_IQP		0x40	/* Inbound queue port */
 #define MFI_OQP		0x44	/* Outbound queue port */
 
+/*
+ * ThunderBolt specific Register
+ */
+
+#define MFI_RPI		0x6c 		/* reply_post_host_index */
+#define MFI_ILQP 	0xc0		/* inbound_low_queue_port */
+#define MFI_IHQP 	0xc4		/* inbound_high_queue_port */
+
 /*
  * 1078 specific related register
  */
@@ -122,18 +103,17 @@
 #define MFI_1078_RM	0x80000000 	/* reply 1078 message interrupt  */
 #define MFI_ODC		0x4 		/* outbound doorbell change interrupt */
 
+/* OCR registers */
+#define MFI_WSR		0x004		/* write sequence register */
+#define MFI_HDR		0x008		/* host diagnostic register */
+#define MFI_RSR		0x3c3		/* Reset Status Register */
+
 /*
  * GEN2 specific changes
  */
 #define MFI_GEN2_EIM	0x00000005	/* GEN2 enable interrupt mask */
 #define MFI_GEN2_RM	0x00000001	/* reply GEN2 message interrupt */
 
-/*
- * gen2 specific changes
- */
-#define MFI_GEN2_EIM	0x00000005	/* gen2 enable interrupt mask */
-#define MFI_GEN2_RM	0x00000001	/* reply gen2 message interrupt */
-
 /*
  * skinny specific changes
  */
@@ -145,6 +125,10 @@
 /* Bits for MFI_OSTS */
 #define MFI_OSTS_INTR_VALID	0x00000002
 
+/* OCR specific flags */
+#define MFI_FIRMWARE_STATE_CHANGE	0x00000002
+#define MFI_STATE_CHANGE_INTERRUPT	0x00000004  /* MFI state change interrrupt */
+
 /*
  * Firmware state values.  Found in OMSG0 during initialization.
  */
@@ -164,6 +148,14 @@
 #define MFI_FWSTATE_MAXCMD_MASK		0x0000ffff
 #define MFI_FWSTATE_HOSTMEMREQD_MASK	0x08000000
 #define MFI_FWSTATE_BOOT_MESSAGE_PENDING	0x90000000
+#define MFI_RESET_REQUIRED		0x00000001
+
+/* ThunderBolt Support */
+#define MFI_FWSTATE_TB_MASK		0xf0000000
+#define MFI_FWSTATE_TB_RESET		0x00000000
+#define MFI_FWSTATE_TB_READY		0x10000000
+#define MFI_FWSTATE_TB_OPERATIONAL	0x20000000
+#define MFI_FWSTATE_TB_FAULT		0x40000000
 
 /*
  * Control bits to drive the card to ready state.  These go into the IDB
@@ -175,6 +167,12 @@
 #define MFI_FWINIT_CLEAR_HANDSHAKE 0x00000008 /* Respond to WAIT_HANDSHAKE */
 #define MFI_FWINIT_HOTPLUG	0x00000010
 
+/* ADP reset flags */
+#define MFI_STOP_ADP		0x00000020
+#define MFI_ADP_RESET		0x00000040
+#define DIAG_WRITE_ENABLE	0x00000080
+#define DIAG_RESET_ADAPTER	0x00000004
+
 /* MFI Commands */
 typedef enum {
 	MFI_CMD_INIT =		0x00,
@@ -220,6 +218,8 @@ typedef enum {
 	MFI_DCMD_PD_GET_PROGRESS =	0x02060000,
 	MFI_DCMD_PD_LOCATE_START =	0x02070100,
 	MFI_DCMD_PD_LOCATE_STOP =	0x02070200,
+	MFI_DCMD_LD_MAP_GET_INFO =	0x0300e101,
+	MFI_DCMD_LD_SYNC =		0x0300e102,
 	MFI_DCMD_LD_GET_LIST =		0x03010000,
 	MFI_DCMD_LD_GET_INFO =		0x03020000,
 	MFI_DCMD_LD_GET_PROP =		0x03030000,
@@ -262,6 +262,35 @@ typedef enum {
 #define MFI_FRAME_DIR_BOTH			0x0018
 #define MFI_FRAME_IEEE_SGL			0x0020
 
+/* ThunderBolt Specific */
+
+/*
+ * Pre-TB command size and TB command size.
+ * We will be checking it at the load time for the time being
+ */
+#define MR_COMMAND_SIZE (MFI_FRAME_SIZE*20) /* 1280 bytes */
+
+#define MEGASAS_THUNDERBOLT_MSG_ALLIGNMENT  256
+/*
+ * We are defining only 128 byte message to reduce memory move over head
+ * and also it will reduce the SRB extension size by 128byte compared with
+ * 256 message size
+ */
+#define MEGASAS_THUNDERBOLT_NEW_MSG_SIZE	256
+#define MEGASAS_THUNDERBOLT_MAX_COMMANDS	1024
+#define MEGASAS_THUNDERBOLT_MAX_REPLY_COUNT	1024
+#define MEGASAS_THUNDERBOLT_REPLY_SIZE		8
+#define MEGASAS_THUNDERBOLT_MAX_CHAIN_COUNT	1
+#define MEGASAS_MAX_SZ_CHAIN_FRAME		1024
+
+#define MPI2_FUNCTION_PASSTHRU_IO_REQUEST       0xF0
+#define MPI2_FUNCTION_LD_IO_REQUEST             0xF1
+
+#define MR_INTERNAL_MFI_FRAMES_SMID             1
+#define MR_CTRL_EVENT_WAIT_SMID                 2
+#define MR_INTERNAL_DRIVER_RESET_SMID           3
+
+
 /* MFI Status codes */
 typedef enum {
 	MFI_STAT_OK =			0x00,
@@ -373,6 +402,10 @@ typedef enum {
 	MR_EVT_ARGS_ECC
 } mfi_evt_args;
 
+#define MR_EVT_CTRL_HOST_BUS_SCAN_REQUESTED	0x0152
+#define MR_EVT_PD_REMOVED			0x0070
+#define MR_EVT_PD_INSERTED			0x005b
+
 typedef enum {
 	MR_LD_CACHE_WRITE_BACK =	0x01,
 	MR_LD_CACHE_WRITE_ADAPTIVE =	0x02,
@@ -406,7 +439,7 @@ typedef enum {
 	MR_PD_QUERY_TYPE_POWER_STATE =	2,
 	MR_PD_QUERY_TYPE_MEDIA_TYPE =	3,
 	MR_PD_QUERY_TYPE_SPEED =	4,
-	MR_PD_QUERY_TYPE_EXPOSED_TO_HOST =	5, /*query for system drives */
+	MR_PD_QUERY_TYPE_EXPOSED_TO_HOST = 5 /*query for system drives */
 } mfi_pd_query_type;
 
 /*
@@ -448,9 +481,9 @@ struct mfi_sg_skinny {
 } __packed;
 
 union mfi_sgl {
-	struct mfi_sg32	sg32[1];
-	struct mfi_sg64	sg64[1];
-	struct mfi_sg_skinny sg_skinny[1];
+	struct mfi_sg32		sg32[1];
+	struct mfi_sg64		sg64[1];
+	struct mfi_sg_skinny	sg_skinny[1];
 } __packed;
 
 /* Message frames.  All messages have a common header */
@@ -466,7 +499,7 @@ struct mfi_frame_header {
 	uint32_t	context;
 	/*
 	 * pad0 is MSI Specific. Not used by Driver. Zero the value before
-	 * sending the command to f/w
+	 * sending the command to f/w.
 	 */
 	uint32_t	pad0;
 	uint16_t	flags;
@@ -482,9 +515,29 @@ struct mfi_init_frame {
 	uint32_t	qinfo_new_addr_hi;
 	uint32_t	qinfo_old_addr_lo;
 	uint32_t	qinfo_old_addr_hi;
-	uint32_t	reserved[6];
+	// Start LSIP200113393
+	uint32_t	driver_ver_lo;      /*28h */
+	uint32_t	driver_ver_hi;      /*2Ch */
+
+	uint32_t	reserved[4];
+	// End LSIP200113393
 } __packed;
 
+/*
+ * Define MFI Address Context union.
+ */
+#ifdef MFI_ADDRESS_IS_uint64_t
+    typedef uint64_t     MFI_ADDRESS;
+#else
+    typedef union _MFI_ADDRESS {
+        struct {
+            uint32_t     addressLow;
+            uint32_t     addressHigh;
+        } u;
+        uint64_t     address;
+    } MFI_ADDRESS, *PMFI_ADDRESS;
+#endif
+
 #define MFI_IO_FRAME_SIZE 40
 struct mfi_io_frame {
 	struct mfi_frame_header	header;
@@ -515,6 +568,7 @@ struct mfi_dcmd_frame {
 struct mfi_abort_frame {
 	struct mfi_frame_header header;
 	uint32_t	abort_context;
+	/* pad is changed to reserved.*/
 	uint32_t	reserved0;
 	uint32_t	abort_mfi_addr_lo;
 	uint32_t	abort_mfi_addr_hi;
@@ -543,6 +597,7 @@ struct mfi_stp_frame {
 union mfi_frame {
 	struct mfi_frame_header header;
 	struct mfi_init_frame	init;
+	/* ThunderBolt Initialization */
 	struct mfi_io_frame	io;
 	struct mfi_pass_frame	pass;
 	struct mfi_dcmd_frame	dcmd;
@@ -592,7 +647,61 @@ struct mfi_ctrl_props {
 	uint16_t	ecc_bucket_leak_rate;
 	uint8_t		restore_hotspare_on_insertion;
 	uint8_t		expose_encl_devices;
-	uint8_t		reserved[38];
+	uint8_t		maintainPdFailHistory;
+	uint8_t		disallowHostRequestReordering;
+	/* set TRUE to abort CC on detecting an inconsistency */
+	uint8_t		abortCCOnError;
+	/* load balance mode (MR_LOAD_BALANCE_MODE) */
+	uint8_t		loadBalanceMode;
+	/*
+	 * 0 - use auto detect logic of backplanes like SGPIO, i2c SEP using
+	 *     h/w mechansim like GPIO pins
+	 * 1 - disable auto detect SGPIO,
+	 * 2 - disable i2c SEP auto detect
+	 * 3 - disable both auto detect
+	 */
+	uint8_t		disableAutoDetectBackplane;
+	/*
+	 * % of source LD to be reserved for a VDs snapshot in snapshot
+	 * repository, for metadata and user data: 1=5%, 2=10%, 3=15% and so on
+	 */
+	uint8_t		snapVDSpace;
+
+	/*
+	 * Add properties that can be controlled by a bit in the following
+	 * structure.
+	 */
+	struct {
+		/* set TRUE to disable copyBack (0=copback enabled) */
+		uint32_t	copyBackDisabled		:1;
+		uint32_t	SMARTerEnabled			:1;
+		uint32_t	prCorrectUnconfiguredAreas	:1;
+		uint32_t	useFdeOnly			:1;
+		uint32_t	disableNCQ			:1;
+		uint32_t	SSDSMARTerEnabled		:1;
+		uint32_t	SSDPatrolReadEnabled		:1;
+		uint32_t	enableSpinDownUnconfigured	:1;
+		uint32_t	autoEnhancedImport		:1;
+		uint32_t	enableSecretKeyControl		:1;
+		uint32_t	disableOnlineCtrlReset		:1;
+		uint32_t	allowBootWithPinnedCache	:1;
+		uint32_t	disableSpinDownHS		:1;
+		uint32_t	enableJBOD			:1;
+		uint32_t	reserved			:18;
+	} OnOffProperties;
+	/*
+	 * % of source LD to be reserved for auto snapshot in snapshot
+	 * repository, for metadata and user data: 1=5%, 2=10%, 3=15% and so on.
+	 */
+	uint8_t		autoSnapVDSpace;
+	/*
+	 * Snapshot writeable VIEWs capacity as a % of source LD capacity:
+	 * 0=READ only, 1=5%, 2=10%, 3=15% and so on.
+	 */
+	uint8_t		viewSpace;
+	/* # of idle minutes before device is spun down (0=use FW defaults) */
+	uint16_t	spinDownTime;
+	uint8_t		reserved[24];
 } __packed;
 
 /* PCI information about the card. */
@@ -1152,7 +1261,7 @@ struct mfi_ld_info {
 	uint8_t			reserved2[16];
 } __packed;
 
-#define MAX_ARRAYS 16
+#define MAX_ARRAYS 128
 struct mfi_spare {
 	union mfi_pd_ref	ref;
 	uint8_t			spare_type;
@@ -1301,6 +1410,452 @@ struct mfi_pr_properties {
 	uint32_t		clear_freq;
 };
 
+/* ThunderBolt support */
+
+/*
+ * Raid Context structure which describes MegaRAID specific IO Paramenters
+ * This resides at offset 0x60 where the SGL normally starts in MPT IO Frames
+ */
+typedef struct _MPI2_SCSI_IO_VENDOR_UNIQUE {
+	uint16_t	resvd0;		/* 0x00 - 0x01 */
+	uint16_t	timeoutValue;	/* 0x02 - 0x03 */
+	uint8_t		regLockFlags;
+	uint8_t		armId;
+	uint16_t	TargetID;	/* 0x06 - 0x07 */
+
+	uint64_t	RegLockLBA;	/* 0x08 - 0x0F */
+
+	uint32_t	RegLockLength;	/* 0x10 - 0x13 */
+
+	uint16_t	SMID;		/* 0x14 - 0x15 nextLMId */
+	uint8_t		exStatus;	/* 0x16 */
+	uint8_t		Status;		/* 0x17 status */
+
+	uint8_t		RAIDFlags;	/* 0x18 */
+	uint8_t		numSGE;		/* 0x19 numSge */
+	uint16_t	configSeqNum;	/* 0x1A - 0x1B */
+	uint8_t		spanArm;	/* 0x1C */
+	uint8_t		resvd2[3];	/* 0x1D - 0x1F */
+} MPI2_SCSI_IO_VENDOR_UNIQUE, MPI25_SCSI_IO_VENDOR_UNIQUE;
+
+/*** DJA *****/
+
+/*****************************************************************************
+*
+*        Message Functions
+*
+*****************************************************************************/
+
+#define NA_MPI2_FUNCTION_SCSI_IO_REQUEST            (0x00) /* SCSI IO */
+#define MPI2_FUNCTION_SCSI_TASK_MGMT                (0x01) /* SCSI Task Management */
+#define MPI2_FUNCTION_IOC_INIT                      (0x02) /* IOC Init */
+#define MPI2_FUNCTION_IOC_FACTS                     (0x03) /* IOC Facts */
+#define MPI2_FUNCTION_CONFIG                        (0x04) /* Configuration */
+#define MPI2_FUNCTION_PORT_FACTS                    (0x05) /* Port Facts */
+#define MPI2_FUNCTION_PORT_ENABLE                   (0x06) /* Port Enable */
+#define MPI2_FUNCTION_EVENT_NOTIFICATION            (0x07) /* Event Notification */
+#define MPI2_FUNCTION_EVENT_ACK                     (0x08) /* Event Acknowledge */
+#define MPI2_FUNCTION_FW_DOWNLOAD                   (0x09) /* FW Download */
+#define MPI2_FUNCTION_TARGET_ASSIST                 (0x0B) /* Target Assist */
+#define MPI2_FUNCTION_TARGET_STATUS_SEND            (0x0C) /* Target Status Send */
+#define MPI2_FUNCTION_TARGET_MODE_ABORT             (0x0D) /* Target Mode Abort */
+#define MPI2_FUNCTION_FW_UPLOAD                     (0x12) /* FW Upload */
+#define MPI2_FUNCTION_RAID_ACTION                   (0x15) /* RAID Action */
+#define MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH      (0x16) /* SCSI IO RAID Passthrough */
+#define MPI2_FUNCTION_TOOLBOX                       (0x17) /* Toolbox */
+#define MPI2_FUNCTION_SCSI_ENCLOSURE_PROCESSOR      (0x18) /* SCSI Enclosure Processor */
+#define MPI2_FUNCTION_SMP_PASSTHROUGH               (0x1A) /* SMP Passthrough */
+#define MPI2_FUNCTION_SAS_IO_UNIT_CONTROL           (0x1B) /* SAS IO Unit Control */
+#define MPI2_FUNCTION_SATA_PASSTHROUGH              (0x1C) /* SATA Passthrough */
+#define MPI2_FUNCTION_DIAG_BUFFER_POST              (0x1D) /* Diagnostic Buffer Post */
+#define MPI2_FUNCTION_DIAG_RELEASE                  (0x1E) /* Diagnostic Release */
+#define MPI2_FUNCTION_TARGET_CMD_BUF_BASE_POST      (0x24) /* Target Command Buffer Post Base */
+#define MPI2_FUNCTION_TARGET_CMD_BUF_LIST_POST      (0x25) /* Target Command Buffer Post List */
+#define MPI2_FUNCTION_RAID_ACCELERATOR              (0x2C) /* RAID Accelerator */
+#define MPI2_FUNCTION_HOST_BASED_DISCOVERY_ACTION   (0x2F) /* Host Based Discovery Action */
+#define MPI2_FUNCTION_PWR_MGMT_CONTROL              (0x30) /* Power Management Control */
+#define MPI2_FUNCTION_MIN_PRODUCT_SPECIFIC          (0xF0) /* beginning of product-specific range */
+#define MPI2_FUNCTION_MAX_PRODUCT_SPECIFIC          (0xFF) /* end of product-specific range */
+
+/* Doorbell functions */
+#define MPI2_FUNCTION_IOC_MESSAGE_UNIT_RESET        (0x40)
+#define MPI2_FUNCTION_HANDSHAKE                     (0x42)
+
+/*****************************************************************************
+*
+*        MPI Version Definitions
+*
+*****************************************************************************/
+
+#define MPI2_VERSION_MAJOR                  (0x02)
+#define MPI2_VERSION_MINOR                  (0x00)
+#define MPI2_VERSION_MAJOR_MASK             (0xFF00)
+#define MPI2_VERSION_MAJOR_SHIFT            (8)
+#define MPI2_VERSION_MINOR_MASK             (0x00FF)
+#define MPI2_VERSION_MINOR_SHIFT            (0)
+#define MPI2_VERSION ((MPI2_VERSION_MAJOR << MPI2_VERSION_MAJOR_SHIFT) |   \
+                                      MPI2_VERSION_MINOR)
+
+#define MPI2_VERSION_02_00                  (0x0200)
+
+/* versioning for this MPI header set */
+#define MPI2_HEADER_VERSION_UNIT            (0x10)
+#define MPI2_HEADER_VERSION_DEV             (0x00)
+#define MPI2_HEADER_VERSION_UNIT_MASK       (0xFF00)
+#define MPI2_HEADER_VERSION_UNIT_SHIFT      (8)
+#define MPI2_HEADER_VERSION_DEV_MASK        (0x00FF)
+#define MPI2_HEADER_VERSION_DEV_SHIFT       (0)
+#define MPI2_HEADER_VERSION ((MPI2_HEADER_VERSION_UNIT << 8) |		\
+					MPI2_HEADER_VERSION_DEV)
+
+
+/* IOCInit Request message */
+struct MPI2_IOC_INIT_REQUEST {
+	uint8_t		WhoInit;                        /* 0x00 */
+	uint8_t		Reserved1;                      /* 0x01 */
+	uint8_t		ChainOffset;                    /* 0x02 */
+	uint8_t		Function;                       /* 0x03 */
+	uint16_t	Reserved2;                      /* 0x04 */
+	uint8_t		Reserved3;                      /* 0x06 */
+	uint8_t		MsgFlags;                       /* 0x07 */
+	uint8_t		VP_ID;                          /* 0x08 */
+	uint8_t		VF_ID;                          /* 0x09 */
+	uint16_t	Reserved4;                      /* 0x0A */
+	uint16_t	MsgVersion;                     /* 0x0C */
+	uint16_t	HeaderVersion;                  /* 0x0E */
+	uint32_t	Reserved5;                      /* 0x10 */
+	uint16_t	Reserved6;                      /* 0x14 */
+	uint8_t		Reserved7;                      /* 0x16 */
+	uint8_t		HostMSIxVectors;                /* 0x17 */
+	uint16_t	Reserved8;                      /* 0x18 */
+	uint16_t	SystemRequestFrameSize;         /* 0x1A */
+	uint16_t	ReplyDescriptorPostQueueDepth;  /* 0x1C */
+	uint16_t	ReplyFreeQueueDepth;            /* 0x1E */
+	uint32_t	SenseBufferAddressHigh;         /* 0x20 */
+	uint32_t	SystemReplyAddressHigh;         /* 0x24 */
+	uint64_t	SystemRequestFrameBaseAddress;  /* 0x28 */
+	uint64_t	ReplyDescriptorPostQueueAddress;/* 0x30 */
+	uint64_t	ReplyFreeQueueAddress;          /* 0x38 */
+	uint64_t	TimeStamp;                      /* 0x40 */
+};
+
+/* WhoInit values */
+#define MPI2_WHOINIT_NOT_INITIALIZED            (0x00)
+#define MPI2_WHOINIT_SYSTEM_BIOS                (0x01)
+#define MPI2_WHOINIT_ROM_BIOS                   (0x02)
+#define MPI2_WHOINIT_PCI_PEER                   (0x03)
+#define MPI2_WHOINIT_HOST_DRIVER                (0x04)
+#define MPI2_WHOINIT_MANUFACTURER               (0x05)
+
+struct MPI2_SGE_CHAIN_UNION {
+	uint16_t	Length;
+	uint8_t		NextChainOffset;
+	uint8_t		Flags;
+	union {
+		uint32_t	Address32;
+		uint64_t	Address64;
+	} u;
+};
+
+struct MPI2_IEEE_SGE_SIMPLE32 {
+	uint32_t	Address;
+	uint32_t	FlagsLength;
+};
+
+struct MPI2_IEEE_SGE_SIMPLE64 {
+	uint64_t	Address;
+	uint32_t	Length;
+	uint16_t	Reserved1;
+	uint8_t		Reserved2;
+	uint8_t		Flags;
+};
+
+typedef union _MPI2_IEEE_SGE_SIMPLE_UNION {
+	struct MPI2_IEEE_SGE_SIMPLE32	Simple32;
+	struct MPI2_IEEE_SGE_SIMPLE64	Simple64;
+} MPI2_IEEE_SGE_SIMPLE_UNION;
+
+typedef struct _MPI2_SGE_SIMPLE_UNION {
+	uint32_t	FlagsLength;
+	union {
+		uint32_t	Address32;
+		uint64_t	Address64;
+	} u;
+} MPI2_SGE_SIMPLE_UNION;
+
+/****************************************************************************
+*  IEEE SGE field definitions and masks
+****************************************************************************/
+
+/* Flags field bit definitions */
+
+#define MPI2_IEEE_SGE_FLAGS_ELEMENT_TYPE_MASK   (0x80)
+
+#define MPI2_IEEE32_SGE_FLAGS_SHIFT             (24)
+
+#define MPI2_IEEE32_SGE_LENGTH_MASK             (0x00FFFFFF)
+
+/* Element Type */
+
+#define MPI2_IEEE_SGE_FLAGS_SIMPLE_ELEMENT      (0x00)
+#define MPI2_IEEE_SGE_FLAGS_CHAIN_ELEMENT       (0x80)
+
+/* Data Location Address Space */
+
+#define MPI2_IEEE_SGE_FLAGS_ADDR_MASK           (0x03)
+#define MPI2_IEEE_SGE_FLAGS_SYSTEM_ADDR         (0x00)
+#define MPI2_IEEE_SGE_FLAGS_IOCDDR_ADDR         (0x01)
+#define MPI2_IEEE_SGE_FLAGS_IOCPLB_ADDR         (0x02)
+#define MPI2_IEEE_SGE_FLAGS_IOCPLBNTA_ADDR      (0x03)
+
+/* Address Size */
+
+#define MPI2_SGE_FLAGS_32_BIT_ADDRESSING        (0x00)
+#define MPI2_SGE_FLAGS_64_BIT_ADDRESSING        (0x02)
+
+/*******************/
+/* SCSI IO Control bits */
+#define MPI2_SCSIIO_CONTROL_ADDCDBLEN_MASK      (0xFC000000)
+#define MPI2_SCSIIO_CONTROL_ADDCDBLEN_SHIFT     (26)
+
+#define MPI2_SCSIIO_CONTROL_DATADIRECTION_MASK  (0x03000000)
+#define MPI2_SCSIIO_CONTROL_NODATATRANSFER      (0x00000000)
+#define MPI2_SCSIIO_CONTROL_WRITE               (0x01000000)
+#define MPI2_SCSIIO_CONTROL_READ                (0x02000000)
+#define MPI2_SCSIIO_CONTROL_BIDIRECTIONAL       (0x03000000)
+
+#define MPI2_SCSIIO_CONTROL_TASKPRI_MASK        (0x00007800)
+#define MPI2_SCSIIO_CONTROL_TASKPRI_SHIFT       (11)
+
+#define MPI2_SCSIIO_CONTROL_TASKATTRIBUTE_MASK  (0x00000700)
+#define MPI2_SCSIIO_CONTROL_SIMPLEQ             (0x00000000)
+#define MPI2_SCSIIO_CONTROL_HEADOFQ             (0x00000100)
+#define MPI2_SCSIIO_CONTROL_ORDEREDQ            (0x00000200)
+#define MPI2_SCSIIO_CONTROL_ACAQ                (0x00000400)
+
+#define MPI2_SCSIIO_CONTROL_TLR_MASK            (0x000000C0)
+#define MPI2_SCSIIO_CONTROL_NO_TLR              (0x00000000)
+#define MPI2_SCSIIO_CONTROL_TLR_ON              (0x00000040)
+#define MPI2_SCSIIO_CONTROL_TLR_OFF             (0x00000080)
+
+/*******************/
+
+typedef struct {
+	uint8_t		CDB[20];                    /* 0x00 */
+	uint32_t	PrimaryReferenceTag;        /* 0x14 */
+	uint16_t	PrimaryApplicationTag;      /* 0x18 */
+	uint16_t	PrimaryApplicationTagMask;  /* 0x1A */
+	uint32_t	TransferLength;             /* 0x1C */
+} MPI2_SCSI_IO_CDB_EEDP32;
+
+
+typedef union _MPI2_IEEE_SGE_CHAIN_UNION {
+	struct MPI2_IEEE_SGE_SIMPLE32	Chain32;
+	struct MPI2_IEEE_SGE_SIMPLE64	Chain64;
+} MPI2_IEEE_SGE_CHAIN_UNION;
+
+typedef union _MPI2_SIMPLE_SGE_UNION {
+	MPI2_SGE_SIMPLE_UNION		MpiSimple;
+	MPI2_IEEE_SGE_SIMPLE_UNION	IeeeSimple;
+} MPI2_SIMPLE_SGE_UNION;
+
+typedef union _MPI2_SGE_IO_UNION {
+	MPI2_SGE_SIMPLE_UNION		MpiSimple;
+	struct MPI2_SGE_CHAIN_UNION	MpiChain;
+	MPI2_IEEE_SGE_SIMPLE_UNION	IeeeSimple;
+	MPI2_IEEE_SGE_CHAIN_UNION	IeeeChain;
+} MPI2_SGE_IO_UNION;
+
+typedef union {
+	uint8_t			CDB32[32];
+	MPI2_SCSI_IO_CDB_EEDP32	EEDP32;
+	MPI2_SGE_SIMPLE_UNION	SGE;
+} MPI2_SCSI_IO_CDB_UNION;
+
+
+/* MPI 2.5 SGLs */
+
+#define MPI25_IEEE_SGE_FLAGS_END_OF_LIST        (0x40)
+
+typedef struct _MPI25_IEEE_SGE_CHAIN64 {
+	uint64_t	Address;
+	uint32_t	Length;
+	uint16_t	Reserved1;
+	uint8_t		NextChainOffset;
+	uint8_t		Flags;
+} MPI25_IEEE_SGE_CHAIN64, *pMpi25IeeeSgeChain64_t;
+
+/* use MPI2_IEEE_SGE_FLAGS_ defines for the Flags field */
+
+
+/********/
+
+/*
+ * RAID SCSI IO Request Message
+ * Total SGE count will be one less than  _MPI2_SCSI_IO_REQUEST
+ */
+struct mfi_mpi2_request_raid_scsi_io {
+	uint16_t		DevHandle;                      /* 0x00 */
+	uint8_t			ChainOffset;                    /* 0x02 */
+	uint8_t			Function;                       /* 0x03 */
+	uint16_t		Reserved1;                      /* 0x04 */
+	uint8_t			Reserved2;                      /* 0x06 */
+	uint8_t			MsgFlags;                       /* 0x07 */
+	uint8_t			VP_ID;                          /* 0x08 */
+	uint8_t			VF_ID;                          /* 0x09 */
+	uint16_t		Reserved3;                      /* 0x0A */
+	uint32_t		SenseBufferLowAddress;          /* 0x0C */
+	uint16_t		SGLFlags;                       /* 0x10 */
+	uint8_t			SenseBufferLength;              /* 0x12 */
+	uint8_t			Reserved4;                      /* 0x13 */
+	uint8_t			SGLOffset0;                     /* 0x14 */
+	uint8_t			SGLOffset1;                     /* 0x15 */
+	uint8_t			SGLOffset2;                     /* 0x16 */
+	uint8_t			SGLOffset3;                     /* 0x17 */
+	uint32_t		SkipCount;                      /* 0x18 */
+	uint32_t		DataLength;                     /* 0x1C */
+	uint32_t		BidirectionalDataLength;        /* 0x20 */
+	uint16_t		IoFlags;                        /* 0x24 */
+	uint16_t		EEDPFlags;                      /* 0x26 */
+	uint32_t		EEDPBlockSize;                  /* 0x28 */
+	uint32_t		SecondaryReferenceTag;          /* 0x2C */
+	uint16_t		SecondaryApplicationTag;        /* 0x30 */
+	uint16_t		ApplicationTagTranslationMask;  /* 0x32 */
+	uint8_t			LUN[8];                         /* 0x34 */
+	uint32_t		Control;                        /* 0x3C */
+	MPI2_SCSI_IO_CDB_UNION	CDB;                            /* 0x40 */
+	MPI2_SCSI_IO_VENDOR_UNIQUE	RaidContext;              /* 0x60 */
+	MPI2_SGE_IO_UNION	SGL;                            /* 0x80 */
+} __packed;
+
+/*
+ * MPT RAID MFA IO Descriptor.
+ */
+typedef struct _MFI_RAID_MFA_IO_DESCRIPTOR {
+	uint32_t	RequestFlags : 8;
+	uint32_t	MessageAddress1 : 24; /* bits 31:8*/
+	uint32_t	MessageAddress2;      /* bits 61:32 */
+} MFI_RAID_MFA_IO_REQUEST_DESCRIPTOR,*PMFI_RAID_MFA_IO_REQUEST_DESCRIPTOR;
+
+struct mfi_mpi2_request_header {
+	uint8_t		RequestFlags;       /* 0x00 */
+	uint8_t		MSIxIndex;          /* 0x01 */
+	uint16_t	SMID;               /* 0x02 */
+	uint16_t	LMID;               /* 0x04 */
+};
+
+/* defines for the RequestFlags field */
+#define MPI2_REQ_DESCRIPT_FLAGS_TYPE_MASK               (0x0E)
+#define MPI2_REQ_DESCRIPT_FLAGS_SCSI_IO                 (0x00)
+#define MPI2_REQ_DESCRIPT_FLAGS_SCSI_TARGET             (0x02)
+#define MPI2_REQ_DESCRIPT_FLAGS_HIGH_PRIORITY           (0x06)
+#define MPI2_REQ_DESCRIPT_FLAGS_DEFAULT_TYPE            (0x08)
+#define MPI2_REQ_DESCRIPT_FLAGS_RAID_ACCELERATOR        (0x0A)
+
+#define MPI2_REQ_DESCRIPT_FLAGS_IOC_FIFO_MARKER (0x01)
+
+struct mfi_mpi2_request_high_priority {
+	struct mfi_mpi2_request_header	header;
+	uint16_t			reserved;
+};
+
+struct mfi_mpi2_request_scsi_io {
+	struct mfi_mpi2_request_header	header;
+	uint16_t			scsi_io_dev_handle;
+};
+
+struct mfi_mpi2_request_scsi_target {
+	struct mfi_mpi2_request_header	header;
+	uint16_t			scsi_target_io_index;
+};
+
+/* Request Descriptors */
+union mfi_mpi2_request_descriptor {
+	struct mfi_mpi2_request_header		header;
+	struct mfi_mpi2_request_high_priority	high_priority;
+	struct mfi_mpi2_request_scsi_io		scsi_io;
+	struct mfi_mpi2_request_scsi_target	scsi_target;
+	uint64_t				words;
+};
+
+
+struct mfi_mpi2_reply_header {
+	uint8_t		ReplyFlags;                 /* 0x00 */
+	uint8_t		MSIxIndex;                  /* 0x01 */
+	uint16_t	SMID;                       /* 0x02 */
+};
+
+/* defines for the ReplyFlags field */
+#define MPI2_RPY_DESCRIPT_FLAGS_TYPE_MASK                   (0x0F)
+#define MPI2_RPY_DESCRIPT_FLAGS_SCSI_IO_SUCCESS             (0x00)
+#define MPI2_RPY_DESCRIPT_FLAGS_ADDRESS_REPLY               (0x01)
+#define MPI2_RPY_DESCRIPT_FLAGS_TARGETASSIST_SUCCESS        (0x02)
+#define MPI2_RPY_DESCRIPT_FLAGS_TARGET_COMMAND_BUFFER       (0x03)
+#define MPI2_RPY_DESCRIPT_FLAGS_RAID_ACCELERATOR_SUCCESS    (0x05)
+#define MPI2_RPY_DESCRIPT_FLAGS_UNUSED                      (0x0F)
+
+/* values for marking a reply descriptor as unused */
+#define MPI2_RPY_DESCRIPT_UNUSED_WORD0_MARK             (0xFFFFFFFF)
+#define MPI2_RPY_DESCRIPT_UNUSED_WORD1_MARK             (0xFFFFFFFF)
+
+struct mfi_mpi2_reply_default {
+	struct mfi_mpi2_reply_header	header;
+	uint32_t			DescriptorTypeDependent2;
+};
+
+struct mfi_mpi2_reply_address {
+	struct mfi_mpi2_reply_header	header;
+	uint32_t			ReplyFrameAddress;
+};
+
+struct mfi_mpi2_reply_scsi_io {
+	struct mfi_mpi2_reply_header	header;
+	uint16_t			TaskTag;		/* 0x04 */
+	uint16_t			Reserved1;		/* 0x06 */
+};
+
+struct mfi_mpi2_reply_target_assist {
+	struct mfi_mpi2_reply_header	header;
+	uint8_t				SequenceNumber;		/* 0x04 */
+	uint8_t				Reserved1;		/* 0x04 */
+	uint16_t			IoIndex;		/* 0x06 */
+};
+
+struct mfi_mpi2_reply_target_cmd_buffer {
+	struct mfi_mpi2_reply_header	header;
+	uint8_t				SequenceNumber;		/* 0x04 */
+	uint8_t				Flags;			/* 0x04 */
+	uint16_t			InitiatorDevHandle;	/* 0x06 */
+	uint16_t			IoIndex;		/* 0x06 */
+};
+
+struct mfi_mpi2_reply_raid_accel {
+	struct mfi_mpi2_reply_header	header;
+	uint8_t				SequenceNumber;		/* 0x04 */
+	uint32_t			Reserved;		/* 0x04 */
+};
+
+/* union of Reply Descriptors */
+union mfi_mpi2_reply_descriptor {
+	struct mfi_mpi2_reply_header		header;
+	struct mfi_mpi2_reply_scsi_io		scsi_io;
+	struct mfi_mpi2_reply_target_assist	target_assist;
+	struct mfi_mpi2_reply_target_cmd_buffer	target_cmd;
+	struct mfi_mpi2_reply_raid_accel	raid_accel;
+	struct mfi_mpi2_reply_default		reply_default;
+	uint64_t				words;
+};
+
+struct IO_REQUEST_INFO {
+	uint64_t	ldStartBlock;
+	uint32_t	numBlocks;
+	uint16_t	ldTgtId;
+	uint8_t		isRead;
+	uint16_t	devHandle;
+	uint64_t	pdBlock;
+	uint8_t		fpOkForIo;
+};
+
 #define MFI_SCSI_MAX_TARGETS	128
 #define MFI_SCSI_MAX_LUNS	8
 #define MFI_SCSI_INITIATOR_ID	255
diff --git a/sys/dev/raid/mfi/mfivar.h b/sys/dev/raid/mfi/mfivar.h
index 56518a8c9b..0de856bfd2 100644
--- a/sys/dev/raid/mfi/mfivar.h
+++ b/sys/dev/raid/mfi/mfivar.h
@@ -48,38 +48,9 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- */
-/*-
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *            Copyright 1994-2009 The FreeBSD Project.
- *            All rights reserved.
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- *    THIS SOFTWARE IS PROVIDED BY THE FREEBSD PROJECT``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
- * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FREEBSD PROJECT OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY,OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION)HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * The views and conclusions contained in the software and documentation
- * are those of the authors and should not be interpreted as representing
- * official policies,either expressed or implied, of the FreeBSD Project.
  *
  * $FreeBSD: src/sys/dev/mfi/mfivar.h,v 1.14 2011/09/29 08:37:53 mav Exp $
+ * FreeBSD projects/head_mfi/ r232949
  */
 
 #ifndef _MFIVAR_H
@@ -90,6 +61,7 @@
 #include 
 #include 
 #include 
+#include 
 
 /*
  * SCSI structures and definitions are used from here, but no linking
@@ -103,6 +75,9 @@ struct mfi_hwcomms {
 	uint32_t		hw_reply_q[1];
 };
 
+#define	MEGASAS_MAX_NAME	32
+#define	MEGASAS_VERSION		"4.23"
+
 struct mfi_softc;
 struct disk;
 struct ccb_hdr;
@@ -112,17 +87,9 @@ struct mfi_command {
 	time_t			cm_timestamp;
 	struct mfi_softc	*cm_sc;
 	union mfi_frame		*cm_frame;
-#if defined(__x86_64__)
-	uint64_t		cm_frame_busaddr;
-#else
-	uint32_t		cm_frame_busaddr;
-#endif
+	bus_addr_t		cm_frame_busaddr;
 	struct mfi_sense	*cm_sense;
-#if defined(__x86_64__)
-	uint64_t		cm_sense_busaddr;
-#else
-	uint32_t		cm_sense_busaddr;
-#endif
+	bus_addr_t		cm_sense_busaddr;
 	bus_dmamap_t		cm_dmamap;
 	union mfi_sgl		*cm_sg;
 	void			*cm_data;
@@ -141,6 +108,7 @@ struct mfi_command {
 #define MFI_ON_MFIQ_BUSY	(1<<7)
 #define MFI_ON_MFIQ_MASK	((1<<5)|(1<<6)|(1<<7))
 	int			cm_aen_abort;
+	uint8_t			retry_for_fw_reset;
 	void			(* cm_complete)(struct mfi_command *cm);
 	void			*cm_private;
 	int			cm_index;
@@ -182,11 +150,31 @@ struct mfi_system_pd {
 	int		pd_flags;
 };
 
+struct mfi_evt_queue_elm {
+	TAILQ_ENTRY(mfi_evt_queue_elm)	link;
+	struct mfi_evt_detail		detail;
+};
+
 struct mfi_aen {
 	TAILQ_ENTRY(mfi_aen) aen_link;
 	struct proc			*p;
 };
 
+struct mfi_skinny_dma_info {
+	bus_dma_tag_t	dmat[514];
+	bus_dmamap_t	dmamap[514];
+	uint32_t	mem[514];
+	int		noofmaps;
+};
+
+struct mfi_cmd_tbolt;
+typedef struct {
+	volatile unsigned int val;
+} atomic_t;
+
+#define	atomic_read(v)	((v)->val)
+#define	atomic_set(v,i)	((v)->val - (i))
+
 struct mfi_softc {
 	device_t			mfi_dev;
 	int				mfi_flags;
@@ -198,11 +186,21 @@ struct mfi_softc {
 #define MFI_FLAGS_1078		(1<<5)
 #define MFI_FLAGS_GEN2		(1<<6)
 #define MFI_FLAGS_SKINNY	(1<<7)
+#define MFI_FLAGS_TBOLT		(1<<8)
+	// Start: LSIP200113393
+	bus_dma_tag_t			verbuf_h_dmat;
+	bus_dmamap_t			verbuf_h_dmamap;
+	uint32_t			verbuf_h_busaddr;
+	uint32_t			*verbuf;
+	void				*kbuff_arr[MAX_IOCTL_SGE];
+	bus_dma_tag_t			mfi_kbuff_arr_dmat[2];
+	bus_dmamap_t			mfi_kbuff_arr_dmamap[2];
+	bus_addr_t			mfi_kbuff_arr_busaddr[2];
 
 	struct mfi_hwcomms		*mfi_comms;
 	TAILQ_HEAD(,mfi_command)	mfi_free;
 	TAILQ_HEAD(,mfi_command)	mfi_ready;
-	TAILQ_HEAD(,mfi_command)	mfi_busy;
+	TAILQ_HEAD(BUSYQ,mfi_command)	mfi_busy;
 	struct bio_queue_head		mfi_bioq;
 	struct mfi_qstat		mfi_qstat[MFIQ_COUNT];
 
@@ -216,19 +214,28 @@ struct mfi_softc {
 
 	bus_dma_tag_t			mfi_comms_dmat;
 	bus_dmamap_t			mfi_comms_dmamap;
-	uint32_t			mfi_comms_busaddr;
+	bus_addr_t			mfi_comms_busaddr;
 
 	bus_dma_tag_t			mfi_frames_dmat;
 	bus_dmamap_t			mfi_frames_dmamap;
-	uint32_t			mfi_frames_busaddr;
+	bus_addr_t			mfi_frames_busaddr;
 	union mfi_frame			*mfi_frames;
 
+	bus_dma_tag_t			mfi_tb_init_dmat;
+	bus_dmamap_t			mfi_tb_init_dmamap;
+	bus_addr_t			mfi_tb_init_busaddr;
+	bus_addr_t			mfi_tb_ioc_init_busaddr;
+	union mfi_frame			*mfi_tb_init;
+
+	TAILQ_HEAD(,mfi_evt_queue_elm)	mfi_evt_queue;
+	struct task			mfi_evt_task;
 	TAILQ_HEAD(,mfi_aen)		mfi_aen_pids;
 	struct mfi_command		*mfi_aen_cm;
 	struct mfi_command		*mfi_skinny_cm;
 	uint32_t			mfi_aen_triggered;
 	uint32_t			mfi_poll_waiting;
 	struct kqinfo			mfi_kq;
+	uint32_t			mfi_boot_seq_num;
 	int				mfi_delete_busy_volumes;
 	int				mfi_keep_deleted_volumes;
 	int				mfi_detaching;
@@ -245,6 +252,14 @@ struct mfi_softc {
 
 	struct intr_config_hook		mfi_ich;
 	eventhandler_tag		eh;
+	/* OCR flags */
+	atomic_t fw_reset_no_pci_access;
+	uint8_t adpreset;
+	uint8_t issuepend_done;
+	uint8_t disableOnlineCtrlReset;
+	uint32_t mfiStatus;
+	uint32_t last_seq_num;
+	uint32_t volatile hw_crit_error;
 
 	/*
 	 * Allocation for the command array.  Used as an indexable array to
@@ -295,9 +310,98 @@ struct mfi_softc {
 
 	/* Controller type specific interfaces */
 	void	(*mfi_enable_intr)(struct mfi_softc *sc);
+	void	(*mfi_disable_intr)(struct mfi_softc *sc);
 	int32_t	(*mfi_read_fw_status)(struct mfi_softc *sc);
 	int	(*mfi_check_clear_intr)(struct mfi_softc *sc);
-	void	(*mfi_issue_cmd)(struct mfi_softc *sc,uint32_t bus_add,uint32_t frame_cnt);
+	void	(*mfi_issue_cmd)(struct mfi_softc *sc, bus_addr_t bus_add,
+		    uint32_t frame_cnt);
+	int	(*mfi_adp_reset)(struct mfi_softc *sc);
+	int	(*mfi_adp_check_reset)(struct mfi_softc *sc);
+
+	/* ThunderBolt */
+	uint32_t			mfi_tbolt;
+	uint32_t			MFA_enabled;
+	uint64_t			map_id;
+	struct mfi_command 		*map_update_cmd;
+	/* Single Reply structure size */
+	uint16_t			reply_size;
+	/* Singler message size. */
+	uint16_t			raid_io_msg_size;
+	TAILQ_HEAD(TB, mfi_cmd_tbolt)	mfi_cmd_tbolt_tqh;
+	/* ThunderBolt base contiguous memory mapping. */
+	bus_dma_tag_t			mfi_tb_dmat;
+	bus_dmamap_t			mfi_tb_dmamap;
+	bus_addr_t			mfi_tb_busaddr;
+	/* ThunderBolt Contiguous DMA memory Mapping */
+	uint8_t	*			request_message_pool;
+	uint8_t *			request_message_pool_align;
+	uint8_t *			request_desc_pool;
+	//uint32_t			request_desc_busaddr;
+	bus_addr_t			request_msg_busaddr;
+	bus_addr_t			reply_frame_busaddr;
+	bus_addr_t			sg_frame_busaddr;
+	/* ThunderBolt IOC Init Descriptor */
+	bus_dma_tag_t			mfi_tb_ioc_init_dmat;
+	bus_dmamap_t			mfi_tb_ioc_init_dmamap;
+	uint8_t *			mfi_tb_ioc_init_desc;
+	struct mfi_cmd_tbolt		**mfi_cmd_pool_tbolt;
+	/* Virtual address of reply Frame Pool */
+	struct mfi_mpi2_reply_header*	reply_frame_pool;
+	struct mfi_mpi2_reply_header*	reply_frame_pool_align;
+
+	/* Last reply frame address */
+	uint8_t *			reply_pool_limit;
+	uint16_t			last_reply_idx;
+	uint8_t				max_SGEs_in_chain_message;
+	uint8_t				max_SGEs_in_main_message;
+	uint8_t				chain_offset_value_for_main_message;
+	uint8_t				chain_offset_value_for_mpt_ptmsg;
+};
+
+union desc_value {
+	uint64_t	word;
+	struct {
+		uint32_t	low;
+		uint32_t	high;
+	}u;
+};
+
+// TODO find the right definition
+#define XXX_MFI_CMD_OP_INIT2                    0x9
+/*
+ * Request descriptor types
+ */
+#define MFI_REQ_DESCRIPT_FLAGS_LD_IO           0x7
+#define MFI_REQ_DESCRIPT_FLAGS_MFA             0x1
+#define MFI_REQ_DESCRIPT_FLAGS_TYPE_SHIFT	0x1
+#define MFI_FUSION_FP_DEFAULT_TIMEOUT		0x14
+#define MFI_LOAD_BALANCE_FLAG			0x1
+#define MFI_DCMD_MBOX_PEND_FLAG			0x1
+
+//#define MR_PROT_INFO_TYPE_CONTROLLER	0x08
+#define	MEGASAS_SCSI_VARIABLE_LENGTH_CMD	0x7f
+#define MEGASAS_SCSI_SERVICE_ACTION_READ32	0x9
+#define MEGASAS_SCSI_SERVICE_ACTION_WRITE32	0xB
+#define	MEGASAS_SCSI_ADDL_CDB_LEN   		0x18
+#define MEGASAS_RD_WR_PROTECT_CHECK_ALL		0x20
+#define MEGASAS_RD_WR_PROTECT_CHECK_NONE	0x60
+#define MEGASAS_EEDPBLOCKSIZE			512
+struct mfi_cmd_tbolt {
+	union mfi_mpi2_request_descriptor *request_desc;
+	struct mfi_mpi2_request_raid_scsi_io *io_request;
+	bus_addr_t		io_request_phys_addr;
+	bus_addr_t		sg_frame_phys_addr;
+	bus_addr_t 		sense_phys_addr;
+	MPI2_SGE_IO_UNION	*sg_frame;
+	uint8_t			*sense;
+	TAILQ_ENTRY(mfi_cmd_tbolt) next;
+	/*
+	 * Context for a MFI frame.
+	 * Used to get the mfi cmd from list when a MFI cmd is completed
+	 */
+	uint32_t		sync_cmd_idx;
+	uint16_t		index;
+	uint8_t			status;
 };
 
 extern int mfi_attach(struct mfi_softc *);
@@ -310,7 +414,28 @@ extern void mfi_disk_enable(struct mfi_disk *);
 extern int mfi_dump_blocks(struct mfi_softc *, int id, uint64_t, void *, int);
 extern int mfi_syspd_disable(struct mfi_system_pd *);
 extern void mfi_syspd_enable(struct mfi_system_pd *);
-extern int mfi_dump_syspd_blocks(struct mfi_softc *, int id, uint64_t, void *, int);
+extern int mfi_dump_syspd_blocks(struct mfi_softc *, int id, uint64_t, void *,
+    int);
+extern int mfi_transition_firmware(struct mfi_softc *sc);
+extern int mfi_aen_setup(struct mfi_softc *sc, uint32_t seq_start);
+extern void mfi_complete(struct mfi_softc *sc, struct mfi_command *cm);
+extern int mfi_mapcmd(struct mfi_softc *sc,struct mfi_command *cm);
+extern int mfi_wait_command(struct mfi_softc *sc, struct mfi_command *cm);
+extern void mfi_tbolt_enable_intr_ppc(struct mfi_softc *);
+extern void mfi_tbolt_disable_intr_ppc(struct mfi_softc *);
+extern int32_t mfi_tbolt_read_fw_status_ppc(struct mfi_softc *);
+extern int32_t mfi_tbolt_check_clear_intr_ppc(struct mfi_softc *);
+extern void mfi_tbolt_issue_cmd_ppc(struct mfi_softc *, bus_addr_t, uint32_t);
+extern void mfi_tbolt_init_globals(struct mfi_softc*);
+extern uint32_t mfi_tbolt_get_memory_requirement(struct mfi_softc *);
+extern int mfi_tbolt_init_desc_pool(struct mfi_softc *, uint8_t *, uint32_t);
+extern int mfi_tbolt_init_MFI_queue(struct mfi_softc *);
+extern void mfi_intr_tbolt(void *arg);
+extern int mfi_tbolt_alloc_cmd(struct mfi_softc *sc);
+extern int mfi_tbolt_send_frame(struct mfi_softc *sc, struct mfi_command *cm);
+extern int mfi_tbolt_adp_reset(struct mfi_softc *sc);
+extern int mfi_tbolt_reset(struct mfi_softc *sc);
+extern int mfi_tbolt_sync_map_info(struct mfi_softc *sc);
 
 #define MFIQ_ADD(sc, qname)					\
 	do {							\
@@ -451,9 +576,10 @@ mfi_print_sense(struct mfi_softc *sc, void *sense)
 
 MALLOC_DECLARE(M_MFIBUF);
 
+#define MFI_RESET_WAIT_TIME 180
 #define MFI_CMD_TIMEOUT 30
-#define MFI_MAXPHYS (128 * 1024)
 #define SKINNY_MEMORY 0x02000000
+#define MFI_MAXPHYS (128 * 1024)
 
 #ifdef MFI_DEBUG
 extern void mfi_print_cmd(struct mfi_command *cm);
diff --git a/sys/dev/raid/mps/mps_sas.c b/sys/dev/raid/mps/mps_sas.c
index 889b7c5544..d58eafe896 100644
--- a/sys/dev/raid/mps/mps_sas.c
+++ b/sys/dev/raid/mps/mps_sas.c
@@ -3003,15 +3003,6 @@ mpssas_check_eedp(struct mpssas_softc *sassc)
 				if (!found_lun) {
 					lun = kmalloc(sizeof(struct mpssas_lun),
 					    M_MPT2, M_WAITOK | M_ZERO);
-					if (lun == NULL) {
-						mps_dprint(sc, MPS_FAULT,
-						    "Unable to alloc LUN for "
-						    "EEDP support.\n");
-						kfree(rcap_buf, M_MPT2);
-						xpt_free_path(ccb->ccb_h.path);
-						xpt_free_ccb(ccb);
-						return;
-					}
 					lun->lun_id = lunid;
 					SLIST_INSERT_HEAD(&target->luns, lun,
 					    lun_link);
diff --git a/sys/dev/raid/mps/mps_sas_lsi.c b/sys/dev/raid/mps/mps_sas_lsi.c
index 15112cf2e0..1bea24de0b 100644
--- a/sys/dev/raid/mps/mps_sas_lsi.c
+++ b/sys/dev/raid/mps/mps_sas_lsi.c
@@ -702,8 +702,10 @@ mpssas_get_sata_identify(struct mps_softc *sc, u16 handle,
 	if (!buffer)
 		return ENOMEM;
 
-	if ((cm = mps_alloc_command(sc)) == NULL)
+	if ((cm = mps_alloc_command(sc)) == NULL) {
+		kfree(buffer, M_MPT2);
 		return (EBUSY);
+	}
 	mpi_request = (MPI2_SATA_PASSTHROUGH_REQUEST *)cm->cm_req;
 	bzero(mpi_request,sizeof(MPI2_SATA_PASSTHROUGH_REQUEST));
 	mpi_request->Function = MPI2_FUNCTION_SATA_PASSTHROUGH;
diff --git a/sys/dev/raid/pst/pst-iop.c b/sys/dev/raid/pst/pst-iop.c
index 1299815985..be4ef8b682 100644
--- a/sys/dev/raid/pst/pst-iop.c
+++ b/sys/dev/raid/pst/pst-iop.c
@@ -26,7 +26,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  * $FreeBSD: src/sys/dev/pst/pst-iop.c,v 1.2.2.1 2002/08/18 12:32:36 sos Exp $
- * $DragonFly: src/sys/dev/raid/pst/pst-iop.c,v 1.11 2006/12/22 23:26:24 swildner Exp $
  */
 
 #include 
@@ -326,7 +325,10 @@ iop_get_util_params(struct iop_softc *sc, int target, int operation, int group)
 
     if (!(reply = contigmalloc(PAGE_SIZE, M_PSTIOP, M_NOWAIT | M_ZERO,
 			       0x00010000, 0xFFFFFFFF, sizeof(u_int32_t), 0)))
+    {
+	contigfree(param, PAGE_SIZE, M_PSTIOP);
 	return NULL;
+    }
 
     mfa = iop_get_mfa(sc);
     msg = (struct i2o_util_get_param_message *)(sc->ibase + mfa);
diff --git a/sys/dev/raid/twa/tw_cl_misc.c b/sys/dev/raid/twa/tw_cl_misc.c
index 9b4e7f86f9..798e38a25c 100644
--- a/sys/dev/raid/twa/tw_cl_misc.c
+++ b/sys/dev/raid/twa/tw_cl_misc.c
@@ -641,7 +641,7 @@ tw_cli_dbg_printf(TW_UINT8 dbg_level,
 		va_end(ap);
 
 		tw_osl_strcpy(print_str + tw_osl_strlen(print_str), "\n");
-		tw_osl_dbg_printf(ctlr_handle, print_str);
+		tw_osl_dbg_printf(ctlr_handle, "%s", print_str);
 	}
 #endif /* TW_OSL_DEBUG */
 }
diff --git a/sys/dev/serial/rp/rp.c b/sys/dev/serial/rp/rp.c
index 711697655a..b79d17cbc2 100644
--- a/sys/dev/serial/rp/rp.c
+++ b/sys/dev/serial/rp/rp.c
@@ -1415,7 +1415,7 @@ rpioctl(struct dev_ioctl_args *ap)
 			flags |= SET_RTS;
 		if(arg & TIOCM_DTR)
 			flags |= SET_DTR;
-			rp->rp_channel.TxControl[3] |= flags;
+		rp->rp_channel.TxControl[3] |= flags;
 		rp_writech4(&rp->rp_channel,_INDX_ADDR,
 			*(DWord_t *) &(rp->rp_channel.TxControl[0]));
 		break;
diff --git a/sys/dev/sound/pcm/feeder_fmt.c b/sys/dev/sound/pcm/feeder_fmt.c
index 0650a6abc8..9579b6ecf6 100644
--- a/sys/dev/sound/pcm/feeder_fmt.c
+++ b/sys/dev/sound/pcm/feeder_fmt.c
@@ -325,8 +325,6 @@ static int
 feed_common_init(struct pcm_feeder *f)
 {
 	f->data = kmalloc(FEEDBUFSZ, M_FMTFEEDER, M_WAITOK|M_ZERO);
-	if (f->data == NULL)
-		return ENOMEM;
 	return 0;
 }
 
diff --git a/sys/dev/video/bktr/msp34xx.c b/sys/dev/video/bktr/msp34xx.c
index d294e33a60..7de07fc6f9 100644
--- a/sys/dev/video/bktr/msp34xx.c
+++ b/sys/dev/video/bktr/msp34xx.c
@@ -24,7 +24,6 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/sys/dev/bktr/msp34xx.c,v 1.5 2004/12/16 23:19:57 julian Exp
- * $DragonFly: src/sys/dev/video/bktr/msp34xx.c,v 1.8 2007/10/03 19:27:08 swildner Exp $
  */
 
 /*
@@ -131,7 +130,6 @@ struct msp3400c {
 
 	/* thread */
 	struct thread	    *kthread;
-	char                *threaddesc;
 
 	int                  active,restart,rmmod;
 
@@ -1146,12 +1144,6 @@ int msp_attach(bktr_ptr_t bktr)
 	msp->bass   = 32768;
 	msp->treble = 32768;
 	msp->input  = -1;
-	msp->threaddesc = kmalloc(15 * sizeof(char), M_DEVBUF, M_NOWAIT);
-	if (msp->threaddesc == NULL) {
-		kfree(msp, M_DEVBUF);
-                return ENOMEM;
-	}
-	ksnprintf(msp->threaddesc, 14, "%s_msp34xx_thread", bktr->bktr_xname);
 
 	for (i = 0; i < DFP_COUNT; i++)
 		msp->dfp_regs[i] = -1;
@@ -1162,7 +1154,6 @@ int msp_attach(bktr_ptr_t bktr)
 	if (-1 != rev1)
 		rev2 = msp3400c_read(bktr, I2C_MSP3400C_DFP, 0x1f);
 	if ((-1 == rev1) || (0 == rev1 && 0 == rev2)) {
-		kfree(msp->threaddesc, M_DEVBUF);
 		kfree(msp, M_DEVBUF);
 		bktr->msp3400c_info = NULL;
 		kprintf("%s: msp3400: error while reading chip version\n", bktr_name(bktr));
@@ -1197,10 +1188,9 @@ int msp_attach(bktr_ptr_t bktr)
 
 	/* startup control thread */
 	err = kthread_create(msp->simple ? msp3410d_thread : msp3400c_thread,
-			     bktr, &msp->kthread, msp->threaddesc);
+	    bktr, &msp->kthread, "%s_msp34xx_thread", bktr->bktr_xname);
 	if (err) {
 		kprintf("%s: Error returned by kthread_create: %d", bktr_name(bktr), err);
-		kfree(msp->threaddesc, M_DEVBUF);
 		kfree(msp, M_DEVBUF);
 		bktr->msp3400c_info = NULL;
 		return ENXIO;
diff --git a/sys/dev/virtual/vkernel/disk/vdisk.c b/sys/dev/virtual/vkernel/disk/vdisk.c
index c468d6ce72..73a813d357 100644
--- a/sys/dev/virtual/vkernel/disk/vdisk.c
+++ b/sys/dev/virtual/vkernel/disk/vdisk.c
@@ -120,7 +120,7 @@ vkdinit(void *dummy __unused)
 				  DEVSTAT_PRIORITY_DISK);
 		sc->dev = disk_create(sc->unit, &sc->disk, &vkd_ops);
 		sc->dev->si_drv1 = sc;
-		sc->dev->si_iosize_max = 256 * 1024;
+		sc->dev->si_iosize_max = min(MAXPHYS,256*1024);
 
 		TAILQ_INIT(&sc->cotd_queue);
 		TAILQ_INIT(&sc->cotd_done);
diff --git a/sys/kern/kern_clock.c b/sys/kern/kern_clock.c
index 60408ce3fc..a581a498c6 100644
--- a/sys/kern/kern_clock.c
+++ b/sys/kern/kern_clock.c
@@ -85,6 +85,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -164,11 +165,11 @@ sysctl_cp_time(SYSCTL_HANDLER_ARGS)
 	size_t size = sizeof(cpu_states);
 
 	for (cpu = 0; cpu < ncpus; ++cpu) {
-		cpu_states[0] += cputime_percpu[cpu].cp_user;
-		cpu_states[1] += cputime_percpu[cpu].cp_nice;
-		cpu_states[2] += cputime_percpu[cpu].cp_sys;
-		cpu_states[3] += cputime_percpu[cpu].cp_intr;
-		cpu_states[4] += cputime_percpu[cpu].cp_idle;
+		cpu_states[CP_USER] += cputime_percpu[cpu].cp_user;
+		cpu_states[CP_NICE] += cputime_percpu[cpu].cp_nice;
+		cpu_states[CP_SYS] += cputime_percpu[cpu].cp_sys;
+		cpu_states[CP_INTR] += cputime_percpu[cpu].cp_intr;
+		cpu_states[CP_IDLE] += cputime_percpu[cpu].cp_idle;
 	}
 
 	error = SYSCTL_OUT(req, cpu_states, size);
diff --git a/sys/kern/kern_kthread.c b/sys/kern/kern_kthread.c
index 72d4806d92..71f7332cc9 100644
--- a/sys/kern/kern_kthread.c
+++ b/sys/kern/kern_kthread.c
@@ -24,7 +24,6 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/sys/kern/kern_kthread.c,v 1.5.2.3 2001/12/25 01:51:14 dillon Exp $
- * $DragonFly: src/sys/kern/kern_kthread.c,v 1.13 2006/12/18 20:41:01 dillon Exp $
  */
 
 #include 
@@ -164,7 +163,7 @@ kproc_start(const void *udata)
 	int error;
 
 	error = kthread_create((void (*)(void *))kp->func, NULL,
-				kp->global_threadpp, kp->arg0);
+				kp->global_threadpp, "%s", kp->arg0);
 	lwkt_setpri(*kp->global_threadpp, TDPRI_KERN_DAEMON);
 	if (error)
 		panic("kproc_start: %s: error %d", kp->arg0, error);
diff --git a/sys/kern/kern_lock.c b/sys/kern/kern_lock.c
index 5ee689f379..100a4d0368 100644
--- a/sys/kern/kern_lock.c
+++ b/sys/kern/kern_lock.c
@@ -190,8 +190,7 @@ debuglockmgr(struct lock *lkp, u_int flags,
 
 #ifdef DEBUG_LOCKS
 	if (mycpu->gd_spinlocks_wr &&
-	    ((flags & LK_NOWAIT) == 0 &&
-	    ((flags & LK_RELEASE) == 0)
+	    ((flags & LK_NOWAIT) == 0)
 	) {
 		panic("lockmgr %s from %s:%d: called with %d spinlocks held",
 		      lkp->lk_wmesg, file, line, mycpu->gd_spinlocks_wr);
diff --git a/sys/kern/kern_physio.c b/sys/kern/kern_physio.c
index 4bcf743065..af3d2786b3 100644
--- a/sys/kern/kern_physio.c
+++ b/sys/kern/kern_physio.c
@@ -50,9 +50,9 @@ physio(cdev_t dev, struct uio *uio, int ioflag)
 
 	/* XXX: sanity check */
 	if (dev->si_iosize_max < PAGE_SIZE) {
-		kprintf("WARNING: %s si_iosize_max=%d, using DFLTPHYS.\n",
+		kprintf("WARNING: %s si_iosize_max=%d, using MAXPHYS.\n",
 		    devtoname(dev), dev->si_iosize_max);
-		dev->si_iosize_max = DFLTPHYS;
+		dev->si_iosize_max = MAXPHYS;
 	}
 
 	/* Must be a real uio */
diff --git a/sys/kern/link_elf_obj.c b/sys/kern/link_elf_obj.c
index b7bd1db28d..d4a23f8f26 100644
--- a/sys/kern/link_elf_obj.c
+++ b/sys/kern/link_elf_obj.c
@@ -573,10 +573,6 @@ link_elf_obj_load_file(const char *filename, linker_file_t * result)
 	/* Allocate space for and load the symbol table */
 	ef->ddbsymcnt = shdr[symtabindex].sh_size / sizeof(Elf_Sym);
 	ef->ddbsymtab = kmalloc(shdr[symtabindex].sh_size, M_LINKER, M_WAITOK);
-	if (ef->ddbsymtab == NULL) {
-		error = ENOMEM;
-		goto out;
-	}
 	error = vn_rdwr(UIO_READ, vp, (void *)ef->ddbsymtab,
 			shdr[symtabindex].sh_size, shdr[symtabindex].sh_offset,
 			UIO_SYSSPACE, IO_NODELOCKED, p->p_ucred, &resid);
@@ -591,10 +587,6 @@ link_elf_obj_load_file(const char *filename, linker_file_t * result)
 	/* Allocate space for and load the symbol strings */
 	ef->ddbstrcnt = shdr[symstrindex].sh_size;
 	ef->ddbstrtab = kmalloc(shdr[symstrindex].sh_size, M_LINKER, M_WAITOK);
-	if (ef->ddbstrtab == NULL) {
-		error = ENOMEM;
-		goto out;
-	}
 	error = vn_rdwr(UIO_READ, vp, ef->ddbstrtab,
 			shdr[symstrindex].sh_size, shdr[symstrindex].sh_offset,
 			UIO_SYSSPACE, IO_NODELOCKED, p->p_ucred, &resid);
@@ -612,10 +604,6 @@ link_elf_obj_load_file(const char *filename, linker_file_t * result)
 		ef->shstrcnt = shdr[shstrindex].sh_size;
 		ef->shstrtab = kmalloc(shdr[shstrindex].sh_size, M_LINKER,
 				       M_WAITOK);
-		if (ef->shstrtab == NULL) {
-			error = ENOMEM;
-			goto out;
-		}
 		error = vn_rdwr(UIO_READ, vp, ef->shstrtab,
 				shdr[shstrindex].sh_size, shdr[shstrindex].sh_offset,
 				UIO_SYSSPACE, IO_NODELOCKED, p->p_ucred, &resid);
diff --git a/sys/kern/subr_bus.c b/sys/kern/subr_bus.c
index c9e1800fb5..547e05e1f0 100644
--- a/sys/kern/subr_bus.c
+++ b/sys/kern/subr_bus.c
@@ -1682,7 +1682,7 @@ device_attach_async(device_t dev)
 
 	atomic_add_int(&numasyncthreads, 1);
 	lwkt_create(device_attach_thread, dev, &td, NULL,
-		    0, 0, (dev->desc ? dev->desc : "devattach"));
+		    0, 0, "%s", (dev->desc ? dev->desc : "devattach"));
 }
 
 static void
diff --git a/sys/kern/subr_disk.c b/sys/kern/subr_disk.c
index 1793dd4c67..d29cd2c5d3 100644
--- a/sys/kern/subr_disk.c
+++ b/sys/kern/subr_disk.c
@@ -238,6 +238,7 @@ disk_probe_slice(struct disk *dp, cdev_t dev, int slice, int reprobe)
 						UID_ROOT, GID_OPERATOR, 0640,
 						"%s%c", dev->si_name, 'a'+ i);
 					ndev->si_parent = dev;
+					ndev->si_iosize_max = dev->si_iosize_max;
 					ndev->si_disk = dp;
 					udev_dict_set_cstr(ndev, "subsystem", "disk");
 					/* Inherit parent's disk type */
@@ -401,6 +402,7 @@ disk_probe(struct disk *dp, int reprobe)
 					(info->d_dsflags & DSO_DEVICEMAPPER)?
 					"%s.s%d" : "%ss%d", dev->si_name, sno);
 			ndev->si_parent = dev;
+			ndev->si_iosize_max = dev->si_iosize_max;
 			udev_dict_set_cstr(ndev, "subsystem", "disk");
 			/* Inherit parent's disk type */
 			if (dp->d_disktype) {
@@ -848,6 +850,7 @@ disk_dumpconf(cdev_t dev, u_int onoff)
 	di.dumper = diskdump;
 	di.priv = dev;
 	di.blocksize = secsize;
+	di.maxiosize = dev->si_iosize_max;
 	di.mediaoffset = blkno * DEV_BSIZE;
 	di.mediasize = size * DEV_BSIZE;
 
@@ -1379,7 +1382,7 @@ diskerr(struct bio *bio, cdev_t dev, const char *what, int pri, int donecnt)
 cdev_t
 disk_locate(const char *devname)
 {
-	return devfs_find_device_by_name(devname);
+	return devfs_find_device_by_name("%s", devname);
 }
 
 void
diff --git a/sys/kern/vfs_bio.c b/sys/kern/vfs_bio.c
index e195167c52..35bcba8fc7 100644
--- a/sys/kern/vfs_bio.c
+++ b/sys/kern/vfs_bio.c
@@ -101,7 +101,7 @@ static void vfs_clean_one_page(struct buf *bp, int pageno, vm_page_t m);
 static void vfs_dirty_one_page(struct buf *bp, int pageno, vm_page_t m);
 #endif
 static void vfs_vmio_release(struct buf *bp);
-static int flushbufqueues(bufq_type_t q);
+static int flushbufqueues(struct buf *marker, bufq_type_t q);
 static vm_page_t bio_page_alloc(vm_object_t obj, vm_pindex_t pg, int deficit);
 
 static void bd_signal(long totalspace);
@@ -2328,6 +2328,11 @@ recoverbufpages(void)
 		bremfree_locked(bp);
 		spin_unlock(&bufqspin);
 
+		/*
+		 * Sanity check.  Only BQUEUE_DIRTY[_HW] employs markers.
+		 */
+		KKASSERT((bp->b_flags & B_MARKER) == 0);
+
 		/*
 		 * Dependancies must be handled before we disassociate the
 		 * vnode.
@@ -2422,6 +2427,11 @@ buf_daemon1(struct thread *td, int queue, int (*buf_limit_fn)(long),
 	    int *bd_req)
 {
 	long limit;
+	struct buf *marker;
+
+	marker = kmalloc(sizeof(*marker), M_BIOBUF, M_WAITOK | M_ZERO);
+	marker->b_flags |= B_MARKER;
+	marker->b_qindex = BQUEUE_NONE;
 
 	/*
 	 * This process needs to be suspended prior to shutdown sync.
@@ -2453,7 +2463,7 @@ buf_daemon1(struct thread *td, int queue, int (*buf_limit_fn)(long),
 		waitrunningbufspace();
 		limit = lodirtybufspace / 2;
 		while (buf_limit_fn(limit)) {
-			if (flushbufqueues(queue) == 0)
+			if (flushbufqueues(marker, queue) == 0)
 				break;
 			if (runningbufspace < hirunningspace)
 				continue;
@@ -2471,6 +2481,8 @@ buf_daemon1(struct thread *td, int queue, int (*buf_limit_fn)(long),
 		*bd_req = 0;
 		spin_unlock(&bufcspin);
 	}
+	/* NOT REACHED */
+	/*kfree(marker, M_BIOBUF);*/
 }
 
 static int
@@ -2516,65 +2528,103 @@ buf_daemon_hw(void)
  *	can mess with its contents.  bufqspin isn't enough.
  */
 static int
-flushbufqueues(bufq_type_t q)
+flushbufqueues(struct buf *marker, bufq_type_t q)
 {
 	struct buf *bp;
 	int r = 0;
-	int spun;
 
+	KKASSERT(marker->b_qindex == BQUEUE_NONE);
+	KKASSERT(marker->b_flags & B_MARKER);
+
+	/*
+	 * Spinlock needed to perform operations on the queue and may be
+	 * held through a non-blocking BUF_LOCK(), but cannot be held when
+	 * BUF_UNLOCK()ing or through any other major operation.
+	 */
 	spin_lock(&bufqspin);
-	spun = 1;
+	marker->b_qindex = q;
+	TAILQ_INSERT_HEAD(&bufqueues[q], marker, b_freelist);
+	bp = marker;
 
-	bp = TAILQ_FIRST(&bufqueues[q]);
-	while (bp) {
+	while ((bp = TAILQ_NEXT(bp, b_freelist)) != NULL) {
+		/*
+		 * NOTE: spinlock is always held at the top of the loop
+		 */
+		if (bp->b_flags & B_MARKER)
+			continue;
 		if ((bp->b_flags & B_DELWRI) == 0) {
 			kprintf("Unexpected clean buffer %p\n", bp);
-			bp = TAILQ_NEXT(bp, b_freelist);
 			continue;
 		}
-		if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_NOWAIT)) {
-			bp = TAILQ_NEXT(bp, b_freelist);
+		if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_NOWAIT))
 			continue;
-		}
 		KKASSERT(bp->b_qindex == q);
 
+		/*
+		 * Once the buffer is locked we will have no choice but to
+		 * unlock the spinlock around a later BUF_UNLOCK and re-set
+		 * bp = marker when looping.  Move the marker now to make
+		 * things easier.
+		 */
+		TAILQ_REMOVE(&bufqueues[q], marker, b_freelist);
+		TAILQ_INSERT_AFTER(&bufqueues[q], bp, marker, b_freelist);
+
 		/*
 		 * Must recheck B_DELWRI after successfully locking
 		 * the buffer.
 		 */
 		if ((bp->b_flags & B_DELWRI) == 0) {
+			spin_unlock(&bufqspin);
 			BUF_UNLOCK(bp);
-			bp = TAILQ_NEXT(bp, b_freelist);
+			spin_lock(&bufqspin);
+			bp = marker;
 			continue;
 		}
 
+		/*
+		 * Remove the buffer from its queue.  We still own the
+		 * spinlock here.
+		 */
+		_bremfree(bp);
+
+		/*
+		 * Disposing of an invalid buffer counts as a flush op
+		 */
 		if (bp->b_flags & B_INVAL) {
-			_bremfree(bp);
 			spin_unlock(&bufqspin);
-			spun = 0;
 			brelse(bp);
+			spin_lock(&bufqspin);
 			++r;
 			break;
 		}
 
+		/*
+		 * Release the spinlock for the more complex ops we
+		 * are now going to do.
+		 */
 		spin_unlock(&bufqspin);
 		lwkt_yield();
-		spun = 0;
 
+		/*
+		 * This is a bit messy
+		 */
 		if (LIST_FIRST(&bp->b_dep) != NULL &&
 		    (bp->b_flags & B_DEFERRED) == 0 &&
 		    buf_countdeps(bp, 0)) {
 			spin_lock(&bufqspin);
-			spun = 1;
-			TAILQ_REMOVE(&bufqueues[q], bp, b_freelist);
 			TAILQ_INSERT_TAIL(&bufqueues[q], bp, b_freelist);
+			bp->b_qindex = q;
 			bp->b_flags |= B_DEFERRED;
+			spin_unlock(&bufqspin);
 			BUF_UNLOCK(bp);
-			bp = TAILQ_FIRST(&bufqueues[q]);
+			spin_lock(&bufqspin);
+			bp = marker;
 			continue;
 		}
 
 		/*
+		 * spinlock not held here.
+		 *
 		 * If the buffer has a dependancy, buf_checkwrite() must
 		 * also return 0 for us to be able to initate the write.
 		 *
@@ -2583,7 +2633,6 @@ flushbufqueues(bufq_type_t q)
 		 *
 		 * NOTE: buf_checkwrite is MPSAFE.
 		 */
-		bremfree(bp);
 		if (LIST_FIRST(&bp->b_dep) != NULL && buf_checkwrite(bp)) {
 			brelse(bp);
 		} else if (bp->b_flags & B_ERROR) {
@@ -2594,11 +2643,14 @@ flushbufqueues(bufq_type_t q)
 			bp->b_flags |= B_AGE;
 			cluster_awrite(bp);
 		}
+		spin_lock(&bufqspin);
 		++r;
 		break;
 	}
-	if (spun)
-		spin_unlock(&bufqspin);
+	TAILQ_REMOVE(&bufqueues[q], marker, b_freelist);
+	marker->b_qindex = BQUEUE_NONE;
+	spin_unlock(&bufqspin);
+
 	return (r);
 }
 
@@ -3000,7 +3052,7 @@ loop:
 		if ((bp->b_flags & (B_CACHE|B_DELWRI)) == B_DELWRI) {
 			kprintf("getblk: Warning, bp %p loff=%jx DELWRI set "
 				"and CACHE clear, b_flags %08x\n",
-				bp, (intmax_t)bp->b_loffset, bp->b_flags);
+				bp, (uintmax_t)bp->b_loffset, bp->b_flags);
 			bp->b_flags |= B_NOCACHE;
 			bwrite(bp);
 			goto loop;
@@ -4130,7 +4182,7 @@ retry:
 				kprintf("Warning: vfs_busy_pages - page not "
 					"fully valid! loff=%jx bpf=%08x "
 					"idx=%d val=%02x dir=%02x\n",
-					(intmax_t)bp->b_loffset, bp->b_flags,
+					(uintmax_t)bp->b_loffset, bp->b_flags,
 					i, m->valid, m->dirty);
 				vm_page_protect(m, VM_PROT_NONE);
 			} else {
@@ -4252,14 +4304,14 @@ vfs_clean_one_page(struct buf *bp, int pageno, vm_page_t m)
 		if ((bp->b_flags & B_NEEDCOMMIT) &&
 		    (m->dirty & vm_page_bits(soff & PAGE_MASK, eoff - soff))) {
 			if (debug_commit)
-			kprintf("Warning: vfs_clean_one_page: bp %p "
-				"loff=%jx,%d flgs=%08x clr B_NEEDCOMMIT"
-				" cmd %d vd %02x/%02x x/s/e %d %d %d "
-				"doff/end %d %d\n",
-				bp, (intmax_t)bp->b_loffset, bp->b_bcount,
-				bp->b_flags, bp->b_cmd,
-				m->valid, m->dirty, xoff, soff, eoff,
-				bp->b_dirtyoff, bp->b_dirtyend);
+				kprintf("Warning: vfs_clean_one_page: bp %p "
+				    "loff=%jx,%d flgs=%08x clr B_NEEDCOMMIT"
+				    " cmd %d vd %02x/%02x x/s/e %d %d %d "
+				    "doff/end %d %d\n",
+				    bp, (uintmax_t)bp->b_loffset, bp->b_bcount,
+				    bp->b_flags, bp->b_cmd,
+				    m->valid, m->dirty, xoff, soff, eoff,
+				    bp->b_dirtyoff, bp->b_dirtyend);
 			bp->b_flags &= ~(B_NEEDCOMMIT | B_CLUSTEROK);
 			if (debug_commit)
 				print_backtrace(-1);
@@ -4861,6 +4913,8 @@ vfs_bufstats(void)
 
 		spin_lock(&bufqspin);
                 TAILQ_FOREACH(bp, dp, b_freelist) {
+			if (bp->b_flags & B_MARKER)
+				continue;
                         counts[bp->b_bufsize/PAGE_SIZE]++;
                         count++;
                 }
diff --git a/sys/kern/vfs_cluster.c b/sys/kern/vfs_cluster.c
index 2f11de765a..3e02dc45bb 100644
--- a/sys/kern/vfs_cluster.c
+++ b/sys/kern/vfs_cluster.c
@@ -82,6 +82,9 @@ static int cluster_wbuild(struct vnode *vp, struct buf **bpp, int blksize,
 static int write_behind = 1;
 SYSCTL_INT(_vfs, OID_AUTO, write_behind, CTLFLAG_RW, &write_behind, 0,
     "Cluster write-behind setting");
+static quad_t write_behind_minfilesize = 10 * 1024 * 1024;
+SYSCTL_QUAD(_vfs, OID_AUTO, write_behind_minfilesize, CTLFLAG_RW,
+    &write_behind_minfilesize, 0, "Cluster write-behind setting");
 static int max_readahead = 2 * 1024 * 1024;
 SYSCTL_INT(_vfs, OID_AUTO, max_readahead, CTLFLAG_RW, &max_readahead, 0,
     "Limit in bytes for desired cluster read-ahead");
@@ -665,15 +668,16 @@ cluster_callback(struct bio *bio)
 }
 
 /*
- *	cluster_wbuild_wb:
+ * Implement modified write build for cluster.
  *
- *	Implement modified write build for cluster.
+ * 	write_behind = 0	write behind disabled
+ *	write_behind = 1	write behind normal (default)
+ *	write_behind = 2	write behind backed-off
  *
- *		write_behind = 0	write behind disabled
- *		write_behind = 1	write behind normal (default)
- *		write_behind = 2	write behind backed-off
+ * In addition, write_behind is only activated for files that have
+ * grown past a certain size (default 10MB).  Otherwise temporary files
+ * wind up generating a lot of unnecessary disk I/O.
  */
-
 static __inline int
 cluster_wbuild_wb(struct vnode *vp, int blksize, off_t start_loffset, int len)
 {
@@ -686,7 +690,10 @@ cluster_wbuild_wb(struct vnode *vp, int blksize, off_t start_loffset, int len)
 		start_loffset -= len;
 		/* fall through */
 	case 1:
-		r = cluster_wbuild(vp, NULL, blksize, start_loffset, len);
+		if (vp->v_filesize >= write_behind_minfilesize) {
+			r = cluster_wbuild(vp, NULL, blksize,
+					   start_loffset, len);
+		}
 		/* fall through */
 	default:
 		/* fall through */
diff --git a/sys/kern/vfs_conf.c b/sys/kern/vfs_conf.c
index de66f640c6..d0d33de41f 100644
--- a/sys/kern/vfs_conf.c
+++ b/sys/kern/vfs_conf.c
@@ -604,7 +604,7 @@ kgetdiskbyname(const char *name)
 	/*
 	 * Locate the device
 	 */
-	rdev = devfs_find_device_by_name(name);
+	rdev = devfs_find_device_by_name("%s", name);
 	if (rdev == NULL) {
 		kprintf("no disk named '%s'\n", name);
 	}
diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c
index f0a9cdd741..6810003dfe 100644
--- a/sys/kern/vfs_mount.c
+++ b/sys/kern/vfs_mount.c
@@ -92,7 +92,6 @@
 #include 
 #include 
 #include 
-#include 
 
 #include 
 #include 
@@ -337,7 +336,7 @@ mount_init(struct mount *mp)
 	TAILQ_INIT(&mp->mnt_jlist);
 	mp->mnt_nvnodelistsize = 0;
 	mp->mnt_flag = 0;
-	mp->mnt_iosize_max = DFLTPHYS;
+	mp->mnt_iosize_max = MAXPHYS;
 }
 
 /*
@@ -706,9 +705,6 @@ vnlru_proc(void)
 	EVENTHANDLER_REGISTER(shutdown_pre_sync, shutdown_kproc, td,
 			      SHUTDOWN_PRI_FIRST);
 
-	get_mplock();
-	crit_enter();
-
 	for (;;) {
 		kproc_suspend_loop();
 
@@ -770,9 +766,6 @@ vnlru_proc(void)
 			vnlru_nowhere = 0;
 		}
 	}
-
-	crit_exit();
-	rel_mplock();
 }
 
 /*
diff --git a/sys/kern/vfs_subr.c b/sys/kern/vfs_subr.c
index ec42fe6f2d..ca17cfe1e8 100644
--- a/sys/kern/vfs_subr.c
+++ b/sys/kern/vfs_subr.c
@@ -1366,15 +1366,23 @@ vrecycle(struct vnode *vp)
  *
  * If vp is VCHR or VBLK we dive the device, otherwise we use
  * the vp's mount info.
+ *
+ * The returned value is clamped at MAXPHYS as most callers cannot use
+ * buffers larger than that size.
  */
 int
 vmaxiosize(struct vnode *vp)
 {
-	if (vp->v_type == VBLK || vp->v_type == VCHR) {
-		return(vp->v_rdev->si_iosize_max);
-	} else {
-		return(vp->v_mount->mnt_iosize_max);
-	}
+	int maxiosize;
+
+	if (vp->v_type == VBLK || vp->v_type == VCHR)
+		maxiosize = vp->v_rdev->si_iosize_max;
+	else
+		maxiosize = vp->v_mount->mnt_iosize_max;
+
+	if (maxiosize > MAXPHYS)
+		maxiosize = MAXPHYS;
+	return (maxiosize);
 }
 
 /*
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 06ce36a490..32358bd8d6 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -3404,9 +3404,9 @@ kern_truncate(struct nlookupdata *nd, off_t length)
 	struct vnode *vp;
 	struct vattr vattr;
 	int error;
-	uid_t uid;
-	gid_t gid;
-	uint64_t old_size;
+	uid_t uid = 0;
+	gid_t gid = 0;
+	uint64_t old_size = 0;
 
 	if (length < 0)
 		return(EINVAL);
@@ -3425,11 +3425,13 @@ kern_truncate(struct nlookupdata *nd, off_t length)
 		error = EISDIR;
 		goto done;
 	}
-	error = VOP_GETATTR(vp, &vattr);
-	KASSERT(error == 0, ("kern_truncate(): VOP_GETATTR didn't return 0"));
-	uid = vattr.va_uid;
-	gid = vattr.va_gid;
-	old_size = vattr.va_size;
+	if (vfs_accounting_enabled) {
+		error = VOP_GETATTR(vp, &vattr);
+		KASSERT(error == 0, ("kern_truncate(): VOP_GETATTR didn't return 0"));
+		uid = vattr.va_uid;
+		gid = vattr.va_gid;
+		old_size = vattr.va_size;
+	}
 
 	if ((error = vn_writechk(vp, &nd->nl_nch)) == 0) {
 		VATTR_NULL(&vattr);
@@ -3469,9 +3471,10 @@ kern_ftruncate(int fd, off_t length)
 	struct vnode *vp;
 	struct file *fp;
 	int error;
-	uid_t uid;
-	gid_t gid;
-	uint64_t old_size;
+	uid_t uid = 0;
+	gid_t gid = 0;
+	uint64_t old_size = 0;
+	struct mount *mp;
 
 	if (length < 0)
 		return(EINVAL);
@@ -3497,17 +3500,20 @@ kern_ftruncate(int fd, off_t length)
 		goto done;
 	}
 
-	error = VOP_GETATTR(vp, &vattr);
-	KASSERT(error == 0, ("kern_ftruncate(): VOP_GETATTR didn't return 0"));
-	uid = vattr.va_uid;
-	gid = vattr.va_gid;
-	old_size = vattr.va_size;
+	if (vfs_accounting_enabled) {
+		error = VOP_GETATTR(vp, &vattr);
+		KASSERT(error == 0, ("kern_ftruncate(): VOP_GETATTR didn't return 0"));
+		uid = vattr.va_uid;
+		gid = vattr.va_gid;
+		old_size = vattr.va_size;
+	}
 
 	if ((error = vn_writechk(vp, NULL)) == 0) {
 		VATTR_NULL(&vattr);
 		vattr.va_size = length;
 		error = VOP_SETATTR(vp, &vattr, fp->f_cred);
-		VFS_ACCOUNT(p->p_fd->fd_ncdir.mount, uid, gid, length - old_size);
+		mp = vq_vptomp(vp);
+		VFS_ACCOUNT(mp, uid, gid, length - old_size);
 	}
 	vn_unlock(vp);
 done:
diff --git a/sys/kern/vfs_vopops.c b/sys/kern/vfs_vopops.c
index 9aa5b6f5cb..8343d9aac9 100644
--- a/sys/kern/vfs_vopops.c
+++ b/sys/kern/vfs_vopops.c
@@ -429,10 +429,12 @@ vop_write(struct vop_ops *ops, struct vnode *vp, struct uio *uio, int ioflag,
 
 	/* is this a regular vnode ? */
 	if ((vp->v_type == VREG) && vfs_accounting_enabled) {
-		do_accounting = 1;
 		if ((error = VOP_GETATTR(vp, &va)) != 0)
 			return (error);
 		size_before = va.va_size;
+		/* this file may already have been removed */
+		if (va.va_nlink > 0)
+			do_accounting = 1;
 	}
 
 	VFS_MPLOCK_FLAG(vp->v_mount, MNTK_WR_MPSAFE);
diff --git a/sys/net/altq/altq_hfsc.c b/sys/net/altq/altq_hfsc.c
index 9b34a96e02..2c3d69a643 100644
--- a/sys/net/altq/altq_hfsc.c
+++ b/sys/net/altq/altq_hfsc.c
@@ -450,15 +450,11 @@ hfsc_class_create(struct hfsc_if *hif, struct service_curve *rsc,
 	}
 	if (fsc != NULL && (fsc->m1 != 0 || fsc->m2 != 0)) {
 		cl->cl_fsc = kmalloc(sizeof(*cl->cl_fsc), M_ALTQ, M_WAITOK);
-		if (cl->cl_fsc == NULL)
-			goto err_ret;
 		sc2isc(fsc, cl->cl_fsc);
 		rtsc_init(&cl->cl_virtual, cl->cl_fsc, 0, 0);
 	}
 	if (usc != NULL && (usc->m1 != 0 || usc->m2 != 0)) {
 		cl->cl_usc = kmalloc(sizeof(*cl->cl_usc), M_ALTQ, M_WAITOK);
-		if (cl->cl_usc == NULL)
-			goto err_ret;
 		sc2isc(usc, cl->cl_usc);
 		rtsc_init(&cl->cl_ulimit, cl->cl_usc, 0, 0);
 	}
diff --git a/sys/net/if_ethersubr.c b/sys/net/if_ethersubr.c
index 6b198087a6..0bd6b78762 100644
--- a/sys/net/if_ethersubr.c
+++ b/sys/net/if_ethersubr.c
@@ -335,6 +335,9 @@ ether_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
 #ifdef CARP
 	if (ifp->if_type == IFT_CARP) {
 		ifp = carp_parent(ifp);
+		if (ifp == NULL)
+			gotoerr(ENETUNREACH);
+
 		ac = IFP2AC(ifp);
 
 		/*
@@ -1229,6 +1232,10 @@ post_stats:
 static void
 ether_input_oncpu(struct ifnet *ifp, struct mbuf *m)
 {
+#ifdef CARP
+	void *carp;
+#endif
+
 	if ((ifp->if_flags & (IFF_UP | IFF_MONITOR)) != IFF_UP) {
 		/*
 		 * Receiving interface's flags are changed, when this
@@ -1262,21 +1269,13 @@ ether_input_oncpu(struct ifnet *ifp, struct mbuf *m)
 	}
 
 #ifdef CARP
-	if (ifp->if_carp) {
-		/*
-		 * Hold CARP token and recheck ifp->if_carp
-		 */
-		carp_gettok();
-		if (ifp->if_carp) {
-			m = carp_input(ifp->if_carp, m);
-			if (m == NULL) {
-				carp_reltok();
-				return;
-			}
-			KASSERT(ifp == m->m_pkthdr.rcvif,
-				("carp_input changed rcvif\n"));
-		}
-		carp_reltok();
+	carp = ifp->if_carp;
+	if (carp) {
+		m = carp_input(carp, m);
+		if (m == NULL)
+			return;
+		KASSERT(ifp == m->m_pkthdr.rcvif,
+		    ("carp_input changed rcvif\n"));
 	}
 #endif
 
diff --git a/sys/net/if_var.h b/sys/net/if_var.h
index a8263b3f72..8eed43f409 100644
--- a/sys/net/if_var.h
+++ b/sys/net/if_var.h
@@ -280,12 +280,7 @@ struct ifnet {
 	int	if_cpuid;
 	struct netmsg_base *if_start_nmsg; /* percpu msgs to sched if_start */
 	void	*if_pf_kif; /* pf interface abstraction */
- 	union {
- 		void *carp_s;		/* carp structure (used by !carp ifs) */
- 		struct ifnet *carp_d;	/* ptr to carpdev (used by carp ifs) */
- 	} if_carp_ptr;
-	#define if_carp		if_carp_ptr.carp_s
-	#define if_carpdev	if_carp_ptr.carp_d
+	void	*if_unused;
 };
 typedef void if_init_f_t (void *);
 
diff --git a/sys/net/pf/pf.c b/sys/net/pf/pf.c
index 70898e2821..3114fc040b 100644
--- a/sys/net/pf/pf.c
+++ b/sys/net/pf/pf.c
@@ -5907,9 +5907,11 @@ pf_test(int dir, struct ifnet *ifp, struct mbuf **m0,
 		return (PF_PASS);
 
 	memset(&pd, 0, sizeof(pd));
+#ifdef foo
 	if (ifp->if_type == IFT_CARP && ifp->if_carpdev)
 		kif = (struct pfi_kif *)ifp->if_carpdev->if_pf_kif;
 	else
+#endif
 		kif = (struct pfi_kif *)ifp->if_pf_kif;
 
 	if (kif == NULL) {
@@ -6222,9 +6224,11 @@ pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0,
 		return (PF_PASS);
 
 	memset(&pd, 0, sizeof(pd));
+#ifdef foo
 	if (ifp->if_type == IFT_CARP && ifp->if_carpdev)
 		kif = (struct pfi_kif *)ifp->if_carpdev->if_pf_kif;
 	else
+#endif
 		kif = (struct pfi_kif *)ifp->if_pf_kif;
 
 	if (kif == NULL) {
diff --git a/sys/net/pf/pf_ioctl.c b/sys/net/pf/pf_ioctl.c
index 8fb6914ebd..b74fb192ba 100644
--- a/sys/net/pf/pf_ioctl.c
+++ b/sys/net/pf/pf_ioctl.c
@@ -908,9 +908,6 @@ pf_setup_pfsync_matching(struct pf_ruleset *rs)
 			    kmalloc(sizeof(caddr_t) *
 				    rs->rules[rs_cnt].inactive.rcount,
 				    M_TEMP, M_WAITOK);
-
-			if (!rs->rules[rs_cnt].inactive.ptr_array)
-				return (ENOMEM);
 		}
 
 		TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr,
diff --git a/sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c b/sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c
index 904f777758..a226effd5f 100644
--- a/sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c
+++ b/sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c
@@ -29,7 +29,6 @@
  *
  * $Id: ng_l2cap_evnt.c,v 1.5 2003/09/08 19:11:45 max Exp $
  * $FreeBSD: src/sys/netgraph/bluetooth/l2cap/ng_l2cap_evnt.c,v 1.8 2005/01/07 01:45:43 imp Exp $
- * $DragonFly: src/sys/netgraph7/bluetooth/l2cap/ng_l2cap_evnt.c,v 1.2 2008/06/26 23:05:40 dillon Exp $
  */
 
 #include 
@@ -1179,7 +1178,7 @@ send_l2cap_reject(ng_l2cap_con_p con, u_int8_t ident, u_int16_t reason,
 	if (cmd == NULL)
 		return (ENOMEM);
 
-	 _ng_l2cap_cmd_rej(cmd->aux, cmd->ident, reason, mtu, scid, dcid);
+	_ng_l2cap_cmd_rej(cmd->aux, cmd->ident, reason, mtu, scid, dcid);
 	if (cmd->aux == NULL) {
 		ng_l2cap_free_cmd(cmd);
 
diff --git a/sys/netgraph7/netflow/netflow.c b/sys/netgraph7/netflow/netflow.c
index 70f68cff3d..9741951d00 100644
--- a/sys/netgraph7/netflow/netflow.c
+++ b/sys/netgraph7/netflow/netflow.c
@@ -26,7 +26,6 @@
  *
  * $SourceForge: netflow.c,v 1.41 2004/09/05 11:41:10 glebius Exp $
  * $FreeBSD: src/sys/netgraph/netflow/netflow.c,v 1.29 2008/05/09 23:02:57 julian Exp $
- * $DragonFly: src/sys/netgraph7/netflow/netflow.c,v 1.2 2008/06/26 23:05:40 dillon Exp $
  */
 
 #include 
@@ -333,11 +332,6 @@ ng_netflow_cache_init(priv_p priv)
 	priv->hash = kmalloc(NBUCKETS * sizeof(struct flow_hash_entry),
 			     M_NETFLOW_HASH, M_WAITOK | M_ZERO);
 
-	if (priv->hash == NULL) {
-		uma_zdestroy(priv->zone);
-		return (ENOMEM);
-	}
-
 	/* Initialize hash. */
 	for (i = 0, hsh = priv->hash; i < NBUCKETS; i++, hsh++) {
 		mtx_init(&hsh->mtx, "hash mutex", NULL, MTX_DEF);
diff --git a/sys/netgraph7/netgraph/ng_base.c b/sys/netgraph7/netgraph/ng_base.c
index c3208f8d47..acf5f0413b 100644
--- a/sys/netgraph7/netgraph/ng_base.c
+++ b/sys/netgraph7/netgraph/ng_base.c
@@ -39,7 +39,6 @@
  *          Archie Cobbs 
  *
  * $FreeBSD: src/sys/netgraph/ng_base.c,v 1.159 2008/04/19 05:30:49 mav Exp $
- * $DragonFly: src/sys/netgraph7/ng_base.c,v 1.4 2008/09/24 14:26:39 sephe Exp $
  * $Whistle: ng_base.c,v 1.39 1999/01/28 23:54:53 julian Exp $
  */
 
@@ -2400,7 +2399,7 @@ ng_apply_item(node_p node, item_p item, int rw)
 	if (hook)
 		NG_HOOK_UNREF(hook);
 
- 	if (rw == NGQRW_R)
+	if (rw == NGQRW_R)
 		ng_leave_read(node);
 	else
 		ng_leave_write(node);
diff --git a/sys/netgraph7/ng_device.c b/sys/netgraph7/ng_device.c
index 58f7487154..502a1fe419 100644
--- a/sys/netgraph7/ng_device.c
+++ b/sys/netgraph7/ng_device.c
@@ -28,7 +28,6 @@
  * netgraph node.
  *
  * $FreeBSD: src/sys/netgraph/ng_device.c,v 1.22 2006/11/02 17:37:21 andre Exp $
- * $DragonFly: src/sys/netgraph7/ng_device.c,v 1.2 2008/06/26 23:05:35 dillon Exp $
  *
  */
 
@@ -164,8 +163,6 @@ ng_device_constructor(node_p node)
 	DBG;
 
 	priv = kmalloc(sizeof(*priv), M_NETGRAPH, M_WAITOK | M_ZERO);
-	if (priv == NULL)
-		return (ENOMEM);
 
 	/* Allocate unit number */
 	priv->unit = alloc_unr(ngd_unit);
diff --git a/sys/netgraph7/ng_tty.c b/sys/netgraph7/ng_tty.c
index fc4beebb63..16523f125a 100644
--- a/sys/netgraph7/ng_tty.c
+++ b/sys/netgraph7/ng_tty.c
@@ -38,7 +38,6 @@
  * Author: Archie Cobbs 
  *
  * $FreeBSD: src/sys/netgraph/ng_tty.c,v 1.37 2006/11/06 13:42:03 rwatson Exp $
- * $DragonFly: src/sys/netgraph7/ng_tty.c,v 1.2 2008/06/26 23:05:35 dillon Exp $
  * $Whistle: ng_tty.c,v 1.21 1999/11/01 09:24:52 julian Exp $
  */
 
@@ -196,8 +195,6 @@ ngt_open(struct cdev *dev, struct tty *tp)
 
 	/* Initialize private struct */
 	sc = kmalloc(sizeof(*sc), M_NETGRAPH, M_WAITOK | M_ZERO);
-	if (sc == NULL)
-		return (ENOMEM);
 
 	lwkt_gettoken(&tty_token);
 	sc->tp = tp;
diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c
index c60ec8e068..e712a25844 100644
--- a/sys/netinet/if_ether.c
+++ b/sys/netinet/if_ether.c
@@ -894,12 +894,10 @@ in_arpinput(struct mbuf *m)
 		if (ia->ia_ifp->if_type != IFT_CARP)
 			continue;
 
-		carp_gettok();
 		if (carp_parent(ia->ia_ifp) == ifp)
 			is_parent = 1;
 		if (is_parent || ia->ia_ifp == ifp)
 			is_match = carp_iamatch(ia);
-		carp_reltok();
 
 		if (is_match) {
 			if (is_parent) {
diff --git a/sys/netinet/ip_carp.c b/sys/netinet/ip_carp.c
index 764c1a8512..88b841f0bc 100644
--- a/sys/netinet/ip_carp.c
+++ b/sys/netinet/ip_carp.c
@@ -60,6 +60,7 @@
 #include 
 #include 
 #include 
+#include 
 
 #ifdef INET
 #include 
@@ -84,6 +85,8 @@
 #define CARP_IS_RUNNING(ifp)	\
 	(((ifp)->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
 
+struct carp_softc;
+
 struct carp_vhaddr {
 	uint32_t		vha_flags;	/* CARP_VHAF_ */
 	struct in_ifaddr	*vha_ia;	/* carp address */
@@ -92,6 +95,14 @@ struct carp_vhaddr {
 };
 TAILQ_HEAD(carp_vhaddr_list, carp_vhaddr);
 
+struct netmsg_carp {
+	struct netmsg_base	base;
+	struct ifnet		*nc_carpdev;
+	struct carp_softc	*nc_softc;
+	void			*nc_data;
+	size_t			nc_datalen;
+};
+
 struct carp_softc {
 	struct arpcom		 arpcom;
 	struct ifnet		*sc_carpdev;	/* parent interface */
@@ -104,7 +115,6 @@ struct carp_softc {
 	struct in6_ifaddr 	*sc_ia6;	/* primary iface address v6 */
 	struct ip6_moptions 	 sc_im6o;
 #endif /* INET6 */
-	TAILQ_ENTRY(carp_softc)	 sc_list;
 
 	enum { INIT = 0, BACKUP, MASTER }
 				 sc_state;
@@ -132,19 +142,21 @@ struct carp_softc {
 	SHA1_CTX		 sc_sha1;
 
 	struct callout		 sc_ad_tmo;	/* advertisement timeout */
-	struct callout		 sc_md_tmo;	/* master down timeout */
-	struct callout 		 sc_md6_tmo;	/* master down timeout */
+	struct netmsg_carp	 sc_ad_msg;	/* adv timeout netmsg */
+	struct callout		 sc_md_tmo;	/* ip4 master down timeout */
+	struct callout 		 sc_md6_tmo;	/* ip6 master down timeout */
+	struct netmsg_carp	 sc_md_msg;	/* master down timeout netmsg */
 
 	LIST_ENTRY(carp_softc)	 sc_next;	/* Interface clue */
 };
 
 #define sc_if	arpcom.ac_if
 
-struct carp_if {
-	TAILQ_HEAD(, carp_softc) vhif_vrs;
+struct carp_softc_container {
+	TAILQ_ENTRY(carp_softc_container) scc_link;
+	struct carp_softc	*scc_softc;
 };
-
-enum	{ CARP_COUNT_MASTER, CARP_COUNT_RUNNING };
+TAILQ_HEAD(carp_if, carp_softc_container);
 
 SYSCTL_DECL(_net_inet_carp);
 
@@ -177,7 +189,7 @@ SYSCTL_STRUCT(_net_inet_carp, CARPCTL_STATS, stats, CTLFLAG_RW,
 		log(LOG_DEBUG, __VA_ARGS__);		\
 } while (0)
 
-static struct lwkt_token carp_tok = LWKT_TOKEN_INITIALIZER(carp_token);
+static struct lwkt_token carp_listtok = LWKT_TOKEN_INITIALIZER(carp_list_token);
 
 static void	carp_hmac_prepare(struct carp_softc *);
 static void	carp_hmac_generate(struct carp_softc *, uint32_t *,
@@ -224,7 +236,6 @@ static void	carp_unlink_addrs(struct carp_softc *, struct ifnet *,
 		    struct ifaddr *);
 static void	carp_update_addrs(struct carp_softc *, struct ifaddr *);
 
-static int	carp_get_vhaddr(struct carp_softc *, struct ifdrv *);
 static int	carp_config_vhaddr(struct carp_softc *, struct carp_vhaddr *,
 		    struct in_ifaddr *);
 static int	carp_activate_vhaddr(struct carp_softc *, struct carp_vhaddr *,
@@ -235,7 +246,9 @@ static int	carp_addroute_vhaddr(struct carp_softc *, struct carp_vhaddr *);
 static void	carp_delroute_vhaddr(struct carp_softc *, struct carp_vhaddr *,
 		    boolean_t);
 
+#ifdef foo
 static void	carp_sc_state(struct carp_softc *);
+#endif
 #ifdef INET6
 static void	carp_send_na(struct carp_softc *);
 #ifdef notyet
@@ -246,11 +259,31 @@ static void	carp_multicast6_cleanup(struct carp_softc *);
 #endif
 static void	carp_stop(struct carp_softc *, int);
 static void	carp_suspend(struct carp_softc *, int);
+static void	carp_ioctl_stop(struct carp_softc *);
+static int	carp_ioctl_setvh(struct carp_softc *, void *, struct ucred *);
+static int	carp_ioctl_getvh(struct carp_softc *, void *, struct ucred *);
+static int	carp_ioctl_getdevname(struct carp_softc *, struct ifdrv *);
+static int	carp_ioctl_getvhaddr(struct carp_softc *, struct ifdrv *);
+
+static struct carp_if *carp_if_remove(struct carp_if *, struct carp_softc *);
+static struct carp_if *carp_if_insert(struct carp_if *, struct carp_softc *);
+static void	carp_if_free(struct carp_if *);
 
 static void	carp_ifaddr(void *, struct ifnet *, enum ifaddr_event,
 			    struct ifaddr *);
 static void	carp_ifdetach(void *, struct ifnet *);
 
+static void	carp_ifdetach_dispatch(netmsg_t);
+static void	carp_clone_destroy_dispatch(netmsg_t);
+static void	carp_init_dispatch(netmsg_t);
+static void	carp_ioctl_stop_dispatch(netmsg_t);
+static void	carp_ioctl_setvh_dispatch(netmsg_t);
+static void	carp_ioctl_getvh_dispatch(netmsg_t);
+static void	carp_ioctl_getdevname_dispatch(netmsg_t);
+static void	carp_ioctl_getvhaddr_dispatch(netmsg_t);
+static void	carp_send_ad_timeout_dispatch(netmsg_t);
+static void	carp_master_down_timeout_dispatch(netmsg_t);
+
 static MALLOC_DEFINE(M_CARP, "CARP", "CARP interfaces");
 
 static LIST_HEAD(, carp_softc) carpif_list;
@@ -436,8 +469,15 @@ carp_clone_create(struct if_clone *ifc, int unit, caddr_t param __unused)
 #endif
 
 	callout_init_mp(&sc->sc_ad_tmo);
+	netmsg_init(&sc->sc_ad_msg.base, NULL, &netisr_adone_rport,
+	    MSGF_DROPABLE | MSGF_PRIORITY, carp_send_ad_timeout_dispatch);
+	sc->sc_ad_msg.nc_softc = sc;
+
 	callout_init_mp(&sc->sc_md_tmo);
 	callout_init_mp(&sc->sc_md6_tmo);
+	netmsg_init(&sc->sc_md_msg.base, NULL, &netisr_adone_rport,
+	    MSGF_DROPABLE | MSGF_PRIORITY, carp_master_down_timeout_dispatch);
+	sc->sc_md_msg.nc_softc = sc;
 
 	if_initname(ifp, CARP_IFNAME, unit);
 	ifp->if_softc = sc;
@@ -459,25 +499,52 @@ carp_clone_create(struct if_clone *ifc, int unit, caddr_t param __unused)
 	ifp->if_type = IFT_CARP;
 	ifp->if_output = carp_output;
 
-	carp_gettok();
+	lwkt_gettoken(&carp_listtok);
 	LIST_INSERT_HEAD(&carpif_list, sc, sc_next);
-	carp_reltok();
+	lwkt_reltoken(&carp_listtok);
 
 	return (0);
 }
 
+static void
+carp_clone_destroy_dispatch(netmsg_t msg)
+{
+	struct netmsg_carp *cmsg = (struct netmsg_carp *)msg;
+	struct carp_softc *sc = cmsg->nc_softc;
+
+	sc->sc_dead = 1;
+	carp_detach(sc, 1, FALSE);
+
+	callout_stop_sync(&sc->sc_ad_tmo);
+	callout_stop_sync(&sc->sc_md_tmo);
+	callout_stop_sync(&sc->sc_md6_tmo);
+
+	crit_enter();
+	if ((sc->sc_ad_msg.base.lmsg.ms_flags & MSGF_DONE) == 0)
+		lwkt_dropmsg(&sc->sc_ad_msg.base.lmsg);
+	if ((sc->sc_md_msg.base.lmsg.ms_flags & MSGF_DONE) == 0)
+		lwkt_dropmsg(&sc->sc_md_msg.base.lmsg);
+	crit_exit();
+
+	lwkt_replymsg(&cmsg->base.lmsg, 0);
+}
+
 static int
 carp_clone_destroy(struct ifnet *ifp)
 {
 	struct carp_softc *sc = ifp->if_softc;
+	struct netmsg_carp cmsg;
 
-	carp_gettok();
+	bzero(&cmsg, sizeof(cmsg));
+	netmsg_init(&cmsg.base, NULL, &curthread->td_msgport, 0,
+	    carp_clone_destroy_dispatch);
+	cmsg.nc_softc = sc;
 
-	sc->sc_dead = 1;
-	carp_detach(sc, 1, FALSE);
-	LIST_REMOVE(sc, sc_next);
+	lwkt_domsg(cpu_portfn(0), &cmsg.base.lmsg, 0);
 
-	carp_reltok();
+	lwkt_gettoken(&carp_listtok);
+	LIST_REMOVE(sc, sc_next);
+	lwkt_reltoken(&carp_listtok);
 
 	bpfdetach(ifp);
 	if_detach(ifp);
@@ -488,11 +555,119 @@ carp_clone_destroy(struct ifnet *ifp)
 	return 0;
 }
 
-static void
-carp_detach(struct carp_softc *sc, int detach, boolean_t del_iaback)
+static struct carp_if *
+carp_if_remove(struct carp_if *ocif, struct carp_softc *sc)
 {
+	struct carp_softc_container *oscc, *scc;
 	struct carp_if *cif;
+	int count = 0;
+#ifdef INVARIANTS
+	int found = 0;
+#endif
 
+	TAILQ_FOREACH(oscc, ocif, scc_link) {
+		++count;
+#ifdef INVARIANTS
+		if (oscc->scc_softc == sc)
+			found = 1;
+#endif
+	}
+	KASSERT(found, ("%s carp_softc is not on carp_if\n", __func__));
+
+	if (count == 1) {
+		/* Last one is going to be unlinked */
+		return NULL;
+	}
+
+	cif = kmalloc(sizeof(*cif), M_CARP, M_WAITOK | M_ZERO);
+	TAILQ_INIT(cif);
+
+	TAILQ_FOREACH(oscc, ocif, scc_link) {
+		if (oscc->scc_softc == sc)
+			continue;
+
+		scc = kmalloc(sizeof(*scc), M_CARP, M_WAITOK | M_ZERO);
+		scc->scc_softc = oscc->scc_softc;
+		TAILQ_INSERT_TAIL(cif, scc, scc_link);
+	}
+
+	return cif;
+}
+
+static struct carp_if *
+carp_if_insert(struct carp_if *ocif, struct carp_softc *sc)
+{
+	struct carp_softc_container *oscc;
+	int onlist;
+
+	onlist = 0;
+	if (ocif != NULL) {
+		TAILQ_FOREACH(oscc, ocif, scc_link) {
+			if (oscc->scc_softc == sc)
+				onlist = 1;
+		}
+	}
+
+#ifdef INVARIANTS
+	if (sc->sc_carpdev != NULL) {
+		KASSERT(onlist, ("%s is not on %s carp list\n",
+		    sc->sc_if.if_xname, sc->sc_carpdev->if_xname));
+	} else {
+		KASSERT(!onlist, ("%s is already on carp list\n",
+		    sc->sc_if.if_xname));
+	}
+#endif
+
+	if (!onlist) {
+		struct carp_if *cif;
+		struct carp_softc_container *new_scc, *scc;
+		int inserted = 0;
+
+		cif = kmalloc(sizeof(*cif), M_CARP, M_WAITOK | M_ZERO);
+		TAILQ_INIT(cif);
+
+		new_scc = kmalloc(sizeof(*new_scc), M_CARP, M_WAITOK | M_ZERO);
+		new_scc->scc_softc = sc;
+
+		if (ocif != NULL) {
+			TAILQ_FOREACH(oscc, ocif, scc_link) {
+				if (!inserted &&
+				    oscc->scc_softc->sc_vhid > sc->sc_vhid) {
+					TAILQ_INSERT_TAIL(cif, new_scc,
+					    scc_link);
+					inserted = 1;
+				}
+
+				scc = kmalloc(sizeof(*scc), M_CARP,
+				    M_WAITOK | M_ZERO);
+				scc->scc_softc = oscc->scc_softc;
+				TAILQ_INSERT_TAIL(cif, scc, scc_link);
+			}
+		}
+		if (!inserted)
+			TAILQ_INSERT_TAIL(cif, new_scc, scc_link);
+
+		return cif;
+	} else {
+		return ocif;
+	}
+}
+
+static void
+carp_if_free(struct carp_if *cif)
+{
+	struct carp_softc_container *scc;
+
+	while ((scc = TAILQ_FIRST(cif)) != NULL) {
+		TAILQ_REMOVE(cif, scc, scc_link);
+		kfree(scc, M_CARP);
+	}
+	kfree(cif, M_CARP);
+}
+
+static void
+carp_detach(struct carp_softc *sc, int detach, boolean_t del_iaback)
+{
 	carp_suspend(sc, detach);
 
 	carp_multicast_cleanup(sc);
@@ -509,32 +684,68 @@ carp_detach(struct carp_softc *sc, int detach, boolean_t del_iaback)
 	}
 
 	if (sc->sc_carpdev != NULL) {
-		cif = sc->sc_carpdev->if_carp;
-		TAILQ_REMOVE(&cif->vhif_vrs, sc, sc_list);
-		if (TAILQ_EMPTY(&cif->vhif_vrs)) {
-			ifpromisc(sc->sc_carpdev, 0);
-			sc->sc_carpdev->if_carp = NULL;
-			kfree(cif, M_CARP);
-		}
+		struct ifnet *ifp = sc->sc_carpdev;
+		struct carp_if *ocif = ifp->if_carp;
+
+		ifp->if_carp = carp_if_remove(ocif, sc);
+		KASSERT(ifp->if_carp != ocif,
+		    ("%s carp_if_remove failed\n", __func__));
+
 		sc->sc_carpdev = NULL;
 		sc->sc_ia = NULL;
+
+		/*
+		 * Make sure that all protocol threads see the
+		 * sc_carpdev and if_carp changes
+		 */
+		netmsg_service_sync();
+
+		if (ifp->if_carp == NULL) {
+			/*
+			 * No more carp interfaces using
+			 * ifp as the backing interface,
+			 * move it out of promiscous mode.
+			 */
+			ifpromisc(ifp, 0);
+		}
+
+		/*
+		 * The old carp list could be safely free now,
+		 * since no one can access it.
+		 */
+		carp_if_free(ocif);
+	}
+}
+
+static void
+carp_ifdetach_dispatch(netmsg_t msg)
+{
+	struct netmsg_carp *cmsg = (struct netmsg_carp *)msg;
+	struct ifnet *ifp = cmsg->nc_carpdev;
+
+	while (ifp->if_carp) {
+		struct carp_softc_container *scc;
+
+		scc = TAILQ_FIRST((struct carp_if *)(ifp->if_carp));
+		carp_detach(scc->scc_softc, 1, TRUE);
 	}
+	lwkt_replymsg(&cmsg->base.lmsg, 0);
 }
 
 /* Detach an interface from the carp. */
 static void
 carp_ifdetach(void *arg __unused, struct ifnet *ifp)
 {
-	struct carp_if *cif = ifp->if_carp;
-	struct carp_softc *sc;
+	struct netmsg_carp cmsg;
 
-	carp_gettok();
+	ASSERT_IFNET_NOT_SERIALIZED_ALL(ifp);
 
-	while (ifp->if_carp &&
-	       (sc = TAILQ_FIRST(&cif->vhif_vrs)) != NULL)
-		carp_detach(sc, 1, TRUE);
+	bzero(&cmsg, sizeof(cmsg));
+	netmsg_init(&cmsg.base, NULL, &curthread->td_msgport, 0,
+	    carp_ifdetach_dispatch);
+	cmsg.nc_carpdev = ifp;
 
-	carp_reltok();
+	lwkt_domsg(cpu_portfn(0), &cmsg.base.lmsg, 0);
 }
 
 /*
@@ -552,8 +763,6 @@ carp_proto_input(struct mbuf **mp, int *offp, int proto)
 	struct carp_softc *sc;
 	int len, iphlen;
 
-	carp_gettok();
-
 	iphlen = *offp;
 	*mp = NULL;
 
@@ -644,7 +853,6 @@ carp_proto_input(struct mbuf **mp, int *offp, int proto)
 	}
 	carp_proto_input_c(sc, m, ch, AF_INET);
 back:
-	carp_reltok();
 	return(IPPROTO_DONE);
 }
 
@@ -659,8 +867,6 @@ carp6_proto_input(struct mbuf **mp, int *offp, int proto)
 	struct carp_softc *sc;
 	u_int len;
 
-	carp_gettok();
-
 	carpstats.carps_ipackets6++;
 
 	if (!carp_opts[CARPCTL_ALLOW]) {
@@ -723,7 +929,6 @@ carp6_proto_input(struct mbuf **mp, int *offp, int proto)
 
 	carp_proto_input_c(sc, m, ch, AF_INET6);
 back:
-	carp_reltok();
 	return (IPPROTO_DONE);
 }
 #endif /* INET6 */
@@ -844,11 +1049,9 @@ carp_input(void *v, struct mbuf *m)
 {
 	struct carp_if *cif = v;
 	struct ether_header *eh;
-	struct carp_softc *sc;
+	struct carp_softc_container *scc;
 	struct ifnet *ifp;
 
-	ASSERT_LWKT_TOKEN_HELD(&carp_tok);
-
 	eh = mtod(m, struct ether_header *);
 
 	ifp = carp_forus(cif, eh->ether_dhost);
@@ -864,7 +1067,8 @@ carp_input(void *v, struct mbuf *m)
 	 * XXX Should really check the list of multicast addresses
 	 * for each CARP interface _before_ copying.
 	 */
-	TAILQ_FOREACH(sc, &cif->vhif_vrs, sc_list) {
+	TAILQ_FOREACH(scc, cif, scc_link) {
+		struct carp_softc *sc = scc->scc_softc;
 		struct mbuf *m0;
 
 		if ((sc->sc_if.if_flags & IFF_UP) == 0)
@@ -914,9 +1118,30 @@ carp_send_ad_all(void)
 static void
 carp_send_ad_timeout(void *xsc)
 {
-	carp_gettok();
-	carp_send_ad(xsc);
-	carp_reltok();
+	struct carp_softc *sc = xsc;
+	struct netmsg_carp *cmsg = &sc->sc_ad_msg;
+
+	KASSERT(mycpuid == 0, ("%s not on cpu0 but on cpu%d\n",
+	    __func__, mycpuid));
+
+	crit_enter();
+	if (cmsg->base.lmsg.ms_flags & MSGF_DONE)
+		lwkt_sendmsg(cpu_portfn(0), &cmsg->base.lmsg);
+	crit_exit();
+}
+
+static void
+carp_send_ad_timeout_dispatch(netmsg_t msg)
+{
+	struct netmsg_carp *cmsg = (struct netmsg_carp *)msg;
+	struct carp_softc *sc = cmsg->nc_softc;
+
+	/* Reply ASAP */
+	crit_enter();
+	lwkt_replymsg(&cmsg->base.lmsg, 0);
+	crit_exit();
+
+	carp_send_ad(sc);
 }
 
 static void
@@ -1207,7 +1432,8 @@ carp_iamatch(const struct in_ifaddr *ia)
 {
 	const struct carp_softc *sc = ia->ia_ifp->if_softc;
 
-	ASSERT_LWKT_TOKEN_HELD(&carp_tok);
+	KASSERT(&curthread->td_msgport == cpu_portfn(0),
+	    ("not in netisr0"));
 
 #ifdef notyet
 	if (carp_opts[CARPCTL_ARPBALANCE])
@@ -1224,11 +1450,10 @@ carp_iamatch(const struct in_ifaddr *ia)
 struct ifaddr *
 carp_iamatch6(void *v, struct in6_addr *taddr)
 {
+#ifdef foo
 	struct carp_if *cif = v;
 	struct carp_softc *vh;
 
-	ASSERT_LWKT_TOKEN_HELD(&carp_tok);
-
 	TAILQ_FOREACH(vh, &cif->vhif_vrs, sc_list) {
 		struct ifaddr_container *ifac;
 
@@ -1244,18 +1469,18 @@ carp_iamatch6(void *v, struct in6_addr *taddr)
 			}
 		}
 	}
+#endif
 	return (NULL);
 }
 
 void *
 carp_macmatch6(void *v, struct mbuf *m, const struct in6_addr *taddr)
 {
+#ifdef foo
 	struct m_tag *mtag;
 	struct carp_if *cif = v;
 	struct carp_softc *sc;
 
-	ASSERT_LWKT_TOKEN_HELD(&carp_tok);
-
 	TAILQ_FOREACH(sc, &cif->vhif_vrs, sc_list) {
 		struct ifaddr_container *ifac;
 
@@ -1282,6 +1507,7 @@ carp_macmatch6(void *v, struct mbuf *m, const struct in6_addr *taddr)
 			}
 		}
 	}
+#endif
 	return (NULL);
 }
 #endif
@@ -1289,14 +1515,13 @@ carp_macmatch6(void *v, struct mbuf *m, const struct in6_addr *taddr)
 static struct ifnet *
 carp_forus(struct carp_if *cif, const uint8_t *dhost)
 {
-	struct carp_softc *sc;
-
-	ASSERT_LWKT_TOKEN_HELD(&carp_tok);
+	struct carp_softc_container *scc;
 
 	if (memcmp(dhost, carp_etheraddr, ETHER_ADDR_LEN - 1) != 0)
 		return NULL;
 
-	TAILQ_FOREACH(sc, &cif->vhif_vrs, sc_list) {
+	TAILQ_FOREACH(scc, cif, scc_link) {
+		struct carp_softc *sc = scc->scc_softc;
 		struct ifnet *ifp = &sc->sc_if;
 
 		if (CARP_IS_RUNNING(ifp) && sc->sc_state == MASTER &&
@@ -1310,12 +1535,31 @@ static void
 carp_master_down_timeout(void *xsc)
 {
 	struct carp_softc *sc = xsc;
+	struct netmsg_carp *cmsg = &sc->sc_md_msg;
+
+	KASSERT(mycpuid == 0, ("%s not on cpu0 but on cpu%d\n",
+	    __func__, mycpuid));
+
+	crit_enter();
+	if (cmsg->base.lmsg.ms_flags & MSGF_DONE)
+		lwkt_sendmsg(cpu_portfn(0), &cmsg->base.lmsg);
+	crit_exit();
+}
+
+static void
+carp_master_down_timeout_dispatch(netmsg_t msg)
+{
+	struct netmsg_carp *cmsg = (struct netmsg_carp *)msg;
+	struct carp_softc *sc = cmsg->nc_softc;
+
+	/* Reply ASAP */
+	crit_enter();
+	lwkt_replymsg(&cmsg->base.lmsg, 0);
+	crit_exit();
 
 	CARP_DEBUG("%s: BACKUP -> MASTER (master timed out)\n",
 		   sc->sc_if.if_xname);
-	carp_gettok();
 	carp_master_down(sc);
-	carp_reltok();
 }
 
 static void
@@ -1455,30 +1699,34 @@ carp_multicast6_cleanup(struct carp_softc *sc)
 }
 #endif
 
-static int
-carp_get_vhaddr(struct carp_softc *sc, struct ifdrv *ifd)
+static void
+carp_ioctl_getvhaddr_dispatch(netmsg_t msg)
 {
+	struct netmsg_carp *cmsg = (struct netmsg_carp *)msg;
+	struct carp_softc *sc = cmsg->nc_softc;
 	const struct carp_vhaddr *vha;
 	struct ifcarpvhaddr *carpa, *carpa0;
-	int count, len, error;
+	int count, len, error = 0;
 
 	count = 0;
 	TAILQ_FOREACH(vha, &sc->sc_vha_list, vha_link)
 		++count;
 
-	if (ifd->ifd_len == 0) {
-		ifd->ifd_len = count * sizeof(*carpa);
-		return 0;
-	} else if (count == 0 || ifd->ifd_len < sizeof(*carpa)) {
-		ifd->ifd_len = 0;
-		return 0;
+	if (cmsg->nc_datalen == 0) {
+		cmsg->nc_datalen = count * sizeof(*carpa);
+		goto back;
+	} else if (count == 0 || cmsg->nc_datalen < sizeof(*carpa)) {
+		cmsg->nc_datalen = 0;
+		goto back;
 	}
-	len = min(ifd->ifd_len, sizeof(*carpa) * count);
+	len = min(cmsg->nc_datalen, sizeof(*carpa) * count);
 	KKASSERT(len >= sizeof(*carpa));
 
 	carpa0 = carpa = kmalloc(len, M_TEMP, M_WAITOK | M_NULLOK | M_ZERO);
-	if (carpa == NULL)
-		return ENOMEM;
+	if (carpa == NULL) {
+		error = ENOMEM; 
+		goto back;
+	}
 
 	count = 0;
 	TAILQ_FOREACH(vha, &sc->sc_vha_list, vha_link) {
@@ -1501,11 +1749,46 @@ carp_get_vhaddr(struct carp_softc *sc, struct ifdrv *ifd)
 		++count;
 		len -= sizeof(*carpa);
 	}
-	ifd->ifd_len = sizeof(*carpa) * count;
-	KKASSERT(ifd->ifd_len > 0);
+	cmsg->nc_datalen = sizeof(*carpa) * count;
+	KKASSERT(cmsg->nc_datalen > 0);
+
+	cmsg->nc_data = carpa0;
+
+back:
+	lwkt_replymsg(&cmsg->base.lmsg, error);
+}
+
+static int
+carp_ioctl_getvhaddr(struct carp_softc *sc, struct ifdrv *ifd)
+{
+	struct ifnet *ifp = &sc->arpcom.ac_if;
+	struct netmsg_carp cmsg;
+	int error;
+
+	ASSERT_IFNET_SERIALIZED_ALL(ifp);
+	ifnet_deserialize_all(ifp);
+
+	bzero(&cmsg, sizeof(cmsg));
+	netmsg_init(&cmsg.base, NULL, &curthread->td_msgport, 0,
+	    carp_ioctl_getvhaddr_dispatch);
+	cmsg.nc_softc = sc;
+	cmsg.nc_datalen = ifd->ifd_len;
+
+	error = lwkt_domsg(cpu_portfn(0), &cmsg.base.lmsg, 0);
+
+	if (!error) {
+		if (cmsg.nc_data != NULL) {
+			error = copyout(cmsg.nc_data, ifd->ifd_data,
+			    cmsg.nc_datalen);
+			kfree(cmsg.nc_data, M_TEMP);
+		}
+		ifd->ifd_len = cmsg.nc_datalen;
+	} else {
+		KASSERT(cmsg.nc_data == NULL,
+		    ("%s temp vhaddr is alloc upon error\n", __func__));
+	}
 
-	error = copyout(carpa0, ifd->ifd_data, ifd->ifd_len);
-	kfree(carpa0, M_TEMP);
+	ifnet_serialize_all(ifp);
 	return error;
 }
 
@@ -1740,6 +2023,7 @@ carp_set_addr6(struct carp_softc *sc, struct sockaddr_in6 *sin6)
 		LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
 	}
 
+#ifdef foo
 	if (!ifp->if_carp) {
 		cif = kmalloc(sizeof(*cif), M_CARP, M_WAITOK | M_ZERO);
 
@@ -1761,9 +2045,11 @@ carp_set_addr6(struct carp_softc *sc, struct sockaddr_in6 *sin6)
 			}
 		}
 	}
+#endif
 	sc->sc_ia6 = ia;
 	sc->sc_carpdev = ifp;
 
+#ifdef foo
 	{ /* XXX prevent endless loop if already in queue */
 	struct carp_softc *vr, *after = NULL;
 	int myself = 0;
@@ -1784,6 +2070,7 @@ carp_set_addr6(struct carp_softc *sc, struct sockaddr_in6 *sin6)
 			TAILQ_INSERT_AFTER(&cif->vhif_vrs, after, sc, sc_list);
 	}
 	}
+#endif
 
 	sc->sc_naddrs6++;
 	if (own)
@@ -1824,11 +2111,13 @@ carp_del_addr6(struct carp_softc *sc, struct sockaddr_in6 *sin6)
 			in6_leavegroup(imm);
 		}
 		im6o->im6o_multicast_ifp = NULL;
+#ifdef foo
 		TAILQ_REMOVE(&cif->vhif_vrs, sc, sc_list);
 		if (TAILQ_EMPTY(&cif->vhif_vrs)) {
 			sc->sc_carpdev->if_carp = NULL;
 			kfree(cif, M_IFADDR);
 		}
+#endif
 	}
 	return (error);
 }
@@ -1839,21 +2128,12 @@ carp_del_addr6(struct carp_softc *sc, struct sockaddr_in6 *sin6)
 static int
 carp_ioctl(struct ifnet *ifp, u_long cmd, caddr_t addr, struct ucred *cr)
 {
-	struct carp_softc *sc = ifp->if_softc, *vr;
-	struct carpreq carpr;
-	struct ifaddr *ifa;
-	struct ifreq *ifr;
-	struct ifaliasreq *ifra;
-	struct ifdrv *ifd;
-	char devname[IFNAMSIZ];
+	struct carp_softc *sc = ifp->if_softc;
+	struct ifreq *ifr = (struct ifreq *)addr;
+	struct ifdrv *ifd = (struct ifdrv *)addr;
 	int error = 0;
 
-	carp_gettok();
-
-	ifa = (struct ifaddr *)addr;
-	ifra = (struct ifaliasreq *)addr;
-	ifr = (struct ifreq *)addr;
-	ifd = (struct ifdrv *)addr;
+	ASSERT_IFNET_SERIALIZED_ALL(ifp);
 
 	switch (cmd) {
 	case SIOCSIFFLAGS:
@@ -1861,154 +2141,306 @@ carp_ioctl(struct ifnet *ifp, u_long cmd, caddr_t addr, struct ucred *cr)
 			if ((ifp->if_flags & IFF_RUNNING) == 0)
 				carp_init(sc);
 		} else if (ifp->if_flags & IFF_RUNNING) {
-			carp_stop(sc, 0);
+			carp_ioctl_stop(sc);
 		}
 		break;
 
 	case SIOCSVH:
-		error = priv_check_cred(cr, PRIV_ROOT, NULL_CRED_OKAY);
-		if (error)
-			break;
-		error = copyin(ifr->ifr_data, &carpr, sizeof(carpr));
-		if (error)
-			break;
-
-		error = 1;
-		if ((ifp->if_flags & IFF_RUNNING) &&
-		    sc->sc_state != INIT && carpr.carpr_state != sc->sc_state) {
-			switch (carpr.carpr_state) {
-			case BACKUP:
-				callout_stop(&sc->sc_ad_tmo);
-				carp_set_state(sc, BACKUP);
-				carp_setrun(sc, 0);
-				carp_setroute(sc, RTM_DELETE);
-				break;
-
-			case MASTER:
-				carp_master_down(sc);
-				break;
-
-			default:
-				break;
-			}
-		}
-		if (carpr.carpr_vhid > 0) {
-			if (carpr.carpr_vhid > 255) {
-				error = EINVAL;
-				break;
-			}
-			if (sc->sc_carpdev) {
-				struct carp_if *cif = sc->sc_carpdev->if_carp;
-
-				TAILQ_FOREACH(vr, &cif->vhif_vrs, sc_list) {
-					if (vr != sc &&
-					    vr->sc_vhid == carpr.carpr_vhid) {
-						carp_reltok();
-						return EEXIST;
-					}
-				}
-			}
-			sc->sc_vhid = carpr.carpr_vhid;
-
-			IF_LLADDR(ifp)[5] = sc->sc_vhid;
-			bcopy(IF_LLADDR(ifp), sc->arpcom.ac_enaddr,
-			    ETHER_ADDR_LEN);
-
-			error--;
-		}
-		if (carpr.carpr_advbase > 0 || carpr.carpr_advskew > 0) {
-			if (carpr.carpr_advskew >= 255) {
-				error = EINVAL;
-				break;
-			}
-			if (carpr.carpr_advbase > 255) {
-				error = EINVAL;
-				break;
-			}
-			sc->sc_advbase = carpr.carpr_advbase;
-			sc->sc_advskew = carpr.carpr_advskew;
-			error--;
-		}
-		bcopy(carpr.carpr_key, sc->sc_key, sizeof(sc->sc_key));
-		if (error > 0) {
-			error = EINVAL;
-		} else {
-			error = 0;
-			carp_setrun(sc, 0);
-		}
+		error = carp_ioctl_setvh(sc, ifr->ifr_data, cr);
 		break;
 
 	case SIOCGVH:
-		bzero(&carpr, sizeof(carpr));
-		carpr.carpr_state = sc->sc_state;
-		carpr.carpr_vhid = sc->sc_vhid;
-		carpr.carpr_advbase = sc->sc_advbase;
-		carpr.carpr_advskew = sc->sc_advskew;
-		error = priv_check_cred(cr, PRIV_ROOT, NULL_CRED_OKAY);
-		if (error == 0) {
-			bcopy(sc->sc_key, carpr.carpr_key,
-			      sizeof(carpr.carpr_key));
-		}
-
-		error = copyout(&carpr, ifr->ifr_data, sizeof(carpr));
+		error = carp_ioctl_getvh(sc, ifr->ifr_data, cr);
 		break;
 
 	case SIOCGDRVSPEC:
 		switch (ifd->ifd_cmd) {
 		case CARPGDEVNAME:
-			if (ifd->ifd_len != sizeof(devname))
-				error = EINVAL;
+			error = carp_ioctl_getdevname(sc, ifd);
 			break;
 
 		case CARPGVHADDR:
+			error = carp_ioctl_getvhaddr(sc, ifd);
 			break;
 
 		default:
 			error = EINVAL;
 			break;
 		}
-		if (error)
+		break;
+
+	default:
+		error = ether_ioctl(ifp, cmd, addr);
+		break;
+	}
+
+	return error;
+}
+
+static void
+carp_ioctl_stop_dispatch(netmsg_t msg)
+{
+	struct netmsg_carp *cmsg = (struct netmsg_carp *)msg;
+	struct carp_softc *sc = cmsg->nc_softc;
+
+	carp_stop(sc, 0);
+	lwkt_replymsg(&cmsg->base.lmsg, 0);
+}
+
+static void
+carp_ioctl_stop(struct carp_softc *sc)
+{
+	struct ifnet *ifp = &sc->arpcom.ac_if;
+	struct netmsg_carp cmsg;
+
+	ASSERT_IFNET_SERIALIZED_ALL(ifp);
+
+	ifnet_deserialize_all(ifp);
+
+	bzero(&cmsg, sizeof(cmsg));
+	netmsg_init(&cmsg.base, NULL, &curthread->td_msgport, 0,
+	    carp_ioctl_stop_dispatch);
+	cmsg.nc_softc = sc;
+
+	lwkt_domsg(cpu_portfn(0), &cmsg.base.lmsg, 0);
+
+	ifnet_serialize_all(ifp);
+}
+
+static void
+carp_ioctl_setvh_dispatch(netmsg_t msg)
+{
+	struct netmsg_carp *cmsg = (struct netmsg_carp *)msg;
+	struct carp_softc *sc = cmsg->nc_softc;
+	struct ifnet *ifp = &sc->arpcom.ac_if;
+	const struct carpreq *carpr = cmsg->nc_data;
+	int error;
+
+	error = 1;
+	if ((ifp->if_flags & IFF_RUNNING) &&
+	    sc->sc_state != INIT && carpr->carpr_state != sc->sc_state) {
+		switch (carpr->carpr_state) {
+		case BACKUP:
+			callout_stop(&sc->sc_ad_tmo);
+			carp_set_state(sc, BACKUP);
+			carp_setrun(sc, 0);
+			carp_setroute(sc, RTM_DELETE);
 			break;
 
-		switch (ifd->ifd_cmd) {
-		case CARPGVHADDR:
-			error = carp_get_vhaddr(sc, ifd);
+		case MASTER:
+			carp_master_down(sc);
 			break;
 
-		case CARPGDEVNAME:
-			bzero(devname, sizeof(devname));
-			if (sc->sc_carpdev != NULL) {
-				strlcpy(devname, sc->sc_carpdev->if_xname,
-					sizeof(devname));
-			}
-			error = copyout(devname, ifd->ifd_data,
-					sizeof(devname));
+		default:
 			break;
 		}
-		break;
+	}
+	if (carpr->carpr_vhid > 0) {
+		if (carpr->carpr_vhid > 255) {
+			error = EINVAL;
+			goto back;
+		}
+		if (sc->sc_carpdev) {
+			struct carp_if *cif = sc->sc_carpdev->if_carp;
+			struct carp_softc_container *scc;
 
-	default:
-		error = ether_ioctl(ifp, cmd, addr);
-		break;
+			TAILQ_FOREACH(scc, cif, scc_link) {
+				struct carp_softc *vr = scc->scc_softc;
+
+				if (vr != sc &&
+				    vr->sc_vhid == carpr->carpr_vhid) {
+					error = EEXIST;
+					goto back;
+				}
+			}
+		}
+		sc->sc_vhid = carpr->carpr_vhid;
+
+		IF_LLADDR(ifp)[5] = sc->sc_vhid;
+		bcopy(IF_LLADDR(ifp), sc->arpcom.ac_enaddr,
+		    ETHER_ADDR_LEN);
+
+		error--;
 	}
+	if (carpr->carpr_advbase > 0 || carpr->carpr_advskew > 0) {
+		if (carpr->carpr_advskew >= 255) {
+			error = EINVAL;
+			goto back;
+		}
+		if (carpr->carpr_advbase > 255) {
+			error = EINVAL;
+			goto back;
+		}
+		sc->sc_advbase = carpr->carpr_advbase;
+		sc->sc_advskew = carpr->carpr_advskew;
+		error--;
+	}
+	bcopy(carpr->carpr_key, sc->sc_key, sizeof(sc->sc_key));
+	if (error > 0) {
+		error = EINVAL;
+	} else {
+		error = 0;
+		carp_setrun(sc, 0);
+	}
+back:
 	carp_hmac_prepare(sc);
 
-	carp_reltok();
+	lwkt_replymsg(&cmsg->base.lmsg, error);
+}
+
+static int
+carp_ioctl_setvh(struct carp_softc *sc, void *udata, struct ucred *cr)
+{
+	struct ifnet *ifp = &sc->arpcom.ac_if;
+	struct netmsg_carp cmsg;
+	struct carpreq carpr;
+	int error;
+
+	ASSERT_IFNET_SERIALIZED_ALL(ifp);
+	ifnet_deserialize_all(ifp);
+
+	error = priv_check_cred(cr, PRIV_ROOT, NULL_CRED_OKAY);
+	if (error)
+		goto back;
+
+	error = copyin(udata, &carpr, sizeof(carpr));
+	if (error)
+		goto back;
+
+	bzero(&cmsg, sizeof(cmsg));
+	netmsg_init(&cmsg.base, NULL, &curthread->td_msgport, 0,
+	    carp_ioctl_setvh_dispatch);
+	cmsg.nc_softc = sc;
+	cmsg.nc_data = &carpr;
+
+	error = lwkt_domsg(cpu_portfn(0), &cmsg.base.lmsg, 0);
+
+back:
+	ifnet_serialize_all(ifp);
 	return error;
 }
 
 static void
-carp_init(void *xsc)
+carp_ioctl_getvh_dispatch(netmsg_t msg)
 {
-	struct carp_softc *sc = xsc;
+	struct netmsg_carp *cmsg = (struct netmsg_carp *)msg;
+	struct carp_softc *sc = cmsg->nc_softc;
+	struct carpreq *carpr = cmsg->nc_data;
 
-	carp_gettok();
+	carpr->carpr_state = sc->sc_state;
+	carpr->carpr_vhid = sc->sc_vhid;
+	carpr->carpr_advbase = sc->sc_advbase;
+	carpr->carpr_advskew = sc->sc_advskew;
+	bcopy(sc->sc_key, carpr->carpr_key, sizeof(carpr->carpr_key));
+
+	lwkt_replymsg(&cmsg->base.lmsg, 0);
+}
+
+static int
+carp_ioctl_getvh(struct carp_softc *sc, void *udata, struct ucred *cr)
+{
+	struct ifnet *ifp = &sc->arpcom.ac_if;
+	struct netmsg_carp cmsg;
+	struct carpreq carpr;
+	int error;
+
+	ASSERT_IFNET_SERIALIZED_ALL(ifp);
+	ifnet_deserialize_all(ifp);
+
+	bzero(&cmsg, sizeof(cmsg));
+	netmsg_init(&cmsg.base, NULL, &curthread->td_msgport, 0,
+	    carp_ioctl_getvh_dispatch);
+	cmsg.nc_softc = sc;
+	cmsg.nc_data = &carpr;
+
+	lwkt_domsg(cpu_portfn(0), &cmsg.base.lmsg, 0);
+
+	error = priv_check_cred(cr, PRIV_ROOT, NULL_CRED_OKAY);
+	if (error)
+		bzero(carpr.carpr_key, sizeof(carpr.carpr_key));
+
+	error = copyout(&carpr, udata, sizeof(carpr));
+
+	ifnet_serialize_all(ifp);
+	return error;
+}
+
+static void
+carp_ioctl_getdevname_dispatch(netmsg_t msg)
+{
+	struct netmsg_carp *cmsg = (struct netmsg_carp *)msg;
+	struct carp_softc *sc = cmsg->nc_softc;
+	char *devname = cmsg->nc_data;
+
+	bzero(devname, sizeof(devname));
+	if (sc->sc_carpdev != NULL)
+		strlcpy(devname, sc->sc_carpdev->if_xname, sizeof(devname));
+
+	lwkt_replymsg(&cmsg->base.lmsg, 0);
+}
+
+static int
+carp_ioctl_getdevname(struct carp_softc *sc, struct ifdrv *ifd)
+{
+	struct ifnet *ifp = &sc->arpcom.ac_if;
+	struct netmsg_carp cmsg;
+	char devname[IFNAMSIZ];
+	int error;
+
+	ASSERT_IFNET_SERIALIZED_ALL(ifp);
+
+	if (ifd->ifd_len != sizeof(devname))
+		return EINVAL;
+
+	ifnet_deserialize_all(ifp);
+
+	bzero(&cmsg, sizeof(cmsg));
+	netmsg_init(&cmsg.base, NULL, &curthread->td_msgport, 0,
+	    carp_ioctl_getdevname_dispatch);
+	cmsg.nc_softc = sc;
+	cmsg.nc_data = devname;
+
+	lwkt_domsg(cpu_portfn(0), &cmsg.base.lmsg, 0);
+
+	error = copyout(devname, ifd->ifd_data, sizeof(devname));
+
+	ifnet_serialize_all(ifp);
+	return error;
+}
+
+static void
+carp_init_dispatch(netmsg_t msg)
+{
+	struct netmsg_carp *cmsg = (struct netmsg_carp *)msg;
+	struct carp_softc *sc = cmsg->nc_softc;
 
 	sc->sc_if.if_flags |= IFF_RUNNING;
+	carp_hmac_prepare(sc);
 	carp_set_state(sc, INIT);
 	carp_setrun(sc, 0);
 
-	carp_reltok();
+	lwkt_replymsg(&cmsg->base.lmsg, 0);
+}
+
+static void
+carp_init(void *xsc)
+{
+	struct carp_softc *sc = xsc;
+	struct ifnet *ifp = &sc->arpcom.ac_if;
+	struct netmsg_carp cmsg;
+
+	ASSERT_IFNET_SERIALIZED_ALL(ifp);
+
+	ifnet_deserialize_all(ifp);
+
+	bzero(&cmsg, sizeof(cmsg));
+	netmsg_init(&cmsg.base, NULL, &curthread->td_msgport, 0,
+	    carp_init_dispatch);
+	cmsg.nc_softc = sc;
+
+	lwkt_domsg(cpu_portfn(0), &cmsg.base.lmsg, 0);
+
+	ifnet_serialize_all(ifp);
 }
 
 static int
@@ -2016,22 +2448,21 @@ carp_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
     struct rtentry *rt)
 {
 	struct carp_softc *sc = ifp->if_softc;
+	struct ifnet *carpdev;
 	int error = 0;
 
-	carp_gettok();
-	if (sc->sc_carpdev) {
+	carpdev = sc->sc_carpdev;
+	if (carpdev != NULL) {
 		/*
 		 * NOTE:
 		 * CARP's ifp is passed to backing device's
 		 * if_output method.
 		 */
-		sc->sc_carpdev->if_output(ifp, m, dst, rt);
+		carpdev->if_output(ifp, m, dst, rt);
 	} else {
 		m_freem(m);
 		error = ENETUNREACH;
 	}
-	carp_reltok();
-
 	return error;
 }
 
@@ -2104,8 +2535,6 @@ carp_group_demote_adj(struct ifnet *ifp, int adj)
 	struct ifg_list	*ifgl;
 	int *dm;
 
-	carp_gettok();
-
 	TAILQ_FOREACH(ifgl, &ifp->if_groups, ifgl_next) {
 		if (!strcmp(ifgl->ifgl_group->ifg_group, IFG_ALL))
 			continue;
@@ -2121,22 +2550,17 @@ carp_group_demote_adj(struct ifnet *ifp, int adj)
 		CARP_LOG("%s demoted group %s to %d", ifp->if_xname,
                     ifgl->ifgl_group->ifg_group, *dm);
 	}
-
-	carp_reltok();
 }
 
+#ifdef foo
 void
 carp_carpdev_state(void *v)
 {
 	struct carp_if *cif = v;
 	struct carp_softc *sc;
 
-	carp_gettok();
-
 	TAILQ_FOREACH(sc, &cif->vhif_vrs, sc_list)
 		carp_sc_state(sc);
-
-	carp_reltok();
 }
 
 static void
@@ -2162,6 +2586,7 @@ carp_sc_state(struct carp_softc *sc)
 		sc->sc_suppress = 0;
 	}
 }
+#endif
 
 static void
 carp_stop(struct carp_softc *sc, int detach)
@@ -2205,12 +2630,8 @@ carp_activate_vhaddr(struct carp_softc *sc, struct carp_vhaddr *vha,
     struct ifnet *ifp, struct in_ifaddr *ia_if, int own)
 {
 	struct ip_moptions *imo = &sc->sc_imo;
-	struct carp_if *cif;
-	struct carp_softc *vr, *after = NULL;
-	int onlist, error;
-#ifdef INVARIANTS
-	int assert_onlist;
-#endif
+	struct carp_if *ocif = ifp->if_carp;
+	int error;
 
 	KKASSERT(vha->vha_ia != NULL);
 
@@ -2223,63 +2644,43 @@ carp_activate_vhaddr(struct carp_softc *sc, struct carp_vhaddr *vha,
 		("%s is already on %s\n", sc->sc_if.if_xname,
 		 sc->sc_carpdev->if_xname));
 
-	if (!ifp->if_carp) {
+	if (ocif == NULL) {
 		KASSERT(sc->sc_carpdev == NULL,
 			("%s is already on %s\n", sc->sc_if.if_xname,
 			 sc->sc_carpdev->if_xname));
 
-		cif = kmalloc(sizeof(*cif), M_CARP, M_WAITOK | M_ZERO);
-
 		error = ifpromisc(ifp, 1);
-		if (error) {
-			kfree(cif, M_CARP);
+		if (error)
 			return error;
-		}
-
-		TAILQ_INIT(&cif->vhif_vrs);
-		ifp->if_carp = cif;
 	} else {
-		cif = ifp->if_carp;
-		TAILQ_FOREACH(vr, &cif->vhif_vrs, sc_list) {
+		struct carp_softc_container *scc;
+
+		TAILQ_FOREACH(scc, ocif, scc_link) {
+			struct carp_softc *vr = scc->scc_softc;
+
 			if (vr != sc && vr->sc_vhid == sc->sc_vhid)
 				return EINVAL;
 		}
 	}
 
-#ifdef INVARIANTS
-	if (sc->sc_carpdev != NULL)
-		assert_onlist = 1;
-	else
-		assert_onlist = 0;
-#endif
+	ifp->if_carp = carp_if_insert(ocif, sc);
+	KASSERT(ifp->if_carp != NULL, ("%s carp_if_insert failed\n", __func__));
+
 	sc->sc_ia = ia_if;
 	sc->sc_carpdev = ifp;
 
-	cif = ifp->if_carp;
-	onlist = 0;
-	TAILQ_FOREACH(vr, &cif->vhif_vrs, sc_list) {
-		if (vr == sc)
-			onlist = 1;
-		if (vr->sc_vhid < sc->sc_vhid)
-			after = vr;
-	}
-
-#ifdef INVARIANTS
-	if (assert_onlist) {
-		KASSERT(onlist, ("%s is not on %s carp list\n",
-			sc->sc_if.if_xname, ifp->if_xname));
-	} else {
-		KASSERT(!onlist, ("%s is already on %s carp list\n",
-			sc->sc_if.if_xname, ifp->if_xname));
-	}
-#endif
+	/*
+	 * Make sure that all protocol threads see the sc_carpdev and
+	 * if_carp changes
+	 */
+	netmsg_service_sync();
 
-	if (!onlist) {
-		/* We're trying to keep things in order */
-		if (after == NULL)
-			TAILQ_INSERT_TAIL(&cif->vhif_vrs, sc, sc_list);
-		else
-			TAILQ_INSERT_AFTER(&cif->vhif_vrs, after, sc, sc_list);
+	if (ocif != NULL && ifp->if_carp != ocif) {
+		/*
+		 * The old carp list could be safely free now,
+		 * since no one can access it.
+		 */
+		carp_if_free(ocif);
 	}
 
 	vha->vha_iaback = ia_if;
@@ -2443,10 +2844,11 @@ carp_ifaddr(void *arg __unused, struct ifnet *ifp,
 {
 	struct carp_softc *sc;
 
-	carp_gettok();
-
 	if (ifa->ifa_addr->sa_family != AF_INET)
-		goto back;
+		return;
+
+	KASSERT(&curthread->td_msgport == cpu_portfn(0),
+	    ("not in netisr0"));
 
 	if (ifp->if_type == IFT_CARP) {
 		/*
@@ -2465,14 +2867,14 @@ carp_ifaddr(void *arg __unused, struct ifnet *ifp,
 			carp_del_addr(ifp->if_softc, ifa);
 			break;
 		}
-		goto back;
+		return;
 	}
 
 	/*
 	 * Address is changed on non-carp(4) interface
 	 */
 	if ((ifp->if_flags & IFF_MULTICAST) == 0)
-		goto back;
+		return;
 
 	LIST_FOREACH(sc, &carpif_list, sc_next) {
 		if (sc->sc_carpdev != NULL && sc->sc_carpdev != ifp) {
@@ -2543,9 +2945,6 @@ carp_ifaddr(void *arg __unused, struct ifnet *ifp,
 			break;
 		}
 	}
-
-back:
-	carp_reltok();
 }
 
 void
@@ -2555,8 +2954,6 @@ carp_proto_ctlinput(netmsg_t msg)
 	struct sockaddr *sa = msg->ctlinput.nm_arg;
 	struct in_ifaddr_container *iac;
 
-	carp_gettok();
-
 	TAILQ_FOREACH(iac, &in_ifaddrheads[mycpuid], ia_link) {
 		struct in_ifaddr *ia = iac->ia;
 		struct ifnet *ifp = ia->ia_ifp;
@@ -2576,29 +2973,14 @@ carp_proto_ctlinput(netmsg_t msg)
 		}
 	}
 
-	carp_reltok();
 	lwkt_replymsg(&msg->lmsg, 0);
 }
 
-void
-carp_gettok(void)
-{
-	lwkt_gettoken(&carp_tok);
-}
-
-void
-carp_reltok(void)
-{
-	lwkt_reltoken(&carp_tok);
-}
-
 struct ifnet *
 carp_parent(struct ifnet *cifp)
 {
 	struct carp_softc *sc;
 
-	ASSERT_LWKT_TOKEN_HELD(&carp_tok);
-
 	KKASSERT(cifp->if_type == IFT_CARP);
 	sc = cifp->if_softc;
 
diff --git a/sys/netinet/ip_carp.h b/sys/netinet/ip_carp.h
index c4ec267cae..3244da615c 100644
--- a/sys/netinet/ip_carp.h
+++ b/sys/netinet/ip_carp.h
@@ -169,7 +169,6 @@ struct ifcarpvhaddr {
 }
 
 #ifdef _KERNEL
-void		 carp_carpdev_state(void *);
 void		 carp_group_demote_adj(struct ifnet *, int);
 int		 carp_proto_input(struct mbuf **, int *, int);
 int		 carp6_proto_input(struct mbuf **, int *, int);
@@ -179,9 +178,6 @@ struct ifaddr	*carp_iamatch6(void *, struct in6_addr *);
 void		*carp_macmatch6(void *, struct mbuf *, const struct in6_addr *);
 struct mbuf	*carp_input(void *, struct mbuf *);
 struct ifnet	*carp_parent(struct ifnet *);
-
-void		 carp_gettok(void);
-void		 carp_reltok(void);
 #endif /* _KERNEL */
 
 #endif /* _IP_CARP_H */
diff --git a/sys/netinet/ip_divert.c b/sys/netinet/ip_divert.c
index 7afaccc7f9..c304c65660 100644
--- a/sys/netinet/ip_divert.c
+++ b/sys/netinet/ip_divert.c
@@ -222,7 +222,7 @@ div_packet(struct mbuf *m, int incoming, int port)
 		 * this iface name will come along for the ride.
 		 * (see div_output for the other half of this.)
 		 */
-		ksnprintf(divsrc.sin_zero, sizeof divsrc.sin_zero,
+		ksnprintf(divsrc.sin_zero, sizeof divsrc.sin_zero, "%s",
 			  m->m_pkthdr.rcvif->if_xname);
 	}
 
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 248bd72514..1d03220d20 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -2692,6 +2692,7 @@ tcp_dooptions(struct tcpopt *to, u_char *cp, int cnt, boolean_t is_syn)
 					 * Invalid SACK block; discard all
 					 * SACK blocks
 					 */
+					tcpstat.tcps_rcvbadsackopt++;
 					to->to_nsackblocks = 0;
 					to->to_sackblocks = NULL;
 					to->to_flags &= ~TOF_SACK;
diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
index 58f4d198ef..ef137efa88 100644
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -711,6 +711,10 @@ send:
 		else if (SEQ_LT(tp->snd_nxt, tp->snd_max)) {
 			if (tp->snd_nxt == tp->snd_una)
 				tp->snd_max_rexmt = tp->snd_max;
+			if (nsacked) {
+				tcpstat.tcps_sndsackrtopack++;
+				tcpstat.tcps_sndsackrtobyte += len;
+			}
 			tcpstat.tcps_sndrexmitpack++;
 			tcpstat.tcps_sndrexmitbyte += len;
 		} else {
diff --git a/sys/netinet/tcp_sack.c b/sys/netinet/tcp_sack.c
index 85633bd298..e65154c2be 100644
--- a/sys/netinet/tcp_sack.c
+++ b/sys/netinet/tcp_sack.c
@@ -249,12 +249,17 @@ tcp_sack_add_blocks(struct tcpcb *tp, struct tcpopt *to)
 		struct raw_sackblock *newsackblock = &blocks[i];
 
 		/* don't accept bad SACK blocks */
-		if (SEQ_GT(newsackblock->rblk_end, tp->snd_max))
+		if (SEQ_GT(newsackblock->rblk_end, tp->snd_max)) {
+			tcpstat.tcps_rcvbadsackopt++;
 			break;		/* skip all other blocks */
+		}
+		tcpstat.tcps_sacksbupdate++;
 
 		sb = alloc_sackblock();
-		if (sb == NULL)		/* do some sort of cleanup? XXX */
+		if (sb == NULL) {	/* do some sort of cleanup? XXX */
+			tcpstat.tcps_sacksbfailed++;
 			break;		/* just skip rest of blocks */
+		}
 		sb->sblk_start = newsackblock->rblk_start;
 		sb->sblk_end = newsackblock->rblk_end;
 		if (TAILQ_EMPTY(&scb->sackblocks)) {
@@ -297,6 +302,7 @@ insert_block(struct scoreboard *scb, struct sackblock *newblock)
 		 * Or, go other way and free all blocks if we hit this limit.
 		 */
 		free_sackblock(newblock);
+		tcpstat.tcps_sacksboverflow++;
 		return;
 	}
 	KASSERT(scb->nblocks < MAXSAVEDBLOCKS,
@@ -315,6 +321,7 @@ insert_block(struct scoreboard *scb, struct sackblock *newblock)
 			if (SEQ_GT(newblock->sblk_end, sb->sblk_end))
 				sb->sblk_end = newblock->sblk_end;
 			free_sackblock(newblock);
+			tcpstat.tcps_sacksbreused++;
 		} else {
 			workingblock = newblock;
 			TAILQ_INSERT_AFTER(&scb->sackblocks, sb, newblock,
@@ -692,6 +699,11 @@ tcp_sack_fill_report(struct tcpcb *tp, u_char *opt, u_int *plen)
 	    TCPOLEN_SACK_ALIGNED + TCPOLEN_SACK_BLOCK,
 	    ("no room for SACK header and one block: optlen %d", optlen));
 
+	if (tp->t_flags & TF_DUPSEG)
+		tcpstat.tcps_snddsackopt++;
+	else
+		tcpstat.tcps_sndsackopt++;
+
 	olp = lp++;
 	optlen += TCPOLEN_SACK_ALIGNED;
 
diff --git a/sys/netinet/tcp_var.h b/sys/netinet/tcp_var.h
index b9ea866733..de718d6317 100644
--- a/sys/netinet/tcp_var.h
+++ b/sys/netinet/tcp_var.h
@@ -324,6 +324,8 @@ struct tcp_stats {
 	u_long	tcps_sndbyte;		/* data bytes sent */
 	u_long	tcps_sndrexmitpack;	/* data packets retransmitted */
 	u_long	tcps_sndrexmitbyte;	/* data bytes retransmitted */
+	u_long	tcps_sndsackrtopack;	/* packets sent by SACK after RTO */
+	u_long	tcps_sndsackrtobyte;	/* bytes sent by SACK after RTO */
 	u_long	tcps_sndfastrexmit;	/* Fast Retransmissions */
 	u_long	tcps_sndearlyrexmit;	/* early Fast Retransmissions */
 	u_long	tcps_sndlimited;	/* Limited Transmit packets */
@@ -343,6 +345,8 @@ struct tcp_stats {
 	u_long	tcps_sndsackbyte;	/* bytes sent by SACK recovery */
 	u_long	tcps_snduna3;		/* re-retransmit snd_una on 3 new seg */
 	u_long	tcps_snduna1;		/* re-retransmit snd_una on 1 new seg */
+	u_long	tcps_sndsackopt;	/* SACK options sent */
+	u_long	tcps_snddsackopt;	/* D-SACK options sent */
 
 	u_long	tcps_rcvtotal;		/* total packets received */
 	u_long	tcps_rcvpack;		/* packets received in sequence */
@@ -380,6 +384,12 @@ struct tcp_stats {
 	u_long	tcps_badsyn;		/* bogus SYN, e.g. premature ACK */
 	u_long	tcps_mturesent;		/* resends due to MTU discovery */
 	u_long	tcps_listendrop;	/* listen queue overflows */
+	u_long	tcps_rcvbadsackopt;	/* rcvd illegal SACK options */
+
+	u_long	tcps_sacksbupdate;	/* times SACK scoreboard updated */
+	u_long	tcps_sacksboverflow;	/* times SACK scoreboard overflowed */
+	u_long	tcps_sacksbreused;	/* times SACK sb-block reused */
+	u_long	tcps_sacksbfailed;	/* times SACK sb update failed */
 
 	u_long	tcps_sc_added;		/* entry added to syncache */
 	u_long	tcps_sc_retransmitted;	/* syncache entry was retransmitted */
diff --git a/sys/netinet6/nd6_nbr.c b/sys/netinet6/nd6_nbr.c
index ae8e83aefa..33ef955085 100644
--- a/sys/netinet6/nd6_nbr.c
+++ b/sys/netinet6/nd6_nbr.c
@@ -220,12 +220,8 @@ nd6_ns_input(struct mbuf *m, int off, int icmp6len)
 	 */
 	/* (1) and (3) check. */
 #ifdef CARP
-	if (ifp->if_carp) {
-		carp_gettok();
-		if (ifp->if_carp)
-			ifa = carp_iamatch6(ifp->if_carp, &taddr6);
-		carp_reltok();
-	}
+	if (ifp->if_carp)
+		ifa = carp_iamatch6(ifp->if_carp, &taddr6);
 	if (!ifa)
 		ifa = (struct ifaddr *)in6ifa_ifpwithaddr(ifp, &taddr6);
 #else
@@ -934,14 +930,8 @@ nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6,
 		 */
 		if (sdl0 == NULL) {
 #ifdef CARP
-			if (ifp->if_carp) {
-				carp_gettok();
-				if (ifp->if_carp) {
-					mac = carp_macmatch6(ifp->if_carp, m,
-					    taddr6);
-				}
-				carp_reltok();
-			}
+			if (ifp->if_carp)
+				mac = carp_macmatch6(ifp->if_carp, m, taddr6);
 			if (mac == NULL)
 				mac = nd6_ifptomac(ifp);
 #else
diff --git a/sys/opencrypto/cryptosoft.c b/sys/opencrypto/cryptosoft.c
index f2b735c97c..7439a7cd42 100644
--- a/sys/opencrypto/cryptosoft.c
+++ b/sys/opencrypto/cryptosoft.c
@@ -936,17 +936,9 @@ swcr_newsession(device_t dev, u_int32_t *sid, struct cryptoini *cri)
 		authcommon:
 			(*swd)->sw_ictx = kmalloc(axf->ctxsize, M_CRYPTO_DATA,
 						  M_WAITOK);
-			if ((*swd)->sw_ictx == NULL) {
-				swcr_freesession_slot(&swd_base, 0);
-				return ENOBUFS;
-			}
 	
 			(*swd)->sw_octx = kmalloc(axf->ctxsize, M_CRYPTO_DATA,
 						  M_WAITOK);
-			if ((*swd)->sw_octx == NULL) {
-				swcr_freesession_slot(&swd_base, 0);
-				return ENOBUFS;
-			}
 	
 			if (cri->cri_key != NULL) {
 				swcr_authprepare(axf, *swd, cri->cri_key,
@@ -966,17 +958,9 @@ swcr_newsession(device_t dev, u_int32_t *sid, struct cryptoini *cri)
 		auth2common:
 			(*swd)->sw_ictx = kmalloc(axf->ctxsize, M_CRYPTO_DATA,
 						  M_WAITOK);
-			if ((*swd)->sw_ictx == NULL) {
-				swcr_freesession_slot(&swd_base, 0);
-				return ENOBUFS;
-			}
 	
 			(*swd)->sw_octx = kmalloc(cri->cri_klen / 8,
 						  M_CRYPTO_DATA, M_WAITOK);
-			if ((*swd)->sw_octx == NULL) {
-				swcr_freesession_slot(&swd_base, 0);
-				return ENOBUFS;
-			}
 	
 			/* Store the key so we can "append" it to the payload */
 			if (cri->cri_key != NULL) {
@@ -997,10 +981,6 @@ swcr_newsession(device_t dev, u_int32_t *sid, struct cryptoini *cri)
 		auth3common:
 			(*swd)->sw_ictx = kmalloc(axf->ctxsize, M_CRYPTO_DATA,
 						  M_WAITOK);
-			if ((*swd)->sw_ictx == NULL) {
-				swcr_freesession_slot(&swd_base, 0);
-				return ENOBUFS;
-			}
 
 			axf->Init((*swd)->sw_ictx);
 			(*swd)->sw_mlen = cri->cri_mlen;
diff --git a/sys/opencrypto/deflate.c b/sys/opencrypto/deflate.c
index ca63966e15..0b746233d5 100644
--- a/sys/opencrypto/deflate.c
+++ b/sys/opencrypto/deflate.c
@@ -74,8 +74,6 @@ deflate_global(u_int8_t *data, u_int32_t size, int decomp, u_int8_t **out)
 
 	if (!decomp) {
 		buf[i].out = kmalloc((u_long) size, M_CRYPTO_DATA, M_WAITOK);
-		if (buf[i].out == NULL)
-			goto bad;
 		buf[i].size = size;
 		buf[i].flag = 1;
 		i++;
@@ -89,8 +87,6 @@ deflate_global(u_int8_t *data, u_int32_t size, int decomp, u_int8_t **out)
 
 		buf[i].out = kmalloc((u_long) (size * 4),
 				     M_CRYPTO_DATA, M_WAITOK);
-		if (buf[i].out == NULL)
-			goto bad;
 		buf[i].size = size * 4;
 		buf[i].flag = 1;
 		i++;
@@ -116,8 +112,6 @@ deflate_global(u_int8_t *data, u_int32_t size, int decomp, u_int8_t **out)
 			/* we need more output space, allocate size */
 			buf[i].out = kmalloc((u_long) size,
 					     M_CRYPTO_DATA, M_WAITOK);
-			if (buf[i].out == NULL)
-				goto bad;
 			zbuf.next_out = buf[i].out;
 			buf[i].size = size;
 			buf[i].flag = 1;
@@ -131,8 +125,6 @@ end:
 	result = count = zbuf.total_out;
 
 	*out = kmalloc((u_long) result, M_CRYPTO_DATA, M_WAITOK);
-	if (*out == NULL)
-		goto bad;
 	if (decomp)
 		inflateEnd(&zbuf);
 	else
diff --git a/sys/platform/pc32/conf/files b/sys/platform/pc32/conf/files
index b7280bb00e..618c94a62d 100644
--- a/sys/platform/pc32/conf/files
+++ b/sys/platform/pc32/conf/files
@@ -83,7 +83,6 @@ crypto/des/arch/i386/des_enc.S		optional	crypto
 crypto/des/des_ecb.c			optional	crypto
 crypto/des/des_setkey.c			optional	crypto
 dev/disk/advansys/adv_isa.c		optional	adv isa
-dev/disk/aic/aic_isa.c			optional	aic isa
 dev/netif/ar/if_ar_isa.c		optional	ar isa
 
 ${OSACPI_MD_DIR}/OsdEnvironment.c	optional        acpi
diff --git a/sys/platform/pc32/i386/dump_machdep.c b/sys/platform/pc32/i386/dump_machdep.c
index b956304561..4b02c54e34 100644
--- a/sys/platform/pc32/i386/dump_machdep.c
+++ b/sys/platform/pc32/i386/dump_machdep.c
@@ -159,19 +159,21 @@ cb_dumpdata(struct md_pa *mdp, int seqnr, void *arg)
 	uint64_t pgs;
 	size_t counter, sz, chunk;
 	int i, c, error;
+	int max_iosize;
 
 	error = 0;	/* catch case in which chunk size is 0 */
 	counter = 0;	/* Update twiddle every 16MB */
 	va = NULL;
 	pgs = mdp->md_size / PAGE_SIZE;
 	pa = mdp->md_start;
+	max_iosize = min(MAXPHYS, di->maxiosize);
 
 	kprintf("  chunk %d: %lldMB (%lld pages)", seqnr, PG2MB(pgs), pgs);
 
 	while (pgs) {
 		chunk = pgs;
-		if (chunk > MAXDUMPPGS)
-			chunk = MAXDUMPPGS;
+		if (chunk > (max_iosize/PAGE_SIZE))
+			chunk =  max_iosize/PAGE_SIZE;
 		sz = chunk << PAGE_SHIFT;
 		counter += sz;
 		if (counter >> 24) {
diff --git a/sys/platform/pc32/i386/minidump_machdep.c b/sys/platform/pc32/i386/minidump_machdep.c
index 824d92c4f4..8155976ee6 100644
--- a/sys/platform/pc32/i386/minidump_machdep.c
+++ b/sys/platform/pc32/i386/minidump_machdep.c
@@ -102,6 +102,7 @@ blk_write(struct dumperinfo *di, char *ptr, vm_paddr_t pa, size_t sz)
 {
 	size_t len;
 	int error, i, c;
+	int max_iosize;
 
 	error = 0;
 	if ((sz % PAGE_SIZE) != 0) {
@@ -122,8 +123,9 @@ blk_write(struct dumperinfo *di, char *ptr, vm_paddr_t pa, size_t sz)
 		if (error)
 			return (error);
 	}
+	max_iosize = min(MAXPHYS, di->maxiosize);
 	while (sz) {
-		len = (MAXDUMPPGS * PAGE_SIZE) - fragsz;
+		len = max_iosize - fragsz;
 		if (len > sz)
 			len = sz;
 		counter += len;
@@ -148,7 +150,7 @@ blk_write(struct dumperinfo *di, char *ptr, vm_paddr_t pa, size_t sz)
 			fragsz += len;
 			pa += len;
 			sz -= len;
-			if (fragsz == (MAXDUMPPGS * PAGE_SIZE)) {
+			if (fragsz == max_iosize) {
 				error = blk_flush(di);
 				if (error)
 					return (error);
diff --git a/sys/platform/pc32/i386/trap.c b/sys/platform/pc32/i386/trap.c
index 2885a5f8f7..fa3b21897b 100644
--- a/sys/platform/pc32/i386/trap.c
+++ b/sys/platform/pc32/i386/trap.c
@@ -322,10 +322,16 @@ recheck:
 	}
 
 	/*
-	 * Make sure postsig() handled request to restore old signal mask after
-	 * running signal handler.
+	 * In a multi-threaded program it is possible for a thread to change
+	 * signal state during a system call which temporarily changes the
+	 * signal mask.  In this case postsig() might not be run and we
+	 * have to restore the mask ourselves.
 	 */
-	KKASSERT((lp->lwp_flags & LWP_OLDMASK) == 0);
+	if (lp->lwp_flags & LWP_OLDMASK) {
+		lp->lwp_flags &= ~LWP_OLDMASK;
+		lp->lwp_sigmask = lp->lwp_oldsigmask;
+		goto recheck;
+	}
 }
 
 /*
diff --git a/sys/platform/pc32/i386/userconfig.c b/sys/platform/pc32/i386/userconfig.c
index 05c061a27e..a293ead58b 100644
--- a/sys/platform/pc32/i386/userconfig.c
+++ b/sys/platform/pc32/i386/userconfig.c
@@ -332,7 +332,6 @@ static DEV_INFO device_info[] = {
 /*---Name-----   ---Description---------------------------------------------- */
 {"adv",         "AdvanSys SCSI narrow controller",	0,		CLS_STORAGE},
 {"bt",          "Buslogic SCSI controller",		0,		CLS_STORAGE},
-{"aic",         "Adaptec 152x SCSI and compatible sound cards",	0,      CLS_STORAGE},
 {"nca",         "ProAudio Spectrum SCSI and compatibles",	0,	CLS_STORAGE},
 {"sea",         "Seagate ST01/ST02 SCSI and compatibles",	0,	CLS_STORAGE},
 {"stg",         "TMC 18C30/18C50 based SCSI cards",	0,		CLS_STORAGE},
@@ -3051,7 +3050,9 @@ introfunc(CmdParm *parms)
 	    }
 	}
     }
-#endif
+#else	/* !VISUAL_USERCONFIG */
+    return 0;
+#endif	/* VISUAL_USERCONFIG */
 }
 
 #if NPNP > 0
diff --git a/sys/platform/pc64/x86_64/dump_machdep.c b/sys/platform/pc64/x86_64/dump_machdep.c
index 9a144e05a7..dbc52dcc42 100644
--- a/sys/platform/pc64/x86_64/dump_machdep.c
+++ b/sys/platform/pc64/x86_64/dump_machdep.c
@@ -158,19 +158,21 @@ cb_dumpdata(struct md_pa *mdp, int seqnr, void *arg)
 	uint64_t pgs;
 	size_t counter, sz, chunk;
 	int i, c, error;
+	int max_iosize;
 
 	error = 0;	/* catch case in which chunk size is 0 */
 	counter = 0;	/* Update twiddle every 16MB */
 	va = NULL;
 	pgs = mdp->md_size / PAGE_SIZE;
 	pa = mdp->md_start;
+	max_iosize = min(MAXPHYS, di->maxiosize);
 
 	kprintf("  chunk %d: %ldMB (%ld pages)", seqnr, PG2MB(pgs), pgs);
 
 	while (pgs) {
 		chunk = pgs;
-		if (chunk > MAXDUMPPGS)
-			chunk = MAXDUMPPGS;
+		if (chunk > (max_iosize/PAGE_SIZE))
+			chunk = max_iosize/PAGE_SIZE;
 		sz = chunk << PAGE_SHIFT;
 		counter += sz;
 		if (counter >> 24) {
diff --git a/sys/platform/pc64/x86_64/minidump_machdep.c b/sys/platform/pc64/x86_64/minidump_machdep.c
index b4f3b2afcd..12950c685c 100644
--- a/sys/platform/pc64/x86_64/minidump_machdep.c
+++ b/sys/platform/pc64/x86_64/minidump_machdep.c
@@ -104,6 +104,7 @@ blk_write(struct dumperinfo *di, char *ptr, vm_paddr_t pa, size_t sz)
 {
 	size_t len;
 	int error, i, c;
+	int max_iosize;
 
 	error = 0;
 	if ((sz & PAGE_MASK)) {
@@ -127,8 +128,9 @@ blk_write(struct dumperinfo *di, char *ptr, vm_paddr_t pa, size_t sz)
 		if (error)
 			return (error);
 	}
+	max_iosize = min(MAXPHYS, di->maxiosize);
 	while (sz) {
-		len = (MAXDUMPPGS * PAGE_SIZE) - fragsz;
+		len = max_iosize - fragsz;
 		if (len > sz)
 			len = sz;
 		counter += len;
@@ -155,7 +157,7 @@ blk_write(struct dumperinfo *di, char *ptr, vm_paddr_t pa, size_t sz)
 			fragsz += len;
 			pa += len;
 			sz -= len;
-			if (fragsz == (MAXDUMPPGS * PAGE_SIZE)) {
+			if (fragsz == max_iosize) {
 				error = blk_flush(di);
 				if (error)
 					return (error);
diff --git a/sys/platform/pc64/x86_64/trap.c b/sys/platform/pc64/x86_64/trap.c
index a2fc61154e..fb4245c5ff 100644
--- a/sys/platform/pc64/x86_64/trap.c
+++ b/sys/platform/pc64/x86_64/trap.c
@@ -309,10 +309,16 @@ recheck:
 	}
 
 	/*
-	 * Make sure postsig() handled request to restore old signal mask after
-	 * running signal handler.
+	 * In a multi-threaded program it is possible for a thread to change
+	 * signal state during a system call which temporarily changes the
+	 * signal mask.  In this case postsig() might not be run and we
+	 * have to restore the mask ourselves.
 	 */
-	KKASSERT((lp->lwp_flags & LWP_OLDMASK) == 0);
+	if (lp->lwp_flags & LWP_OLDMASK) {
+		lp->lwp_flags &= ~LWP_OLDMASK;
+		lp->lwp_sigmask = lp->lwp_oldsigmask;
+		goto recheck;
+	}
 }
 
 /*
diff --git a/sys/platform/vkernel/i386/trap.c b/sys/platform/vkernel/i386/trap.c
index d8e51246cc..0367345d38 100644
--- a/sys/platform/vkernel/i386/trap.c
+++ b/sys/platform/vkernel/i386/trap.c
@@ -296,10 +296,16 @@ recheck:
 	}
 
 	/*
-	 * Make sure postsig() handled request to restore old signal mask after
-	 * running signal handler.
+	 * In a multi-threaded program it is possible for a thread to change
+	 * signal state during a system call which temporarily changes the
+	 * signal mask.  In this case postsig() might not be run and we
+	 * have to restore the mask ourselves.
 	 */
-	KKASSERT((lp->lwp_flags & LWP_OLDMASK) == 0);
+	if (lp->lwp_flags & LWP_OLDMASK) {
+		lp->lwp_flags &= ~LWP_OLDMASK;
+		lp->lwp_sigmask = lp->lwp_oldsigmask;
+		goto recheck;
+	}
 }
 
 /*
diff --git a/sys/platform/vkernel64/x86_64/trap.c b/sys/platform/vkernel64/x86_64/trap.c
index 5c558a11d4..a0cd7188e1 100644
--- a/sys/platform/vkernel64/x86_64/trap.c
+++ b/sys/platform/vkernel64/x86_64/trap.c
@@ -296,10 +296,16 @@ recheck:
 	}
 
 	/*
-	 * Make sure postsig() handled request to restore old signal mask after
-	 * running signal handler.
+	 * In a multi-threaded program it is possible for a thread to change
+	 * signal state during a system call which temporarily changes the
+	 * signal mask.  In this case postsig() might not be run and we
+	 * have to restore the mask ourselves.
 	 */
-	KKASSERT((lp->lwp_flags & LWP_OLDMASK) == 0);
+	if (lp->lwp_flags & LWP_OLDMASK) {
+		lp->lwp_flags &= ~LWP_OLDMASK;
+		lp->lwp_sigmask = lp->lwp_oldsigmask;
+		goto recheck;
+	}
 }
 
 /*
diff --git a/sys/sys/buf.h b/sys/sys/buf.h
index fee2954d5c..ba033c6df0 100644
--- a/sys/sys/buf.h
+++ b/sys/sys/buf.h
@@ -284,6 +284,8 @@ struct buf {
  *			which will cause the buffer cache to set PG_NOTMETA
  *			in the VM pages when releasing them and the
  *			swapcache to not try to cache them.
+ *
+ *	B_MARKER	Special marker buf, always skip.
  */
 
 #define	B_AGE		0x00000001	/* Reuse more quickly */
@@ -304,7 +306,7 @@ struct buf {
 #define	B_NOCACHE	0x00008000	/* Destroy buffer AND backing store */
 #define	B_MALLOC	0x00010000	/* malloced b_data */
 #define	B_CLUSTEROK	0x00020000	/* Pagein op, so swap() can count it. */
-#define	B_UNUSED18	0x00040000
+#define	B_MARKER	0x00040000	/* Special marker buf in queue */
 #define	B_RAW		0x00080000	/* Set by physio for raw transfers. */
 #define	B_HEAVY		0x00100000	/* Heavy-weight buffer */
 #define	B_DIRTY		0x00200000	/* Needs writing later. */
diff --git a/sys/sys/malloc.h b/sys/sys/malloc.h
index 8aeabf9c41..83b27e8189 100644
--- a/sys/sys/malloc.h
+++ b/sys/sys/malloc.h
@@ -90,7 +90,7 @@
 #define	M_INTWAIT	(M_WAITOK | M_USE_RESERVE | M_USE_INTERRUPT_RESERVE)
 #define	M_SYSWAIT	(M_WAITOK | M_USE_RESERVE)
 
-#define	M_NOWAIT	M_INTNOWAIT
+#define	M_NOWAIT	(M_RNOWAIT | M_NULLOK | M_USE_RESERVE)
 #define	M_SYSALLOC	M_SYSWAIT
 
 #define	M_MAGIC		877983977	/* time when first defined :-) */
diff --git a/sys/sys/mount.h b/sys/sys/mount.h
index dadd883737..e3c3b1cbfb 100644
--- a/sys/sys/mount.h
+++ b/sys/sys/mount.h
@@ -622,7 +622,7 @@ struct vfsops {
 #define VFS_EXTATTRCTL(MP, C, FVP, NS, N, CRED)	\
 	vfs_extattrctl(MP, C, FVP, NS, N, CRED)
 #define VFS_ACCOUNT(MP, U, G, D) \
-	if (MP->mnt_op->vfs_account != NULL) \
+	if ((MP->mnt_op->vfs_account != NULL) && (D != 0)) \
 		MP->mnt_op->vfs_account(MP, U, G, D);
 #define VFS_NCPGEN_SET(MP, NCP) \
 	MP->mnt_op->vfs_ncpgen_set(MP, NCP)
diff --git a/sys/sys/resource.h b/sys/sys/resource.h
index f1bc46c2a7..15d95596f2 100644
--- a/sys/sys/resource.h
+++ b/sys/sys/resource.h
@@ -136,12 +136,21 @@ struct rlimit {
 	rlim_t	rlim_max;		/* maximum value for rlim_cur */
 };
 
-/* Load average structure. */
 struct loadavg {
 	fixpt_t	ldavg[3];
 	long	fscale;
 };
 
+/*
+ * CPU state fields as reported by the sysctl kern.cp_time
+ */
+#define CP_USER         0
+#define CP_NICE         1
+#define CP_SYS          2
+#define CP_INTR         3
+#define CP_IDLE         4
+#define CPUSTATES       5
+
 #ifdef _KERNEL
 extern struct loadavg averunnable;
 
diff --git a/sys/vfs/devfs/devfs_vnops.c b/sys/vfs/devfs/devfs_vnops.c
index 04638fb6e1..31716adddf 100644
--- a/sys/vfs/devfs/devfs_vnops.c
+++ b/sys/vfs/devfs/devfs_vnops.c
@@ -907,7 +907,8 @@ devfs_spec_open(struct vop_open_args *ap)
 	 * Make this field valid before any I/O in ->d_open
 	 */
 	if (!dev->si_iosize_max)
-		dev->si_iosize_max = DFLTPHYS;
+		/* XXX: old DFLTPHYS == 64KB dependency */
+		dev->si_iosize_max = min(MAXPHYS,64*1024);
 
 	if (dev_dflags(dev) & D_TTY)
 		vsetflags(vp, VISTTY);
diff --git a/sys/vfs/hammer/hammer_io.c b/sys/vfs/hammer/hammer_io.c
index b32b115b69..db1d14916d 100644
--- a/sys/vfs/hammer/hammer_io.c
+++ b/sys/vfs/hammer/hammer_io.c
@@ -73,9 +73,9 @@ hammer_mod_rb_compare(hammer_io_t io1, hammer_io_t io2)
 	hammer_off_t io2_offset;
 
 	io1_offset = ((io1->offset & HAMMER_OFF_SHORT_MASK) << 8) |
-		     HAMMER_VOL_DECODE(io1->offset);
+		     io1->volume->vol_no;
 	io2_offset = ((io2->offset & HAMMER_OFF_SHORT_MASK) << 8) |
-		     HAMMER_VOL_DECODE(io2->offset);
+		     io2->volume->vol_no;
 
 	if (io1_offset < io2_offset)
 		return(-1);
diff --git a/sys/vfs/hpfs/hpfs_vnops.c b/sys/vfs/hpfs/hpfs_vnops.c
index 10be9042e8..12fa3ace42 100644
--- a/sys/vfs/hpfs/hpfs_vnops.c
+++ b/sys/vfs/hpfs/hpfs_vnops.c
@@ -322,7 +322,7 @@ hpfs_read(struct vop_read_args *ap)
 		if (error)
 			return (error);
 
-		toread = min(off + resid, min(DFLTPHYS, (runl+1)*DEV_BSIZE));
+		toread = min(off + resid, min(64*1024, (runl+1)*DEV_BSIZE));
 		xfersz = (toread + DEV_BSIZE - 1) & ~(DEV_BSIZE - 1);
 		dprintf(("hpfs_read: bn: 0x%x (0x%x) toread: 0x%x (0x%x)\n",
 			bn, runl, toread, xfersz));
@@ -391,7 +391,7 @@ hpfs_write(struct vop_write_args *ap)
 			return (error);
 
 		towrite = szmin(off + uio->uio_resid,
-				min(DFLTPHYS, (runl+1)*DEV_BSIZE));
+				min(64*1024, (runl+1)*DEV_BSIZE));
 		xfersz = (towrite + DEV_BSIZE - 1) & ~(DEV_BSIZE - 1);
 		dprintf(("hpfs_write: bn: 0x%x (0x%x) towrite: 0x%x (0x%x)\n",
 			bn, runl, towrite, xfersz));
diff --git a/sys/vfs/mfs/mfs_vfsops.c b/sys/vfs/mfs/mfs_vfsops.c
index 1c80dc013f..17b5324c33 100644
--- a/sys/vfs/mfs/mfs_vfsops.c
+++ b/sys/vfs/mfs/mfs_vfsops.c
@@ -335,7 +335,7 @@ mfs_mount(struct mount *mp, char *path, caddr_t data, struct ucred *cred)
 		       "mfs%d", minnum);
 	/* It is not clear that these will get initialized otherwise */
 	dev->si_bsize_phys = DEV_BSIZE;
-	dev->si_iosize_max = DFLTPHYS;
+	dev->si_iosize_max = MAXPHYS;
 	dev->si_drv1 = mfsp;
 	mfsp->mfs_baseoff = args.base;
 	mfsp->mfs_size = args.size;
diff --git a/sys/vfs/ufs/ffs_softdep.c b/sys/vfs/ufs/ffs_softdep.c
index 93855cc98d..7828bd5596 100644
--- a/sys/vfs/ufs/ffs_softdep.c
+++ b/sys/vfs/ufs/ffs_softdep.c
@@ -72,6 +72,7 @@
 #include 
 #include 
 #include 
+#include 
 
 /*
  * These definitions need to be adapted to the system to which
@@ -221,132 +222,48 @@ static struct bio_ops softdep_bioops = {
 
 /*
  * Locking primitives.
- *
- * For a uniprocessor, all we need to do is protect against disk
- * interrupts. For a multiprocessor, this lock would have to be
- * a mutex. A single mutex is used throughout this file, though
- * finer grain locking could be used if contention warranted it.
- *
- * For a multiprocessor, the sleep call would accept a lock and
- * release it after the sleep processing was complete. In a uniprocessor
- * implementation there is no such interlock, so we simple mark
- * the places where it needs to be done with the `interlocked' form
- * of the lock calls. Since the uniprocessor sleep already interlocks
- * the spl, there is nothing that really needs to be done.
  */
-#ifndef /* NOT */ DEBUG
-static struct lockit {
-} lk = { 0 };
-#define ACQUIRE_LOCK(lk)		crit_enter_id("softupdates");
-#define FREE_LOCK(lk)			crit_exit_id("softupdates");
-
-#else /* DEBUG */
-#define NOHOLDER	((struct thread *)-1)
-#define SPECIAL_FLAG	((struct thread *)-2)
-static struct lockit {
-	int	lkt_spl;
-	struct thread *lkt_held;
-} lk = { 0, NOHOLDER };
-static int lockcnt;
-
-static	void acquire_lock(struct lockit *);
-static	void free_lock(struct lockit *);
-void	softdep_panic(char *);
-
-#define ACQUIRE_LOCK(lk)		acquire_lock(lk)
-#define FREE_LOCK(lk)			free_lock(lk)
+static	void acquire_lock(struct lock *);
+static	void free_lock(struct lock *);
+#ifdef INVARIANTS
+static	int lock_held(struct lock *);
+#endif
+static	int interlocked_sleep(struct lock *, void *, int,
+	    const char *, int);
+
+static struct lock lk;
+
+#define ACQUIRE_LOCK(lkp)		acquire_lock(lkp)
+#define FREE_LOCK(lkp)			free_lock(lkp)
 
 static void
-acquire_lock(struct lockit *lk)
+acquire_lock(struct lock *lkp)
 {
-	thread_t holder;
-
-	if (lk->lkt_held != NOHOLDER) {
-		holder = lk->lkt_held;
-		FREE_LOCK(lk);
-		if (holder == curthread)
-			panic("softdep_lock: locking against myself");
-		else
-			panic("softdep_lock: lock held by %p", holder);
-	}
-	crit_enter_id("softupdates");
-	lk->lkt_held = curthread;
-	lockcnt++;
+	lockmgr(lkp, LK_EXCLUSIVE);
 }
 
 static void
-free_lock(struct lockit *lk)
+free_lock(struct lock *lkp)
 {
-
-	if (lk->lkt_held == NOHOLDER)
-		panic("softdep_unlock: lock not held");
-	lk->lkt_held = NOHOLDER;
-	crit_exit_id("softupdates");
+	lockmgr(lkp, LK_RELEASE);
 }
 
-/*
- * Function to release soft updates lock and panic.
- */
-void
-softdep_panic(char *msg)
+#ifdef INVARIANTS
+static int
+lock_held(struct lock *lkp) 
 {
-
-	if (lk.lkt_held != NOHOLDER)
-		FREE_LOCK(&lk);
-	panic(msg);
+	return lockcountnb(lkp);
 }
-#endif /* DEBUG */
-
-static	int interlocked_sleep(struct lockit *, int, void *, int,
-	    const char *, int);
-
-/*
- * When going to sleep, we must save our SPL so that it does
- * not get lost if some other process uses the lock while we
- * are sleeping. We restore it after we have slept. This routine
- * wraps the interlocking with functions that sleep. The list
- * below enumerates the available set of operations.
- */
-#define	UNKNOWN		0
-#define	SLEEP		1
-#define	LOCKBUF		2
+#endif
 
 static int
-interlocked_sleep(struct lockit *lk, int op, void *ident, int flags,
+interlocked_sleep(struct lock *lkp, void *ident, int flags,
 		  const char *wmesg, int timo)
 {
-	thread_t holder;
-	int s, retval;
-
-	s = lk->lkt_spl;
-#	ifdef DEBUG
-	if (lk->lkt_held == NOHOLDER)
-		panic("interlocked_sleep: lock not held");
-	lk->lkt_held = NOHOLDER;
-#	endif /* DEBUG */
-	switch (op) {
-	case SLEEP:
-		retval = tsleep(ident, flags, wmesg, timo);
-		break;
-	case LOCKBUF:
-		retval = BUF_LOCK((struct buf *)ident, flags);
-		break;
-	default:
-		panic("interlocked_sleep: unknown operation");
-	}
-#	ifdef DEBUG
-	if (lk->lkt_held != NOHOLDER) {
-		holder = lk->lkt_held;
-		FREE_LOCK(lk);
-		if (holder == curthread)
-			panic("interlocked_sleep: locking against self");
-		else
-			panic("interlocked_sleep: lock held by %p", holder);
-	}
-	lk->lkt_held = curthread;
-	lockcnt++;
-#	endif /* DEBUG */
-	lk->lkt_spl = s;
+	int retval;
+
+	KKASSERT(lock_held(lkp) > 0);
+	retval = lksleep(ident, lkp, flags, wmesg, timo);
 	return (retval);
 }
 
@@ -361,9 +278,11 @@ struct sema {
 	int	timo;
 };
 static	void sema_init(struct sema *, char *, int, int);
-static	int sema_get(struct sema *, struct lockit *);
+static	int sema_get(struct sema *, struct lock *);
 static	void sema_release(struct sema *);
 
+#define NOHOLDER	((struct thread *) -1)
+
 static void
 sema_init(struct sema *semap, char *name, int prio, int timo)
 {
@@ -376,12 +295,12 @@ sema_init(struct sema *semap, char *name, int prio, int timo)
 }
 
 static int
-sema_get(struct sema *semap, struct lockit *interlock)
+sema_get(struct sema *semap, struct lock *interlock)
 {
 
 	if (semap->value++ > 0) {
 		if (interlock != NULL) {
-			interlocked_sleep(interlock, SLEEP, (caddr_t)semap,
+			interlocked_sleep(interlock, (caddr_t)semap,
 			    semap->prio, semap->name, semap->timo);
 			FREE_LOCK(interlock);
 		} else {
@@ -401,8 +320,6 @@ sema_release(struct sema *semap)
 {
 
 	if (semap->value <= 0 || semap->holder != curthread) {
-		if (lk.lkt_held != NOHOLDER)
-			FREE_LOCK(&lk);
 		panic("sema_release: not held");
 	}
 	if (--semap->value > 0) {
@@ -416,26 +333,6 @@ sema_release(struct sema *semap)
  * Worklist queue management.
  * These routines require that the lock be held.
  */
-#ifndef /* NOT */ DEBUG
-#define WORKLIST_INSERT(head, item) do {	\
-	(item)->wk_state |= ONWORKLIST;		\
-	LIST_INSERT_HEAD(head, item, wk_list);	\
-} while (0)
-
-#define WORKLIST_INSERT_BP(bp, item) do {	\
-	(item)->wk_state |= ONWORKLIST;		\
-	(bp)->b_ops = &softdep_bioops;		\
-	LIST_INSERT_HEAD(&(bp)->b_dep, item, wk_list);	\
-} while (0)
-
-#define WORKLIST_REMOVE(item) do {		\
-	(item)->wk_state &= ~ONWORKLIST;	\
-	LIST_REMOVE(item, wk_list);		\
-} while (0)
-
-#define WORKITEM_FREE(item, type) kfree(item, DtoM(type))
-
-#else /* DEBUG */
 static	void worklist_insert(struct workhead *, struct worklist *);
 static	void worklist_remove(struct worklist *);
 static	void workitem_free(struct worklist *, int);
@@ -453,10 +350,9 @@ static void
 worklist_insert(struct workhead *head, struct worklist *item)
 {
 
-	if (lk.lkt_held == NOHOLDER)
-		panic("worklist_insert: lock not held");
+	KKASSERT(lock_held(&lk) > 0);
+
 	if (item->wk_state & ONWORKLIST) {
-		FREE_LOCK(&lk);
 		panic("worklist_insert: already on list");
 	}
 	item->wk_state |= ONWORKLIST;
@@ -467,12 +363,10 @@ static void
 worklist_remove(struct worklist *item)
 {
 
-	if (lk.lkt_held == NOHOLDER)
-		panic("worklist_remove: lock not held");
-	if ((item->wk_state & ONWORKLIST) == 0) {
-		FREE_LOCK(&lk);
+	KKASSERT(lock_held(&lk));
+	if ((item->wk_state & ONWORKLIST) == 0) 
 		panic("worklist_remove: not on list");
-	}
+	
 	item->wk_state &= ~ONWORKLIST;
 	LIST_REMOVE(item, wk_list);
 }
@@ -481,19 +375,13 @@ static void
 workitem_free(struct worklist *item, int type)
 {
 
-	if (item->wk_state & ONWORKLIST) {
-		if (lk.lkt_held != NOHOLDER)
-			FREE_LOCK(&lk);
+	if (item->wk_state & ONWORKLIST) 
 		panic("workitem_free: still on list");
-	}
-	if (item->wk_type != type) {
-		if (lk.lkt_held != NOHOLDER)
-			FREE_LOCK(&lk);
+	if (item->wk_type != type) 
 		panic("workitem_free: type mismatch");
-	}
+
 	kfree(item, DtoM(type));
 }
-#endif /* DEBUG */
 
 /*
  * Workitem queue management
@@ -567,8 +455,6 @@ add_to_worklist(struct worklist *wk)
 	static struct worklist *worklist_tail;
 
 	if (wk->wk_state & ONWORKLIST) {
-		if (lk.lkt_held != NOHOLDER)
-			FREE_LOCK(&lk);
 		panic("add_to_worklist: already on list");
 	}
 	wk->wk_state |= ONWORKLIST;
@@ -803,12 +689,14 @@ softdep_flushfiles(struct mount *oldmnt, int flags)
 	/*
 	 * Await our turn to clear out the queue, then serialize access.
 	 */
+	ACQUIRE_LOCK(&lk);
 	while (softdep_worklist_busy != 0) {
 		softdep_worklist_req += 1;
-		tsleep(&softdep_worklist_req, 0, "softflush", 0);
+		lksleep(&softdep_worklist_req, &lk, 0, "softflush", 0);
 		softdep_worklist_req -= 1;
 	}
 	softdep_worklist_busy = -1;
+	FREE_LOCK(&lk);
 
 	if ((error = ffs_flushfiles(oldmnt, flags)) != 0) {
 		softdep_worklist_busy = 0;
@@ -844,9 +732,11 @@ softdep_flushfiles(struct mount *oldmnt, int flags)
 		if (error)
 			break;
 	}
+	ACQUIRE_LOCK(&lk);
 	softdep_worklist_busy = 0;
-	if (softdep_worklist_req)
+	if (softdep_worklist_req) 
 		wakeup(&softdep_worklist_req);
+	FREE_LOCK(&lk);
 
 	/*
 	 * If we are unmounting then it is an error to fail. If we
@@ -931,10 +821,8 @@ pagedep_lookup(struct inode *ip, ufs_lbn_t lbn, int flags,
 	struct mount *mp;
 	int i;
 
-#ifdef DEBUG
-	if (lk.lkt_held == NOHOLDER)
-		panic("pagedep_lookup: lock not held");
-#endif
+	KKASSERT(lock_held(&lk) > 0);
+	
 	mp = ITOV(ip)->v_mount;
 	pagedephd = PAGEDEP_HASH(mp, ip->i_number, lbn);
 top:
@@ -1013,10 +901,8 @@ inodedep_lookup(struct fs *fs, ino_t inum, int flags,
 	struct inodedep_hashhead *inodedephd;
 	int firsttry;
 
-#ifdef DEBUG
-	if (lk.lkt_held == NOHOLDER)
-		panic("inodedep_lookup: lock not held");
-#endif
+	KKASSERT(lock_held(&lk) > 0);
+
 	firsttry = 1;
 	inodedephd = INODEDEP_HASH(fs, inum);
 top:
@@ -1148,6 +1034,7 @@ softdep_initialize(void)
 		M_INODEDEP->ks_limit / (2 * sizeof(struct inodedep)));
 	pagedep_hashtbl = hashinit(desiredvnodes / 5, M_PAGEDEP,
 	    &pagedep_hash);
+	lockinit(&lk, "ffs_softdep", 0, LK_CANRECURSE);
 	sema_init(&pagedep_in_progress, "pagedep", 0, 0);
 	inodedep_hashtbl = hashinit(desiredvnodes, M_INODEDEP, &inodedep_hash);
 	sema_init(&inodedep_in_progress, "inodedep", 0, 0);
@@ -1306,10 +1193,8 @@ bmsafemap_lookup(struct buf *bp)
 	struct bmsafemap *bmsafemap;
 	struct worklist *wk;
 
-#ifdef DEBUG
-	if (lk.lkt_held == NOHOLDER)
-		panic("bmsafemap_lookup: lock not held");
-#endif
+	KKASSERT(lock_held(&lk) > 0);
+
 	LIST_FOREACH(wk, &bp->b_dep, wk_list) {
 		if (wk->wk_type == D_BMSAFEMAP)
 			return (WK_BMSAFEMAP(wk));
@@ -1485,10 +1370,8 @@ allocdirect_merge(struct allocdirectlst *adphead,
 {
 	struct freefrag *freefrag;
 
-#ifdef DEBUG
-	if (lk.lkt_held == NOHOLDER)
-		panic("allocdirect_merge: lock not held");
-#endif
+	KKASSERT(lock_held(&lk) > 0);
+
 	if (newadp->ad_oldblkno != oldadp->ad_newblkno ||
 	    newadp->ad_oldsize != oldadp->ad_newsize ||
 	    newadp->ad_lbn >= NDADDR) {
@@ -2101,11 +1984,8 @@ static void
 free_allocdirect(struct allocdirectlst *adphead,
 		 struct allocdirect *adp, int delay)
 {
+	KKASSERT(lock_held(&lk) > 0);
 
-#ifdef DEBUG
-	if (lk.lkt_held == NOHOLDER)
-		panic("free_allocdirect: lock not held");
-#endif
 	if ((adp->ad_state & DEPCOMPLETE) == 0)
 		LIST_REMOVE(adp, ad_deps);
 	TAILQ_REMOVE(adphead, adp, ad_next);
@@ -2391,10 +2271,8 @@ free_allocindir(struct allocindir *aip, struct inodedep *inodedep)
 {
 	struct freefrag *freefrag;
 
-#ifdef DEBUG
-	if (lk.lkt_held == NOHOLDER)
-		panic("free_allocindir: lock not held");
-#endif
+	KKASSERT(lock_held(&lk) > 0);
+
 	if ((aip->ai_state & DEPCOMPLETE) == 0)
 		LIST_REMOVE(aip, ai_deps);
 	if (aip->ai_state & ONWORKLIST)
@@ -2597,10 +2475,8 @@ free_diradd(struct diradd *dap)
 	struct inodedep *inodedep;
 	struct mkdir *mkdir, *nextmd;
 
-#ifdef DEBUG
-	if (lk.lkt_held == NOHOLDER)
-		panic("free_diradd: lock not held");
-#endif
+	KKASSERT(lock_held(&lk) > 0);
+
 	WORKLIST_REMOVE(&dap->da_list);
 	LIST_REMOVE(dap, da_pdlist);
 	if ((dap->da_state & DIRCHG) == 0) {
@@ -3152,6 +3028,7 @@ softdep_disk_io_initiation(struct buf *bp)
 		panic("softdep_disk_io_initiation: read");
 
 	get_mplock();
+	ACQUIRE_LOCK(&lk);
 	marker.wk_type = D_LAST + 1;	/* Not a normal workitem */
 	
 	/*
@@ -3214,6 +3091,7 @@ softdep_disk_io_initiation(struct buf *bp)
 			/* NOTREACHED */
 		}
 	}
+	FREE_LOCK(&lk);
 	rel_mplock();
 }
 
@@ -3435,12 +3313,8 @@ softdep_disk_write_complete(struct buf *bp)
 	struct inodedep *inodedep;
 	struct bmsafemap *bmsafemap;
 
-	get_mplock();
-#ifdef DEBUG
-	if (lk.lkt_held != NOHOLDER)
-		panic("softdep_disk_write_complete: lock is held");
-	lk.lkt_held = SPECIAL_FLAG;
-#endif
+	ACQUIRE_LOCK(&lk);
+
 	LIST_INIT(&reattach);
 	while ((wk = LIST_FIRST(&bp->b_dep)) != NULL) {
 		WORKLIST_REMOVE(wk);
@@ -3505,7 +3379,6 @@ softdep_disk_write_complete(struct buf *bp)
 		case D_INDIRDEP:
 			indirdep = WK_INDIRDEP(wk);
 			if (indirdep->ir_state & GOINGAWAY) {
-				lk.lkt_held = NOHOLDER;
 				panic("disk_write_complete: indirdep gone");
 			}
 			bcopy(indirdep->ir_saveddata, bp->b_data, bp->b_bcount);
@@ -3516,7 +3389,6 @@ softdep_disk_write_complete(struct buf *bp)
 			while ((aip = LIST_FIRST(&indirdep->ir_donehd)) != NULL) {
 				handle_allocindir_partdone(aip);
 				if (aip == LIST_FIRST(&indirdep->ir_donehd)) {
-					lk.lkt_held = NOHOLDER;
 					panic("disk_write_complete: not gone");
 				}
 			}
@@ -3527,7 +3399,6 @@ softdep_disk_write_complete(struct buf *bp)
 			continue;
 
 		default:
-			lk.lkt_held = NOHOLDER;
 			panic("handle_disk_write_complete: Unknown type %s",
 			    TYPENAME(wk->wk_type));
 			/* NOTREACHED */
@@ -3540,12 +3411,8 @@ softdep_disk_write_complete(struct buf *bp)
 		WORKLIST_REMOVE(wk);
 		WORKLIST_INSERT_BP(bp, wk);
 	}
-#ifdef DEBUG
-	if (lk.lkt_held != SPECIAL_FLAG)
-		panic("softdep_disk_write_complete: lock lost");
-	lk.lkt_held = NOHOLDER;
-#endif
-	rel_mplock();
+
+	FREE_LOCK(&lk);
 }
 
 /*
@@ -3565,10 +3432,9 @@ handle_allocdirect_partdone(struct allocdirect *adp)
 
 	if ((adp->ad_state & ALLCOMPLETE) != ALLCOMPLETE)
 		return;
-	if (adp->ad_buf != NULL) {
-		lk.lkt_held = NOHOLDER;
+	if (adp->ad_buf != NULL) 
 		panic("handle_allocdirect_partdone: dangling dep");
-	}
+	
 	/*
 	 * The on-disk inode cannot claim to be any larger than the last
 	 * fragment that has been written. Otherwise, the on-disk inode
@@ -3603,10 +3469,8 @@ handle_allocdirect_partdone(struct allocdirect *adp)
 			/* found our block */
 			if (listadp == adp)
 				break;
-		if (listadp == NULL) {
-			lk.lkt_held = NOHOLDER;
+		if (listadp == NULL) 
 			panic("handle_allocdirect_partdone: lost dep");
-		}
 #endif /* DEBUG */
 		return;
 	}
@@ -3637,10 +3501,9 @@ handle_allocindir_partdone(struct allocindir *aip)
 
 	if ((aip->ai_state & ALLCOMPLETE) != ALLCOMPLETE)
 		return;
-	if (aip->ai_buf != NULL) {
-		lk.lkt_held = NOHOLDER;
+	if (aip->ai_buf != NULL) 
 		panic("handle_allocindir_partdone: dangling dependency");
-	}
+	
 	indirdep = aip->ai_indirdep;
 	if (indirdep->ir_state & UNDONE) {
 		LIST_REMOVE(aip, ai_next);
@@ -3672,10 +3535,9 @@ handle_written_inodeblock(struct inodedep *inodedep, struct buf *bp)
 	struct ufs1_dinode *dp;
 	int hadchanges;
 
-	if ((inodedep->id_state & IOSTARTED) == 0) {
-		lk.lkt_held = NOHOLDER;
+	if ((inodedep->id_state & IOSTARTED) == 0) 
 		panic("handle_written_inodeblock: not started");
-	}
+	
 	inodedep->id_state &= ~IOSTARTED;
 	dp = (struct ufs1_dinode *)bp->b_data +
 	    ino_to_fsbo(inodedep->id_fs, inodedep->id_ino);
@@ -3703,13 +3565,11 @@ handle_written_inodeblock(struct inodedep *inodedep, struct buf *bp)
 	hadchanges = 0;
 	for (adp = TAILQ_FIRST(&inodedep->id_inoupdt); adp; adp = nextadp) {
 		nextadp = TAILQ_NEXT(adp, ad_next);
-		if (adp->ad_state & ATTACHED) {
-			lk.lkt_held = NOHOLDER;
+		if (adp->ad_state & ATTACHED) 
 			panic("handle_written_inodeblock: new entry");
-		}
+		
 		if (adp->ad_lbn < NDADDR) {
 			if (dp->di_db[adp->ad_lbn] != adp->ad_oldblkno) {
-				lk.lkt_held = NOHOLDER;
 				panic("%s: %s #%ld mismatch %d != %d",
 				    "handle_written_inodeblock",
 				    "direct pointer", adp->ad_lbn,
@@ -3718,7 +3578,6 @@ handle_written_inodeblock(struct inodedep *inodedep, struct buf *bp)
 			dp->di_db[adp->ad_lbn] = adp->ad_newblkno;
 		} else {
 			if (dp->di_ib[adp->ad_lbn - NDADDR] != 0) {
-				lk.lkt_held = NOHOLDER;
 				panic("%s: %s #%ld allocated as %d",
 				    "handle_written_inodeblock",
 				    "indirect pointer", adp->ad_lbn - NDADDR,
@@ -3736,7 +3595,6 @@ handle_written_inodeblock(struct inodedep *inodedep, struct buf *bp)
 	 * Reset the file size to its most up-to-date value.
 	 */
 	if (inodedep->id_savedsize == -1) {
-		lk.lkt_held = NOHOLDER;
 		panic("handle_written_inodeblock: bad size");
 	}
 	if (dp->di_size != inodedep->id_savedsize) {
@@ -3776,7 +3634,6 @@ handle_written_inodeblock(struct inodedep *inodedep, struct buf *bp)
 			 * have been freed.
 			 */
 			if (filefree != NULL) {
-				lk.lkt_held = NOHOLDER;
 				panic("handle_written_inodeblock: filefree");
 			}
 			filefree = wk;
@@ -3801,7 +3658,6 @@ handle_written_inodeblock(struct inodedep *inodedep, struct buf *bp)
 			continue;
 
 		default:
-			lk.lkt_held = NOHOLDER;
 			panic("handle_written_inodeblock: Unknown type %s",
 			    TYPENAME(wk->wk_type));
 			/* NOTREACHED */
@@ -3809,7 +3665,6 @@ handle_written_inodeblock(struct inodedep *inodedep, struct buf *bp)
 	}
 	if (filefree != NULL) {
 		if (free_inodedep(inodedep) == 0) {
-			lk.lkt_held = NOHOLDER;
 			panic("handle_written_inodeblock: live inodedep");
 		}
 		add_to_worklist(filefree);
@@ -3855,7 +3710,6 @@ handle_written_mkdir(struct mkdir *mkdir, int type)
 	struct pagedep *pagedep;
 
 	if (mkdir->md_state != type) {
-		lk.lkt_held = NOHOLDER;
 		panic("handle_written_mkdir: bad type");
 	}
 	dap = mkdir->md_diradd;
@@ -3893,7 +3747,6 @@ handle_written_filepage(struct pagedep *pagedep, struct buf *bp)
 	int i, chgs;
 
 	if ((pagedep->pd_state & IOSTARTED) == 0) {
-		lk.lkt_held = NOHOLDER;
 		panic("handle_written_filepage: not started");
 	}
 	pagedep->pd_state &= ~IOSTARTED;
@@ -3918,7 +3771,6 @@ handle_written_filepage(struct pagedep *pagedep, struct buf *bp)
 		     dap = nextdap) {
 			nextdap = LIST_NEXT(dap, da_pdlist);
 			if (dap->da_state & ATTACHED) {
-				lk.lkt_held = NOHOLDER;
 				panic("handle_written_filepage: attached");
 			}
 			ep = (struct direct *)
@@ -4079,14 +3931,24 @@ softdep_update_inodeblock(struct inode *ip, struct buf *bp,
 	 * forced sync (e.g., an fsync on a file), we force the bitmap
 	 * to be written so that the update can be done.
 	 */
-	if ((inodedep->id_state & DEPCOMPLETE) != 0 || waitfor == 0) {
+	if (waitfor == 0) {
+		FREE_LOCK(&lk);
+		return;
+	}
+retry:
+	if ((inodedep->id_state & DEPCOMPLETE) != 0) {
 		FREE_LOCK(&lk);
 		return;
 	}
 	gotit = getdirtybuf(&inodedep->id_buf, MNT_WAIT);
+	if (gotit == 0) {
+		if (inodedep_lookup(ip->i_fs, ip->i_number, 0, &inodedep) != 0)
+			goto retry;
+		FREE_LOCK(&lk);
+		return;
+	}
 	FREE_LOCK(&lk);
-	if (gotit &&
-	    (error = bwrite(inodedep->id_buf)) != 0)
+	if ((error = bwrite(inodedep->id_buf)) != 0)
 		softdep_error("softdep_update_inodeblock: bwrite", error);
 }
 
@@ -4899,7 +4761,7 @@ request_cleanup(int resource, int islocked)
 	if (!callout_active(&handle))
 		callout_reset(&handle, tickdelay > 2 ? tickdelay : 2,
 			      pause_timer, NULL);
-	interlocked_sleep(&lk, SLEEP, (caddr_t)&proc_waiting, 0,
+	interlocked_sleep(&lk, (caddr_t)&proc_waiting, 0,
 	    "softupdate", 0);
 	proc_waiting -= 1;
 	if (islocked == 0)
@@ -5143,9 +5005,13 @@ out:
 }
 
 /*
- * Acquire exclusive access to a buffer.
- * Must be called with splbio blocked.
- * Return 1 if buffer was acquired.
+ * getdirtybuf:
+ *
+ *	Acquire exclusive access to a buffer. Requires softdep lock
+ *	to be held on entry. If waitfor is MNT_WAIT, may release/reacquire
+ *	softdep lock.
+ *
+ *	Returns 1 if the buffer was locked, 0 otherwise.
  */
 static int
 getdirtybuf(struct buf **bpp, int waitfor)
@@ -5153,20 +5019,38 @@ getdirtybuf(struct buf **bpp, int waitfor)
 	struct buf *bp;
 	int error;
 
+	bp = *bpp;
+	if (bp == NULL)
+		return (0);
+
 	for (;;) {
-		if ((bp = *bpp) == NULL)
-			return (0);
-		if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_NOWAIT) == 0)
+		/* Must acquire buffer lock with ffs_softdep lock held */
+		KKASSERT(lock_held(&lk) > 0);
+		error = BUF_LOCK(bp, LK_EXCLUSIVE | LK_NOWAIT);
+		if (error == 0)
 			break;
+
 		if (waitfor != MNT_WAIT)
 			return (0);
-		error = interlocked_sleep(&lk, LOCKBUF, bp,
-		    LK_EXCLUSIVE | LK_SLEEPFAIL, 0, 0);
-		if (error != ENOLCK) {
-			FREE_LOCK(&lk);
-			panic("getdirtybuf: inconsistent lock");
-		}
+
+		/* 
+		 * Release ffs_softdep lock around sleep/wait for buffer lock.
+		 *
+		 * We must acquire buffer lock with softdep lock held, so
+		 * we must retry locking the buffer after we wake.
+		 */
+		FREE_LOCK(&lk);
+		error = BUF_LOCK(bp, LK_EXCLUSIVE | LK_SLEEPFAIL);
+		ACQUIRE_LOCK(&lk);
+		if (error == 0)
+			BUF_UNLOCK(bp);
+		else if (error == ENOLCK)
+			;
+		else
+			panic("getdirtybuf: Inconsistent lock");
 	}
+
+	/* Buffer wasn't dirty */
 	if ((bp->b_flags & B_DELWRI) == 0) {
 		BUF_UNLOCK(bp);
 		return (0);
diff --git a/sys/vfs/ufs/ffs_vfsops.c b/sys/vfs/ufs/ffs_vfsops.c
index ecd49b5936..b004177cfe 100644
--- a/sys/vfs/ufs/ffs_vfsops.c
+++ b/sys/vfs/ufs/ffs_vfsops.c
@@ -1031,7 +1031,7 @@ ffs_sync_scan1(struct mount *mp, struct vnode *vp, void *data)
 	/* Restart out whole search if this guy is locked
 	 * or is being reclaimed.
 	 */
-	if (vp->v_type == VNON || ((ip->i_flag &
+	if (vp->v_type == VNON || (ip == NULL) || ((ip->i_flag &
 	     (IN_ACCESS | IN_CHANGE | IN_MODIFIED | IN_UPDATE)) == 0 &&
 	     RB_EMPTY(&vp->v_rbdirty_tree))) {
 		return(-1);
diff --git a/sys/vm/vm_zone.c b/sys/vm/vm_zone.c
index dcc59ec610..68d2ebd6f0 100644
--- a/sys/vm/vm_zone.c
+++ b/sys/vm/vm_zone.c
@@ -702,7 +702,7 @@ zerror(int error)
 		msg = "zone: invalid error";
 		break;
 	}
-	panic(msg);
+	panic("%s", msg);
 }
 #endif
 
diff --git a/test/stress/fsstress/dotest.sample b/test/stress/fsstress/dotest.sample
index 1810179802..45b97f7b4c 100644
--- a/test/stress/fsstress/dotest.sample
+++ b/test/stress/fsstress/dotest.sample
@@ -1,6 +1,4 @@
-#!/bin/tcsh
-#
-# $DragonFly: src/test/stress/fsstress/dotest.sample,v 1.1 2004/05/07 17:51:02 dillon Exp $
+#!/bin/sh
 
-./fsstress -n 1000000 -p 10 -d test
+/tmp/fsstress -n 1000000 -p 10 -d test
 
diff --git a/usr.bin/fmt/fmt.c b/usr.bin/fmt/fmt.c
index 1ff93bf45e..32bf2517cb 100644
--- a/usr.bin/fmt/fmt.c
+++ b/usr.bin/fmt/fmt.c
@@ -256,7 +256,7 @@ main(int argc, char *argv[]) {
   /* 1. Grok parameters. */
 
   while ((ch = getopt(argc, argv, "0123456789cd:hl:mnpst:w:")) != -1)
-  switch(ch) {
+    switch(ch) {
     case 'c':
       centerP = 1;
       format_troff = 1;
@@ -316,7 +316,7 @@ main(int argc, char *argv[]) {
 "         -w  set maximum width to \n"
 "         goal   set target width to goal\n");
       exit(ch=='h' ? 0 : EX_USAGE);
-  }
+    }
   argc -= optind; argv += optind;
 
   /* [ goal [ maximum ] ] */
diff --git a/usr.bin/netstat/inet.c b/usr.bin/netstat/inet.c
index 3319cbf069..1cc0ea9933 100644
--- a/usr.bin/netstat/inet.c
+++ b/usr.bin/netstat/inet.c
@@ -446,6 +446,10 @@ tcp_stats(u_long off __unused, const char *name, int af1 __unused)
 		"\t\t%lu data packet%s (%lu byte%s)\n");
 	p2(tcps_sndrexmitpack, tcps_sndrexmitbyte,
 		"\t\t%lu data packet%s (%lu byte%s) retransmitted\n");
+	p2(tcps_sndsackpack, tcps_sndsackbyte,
+		"\t\t%lu data packet%s (%lu byte%s) sent by SACK recovery\n");
+	p2(tcps_sndsackrtopack, tcps_sndsackrtobyte,
+		"\t\t%lu data packet%s (%lu byte%s) retransmitted by SACK\n");
 	p2a(tcps_sndfastrexmit, tcps_sndearlyrexmit,
 		"\t\t%lu Fast Retransmit%s (%lu early)\n");
 	p(tcps_sndlimited, "\t\t%lu packet%s sent by Limited Transmit\n");
@@ -456,6 +460,8 @@ tcp_stats(u_long off __unused, const char *name, int af1 __unused)
 		"\t\t%lu Eifel-detected spurious retransmit%s (%lu non-RTT)\n");
 	p(tcps_rttdetected, "\t\t%lu RTT-detected spurious retransmit%s\n");
 	p(tcps_mturesent, "\t\t%lu resend%s initiated by MTU discovery\n");
+	p(tcps_sndsackopt, "\t\t%lu SACK option%s sent\n");
+	p(tcps_snddsackopt, "\t\t%lu D-SACK option%s sent\n");
 	p2a(tcps_sndacks, tcps_delack,
 		"\t\t%lu ack-only packet%s (%lu delayed)\n");
 	p(tcps_sndurg, "\t\t%lu URG only packet%s\n");
@@ -483,6 +489,7 @@ tcp_stats(u_long off __unused, const char *name, int af1 __unused)
 	p(tcps_rcvbadsum, "\t\t%lu discarded for bad checksum%s\n");
 	p(tcps_rcvbadoff, "\t\t%lu discarded for bad header offset field%s\n");
 	p1a(tcps_rcvshort, "\t\t%lu discarded because packet too short\n");
+	p(tcps_rcvbadsackopt, "\t\t%lu bad SACK option%s\n");
 	p(tcps_connattempt, "\t%lu connection request%s\n");
 	p(tcps_accepts, "\t%lu connection accept%s\n");
 	p(tcps_badsyn, "\t%lu bad connection attempt%s\n");
@@ -521,8 +528,14 @@ tcp_stats(u_long off __unused, const char *name, int af1 __unused)
 	p1a(tcps_sc_badack, "\t\t%lu badack\n"); 
 	p1a(tcps_sc_unreach, "\t\t%lu unreach\n"); 
 	p1a(tcps_sc_zonefail, "\t\t%lu zone failures\n"); 
-	p1a(tcps_sc_sendcookie, "\t%lu cookies sent\n"); 
-	p1a(tcps_sc_recvcookie, "\t%lu cookies received\n"); 
+	p1a(tcps_sc_sendcookie, "\t\t%lu cookies sent\n"); 
+	p1a(tcps_sc_recvcookie, "\t\t%lu cookies received\n"); 
+
+	p(tcps_sacksbupdate, "\t%lu SACK scoreboard update%s\n");
+	p(tcps_sacksboverflow, "\t\t%lu overflow%s\n");
+	p(tcps_sacksbfailed, "\t\t%lu failure%s\n");
+	p(tcps_sacksbreused, "\t\t%lu record%s reused\n");
+
 	free(stattmp);
 #undef p
 #undef p1a
diff --git a/usr.bin/rlogin/rlogin.c b/usr.bin/rlogin/rlogin.c
index a9f35503e0..a9cde4a771 100644
--- a/usr.bin/rlogin/rlogin.c
+++ b/usr.bin/rlogin/rlogin.c
@@ -40,7 +40,6 @@
  * @(#) Copyright (c) 1983, 1990, 1993 The Regents of the University of California.  All rights reserved.
  * @(#)rlogin.c	8.1 (Berkeley) 6/6/93
  * $FreeBSD: src/usr.bin/rlogin/rlogin.c,v 1.30 2002/04/28 11:16:43 markm Exp $
- * $DragonFly: src/usr.bin/rlogin/rlogin.c,v 1.7 2005/02/15 01:24:49 cpressey Exp $
  */
 
 /*
@@ -317,7 +316,7 @@ main(int argc, char *argv[])
 			newargv[0] = argv[0];
 			newargv[1] = "-K";
 			for(i = 1; i < argc; ++i)
-			newargv[i + 1] = argv[i];
+				newargv[i + 1] = argv[i];
 			newargv[argc + 1] = NULL;
 			execv(_PATH_RLOGIN, newargv);
 		}
diff --git a/usr.bin/talk/ctl.c b/usr.bin/talk/ctl.c
index 3f667f141f..7f7b312a50 100644
--- a/usr.bin/talk/ctl.c
+++ b/usr.bin/talk/ctl.c
@@ -105,7 +105,7 @@ print_addr(struct sockaddr_in addr)
 
 	printf("addr = %lx, port = %o, family = %o zero = ",
 		(u_long)addr.sin_addr.s_addr, addr.sin_port, addr.sin_family);
-	for (i = 0; i<8;i++)
-	printf("%o ", (int)addr.sin_zero[i]);
+	for (i = 0; i < 8; i++)
+		printf("%o ", (int)addr.sin_zero[i]);
 	putchar('\n');
 }
diff --git a/usr.bin/whereis/whereis.c b/usr.bin/whereis/whereis.c
index 51ebfb3957..35e8e5f471 100644
--- a/usr.bin/whereis/whereis.c
+++ b/usr.bin/whereis/whereis.c
@@ -164,7 +164,7 @@ scanopts(int argc, char **argv)
 		default:
 			usage();
 		}
-  breakout:
+breakout:
 	if (optind == argc)
 		usage();
 	query = argv + optind;
@@ -634,7 +634,7 @@ main(int argc, char **argv)
 			pclose(p);
 			free(cp);
 		}
-	  done_sources:
+done_sources:
 
 		if (opt_u && !unusual)
 			continue;
diff --git a/usr.bin/yacc/output.c b/usr.bin/yacc/output.c
index 3d8cf9102a..cf88d37ef1 100644
--- a/usr.bin/yacc/output.c
+++ b/usr.bin/yacc/output.c
@@ -296,7 +296,7 @@ token_actions(void)
 	if (parser[i])
 	{
 	    for (j = 0; j < 2*ntokens; ++j)
-	    actionrow[j] = 0;
+		actionrow[j] = 0;
 
 	    shiftcount = 0;
 	    reducecount = 0;
diff --git a/usr.sbin/IPXrouted/output.c b/usr.sbin/IPXrouted/output.c
index 7d7d32f99d..f119a4b8a1 100644
--- a/usr.sbin/IPXrouted/output.c
+++ b/usr.sbin/IPXrouted/output.c
@@ -36,7 +36,6 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/usr.sbin/IPXrouted/output.c,v 1.8 1999/08/28 01:15:03 peter Exp $
- * $DragonFly: src/usr.sbin/IPXrouted/output.c,v 1.3 2004/03/11 09:38:59 hmp Exp $
  *
  * @(#)output.c	8.1 (Berkeley) 6/5/93
  */
@@ -134,89 +133,100 @@ supply(struct sockaddr *dst, int flags, struct interface *ifp,
 		sipx->sipx_port = htons(IPXPORT_RIP);
 
 	msg->rip_cmd = ntohs(RIPCMD_RESPONSE);
-	for (rh = nethash; rh < &nethash[ROUTEHASHSIZ]; rh++)
-	for (rt = rh->rt_forw; rt != (struct rt_entry *)rh; rt = rt->rt_forw) {
-		size = (char *)n - (char *)msg;
-		if (size >= ((MAXRIPNETS * sizeof (struct netinfo)) +
+	for (rh = nethash; rh < &nethash[ROUTEHASHSIZ]; rh++) {
+		for (rt = rh->rt_forw; rt != (struct rt_entry *)rh;
+		     rt = rt->rt_forw) {
+			size = (char *)n - (char *)msg;
+			if (size >= ((MAXRIPNETS * sizeof (struct netinfo)) +
 				sizeof (msg->rip_cmd))) {
-			(*output)(ripsock, flags, dst, size);
-			TRACE_OUTPUT(ifp, dst, size);
-			n = msg->rip_nets;
-			delay++; 
-			if(delay == 2) {
-				usleep(50000);
-				delay = 0;
+				(*output)(ripsock, flags, dst, size);
+				TRACE_OUTPUT(ifp, dst, size);
+				n = msg->rip_nets;
+				delay++;
+				if(delay == 2) {
+					usleep(50000);
+					delay = 0;
+				}
 			}
-		}
 
-		if (changesonly && !(rt->rt_state & RTS_CHANGED))
-			continue;
+			if (changesonly && !(rt->rt_state & RTS_CHANGED))
+				continue;
 
-		/*
-		 * This should do rule one and two of the split horizon
-		 * algorithm.
-		 */
-		if (rt->rt_ifp == ifp)
-			continue;
+			/*
+			 * This should do rule one and two of the split horizon
+			 * algorithm.
+			 */
+			if (rt->rt_ifp == ifp)
+				continue;
 
-		/*
-		 * Rule 3.
-		 * Look if we have clones (different routes to the same
-		 * place with exactly the same cost).
-		 *
-		 * We should not publish on any of the clone interfaces.
-		 */
-		crt = rt->rt_clone;
-		while (crt) {
-			if (crt->rt_ifp == ifp)
-				goto next;
-			crt = crt->rt_clone;
-		}
+			/*
+			 * Rule 3.
+			 * Look if we have clones (different routes to the same
+			 * place with exactly the same cost).
+			 *
+			 * We should not publish on any of the clone
+			 * interfaces.
+			 */
+			crt = rt->rt_clone;
+			while (crt) {
+				if (crt->rt_ifp == ifp)
+					goto next;
+				crt = crt->rt_clone;
+			}
 
-		sipx = (struct sockaddr_ipx *)&rt->rt_dst;
-	        if ((rt->rt_flags & (RTF_HOST|RTF_GATEWAY)) == RTF_HOST)
-			sipx = (struct sockaddr_ipx *)&rt->rt_router;
-		if (rt->rt_metric == HOPCNT_INFINITY)
-			metric = HOPCNT_INFINITY;
-		else {
-			metric = rt->rt_metric + 1;
+			sipx = (struct sockaddr_ipx *)&rt->rt_dst;
+			if ((rt->rt_flags & (RTF_HOST|RTF_GATEWAY)) ==
+			    RTF_HOST)
+				sipx = (struct sockaddr_ipx *)&rt->rt_router;
+			if (rt->rt_metric == HOPCNT_INFINITY)
+				metric = HOPCNT_INFINITY;
+			else {
+				metric = rt->rt_metric + 1;
+				/*
+				 * We don't advertize routes with more than
+				 * 15 hops.
+				 */
+				if (metric >= HOPCNT_INFINITY)
+					continue;
+			}
 			/*
-			 * We don't advertize routes with more than 15 hops.
+			 * XXX One day we should cater for slow interfaces
+			 * also.
 			 */
-			if (metric >= HOPCNT_INFINITY)
-				continue;
-		}
-		/* XXX One day we should cater for slow interfaces also. */
-		ticks = rt->rt_ticks + 1;
-		net = sipx->sipx_addr.x_net;
+			ticks = rt->rt_ticks + 1;
+			net = sipx->sipx_addr.x_net;
 
-		/*
-		 * Make sure that we don't put out a two net entries
-		 * for a pt to pt link (one for the G route, one for the if)
-		 * This is a kludge, and won't work if there are lots of nets.
-		 */
-		for (nn = msg->rip_nets; nn < n; nn++) {
-			if (ipx_neteqnn(net, nn->rip_dst)) {
-				if (ticks < ntohs(nn->rip_ticks)) {
-					nn->rip_metric = htons(metric);
-					nn->rip_ticks = htons(ticks);
-				} else if ((ticks == ntohs(nn->rip_ticks)) &&
-					   (metric < ntohs(nn->rip_metric))) {
-					nn->rip_metric = htons(metric);
-					nn->rip_ticks = htons(ticks);
+			/*
+			 * Make sure that we don't put out a two net entries
+			 * for a pt to pt link (one for the G route, one for
+			 * the if)
+			 * This is a kludge, and won't work if there are lots
+			 * of nets.
+			 */
+			for (nn = msg->rip_nets; nn < n; nn++) {
+				if (ipx_neteqnn(net, nn->rip_dst)) {
+					if (ticks < ntohs(nn->rip_ticks)) {
+						nn->rip_metric = htons(metric);
+						nn->rip_ticks = htons(ticks);
+					} else if ((ticks == ntohs(nn->rip_ticks)) &&
+					    (metric < ntohs(nn->rip_metric))) {
+						nn->rip_metric = htons(metric);
+						nn->rip_ticks = htons(ticks);
+					}
+					goto next;
 				}
-				goto next;
 			}
+			n->rip_dst = net;
+			n->rip_metric = htons(metric);
+			n->rip_ticks = htons(ticks);
+			n++;
+next:
+			;
+		}
+		if (n != msg->rip_nets) {
+			size = (char *)n - (char *)msg;
+			(*output)(ripsock, flags, dst, size);
+			TRACE_OUTPUT(ifp, dst, size);
 		}
-		n->rip_dst = net;
-		n->rip_metric = htons(metric);
-		n->rip_ticks = htons(ticks);
-		n++;
-	next:;
-	}
-	if (n != msg->rip_nets) {
-		size = (char *)n - (char *)msg;
-		(*output)(ripsock, flags, dst, size);
-		TRACE_OUTPUT(ifp, dst, size);
 	}
 }
diff --git a/usr.sbin/IPXrouted/sap_output.c b/usr.sbin/IPXrouted/sap_output.c
index 1e780ab415..93b3b74551 100644
--- a/usr.sbin/IPXrouted/sap_output.c
+++ b/usr.sbin/IPXrouted/sap_output.c
@@ -29,7 +29,6 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/usr.sbin/IPXrouted/sap_output.c,v 1.9 1999/08/28 01:15:04 peter Exp $
- * $DragonFly: src/usr.sbin/IPXrouted/sap_output.c,v 1.4 2004/06/19 20:38:22 joerg Exp $
  */
 
 /*
@@ -121,71 +120,76 @@ sap_supply(struct sockaddr *dst, int flags, struct interface *ifp,
 
 	sap_msg->sap_cmd = ntohs(SAP_RESP);
 
-	for (sh = base; sh < &base[SAPHASHSIZ]; sh++)
-	for (sap = sh->forw; sap != (struct sap_entry *)sh; sap = sap->forw) {
-		size = (char *)n - (char *)sap_msg;
-		if (size >= ((MAXSAPENTRIES * sizeof (struct sap_info)) +
-				sizeof (sap_msg->sap_cmd))) {
-			(*output)(sapsock, flags, dst, size);
-			TRACE_SAP_OUTPUT(ifp, dst, size);
-			n = sap_msg->sap;
-			delay++;
-			if(delay == 2) {
-				usleep(50000);
-				delay = 0;
+	for (sh = base; sh < &base[SAPHASHSIZ]; sh++) {
+		for (sap = sh->forw; sap != (struct sap_entry *)sh;
+		     sap = sap->forw) {
+			size = (char *)n - (char *)sap_msg;
+			if (size >=
+			    ((MAXSAPENTRIES * sizeof (struct sap_info)) +
+			     sizeof (sap_msg->sap_cmd))) {
+				(*output)(sapsock, flags, dst, size);
+				TRACE_SAP_OUTPUT(ifp, dst, size);
+				n = sap_msg->sap;
+				delay++;
+				if(delay == 2) {
+					usleep(50000);
+					delay = 0;
+				}
 			}
-		}
-
-		if (changesonly && !(sap->state & RTS_CHANGED))
-			continue;
-
-		/*
-		 * Check for the servicetype except if the ServType is
-		 * a wildcard (0xFFFF).
-		 */
-		if ((ServType != SAP_WILDCARD) &&
-		    (ServType != sap->sap.ServType))
-			continue;
-
-		/*
-		 * This should do rule one and two of the split horizon
-		 * algorithm.
-		 */
-		if (sap->ifp == ifp)
-			continue;
 
-		/*
-		 * Rule 2.
-		 * Look if we have clones (different routes to the same
-		 * place with exactly the same cost).
-		 *
-		 * We should not publish on any of the clone interfaces.
-		 */
-		csap = sap->clone;
-		while (csap) {
-			if (csap->ifp == ifp)
-				goto next;
-			csap = csap->clone;
-		}
-
-		/*
-		 * Don't advertise services with more than 15 hops. It
-		 * will be confused with a service that has gone down.
-		 */
-		if (ntohs(sap->sap.hops) == (HOPCNT_INFINITY - 1))
-			continue;
-		metric = min(ntohs(sap->sap.hops) + 1, HOPCNT_INFINITY);
+			if (changesonly && !(sap->state & RTS_CHANGED))
+				continue;
+
+			/*
+			 * Check for the servicetype except if the ServType is
+			 * a wildcard (0xFFFF).
+			 */
+			if ((ServType != SAP_WILDCARD) &&
+			    (ServType != sap->sap.ServType))
+				continue;
+
+			/*
+			 * This should do rule one and two of the split horizon
+			 * algorithm.
+			 */
+			if (sap->ifp == ifp)
+				continue;
+
+			/*
+			 * Rule 2.
+			 * Look if we have clones (different routes to the same
+			 * place with exactly the same cost).
+			 *
+			 * We should not publish on any of the clone
+			 * interfaces.
+			 */
+			csap = sap->clone;
+			while (csap) {
+				if (csap->ifp == ifp)
+					goto next;
+				csap = csap->clone;
+			}
 
-		*n = sap->sap;
-		n->hops = htons(metric);
-		n++;
+			/*
+			 * Don't advertise services with more than 15 hops. It
+			 * will be confused with a service that has gone down.
+			 */
+			if (ntohs(sap->sap.hops) == (HOPCNT_INFINITY - 1))
+				continue;
+			metric = min(ntohs(sap->sap.hops) + 1,
+			    HOPCNT_INFINITY);
+
+			*n = sap->sap;
+			n->hops = htons(metric);
+			n++;
 next:
-		;
-	}
-	if (n != sap_msg->sap) {
-		size = (char *)n - (char *)sap_msg;
-		(*output)(sapsock, flags, dst, size);
-		TRACE_SAP_OUTPUT(ifp, dst, size);
+			;
+		}
+		if (n != sap_msg->sap) {
+			size = (char *)n - (char *)sap_msg;
+			(*output)(sapsock, flags, dst, size);
+			TRACE_SAP_OUTPUT(ifp, dst, size);
+		}
 	}
 }
 
diff --git a/usr.sbin/keyserv/crypt_server.c b/usr.sbin/keyserv/crypt_server.c
index 2f3398ab7c..6bd332c281 100644
--- a/usr.sbin/keyserv/crypt_server.c
+++ b/usr.sbin/keyserv/crypt_server.c
@@ -30,7 +30,6 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/usr.sbin/keyserv/crypt_server.c,v 1.6.2.1 2001/07/19 04:21:20 kris Exp $
- * $DragonFly: src/usr.sbin/keyserv/crypt_server.c,v 1.6 2005/12/05 01:04:01 swildner Exp $
  */
 
 #include 
@@ -90,7 +89,7 @@ prepare_key(unsigned char *key_data_ptr, int key_data_len, arcfour_key *key)
 
    state = &key->state[0];         
    for(counter = 0; counter < 256; counter++)              
-   state[counter] = counter;               
+       state[counter] = counter;
    key->x = 0;     
    key->y = 0;     
    index1 = 0;     
diff --git a/usr.sbin/mfiutil/Makefile b/usr.sbin/mfiutil/Makefile
index 65c3065483..b9247f945d 100644
--- a/usr.sbin/mfiutil/Makefile
+++ b/usr.sbin/mfiutil/Makefile
@@ -6,7 +6,6 @@ SRCS=	mfiutil.c mfi_cmd.c mfi_config.c mfi_drive.c mfi_evt.c mfi_flash.c \
 MAN8=	mfiutil.8
 
 CFLAGS+= -fno-builtin-strftime
-WARNS?=3
 
 DPADD=	${LIBUTIL}
 LDADD=	-lutil
diff --git a/usr.sbin/mfiutil/mfi_config.c b/usr.sbin/mfiutil/mfi_config.c
index bb7b68b32d..0b5d37b6e1 100644
--- a/usr.sbin/mfiutil/mfi_config.c
+++ b/usr.sbin/mfiutil/mfi_config.c
@@ -123,7 +123,7 @@ mfi_config_lookup_volume(struct mfi_config_data *config, uint8_t target_id)
 }
 
 static int
-clear_config(int ac, char **av)
+clear_config(__unused int ac, __unused char **av)
 {
 	struct mfi_ld_list list;
 	int ch, error, fd;
@@ -383,7 +383,7 @@ find_next_volume(struct config_id_state *state)
 
 /* Populate an array with drives. */
 static void
-build_array(int fd, char *arrayp, struct array_info *array_info,
+build_array(__unused int fd, char *arrayp, struct array_info *array_info,
     struct config_id_state *state, int verbose)
 {
 	struct mfi_array *ar = (struct mfi_array *)arrayp;
diff --git a/usr.sbin/mfiutil/mfi_evt.c b/usr.sbin/mfiutil/mfi_evt.c
index 6b1cc7902a..93a9473bbc 100644
--- a/usr.sbin/mfiutil/mfi_evt.c
+++ b/usr.sbin/mfiutil/mfi_evt.c
@@ -63,7 +63,7 @@ mfi_get_events(int fd, struct mfi_evt_list *list, int num_events,
 }
 
 static int
-show_logstate(int ac, char **av)
+show_logstate(int ac, __unused char **av)
 {
 	struct mfi_evt_log_state info;
 	int error, fd;
diff --git a/usr.sbin/mfiutil/mfi_patrol.c b/usr.sbin/mfiutil/mfi_patrol.c
index 834313f441..9764688140 100644
--- a/usr.sbin/mfiutil/mfi_patrol.c
+++ b/usr.sbin/mfiutil/mfi_patrol.c
@@ -74,7 +74,7 @@ patrol_get_props(int fd, struct mfi_pr_properties *prop)
 }
 
 static int
-show_patrol(int ac, char **av)
+show_patrol(__unused int ac, __unused char **av)
 {
 	struct mfi_pr_properties prop;
 	struct mfi_pr_status status;
@@ -192,7 +192,7 @@ show_patrol(int ac, char **av)
 MFI_COMMAND(show, patrol, show_patrol);
 
 static int
-start_patrol(int ac, char **av)
+start_patrol(__unused int ac, __unused char **av)
 {
 	int error, fd;
 
@@ -218,7 +218,7 @@ start_patrol(int ac, char **av)
 MFI_COMMAND(start, patrol, start_patrol);
 
 static int
-stop_patrol(int ac, char **av)
+stop_patrol(__unused int ac, __unused char **av)
 {
 	int error, fd;
 
diff --git a/usr.sbin/mfiutil/mfi_show.c b/usr.sbin/mfiutil/mfi_show.c
index 64db06dacc..8ba0e037c3 100644
--- a/usr.sbin/mfiutil/mfi_show.c
+++ b/usr.sbin/mfiutil/mfi_show.c
@@ -50,7 +50,7 @@ format_stripe(char *buf, size_t buflen, uint8_t stripe)
 }
 
 static int
-show_adapter(int ac, char **av)
+show_adapter(int ac, __unused char **av)
 {
 	struct mfi_ctrl_info info;
 	char stripe[5];
@@ -135,7 +135,7 @@ show_adapter(int ac, char **av)
 MFI_COMMAND(show, adapter, show_adapter);
 
 static int
-show_battery(int ac, char **av)
+show_battery(int ac, __unused char **av)
 {
 	struct mfi_bbu_capacity_info cap;
 	struct mfi_bbu_design_info design;
@@ -281,7 +281,7 @@ print_pd(struct mfi_pd_info *info, int state_len)
 }
 
 static int
-show_config(int ac, char **av)
+show_config(int ac, __unused char **av)
 {
 	struct mfi_config_data *config;
 	struct mfi_array *ar;
@@ -387,7 +387,7 @@ show_config(int ac, char **av)
 MFI_COMMAND(show, config, show_config);
 
 static int
-show_volumes(int ac, char **av)
+show_volumes(int ac, __unused char **av)
 {
 	struct mfi_ld_list list;
 	struct mfi_ld_info info;
@@ -470,7 +470,7 @@ show_volumes(int ac, char **av)
 MFI_COMMAND(show, volumes, show_volumes);
 
 static int
-show_drives(int ac, char **av)
+show_drives(int ac, __unused char **av)
 {
 	struct mfi_pd_list *list;
 	struct mfi_pd_info info;
@@ -578,7 +578,7 @@ display_firmware(struct mfi_info_component *comp, const char *tag)
 }
 
 static int
-show_firmware(int ac, char **av)
+show_firmware(int ac, __unused char **av)
 {
 	struct mfi_ctrl_info info;
 	struct mfi_info_component header;
@@ -634,7 +634,7 @@ show_firmware(int ac, char **av)
 MFI_COMMAND(show, firmware, show_firmware);
 
 static int
-show_progress(int ac, char **av)
+show_progress(int ac, __unused char **av)
 {
 	struct mfi_ld_list llist;
 	struct mfi_pd_list *plist;
diff --git a/usr.sbin/mfiutil/mfiutil.c b/usr.sbin/mfiutil/mfiutil.c
index df45238777..95579ad424 100644
--- a/usr.sbin/mfiutil/mfiutil.c
+++ b/usr.sbin/mfiutil/mfiutil.c
@@ -92,7 +92,7 @@ usage(void)
 }
 
 static int
-version(int ac, char **av)
+version(__unused int ac, __unused char **av)
 {
 
 	printf("mfiutil version 1.0.13");
diff --git a/usr.sbin/ppp/Makefile b/usr.sbin/ppp/Makefile
index 25e3adc393..61ad84d4ad 100644
--- a/usr.sbin/ppp/Makefile
+++ b/usr.sbin/ppp/Makefile
@@ -21,7 +21,7 @@ M4FLAGS=
 LDADD= -lcrypt -lmd -lutil -lz
 DPADD=	${LIBCRYPT} ${LIBMD} ${LIBUTIL} ${LIBZ}
 
-WARNS?=	1
+WARNS?=	2
 
 .SUFFIXES: .8 .8.m4
 
diff --git a/usr.sbin/ppp/ip.c b/usr.sbin/ppp/ip.c
index c04c0335dd..3086120d62 100644
--- a/usr.sbin/ppp/ip.c
+++ b/usr.sbin/ppp/ip.c
@@ -26,7 +26,6 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/usr.sbin/ppp/ip.c,v 1.78.2.11 2002/09/01 02:12:27 brian Exp $
- * $DragonFly: src/usr.sbin/ppp/ip.c,v 1.3 2004/08/09 19:54:36 dillon Exp $
  */
 
 #include 
@@ -202,7 +201,6 @@ FilterCheck(const unsigned char *packet, u_int32_t family,
   int mindata;			/* minimum data size or zero */
   const struct filterent *fp = filter->rule;
   char dbuff[100], dstip[16];
-  struct protoent *pe;
   struct ncpaddr srcaddr, dstaddr;
   const char *payload;		/* IP payload */
   int datalen;			/* IP datagram length */
diff --git a/usr.sbin/ppp/mbuf.h b/usr.sbin/ppp/mbuf.h
index ea66a4df00..37fc38a05e 100644
--- a/usr.sbin/ppp/mbuf.h
+++ b/usr.sbin/ppp/mbuf.h
@@ -26,7 +26,6 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/usr.sbin/ppp/mbuf.h,v 1.24.2.3 2002/09/01 02:12:28 brian Exp $
- * $DragonFly: src/usr.sbin/ppp/mbuf.h,v 1.2 2003/06/17 04:30:00 dillon Exp $
  */
 
 struct mbuf {
@@ -46,10 +45,10 @@ struct mqueue {
 };
 
 #define MBUF_CTOP(bp) \
-	((bp) ? (u_char *)((bp)+1) + (bp)->m_offset : NULL)
+	((bp) ? (u_char *)((bp)+1) + (bp)->m_offset : (u_char *)bp)
 
 #define CONST_MBUF_CTOP(bp) \
-	((bp) ? (const u_char *)((bp)+1) + (bp)->m_offset : NULL)
+	((bp) ? (const u_char *)((bp)+1) + (bp)->m_offset : (const u_char *)bp)
 
 #define MB_IPIN		0
 #define MB_IPOUT	1
diff --git a/usr.sbin/ppp/mppe.c b/usr.sbin/ppp/mppe.c
index 632209ac18..02d6f51aff 100644
--- a/usr.sbin/ppp/mppe.c
+++ b/usr.sbin/ppp/mppe.c
@@ -24,7 +24,6 @@
  * SUCH DAMAGE.
  *
  * $FreeBSD: src/usr.sbin/ppp/mppe.c,v 1.4.2.6 2002/09/01 02:12:29 brian Exp $
- * $DragonFly: src/usr.sbin/ppp/mppe.c,v 1.2 2003/06/17 04:30:00 dillon Exp $
  */
 
 #include 
@@ -518,7 +517,8 @@ MPPEInitOptsOutput(struct bundle *bundle, struct fsm_opt *o,
   if (!MPPE_MasterKeyValid) {
     log_Printf(LogCCP, "MPPE: MasterKey is invalid,"
                " MPPE is available only with CHAP81 authentication\n");
-    ua_htonl(0x0, o->data);
+    mval = 0;
+    ua_htonl(&mval, o->data);
     return;
   }
 
diff --git a/usr.sbin/rwhod/rwhod.c b/usr.sbin/rwhod/rwhod.c
index fda528af76..32f86f1419 100644
--- a/usr.sbin/rwhod/rwhod.c
+++ b/usr.sbin/rwhod/rwhod.c
@@ -382,7 +382,7 @@ handleread(int sock)
 		}
 	}
 #endif
-	time((time_t *)&wd.wd_recvtime);
+	wd.wd_recvtime = time(NULL);
 	write(whod, (char *)&wd, cc);
 	if (fstat(whod, &st) < 0 || st.st_size > cc)
 		ftruncate(whod, cc);