xref: /freebsd/sys/dev/mlx/mlx.c (revision 055aefb1bcd6c54859c45274c8e03f03b3f5e681)
1 /*-
2  * Copyright (c) 1999 Michael Smith
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  *
26  *	$FreeBSD$
27  */
28 
29 /*
30  * Driver for the Mylex DAC960 family of RAID controllers.
31  */
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/malloc.h>
36 #include <sys/kernel.h>
37 
38 #include <sys/bio.h>
39 #include <sys/bus.h>
40 #include <sys/conf.h>
41 #include <sys/devicestat.h>
42 #include <sys/disk.h>
43 #include <sys/stat.h>
44 
45 #include <machine/resource.h>
46 #include <machine/bus_memio.h>
47 #include <machine/bus_pio.h>
48 #include <machine/bus.h>
49 #include <machine/clock.h>
50 #include <sys/rman.h>
51 
52 #include <dev/mlx/mlxio.h>
53 #include <dev/mlx/mlxvar.h>
54 #include <dev/mlx/mlxreg.h>
55 
56 #define MLX_CDEV_MAJOR	130
57 
58 static struct cdevsw mlx_cdevsw = {
59 		/* open */	mlx_open,
60 		/* close */	mlx_close,
61 		/* read */	noread,
62 		/* write */	nowrite,
63 		/* ioctl */	mlx_ioctl,
64 		/* poll */	nopoll,
65 		/* mmap */	nommap,
66 		/* strategy */	nostrategy,
67 		/* name */ 	"mlx",
68 		/* maj */	MLX_CDEV_MAJOR,
69 		/* dump */	nodump,
70 		/* psize */ 	nopsize,
71 		/* flags */	0,
72 		/* bmaj */	-1
73 };
74 
75 devclass_t	mlx_devclass;
76 
77 /*
78  * Per-interface accessor methods
79  */
80 static int			mlx_v3_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
81 static int			mlx_v3_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
82 static void			mlx_v3_intaction(struct mlx_softc *sc, int action);
83 static int			mlx_v3_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2);
84 
85 static int			mlx_v4_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
86 static int			mlx_v4_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
87 static void			mlx_v4_intaction(struct mlx_softc *sc, int action);
88 static int			mlx_v4_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2);
89 
90 static int			mlx_v5_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
91 static int			mlx_v5_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
92 static void			mlx_v5_intaction(struct mlx_softc *sc, int action);
93 static int			mlx_v5_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2);
94 
95 /*
96  * Status monitoring
97  */
98 static void			mlx_periodic(void *data);
99 static void			mlx_periodic_enquiry(struct mlx_command *mc);
100 static void			mlx_periodic_eventlog_poll(struct mlx_softc *sc);
101 static void			mlx_periodic_eventlog_respond(struct mlx_command *mc);
102 static void			mlx_periodic_rebuild(struct mlx_command *mc);
103 
104 /*
105  * Channel Pause
106  */
107 static void			mlx_pause_action(struct mlx_softc *sc);
108 static void			mlx_pause_done(struct mlx_command *mc);
109 
110 /*
111  * Command submission.
112  */
113 static void			*mlx_enquire(struct mlx_softc *sc, int command, size_t bufsize,
114 					     void (*complete)(struct mlx_command *mc));
115 static int			mlx_flush(struct mlx_softc *sc);
116 static int			mlx_check(struct mlx_softc *sc, int drive);
117 static int			mlx_rebuild(struct mlx_softc *sc, int channel, int target);
118 static int			mlx_wait_command(struct mlx_command *mc);
119 static int			mlx_poll_command(struct mlx_command *mc);
120 static void			mlx_startio(struct mlx_softc *sc);
121 static void			mlx_completeio(struct mlx_command *mc);
122 static int			mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu);
123 
124 /*
125  * Command buffer allocation.
126  */
127 static struct mlx_command	*mlx_alloccmd(struct mlx_softc *sc);
128 static void			mlx_releasecmd(struct mlx_command *mc);
129 static void			mlx_freecmd(struct mlx_command *mc);
130 
131 /*
132  * Command management.
133  */
134 static int			mlx_getslot(struct mlx_command *mc);
135 static void			mlx_mapcmd(struct mlx_command *mc);
136 static void			mlx_unmapcmd(struct mlx_command *mc);
137 static int			mlx_start(struct mlx_command *mc);
138 static int			mlx_done(struct mlx_softc *sc);
139 static void			mlx_complete(struct mlx_softc *sc);
140 
141 /*
142  * Debugging.
143  */
144 static char			*mlx_diagnose_command(struct mlx_command *mc);
145 static void			mlx_describe_controller(struct mlx_softc *sc);
146 static int			mlx_fw_message(struct mlx_softc *sc, int status, int param1, int param2);
147 
148 /*
149  * Utility functions.
150  */
151 static struct mlx_sysdrive	*mlx_findunit(struct mlx_softc *sc, int unit);
152 
153 /********************************************************************************
154  ********************************************************************************
155                                                                 Public Interfaces
156  ********************************************************************************
157  ********************************************************************************/
158 
159 /********************************************************************************
160  * Free all of the resources associated with (sc)
161  *
162  * Should not be called if the controller is active.
163  */
164 void
165 mlx_free(struct mlx_softc *sc)
166 {
167     struct mlx_command	*mc;
168 
169     debug_called(1);
170 
171     /* cancel status timeout */
172     untimeout(mlx_periodic, sc, sc->mlx_timeout);
173 
174     /* throw away any command buffers */
175     while ((mc = TAILQ_FIRST(&sc->mlx_freecmds)) != NULL) {
176 	TAILQ_REMOVE(&sc->mlx_freecmds, mc, mc_link);
177 	mlx_freecmd(mc);
178     }
179 
180     /* destroy data-transfer DMA tag */
181     if (sc->mlx_buffer_dmat)
182 	bus_dma_tag_destroy(sc->mlx_buffer_dmat);
183 
184     /* free and destroy DMA memory and tag for s/g lists */
185     if (sc->mlx_sgtable)
186 	bus_dmamem_free(sc->mlx_sg_dmat, sc->mlx_sgtable, sc->mlx_sg_dmamap);
187     if (sc->mlx_sg_dmat)
188 	bus_dma_tag_destroy(sc->mlx_sg_dmat);
189 
190     /* disconnect the interrupt handler */
191     if (sc->mlx_intr)
192 	bus_teardown_intr(sc->mlx_dev, sc->mlx_irq, sc->mlx_intr);
193     if (sc->mlx_irq != NULL)
194 	bus_release_resource(sc->mlx_dev, SYS_RES_IRQ, 0, sc->mlx_irq);
195 
196     /* destroy the parent DMA tag */
197     if (sc->mlx_parent_dmat)
198 	bus_dma_tag_destroy(sc->mlx_parent_dmat);
199 
200     /* release the register window mapping */
201     if (sc->mlx_mem != NULL)
202 	bus_release_resource(sc->mlx_dev, SYS_RES_MEMORY,
203 			     (sc->mlx_iftype == MLX_IFTYPE_3) ? MLX_CFG_BASE1 : MLX_CFG_BASE0, sc->mlx_mem);
204 
205     /* free controller enquiry data */
206     if (sc->mlx_enq2 != NULL)
207 	free(sc->mlx_enq2, M_DEVBUF);
208 
209     /* destroy control device */
210     if (sc->mlx_dev_t != (dev_t)NULL)
211 	destroy_dev(sc->mlx_dev_t);
212 }
213 
214 /********************************************************************************
215  * Map the scatter/gather table into bus space
216  */
217 static void
218 mlx_dma_map_sg(void *arg, bus_dma_segment_t *segs, int nseg, int error)
219 {
220     struct mlx_softc	*sc = (struct mlx_softc *)arg;
221 
222     debug_called(1);
223 
224     /* save base of s/g table's address in bus space */
225     sc->mlx_sgbusaddr = segs->ds_addr;
226 }
227 
228 static int
229 mlx_sglist_map(struct mlx_softc *sc)
230 {
231     size_t	segsize;
232     int		error, ncmd;
233 
234     debug_called(1);
235 
236     /* destroy any existing mappings */
237     if (sc->mlx_sgtable)
238 	bus_dmamem_free(sc->mlx_sg_dmat, sc->mlx_sgtable, sc->mlx_sg_dmamap);
239     if (sc->mlx_sg_dmat)
240 	bus_dma_tag_destroy(sc->mlx_sg_dmat);
241 
242     /*
243      * Create a single tag describing a region large enough to hold all of
244      * the s/g lists we will need.  If we're called early on, we don't know how
245      * many commands we're going to be asked to support, so only allocate enough
246      * for a couple.
247      */
248     if (sc->mlx_enq2 == NULL) {
249 	ncmd = 2;
250     } else {
251 	ncmd = sc->mlx_enq2->me_max_commands;
252     }
253     segsize = sizeof(struct mlx_sgentry) * MLX_NSEG * ncmd;
254     error = bus_dma_tag_create(sc->mlx_parent_dmat, 	/* parent */
255 			       1, 0, 			/* alignment, boundary */
256 			       BUS_SPACE_MAXADDR,	/* lowaddr */
257 			       BUS_SPACE_MAXADDR, 	/* highaddr */
258 			       NULL, NULL, 		/* filter, filterarg */
259 			       segsize, 1,		/* maxsize, nsegments */
260 			       BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
261 			       0,			/* flags */
262 			       &sc->mlx_sg_dmat);
263     if (error != 0) {
264 	device_printf(sc->mlx_dev, "can't allocate scatter/gather DMA tag\n");
265 	return(ENOMEM);
266     }
267 
268     /*
269      * Allocate enough s/g maps for all commands and permanently map them into
270      * controller-visible space.
271      *
272      * XXX this assumes we can get enough space for all the s/g maps in one
273      * contiguous slab.  We may need to switch to a more complex arrangement where
274      * we allocate in smaller chunks and keep a lookup table from slot to bus address.
275      */
276     error = bus_dmamem_alloc(sc->mlx_sg_dmat, (void **)&sc->mlx_sgtable, BUS_DMA_NOWAIT, &sc->mlx_sg_dmamap);
277     if (error) {
278 	device_printf(sc->mlx_dev, "can't allocate s/g table\n");
279 	return(ENOMEM);
280     }
281     bus_dmamap_load(sc->mlx_sg_dmat, sc->mlx_sg_dmamap, sc->mlx_sgtable, segsize, mlx_dma_map_sg, sc, 0);
282     return(0);
283 }
284 
285 /********************************************************************************
286  * Initialise the controller and softc
287  */
288 int
289 mlx_attach(struct mlx_softc *sc)
290 {
291     struct mlx_enquiry_old	*meo;
292     int				rid, error, fwminor, hscode, hserror, hsparam1, hsparam2, hsmsg;
293 
294     debug_called(1);
295 
296     /*
297      * Initialise per-controller queues.
298      */
299     TAILQ_INIT(&sc->mlx_work);
300     TAILQ_INIT(&sc->mlx_freecmds);
301     bioq_init(&sc->mlx_bioq);
302 
303     /*
304      * Select accessor methods based on controller interface type.
305      */
306     switch(sc->mlx_iftype) {
307     case MLX_IFTYPE_2:
308     case MLX_IFTYPE_3:
309 	sc->mlx_tryqueue	= mlx_v3_tryqueue;
310 	sc->mlx_findcomplete	= mlx_v3_findcomplete;
311 	sc->mlx_intaction	= mlx_v3_intaction;
312 	sc->mlx_fw_handshake	= mlx_v3_fw_handshake;
313 	break;
314     case MLX_IFTYPE_4:
315 	sc->mlx_tryqueue	= mlx_v4_tryqueue;
316 	sc->mlx_findcomplete	= mlx_v4_findcomplete;
317 	sc->mlx_intaction	= mlx_v4_intaction;
318 	sc->mlx_fw_handshake	= mlx_v4_fw_handshake;
319 	break;
320     case MLX_IFTYPE_5:
321 	sc->mlx_tryqueue	= mlx_v5_tryqueue;
322 	sc->mlx_findcomplete	= mlx_v5_findcomplete;
323 	sc->mlx_intaction	= mlx_v5_intaction;
324 	sc->mlx_fw_handshake	= mlx_v5_fw_handshake;
325 	break;
326     default:
327 	mlx_free(sc);
328 	return(ENXIO);		/* should never happen */
329     }
330 
331     /* disable interrupts before we start talking to the controller */
332     sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
333 
334     /*
335      * Wait for the controller to come ready, handshake with the firmware if required.
336      * This is typically only necessary on platforms where the controller BIOS does not
337      * run.
338      */
339     hsmsg = 0;
340     DELAY(1000);
341     while ((hscode = sc->mlx_fw_handshake(sc, &hserror, &hsparam1, &hsparam2)) != 0) {
342 	/* report first time around... */
343 	if (hsmsg == 0) {
344 	    device_printf(sc->mlx_dev, "controller initialisation in progress...\n");
345 	    hsmsg = 1;
346 	}
347 	/* did we get a real message? */
348 	if (hscode == 2) {
349 	    hscode = mlx_fw_message(sc, hserror, hsparam1, hsparam2);
350 	    /* fatal initialisation error? */
351 	    if (hscode != 0) {
352 		mlx_free(sc);
353 		return(ENXIO);
354 	    }
355 	}
356     }
357     if (hsmsg == 1)
358 	device_printf(sc->mlx_dev, "initialisation complete.\n");
359 
360     /*
361      * Allocate and connect our interrupt.
362      */
363     rid = 0;
364     sc->mlx_irq = bus_alloc_resource(sc->mlx_dev, SYS_RES_IRQ, &rid, 0, ~0, 1, RF_SHAREABLE | RF_ACTIVE);
365     if (sc->mlx_irq == NULL) {
366 	device_printf(sc->mlx_dev, "can't allocate interrupt\n");
367 	mlx_free(sc);
368 	return(ENXIO);
369     }
370     error = bus_setup_intr(sc->mlx_dev, sc->mlx_irq, INTR_TYPE_BIO,  mlx_intr, sc, &sc->mlx_intr);
371     if (error) {
372 	device_printf(sc->mlx_dev, "can't set up interrupt\n");
373 	mlx_free(sc);
374 	return(ENXIO);
375     }
376 
377     /*
378      * Create DMA tag for mapping buffers into controller-addressable space.
379      */
380     error = bus_dma_tag_create(sc->mlx_parent_dmat, 		/* parent */
381 			       1, 0, 				/* alignment, boundary */
382 			       BUS_SPACE_MAXADDR,		/* lowaddr */
383 			       BUS_SPACE_MAXADDR, 		/* highaddr */
384 			       NULL, NULL, 			/* filter, filterarg */
385 			       MAXBSIZE, MLX_NSEG,		/* maxsize, nsegments */
386 			       BUS_SPACE_MAXSIZE_32BIT,		/* maxsegsize */
387 			       0,				/* flags */
388 			       &sc->mlx_buffer_dmat);
389     if (error != 0) {
390 	device_printf(sc->mlx_dev, "can't allocate buffer DMA tag\n");
391 	mlx_free(sc);
392 	return(ENOMEM);
393     }
394 
395     /*
396      * Create some initial scatter/gather mappings so we can run the probe commands.
397      */
398     error = mlx_sglist_map(sc);
399     if (error != 0) {
400 	device_printf(sc->mlx_dev, "can't make initial s/g list mapping\n");
401 	mlx_free(sc);
402 	return(error);
403     }
404 
405     /*
406      * We don't (yet) know where the event log is up to.
407      */
408     sc->mlx_currevent = -1;
409 
410     /*
411      * Obtain controller feature information
412      */
413     if ((sc->mlx_enq2 = mlx_enquire(sc, MLX_CMD_ENQUIRY2, sizeof(struct mlx_enquiry2), NULL)) == NULL) {
414 	device_printf(sc->mlx_dev, "ENQUIRY2 failed\n");
415 	mlx_free(sc);
416 	return(ENXIO);
417     }
418 
419     /*
420      * Do quirk/feature related things.
421      */
422     fwminor = (sc->mlx_enq2->me_firmware_id >> 8) & 0xff;
423     switch(sc->mlx_iftype) {
424     case MLX_IFTYPE_2:
425 	/* These controllers don't report the firmware version in the ENQUIRY2 response */
426 	if ((meo = mlx_enquire(sc, MLX_CMD_ENQUIRY_OLD, sizeof(struct mlx_enquiry_old), NULL)) == NULL) {
427 	    device_printf(sc->mlx_dev, "ENQUIRY_OLD failed\n");
428 	    mlx_free(sc);
429 	    return(ENXIO);
430 	}
431 	sc->mlx_enq2->me_firmware_id = ('0' << 24) | (0 << 16) | (meo->me_fwminor << 8) | meo->me_fwmajor;
432 	free(meo, M_DEVBUF);
433 
434 	/* XXX require 2.42 or better (PCI) or 2.14 or better (EISA) */
435 	if (meo->me_fwminor < 42) {
436 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
437 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 2.42 or later\n");
438 	}
439 	break;
440     case MLX_IFTYPE_3:
441 	/* XXX certify 3.52? */
442 	if (fwminor < 51) {
443 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
444 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 3.51 or later\n");
445 	}
446 	break;
447     case MLX_IFTYPE_4:
448 	/* XXX certify firmware versions? */
449 	if (fwminor < 6) {
450 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
451 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 4.06 or later\n");
452 	}
453 	break;
454     case MLX_IFTYPE_5:
455 	if (fwminor < 7) {
456 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
457 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 5.07 or later\n");
458 	}
459 	break;
460     default:
461 	mlx_free(sc);
462 	return(ENXIO);		/* should never happen */
463     }
464 
465     /*
466      * Create the final scatter/gather mappings now that we have characterised the controller.
467      */
468     error = mlx_sglist_map(sc);
469     if (error != 0) {
470 	device_printf(sc->mlx_dev, "can't make final s/g list mapping\n");
471 	mlx_free(sc);
472 	return(error);
473     }
474 
475     /*
476      * No user-requested background operation is in progress.
477      */
478     sc->mlx_background = 0;
479     sc->mlx_rebuildstat.rs_code = MLX_REBUILDSTAT_IDLE;
480 
481     /*
482      * Create the control device.
483      */
484     sc->mlx_dev_t = make_dev(&mlx_cdevsw, device_get_unit(sc->mlx_dev), UID_ROOT, GID_OPERATOR,
485 			     S_IRUSR | S_IWUSR, "mlx%d", device_get_unit(sc->mlx_dev));
486 
487     /*
488      * Start the timeout routine.
489      */
490     sc->mlx_timeout = timeout(mlx_periodic, sc, hz);
491 
492     /* print a little information about the controller */
493     mlx_describe_controller(sc);
494 
495     return(0);
496 }
497 
498 /********************************************************************************
499  * Locate disk resources and attach children to them.
500  */
501 void
502 mlx_startup(struct mlx_softc *sc)
503 {
504     struct mlx_enq_sys_drive	*mes;
505     struct mlx_sysdrive		*dr;
506     int				i, error;
507 
508     debug_called(1);
509 
510     /*
511      * Scan all the system drives and attach children for those that
512      * don't currently have them.
513      */
514     mes = mlx_enquire(sc, MLX_CMD_ENQSYSDRIVE, sizeof(*mes) * MLX_MAXDRIVES, NULL);
515     if (mes == NULL) {
516 	device_printf(sc->mlx_dev, "error fetching drive status\n");
517 	return;
518     }
519 
520     /* iterate over drives returned */
521     for (i = 0, dr = &sc->mlx_sysdrive[0];
522 	 (i < MLX_MAXDRIVES) && (mes[i].sd_size != 0xffffffff);
523 	 i++, dr++) {
524 	/* are we already attached to this drive? */
525     	if (dr->ms_disk == 0) {
526 	    /* pick up drive information */
527 	    dr->ms_size = mes[i].sd_size;
528 	    dr->ms_raidlevel = mes[i].sd_raidlevel & 0xf;
529 	    dr->ms_state = mes[i].sd_state;
530 
531 	    /* generate geometry information */
532 	    if (sc->mlx_geom == MLX_GEOM_128_32) {
533 		dr->ms_heads = 128;
534 		dr->ms_sectors = 32;
535 		dr->ms_cylinders = dr->ms_size / (128 * 32);
536 	    } else {        /* MLX_GEOM_255/63 */
537 		dr->ms_heads = 255;
538 		dr->ms_sectors = 63;
539 		dr->ms_cylinders = dr->ms_size / (255 * 63);
540 	    }
541 	    dr->ms_disk =  device_add_child(sc->mlx_dev, /*"mlxd"*/NULL, -1);
542 	    if (dr->ms_disk == 0)
543 		device_printf(sc->mlx_dev, "device_add_child failed\n");
544 	    device_set_ivars(dr->ms_disk, dr);
545 	}
546     }
547     free(mes, M_DEVBUF);
548     if ((error = bus_generic_attach(sc->mlx_dev)) != 0)
549 	device_printf(sc->mlx_dev, "bus_generic_attach returned %d", error);
550 
551     /* mark controller back up */
552     sc->mlx_state &= ~MLX_STATE_SHUTDOWN;
553 
554     /* enable interrupts */
555     sc->mlx_intaction(sc, MLX_INTACTION_ENABLE);
556 }
557 
558 /********************************************************************************
559  * Disconnect from the controller completely, in preparation for unload.
560  */
561 int
562 mlx_detach(device_t dev)
563 {
564     struct mlx_softc	*sc = device_get_softc(dev);
565     struct mlxd_softc	*mlxd;
566     int			i, s, error;
567 
568     debug_called(1);
569 
570     error = EBUSY;
571     s = splbio();
572     if (sc->mlx_state & MLX_STATE_OPEN)
573 	goto out;
574 
575     for (i = 0; i < MLX_MAXDRIVES; i++) {
576 	if (sc->mlx_sysdrive[i].ms_disk != 0) {
577 	    mlxd = device_get_softc(sc->mlx_sysdrive[i].ms_disk);
578 	    if (mlxd->mlxd_flags & MLXD_OPEN) {		/* drive is mounted, abort detach */
579 		device_printf(sc->mlx_sysdrive[i].ms_disk, "still open, can't detach\n");
580 		goto out;
581 	    }
582 	}
583     }
584     if ((error = mlx_shutdown(dev)))
585 	goto out;
586 
587     mlx_free(sc);
588 
589     error = 0;
590  out:
591     splx(s);
592     return(error);
593 }
594 
595 /********************************************************************************
596  * Bring the controller down to a dormant state and detach all child devices.
597  *
598  * This function is called before detach, system shutdown, or before performing
599  * an operation which may add or delete system disks.  (Call mlx_startup to
600  * resume normal operation.)
601  *
602  * Note that we can assume that the bioq on the controller is empty, as we won't
603  * allow shutdown if any device is open.
604  */
605 int
606 mlx_shutdown(device_t dev)
607 {
608     struct mlx_softc	*sc = device_get_softc(dev);
609     int			i, s, error;
610 
611     debug_called(1);
612 
613     s = splbio();
614     error = 0;
615 
616     sc->mlx_state |= MLX_STATE_SHUTDOWN;
617     sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
618 
619     /* flush controller */
620     device_printf(sc->mlx_dev, "flushing cache...");
621     if (mlx_flush(sc)) {
622 	printf("failed\n");
623     } else {
624 	printf("done\n");
625     }
626 
627     /* delete all our child devices */
628     for (i = 0; i < MLX_MAXDRIVES; i++) {
629 	if (sc->mlx_sysdrive[i].ms_disk != 0) {
630 	    if ((error = device_delete_child(sc->mlx_dev, sc->mlx_sysdrive[i].ms_disk)) != 0)
631 		goto out;
632 	    sc->mlx_sysdrive[i].ms_disk = 0;
633 	}
634     }
635 
636  out:
637     splx(s);
638     return(error);
639 }
640 
641 /********************************************************************************
642  * Bring the controller to a quiescent state, ready for system suspend.
643  */
644 int
645 mlx_suspend(device_t dev)
646 {
647     struct mlx_softc	*sc = device_get_softc(dev);
648     int			s;
649 
650     debug_called(1);
651 
652     s = splbio();
653     sc->mlx_state |= MLX_STATE_SUSPEND;
654 
655     /* flush controller */
656     device_printf(sc->mlx_dev, "flushing cache...");
657     printf("%s\n", mlx_flush(sc) ? "failed" : "done");
658 
659     sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
660     splx(s);
661 
662     return(0);
663 }
664 
665 /********************************************************************************
666  * Bring the controller back to a state ready for operation.
667  */
668 int
669 mlx_resume(device_t dev)
670 {
671     struct mlx_softc	*sc = device_get_softc(dev);
672 
673     debug_called(1);
674 
675     sc->mlx_state &= ~MLX_STATE_SUSPEND;
676     sc->mlx_intaction(sc, MLX_INTACTION_ENABLE);
677 
678     return(0);
679 }
680 
681 /*******************************************************************************
682  * Take an interrupt, or be poked by other code to look for interrupt-worthy
683  * status.
684  */
685 void
686 mlx_intr(void *arg)
687 {
688     struct mlx_softc	*sc = (struct mlx_softc *)arg;
689 
690     debug_called(1);
691 
692     /* collect finished commands, queue anything waiting */
693     mlx_done(sc);
694 };
695 
696 /*******************************************************************************
697  * Receive a buf structure from a child device and queue it on a particular
698  * disk resource, then poke the disk resource to start as much work as it can.
699  */
700 int
701 mlx_submit_buf(struct mlx_softc *sc, struct bio *bp)
702 {
703     int		s;
704 
705     debug_called(1);
706 
707     s = splbio();
708     bioq_insert_tail(&sc->mlx_bioq, bp);
709     sc->mlx_waitbufs++;
710     splx(s);
711     mlx_startio(sc);
712     return(0);
713 }
714 
715 /********************************************************************************
716  * Accept an open operation on the control device.
717  */
718 int
719 mlx_open(dev_t dev, int flags, int fmt, struct proc *p)
720 {
721     int			unit = minor(dev);
722     struct mlx_softc	*sc = devclass_get_softc(mlx_devclass, unit);
723 
724     sc->mlx_state |= MLX_STATE_OPEN;
725     return(0);
726 }
727 
728 /********************************************************************************
729  * Accept the last close on the control device.
730  */
731 int
732 mlx_close(dev_t dev, int flags, int fmt, struct proc *p)
733 {
734     int			unit = minor(dev);
735     struct mlx_softc	*sc = devclass_get_softc(mlx_devclass, unit);
736 
737     sc->mlx_state &= ~MLX_STATE_OPEN;
738     return (0);
739 }
740 
741 /********************************************************************************
742  * Handle controller-specific control operations.
743  */
744 int
745 mlx_ioctl(dev_t dev, u_long cmd, caddr_t addr, int32_t flag, struct proc *p)
746 {
747     int				unit = minor(dev);
748     struct mlx_softc		*sc = devclass_get_softc(mlx_devclass, unit);
749     struct mlx_rebuild_request	*rb = (struct mlx_rebuild_request *)addr;
750     struct mlx_rebuild_status	*rs = (struct mlx_rebuild_status *)addr;
751     int				*arg = (int *)addr;
752     struct mlx_pause		*mp;
753     struct mlx_sysdrive		*dr;
754     struct mlxd_softc		*mlxd;
755     int				i, error;
756 
757     switch(cmd) {
758 	/*
759 	 * Enumerate connected system drives; returns the first system drive's
760 	 * unit number if *arg is -1, or the next unit after *arg if it's
761 	 * a valid unit on this controller.
762 	 */
763     case MLX_NEXT_CHILD:
764 	/* search system drives */
765 	for (i = 0; i < MLX_MAXDRIVES; i++) {
766 	    /* is this one attached? */
767 	    if (sc->mlx_sysdrive[i].ms_disk != 0) {
768 		/* looking for the next one we come across? */
769 		if (*arg == -1) {
770 		    *arg = device_get_unit(sc->mlx_sysdrive[0].ms_disk);
771 		    return(0);
772 		}
773 		/* we want the one after this one */
774 		if (*arg == device_get_unit(sc->mlx_sysdrive[i].ms_disk))
775 		    *arg = -1;
776 	    }
777 	}
778 	return(ENOENT);
779 
780 	/*
781 	 * Scan the controller to see whether new drives have appeared.
782 	 */
783     case MLX_RESCAN_DRIVES:
784 	mlx_startup(sc);
785 	return(0);
786 
787 	/*
788 	 * Disconnect from the specified drive; it may be about to go
789 	 * away.
790 	 */
791     case MLX_DETACH_DRIVE:			/* detach one drive */
792 
793 	if (((dr = mlx_findunit(sc, *arg)) == NULL) ||
794 	    ((mlxd = device_get_softc(dr->ms_disk)) == NULL))
795 	    return(ENOENT);
796 
797 	device_printf(dr->ms_disk, "detaching...");
798 	error = 0;
799 	if (mlxd->mlxd_flags & MLXD_OPEN) {
800 	    error = EBUSY;
801 	    goto detach_out;
802 	}
803 
804 	/* flush controller */
805 	if (mlx_flush(sc)) {
806 	    error = EBUSY;
807 	    goto detach_out;
808 	}
809 
810 	/* nuke drive */
811 	if ((error = device_delete_child(sc->mlx_dev, dr->ms_disk)) != 0)
812 	    goto detach_out;
813 	dr->ms_disk = 0;
814 
815     detach_out:
816 	if (error) {
817 	    printf("failed\n");
818 	} else {
819 	    printf("done\n");
820 	}
821 	return(error);
822 
823 	/*
824 	 * Pause one or more SCSI channels for a period of time, to assist
825 	 * in the process of hot-swapping devices.
826 	 *
827 	 * Note that at least the 3.51 firmware on the DAC960PL doesn't seem
828 	 * to do this right.
829 	 */
830     case MLX_PAUSE_CHANNEL:			/* schedule a channel pause */
831 	/* Does this command work on this firmware? */
832 	if (!(sc->mlx_feature & MLX_FEAT_PAUSEWORKS))
833 	    return(EOPNOTSUPP);
834 
835 	mp = (struct mlx_pause *)addr;
836 	if ((mp->mp_which == MLX_PAUSE_CANCEL) && (sc->mlx_pause.mp_when != 0)) {
837 	    /* cancel a pending pause operation */
838 	    sc->mlx_pause.mp_which = 0;
839 	} else {
840 	    /* fix for legal channels */
841 	    mp->mp_which &= ((1 << sc->mlx_enq2->me_actual_channels) -1);
842 	    /* check time values */
843 	    if ((mp->mp_when < 0) || (mp->mp_when > 3600))
844 		return(EINVAL);
845 	    if ((mp->mp_howlong < 1) || (mp->mp_howlong > (0xf * 30)))
846 		return(EINVAL);
847 
848 	    /* check for a pause currently running */
849 	    if ((sc->mlx_pause.mp_which != 0) && (sc->mlx_pause.mp_when == 0))
850 		return(EBUSY);
851 
852 	    /* looks ok, go with it */
853 	    sc->mlx_pause.mp_which = mp->mp_which;
854 	    sc->mlx_pause.mp_when = time_second + mp->mp_when;
855 	    sc->mlx_pause.mp_howlong = sc->mlx_pause.mp_when + mp->mp_howlong;
856 	}
857 	return(0);
858 
859 	/*
860 	 * Accept a command passthrough-style.
861 	 */
862     case MLX_COMMAND:
863 	return(mlx_user_command(sc, (struct mlx_usercommand *)addr));
864 
865 	/*
866 	 * Start a rebuild on a given SCSI disk
867 	 */
868     case MLX_REBUILDASYNC:
869 	if (sc->mlx_background != 0) {
870 	    rb->rr_status = 0x0106;
871 	    return(EBUSY);
872 	}
873 	rb->rr_status = mlx_rebuild(sc, rb->rr_channel, rb->rr_target);
874 	switch (rb->rr_status) {
875 	case 0:
876 	    error = 0;
877 	    break;
878 	case 0x10000:
879 	    error = ENOMEM;		/* couldn't set up the command */
880 	    break;
881 	case 0x0002:
882 	    error = EBUSY;
883 	    break;
884 	case 0x0104:
885 	    error = EIO;
886 	    break;
887 	case 0x0105:
888 	    error = ERANGE;
889 	    break;
890 	case 0x0106:
891 	    error = EBUSY;
892 	    break;
893 	default:
894 	    error = EINVAL;
895 	    break;
896 	}
897 	if (error == 0)
898 	    sc->mlx_background = MLX_BACKGROUND_REBUILD;
899 	return(error);
900 
901 	/*
902 	 * Get the status of the current rebuild or consistency check.
903 	 */
904     case MLX_REBUILDSTAT:
905 	*rs = sc->mlx_rebuildstat;
906 	return(0);
907 
908 	/*
909 	 * Return the per-controller system drive number matching the
910 	 * disk device number in (arg), if it happens to belong to us.
911 	 */
912     case MLX_GET_SYSDRIVE:
913 	error = ENOENT;
914 	mlxd = (struct mlxd_softc *)devclass_get_softc(mlxd_devclass, *arg);
915 	if ((mlxd != NULL) && (mlxd->mlxd_drive >= sc->mlx_sysdrive) &&
916 	    (mlxd->mlxd_drive < (sc->mlx_sysdrive + MLX_MAXDRIVES))) {
917 	    error = 0;
918 	    *arg = mlxd->mlxd_drive - sc->mlx_sysdrive;
919 	}
920 	return(error);
921 
922     default:
923 	return(ENOTTY);
924     }
925 }
926 
927 /********************************************************************************
928  * Handle operations requested by a System Drive connected to this controller.
929  */
930 int
931 mlx_submit_ioctl(struct mlx_softc *sc, struct mlx_sysdrive *drive, u_long cmd,
932 		caddr_t addr, int32_t flag, struct proc *p)
933 {
934     int				*arg = (int *)addr;
935     int				error, result;
936 
937     switch(cmd) {
938 	/*
939 	 * Return the current status of this drive.
940 	 */
941     case MLXD_STATUS:
942 	*arg = drive->ms_state;
943 	return(0);
944 
945 	/*
946 	 * Start a background consistency check on this drive.
947 	 */
948     case MLXD_CHECKASYNC:		/* start a background consistency check */
949 	if (sc->mlx_background != 0) {
950 	    *arg = 0x0106;
951 	    return(EBUSY);
952 	}
953 	result = mlx_check(sc, drive - &sc->mlx_sysdrive[0]);
954 	switch (result) {
955 	case 0:
956 	    error = 0;
957 	    break;
958 	case 0x10000:
959 	    error = ENOMEM;		/* couldn't set up the command */
960 	    break;
961 	case 0x0002:
962 	    error = EIO;
963 	    break;
964 	case 0x0105:
965 	    error = ERANGE;
966 	    break;
967 	case 0x0106:
968 	    error = EBUSY;
969 	    break;
970 	default:
971 	    error = EINVAL;
972 	    break;
973 	}
974 	if (error == 0)
975 	    sc->mlx_background = MLX_BACKGROUND_CHECK;
976 	*arg = result;
977 	return(error);
978 
979     }
980     return(ENOIOCTL);
981 }
982 
983 
984 /********************************************************************************
985  ********************************************************************************
986                                                                 Status Monitoring
987  ********************************************************************************
988  ********************************************************************************/
989 
990 /********************************************************************************
991  * Fire off commands to periodically check the status of connected drives.
992  */
993 static void
994 mlx_periodic(void *data)
995 {
996     struct mlx_softc *sc = (struct mlx_softc *)data;
997 
998     debug_called(1);
999 
1000     /*
1001      * Run a bus pause?
1002      */
1003     if ((sc->mlx_pause.mp_which != 0) &&
1004 	(sc->mlx_pause.mp_when > 0) &&
1005 	(time_second >= sc->mlx_pause.mp_when)){
1006 
1007 	mlx_pause_action(sc);		/* pause is running */
1008 	sc->mlx_pause.mp_when = 0;
1009 	sysbeep(500, hz);
1010 
1011 	/*
1012 	 * Bus pause still running?
1013 	 */
1014     } else if ((sc->mlx_pause.mp_which != 0) &&
1015 	       (sc->mlx_pause.mp_when == 0)) {
1016 
1017 	/* time to stop bus pause? */
1018 	if (time_second >= sc->mlx_pause.mp_howlong) {
1019 	    mlx_pause_action(sc);
1020 	    sc->mlx_pause.mp_which = 0;	/* pause is complete */
1021 	    sysbeep(500, hz);
1022 	} else {
1023 	    sysbeep((time_second % 5) * 100 + 500, hz/8);
1024 	}
1025 
1026 	/*
1027 	 * Run normal periodic activities?
1028 	 */
1029     } else if (time_second > (sc->mlx_lastpoll + 10)) {
1030 	sc->mlx_lastpoll = time_second;
1031 
1032 	/*
1033 	 * Check controller status.
1034 	 *
1035 	 * XXX Note that this may not actually launch a command in situations of high load.
1036 	 */
1037 	mlx_enquire(sc, (sc->mlx_iftype == MLX_IFTYPE_2) ? MLX_CMD_ENQUIRY_OLD : MLX_CMD_ENQUIRY,
1038 		    imax(sizeof(struct mlx_enquiry), sizeof(struct mlx_enquiry_old)), mlx_periodic_enquiry);
1039 
1040 	/*
1041 	 * Check system drive status.
1042 	 *
1043 	 * XXX This might be better left to event-driven detection, eg. I/O to an offline
1044 	 *     drive will detect it's offline, rebuilds etc. should detect the drive is back
1045 	 *     online.
1046 	 */
1047 	mlx_enquire(sc, MLX_CMD_ENQSYSDRIVE, sizeof(struct mlx_enq_sys_drive) * MLX_MAXDRIVES,
1048 			mlx_periodic_enquiry);
1049 
1050     }
1051 
1052     /* get drive rebuild/check status */
1053     /* XXX should check sc->mlx_background if this is only valid while in progress */
1054     mlx_enquire(sc, MLX_CMD_REBUILDSTAT, sizeof(struct mlx_rebuild_stat), mlx_periodic_rebuild);
1055 
1056     /* deal with possibly-missed interrupts and timed-out commands */
1057     mlx_done(sc);
1058 
1059     /* reschedule another poll next second or so */
1060     sc->mlx_timeout = timeout(mlx_periodic, sc, hz);
1061 }
1062 
1063 /********************************************************************************
1064  * Handle the result of an ENQUIRY command instigated by periodic status polling.
1065  */
1066 static void
1067 mlx_periodic_enquiry(struct mlx_command *mc)
1068 {
1069     struct mlx_softc		*sc = mc->mc_sc;
1070 
1071     debug_called(1);
1072 
1073     /* Command completed OK? */
1074     if (mc->mc_status != 0) {
1075 	device_printf(sc->mlx_dev, "periodic enquiry failed - %s\n", mlx_diagnose_command(mc));
1076 	goto out;
1077     }
1078 
1079     /* respond to command */
1080     switch(mc->mc_mailbox[0]) {
1081 	/*
1082 	 * This is currently a bit fruitless, as we don't know how to extract the eventlog
1083 	 * pointer yet.
1084 	 */
1085     case MLX_CMD_ENQUIRY_OLD:
1086     {
1087 	struct mlx_enquiry		*me = (struct mlx_enquiry *)mc->mc_data;
1088 	struct mlx_enquiry_old		*meo = (struct mlx_enquiry_old *)mc->mc_data;
1089 	int				i;
1090 
1091 	/* convert data in-place to new format */
1092 	for (i = (sizeof(me->me_dead) / sizeof(me->me_dead[0])) - 1; i >= 0; i--) {
1093 	    me->me_dead[i].dd_chan = meo->me_dead[i].dd_chan;
1094 	    me->me_dead[i].dd_targ = meo->me_dead[i].dd_targ;
1095 	}
1096 	me->me_misc_flags        = 0;
1097 	me->me_rebuild_count     = meo->me_rebuild_count;
1098 	me->me_dead_count        = meo->me_dead_count;
1099 	me->me_critical_sd_count = meo->me_critical_sd_count;
1100 	me->me_event_log_seq_num = 0;
1101 	me->me_offline_sd_count  = meo->me_offline_sd_count;
1102 	me->me_max_commands      = meo->me_max_commands;
1103 	me->me_rebuild_flag      = meo->me_rebuild_flag;
1104 	me->me_fwmajor           = meo->me_fwmajor;
1105 	me->me_fwminor           = meo->me_fwminor;
1106 	me->me_status_flags      = meo->me_status_flags;
1107 	me->me_flash_age         = meo->me_flash_age;
1108 	for (i = (sizeof(me->me_drvsize) / sizeof(me->me_drvsize[0])) - 1; i >= 0; i--) {
1109 	    if (i > ((sizeof(meo->me_drvsize) / sizeof(meo->me_drvsize[0])) - 1)) {
1110 		me->me_drvsize[i] = 0;		/* drive beyond supported range */
1111 	    } else {
1112 		me->me_drvsize[i] = meo->me_drvsize[i];
1113 	    }
1114 	}
1115 	me->me_num_sys_drvs = meo->me_num_sys_drvs;
1116     }
1117     /* FALLTHROUGH */
1118 
1119 	/*
1120 	 * Generic controller status update.  We could do more with this than just
1121 	 * checking the event log.
1122 	 */
1123     case MLX_CMD_ENQUIRY:
1124     {
1125 	struct mlx_enquiry		*me = (struct mlx_enquiry *)mc->mc_data;
1126 
1127 	if (sc->mlx_currevent == -1) {
1128 	    /* initialise our view of the event log */
1129 	    sc->mlx_currevent = sc->mlx_lastevent = me->me_event_log_seq_num;
1130 	} else if ((me->me_event_log_seq_num != sc->mlx_lastevent) && !(sc->mlx_flags & MLX_EVENTLOG_BUSY)) {
1131 	    /* record where current events are up to */
1132 	    sc->mlx_currevent = me->me_event_log_seq_num;
1133 	    debug(1, "event log pointer was %d, now %d\n", sc->mlx_lastevent, sc->mlx_currevent);
1134 
1135 	    /* mark the event log as busy */
1136 	    atomic_set_int(&sc->mlx_flags, MLX_EVENTLOG_BUSY);
1137 
1138 	    /* drain new eventlog entries */
1139 	    mlx_periodic_eventlog_poll(sc);
1140 	}
1141 	break;
1142     }
1143     case MLX_CMD_ENQSYSDRIVE:
1144     {
1145 	struct mlx_enq_sys_drive	*mes = (struct mlx_enq_sys_drive *)mc->mc_data;
1146 	struct mlx_sysdrive		*dr;
1147 	int				i;
1148 
1149 	for (i = 0, dr = &sc->mlx_sysdrive[0];
1150 	     (i < MLX_MAXDRIVES) && (mes[i].sd_size != 0xffffffff);
1151 	     i++) {
1152 
1153 	    /* has state been changed by controller? */
1154 	    if (dr->ms_state != mes[i].sd_state) {
1155 		switch(mes[i].sd_state) {
1156 		case MLX_SYSD_OFFLINE:
1157 		    device_printf(dr->ms_disk, "drive offline\n");
1158 		    break;
1159 		case MLX_SYSD_ONLINE:
1160 		    device_printf(dr->ms_disk, "drive online\n");
1161 		    break;
1162 		case MLX_SYSD_CRITICAL:
1163 		    device_printf(dr->ms_disk, "drive critical\n");
1164 		    break;
1165 		}
1166 		/* save new state */
1167 		dr->ms_state = mes[i].sd_state;
1168 	    }
1169 	}
1170 	break;
1171     }
1172     default:
1173 	device_printf(sc->mlx_dev, "%s: unknown command 0x%x", __FUNCTION__, mc->mc_mailbox[0]);
1174 	break;
1175     }
1176 
1177  out:
1178     free(mc->mc_data, M_DEVBUF);
1179     mlx_releasecmd(mc);
1180 }
1181 
1182 /********************************************************************************
1183  * Instigate a poll for one event log message on (sc).
1184  * We only poll for one message at a time, to keep our command usage down.
1185  */
1186 static void
1187 mlx_periodic_eventlog_poll(struct mlx_softc *sc)
1188 {
1189     struct mlx_command	*mc;
1190     void		*result = NULL;
1191     int			error;
1192 
1193     debug_called(1);
1194 
1195     /* get ourselves a command buffer */
1196     error = 1;
1197     if ((mc = mlx_alloccmd(sc)) == NULL)
1198 	goto out;
1199     /* allocate the response structure */
1200     if ((result = malloc(/*sizeof(struct mlx_eventlog_entry)*/1024, M_DEVBUF, M_NOWAIT)) == NULL)
1201 	goto out;
1202     /* get a command slot */
1203     if (mlx_getslot(mc))
1204 	goto out;
1205 
1206     /* map the command so the controller can see it */
1207     mc->mc_data = result;
1208     mc->mc_length = /*sizeof(struct mlx_eventlog_entry)*/1024;
1209     mlx_mapcmd(mc);
1210 
1211     /* build the command to get one entry */
1212     mlx_make_type3(mc, MLX_CMD_LOGOP, MLX_LOGOP_GET, 1, sc->mlx_lastevent, 0, 0, mc->mc_dataphys, 0);
1213     mc->mc_complete = mlx_periodic_eventlog_respond;
1214     mc->mc_private = mc;
1215 
1216     /* start the command */
1217     if ((error = mlx_start(mc)) != 0)
1218 	goto out;
1219 
1220     error = 0;			/* success */
1221  out:
1222     if (error != 0) {
1223 	if (mc != NULL)
1224 	    mlx_releasecmd(mc);
1225 	if (result != NULL)
1226 	    free(result, M_DEVBUF);
1227     }
1228 }
1229 
1230 /********************************************************************************
1231  * Handle the result of polling for a log message, generate diagnostic output.
1232  * If this wasn't the last message waiting for us, we'll go collect another.
1233  */
1234 static char *mlx_sense_messages[] = {
1235     "because write recovery failed",
1236     "because of SCSI bus reset failure",
1237     "because of double check condition",
1238     "because it was removed",
1239     "because of gross error on SCSI chip",
1240     "because of bad tag returned from drive",
1241     "because of timeout on SCSI command",
1242     "because of reset SCSI command issued from system",
1243     "because busy or parity error count exceeded limit",
1244     "because of 'kill drive' command from system",
1245     "because of selection timeout",
1246     "due to SCSI phase sequence error",
1247     "due to unknown status"
1248 };
1249 
1250 static void
1251 mlx_periodic_eventlog_respond(struct mlx_command *mc)
1252 {
1253     struct mlx_softc		*sc = mc->mc_sc;
1254     struct mlx_eventlog_entry	*el = (struct mlx_eventlog_entry *)mc->mc_data;
1255     char			*reason;
1256 
1257     debug_called(1);
1258 
1259     sc->mlx_lastevent++;		/* next message... */
1260     if (mc->mc_status == 0) {
1261 
1262 	/* handle event log message */
1263 	switch(el->el_type) {
1264 	    /*
1265 	     * This is the only sort of message we understand at the moment.
1266 	     * The tests here are probably incomplete.
1267 	     */
1268 	case MLX_LOGMSG_SENSE:	/* sense data */
1269 	    /* Mylex vendor-specific message indicating a drive was killed? */
1270 	    if ((el->el_sensekey == 9) &&
1271 		(el->el_asc == 0x80)) {
1272 		if (el->el_asq < (sizeof(mlx_sense_messages) / sizeof(mlx_sense_messages[0]))) {
1273 		    reason = mlx_sense_messages[el->el_asq];
1274 		} else {
1275 		    reason = "for unknown reason";
1276 		}
1277 		device_printf(sc->mlx_dev, "physical drive %d:%d killed %s\n",
1278 			      el->el_channel, el->el_target, reason);
1279 	    }
1280 	    /* SCSI drive was reset? */
1281 	    if ((el->el_sensekey == 6) && (el->el_asc == 0x29)) {
1282 		device_printf(sc->mlx_dev, "physical drive %d:%d reset\n",
1283 			      el->el_channel, el->el_target);
1284 	    }
1285 	    /* SCSI drive error? */
1286 	    if (!((el->el_sensekey == 0) ||
1287 		  ((el->el_sensekey == 2) &&
1288 		   (el->el_asc == 0x04) &&
1289 		   ((el->el_asq == 0x01) ||
1290 		    (el->el_asq == 0x02))))) {
1291 		device_printf(sc->mlx_dev, "physical drive %d:%d error log: sense = %d asc = %x asq = %x\n",
1292 			      el->el_channel, el->el_target, el->el_sensekey, el->el_asc, el->el_asq);
1293 		device_printf(sc->mlx_dev, "  info %4D csi %4D\n", el->el_information, ":", el->el_csi, ":");
1294 	    }
1295 	    break;
1296 
1297 	default:
1298 	    device_printf(sc->mlx_dev, "unknown log message type 0x%x\n", el->el_type);
1299 	    break;
1300 	}
1301     } else {
1302 	device_printf(sc->mlx_dev, "error reading message log - %s\n", mlx_diagnose_command(mc));
1303 	/* give up on all the outstanding messages, as we may have come unsynched */
1304 	sc->mlx_lastevent = sc->mlx_currevent;
1305     }
1306 
1307     /* dispose of command and data */
1308     free(mc->mc_data, M_DEVBUF);
1309     mlx_releasecmd(mc);
1310 
1311     /* is there another message to obtain? */
1312     if (sc->mlx_lastevent != sc->mlx_currevent) {
1313 	mlx_periodic_eventlog_poll(sc);
1314     } else {
1315 	/* clear log-busy status */
1316 	atomic_clear_int(&sc->mlx_flags, MLX_EVENTLOG_BUSY);
1317     }
1318 }
1319 
1320 /********************************************************************************
1321  * Handle check/rebuild operations in progress.
1322  */
1323 static void
1324 mlx_periodic_rebuild(struct mlx_command *mc)
1325 {
1326     struct mlx_softc		*sc = mc->mc_sc;
1327     struct mlx_rebuild_status	*mr = (struct mlx_rebuild_status *)mc->mc_data;
1328 
1329     switch(mc->mc_status) {
1330     case 0:				/* operation running, update stats */
1331 	sc->mlx_rebuildstat = *mr;
1332 
1333 	/* spontaneous rebuild/check? */
1334 	if (sc->mlx_background == 0) {
1335 	    sc->mlx_background = MLX_BACKGROUND_SPONTANEOUS;
1336 	    device_printf(sc->mlx_dev, "background check/rebuild operation started\n");
1337 	}
1338 	break;
1339 
1340     case 0x0105:			/* nothing running, finalise stats and report */
1341 	switch(sc->mlx_background) {
1342 	case MLX_BACKGROUND_CHECK:
1343 	    device_printf(sc->mlx_dev, "consistency check completed\n");	/* XXX print drive? */
1344 	    break;
1345 	case MLX_BACKGROUND_REBUILD:
1346 	    device_printf(sc->mlx_dev, "drive rebuild completed\n");	/* XXX print channel/target? */
1347 	    break;
1348 	case MLX_BACKGROUND_SPONTANEOUS:
1349 	default:
1350 	    /* if we have previously been non-idle, report the transition */
1351 	    if (sc->mlx_rebuildstat.rs_code != MLX_REBUILDSTAT_IDLE) {
1352 		device_printf(sc->mlx_dev, "background check/rebuild operation completed\n");
1353 	    }
1354 	}
1355 	sc->mlx_background = 0;
1356 	sc->mlx_rebuildstat.rs_code = MLX_REBUILDSTAT_IDLE;
1357 	break;
1358     }
1359     free(mc->mc_data, M_DEVBUF);
1360     mlx_releasecmd(mc);
1361 }
1362 
1363 /********************************************************************************
1364  ********************************************************************************
1365                                                                     Channel Pause
1366  ********************************************************************************
1367  ********************************************************************************/
1368 
1369 /********************************************************************************
1370  * It's time to perform a channel pause action for (sc), either start or stop
1371  * the pause.
1372  */
1373 static void
1374 mlx_pause_action(struct mlx_softc *sc)
1375 {
1376     struct mlx_command	*mc;
1377     int			failsafe, i, command;
1378 
1379     /* What are we doing here? */
1380     if (sc->mlx_pause.mp_when == 0) {
1381 	command = MLX_CMD_STARTCHANNEL;
1382 	failsafe = 0;
1383 
1384     } else {
1385 	command = MLX_CMD_STOPCHANNEL;
1386 
1387 	/*
1388 	 * Channels will always start again after the failsafe period,
1389 	 * which is specified in multiples of 30 seconds.
1390 	 * This constrains us to a maximum pause of 450 seconds.
1391 	 */
1392 	failsafe = ((sc->mlx_pause.mp_howlong - time_second) + 5) / 30;
1393 	if (failsafe > 0xf) {
1394 	    failsafe = 0xf;
1395 	    sc->mlx_pause.mp_howlong = time_second + (0xf * 30) - 5;
1396 	}
1397     }
1398 
1399     /* build commands for every channel requested */
1400     for (i = 0; i < sc->mlx_enq2->me_actual_channels; i++) {
1401 	if ((1 << i) & sc->mlx_pause.mp_which) {
1402 
1403 	    /* get ourselves a command buffer */
1404 	    if ((mc = mlx_alloccmd(sc)) == NULL)
1405 		goto fail;
1406 	    /* get a command slot */
1407 	    mc->mc_flags |= MLX_CMD_PRIORITY;
1408 	    if (mlx_getslot(mc))
1409 		goto fail;
1410 
1411 	    /* build the command */
1412 	    mlx_make_type2(mc, command, (failsafe << 4) | i, 0, 0, 0, 0, 0, 0, 0);
1413 	    mc->mc_complete = mlx_pause_done;
1414 	    mc->mc_private = sc;		/* XXX not needed */
1415 	    if (mlx_start(mc))
1416 		goto fail;
1417 	    /* command submitted OK */
1418 	    return;
1419 
1420 	fail:
1421 	    device_printf(sc->mlx_dev, "%s failed for channel %d\n",
1422 			  command == MLX_CMD_STOPCHANNEL ? "pause" : "resume", i);
1423 	    if (mc != NULL)
1424 		mlx_releasecmd(mc);
1425 	}
1426     }
1427 }
1428 
1429 static void
1430 mlx_pause_done(struct mlx_command *mc)
1431 {
1432     struct mlx_softc	*sc = mc->mc_sc;
1433     int			command = mc->mc_mailbox[0];
1434     int			channel = mc->mc_mailbox[2] & 0xf;
1435 
1436     if (mc->mc_status != 0) {
1437 	device_printf(sc->mlx_dev, "%s command failed - %s\n",
1438 		      command == MLX_CMD_STOPCHANNEL ? "pause" : "resume", mlx_diagnose_command(mc));
1439     } else if (command == MLX_CMD_STOPCHANNEL) {
1440 	device_printf(sc->mlx_dev, "channel %d pausing for %ld seconds\n",
1441 		      channel, (long)(sc->mlx_pause.mp_howlong - time_second));
1442     } else {
1443 	device_printf(sc->mlx_dev, "channel %d resuming\n", channel);
1444     }
1445     mlx_releasecmd(mc);
1446 }
1447 
1448 /********************************************************************************
1449  ********************************************************************************
1450                                                                Command Submission
1451  ********************************************************************************
1452  ********************************************************************************/
1453 
1454 /********************************************************************************
1455  * Perform an Enquiry command using a type-3 command buffer and a return a single
1456  * linear result buffer.  If the completion function is specified, it will
1457  * be called with the completed command (and the result response will not be
1458  * valid until that point).  Otherwise, the command will either be busy-waited
1459  * for (interrupts not enabled), or slept for.
1460  */
1461 static void *
1462 mlx_enquire(struct mlx_softc *sc, int command, size_t bufsize, void (* complete)(struct mlx_command *mc))
1463 {
1464     struct mlx_command	*mc;
1465     void		*result;
1466     int			error;
1467 
1468     debug_called(1);
1469 
1470     /* get ourselves a command buffer */
1471     error = 1;
1472     result = NULL;
1473     if ((mc = mlx_alloccmd(sc)) == NULL)
1474 	goto out;
1475     /* allocate the response structure */
1476     if ((result = malloc(bufsize, M_DEVBUF, M_NOWAIT)) == NULL)
1477 	goto out;
1478     /* get a command slot */
1479     mc->mc_flags |= MLX_CMD_PRIORITY | MLX_CMD_DATAOUT;
1480     if (mlx_getslot(mc))
1481 	goto out;
1482 
1483     /* map the command so the controller can see it */
1484     mc->mc_data = result;
1485     mc->mc_length = bufsize;
1486     mlx_mapcmd(mc);
1487 
1488     /* build an enquiry command */
1489     mlx_make_type2(mc, command, 0, 0, 0, 0, 0, 0, mc->mc_dataphys, 0);
1490 
1491     /* do we want a completion callback? */
1492     if (complete != NULL) {
1493 	mc->mc_complete = complete;
1494 	mc->mc_private = mc;
1495 	if ((error = mlx_start(mc)) != 0)
1496 	    goto out;
1497     } else {
1498 	/* run the command in either polled or wait mode */
1499 	if ((sc->mlx_state & MLX_STATE_INTEN) ? mlx_wait_command(mc) : mlx_poll_command(mc))
1500 	    goto out;
1501 
1502 	/* command completed OK? */
1503 	if (mc->mc_status != 0) {
1504 	    device_printf(sc->mlx_dev, "ENQUIRY failed - %s\n", mlx_diagnose_command(mc));
1505 	    goto out;
1506 	}
1507     }
1508     error = 0;			/* success */
1509  out:
1510     /* we got a command, but nobody else will free it */
1511     if ((complete == NULL) && (mc != NULL))
1512 	mlx_releasecmd(mc);
1513     /* we got an error, and we allocated a result */
1514     if ((error != 0) && (result != NULL)) {
1515 	free(result, M_DEVBUF);
1516 	result = NULL;
1517     }
1518     return(result);
1519 }
1520 
1521 
1522 /********************************************************************************
1523  * Perform a Flush command on the nominated controller.
1524  *
1525  * May be called with interrupts enabled or disabled; will not return until
1526  * the flush operation completes or fails.
1527  */
1528 static int
1529 mlx_flush(struct mlx_softc *sc)
1530 {
1531     struct mlx_command	*mc;
1532     int			error;
1533 
1534     debug_called(1);
1535 
1536     /* get ourselves a command buffer */
1537     error = 1;
1538     if ((mc = mlx_alloccmd(sc)) == NULL)
1539 	goto out;
1540     /* get a command slot */
1541     if (mlx_getslot(mc))
1542 	goto out;
1543 
1544     /* build a flush command */
1545     mlx_make_type2(mc, MLX_CMD_FLUSH, 0, 0, 0, 0, 0, 0, 0, 0);
1546 
1547     /* can't assume that interrupts are going to work here, so play it safe */
1548     if (mlx_poll_command(mc))
1549 	goto out;
1550 
1551     /* command completed OK? */
1552     if (mc->mc_status != 0) {
1553 	device_printf(sc->mlx_dev, "FLUSH failed - %s\n", mlx_diagnose_command(mc));
1554 	goto out;
1555     }
1556 
1557     error = 0;			/* success */
1558  out:
1559     if (mc != NULL)
1560 	mlx_releasecmd(mc);
1561     return(error);
1562 }
1563 
1564 /********************************************************************************
1565  * Start a background consistency check on (drive).
1566  *
1567  * May be called with interrupts enabled or disabled; will return as soon as the
1568  * operation has started or been refused.
1569  */
1570 static int
1571 mlx_check(struct mlx_softc *sc, int drive)
1572 {
1573     struct mlx_command	*mc;
1574     int			error;
1575 
1576     debug_called(1);
1577 
1578     /* get ourselves a command buffer */
1579     error = 0x10000;
1580     if ((mc = mlx_alloccmd(sc)) == NULL)
1581 	goto out;
1582     /* get a command slot */
1583     if (mlx_getslot(mc))
1584 	goto out;
1585 
1586     /* build a checkasync command, set the "fix it" flag */
1587     mlx_make_type2(mc, MLX_CMD_CHECKASYNC, 0, 0, 0, 0, 0, drive | 0x80, 0, 0);
1588 
1589     /* start the command and wait for it to be returned */
1590     if (mlx_wait_command(mc))
1591 	goto out;
1592 
1593     /* command completed OK? */
1594     if (mc->mc_status != 0) {
1595 	device_printf(sc->mlx_dev, "CHECK ASYNC failed - %s\n", mlx_diagnose_command(mc));
1596     } else {
1597 	device_printf(sc->mlx_sysdrive[drive].ms_disk, "consistency check started");
1598     }
1599     error = mc->mc_status;
1600 
1601  out:
1602     if (mc != NULL)
1603 	mlx_releasecmd(mc);
1604     return(error);
1605 }
1606 
1607 /********************************************************************************
1608  * Start a background rebuild of the physical drive at (channel),(target).
1609  *
1610  * May be called with interrupts enabled or disabled; will return as soon as the
1611  * operation has started or been refused.
1612  */
1613 static int
1614 mlx_rebuild(struct mlx_softc *sc, int channel, int target)
1615 {
1616     struct mlx_command	*mc;
1617     int			error;
1618 
1619     debug_called(1);
1620 
1621     /* get ourselves a command buffer */
1622     error = 0x10000;
1623     if ((mc = mlx_alloccmd(sc)) == NULL)
1624 	goto out;
1625     /* get a command slot */
1626     if (mlx_getslot(mc))
1627 	goto out;
1628 
1629     /* build a checkasync command, set the "fix it" flag */
1630     mlx_make_type2(mc, MLX_CMD_REBUILDASYNC, channel, target, 0, 0, 0, 0, 0, 0);
1631 
1632     /* start the command and wait for it to be returned */
1633     if (mlx_wait_command(mc))
1634 	goto out;
1635 
1636     /* command completed OK? */
1637     if (mc->mc_status != 0) {
1638 	device_printf(sc->mlx_dev, "REBUILD ASYNC failed - %s\n", mlx_diagnose_command(mc));
1639     } else {
1640 	device_printf(sc->mlx_dev, "drive rebuild started for %d:%d\n", channel, target);
1641     }
1642     error = mc->mc_status;
1643 
1644  out:
1645     if (mc != NULL)
1646 	mlx_releasecmd(mc);
1647     return(error);
1648 }
1649 
1650 /********************************************************************************
1651  * Run the command (mc) and return when it completes.
1652  *
1653  * Interrupts need to be enabled; returns nonzero on error.
1654  */
1655 static int
1656 mlx_wait_command(struct mlx_command *mc)
1657 {
1658     struct mlx_softc	*sc = mc->mc_sc;
1659     int			error, count;
1660 
1661     debug_called(1);
1662 
1663     mc->mc_complete = NULL;
1664     mc->mc_private = mc;		/* wake us when you're done */
1665     if ((error = mlx_start(mc)) != 0)
1666 	return(error);
1667 
1668     count = 0;
1669     /* XXX better timeout? */
1670     while ((mc->mc_status == MLX_STATUS_BUSY) && (count < 30)) {
1671 	tsleep(mc->mc_private, PRIBIO | PCATCH, "mlxwcmd", hz);
1672     }
1673 
1674     if (mc->mc_status != 0) {
1675 	device_printf(sc->mlx_dev, "command failed - %s\n", mlx_diagnose_command(mc));
1676 	return(EIO);
1677     }
1678     return(0);
1679 }
1680 
1681 
1682 /********************************************************************************
1683  * Start the command (mc) and busy-wait for it to complete.
1684  *
1685  * Should only be used when interrupts can't be relied upon. Returns 0 on
1686  * success, nonzero on error.
1687  * Successfully completed commands are dequeued.
1688  */
1689 static int
1690 mlx_poll_command(struct mlx_command *mc)
1691 {
1692     struct mlx_softc	*sc = mc->mc_sc;
1693     int			error, count, s;
1694 
1695     debug_called(1);
1696 
1697     mc->mc_complete = NULL;
1698     mc->mc_private = NULL;	/* we will poll for it */
1699     if ((error = mlx_start(mc)) != 0)
1700 	return(error);
1701 
1702     count = 0;
1703     do {
1704 	/* poll for completion */
1705 	mlx_done(mc->mc_sc);
1706 
1707     } while ((mc->mc_status == MLX_STATUS_BUSY) && (count++ < 15000000));
1708     if (mc->mc_status != MLX_STATUS_BUSY) {
1709 	s = splbio();
1710 	TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
1711 	splx(s);
1712 	return(0);
1713     }
1714     device_printf(sc->mlx_dev, "command failed - %s\n", mlx_diagnose_command(mc));
1715     return(EIO);
1716 }
1717 
1718 /********************************************************************************
1719  * Pull as much work off the softc's work queue as possible and give it to the
1720  * controller.  Leave a couple of slots free for emergencies.
1721  *
1722  * Must be called at splbio or in an equivalent fashion that prevents
1723  * reentry or activity on the bioq.
1724  */
1725 static void
1726 mlx_startio(struct mlx_softc *sc)
1727 {
1728     struct mlx_command	*mc;
1729     struct mlxd_softc	*mlxd;
1730     struct bio		*bp;
1731     int			blkcount;
1732     int			driveno;
1733     int			cmd;
1734     int			s;
1735 
1736     /* avoid reentrancy */
1737     if (mlx_lock_tas(sc, MLX_LOCK_STARTING))
1738 	return;
1739 
1740     /* spin until something prevents us from doing any work */
1741     s = splbio();
1742     for (;;) {
1743 
1744 	/* see if there's work to be done */
1745 	if ((bp = bioq_first(&sc->mlx_bioq)) == NULL)
1746 	    break;
1747 	/* get a command */
1748 	if ((mc = mlx_alloccmd(sc)) == NULL)
1749 	    break;
1750 	/* get a slot for the command */
1751 	if (mlx_getslot(mc) != 0) {
1752 	    mlx_releasecmd(mc);
1753 	    break;
1754 	}
1755 	/* get the buf containing our work */
1756 	bioq_remove(&sc->mlx_bioq, bp);
1757 	sc->mlx_waitbufs--;
1758 	splx(s);
1759 
1760 	/* connect the buf to the command */
1761 	mc->mc_complete = mlx_completeio;
1762 	mc->mc_private = bp;
1763 	mc->mc_data = bp->bio_data;
1764 	mc->mc_length = bp->bio_bcount;
1765 	if (bp->bio_cmd == BIO_READ) {
1766 	    mc->mc_flags |= MLX_CMD_DATAIN;
1767 	    cmd = MLX_CMD_READSG;
1768 	} else {
1769 	    mc->mc_flags |= MLX_CMD_DATAOUT;
1770 	    cmd = MLX_CMD_WRITESG;
1771 	}
1772 
1773 	/* map the command so the controller can work with it */
1774 	mlx_mapcmd(mc);
1775 
1776 	/* build a suitable I/O command (assumes 512-byte rounded transfers) */
1777 	mlxd = (struct mlxd_softc *)bp->bio_dev->si_drv1;
1778 	driveno = mlxd->mlxd_drive - sc->mlx_sysdrive;
1779 	blkcount = (bp->bio_bcount + MLX_BLKSIZE - 1) / MLX_BLKSIZE;
1780 
1781 	if ((bp->bio_pblkno + blkcount) > sc->mlx_sysdrive[driveno].ms_size)
1782 	    device_printf(sc->mlx_dev, "I/O beyond end of unit (%u,%d > %u)\n",
1783 			  bp->bio_pblkno, blkcount, sc->mlx_sysdrive[driveno].ms_size);
1784 
1785 	/*
1786 	 * Build the I/O command.  Note that the SG list type bits are set to zero,
1787 	 * denoting the format of SG list that we are using.
1788 	 */
1789 	if (sc->mlx_iftype == MLX_IFTYPE_2) {
1790 	    mlx_make_type1(mc, (cmd == MLX_CMD_WRITESG) ? MLX_CMD_WRITESG_OLD : MLX_CMD_READSG_OLD,
1791 			   blkcount & 0xff, 				/* xfer length low byte */
1792 			   bp->bio_pblkno,				/* physical block number */
1793 			   driveno,					/* target drive number */
1794 			   mc->mc_sgphys,				/* location of SG list */
1795 			   mc->mc_nsgent & 0x3f);			/* size of SG list (top 3 bits clear) */
1796 	} else {
1797 	    mlx_make_type5(mc, cmd,
1798 			   blkcount & 0xff, 				/* xfer length low byte */
1799 			   (driveno << 3) | ((blkcount >> 8) & 0x07),	/* target and length high 3 bits */
1800 			   bp->bio_pblkno,				/* physical block number */
1801 			   mc->mc_sgphys,				/* location of SG list */
1802 			   mc->mc_nsgent & 0x3f);			/* size of SG list (top 3 bits clear) */
1803 	}
1804 
1805 	/* try to give command to controller */
1806 	if (mlx_start(mc) != 0) {
1807 	    /* fail the command */
1808 	    mc->mc_status = MLX_STATUS_WEDGED;
1809 	    mlx_completeio(mc);
1810 	}
1811 	s = splbio();
1812     }
1813     splx(s);
1814     mlx_lock_clr(sc, MLX_LOCK_STARTING);
1815 }
1816 
1817 /********************************************************************************
1818  * Handle completion of an I/O command.
1819  */
1820 static void
1821 mlx_completeio(struct mlx_command *mc)
1822 {
1823     struct mlx_softc	*sc = mc->mc_sc;
1824     struct bio		*bp = (struct bio *)mc->mc_private;
1825     struct mlxd_softc	*mlxd = (struct mlxd_softc *)bp->bio_dev->si_drv1;
1826 
1827     if (mc->mc_status != MLX_STATUS_OK) {	/* could be more verbose here? */
1828 	bp->bio_error = EIO;
1829 	bp->bio_flags |= BIO_ERROR;
1830 
1831 	switch(mc->mc_status) {
1832 	case MLX_STATUS_RDWROFFLINE:		/* system drive has gone offline */
1833 	    device_printf(mlxd->mlxd_dev, "drive offline\n");
1834 	    /* should signal this with a return code */
1835 	    mlxd->mlxd_drive->ms_state = MLX_SYSD_OFFLINE;
1836 	    break;
1837 
1838 	default:				/* other I/O error */
1839 	    device_printf(sc->mlx_dev, "I/O error - %s\n", mlx_diagnose_command(mc));
1840 #if 0
1841 	    device_printf(sc->mlx_dev, "  b_bcount %ld  blkcount %ld  b_pblkno %d\n",
1842 			  bp->bio_bcount, bp->bio_bcount / MLX_BLKSIZE, bp->bio_pblkno);
1843 	    device_printf(sc->mlx_dev, "  %13D\n", mc->mc_mailbox, " ");
1844 #endif
1845 	    break;
1846 	}
1847     }
1848     mlx_releasecmd(mc);
1849     mlxd_intr(bp);
1850 }
1851 
1852 /********************************************************************************
1853  * Take a command from user-space and try to run it.
1854  *
1855  * XXX Note that this can't perform very much in the way of error checking, and
1856  *     as such, applications _must_ be considered trustworthy.
1857  * XXX Commands using S/G for data are not supported.
1858  */
1859 static int
1860 mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu)
1861 {
1862     struct mlx_command	*mc;
1863     struct mlx_dcdb	*dcdb;
1864     void		*kbuf;
1865     int			error;
1866 
1867     debug_called(0);
1868 
1869     kbuf = NULL;
1870     mc = NULL;
1871     dcdb = NULL;
1872     error = ENOMEM;
1873 
1874     /* get ourselves a command and copy in from user space */
1875     if ((mc = mlx_alloccmd(sc)) == NULL)
1876 	goto out;
1877     bcopy(mu->mu_command, mc->mc_mailbox, sizeof(mc->mc_mailbox));
1878     debug(0, "got command buffer");
1879 
1880     /* if we need a buffer for data transfer, allocate one and copy in its initial contents */
1881     if (mu->mu_datasize > 0) {
1882 	if (((kbuf = malloc(mu->mu_datasize, M_DEVBUF, M_WAITOK)) == NULL) ||
1883 	    (error = copyin(mu->mu_buf, kbuf, mu->mu_datasize)))
1884 	    goto out;
1885 	debug(0, "got kernel buffer");
1886     }
1887 
1888     /* get a command slot */
1889     if (mlx_getslot(mc))
1890 	goto out;
1891     debug(0, "got a slot");
1892 
1893     /* map the command so the controller can see it */
1894     mc->mc_data = kbuf;
1895     mc->mc_length = mu->mu_datasize;
1896     mlx_mapcmd(mc);
1897     debug(0, "mapped");
1898 
1899     /*
1900      * If this is a passthrough SCSI command, the DCDB is packed at the
1901      * beginning of the data area.  Fix up the DCDB to point to the correct physical
1902      * address and override any bufptr supplied by the caller since we know
1903      * what it's meant to be.
1904      */
1905     if (mc->mc_mailbox[0] == MLX_CMD_DIRECT_CDB) {
1906 	dcdb = (struct mlx_dcdb *)kbuf;
1907 	dcdb->dcdb_physaddr = mc->mc_dataphys + sizeof(*dcdb);
1908 	mu->mu_bufptr = 8;
1909     }
1910 
1911     /*
1912      * If there's a data buffer, fix up the command's buffer pointer.
1913      */
1914     if (mu->mu_datasize > 0) {
1915 
1916 	/* range check the pointer to physical buffer address */
1917 	if ((mu->mu_bufptr < 0) || (mu->mu_bufptr > (sizeof(mu->mu_command) - sizeof(u_int32_t)))) {
1918 	    error = EINVAL;
1919 	    goto out;
1920 	}
1921 	mc->mc_mailbox[mu->mu_bufptr    ] =  mc->mc_dataphys        & 0xff;
1922 	mc->mc_mailbox[mu->mu_bufptr + 1] = (mc->mc_dataphys >> 8)  & 0xff;
1923 	mc->mc_mailbox[mu->mu_bufptr + 2] = (mc->mc_dataphys >> 16) & 0xff;
1924 	mc->mc_mailbox[mu->mu_bufptr + 3] = (mc->mc_dataphys >> 24) & 0xff;
1925     }
1926     debug(0, "command fixup");
1927 
1928     /* submit the command and wait */
1929     if ((error = mlx_wait_command(mc)) != 0)
1930 	goto out;
1931 
1932     /* copy out status and data */
1933     mu->mu_status = mc->mc_status;
1934     if ((mu->mu_datasize > 0) && ((error = copyout(kbuf, mu->mu_buf, mu->mu_datasize))))
1935 	goto out;
1936     error = 0;
1937 
1938  out:
1939     mlx_releasecmd(mc);
1940     if (kbuf != NULL)
1941 	free(kbuf, M_DEVBUF);
1942     return(error);
1943 }
1944 
1945 /********************************************************************************
1946  ********************************************************************************
1947                                                         Command I/O to Controller
1948  ********************************************************************************
1949  ********************************************************************************/
1950 
1951 /********************************************************************************
1952  * Find a free command slot for (mc).
1953  *
1954  * Don't hand out a slot to a normal-priority command unless there are at least
1955  * 4 slots free for priority commands.
1956  */
1957 static int
1958 mlx_getslot(struct mlx_command *mc)
1959 {
1960     struct mlx_softc	*sc = mc->mc_sc;
1961     int			s, slot, limit;
1962 
1963     debug_called(1);
1964 
1965     /*
1966      * Enforce slot-usage limit, if we have the required information.
1967      */
1968     if (sc->mlx_enq2 != NULL) {
1969 	limit = sc->mlx_enq2->me_max_commands;
1970     } else {
1971 	limit = 2;
1972     }
1973     if (sc->mlx_busycmds >= ((mc->mc_flags & MLX_CMD_PRIORITY) ? limit : limit - 4))
1974 	return(EBUSY);
1975 
1976     /*
1977      * Allocate an outstanding command slot
1978      *
1979      * XXX linear search is slow
1980      */
1981     s = splbio();
1982     for (slot = 0; slot < limit; slot++) {
1983 	debug(2, "try slot %d", slot);
1984 	if (sc->mlx_busycmd[slot] == NULL)
1985 	    break;
1986     }
1987     if (slot < limit) {
1988 	sc->mlx_busycmd[slot] = mc;
1989 	sc->mlx_busycmds++;
1990     }
1991     splx(s);
1992 
1993     /* out of slots? */
1994     if (slot >= limit)
1995 	return(EBUSY);
1996 
1997     debug(2, "got slot %d", slot);
1998     mc->mc_slot = slot;
1999     return(0);
2000 }
2001 
2002 /********************************************************************************
2003  * Map/unmap (mc)'s data in the controller's addressable space.
2004  */
2005 static void
2006 mlx_setup_dmamap(void *arg, bus_dma_segment_t *segs, int nsegments, int error)
2007 {
2008     struct mlx_command	*mc = (struct mlx_command *)arg;
2009     struct mlx_softc	*sc = mc->mc_sc;
2010     struct mlx_sgentry	*sg;
2011     int			i;
2012 
2013     debug_called(1);
2014 
2015     /* XXX should be unnecessary */
2016     if (sc->mlx_enq2 && (nsegments > sc->mlx_enq2->me_max_sg))
2017 	panic("MLX: too many s/g segments (%d, max %d)", nsegments, sc->mlx_enq2->me_max_sg);
2018 
2019     /* get base address of s/g table */
2020     sg = sc->mlx_sgtable + (mc->mc_slot * MLX_NSEG);
2021 
2022     /* save s/g table information in command */
2023     mc->mc_nsgent = nsegments;
2024     mc->mc_sgphys = sc->mlx_sgbusaddr + (mc->mc_slot * MLX_NSEG * sizeof(struct mlx_sgentry));
2025     mc->mc_dataphys = segs[0].ds_addr;
2026 
2027     /* populate s/g table */
2028     for (i = 0; i < nsegments; i++, sg++) {
2029 	sg->sg_addr = segs[i].ds_addr;
2030 	sg->sg_count = segs[i].ds_len;
2031     }
2032 }
2033 
2034 static void
2035 mlx_mapcmd(struct mlx_command *mc)
2036 {
2037     struct mlx_softc	*sc = mc->mc_sc;
2038 
2039     debug_called(1);
2040 
2041     /* if the command involves data at all */
2042     if (mc->mc_data != NULL) {
2043 
2044 	/* map the data buffer into bus space and build the s/g list */
2045 	bus_dmamap_load(sc->mlx_buffer_dmat, mc->mc_dmamap, mc->mc_data, mc->mc_length,
2046 			mlx_setup_dmamap, mc, 0);
2047 	if (mc->mc_flags & MLX_CMD_DATAIN)
2048 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_PREREAD);
2049 	if (mc->mc_flags & MLX_CMD_DATAOUT)
2050 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_PREWRITE);
2051     }
2052 }
2053 
2054 static void
2055 mlx_unmapcmd(struct mlx_command *mc)
2056 {
2057     struct mlx_softc	*sc = mc->mc_sc;
2058 
2059     debug_called(1);
2060 
2061     /* if the command involved data at all */
2062     if (mc->mc_data != NULL) {
2063 
2064 	if (mc->mc_flags & MLX_CMD_DATAIN)
2065 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_POSTREAD);
2066 	if (mc->mc_flags & MLX_CMD_DATAOUT)
2067 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_POSTWRITE);
2068 
2069 	bus_dmamap_unload(sc->mlx_buffer_dmat, mc->mc_dmamap);
2070     }
2071 }
2072 
2073 /********************************************************************************
2074  * Try to deliver (mc) to the controller.
2075  *
2076  * Can be called at any interrupt level, with or without interrupts enabled.
2077  */
2078 static int
2079 mlx_start(struct mlx_command *mc)
2080 {
2081     struct mlx_softc	*sc = mc->mc_sc;
2082     int			i, s, done;
2083 
2084     debug_called(1);
2085 
2086     /* save the slot number as ident so we can handle this command when complete */
2087     mc->mc_mailbox[0x1] = mc->mc_slot;
2088 
2089     /* mark the command as currently being processed */
2090     mc->mc_status = MLX_STATUS_BUSY;
2091 
2092     /* set a default 60-second timeout  XXX tunable?  XXX not currently used */
2093     mc->mc_timeout = time_second + 60;
2094 
2095     /* spin waiting for the mailbox */
2096     for (i = 100000, done = 0; (i > 0) && !done; i--) {
2097 	s = splbio();
2098 	if (sc->mlx_tryqueue(sc, mc)) {
2099 	    done = 1;
2100 	    /* move command to work queue */
2101 	    TAILQ_INSERT_TAIL(&sc->mlx_work, mc, mc_link);
2102 	}
2103 	splx(s);	/* drop spl to allow completion interrupts */
2104     }
2105 
2106     /* command is enqueued */
2107     if (done)
2108 	return(0);
2109 
2110     /*
2111      * We couldn't get the controller to take the command.  Revoke the slot
2112      * that the command was given and return it with a bad status.
2113      */
2114     sc->mlx_busycmd[mc->mc_slot] = NULL;
2115     device_printf(sc->mlx_dev, "controller wedged (not taking commands)\n");
2116     mc->mc_status = MLX_STATUS_WEDGED;
2117     mlx_complete(sc);
2118     return(EIO);
2119 }
2120 
2121 /********************************************************************************
2122  * Poll the controller (sc) for completed commands.
2123  * Update command status and free slots for reuse.  If any slots were freed,
2124  * new commands may be posted.
2125  *
2126  * Returns nonzero if one or more commands were completed.
2127  */
2128 static int
2129 mlx_done(struct mlx_softc *sc)
2130 {
2131     struct mlx_command	*mc;
2132     int			s, result;
2133     u_int8_t		slot;
2134     u_int16_t		status;
2135 
2136     debug_called(2);
2137 
2138     result = 0;
2139 
2140     /* loop collecting completed commands */
2141     s = splbio();
2142     for (;;) {
2143 	/* poll for a completed command's identifier and status */
2144 	if (sc->mlx_findcomplete(sc, &slot, &status)) {
2145 	    result = 1;
2146 	    mc = sc->mlx_busycmd[slot];			/* find command */
2147 	    if (mc != NULL) {				/* paranoia */
2148 		if (mc->mc_status == MLX_STATUS_BUSY) {
2149 		    mc->mc_status = status;		/* save status */
2150 
2151 		    /* free slot for reuse */
2152 		    sc->mlx_busycmd[slot] = NULL;
2153 		    sc->mlx_busycmds--;
2154 		} else {
2155 		    device_printf(sc->mlx_dev, "duplicate done event for slot %d\n", slot);
2156 		}
2157 	    } else {
2158 		device_printf(sc->mlx_dev, "done event for nonbusy slot %d\n", slot);
2159 	    }
2160 	} else {
2161 	    break;
2162 	}
2163     }
2164     splx(s);
2165 
2166     /* if we've completed any commands, try posting some more */
2167     if (result)
2168 	mlx_startio(sc);
2169 
2170     /* handle completion and timeouts */
2171     mlx_complete(sc);
2172 
2173     return(result);
2174 }
2175 
2176 /********************************************************************************
2177  * Perform post-completion processing for commands on (sc).
2178  */
2179 static void
2180 mlx_complete(struct mlx_softc *sc)
2181 {
2182     struct mlx_command	*mc, *nc;
2183     int			s, count;
2184 
2185     debug_called(2);
2186 
2187     /* avoid reentrancy  XXX might want to signal and request a restart */
2188     if (mlx_lock_tas(sc, MLX_LOCK_COMPLETING))
2189 	return;
2190 
2191     s = splbio();
2192     count = 0;
2193 
2194     /* scan the list of busy/done commands */
2195     mc = TAILQ_FIRST(&sc->mlx_work);
2196     while (mc != NULL) {
2197 	nc = TAILQ_NEXT(mc, mc_link);
2198 
2199 	/* Command has been completed in some fashion */
2200 	if (mc->mc_status != MLX_STATUS_BUSY) {
2201 
2202 	    /* unmap the command's data buffer */
2203 	    mlx_unmapcmd(mc);
2204 	    /*
2205 	     * Does the command have a completion handler?
2206 	     */
2207 	    if (mc->mc_complete != NULL) {
2208 		/* remove from list and give to handler */
2209 		TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
2210 		mc->mc_complete(mc);
2211 
2212 		/*
2213 		 * Is there a sleeper waiting on this command?
2214 		 */
2215 	    } else if (mc->mc_private != NULL) {	/* sleeping caller wants to know about it */
2216 
2217 		/* remove from list and wake up sleeper */
2218 		TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
2219 		wakeup_one(mc->mc_private);
2220 
2221 		/*
2222 		 * Leave the command for a caller that's polling for it.
2223 		 */
2224 	    } else {
2225 	    }
2226 	}
2227 	mc = nc;
2228     }
2229     splx(s);
2230 
2231     mlx_lock_clr(sc, MLX_LOCK_COMPLETING);
2232 }
2233 
2234 /********************************************************************************
2235  ********************************************************************************
2236                                                         Command Buffer Management
2237  ********************************************************************************
2238  ********************************************************************************/
2239 
2240 /********************************************************************************
2241  * Get a new command buffer.
2242  *
2243  * This may return NULL in low-memory cases.
2244  *
2245  * Note that using malloc() is expensive (the command buffer is << 1 page) but
2246  * necessary if we are to be a loadable module before the zone allocator is fixed.
2247  *
2248  * If possible, we recycle a command buffer that's been used before.
2249  *
2250  * XXX Note that command buffers are not cleaned out - it is the caller's
2251  *     responsibility to ensure that all required fields are filled in before
2252  *     using a buffer.
2253  */
2254 static struct mlx_command *
2255 mlx_alloccmd(struct mlx_softc *sc)
2256 {
2257     struct mlx_command	*mc;
2258     int			error;
2259     int			s;
2260 
2261     debug_called(1);
2262 
2263     s = splbio();
2264     if ((mc = TAILQ_FIRST(&sc->mlx_freecmds)) != NULL)
2265 	TAILQ_REMOVE(&sc->mlx_freecmds, mc, mc_link);
2266     splx(s);
2267 
2268     /* allocate a new command buffer? */
2269     if (mc == NULL) {
2270 	mc = (struct mlx_command *)malloc(sizeof(*mc), M_DEVBUF, M_NOWAIT);
2271 	if (mc != NULL) {
2272 	    bzero(mc, sizeof(*mc));
2273 	    mc->mc_sc = sc;
2274 	    error = bus_dmamap_create(sc->mlx_buffer_dmat, 0, &mc->mc_dmamap);
2275 	    if (error) {
2276 		free(mc, M_DEVBUF);
2277 		return(NULL);
2278 	    }
2279 	}
2280     }
2281     return(mc);
2282 }
2283 
2284 /********************************************************************************
2285  * Release a command buffer for recycling.
2286  *
2287  * XXX It might be a good idea to limit the number of commands we save for reuse
2288  *     if it's shown that this list bloats out massively.
2289  */
2290 static void
2291 mlx_releasecmd(struct mlx_command *mc)
2292 {
2293     int		s;
2294 
2295     debug_called(1);
2296 
2297     s = splbio();
2298     TAILQ_INSERT_HEAD(&mc->mc_sc->mlx_freecmds, mc, mc_link);
2299     splx(s);
2300 }
2301 
2302 /********************************************************************************
2303  * Permanently discard a command buffer.
2304  */
2305 static void
2306 mlx_freecmd(struct mlx_command *mc)
2307 {
2308     struct mlx_softc	*sc = mc->mc_sc;
2309 
2310     debug_called(1);
2311     bus_dmamap_destroy(sc->mlx_buffer_dmat, mc->mc_dmamap);
2312     free(mc, M_DEVBUF);
2313 }
2314 
2315 
2316 /********************************************************************************
2317  ********************************************************************************
2318                                                 Type 3 interface accessor methods
2319  ********************************************************************************
2320  ********************************************************************************/
2321 
2322 /********************************************************************************
2323  * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2324  * (the controller is not ready to take a command).
2325  *
2326  * Must be called at splbio or in a fashion that prevents reentry.
2327  */
2328 static int
2329 mlx_v3_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2330 {
2331     int		i;
2332 
2333     debug_called(2);
2334 
2335     /* ready for our command? */
2336     if (!(MLX_V3_GET_IDBR(sc) & MLX_V3_IDB_FULL)) {
2337 	/* copy mailbox data to window */
2338 	for (i = 0; i < 13; i++)
2339 	    MLX_V3_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2340 
2341 	/* post command */
2342 	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_FULL);
2343 	return(1);
2344     }
2345     return(0);
2346 }
2347 
2348 /********************************************************************************
2349  * See if a command has been completed, if so acknowledge its completion
2350  * and recover the slot number and status code.
2351  *
2352  * Must be called at splbio or in a fashion that prevents reentry.
2353  */
2354 static int
2355 mlx_v3_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2356 {
2357 
2358     debug_called(2);
2359 
2360     /* status available? */
2361     if (MLX_V3_GET_ODBR(sc) & MLX_V3_ODB_SAVAIL) {
2362 	*slot = MLX_V3_GET_STATUS_IDENT(sc);		/* get command identifier */
2363 	*status = MLX_V3_GET_STATUS(sc);		/* get status */
2364 
2365 	/* acknowledge completion */
2366 	MLX_V3_PUT_ODBR(sc, MLX_V3_ODB_SAVAIL);
2367 	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_SACK);
2368 	return(1);
2369     }
2370     return(0);
2371 }
2372 
2373 /********************************************************************************
2374  * Enable/disable interrupts as requested. (No acknowledge required)
2375  *
2376  * Must be called at splbio or in a fashion that prevents reentry.
2377  */
2378 static void
2379 mlx_v3_intaction(struct mlx_softc *sc, int action)
2380 {
2381     debug_called(1);
2382 
2383     switch(action) {
2384     case MLX_INTACTION_DISABLE:
2385 	MLX_V3_PUT_IER(sc, 0);
2386 	sc->mlx_state &= ~MLX_STATE_INTEN;
2387 	break;
2388     case MLX_INTACTION_ENABLE:
2389 	MLX_V3_PUT_IER(sc, 1);
2390 	sc->mlx_state |= MLX_STATE_INTEN;
2391 	break;
2392     }
2393 }
2394 
2395 /********************************************************************************
2396  * Poll for firmware error codes during controller initialisation.
2397  * Returns 0 if initialisation is complete, 1 if still in progress but no
2398  * error has been fetched, 2 if an error has been retrieved.
2399  */
2400 static int
2401 mlx_v3_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2)
2402 {
2403     u_int8_t	fwerror;
2404     static int	initted = 0;
2405 
2406     debug_called(2);
2407 
2408     /* first time around, clear any hardware completion status */
2409     if (!initted) {
2410 	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_SACK);
2411 	DELAY(1000);
2412 	initted = 1;
2413     }
2414 
2415     /* init in progress? */
2416     if (!(MLX_V3_GET_IDBR(sc) & MLX_V3_IDB_INIT_BUSY))
2417 	return(0);
2418 
2419     /* test error value */
2420     fwerror = MLX_V3_GET_FWERROR(sc);
2421     if (!(fwerror & MLX_V3_FWERROR_PEND))
2422 	return(1);
2423 
2424     /* mask status pending bit, fetch status */
2425     *error = fwerror & ~MLX_V3_FWERROR_PEND;
2426     *param1 = MLX_V3_GET_FWERROR_PARAM1(sc);
2427     *param2 = MLX_V3_GET_FWERROR_PARAM2(sc);
2428 
2429     /* acknowledge */
2430     MLX_V3_PUT_FWERROR(sc, 0);
2431 
2432     return(2);
2433 }
2434 
2435 /********************************************************************************
2436  ********************************************************************************
2437                                                 Type 4 interface accessor methods
2438  ********************************************************************************
2439  ********************************************************************************/
2440 
2441 /********************************************************************************
2442  * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2443  * (the controller is not ready to take a command).
2444  *
2445  * Must be called at splbio or in a fashion that prevents reentry.
2446  */
2447 static int
2448 mlx_v4_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2449 {
2450     int		i;
2451 
2452     debug_called(2);
2453 
2454     /* ready for our command? */
2455     if (!(MLX_V4_GET_IDBR(sc) & MLX_V4_IDB_FULL)) {
2456 	/* copy mailbox data to window */
2457 	for (i = 0; i < 13; i++)
2458 	    MLX_V4_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2459 
2460 	/* memory-mapped controller, so issue a write barrier to ensure the mailbox is filled */
2461 	bus_space_barrier(sc->mlx_btag, sc->mlx_bhandle, MLX_V4_MAILBOX, MLX_V4_MAILBOX_LENGTH,
2462 			  BUS_SPACE_BARRIER_WRITE);
2463 
2464 	/* post command */
2465 	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_HWMBOX_CMD);
2466 	return(1);
2467     }
2468     return(0);
2469 }
2470 
2471 /********************************************************************************
2472  * See if a command has been completed, if so acknowledge its completion
2473  * and recover the slot number and status code.
2474  *
2475  * Must be called at splbio or in a fashion that prevents reentry.
2476  */
2477 static int
2478 mlx_v4_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2479 {
2480 
2481     debug_called(2);
2482 
2483     /* status available? */
2484     if (MLX_V4_GET_ODBR(sc) & MLX_V4_ODB_HWSAVAIL) {
2485 	*slot = MLX_V4_GET_STATUS_IDENT(sc);		/* get command identifier */
2486 	*status = MLX_V4_GET_STATUS(sc);		/* get status */
2487 
2488 	/* acknowledge completion */
2489 	MLX_V4_PUT_ODBR(sc, MLX_V4_ODB_HWMBOX_ACK);
2490 	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_SACK);
2491 	return(1);
2492     }
2493     return(0);
2494 }
2495 
2496 /********************************************************************************
2497  * Enable/disable interrupts as requested.
2498  *
2499  * Must be called at splbio or in a fashion that prevents reentry.
2500  */
2501 static void
2502 mlx_v4_intaction(struct mlx_softc *sc, int action)
2503 {
2504     debug_called(1);
2505 
2506     switch(action) {
2507     case MLX_INTACTION_DISABLE:
2508 	MLX_V4_PUT_IER(sc, MLX_V4_IER_MASK | MLX_V4_IER_DISINT);
2509 	sc->mlx_state &= ~MLX_STATE_INTEN;
2510 	break;
2511     case MLX_INTACTION_ENABLE:
2512 	MLX_V4_PUT_IER(sc, MLX_V4_IER_MASK & ~MLX_V4_IER_DISINT);
2513 	sc->mlx_state |= MLX_STATE_INTEN;
2514 	break;
2515     }
2516 }
2517 
2518 /********************************************************************************
2519  * Poll for firmware error codes during controller initialisation.
2520  * Returns 0 if initialisation is complete, 1 if still in progress but no
2521  * error has been fetched, 2 if an error has been retrieved.
2522  */
2523 static int
2524 mlx_v4_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2)
2525 {
2526     u_int8_t	fwerror;
2527     static int	initted = 0;
2528 
2529     debug_called(2);
2530 
2531     /* first time around, clear any hardware completion status */
2532     if (!initted) {
2533 	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_SACK);
2534 	DELAY(1000);
2535 	initted = 1;
2536     }
2537 
2538     /* init in progress? */
2539     if (!(MLX_V4_GET_IDBR(sc) & MLX_V4_IDB_INIT_BUSY))
2540 	return(0);
2541 
2542     /* test error value */
2543     fwerror = MLX_V4_GET_FWERROR(sc);
2544     if (!(fwerror & MLX_V4_FWERROR_PEND))
2545 	return(1);
2546 
2547     /* mask status pending bit, fetch status */
2548     *error = fwerror & ~MLX_V4_FWERROR_PEND;
2549     *param1 = MLX_V4_GET_FWERROR_PARAM1(sc);
2550     *param2 = MLX_V4_GET_FWERROR_PARAM2(sc);
2551 
2552     /* acknowledge */
2553     MLX_V4_PUT_FWERROR(sc, 0);
2554 
2555     return(2);
2556 }
2557 
2558 /********************************************************************************
2559  ********************************************************************************
2560                                                 Type 5 interface accessor methods
2561  ********************************************************************************
2562  ********************************************************************************/
2563 
2564 /********************************************************************************
2565  * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2566  * (the controller is not ready to take a command).
2567  *
2568  * Must be called at splbio or in a fashion that prevents reentry.
2569  */
2570 static int
2571 mlx_v5_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2572 {
2573     int		i;
2574 
2575     debug_called(2);
2576 
2577     /* ready for our command? */
2578     if (MLX_V5_GET_IDBR(sc) & MLX_V5_IDB_EMPTY) {
2579 	/* copy mailbox data to window */
2580 	for (i = 0; i < 13; i++)
2581 	    MLX_V5_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2582 
2583 	/* post command */
2584 	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_HWMBOX_CMD);
2585 	return(1);
2586     }
2587     return(0);
2588 }
2589 
2590 /********************************************************************************
2591  * See if a command has been completed, if so acknowledge its completion
2592  * and recover the slot number and status code.
2593  *
2594  * Must be called at splbio or in a fashion that prevents reentry.
2595  */
2596 static int
2597 mlx_v5_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2598 {
2599 
2600     debug_called(2);
2601 
2602     /* status available? */
2603     if (MLX_V5_GET_ODBR(sc) & MLX_V5_ODB_HWSAVAIL) {
2604 	*slot = MLX_V5_GET_STATUS_IDENT(sc);		/* get command identifier */
2605 	*status = MLX_V5_GET_STATUS(sc);		/* get status */
2606 
2607 	/* acknowledge completion */
2608 	MLX_V5_PUT_ODBR(sc, MLX_V5_ODB_HWMBOX_ACK);
2609 	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_SACK);
2610 	return(1);
2611     }
2612     return(0);
2613 }
2614 
2615 /********************************************************************************
2616  * Enable/disable interrupts as requested.
2617  *
2618  * Must be called at splbio or in a fashion that prevents reentry.
2619  */
2620 static void
2621 mlx_v5_intaction(struct mlx_softc *sc, int action)
2622 {
2623     debug_called(1);
2624 
2625     switch(action) {
2626     case MLX_INTACTION_DISABLE:
2627 	MLX_V5_PUT_IER(sc, 0xff & MLX_V5_IER_DISINT);
2628 	sc->mlx_state &= ~MLX_STATE_INTEN;
2629 	break;
2630     case MLX_INTACTION_ENABLE:
2631 	MLX_V5_PUT_IER(sc, 0xff & ~MLX_V5_IER_DISINT);
2632 	sc->mlx_state |= MLX_STATE_INTEN;
2633 	break;
2634     }
2635 }
2636 
2637 /********************************************************************************
2638  * Poll for firmware error codes during controller initialisation.
2639  * Returns 0 if initialisation is complete, 1 if still in progress but no
2640  * error has been fetched, 2 if an error has been retrieved.
2641  */
2642 static int
2643 mlx_v5_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2)
2644 {
2645     u_int8_t	fwerror;
2646     static int	initted = 0;
2647 
2648     debug_called(2);
2649 
2650     /* first time around, clear any hardware completion status */
2651     if (!initted) {
2652 	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_SACK);
2653 	DELAY(1000);
2654 	initted = 1;
2655     }
2656 
2657     /* init in progress? */
2658     if (MLX_V5_GET_IDBR(sc) & MLX_V5_IDB_INIT_DONE)
2659 	return(0);
2660 
2661     /* test for error value */
2662     fwerror = MLX_V5_GET_FWERROR(sc);
2663     if (!(fwerror & MLX_V5_FWERROR_PEND))
2664 	return(1);
2665 
2666     /* mask status pending bit, fetch status */
2667     *error = fwerror & ~MLX_V5_FWERROR_PEND;
2668     *param1 = MLX_V5_GET_FWERROR_PARAM1(sc);
2669     *param2 = MLX_V5_GET_FWERROR_PARAM2(sc);
2670 
2671     /* acknowledge */
2672     MLX_V5_PUT_FWERROR(sc, 0xff);
2673 
2674     return(2);
2675 }
2676 
2677 /********************************************************************************
2678  ********************************************************************************
2679                                                                         Debugging
2680  ********************************************************************************
2681  ********************************************************************************/
2682 
2683 /********************************************************************************
2684  * Return a status message describing (mc)
2685  */
2686 static char *mlx_status_messages[] = {
2687     "normal completion",			/* 00 */
2688     "irrecoverable data error",			/* 01 */
2689     "drive does not exist, or is offline",	/* 02 */
2690     "attempt to write beyond end of drive",	/* 03 */
2691     "bad data encountered",			/* 04 */
2692     "invalid log entry request",		/* 05 */
2693     "attempt to rebuild online drive",		/* 06 */
2694     "new disk failed during rebuild",		/* 07 */
2695     "invalid channel/target",			/* 08 */
2696     "rebuild/check already in progress",	/* 09 */
2697     "one or more disks are dead",		/* 10 */
2698     "invalid or non-redundant drive",		/* 11 */
2699     "channel is busy",				/* 12 */
2700     "channel is not stopped",			/* 13 */
2701     "rebuild successfully terminated",		/* 14 */
2702     "unsupported command",			/* 15 */
2703     "check condition received",			/* 16 */
2704     "device is busy",				/* 17 */
2705     "selection or command timeout",		/* 18 */
2706     "command terminated abnormally",		/* 19 */
2707     ""
2708 };
2709 
2710 static struct
2711 {
2712     int		command;
2713     u_int16_t	status;
2714     int		msg;
2715 } mlx_messages[] = {
2716     {MLX_CMD_READSG,		0x0001,	 1},
2717     {MLX_CMD_READSG,		0x0002,	 1},
2718     {MLX_CMD_READSG,		0x0105,	 3},
2719     {MLX_CMD_READSG,		0x010c,	 4},
2720     {MLX_CMD_WRITESG,		0x0001,	 1},
2721     {MLX_CMD_WRITESG,		0x0002,	 1},
2722     {MLX_CMD_WRITESG,		0x0105,	 3},
2723     {MLX_CMD_READSG_OLD,	0x0001,	 1},
2724     {MLX_CMD_READSG_OLD,	0x0002,	 1},
2725     {MLX_CMD_READSG_OLD,	0x0105,	 3},
2726     {MLX_CMD_WRITESG_OLD,	0x0001,	 1},
2727     {MLX_CMD_WRITESG_OLD,	0x0002,	 1},
2728     {MLX_CMD_WRITESG_OLD,	0x0105,	 3},
2729     {MLX_CMD_LOGOP,		0x0105,	 5},
2730     {MLX_CMD_REBUILDASYNC,	0x0002,  6},
2731     {MLX_CMD_REBUILDASYNC,	0x0004,  7},
2732     {MLX_CMD_REBUILDASYNC,	0x0105,  8},
2733     {MLX_CMD_REBUILDASYNC,	0x0106,  9},
2734     {MLX_CMD_REBUILDASYNC,	0x0107, 14},
2735     {MLX_CMD_CHECKASYNC,	0x0002, 10},
2736     {MLX_CMD_CHECKASYNC,	0x0105, 11},
2737     {MLX_CMD_CHECKASYNC,	0x0106,  9},
2738     {MLX_CMD_STOPCHANNEL,	0x0106, 12},
2739     {MLX_CMD_STOPCHANNEL,	0x0105,  8},
2740     {MLX_CMD_STARTCHANNEL,	0x0005, 13},
2741     {MLX_CMD_STARTCHANNEL,	0x0105,  8},
2742     {MLX_CMD_DIRECT_CDB,	0x0002, 16},
2743     {MLX_CMD_DIRECT_CDB,	0x0008, 17},
2744     {MLX_CMD_DIRECT_CDB,	0x000e, 18},
2745     {MLX_CMD_DIRECT_CDB,	0x000f, 19},
2746     {MLX_CMD_DIRECT_CDB,	0x0105,  8},
2747 
2748     {0,				0x0104, 14},
2749     {-1, 0, 0}
2750 };
2751 
2752 static char *
2753 mlx_diagnose_command(struct mlx_command *mc)
2754 {
2755     static char	unkmsg[80];
2756     int		i;
2757 
2758     /* look up message in table */
2759     for (i = 0; mlx_messages[i].command != -1; i++)
2760 	if (((mc->mc_mailbox[0] == mlx_messages[i].command) || (mlx_messages[i].command == 0)) &&
2761 	    (mc->mc_status == mlx_messages[i].status))
2762 	    return(mlx_status_messages[mlx_messages[i].msg]);
2763 
2764     sprintf(unkmsg, "unknown response 0x%x for command 0x%x", (int)mc->mc_status, (int)mc->mc_mailbox[0]);
2765     return(unkmsg);
2766 }
2767 
2768 /*******************************************************************************
2769  * Print a string describing the controller (sc)
2770  */
2771 static struct
2772 {
2773     int		hwid;
2774     char	*name;
2775 } mlx_controller_names[] = {
2776     {0x01,	"960P/PD"},
2777     {0x02,	"960PL"},
2778     {0x10,	"960PG"},
2779     {0x11,	"960PJ"},
2780     {0x12,	"960PR"},
2781     {0x13,	"960PT"},
2782     {0x14,	"960PTL0"},
2783     {0x15,	"960PRL"},
2784     {0x16,	"960PTL1"},
2785     {0x20,	"1164PVX"},
2786     {-1, NULL}
2787 };
2788 
2789 static void
2790 mlx_describe_controller(struct mlx_softc *sc)
2791 {
2792     static char		buf[80];
2793     char		*model;
2794     int			i;
2795 
2796     for (i = 0, model = NULL; mlx_controller_names[i].name != NULL; i++) {
2797 	if ((sc->mlx_enq2->me_hardware_id & 0xff) == mlx_controller_names[i].hwid) {
2798 	    model = mlx_controller_names[i].name;
2799 	    break;
2800 	}
2801     }
2802     if (model == NULL) {
2803 	sprintf(buf, " model 0x%x", sc->mlx_enq2->me_hardware_id & 0xff);
2804 	model = buf;
2805     }
2806     device_printf(sc->mlx_dev, "DAC%s, %d channel%s, firmware %d.%02d-%c-%02d, %dMB RAM\n",
2807 		  model,
2808 		  sc->mlx_enq2->me_actual_channels,
2809 		  sc->mlx_enq2->me_actual_channels > 1 ? "s" : "",
2810 		  sc->mlx_enq2->me_firmware_id & 0xff,
2811 		  (sc->mlx_enq2->me_firmware_id >> 8) & 0xff,
2812 		  (sc->mlx_enq2->me_firmware_id >> 24) & 0xff,
2813 		  (sc->mlx_enq2->me_firmware_id >> 16) & 0xff,
2814 		  sc->mlx_enq2->me_mem_size / (1024 * 1024));
2815 
2816     if (bootverbose) {
2817 	device_printf(sc->mlx_dev, "  Hardware ID                 0x%08x\n", sc->mlx_enq2->me_hardware_id);
2818 	device_printf(sc->mlx_dev, "  Firmware ID                 0x%08x\n", sc->mlx_enq2->me_firmware_id);
2819 	device_printf(sc->mlx_dev, "  Configured/Actual channels  %d/%d\n", sc->mlx_enq2->me_configured_channels,
2820 		      sc->mlx_enq2->me_actual_channels);
2821 	device_printf(sc->mlx_dev, "  Max Targets                 %d\n", sc->mlx_enq2->me_max_targets);
2822 	device_printf(sc->mlx_dev, "  Max Tags                    %d\n", sc->mlx_enq2->me_max_tags);
2823 	device_printf(sc->mlx_dev, "  Max System Drives           %d\n", sc->mlx_enq2->me_max_sys_drives);
2824 	device_printf(sc->mlx_dev, "  Max Arms                    %d\n", sc->mlx_enq2->me_max_arms);
2825 	device_printf(sc->mlx_dev, "  Max Spans                   %d\n", sc->mlx_enq2->me_max_spans);
2826 	device_printf(sc->mlx_dev, "  DRAM/cache/flash/NVRAM size %d/%d/%d/%d\n", sc->mlx_enq2->me_mem_size,
2827 		      sc->mlx_enq2->me_cache_size, sc->mlx_enq2->me_flash_size, sc->mlx_enq2->me_nvram_size);
2828 	device_printf(sc->mlx_dev, "  DRAM type                   %d\n", sc->mlx_enq2->me_mem_type);
2829 	device_printf(sc->mlx_dev, "  Clock Speed                 %dns\n", sc->mlx_enq2->me_clock_speed);
2830 	device_printf(sc->mlx_dev, "  Hardware Speed              %dns\n", sc->mlx_enq2->me_hardware_speed);
2831 	device_printf(sc->mlx_dev, "  Max Commands                %d\n", sc->mlx_enq2->me_max_commands);
2832 	device_printf(sc->mlx_dev, "  Max SG Entries              %d\n", sc->mlx_enq2->me_max_sg);
2833 	device_printf(sc->mlx_dev, "  Max DP                      %d\n", sc->mlx_enq2->me_max_dp);
2834 	device_printf(sc->mlx_dev, "  Max IOD                     %d\n", sc->mlx_enq2->me_max_iod);
2835 	device_printf(sc->mlx_dev, "  Max Comb                    %d\n", sc->mlx_enq2->me_max_comb);
2836 	device_printf(sc->mlx_dev, "  Latency                     %ds\n", sc->mlx_enq2->me_latency);
2837 	device_printf(sc->mlx_dev, "  SCSI Timeout                %ds\n", sc->mlx_enq2->me_scsi_timeout);
2838 	device_printf(sc->mlx_dev, "  Min Free Lines              %d\n", sc->mlx_enq2->me_min_freelines);
2839 	device_printf(sc->mlx_dev, "  Rate Constant               %d\n", sc->mlx_enq2->me_rate_const);
2840 	device_printf(sc->mlx_dev, "  MAXBLK                      %d\n", sc->mlx_enq2->me_maxblk);
2841 	device_printf(sc->mlx_dev, "  Blocking Factor             %d sectors\n", sc->mlx_enq2->me_blocking_factor);
2842 	device_printf(sc->mlx_dev, "  Cache Line Size             %d blocks\n", sc->mlx_enq2->me_cacheline);
2843 	device_printf(sc->mlx_dev, "  SCSI Capability             %s%dMHz, %d bit\n",
2844 		      sc->mlx_enq2->me_scsi_cap & (1<<4) ? "differential " : "",
2845 		      (1 << ((sc->mlx_enq2->me_scsi_cap >> 2) & 3)) * 10,
2846 		      8 << (sc->mlx_enq2->me_scsi_cap & 0x3));
2847 	device_printf(sc->mlx_dev, "  Firmware Build Number       %d\n", sc->mlx_enq2->me_firmware_build);
2848 	device_printf(sc->mlx_dev, "  Fault Management Type       %d\n", sc->mlx_enq2->me_fault_mgmt_type);
2849 	device_printf(sc->mlx_dev, "  Features                    %b\n", sc->mlx_enq2->me_firmware_features,
2850 		      "\20\4Background Init\3Read Ahead\2MORE\1Cluster\n");
2851 
2852     }
2853 }
2854 
2855 /*******************************************************************************
2856  * Emit a string describing the firmware handshake status code, and return a flag
2857  * indicating whether the code represents a fatal error.
2858  *
2859  * Error code interpretations are from the Linux driver, and don't directly match
2860  * the messages printed by Mylex's BIOS.  This may change if documentation on the
2861  * codes is forthcoming.
2862  */
2863 static int
2864 mlx_fw_message(struct mlx_softc *sc, int error, int param1, int param2)
2865 {
2866     switch(error) {
2867     case 0x00:
2868 	device_printf(sc->mlx_dev, "physical drive %d:%d not responding\n", param2, param1);
2869 	break;
2870     case 0x08:
2871 	/* we could be neater about this and give some indication when we receive more of them */
2872 	if (!(sc->mlx_flags & MLX_SPINUP_REPORTED)) {
2873 	    device_printf(sc->mlx_dev, "spinning up drives...\n");
2874 	    sc->mlx_flags |= MLX_SPINUP_REPORTED;
2875 	}
2876 	break;
2877     case 0x30:
2878 	device_printf(sc->mlx_dev, "configuration checksum error\n");
2879 	break;
2880     case 0x60:
2881 	device_printf(sc->mlx_dev, "mirror race recovery failed\n");
2882 	break;
2883     case 0x70:
2884 	device_printf(sc->mlx_dev, "mirror race recovery in progress\n");
2885 	break;
2886     case 0x90:
2887 	device_printf(sc->mlx_dev, "physical drive %d:%d COD mismatch\n", param2, param1);
2888 	break;
2889     case 0xa0:
2890 	device_printf(sc->mlx_dev, "logical drive installation aborted\n");
2891 	break;
2892     case 0xb0:
2893 	device_printf(sc->mlx_dev, "mirror race on a critical system drive\n");
2894 	break;
2895     case 0xd0:
2896 	device_printf(sc->mlx_dev, "new controller configuration found\n");
2897 	break;
2898     case 0xf0:
2899 	device_printf(sc->mlx_dev, "FATAL MEMORY PARITY ERROR\n");
2900 	return(1);
2901     default:
2902 	device_printf(sc->mlx_dev, "unknown firmware initialisation error %02x:%02x:%02x\n", error, param1, param2);
2903 	break;
2904     }
2905     return(0);
2906 }
2907 
2908 /********************************************************************************
2909  ********************************************************************************
2910                                                                 Utility Functions
2911  ********************************************************************************
2912  ********************************************************************************/
2913 
2914 /********************************************************************************
2915  * Find the disk whose unit number is (unit) on this controller
2916  */
2917 static struct mlx_sysdrive *
2918 mlx_findunit(struct mlx_softc *sc, int unit)
2919 {
2920     int		i;
2921 
2922     /* search system drives */
2923     for (i = 0; i < MLX_MAXDRIVES; i++) {
2924 	/* is this one attached? */
2925 	if (sc->mlx_sysdrive[i].ms_disk != 0) {
2926 	    /* is this the one? */
2927 	    if (unit == device_get_unit(sc->mlx_sysdrive[i].ms_disk))
2928 		return(&sc->mlx_sysdrive[i]);
2929 	}
2930     }
2931     return(NULL);
2932 }
2933