xref: /freebsd/sys/dev/ciss/ciss.c (revision 646a7fea0c8a60ce2795ffc1bdf58e0fd0f7d624)
1 /*-
2  * Copyright (c) 2001 Michael Smith
3  * Copyright (c) 2004 Paul Saab
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  *
27  *	$FreeBSD$
28  */
29 
30 /*
31  * Common Interface for SCSI-3 Support driver.
32  *
33  * CISS claims to provide a common interface between a generic SCSI
34  * transport and an intelligent host adapter.
35  *
36  * This driver supports CISS as defined in the document "CISS Command
37  * Interface for SCSI-3 Support Open Specification", Version 1.04,
38  * Valence Number 1, dated 20001127, produced by Compaq Computer
39  * Corporation.  This document appears to be a hastily and somewhat
40  * arbitrarlily cut-down version of a larger (and probably even more
41  * chaotic and inconsistent) Compaq internal document.  Various
42  * details were also gleaned from Compaq's "cciss" driver for Linux.
43  *
44  * We provide a shim layer between the CISS interface and CAM,
45  * offloading most of the queueing and being-a-disk chores onto CAM.
46  * Entry to the driver is via the PCI bus attachment (ciss_probe,
47  * ciss_attach, etc) and via the CAM interface (ciss_cam_action,
48  * ciss_cam_poll).  The Compaq CISS adapters are, however, poor SCSI
49  * citizens and we have to fake up some responses to get reasonable
50  * behaviour out of them.  In addition, the CISS command set is by no
51  * means adequate to support the functionality of a RAID controller,
52  * and thus the supported Compaq adapters utilise portions of the
53  * control protocol from earlier Compaq adapter families.
54  *
55  * Note that we only support the "simple" transport layer over PCI.
56  * This interface (ab)uses the I2O register set (specifically the post
57  * queues) to exchange commands with the adapter.  Other interfaces
58  * are available, but we aren't supposed to know about them, and it is
59  * dubious whether they would provide major performance improvements
60  * except under extreme load.
61  *
62  * Currently the only supported CISS adapters are the Compaq Smart
63  * Array 5* series (5300, 5i, 532).  Even with only three adapters,
64  * Compaq still manage to have interface variations.
65  *
66  *
67  * Thanks must go to Fred Harris and Darryl DeVinney at Compaq, as
68  * well as Paul Saab at Yahoo! for their assistance in making this
69  * driver happen.
70  *
71  * More thanks must go to John Cagle at HP for the countless hours
72  * spent making this driver "work" with the MSA* series storage
73  * enclosures.  Without his help (and nagging), this driver could not
74  * be used with these enclosures.
75  */
76 
77 #include <sys/param.h>
78 #include <sys/systm.h>
79 #include <sys/malloc.h>
80 #include <sys/kernel.h>
81 #include <sys/bus.h>
82 #include <sys/conf.h>
83 #include <sys/stat.h>
84 #include <sys/kthread.h>
85 #include <sys/queue.h>
86 #include <sys/sysctl.h>
87 
88 #include <cam/cam.h>
89 #include <cam/cam_ccb.h>
90 #include <cam/cam_periph.h>
91 #include <cam/cam_sim.h>
92 #include <cam/cam_xpt_sim.h>
93 #include <cam/scsi/scsi_all.h>
94 #include <cam/scsi/scsi_message.h>
95 
96 #include <machine/bus.h>
97 #include <machine/endian.h>
98 #include <machine/resource.h>
99 #include <sys/rman.h>
100 
101 #include <dev/pci/pcireg.h>
102 #include <dev/pci/pcivar.h>
103 
104 #include <dev/ciss/cissreg.h>
105 #include <dev/ciss/cissio.h>
106 #include <dev/ciss/cissvar.h>
107 
108 static MALLOC_DEFINE(CISS_MALLOC_CLASS, "ciss_data",
109     "ciss internal data buffers");
110 
111 /* pci interface */
112 static int	ciss_lookup(device_t dev);
113 static int	ciss_probe(device_t dev);
114 static int	ciss_attach(device_t dev);
115 static int	ciss_detach(device_t dev);
116 static int	ciss_shutdown(device_t dev);
117 
118 /* (de)initialisation functions, control wrappers */
119 static int	ciss_init_pci(struct ciss_softc *sc);
120 static int	ciss_setup_msix(struct ciss_softc *sc);
121 static int	ciss_init_perf(struct ciss_softc *sc);
122 static int	ciss_wait_adapter(struct ciss_softc *sc);
123 static int	ciss_flush_adapter(struct ciss_softc *sc);
124 static int	ciss_init_requests(struct ciss_softc *sc);
125 static void	ciss_command_map_helper(void *arg, bus_dma_segment_t *segs,
126 					int nseg, int error);
127 static int	ciss_identify_adapter(struct ciss_softc *sc);
128 static int	ciss_init_logical(struct ciss_softc *sc);
129 static int	ciss_init_physical(struct ciss_softc *sc);
130 static int	ciss_filter_physical(struct ciss_softc *sc, struct ciss_lun_report *cll);
131 static int	ciss_identify_logical(struct ciss_softc *sc, struct ciss_ldrive *ld);
132 static int	ciss_get_ldrive_status(struct ciss_softc *sc,  struct ciss_ldrive *ld);
133 static int	ciss_update_config(struct ciss_softc *sc);
134 static int	ciss_accept_media(struct ciss_softc *sc, struct ciss_ldrive *ld);
135 static void	ciss_init_sysctl(struct ciss_softc *sc);
136 static void	ciss_soft_reset(struct ciss_softc *sc);
137 static void	ciss_free(struct ciss_softc *sc);
138 static void	ciss_spawn_notify_thread(struct ciss_softc *sc);
139 static void	ciss_kill_notify_thread(struct ciss_softc *sc);
140 
141 /* request submission/completion */
142 static int	ciss_start(struct ciss_request *cr);
143 static void	ciss_done(struct ciss_softc *sc, cr_qhead_t *qh);
144 static void	ciss_perf_done(struct ciss_softc *sc, cr_qhead_t *qh);
145 static void	ciss_intr(void *arg);
146 static void	ciss_perf_intr(void *arg);
147 static void	ciss_perf_msi_intr(void *arg);
148 static void	ciss_complete(struct ciss_softc *sc, cr_qhead_t *qh);
149 static int	_ciss_report_request(struct ciss_request *cr, int *command_status, int *scsi_status, const char *func);
150 static int	ciss_synch_request(struct ciss_request *cr, int timeout);
151 static int	ciss_poll_request(struct ciss_request *cr, int timeout);
152 static int	ciss_wait_request(struct ciss_request *cr, int timeout);
153 #if 0
154 static int	ciss_abort_request(struct ciss_request *cr);
155 #endif
156 
157 /* request queueing */
158 static int	ciss_get_request(struct ciss_softc *sc, struct ciss_request **crp);
159 static void	ciss_preen_command(struct ciss_request *cr);
160 static void 	ciss_release_request(struct ciss_request *cr);
161 
162 /* request helpers */
163 static int	ciss_get_bmic_request(struct ciss_softc *sc, struct ciss_request **crp,
164 				      int opcode, void **bufp, size_t bufsize);
165 static int	ciss_user_command(struct ciss_softc *sc, IOCTL_Command_struct *ioc);
166 
167 /* DMA map/unmap */
168 static int	ciss_map_request(struct ciss_request *cr);
169 static void	ciss_request_map_helper(void *arg, bus_dma_segment_t *segs,
170 					int nseg, int error);
171 static void	ciss_unmap_request(struct ciss_request *cr);
172 
173 /* CAM interface */
174 static int	ciss_cam_init(struct ciss_softc *sc);
175 static void	ciss_cam_rescan_target(struct ciss_softc *sc,
176 				       int bus, int target);
177 static void	ciss_cam_action(struct cam_sim *sim, union ccb *ccb);
178 static int	ciss_cam_action_io(struct cam_sim *sim, struct ccb_scsiio *csio);
179 static int	ciss_cam_emulate(struct ciss_softc *sc, struct ccb_scsiio *csio);
180 static void	ciss_cam_poll(struct cam_sim *sim);
181 static void	ciss_cam_complete(struct ciss_request *cr);
182 static void	ciss_cam_complete_fixup(struct ciss_softc *sc, struct ccb_scsiio *csio);
183 static struct cam_periph *ciss_find_periph(struct ciss_softc *sc,
184 					   int bus, int target);
185 static int	ciss_name_device(struct ciss_softc *sc, int bus, int target);
186 
187 /* periodic status monitoring */
188 static void	ciss_periodic(void *arg);
189 static void	ciss_nop_complete(struct ciss_request *cr);
190 static void	ciss_disable_adapter(struct ciss_softc *sc);
191 static void	ciss_notify_event(struct ciss_softc *sc);
192 static void	ciss_notify_complete(struct ciss_request *cr);
193 static int	ciss_notify_abort(struct ciss_softc *sc);
194 static int	ciss_notify_abort_bmic(struct ciss_softc *sc);
195 static void	ciss_notify_hotplug(struct ciss_softc *sc, struct ciss_notify *cn);
196 static void	ciss_notify_logical(struct ciss_softc *sc, struct ciss_notify *cn);
197 static void	ciss_notify_physical(struct ciss_softc *sc, struct ciss_notify *cn);
198 
199 /* debugging output */
200 static void	ciss_print_request(struct ciss_request *cr);
201 static void	ciss_print_ldrive(struct ciss_softc *sc, struct ciss_ldrive *ld);
202 static const char *ciss_name_ldrive_status(int status);
203 static int	ciss_decode_ldrive_status(int status);
204 static const char *ciss_name_ldrive_org(int org);
205 static const char *ciss_name_command_status(int status);
206 
207 /*
208  * PCI bus interface.
209  */
210 static device_method_t ciss_methods[] = {
211     /* Device interface */
212     DEVMETHOD(device_probe,	ciss_probe),
213     DEVMETHOD(device_attach,	ciss_attach),
214     DEVMETHOD(device_detach,	ciss_detach),
215     DEVMETHOD(device_shutdown,	ciss_shutdown),
216     { 0, 0 }
217 };
218 
219 static driver_t ciss_pci_driver = {
220     "ciss",
221     ciss_methods,
222     sizeof(struct ciss_softc)
223 };
224 
225 static devclass_t	ciss_devclass;
226 DRIVER_MODULE(ciss, pci, ciss_pci_driver, ciss_devclass, 0, 0);
227 MODULE_DEPEND(ciss, cam, 1, 1, 1);
228 MODULE_DEPEND(ciss, pci, 1, 1, 1);
229 
230 /*
231  * Control device interface.
232  */
233 static d_open_t		ciss_open;
234 static d_close_t	ciss_close;
235 static d_ioctl_t	ciss_ioctl;
236 
237 static struct cdevsw ciss_cdevsw = {
238 	.d_version =	D_VERSION,
239 	.d_flags =	0,
240 	.d_open =	ciss_open,
241 	.d_close =	ciss_close,
242 	.d_ioctl =	ciss_ioctl,
243 	.d_name =	"ciss",
244 };
245 
246 /*
247  * This tunable can be set at boot time and controls whether physical devices
248  * that are marked hidden by the firmware should be exposed anyways.
249  */
250 static unsigned int ciss_expose_hidden_physical = 0;
251 TUNABLE_INT("hw.ciss.expose_hidden_physical", &ciss_expose_hidden_physical);
252 
253 static unsigned int ciss_nop_message_heartbeat = 0;
254 TUNABLE_INT("hw.ciss.nop_message_heartbeat", &ciss_nop_message_heartbeat);
255 
256 /*
257  * This tunable can force a particular transport to be used:
258  * <= 0 : use default
259  *    1 : force simple
260  *    2 : force performant
261  */
262 static int ciss_force_transport = 0;
263 TUNABLE_INT("hw.ciss.force_transport", &ciss_force_transport);
264 
265 /*
266  * This tunable can force a particular interrupt delivery method to be used:
267  * <= 0 : use default
268  *    1 : force INTx
269  *    2 : force MSIX
270  */
271 static int ciss_force_interrupt = 0;
272 TUNABLE_INT("hw.ciss.force_interrupt", &ciss_force_interrupt);
273 
274 /************************************************************************
275  * CISS adapters amazingly don't have a defined programming interface
276  * value.  (One could say some very despairing things about PCI and
277  * people just not getting the general idea.)  So we are forced to
278  * stick with matching against subvendor/subdevice, and thus have to
279  * be updated for every new CISS adapter that appears.
280  */
281 #define CISS_BOARD_UNKNWON	0
282 #define CISS_BOARD_SA5		1
283 #define CISS_BOARD_SA5B		2
284 #define CISS_BOARD_NOMSI	(1<<4)
285 
286 static struct
287 {
288     u_int16_t	subvendor;
289     u_int16_t	subdevice;
290     int		flags;
291     char	*desc;
292 } ciss_vendor_data[] = {
293     { 0x0e11, 0x4070, CISS_BOARD_SA5|CISS_BOARD_NOMSI,	"Compaq Smart Array 5300" },
294     { 0x0e11, 0x4080, CISS_BOARD_SA5B|CISS_BOARD_NOMSI,	"Compaq Smart Array 5i" },
295     { 0x0e11, 0x4082, CISS_BOARD_SA5B|CISS_BOARD_NOMSI,	"Compaq Smart Array 532" },
296     { 0x0e11, 0x4083, CISS_BOARD_SA5B|CISS_BOARD_NOMSI,	"HP Smart Array 5312" },
297     { 0x0e11, 0x4091, CISS_BOARD_SA5,	"HP Smart Array 6i" },
298     { 0x0e11, 0x409A, CISS_BOARD_SA5,	"HP Smart Array 641" },
299     { 0x0e11, 0x409B, CISS_BOARD_SA5,	"HP Smart Array 642" },
300     { 0x0e11, 0x409C, CISS_BOARD_SA5,	"HP Smart Array 6400" },
301     { 0x0e11, 0x409D, CISS_BOARD_SA5,	"HP Smart Array 6400 EM" },
302     { 0x103C, 0x3211, CISS_BOARD_SA5,	"HP Smart Array E200i" },
303     { 0x103C, 0x3212, CISS_BOARD_SA5,	"HP Smart Array E200" },
304     { 0x103C, 0x3213, CISS_BOARD_SA5,	"HP Smart Array E200i" },
305     { 0x103C, 0x3214, CISS_BOARD_SA5,	"HP Smart Array E200i" },
306     { 0x103C, 0x3215, CISS_BOARD_SA5,	"HP Smart Array E200i" },
307     { 0x103C, 0x3220, CISS_BOARD_SA5,	"HP Smart Array" },
308     { 0x103C, 0x3222, CISS_BOARD_SA5,	"HP Smart Array" },
309     { 0x103C, 0x3223, CISS_BOARD_SA5,	"HP Smart Array P800" },
310     { 0x103C, 0x3225, CISS_BOARD_SA5,	"HP Smart Array P600" },
311     { 0x103C, 0x3230, CISS_BOARD_SA5,	"HP Smart Array" },
312     { 0x103C, 0x3231, CISS_BOARD_SA5,	"HP Smart Array" },
313     { 0x103C, 0x3232, CISS_BOARD_SA5,	"HP Smart Array" },
314     { 0x103C, 0x3233, CISS_BOARD_SA5,	"HP Smart Array" },
315     { 0x103C, 0x3234, CISS_BOARD_SA5,	"HP Smart Array P400" },
316     { 0x103C, 0x3235, CISS_BOARD_SA5,	"HP Smart Array P400i" },
317     { 0x103C, 0x3236, CISS_BOARD_SA5,	"HP Smart Array" },
318     { 0x103C, 0x3237, CISS_BOARD_SA5,	"HP Smart Array E500" },
319     { 0x103C, 0x3238, CISS_BOARD_SA5,	"HP Smart Array" },
320     { 0x103C, 0x3239, CISS_BOARD_SA5,	"HP Smart Array" },
321     { 0x103C, 0x323A, CISS_BOARD_SA5,	"HP Smart Array" },
322     { 0x103C, 0x323B, CISS_BOARD_SA5,	"HP Smart Array" },
323     { 0x103C, 0x323C, CISS_BOARD_SA5,	"HP Smart Array" },
324     { 0x103C, 0x323D, CISS_BOARD_SA5,	"HP Smart Array P700m" },
325     { 0x103C, 0x3241, CISS_BOARD_SA5,	"HP Smart Array P212" },
326     { 0x103C, 0x3243, CISS_BOARD_SA5,	"HP Smart Array P410" },
327     { 0x103C, 0x3245, CISS_BOARD_SA5,	"HP Smart Array P410i" },
328     { 0x103C, 0x3247, CISS_BOARD_SA5,	"HP Smart Array P411" },
329     { 0x103C, 0x3249, CISS_BOARD_SA5,	"HP Smart Array P812" },
330     { 0x103C, 0x324A, CISS_BOARD_SA5,	"HP Smart Array P712m" },
331     { 0x103C, 0x324B, CISS_BOARD_SA5,	"HP Smart Array" },
332     { 0x103C, 0x3350, CISS_BOARD_SA5,   "HP Smart Array P222" },
333     { 0x103C, 0x3351, CISS_BOARD_SA5,   "HP Smart Array P420" },
334     { 0x103C, 0x3352, CISS_BOARD_SA5,   "HP Smart Array P421" },
335     { 0x103C, 0x3353, CISS_BOARD_SA5,   "HP Smart Array P822" },
336     { 0x103C, 0x3354, CISS_BOARD_SA5,   "HP Smart Array P420i" },
337     { 0x103C, 0x3355, CISS_BOARD_SA5,   "HP Smart Array P220i" },
338     { 0x103C, 0x3356, CISS_BOARD_SA5,   "HP Smart Array P721m" },
339     { 0, 0, 0, NULL }
340 };
341 
342 /************************************************************************
343  * Find a match for the device in our list of known adapters.
344  */
345 static int
346 ciss_lookup(device_t dev)
347 {
348     int 	i;
349 
350     for (i = 0; ciss_vendor_data[i].desc != NULL; i++)
351 	if ((pci_get_subvendor(dev) == ciss_vendor_data[i].subvendor) &&
352 	    (pci_get_subdevice(dev) == ciss_vendor_data[i].subdevice)) {
353 	    return(i);
354 	}
355     return(-1);
356 }
357 
358 /************************************************************************
359  * Match a known CISS adapter.
360  */
361 static int
362 ciss_probe(device_t dev)
363 {
364     int		i;
365 
366     i = ciss_lookup(dev);
367     if (i != -1) {
368 	device_set_desc(dev, ciss_vendor_data[i].desc);
369 	return(BUS_PROBE_DEFAULT);
370     }
371     return(ENOENT);
372 }
373 
374 /************************************************************************
375  * Attach the driver to this adapter.
376  */
377 static int
378 ciss_attach(device_t dev)
379 {
380     struct ciss_softc	*sc;
381     int			error;
382 
383     debug_called(1);
384 
385 #ifdef CISS_DEBUG
386     /* print structure/union sizes */
387     debug_struct(ciss_command);
388     debug_struct(ciss_header);
389     debug_union(ciss_device_address);
390     debug_struct(ciss_cdb);
391     debug_struct(ciss_report_cdb);
392     debug_struct(ciss_notify_cdb);
393     debug_struct(ciss_notify);
394     debug_struct(ciss_message_cdb);
395     debug_struct(ciss_error_info_pointer);
396     debug_struct(ciss_error_info);
397     debug_struct(ciss_sg_entry);
398     debug_struct(ciss_config_table);
399     debug_struct(ciss_bmic_cdb);
400     debug_struct(ciss_bmic_id_ldrive);
401     debug_struct(ciss_bmic_id_lstatus);
402     debug_struct(ciss_bmic_id_table);
403     debug_struct(ciss_bmic_id_pdrive);
404     debug_struct(ciss_bmic_blink_pdrive);
405     debug_struct(ciss_bmic_flush_cache);
406     debug_const(CISS_MAX_REQUESTS);
407     debug_const(CISS_MAX_LOGICAL);
408     debug_const(CISS_INTERRUPT_COALESCE_DELAY);
409     debug_const(CISS_INTERRUPT_COALESCE_COUNT);
410     debug_const(CISS_COMMAND_ALLOC_SIZE);
411     debug_const(CISS_COMMAND_SG_LENGTH);
412 
413     debug_type(cciss_pci_info_struct);
414     debug_type(cciss_coalint_struct);
415     debug_type(cciss_coalint_struct);
416     debug_type(NodeName_type);
417     debug_type(NodeName_type);
418     debug_type(Heartbeat_type);
419     debug_type(BusTypes_type);
420     debug_type(FirmwareVer_type);
421     debug_type(DriverVer_type);
422     debug_type(IOCTL_Command_struct);
423 #endif
424 
425     sc = device_get_softc(dev);
426     sc->ciss_dev = dev;
427     mtx_init(&sc->ciss_mtx, "cissmtx", NULL, MTX_DEF);
428     callout_init_mtx(&sc->ciss_periodic, &sc->ciss_mtx, 0);
429 
430     /*
431      * Do PCI-specific init.
432      */
433     if ((error = ciss_init_pci(sc)) != 0)
434 	goto out;
435 
436     /*
437      * Initialise driver queues.
438      */
439     ciss_initq_free(sc);
440     ciss_initq_notify(sc);
441 
442     /*
443      * Initalize device sysctls.
444      */
445     ciss_init_sysctl(sc);
446 
447     /*
448      * Initialise command/request pool.
449      */
450     if ((error = ciss_init_requests(sc)) != 0)
451 	goto out;
452 
453     /*
454      * Get adapter information.
455      */
456     if ((error = ciss_identify_adapter(sc)) != 0)
457 	goto out;
458 
459     /*
460      * Find all the physical devices.
461      */
462     if ((error = ciss_init_physical(sc)) != 0)
463 	goto out;
464 
465     /*
466      * Build our private table of logical devices.
467      */
468     if ((error = ciss_init_logical(sc)) != 0)
469 	goto out;
470 
471     /*
472      * Enable interrupts so that the CAM scan can complete.
473      */
474     CISS_TL_SIMPLE_ENABLE_INTERRUPTS(sc);
475 
476     /*
477      * Initialise the CAM interface.
478      */
479     if ((error = ciss_cam_init(sc)) != 0)
480 	goto out;
481 
482     /*
483      * Start the heartbeat routine and event chain.
484      */
485     ciss_periodic(sc);
486 
487    /*
488      * Create the control device.
489      */
490     sc->ciss_dev_t = make_dev(&ciss_cdevsw, device_get_unit(sc->ciss_dev),
491 			      UID_ROOT, GID_OPERATOR, S_IRUSR | S_IWUSR,
492 			      "ciss%d", device_get_unit(sc->ciss_dev));
493     sc->ciss_dev_t->si_drv1 = sc;
494 
495     /*
496      * The adapter is running; synchronous commands can now sleep
497      * waiting for an interrupt to signal completion.
498      */
499     sc->ciss_flags |= CISS_FLAG_RUNNING;
500 
501     ciss_spawn_notify_thread(sc);
502 
503     error = 0;
504  out:
505     if (error != 0) {
506 	/* ciss_free() expects the mutex to be held */
507 	mtx_lock(&sc->ciss_mtx);
508 	ciss_free(sc);
509     }
510     return(error);
511 }
512 
513 /************************************************************************
514  * Detach the driver from this adapter.
515  */
516 static int
517 ciss_detach(device_t dev)
518 {
519     struct ciss_softc	*sc = device_get_softc(dev);
520 
521     debug_called(1);
522 
523     mtx_lock(&sc->ciss_mtx);
524     if (sc->ciss_flags & CISS_FLAG_CONTROL_OPEN) {
525 	mtx_unlock(&sc->ciss_mtx);
526 	return (EBUSY);
527     }
528 
529     /* flush adapter cache */
530     ciss_flush_adapter(sc);
531 
532     /* release all resources.  The mutex is released and freed here too. */
533     ciss_free(sc);
534 
535     return(0);
536 }
537 
538 /************************************************************************
539  * Prepare adapter for system shutdown.
540  */
541 static int
542 ciss_shutdown(device_t dev)
543 {
544     struct ciss_softc	*sc = device_get_softc(dev);
545 
546     debug_called(1);
547 
548     mtx_lock(&sc->ciss_mtx);
549     /* flush adapter cache */
550     ciss_flush_adapter(sc);
551 
552     if (sc->ciss_soft_reset)
553 	ciss_soft_reset(sc);
554     mtx_unlock(&sc->ciss_mtx);
555 
556     return(0);
557 }
558 
559 static void
560 ciss_init_sysctl(struct ciss_softc *sc)
561 {
562 
563     SYSCTL_ADD_INT(device_get_sysctl_ctx(sc->ciss_dev),
564 	SYSCTL_CHILDREN(device_get_sysctl_tree(sc->ciss_dev)),
565 	OID_AUTO, "soft_reset", CTLFLAG_RW, &sc->ciss_soft_reset, 0, "");
566 }
567 
568 /************************************************************************
569  * Perform PCI-specific attachment actions.
570  */
571 static int
572 ciss_init_pci(struct ciss_softc *sc)
573 {
574     uintptr_t		cbase, csize, cofs;
575     uint32_t		method, supported_methods;
576     int			error, sqmask, i;
577     void		*intr;
578 
579     debug_called(1);
580 
581     /*
582      * Work out adapter type.
583      */
584     i = ciss_lookup(sc->ciss_dev);
585     if (i < 0) {
586 	ciss_printf(sc, "unknown adapter type\n");
587 	return (ENXIO);
588     }
589 
590     if (ciss_vendor_data[i].flags & CISS_BOARD_SA5) {
591 	sqmask = CISS_TL_SIMPLE_INTR_OPQ_SA5;
592     } else if (ciss_vendor_data[i].flags & CISS_BOARD_SA5B) {
593 	sqmask = CISS_TL_SIMPLE_INTR_OPQ_SA5B;
594     } else {
595 	/*
596 	 * XXX Big hammer, masks/unmasks all possible interrupts.  This should
597 	 * work on all hardware variants.  Need to add code to handle the
598 	 * "controller crashed" interupt bit that this unmasks.
599 	 */
600 	sqmask = ~0;
601     }
602 
603     /*
604      * Allocate register window first (we need this to find the config
605      * struct).
606      */
607     error = ENXIO;
608     sc->ciss_regs_rid = CISS_TL_SIMPLE_BAR_REGS;
609     if ((sc->ciss_regs_resource =
610 	 bus_alloc_resource_any(sc->ciss_dev, SYS_RES_MEMORY,
611 				&sc->ciss_regs_rid, RF_ACTIVE)) == NULL) {
612 	ciss_printf(sc, "can't allocate register window\n");
613 	return(ENXIO);
614     }
615     sc->ciss_regs_bhandle = rman_get_bushandle(sc->ciss_regs_resource);
616     sc->ciss_regs_btag = rman_get_bustag(sc->ciss_regs_resource);
617 
618     /*
619      * Find the BAR holding the config structure.  If it's not the one
620      * we already mapped for registers, map it too.
621      */
622     sc->ciss_cfg_rid = CISS_TL_SIMPLE_READ(sc, CISS_TL_SIMPLE_CFG_BAR) & 0xffff;
623     if (sc->ciss_cfg_rid != sc->ciss_regs_rid) {
624 	if ((sc->ciss_cfg_resource =
625 	     bus_alloc_resource_any(sc->ciss_dev, SYS_RES_MEMORY,
626 				    &sc->ciss_cfg_rid, RF_ACTIVE)) == NULL) {
627 	    ciss_printf(sc, "can't allocate config window\n");
628 	    return(ENXIO);
629 	}
630 	cbase = (uintptr_t)rman_get_virtual(sc->ciss_cfg_resource);
631 	csize = rman_get_end(sc->ciss_cfg_resource) -
632 	    rman_get_start(sc->ciss_cfg_resource) + 1;
633     } else {
634 	cbase = (uintptr_t)rman_get_virtual(sc->ciss_regs_resource);
635 	csize = rman_get_end(sc->ciss_regs_resource) -
636 	    rman_get_start(sc->ciss_regs_resource) + 1;
637     }
638     cofs = CISS_TL_SIMPLE_READ(sc, CISS_TL_SIMPLE_CFG_OFF);
639 
640     /*
641      * Use the base/size/offset values we just calculated to
642      * sanity-check the config structure.  If it's OK, point to it.
643      */
644     if ((cofs + sizeof(struct ciss_config_table)) > csize) {
645 	ciss_printf(sc, "config table outside window\n");
646 	return(ENXIO);
647     }
648     sc->ciss_cfg = (struct ciss_config_table *)(cbase + cofs);
649     debug(1, "config struct at %p", sc->ciss_cfg);
650 
651     /*
652      * Calculate the number of request structures/commands we are
653      * going to provide for this adapter.
654      */
655     sc->ciss_max_requests = min(CISS_MAX_REQUESTS, sc->ciss_cfg->max_outstanding_commands);
656 
657     /*
658      * Validate the config structure.  If we supported other transport
659      * methods, we could select amongst them at this point in time.
660      */
661     if (strncmp(sc->ciss_cfg->signature, "CISS", 4)) {
662 	ciss_printf(sc, "config signature mismatch (got '%c%c%c%c')\n",
663 		    sc->ciss_cfg->signature[0], sc->ciss_cfg->signature[1],
664 		    sc->ciss_cfg->signature[2], sc->ciss_cfg->signature[3]);
665 	return(ENXIO);
666     }
667 
668     /*
669      * Select the mode of operation, prefer Performant.
670      */
671     if (!(sc->ciss_cfg->supported_methods &
672 	(CISS_TRANSPORT_METHOD_SIMPLE | CISS_TRANSPORT_METHOD_PERF))) {
673 	ciss_printf(sc, "No supported transport layers: 0x%x\n",
674 	    sc->ciss_cfg->supported_methods);
675     }
676 
677     switch (ciss_force_transport) {
678     case 1:
679 	supported_methods = CISS_TRANSPORT_METHOD_SIMPLE;
680 	break;
681     case 2:
682 	supported_methods = CISS_TRANSPORT_METHOD_PERF;
683 	break;
684     default:
685 	supported_methods = sc->ciss_cfg->supported_methods;
686 	break;
687     }
688 
689 setup:
690     if ((supported_methods & CISS_TRANSPORT_METHOD_PERF) != 0) {
691 	method = CISS_TRANSPORT_METHOD_PERF;
692 	sc->ciss_perf = (struct ciss_perf_config *)(cbase + cofs +
693 	    sc->ciss_cfg->transport_offset);
694 	if (ciss_init_perf(sc)) {
695 	    supported_methods &= ~method;
696 	    goto setup;
697 	}
698     } else if (supported_methods & CISS_TRANSPORT_METHOD_SIMPLE) {
699 	method = CISS_TRANSPORT_METHOD_SIMPLE;
700     } else {
701 	ciss_printf(sc, "No supported transport methods: 0x%x\n",
702 	    sc->ciss_cfg->supported_methods);
703 	return(ENXIO);
704     }
705 
706     /*
707      * Tell it we're using the low 4GB of RAM.  Set the default interrupt
708      * coalescing options.
709      */
710     sc->ciss_cfg->requested_method = method;
711     sc->ciss_cfg->command_physlimit = 0;
712     sc->ciss_cfg->interrupt_coalesce_delay = CISS_INTERRUPT_COALESCE_DELAY;
713     sc->ciss_cfg->interrupt_coalesce_count = CISS_INTERRUPT_COALESCE_COUNT;
714 
715 #ifdef __i386__
716     sc->ciss_cfg->host_driver |= CISS_DRIVER_SCSI_PREFETCH;
717 #endif
718 
719     if (ciss_update_config(sc)) {
720 	ciss_printf(sc, "adapter refuses to accept config update (IDBR 0x%x)\n",
721 		    CISS_TL_SIMPLE_READ(sc, CISS_TL_SIMPLE_IDBR));
722 	return(ENXIO);
723     }
724     if ((sc->ciss_cfg->active_method & method) == 0) {
725 	supported_methods &= ~method;
726 	if (supported_methods == 0) {
727 	    ciss_printf(sc, "adapter refuses to go into available transports "
728 		"mode (0x%x, 0x%x)\n", supported_methods,
729 		sc->ciss_cfg->active_method);
730 	    return(ENXIO);
731 	} else
732 	    goto setup;
733     }
734 
735     /*
736      * Wait for the adapter to come ready.
737      */
738     if ((error = ciss_wait_adapter(sc)) != 0)
739 	return(error);
740 
741     /* Prepare to possibly use MSIX and/or PERFORMANT interrupts.  Normal
742      * interrupts have a rid of 0, this will be overridden if MSIX is used.
743      */
744     sc->ciss_irq_rid[0] = 0;
745     if (method == CISS_TRANSPORT_METHOD_PERF) {
746 	ciss_printf(sc, "PERFORMANT Transport\n");
747 	if ((ciss_force_interrupt != 1) && (ciss_setup_msix(sc) == 0)) {
748 	    intr = ciss_perf_msi_intr;
749 	} else {
750 	    intr = ciss_perf_intr;
751 	}
752 	/* XXX The docs say that the 0x01 bit is only for SAS controllers.
753 	 * Unfortunately, there is no good way to know if this is a SAS
754 	 * controller.  Hopefully enabling this bit universally will work OK.
755 	 * It seems to work fine for SA6i controllers.
756 	 */
757 	sc->ciss_interrupt_mask = CISS_TL_PERF_INTR_OPQ | CISS_TL_PERF_INTR_MSI;
758 
759     } else {
760 	ciss_printf(sc, "SIMPLE Transport\n");
761 	/* MSIX doesn't seem to work in SIMPLE mode, only enable if it forced */
762 	if (ciss_force_interrupt == 2)
763 	    /* If this fails, we automatically revert to INTx */
764 	    ciss_setup_msix(sc);
765 	sc->ciss_perf = NULL;
766 	intr = ciss_intr;
767 	sc->ciss_interrupt_mask = sqmask;
768     }
769 
770     /*
771      * Turn off interrupts before we go routing anything.
772      */
773     CISS_TL_SIMPLE_DISABLE_INTERRUPTS(sc);
774 
775     /*
776      * Allocate and set up our interrupt.
777      */
778     if ((sc->ciss_irq_resource =
779 	 bus_alloc_resource_any(sc->ciss_dev, SYS_RES_IRQ, &sc->ciss_irq_rid[0],
780 				RF_ACTIVE | RF_SHAREABLE)) == NULL) {
781 	ciss_printf(sc, "can't allocate interrupt\n");
782 	return(ENXIO);
783     }
784 
785     if (bus_setup_intr(sc->ciss_dev, sc->ciss_irq_resource,
786 		       INTR_TYPE_CAM|INTR_MPSAFE, NULL, intr, sc,
787 		       &sc->ciss_intr)) {
788 	ciss_printf(sc, "can't set up interrupt\n");
789 	return(ENXIO);
790     }
791 
792     /*
793      * Allocate the parent bus DMA tag appropriate for our PCI
794      * interface.
795      *
796      * Note that "simple" adapters can only address within a 32-bit
797      * span.
798      */
799     if (bus_dma_tag_create(bus_get_dma_tag(sc->ciss_dev),/* PCI parent */
800 			   1, 0, 			/* alignment, boundary */
801 			   BUS_SPACE_MAXADDR,		/* lowaddr */
802 			   BUS_SPACE_MAXADDR, 		/* highaddr */
803 			   NULL, NULL, 			/* filter, filterarg */
804 			   BUS_SPACE_MAXSIZE_32BIT,	/* maxsize */
805 			   CISS_MAX_SG_ELEMENTS,	/* nsegments */
806 			   BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
807 			   0,				/* flags */
808 			   NULL, NULL,			/* lockfunc, lockarg */
809 			   &sc->ciss_parent_dmat)) {
810 	ciss_printf(sc, "can't allocate parent DMA tag\n");
811 	return(ENOMEM);
812     }
813 
814     /*
815      * Create DMA tag for mapping buffers into adapter-addressable
816      * space.
817      */
818     if (bus_dma_tag_create(sc->ciss_parent_dmat, 	/* parent */
819 			   1, 0, 			/* alignment, boundary */
820 			   BUS_SPACE_MAXADDR,		/* lowaddr */
821 			   BUS_SPACE_MAXADDR, 		/* highaddr */
822 			   NULL, NULL, 			/* filter, filterarg */
823 			   MAXBSIZE, CISS_MAX_SG_ELEMENTS,	/* maxsize, nsegments */
824 			   BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
825 			   BUS_DMA_ALLOCNOW,		/* flags */
826 			   busdma_lock_mutex, &sc->ciss_mtx,	/* lockfunc, lockarg */
827 			   &sc->ciss_buffer_dmat)) {
828 	ciss_printf(sc, "can't allocate buffer DMA tag\n");
829 	return(ENOMEM);
830     }
831     return(0);
832 }
833 
834 /************************************************************************
835  * Setup MSI/MSIX operation (Performant only)
836  * Four interrupts are available, but we only use 1 right now.  If MSI-X
837  * isn't avaialble, try using MSI instead.
838  */
839 static int
840 ciss_setup_msix(struct ciss_softc *sc)
841 {
842     int val, i;
843 
844     /* Weed out devices that don't actually support MSI */
845     i = ciss_lookup(sc->ciss_dev);
846     if (ciss_vendor_data[i].flags & CISS_BOARD_NOMSI)
847 	return (EINVAL);
848 
849     /*
850      * Only need to use the minimum number of MSI vectors, as the driver
851      * doesn't support directed MSIX interrupts.
852      */
853     val = pci_msix_count(sc->ciss_dev);
854     if (val < CISS_MSI_COUNT) {
855 	val = pci_msi_count(sc->ciss_dev);
856 	device_printf(sc->ciss_dev, "got %d MSI messages]\n", val);
857 	if (val < CISS_MSI_COUNT)
858 	    return (EINVAL);
859     }
860     val = MIN(val, CISS_MSI_COUNT);
861     if (pci_alloc_msix(sc->ciss_dev, &val) != 0) {
862 	if (pci_alloc_msi(sc->ciss_dev, &val) != 0)
863 	    return (EINVAL);
864     }
865 
866     sc->ciss_msi = val;
867     if (bootverbose)
868 	ciss_printf(sc, "Using %d MSIX interrupt%s\n", val,
869 	    (val != 1) ? "s" : "");
870 
871     for (i = 0; i < val; i++)
872 	sc->ciss_irq_rid[i] = i + 1;
873 
874     return (0);
875 
876 }
877 
878 /************************************************************************
879  * Setup the Performant structures.
880  */
881 static int
882 ciss_init_perf(struct ciss_softc *sc)
883 {
884     struct ciss_perf_config *pc = sc->ciss_perf;
885     int reply_size;
886 
887     /*
888      * Create the DMA tag for the reply queue.
889      */
890     reply_size = sizeof(uint64_t) * sc->ciss_max_requests;
891     if (bus_dma_tag_create(sc->ciss_parent_dmat,	/* parent */
892 			   1, 0, 			/* alignment, boundary */
893 			   BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
894 			   BUS_SPACE_MAXADDR, 		/* highaddr */
895 			   NULL, NULL, 			/* filter, filterarg */
896 			   reply_size, 1,		/* maxsize, nsegments */
897 			   BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
898 			   0,				/* flags */
899 			   NULL, NULL,			/* lockfunc, lockarg */
900 			   &sc->ciss_reply_dmat)) {
901 	ciss_printf(sc, "can't allocate reply DMA tag\n");
902 	return(ENOMEM);
903     }
904     /*
905      * Allocate memory and make it available for DMA.
906      */
907     if (bus_dmamem_alloc(sc->ciss_reply_dmat, (void **)&sc->ciss_reply,
908 			 BUS_DMA_NOWAIT, &sc->ciss_reply_map)) {
909 	ciss_printf(sc, "can't allocate reply memory\n");
910 	return(ENOMEM);
911     }
912     bus_dmamap_load(sc->ciss_reply_dmat, sc->ciss_reply_map, sc->ciss_reply,
913 		    reply_size, ciss_command_map_helper, &sc->ciss_reply_phys, 0);
914     bzero(sc->ciss_reply, reply_size);
915 
916     sc->ciss_cycle = 0x1;
917     sc->ciss_rqidx = 0;
918 
919     /*
920      * Preload the fetch table with common command sizes.  This allows the
921      * hardware to not waste bus cycles for typical i/o commands, but also not
922      * tax the driver to be too exact in choosing sizes.  The table is optimized
923      * for page-aligned i/o's, but since most i/o comes from the various pagers,
924      * it's a reasonable assumption to make.
925      */
926     pc->fetch_count[CISS_SG_FETCH_NONE] = (sizeof(struct ciss_command) + 15) / 16;
927     pc->fetch_count[CISS_SG_FETCH_1] =
928 	(sizeof(struct ciss_command) + sizeof(struct ciss_sg_entry) * 1 + 15) / 16;
929     pc->fetch_count[CISS_SG_FETCH_2] =
930 	(sizeof(struct ciss_command) + sizeof(struct ciss_sg_entry) * 2 + 15) / 16;
931     pc->fetch_count[CISS_SG_FETCH_4] =
932 	(sizeof(struct ciss_command) + sizeof(struct ciss_sg_entry) * 4 + 15) / 16;
933     pc->fetch_count[CISS_SG_FETCH_8] =
934 	(sizeof(struct ciss_command) + sizeof(struct ciss_sg_entry) * 8 + 15) / 16;
935     pc->fetch_count[CISS_SG_FETCH_16] =
936 	(sizeof(struct ciss_command) + sizeof(struct ciss_sg_entry) * 16 + 15) / 16;
937     pc->fetch_count[CISS_SG_FETCH_32] =
938 	(sizeof(struct ciss_command) + sizeof(struct ciss_sg_entry) * 32 + 15) / 16;
939     pc->fetch_count[CISS_SG_FETCH_MAX] = (CISS_COMMAND_ALLOC_SIZE + 15) / 16;
940 
941     pc->rq_size = sc->ciss_max_requests; /* XXX less than the card supports? */
942     pc->rq_count = 1;	/* XXX Hardcode for a single queue */
943     pc->rq_bank_hi = 0;
944     pc->rq_bank_lo = 0;
945     pc->rq[0].rq_addr_hi = 0x0;
946     pc->rq[0].rq_addr_lo = sc->ciss_reply_phys;
947 
948     return(0);
949 }
950 
951 /************************************************************************
952  * Wait for the adapter to come ready.
953  */
954 static int
955 ciss_wait_adapter(struct ciss_softc *sc)
956 {
957     int		i;
958 
959     debug_called(1);
960 
961     /*
962      * Wait for the adapter to come ready.
963      */
964     if (!(sc->ciss_cfg->active_method & CISS_TRANSPORT_METHOD_READY)) {
965 	ciss_printf(sc, "waiting for adapter to come ready...\n");
966 	for (i = 0; !(sc->ciss_cfg->active_method & CISS_TRANSPORT_METHOD_READY); i++) {
967 	    DELAY(1000000);	/* one second */
968 	    if (i > 30) {
969 		ciss_printf(sc, "timed out waiting for adapter to come ready\n");
970 		return(EIO);
971 	    }
972 	}
973     }
974     return(0);
975 }
976 
977 /************************************************************************
978  * Flush the adapter cache.
979  */
980 static int
981 ciss_flush_adapter(struct ciss_softc *sc)
982 {
983     struct ciss_request			*cr;
984     struct ciss_bmic_flush_cache	*cbfc;
985     int					error, command_status;
986 
987     debug_called(1);
988 
989     cr = NULL;
990     cbfc = NULL;
991 
992     /*
993      * Build a BMIC request to flush the cache.  We don't disable
994      * it, as we may be going to do more I/O (eg. we are emulating
995      * the Synchronise Cache command).
996      */
997     if ((cbfc = malloc(sizeof(*cbfc), CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO)) == NULL) {
998 	error = ENOMEM;
999 	goto out;
1000     }
1001     if ((error = ciss_get_bmic_request(sc, &cr, CISS_BMIC_FLUSH_CACHE,
1002 				       (void **)&cbfc, sizeof(*cbfc))) != 0)
1003 	goto out;
1004 
1005     /*
1006      * Submit the request and wait for it to complete.
1007      */
1008     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1009 	ciss_printf(sc, "error sending BMIC FLUSH_CACHE command (%d)\n", error);
1010 	goto out;
1011     }
1012 
1013     /*
1014      * Check response.
1015      */
1016     ciss_report_request(cr, &command_status, NULL);
1017     switch(command_status) {
1018     case CISS_CMD_STATUS_SUCCESS:
1019 	break;
1020     default:
1021 	ciss_printf(sc, "error flushing cache (%s)\n",
1022 		    ciss_name_command_status(command_status));
1023 	error = EIO;
1024 	goto out;
1025     }
1026 
1027 out:
1028     if (cbfc != NULL)
1029 	free(cbfc, CISS_MALLOC_CLASS);
1030     if (cr != NULL)
1031 	ciss_release_request(cr);
1032     return(error);
1033 }
1034 
1035 static void
1036 ciss_soft_reset(struct ciss_softc *sc)
1037 {
1038     struct ciss_request		*cr = NULL;
1039     struct ciss_command		*cc;
1040     int				i, error = 0;
1041 
1042     for (i = 0; i < sc->ciss_max_logical_bus; i++) {
1043 	/* only reset proxy controllers */
1044 	if (sc->ciss_controllers[i].physical.bus == 0)
1045 	    continue;
1046 
1047 	if ((error = ciss_get_request(sc, &cr)) != 0)
1048 	    break;
1049 
1050 	if ((error = ciss_get_bmic_request(sc, &cr, CISS_BMIC_SOFT_RESET,
1051 					   NULL, 0)) != 0)
1052 	    break;
1053 
1054 	cc = cr->cr_cc;
1055 	cc->header.address = sc->ciss_controllers[i];
1056 
1057 	if ((error = ciss_synch_request(cr, 60 * 1000)) != 0)
1058 	    break;
1059 
1060 	ciss_release_request(cr);
1061     }
1062 
1063     if (error)
1064 	ciss_printf(sc, "error resetting controller (%d)\n", error);
1065 
1066     if (cr != NULL)
1067 	ciss_release_request(cr);
1068 }
1069 
1070 /************************************************************************
1071  * Allocate memory for the adapter command structures, initialise
1072  * the request structures.
1073  *
1074  * Note that the entire set of commands are allocated in a single
1075  * contiguous slab.
1076  */
1077 static int
1078 ciss_init_requests(struct ciss_softc *sc)
1079 {
1080     struct ciss_request	*cr;
1081     int			i;
1082 
1083     debug_called(1);
1084 
1085     if (bootverbose)
1086 	ciss_printf(sc, "using %d of %d available commands\n",
1087 		    sc->ciss_max_requests, sc->ciss_cfg->max_outstanding_commands);
1088 
1089     /*
1090      * Create the DMA tag for commands.
1091      */
1092     if (bus_dma_tag_create(sc->ciss_parent_dmat,	/* parent */
1093 			   32, 0, 			/* alignment, boundary */
1094 			   BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
1095 			   BUS_SPACE_MAXADDR, 		/* highaddr */
1096 			   NULL, NULL, 			/* filter, filterarg */
1097 			   CISS_COMMAND_ALLOC_SIZE *
1098 			   sc->ciss_max_requests, 1,	/* maxsize, nsegments */
1099 			   BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
1100 			   0,				/* flags */
1101 			   NULL, NULL,			/* lockfunc, lockarg */
1102 			   &sc->ciss_command_dmat)) {
1103 	ciss_printf(sc, "can't allocate command DMA tag\n");
1104 	return(ENOMEM);
1105     }
1106     /*
1107      * Allocate memory and make it available for DMA.
1108      */
1109     if (bus_dmamem_alloc(sc->ciss_command_dmat, (void **)&sc->ciss_command,
1110 			 BUS_DMA_NOWAIT, &sc->ciss_command_map)) {
1111 	ciss_printf(sc, "can't allocate command memory\n");
1112 	return(ENOMEM);
1113     }
1114     bus_dmamap_load(sc->ciss_command_dmat, sc->ciss_command_map,sc->ciss_command,
1115 		    CISS_COMMAND_ALLOC_SIZE * sc->ciss_max_requests,
1116 		    ciss_command_map_helper, &sc->ciss_command_phys, 0);
1117     bzero(sc->ciss_command, CISS_COMMAND_ALLOC_SIZE * sc->ciss_max_requests);
1118 
1119     /*
1120      * Set up the request and command structures, push requests onto
1121      * the free queue.
1122      */
1123     for (i = 1; i < sc->ciss_max_requests; i++) {
1124 	cr = &sc->ciss_request[i];
1125 	cr->cr_sc = sc;
1126 	cr->cr_tag = i;
1127 	cr->cr_cc = (struct ciss_command *)((uintptr_t)sc->ciss_command +
1128 	    CISS_COMMAND_ALLOC_SIZE * i);
1129 	cr->cr_ccphys = sc->ciss_command_phys + CISS_COMMAND_ALLOC_SIZE * i;
1130 	bus_dmamap_create(sc->ciss_buffer_dmat, 0, &cr->cr_datamap);
1131 	ciss_enqueue_free(cr);
1132     }
1133     return(0);
1134 }
1135 
1136 static void
1137 ciss_command_map_helper(void *arg, bus_dma_segment_t *segs, int nseg, int error)
1138 {
1139     uint32_t *addr;
1140 
1141     addr = arg;
1142     *addr = segs[0].ds_addr;
1143 }
1144 
1145 /************************************************************************
1146  * Identify the adapter, print some information about it.
1147  */
1148 static int
1149 ciss_identify_adapter(struct ciss_softc *sc)
1150 {
1151     struct ciss_request	*cr;
1152     int			error, command_status;
1153 
1154     debug_called(1);
1155 
1156     cr = NULL;
1157 
1158     /*
1159      * Get a request, allocate storage for the adapter data.
1160      */
1161     if ((error = ciss_get_bmic_request(sc, &cr, CISS_BMIC_ID_CTLR,
1162 				       (void **)&sc->ciss_id,
1163 				       sizeof(*sc->ciss_id))) != 0)
1164 	goto out;
1165 
1166     /*
1167      * Submit the request and wait for it to complete.
1168      */
1169     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1170 	ciss_printf(sc, "error sending BMIC ID_CTLR command (%d)\n", error);
1171 	goto out;
1172     }
1173 
1174     /*
1175      * Check response.
1176      */
1177     ciss_report_request(cr, &command_status, NULL);
1178     switch(command_status) {
1179     case CISS_CMD_STATUS_SUCCESS:		/* buffer right size */
1180 	break;
1181     case CISS_CMD_STATUS_DATA_UNDERRUN:
1182     case CISS_CMD_STATUS_DATA_OVERRUN:
1183 	ciss_printf(sc, "data over/underrun reading adapter information\n");
1184     default:
1185 	ciss_printf(sc, "error reading adapter information (%s)\n",
1186 		    ciss_name_command_status(command_status));
1187 	error = EIO;
1188 	goto out;
1189     }
1190 
1191     /* sanity-check reply */
1192     if (!sc->ciss_id->big_map_supported) {
1193 	ciss_printf(sc, "adapter does not support BIG_MAP\n");
1194 	error = ENXIO;
1195 	goto out;
1196     }
1197 
1198 #if 0
1199     /* XXX later revisions may not need this */
1200     sc->ciss_flags |= CISS_FLAG_FAKE_SYNCH;
1201 #endif
1202 
1203     /* XXX only really required for old 5300 adapters? */
1204     sc->ciss_flags |= CISS_FLAG_BMIC_ABORT;
1205 
1206     /*
1207      * Earlier controller specs do not contain these config
1208      * entries, so assume that a 0 means its old and assign
1209      * these values to the defaults that were established
1210      * when this driver was developed for them
1211      */
1212     if (sc->ciss_cfg->max_logical_supported == 0)
1213         sc->ciss_cfg->max_logical_supported = CISS_MAX_LOGICAL;
1214     if (sc->ciss_cfg->max_physical_supported == 0)
1215 	sc->ciss_cfg->max_physical_supported = CISS_MAX_PHYSICAL;
1216     /* print information */
1217     if (bootverbose) {
1218 	ciss_printf(sc, "  %d logical drive%s configured\n",
1219 		    sc->ciss_id->configured_logical_drives,
1220 		    (sc->ciss_id->configured_logical_drives == 1) ? "" : "s");
1221 	ciss_printf(sc, "  firmware %4.4s\n", sc->ciss_id->running_firmware_revision);
1222 	ciss_printf(sc, "  %d SCSI channels\n", sc->ciss_id->scsi_bus_count);
1223 
1224 	ciss_printf(sc, "  signature '%.4s'\n", sc->ciss_cfg->signature);
1225 	ciss_printf(sc, "  valence %d\n", sc->ciss_cfg->valence);
1226 	ciss_printf(sc, "  supported I/O methods 0x%b\n",
1227 		    sc->ciss_cfg->supported_methods,
1228 		    "\20\1READY\2simple\3performant\4MEMQ\n");
1229 	ciss_printf(sc, "  active I/O method 0x%b\n",
1230 		    sc->ciss_cfg->active_method, "\20\2simple\3performant\4MEMQ\n");
1231 	ciss_printf(sc, "  4G page base 0x%08x\n",
1232 		    sc->ciss_cfg->command_physlimit);
1233 	ciss_printf(sc, "  interrupt coalesce delay %dus\n",
1234 		    sc->ciss_cfg->interrupt_coalesce_delay);
1235 	ciss_printf(sc, "  interrupt coalesce count %d\n",
1236 		    sc->ciss_cfg->interrupt_coalesce_count);
1237 	ciss_printf(sc, "  max outstanding commands %d\n",
1238 		    sc->ciss_cfg->max_outstanding_commands);
1239 	ciss_printf(sc, "  bus types 0x%b\n", sc->ciss_cfg->bus_types,
1240 		    "\20\1ultra2\2ultra3\10fibre1\11fibre2\n");
1241 	ciss_printf(sc, "  server name '%.16s'\n", sc->ciss_cfg->server_name);
1242 	ciss_printf(sc, "  heartbeat 0x%x\n", sc->ciss_cfg->heartbeat);
1243     	ciss_printf(sc, "  max logical logical volumes: %d\n", sc->ciss_cfg->max_logical_supported);
1244     	ciss_printf(sc, "  max physical disks supported: %d\n", sc->ciss_cfg->max_physical_supported);
1245     	ciss_printf(sc, "  max physical disks per logical volume: %d\n", sc->ciss_cfg->max_physical_per_logical);
1246     }
1247 
1248 out:
1249     if (error) {
1250 	if (sc->ciss_id != NULL) {
1251 	    free(sc->ciss_id, CISS_MALLOC_CLASS);
1252 	    sc->ciss_id = NULL;
1253 	}
1254     }
1255     if (cr != NULL)
1256 	ciss_release_request(cr);
1257     return(error);
1258 }
1259 
1260 /************************************************************************
1261  * Helper routine for generating a list of logical and physical luns.
1262  */
1263 static struct ciss_lun_report *
1264 ciss_report_luns(struct ciss_softc *sc, int opcode, int nunits)
1265 {
1266     struct ciss_request		*cr;
1267     struct ciss_command		*cc;
1268     struct ciss_report_cdb	*crc;
1269     struct ciss_lun_report	*cll;
1270     int				command_status;
1271     int				report_size;
1272     int				error = 0;
1273 
1274     debug_called(1);
1275 
1276     cr = NULL;
1277     cll = NULL;
1278 
1279     /*
1280      * Get a request, allocate storage for the address list.
1281      */
1282     if ((error = ciss_get_request(sc, &cr)) != 0)
1283 	goto out;
1284     report_size = sizeof(*cll) + nunits * sizeof(union ciss_device_address);
1285     if ((cll = malloc(report_size, CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO)) == NULL) {
1286 	ciss_printf(sc, "can't allocate memory for lun report\n");
1287 	error = ENOMEM;
1288 	goto out;
1289     }
1290 
1291     /*
1292      * Build the Report Logical/Physical LUNs command.
1293      */
1294     cc = cr->cr_cc;
1295     cr->cr_data = cll;
1296     cr->cr_length = report_size;
1297     cr->cr_flags = CISS_REQ_DATAIN;
1298 
1299     cc->header.address.physical.mode = CISS_HDR_ADDRESS_MODE_PERIPHERAL;
1300     cc->header.address.physical.bus = 0;
1301     cc->header.address.physical.target = 0;
1302     cc->cdb.cdb_length = sizeof(*crc);
1303     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
1304     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
1305     cc->cdb.direction = CISS_CDB_DIRECTION_READ;
1306     cc->cdb.timeout = 30;	/* XXX better suggestions? */
1307 
1308     crc = (struct ciss_report_cdb *)&(cc->cdb.cdb[0]);
1309     bzero(crc, sizeof(*crc));
1310     crc->opcode = opcode;
1311     crc->length = htonl(report_size);			/* big-endian field */
1312     cll->list_size = htonl(report_size - sizeof(*cll));	/* big-endian field */
1313 
1314     /*
1315      * Submit the request and wait for it to complete.  (timeout
1316      * here should be much greater than above)
1317      */
1318     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1319 	ciss_printf(sc, "error sending %d LUN command (%d)\n", opcode, error);
1320 	goto out;
1321     }
1322 
1323     /*
1324      * Check response.  Note that data over/underrun is OK.
1325      */
1326     ciss_report_request(cr, &command_status, NULL);
1327     switch(command_status) {
1328     case CISS_CMD_STATUS_SUCCESS:	/* buffer right size */
1329     case CISS_CMD_STATUS_DATA_UNDERRUN:	/* buffer too large, not bad */
1330 	break;
1331     case CISS_CMD_STATUS_DATA_OVERRUN:
1332 	ciss_printf(sc, "WARNING: more units than driver limit (%d)\n",
1333 		    sc->ciss_cfg->max_logical_supported);
1334 	break;
1335     default:
1336 	ciss_printf(sc, "error detecting logical drive configuration (%s)\n",
1337 		    ciss_name_command_status(command_status));
1338 	error = EIO;
1339 	goto out;
1340     }
1341     ciss_release_request(cr);
1342     cr = NULL;
1343 
1344 out:
1345     if (cr != NULL)
1346 	ciss_release_request(cr);
1347     if (error && cll != NULL) {
1348 	free(cll, CISS_MALLOC_CLASS);
1349 	cll = NULL;
1350     }
1351     return(cll);
1352 }
1353 
1354 /************************************************************************
1355  * Find logical drives on the adapter.
1356  */
1357 static int
1358 ciss_init_logical(struct ciss_softc *sc)
1359 {
1360     struct ciss_lun_report	*cll;
1361     int				error = 0, i, j;
1362     int				ndrives;
1363 
1364     debug_called(1);
1365 
1366     cll = ciss_report_luns(sc, CISS_OPCODE_REPORT_LOGICAL_LUNS,
1367 			   sc->ciss_cfg->max_logical_supported);
1368     if (cll == NULL) {
1369 	error = ENXIO;
1370 	goto out;
1371     }
1372 
1373     /* sanity-check reply */
1374     ndrives = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
1375     if ((ndrives < 0) || (ndrives > sc->ciss_cfg->max_logical_supported)) {
1376 	ciss_printf(sc, "adapter claims to report absurd number of logical drives (%d > %d)\n",
1377 	    	ndrives, sc->ciss_cfg->max_logical_supported);
1378 	error = ENXIO;
1379 	goto out;
1380     }
1381 
1382     /*
1383      * Save logical drive information.
1384      */
1385     if (bootverbose) {
1386 	ciss_printf(sc, "%d logical drive%s\n",
1387 	    ndrives, (ndrives > 1 || ndrives == 0) ? "s" : "");
1388     }
1389 
1390     sc->ciss_logical =
1391 	malloc(sc->ciss_max_logical_bus * sizeof(struct ciss_ldrive *),
1392 	       CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
1393     if (sc->ciss_logical == NULL) {
1394 	error = ENXIO;
1395 	goto out;
1396     }
1397 
1398     for (i = 0; i <= sc->ciss_max_logical_bus; i++) {
1399 	sc->ciss_logical[i] =
1400 	    malloc(sc->ciss_cfg->max_logical_supported *
1401 		   sizeof(struct ciss_ldrive),
1402 		   CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
1403 	if (sc->ciss_logical[i] == NULL) {
1404 	    error = ENXIO;
1405 	    goto out;
1406 	}
1407 
1408 	for (j = 0; j < sc->ciss_cfg->max_logical_supported; j++)
1409 	    sc->ciss_logical[i][j].cl_status = CISS_LD_NONEXISTENT;
1410     }
1411 
1412 
1413     for (i = 0; i < sc->ciss_cfg->max_logical_supported; i++) {
1414 	if (i < ndrives) {
1415 	    struct ciss_ldrive	*ld;
1416 	    int			bus, target;
1417 
1418 	    bus		= CISS_LUN_TO_BUS(cll->lun[i].logical.lun);
1419 	    target	= CISS_LUN_TO_TARGET(cll->lun[i].logical.lun);
1420 	    ld		= &sc->ciss_logical[bus][target];
1421 
1422 	    ld->cl_address	= cll->lun[i];
1423 	    ld->cl_controller	= &sc->ciss_controllers[bus];
1424 	    if (ciss_identify_logical(sc, ld) != 0)
1425 		continue;
1426 	    /*
1427 	     * If the drive has had media exchanged, we should bring it online.
1428 	     */
1429 	    if (ld->cl_lstatus->media_exchanged)
1430 		ciss_accept_media(sc, ld);
1431 
1432 	}
1433     }
1434 
1435  out:
1436     if (cll != NULL)
1437 	free(cll, CISS_MALLOC_CLASS);
1438     return(error);
1439 }
1440 
1441 static int
1442 ciss_init_physical(struct ciss_softc *sc)
1443 {
1444     struct ciss_lun_report	*cll;
1445     int				error = 0, i;
1446     int				nphys;
1447     int				bus, target;
1448 
1449     debug_called(1);
1450 
1451     bus = 0;
1452     target = 0;
1453 
1454     cll = ciss_report_luns(sc, CISS_OPCODE_REPORT_PHYSICAL_LUNS,
1455 			   sc->ciss_cfg->max_physical_supported);
1456     if (cll == NULL) {
1457 	error = ENXIO;
1458 	goto out;
1459     }
1460 
1461     nphys = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
1462 
1463     if (bootverbose) {
1464 	ciss_printf(sc, "%d physical device%s\n",
1465 	    nphys, (nphys > 1 || nphys == 0) ? "s" : "");
1466     }
1467 
1468     /*
1469      * Figure out the bus mapping.
1470      * Logical buses include both the local logical bus for local arrays and
1471      * proxy buses for remote arrays.  Physical buses are numbered by the
1472      * controller and represent physical buses that hold physical devices.
1473      * We shift these bus numbers so that everything fits into a single flat
1474      * numbering space for CAM.  Logical buses occupy the first 32 CAM bus
1475      * numbers, and the physical bus numbers are shifted to be above that.
1476      * This results in the various driver arrays being indexed as follows:
1477      *
1478      * ciss_controllers[] - indexed by logical bus
1479      * ciss_cam_sim[]     - indexed by both logical and physical, with physical
1480      *                      being shifted by 32.
1481      * ciss_logical[][]   - indexed by logical bus
1482      * ciss_physical[][]  - indexed by physical bus
1483      *
1484      * XXX This is getting more and more hackish.  CISS really doesn't play
1485      *     well with a standard SCSI model; devices are addressed via magic
1486      *     cookies, not via b/t/l addresses.  Since there is no way to store
1487      *     the cookie in the CAM device object, we have to keep these lookup
1488      *     tables handy so that the devices can be found quickly at the cost
1489      *     of wasting memory and having a convoluted lookup scheme.  This
1490      *     driver should probably be converted to block interface.
1491      */
1492     /*
1493      * If the L2 and L3 SCSI addresses are 0, this signifies a proxy
1494      * controller. A proxy controller is another physical controller
1495      * behind the primary PCI controller. We need to know about this
1496      * so that BMIC commands can be properly targeted.  There can be
1497      * proxy controllers attached to a single PCI controller, so
1498      * find the highest numbered one so the array can be properly
1499      * sized.
1500      */
1501     sc->ciss_max_logical_bus = 1;
1502     for (i = 0; i < nphys; i++) {
1503 	if (cll->lun[i].physical.extra_address == 0) {
1504 	    bus = cll->lun[i].physical.bus;
1505 	    sc->ciss_max_logical_bus = max(sc->ciss_max_logical_bus, bus) + 1;
1506 	} else {
1507 	    bus = CISS_EXTRA_BUS2(cll->lun[i].physical.extra_address);
1508 	    sc->ciss_max_physical_bus = max(sc->ciss_max_physical_bus, bus);
1509 	}
1510     }
1511 
1512     sc->ciss_controllers =
1513 	malloc(sc->ciss_max_logical_bus * sizeof (union ciss_device_address),
1514 	       CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
1515 
1516     if (sc->ciss_controllers == NULL) {
1517 	ciss_printf(sc, "Could not allocate memory for controller map\n");
1518 	error = ENOMEM;
1519 	goto out;
1520     }
1521 
1522     /* setup a map of controller addresses */
1523     for (i = 0; i < nphys; i++) {
1524 	if (cll->lun[i].physical.extra_address == 0) {
1525 	    sc->ciss_controllers[cll->lun[i].physical.bus] = cll->lun[i];
1526 	}
1527     }
1528 
1529     sc->ciss_physical =
1530 	malloc(sc->ciss_max_physical_bus * sizeof(struct ciss_pdrive *),
1531 	       CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
1532     if (sc->ciss_physical == NULL) {
1533 	ciss_printf(sc, "Could not allocate memory for physical device map\n");
1534 	error = ENOMEM;
1535 	goto out;
1536     }
1537 
1538     for (i = 0; i < sc->ciss_max_physical_bus; i++) {
1539 	sc->ciss_physical[i] =
1540 	    malloc(sizeof(struct ciss_pdrive) * CISS_MAX_PHYSTGT,
1541 		   CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
1542 	if (sc->ciss_physical[i] == NULL) {
1543 	    ciss_printf(sc, "Could not allocate memory for target map\n");
1544 	    error = ENOMEM;
1545 	    goto out;
1546 	}
1547     }
1548 
1549     ciss_filter_physical(sc, cll);
1550 
1551 out:
1552     if (cll != NULL)
1553 	free(cll, CISS_MALLOC_CLASS);
1554 
1555     return(error);
1556 }
1557 
1558 static int
1559 ciss_filter_physical(struct ciss_softc *sc, struct ciss_lun_report *cll)
1560 {
1561     u_int32_t ea;
1562     int i, nphys;
1563     int	bus, target;
1564 
1565     nphys = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
1566     for (i = 0; i < nphys; i++) {
1567 	if (cll->lun[i].physical.extra_address == 0)
1568 	    continue;
1569 
1570 	/*
1571 	 * Filter out devices that we don't want.  Level 3 LUNs could
1572 	 * probably be supported, but the docs don't give enough of a
1573 	 * hint to know how.
1574 	 *
1575 	 * The mode field of the physical address is likely set to have
1576 	 * hard disks masked out.  Honor it unless the user has overridden
1577 	 * us with the tunable.  We also munge the inquiry data for these
1578 	 * disks so that they only show up as passthrough devices.  Keeping
1579 	 * them visible in this fashion is useful for doing things like
1580 	 * flashing firmware.
1581 	 */
1582 	ea = cll->lun[i].physical.extra_address;
1583 	if ((CISS_EXTRA_BUS3(ea) != 0) || (CISS_EXTRA_TARGET3(ea) != 0) ||
1584 	    (CISS_EXTRA_MODE2(ea) == 0x3))
1585 	    continue;
1586 	if ((ciss_expose_hidden_physical == 0) &&
1587 	   (cll->lun[i].physical.mode == CISS_HDR_ADDRESS_MODE_MASK_PERIPHERAL))
1588 	    continue;
1589 
1590 	/*
1591 	 * Note: CISS firmware numbers physical busses starting at '1', not
1592 	 *       '0'.  This numbering is internal to the firmware and is only
1593 	 *       used as a hint here.
1594 	 */
1595 	bus = CISS_EXTRA_BUS2(ea) - 1;
1596 	target = CISS_EXTRA_TARGET2(ea);
1597 	sc->ciss_physical[bus][target].cp_address = cll->lun[i];
1598 	sc->ciss_physical[bus][target].cp_online = 1;
1599     }
1600 
1601     return (0);
1602 }
1603 
1604 static int
1605 ciss_inquiry_logical(struct ciss_softc *sc, struct ciss_ldrive *ld)
1606 {
1607     struct ciss_request			*cr;
1608     struct ciss_command			*cc;
1609     struct scsi_inquiry			*inq;
1610     int					error;
1611     int					command_status;
1612 
1613     cr = NULL;
1614 
1615     bzero(&ld->cl_geometry, sizeof(ld->cl_geometry));
1616 
1617     if ((error = ciss_get_request(sc, &cr)) != 0)
1618 	goto out;
1619 
1620     cc = cr->cr_cc;
1621     cr->cr_data = &ld->cl_geometry;
1622     cr->cr_length = sizeof(ld->cl_geometry);
1623     cr->cr_flags = CISS_REQ_DATAIN;
1624 
1625     cc->header.address = ld->cl_address;
1626     cc->cdb.cdb_length = 6;
1627     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
1628     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
1629     cc->cdb.direction = CISS_CDB_DIRECTION_READ;
1630     cc->cdb.timeout = 30;
1631 
1632     inq = (struct scsi_inquiry *)&(cc->cdb.cdb[0]);
1633     inq->opcode = INQUIRY;
1634     inq->byte2 = SI_EVPD;
1635     inq->page_code = CISS_VPD_LOGICAL_DRIVE_GEOMETRY;
1636     scsi_ulto2b(sizeof(ld->cl_geometry), inq->length);
1637 
1638     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1639 	ciss_printf(sc, "error getting geometry (%d)\n", error);
1640 	goto out;
1641     }
1642 
1643     ciss_report_request(cr, &command_status, NULL);
1644     switch(command_status) {
1645     case CISS_CMD_STATUS_SUCCESS:
1646     case CISS_CMD_STATUS_DATA_UNDERRUN:
1647 	break;
1648     case CISS_CMD_STATUS_DATA_OVERRUN:
1649 	ciss_printf(sc, "WARNING: Data overrun\n");
1650 	break;
1651     default:
1652 	ciss_printf(sc, "Error detecting logical drive geometry (%s)\n",
1653 		    ciss_name_command_status(command_status));
1654 	break;
1655     }
1656 
1657 out:
1658     if (cr != NULL)
1659 	ciss_release_request(cr);
1660     return(error);
1661 }
1662 /************************************************************************
1663  * Identify a logical drive, initialise state related to it.
1664  */
1665 static int
1666 ciss_identify_logical(struct ciss_softc *sc, struct ciss_ldrive *ld)
1667 {
1668     struct ciss_request		*cr;
1669     struct ciss_command		*cc;
1670     struct ciss_bmic_cdb	*cbc;
1671     int				error, command_status;
1672 
1673     debug_called(1);
1674 
1675     cr = NULL;
1676 
1677     /*
1678      * Build a BMIC request to fetch the drive ID.
1679      */
1680     if ((error = ciss_get_bmic_request(sc, &cr, CISS_BMIC_ID_LDRIVE,
1681 				       (void **)&ld->cl_ldrive,
1682 				       sizeof(*ld->cl_ldrive))) != 0)
1683 	goto out;
1684     cc = cr->cr_cc;
1685     cc->header.address = *ld->cl_controller;	/* target controller */
1686     cbc = (struct ciss_bmic_cdb *)&(cc->cdb.cdb[0]);
1687     cbc->log_drive = CISS_LUN_TO_TARGET(ld->cl_address.logical.lun);
1688 
1689     /*
1690      * Submit the request and wait for it to complete.
1691      */
1692     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1693 	ciss_printf(sc, "error sending BMIC LDRIVE command (%d)\n", error);
1694 	goto out;
1695     }
1696 
1697     /*
1698      * Check response.
1699      */
1700     ciss_report_request(cr, &command_status, NULL);
1701     switch(command_status) {
1702     case CISS_CMD_STATUS_SUCCESS:		/* buffer right size */
1703 	break;
1704     case CISS_CMD_STATUS_DATA_UNDERRUN:
1705     case CISS_CMD_STATUS_DATA_OVERRUN:
1706 	ciss_printf(sc, "data over/underrun reading logical drive ID\n");
1707     default:
1708 	ciss_printf(sc, "error reading logical drive ID (%s)\n",
1709 		    ciss_name_command_status(command_status));
1710 	error = EIO;
1711 	goto out;
1712     }
1713     ciss_release_request(cr);
1714     cr = NULL;
1715 
1716     /*
1717      * Build a CISS BMIC command to get the logical drive status.
1718      */
1719     if ((error = ciss_get_ldrive_status(sc, ld)) != 0)
1720 	goto out;
1721 
1722     /*
1723      * Get the logical drive geometry.
1724      */
1725     if ((error = ciss_inquiry_logical(sc, ld)) != 0)
1726 	goto out;
1727 
1728     /*
1729      * Print the drive's basic characteristics.
1730      */
1731     if (bootverbose) {
1732 	ciss_printf(sc, "logical drive (b%dt%d): %s, %dMB ",
1733 		    CISS_LUN_TO_BUS(ld->cl_address.logical.lun),
1734 		    CISS_LUN_TO_TARGET(ld->cl_address.logical.lun),
1735 		    ciss_name_ldrive_org(ld->cl_ldrive->fault_tolerance),
1736 		    ((ld->cl_ldrive->blocks_available / (1024 * 1024)) *
1737 		     ld->cl_ldrive->block_size));
1738 
1739 	ciss_print_ldrive(sc, ld);
1740     }
1741 out:
1742     if (error != 0) {
1743 	/* make the drive not-exist */
1744 	ld->cl_status = CISS_LD_NONEXISTENT;
1745 	if (ld->cl_ldrive != NULL) {
1746 	    free(ld->cl_ldrive, CISS_MALLOC_CLASS);
1747 	    ld->cl_ldrive = NULL;
1748 	}
1749 	if (ld->cl_lstatus != NULL) {
1750 	    free(ld->cl_lstatus, CISS_MALLOC_CLASS);
1751 	    ld->cl_lstatus = NULL;
1752 	}
1753     }
1754     if (cr != NULL)
1755 	ciss_release_request(cr);
1756 
1757     return(error);
1758 }
1759 
1760 /************************************************************************
1761  * Get status for a logical drive.
1762  *
1763  * XXX should we also do this in response to Test Unit Ready?
1764  */
1765 static int
1766 ciss_get_ldrive_status(struct ciss_softc *sc,  struct ciss_ldrive *ld)
1767 {
1768     struct ciss_request		*cr;
1769     struct ciss_command		*cc;
1770     struct ciss_bmic_cdb	*cbc;
1771     int				error, command_status;
1772 
1773     /*
1774      * Build a CISS BMIC command to get the logical drive status.
1775      */
1776     if ((error = ciss_get_bmic_request(sc, &cr, CISS_BMIC_ID_LSTATUS,
1777 				       (void **)&ld->cl_lstatus,
1778 				       sizeof(*ld->cl_lstatus))) != 0)
1779 	goto out;
1780     cc = cr->cr_cc;
1781     cc->header.address = *ld->cl_controller;	/* target controller */
1782     cbc = (struct ciss_bmic_cdb *)&(cc->cdb.cdb[0]);
1783     cbc->log_drive = CISS_LUN_TO_TARGET(ld->cl_address.logical.lun);
1784 
1785     /*
1786      * Submit the request and wait for it to complete.
1787      */
1788     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1789 	ciss_printf(sc, "error sending BMIC LSTATUS command (%d)\n", error);
1790 	goto out;
1791     }
1792 
1793     /*
1794      * Check response.
1795      */
1796     ciss_report_request(cr, &command_status, NULL);
1797     switch(command_status) {
1798     case CISS_CMD_STATUS_SUCCESS:		/* buffer right size */
1799 	break;
1800     case CISS_CMD_STATUS_DATA_UNDERRUN:
1801     case CISS_CMD_STATUS_DATA_OVERRUN:
1802 	ciss_printf(sc, "data over/underrun reading logical drive status\n");
1803     default:
1804 	ciss_printf(sc, "error reading logical drive status (%s)\n",
1805 		    ciss_name_command_status(command_status));
1806 	error = EIO;
1807 	goto out;
1808     }
1809 
1810     /*
1811      * Set the drive's summary status based on the returned status.
1812      *
1813      * XXX testing shows that a failed JBOD drive comes back at next
1814      * boot in "queued for expansion" mode.  WTF?
1815      */
1816     ld->cl_status = ciss_decode_ldrive_status(ld->cl_lstatus->status);
1817 
1818 out:
1819     if (cr != NULL)
1820 	ciss_release_request(cr);
1821     return(error);
1822 }
1823 
1824 /************************************************************************
1825  * Notify the adapter of a config update.
1826  */
1827 static int
1828 ciss_update_config(struct ciss_softc *sc)
1829 {
1830     int		i;
1831 
1832     debug_called(1);
1833 
1834     CISS_TL_SIMPLE_WRITE(sc, CISS_TL_SIMPLE_IDBR, CISS_TL_SIMPLE_IDBR_CFG_TABLE);
1835     for (i = 0; i < 1000; i++) {
1836 	if (!(CISS_TL_SIMPLE_READ(sc, CISS_TL_SIMPLE_IDBR) &
1837 	      CISS_TL_SIMPLE_IDBR_CFG_TABLE)) {
1838 	    return(0);
1839 	}
1840 	DELAY(1000);
1841     }
1842     return(1);
1843 }
1844 
1845 /************************************************************************
1846  * Accept new media into a logical drive.
1847  *
1848  * XXX The drive has previously been offline; it would be good if we
1849  *     could make sure it's not open right now.
1850  */
1851 static int
1852 ciss_accept_media(struct ciss_softc *sc, struct ciss_ldrive *ld)
1853 {
1854     struct ciss_request		*cr;
1855     struct ciss_command		*cc;
1856     struct ciss_bmic_cdb	*cbc;
1857     int				command_status;
1858     int				error = 0, ldrive;
1859 
1860     ldrive = CISS_LUN_TO_TARGET(ld->cl_address.logical.lun);
1861 
1862     debug(0, "bringing logical drive %d back online");
1863 
1864     /*
1865      * Build a CISS BMIC command to bring the drive back online.
1866      */
1867     if ((error = ciss_get_bmic_request(sc, &cr, CISS_BMIC_ACCEPT_MEDIA,
1868 				       NULL, 0)) != 0)
1869 	goto out;
1870     cc = cr->cr_cc;
1871     cc->header.address = *ld->cl_controller;	/* target controller */
1872     cbc = (struct ciss_bmic_cdb *)&(cc->cdb.cdb[0]);
1873     cbc->log_drive = ldrive;
1874 
1875     /*
1876      * Submit the request and wait for it to complete.
1877      */
1878     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1879 	ciss_printf(sc, "error sending BMIC ACCEPT MEDIA command (%d)\n", error);
1880 	goto out;
1881     }
1882 
1883     /*
1884      * Check response.
1885      */
1886     ciss_report_request(cr, &command_status, NULL);
1887     switch(command_status) {
1888     case CISS_CMD_STATUS_SUCCESS:		/* all OK */
1889 	/* we should get a logical drive status changed event here */
1890 	break;
1891     default:
1892 	ciss_printf(cr->cr_sc, "error accepting media into failed logical drive (%s)\n",
1893 		    ciss_name_command_status(command_status));
1894 	break;
1895     }
1896 
1897 out:
1898     if (cr != NULL)
1899 	ciss_release_request(cr);
1900     return(error);
1901 }
1902 
1903 /************************************************************************
1904  * Release adapter resources.
1905  */
1906 static void
1907 ciss_free(struct ciss_softc *sc)
1908 {
1909     struct ciss_request *cr;
1910     int			i, j;
1911 
1912     debug_called(1);
1913 
1914     /* we're going away */
1915     sc->ciss_flags |= CISS_FLAG_ABORTING;
1916 
1917     /* terminate the periodic heartbeat routine */
1918     callout_stop(&sc->ciss_periodic);
1919 
1920     /* cancel the Event Notify chain */
1921     ciss_notify_abort(sc);
1922 
1923     ciss_kill_notify_thread(sc);
1924 
1925     /* disconnect from CAM */
1926     if (sc->ciss_cam_sim) {
1927 	for (i = 0; i < sc->ciss_max_logical_bus; i++) {
1928 	    if (sc->ciss_cam_sim[i]) {
1929 		xpt_bus_deregister(cam_sim_path(sc->ciss_cam_sim[i]));
1930 		cam_sim_free(sc->ciss_cam_sim[i], 0);
1931 	    }
1932 	}
1933 	for (i = CISS_PHYSICAL_BASE; i < sc->ciss_max_physical_bus +
1934 	     CISS_PHYSICAL_BASE; i++) {
1935 	    if (sc->ciss_cam_sim[i]) {
1936 		xpt_bus_deregister(cam_sim_path(sc->ciss_cam_sim[i]));
1937 		cam_sim_free(sc->ciss_cam_sim[i], 0);
1938 	    }
1939 	}
1940 	free(sc->ciss_cam_sim, CISS_MALLOC_CLASS);
1941     }
1942     if (sc->ciss_cam_devq)
1943 	cam_simq_free(sc->ciss_cam_devq);
1944 
1945     /* remove the control device */
1946     mtx_unlock(&sc->ciss_mtx);
1947     if (sc->ciss_dev_t != NULL)
1948 	destroy_dev(sc->ciss_dev_t);
1949 
1950     /* Final cleanup of the callout. */
1951     callout_drain(&sc->ciss_periodic);
1952     mtx_destroy(&sc->ciss_mtx);
1953 
1954     /* free the controller data */
1955     if (sc->ciss_id != NULL)
1956 	free(sc->ciss_id, CISS_MALLOC_CLASS);
1957 
1958     /* release I/O resources */
1959     if (sc->ciss_regs_resource != NULL)
1960 	bus_release_resource(sc->ciss_dev, SYS_RES_MEMORY,
1961 			     sc->ciss_regs_rid, sc->ciss_regs_resource);
1962     if (sc->ciss_cfg_resource != NULL)
1963 	bus_release_resource(sc->ciss_dev, SYS_RES_MEMORY,
1964 			     sc->ciss_cfg_rid, sc->ciss_cfg_resource);
1965     if (sc->ciss_intr != NULL)
1966 	bus_teardown_intr(sc->ciss_dev, sc->ciss_irq_resource, sc->ciss_intr);
1967     if (sc->ciss_irq_resource != NULL)
1968 	bus_release_resource(sc->ciss_dev, SYS_RES_IRQ,
1969 			     sc->ciss_irq_rid[0], sc->ciss_irq_resource);
1970     if (sc->ciss_msi)
1971 	pci_release_msi(sc->ciss_dev);
1972 
1973     while ((cr = ciss_dequeue_free(sc)) != NULL)
1974 	bus_dmamap_destroy(sc->ciss_buffer_dmat, cr->cr_datamap);
1975     if (sc->ciss_buffer_dmat)
1976 	bus_dma_tag_destroy(sc->ciss_buffer_dmat);
1977 
1978     /* destroy command memory and DMA tag */
1979     if (sc->ciss_command != NULL) {
1980 	bus_dmamap_unload(sc->ciss_command_dmat, sc->ciss_command_map);
1981 	bus_dmamem_free(sc->ciss_command_dmat, sc->ciss_command, sc->ciss_command_map);
1982     }
1983     if (sc->ciss_command_dmat)
1984 	bus_dma_tag_destroy(sc->ciss_command_dmat);
1985 
1986     if (sc->ciss_reply) {
1987 	bus_dmamap_unload(sc->ciss_reply_dmat, sc->ciss_reply_map);
1988 	bus_dmamem_free(sc->ciss_reply_dmat, sc->ciss_reply, sc->ciss_reply_map);
1989     }
1990     if (sc->ciss_reply_dmat)
1991 	bus_dma_tag_destroy(sc->ciss_reply_dmat);
1992 
1993     /* destroy DMA tags */
1994     if (sc->ciss_parent_dmat)
1995 	bus_dma_tag_destroy(sc->ciss_parent_dmat);
1996     if (sc->ciss_logical) {
1997 	for (i = 0; i <= sc->ciss_max_logical_bus; i++) {
1998 	    for (j = 0; j < sc->ciss_cfg->max_logical_supported; j++) {
1999 		if (sc->ciss_logical[i][j].cl_ldrive)
2000 		    free(sc->ciss_logical[i][j].cl_ldrive, CISS_MALLOC_CLASS);
2001 		if (sc->ciss_logical[i][j].cl_lstatus)
2002 		    free(sc->ciss_logical[i][j].cl_lstatus, CISS_MALLOC_CLASS);
2003 	    }
2004 	    free(sc->ciss_logical[i], CISS_MALLOC_CLASS);
2005 	}
2006 	free(sc->ciss_logical, CISS_MALLOC_CLASS);
2007     }
2008 
2009     if (sc->ciss_physical) {
2010 	for (i = 0; i < sc->ciss_max_physical_bus; i++)
2011 	    free(sc->ciss_physical[i], CISS_MALLOC_CLASS);
2012 	free(sc->ciss_physical, CISS_MALLOC_CLASS);
2013     }
2014 
2015     if (sc->ciss_controllers)
2016 	free(sc->ciss_controllers, CISS_MALLOC_CLASS);
2017 
2018 }
2019 
2020 /************************************************************************
2021  * Give a command to the adapter.
2022  *
2023  * Note that this uses the simple transport layer directly.  If we
2024  * want to add support for other layers, we'll need a switch of some
2025  * sort.
2026  *
2027  * Note that the simple transport layer has no way of refusing a
2028  * command; we only have as many request structures as the adapter
2029  * supports commands, so we don't have to check (this presumes that
2030  * the adapter can handle commands as fast as we throw them at it).
2031  */
2032 static int
2033 ciss_start(struct ciss_request *cr)
2034 {
2035     struct ciss_command	*cc;	/* XXX debugging only */
2036     int			error;
2037 
2038     cc = cr->cr_cc;
2039     debug(2, "post command %d tag %d ", cr->cr_tag, cc->header.host_tag);
2040 
2041     /*
2042      * Map the request's data.
2043      */
2044     if ((error = ciss_map_request(cr)))
2045 	return(error);
2046 
2047 #if 0
2048     ciss_print_request(cr);
2049 #endif
2050 
2051     return(0);
2052 }
2053 
2054 /************************************************************************
2055  * Fetch completed request(s) from the adapter, queue them for
2056  * completion handling.
2057  *
2058  * Note that this uses the simple transport layer directly.  If we
2059  * want to add support for other layers, we'll need a switch of some
2060  * sort.
2061  *
2062  * Note that the simple transport mechanism does not require any
2063  * reentrancy protection; the OPQ read is atomic.  If there is a
2064  * chance of a race with something else that might move the request
2065  * off the busy list, then we will have to lock against that
2066  * (eg. timeouts, etc.)
2067  */
2068 static void
2069 ciss_done(struct ciss_softc *sc, cr_qhead_t *qh)
2070 {
2071     struct ciss_request	*cr;
2072     struct ciss_command	*cc;
2073     u_int32_t		tag, index;
2074 
2075     debug_called(3);
2076 
2077     /*
2078      * Loop quickly taking requests from the adapter and moving them
2079      * to the completed queue.
2080      */
2081     for (;;) {
2082 
2083 	tag = CISS_TL_SIMPLE_FETCH_CMD(sc);
2084 	if (tag == CISS_TL_SIMPLE_OPQ_EMPTY)
2085 	    break;
2086 	index = tag >> 2;
2087 	debug(2, "completed command %d%s", index,
2088 	      (tag & CISS_HDR_HOST_TAG_ERROR) ? " with error" : "");
2089 	if (index >= sc->ciss_max_requests) {
2090 	    ciss_printf(sc, "completed invalid request %d (0x%x)\n", index, tag);
2091 	    continue;
2092 	}
2093 	cr = &(sc->ciss_request[index]);
2094 	cc = cr->cr_cc;
2095 	cc->header.host_tag = tag;	/* not updated by adapter */
2096 	ciss_enqueue_complete(cr, qh);
2097     }
2098 
2099 }
2100 
2101 static void
2102 ciss_perf_done(struct ciss_softc *sc, cr_qhead_t *qh)
2103 {
2104     struct ciss_request	*cr;
2105     struct ciss_command	*cc;
2106     u_int32_t		tag, index;
2107 
2108     debug_called(3);
2109 
2110     /*
2111      * Loop quickly taking requests from the adapter and moving them
2112      * to the completed queue.
2113      */
2114     for (;;) {
2115 	tag = sc->ciss_reply[sc->ciss_rqidx];
2116 	if ((tag & CISS_CYCLE_MASK) != sc->ciss_cycle)
2117 	    break;
2118 	index = tag >> 2;
2119 	debug(2, "completed command %d%s\n", index,
2120 	      (tag & CISS_HDR_HOST_TAG_ERROR) ? " with error" : "");
2121 	if (index < sc->ciss_max_requests) {
2122 	    cr = &(sc->ciss_request[index]);
2123 	    cc = cr->cr_cc;
2124 	    cc->header.host_tag = tag;	/* not updated by adapter */
2125 	    ciss_enqueue_complete(cr, qh);
2126 	} else {
2127 	    ciss_printf(sc, "completed invalid request %d (0x%x)\n", index, tag);
2128 	}
2129 	if (++sc->ciss_rqidx == sc->ciss_max_requests) {
2130 	    sc->ciss_rqidx = 0;
2131 	    sc->ciss_cycle ^= 1;
2132 	}
2133     }
2134 
2135 }
2136 
2137 /************************************************************************
2138  * Take an interrupt from the adapter.
2139  */
2140 static void
2141 ciss_intr(void *arg)
2142 {
2143     cr_qhead_t qh;
2144     struct ciss_softc	*sc = (struct ciss_softc *)arg;
2145 
2146     /*
2147      * The only interrupt we recognise indicates that there are
2148      * entries in the outbound post queue.
2149      */
2150     STAILQ_INIT(&qh);
2151     ciss_done(sc, &qh);
2152     mtx_lock(&sc->ciss_mtx);
2153     ciss_complete(sc, &qh);
2154     mtx_unlock(&sc->ciss_mtx);
2155 }
2156 
2157 static void
2158 ciss_perf_intr(void *arg)
2159 {
2160     struct ciss_softc	*sc = (struct ciss_softc *)arg;
2161 
2162     /* Clear the interrupt and flush the bridges.  Docs say that the flush
2163      * needs to be done twice, which doesn't seem right.
2164      */
2165     CISS_TL_PERF_CLEAR_INT(sc);
2166     CISS_TL_PERF_FLUSH_INT(sc);
2167 
2168     ciss_perf_msi_intr(sc);
2169 }
2170 
2171 static void
2172 ciss_perf_msi_intr(void *arg)
2173 {
2174     cr_qhead_t qh;
2175     struct ciss_softc	*sc = (struct ciss_softc *)arg;
2176 
2177     STAILQ_INIT(&qh);
2178     ciss_perf_done(sc, &qh);
2179     mtx_lock(&sc->ciss_mtx);
2180     ciss_complete(sc, &qh);
2181     mtx_unlock(&sc->ciss_mtx);
2182 }
2183 
2184 
2185 /************************************************************************
2186  * Process completed requests.
2187  *
2188  * Requests can be completed in three fashions:
2189  *
2190  * - by invoking a callback function (cr_complete is non-null)
2191  * - by waking up a sleeper (cr_flags has CISS_REQ_SLEEP set)
2192  * - by clearing the CISS_REQ_POLL flag in interrupt/timeout context
2193  */
2194 static void
2195 ciss_complete(struct ciss_softc *sc, cr_qhead_t *qh)
2196 {
2197     struct ciss_request	*cr;
2198 
2199     debug_called(2);
2200 
2201     /*
2202      * Loop taking requests off the completed queue and performing
2203      * completion processing on them.
2204      */
2205     for (;;) {
2206 	if ((cr = ciss_dequeue_complete(sc, qh)) == NULL)
2207 	    break;
2208 	ciss_unmap_request(cr);
2209 
2210 	if ((cr->cr_flags & CISS_REQ_BUSY) == 0)
2211 	    ciss_printf(sc, "WARNING: completing non-busy request\n");
2212 	cr->cr_flags &= ~CISS_REQ_BUSY;
2213 
2214 	/*
2215 	 * If the request has a callback, invoke it.
2216 	 */
2217 	if (cr->cr_complete != NULL) {
2218 	    cr->cr_complete(cr);
2219 	    continue;
2220 	}
2221 
2222 	/*
2223 	 * If someone is sleeping on this request, wake them up.
2224 	 */
2225 	if (cr->cr_flags & CISS_REQ_SLEEP) {
2226 	    cr->cr_flags &= ~CISS_REQ_SLEEP;
2227 	    wakeup(cr);
2228 	    continue;
2229 	}
2230 
2231 	/*
2232 	 * If someone is polling this request for completion, signal.
2233 	 */
2234 	if (cr->cr_flags & CISS_REQ_POLL) {
2235 	    cr->cr_flags &= ~CISS_REQ_POLL;
2236 	    continue;
2237 	}
2238 
2239 	/*
2240 	 * Give up and throw the request back on the free queue.  This
2241 	 * should never happen; resources will probably be lost.
2242 	 */
2243 	ciss_printf(sc, "WARNING: completed command with no submitter\n");
2244 	ciss_enqueue_free(cr);
2245     }
2246 }
2247 
2248 /************************************************************************
2249  * Report on the completion status of a request, and pass back SCSI
2250  * and command status values.
2251  */
2252 static int
2253 _ciss_report_request(struct ciss_request *cr, int *command_status, int *scsi_status, const char *func)
2254 {
2255     struct ciss_command		*cc;
2256     struct ciss_error_info	*ce;
2257 
2258     debug_called(2);
2259 
2260     cc = cr->cr_cc;
2261     ce = (struct ciss_error_info *)&(cc->sg[0]);
2262 
2263     /*
2264      * We don't consider data under/overrun an error for the Report
2265      * Logical/Physical LUNs commands.
2266      */
2267     if ((cc->header.host_tag & CISS_HDR_HOST_TAG_ERROR) &&
2268 	((ce->command_status == CISS_CMD_STATUS_DATA_OVERRUN) ||
2269 	 (ce->command_status == CISS_CMD_STATUS_DATA_UNDERRUN)) &&
2270 	((cc->cdb.cdb[0] == CISS_OPCODE_REPORT_LOGICAL_LUNS) ||
2271 	 (cc->cdb.cdb[0] == CISS_OPCODE_REPORT_PHYSICAL_LUNS) ||
2272 	 (cc->cdb.cdb[0] == INQUIRY))) {
2273 	cc->header.host_tag &= ~CISS_HDR_HOST_TAG_ERROR;
2274 	debug(2, "ignoring irrelevant under/overrun error");
2275     }
2276 
2277     /*
2278      * Check the command's error bit, if clear, there's no status and
2279      * everything is OK.
2280      */
2281     if (!(cc->header.host_tag & CISS_HDR_HOST_TAG_ERROR)) {
2282 	if (scsi_status != NULL)
2283 	    *scsi_status = SCSI_STATUS_OK;
2284 	if (command_status != NULL)
2285 	    *command_status = CISS_CMD_STATUS_SUCCESS;
2286 	return(0);
2287     } else {
2288 	if (command_status != NULL)
2289 	    *command_status = ce->command_status;
2290 	if (scsi_status != NULL) {
2291 	    if (ce->command_status == CISS_CMD_STATUS_TARGET_STATUS) {
2292 		*scsi_status = ce->scsi_status;
2293 	    } else {
2294 		*scsi_status = -1;
2295 	    }
2296 	}
2297 	if (bootverbose)
2298 	    ciss_printf(cr->cr_sc, "command status 0x%x (%s) scsi status 0x%x\n",
2299 			ce->command_status, ciss_name_command_status(ce->command_status),
2300 			ce->scsi_status);
2301 	if (ce->command_status == CISS_CMD_STATUS_INVALID_COMMAND) {
2302 	    ciss_printf(cr->cr_sc, "invalid command, offense size %d at %d, value 0x%x, function %s\n",
2303 			ce->additional_error_info.invalid_command.offense_size,
2304 			ce->additional_error_info.invalid_command.offense_offset,
2305 			ce->additional_error_info.invalid_command.offense_value,
2306 			func);
2307 	}
2308     }
2309 #if 0
2310     ciss_print_request(cr);
2311 #endif
2312     return(1);
2313 }
2314 
2315 /************************************************************************
2316  * Issue a request and don't return until it's completed.
2317  *
2318  * Depending on adapter status, we may poll or sleep waiting for
2319  * completion.
2320  */
2321 static int
2322 ciss_synch_request(struct ciss_request *cr, int timeout)
2323 {
2324     if (cr->cr_sc->ciss_flags & CISS_FLAG_RUNNING) {
2325 	return(ciss_wait_request(cr, timeout));
2326     } else {
2327 	return(ciss_poll_request(cr, timeout));
2328     }
2329 }
2330 
2331 /************************************************************************
2332  * Issue a request and poll for completion.
2333  *
2334  * Timeout in milliseconds.
2335  */
2336 static int
2337 ciss_poll_request(struct ciss_request *cr, int timeout)
2338 {
2339     cr_qhead_t qh;
2340     struct ciss_softc *sc;
2341     int		error;
2342 
2343     debug_called(2);
2344 
2345     STAILQ_INIT(&qh);
2346     sc = cr->cr_sc;
2347     cr->cr_flags |= CISS_REQ_POLL;
2348     if ((error = ciss_start(cr)) != 0)
2349 	return(error);
2350 
2351     do {
2352 	if (sc->ciss_perf)
2353 	    ciss_perf_done(sc, &qh);
2354 	else
2355 	    ciss_done(sc, &qh);
2356 	ciss_complete(sc, &qh);
2357 	if (!(cr->cr_flags & CISS_REQ_POLL))
2358 	    return(0);
2359 	DELAY(1000);
2360     } while (timeout-- >= 0);
2361     return(EWOULDBLOCK);
2362 }
2363 
2364 /************************************************************************
2365  * Issue a request and sleep waiting for completion.
2366  *
2367  * Timeout in milliseconds.  Note that a spurious wakeup will reset
2368  * the timeout.
2369  */
2370 static int
2371 ciss_wait_request(struct ciss_request *cr, int timeout)
2372 {
2373     int		error;
2374 
2375     debug_called(2);
2376 
2377     cr->cr_flags |= CISS_REQ_SLEEP;
2378     if ((error = ciss_start(cr)) != 0)
2379 	return(error);
2380 
2381     while ((cr->cr_flags & CISS_REQ_SLEEP) && (error != EWOULDBLOCK)) {
2382 	error = msleep(cr, &cr->cr_sc->ciss_mtx, PRIBIO, "cissREQ", (timeout * hz) / 1000);
2383     }
2384     return(error);
2385 }
2386 
2387 #if 0
2388 /************************************************************************
2389  * Abort a request.  Note that a potential exists here to race the
2390  * request being completed; the caller must deal with this.
2391  */
2392 static int
2393 ciss_abort_request(struct ciss_request *ar)
2394 {
2395     struct ciss_request		*cr;
2396     struct ciss_command		*cc;
2397     struct ciss_message_cdb	*cmc;
2398     int				error;
2399 
2400     debug_called(1);
2401 
2402     /* get a request */
2403     if ((error = ciss_get_request(ar->cr_sc, &cr)) != 0)
2404 	return(error);
2405 
2406     /* build the abort command */
2407     cc = cr->cr_cc;
2408     cc->header.address.mode.mode = CISS_HDR_ADDRESS_MODE_PERIPHERAL;	/* addressing? */
2409     cc->header.address.physical.target = 0;
2410     cc->header.address.physical.bus = 0;
2411     cc->cdb.cdb_length = sizeof(*cmc);
2412     cc->cdb.type = CISS_CDB_TYPE_MESSAGE;
2413     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
2414     cc->cdb.direction = CISS_CDB_DIRECTION_NONE;
2415     cc->cdb.timeout = 30;
2416 
2417     cmc = (struct ciss_message_cdb *)&(cc->cdb.cdb[0]);
2418     cmc->opcode = CISS_OPCODE_MESSAGE_ABORT;
2419     cmc->type = CISS_MESSAGE_ABORT_TASK;
2420     cmc->abort_tag = ar->cr_tag;	/* endianness?? */
2421 
2422     /*
2423      * Send the request and wait for a response.  If we believe we
2424      * aborted the request OK, clear the flag that indicates it's
2425      * running.
2426      */
2427     error = ciss_synch_request(cr, 35 * 1000);
2428     if (!error)
2429 	error = ciss_report_request(cr, NULL, NULL);
2430     ciss_release_request(cr);
2431 
2432     return(error);
2433 }
2434 #endif
2435 
2436 
2437 /************************************************************************
2438  * Fetch and initialise a request
2439  */
2440 static int
2441 ciss_get_request(struct ciss_softc *sc, struct ciss_request **crp)
2442 {
2443     struct ciss_request *cr;
2444 
2445     debug_called(2);
2446 
2447     /*
2448      * Get a request and clean it up.
2449      */
2450     if ((cr = ciss_dequeue_free(sc)) == NULL)
2451 	return(ENOMEM);
2452 
2453     cr->cr_data = NULL;
2454     cr->cr_flags = 0;
2455     cr->cr_complete = NULL;
2456     cr->cr_private = NULL;
2457     cr->cr_sg_tag = CISS_SG_MAX;	/* Backstop to prevent accidents */
2458 
2459     ciss_preen_command(cr);
2460     *crp = cr;
2461     return(0);
2462 }
2463 
2464 static void
2465 ciss_preen_command(struct ciss_request *cr)
2466 {
2467     struct ciss_command	*cc;
2468     u_int32_t		cmdphys;
2469 
2470     /*
2471      * Clean up the command structure.
2472      *
2473      * Note that we set up the error_info structure here, since the
2474      * length can be overwritten by any command.
2475      */
2476     cc = cr->cr_cc;
2477     cc->header.sg_in_list = 0;		/* kinda inefficient this way */
2478     cc->header.sg_total = 0;
2479     cc->header.host_tag = cr->cr_tag << 2;
2480     cc->header.host_tag_zeroes = 0;
2481     cmdphys = cr->cr_ccphys;
2482     cc->error_info.error_info_address = cmdphys + sizeof(struct ciss_command);
2483     cc->error_info.error_info_length = CISS_COMMAND_ALLOC_SIZE - sizeof(struct ciss_command);
2484 }
2485 
2486 /************************************************************************
2487  * Release a request to the free list.
2488  */
2489 static void
2490 ciss_release_request(struct ciss_request *cr)
2491 {
2492     struct ciss_softc	*sc;
2493 
2494     debug_called(2);
2495 
2496     sc = cr->cr_sc;
2497 
2498     /* release the request to the free queue */
2499     ciss_requeue_free(cr);
2500 }
2501 
2502 /************************************************************************
2503  * Allocate a request that will be used to send a BMIC command.  Do some
2504  * of the common setup here to avoid duplicating it everywhere else.
2505  */
2506 static int
2507 ciss_get_bmic_request(struct ciss_softc *sc, struct ciss_request **crp,
2508 		      int opcode, void **bufp, size_t bufsize)
2509 {
2510     struct ciss_request		*cr;
2511     struct ciss_command		*cc;
2512     struct ciss_bmic_cdb	*cbc;
2513     void			*buf;
2514     int				error;
2515     int				dataout;
2516 
2517     debug_called(2);
2518 
2519     cr = NULL;
2520     buf = NULL;
2521 
2522     /*
2523      * Get a request.
2524      */
2525     if ((error = ciss_get_request(sc, &cr)) != 0)
2526 	goto out;
2527 
2528     /*
2529      * Allocate data storage if requested, determine the data direction.
2530      */
2531     dataout = 0;
2532     if ((bufsize > 0) && (bufp != NULL)) {
2533 	if (*bufp == NULL) {
2534 	    if ((buf = malloc(bufsize, CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO)) == NULL) {
2535 		error = ENOMEM;
2536 		goto out;
2537 	    }
2538 	} else {
2539 	    buf = *bufp;
2540 	    dataout = 1;	/* we are given a buffer, so we are writing */
2541 	}
2542     }
2543 
2544     /*
2545      * Build a CISS BMIC command to get the logical drive ID.
2546      */
2547     cr->cr_data = buf;
2548     cr->cr_length = bufsize;
2549     if (!dataout)
2550 	cr->cr_flags = CISS_REQ_DATAIN;
2551 
2552     cc = cr->cr_cc;
2553     cc->header.address.physical.mode = CISS_HDR_ADDRESS_MODE_PERIPHERAL;
2554     cc->header.address.physical.bus = 0;
2555     cc->header.address.physical.target = 0;
2556     cc->cdb.cdb_length = sizeof(*cbc);
2557     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
2558     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
2559     cc->cdb.direction = dataout ? CISS_CDB_DIRECTION_WRITE : CISS_CDB_DIRECTION_READ;
2560     cc->cdb.timeout = 0;
2561 
2562     cbc = (struct ciss_bmic_cdb *)&(cc->cdb.cdb[0]);
2563     bzero(cbc, sizeof(*cbc));
2564     cbc->opcode = dataout ? CISS_ARRAY_CONTROLLER_WRITE : CISS_ARRAY_CONTROLLER_READ;
2565     cbc->bmic_opcode = opcode;
2566     cbc->size = htons((u_int16_t)bufsize);
2567 
2568 out:
2569     if (error) {
2570 	if (cr != NULL)
2571 	    ciss_release_request(cr);
2572     } else {
2573 	*crp = cr;
2574 	if ((bufp != NULL) && (*bufp == NULL) && (buf != NULL))
2575 	    *bufp = buf;
2576     }
2577     return(error);
2578 }
2579 
2580 /************************************************************************
2581  * Handle a command passed in from userspace.
2582  */
2583 static int
2584 ciss_user_command(struct ciss_softc *sc, IOCTL_Command_struct *ioc)
2585 {
2586     struct ciss_request		*cr;
2587     struct ciss_command		*cc;
2588     struct ciss_error_info	*ce;
2589     int				error = 0;
2590 
2591     debug_called(1);
2592 
2593     cr = NULL;
2594 
2595     /*
2596      * Get a request.
2597      */
2598     while (ciss_get_request(sc, &cr) != 0)
2599 	msleep(sc, &sc->ciss_mtx, PPAUSE, "cissREQ", hz);
2600     cc = cr->cr_cc;
2601 
2602     /*
2603      * Allocate an in-kernel databuffer if required, copy in user data.
2604      */
2605     mtx_unlock(&sc->ciss_mtx);
2606     cr->cr_length = ioc->buf_size;
2607     if (ioc->buf_size > 0) {
2608 	if ((cr->cr_data = malloc(ioc->buf_size, CISS_MALLOC_CLASS, M_NOWAIT)) == NULL) {
2609 	    error = ENOMEM;
2610 	    goto out_unlocked;
2611 	}
2612 	if ((error = copyin(ioc->buf, cr->cr_data, ioc->buf_size))) {
2613 	    debug(0, "copyin: bad data buffer %p/%d", ioc->buf, ioc->buf_size);
2614 	    goto out_unlocked;
2615 	}
2616     }
2617 
2618     /*
2619      * Build the request based on the user command.
2620      */
2621     bcopy(&ioc->LUN_info, &cc->header.address, sizeof(cc->header.address));
2622     bcopy(&ioc->Request, &cc->cdb, sizeof(cc->cdb));
2623 
2624     /* XXX anything else to populate here? */
2625     mtx_lock(&sc->ciss_mtx);
2626 
2627     /*
2628      * Run the command.
2629      */
2630     if ((error = ciss_synch_request(cr, 60 * 1000))) {
2631 	debug(0, "request failed - %d", error);
2632 	goto out;
2633     }
2634 
2635     /*
2636      * Check to see if the command succeeded.
2637      */
2638     ce = (struct ciss_error_info *)&(cc->sg[0]);
2639     if ((cc->header.host_tag & CISS_HDR_HOST_TAG_ERROR) == 0)
2640 	bzero(ce, sizeof(*ce));
2641 
2642     /*
2643      * Copy the results back to the user.
2644      */
2645     bcopy(ce, &ioc->error_info, sizeof(*ce));
2646     mtx_unlock(&sc->ciss_mtx);
2647     if ((ioc->buf_size > 0) &&
2648 	(error = copyout(cr->cr_data, ioc->buf, ioc->buf_size))) {
2649 	debug(0, "copyout: bad data buffer %p/%d", ioc->buf, ioc->buf_size);
2650 	goto out_unlocked;
2651     }
2652 
2653     /* done OK */
2654     error = 0;
2655 
2656 out_unlocked:
2657     mtx_lock(&sc->ciss_mtx);
2658 
2659 out:
2660     if ((cr != NULL) && (cr->cr_data != NULL))
2661 	free(cr->cr_data, CISS_MALLOC_CLASS);
2662     if (cr != NULL)
2663 	ciss_release_request(cr);
2664     return(error);
2665 }
2666 
2667 /************************************************************************
2668  * Map a request into bus-visible space, initialise the scatter/gather
2669  * list.
2670  */
2671 static int
2672 ciss_map_request(struct ciss_request *cr)
2673 {
2674     struct ciss_softc	*sc;
2675     int			error = 0;
2676 
2677     debug_called(2);
2678 
2679     sc = cr->cr_sc;
2680 
2681     /* check that mapping is necessary */
2682     if (cr->cr_flags & CISS_REQ_MAPPED)
2683 	return(0);
2684 
2685     cr->cr_flags |= CISS_REQ_MAPPED;
2686 
2687     bus_dmamap_sync(sc->ciss_command_dmat, sc->ciss_command_map,
2688 		    BUS_DMASYNC_PREWRITE);
2689 
2690     if (cr->cr_data != NULL) {
2691 	error = bus_dmamap_load(sc->ciss_buffer_dmat, cr->cr_datamap,
2692 				cr->cr_data, cr->cr_length,
2693 				ciss_request_map_helper, cr, 0);
2694 	if (error != 0)
2695 	    return (error);
2696     } else {
2697 	/*
2698 	 * Post the command to the adapter.
2699 	 */
2700 	cr->cr_sg_tag = CISS_SG_NONE;
2701 	cr->cr_flags |= CISS_REQ_BUSY;
2702 	if (sc->ciss_perf)
2703 	    CISS_TL_PERF_POST_CMD(sc, cr);
2704 	else
2705 	    CISS_TL_SIMPLE_POST_CMD(sc, cr->cr_ccphys);
2706     }
2707 
2708     return(0);
2709 }
2710 
2711 static void
2712 ciss_request_map_helper(void *arg, bus_dma_segment_t *segs, int nseg, int error)
2713 {
2714     struct ciss_command	*cc;
2715     struct ciss_request *cr;
2716     struct ciss_softc	*sc;
2717     int			i;
2718 
2719     debug_called(2);
2720 
2721     cr = (struct ciss_request *)arg;
2722     sc = cr->cr_sc;
2723     cc = cr->cr_cc;
2724 
2725     for (i = 0; i < nseg; i++) {
2726 	cc->sg[i].address = segs[i].ds_addr;
2727 	cc->sg[i].length = segs[i].ds_len;
2728 	cc->sg[i].extension = 0;
2729     }
2730     /* we leave the s/g table entirely within the command */
2731     cc->header.sg_in_list = nseg;
2732     cc->header.sg_total = nseg;
2733 
2734     if (cr->cr_flags & CISS_REQ_DATAIN)
2735 	bus_dmamap_sync(sc->ciss_buffer_dmat, cr->cr_datamap, BUS_DMASYNC_PREREAD);
2736     if (cr->cr_flags & CISS_REQ_DATAOUT)
2737 	bus_dmamap_sync(sc->ciss_buffer_dmat, cr->cr_datamap, BUS_DMASYNC_PREWRITE);
2738 
2739     if (nseg == 0)
2740 	cr->cr_sg_tag = CISS_SG_NONE;
2741     else if (nseg == 1)
2742 	cr->cr_sg_tag = CISS_SG_1;
2743     else if (nseg == 2)
2744 	cr->cr_sg_tag = CISS_SG_2;
2745     else if (nseg <= 4)
2746 	cr->cr_sg_tag = CISS_SG_4;
2747     else if (nseg <= 8)
2748 	cr->cr_sg_tag = CISS_SG_8;
2749     else if (nseg <= 16)
2750 	cr->cr_sg_tag = CISS_SG_16;
2751     else if (nseg <= 32)
2752 	cr->cr_sg_tag = CISS_SG_32;
2753     else
2754 	cr->cr_sg_tag = CISS_SG_MAX;
2755 
2756     /*
2757      * Post the command to the adapter.
2758      */
2759     cr->cr_flags |= CISS_REQ_BUSY;
2760     if (sc->ciss_perf)
2761 	CISS_TL_PERF_POST_CMD(sc, cr);
2762     else
2763 	CISS_TL_SIMPLE_POST_CMD(sc, cr->cr_ccphys);
2764 }
2765 
2766 /************************************************************************
2767  * Unmap a request from bus-visible space.
2768  */
2769 static void
2770 ciss_unmap_request(struct ciss_request *cr)
2771 {
2772     struct ciss_softc	*sc;
2773 
2774     debug_called(2);
2775 
2776     sc = cr->cr_sc;
2777 
2778     /* check that unmapping is necessary */
2779     if ((cr->cr_flags & CISS_REQ_MAPPED) == 0)
2780 	return;
2781 
2782     bus_dmamap_sync(sc->ciss_command_dmat, sc->ciss_command_map,
2783 		    BUS_DMASYNC_POSTWRITE);
2784 
2785     if (cr->cr_data == NULL)
2786 	goto out;
2787 
2788     if (cr->cr_flags & CISS_REQ_DATAIN)
2789 	bus_dmamap_sync(sc->ciss_buffer_dmat, cr->cr_datamap, BUS_DMASYNC_POSTREAD);
2790     if (cr->cr_flags & CISS_REQ_DATAOUT)
2791 	bus_dmamap_sync(sc->ciss_buffer_dmat, cr->cr_datamap, BUS_DMASYNC_POSTWRITE);
2792 
2793     bus_dmamap_unload(sc->ciss_buffer_dmat, cr->cr_datamap);
2794 out:
2795     cr->cr_flags &= ~CISS_REQ_MAPPED;
2796 }
2797 
2798 /************************************************************************
2799  * Attach the driver to CAM.
2800  *
2801  * We put all the logical drives on a single SCSI bus.
2802  */
2803 static int
2804 ciss_cam_init(struct ciss_softc *sc)
2805 {
2806     int			i, maxbus;
2807 
2808     debug_called(1);
2809 
2810     /*
2811      * Allocate a devq.  We can reuse this for the masked physical
2812      * devices if we decide to export these as well.
2813      */
2814     if ((sc->ciss_cam_devq = cam_simq_alloc(sc->ciss_max_requests - 2)) == NULL) {
2815 	ciss_printf(sc, "can't allocate CAM SIM queue\n");
2816 	return(ENOMEM);
2817     }
2818 
2819     /*
2820      * Create a SIM.
2821      *
2822      * This naturally wastes a bit of memory.  The alternative is to allocate
2823      * and register each bus as it is found, and then track them on a linked
2824      * list.  Unfortunately, the driver has a few places where it needs to
2825      * look up the SIM based solely on bus number, and it's unclear whether
2826      * a list traversal would work for these situations.
2827      */
2828     maxbus = max(sc->ciss_max_logical_bus, sc->ciss_max_physical_bus +
2829 		 CISS_PHYSICAL_BASE);
2830     sc->ciss_cam_sim = malloc(maxbus * sizeof(struct cam_sim*),
2831 			      CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
2832     if (sc->ciss_cam_sim == NULL) {
2833 	ciss_printf(sc, "can't allocate memory for controller SIM\n");
2834 	return(ENOMEM);
2835     }
2836 
2837     for (i = 0; i < sc->ciss_max_logical_bus; i++) {
2838 	if ((sc->ciss_cam_sim[i] = cam_sim_alloc(ciss_cam_action, ciss_cam_poll,
2839 						 "ciss", sc,
2840 						 device_get_unit(sc->ciss_dev),
2841 						 &sc->ciss_mtx,
2842 						 2,
2843 						 sc->ciss_max_requests - 2,
2844 						 sc->ciss_cam_devq)) == NULL) {
2845 	    ciss_printf(sc, "can't allocate CAM SIM for controller %d\n", i);
2846 	    return(ENOMEM);
2847 	}
2848 
2849 	/*
2850 	 * Register bus with this SIM.
2851 	 */
2852 	mtx_lock(&sc->ciss_mtx);
2853 	if (i == 0 || sc->ciss_controllers[i].physical.bus != 0) {
2854 	    if (xpt_bus_register(sc->ciss_cam_sim[i], sc->ciss_dev, i) != 0) {
2855 		ciss_printf(sc, "can't register SCSI bus %d\n", i);
2856 		mtx_unlock(&sc->ciss_mtx);
2857 		return (ENXIO);
2858 	    }
2859 	}
2860 	mtx_unlock(&sc->ciss_mtx);
2861     }
2862 
2863     for (i = CISS_PHYSICAL_BASE; i < sc->ciss_max_physical_bus +
2864 	 CISS_PHYSICAL_BASE; i++) {
2865 	if ((sc->ciss_cam_sim[i] = cam_sim_alloc(ciss_cam_action, ciss_cam_poll,
2866 						 "ciss", sc,
2867 						 device_get_unit(sc->ciss_dev),
2868 						 &sc->ciss_mtx, 1,
2869 						 sc->ciss_max_requests - 2,
2870 						 sc->ciss_cam_devq)) == NULL) {
2871 	    ciss_printf(sc, "can't allocate CAM SIM for controller %d\n", i);
2872 	    return (ENOMEM);
2873 	}
2874 
2875 	mtx_lock(&sc->ciss_mtx);
2876 	if (xpt_bus_register(sc->ciss_cam_sim[i], sc->ciss_dev, i) != 0) {
2877 	    ciss_printf(sc, "can't register SCSI bus %d\n", i);
2878 	    mtx_unlock(&sc->ciss_mtx);
2879 	    return (ENXIO);
2880 	}
2881 	mtx_unlock(&sc->ciss_mtx);
2882     }
2883 
2884     return(0);
2885 }
2886 
2887 /************************************************************************
2888  * Initiate a rescan of the 'logical devices' SIM
2889  */
2890 static void
2891 ciss_cam_rescan_target(struct ciss_softc *sc, int bus, int target)
2892 {
2893     union ccb		*ccb;
2894 
2895     debug_called(1);
2896 
2897     if ((ccb = xpt_alloc_ccb_nowait()) == NULL) {
2898 	ciss_printf(sc, "rescan failed (can't allocate CCB)\n");
2899 	return;
2900     }
2901 
2902     if (xpt_create_path(&ccb->ccb_h.path, xpt_periph,
2903 	    cam_sim_path(sc->ciss_cam_sim[bus]),
2904 	    target, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
2905 	ciss_printf(sc, "rescan failed (can't create path)\n");
2906 	xpt_free_ccb(ccb);
2907 	return;
2908     }
2909     xpt_rescan(ccb);
2910     /* scan is now in progress */
2911 }
2912 
2913 /************************************************************************
2914  * Handle requests coming from CAM
2915  */
2916 static void
2917 ciss_cam_action(struct cam_sim *sim, union ccb *ccb)
2918 {
2919     struct ciss_softc	*sc;
2920     struct ccb_scsiio	*csio;
2921     int			bus, target;
2922     int			physical;
2923 
2924     sc = cam_sim_softc(sim);
2925     bus = cam_sim_bus(sim);
2926     csio = (struct ccb_scsiio *)&ccb->csio;
2927     target = csio->ccb_h.target_id;
2928     physical = CISS_IS_PHYSICAL(bus);
2929 
2930     switch (ccb->ccb_h.func_code) {
2931 
2932 	/* perform SCSI I/O */
2933     case XPT_SCSI_IO:
2934 	if (!ciss_cam_action_io(sim, csio))
2935 	    return;
2936 	break;
2937 
2938 	/* perform geometry calculations */
2939     case XPT_CALC_GEOMETRY:
2940     {
2941 	struct ccb_calc_geometry	*ccg = &ccb->ccg;
2942 	struct ciss_ldrive		*ld;
2943 
2944 	debug(1, "XPT_CALC_GEOMETRY %d:%d:%d", cam_sim_bus(sim), ccb->ccb_h.target_id, ccb->ccb_h.target_lun);
2945 
2946 	ld = NULL;
2947 	if (!physical)
2948 	    ld = &sc->ciss_logical[bus][target];
2949 
2950 	/*
2951 	 * Use the cached geometry settings unless the fault tolerance
2952 	 * is invalid.
2953 	 */
2954 	if (physical || ld->cl_geometry.fault_tolerance == 0xFF) {
2955 	    u_int32_t			secs_per_cylinder;
2956 
2957 	    ccg->heads = 255;
2958 	    ccg->secs_per_track = 32;
2959 	    secs_per_cylinder = ccg->heads * ccg->secs_per_track;
2960 	    ccg->cylinders = ccg->volume_size / secs_per_cylinder;
2961 	} else {
2962 	    ccg->heads = ld->cl_geometry.heads;
2963 	    ccg->secs_per_track = ld->cl_geometry.sectors;
2964 	    ccg->cylinders = ntohs(ld->cl_geometry.cylinders);
2965 	}
2966 	ccb->ccb_h.status = CAM_REQ_CMP;
2967         break;
2968     }
2969 
2970 	/* handle path attribute inquiry */
2971     case XPT_PATH_INQ:
2972     {
2973 	struct ccb_pathinq	*cpi = &ccb->cpi;
2974 
2975 	debug(1, "XPT_PATH_INQ %d:%d:%d", cam_sim_bus(sim), ccb->ccb_h.target_id, ccb->ccb_h.target_lun);
2976 
2977 	cpi->version_num = 1;
2978 	cpi->hba_inquiry = PI_TAG_ABLE;	/* XXX is this correct? */
2979 	cpi->target_sprt = 0;
2980 	cpi->hba_misc = 0;
2981 	cpi->max_target = sc->ciss_cfg->max_logical_supported;
2982 	cpi->max_lun = 0;		/* 'logical drive' channel only */
2983 	cpi->initiator_id = sc->ciss_cfg->max_logical_supported;
2984 	strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2985         strncpy(cpi->hba_vid, "msmith@freebsd.org", HBA_IDLEN);
2986         strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2987         cpi->unit_number = cam_sim_unit(sim);
2988         cpi->bus_id = cam_sim_bus(sim);
2989 	cpi->base_transfer_speed = 132 * 1024;	/* XXX what to set this to? */
2990 	cpi->transport = XPORT_SPI;
2991 	cpi->transport_version = 2;
2992 	cpi->protocol = PROTO_SCSI;
2993 	cpi->protocol_version = SCSI_REV_2;
2994 	cpi->maxio = (CISS_MAX_SG_ELEMENTS - 1) * PAGE_SIZE;
2995 	ccb->ccb_h.status = CAM_REQ_CMP;
2996 	break;
2997     }
2998 
2999     case XPT_GET_TRAN_SETTINGS:
3000     {
3001 	struct ccb_trans_settings	*cts = &ccb->cts;
3002 	int				bus, target;
3003 	struct ccb_trans_settings_spi *spi = &cts->xport_specific.spi;
3004 	struct ccb_trans_settings_scsi *scsi = &cts->proto_specific.scsi;
3005 
3006 	bus = cam_sim_bus(sim);
3007 	target = cts->ccb_h.target_id;
3008 
3009 	debug(1, "XPT_GET_TRAN_SETTINGS %d:%d", bus, target);
3010 	/* disconnect always OK */
3011 	cts->protocol = PROTO_SCSI;
3012 	cts->protocol_version = SCSI_REV_2;
3013 	cts->transport = XPORT_SPI;
3014 	cts->transport_version = 2;
3015 
3016 	spi->valid = CTS_SPI_VALID_DISC;
3017 	spi->flags = CTS_SPI_FLAGS_DISC_ENB;
3018 
3019 	scsi->valid = CTS_SCSI_VALID_TQ;
3020 	scsi->flags = CTS_SCSI_FLAGS_TAG_ENB;
3021 
3022 	cts->ccb_h.status = CAM_REQ_CMP;
3023 	break;
3024     }
3025 
3026     default:		/* we can't do this */
3027 	debug(1, "unspported func_code = 0x%x", ccb->ccb_h.func_code);
3028 	ccb->ccb_h.status = CAM_REQ_INVALID;
3029 	break;
3030     }
3031 
3032     xpt_done(ccb);
3033 }
3034 
3035 /************************************************************************
3036  * Handle a CAM SCSI I/O request.
3037  */
3038 static int
3039 ciss_cam_action_io(struct cam_sim *sim, struct ccb_scsiio *csio)
3040 {
3041     struct ciss_softc	*sc;
3042     int			bus, target;
3043     struct ciss_request	*cr;
3044     struct ciss_command	*cc;
3045     int			error;
3046 
3047     sc = cam_sim_softc(sim);
3048     bus = cam_sim_bus(sim);
3049     target = csio->ccb_h.target_id;
3050 
3051     debug(2, "XPT_SCSI_IO %d:%d:%d", bus, target, csio->ccb_h.target_lun);
3052 
3053     /* check that the CDB pointer is not to a physical address */
3054     if ((csio->ccb_h.flags & CAM_CDB_POINTER) && (csio->ccb_h.flags & CAM_CDB_PHYS)) {
3055 	debug(3, "  CDB pointer is to physical address");
3056 	csio->ccb_h.status = CAM_REQ_CMP_ERR;
3057     }
3058 
3059     /* if there is data transfer, it must be to/from a virtual address */
3060     if ((csio->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
3061 	if (csio->ccb_h.flags & CAM_DATA_PHYS) {		/* we can't map it */
3062 	    debug(3, "  data pointer is to physical address");
3063 	    csio->ccb_h.status = CAM_REQ_CMP_ERR;
3064 	}
3065 	if (csio->ccb_h.flags & CAM_SCATTER_VALID) {	/* we want to do the s/g setup */
3066 	    debug(3, "  data has premature s/g setup");
3067 	    csio->ccb_h.status = CAM_REQ_CMP_ERR;
3068 	}
3069     }
3070 
3071     /* abandon aborted ccbs or those that have failed validation */
3072     if ((csio->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_INPROG) {
3073 	debug(3, "abandoning CCB due to abort/validation failure");
3074 	return(EINVAL);
3075     }
3076 
3077     /* handle emulation of some SCSI commands ourself */
3078     if (ciss_cam_emulate(sc, csio))
3079 	return(0);
3080 
3081     /*
3082      * Get a request to manage this command.  If we can't, return the
3083      * ccb, freeze the queue and flag so that we unfreeze it when a
3084      * request completes.
3085      */
3086     if ((error = ciss_get_request(sc, &cr)) != 0) {
3087 	xpt_freeze_simq(sim, 1);
3088 	sc->ciss_flags |= CISS_FLAG_BUSY;
3089 	csio->ccb_h.status |= CAM_REQUEUE_REQ;
3090 	return(error);
3091     }
3092 
3093     /*
3094      * Build the command.
3095      */
3096     cc = cr->cr_cc;
3097     cr->cr_data = csio->data_ptr;
3098     cr->cr_length = csio->dxfer_len;
3099     cr->cr_complete = ciss_cam_complete;
3100     cr->cr_private = csio;
3101 
3102     /*
3103      * Target the right logical volume.
3104      */
3105     if (CISS_IS_PHYSICAL(bus))
3106 	cc->header.address =
3107 	    sc->ciss_physical[CISS_CAM_TO_PBUS(bus)][target].cp_address;
3108     else
3109 	cc->header.address =
3110 	    sc->ciss_logical[bus][target].cl_address;
3111     cc->cdb.cdb_length = csio->cdb_len;
3112     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
3113     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;	/* XXX ordered tags? */
3114     if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_OUT) {
3115 	cr->cr_flags = CISS_REQ_DATAOUT;
3116 	cc->cdb.direction = CISS_CDB_DIRECTION_WRITE;
3117     } else if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
3118 	cr->cr_flags = CISS_REQ_DATAIN;
3119 	cc->cdb.direction = CISS_CDB_DIRECTION_READ;
3120     } else {
3121 	cr->cr_flags = 0;
3122 	cc->cdb.direction = CISS_CDB_DIRECTION_NONE;
3123     }
3124     cc->cdb.timeout = (csio->ccb_h.timeout / 1000) + 1;
3125     if (csio->ccb_h.flags & CAM_CDB_POINTER) {
3126 	bcopy(csio->cdb_io.cdb_ptr, &cc->cdb.cdb[0], csio->cdb_len);
3127     } else {
3128 	bcopy(csio->cdb_io.cdb_bytes, &cc->cdb.cdb[0], csio->cdb_len);
3129     }
3130 
3131     /*
3132      * Submit the request to the adapter.
3133      *
3134      * Note that this may fail if we're unable to map the request (and
3135      * if we ever learn a transport layer other than simple, may fail
3136      * if the adapter rejects the command).
3137      */
3138     if ((error = ciss_start(cr)) != 0) {
3139 	xpt_freeze_simq(sim, 1);
3140 	csio->ccb_h.status |= CAM_RELEASE_SIMQ;
3141 	if (error == EINPROGRESS) {
3142 	    error = 0;
3143 	} else {
3144 	    csio->ccb_h.status |= CAM_REQUEUE_REQ;
3145 	    ciss_release_request(cr);
3146 	}
3147 	return(error);
3148     }
3149 
3150     return(0);
3151 }
3152 
3153 /************************************************************************
3154  * Emulate SCSI commands the adapter doesn't handle as we might like.
3155  */
3156 static int
3157 ciss_cam_emulate(struct ciss_softc *sc, struct ccb_scsiio *csio)
3158 {
3159     int		bus, target;
3160     u_int8_t	opcode;
3161 
3162     target = csio->ccb_h.target_id;
3163     bus = cam_sim_bus(xpt_path_sim(csio->ccb_h.path));
3164     opcode = (csio->ccb_h.flags & CAM_CDB_POINTER) ?
3165 	*(u_int8_t *)csio->cdb_io.cdb_ptr : csio->cdb_io.cdb_bytes[0];
3166 
3167     if (CISS_IS_PHYSICAL(bus)) {
3168 	if (sc->ciss_physical[CISS_CAM_TO_PBUS(bus)][target].cp_online != 1) {
3169 	    csio->ccb_h.status |= CAM_SEL_TIMEOUT;
3170 	    xpt_done((union ccb *)csio);
3171 	    return(1);
3172 	} else
3173 	    return(0);
3174     }
3175 
3176     /*
3177      * Handle requests for volumes that don't exist or are not online.
3178      * A selection timeout is slightly better than an illegal request.
3179      * Other errors might be better.
3180      */
3181     if (sc->ciss_logical[bus][target].cl_status != CISS_LD_ONLINE) {
3182 	csio->ccb_h.status |= CAM_SEL_TIMEOUT;
3183 	xpt_done((union ccb *)csio);
3184 	return(1);
3185     }
3186 
3187     /* if we have to fake Synchronise Cache */
3188     if (sc->ciss_flags & CISS_FLAG_FAKE_SYNCH) {
3189 	/*
3190 	 * If this is a Synchronise Cache command, typically issued when
3191 	 * a device is closed, flush the adapter and complete now.
3192 	 */
3193 	if (((csio->ccb_h.flags & CAM_CDB_POINTER) ?
3194 	     *(u_int8_t *)csio->cdb_io.cdb_ptr : csio->cdb_io.cdb_bytes[0]) == SYNCHRONIZE_CACHE) {
3195 	    ciss_flush_adapter(sc);
3196 	    csio->ccb_h.status |= CAM_REQ_CMP;
3197 	    xpt_done((union ccb *)csio);
3198 	    return(1);
3199 	}
3200     }
3201 
3202     return(0);
3203 }
3204 
3205 /************************************************************************
3206  * Check for possibly-completed commands.
3207  */
3208 static void
3209 ciss_cam_poll(struct cam_sim *sim)
3210 {
3211     cr_qhead_t qh;
3212     struct ciss_softc	*sc = cam_sim_softc(sim);
3213 
3214     debug_called(2);
3215 
3216     STAILQ_INIT(&qh);
3217     if (sc->ciss_perf)
3218 	ciss_perf_done(sc, &qh);
3219     else
3220 	ciss_done(sc, &qh);
3221     ciss_complete(sc, &qh);
3222 }
3223 
3224 /************************************************************************
3225  * Handle completion of a command - pass results back through the CCB
3226  */
3227 static void
3228 ciss_cam_complete(struct ciss_request *cr)
3229 {
3230     struct ciss_softc		*sc;
3231     struct ciss_command		*cc;
3232     struct ciss_error_info	*ce;
3233     struct ccb_scsiio		*csio;
3234     int				scsi_status;
3235     int				command_status;
3236 
3237     debug_called(2);
3238 
3239     sc = cr->cr_sc;
3240     cc = cr->cr_cc;
3241     ce = (struct ciss_error_info *)&(cc->sg[0]);
3242     csio = (struct ccb_scsiio *)cr->cr_private;
3243 
3244     /*
3245      * Extract status values from request.
3246      */
3247     ciss_report_request(cr, &command_status, &scsi_status);
3248     csio->scsi_status = scsi_status;
3249 
3250     /*
3251      * Handle specific SCSI status values.
3252      */
3253     switch(scsi_status) {
3254 	/* no status due to adapter error */
3255     case -1:
3256 	debug(0, "adapter error");
3257 	csio->ccb_h.status |= CAM_REQ_CMP_ERR;
3258 	break;
3259 
3260 	/* no status due to command completed OK */
3261     case SCSI_STATUS_OK:		/* CISS_SCSI_STATUS_GOOD */
3262 	debug(2, "SCSI_STATUS_OK");
3263 	csio->ccb_h.status |= CAM_REQ_CMP;
3264 	break;
3265 
3266 	/* check condition, sense data included */
3267     case SCSI_STATUS_CHECK_COND:	/* CISS_SCSI_STATUS_CHECK_CONDITION */
3268 	debug(0, "SCSI_STATUS_CHECK_COND  sense size %d  resid %d\n",
3269 	      ce->sense_length, ce->residual_count);
3270 	bzero(&csio->sense_data, SSD_FULL_SIZE);
3271 	bcopy(&ce->sense_info[0], &csio->sense_data, ce->sense_length);
3272 	if (csio->sense_len > ce->sense_length)
3273 		csio->sense_resid = csio->sense_len - ce->sense_length;
3274 	else
3275 		csio->sense_resid = 0;
3276 	csio->resid = ce->residual_count;
3277 	csio->ccb_h.status |= CAM_SCSI_STATUS_ERROR | CAM_AUTOSNS_VALID;
3278 #ifdef CISS_DEBUG
3279 	{
3280 	    struct scsi_sense_data	*sns = (struct scsi_sense_data *)&ce->sense_info[0];
3281 	    debug(0, "sense key %x", scsi_get_sense_key(sns, csio->sense_len -
3282 		  csio->sense_resid, /*show_errors*/ 1));
3283 	}
3284 #endif
3285 	break;
3286 
3287     case SCSI_STATUS_BUSY:		/* CISS_SCSI_STATUS_BUSY */
3288 	debug(0, "SCSI_STATUS_BUSY");
3289 	csio->ccb_h.status |= CAM_SCSI_BUSY;
3290 	break;
3291 
3292     default:
3293 	debug(0, "unknown status 0x%x", csio->scsi_status);
3294 	csio->ccb_h.status |= CAM_REQ_CMP_ERR;
3295 	break;
3296     }
3297 
3298     /* handle post-command fixup */
3299     ciss_cam_complete_fixup(sc, csio);
3300 
3301     ciss_release_request(cr);
3302     if (sc->ciss_flags & CISS_FLAG_BUSY) {
3303 	sc->ciss_flags &= ~CISS_FLAG_BUSY;
3304 	if (csio->ccb_h.status & CAM_RELEASE_SIMQ)
3305 	    xpt_release_simq(xpt_path_sim(csio->ccb_h.path), 0);
3306 	else
3307 	    csio->ccb_h.status |= CAM_RELEASE_SIMQ;
3308     }
3309     xpt_done((union ccb *)csio);
3310 }
3311 
3312 /********************************************************************************
3313  * Fix up the result of some commands here.
3314  */
3315 static void
3316 ciss_cam_complete_fixup(struct ciss_softc *sc, struct ccb_scsiio *csio)
3317 {
3318     struct scsi_inquiry_data	*inq;
3319     struct ciss_ldrive		*cl;
3320     uint8_t			*cdb;
3321     int				bus, target;
3322 
3323     cdb = (csio->ccb_h.flags & CAM_CDB_POINTER) ?
3324 	 (uint8_t *)csio->cdb_io.cdb_ptr : csio->cdb_io.cdb_bytes;
3325     if (cdb[0] == INQUIRY &&
3326 	(cdb[1] & SI_EVPD) == 0 &&
3327 	(csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN &&
3328 	csio->dxfer_len >= SHORT_INQUIRY_LENGTH) {
3329 
3330 	inq = (struct scsi_inquiry_data *)csio->data_ptr;
3331 	target = csio->ccb_h.target_id;
3332 	bus = cam_sim_bus(xpt_path_sim(csio->ccb_h.path));
3333 
3334 	/*
3335 	 * Don't let hard drives be seen by the DA driver.  They will still be
3336 	 * attached by the PASS driver.
3337 	 */
3338 	if (CISS_IS_PHYSICAL(bus)) {
3339 	    if (SID_TYPE(inq) == T_DIRECT)
3340 		inq->device = (inq->device & 0xe0) | T_NODEVICE;
3341 	    return;
3342 	}
3343 
3344 	cl = &sc->ciss_logical[bus][target];
3345 
3346 	padstr(inq->vendor, "COMPAQ", 8);
3347 	padstr(inq->product, ciss_name_ldrive_org(cl->cl_ldrive->fault_tolerance), 8);
3348 	padstr(inq->revision, ciss_name_ldrive_status(cl->cl_lstatus->status), 16);
3349     }
3350 }
3351 
3352 
3353 /********************************************************************************
3354  * Find a peripheral attached at (target)
3355  */
3356 static struct cam_periph *
3357 ciss_find_periph(struct ciss_softc *sc, int bus, int target)
3358 {
3359     struct cam_periph	*periph;
3360     struct cam_path	*path;
3361     int			status;
3362 
3363     status = xpt_create_path(&path, NULL, cam_sim_path(sc->ciss_cam_sim[bus]),
3364 			     target, 0);
3365     if (status == CAM_REQ_CMP) {
3366 	periph = cam_periph_find(path, NULL);
3367 	xpt_free_path(path);
3368     } else {
3369 	periph = NULL;
3370     }
3371     return(periph);
3372 }
3373 
3374 /********************************************************************************
3375  * Name the device at (target)
3376  *
3377  * XXX is this strictly correct?
3378  */
3379 static int
3380 ciss_name_device(struct ciss_softc *sc, int bus, int target)
3381 {
3382     struct cam_periph	*periph;
3383 
3384     if (CISS_IS_PHYSICAL(bus))
3385 	return (0);
3386     if ((periph = ciss_find_periph(sc, bus, target)) != NULL) {
3387 	sprintf(sc->ciss_logical[bus][target].cl_name, "%s%d",
3388 		periph->periph_name, periph->unit_number);
3389 	return(0);
3390     }
3391     sc->ciss_logical[bus][target].cl_name[0] = 0;
3392     return(ENOENT);
3393 }
3394 
3395 /************************************************************************
3396  * Periodic status monitoring.
3397  */
3398 static void
3399 ciss_periodic(void *arg)
3400 {
3401     struct ciss_softc	*sc;
3402     struct ciss_request	*cr = NULL;
3403     struct ciss_command	*cc = NULL;
3404     int			error = 0;
3405 
3406     debug_called(1);
3407 
3408     sc = (struct ciss_softc *)arg;
3409 
3410     /*
3411      * Check the adapter heartbeat.
3412      */
3413     if (sc->ciss_cfg->heartbeat == sc->ciss_heartbeat) {
3414 	sc->ciss_heart_attack++;
3415 	debug(0, "adapter heart attack in progress 0x%x/%d",
3416 	      sc->ciss_heartbeat, sc->ciss_heart_attack);
3417 	if (sc->ciss_heart_attack == 3) {
3418 	    ciss_printf(sc, "ADAPTER HEARTBEAT FAILED\n");
3419 	    ciss_disable_adapter(sc);
3420 	    return;
3421 	}
3422     } else {
3423 	sc->ciss_heartbeat = sc->ciss_cfg->heartbeat;
3424 	sc->ciss_heart_attack = 0;
3425 	debug(3, "new heartbeat 0x%x", sc->ciss_heartbeat);
3426     }
3427 
3428     /*
3429      * Send the NOP message and wait for a response.
3430      */
3431     if (ciss_nop_message_heartbeat != 0 && (error = ciss_get_request(sc, &cr)) == 0) {
3432 	cc = cr->cr_cc;
3433 	cr->cr_complete = ciss_nop_complete;
3434 	cc->cdb.cdb_length = 1;
3435 	cc->cdb.type = CISS_CDB_TYPE_MESSAGE;
3436 	cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
3437 	cc->cdb.direction = CISS_CDB_DIRECTION_WRITE;
3438 	cc->cdb.timeout = 0;
3439 	cc->cdb.cdb[0] = CISS_OPCODE_MESSAGE_NOP;
3440 
3441 	if ((error = ciss_start(cr)) != 0) {
3442 	    ciss_printf(sc, "SENDING NOP MESSAGE FAILED\n");
3443 	}
3444     }
3445 
3446     /*
3447      * If the notify event request has died for some reason, or has
3448      * not started yet, restart it.
3449      */
3450     if (!(sc->ciss_flags & CISS_FLAG_NOTIFY_OK)) {
3451 	debug(0, "(re)starting Event Notify chain");
3452 	ciss_notify_event(sc);
3453     }
3454 
3455     /*
3456      * Reschedule.
3457      */
3458     callout_reset(&sc->ciss_periodic, CISS_HEARTBEAT_RATE * hz, ciss_periodic, sc);
3459 }
3460 
3461 static void
3462 ciss_nop_complete(struct ciss_request *cr)
3463 {
3464     struct ciss_softc		*sc;
3465     static int			first_time = 1;
3466 
3467     sc = cr->cr_sc;
3468     if (ciss_report_request(cr, NULL, NULL) != 0) {
3469 	if (first_time == 1) {
3470 	    first_time = 0;
3471 	    ciss_printf(sc, "SENDING NOP MESSAGE FAILED (not logging anymore)\n");
3472 	}
3473     }
3474 
3475     ciss_release_request(cr);
3476 }
3477 
3478 /************************************************************************
3479  * Disable the adapter.
3480  *
3481  * The all requests in completed queue is failed with hardware error.
3482  * This will cause failover in a multipath configuration.
3483  */
3484 static void
3485 ciss_disable_adapter(struct ciss_softc *sc)
3486 {
3487     cr_qhead_t			qh;
3488     struct ciss_request		*cr;
3489     struct ciss_command		*cc;
3490     struct ciss_error_info	*ce;
3491     int				i;
3492 
3493     CISS_TL_SIMPLE_DISABLE_INTERRUPTS(sc);
3494     pci_disable_busmaster(sc->ciss_dev);
3495     sc->ciss_flags &= ~CISS_FLAG_RUNNING;
3496 
3497     for (i = 1; i < sc->ciss_max_requests; i++) {
3498 	cr = &sc->ciss_request[i];
3499 	if ((cr->cr_flags & CISS_REQ_BUSY) == 0)
3500 	    continue;
3501 
3502 	cc = cr->cr_cc;
3503 	ce = (struct ciss_error_info *)&(cc->sg[0]);
3504 	ce->command_status = CISS_CMD_STATUS_HARDWARE_ERROR;
3505 	ciss_enqueue_complete(cr, &qh);
3506     }
3507 
3508     for (;;) {
3509 	if ((cr = ciss_dequeue_complete(sc, &qh)) == NULL)
3510 	    break;
3511 
3512 	/*
3513 	 * If the request has a callback, invoke it.
3514 	 */
3515 	if (cr->cr_complete != NULL) {
3516 	    cr->cr_complete(cr);
3517 	    continue;
3518 	}
3519 
3520 	/*
3521 	 * If someone is sleeping on this request, wake them up.
3522 	 */
3523 	if (cr->cr_flags & CISS_REQ_SLEEP) {
3524 	    cr->cr_flags &= ~CISS_REQ_SLEEP;
3525 	    wakeup(cr);
3526 	    continue;
3527 	}
3528     }
3529 }
3530 
3531 /************************************************************************
3532  * Request a notification response from the adapter.
3533  *
3534  * If (cr) is NULL, this is the first request of the adapter, so
3535  * reset the adapter's message pointer and start with the oldest
3536  * message available.
3537  */
3538 static void
3539 ciss_notify_event(struct ciss_softc *sc)
3540 {
3541     struct ciss_request		*cr;
3542     struct ciss_command		*cc;
3543     struct ciss_notify_cdb	*cnc;
3544     int				error;
3545 
3546     debug_called(1);
3547 
3548     cr = sc->ciss_periodic_notify;
3549 
3550     /* get a request if we don't already have one */
3551     if (cr == NULL) {
3552 	if ((error = ciss_get_request(sc, &cr)) != 0) {
3553 	    debug(0, "can't get notify event request");
3554 	    goto out;
3555 	}
3556 	sc->ciss_periodic_notify = cr;
3557 	cr->cr_complete = ciss_notify_complete;
3558 	debug(1, "acquired request %d", cr->cr_tag);
3559     }
3560 
3561     /*
3562      * Get a databuffer if we don't already have one, note that the
3563      * adapter command wants a larger buffer than the actual
3564      * structure.
3565      */
3566     if (cr->cr_data == NULL) {
3567 	if ((cr->cr_data = malloc(CISS_NOTIFY_DATA_SIZE, CISS_MALLOC_CLASS, M_NOWAIT)) == NULL) {
3568 	    debug(0, "can't get notify event request buffer");
3569 	    error = ENOMEM;
3570 	    goto out;
3571 	}
3572 	cr->cr_length = CISS_NOTIFY_DATA_SIZE;
3573     }
3574 
3575     /* re-setup the request's command (since we never release it) XXX overkill*/
3576     ciss_preen_command(cr);
3577 
3578     /* (re)build the notify event command */
3579     cc = cr->cr_cc;
3580     cc->header.address.physical.mode = CISS_HDR_ADDRESS_MODE_PERIPHERAL;
3581     cc->header.address.physical.bus = 0;
3582     cc->header.address.physical.target = 0;
3583 
3584     cc->cdb.cdb_length = sizeof(*cnc);
3585     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
3586     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
3587     cc->cdb.direction = CISS_CDB_DIRECTION_READ;
3588     cc->cdb.timeout = 0;	/* no timeout, we hope */
3589 
3590     cnc = (struct ciss_notify_cdb *)&(cc->cdb.cdb[0]);
3591     bzero(cr->cr_data, CISS_NOTIFY_DATA_SIZE);
3592     cnc->opcode = CISS_OPCODE_READ;
3593     cnc->command = CISS_COMMAND_NOTIFY_ON_EVENT;
3594     cnc->timeout = 0;		/* no timeout, we hope */
3595     cnc->synchronous = 0;
3596     cnc->ordered = 0;
3597     cnc->seek_to_oldest = 0;
3598     if ((sc->ciss_flags & CISS_FLAG_RUNNING) == 0)
3599 	cnc->new_only = 1;
3600     else
3601 	cnc->new_only = 0;
3602     cnc->length = htonl(CISS_NOTIFY_DATA_SIZE);
3603 
3604     /* submit the request */
3605     error = ciss_start(cr);
3606 
3607  out:
3608     if (error) {
3609 	if (cr != NULL) {
3610 	    if (cr->cr_data != NULL)
3611 		free(cr->cr_data, CISS_MALLOC_CLASS);
3612 	    ciss_release_request(cr);
3613 	}
3614 	sc->ciss_periodic_notify = NULL;
3615 	debug(0, "can't submit notify event request");
3616 	sc->ciss_flags &= ~CISS_FLAG_NOTIFY_OK;
3617     } else {
3618 	debug(1, "notify event submitted");
3619 	sc->ciss_flags |= CISS_FLAG_NOTIFY_OK;
3620     }
3621 }
3622 
3623 static void
3624 ciss_notify_complete(struct ciss_request *cr)
3625 {
3626     struct ciss_command	*cc;
3627     struct ciss_notify	*cn;
3628     struct ciss_softc	*sc;
3629     int			scsi_status;
3630     int			command_status;
3631     debug_called(1);
3632 
3633     cc = cr->cr_cc;
3634     cn = (struct ciss_notify *)cr->cr_data;
3635     sc = cr->cr_sc;
3636 
3637     /*
3638      * Report request results, decode status.
3639      */
3640     ciss_report_request(cr, &command_status, &scsi_status);
3641 
3642     /*
3643      * Abort the chain on a fatal error.
3644      *
3645      * XXX which of these are actually errors?
3646      */
3647     if ((command_status != CISS_CMD_STATUS_SUCCESS) &&
3648 	(command_status != CISS_CMD_STATUS_TARGET_STATUS) &&
3649 	(command_status != CISS_CMD_STATUS_TIMEOUT)) {	/* XXX timeout? */
3650 	ciss_printf(sc, "fatal error in Notify Event request (%s)\n",
3651 		    ciss_name_command_status(command_status));
3652 	ciss_release_request(cr);
3653 	sc->ciss_flags &= ~CISS_FLAG_NOTIFY_OK;
3654 	return;
3655     }
3656 
3657     /*
3658      * If the adapter gave us a text message, print it.
3659      */
3660     if (cn->message[0] != 0)
3661 	ciss_printf(sc, "*** %.80s\n", cn->message);
3662 
3663     debug(0, "notify event class %d subclass %d detail %d",
3664 		cn->class, cn->subclass, cn->detail);
3665 
3666     /*
3667      * If the response indicates that the notifier has been aborted,
3668      * release the notifier command.
3669      */
3670     if ((cn->class == CISS_NOTIFY_NOTIFIER) &&
3671 	(cn->subclass == CISS_NOTIFY_NOTIFIER_STATUS) &&
3672 	(cn->detail == 1)) {
3673 	debug(0, "notifier exiting");
3674 	sc->ciss_flags &= ~CISS_FLAG_NOTIFY_OK;
3675 	ciss_release_request(cr);
3676 	sc->ciss_periodic_notify = NULL;
3677 	wakeup(&sc->ciss_periodic_notify);
3678     } else {
3679 	/* Handle notify events in a kernel thread */
3680 	ciss_enqueue_notify(cr);
3681 	sc->ciss_periodic_notify = NULL;
3682 	wakeup(&sc->ciss_periodic_notify);
3683 	wakeup(&sc->ciss_notify);
3684     }
3685     /*
3686      * Send a new notify event command, if we're not aborting.
3687      */
3688     if (!(sc->ciss_flags & CISS_FLAG_ABORTING)) {
3689 	ciss_notify_event(sc);
3690     }
3691 }
3692 
3693 /************************************************************************
3694  * Abort the Notify Event chain.
3695  *
3696  * Note that we can't just abort the command in progress; we have to
3697  * explicitly issue an Abort Notify Event command in order for the
3698  * adapter to clean up correctly.
3699  *
3700  * If we are called with CISS_FLAG_ABORTING set in the adapter softc,
3701  * the chain will not restart itself.
3702  */
3703 static int
3704 ciss_notify_abort(struct ciss_softc *sc)
3705 {
3706     struct ciss_request		*cr;
3707     struct ciss_command		*cc;
3708     struct ciss_notify_cdb	*cnc;
3709     int				error, command_status, scsi_status;
3710 
3711     debug_called(1);
3712 
3713     cr = NULL;
3714     error = 0;
3715 
3716     /* verify that there's an outstanding command */
3717     if (!(sc->ciss_flags & CISS_FLAG_NOTIFY_OK))
3718 	goto out;
3719 
3720     /* get a command to issue the abort with */
3721     if ((error = ciss_get_request(sc, &cr)))
3722 	goto out;
3723 
3724     /* get a buffer for the result */
3725     if ((cr->cr_data = malloc(CISS_NOTIFY_DATA_SIZE, CISS_MALLOC_CLASS, M_NOWAIT)) == NULL) {
3726 	debug(0, "can't get notify event request buffer");
3727 	error = ENOMEM;
3728 	goto out;
3729     }
3730     cr->cr_length = CISS_NOTIFY_DATA_SIZE;
3731 
3732     /* build the CDB */
3733     cc = cr->cr_cc;
3734     cc->header.address.physical.mode = CISS_HDR_ADDRESS_MODE_PERIPHERAL;
3735     cc->header.address.physical.bus = 0;
3736     cc->header.address.physical.target = 0;
3737     cc->cdb.cdb_length = sizeof(*cnc);
3738     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
3739     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
3740     cc->cdb.direction = CISS_CDB_DIRECTION_READ;
3741     cc->cdb.timeout = 0;	/* no timeout, we hope */
3742 
3743     cnc = (struct ciss_notify_cdb *)&(cc->cdb.cdb[0]);
3744     bzero(cnc, sizeof(*cnc));
3745     cnc->opcode = CISS_OPCODE_WRITE;
3746     cnc->command = CISS_COMMAND_ABORT_NOTIFY;
3747     cnc->length = htonl(CISS_NOTIFY_DATA_SIZE);
3748 
3749     ciss_print_request(cr);
3750 
3751     /*
3752      * Submit the request and wait for it to complete.
3753      */
3754     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
3755 	ciss_printf(sc, "Abort Notify Event command failed (%d)\n", error);
3756 	goto out;
3757     }
3758 
3759     /*
3760      * Check response.
3761      */
3762     ciss_report_request(cr, &command_status, &scsi_status);
3763     switch(command_status) {
3764     case CISS_CMD_STATUS_SUCCESS:
3765 	break;
3766     case CISS_CMD_STATUS_INVALID_COMMAND:
3767 	/*
3768 	 * Some older adapters don't support the CISS version of this
3769 	 * command.  Fall back to using the BMIC version.
3770 	 */
3771 	error = ciss_notify_abort_bmic(sc);
3772 	if (error != 0)
3773 	    goto out;
3774 	break;
3775 
3776     case CISS_CMD_STATUS_TARGET_STATUS:
3777 	/*
3778 	 * This can happen if the adapter thinks there wasn't an outstanding
3779 	 * Notify Event command but we did.  We clean up here.
3780 	 */
3781 	if (scsi_status == CISS_SCSI_STATUS_CHECK_CONDITION) {
3782 	    if (sc->ciss_periodic_notify != NULL)
3783 		ciss_release_request(sc->ciss_periodic_notify);
3784 	    error = 0;
3785 	    goto out;
3786 	}
3787 	/* FALLTHROUGH */
3788 
3789     default:
3790 	ciss_printf(sc, "Abort Notify Event command failed (%s)\n",
3791 		    ciss_name_command_status(command_status));
3792 	error = EIO;
3793 	goto out;
3794     }
3795 
3796     /*
3797      * Sleep waiting for the notifier command to complete.  Note
3798      * that if it doesn't, we may end up in a bad situation, since
3799      * the adapter may deliver it later.  Also note that the adapter
3800      * requires the Notify Event command to be cancelled in order to
3801      * maintain internal bookkeeping.
3802      */
3803     while (sc->ciss_periodic_notify != NULL) {
3804 	error = msleep(&sc->ciss_periodic_notify, &sc->ciss_mtx, PRIBIO, "cissNEA", hz * 5);
3805 	if (error == EWOULDBLOCK) {
3806 	    ciss_printf(sc, "Notify Event command failed to abort, adapter may wedge.\n");
3807 	    break;
3808 	}
3809     }
3810 
3811  out:
3812     /* release the cancel request */
3813     if (cr != NULL) {
3814 	if (cr->cr_data != NULL)
3815 	    free(cr->cr_data, CISS_MALLOC_CLASS);
3816 	ciss_release_request(cr);
3817     }
3818     if (error == 0)
3819 	sc->ciss_flags &= ~CISS_FLAG_NOTIFY_OK;
3820     return(error);
3821 }
3822 
3823 /************************************************************************
3824  * Abort the Notify Event chain using a BMIC command.
3825  */
3826 static int
3827 ciss_notify_abort_bmic(struct ciss_softc *sc)
3828 {
3829     struct ciss_request			*cr;
3830     int					error, command_status;
3831 
3832     debug_called(1);
3833 
3834     cr = NULL;
3835     error = 0;
3836 
3837     /* verify that there's an outstanding command */
3838     if (!(sc->ciss_flags & CISS_FLAG_NOTIFY_OK))
3839 	goto out;
3840 
3841     /*
3842      * Build a BMIC command to cancel the Notify on Event command.
3843      *
3844      * Note that we are sending a CISS opcode here.  Odd.
3845      */
3846     if ((error = ciss_get_bmic_request(sc, &cr, CISS_COMMAND_ABORT_NOTIFY,
3847 				       NULL, 0)) != 0)
3848 	goto out;
3849 
3850     /*
3851      * Submit the request and wait for it to complete.
3852      */
3853     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
3854 	ciss_printf(sc, "error sending BMIC Cancel Notify on Event command (%d)\n", error);
3855 	goto out;
3856     }
3857 
3858     /*
3859      * Check response.
3860      */
3861     ciss_report_request(cr, &command_status, NULL);
3862     switch(command_status) {
3863     case CISS_CMD_STATUS_SUCCESS:
3864 	break;
3865     default:
3866 	ciss_printf(sc, "error cancelling Notify on Event (%s)\n",
3867 		    ciss_name_command_status(command_status));
3868 	error = EIO;
3869 	goto out;
3870     }
3871 
3872 out:
3873     if (cr != NULL)
3874 	ciss_release_request(cr);
3875     return(error);
3876 }
3877 
3878 /************************************************************************
3879  * Handle rescanning all the logical volumes when a notify event
3880  * causes the drives to come online or offline.
3881  */
3882 static void
3883 ciss_notify_rescan_logical(struct ciss_softc *sc)
3884 {
3885     struct ciss_lun_report      *cll;
3886     struct ciss_ldrive		*ld;
3887     int                         i, j, ndrives;
3888 
3889     /*
3890      * We must rescan all logical volumes to get the right logical
3891      * drive address.
3892      */
3893     cll = ciss_report_luns(sc, CISS_OPCODE_REPORT_LOGICAL_LUNS,
3894                            sc->ciss_cfg->max_logical_supported);
3895     if (cll == NULL)
3896         return;
3897 
3898     ndrives = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
3899 
3900     /*
3901      * Delete any of the drives which were destroyed by the
3902      * firmware.
3903      */
3904     for (i = 0; i < sc->ciss_max_logical_bus; i++) {
3905 	for (j = 0; j < sc->ciss_cfg->max_logical_supported; j++) {
3906 	    ld = &sc->ciss_logical[i][j];
3907 
3908 	    if (ld->cl_update == 0)
3909 		continue;
3910 
3911 	    if (ld->cl_status != CISS_LD_ONLINE) {
3912 		ciss_cam_rescan_target(sc, i, j);
3913 		ld->cl_update = 0;
3914 		if (ld->cl_ldrive)
3915 		    free(ld->cl_ldrive, CISS_MALLOC_CLASS);
3916 		if (ld->cl_lstatus)
3917 		    free(ld->cl_lstatus, CISS_MALLOC_CLASS);
3918 
3919 		ld->cl_ldrive = NULL;
3920 		ld->cl_lstatus = NULL;
3921 	    }
3922 	}
3923     }
3924 
3925     /*
3926      * Scan for new drives.
3927      */
3928     for (i = 0; i < ndrives; i++) {
3929 	int	bus, target;
3930 
3931 	bus 	= CISS_LUN_TO_BUS(cll->lun[i].logical.lun);
3932 	target	= CISS_LUN_TO_TARGET(cll->lun[i].logical.lun);
3933 	ld	= &sc->ciss_logical[bus][target];
3934 
3935 	if (ld->cl_update == 0)
3936 		continue;
3937 
3938 	ld->cl_update		= 0;
3939 	ld->cl_address		= cll->lun[i];
3940 	ld->cl_controller	= &sc->ciss_controllers[bus];
3941 	if (ciss_identify_logical(sc, ld) == 0) {
3942 	    ciss_cam_rescan_target(sc, bus, target);
3943 	}
3944     }
3945     free(cll, CISS_MALLOC_CLASS);
3946 }
3947 
3948 /************************************************************************
3949  * Handle a notify event relating to the status of a logical drive.
3950  *
3951  * XXX need to be able to defer some of these to properly handle
3952  *     calling the "ID Physical drive" command, unless the 'extended'
3953  *     drive IDs are always in BIG_MAP format.
3954  */
3955 static void
3956 ciss_notify_logical(struct ciss_softc *sc, struct ciss_notify *cn)
3957 {
3958     struct ciss_ldrive	*ld;
3959     int			ostatus, bus, target;
3960 
3961     debug_called(2);
3962 
3963     bus		= cn->device.physical.bus;
3964     target	= cn->data.logical_status.logical_drive;
3965     ld		= &sc->ciss_logical[bus][target];
3966 
3967     switch (cn->subclass) {
3968     case CISS_NOTIFY_LOGICAL_STATUS:
3969 	switch (cn->detail) {
3970 	case 0:
3971 	    ciss_name_device(sc, bus, target);
3972 	    ciss_printf(sc, "logical drive %d (%s) changed status %s->%s, spare status 0x%b\n",
3973 			cn->data.logical_status.logical_drive, ld->cl_name,
3974 			ciss_name_ldrive_status(cn->data.logical_status.previous_state),
3975 			ciss_name_ldrive_status(cn->data.logical_status.new_state),
3976 			cn->data.logical_status.spare_state,
3977 			"\20\1configured\2rebuilding\3failed\4in use\5available\n");
3978 
3979 	    /*
3980 	     * Update our idea of the drive's status.
3981 	     */
3982 	    ostatus = ciss_decode_ldrive_status(cn->data.logical_status.previous_state);
3983 	    ld->cl_status = ciss_decode_ldrive_status(cn->data.logical_status.new_state);
3984 	    if (ld->cl_lstatus != NULL)
3985 		ld->cl_lstatus->status = cn->data.logical_status.new_state;
3986 
3987 	    /*
3988 	     * Have CAM rescan the drive if its status has changed.
3989 	     */
3990 	    if (ostatus != ld->cl_status) {
3991 		ld->cl_update = 1;
3992 		ciss_notify_rescan_logical(sc);
3993 	    }
3994 
3995 	    break;
3996 
3997 	case 1:	/* logical drive has recognised new media, needs Accept Media Exchange */
3998 	    ciss_name_device(sc, bus, target);
3999 	    ciss_printf(sc, "logical drive %d (%s) media exchanged, ready to go online\n",
4000 			cn->data.logical_status.logical_drive, ld->cl_name);
4001 	    ciss_accept_media(sc, ld);
4002 
4003 	    ld->cl_update = 1;
4004 	    ld->cl_status = ciss_decode_ldrive_status(cn->data.logical_status.new_state);
4005 	    ciss_notify_rescan_logical(sc);
4006 	    break;
4007 
4008 	case 2:
4009 	case 3:
4010 	    ciss_printf(sc, "rebuild of logical drive %d (%s) failed due to %s error\n",
4011 			cn->data.rebuild_aborted.logical_drive,
4012 			ld->cl_name,
4013 			(cn->detail == 2) ? "read" : "write");
4014 	    break;
4015 	}
4016 	break;
4017 
4018     case CISS_NOTIFY_LOGICAL_ERROR:
4019 	if (cn->detail == 0) {
4020 	    ciss_printf(sc, "FATAL I/O ERROR on logical drive %d (%s), SCSI port %d ID %d\n",
4021 			cn->data.io_error.logical_drive,
4022 			ld->cl_name,
4023 			cn->data.io_error.failure_bus,
4024 			cn->data.io_error.failure_drive);
4025 	    /* XXX should we take the drive down at this point, or will we be told? */
4026 	}
4027 	break;
4028 
4029     case CISS_NOTIFY_LOGICAL_SURFACE:
4030 	if (cn->detail == 0)
4031 	    ciss_printf(sc, "logical drive %d (%s) completed consistency initialisation\n",
4032 			cn->data.consistency_completed.logical_drive,
4033 			ld->cl_name);
4034 	break;
4035     }
4036 }
4037 
4038 /************************************************************************
4039  * Handle a notify event relating to the status of a physical drive.
4040  */
4041 static void
4042 ciss_notify_physical(struct ciss_softc *sc, struct ciss_notify *cn)
4043 {
4044 }
4045 
4046 /************************************************************************
4047  * Handle a notify event relating to the status of a physical drive.
4048  */
4049 static void
4050 ciss_notify_hotplug(struct ciss_softc *sc, struct ciss_notify *cn)
4051 {
4052     struct ciss_lun_report *cll = NULL;
4053     int bus, target;
4054 
4055     switch (cn->subclass) {
4056     case CISS_NOTIFY_HOTPLUG_PHYSICAL:
4057     case CISS_NOTIFY_HOTPLUG_NONDISK:
4058 	bus = CISS_BIG_MAP_BUS(sc, cn->data.drive.big_physical_drive_number);
4059 	target =
4060 	    CISS_BIG_MAP_TARGET(sc, cn->data.drive.big_physical_drive_number);
4061 
4062 	if (cn->detail == 0) {
4063 	    /*
4064 	     * Mark the device offline so that it'll start producing selection
4065 	     * timeouts to the upper layer.
4066 	     */
4067 	    if ((bus >= 0) && (target >= 0))
4068 		sc->ciss_physical[bus][target].cp_online = 0;
4069 	} else {
4070 	    /*
4071 	     * Rescan the physical lun list for new items
4072 	     */
4073 	    cll = ciss_report_luns(sc, CISS_OPCODE_REPORT_PHYSICAL_LUNS,
4074 				   sc->ciss_cfg->max_physical_supported);
4075 	    if (cll == NULL) {
4076 		ciss_printf(sc, "Warning, cannot get physical lun list\n");
4077 		break;
4078 	    }
4079 	    ciss_filter_physical(sc, cll);
4080 	}
4081 	break;
4082 
4083     default:
4084 	ciss_printf(sc, "Unknown hotplug event %d\n", cn->subclass);
4085 	return;
4086     }
4087 
4088     if (cll != NULL)
4089 	free(cll, CISS_MALLOC_CLASS);
4090 }
4091 
4092 /************************************************************************
4093  * Handle deferred processing of notify events.  Notify events may need
4094  * sleep which is unsafe during an interrupt.
4095  */
4096 static void
4097 ciss_notify_thread(void *arg)
4098 {
4099     struct ciss_softc		*sc;
4100     struct ciss_request		*cr;
4101     struct ciss_notify		*cn;
4102 
4103     sc = (struct ciss_softc *)arg;
4104 #if __FreeBSD_version >= 500000
4105     mtx_lock(&sc->ciss_mtx);
4106 #endif
4107 
4108     for (;;) {
4109 	if (STAILQ_EMPTY(&sc->ciss_notify) != 0 &&
4110 	    (sc->ciss_flags & CISS_FLAG_THREAD_SHUT) == 0) {
4111 	    msleep(&sc->ciss_notify, &sc->ciss_mtx, PUSER, "idle", 0);
4112 	}
4113 
4114 	if (sc->ciss_flags & CISS_FLAG_THREAD_SHUT)
4115 	    break;
4116 
4117 	cr = ciss_dequeue_notify(sc);
4118 
4119 	if (cr == NULL)
4120 		panic("cr null");
4121 	cn = (struct ciss_notify *)cr->cr_data;
4122 
4123 	switch (cn->class) {
4124 	case CISS_NOTIFY_HOTPLUG:
4125 	    ciss_notify_hotplug(sc, cn);
4126 	    break;
4127 	case CISS_NOTIFY_LOGICAL:
4128 	    ciss_notify_logical(sc, cn);
4129 	    break;
4130 	case CISS_NOTIFY_PHYSICAL:
4131 	    ciss_notify_physical(sc, cn);
4132 	    break;
4133 	}
4134 
4135 	ciss_release_request(cr);
4136 
4137     }
4138     sc->ciss_notify_thread = NULL;
4139     wakeup(&sc->ciss_notify_thread);
4140 
4141 #if __FreeBSD_version >= 500000
4142     mtx_unlock(&sc->ciss_mtx);
4143 #endif
4144     kproc_exit(0);
4145 }
4146 
4147 /************************************************************************
4148  * Start the notification kernel thread.
4149  */
4150 static void
4151 ciss_spawn_notify_thread(struct ciss_softc *sc)
4152 {
4153 
4154 #if __FreeBSD_version > 500005
4155     if (kproc_create((void(*)(void *))ciss_notify_thread, sc,
4156 		       &sc->ciss_notify_thread, 0, 0, "ciss_notify%d",
4157 		       device_get_unit(sc->ciss_dev)))
4158 #else
4159     if (kproc_create((void(*)(void *))ciss_notify_thread, sc,
4160 		       &sc->ciss_notify_thread, "ciss_notify%d",
4161 		       device_get_unit(sc->ciss_dev)))
4162 #endif
4163 	panic("Could not create notify thread\n");
4164 }
4165 
4166 /************************************************************************
4167  * Kill the notification kernel thread.
4168  */
4169 static void
4170 ciss_kill_notify_thread(struct ciss_softc *sc)
4171 {
4172 
4173     if (sc->ciss_notify_thread == NULL)
4174 	return;
4175 
4176     sc->ciss_flags |= CISS_FLAG_THREAD_SHUT;
4177     wakeup(&sc->ciss_notify);
4178     msleep(&sc->ciss_notify_thread, &sc->ciss_mtx, PUSER, "thtrm", 0);
4179 }
4180 
4181 /************************************************************************
4182  * Print a request.
4183  */
4184 static void
4185 ciss_print_request(struct ciss_request *cr)
4186 {
4187     struct ciss_softc	*sc;
4188     struct ciss_command	*cc;
4189     int			i;
4190 
4191     sc = cr->cr_sc;
4192     cc = cr->cr_cc;
4193 
4194     ciss_printf(sc, "REQUEST @ %p\n", cr);
4195     ciss_printf(sc, "  data %p/%d  tag %d  flags %b\n",
4196 	      cr->cr_data, cr->cr_length, cr->cr_tag, cr->cr_flags,
4197 	      "\20\1mapped\2sleep\3poll\4dataout\5datain\n");
4198     ciss_printf(sc, "  sg list/total %d/%d  host tag 0x%x\n",
4199 		cc->header.sg_in_list, cc->header.sg_total, cc->header.host_tag);
4200     switch(cc->header.address.mode.mode) {
4201     case CISS_HDR_ADDRESS_MODE_PERIPHERAL:
4202     case CISS_HDR_ADDRESS_MODE_MASK_PERIPHERAL:
4203 	ciss_printf(sc, "  physical bus %d target %d\n",
4204 		    cc->header.address.physical.bus, cc->header.address.physical.target);
4205 	break;
4206     case CISS_HDR_ADDRESS_MODE_LOGICAL:
4207 	ciss_printf(sc, "  logical unit %d\n", cc->header.address.logical.lun);
4208 	break;
4209     }
4210     ciss_printf(sc, "  %s cdb length %d type %s attribute %s\n",
4211 		(cc->cdb.direction == CISS_CDB_DIRECTION_NONE) ? "no-I/O" :
4212 		(cc->cdb.direction == CISS_CDB_DIRECTION_READ) ? "READ" :
4213 		(cc->cdb.direction == CISS_CDB_DIRECTION_WRITE) ? "WRITE" : "??",
4214 		cc->cdb.cdb_length,
4215 		(cc->cdb.type == CISS_CDB_TYPE_COMMAND) ? "command" :
4216 		(cc->cdb.type == CISS_CDB_TYPE_MESSAGE) ? "message" : "??",
4217 		(cc->cdb.attribute == CISS_CDB_ATTRIBUTE_UNTAGGED) ? "untagged" :
4218 		(cc->cdb.attribute == CISS_CDB_ATTRIBUTE_SIMPLE) ? "simple" :
4219 		(cc->cdb.attribute == CISS_CDB_ATTRIBUTE_HEAD_OF_QUEUE) ? "head-of-queue" :
4220 		(cc->cdb.attribute == CISS_CDB_ATTRIBUTE_ORDERED) ? "ordered" :
4221 		(cc->cdb.attribute == CISS_CDB_ATTRIBUTE_AUTO_CONTINGENT) ? "auto-contingent" : "??");
4222     ciss_printf(sc, "  %*D\n", cc->cdb.cdb_length, &cc->cdb.cdb[0], " ");
4223 
4224     if (cc->header.host_tag & CISS_HDR_HOST_TAG_ERROR) {
4225 	/* XXX print error info */
4226     } else {
4227 	/* since we don't use chained s/g, don't support it here */
4228 	for (i = 0; i < cc->header.sg_in_list; i++) {
4229 	    if ((i % 4) == 0)
4230 		ciss_printf(sc, "   ");
4231 	    printf("0x%08x/%d ", (u_int32_t)cc->sg[i].address, cc->sg[i].length);
4232 	    if ((((i + 1) % 4) == 0) || (i == (cc->header.sg_in_list - 1)))
4233 		printf("\n");
4234 	}
4235     }
4236 }
4237 
4238 /************************************************************************
4239  * Print information about the status of a logical drive.
4240  */
4241 static void
4242 ciss_print_ldrive(struct ciss_softc *sc, struct ciss_ldrive *ld)
4243 {
4244     int		bus, target, i;
4245 
4246     if (ld->cl_lstatus == NULL) {
4247 	printf("does not exist\n");
4248 	return;
4249     }
4250 
4251     /* print drive status */
4252     switch(ld->cl_lstatus->status) {
4253     case CISS_LSTATUS_OK:
4254 	printf("online\n");
4255 	break;
4256     case CISS_LSTATUS_INTERIM_RECOVERY:
4257 	printf("in interim recovery mode\n");
4258 	break;
4259     case CISS_LSTATUS_READY_RECOVERY:
4260 	printf("ready to begin recovery\n");
4261 	break;
4262     case CISS_LSTATUS_RECOVERING:
4263 	bus = CISS_BIG_MAP_BUS(sc, ld->cl_lstatus->drive_rebuilding);
4264 	target = CISS_BIG_MAP_BUS(sc, ld->cl_lstatus->drive_rebuilding);
4265 	printf("being recovered, working on physical drive %d.%d, %u blocks remaining\n",
4266 	       bus, target, ld->cl_lstatus->blocks_to_recover);
4267 	break;
4268     case CISS_LSTATUS_EXPANDING:
4269 	printf("being expanded, %u blocks remaining\n",
4270 	       ld->cl_lstatus->blocks_to_recover);
4271 	break;
4272     case CISS_LSTATUS_QUEUED_FOR_EXPANSION:
4273 	printf("queued for expansion\n");
4274 	break;
4275     case CISS_LSTATUS_FAILED:
4276 	printf("queued for expansion\n");
4277 	break;
4278     case CISS_LSTATUS_WRONG_PDRIVE:
4279 	printf("wrong physical drive inserted\n");
4280 	break;
4281     case CISS_LSTATUS_MISSING_PDRIVE:
4282 	printf("missing a needed physical drive\n");
4283 	break;
4284     case CISS_LSTATUS_BECOMING_READY:
4285 	printf("becoming ready\n");
4286 	break;
4287     }
4288 
4289     /* print failed physical drives */
4290     for (i = 0; i < CISS_BIG_MAP_ENTRIES / 8; i++) {
4291 	bus = CISS_BIG_MAP_BUS(sc, ld->cl_lstatus->drive_failure_map[i]);
4292 	target = CISS_BIG_MAP_TARGET(sc, ld->cl_lstatus->drive_failure_map[i]);
4293 	if (bus == -1)
4294 	    continue;
4295 	ciss_printf(sc, "physical drive %d:%d (%x) failed\n", bus, target,
4296 		    ld->cl_lstatus->drive_failure_map[i]);
4297     }
4298 }
4299 
4300 #ifdef CISS_DEBUG
4301 /************************************************************************
4302  * Print information about the controller/driver.
4303  */
4304 static void
4305 ciss_print_adapter(struct ciss_softc *sc)
4306 {
4307     int		i, j;
4308 
4309     ciss_printf(sc, "ADAPTER:\n");
4310     for (i = 0; i < CISSQ_COUNT; i++) {
4311 	ciss_printf(sc, "%s     %d/%d\n",
4312 	    i == 0 ? "free" :
4313 	    i == 1 ? "busy" : "complete",
4314 	    sc->ciss_qstat[i].q_length,
4315 	    sc->ciss_qstat[i].q_max);
4316     }
4317     ciss_printf(sc, "max_requests %d\n", sc->ciss_max_requests);
4318     ciss_printf(sc, "flags %b\n", sc->ciss_flags,
4319 	"\20\1notify_ok\2control_open\3aborting\4running\21fake_synch\22bmic_abort\n");
4320 
4321     for (i = 0; i < sc->ciss_max_logical_bus; i++) {
4322 	for (j = 0; j < sc->ciss_cfg->max_logical_supported; j++) {
4323 	    ciss_printf(sc, "LOGICAL DRIVE %d:  ", i);
4324 	    ciss_print_ldrive(sc, &sc->ciss_logical[i][j]);
4325 	}
4326     }
4327 
4328     /* XXX Should physical drives be printed out here? */
4329 
4330     for (i = 1; i < sc->ciss_max_requests; i++)
4331 	ciss_print_request(sc->ciss_request + i);
4332 }
4333 
4334 /* DDB hook */
4335 static void
4336 ciss_print0(void)
4337 {
4338     struct ciss_softc	*sc;
4339 
4340     sc = devclass_get_softc(devclass_find("ciss"), 0);
4341     if (sc == NULL) {
4342 	printf("no ciss controllers\n");
4343     } else {
4344 	ciss_print_adapter(sc);
4345     }
4346 }
4347 #endif
4348 
4349 /************************************************************************
4350  * Return a name for a logical drive status value.
4351  */
4352 static const char *
4353 ciss_name_ldrive_status(int status)
4354 {
4355     switch (status) {
4356     case CISS_LSTATUS_OK:
4357 	return("OK");
4358     case CISS_LSTATUS_FAILED:
4359 	return("failed");
4360     case CISS_LSTATUS_NOT_CONFIGURED:
4361 	return("not configured");
4362     case CISS_LSTATUS_INTERIM_RECOVERY:
4363 	return("interim recovery");
4364     case CISS_LSTATUS_READY_RECOVERY:
4365 	return("ready for recovery");
4366     case CISS_LSTATUS_RECOVERING:
4367 	return("recovering");
4368     case CISS_LSTATUS_WRONG_PDRIVE:
4369 	return("wrong physical drive inserted");
4370     case CISS_LSTATUS_MISSING_PDRIVE:
4371 	return("missing physical drive");
4372     case CISS_LSTATUS_EXPANDING:
4373 	return("expanding");
4374     case CISS_LSTATUS_BECOMING_READY:
4375 	return("becoming ready");
4376     case CISS_LSTATUS_QUEUED_FOR_EXPANSION:
4377 	return("queued for expansion");
4378     }
4379     return("unknown status");
4380 }
4381 
4382 /************************************************************************
4383  * Return an online/offline/nonexistent value for a logical drive
4384  * status value.
4385  */
4386 static int
4387 ciss_decode_ldrive_status(int status)
4388 {
4389     switch(status) {
4390     case CISS_LSTATUS_NOT_CONFIGURED:
4391 	return(CISS_LD_NONEXISTENT);
4392 
4393     case CISS_LSTATUS_OK:
4394     case CISS_LSTATUS_INTERIM_RECOVERY:
4395     case CISS_LSTATUS_READY_RECOVERY:
4396     case CISS_LSTATUS_RECOVERING:
4397     case CISS_LSTATUS_EXPANDING:
4398     case CISS_LSTATUS_QUEUED_FOR_EXPANSION:
4399 	return(CISS_LD_ONLINE);
4400 
4401     case CISS_LSTATUS_FAILED:
4402     case CISS_LSTATUS_WRONG_PDRIVE:
4403     case CISS_LSTATUS_MISSING_PDRIVE:
4404     case CISS_LSTATUS_BECOMING_READY:
4405     default:
4406 	return(CISS_LD_OFFLINE);
4407     }
4408 }
4409 
4410 
4411 /************************************************************************
4412  * Return a name for a logical drive's organisation.
4413  */
4414 static const char *
4415 ciss_name_ldrive_org(int org)
4416 {
4417     switch(org) {
4418     case CISS_LDRIVE_RAID0:
4419 	return("RAID 0");
4420     case CISS_LDRIVE_RAID1:
4421 	return("RAID 1(1+0)");
4422     case CISS_LDRIVE_RAID4:
4423 	return("RAID 4");
4424     case CISS_LDRIVE_RAID5:
4425 	return("RAID 5");
4426     case CISS_LDRIVE_RAID51:
4427 	return("RAID 5+1");
4428     case CISS_LDRIVE_RAIDADG:
4429 	return("RAID ADG");
4430     }
4431     return("unkown");
4432 }
4433 
4434 /************************************************************************
4435  * Return a name for a command status value.
4436  */
4437 static const char *
4438 ciss_name_command_status(int status)
4439 {
4440     switch(status) {
4441     case CISS_CMD_STATUS_SUCCESS:
4442 	return("success");
4443     case CISS_CMD_STATUS_TARGET_STATUS:
4444 	return("target status");
4445     case CISS_CMD_STATUS_DATA_UNDERRUN:
4446 	return("data underrun");
4447     case CISS_CMD_STATUS_DATA_OVERRUN:
4448 	return("data overrun");
4449     case CISS_CMD_STATUS_INVALID_COMMAND:
4450 	return("invalid command");
4451     case CISS_CMD_STATUS_PROTOCOL_ERROR:
4452 	return("protocol error");
4453     case CISS_CMD_STATUS_HARDWARE_ERROR:
4454 	return("hardware error");
4455     case CISS_CMD_STATUS_CONNECTION_LOST:
4456 	return("connection lost");
4457     case CISS_CMD_STATUS_ABORTED:
4458 	return("aborted");
4459     case CISS_CMD_STATUS_ABORT_FAILED:
4460 	return("abort failed");
4461     case CISS_CMD_STATUS_UNSOLICITED_ABORT:
4462 	return("unsolicited abort");
4463     case CISS_CMD_STATUS_TIMEOUT:
4464 	return("timeout");
4465     case CISS_CMD_STATUS_UNABORTABLE:
4466 	return("unabortable");
4467     }
4468     return("unknown status");
4469 }
4470 
4471 /************************************************************************
4472  * Handle an open on the control device.
4473  */
4474 static int
4475 ciss_open(struct cdev *dev, int flags, int fmt, struct thread *p)
4476 {
4477     struct ciss_softc	*sc;
4478 
4479     debug_called(1);
4480 
4481     sc = (struct ciss_softc *)dev->si_drv1;
4482 
4483     /* we might want to veto if someone already has us open */
4484 
4485     mtx_lock(&sc->ciss_mtx);
4486     sc->ciss_flags |= CISS_FLAG_CONTROL_OPEN;
4487     mtx_unlock(&sc->ciss_mtx);
4488     return(0);
4489 }
4490 
4491 /************************************************************************
4492  * Handle the last close on the control device.
4493  */
4494 static int
4495 ciss_close(struct cdev *dev, int flags, int fmt, struct thread *p)
4496 {
4497     struct ciss_softc	*sc;
4498 
4499     debug_called(1);
4500 
4501     sc = (struct ciss_softc *)dev->si_drv1;
4502 
4503     mtx_lock(&sc->ciss_mtx);
4504     sc->ciss_flags &= ~CISS_FLAG_CONTROL_OPEN;
4505     mtx_unlock(&sc->ciss_mtx);
4506     return (0);
4507 }
4508 
4509 /********************************************************************************
4510  * Handle adapter-specific control operations.
4511  *
4512  * Note that the API here is compatible with the Linux driver, in order to
4513  * simplify the porting of Compaq's userland tools.
4514  */
4515 static int
4516 ciss_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int32_t flag, struct thread *p)
4517 {
4518     struct ciss_softc		*sc;
4519     IOCTL_Command_struct	*ioc	= (IOCTL_Command_struct *)addr;
4520 #ifdef __amd64__
4521     IOCTL_Command_struct32	*ioc32	= (IOCTL_Command_struct32 *)addr;
4522     IOCTL_Command_struct	ioc_swab;
4523 #endif
4524     int				error;
4525 
4526     debug_called(1);
4527 
4528     sc = (struct ciss_softc *)dev->si_drv1;
4529     error = 0;
4530     mtx_lock(&sc->ciss_mtx);
4531 
4532     switch(cmd) {
4533     case CCISS_GETQSTATS:
4534     {
4535 	union ciss_statrequest *cr = (union ciss_statrequest *)addr;
4536 
4537 	switch (cr->cs_item) {
4538 	case CISSQ_FREE:
4539 	case CISSQ_NOTIFY:
4540 	    bcopy(&sc->ciss_qstat[cr->cs_item], &cr->cs_qstat,
4541 		sizeof(struct ciss_qstat));
4542 	    break;
4543 	default:
4544 	    error = ENOIOCTL;
4545 	    break;
4546 	}
4547 
4548 	break;
4549     }
4550 
4551     case CCISS_GETPCIINFO:
4552     {
4553 	cciss_pci_info_struct	*pis = (cciss_pci_info_struct *)addr;
4554 
4555 	pis->bus = pci_get_bus(sc->ciss_dev);
4556 	pis->dev_fn = pci_get_slot(sc->ciss_dev);
4557         pis->board_id = (pci_get_subvendor(sc->ciss_dev) << 16) |
4558                 pci_get_subdevice(sc->ciss_dev);
4559 
4560 	break;
4561     }
4562 
4563     case CCISS_GETINTINFO:
4564     {
4565 	cciss_coalint_struct	*cis = (cciss_coalint_struct *)addr;
4566 
4567 	cis->delay = sc->ciss_cfg->interrupt_coalesce_delay;
4568 	cis->count = sc->ciss_cfg->interrupt_coalesce_count;
4569 
4570 	break;
4571     }
4572 
4573     case CCISS_SETINTINFO:
4574     {
4575 	cciss_coalint_struct	*cis = (cciss_coalint_struct *)addr;
4576 
4577 	if ((cis->delay == 0) && (cis->count == 0)) {
4578 	    error = EINVAL;
4579 	    break;
4580 	}
4581 
4582 	/*
4583 	 * XXX apparently this is only safe if the controller is idle,
4584 	 *     we should suspend it before doing this.
4585 	 */
4586 	sc->ciss_cfg->interrupt_coalesce_delay = cis->delay;
4587 	sc->ciss_cfg->interrupt_coalesce_count = cis->count;
4588 
4589 	if (ciss_update_config(sc))
4590 	    error = EIO;
4591 
4592 	/* XXX resume the controller here */
4593 	break;
4594     }
4595 
4596     case CCISS_GETNODENAME:
4597 	bcopy(sc->ciss_cfg->server_name, (NodeName_type *)addr,
4598 	      sizeof(NodeName_type));
4599 	break;
4600 
4601     case CCISS_SETNODENAME:
4602 	bcopy((NodeName_type *)addr, sc->ciss_cfg->server_name,
4603 	      sizeof(NodeName_type));
4604 	if (ciss_update_config(sc))
4605 	    error = EIO;
4606 	break;
4607 
4608     case CCISS_GETHEARTBEAT:
4609 	*(Heartbeat_type *)addr = sc->ciss_cfg->heartbeat;
4610 	break;
4611 
4612     case CCISS_GETBUSTYPES:
4613 	*(BusTypes_type *)addr = sc->ciss_cfg->bus_types;
4614 	break;
4615 
4616     case CCISS_GETFIRMVER:
4617 	bcopy(sc->ciss_id->running_firmware_revision, (FirmwareVer_type *)addr,
4618 	      sizeof(FirmwareVer_type));
4619 	break;
4620 
4621     case CCISS_GETDRIVERVER:
4622 	*(DriverVer_type *)addr = CISS_DRIVER_VERSION;
4623 	break;
4624 
4625     case CCISS_REVALIDVOLS:
4626 	/*
4627 	 * This is a bit ugly; to do it "right" we really need
4628 	 * to find any disks that have changed, kick CAM off them,
4629 	 * then rescan only these disks.  It'd be nice if they
4630 	 * a) told us which disk(s) they were going to play with,
4631 	 * and b) which ones had arrived. 8(
4632 	 */
4633 	break;
4634 
4635 #ifdef __amd64__
4636     case CCISS_PASSTHRU32:
4637 	ioc_swab.LUN_info	= ioc32->LUN_info;
4638 	ioc_swab.Request	= ioc32->Request;
4639 	ioc_swab.error_info	= ioc32->error_info;
4640 	ioc_swab.buf_size	= ioc32->buf_size;
4641 	ioc_swab.buf		= (u_int8_t *)(uintptr_t)ioc32->buf;
4642 	ioc			= &ioc_swab;
4643 	/* FALLTHROUGH */
4644 #endif
4645 
4646     case CCISS_PASSTHRU:
4647 	error = ciss_user_command(sc, ioc);
4648 	break;
4649 
4650     default:
4651 	debug(0, "unknown ioctl 0x%lx", cmd);
4652 
4653 	debug(1, "CCISS_GETPCIINFO:   0x%lx", CCISS_GETPCIINFO);
4654 	debug(1, "CCISS_GETINTINFO:   0x%lx", CCISS_GETINTINFO);
4655 	debug(1, "CCISS_SETINTINFO:   0x%lx", CCISS_SETINTINFO);
4656 	debug(1, "CCISS_GETNODENAME:  0x%lx", CCISS_GETNODENAME);
4657 	debug(1, "CCISS_SETNODENAME:  0x%lx", CCISS_SETNODENAME);
4658 	debug(1, "CCISS_GETHEARTBEAT: 0x%lx", CCISS_GETHEARTBEAT);
4659 	debug(1, "CCISS_GETBUSTYPES:  0x%lx", CCISS_GETBUSTYPES);
4660 	debug(1, "CCISS_GETFIRMVER:   0x%lx", CCISS_GETFIRMVER);
4661 	debug(1, "CCISS_GETDRIVERVER: 0x%lx", CCISS_GETDRIVERVER);
4662 	debug(1, "CCISS_REVALIDVOLS:  0x%lx", CCISS_REVALIDVOLS);
4663 	debug(1, "CCISS_PASSTHRU:     0x%lx", CCISS_PASSTHRU);
4664 
4665 	error = ENOIOCTL;
4666 	break;
4667     }
4668 
4669     mtx_unlock(&sc->ciss_mtx);
4670     return(error);
4671 }
4672