xref: /freebsd/sys/dev/ciss/ciss.c (revision ceaec73d406831b1251babb61675df0a1aa54a31)
1 /*-
2  * Copyright (c) 2001 Michael Smith
3  * Copyright (c) 2004 Paul Saab
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  *
27  *	$FreeBSD$
28  */
29 
30 /*
31  * Common Interface for SCSI-3 Support driver.
32  *
33  * CISS claims to provide a common interface between a generic SCSI
34  * transport and an intelligent host adapter.
35  *
36  * This driver supports CISS as defined in the document "CISS Command
37  * Interface for SCSI-3 Support Open Specification", Version 1.04,
38  * Valence Number 1, dated 20001127, produced by Compaq Computer
39  * Corporation.  This document appears to be a hastily and somewhat
40  * arbitrarlily cut-down version of a larger (and probably even more
41  * chaotic and inconsistent) Compaq internal document.  Various
42  * details were also gleaned from Compaq's "cciss" driver for Linux.
43  *
44  * We provide a shim layer between the CISS interface and CAM,
45  * offloading most of the queueing and being-a-disk chores onto CAM.
46  * Entry to the driver is via the PCI bus attachment (ciss_probe,
47  * ciss_attach, etc) and via the CAM interface (ciss_cam_action,
48  * ciss_cam_poll).  The Compaq CISS adapters are, however, poor SCSI
49  * citizens and we have to fake up some responses to get reasonable
50  * behaviour out of them.  In addition, the CISS command set is by no
51  * means adequate to support the functionality of a RAID controller,
52  * and thus the supported Compaq adapters utilise portions of the
53  * control protocol from earlier Compaq adapter families.
54  *
55  * Note that we only support the "simple" transport layer over PCI.
56  * This interface (ab)uses the I2O register set (specifically the post
57  * queues) to exchange commands with the adapter.  Other interfaces
58  * are available, but we aren't supposed to know about them, and it is
59  * dubious whether they would provide major performance improvements
60  * except under extreme load.
61  *
62  * Currently the only supported CISS adapters are the Compaq Smart
63  * Array 5* series (5300, 5i, 532).  Even with only three adapters,
64  * Compaq still manage to have interface variations.
65  *
66  *
67  * Thanks must go to Fred Harris and Darryl DeVinney at Compaq, as
68  * well as Paul Saab at Yahoo! for their assistance in making this
69  * driver happen.
70  *
71  * More thanks must go to John Cagle at HP for the countless hours
72  * spent making this driver "work" with the MSA* series storage
73  * enclosures.  Without his help (and nagging), this driver could not
74  * be used with these enclosures.
75  */
76 
77 #include <sys/param.h>
78 #include <sys/systm.h>
79 #include <sys/malloc.h>
80 #include <sys/kernel.h>
81 #include <sys/bus.h>
82 #include <sys/conf.h>
83 #include <sys/stat.h>
84 #include <sys/kthread.h>
85 #include <sys/queue.h>
86 
87 #include <cam/cam.h>
88 #include <cam/cam_ccb.h>
89 #include <cam/cam_periph.h>
90 #include <cam/cam_sim.h>
91 #include <cam/cam_xpt_sim.h>
92 #include <cam/scsi/scsi_all.h>
93 #include <cam/scsi/scsi_message.h>
94 
95 #include <machine/clock.h>
96 #include <machine/bus_memio.h>
97 #include <machine/bus.h>
98 #include <machine/endian.h>
99 #include <machine/resource.h>
100 #include <sys/rman.h>
101 
102 #include <dev/pci/pcireg.h>
103 #include <dev/pci/pcivar.h>
104 
105 #include <dev/ciss/cissreg.h>
106 #include <dev/ciss/cissvar.h>
107 #include <dev/ciss/cissio.h>
108 
109 MALLOC_DEFINE(CISS_MALLOC_CLASS, "ciss_data", "ciss internal data buffers");
110 
111 /* pci interface */
112 static int	ciss_lookup(device_t dev);
113 static int	ciss_probe(device_t dev);
114 static int	ciss_attach(device_t dev);
115 static int	ciss_detach(device_t dev);
116 static int	ciss_shutdown(device_t dev);
117 
118 /* (de)initialisation functions, control wrappers */
119 static int	ciss_init_pci(struct ciss_softc *sc);
120 static int	ciss_wait_adapter(struct ciss_softc *sc);
121 static int	ciss_flush_adapter(struct ciss_softc *sc);
122 static int	ciss_init_requests(struct ciss_softc *sc);
123 static void	ciss_command_map_helper(void *arg, bus_dma_segment_t *segs,
124 					int nseg, int error);
125 static int	ciss_identify_adapter(struct ciss_softc *sc);
126 static int	ciss_init_logical(struct ciss_softc *sc);
127 static int	ciss_init_physical(struct ciss_softc *sc);
128 static int	ciss_filter_physical(struct ciss_softc *sc, struct ciss_lun_report *cll);
129 static int	ciss_identify_logical(struct ciss_softc *sc, struct ciss_ldrive *ld);
130 static int	ciss_get_ldrive_status(struct ciss_softc *sc,  struct ciss_ldrive *ld);
131 static int	ciss_update_config(struct ciss_softc *sc);
132 static int	ciss_accept_media(struct ciss_softc *sc, struct ciss_ldrive *ld);
133 static void	ciss_free(struct ciss_softc *sc);
134 static void	ciss_spawn_notify_thread(struct ciss_softc *sc);
135 static void	ciss_kill_notify_thread(struct ciss_softc *sc);
136 
137 /* request submission/completion */
138 static int	ciss_start(struct ciss_request *cr);
139 static void	ciss_done(struct ciss_softc *sc);
140 static void	ciss_intr(void *arg);
141 static void	ciss_complete(struct ciss_softc *sc);
142 static int	ciss_report_request(struct ciss_request *cr, int *command_status,
143 				    int *scsi_status);
144 static int	ciss_synch_request(struct ciss_request *cr, int timeout);
145 static int	ciss_poll_request(struct ciss_request *cr, int timeout);
146 static int	ciss_wait_request(struct ciss_request *cr, int timeout);
147 #if 0
148 static int	ciss_abort_request(struct ciss_request *cr);
149 #endif
150 
151 /* request queueing */
152 static int	ciss_get_request(struct ciss_softc *sc, struct ciss_request **crp);
153 static void	ciss_preen_command(struct ciss_request *cr);
154 static void 	ciss_release_request(struct ciss_request *cr);
155 
156 /* request helpers */
157 static int	ciss_get_bmic_request(struct ciss_softc *sc, struct ciss_request **crp,
158 				      int opcode, void **bufp, size_t bufsize);
159 static int	ciss_user_command(struct ciss_softc *sc, IOCTL_Command_struct *ioc);
160 
161 /* DMA map/unmap */
162 static int	ciss_map_request(struct ciss_request *cr);
163 static void	ciss_request_map_helper(void *arg, bus_dma_segment_t *segs,
164 					int nseg, int error);
165 static void	ciss_unmap_request(struct ciss_request *cr);
166 
167 /* CAM interface */
168 static int	ciss_cam_init(struct ciss_softc *sc);
169 static void	ciss_cam_rescan_target(struct ciss_softc *sc,
170 				       int bus, int target);
171 static void	ciss_cam_rescan_all(struct ciss_softc *sc);
172 static void	ciss_cam_rescan_callback(struct cam_periph *periph, union ccb *ccb);
173 static void	ciss_cam_action(struct cam_sim *sim, union ccb *ccb);
174 static int	ciss_cam_action_io(struct cam_sim *sim, struct ccb_scsiio *csio);
175 static int	ciss_cam_emulate(struct ciss_softc *sc, struct ccb_scsiio *csio);
176 static void	ciss_cam_poll(struct cam_sim *sim);
177 static void	ciss_cam_complete(struct ciss_request *cr);
178 static void	ciss_cam_complete_fixup(struct ciss_softc *sc, struct ccb_scsiio *csio);
179 static struct cam_periph *ciss_find_periph(struct ciss_softc *sc,
180 					   int bus, int target);
181 static int	ciss_name_device(struct ciss_softc *sc, int bus, int target);
182 
183 /* periodic status monitoring */
184 static void	ciss_periodic(void *arg);
185 static void	ciss_notify_event(struct ciss_softc *sc);
186 static void	ciss_notify_complete(struct ciss_request *cr);
187 static int	ciss_notify_abort(struct ciss_softc *sc);
188 static int	ciss_notify_abort_bmic(struct ciss_softc *sc);
189 static void	ciss_notify_hotplug(struct ciss_softc *sc, struct ciss_notify *cn);
190 static void	ciss_notify_logical(struct ciss_softc *sc, struct ciss_notify *cn);
191 static void	ciss_notify_physical(struct ciss_softc *sc, struct ciss_notify *cn);
192 
193 /* debugging output */
194 static void	ciss_print_request(struct ciss_request *cr);
195 static void	ciss_print_ldrive(struct ciss_softc *sc, struct ciss_ldrive *ld);
196 static const char *ciss_name_ldrive_status(int status);
197 static int	ciss_decode_ldrive_status(int status);
198 static const char *ciss_name_ldrive_org(int org);
199 static const char *ciss_name_command_status(int status);
200 
201 /*
202  * PCI bus interface.
203  */
204 static device_method_t ciss_methods[] = {
205     /* Device interface */
206     DEVMETHOD(device_probe,	ciss_probe),
207     DEVMETHOD(device_attach,	ciss_attach),
208     DEVMETHOD(device_detach,	ciss_detach),
209     DEVMETHOD(device_shutdown,	ciss_shutdown),
210     { 0, 0 }
211 };
212 
213 static driver_t ciss_pci_driver = {
214     "ciss",
215     ciss_methods,
216     sizeof(struct ciss_softc)
217 };
218 
219 static devclass_t	ciss_devclass;
220 DRIVER_MODULE(ciss, pci, ciss_pci_driver, ciss_devclass, 0, 0);
221 
222 /*
223  * Control device interface.
224  */
225 static d_open_t		ciss_open;
226 static d_close_t	ciss_close;
227 static d_ioctl_t	ciss_ioctl;
228 
229 static struct cdevsw ciss_cdevsw = {
230 	.d_version =	D_VERSION,
231 	.d_flags =	D_NEEDGIANT,
232 	.d_open =	ciss_open,
233 	.d_close =	ciss_close,
234 	.d_ioctl =	ciss_ioctl,
235 	.d_name =	"ciss",
236 };
237 
238 /*
239  * This tunable can be set at boot time and controls whether physical devices
240  * that are marked hidden by the firmware should be exposed anyways.
241  */
242 static unsigned int ciss_expose_hidden_physical = 0;
243 TUNABLE_INT("hw.ciss.expose_hidden_physical", &ciss_expose_hidden_physical);
244 
245 /************************************************************************
246  * CISS adapters amazingly don't have a defined programming interface
247  * value.  (One could say some very despairing things about PCI and
248  * people just not getting the general idea.)  So we are forced to
249  * stick with matching against subvendor/subdevice, and thus have to
250  * be updated for every new CISS adapter that appears.
251  */
252 #define CISS_BOARD_SA5	(1<<0)
253 #define CISS_BOARD_SA5B	(1<<1)
254 
255 static struct
256 {
257     u_int16_t	subvendor;
258     u_int16_t	subdevice;
259     int		flags;
260     char	*desc;
261 } ciss_vendor_data[] = {
262     { 0x0e11, 0x4070, CISS_BOARD_SA5,	"Compaq Smart Array 5300" },
263     { 0x0e11, 0x4080, CISS_BOARD_SA5B,	"Compaq Smart Array 5i" },
264     { 0x0e11, 0x4082, CISS_BOARD_SA5B,	"Compaq Smart Array 532" },
265     { 0x0e11, 0x4083, CISS_BOARD_SA5B,	"HP Smart Array 5312" },
266     { 0x0e11, 0x4091, CISS_BOARD_SA5,	"HP Smart Array 6i" },
267     { 0x0e11, 0x409A, CISS_BOARD_SA5,	"HP Smart Array 641" },
268     { 0x0e11, 0x409B, CISS_BOARD_SA5,	"HP Smart Array 642" },
269     { 0x0e11, 0x409C, CISS_BOARD_SA5,	"HP Smart Array 6400" },
270     { 0x0e11, 0x409D, CISS_BOARD_SA5,	"HP Smart Array 6400 EM" },
271     { 0x103C, 0x3220, CISS_BOARD_SA5,	"HP Smart Array" },
272     { 0x103C, 0x3222, CISS_BOARD_SA5,	"HP Smart Array" },
273     { 0x103C, 0x3225, CISS_BOARD_SA5,	"HP Smart Array P600" },
274     { 0x103C, 0x3230, CISS_BOARD_SA5,	"HP Smart Array" },
275     { 0x103C, 0x3231, CISS_BOARD_SA5,	"HP Smart Array" },
276     { 0x103C, 0x3232, CISS_BOARD_SA5,	"HP Smart Array" },
277     { 0x103C, 0x3233, CISS_BOARD_SA5,	"HP Smart Array" },
278     { 0x103C, 0x3234, CISS_BOARD_SA5,	"HP Smart Array" },
279     { 0x103C, 0x3235, CISS_BOARD_SA5,	"HP Smart Array" },
280     { 0x103C, 0x3236, CISS_BOARD_SA5,	"HP Smart Array" },
281     { 0x103C, 0x3237, CISS_BOARD_SA5,	"HP Smart Array" },
282     { 0x103C, 0x3238, CISS_BOARD_SA5,	"HP Smart Array" },
283     { 0x103C, 0x3239, CISS_BOARD_SA5,	"HP Smart Array" },
284     { 0x103C, 0x323A, CISS_BOARD_SA5,	"HP Smart Array" },
285     { 0x103C, 0x323B, CISS_BOARD_SA5,	"HP Smart Array" },
286     { 0x103C, 0x323C, CISS_BOARD_SA5,	"HP Smart Array" },
287     { 0, 0, 0, NULL }
288 };
289 
290 /************************************************************************
291  * Find a match for the device in our list of known adapters.
292  */
293 static int
294 ciss_lookup(device_t dev)
295 {
296     int 	i;
297 
298     for (i = 0; ciss_vendor_data[i].desc != NULL; i++)
299 	if ((pci_get_subvendor(dev) == ciss_vendor_data[i].subvendor) &&
300 	    (pci_get_subdevice(dev) == ciss_vendor_data[i].subdevice)) {
301 	    return(i);
302 	}
303     return(-1);
304 }
305 
306 /************************************************************************
307  * Match a known CISS adapter.
308  */
309 static int
310 ciss_probe(device_t dev)
311 {
312     int		i;
313 
314     i = ciss_lookup(dev);
315     if (i != -1) {
316 	device_set_desc(dev, ciss_vendor_data[i].desc);
317 	return(BUS_PROBE_DEFAULT);
318     }
319     return(ENOENT);
320 }
321 
322 /************************************************************************
323  * Attach the driver to this adapter.
324  */
325 static int
326 ciss_attach(device_t dev)
327 {
328     struct ciss_softc	*sc;
329     int			i, error;
330 
331     debug_called(1);
332 
333 #ifdef CISS_DEBUG
334     /* print structure/union sizes */
335     debug_struct(ciss_command);
336     debug_struct(ciss_header);
337     debug_union(ciss_device_address);
338     debug_struct(ciss_cdb);
339     debug_struct(ciss_report_cdb);
340     debug_struct(ciss_notify_cdb);
341     debug_struct(ciss_notify);
342     debug_struct(ciss_message_cdb);
343     debug_struct(ciss_error_info_pointer);
344     debug_struct(ciss_error_info);
345     debug_struct(ciss_sg_entry);
346     debug_struct(ciss_config_table);
347     debug_struct(ciss_bmic_cdb);
348     debug_struct(ciss_bmic_id_ldrive);
349     debug_struct(ciss_bmic_id_lstatus);
350     debug_struct(ciss_bmic_id_table);
351     debug_struct(ciss_bmic_id_pdrive);
352     debug_struct(ciss_bmic_blink_pdrive);
353     debug_struct(ciss_bmic_flush_cache);
354     debug_const(CISS_MAX_REQUESTS);
355     debug_const(CISS_MAX_LOGICAL);
356     debug_const(CISS_INTERRUPT_COALESCE_DELAY);
357     debug_const(CISS_INTERRUPT_COALESCE_COUNT);
358     debug_const(CISS_COMMAND_ALLOC_SIZE);
359     debug_const(CISS_COMMAND_SG_LENGTH);
360 
361     debug_type(cciss_pci_info_struct);
362     debug_type(cciss_coalint_struct);
363     debug_type(cciss_coalint_struct);
364     debug_type(NodeName_type);
365     debug_type(NodeName_type);
366     debug_type(Heartbeat_type);
367     debug_type(BusTypes_type);
368     debug_type(FirmwareVer_type);
369     debug_type(DriverVer_type);
370     debug_type(IOCTL_Command_struct);
371 #endif
372 
373     sc = device_get_softc(dev);
374     sc->ciss_dev = dev;
375 
376     /*
377      * Work out adapter type.
378      */
379     i = ciss_lookup(dev);
380     if (i < 0) {
381 	ciss_printf(sc, "unknown adapter type\n");
382 	error = ENXIO;
383 	goto out;
384     }
385     if (ciss_vendor_data[i].flags & CISS_BOARD_SA5) {
386 	sc->ciss_interrupt_mask = CISS_TL_SIMPLE_INTR_OPQ_SA5;
387     } else if (ciss_vendor_data[i].flags & CISS_BOARD_SA5B) {
388 	sc->ciss_interrupt_mask = CISS_TL_SIMPLE_INTR_OPQ_SA5B;
389     } else {
390 	/* really an error on our part */
391 	ciss_printf(sc, "unable to determine hardware type\n");
392 	error = ENXIO;
393 	goto out;
394     }
395 
396     /*
397      * Do PCI-specific init.
398      */
399     if ((error = ciss_init_pci(sc)) != 0)
400 	goto out;
401 
402     /*
403      * Initialise driver queues.
404      */
405     ciss_initq_free(sc);
406     ciss_initq_busy(sc);
407     ciss_initq_complete(sc);
408     ciss_initq_notify(sc);
409 
410     /*
411      * Initialise command/request pool.
412      */
413     if ((error = ciss_init_requests(sc)) != 0)
414 	goto out;
415 
416     /*
417      * Get adapter information.
418      */
419     if ((error = ciss_identify_adapter(sc)) != 0)
420 	goto out;
421 
422     /*
423      * Find all the physical devices.
424      */
425     if ((error = ciss_init_physical(sc)) != 0)
426 	goto out;
427 
428     /*
429      * Build our private table of logical devices.
430      */
431     if ((error = ciss_init_logical(sc)) != 0)
432 	goto out;
433 
434     /*
435      * Enable interrupts so that the CAM scan can complete.
436      */
437     CISS_TL_SIMPLE_ENABLE_INTERRUPTS(sc);
438 
439     /*
440      * Initialise the CAM interface.
441      */
442     if ((error = ciss_cam_init(sc)) != 0)
443 	goto out;
444 
445     /*
446      * Start the heartbeat routine and event chain.
447      */
448     ciss_periodic(sc);
449 
450    /*
451      * Create the control device.
452      */
453     sc->ciss_dev_t = make_dev(&ciss_cdevsw, device_get_unit(sc->ciss_dev),
454 			      UID_ROOT, GID_OPERATOR, S_IRUSR | S_IWUSR,
455 			      "ciss%d", device_get_unit(sc->ciss_dev));
456     sc->ciss_dev_t->si_drv1 = sc;
457 
458     /*
459      * The adapter is running; synchronous commands can now sleep
460      * waiting for an interrupt to signal completion.
461      */
462     sc->ciss_flags |= CISS_FLAG_RUNNING;
463 
464     ciss_spawn_notify_thread(sc);
465 
466     error = 0;
467  out:
468     if (error != 0)
469 	ciss_free(sc);
470     return(error);
471 }
472 
473 /************************************************************************
474  * Detach the driver from this adapter.
475  */
476 static int
477 ciss_detach(device_t dev)
478 {
479     struct ciss_softc	*sc = device_get_softc(dev);
480 
481     debug_called(1);
482 
483     if (sc->ciss_flags & CISS_FLAG_CONTROL_OPEN)
484 	return (EBUSY);
485 
486     /* flush adapter cache */
487     ciss_flush_adapter(sc);
488 
489     /* release all resources */
490     ciss_free(sc);
491 
492     return(0);
493 }
494 
495 /************************************************************************
496  * Prepare adapter for system shutdown.
497  */
498 static int
499 ciss_shutdown(device_t dev)
500 {
501     struct ciss_softc	*sc = device_get_softc(dev);
502 
503     debug_called(1);
504 
505     /* flush adapter cache */
506     ciss_flush_adapter(sc);
507 
508     return(0);
509 }
510 
511 /************************************************************************
512  * Perform PCI-specific attachment actions.
513  */
514 static int
515 ciss_init_pci(struct ciss_softc *sc)
516 {
517     uintptr_t		cbase, csize, cofs;
518     int			error;
519 
520     debug_called(1);
521 
522     /*
523      * Allocate register window first (we need this to find the config
524      * struct).
525      */
526     error = ENXIO;
527     sc->ciss_regs_rid = CISS_TL_SIMPLE_BAR_REGS;
528     if ((sc->ciss_regs_resource =
529 	 bus_alloc_resource_any(sc->ciss_dev, SYS_RES_MEMORY,
530 				&sc->ciss_regs_rid, RF_ACTIVE)) == NULL) {
531 	ciss_printf(sc, "can't allocate register window\n");
532 	return(ENXIO);
533     }
534     sc->ciss_regs_bhandle = rman_get_bushandle(sc->ciss_regs_resource);
535     sc->ciss_regs_btag = rman_get_bustag(sc->ciss_regs_resource);
536 
537     /*
538      * Find the BAR holding the config structure.  If it's not the one
539      * we already mapped for registers, map it too.
540      */
541     sc->ciss_cfg_rid = CISS_TL_SIMPLE_READ(sc, CISS_TL_SIMPLE_CFG_BAR) & 0xffff;
542     if (sc->ciss_cfg_rid != sc->ciss_regs_rid) {
543 	if ((sc->ciss_cfg_resource =
544 	     bus_alloc_resource_any(sc->ciss_dev, SYS_RES_MEMORY,
545 				    &sc->ciss_cfg_rid, RF_ACTIVE)) == NULL) {
546 	    ciss_printf(sc, "can't allocate config window\n");
547 	    return(ENXIO);
548 	}
549 	cbase = (uintptr_t)rman_get_virtual(sc->ciss_cfg_resource);
550 	csize = rman_get_end(sc->ciss_cfg_resource) -
551 	    rman_get_start(sc->ciss_cfg_resource) + 1;
552     } else {
553 	cbase = (uintptr_t)rman_get_virtual(sc->ciss_regs_resource);
554 	csize = rman_get_end(sc->ciss_regs_resource) -
555 	    rman_get_start(sc->ciss_regs_resource) + 1;
556     }
557     cofs = CISS_TL_SIMPLE_READ(sc, CISS_TL_SIMPLE_CFG_OFF);
558 
559     /*
560      * Use the base/size/offset values we just calculated to
561      * sanity-check the config structure.  If it's OK, point to it.
562      */
563     if ((cofs + sizeof(struct ciss_config_table)) > csize) {
564 	ciss_printf(sc, "config table outside window\n");
565 	return(ENXIO);
566     }
567     sc->ciss_cfg = (struct ciss_config_table *)(cbase + cofs);
568     debug(1, "config struct at %p", sc->ciss_cfg);
569 
570     /*
571      * Validate the config structure.  If we supported other transport
572      * methods, we could select amongst them at this point in time.
573      */
574     if (strncmp(sc->ciss_cfg->signature, "CISS", 4)) {
575 	ciss_printf(sc, "config signature mismatch (got '%c%c%c%c')\n",
576 		    sc->ciss_cfg->signature[0], sc->ciss_cfg->signature[1],
577 		    sc->ciss_cfg->signature[2], sc->ciss_cfg->signature[3]);
578 	return(ENXIO);
579     }
580     if ((sc->ciss_cfg->valence < CISS_MIN_VALENCE) ||
581 	(sc->ciss_cfg->valence > CISS_MAX_VALENCE)) {
582 	ciss_printf(sc, "adapter interface specification (%d) unsupported\n",
583 		    sc->ciss_cfg->valence);
584 	return(ENXIO);
585     }
586 
587     /*
588      * Put the board into simple mode, and tell it we're using the low
589      * 4GB of RAM.  Set the default interrupt coalescing options.
590      */
591     if (!(sc->ciss_cfg->supported_methods & CISS_TRANSPORT_METHOD_SIMPLE)) {
592 	ciss_printf(sc, "adapter does not support 'simple' transport layer\n");
593 	return(ENXIO);
594     }
595     sc->ciss_cfg->requested_method = CISS_TRANSPORT_METHOD_SIMPLE;
596     sc->ciss_cfg->command_physlimit = 0;
597     sc->ciss_cfg->interrupt_coalesce_delay = CISS_INTERRUPT_COALESCE_DELAY;
598     sc->ciss_cfg->interrupt_coalesce_count = CISS_INTERRUPT_COALESCE_COUNT;
599 
600 #ifdef __i386__
601     sc->ciss_cfg->host_driver |= CISS_DRIVER_SCSI_PREFETCH;
602 #endif
603 
604     if (ciss_update_config(sc)) {
605 	ciss_printf(sc, "adapter refuses to accept config update (IDBR 0x%x)\n",
606 		    CISS_TL_SIMPLE_READ(sc, CISS_TL_SIMPLE_IDBR));
607 	return(ENXIO);
608     }
609     if (!(sc->ciss_cfg->active_method != CISS_TRANSPORT_METHOD_SIMPLE)) {
610 	ciss_printf(sc,
611 		    "adapter refuses to go into 'simple' transport mode (0x%x, 0x%x)\n",
612 		    sc->ciss_cfg->supported_methods, sc->ciss_cfg->active_method);
613 	return(ENXIO);
614     }
615 
616     /*
617      * Wait for the adapter to come ready.
618      */
619     if ((error = ciss_wait_adapter(sc)) != 0)
620 	return(error);
621 
622     /*
623      * Turn off interrupts before we go routing anything.
624      */
625     CISS_TL_SIMPLE_DISABLE_INTERRUPTS(sc);
626 
627     /*
628      * Allocate and set up our interrupt.
629      */
630     sc->ciss_irq_rid = 0;
631     if ((sc->ciss_irq_resource =
632 	 bus_alloc_resource_any(sc->ciss_dev, SYS_RES_IRQ, &sc->ciss_irq_rid,
633 				RF_ACTIVE | RF_SHAREABLE)) == NULL) {
634 	ciss_printf(sc, "can't allocate interrupt\n");
635 	return(ENXIO);
636     }
637     if (bus_setup_intr(sc->ciss_dev, sc->ciss_irq_resource,
638 		       INTR_TYPE_CAM|INTR_ENTROPY, ciss_intr, sc,
639 		       &sc->ciss_intr)) {
640 	ciss_printf(sc, "can't set up interrupt\n");
641 	return(ENXIO);
642     }
643 
644     /*
645      * Allocate the parent bus DMA tag appropriate for our PCI
646      * interface.
647      *
648      * Note that "simple" adapters can only address within a 32-bit
649      * span.
650      */
651     if (bus_dma_tag_create(NULL, 			/* parent */
652 			   1, 0, 			/* alignment, boundary */
653 			   BUS_SPACE_MAXADDR,		/* lowaddr */
654 			   BUS_SPACE_MAXADDR, 		/* highaddr */
655 			   NULL, NULL, 			/* filter, filterarg */
656 			   BUS_SPACE_MAXSIZE_32BIT,	/* maxsize */
657 			   CISS_COMMAND_SG_LENGTH,	/* nsegments */
658 			   BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
659 			   BUS_DMA_ALLOCNOW,		/* flags */
660 			   NULL, NULL,			/* lockfunc, lockarg */
661 			   &sc->ciss_parent_dmat)) {
662 	ciss_printf(sc, "can't allocate parent DMA tag\n");
663 	return(ENOMEM);
664     }
665 
666     /*
667      * Create DMA tag for mapping buffers into adapter-addressable
668      * space.
669      */
670     if (bus_dma_tag_create(sc->ciss_parent_dmat, 	/* parent */
671 			   1, 0, 			/* alignment, boundary */
672 			   BUS_SPACE_MAXADDR,		/* lowaddr */
673 			   BUS_SPACE_MAXADDR, 		/* highaddr */
674 			   NULL, NULL, 			/* filter, filterarg */
675 			   MAXBSIZE, CISS_COMMAND_SG_LENGTH,	/* maxsize, nsegments */
676 			   BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
677 			   0,				/* flags */
678 			   busdma_lock_mutex, &Giant,	/* lockfunc, lockarg */
679 			   &sc->ciss_buffer_dmat)) {
680 	ciss_printf(sc, "can't allocate buffer DMA tag\n");
681 	return(ENOMEM);
682     }
683     return(0);
684 }
685 
686 /************************************************************************
687  * Wait for the adapter to come ready.
688  */
689 static int
690 ciss_wait_adapter(struct ciss_softc *sc)
691 {
692     int		i;
693 
694     debug_called(1);
695 
696     /*
697      * Wait for the adapter to come ready.
698      */
699     if (!(sc->ciss_cfg->active_method & CISS_TRANSPORT_METHOD_READY)) {
700 	ciss_printf(sc, "waiting for adapter to come ready...\n");
701 	for (i = 0; !(sc->ciss_cfg->active_method & CISS_TRANSPORT_METHOD_READY); i++) {
702 	    DELAY(1000000);	/* one second */
703 	    if (i > 30) {
704 		ciss_printf(sc, "timed out waiting for adapter to come ready\n");
705 		return(EIO);
706 	    }
707 	}
708     }
709     return(0);
710 }
711 
712 /************************************************************************
713  * Flush the adapter cache.
714  */
715 static int
716 ciss_flush_adapter(struct ciss_softc *sc)
717 {
718     struct ciss_request			*cr;
719     struct ciss_bmic_flush_cache	*cbfc;
720     int					error, command_status;
721 
722     debug_called(1);
723 
724     cr = NULL;
725     cbfc = NULL;
726 
727     /*
728      * Build a BMIC request to flush the cache.  We don't disable
729      * it, as we may be going to do more I/O (eg. we are emulating
730      * the Synchronise Cache command).
731      */
732     if ((cbfc = malloc(sizeof(*cbfc), CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO)) == NULL) {
733 	error = ENOMEM;
734 	goto out;
735     }
736     if ((error = ciss_get_bmic_request(sc, &cr, CISS_BMIC_FLUSH_CACHE,
737 				       (void **)&cbfc, sizeof(*cbfc))) != 0)
738 	goto out;
739 
740     /*
741      * Submit the request and wait for it to complete.
742      */
743     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
744 	ciss_printf(sc, "error sending BMIC FLUSH_CACHE command (%d)\n", error);
745 	goto out;
746     }
747 
748     /*
749      * Check response.
750      */
751     ciss_report_request(cr, &command_status, NULL);
752     switch(command_status) {
753     case CISS_CMD_STATUS_SUCCESS:
754 	break;
755     default:
756 	ciss_printf(sc, "error flushing cache (%s)\n",
757 		    ciss_name_command_status(command_status));
758 	error = EIO;
759 	goto out;
760     }
761 
762 out:
763     if (cbfc != NULL)
764 	free(cbfc, CISS_MALLOC_CLASS);
765     if (cr != NULL)
766 	ciss_release_request(cr);
767     return(error);
768 }
769 
770 /************************************************************************
771  * Allocate memory for the adapter command structures, initialise
772  * the request structures.
773  *
774  * Note that the entire set of commands are allocated in a single
775  * contiguous slab.
776  */
777 static int
778 ciss_init_requests(struct ciss_softc *sc)
779 {
780     struct ciss_request	*cr;
781     int			i;
782 
783     debug_called(1);
784 
785     /*
786      * Calculate the number of request structures/commands we are
787      * going to provide for this adapter.
788      */
789     sc->ciss_max_requests = min(CISS_MAX_REQUESTS, sc->ciss_cfg->max_outstanding_commands);
790 
791     if (bootverbose)
792 	ciss_printf(sc, "using %d of %d available commands\n",
793 		    sc->ciss_max_requests, sc->ciss_cfg->max_outstanding_commands);
794 
795     /*
796      * Create the DMA tag for commands.
797      */
798     if (bus_dma_tag_create(sc->ciss_parent_dmat,	/* parent */
799 			   1, 0, 			/* alignment, boundary */
800 			   BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
801 			   BUS_SPACE_MAXADDR, 		/* highaddr */
802 			   NULL, NULL, 			/* filter, filterarg */
803 			   CISS_COMMAND_ALLOC_SIZE *
804 			   sc->ciss_max_requests, 1,	/* maxsize, nsegments */
805 			   BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
806 			   BUS_DMA_ALLOCNOW,		/* flags */
807 			   NULL, NULL,			/* lockfunc, lockarg */
808 			   &sc->ciss_command_dmat)) {
809 	ciss_printf(sc, "can't allocate command DMA tag\n");
810 	return(ENOMEM);
811     }
812     /*
813      * Allocate memory and make it available for DMA.
814      */
815     if (bus_dmamem_alloc(sc->ciss_command_dmat, (void **)&sc->ciss_command,
816 			 BUS_DMA_NOWAIT, &sc->ciss_command_map)) {
817 	ciss_printf(sc, "can't allocate command memory\n");
818 	return(ENOMEM);
819     }
820     bus_dmamap_load(sc->ciss_command_dmat, sc->ciss_command_map, sc->ciss_command,
821 		    CISS_COMMAND_ALLOC_SIZE * sc->ciss_max_requests,
822 		    ciss_command_map_helper, sc, 0);
823     bzero(sc->ciss_command, CISS_COMMAND_ALLOC_SIZE * sc->ciss_max_requests);
824 
825     /*
826      * Set up the request and command structures, push requests onto
827      * the free queue.
828      */
829     for (i = 1; i < sc->ciss_max_requests; i++) {
830 	cr = &sc->ciss_request[i];
831 	cr->cr_sc = sc;
832 	cr->cr_tag = i;
833 	bus_dmamap_create(sc->ciss_buffer_dmat, 0, &cr->cr_datamap);
834 	ciss_enqueue_free(cr);
835     }
836     return(0);
837 }
838 
839 static void
840 ciss_command_map_helper(void *arg, bus_dma_segment_t *segs, int nseg, int error)
841 {
842     struct ciss_softc	*sc = (struct ciss_softc *)arg;
843 
844     sc->ciss_command_phys = segs->ds_addr;
845 }
846 
847 /************************************************************************
848  * Identify the adapter, print some information about it.
849  */
850 static int
851 ciss_identify_adapter(struct ciss_softc *sc)
852 {
853     struct ciss_request	*cr;
854     int			error, command_status;
855 
856     debug_called(1);
857 
858     cr = NULL;
859 
860     /*
861      * Get a request, allocate storage for the adapter data.
862      */
863     if ((error = ciss_get_bmic_request(sc, &cr, CISS_BMIC_ID_CTLR,
864 				       (void **)&sc->ciss_id,
865 				       sizeof(*sc->ciss_id))) != 0)
866 	goto out;
867 
868     /*
869      * Submit the request and wait for it to complete.
870      */
871     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
872 	ciss_printf(sc, "error sending BMIC ID_CTLR command (%d)\n", error);
873 	goto out;
874     }
875 
876     /*
877      * Check response.
878      */
879     ciss_report_request(cr, &command_status, NULL);
880     switch(command_status) {
881     case CISS_CMD_STATUS_SUCCESS:		/* buffer right size */
882 	break;
883     case CISS_CMD_STATUS_DATA_UNDERRUN:
884     case CISS_CMD_STATUS_DATA_OVERRUN:
885 	ciss_printf(sc, "data over/underrun reading adapter information\n");
886     default:
887 	ciss_printf(sc, "error reading adapter information (%s)\n",
888 		    ciss_name_command_status(command_status));
889 	error = EIO;
890 	goto out;
891     }
892 
893     /* sanity-check reply */
894     if (!sc->ciss_id->big_map_supported) {
895 	ciss_printf(sc, "adapter does not support BIG_MAP\n");
896 	error = ENXIO;
897 	goto out;
898     }
899 
900 #if 0
901     /* XXX later revisions may not need this */
902     sc->ciss_flags |= CISS_FLAG_FAKE_SYNCH;
903 #endif
904 
905     /* XXX only really required for old 5300 adapters? */
906     sc->ciss_flags |= CISS_FLAG_BMIC_ABORT;
907 
908     /* print information */
909     if (bootverbose) {
910 #if 0	/* XXX proxy volumes??? */
911 	ciss_printf(sc, "  %d logical drive%s configured\n",
912 		    sc->ciss_id->configured_logical_drives,
913 		    (sc->ciss_id->configured_logical_drives == 1) ? "" : "s");
914 #endif
915 	ciss_printf(sc, "  firmware %4.4s\n", sc->ciss_id->running_firmware_revision);
916 	ciss_printf(sc, "  %d SCSI channels\n", sc->ciss_id->scsi_bus_count);
917 
918 	ciss_printf(sc, "  signature '%.4s'\n", sc->ciss_cfg->signature);
919 	ciss_printf(sc, "  valence %d\n", sc->ciss_cfg->valence);
920 	ciss_printf(sc, "  supported I/O methods 0x%b\n",
921 		    sc->ciss_cfg->supported_methods,
922 		    "\20\1READY\2simple\3performant\4MEMQ\n");
923 	ciss_printf(sc, "  active I/O method 0x%b\n",
924 		    sc->ciss_cfg->active_method, "\20\2simple\3performant\4MEMQ\n");
925 	ciss_printf(sc, "  4G page base 0x%08x\n",
926 		    sc->ciss_cfg->command_physlimit);
927 	ciss_printf(sc, "  interrupt coalesce delay %dus\n",
928 		    sc->ciss_cfg->interrupt_coalesce_delay);
929 	ciss_printf(sc, "  interrupt coalesce count %d\n",
930 		    sc->ciss_cfg->interrupt_coalesce_count);
931 	ciss_printf(sc, "  max outstanding commands %d\n",
932 		    sc->ciss_cfg->max_outstanding_commands);
933 	ciss_printf(sc, "  bus types 0x%b\n", sc->ciss_cfg->bus_types,
934 		    "\20\1ultra2\2ultra3\10fibre1\11fibre2\n");
935 	ciss_printf(sc, "  server name '%.16s'\n", sc->ciss_cfg->server_name);
936 	ciss_printf(sc, "  heartbeat 0x%x\n", sc->ciss_cfg->heartbeat);
937     }
938 
939 out:
940     if (error) {
941 	if (sc->ciss_id != NULL) {
942 	    free(sc->ciss_id, CISS_MALLOC_CLASS);
943 	    sc->ciss_id = NULL;
944 	}
945     }
946     if (cr != NULL)
947 	ciss_release_request(cr);
948     return(error);
949 }
950 
951 /************************************************************************
952  * Helper routine for generating a list of logical and physical luns.
953  */
954 static struct ciss_lun_report *
955 ciss_report_luns(struct ciss_softc *sc, int opcode, int nunits)
956 {
957     struct ciss_request		*cr;
958     struct ciss_command		*cc;
959     struct ciss_report_cdb	*crc;
960     struct ciss_lun_report	*cll;
961     int				command_status;
962     int				report_size;
963     int				error = 0;
964 
965     debug_called(1);
966 
967     cr = NULL;
968     cll = NULL;
969 
970     /*
971      * Get a request, allocate storage for the address list.
972      */
973     if ((error = ciss_get_request(sc, &cr)) != 0)
974 	goto out;
975     report_size = sizeof(*cll) + nunits * sizeof(union ciss_device_address);
976     if ((cll = malloc(report_size, CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO)) == NULL) {
977 	ciss_printf(sc, "can't allocate memory for lun report\n");
978 	error = ENOMEM;
979 	goto out;
980     }
981 
982     /*
983      * Build the Report Logical/Physical LUNs command.
984      */
985     cc = CISS_FIND_COMMAND(cr);
986     cr->cr_data = cll;
987     cr->cr_length = report_size;
988     cr->cr_flags = CISS_REQ_DATAIN;
989 
990     cc->header.address.physical.mode = CISS_HDR_ADDRESS_MODE_PERIPHERAL;
991     cc->header.address.physical.bus = 0;
992     cc->header.address.physical.target = 0;
993     cc->cdb.cdb_length = sizeof(*crc);
994     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
995     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
996     cc->cdb.direction = CISS_CDB_DIRECTION_READ;
997     cc->cdb.timeout = 30;	/* XXX better suggestions? */
998 
999     crc = (struct ciss_report_cdb *)&(cc->cdb.cdb[0]);
1000     bzero(crc, sizeof(*crc));
1001     crc->opcode = opcode;
1002     crc->length = htonl(report_size);			/* big-endian field */
1003     cll->list_size = htonl(report_size - sizeof(*cll));	/* big-endian field */
1004 
1005     /*
1006      * Submit the request and wait for it to complete.  (timeout
1007      * here should be much greater than above)
1008      */
1009     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1010 	ciss_printf(sc, "error sending %d LUN command (%d)\n", opcode, error);
1011 	goto out;
1012     }
1013 
1014     /*
1015      * Check response.  Note that data over/underrun is OK.
1016      */
1017     ciss_report_request(cr, &command_status, NULL);
1018     switch(command_status) {
1019     case CISS_CMD_STATUS_SUCCESS:	/* buffer right size */
1020     case CISS_CMD_STATUS_DATA_UNDERRUN:	/* buffer too large, not bad */
1021 	break;
1022     case CISS_CMD_STATUS_DATA_OVERRUN:
1023 	ciss_printf(sc, "WARNING: more units than driver limit (%d)\n",
1024 		    CISS_MAX_LOGICAL);
1025 	break;
1026     default:
1027 	ciss_printf(sc, "error detecting logical drive configuration (%s)\n",
1028 		    ciss_name_command_status(command_status));
1029 	error = EIO;
1030 	goto out;
1031     }
1032     ciss_release_request(cr);
1033     cr = NULL;
1034 
1035 out:
1036     if (cr != NULL)
1037 	ciss_release_request(cr);
1038     if (error && cll != NULL) {
1039 	free(cll, CISS_MALLOC_CLASS);
1040 	cll = NULL;
1041     }
1042     return(cll);
1043 }
1044 
1045 /************************************************************************
1046  * Find logical drives on the adapter.
1047  */
1048 static int
1049 ciss_init_logical(struct ciss_softc *sc)
1050 {
1051     struct ciss_lun_report	*cll;
1052     int				error = 0, i, j;
1053     int				ndrives;
1054 
1055     debug_called(1);
1056 
1057     cll = ciss_report_luns(sc, CISS_OPCODE_REPORT_LOGICAL_LUNS,
1058 			   CISS_MAX_LOGICAL);
1059     if (cll == NULL) {
1060 	error = ENXIO;
1061 	goto out;
1062     }
1063 
1064     /* sanity-check reply */
1065     ndrives = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
1066     if ((ndrives < 0) || (ndrives >= CISS_MAX_LOGICAL)) {
1067 	ciss_printf(sc, "adapter claims to report absurd number of logical drives (%d > %d)\n",
1068 		    ndrives, CISS_MAX_LOGICAL);
1069 	error = ENXIO;
1070 	goto out;
1071     }
1072 
1073     /*
1074      * Save logical drive information.
1075      */
1076     if (bootverbose) {
1077 	ciss_printf(sc, "%d logical drive%s\n",
1078 	    ndrives, (ndrives > 1 || ndrives == 0) ? "s" : "");
1079     }
1080 
1081     sc->ciss_logical =
1082 	malloc(sc->ciss_max_logical_bus * sizeof(struct ciss_ldrive *),
1083 	       CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
1084     if (sc->ciss_logical == NULL) {
1085 	error = ENXIO;
1086 	goto out;
1087     }
1088 
1089     for (i = 0; i <= sc->ciss_max_logical_bus; i++) {
1090 	sc->ciss_logical[i] =
1091 	    malloc(CISS_MAX_LOGICAL * sizeof(struct ciss_ldrive),
1092 		   CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
1093 	if (sc->ciss_logical[i] == NULL) {
1094 	    error = ENXIO;
1095 	    goto out;
1096 	}
1097 
1098 	for (j = 0; j < CISS_MAX_LOGICAL; j++)
1099 	    sc->ciss_logical[i][j].cl_status = CISS_LD_NONEXISTENT;
1100     }
1101 
1102 
1103     for (i = 0; i < CISS_MAX_LOGICAL; i++) {
1104 	if (i < ndrives) {
1105 	    struct ciss_ldrive	*ld;
1106 	    int			bus, target;
1107 
1108 	    bus		= CISS_LUN_TO_BUS(cll->lun[i].logical.lun);
1109 	    target	= CISS_LUN_TO_TARGET(cll->lun[i].logical.lun);
1110 	    ld		= &sc->ciss_logical[bus][target];
1111 
1112 	    ld->cl_address	= cll->lun[i];
1113 	    ld->cl_controller	= &sc->ciss_controllers[bus];
1114 	    if (ciss_identify_logical(sc, ld) != 0)
1115 		continue;
1116 	    /*
1117 	     * If the drive has had media exchanged, we should bring it online.
1118 	     */
1119 	    if (ld->cl_lstatus->media_exchanged)
1120 		ciss_accept_media(sc, ld);
1121 
1122 	}
1123     }
1124 
1125  out:
1126     if (cll != NULL)
1127 	free(cll, CISS_MALLOC_CLASS);
1128     return(error);
1129 }
1130 
1131 static int
1132 ciss_init_physical(struct ciss_softc *sc)
1133 {
1134     struct ciss_lun_report	*cll;
1135     int				error = 0, i;
1136     int				nphys;
1137     int				bus, target;
1138 
1139     debug_called(1);
1140 
1141     bus = 0;
1142     target = 0;
1143 
1144     cll = ciss_report_luns(sc, CISS_OPCODE_REPORT_PHYSICAL_LUNS,
1145 			   CISS_MAX_PHYSICAL);
1146     if (cll == NULL) {
1147 	error = ENXIO;
1148 	goto out;
1149     }
1150 
1151     nphys = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
1152 
1153     if (bootverbose) {
1154 	ciss_printf(sc, "%d physical device%s\n",
1155 	    nphys, (nphys > 1 || nphys == 0) ? "s" : "");
1156     }
1157 
1158     /*
1159      * Figure out the bus mapping.
1160      * Logical buses include both the local logical bus for local arrays and
1161      * proxy buses for remote arrays.  Physical buses are numbered by the
1162      * controller and represent physical buses that hold physical devices.
1163      * We shift these bus numbers so that everything fits into a single flat
1164      * numbering space for CAM.  Logical buses occupy the first 32 CAM bus
1165      * numbers, and the physical bus numbers are shifted to be above that.
1166      * This results in the various driver arrays being indexed as follows:
1167      *
1168      * ciss_controllers[] - indexed by logical bus
1169      * ciss_cam_sim[]     - indexed by both logical and physical, with physical
1170      *                      being shifted by 32.
1171      * ciss_logical[][]   - indexed by logical bus
1172      * ciss_physical[][]  - indexed by physical bus
1173      *
1174      * XXX This is getting more and more hackish.  CISS really doesn't play
1175      *     well with a standard SCSI model; devices are addressed via magic
1176      *     cookies, not via b/t/l addresses.  Since there is no way to store
1177      *     the cookie in the CAM device object, we have to keep these lookup
1178      *     tables handy so that the devices can be found quickly at the cost
1179      *     of wasting memory and having a convoluted lookup scheme.  This
1180      *     driver should probably be converted to block interface.
1181      */
1182     /*
1183      * If the L2 and L3 SCSI addresses are 0, this signifies a proxy
1184      * controller. A proxy controller is another physical controller
1185      * behind the primary PCI controller. We need to know about this
1186      * so that BMIC commands can be properly targeted.  There can be
1187      * proxy controllers attached to a single PCI controller, so
1188      * find the highest numbered one so the array can be properly
1189      * sized.
1190      */
1191     sc->ciss_max_logical_bus = 1;
1192     for (i = 0; i < nphys; i++) {
1193 	if (cll->lun[i].physical.extra_address == 0) {
1194 	    bus = cll->lun[i].physical.bus;
1195 	    sc->ciss_max_logical_bus = max(sc->ciss_max_logical_bus, bus) + 1;
1196 	} else {
1197 	    bus = CISS_EXTRA_BUS2(cll->lun[i].physical.extra_address);
1198 	    sc->ciss_max_physical_bus = max(sc->ciss_max_physical_bus, bus);
1199 	}
1200     }
1201 
1202     sc->ciss_controllers =
1203 	malloc(sc->ciss_max_logical_bus * sizeof (union ciss_device_address),
1204 	       CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
1205 
1206     if (sc->ciss_controllers == NULL) {
1207 	ciss_printf(sc, "Could not allocate memory for controller map\n");
1208 	error = ENOMEM;
1209 	goto out;
1210     }
1211 
1212     /* setup a map of controller addresses */
1213     for (i = 0; i < nphys; i++) {
1214 	if (cll->lun[i].physical.extra_address == 0) {
1215 	    sc->ciss_controllers[cll->lun[i].physical.bus] = cll->lun[i];
1216 	}
1217     }
1218 
1219     sc->ciss_physical =
1220 	malloc(sc->ciss_max_physical_bus * sizeof(struct ciss_pdrive *),
1221 	       CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
1222     if (sc->ciss_physical == NULL) {
1223 	ciss_printf(sc, "Could not allocate memory for physical device map\n");
1224 	error = ENOMEM;
1225 	goto out;
1226     }
1227 
1228     for (i = 0; i < sc->ciss_max_physical_bus; i++) {
1229 	sc->ciss_physical[i] =
1230 	    malloc(sizeof(struct ciss_pdrive) * CISS_MAX_PHYSTGT,
1231 		   CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
1232 	if (sc->ciss_physical[i] == NULL) {
1233 	    ciss_printf(sc, "Could not allocate memory for target map\n");
1234 	    error = ENOMEM;
1235 	    goto out;
1236 	}
1237     }
1238 
1239     ciss_filter_physical(sc, cll);
1240 
1241 out:
1242     if (cll != NULL)
1243 	free(cll, CISS_MALLOC_CLASS);
1244 
1245     return(error);
1246 }
1247 
1248 static int
1249 ciss_filter_physical(struct ciss_softc *sc, struct ciss_lun_report *cll)
1250 {
1251     u_int32_t ea;
1252     int i, nphys;
1253     int	bus, target;
1254 
1255     nphys = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
1256     for (i = 0; i < nphys; i++) {
1257 	if (cll->lun[i].physical.extra_address == 0)
1258 	    continue;
1259 
1260 	/*
1261 	 * Filter out devices that we don't want.  Level 3 LUNs could
1262 	 * probably be supported, but the docs don't give enough of a
1263 	 * hint to know how.
1264 	 *
1265 	 * The mode field of the physical address is likely set to have
1266 	 * hard disks masked out.  Honor it unless the user has overridden
1267 	 * us with the tunable.  We also munge the inquiry data for these
1268 	 * disks so that they only show up as passthrough devices.  Keeping
1269 	 * them visible in this fashion is useful for doing things like
1270 	 * flashing firmware.
1271 	 */
1272 	ea = cll->lun[i].physical.extra_address;
1273 	if ((CISS_EXTRA_BUS3(ea) != 0) || (CISS_EXTRA_TARGET3(ea) != 0) ||
1274 	    (CISS_EXTRA_MODE2(ea) == 0x3))
1275 	    continue;
1276 	if ((ciss_expose_hidden_physical == 0) &&
1277 	   (cll->lun[i].physical.mode == CISS_HDR_ADDRESS_MODE_MASK_PERIPHERAL))
1278 	    continue;
1279 
1280 	/*
1281 	 * Note: CISS firmware numbers physical busses starting at '1', not
1282 	 *       '0'.  This numbering is internal to the firmware and is only
1283 	 *       used as a hint here.
1284 	 */
1285 	bus = CISS_EXTRA_BUS2(ea) - 1;
1286 	target = CISS_EXTRA_TARGET2(ea);
1287 	sc->ciss_physical[bus][target].cp_address = cll->lun[i];
1288 	sc->ciss_physical[bus][target].cp_online = 1;
1289     }
1290 
1291     return (0);
1292 }
1293 
1294 static int
1295 ciss_inquiry_logical(struct ciss_softc *sc, struct ciss_ldrive *ld)
1296 {
1297     struct ciss_request			*cr;
1298     struct ciss_command			*cc;
1299     struct scsi_inquiry			*inq;
1300     int					error;
1301     int					command_status;
1302 
1303     cr = NULL;
1304 
1305     bzero(&ld->cl_geometry, sizeof(ld->cl_geometry));
1306 
1307     if ((error = ciss_get_request(sc, &cr)) != 0)
1308 	goto out;
1309 
1310     cc = CISS_FIND_COMMAND(cr);
1311     cr->cr_data = &ld->cl_geometry;
1312     cr->cr_length = sizeof(ld->cl_geometry);
1313     cr->cr_flags = CISS_REQ_DATAIN;
1314 
1315     cc->header.address = ld->cl_address;
1316     cc->cdb.cdb_length = 6;
1317     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
1318     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
1319     cc->cdb.direction = CISS_CDB_DIRECTION_READ;
1320     cc->cdb.timeout = 30;
1321 
1322     inq = (struct scsi_inquiry *)&(cc->cdb.cdb[0]);
1323     inq->opcode = INQUIRY;
1324     inq->byte2 = SI_EVPD;
1325     inq->page_code = CISS_VPD_LOGICAL_DRIVE_GEOMETRY;
1326     inq->length = sizeof(ld->cl_geometry);
1327 
1328     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1329 	ciss_printf(sc, "error getting geometry (%d)\n", error);
1330 	goto out;
1331     }
1332 
1333     ciss_report_request(cr, &command_status, NULL);
1334     switch(command_status) {
1335     case CISS_CMD_STATUS_SUCCESS:
1336     case CISS_CMD_STATUS_DATA_UNDERRUN:
1337 	break;
1338     case CISS_CMD_STATUS_DATA_OVERRUN:
1339 	ciss_printf(sc, "WARNING: Data overrun\n");
1340 	break;
1341     default:
1342 	ciss_printf(sc, "Error detecting logical drive geometry (%s)\n",
1343 		    ciss_name_command_status(command_status));
1344 	break;
1345     }
1346 
1347 out:
1348     if (cr != NULL)
1349 	ciss_release_request(cr);
1350     return(error);
1351 }
1352 /************************************************************************
1353  * Identify a logical drive, initialise state related to it.
1354  */
1355 static int
1356 ciss_identify_logical(struct ciss_softc *sc, struct ciss_ldrive *ld)
1357 {
1358     struct ciss_request		*cr;
1359     struct ciss_command		*cc;
1360     struct ciss_bmic_cdb	*cbc;
1361     int				error, command_status;
1362 
1363     debug_called(1);
1364 
1365     cr = NULL;
1366 
1367     /*
1368      * Build a BMIC request to fetch the drive ID.
1369      */
1370     if ((error = ciss_get_bmic_request(sc, &cr, CISS_BMIC_ID_LDRIVE,
1371 				       (void **)&ld->cl_ldrive,
1372 				       sizeof(*ld->cl_ldrive))) != 0)
1373 	goto out;
1374     cc = CISS_FIND_COMMAND(cr);
1375     cc->header.address = *ld->cl_controller;	/* target controller */
1376     cbc = (struct ciss_bmic_cdb *)&(cc->cdb.cdb[0]);
1377     cbc->log_drive = CISS_LUN_TO_TARGET(ld->cl_address.logical.lun);
1378 
1379     /*
1380      * Submit the request and wait for it to complete.
1381      */
1382     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1383 	ciss_printf(sc, "error sending BMIC LDRIVE command (%d)\n", error);
1384 	goto out;
1385     }
1386 
1387     /*
1388      * Check response.
1389      */
1390     ciss_report_request(cr, &command_status, NULL);
1391     switch(command_status) {
1392     case CISS_CMD_STATUS_SUCCESS:		/* buffer right size */
1393 	break;
1394     case CISS_CMD_STATUS_DATA_UNDERRUN:
1395     case CISS_CMD_STATUS_DATA_OVERRUN:
1396 	ciss_printf(sc, "data over/underrun reading logical drive ID\n");
1397     default:
1398 	ciss_printf(sc, "error reading logical drive ID (%s)\n",
1399 		    ciss_name_command_status(command_status));
1400 	error = EIO;
1401 	goto out;
1402     }
1403     ciss_release_request(cr);
1404     cr = NULL;
1405 
1406     /*
1407      * Build a CISS BMIC command to get the logical drive status.
1408      */
1409     if ((error = ciss_get_ldrive_status(sc, ld)) != 0)
1410 	goto out;
1411 
1412     /*
1413      * Get the logical drive geometry.
1414      */
1415     if ((error = ciss_inquiry_logical(sc, ld)) != 0)
1416 	goto out;
1417 
1418     /*
1419      * Print the drive's basic characteristics.
1420      */
1421     if (bootverbose) {
1422 	ciss_printf(sc, "logical drive (b%dt%d): %s, %dMB ",
1423 		    CISS_LUN_TO_BUS(ld->cl_address.logical.lun),
1424 		    CISS_LUN_TO_TARGET(ld->cl_address.logical.lun),
1425 		    ciss_name_ldrive_org(ld->cl_ldrive->fault_tolerance),
1426 		    ((ld->cl_ldrive->blocks_available / (1024 * 1024)) *
1427 		     ld->cl_ldrive->block_size));
1428 
1429 	ciss_print_ldrive(sc, ld);
1430     }
1431 out:
1432     if (error != 0) {
1433 	/* make the drive not-exist */
1434 	ld->cl_status = CISS_LD_NONEXISTENT;
1435 	if (ld->cl_ldrive != NULL) {
1436 	    free(ld->cl_ldrive, CISS_MALLOC_CLASS);
1437 	    ld->cl_ldrive = NULL;
1438 	}
1439 	if (ld->cl_lstatus != NULL) {
1440 	    free(ld->cl_lstatus, CISS_MALLOC_CLASS);
1441 	    ld->cl_lstatus = NULL;
1442 	}
1443     }
1444     if (cr != NULL)
1445 	ciss_release_request(cr);
1446 
1447     return(error);
1448 }
1449 
1450 /************************************************************************
1451  * Get status for a logical drive.
1452  *
1453  * XXX should we also do this in response to Test Unit Ready?
1454  */
1455 static int
1456 ciss_get_ldrive_status(struct ciss_softc *sc,  struct ciss_ldrive *ld)
1457 {
1458     struct ciss_request		*cr;
1459     struct ciss_command		*cc;
1460     struct ciss_bmic_cdb	*cbc;
1461     int				error, command_status;
1462 
1463     /*
1464      * Build a CISS BMIC command to get the logical drive status.
1465      */
1466     if ((error = ciss_get_bmic_request(sc, &cr, CISS_BMIC_ID_LSTATUS,
1467 				       (void **)&ld->cl_lstatus,
1468 				       sizeof(*ld->cl_lstatus))) != 0)
1469 	goto out;
1470     cc = CISS_FIND_COMMAND(cr);
1471     cc->header.address = *ld->cl_controller;	/* target controller */
1472     cbc = (struct ciss_bmic_cdb *)&(cc->cdb.cdb[0]);
1473     cbc->log_drive = CISS_LUN_TO_TARGET(ld->cl_address.logical.lun);
1474 
1475     /*
1476      * Submit the request and wait for it to complete.
1477      */
1478     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1479 	ciss_printf(sc, "error sending BMIC LSTATUS command (%d)\n", error);
1480 	goto out;
1481     }
1482 
1483     /*
1484      * Check response.
1485      */
1486     ciss_report_request(cr, &command_status, NULL);
1487     switch(command_status) {
1488     case CISS_CMD_STATUS_SUCCESS:		/* buffer right size */
1489 	break;
1490     case CISS_CMD_STATUS_DATA_UNDERRUN:
1491     case CISS_CMD_STATUS_DATA_OVERRUN:
1492 	ciss_printf(sc, "data over/underrun reading logical drive status\n");
1493     default:
1494 	ciss_printf(sc, "error reading logical drive status (%s)\n",
1495 		    ciss_name_command_status(command_status));
1496 	error = EIO;
1497 	goto out;
1498     }
1499 
1500     /*
1501      * Set the drive's summary status based on the returned status.
1502      *
1503      * XXX testing shows that a failed JBOD drive comes back at next
1504      * boot in "queued for expansion" mode.  WTF?
1505      */
1506     ld->cl_status = ciss_decode_ldrive_status(ld->cl_lstatus->status);
1507 
1508 out:
1509     if (cr != NULL)
1510 	ciss_release_request(cr);
1511     return(error);
1512 }
1513 
1514 /************************************************************************
1515  * Notify the adapter of a config update.
1516  */
1517 static int
1518 ciss_update_config(struct ciss_softc *sc)
1519 {
1520     int		i;
1521 
1522     debug_called(1);
1523 
1524     CISS_TL_SIMPLE_WRITE(sc, CISS_TL_SIMPLE_IDBR, CISS_TL_SIMPLE_IDBR_CFG_TABLE);
1525     for (i = 0; i < 1000; i++) {
1526 	if (!(CISS_TL_SIMPLE_READ(sc, CISS_TL_SIMPLE_IDBR) &
1527 	      CISS_TL_SIMPLE_IDBR_CFG_TABLE)) {
1528 	    return(0);
1529 	}
1530 	DELAY(1000);
1531     }
1532     return(1);
1533 }
1534 
1535 /************************************************************************
1536  * Accept new media into a logical drive.
1537  *
1538  * XXX The drive has previously been offline; it would be good if we
1539  *     could make sure it's not open right now.
1540  */
1541 static int
1542 ciss_accept_media(struct ciss_softc *sc, struct ciss_ldrive *ld)
1543 {
1544     struct ciss_request		*cr;
1545     struct ciss_command		*cc;
1546     struct ciss_bmic_cdb	*cbc;
1547     int				command_status;
1548     int				error = 0, ldrive;
1549 
1550     ldrive = CISS_LUN_TO_TARGET(ld->cl_address.logical.lun);
1551 
1552     debug(0, "bringing logical drive %d back online");
1553 
1554     /*
1555      * Build a CISS BMIC command to bring the drive back online.
1556      */
1557     if ((error = ciss_get_bmic_request(sc, &cr, CISS_BMIC_ACCEPT_MEDIA,
1558 				       NULL, 0)) != 0)
1559 	goto out;
1560     cc = CISS_FIND_COMMAND(cr);
1561     cc->header.address = *ld->cl_controller;	/* target controller */
1562     cbc = (struct ciss_bmic_cdb *)&(cc->cdb.cdb[0]);
1563     cbc->log_drive = ldrive;
1564 
1565     /*
1566      * Submit the request and wait for it to complete.
1567      */
1568     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
1569 	ciss_printf(sc, "error sending BMIC ACCEPT MEDIA command (%d)\n", error);
1570 	goto out;
1571     }
1572 
1573     /*
1574      * Check response.
1575      */
1576     ciss_report_request(cr, &command_status, NULL);
1577     switch(command_status) {
1578     case CISS_CMD_STATUS_SUCCESS:		/* all OK */
1579 	/* we should get a logical drive status changed event here */
1580 	break;
1581     default:
1582 	ciss_printf(cr->cr_sc, "error accepting media into failed logical drive (%s)\n",
1583 		    ciss_name_command_status(command_status));
1584 	break;
1585     }
1586 
1587 out:
1588     if (cr != NULL)
1589 	ciss_release_request(cr);
1590     return(error);
1591 }
1592 
1593 /************************************************************************
1594  * Release adapter resources.
1595  */
1596 static void
1597 ciss_free(struct ciss_softc *sc)
1598 {
1599     struct ciss_request *cr;
1600     int			i;
1601 
1602     debug_called(1);
1603 
1604     /* we're going away */
1605     sc->ciss_flags |= CISS_FLAG_ABORTING;
1606 
1607     /* terminate the periodic heartbeat routine */
1608     untimeout(ciss_periodic, sc, sc->ciss_periodic);
1609 
1610     /* cancel the Event Notify chain */
1611     ciss_notify_abort(sc);
1612 
1613     ciss_kill_notify_thread(sc);
1614 
1615     /* remove the control device */
1616     if (sc->ciss_dev_t != NULL)
1617 	destroy_dev(sc->ciss_dev_t);
1618 
1619     /* free the controller data */
1620     if (sc->ciss_id != NULL)
1621 	free(sc->ciss_id, CISS_MALLOC_CLASS);
1622 
1623     /* release I/O resources */
1624     if (sc->ciss_regs_resource != NULL)
1625 	bus_release_resource(sc->ciss_dev, SYS_RES_MEMORY,
1626 			     sc->ciss_regs_rid, sc->ciss_regs_resource);
1627     if (sc->ciss_cfg_resource != NULL)
1628 	bus_release_resource(sc->ciss_dev, SYS_RES_MEMORY,
1629 			     sc->ciss_cfg_rid, sc->ciss_cfg_resource);
1630     if (sc->ciss_intr != NULL)
1631 	bus_teardown_intr(sc->ciss_dev, sc->ciss_irq_resource, sc->ciss_intr);
1632     if (sc->ciss_irq_resource != NULL)
1633 	bus_release_resource(sc->ciss_dev, SYS_RES_IRQ,
1634 			     sc->ciss_irq_rid, sc->ciss_irq_resource);
1635 
1636     /* destroy DMA tags */
1637     if (sc->ciss_parent_dmat)
1638 	bus_dma_tag_destroy(sc->ciss_parent_dmat);
1639 
1640     while ((cr = ciss_dequeue_free(sc)) != NULL)
1641 	bus_dmamap_destroy(sc->ciss_buffer_dmat, cr->cr_datamap);
1642     if (sc->ciss_buffer_dmat)
1643 	bus_dma_tag_destroy(sc->ciss_buffer_dmat);
1644 
1645     /* destroy command memory and DMA tag */
1646     if (sc->ciss_command != NULL) {
1647 	bus_dmamap_unload(sc->ciss_command_dmat, sc->ciss_command_map);
1648 	bus_dmamem_free(sc->ciss_command_dmat, sc->ciss_command, sc->ciss_command_map);
1649     }
1650     if (sc->ciss_command_dmat)
1651 	bus_dma_tag_destroy(sc->ciss_command_dmat);
1652 
1653     /* disconnect from CAM */
1654     if (sc->ciss_cam_sim) {
1655 	for (i = 0; i < sc->ciss_max_logical_bus; i++) {
1656 	    if (sc->ciss_cam_sim[i]) {
1657 		xpt_bus_deregister(cam_sim_path(sc->ciss_cam_sim[i]));
1658 		cam_sim_free(sc->ciss_cam_sim[i], 0);
1659 	    }
1660 	}
1661 	for (i = CISS_PHYSICAL_BASE; i < sc->ciss_max_physical_bus +
1662 	     CISS_PHYSICAL_BASE; i++) {
1663 	    if (sc->ciss_cam_sim[i]) {
1664 		xpt_bus_deregister(cam_sim_path(sc->ciss_cam_sim[i]));
1665 		cam_sim_free(sc->ciss_cam_sim[i], 0);
1666 	    }
1667 	}
1668 	free(sc->ciss_cam_sim, CISS_MALLOC_CLASS);
1669     }
1670     if (sc->ciss_cam_devq)
1671 	cam_simq_free(sc->ciss_cam_devq);
1672 
1673     if (sc->ciss_logical) {
1674 	for (i = 0; i < sc->ciss_max_logical_bus; i++)
1675 	    free(sc->ciss_logical[i], CISS_MALLOC_CLASS);
1676 	free(sc->ciss_logical, CISS_MALLOC_CLASS);
1677     }
1678 
1679     if (sc->ciss_physical) {
1680 	for (i = 0; i < sc->ciss_max_physical_bus; i++)
1681 	    free(sc->ciss_physical[i], CISS_MALLOC_CLASS);
1682 	free(sc->ciss_physical, CISS_MALLOC_CLASS);
1683     }
1684 
1685     if (sc->ciss_controllers)
1686 	free(sc->ciss_controllers, CISS_MALLOC_CLASS);
1687 }
1688 
1689 /************************************************************************
1690  * Give a command to the adapter.
1691  *
1692  * Note that this uses the simple transport layer directly.  If we
1693  * want to add support for other layers, we'll need a switch of some
1694  * sort.
1695  *
1696  * Note that the simple transport layer has no way of refusing a
1697  * command; we only have as many request structures as the adapter
1698  * supports commands, so we don't have to check (this presumes that
1699  * the adapter can handle commands as fast as we throw them at it).
1700  */
1701 static int
1702 ciss_start(struct ciss_request *cr)
1703 {
1704     struct ciss_command	*cc;	/* XXX debugging only */
1705     int			error;
1706 
1707     cc = CISS_FIND_COMMAND(cr);
1708     debug(2, "post command %d tag %d ", cr->cr_tag, cc->header.host_tag);
1709 
1710     /*
1711      * Map the request's data.
1712      */
1713     if ((error = ciss_map_request(cr)))
1714 	return(error);
1715 
1716 #if 0
1717     ciss_print_request(cr);
1718 #endif
1719 
1720     return(0);
1721 }
1722 
1723 /************************************************************************
1724  * Fetch completed request(s) from the adapter, queue them for
1725  * completion handling.
1726  *
1727  * Note that this uses the simple transport layer directly.  If we
1728  * want to add support for other layers, we'll need a switch of some
1729  * sort.
1730  *
1731  * Note that the simple transport mechanism does not require any
1732  * reentrancy protection; the OPQ read is atomic.  If there is a
1733  * chance of a race with something else that might move the request
1734  * off the busy list, then we will have to lock against that
1735  * (eg. timeouts, etc.)
1736  */
1737 static void
1738 ciss_done(struct ciss_softc *sc)
1739 {
1740     struct ciss_request	*cr;
1741     struct ciss_command	*cc;
1742     u_int32_t		tag, index;
1743     int			complete;
1744 
1745     debug_called(3);
1746 
1747     /*
1748      * Loop quickly taking requests from the adapter and moving them
1749      * from the busy queue to the completed queue.
1750      */
1751     complete = 0;
1752     for (;;) {
1753 
1754 	/* see if the OPQ contains anything */
1755 	if (!CISS_TL_SIMPLE_OPQ_INTERRUPT(sc))
1756 	    break;
1757 
1758 	tag = CISS_TL_SIMPLE_FETCH_CMD(sc);
1759 	if (tag == CISS_TL_SIMPLE_OPQ_EMPTY)
1760 	    break;
1761 	index = tag >> 2;
1762 	debug(2, "completed command %d%s", index,
1763 	      (tag & CISS_HDR_HOST_TAG_ERROR) ? " with error" : "");
1764 	if (index >= sc->ciss_max_requests) {
1765 	    ciss_printf(sc, "completed invalid request %d (0x%x)\n", index, tag);
1766 	    continue;
1767 	}
1768 	cr = &(sc->ciss_request[index]);
1769 	cc = CISS_FIND_COMMAND(cr);
1770 	cc->header.host_tag = tag;	/* not updated by adapter */
1771 	if (ciss_remove_busy(cr)) {
1772 	    /* assume this is garbage out of the adapter */
1773 	    ciss_printf(sc, "completed nonbusy request %d\n", index);
1774 	} else {
1775 	    ciss_enqueue_complete(cr);
1776 	}
1777 	complete = 1;
1778     }
1779 
1780     /*
1781      * Invoke completion processing.  If we can defer this out of
1782      * interrupt context, that'd be good.
1783      */
1784     if (complete)
1785 	ciss_complete(sc);
1786 }
1787 
1788 /************************************************************************
1789  * Take an interrupt from the adapter.
1790  */
1791 static void
1792 ciss_intr(void *arg)
1793 {
1794     struct ciss_softc	*sc = (struct ciss_softc *)arg;
1795 
1796     /*
1797      * The only interrupt we recognise indicates that there are
1798      * entries in the outbound post queue.
1799      */
1800     ciss_done(sc);
1801 }
1802 
1803 /************************************************************************
1804  * Process completed requests.
1805  *
1806  * Requests can be completed in three fashions:
1807  *
1808  * - by invoking a callback function (cr_complete is non-null)
1809  * - by waking up a sleeper (cr_flags has CISS_REQ_SLEEP set)
1810  * - by clearing the CISS_REQ_POLL flag in interrupt/timeout context
1811  */
1812 static void
1813 ciss_complete(struct ciss_softc *sc)
1814 {
1815     struct ciss_request	*cr;
1816 
1817     debug_called(2);
1818 
1819     /*
1820      * Loop taking requests off the completed queue and performing
1821      * completion processing on them.
1822      */
1823     for (;;) {
1824 	if ((cr = ciss_dequeue_complete(sc)) == NULL)
1825 	    break;
1826 	ciss_unmap_request(cr);
1827 
1828 	/*
1829 	 * If the request has a callback, invoke it.
1830 	 */
1831 	if (cr->cr_complete != NULL) {
1832 	    cr->cr_complete(cr);
1833 	    continue;
1834 	}
1835 
1836 	/*
1837 	 * If someone is sleeping on this request, wake them up.
1838 	 */
1839 	if (cr->cr_flags & CISS_REQ_SLEEP) {
1840 	    cr->cr_flags &= ~CISS_REQ_SLEEP;
1841 	    wakeup(cr);
1842 	    continue;
1843 	}
1844 
1845 	/*
1846 	 * If someone is polling this request for completion, signal.
1847 	 */
1848 	if (cr->cr_flags & CISS_REQ_POLL) {
1849 	    cr->cr_flags &= ~CISS_REQ_POLL;
1850 	    continue;
1851 	}
1852 
1853 	/*
1854 	 * Give up and throw the request back on the free queue.  This
1855 	 * should never happen; resources will probably be lost.
1856 	 */
1857 	ciss_printf(sc, "WARNING: completed command with no submitter\n");
1858 	ciss_enqueue_free(cr);
1859     }
1860 }
1861 
1862 /************************************************************************
1863  * Report on the completion status of a request, and pass back SCSI
1864  * and command status values.
1865  */
1866 static int
1867 ciss_report_request(struct ciss_request *cr, int *command_status, int *scsi_status)
1868 {
1869     struct ciss_command		*cc;
1870     struct ciss_error_info	*ce;
1871 
1872     debug_called(2);
1873 
1874     cc = CISS_FIND_COMMAND(cr);
1875     ce = (struct ciss_error_info *)&(cc->sg[0]);
1876 
1877     /*
1878      * We don't consider data under/overrun an error for the Report
1879      * Logical/Physical LUNs commands.
1880      */
1881     if ((cc->header.host_tag & CISS_HDR_HOST_TAG_ERROR) &&
1882 	((cc->cdb.cdb[0] == CISS_OPCODE_REPORT_LOGICAL_LUNS) ||
1883 	 (cc->cdb.cdb[0] == CISS_OPCODE_REPORT_PHYSICAL_LUNS))) {
1884 	cc->header.host_tag &= ~CISS_HDR_HOST_TAG_ERROR;
1885 	debug(2, "ignoring irrelevant under/overrun error");
1886     }
1887 
1888     /*
1889      * Check the command's error bit, if clear, there's no status and
1890      * everything is OK.
1891      */
1892     if (!(cc->header.host_tag & CISS_HDR_HOST_TAG_ERROR)) {
1893 	if (scsi_status != NULL)
1894 	    *scsi_status = SCSI_STATUS_OK;
1895 	if (command_status != NULL)
1896 	    *command_status = CISS_CMD_STATUS_SUCCESS;
1897 	return(0);
1898     } else {
1899 	if (command_status != NULL)
1900 	    *command_status = ce->command_status;
1901 	if (scsi_status != NULL) {
1902 	    if (ce->command_status == CISS_CMD_STATUS_TARGET_STATUS) {
1903 		*scsi_status = ce->scsi_status;
1904 	    } else {
1905 		*scsi_status = -1;
1906 	    }
1907 	}
1908 	if (bootverbose)
1909 	    ciss_printf(cr->cr_sc, "command status 0x%x (%s) scsi status 0x%x\n",
1910 			ce->command_status, ciss_name_command_status(ce->command_status),
1911 			ce->scsi_status);
1912 	if (ce->command_status == CISS_CMD_STATUS_INVALID_COMMAND) {
1913 	    ciss_printf(cr->cr_sc, "invalid command, offense size %d at %d, value 0x%x\n",
1914 			ce->additional_error_info.invalid_command.offense_size,
1915 			ce->additional_error_info.invalid_command.offense_offset,
1916 			ce->additional_error_info.invalid_command.offense_value);
1917 	}
1918     }
1919 #if 0
1920     ciss_print_request(cr);
1921 #endif
1922     return(1);
1923 }
1924 
1925 /************************************************************************
1926  * Issue a request and don't return until it's completed.
1927  *
1928  * Depending on adapter status, we may poll or sleep waiting for
1929  * completion.
1930  */
1931 static int
1932 ciss_synch_request(struct ciss_request *cr, int timeout)
1933 {
1934     if (cr->cr_sc->ciss_flags & CISS_FLAG_RUNNING) {
1935 	return(ciss_wait_request(cr, timeout));
1936     } else {
1937 	return(ciss_poll_request(cr, timeout));
1938     }
1939 }
1940 
1941 /************************************************************************
1942  * Issue a request and poll for completion.
1943  *
1944  * Timeout in milliseconds.
1945  */
1946 static int
1947 ciss_poll_request(struct ciss_request *cr, int timeout)
1948 {
1949     int		error;
1950 
1951     debug_called(2);
1952 
1953     cr->cr_flags |= CISS_REQ_POLL;
1954     if ((error = ciss_start(cr)) != 0)
1955 	return(error);
1956 
1957     do {
1958 	ciss_done(cr->cr_sc);
1959 	if (!(cr->cr_flags & CISS_REQ_POLL))
1960 	    return(0);
1961 	DELAY(1000);
1962     } while (timeout-- >= 0);
1963     return(EWOULDBLOCK);
1964 }
1965 
1966 /************************************************************************
1967  * Issue a request and sleep waiting for completion.
1968  *
1969  * Timeout in milliseconds.  Note that a spurious wakeup will reset
1970  * the timeout.
1971  */
1972 static int
1973 ciss_wait_request(struct ciss_request *cr, int timeout)
1974 {
1975     int		s, error;
1976 
1977     debug_called(2);
1978 
1979     cr->cr_flags |= CISS_REQ_SLEEP;
1980     if ((error = ciss_start(cr)) != 0)
1981 	return(error);
1982 
1983     s = splcam();
1984     while ((cr->cr_flags & CISS_REQ_SLEEP) && (error != EWOULDBLOCK)) {
1985 	error = tsleep(cr, PRIBIO, "cissREQ", (timeout * hz) / 1000);
1986     }
1987     splx(s);
1988     return(error);
1989 }
1990 
1991 #if 0
1992 /************************************************************************
1993  * Abort a request.  Note that a potential exists here to race the
1994  * request being completed; the caller must deal with this.
1995  */
1996 static int
1997 ciss_abort_request(struct ciss_request *ar)
1998 {
1999     struct ciss_request		*cr;
2000     struct ciss_command		*cc;
2001     struct ciss_message_cdb	*cmc;
2002     int				error;
2003 
2004     debug_called(1);
2005 
2006     /* get a request */
2007     if ((error = ciss_get_request(ar->cr_sc, &cr)) != 0)
2008 	return(error);
2009 
2010     /* build the abort command */
2011     cc = CISS_FIND_COMMAND(cr);
2012     cc->header.address.mode.mode = CISS_HDR_ADDRESS_MODE_PERIPHERAL;	/* addressing? */
2013     cc->header.address.physical.target = 0;
2014     cc->header.address.physical.bus = 0;
2015     cc->cdb.cdb_length = sizeof(*cmc);
2016     cc->cdb.type = CISS_CDB_TYPE_MESSAGE;
2017     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
2018     cc->cdb.direction = CISS_CDB_DIRECTION_NONE;
2019     cc->cdb.timeout = 30;
2020 
2021     cmc = (struct ciss_message_cdb *)&(cc->cdb.cdb[0]);
2022     cmc->opcode = CISS_OPCODE_MESSAGE_ABORT;
2023     cmc->type = CISS_MESSAGE_ABORT_TASK;
2024     cmc->abort_tag = ar->cr_tag;	/* endianness?? */
2025 
2026     /*
2027      * Send the request and wait for a response.  If we believe we
2028      * aborted the request OK, clear the flag that indicates it's
2029      * running.
2030      */
2031     error = ciss_synch_request(cr, 35 * 1000);
2032     if (!error)
2033 	error = ciss_report_request(cr, NULL, NULL);
2034     ciss_release_request(cr);
2035 
2036     return(error);
2037 }
2038 #endif
2039 
2040 
2041 /************************************************************************
2042  * Fetch and initialise a request
2043  */
2044 static int
2045 ciss_get_request(struct ciss_softc *sc, struct ciss_request **crp)
2046 {
2047     struct ciss_request *cr;
2048 
2049     debug_called(2);
2050 
2051     /*
2052      * Get a request and clean it up.
2053      */
2054     if ((cr = ciss_dequeue_free(sc)) == NULL)
2055 	return(ENOMEM);
2056 
2057     cr->cr_data = NULL;
2058     cr->cr_flags = 0;
2059     cr->cr_complete = NULL;
2060     cr->cr_private = NULL;
2061 
2062     ciss_preen_command(cr);
2063     *crp = cr;
2064     return(0);
2065 }
2066 
2067 static void
2068 ciss_preen_command(struct ciss_request *cr)
2069 {
2070     struct ciss_command	*cc;
2071     u_int32_t		cmdphys;
2072 
2073     /*
2074      * Clean up the command structure.
2075      *
2076      * Note that we set up the error_info structure here, since the
2077      * length can be overwritten by any command.
2078      */
2079     cc = CISS_FIND_COMMAND(cr);
2080     cc->header.sg_in_list = 0;		/* kinda inefficient this way */
2081     cc->header.sg_total = 0;
2082     cc->header.host_tag = cr->cr_tag << 2;
2083     cc->header.host_tag_zeroes = 0;
2084     cmdphys = CISS_FIND_COMMANDPHYS(cr);
2085     cc->error_info.error_info_address = cmdphys + sizeof(struct ciss_command);
2086     cc->error_info.error_info_length = CISS_COMMAND_ALLOC_SIZE - sizeof(struct ciss_command);
2087 }
2088 
2089 /************************************************************************
2090  * Release a request to the free list.
2091  */
2092 static void
2093 ciss_release_request(struct ciss_request *cr)
2094 {
2095     struct ciss_softc	*sc;
2096 
2097     debug_called(2);
2098 
2099     sc = cr->cr_sc;
2100 
2101     /* release the request to the free queue */
2102     ciss_requeue_free(cr);
2103 }
2104 
2105 /************************************************************************
2106  * Allocate a request that will be used to send a BMIC command.  Do some
2107  * of the common setup here to avoid duplicating it everywhere else.
2108  */
2109 static int
2110 ciss_get_bmic_request(struct ciss_softc *sc, struct ciss_request **crp,
2111 		      int opcode, void **bufp, size_t bufsize)
2112 {
2113     struct ciss_request		*cr;
2114     struct ciss_command		*cc;
2115     struct ciss_bmic_cdb	*cbc;
2116     void			*buf;
2117     int				error;
2118     int				dataout;
2119 
2120     debug_called(2);
2121 
2122     cr = NULL;
2123     buf = NULL;
2124 
2125     /*
2126      * Get a request.
2127      */
2128     if ((error = ciss_get_request(sc, &cr)) != 0)
2129 	goto out;
2130 
2131     /*
2132      * Allocate data storage if requested, determine the data direction.
2133      */
2134     dataout = 0;
2135     if ((bufsize > 0) && (bufp != NULL)) {
2136 	if (*bufp == NULL) {
2137 	    if ((buf = malloc(bufsize, CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO)) == NULL) {
2138 		error = ENOMEM;
2139 		goto out;
2140 	    }
2141 	} else {
2142 	    buf = *bufp;
2143 	    dataout = 1;	/* we are given a buffer, so we are writing */
2144 	}
2145     }
2146 
2147     /*
2148      * Build a CISS BMIC command to get the logical drive ID.
2149      */
2150     cr->cr_data = buf;
2151     cr->cr_length = bufsize;
2152     if (!dataout)
2153 	cr->cr_flags = CISS_REQ_DATAIN;
2154 
2155     cc = CISS_FIND_COMMAND(cr);
2156     cc->header.address.physical.mode = CISS_HDR_ADDRESS_MODE_PERIPHERAL;
2157     cc->header.address.physical.bus = 0;
2158     cc->header.address.physical.target = 0;
2159     cc->cdb.cdb_length = sizeof(*cbc);
2160     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
2161     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
2162     cc->cdb.direction = dataout ? CISS_CDB_DIRECTION_WRITE : CISS_CDB_DIRECTION_READ;
2163     cc->cdb.timeout = 0;
2164 
2165     cbc = (struct ciss_bmic_cdb *)&(cc->cdb.cdb[0]);
2166     bzero(cbc, sizeof(*cbc));
2167     cbc->opcode = dataout ? CISS_ARRAY_CONTROLLER_WRITE : CISS_ARRAY_CONTROLLER_READ;
2168     cbc->bmic_opcode = opcode;
2169     cbc->size = htons((u_int16_t)bufsize);
2170 
2171 out:
2172     if (error) {
2173 	if (cr != NULL)
2174 	    ciss_release_request(cr);
2175     } else {
2176 	*crp = cr;
2177 	if ((bufp != NULL) && (*bufp == NULL) && (buf != NULL))
2178 	    *bufp = buf;
2179     }
2180     return(error);
2181 }
2182 
2183 /************************************************************************
2184  * Handle a command passed in from userspace.
2185  */
2186 static int
2187 ciss_user_command(struct ciss_softc *sc, IOCTL_Command_struct *ioc)
2188 {
2189     struct ciss_request		*cr;
2190     struct ciss_command		*cc;
2191     struct ciss_error_info	*ce;
2192     int				error = 0;
2193 
2194     debug_called(1);
2195 
2196     cr = NULL;
2197 
2198     /*
2199      * Get a request.
2200      */
2201     if ((error = ciss_get_request(sc, &cr)) != 0)
2202 	goto out;
2203     cc = CISS_FIND_COMMAND(cr);
2204 
2205     /*
2206      * Allocate an in-kernel databuffer if required, copy in user data.
2207      */
2208     cr->cr_length = ioc->buf_size;
2209     if (ioc->buf_size > 0) {
2210 	if ((cr->cr_data = malloc(ioc->buf_size, CISS_MALLOC_CLASS, M_WAITOK)) == NULL) {
2211 	    error = ENOMEM;
2212 	    goto out;
2213 	}
2214 	if ((error = copyin(ioc->buf, cr->cr_data, ioc->buf_size))) {
2215 	    debug(0, "copyin: bad data buffer %p/%d", ioc->buf, ioc->buf_size);
2216 	    goto out;
2217 	}
2218     }
2219 
2220     /*
2221      * Build the request based on the user command.
2222      */
2223     bcopy(&ioc->LUN_info, &cc->header.address, sizeof(cc->header.address));
2224     bcopy(&ioc->Request, &cc->cdb, sizeof(cc->cdb));
2225 
2226     /* XXX anything else to populate here? */
2227 
2228     /*
2229      * Run the command.
2230      */
2231     if ((error = ciss_synch_request(cr, 60 * 1000))) {
2232 	debug(0, "request failed - %d", error);
2233 	goto out;
2234     }
2235 
2236     /*
2237      * Check to see if the command succeeded.
2238      */
2239     ce = (struct ciss_error_info *)&(cc->sg[0]);
2240     if ((cc->header.host_tag & CISS_HDR_HOST_TAG_ERROR) == 0)
2241 	bzero(ce, sizeof(*ce));
2242 
2243     /*
2244      * Copy the results back to the user.
2245      */
2246     bcopy(ce, &ioc->error_info, sizeof(*ce));
2247     if ((ioc->buf_size > 0) &&
2248 	(error = copyout(cr->cr_data, ioc->buf, ioc->buf_size))) {
2249 	debug(0, "copyout: bad data buffer %p/%d", ioc->buf, ioc->buf_size);
2250 	goto out;
2251     }
2252 
2253     /* done OK */
2254     error = 0;
2255 
2256 out:
2257     if ((cr != NULL) && (cr->cr_data != NULL))
2258 	free(cr->cr_data, CISS_MALLOC_CLASS);
2259     if (cr != NULL)
2260 	ciss_release_request(cr);
2261     return(error);
2262 }
2263 
2264 /************************************************************************
2265  * Map a request into bus-visible space, initialise the scatter/gather
2266  * list.
2267  */
2268 static int
2269 ciss_map_request(struct ciss_request *cr)
2270 {
2271     struct ciss_softc	*sc;
2272     int			error = 0;
2273 
2274     debug_called(2);
2275 
2276     sc = cr->cr_sc;
2277 
2278     /* check that mapping is necessary */
2279     if (cr->cr_flags & CISS_REQ_MAPPED)
2280 	return(0);
2281 
2282     cr->cr_flags |= CISS_REQ_MAPPED;
2283 
2284     bus_dmamap_sync(sc->ciss_command_dmat, sc->ciss_command_map,
2285 		    BUS_DMASYNC_PREWRITE);
2286 
2287     if (cr->cr_data != NULL) {
2288 	error = bus_dmamap_load(sc->ciss_buffer_dmat, cr->cr_datamap,
2289 				cr->cr_data, cr->cr_length,
2290 				ciss_request_map_helper, cr, 0);
2291 	if (error != 0)
2292 	    return (error);
2293     } else {
2294 	/*
2295 	 * Post the command to the adapter.
2296 	 */
2297 	ciss_enqueue_busy(cr);
2298 	CISS_TL_SIMPLE_POST_CMD(cr->cr_sc, CISS_FIND_COMMANDPHYS(cr));
2299     }
2300 
2301     return(0);
2302 }
2303 
2304 static void
2305 ciss_request_map_helper(void *arg, bus_dma_segment_t *segs, int nseg, int error)
2306 {
2307     struct ciss_command	*cc;
2308     struct ciss_request *cr;
2309     struct ciss_softc	*sc;
2310     int			i;
2311 
2312     debug_called(2);
2313 
2314     cr = (struct ciss_request *)arg;
2315     sc = cr->cr_sc;
2316     cc = CISS_FIND_COMMAND(cr);
2317 
2318     for (i = 0; i < nseg; i++) {
2319 	cc->sg[i].address = segs[i].ds_addr;
2320 	cc->sg[i].length = segs[i].ds_len;
2321 	cc->sg[i].extension = 0;
2322     }
2323     /* we leave the s/g table entirely within the command */
2324     cc->header.sg_in_list = nseg;
2325     cc->header.sg_total = nseg;
2326 
2327     if (cr->cr_flags & CISS_REQ_DATAIN)
2328 	bus_dmamap_sync(sc->ciss_buffer_dmat, cr->cr_datamap, BUS_DMASYNC_PREREAD);
2329     if (cr->cr_flags & CISS_REQ_DATAOUT)
2330 	bus_dmamap_sync(sc->ciss_buffer_dmat, cr->cr_datamap, BUS_DMASYNC_PREWRITE);
2331 
2332     /*
2333      * Post the command to the adapter.
2334      */
2335     ciss_enqueue_busy(cr);
2336     CISS_TL_SIMPLE_POST_CMD(cr->cr_sc, CISS_FIND_COMMANDPHYS(cr));
2337 }
2338 
2339 /************************************************************************
2340  * Unmap a request from bus-visible space.
2341  */
2342 static void
2343 ciss_unmap_request(struct ciss_request *cr)
2344 {
2345     struct ciss_softc	*sc;
2346 
2347     debug_called(2);
2348 
2349     sc = cr->cr_sc;
2350 
2351     /* check that unmapping is necessary */
2352     if ((cr->cr_flags & CISS_REQ_MAPPED) == 0)
2353 	return;
2354 
2355     bus_dmamap_sync(sc->ciss_command_dmat, sc->ciss_command_map,
2356 		    BUS_DMASYNC_POSTWRITE);
2357 
2358     if (cr->cr_data == NULL)
2359 	goto out;
2360 
2361     if (cr->cr_flags & CISS_REQ_DATAIN)
2362 	bus_dmamap_sync(sc->ciss_buffer_dmat, cr->cr_datamap, BUS_DMASYNC_POSTREAD);
2363     if (cr->cr_flags & CISS_REQ_DATAOUT)
2364 	bus_dmamap_sync(sc->ciss_buffer_dmat, cr->cr_datamap, BUS_DMASYNC_POSTWRITE);
2365 
2366     bus_dmamap_unload(sc->ciss_buffer_dmat, cr->cr_datamap);
2367 out:
2368     cr->cr_flags &= ~CISS_REQ_MAPPED;
2369 }
2370 
2371 /************************************************************************
2372  * Attach the driver to CAM.
2373  *
2374  * We put all the logical drives on a single SCSI bus.
2375  */
2376 static int
2377 ciss_cam_init(struct ciss_softc *sc)
2378 {
2379     int			i, maxbus;
2380 
2381     debug_called(1);
2382 
2383     /*
2384      * Allocate a devq.  We can reuse this for the masked physical
2385      * devices if we decide to export these as well.
2386      */
2387     if ((sc->ciss_cam_devq = cam_simq_alloc(sc->ciss_max_requests)) == NULL) {
2388 	ciss_printf(sc, "can't allocate CAM SIM queue\n");
2389 	return(ENOMEM);
2390     }
2391 
2392     /*
2393      * Create a SIM.
2394      *
2395      * This naturally wastes a bit of memory.  The alternative is to allocate
2396      * and register each bus as it is found, and then track them on a linked
2397      * list.  Unfortunately, the driver has a few places where it needs to
2398      * look up the SIM based solely on bus number, and it's unclear whether
2399      * a list traversal would work for these situations.
2400      */
2401     maxbus = max(sc->ciss_max_logical_bus, sc->ciss_max_physical_bus +
2402 		 CISS_PHYSICAL_BASE);
2403     sc->ciss_cam_sim = malloc(maxbus * sizeof(struct cam_sim*),
2404 			      CISS_MALLOC_CLASS, M_NOWAIT | M_ZERO);
2405     if (sc->ciss_cam_sim == NULL) {
2406 	ciss_printf(sc, "can't allocate memory for controller SIM\n");
2407 	return(ENOMEM);
2408     }
2409 
2410     for (i = 0; i < sc->ciss_max_logical_bus; i++) {
2411 	if ((sc->ciss_cam_sim[i] = cam_sim_alloc(ciss_cam_action, ciss_cam_poll,
2412 						 "ciss", sc,
2413 						 device_get_unit(sc->ciss_dev),
2414 						 sc->ciss_max_requests - 2,
2415 						 1,
2416 						 sc->ciss_cam_devq)) == NULL) {
2417 	    ciss_printf(sc, "can't allocate CAM SIM for controller %d\n", i);
2418 	    return(ENOMEM);
2419 	}
2420 
2421 	/*
2422 	 * Register bus with this SIM.
2423 	 */
2424 	if (i == 0 || sc->ciss_controllers[i].physical.bus != 0) {
2425 	    if (xpt_bus_register(sc->ciss_cam_sim[i], i) != 0) {
2426 		ciss_printf(sc, "can't register SCSI bus %d\n", i);
2427 		return (ENXIO);
2428 	    }
2429 	}
2430     }
2431 
2432     for (i = CISS_PHYSICAL_BASE; i < sc->ciss_max_physical_bus +
2433 	 CISS_PHYSICAL_BASE; i++) {
2434 	if ((sc->ciss_cam_sim[i] = cam_sim_alloc(ciss_cam_action, ciss_cam_poll,
2435 						 "ciss", sc,
2436 						 device_get_unit(sc->ciss_dev),
2437 						 sc->ciss_max_requests - 2,
2438 						 1,
2439 						 sc->ciss_cam_devq)) == NULL) {
2440 	    ciss_printf(sc, "can't allocate CAM SIM for controller %d\n", i);
2441 	    return (ENOMEM);
2442 	}
2443 
2444 	if (xpt_bus_register(sc->ciss_cam_sim[i], i) != 0) {
2445 	    ciss_printf(sc, "can't register SCSI bus %d\n", i);
2446 	    return (ENXIO);
2447 	}
2448     }
2449 
2450     /*
2451      * Initiate a rescan of the bus.
2452      */
2453     ciss_cam_rescan_all(sc);
2454 
2455     return(0);
2456 }
2457 
2458 /************************************************************************
2459  * Initiate a rescan of the 'logical devices' SIM
2460  */
2461 static void
2462 ciss_cam_rescan_target(struct ciss_softc *sc, int bus, int target)
2463 {
2464     struct cam_path	*path;
2465     union ccb		*ccb;
2466 
2467     debug_called(1);
2468 
2469     if ((ccb = malloc(sizeof(union ccb), M_TEMP, M_WAITOK | M_ZERO)) == NULL) {
2470 	ciss_printf(sc, "rescan failed (can't allocate CCB)\n");
2471 	return;
2472     }
2473 
2474     if (xpt_create_path(&path, xpt_periph, cam_sim_path(sc->ciss_cam_sim[bus]),
2475 			target, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
2476 	ciss_printf(sc, "rescan failed (can't create path)\n");
2477 	free(ccb, M_TEMP);
2478 	return;
2479     }
2480 
2481     xpt_setup_ccb(&ccb->ccb_h, path, 5/*priority (low)*/);
2482     ccb->ccb_h.func_code = XPT_SCAN_BUS;
2483     ccb->ccb_h.cbfcnp = ciss_cam_rescan_callback;
2484     ccb->crcn.flags = CAM_FLAG_NONE;
2485     xpt_action(ccb);
2486 
2487     /* scan is now in progress */
2488 }
2489 
2490 static void
2491 ciss_cam_rescan_all(struct ciss_softc *sc)
2492 {
2493     int i;
2494 
2495     /* Rescan the logical buses */
2496     for (i = 0; i < sc->ciss_max_logical_bus; i++)
2497 	ciss_cam_rescan_target(sc, i, CAM_TARGET_WILDCARD);
2498     /* Rescan the physical buses */
2499     for (i = CISS_PHYSICAL_BASE; i < sc->ciss_max_physical_bus +
2500 	 CISS_PHYSICAL_BASE; i++)
2501 	ciss_cam_rescan_target(sc, i, CAM_TARGET_WILDCARD);
2502 }
2503 
2504 static void
2505 ciss_cam_rescan_callback(struct cam_periph *periph, union ccb *ccb)
2506 {
2507     xpt_free_path(ccb->ccb_h.path);
2508     free(ccb, M_TEMP);
2509 }
2510 
2511 /************************************************************************
2512  * Handle requests coming from CAM
2513  */
2514 static void
2515 ciss_cam_action(struct cam_sim *sim, union ccb *ccb)
2516 {
2517     struct ciss_softc	*sc;
2518     struct ccb_scsiio	*csio;
2519     int			bus, target;
2520     int			physical;
2521 
2522     sc = cam_sim_softc(sim);
2523     bus = cam_sim_bus(sim);
2524     csio = (struct ccb_scsiio *)&ccb->csio;
2525     target = csio->ccb_h.target_id;
2526     physical = CISS_IS_PHYSICAL(bus);
2527 
2528     switch (ccb->ccb_h.func_code) {
2529 
2530 	/* perform SCSI I/O */
2531     case XPT_SCSI_IO:
2532 	if (!ciss_cam_action_io(sim, csio))
2533 	    return;
2534 	break;
2535 
2536 	/* perform geometry calculations */
2537     case XPT_CALC_GEOMETRY:
2538     {
2539 	struct ccb_calc_geometry	*ccg = &ccb->ccg;
2540 	struct ciss_ldrive		*ld;
2541 
2542 	debug(1, "XPT_CALC_GEOMETRY %d:%d:%d", cam_sim_bus(sim), ccb->ccb_h.target_id, ccb->ccb_h.target_lun);
2543 
2544 	ld = NULL;
2545 	if (!physical)
2546 	    ld = &sc->ciss_logical[bus][target];
2547 
2548 	/*
2549 	 * Use the cached geometry settings unless the fault tolerance
2550 	 * is invalid.
2551 	 */
2552 	if (physical || ld->cl_geometry.fault_tolerance == 0xFF) {
2553 	    u_int32_t			secs_per_cylinder;
2554 
2555 	    ccg->heads = 255;
2556 	    ccg->secs_per_track = 32;
2557 	    secs_per_cylinder = ccg->heads * ccg->secs_per_track;
2558 	    ccg->cylinders = ccg->volume_size / secs_per_cylinder;
2559 	} else {
2560 	    ccg->heads = ld->cl_geometry.heads;
2561 	    ccg->secs_per_track = ld->cl_geometry.sectors;
2562 	    ccg->cylinders = ntohs(ld->cl_geometry.cylinders);
2563 	}
2564 	ccb->ccb_h.status = CAM_REQ_CMP;
2565         break;
2566     }
2567 
2568 	/* handle path attribute inquiry */
2569     case XPT_PATH_INQ:
2570     {
2571 	struct ccb_pathinq	*cpi = &ccb->cpi;
2572 
2573 	debug(1, "XPT_PATH_INQ %d:%d:%d", cam_sim_bus(sim), ccb->ccb_h.target_id, ccb->ccb_h.target_lun);
2574 
2575 	cpi->version_num = 1;
2576 	cpi->hba_inquiry = PI_TAG_ABLE;	/* XXX is this correct? */
2577 	cpi->target_sprt = 0;
2578 	cpi->hba_misc = 0;
2579 	cpi->max_target = CISS_MAX_LOGICAL;
2580 	cpi->max_lun = 0;		/* 'logical drive' channel only */
2581 	cpi->initiator_id = CISS_MAX_LOGICAL;
2582 	strncpy(cpi->sim_vid, "FreeBSD", SIM_IDLEN);
2583         strncpy(cpi->hba_vid, "msmith@freebsd.org", HBA_IDLEN);
2584         strncpy(cpi->dev_name, cam_sim_name(sim), DEV_IDLEN);
2585         cpi->unit_number = cam_sim_unit(sim);
2586         cpi->bus_id = cam_sim_bus(sim);
2587 	cpi->base_transfer_speed = 132 * 1024;	/* XXX what to set this to? */
2588 	ccb->ccb_h.status = CAM_REQ_CMP;
2589 	break;
2590     }
2591 
2592     case XPT_GET_TRAN_SETTINGS:
2593     {
2594 	struct ccb_trans_settings	*cts = &ccb->cts;
2595 	int				bus, target;
2596 
2597 	bus = cam_sim_bus(sim);
2598 	target = cts->ccb_h.target_id;
2599 
2600 	debug(1, "XPT_GET_TRAN_SETTINGS %d:%d", bus, target);
2601 	cts->valid = 0;
2602 
2603 	/* disconnect always OK */
2604 	cts->flags |= CCB_TRANS_DISC_ENB;
2605 	cts->valid |= CCB_TRANS_DISC_VALID;
2606 
2607 	cts->ccb_h.status = CAM_REQ_CMP;
2608 	break;
2609     }
2610 
2611     default:		/* we can't do this */
2612 	debug(1, "unspported func_code = 0x%x", ccb->ccb_h.func_code);
2613 	ccb->ccb_h.status = CAM_REQ_INVALID;
2614 	break;
2615     }
2616 
2617     xpt_done(ccb);
2618 }
2619 
2620 /************************************************************************
2621  * Handle a CAM SCSI I/O request.
2622  */
2623 static int
2624 ciss_cam_action_io(struct cam_sim *sim, struct ccb_scsiio *csio)
2625 {
2626     struct ciss_softc	*sc;
2627     int			bus, target;
2628     struct ciss_request	*cr;
2629     struct ciss_command	*cc;
2630     int			error;
2631 
2632     sc = cam_sim_softc(sim);
2633     bus = cam_sim_bus(sim);
2634     target = csio->ccb_h.target_id;
2635 
2636     debug(2, "XPT_SCSI_IO %d:%d:%d", bus, target, csio->ccb_h.target_lun);
2637 
2638     /* firmware does not support commands > 10 bytes */
2639     if (csio->cdb_len > 12/*CISS_CDB_BUFFER_SIZE*/) {
2640 	debug(3, "  command too large (%d > %d)", csio->cdb_len, CISS_CDB_BUFFER_SIZE);
2641 	csio->ccb_h.status = CAM_REQ_CMP_ERR;
2642     }
2643 
2644     /* check that the CDB pointer is not to a physical address */
2645     if ((csio->ccb_h.flags & CAM_CDB_POINTER) && (csio->ccb_h.flags & CAM_CDB_PHYS)) {
2646 	debug(3, "  CDB pointer is to physical address");
2647 	csio->ccb_h.status = CAM_REQ_CMP_ERR;
2648     }
2649 
2650     /* if there is data transfer, it must be to/from a virtual address */
2651     if ((csio->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE) {
2652 	if (csio->ccb_h.flags & CAM_DATA_PHYS) {		/* we can't map it */
2653 	    debug(3, "  data pointer is to physical address");
2654 	    csio->ccb_h.status = CAM_REQ_CMP_ERR;
2655 	}
2656 	if (csio->ccb_h.flags & CAM_SCATTER_VALID) {	/* we want to do the s/g setup */
2657 	    debug(3, "  data has premature s/g setup");
2658 	    csio->ccb_h.status = CAM_REQ_CMP_ERR;
2659 	}
2660     }
2661 
2662     /* abandon aborted ccbs or those that have failed validation */
2663     if ((csio->ccb_h.status & CAM_STATUS_MASK) != CAM_REQ_INPROG) {
2664 	debug(3, "abandoning CCB due to abort/validation failure");
2665 	return(EINVAL);
2666     }
2667 
2668     /* handle emulation of some SCSI commands ourself */
2669     if (ciss_cam_emulate(sc, csio))
2670 	return(0);
2671 
2672     /*
2673      * Get a request to manage this command.  If we can't, return the
2674      * ccb, freeze the queue and flag so that we unfreeze it when a
2675      * request completes.
2676      */
2677     if ((error = ciss_get_request(sc, &cr)) != 0) {
2678 	xpt_freeze_simq(sim, 1);
2679 	csio->ccb_h.status |= CAM_REQUEUE_REQ;
2680 	return(error);
2681     }
2682 
2683     /*
2684      * Build the command.
2685      */
2686     cc = CISS_FIND_COMMAND(cr);
2687     cr->cr_data = csio->data_ptr;
2688     cr->cr_length = csio->dxfer_len;
2689     cr->cr_complete = ciss_cam_complete;
2690     cr->cr_private = csio;
2691 
2692     /*
2693      * Target the right logical volume.
2694      */
2695     if (CISS_IS_PHYSICAL(bus))
2696 	cc->header.address =
2697 	    sc->ciss_physical[CISS_CAM_TO_PBUS(bus)][target].cp_address;
2698     else
2699 	cc->header.address =
2700 	    sc->ciss_logical[bus][target].cl_address;
2701     cc->cdb.cdb_length = csio->cdb_len;
2702     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
2703     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;	/* XXX ordered tags? */
2704     if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_OUT) {
2705 	cr->cr_flags = CISS_REQ_DATAOUT;
2706 	cc->cdb.direction = CISS_CDB_DIRECTION_WRITE;
2707     } else if ((csio->ccb_h.flags & CAM_DIR_MASK) == CAM_DIR_IN) {
2708 	cr->cr_flags = CISS_REQ_DATAIN;
2709 	cc->cdb.direction = CISS_CDB_DIRECTION_READ;
2710     } else {
2711 	cr->cr_flags = 0;
2712 	cc->cdb.direction = CISS_CDB_DIRECTION_NONE;
2713     }
2714     cc->cdb.timeout = (csio->ccb_h.timeout / 1000) + 1;
2715     if (csio->ccb_h.flags & CAM_CDB_POINTER) {
2716 	bcopy(csio->cdb_io.cdb_ptr, &cc->cdb.cdb[0], csio->cdb_len);
2717     } else {
2718 	bcopy(csio->cdb_io.cdb_bytes, &cc->cdb.cdb[0], csio->cdb_len);
2719     }
2720 
2721     /*
2722      * Submit the request to the adapter.
2723      *
2724      * Note that this may fail if we're unable to map the request (and
2725      * if we ever learn a transport layer other than simple, may fail
2726      * if the adapter rejects the command).
2727      */
2728     if ((error = ciss_start(cr)) != 0) {
2729 	xpt_freeze_simq(sim, 1);
2730 	if (error == EINPROGRESS) {
2731 	    csio->ccb_h.status |= CAM_RELEASE_SIMQ;
2732 	    error = 0;
2733 	} else {
2734 	    csio->ccb_h.status |= CAM_REQUEUE_REQ;
2735 	    ciss_release_request(cr);
2736 	}
2737 	return(error);
2738     }
2739 
2740     return(0);
2741 }
2742 
2743 /************************************************************************
2744  * Emulate SCSI commands the adapter doesn't handle as we might like.
2745  */
2746 static int
2747 ciss_cam_emulate(struct ciss_softc *sc, struct ccb_scsiio *csio)
2748 {
2749     int		bus, target;
2750     u_int8_t	opcode;
2751 
2752     target = csio->ccb_h.target_id;
2753     bus = cam_sim_bus(xpt_path_sim(csio->ccb_h.path));
2754     opcode = (csio->ccb_h.flags & CAM_CDB_POINTER) ?
2755 	*(u_int8_t *)csio->cdb_io.cdb_ptr : csio->cdb_io.cdb_bytes[0];
2756 
2757     if (CISS_IS_PHYSICAL(bus)) {
2758 	if (sc->ciss_physical[CISS_CAM_TO_PBUS(bus)][target].cp_online != 1) {
2759 	    csio->ccb_h.status = CAM_SEL_TIMEOUT;
2760 	    xpt_done((union ccb *)csio);
2761 	    return(1);
2762 	} else
2763 	    return(0);
2764     }
2765 
2766     /*
2767      * Handle requests for volumes that don't exist or are not online.
2768      * A selection timeout is slightly better than an illegal request.
2769      * Other errors might be better.
2770      */
2771     if (sc->ciss_logical[bus][target].cl_status != CISS_LD_ONLINE) {
2772 	csio->ccb_h.status = CAM_SEL_TIMEOUT;
2773 	xpt_done((union ccb *)csio);
2774 	return(1);
2775     }
2776 
2777     /* if we have to fake Synchronise Cache */
2778     if (sc->ciss_flags & CISS_FLAG_FAKE_SYNCH) {
2779 	/*
2780 	 * If this is a Synchronise Cache command, typically issued when
2781 	 * a device is closed, flush the adapter and complete now.
2782 	 */
2783 	if (((csio->ccb_h.flags & CAM_CDB_POINTER) ?
2784 	     *(u_int8_t *)csio->cdb_io.cdb_ptr : csio->cdb_io.cdb_bytes[0]) == SYNCHRONIZE_CACHE) {
2785 	    ciss_flush_adapter(sc);
2786 	    csio->ccb_h.status = CAM_REQ_CMP;
2787 	    xpt_done((union ccb *)csio);
2788 	    return(1);
2789 	}
2790     }
2791 
2792     return(0);
2793 }
2794 
2795 /************************************************************************
2796  * Check for possibly-completed commands.
2797  */
2798 static void
2799 ciss_cam_poll(struct cam_sim *sim)
2800 {
2801     struct ciss_softc	*sc = cam_sim_softc(sim);
2802 
2803     debug_called(2);
2804 
2805     ciss_done(sc);
2806 }
2807 
2808 /************************************************************************
2809  * Handle completion of a command - pass results back through the CCB
2810  */
2811 static void
2812 ciss_cam_complete(struct ciss_request *cr)
2813 {
2814     struct ciss_softc		*sc;
2815     struct ciss_command		*cc;
2816     struct ciss_error_info	*ce;
2817     struct ccb_scsiio		*csio;
2818     int				scsi_status;
2819     int				command_status;
2820 
2821     debug_called(2);
2822 
2823     sc = cr->cr_sc;
2824     cc = CISS_FIND_COMMAND(cr);
2825     ce = (struct ciss_error_info *)&(cc->sg[0]);
2826     csio = (struct ccb_scsiio *)cr->cr_private;
2827 
2828     /*
2829      * Extract status values from request.
2830      */
2831     ciss_report_request(cr, &command_status, &scsi_status);
2832     csio->scsi_status = scsi_status;
2833 
2834     /*
2835      * Handle specific SCSI status values.
2836      */
2837     switch(scsi_status) {
2838 	/* no status due to adapter error */
2839     case -1:
2840 	debug(0, "adapter error");
2841 	csio->ccb_h.status = CAM_REQ_CMP_ERR;
2842 	break;
2843 
2844 	/* no status due to command completed OK */
2845     case SCSI_STATUS_OK:		/* CISS_SCSI_STATUS_GOOD */
2846 	debug(2, "SCSI_STATUS_OK");
2847 	csio->ccb_h.status = CAM_REQ_CMP;
2848 	break;
2849 
2850 	/* check condition, sense data included */
2851     case SCSI_STATUS_CHECK_COND:	/* CISS_SCSI_STATUS_CHECK_CONDITION */
2852 	debug(0, "SCSI_STATUS_CHECK_COND  sense size %d  resid %d\n",
2853 	      ce->sense_length, ce->residual_count);
2854 	bzero(&csio->sense_data, SSD_FULL_SIZE);
2855 	bcopy(&ce->sense_info[0], &csio->sense_data, ce->sense_length);
2856 	csio->sense_len = ce->sense_length;
2857 	csio->resid = ce->residual_count;
2858 	csio->ccb_h.status = CAM_SCSI_STATUS_ERROR | CAM_AUTOSNS_VALID;
2859 #ifdef CISS_DEBUG
2860 	{
2861 	    struct scsi_sense_data	*sns = (struct scsi_sense_data *)&ce->sense_info[0];
2862 	    debug(0, "sense key %x", sns->flags & SSD_KEY);
2863 	}
2864 #endif
2865 	break;
2866 
2867     case SCSI_STATUS_BUSY:		/* CISS_SCSI_STATUS_BUSY */
2868 	debug(0, "SCSI_STATUS_BUSY");
2869 	csio->ccb_h.status = CAM_SCSI_BUSY;
2870 	break;
2871 
2872     default:
2873 	debug(0, "unknown status 0x%x", csio->scsi_status);
2874 	csio->ccb_h.status = CAM_REQ_CMP_ERR;
2875 	break;
2876     }
2877 
2878     /* handle post-command fixup */
2879     ciss_cam_complete_fixup(sc, csio);
2880 
2881     /* tell CAM we're ready for more commands */
2882     csio->ccb_h.status |= CAM_RELEASE_SIMQ;
2883 
2884     xpt_done((union ccb *)csio);
2885     ciss_release_request(cr);
2886 }
2887 
2888 /********************************************************************************
2889  * Fix up the result of some commands here.
2890  */
2891 static void
2892 ciss_cam_complete_fixup(struct ciss_softc *sc, struct ccb_scsiio *csio)
2893 {
2894     struct scsi_inquiry_data	*inq;
2895     struct ciss_ldrive		*cl;
2896     int				bus, target;
2897 
2898     if (((csio->ccb_h.flags & CAM_CDB_POINTER) ?
2899 	 *(u_int8_t *)csio->cdb_io.cdb_ptr : csio->cdb_io.cdb_bytes[0]) == INQUIRY) {
2900 
2901 	inq = (struct scsi_inquiry_data *)csio->data_ptr;
2902 	target = csio->ccb_h.target_id;
2903 	bus = cam_sim_bus(xpt_path_sim(csio->ccb_h.path));
2904 
2905 	/*
2906 	 * Don't let hard drives be seen by the DA driver.  They will still be
2907 	 * attached by the PASS driver.
2908 	 */
2909 	if (CISS_IS_PHYSICAL(bus)) {
2910 	    if (SID_TYPE(inq) == T_DIRECT)
2911 		inq->device = (inq->device & 0xe0) | T_NODEVICE;
2912 	    return;
2913 	}
2914 
2915 	cl = &sc->ciss_logical[bus][target];
2916 
2917 	padstr(inq->vendor, "COMPAQ", 8);
2918 	padstr(inq->product, ciss_name_ldrive_org(cl->cl_ldrive->fault_tolerance), 8);
2919 	padstr(inq->revision, ciss_name_ldrive_status(cl->cl_lstatus->status), 16);
2920     }
2921 }
2922 
2923 
2924 /********************************************************************************
2925  * Find a peripheral attached at (target)
2926  */
2927 static struct cam_periph *
2928 ciss_find_periph(struct ciss_softc *sc, int bus, int target)
2929 {
2930     struct cam_periph	*periph;
2931     struct cam_path	*path;
2932     int			status;
2933 
2934     status = xpt_create_path(&path, NULL, cam_sim_path(sc->ciss_cam_sim[bus]),
2935 			     target, 0);
2936     if (status == CAM_REQ_CMP) {
2937 	periph = cam_periph_find(path, NULL);
2938 	xpt_free_path(path);
2939     } else {
2940 	periph = NULL;
2941     }
2942     return(periph);
2943 }
2944 
2945 /********************************************************************************
2946  * Name the device at (target)
2947  *
2948  * XXX is this strictly correct?
2949  */
2950 static int
2951 ciss_name_device(struct ciss_softc *sc, int bus, int target)
2952 {
2953     struct cam_periph	*periph;
2954 
2955     if (CISS_IS_PHYSICAL(bus))
2956 	return (0);
2957     if ((periph = ciss_find_periph(sc, bus, target)) != NULL) {
2958 	sprintf(sc->ciss_logical[bus][target].cl_name, "%s%d",
2959 		periph->periph_name, periph->unit_number);
2960 	return(0);
2961     }
2962     sc->ciss_logical[bus][target].cl_name[0] = 0;
2963     return(ENOENT);
2964 }
2965 
2966 /************************************************************************
2967  * Periodic status monitoring.
2968  */
2969 static void
2970 ciss_periodic(void *arg)
2971 {
2972     struct ciss_softc	*sc;
2973 
2974     debug_called(1);
2975 
2976     sc = (struct ciss_softc *)arg;
2977 
2978     /*
2979      * Check the adapter heartbeat.
2980      */
2981     if (sc->ciss_cfg->heartbeat == sc->ciss_heartbeat) {
2982 	sc->ciss_heart_attack++;
2983 	debug(0, "adapter heart attack in progress 0x%x/%d",
2984 	      sc->ciss_heartbeat, sc->ciss_heart_attack);
2985 	if (sc->ciss_heart_attack == 3) {
2986 	    ciss_printf(sc, "ADAPTER HEARTBEAT FAILED\n");
2987 	    /* XXX should reset adapter here */
2988 	}
2989     } else {
2990 	sc->ciss_heartbeat = sc->ciss_cfg->heartbeat;
2991 	sc->ciss_heart_attack = 0;
2992 	debug(3, "new heartbeat 0x%x", sc->ciss_heartbeat);
2993     }
2994 
2995     /*
2996      * If the notify event request has died for some reason, or has
2997      * not started yet, restart it.
2998      */
2999     if (!(sc->ciss_flags & CISS_FLAG_NOTIFY_OK)) {
3000 	debug(0, "(re)starting Event Notify chain");
3001 	ciss_notify_event(sc);
3002     }
3003 
3004     /*
3005      * Reschedule.
3006      */
3007     if (!(sc->ciss_flags & CISS_FLAG_ABORTING))
3008 	sc->ciss_periodic = timeout(ciss_periodic, sc, CISS_HEARTBEAT_RATE * hz);
3009 }
3010 
3011 /************************************************************************
3012  * Request a notification response from the adapter.
3013  *
3014  * If (cr) is NULL, this is the first request of the adapter, so
3015  * reset the adapter's message pointer and start with the oldest
3016  * message available.
3017  */
3018 static void
3019 ciss_notify_event(struct ciss_softc *sc)
3020 {
3021     struct ciss_request		*cr;
3022     struct ciss_command		*cc;
3023     struct ciss_notify_cdb	*cnc;
3024     int				error;
3025 
3026     debug_called(1);
3027 
3028     cr = sc->ciss_periodic_notify;
3029 
3030     /* get a request if we don't already have one */
3031     if (cr == NULL) {
3032 	if ((error = ciss_get_request(sc, &cr)) != 0) {
3033 	    debug(0, "can't get notify event request");
3034 	    goto out;
3035 	}
3036 	sc->ciss_periodic_notify = cr;
3037 	cr->cr_complete = ciss_notify_complete;
3038 	debug(1, "acquired request %d", cr->cr_tag);
3039     }
3040 
3041     /*
3042      * Get a databuffer if we don't already have one, note that the
3043      * adapter command wants a larger buffer than the actual
3044      * structure.
3045      */
3046     if (cr->cr_data == NULL) {
3047 	if ((cr->cr_data = malloc(CISS_NOTIFY_DATA_SIZE, CISS_MALLOC_CLASS, M_NOWAIT)) == NULL) {
3048 	    debug(0, "can't get notify event request buffer");
3049 	    error = ENOMEM;
3050 	    goto out;
3051 	}
3052 	cr->cr_length = CISS_NOTIFY_DATA_SIZE;
3053     }
3054 
3055     /* re-setup the request's command (since we never release it) XXX overkill*/
3056     ciss_preen_command(cr);
3057 
3058     /* (re)build the notify event command */
3059     cc = CISS_FIND_COMMAND(cr);
3060     cc->header.address.physical.mode = CISS_HDR_ADDRESS_MODE_PERIPHERAL;
3061     cc->header.address.physical.bus = 0;
3062     cc->header.address.physical.target = 0;
3063 
3064     cc->cdb.cdb_length = sizeof(*cnc);
3065     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
3066     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
3067     cc->cdb.direction = CISS_CDB_DIRECTION_READ;
3068     cc->cdb.timeout = 0;	/* no timeout, we hope */
3069 
3070     cnc = (struct ciss_notify_cdb *)&(cc->cdb.cdb[0]);
3071     bzero(cr->cr_data, CISS_NOTIFY_DATA_SIZE);
3072     cnc->opcode = CISS_OPCODE_READ;
3073     cnc->command = CISS_COMMAND_NOTIFY_ON_EVENT;
3074     cnc->timeout = 0;		/* no timeout, we hope */
3075     cnc->synchronous = 0;
3076     cnc->ordered = 0;
3077     cnc->seek_to_oldest = 0;
3078     if ((sc->ciss_flags & CISS_FLAG_RUNNING) == 0)
3079 	cnc->new_only = 1;
3080     else
3081 	cnc->new_only = 0;
3082     cnc->length = htonl(CISS_NOTIFY_DATA_SIZE);
3083 
3084     /* submit the request */
3085     error = ciss_start(cr);
3086 
3087  out:
3088     if (error) {
3089 	if (cr != NULL) {
3090 	    if (cr->cr_data != NULL)
3091 		free(cr->cr_data, CISS_MALLOC_CLASS);
3092 	    ciss_release_request(cr);
3093 	}
3094 	sc->ciss_periodic_notify = NULL;
3095 	debug(0, "can't submit notify event request");
3096 	sc->ciss_flags &= ~CISS_FLAG_NOTIFY_OK;
3097     } else {
3098 	debug(1, "notify event submitted");
3099 	sc->ciss_flags |= CISS_FLAG_NOTIFY_OK;
3100     }
3101 }
3102 
3103 static void
3104 ciss_notify_complete(struct ciss_request *cr)
3105 {
3106     struct ciss_command	*cc;
3107     struct ciss_notify	*cn;
3108     struct ciss_softc	*sc;
3109     int			scsi_status;
3110     int			command_status;
3111     debug_called(1);
3112 
3113     cc = CISS_FIND_COMMAND(cr);
3114     cn = (struct ciss_notify *)cr->cr_data;
3115     sc = cr->cr_sc;
3116 
3117     /*
3118      * Report request results, decode status.
3119      */
3120     ciss_report_request(cr, &command_status, &scsi_status);
3121 
3122     /*
3123      * Abort the chain on a fatal error.
3124      *
3125      * XXX which of these are actually errors?
3126      */
3127     if ((command_status != CISS_CMD_STATUS_SUCCESS) &&
3128 	(command_status != CISS_CMD_STATUS_TARGET_STATUS) &&
3129 	(command_status != CISS_CMD_STATUS_TIMEOUT)) {	/* XXX timeout? */
3130 	ciss_printf(sc, "fatal error in Notify Event request (%s)\n",
3131 		    ciss_name_command_status(command_status));
3132 	ciss_release_request(cr);
3133 	sc->ciss_flags &= ~CISS_FLAG_NOTIFY_OK;
3134 	return;
3135     }
3136 
3137     /*
3138      * If the adapter gave us a text message, print it.
3139      */
3140     if (cn->message[0] != 0)
3141 	ciss_printf(sc, "*** %.80s\n", cn->message);
3142 
3143     debug(0, "notify event class %d subclass %d detail %d",
3144 		cn->class, cn->subclass, cn->detail);
3145 
3146     /*
3147      * If the response indicates that the notifier has been aborted,
3148      * release the notifier command.
3149      */
3150     if ((cn->class == CISS_NOTIFY_NOTIFIER) &&
3151 	(cn->subclass == CISS_NOTIFY_NOTIFIER_STATUS) &&
3152 	(cn->detail == 1)) {
3153 	debug(0, "notifier exiting");
3154 	sc->ciss_flags &= ~CISS_FLAG_NOTIFY_OK;
3155 	ciss_release_request(cr);
3156 	sc->ciss_periodic_notify = NULL;
3157 	wakeup(&sc->ciss_periodic_notify);
3158     } else {
3159 	/* Handle notify events in a kernel thread */
3160 	ciss_enqueue_notify(cr);
3161 	sc->ciss_periodic_notify = NULL;
3162 	wakeup(&sc->ciss_periodic_notify);
3163 	wakeup(&sc->ciss_notify);
3164     }
3165     /*
3166      * Send a new notify event command, if we're not aborting.
3167      */
3168     if (!(sc->ciss_flags & CISS_FLAG_ABORTING)) {
3169 	ciss_notify_event(sc);
3170     }
3171 }
3172 
3173 /************************************************************************
3174  * Abort the Notify Event chain.
3175  *
3176  * Note that we can't just abort the command in progress; we have to
3177  * explicitly issue an Abort Notify Event command in order for the
3178  * adapter to clean up correctly.
3179  *
3180  * If we are called with CISS_FLAG_ABORTING set in the adapter softc,
3181  * the chain will not restart itself.
3182  */
3183 static int
3184 ciss_notify_abort(struct ciss_softc *sc)
3185 {
3186     struct ciss_request		*cr;
3187     struct ciss_command		*cc;
3188     struct ciss_notify_cdb	*cnc;
3189     int				error, s, command_status, scsi_status;
3190 
3191     debug_called(1);
3192 
3193     cr = NULL;
3194     error = 0;
3195 
3196     /* verify that there's an outstanding command */
3197     if (!(sc->ciss_flags & CISS_FLAG_NOTIFY_OK))
3198 	goto out;
3199 
3200     /* get a command to issue the abort with */
3201     if ((error = ciss_get_request(sc, &cr)))
3202 	goto out;
3203 
3204     /* get a buffer for the result */
3205     if ((cr->cr_data = malloc(CISS_NOTIFY_DATA_SIZE, CISS_MALLOC_CLASS, M_NOWAIT)) == NULL) {
3206 	debug(0, "can't get notify event request buffer");
3207 	error = ENOMEM;
3208 	goto out;
3209     }
3210     cr->cr_length = CISS_NOTIFY_DATA_SIZE;
3211 
3212     /* build the CDB */
3213     cc = CISS_FIND_COMMAND(cr);
3214     cc->header.address.physical.mode = CISS_HDR_ADDRESS_MODE_PERIPHERAL;
3215     cc->header.address.physical.bus = 0;
3216     cc->header.address.physical.target = 0;
3217     cc->cdb.cdb_length = sizeof(*cnc);
3218     cc->cdb.type = CISS_CDB_TYPE_COMMAND;
3219     cc->cdb.attribute = CISS_CDB_ATTRIBUTE_SIMPLE;
3220     cc->cdb.direction = CISS_CDB_DIRECTION_READ;
3221     cc->cdb.timeout = 0;	/* no timeout, we hope */
3222 
3223     cnc = (struct ciss_notify_cdb *)&(cc->cdb.cdb[0]);
3224     bzero(cnc, sizeof(*cnc));
3225     cnc->opcode = CISS_OPCODE_WRITE;
3226     cnc->command = CISS_COMMAND_ABORT_NOTIFY;
3227     cnc->length = htonl(CISS_NOTIFY_DATA_SIZE);
3228 
3229     ciss_print_request(cr);
3230 
3231     /*
3232      * Submit the request and wait for it to complete.
3233      */
3234     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
3235 	ciss_printf(sc, "Abort Notify Event command failed (%d)\n", error);
3236 	goto out;
3237     }
3238 
3239     /*
3240      * Check response.
3241      */
3242     ciss_report_request(cr, &command_status, &scsi_status);
3243     switch(command_status) {
3244     case CISS_CMD_STATUS_SUCCESS:
3245 	break;
3246     case CISS_CMD_STATUS_INVALID_COMMAND:
3247 	/*
3248 	 * Some older adapters don't support the CISS version of this
3249 	 * command.  Fall back to using the BMIC version.
3250 	 */
3251 	error = ciss_notify_abort_bmic(sc);
3252 	if (error != 0)
3253 	    goto out;
3254 	break;
3255 
3256     case CISS_CMD_STATUS_TARGET_STATUS:
3257 	/*
3258 	 * This can happen if the adapter thinks there wasn't an outstanding
3259 	 * Notify Event command but we did.  We clean up here.
3260 	 */
3261 	if (scsi_status == CISS_SCSI_STATUS_CHECK_CONDITION) {
3262 	    if (sc->ciss_periodic_notify != NULL)
3263 		ciss_release_request(sc->ciss_periodic_notify);
3264 	    error = 0;
3265 	    goto out;
3266 	}
3267 	/* FALLTHROUGH */
3268 
3269     default:
3270 	ciss_printf(sc, "Abort Notify Event command failed (%s)\n",
3271 		    ciss_name_command_status(command_status));
3272 	error = EIO;
3273 	goto out;
3274     }
3275 
3276     /*
3277      * Sleep waiting for the notifier command to complete.  Note
3278      * that if it doesn't, we may end up in a bad situation, since
3279      * the adapter may deliver it later.  Also note that the adapter
3280      * requires the Notify Event command to be cancelled in order to
3281      * maintain internal bookkeeping.
3282      */
3283     s = splcam();
3284     while (sc->ciss_periodic_notify != NULL) {
3285 	error = tsleep(&sc->ciss_periodic_notify, 0, "cissNEA", hz * 5);
3286 	if (error == EWOULDBLOCK) {
3287 	    ciss_printf(sc, "Notify Event command failed to abort, adapter may wedge.\n");
3288 	    break;
3289 	}
3290     }
3291     splx(s);
3292 
3293  out:
3294     /* release the cancel request */
3295     if (cr != NULL) {
3296 	if (cr->cr_data != NULL)
3297 	    free(cr->cr_data, CISS_MALLOC_CLASS);
3298 	ciss_release_request(cr);
3299     }
3300     if (error == 0)
3301 	sc->ciss_flags &= ~CISS_FLAG_NOTIFY_OK;
3302     return(error);
3303 }
3304 
3305 /************************************************************************
3306  * Abort the Notify Event chain using a BMIC command.
3307  */
3308 static int
3309 ciss_notify_abort_bmic(struct ciss_softc *sc)
3310 {
3311     struct ciss_request			*cr;
3312     int					error, command_status;
3313 
3314     debug_called(1);
3315 
3316     cr = NULL;
3317     error = 0;
3318 
3319     /* verify that there's an outstanding command */
3320     if (!(sc->ciss_flags & CISS_FLAG_NOTIFY_OK))
3321 	goto out;
3322 
3323     /*
3324      * Build a BMIC command to cancel the Notify on Event command.
3325      *
3326      * Note that we are sending a CISS opcode here.  Odd.
3327      */
3328     if ((error = ciss_get_bmic_request(sc, &cr, CISS_COMMAND_ABORT_NOTIFY,
3329 				       NULL, 0)) != 0)
3330 	goto out;
3331 
3332     /*
3333      * Submit the request and wait for it to complete.
3334      */
3335     if ((error = ciss_synch_request(cr, 60 * 1000)) != 0) {
3336 	ciss_printf(sc, "error sending BMIC Cancel Notify on Event command (%d)\n", error);
3337 	goto out;
3338     }
3339 
3340     /*
3341      * Check response.
3342      */
3343     ciss_report_request(cr, &command_status, NULL);
3344     switch(command_status) {
3345     case CISS_CMD_STATUS_SUCCESS:
3346 	break;
3347     default:
3348 	ciss_printf(sc, "error cancelling Notify on Event (%s)\n",
3349 		    ciss_name_command_status(command_status));
3350 	error = EIO;
3351 	goto out;
3352     }
3353 
3354 out:
3355     if (cr != NULL)
3356 	ciss_release_request(cr);
3357     return(error);
3358 }
3359 
3360 /************************************************************************
3361  * Handle rescanning all the logical volumes when a notify event
3362  * causes the drives to come online or offline.
3363  */
3364 static void
3365 ciss_notify_rescan_logical(struct ciss_softc *sc)
3366 {
3367     struct ciss_lun_report      *cll;
3368     struct ciss_ldrive		*ld;
3369     int                         i, j, ndrives;
3370 
3371     /*
3372      * We must rescan all logical volumes to get the right logical
3373      * drive address.
3374      */
3375     cll = ciss_report_luns(sc, CISS_OPCODE_REPORT_LOGICAL_LUNS,
3376                            CISS_MAX_LOGICAL);
3377     if (cll == NULL)
3378         return;
3379 
3380     ndrives = (ntohl(cll->list_size) / sizeof(union ciss_device_address));
3381 
3382     /*
3383      * Delete any of the drives which were destroyed by the
3384      * firmware.
3385      */
3386     for (i = 0; i < sc->ciss_max_logical_bus; i++) {
3387 	for (j = 0; j < CISS_MAX_LOGICAL; j++) {
3388 	    ld = &sc->ciss_logical[i][j];
3389 
3390 	    if (ld->cl_update == 0)
3391 		continue;
3392 
3393 	    if (ld->cl_status != CISS_LD_ONLINE) {
3394 		ciss_cam_rescan_target(sc, i, j);
3395 		ld->cl_update = 0;
3396 		if (ld->cl_ldrive)
3397 		    free(ld->cl_ldrive, CISS_MALLOC_CLASS);
3398 		if (ld->cl_lstatus)
3399 		    free(ld->cl_lstatus, CISS_MALLOC_CLASS);
3400 
3401 		ld->cl_ldrive = NULL;
3402 		ld->cl_lstatus = NULL;
3403 	    }
3404 	}
3405     }
3406 
3407     /*
3408      * Scan for new drives.
3409      */
3410     for (i = 0; i < ndrives; i++) {
3411 	int	bus, target;
3412 
3413 	bus 	= CISS_LUN_TO_BUS(cll->lun[i].logical.lun);
3414 	target	= CISS_LUN_TO_TARGET(cll->lun[i].logical.lun);
3415 	ld	= &sc->ciss_logical[bus][target];
3416 
3417 	if (ld->cl_update == 0)
3418 		continue;
3419 
3420 	ld->cl_update		= 0;
3421 	ld->cl_address		= cll->lun[i];
3422 	ld->cl_controller	= &sc->ciss_controllers[bus];
3423 	if (ciss_identify_logical(sc, ld) == 0) {
3424 	    ciss_cam_rescan_target(sc, bus, target);
3425 	}
3426     }
3427     free(cll, CISS_MALLOC_CLASS);
3428 }
3429 
3430 /************************************************************************
3431  * Handle a notify event relating to the status of a logical drive.
3432  *
3433  * XXX need to be able to defer some of these to properly handle
3434  *     calling the "ID Physical drive" command, unless the 'extended'
3435  *     drive IDs are always in BIG_MAP format.
3436  */
3437 static void
3438 ciss_notify_logical(struct ciss_softc *sc, struct ciss_notify *cn)
3439 {
3440     struct ciss_ldrive	*ld;
3441     int			ostatus, bus, target;
3442 
3443     debug_called(2);
3444 
3445     bus		= cn->device.physical.bus;
3446     target	= cn->data.logical_status.logical_drive;
3447     ld		= &sc->ciss_logical[bus][target];
3448 
3449     switch (cn->subclass) {
3450     case CISS_NOTIFY_LOGICAL_STATUS:
3451 	switch (cn->detail) {
3452 	case 0:
3453 	    ciss_name_device(sc, bus, target);
3454 	    ciss_printf(sc, "logical drive %d (%s) changed status %s->%s, spare status 0x%b\n",
3455 			cn->data.logical_status.logical_drive, ld->cl_name,
3456 			ciss_name_ldrive_status(cn->data.logical_status.previous_state),
3457 			ciss_name_ldrive_status(cn->data.logical_status.new_state),
3458 			cn->data.logical_status.spare_state,
3459 			"\20\1configured\2rebuilding\3failed\4in use\5available\n");
3460 
3461 	    /*
3462 	     * Update our idea of the drive's status.
3463 	     */
3464 	    ostatus = ciss_decode_ldrive_status(cn->data.logical_status.previous_state);
3465 	    ld->cl_status = ciss_decode_ldrive_status(cn->data.logical_status.new_state);
3466 	    if (ld->cl_lstatus != NULL)
3467 		ld->cl_lstatus->status = cn->data.logical_status.new_state;
3468 
3469 	    /*
3470 	     * Have CAM rescan the drive if its status has changed.
3471 	     */
3472 	    if (ostatus != ld->cl_status) {
3473 		ld->cl_update = 1;
3474 		ciss_notify_rescan_logical(sc);
3475 	    }
3476 
3477 	    break;
3478 
3479 	case 1:	/* logical drive has recognised new media, needs Accept Media Exchange */
3480 	    ciss_name_device(sc, bus, target);
3481 	    ciss_printf(sc, "logical drive %d (%s) media exchanged, ready to go online\n",
3482 			cn->data.logical_status.logical_drive, ld->cl_name);
3483 	    ciss_accept_media(sc, ld);
3484 
3485 	    ld->cl_update = 1;
3486 	    ld->cl_status = ciss_decode_ldrive_status(cn->data.logical_status.new_state);
3487 	    ciss_notify_rescan_logical(sc);
3488 	    break;
3489 
3490 	case 2:
3491 	case 3:
3492 	    ciss_printf(sc, "rebuild of logical drive %d (%s) failed due to %s error\n",
3493 			cn->data.rebuild_aborted.logical_drive,
3494 			ld->cl_name,
3495 			(cn->detail == 2) ? "read" : "write");
3496 	    break;
3497 	}
3498 	break;
3499 
3500     case CISS_NOTIFY_LOGICAL_ERROR:
3501 	if (cn->detail == 0) {
3502 	    ciss_printf(sc, "FATAL I/O ERROR on logical drive %d (%s), SCSI port %d ID %d\n",
3503 			cn->data.io_error.logical_drive,
3504 			ld->cl_name,
3505 			cn->data.io_error.failure_bus,
3506 			cn->data.io_error.failure_drive);
3507 	    /* XXX should we take the drive down at this point, or will we be told? */
3508 	}
3509 	break;
3510 
3511     case CISS_NOTIFY_LOGICAL_SURFACE:
3512 	if (cn->detail == 0)
3513 	    ciss_printf(sc, "logical drive %d (%s) completed consistency initialisation\n",
3514 			cn->data.consistency_completed.logical_drive,
3515 			ld->cl_name);
3516 	break;
3517     }
3518 }
3519 
3520 /************************************************************************
3521  * Handle a notify event relating to the status of a physical drive.
3522  */
3523 static void
3524 ciss_notify_physical(struct ciss_softc *sc, struct ciss_notify *cn)
3525 {
3526 }
3527 
3528 /************************************************************************
3529  * Handle a notify event relating to the status of a physical drive.
3530  */
3531 static void
3532 ciss_notify_hotplug(struct ciss_softc *sc, struct ciss_notify *cn)
3533 {
3534     struct ciss_lun_report *cll;
3535     int bus, target;
3536     int s;
3537 
3538     switch (cn->subclass) {
3539     case CISS_NOTIFY_HOTPLUG_PHYSICAL:
3540     case CISS_NOTIFY_HOTPLUG_NONDISK:
3541 	bus = CISS_BIG_MAP_BUS(sc, cn->data.drive.big_physical_drive_number);
3542 	target =
3543 	    CISS_BIG_MAP_TARGET(sc, cn->data.drive.big_physical_drive_number);
3544 
3545 	s = splcam();
3546 	if (cn->detail == 0) {
3547 	    /*
3548 	     * Mark the device offline so that it'll start producing selection
3549 	     * timeouts to the upper layer.
3550 	     */
3551 	    if ((bus >= 0) && (target >= 0))
3552 		sc->ciss_physical[bus][target].cp_online = 0;
3553 	} else {
3554 	    /*
3555 	     * Rescan the physical lun list for new items
3556 	     */
3557 	    cll = ciss_report_luns(sc, CISS_OPCODE_REPORT_PHYSICAL_LUNS,
3558 				   CISS_MAX_PHYSICAL);
3559 	    if (cll == NULL) {
3560 		ciss_printf(sc, "Warning, cannot get physical lun list\n");
3561 		break;
3562 	    }
3563 	    ciss_filter_physical(sc, cll);
3564 	}
3565 	splx(s);
3566 	break;
3567 
3568     default:
3569 	ciss_printf(sc, "Unknown hotplug event %d\n", cn->subclass);
3570 	return;
3571     }
3572 }
3573 
3574 /************************************************************************
3575  * Handle deferred processing of notify events.  Notify events may need
3576  * sleep which is unsafe during an interrupt.
3577  */
3578 static void
3579 ciss_notify_thread(void *arg)
3580 {
3581     struct ciss_softc		*sc;
3582     struct ciss_request		*cr;
3583     struct ciss_notify		*cn;
3584     int				s;
3585 
3586 #if __FreeBSD_version >= 500000
3587     mtx_lock(&Giant);
3588 #endif
3589     sc = (struct ciss_softc *)arg;
3590 
3591     s = splcam();
3592     for (;;) {
3593 	if (TAILQ_EMPTY(&sc->ciss_notify) != 0 &&
3594 	    (sc->ciss_flags & CISS_FLAG_THREAD_SHUT) == 0) {
3595 	    tsleep(&sc->ciss_notify, PUSER, "idle", 0);
3596 	}
3597 
3598 	if (sc->ciss_flags & CISS_FLAG_THREAD_SHUT)
3599 	    break;
3600 
3601 	cr = ciss_dequeue_notify(sc);
3602 	splx(s);
3603 
3604 	if (cr == NULL)
3605 		panic("cr null");
3606 	cn = (struct ciss_notify *)cr->cr_data;
3607 
3608 	switch (cn->class) {
3609 	case CISS_NOTIFY_HOTPLUG:
3610 	    ciss_notify_hotplug(sc, cn);
3611 	    break;
3612 	case CISS_NOTIFY_LOGICAL:
3613 	    ciss_notify_logical(sc, cn);
3614 	    break;
3615 	case CISS_NOTIFY_PHYSICAL:
3616 	    ciss_notify_physical(sc, cn);
3617 	    break;
3618 	}
3619 
3620 	ciss_release_request(cr);
3621 
3622 	s = splcam();
3623     }
3624     sc->ciss_notify_thread = NULL;
3625     wakeup(&sc->ciss_notify_thread);
3626     splx(s);
3627 
3628 #if __FreeBSD_version >= 500000
3629     mtx_unlock(&Giant);
3630 #endif
3631     kthread_exit(0);
3632 }
3633 
3634 /************************************************************************
3635  * Start the notification kernel thread.
3636  */
3637 static void
3638 ciss_spawn_notify_thread(struct ciss_softc *sc)
3639 {
3640 
3641 #if __FreeBSD_version > 500005
3642     if (kthread_create((void(*)(void *))ciss_notify_thread, sc,
3643 		       &sc->ciss_notify_thread, 0, 0, "ciss_notify%d",
3644 		       device_get_unit(sc->ciss_dev)))
3645 #else
3646     if (kthread_create((void(*)(void *))ciss_notify_thread, sc,
3647 		       &sc->ciss_notify_thread, "ciss_notify%d",
3648 		       device_get_unit(sc->ciss_dev)))
3649 #endif
3650 	panic("Could not create notify thread\n");
3651 }
3652 
3653 /************************************************************************
3654  * Kill the notification kernel thread.
3655  */
3656 static void
3657 ciss_kill_notify_thread(struct ciss_softc *sc)
3658 {
3659 
3660     if (sc->ciss_notify_thread == NULL)
3661 	return;
3662 
3663     sc->ciss_flags |= CISS_FLAG_THREAD_SHUT;
3664     wakeup(&sc->ciss_notify);
3665     tsleep(&sc->ciss_notify_thread, PUSER, "thtrm", 0);
3666 }
3667 
3668 /************************************************************************
3669  * Print a request.
3670  */
3671 static void
3672 ciss_print_request(struct ciss_request *cr)
3673 {
3674     struct ciss_softc	*sc;
3675     struct ciss_command	*cc;
3676     int			i;
3677 
3678     sc = cr->cr_sc;
3679     cc = CISS_FIND_COMMAND(cr);
3680 
3681     ciss_printf(sc, "REQUEST @ %p\n", cr);
3682     ciss_printf(sc, "  data %p/%d  tag %d  flags %b\n",
3683 	      cr->cr_data, cr->cr_length, cr->cr_tag, cr->cr_flags,
3684 	      "\20\1mapped\2sleep\3poll\4dataout\5datain\n");
3685     ciss_printf(sc, "  sg list/total %d/%d  host tag 0x%x\n",
3686 		cc->header.sg_in_list, cc->header.sg_total, cc->header.host_tag);
3687     switch(cc->header.address.mode.mode) {
3688     case CISS_HDR_ADDRESS_MODE_PERIPHERAL:
3689     case CISS_HDR_ADDRESS_MODE_MASK_PERIPHERAL:
3690 	ciss_printf(sc, "  physical bus %d target %d\n",
3691 		    cc->header.address.physical.bus, cc->header.address.physical.target);
3692 	break;
3693     case CISS_HDR_ADDRESS_MODE_LOGICAL:
3694 	ciss_printf(sc, "  logical unit %d\n", cc->header.address.logical.lun);
3695 	break;
3696     }
3697     ciss_printf(sc, "  %s cdb length %d type %s attribute %s\n",
3698 		(cc->cdb.direction == CISS_CDB_DIRECTION_NONE) ? "no-I/O" :
3699 		(cc->cdb.direction == CISS_CDB_DIRECTION_READ) ? "READ" :
3700 		(cc->cdb.direction == CISS_CDB_DIRECTION_WRITE) ? "WRITE" : "??",
3701 		cc->cdb.cdb_length,
3702 		(cc->cdb.type == CISS_CDB_TYPE_COMMAND) ? "command" :
3703 		(cc->cdb.type == CISS_CDB_TYPE_MESSAGE) ? "message" : "??",
3704 		(cc->cdb.attribute == CISS_CDB_ATTRIBUTE_UNTAGGED) ? "untagged" :
3705 		(cc->cdb.attribute == CISS_CDB_ATTRIBUTE_SIMPLE) ? "simple" :
3706 		(cc->cdb.attribute == CISS_CDB_ATTRIBUTE_HEAD_OF_QUEUE) ? "head-of-queue" :
3707 		(cc->cdb.attribute == CISS_CDB_ATTRIBUTE_ORDERED) ? "ordered" :
3708 		(cc->cdb.attribute == CISS_CDB_ATTRIBUTE_AUTO_CONTINGENT) ? "auto-contingent" : "??");
3709     ciss_printf(sc, "  %*D\n", cc->cdb.cdb_length, &cc->cdb.cdb[0], " ");
3710 
3711     if (cc->header.host_tag & CISS_HDR_HOST_TAG_ERROR) {
3712 	/* XXX print error info */
3713     } else {
3714 	/* since we don't use chained s/g, don't support it here */
3715 	for (i = 0; i < cc->header.sg_in_list; i++) {
3716 	    if ((i % 4) == 0)
3717 		ciss_printf(sc, "   ");
3718 	    printf("0x%08x/%d ", (u_int32_t)cc->sg[i].address, cc->sg[i].length);
3719 	    if ((((i + 1) % 4) == 0) || (i == (cc->header.sg_in_list - 1)))
3720 		printf("\n");
3721 	}
3722     }
3723 }
3724 
3725 /************************************************************************
3726  * Print information about the status of a logical drive.
3727  */
3728 static void
3729 ciss_print_ldrive(struct ciss_softc *sc, struct ciss_ldrive *ld)
3730 {
3731     int		bus, target, i;
3732 
3733     if (ld->cl_lstatus == NULL) {
3734 	printf("does not exist\n");
3735 	return;
3736     }
3737 
3738     /* print drive status */
3739     switch(ld->cl_lstatus->status) {
3740     case CISS_LSTATUS_OK:
3741 	printf("online\n");
3742 	break;
3743     case CISS_LSTATUS_INTERIM_RECOVERY:
3744 	printf("in interim recovery mode\n");
3745 	break;
3746     case CISS_LSTATUS_READY_RECOVERY:
3747 	printf("ready to begin recovery\n");
3748 	break;
3749     case CISS_LSTATUS_RECOVERING:
3750 	bus = CISS_BIG_MAP_BUS(sc, ld->cl_lstatus->drive_rebuilding);
3751 	target = CISS_BIG_MAP_BUS(sc, ld->cl_lstatus->drive_rebuilding);
3752 	printf("being recovered, working on physical drive %d.%d, %u blocks remaining\n",
3753 	       bus, target, ld->cl_lstatus->blocks_to_recover);
3754 	break;
3755     case CISS_LSTATUS_EXPANDING:
3756 	printf("being expanded, %u blocks remaining\n",
3757 	       ld->cl_lstatus->blocks_to_recover);
3758 	break;
3759     case CISS_LSTATUS_QUEUED_FOR_EXPANSION:
3760 	printf("queued for expansion\n");
3761 	break;
3762     case CISS_LSTATUS_FAILED:
3763 	printf("queued for expansion\n");
3764 	break;
3765     case CISS_LSTATUS_WRONG_PDRIVE:
3766 	printf("wrong physical drive inserted\n");
3767 	break;
3768     case CISS_LSTATUS_MISSING_PDRIVE:
3769 	printf("missing a needed physical drive\n");
3770 	break;
3771     case CISS_LSTATUS_BECOMING_READY:
3772 	printf("becoming ready\n");
3773 	break;
3774     }
3775 
3776     /* print failed physical drives */
3777     for (i = 0; i < CISS_BIG_MAP_ENTRIES / 8; i++) {
3778 	bus = CISS_BIG_MAP_BUS(sc, ld->cl_lstatus->drive_failure_map[i]);
3779 	target = CISS_BIG_MAP_TARGET(sc, ld->cl_lstatus->drive_failure_map[i]);
3780 	if (bus == -1)
3781 	    continue;
3782 	ciss_printf(sc, "physical drive %d:%d (%x) failed\n", bus, target,
3783 		    ld->cl_lstatus->drive_failure_map[i]);
3784     }
3785 }
3786 
3787 #ifdef CISS_DEBUG
3788 /************************************************************************
3789  * Print information about the controller/driver.
3790  */
3791 static void
3792 ciss_print_adapter(struct ciss_softc *sc)
3793 {
3794     int		i, j;
3795 
3796     ciss_printf(sc, "ADAPTER:\n");
3797     for (i = 0; i < CISSQ_COUNT; i++) {
3798 	ciss_printf(sc, "%s     %d/%d\n",
3799 	    i == 0 ? "free" :
3800 	    i == 1 ? "busy" : "complete",
3801 	    sc->ciss_qstat[i].q_length,
3802 	    sc->ciss_qstat[i].q_max);
3803     }
3804     ciss_printf(sc, "max_requests %d\n", sc->ciss_max_requests);
3805     ciss_printf(sc, "flags %b\n", sc->ciss_flags,
3806 	"\20\1notify_ok\2control_open\3aborting\4running\21fake_synch\22bmic_abort\n");
3807 
3808     for (i = 0; i < sc->ciss_max_logical_bus; i++) {
3809 	for (j = 0; j < CISS_MAX_LOGICAL; j++) {
3810 	    ciss_printf(sc, "LOGICAL DRIVE %d:  ", i);
3811 	    ciss_print_ldrive(sc, &sc->ciss_logical[i][j]);
3812 	}
3813     }
3814 
3815     /* XXX Should physical drives be printed out here? */
3816 
3817     for (i = 1; i < sc->ciss_max_requests; i++)
3818 	ciss_print_request(sc->ciss_request + i);
3819 }
3820 
3821 /* DDB hook */
3822 static void
3823 ciss_print0(void)
3824 {
3825     struct ciss_softc	*sc;
3826 
3827     sc = devclass_get_softc(devclass_find("ciss"), 0);
3828     if (sc == NULL) {
3829 	printf("no ciss controllers\n");
3830     } else {
3831 	ciss_print_adapter(sc);
3832     }
3833 }
3834 #endif
3835 
3836 /************************************************************************
3837  * Return a name for a logical drive status value.
3838  */
3839 static const char *
3840 ciss_name_ldrive_status(int status)
3841 {
3842     switch (status) {
3843     case CISS_LSTATUS_OK:
3844 	return("OK");
3845     case CISS_LSTATUS_FAILED:
3846 	return("failed");
3847     case CISS_LSTATUS_NOT_CONFIGURED:
3848 	return("not configured");
3849     case CISS_LSTATUS_INTERIM_RECOVERY:
3850 	return("interim recovery");
3851     case CISS_LSTATUS_READY_RECOVERY:
3852 	return("ready for recovery");
3853     case CISS_LSTATUS_RECOVERING:
3854 	return("recovering");
3855     case CISS_LSTATUS_WRONG_PDRIVE:
3856 	return("wrong physical drive inserted");
3857     case CISS_LSTATUS_MISSING_PDRIVE:
3858 	return("missing physical drive");
3859     case CISS_LSTATUS_EXPANDING:
3860 	return("expanding");
3861     case CISS_LSTATUS_BECOMING_READY:
3862 	return("becoming ready");
3863     case CISS_LSTATUS_QUEUED_FOR_EXPANSION:
3864 	return("queued for expansion");
3865     }
3866     return("unknown status");
3867 }
3868 
3869 /************************************************************************
3870  * Return an online/offline/nonexistent value for a logical drive
3871  * status value.
3872  */
3873 static int
3874 ciss_decode_ldrive_status(int status)
3875 {
3876     switch(status) {
3877     case CISS_LSTATUS_NOT_CONFIGURED:
3878 	return(CISS_LD_NONEXISTENT);
3879 
3880     case CISS_LSTATUS_OK:
3881     case CISS_LSTATUS_INTERIM_RECOVERY:
3882     case CISS_LSTATUS_READY_RECOVERY:
3883     case CISS_LSTATUS_RECOVERING:
3884     case CISS_LSTATUS_EXPANDING:
3885     case CISS_LSTATUS_QUEUED_FOR_EXPANSION:
3886 	return(CISS_LD_ONLINE);
3887 
3888     case CISS_LSTATUS_FAILED:
3889     case CISS_LSTATUS_WRONG_PDRIVE:
3890     case CISS_LSTATUS_MISSING_PDRIVE:
3891     case CISS_LSTATUS_BECOMING_READY:
3892     default:
3893 	return(CISS_LD_OFFLINE);
3894     }
3895 }
3896 
3897 
3898 /************************************************************************
3899  * Return a name for a logical drive's organisation.
3900  */
3901 static const char *
3902 ciss_name_ldrive_org(int org)
3903 {
3904     switch(org) {
3905     case CISS_LDRIVE_RAID0:
3906 	return("RAID 0");
3907     case CISS_LDRIVE_RAID1:
3908 	return("RAID 1");
3909     case CISS_LDRIVE_RAID4:
3910 	return("RAID 4");
3911     case CISS_LDRIVE_RAID5:
3912 	return("RAID 5");
3913     case CISS_LDRIVE_RAID51:
3914 	return("RAID 5+1");
3915     case CISS_LDRIVE_RAIDADG:
3916 	return("RAID ADG");
3917     }
3918     return("unkown");
3919 }
3920 
3921 /************************************************************************
3922  * Return a name for a command status value.
3923  */
3924 static const char *
3925 ciss_name_command_status(int status)
3926 {
3927     switch(status) {
3928     case CISS_CMD_STATUS_SUCCESS:
3929 	return("success");
3930     case CISS_CMD_STATUS_TARGET_STATUS:
3931 	return("target status");
3932     case CISS_CMD_STATUS_DATA_UNDERRUN:
3933 	return("data underrun");
3934     case CISS_CMD_STATUS_DATA_OVERRUN:
3935 	return("data overrun");
3936     case CISS_CMD_STATUS_INVALID_COMMAND:
3937 	return("invalid command");
3938     case CISS_CMD_STATUS_PROTOCOL_ERROR:
3939 	return("protocol error");
3940     case CISS_CMD_STATUS_HARDWARE_ERROR:
3941 	return("hardware error");
3942     case CISS_CMD_STATUS_CONNECTION_LOST:
3943 	return("connection lost");
3944     case CISS_CMD_STATUS_ABORTED:
3945 	return("aborted");
3946     case CISS_CMD_STATUS_ABORT_FAILED:
3947 	return("abort failed");
3948     case CISS_CMD_STATUS_UNSOLICITED_ABORT:
3949 	return("unsolicited abort");
3950     case CISS_CMD_STATUS_TIMEOUT:
3951 	return("timeout");
3952     case CISS_CMD_STATUS_UNABORTABLE:
3953 	return("unabortable");
3954     }
3955     return("unknown status");
3956 }
3957 
3958 /************************************************************************
3959  * Handle an open on the control device.
3960  */
3961 static int
3962 ciss_open(struct cdev *dev, int flags, int fmt, d_thread_t *p)
3963 {
3964     struct ciss_softc	*sc;
3965 
3966     debug_called(1);
3967 
3968     sc = (struct ciss_softc *)dev->si_drv1;
3969 
3970     /* we might want to veto if someone already has us open */
3971 
3972     sc->ciss_flags |= CISS_FLAG_CONTROL_OPEN;
3973     return(0);
3974 }
3975 
3976 /************************************************************************
3977  * Handle the last close on the control device.
3978  */
3979 static int
3980 ciss_close(struct cdev *dev, int flags, int fmt, d_thread_t *p)
3981 {
3982     struct ciss_softc	*sc;
3983 
3984     debug_called(1);
3985 
3986     sc = (struct ciss_softc *)dev->si_drv1;
3987 
3988     sc->ciss_flags &= ~CISS_FLAG_CONTROL_OPEN;
3989     return (0);
3990 }
3991 
3992 /********************************************************************************
3993  * Handle adapter-specific control operations.
3994  *
3995  * Note that the API here is compatible with the Linux driver, in order to
3996  * simplify the porting of Compaq's userland tools.
3997  */
3998 static int
3999 ciss_ioctl(struct cdev *dev, u_long cmd, caddr_t addr, int32_t flag, d_thread_t *p)
4000 {
4001     struct ciss_softc		*sc;
4002     int				error;
4003 
4004     debug_called(1);
4005 
4006     sc = (struct ciss_softc *)dev->si_drv1;
4007     error = 0;
4008 
4009     switch(cmd) {
4010     case CCISS_GETPCIINFO:
4011     {
4012 	cciss_pci_info_struct	*pis = (cciss_pci_info_struct *)addr;
4013 
4014 	pis->bus = pci_get_bus(sc->ciss_dev);
4015 	pis->dev_fn = pci_get_slot(sc->ciss_dev);
4016 	pis->board_id = pci_get_devid(sc->ciss_dev);
4017 
4018 	break;
4019     }
4020 
4021     case CCISS_GETINTINFO:
4022     {
4023 	cciss_coalint_struct	*cis = (cciss_coalint_struct *)addr;
4024 
4025 	cis->delay = sc->ciss_cfg->interrupt_coalesce_delay;
4026 	cis->count = sc->ciss_cfg->interrupt_coalesce_count;
4027 
4028 	break;
4029     }
4030 
4031     case CCISS_SETINTINFO:
4032     {
4033 	cciss_coalint_struct	*cis = (cciss_coalint_struct *)addr;
4034 
4035 	if ((cis->delay == 0) && (cis->count == 0)) {
4036 	    error = EINVAL;
4037 	    break;
4038 	}
4039 
4040 	/*
4041 	 * XXX apparently this is only safe if the controller is idle,
4042 	 *     we should suspend it before doing this.
4043 	 */
4044 	sc->ciss_cfg->interrupt_coalesce_delay = cis->delay;
4045 	sc->ciss_cfg->interrupt_coalesce_count = cis->count;
4046 
4047 	if (ciss_update_config(sc))
4048 	    error = EIO;
4049 
4050 	/* XXX resume the controller here */
4051 	break;
4052     }
4053 
4054     case CCISS_GETNODENAME:
4055 	bcopy(sc->ciss_cfg->server_name, (NodeName_type *)addr,
4056 	      sizeof(NodeName_type));
4057 	break;
4058 
4059     case CCISS_SETNODENAME:
4060 	bcopy((NodeName_type *)addr, sc->ciss_cfg->server_name,
4061 	      sizeof(NodeName_type));
4062 	if (ciss_update_config(sc))
4063 	    error = EIO;
4064 	break;
4065 
4066     case CCISS_GETHEARTBEAT:
4067 	*(Heartbeat_type *)addr = sc->ciss_cfg->heartbeat;
4068 	break;
4069 
4070     case CCISS_GETBUSTYPES:
4071 	*(BusTypes_type *)addr = sc->ciss_cfg->bus_types;
4072 	break;
4073 
4074     case CCISS_GETFIRMVER:
4075 	bcopy(sc->ciss_id->running_firmware_revision, (FirmwareVer_type *)addr,
4076 	      sizeof(FirmwareVer_type));
4077 	break;
4078 
4079     case CCISS_GETDRIVERVER:
4080 	*(DriverVer_type *)addr = CISS_DRIVER_VERSION;
4081 	break;
4082 
4083     case CCISS_REVALIDVOLS:
4084 	/*
4085 	 * This is a bit ugly; to do it "right" we really need
4086 	 * to find any disks that have changed, kick CAM off them,
4087 	 * then rescan only these disks.  It'd be nice if they
4088 	 * a) told us which disk(s) they were going to play with,
4089 	 * and b) which ones had arrived. 8(
4090 	 */
4091 	break;
4092 
4093     case CCISS_PASSTHRU:
4094 	error = ciss_user_command(sc, (IOCTL_Command_struct *)addr);
4095 	break;
4096 
4097     default:
4098 	debug(0, "unknown ioctl 0x%lx", cmd);
4099 
4100 	debug(1, "CCISS_GETPCIINFO:   0x%lx", CCISS_GETPCIINFO);
4101 	debug(1, "CCISS_GETINTINFO:   0x%lx", CCISS_GETINTINFO);
4102 	debug(1, "CCISS_SETINTINFO:   0x%lx", CCISS_SETINTINFO);
4103 	debug(1, "CCISS_GETNODENAME:  0x%lx", CCISS_GETNODENAME);
4104 	debug(1, "CCISS_SETNODENAME:  0x%lx", CCISS_SETNODENAME);
4105 	debug(1, "CCISS_GETHEARTBEAT: 0x%lx", CCISS_GETHEARTBEAT);
4106 	debug(1, "CCISS_GETBUSTYPES:  0x%lx", CCISS_GETBUSTYPES);
4107 	debug(1, "CCISS_GETFIRMVER:   0x%lx", CCISS_GETFIRMVER);
4108 	debug(1, "CCISS_GETDRIVERVER: 0x%lx", CCISS_GETDRIVERVER);
4109 	debug(1, "CCISS_REVALIDVOLS:  0x%lx", CCISS_REVALIDVOLS);
4110 	debug(1, "CCISS_PASSTHRU:     0x%lx", CCISS_PASSTHRU);
4111 
4112 	error = ENOIOCTL;
4113 	break;
4114     }
4115 
4116     return(error);
4117 }
4118