xref: /freebsd/sys/dev/mlx/mlx.c (revision 23f282aa31e9b6fceacd449020e936e98d6f2298)
1 /*-
2  * Copyright (c) 1999 Michael Smith
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  *
26  *	$FreeBSD$
27  */
28 
29 /*
30  * Driver for the Mylex DAC960 family of RAID controllers.
31  */
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/malloc.h>
36 #include <sys/kernel.h>
37 
38 #include <sys/buf.h>
39 #include <sys/bus.h>
40 #include <sys/conf.h>
41 #include <sys/devicestat.h>
42 #include <sys/disk.h>
43 #include <sys/stat.h>
44 
45 #include <machine/resource.h>
46 #include <machine/bus.h>
47 #include <machine/clock.h>
48 #include <sys/rman.h>
49 
50 #include <dev/mlx/mlxio.h>
51 #include <dev/mlx/mlxvar.h>
52 #include <dev/mlx/mlxreg.h>
53 
54 #define MLX_CDEV_MAJOR	130
55 
56 static struct cdevsw mlx_cdevsw = {
57 		/* open */	mlx_open,
58 		/* close */	mlx_close,
59 		/* read */	noread,
60 		/* write */	nowrite,
61 		/* ioctl */	mlx_ioctl,
62 		/* poll */	nopoll,
63 		/* mmap */	nommap,
64 		/* strategy */	nostrategy,
65 		/* name */ 	"mlx",
66 		/* maj */	MLX_CDEV_MAJOR,
67 		/* dump */	nodump,
68 		/* psize */ 	nopsize,
69 		/* flags */	0,
70 		/* bmaj */	-1
71 };
72 
73 devclass_t	mlx_devclass;
74 
75 /*
76  * Per-interface accessor methods
77  */
78 static int			mlx_v3_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
79 static int			mlx_v3_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
80 static void			mlx_v3_intaction(struct mlx_softc *sc, int action);
81 static int			mlx_v3_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2);
82 
83 static int			mlx_v4_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
84 static int			mlx_v4_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
85 static void			mlx_v4_intaction(struct mlx_softc *sc, int action);
86 static int			mlx_v4_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2);
87 
88 static int			mlx_v5_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
89 static int			mlx_v5_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
90 static void			mlx_v5_intaction(struct mlx_softc *sc, int action);
91 static int			mlx_v5_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2);
92 
93 /*
94  * Status monitoring
95  */
96 static void			mlx_periodic(void *data);
97 static void			mlx_periodic_enquiry(struct mlx_command *mc);
98 static void			mlx_periodic_eventlog_poll(struct mlx_softc *sc);
99 static void			mlx_periodic_eventlog_respond(struct mlx_command *mc);
100 static void			mlx_periodic_rebuild(struct mlx_command *mc);
101 
102 /*
103  * Channel Pause
104  */
105 static void			mlx_pause_action(struct mlx_softc *sc);
106 static void			mlx_pause_done(struct mlx_command *mc);
107 
108 /*
109  * Command submission.
110  */
111 static void			*mlx_enquire(struct mlx_softc *sc, int command, size_t bufsize,
112 					     void (*complete)(struct mlx_command *mc));
113 static int			mlx_flush(struct mlx_softc *sc);
114 static int			mlx_check(struct mlx_softc *sc, int drive);
115 static int			mlx_rebuild(struct mlx_softc *sc, int channel, int target);
116 static int			mlx_wait_command(struct mlx_command *mc);
117 static int			mlx_poll_command(struct mlx_command *mc);
118 static void			mlx_startio(struct mlx_softc *sc);
119 static void			mlx_completeio(struct mlx_command *mc);
120 static int			mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu);
121 
122 /*
123  * Command buffer allocation.
124  */
125 static struct mlx_command	*mlx_alloccmd(struct mlx_softc *sc);
126 static void			mlx_releasecmd(struct mlx_command *mc);
127 static void			mlx_freecmd(struct mlx_command *mc);
128 
129 /*
130  * Command management.
131  */
132 static int			mlx_getslot(struct mlx_command *mc);
133 static void			mlx_mapcmd(struct mlx_command *mc);
134 static void			mlx_unmapcmd(struct mlx_command *mc);
135 static int			mlx_start(struct mlx_command *mc);
136 static int			mlx_done(struct mlx_softc *sc);
137 static void			mlx_complete(struct mlx_softc *sc);
138 
139 /*
140  * Debugging.
141  */
142 static char			*mlx_diagnose_command(struct mlx_command *mc);
143 static void			mlx_describe_controller(struct mlx_softc *sc);
144 static int			mlx_fw_message(struct mlx_softc *sc, int status, int param1, int param2);
145 
146 /*
147  * Utility functions.
148  */
149 static struct mlx_sysdrive	*mlx_findunit(struct mlx_softc *sc, int unit);
150 
151 /********************************************************************************
152  ********************************************************************************
153                                                                 Public Interfaces
154  ********************************************************************************
155  ********************************************************************************/
156 
157 /********************************************************************************
158  * Free all of the resources associated with (sc)
159  *
160  * Should not be called if the controller is active.
161  */
162 void
163 mlx_free(struct mlx_softc *sc)
164 {
165     struct mlx_command	*mc;
166 
167     debug_called(1);
168 
169     /* cancel status timeout */
170     untimeout(mlx_periodic, sc, sc->mlx_timeout);
171 
172     /* throw away any command buffers */
173     while ((mc = TAILQ_FIRST(&sc->mlx_freecmds)) != NULL) {
174 	TAILQ_REMOVE(&sc->mlx_freecmds, mc, mc_link);
175 	mlx_freecmd(mc);
176     }
177 
178     /* destroy data-transfer DMA tag */
179     if (sc->mlx_buffer_dmat)
180 	bus_dma_tag_destroy(sc->mlx_buffer_dmat);
181 
182     /* free and destroy DMA memory and tag for s/g lists */
183     if (sc->mlx_sgtable)
184 	bus_dmamem_free(sc->mlx_sg_dmat, sc->mlx_sgtable, sc->mlx_sg_dmamap);
185     if (sc->mlx_sg_dmat)
186 	bus_dma_tag_destroy(sc->mlx_sg_dmat);
187 
188     /* disconnect the interrupt handler */
189     if (sc->mlx_intr)
190 	bus_teardown_intr(sc->mlx_dev, sc->mlx_irq, sc->mlx_intr);
191     if (sc->mlx_irq != NULL)
192 	bus_release_resource(sc->mlx_dev, SYS_RES_IRQ, 0, sc->mlx_irq);
193 
194     /* destroy the parent DMA tag */
195     if (sc->mlx_parent_dmat)
196 	bus_dma_tag_destroy(sc->mlx_parent_dmat);
197 
198     /* release the register window mapping */
199     if (sc->mlx_mem != NULL)
200 	bus_release_resource(sc->mlx_dev, SYS_RES_MEMORY,
201 			     (sc->mlx_iftype == MLX_IFTYPE_3) ? MLX_CFG_BASE1 : MLX_CFG_BASE0, sc->mlx_mem);
202 
203     /* free controller enquiry data */
204     if (sc->mlx_enq2 != NULL)
205 	free(sc->mlx_enq2, M_DEVBUF);
206 
207     /* destroy control device */
208     if (sc->mlx_dev_t != (dev_t)NULL)
209 	destroy_dev(sc->mlx_dev_t);
210 }
211 
212 /********************************************************************************
213  * Map the scatter/gather table into bus space
214  */
215 static void
216 mlx_dma_map_sg(void *arg, bus_dma_segment_t *segs, int nseg, int error)
217 {
218     struct mlx_softc	*sc = (struct mlx_softc *)arg;
219 
220     debug_called(1);
221 
222     /* save base of s/g table's address in bus space */
223     sc->mlx_sgbusaddr = segs->ds_addr;
224 }
225 
226 static int
227 mlx_sglist_map(struct mlx_softc *sc)
228 {
229     size_t	segsize;
230     int		error;
231 
232     debug_called(1);
233 
234     /* destroy any existing mappings */
235     if (sc->mlx_sgtable)
236 	bus_dmamem_free(sc->mlx_sg_dmat, sc->mlx_sgtable, sc->mlx_sg_dmamap);
237     if (sc->mlx_sg_dmat)
238 	bus_dma_tag_destroy(sc->mlx_sg_dmat);
239 
240     /*
241      * Create a single tag describing a region large enough to hold all of
242      * the s/g lists we will need.
243      */
244     segsize = sizeof(struct mlx_sgentry) * sc->mlx_sg_nseg * sc->mlx_maxiop;
245     error = bus_dma_tag_create(sc->mlx_parent_dmat, 	/* parent */
246 			       1, 0, 			/* alignment, boundary */
247 			       BUS_SPACE_MAXADDR,	/* lowaddr */
248 			       BUS_SPACE_MAXADDR, 	/* highaddr */
249 			       NULL, NULL, 		/* filter, filterarg */
250 			       segsize, 1,		/* maxsize, nsegments */
251 			       BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
252 			       0,			/* flags */
253 			       &sc->mlx_sg_dmat);
254     if (error != 0) {
255 	device_printf(sc->mlx_dev, "can't allocate scatter/gather DMA tag\n");
256 	return(ENOMEM);
257     }
258 
259     /*
260      * Allocate enough s/g maps for all commands and permanently map them into
261      * controller-visible space.
262      *
263      * XXX this assumes we can get enough space for all the s/g maps in one
264      * contiguous slab.  We may need to switch to a more complex arrangement where
265      * we allocate in smaller chunks and keep a lookup table from slot to bus address.
266      */
267     error = bus_dmamem_alloc(sc->mlx_sg_dmat, (void **)&sc->mlx_sgtable, BUS_DMA_NOWAIT, &sc->mlx_sg_dmamap);
268     if (error) {
269 	device_printf(sc->mlx_dev, "can't allocate s/g table\n");
270 	return(ENOMEM);
271     }
272     bus_dmamap_load(sc->mlx_sg_dmat, sc->mlx_sg_dmamap, sc->mlx_sgtable, segsize, mlx_dma_map_sg, sc, 0);
273     return(0);
274 }
275 
276 /********************************************************************************
277  * Initialise the controller and softc
278  */
279 int
280 mlx_attach(struct mlx_softc *sc)
281 {
282     struct mlx_enquiry_old	*meo;
283     int				rid, error, fwminor, hscode, hserror, hsparam1, hsparam2, hsmsg;
284 
285     debug_called(1);
286 
287     /*
288      * Initialise per-controller queues.
289      */
290     TAILQ_INIT(&sc->mlx_work);
291     TAILQ_INIT(&sc->mlx_freecmds);
292     bioq_init(&sc->mlx_bioq);
293 
294     /*
295      * Select accessor methods based on controller interface type.
296      */
297     switch(sc->mlx_iftype) {
298     case MLX_IFTYPE_2:
299     case MLX_IFTYPE_3:
300 	sc->mlx_tryqueue	= mlx_v3_tryqueue;
301 	sc->mlx_findcomplete	= mlx_v3_findcomplete;
302 	sc->mlx_intaction	= mlx_v3_intaction;
303 	sc->mlx_fw_handshake	= mlx_v3_fw_handshake;
304 	sc->mlx_sg_nseg		= MLX_NSEG_OLD;
305 	break;
306     case MLX_IFTYPE_4:
307 	sc->mlx_tryqueue	= mlx_v4_tryqueue;
308 	sc->mlx_findcomplete	= mlx_v4_findcomplete;
309 	sc->mlx_intaction	= mlx_v4_intaction;
310 	sc->mlx_fw_handshake	= mlx_v4_fw_handshake;
311 	sc->mlx_sg_nseg		= MLX_NSEG_NEW;
312 	break;
313     case MLX_IFTYPE_5:
314 	sc->mlx_tryqueue	= mlx_v5_tryqueue;
315 	sc->mlx_findcomplete	= mlx_v5_findcomplete;
316 	sc->mlx_intaction	= mlx_v5_intaction;
317 	sc->mlx_fw_handshake	= mlx_v5_fw_handshake;
318 	sc->mlx_sg_nseg		= MLX_NSEG_NEW;
319 	break;
320     default:
321 	mlx_free(sc);
322 	return(ENXIO);		/* should never happen */
323     }
324 
325     /* disable interrupts before we start talking to the controller */
326     sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
327 
328     /*
329      * Wait for the controller to come ready, handshake with the firmware if required.
330      * This is typically only necessary on platforms where the controller BIOS does not
331      * run.
332      */
333     hsmsg = 0;
334     DELAY(1000);
335     while ((hscode = sc->mlx_fw_handshake(sc, &hserror, &hsparam1, &hsparam2)) != 0) {
336 	/* report first time around... */
337 	if (hsmsg == 0) {
338 	    device_printf(sc->mlx_dev, "controller initialisation in progress...\n");
339 	    hsmsg = 1;
340 	}
341 	/* did we get a real message? */
342 	if (hscode == 2) {
343 	    hscode = mlx_fw_message(sc, hserror, hsparam1, hsparam2);
344 	    /* fatal initialisation error? */
345 	    if (hscode != 0) {
346 		mlx_free(sc);
347 		return(ENXIO);
348 	    }
349 	}
350     }
351     if (hsmsg == 1)
352 	device_printf(sc->mlx_dev, "initialisation complete.\n");
353 
354     /*
355      * Allocate and connect our interrupt.
356      */
357     rid = 0;
358     sc->mlx_irq = bus_alloc_resource(sc->mlx_dev, SYS_RES_IRQ, &rid, 0, ~0, 1, RF_SHAREABLE | RF_ACTIVE);
359     if (sc->mlx_irq == NULL) {
360 	device_printf(sc->mlx_dev, "can't allocate interrupt\n");
361 	mlx_free(sc);
362 	return(ENXIO);
363     }
364     error = bus_setup_intr(sc->mlx_dev, sc->mlx_irq, INTR_TYPE_BIO,  mlx_intr, sc, &sc->mlx_intr);
365     if (error) {
366 	device_printf(sc->mlx_dev, "can't set up interrupt\n");
367 	mlx_free(sc);
368 	return(ENXIO);
369     }
370 
371     /*
372      * Create DMA tag for mapping buffers into controller-addressable space.
373      */
374     error = bus_dma_tag_create(sc->mlx_parent_dmat, 		/* parent */
375 			       1, 0, 				/* alignment, boundary */
376 			       BUS_SPACE_MAXADDR,		/* lowaddr */
377 			       BUS_SPACE_MAXADDR, 		/* highaddr */
378 			       NULL, NULL, 			/* filter, filterarg */
379 			       MAXBSIZE, sc->mlx_sg_nseg,	/* maxsize, nsegments */
380 			       BUS_SPACE_MAXSIZE_32BIT,		/* maxsegsize */
381 			       0,				/* flags */
382 			       &sc->mlx_buffer_dmat);
383     if (error != 0) {
384 	device_printf(sc->mlx_dev, "can't allocate buffer DMA tag\n");
385 	mlx_free(sc);
386 	return(ENOMEM);
387     }
388 
389     /*
390      * Create an initial set of s/g mappings.
391      */
392     sc->mlx_maxiop = 8;
393     error = mlx_sglist_map(sc);
394     if (error != 0) {
395 	device_printf(sc->mlx_dev, "can't make initial s/g list mapping\n");
396 	mlx_free(sc);
397 	return(error);
398     }
399 
400     /* send an ENQUIRY2 to the controller */
401     if ((sc->mlx_enq2 = mlx_enquire(sc, MLX_CMD_ENQUIRY2, sizeof(struct mlx_enquiry2), NULL)) == NULL) {
402 	device_printf(sc->mlx_dev, "ENQUIRY2 failed\n");
403 	mlx_free(sc);
404 	return(ENXIO);
405     }
406 
407     /*
408      * We don't (yet) know where the event log is up to.
409      */
410     sc->mlx_currevent = -1;
411 
412     /*
413      * Do quirk/feature related things.
414      */
415     fwminor = (sc->mlx_enq2->me_firmware_id >> 8) & 0xff;
416     switch(sc->mlx_iftype) {
417     case MLX_IFTYPE_2:
418 	/* These controllers don't report the firmware version in the ENQUIRY2 response */
419 	if ((meo = mlx_enquire(sc, MLX_CMD_ENQUIRY_OLD, sizeof(struct mlx_enquiry_old), NULL)) == NULL) {
420 	    device_printf(sc->mlx_dev, "ENQUIRY_OLD failed\n");
421 	    mlx_free(sc);
422 	    return(ENXIO);
423 	}
424 	sc->mlx_enq2->me_firmware_id = ('0' << 24) | (0 << 16) | (meo->me_fwminor << 8) | meo->me_fwmajor;
425 	free(meo, M_DEVBUF);
426 
427 	/* XXX require 2.42 or better (PCI) or 2.14 or better (EISA) */
428 	if (meo->me_fwminor < 42) {
429 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
430 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 2.42 or later\n");
431 	}
432 	break;
433     case MLX_IFTYPE_3:
434 	/* XXX certify 3.52? */
435 	if (fwminor < 51) {
436 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
437 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 3.51 or later\n");
438 	}
439 	break;
440     case MLX_IFTYPE_4:
441 	/* XXX certify firmware versions? */
442 	if (fwminor < 6) {
443 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
444 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 4.06 or later\n");
445 	}
446 	break;
447     case MLX_IFTYPE_5:
448 	if (fwminor < 7) {
449 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
450 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 5.07 or later\n");
451 	}
452 	break;
453     default:
454 	mlx_free(sc);
455 	return(ENXIO);		/* should never happen */
456     }
457 
458     /*
459      * Create the final set of s/g mappings now that we know how many commands
460      * the controller actually supports.
461      */
462     sc->mlx_maxiop = sc->mlx_enq2->me_max_commands;
463     error = mlx_sglist_map(sc);
464     if (error != 0) {
465 	device_printf(sc->mlx_dev, "can't make permanent s/g list mapping\n");
466 	mlx_free(sc);
467 	return(error);
468     }
469 
470     /*
471      * No user-requested background operation is in progress.
472      */
473     sc->mlx_background = 0;
474     sc->mlx_rebuildstat.rs_code = MLX_REBUILDSTAT_IDLE;
475 
476     /*
477      * Create the control device.
478      */
479     sc->mlx_dev_t = make_dev(&mlx_cdevsw, device_get_unit(sc->mlx_dev), UID_ROOT, GID_OPERATOR,
480 			     S_IRUSR | S_IWUSR, "mlx%d", device_get_unit(sc->mlx_dev));
481 
482     /*
483      * Start the timeout routine.
484      */
485     sc->mlx_timeout = timeout(mlx_periodic, sc, hz);
486 
487     /* print a little information about the controller */
488     mlx_describe_controller(sc);
489 
490     return(0);
491 }
492 
493 /********************************************************************************
494  * Locate disk resources and attach children to them.
495  */
496 void
497 mlx_startup(struct mlx_softc *sc)
498 {
499     struct mlx_enq_sys_drive	*mes;
500     struct mlx_sysdrive		*dr;
501     int				i, error;
502 
503     debug_called(1);
504 
505     /*
506      * Scan all the system drives and attach children for those that
507      * don't currently have them.
508      */
509     mes = mlx_enquire(sc, MLX_CMD_ENQSYSDRIVE, sizeof(*mes) * MLX_MAXDRIVES, NULL);
510     if (mes == NULL) {
511 	device_printf(sc->mlx_dev, "error fetching drive status\n");
512 	return;
513     }
514 
515     /* iterate over drives returned */
516     for (i = 0, dr = &sc->mlx_sysdrive[0];
517 	 (i < MLX_MAXDRIVES) && (mes[i].sd_size != 0xffffffff);
518 	 i++, dr++) {
519 	/* are we already attached to this drive? */
520     	if (dr->ms_disk == 0) {
521 	    /* pick up drive information */
522 	    dr->ms_size = mes[i].sd_size;
523 	    dr->ms_raidlevel = mes[i].sd_raidlevel & 0xf;
524 	    dr->ms_state = mes[i].sd_state;
525 
526 	    /* generate geometry information */
527 	    if (sc->mlx_geom == MLX_GEOM_128_32) {
528 		dr->ms_heads = 128;
529 		dr->ms_sectors = 32;
530 		dr->ms_cylinders = dr->ms_size / (128 * 32);
531 	    } else {        /* MLX_GEOM_255/63 */
532 		dr->ms_heads = 255;
533 		dr->ms_sectors = 63;
534 		dr->ms_cylinders = dr->ms_size / (255 * 63);
535 	    }
536 	    dr->ms_disk =  device_add_child(sc->mlx_dev, /*"mlxd"*/NULL, -1);
537 	    if (dr->ms_disk == 0)
538 		device_printf(sc->mlx_dev, "device_add_child failed\n");
539 	    device_set_ivars(dr->ms_disk, dr);
540 	}
541     }
542     free(mes, M_DEVBUF);
543     if ((error = bus_generic_attach(sc->mlx_dev)) != 0)
544 	device_printf(sc->mlx_dev, "bus_generic_attach returned %d", error);
545 
546     /* mark controller back up */
547     sc->mlx_state &= ~MLX_STATE_SHUTDOWN;
548 
549     /* enable interrupts */
550     sc->mlx_intaction(sc, MLX_INTACTION_ENABLE);
551 }
552 
553 /********************************************************************************
554  * Disconnect from the controller completely, in preparation for unload.
555  */
556 int
557 mlx_detach(device_t dev)
558 {
559     struct mlx_softc	*sc = device_get_softc(dev);
560     struct mlxd_softc	*mlxd;
561     int			i, s, error;
562 
563     debug_called(1);
564 
565     error = EBUSY;
566     s = splbio();
567     if (sc->mlx_state & MLX_STATE_OPEN)
568 	goto out;
569 
570     for (i = 0; i < MLX_MAXDRIVES; i++) {
571 	if (sc->mlx_sysdrive[i].ms_disk != 0) {
572 	    mlxd = device_get_softc(sc->mlx_sysdrive[i].ms_disk);
573 	    if (mlxd->mlxd_flags & MLXD_OPEN) {		/* drive is mounted, abort detach */
574 		device_printf(sc->mlx_sysdrive[i].ms_disk, "still open, can't detach\n");
575 		goto out;
576 	    }
577 	}
578     }
579     if ((error = mlx_shutdown(dev)))
580 	goto out;
581 
582     mlx_free(sc);
583 
584     error = 0;
585  out:
586     splx(s);
587     return(error);
588 }
589 
590 /********************************************************************************
591  * Bring the controller down to a dormant state and detach all child devices.
592  *
593  * This function is called before detach, system shutdown, or before performing
594  * an operation which may add or delete system disks.  (Call mlx_startup to
595  * resume normal operation.)
596  *
597  * Note that we can assume that the bioq on the controller is empty, as we won't
598  * allow shutdown if any device is open.
599  */
600 int
601 mlx_shutdown(device_t dev)
602 {
603     struct mlx_softc	*sc = device_get_softc(dev);
604     int			i, s, error;
605 
606     debug_called(1);
607 
608     s = splbio();
609     error = 0;
610 
611     sc->mlx_state |= MLX_STATE_SHUTDOWN;
612     sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
613 
614     /* flush controller */
615     device_printf(sc->mlx_dev, "flushing cache...");
616     if (mlx_flush(sc)) {
617 	printf("failed\n");
618     } else {
619 	printf("done\n");
620     }
621 
622     /* delete all our child devices */
623     for (i = 0; i < MLX_MAXDRIVES; i++) {
624 	if (sc->mlx_sysdrive[i].ms_disk != 0) {
625 	    if ((error = device_delete_child(sc->mlx_dev, sc->mlx_sysdrive[i].ms_disk)) != 0)
626 		goto out;
627 	    sc->mlx_sysdrive[i].ms_disk = 0;
628 	}
629     }
630 
631  out:
632     splx(s);
633     return(error);
634 }
635 
636 /********************************************************************************
637  * Bring the controller to a quiescent state, ready for system suspend.
638  */
639 int
640 mlx_suspend(device_t dev)
641 {
642     struct mlx_softc	*sc = device_get_softc(dev);
643     int			s;
644 
645     debug_called(1);
646 
647     s = splbio();
648     sc->mlx_state |= MLX_STATE_SUSPEND;
649 
650     /* flush controller */
651     device_printf(sc->mlx_dev, "flushing cache...");
652     printf("%s\n", mlx_flush(sc) ? "failed" : "done");
653 
654     sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
655     splx(s);
656 
657     return(0);
658 }
659 
660 /********************************************************************************
661  * Bring the controller back to a state ready for operation.
662  */
663 int
664 mlx_resume(device_t dev)
665 {
666     struct mlx_softc	*sc = device_get_softc(dev);
667 
668     debug_called(1);
669 
670     sc->mlx_state &= ~MLX_STATE_SUSPEND;
671     sc->mlx_intaction(sc, MLX_INTACTION_ENABLE);
672 
673     return(0);
674 }
675 
676 /*******************************************************************************
677  * Take an interrupt, or be poked by other code to look for interrupt-worthy
678  * status.
679  */
680 void
681 mlx_intr(void *arg)
682 {
683     struct mlx_softc	*sc = (struct mlx_softc *)arg;
684 
685     debug_called(1);
686 
687     /* collect finished commands, queue anything waiting */
688     mlx_done(sc);
689 };
690 
691 /*******************************************************************************
692  * Receive a buf structure from a child device and queue it on a particular
693  * disk resource, then poke the disk resource to start as much work as it can.
694  */
695 int
696 mlx_submit_buf(struct mlx_softc *sc, struct bio *bp)
697 {
698     int		s;
699 
700     debug_called(1);
701 
702     s = splbio();
703     bioq_insert_tail(&sc->mlx_bioq, bp);
704     sc->mlx_waitbufs++;
705     splx(s);
706     mlx_startio(sc);
707     return(0);
708 }
709 
710 /********************************************************************************
711  * Accept an open operation on the control device.
712  */
713 int
714 mlx_open(dev_t dev, int flags, int fmt, struct proc *p)
715 {
716     int			unit = minor(dev);
717     struct mlx_softc	*sc = devclass_get_softc(mlx_devclass, unit);
718 
719     sc->mlx_state |= MLX_STATE_OPEN;
720     return(0);
721 }
722 
723 /********************************************************************************
724  * Accept the last close on the control device.
725  */
726 int
727 mlx_close(dev_t dev, int flags, int fmt, struct proc *p)
728 {
729     int			unit = minor(dev);
730     struct mlx_softc	*sc = devclass_get_softc(mlx_devclass, unit);
731 
732     sc->mlx_state &= ~MLX_STATE_OPEN;
733     return (0);
734 }
735 
736 /********************************************************************************
737  * Handle controller-specific control operations.
738  */
739 int
740 mlx_ioctl(dev_t dev, u_long cmd, caddr_t addr, int32_t flag, struct proc *p)
741 {
742     int				unit = minor(dev);
743     struct mlx_softc		*sc = devclass_get_softc(mlx_devclass, unit);
744     struct mlx_rebuild_request	*rb = (struct mlx_rebuild_request *)addr;
745     struct mlx_rebuild_status	*rs = (struct mlx_rebuild_status *)addr;
746     int				*arg = (int *)addr;
747     struct mlx_pause		*mp;
748     struct mlx_sysdrive		*dr;
749     struct mlxd_softc		*mlxd;
750     int				i, error;
751 
752     switch(cmd) {
753 	/*
754 	 * Enumerate connected system drives; returns the first system drive's
755 	 * unit number if *arg is -1, or the next unit after *arg if it's
756 	 * a valid unit on this controller.
757 	 */
758     case MLX_NEXT_CHILD:
759 	/* search system drives */
760 	for (i = 0; i < MLX_MAXDRIVES; i++) {
761 	    /* is this one attached? */
762 	    if (sc->mlx_sysdrive[i].ms_disk != 0) {
763 		/* looking for the next one we come across? */
764 		if (*arg == -1) {
765 		    *arg = device_get_unit(sc->mlx_sysdrive[0].ms_disk);
766 		    return(0);
767 		}
768 		/* we want the one after this one */
769 		if (*arg == device_get_unit(sc->mlx_sysdrive[i].ms_disk))
770 		    *arg = -1;
771 	    }
772 	}
773 	return(ENOENT);
774 
775 	/*
776 	 * Scan the controller to see whether new drives have appeared.
777 	 */
778     case MLX_RESCAN_DRIVES:
779 	mlx_startup(sc);
780 	return(0);
781 
782 	/*
783 	 * Disconnect from the specified drive; it may be about to go
784 	 * away.
785 	 */
786     case MLX_DETACH_DRIVE:			/* detach one drive */
787 
788 	if (((dr = mlx_findunit(sc, *arg)) == NULL) ||
789 	    ((mlxd = device_get_softc(dr->ms_disk)) == NULL))
790 	    return(ENOENT);
791 
792 	device_printf(dr->ms_disk, "detaching...");
793 	error = 0;
794 	if (mlxd->mlxd_flags & MLXD_OPEN) {
795 	    error = EBUSY;
796 	    goto detach_out;
797 	}
798 
799 	/* flush controller */
800 	if (mlx_flush(sc)) {
801 	    error = EBUSY;
802 	    goto detach_out;
803 	}
804 
805 	/* nuke drive */
806 	if ((error = device_delete_child(sc->mlx_dev, dr->ms_disk)) != 0)
807 	    goto detach_out;
808 	dr->ms_disk = 0;
809 
810     detach_out:
811 	if (error) {
812 	    printf("failed\n");
813 	} else {
814 	    printf("done\n");
815 	}
816 	return(error);
817 
818 	/*
819 	 * Pause one or more SCSI channels for a period of time, to assist
820 	 * in the process of hot-swapping devices.
821 	 *
822 	 * Note that at least the 3.51 firmware on the DAC960PL doesn't seem
823 	 * to do this right.
824 	 */
825     case MLX_PAUSE_CHANNEL:			/* schedule a channel pause */
826 	/* Does this command work on this firmware? */
827 	if (!(sc->mlx_feature & MLX_FEAT_PAUSEWORKS))
828 	    return(EOPNOTSUPP);
829 
830 	mp = (struct mlx_pause *)addr;
831 	if ((mp->mp_which == MLX_PAUSE_CANCEL) && (sc->mlx_pause.mp_when != 0)) {
832 	    /* cancel a pending pause operation */
833 	    sc->mlx_pause.mp_which = 0;
834 	} else {
835 	    /* fix for legal channels */
836 	    mp->mp_which &= ((1 << sc->mlx_enq2->me_actual_channels) -1);
837 	    /* check time values */
838 	    if ((mp->mp_when < 0) || (mp->mp_when > 3600))
839 		return(EINVAL);
840 	    if ((mp->mp_howlong < 1) || (mp->mp_howlong > (0xf * 30)))
841 		return(EINVAL);
842 
843 	    /* check for a pause currently running */
844 	    if ((sc->mlx_pause.mp_which != 0) && (sc->mlx_pause.mp_when == 0))
845 		return(EBUSY);
846 
847 	    /* looks ok, go with it */
848 	    sc->mlx_pause.mp_which = mp->mp_which;
849 	    sc->mlx_pause.mp_when = time_second + mp->mp_when;
850 	    sc->mlx_pause.mp_howlong = sc->mlx_pause.mp_when + mp->mp_howlong;
851 	}
852 	return(0);
853 
854 	/*
855 	 * Accept a command passthrough-style.
856 	 */
857     case MLX_COMMAND:
858 	return(mlx_user_command(sc, (struct mlx_usercommand *)addr));
859 
860 	/*
861 	 * Start a rebuild on a given SCSI disk
862 	 */
863     case MLX_REBUILDASYNC:
864 	if (sc->mlx_background != 0) {
865 	    rb->rr_status = 0x0106;
866 	    return(EBUSY);
867 	}
868 	rb->rr_status = mlx_rebuild(sc, rb->rr_channel, rb->rr_target);
869 	switch (rb->rr_status) {
870 	case 0:
871 	    error = 0;
872 	    break;
873 	case 0x10000:
874 	    error = ENOMEM;		/* couldn't set up the command */
875 	    break;
876 	case 0x0002:
877 	    error = EBUSY;
878 	    break;
879 	case 0x0104:
880 	    error = EIO;
881 	    break;
882 	case 0x0105:
883 	    error = ERANGE;
884 	    break;
885 	case 0x0106:
886 	    error = EBUSY;
887 	    break;
888 	default:
889 	    error = EINVAL;
890 	    break;
891 	}
892 	if (error == 0)
893 	    sc->mlx_background = MLX_BACKGROUND_REBUILD;
894 	return(error);
895 
896 	/*
897 	 * Get the status of the current rebuild or consistency check.
898 	 */
899     case MLX_REBUILDSTAT:
900 	*rs = sc->mlx_rebuildstat;
901 	return(0);
902 
903 	/*
904 	 * Return the per-controller system drive number matching the
905 	 * disk device number in (arg), if it happens to belong to us.
906 	 */
907     case MLX_GET_SYSDRIVE:
908 	error = ENOENT;
909 	mlxd = (struct mlxd_softc *)devclass_get_softc(mlxd_devclass, *arg);
910 	if ((mlxd != NULL) && (mlxd->mlxd_drive >= sc->mlx_sysdrive) &&
911 	    (mlxd->mlxd_drive < (sc->mlx_sysdrive + MLX_MAXDRIVES))) {
912 	    error = 0;
913 	    *arg = mlxd->mlxd_drive - sc->mlx_sysdrive;
914 	}
915 	return(error);
916 
917     default:
918 	return(ENOTTY);
919     }
920 }
921 
922 /********************************************************************************
923  * Handle operations requested by a System Drive connected to this controller.
924  */
925 int
926 mlx_submit_ioctl(struct mlx_softc *sc, struct mlx_sysdrive *drive, u_long cmd,
927 		caddr_t addr, int32_t flag, struct proc *p)
928 {
929     int				*arg = (int *)addr;
930     int				error, result;
931 
932     switch(cmd) {
933 	/*
934 	 * Return the current status of this drive.
935 	 */
936     case MLXD_STATUS:
937 	*arg = drive->ms_state;
938 	return(0);
939 
940 	/*
941 	 * Start a background consistency check on this drive.
942 	 */
943     case MLXD_CHECKASYNC:		/* start a background consistency check */
944 	if (sc->mlx_background != 0) {
945 	    *arg = 0x0106;
946 	    return(EBUSY);
947 	}
948 	result = mlx_check(sc, drive - &sc->mlx_sysdrive[0]);
949 	switch (result) {
950 	case 0:
951 	    error = 0;
952 	    break;
953 	case 0x10000:
954 	    error = ENOMEM;		/* couldn't set up the command */
955 	    break;
956 	case 0x0002:
957 	    error = EIO;
958 	    break;
959 	case 0x0105:
960 	    error = ERANGE;
961 	    break;
962 	case 0x0106:
963 	    error = EBUSY;
964 	    break;
965 	default:
966 	    error = EINVAL;
967 	    break;
968 	}
969 	if (error == 0)
970 	    sc->mlx_background = MLX_BACKGROUND_CHECK;
971 	*arg = result;
972 	return(error);
973 
974     }
975     return(ENOIOCTL);
976 }
977 
978 
979 /********************************************************************************
980  ********************************************************************************
981                                                                 Status Monitoring
982  ********************************************************************************
983  ********************************************************************************/
984 
985 /********************************************************************************
986  * Fire off commands to periodically check the status of connected drives.
987  */
988 static void
989 mlx_periodic(void *data)
990 {
991     struct mlx_softc *sc = (struct mlx_softc *)data;
992 
993     debug_called(1);
994 
995     /*
996      * Run a bus pause?
997      */
998     if ((sc->mlx_pause.mp_which != 0) &&
999 	(sc->mlx_pause.mp_when > 0) &&
1000 	(time_second >= sc->mlx_pause.mp_when)){
1001 
1002 	mlx_pause_action(sc);		/* pause is running */
1003 	sc->mlx_pause.mp_when = 0;
1004 	sysbeep(500, hz);
1005 
1006 	/*
1007 	 * Bus pause still running?
1008 	 */
1009     } else if ((sc->mlx_pause.mp_which != 0) &&
1010 	       (sc->mlx_pause.mp_when == 0)) {
1011 
1012 	/* time to stop bus pause? */
1013 	if (time_second >= sc->mlx_pause.mp_howlong) {
1014 	    mlx_pause_action(sc);
1015 	    sc->mlx_pause.mp_which = 0;	/* pause is complete */
1016 	    sysbeep(500, hz);
1017 	} else {
1018 	    sysbeep((time_second % 5) * 100 + 500, hz/8);
1019 	}
1020 
1021 	/*
1022 	 * Run normal periodic activities?
1023 	 */
1024     } else if (time_second > (sc->mlx_lastpoll + 10)) {
1025 	sc->mlx_lastpoll = time_second;
1026 
1027 	/*
1028 	 * Check controller status.
1029 	 *
1030 	 * XXX Note that this may not actually launch a command in situations of high load.
1031 	 */
1032 	mlx_enquire(sc, (sc->mlx_iftype == MLX_IFTYPE_2) ? MLX_CMD_ENQUIRY_OLD : MLX_CMD_ENQUIRY,
1033 		    imax(sizeof(struct mlx_enquiry), sizeof(struct mlx_enquiry_old)), mlx_periodic_enquiry);
1034 
1035 	/*
1036 	 * Check system drive status.
1037 	 *
1038 	 * XXX This might be better left to event-driven detection, eg. I/O to an offline
1039 	 *     drive will detect it's offline, rebuilds etc. should detect the drive is back
1040 	 *     online.
1041 	 */
1042 	mlx_enquire(sc, MLX_CMD_ENQSYSDRIVE, sizeof(struct mlx_enq_sys_drive) * MLX_MAXDRIVES,
1043 			mlx_periodic_enquiry);
1044 
1045     }
1046 
1047     /* get drive rebuild/check status */
1048     /* XXX should check sc->mlx_background if this is only valid while in progress */
1049     mlx_enquire(sc, MLX_CMD_REBUILDSTAT, sizeof(struct mlx_rebuild_stat), mlx_periodic_rebuild);
1050 
1051     /* deal with possibly-missed interrupts and timed-out commands */
1052     mlx_done(sc);
1053 
1054     /* reschedule another poll next second or so */
1055     sc->mlx_timeout = timeout(mlx_periodic, sc, hz);
1056 }
1057 
1058 /********************************************************************************
1059  * Handle the result of an ENQUIRY command instigated by periodic status polling.
1060  */
1061 static void
1062 mlx_periodic_enquiry(struct mlx_command *mc)
1063 {
1064     struct mlx_softc		*sc = mc->mc_sc;
1065 
1066     debug_called(1);
1067 
1068     /* Command completed OK? */
1069     if (mc->mc_status != 0) {
1070 	device_printf(sc->mlx_dev, "periodic enquiry failed - %s\n", mlx_diagnose_command(mc));
1071 	goto out;
1072     }
1073 
1074     /* respond to command */
1075     switch(mc->mc_mailbox[0]) {
1076 	/*
1077 	 * This is currently a bit fruitless, as we don't know how to extract the eventlog
1078 	 * pointer yet.
1079 	 */
1080     case MLX_CMD_ENQUIRY_OLD:
1081     {
1082 	struct mlx_enquiry		*me = (struct mlx_enquiry *)mc->mc_data;
1083 	struct mlx_enquiry_old		*meo = (struct mlx_enquiry_old *)mc->mc_data;
1084 	int				i;
1085 
1086 	/* convert data in-place to new format */
1087 	for (i = (sizeof(me->me_dead) / sizeof(me->me_dead[0])) - 1; i >= 0; i--) {
1088 	    me->me_dead[i].dd_chan = meo->me_dead[i].dd_chan;
1089 	    me->me_dead[i].dd_targ = meo->me_dead[i].dd_targ;
1090 	}
1091 	me->me_misc_flags        = 0;
1092 	me->me_rebuild_count     = meo->me_rebuild_count;
1093 	me->me_dead_count        = meo->me_dead_count;
1094 	me->me_critical_sd_count = meo->me_critical_sd_count;
1095 	me->me_event_log_seq_num = 0;
1096 	me->me_offline_sd_count  = meo->me_offline_sd_count;
1097 	me->me_max_commands      = meo->me_max_commands;
1098 	me->me_rebuild_flag      = meo->me_rebuild_flag;
1099 	me->me_fwmajor           = meo->me_fwmajor;
1100 	me->me_fwminor           = meo->me_fwminor;
1101 	me->me_status_flags      = meo->me_status_flags;
1102 	me->me_flash_age         = meo->me_flash_age;
1103 	for (i = (sizeof(me->me_drvsize) / sizeof(me->me_drvsize[0])) - 1; i >= 0; i--) {
1104 	    if (i > ((sizeof(meo->me_drvsize) / sizeof(meo->me_drvsize[0])) - 1)) {
1105 		me->me_drvsize[i] = 0;		/* drive beyond supported range */
1106 	    } else {
1107 		me->me_drvsize[i] = meo->me_drvsize[i];
1108 	    }
1109 	}
1110 	me->me_num_sys_drvs = meo->me_num_sys_drvs;
1111     }
1112     /* FALLTHROUGH */
1113 
1114 	/*
1115 	 * Generic controller status update.  We could do more with this than just
1116 	 * checking the event log.
1117 	 */
1118     case MLX_CMD_ENQUIRY:
1119     {
1120 	struct mlx_enquiry		*me = (struct mlx_enquiry *)mc->mc_data;
1121 
1122 	if (sc->mlx_currevent == -1) {
1123 	    /* initialise our view of the event log */
1124 	    sc->mlx_currevent = sc->mlx_lastevent = me->me_event_log_seq_num;
1125 	} else if ((me->me_event_log_seq_num != sc->mlx_lastevent) && !(sc->mlx_flags & MLX_EVENTLOG_BUSY)) {
1126 	    /* record where current events are up to */
1127 	    sc->mlx_currevent = me->me_event_log_seq_num;
1128 	    debug(1, "event log pointer was %d, now %d\n", sc->mlx_lastevent, sc->mlx_currevent);
1129 
1130 	    /* mark the event log as busy */
1131 	    atomic_set_int(&sc->mlx_flags, MLX_EVENTLOG_BUSY);
1132 
1133 	    /* drain new eventlog entries */
1134 	    mlx_periodic_eventlog_poll(sc);
1135 	}
1136 	break;
1137     }
1138     case MLX_CMD_ENQSYSDRIVE:
1139     {
1140 	struct mlx_enq_sys_drive	*mes = (struct mlx_enq_sys_drive *)mc->mc_data;
1141 	struct mlx_sysdrive		*dr;
1142 	int				i;
1143 
1144 	for (i = 0, dr = &sc->mlx_sysdrive[0];
1145 	     (i < MLX_MAXDRIVES) && (mes[i].sd_size != 0xffffffff);
1146 	     i++) {
1147 
1148 	    /* has state been changed by controller? */
1149 	    if (dr->ms_state != mes[i].sd_state) {
1150 		switch(mes[i].sd_state) {
1151 		case MLX_SYSD_OFFLINE:
1152 		    device_printf(dr->ms_disk, "drive offline\n");
1153 		    break;
1154 		case MLX_SYSD_ONLINE:
1155 		    device_printf(dr->ms_disk, "drive online\n");
1156 		    break;
1157 		case MLX_SYSD_CRITICAL:
1158 		    device_printf(dr->ms_disk, "drive critical\n");
1159 		    break;
1160 		}
1161 		/* save new state */
1162 		dr->ms_state = mes[i].sd_state;
1163 	    }
1164 	}
1165 	break;
1166     }
1167     default:
1168 	device_printf(sc->mlx_dev, "%s: unknown command 0x%x", __FUNCTION__, mc->mc_mailbox[0]);
1169 	break;
1170     }
1171 
1172  out:
1173     free(mc->mc_data, M_DEVBUF);
1174     mlx_releasecmd(mc);
1175 }
1176 
1177 /********************************************************************************
1178  * Instigate a poll for one event log message on (sc).
1179  * We only poll for one message at a time, to keep our command usage down.
1180  */
1181 static void
1182 mlx_periodic_eventlog_poll(struct mlx_softc *sc)
1183 {
1184     struct mlx_command	*mc;
1185     void		*result = NULL;
1186     int			error;
1187 
1188     debug_called(1);
1189 
1190     /* get ourselves a command buffer */
1191     error = 1;
1192     if ((mc = mlx_alloccmd(sc)) == NULL)
1193 	goto out;
1194     /* allocate the response structure */
1195     if ((result = malloc(/*sizeof(struct mlx_eventlog_entry)*/1024, M_DEVBUF, M_NOWAIT)) == NULL)
1196 	goto out;
1197     /* get a command slot */
1198     if (mlx_getslot(mc))
1199 	goto out;
1200 
1201     /* map the command so the controller can see it */
1202     mc->mc_data = result;
1203     mc->mc_length = /*sizeof(struct mlx_eventlog_entry)*/1024;
1204     mlx_mapcmd(mc);
1205 
1206     /* build the command to get one entry */
1207     mlx_make_type3(mc, MLX_CMD_LOGOP, MLX_LOGOP_GET, 1, sc->mlx_lastevent, 0, 0, mc->mc_dataphys, 0);
1208     mc->mc_complete = mlx_periodic_eventlog_respond;
1209     mc->mc_private = mc;
1210 
1211     /* start the command */
1212     if ((error = mlx_start(mc)) != 0)
1213 	goto out;
1214 
1215     error = 0;			/* success */
1216  out:
1217     if (error != 0) {
1218 	if (mc != NULL)
1219 	    mlx_releasecmd(mc);
1220 	if (result != NULL)
1221 	    free(result, M_DEVBUF);
1222     }
1223 }
1224 
1225 /********************************************************************************
1226  * Handle the result of polling for a log message, generate diagnostic output.
1227  * If this wasn't the last message waiting for us, we'll go collect another.
1228  */
1229 static char *mlx_sense_messages[] = {
1230     "because write recovery failed",
1231     "because of SCSI bus reset failure",
1232     "because of double check condition",
1233     "because it was removed",
1234     "because of gross error on SCSI chip",
1235     "because of bad tag returned from drive",
1236     "because of timeout on SCSI command",
1237     "because of reset SCSI command issued from system",
1238     "because busy or parity error count exceeded limit",
1239     "because of 'kill drive' command from system",
1240     "because of selection timeout",
1241     "due to SCSI phase sequence error",
1242     "due to unknown status"
1243 };
1244 
1245 static void
1246 mlx_periodic_eventlog_respond(struct mlx_command *mc)
1247 {
1248     struct mlx_softc		*sc = mc->mc_sc;
1249     struct mlx_eventlog_entry	*el = (struct mlx_eventlog_entry *)mc->mc_data;
1250     char			*reason;
1251 
1252     debug_called(1);
1253 
1254     sc->mlx_lastevent++;		/* next message... */
1255     if (mc->mc_status == 0) {
1256 
1257 	/* handle event log message */
1258 	switch(el->el_type) {
1259 	    /*
1260 	     * This is the only sort of message we understand at the moment.
1261 	     * The tests here are probably incomplete.
1262 	     */
1263 	case MLX_LOGMSG_SENSE:	/* sense data */
1264 	    /* Mylex vendor-specific message indicating a drive was killed? */
1265 	    if ((el->el_sensekey == 9) &&
1266 		(el->el_asc == 0x80)) {
1267 		if (el->el_asq < (sizeof(mlx_sense_messages) / sizeof(mlx_sense_messages[0]))) {
1268 		    reason = mlx_sense_messages[el->el_asq];
1269 		} else {
1270 		    reason = "for unknown reason";
1271 		}
1272 		device_printf(sc->mlx_dev, "physical drive %d:%d killed %s\n",
1273 			      el->el_channel, el->el_target, reason);
1274 	    }
1275 	    /* SCSI drive was reset? */
1276 	    if ((el->el_sensekey == 6) && (el->el_asc == 0x29)) {
1277 		device_printf(sc->mlx_dev, "physical drive %d:%d reset\n",
1278 			      el->el_channel, el->el_target);
1279 	    }
1280 	    /* SCSI drive error? */
1281 	    if (!((el->el_sensekey == 0) ||
1282 		  ((el->el_sensekey == 2) &&
1283 		   (el->el_asc == 0x04) &&
1284 		   ((el->el_asq == 0x01) ||
1285 		    (el->el_asq == 0x02))))) {
1286 		device_printf(sc->mlx_dev, "physical drive %d:%d error log: sense = %d asc = %x asq = %x\n",
1287 			      el->el_channel, el->el_target, el->el_sensekey, el->el_asc, el->el_asq);
1288 		device_printf(sc->mlx_dev, "  info %4D csi %4D\n", el->el_information, ":", el->el_csi, ":");
1289 	    }
1290 	    break;
1291 
1292 	default:
1293 	    device_printf(sc->mlx_dev, "unknown log message type 0x%x\n", el->el_type);
1294 	    break;
1295 	}
1296     } else {
1297 	device_printf(sc->mlx_dev, "error reading message log - %s\n", mlx_diagnose_command(mc));
1298 	/* give up on all the outstanding messages, as we may have come unsynched */
1299 	sc->mlx_lastevent = sc->mlx_currevent;
1300     }
1301 
1302     /* dispose of command and data */
1303     free(mc->mc_data, M_DEVBUF);
1304     mlx_releasecmd(mc);
1305 
1306     /* is there another message to obtain? */
1307     if (sc->mlx_lastevent != sc->mlx_currevent) {
1308 	mlx_periodic_eventlog_poll(sc);
1309     } else {
1310 	/* clear log-busy status */
1311 	atomic_clear_int(&sc->mlx_flags, MLX_EVENTLOG_BUSY);
1312     }
1313 }
1314 
1315 /********************************************************************************
1316  * Handle check/rebuild operations in progress.
1317  */
1318 static void
1319 mlx_periodic_rebuild(struct mlx_command *mc)
1320 {
1321     struct mlx_softc		*sc = mc->mc_sc;
1322     struct mlx_rebuild_status	*mr = (struct mlx_rebuild_status *)mc->mc_data;
1323 
1324     switch(mc->mc_status) {
1325     case 0:				/* operation running, update stats */
1326 	sc->mlx_rebuildstat = *mr;
1327 
1328 	/* spontaneous rebuild/check? */
1329 	if (sc->mlx_background == 0) {
1330 	    sc->mlx_background = MLX_BACKGROUND_SPONTANEOUS;
1331 	    device_printf(sc->mlx_dev, "background check/rebuild operation started\n");
1332 	}
1333 	break;
1334 
1335     case 0x0105:			/* nothing running, finalise stats and report */
1336 	switch(sc->mlx_background) {
1337 	case MLX_BACKGROUND_CHECK:
1338 	    device_printf(sc->mlx_dev, "consistency check completed\n");	/* XXX print drive? */
1339 	    break;
1340 	case MLX_BACKGROUND_REBUILD:
1341 	    device_printf(sc->mlx_dev, "drive rebuild completed\n");	/* XXX print channel/target? */
1342 	    break;
1343 	case MLX_BACKGROUND_SPONTANEOUS:
1344 	default:
1345 	    /* if we have previously been non-idle, report the transition */
1346 	    if (sc->mlx_rebuildstat.rs_code != MLX_REBUILDSTAT_IDLE) {
1347 		device_printf(sc->mlx_dev, "background check/rebuild operation completed\n");
1348 	    }
1349 	}
1350 	sc->mlx_background = 0;
1351 	sc->mlx_rebuildstat.rs_code = MLX_REBUILDSTAT_IDLE;
1352 	break;
1353     }
1354     free(mc->mc_data, M_DEVBUF);
1355     mlx_releasecmd(mc);
1356 }
1357 
1358 /********************************************************************************
1359  ********************************************************************************
1360                                                                     Channel Pause
1361  ********************************************************************************
1362  ********************************************************************************/
1363 
1364 /********************************************************************************
1365  * It's time to perform a channel pause action for (sc), either start or stop
1366  * the pause.
1367  */
1368 static void
1369 mlx_pause_action(struct mlx_softc *sc)
1370 {
1371     struct mlx_command	*mc;
1372     int			failsafe, i, command;
1373 
1374     /* What are we doing here? */
1375     if (sc->mlx_pause.mp_when == 0) {
1376 	command = MLX_CMD_STARTCHANNEL;
1377 	failsafe = 0;
1378 
1379     } else {
1380 	command = MLX_CMD_STOPCHANNEL;
1381 
1382 	/*
1383 	 * Channels will always start again after the failsafe period,
1384 	 * which is specified in multiples of 30 seconds.
1385 	 * This constrains us to a maximum pause of 450 seconds.
1386 	 */
1387 	failsafe = ((sc->mlx_pause.mp_howlong - time_second) + 5) / 30;
1388 	if (failsafe > 0xf) {
1389 	    failsafe = 0xf;
1390 	    sc->mlx_pause.mp_howlong = time_second + (0xf * 30) - 5;
1391 	}
1392     }
1393 
1394     /* build commands for every channel requested */
1395     for (i = 0; i < sc->mlx_enq2->me_actual_channels; i++) {
1396 	if ((1 << i) & sc->mlx_pause.mp_which) {
1397 
1398 	    /* get ourselves a command buffer */
1399 	    if ((mc = mlx_alloccmd(sc)) == NULL)
1400 		goto fail;
1401 	    /* get a command slot */
1402 	    mc->mc_flags |= MLX_CMD_PRIORITY;
1403 	    if (mlx_getslot(mc))
1404 		goto fail;
1405 
1406 	    /* build the command */
1407 	    mlx_make_type2(mc, command, (failsafe << 4) | i, 0, 0, 0, 0, 0, 0, 0);
1408 	    mc->mc_complete = mlx_pause_done;
1409 	    mc->mc_private = sc;		/* XXX not needed */
1410 	    if (mlx_start(mc))
1411 		goto fail;
1412 	    /* command submitted OK */
1413 	    return;
1414 
1415 	fail:
1416 	    device_printf(sc->mlx_dev, "%s failed for channel %d\n",
1417 			  command == MLX_CMD_STOPCHANNEL ? "pause" : "resume", i);
1418 	    if (mc != NULL)
1419 		mlx_releasecmd(mc);
1420 	}
1421     }
1422 }
1423 
1424 static void
1425 mlx_pause_done(struct mlx_command *mc)
1426 {
1427     struct mlx_softc	*sc = mc->mc_sc;
1428     int			command = mc->mc_mailbox[0];
1429     int			channel = mc->mc_mailbox[2] & 0xf;
1430 
1431     if (mc->mc_status != 0) {
1432 	device_printf(sc->mlx_dev, "%s command failed - %s\n",
1433 		      command == MLX_CMD_STOPCHANNEL ? "pause" : "resume", mlx_diagnose_command(mc));
1434     } else if (command == MLX_CMD_STOPCHANNEL) {
1435 	device_printf(sc->mlx_dev, "channel %d pausing for %ld seconds\n",
1436 		      channel, (long)(sc->mlx_pause.mp_howlong - time_second));
1437     } else {
1438 	device_printf(sc->mlx_dev, "channel %d resuming\n", channel);
1439     }
1440     mlx_releasecmd(mc);
1441 }
1442 
1443 /********************************************************************************
1444  ********************************************************************************
1445                                                                Command Submission
1446  ********************************************************************************
1447  ********************************************************************************/
1448 
1449 /********************************************************************************
1450  * Perform an Enquiry command using a type-3 command buffer and a return a single
1451  * linear result buffer.  If the completion function is specified, it will
1452  * be called with the completed command (and the result response will not be
1453  * valid until that point).  Otherwise, the command will either be busy-waited
1454  * for (interrupts not enabled), or slept for.
1455  */
1456 static void *
1457 mlx_enquire(struct mlx_softc *sc, int command, size_t bufsize, void (* complete)(struct mlx_command *mc))
1458 {
1459     struct mlx_command	*mc;
1460     void		*result;
1461     int			error;
1462 
1463     debug_called(1);
1464 
1465     /* get ourselves a command buffer */
1466     error = 1;
1467     result = NULL;
1468     if ((mc = mlx_alloccmd(sc)) == NULL)
1469 	goto out;
1470     /* allocate the response structure */
1471     if ((result = malloc(bufsize, M_DEVBUF, M_NOWAIT)) == NULL)
1472 	goto out;
1473     /* get a command slot */
1474     mc->mc_flags |= MLX_CMD_PRIORITY | MLX_CMD_DATAOUT;
1475     if (mlx_getslot(mc))
1476 	goto out;
1477 
1478     /* map the command so the controller can see it */
1479     mc->mc_data = result;
1480     mc->mc_length = bufsize;
1481     mlx_mapcmd(mc);
1482 
1483     /* build an enquiry command */
1484     mlx_make_type2(mc, command, 0, 0, 0, 0, 0, 0, mc->mc_dataphys, 0);
1485 
1486     /* do we want a completion callback? */
1487     if (complete != NULL) {
1488 	mc->mc_complete = complete;
1489 	mc->mc_private = mc;
1490 	if ((error = mlx_start(mc)) != 0)
1491 	    goto out;
1492     } else {
1493 	/* run the command in either polled or wait mode */
1494 	if ((sc->mlx_state & MLX_STATE_INTEN) ? mlx_wait_command(mc) : mlx_poll_command(mc))
1495 	    goto out;
1496 
1497 	/* command completed OK? */
1498 	if (mc->mc_status != 0) {
1499 	    device_printf(sc->mlx_dev, "ENQUIRY failed - %s\n", mlx_diagnose_command(mc));
1500 	    goto out;
1501 	}
1502     }
1503     error = 0;			/* success */
1504  out:
1505     /* we got a command, but nobody else will free it */
1506     if ((complete == NULL) && (mc != NULL))
1507 	mlx_releasecmd(mc);
1508     /* we got an error, and we allocated a result */
1509     if ((error != 0) && (result != NULL)) {
1510 	free(result, M_DEVBUF);
1511 	result = NULL;
1512     }
1513     return(result);
1514 }
1515 
1516 
1517 /********************************************************************************
1518  * Perform a Flush command on the nominated controller.
1519  *
1520  * May be called with interrupts enabled or disabled; will not return until
1521  * the flush operation completes or fails.
1522  */
1523 static int
1524 mlx_flush(struct mlx_softc *sc)
1525 {
1526     struct mlx_command	*mc;
1527     int			error;
1528 
1529     debug_called(1);
1530 
1531     /* get ourselves a command buffer */
1532     error = 1;
1533     if ((mc = mlx_alloccmd(sc)) == NULL)
1534 	goto out;
1535     /* get a command slot */
1536     if (mlx_getslot(mc))
1537 	goto out;
1538 
1539     /* build a flush command */
1540     mlx_make_type2(mc, MLX_CMD_FLUSH, 0, 0, 0, 0, 0, 0, 0, 0);
1541 
1542     /* can't assume that interrupts are going to work here, so play it safe */
1543     if (mlx_poll_command(mc))
1544 	goto out;
1545 
1546     /* command completed OK? */
1547     if (mc->mc_status != 0) {
1548 	device_printf(sc->mlx_dev, "FLUSH failed - %s\n", mlx_diagnose_command(mc));
1549 	goto out;
1550     }
1551 
1552     error = 0;			/* success */
1553  out:
1554     if (mc != NULL)
1555 	mlx_releasecmd(mc);
1556     return(error);
1557 }
1558 
1559 /********************************************************************************
1560  * Start a background consistency check on (drive).
1561  *
1562  * May be called with interrupts enabled or disabled; will return as soon as the
1563  * operation has started or been refused.
1564  */
1565 static int
1566 mlx_check(struct mlx_softc *sc, int drive)
1567 {
1568     struct mlx_command	*mc;
1569     int			error;
1570 
1571     debug_called(1);
1572 
1573     /* get ourselves a command buffer */
1574     error = 0x10000;
1575     if ((mc = mlx_alloccmd(sc)) == NULL)
1576 	goto out;
1577     /* get a command slot */
1578     if (mlx_getslot(mc))
1579 	goto out;
1580 
1581     /* build a checkasync command, set the "fix it" flag */
1582     mlx_make_type2(mc, MLX_CMD_CHECKASYNC, 0, 0, 0, 0, 0, drive | 0x80, 0, 0);
1583 
1584     /* start the command and wait for it to be returned */
1585     if (mlx_wait_command(mc))
1586 	goto out;
1587 
1588     /* command completed OK? */
1589     if (mc->mc_status != 0) {
1590 	device_printf(sc->mlx_dev, "CHECK ASYNC failed - %s\n", mlx_diagnose_command(mc));
1591     } else {
1592 	device_printf(sc->mlx_sysdrive[drive].ms_disk, "consistency check started");
1593     }
1594     error = mc->mc_status;
1595 
1596  out:
1597     if (mc != NULL)
1598 	mlx_releasecmd(mc);
1599     return(error);
1600 }
1601 
1602 /********************************************************************************
1603  * Start a background rebuild of the physical drive at (channel),(target).
1604  *
1605  * May be called with interrupts enabled or disabled; will return as soon as the
1606  * operation has started or been refused.
1607  */
1608 static int
1609 mlx_rebuild(struct mlx_softc *sc, int channel, int target)
1610 {
1611     struct mlx_command	*mc;
1612     int			error;
1613 
1614     debug_called(1);
1615 
1616     /* get ourselves a command buffer */
1617     error = 0x10000;
1618     if ((mc = mlx_alloccmd(sc)) == NULL)
1619 	goto out;
1620     /* get a command slot */
1621     if (mlx_getslot(mc))
1622 	goto out;
1623 
1624     /* build a checkasync command, set the "fix it" flag */
1625     mlx_make_type2(mc, MLX_CMD_REBUILDASYNC, channel, target, 0, 0, 0, 0, 0, 0);
1626 
1627     /* start the command and wait for it to be returned */
1628     if (mlx_wait_command(mc))
1629 	goto out;
1630 
1631     /* command completed OK? */
1632     if (mc->mc_status != 0) {
1633 	device_printf(sc->mlx_dev, "REBUILD ASYNC failed - %s\n", mlx_diagnose_command(mc));
1634     } else {
1635 	device_printf(sc->mlx_dev, "drive rebuild started for %d:%d\n", channel, target);
1636     }
1637     error = mc->mc_status;
1638 
1639  out:
1640     if (mc != NULL)
1641 	mlx_releasecmd(mc);
1642     return(error);
1643 }
1644 
1645 /********************************************************************************
1646  * Run the command (mc) and return when it completes.
1647  *
1648  * Interrupts need to be enabled; returns nonzero on error.
1649  */
1650 static int
1651 mlx_wait_command(struct mlx_command *mc)
1652 {
1653     struct mlx_softc	*sc = mc->mc_sc;
1654     int			error, count;
1655 
1656     debug_called(1);
1657 
1658     mc->mc_complete = NULL;
1659     mc->mc_private = mc;		/* wake us when you're done */
1660     if ((error = mlx_start(mc)) != 0)
1661 	return(error);
1662 
1663     count = 0;
1664     /* XXX better timeout? */
1665     while ((mc->mc_status == MLX_STATUS_BUSY) && (count < 30)) {
1666 	tsleep(mc->mc_private, PRIBIO | PCATCH, "mlxwcmd", hz);
1667     }
1668 
1669     if (mc->mc_status != 0) {
1670 	device_printf(sc->mlx_dev, "command failed - %s\n", mlx_diagnose_command(mc));
1671 	return(EIO);
1672     }
1673     return(0);
1674 }
1675 
1676 
1677 /********************************************************************************
1678  * Start the command (mc) and busy-wait for it to complete.
1679  *
1680  * Should only be used when interrupts can't be relied upon. Returns 0 on
1681  * success, nonzero on error.
1682  * Successfully completed commands are dequeued.
1683  */
1684 static int
1685 mlx_poll_command(struct mlx_command *mc)
1686 {
1687     struct mlx_softc	*sc = mc->mc_sc;
1688     int			error, count, s;
1689 
1690     debug_called(1);
1691 
1692     mc->mc_complete = NULL;
1693     mc->mc_private = NULL;	/* we will poll for it */
1694     if ((error = mlx_start(mc)) != 0)
1695 	return(error);
1696 
1697     count = 0;
1698     do {
1699 	/* poll for completion */
1700 	mlx_done(mc->mc_sc);
1701 
1702     } while ((mc->mc_status == MLX_STATUS_BUSY) && (count++ < 15000000));
1703     if (mc->mc_status != MLX_STATUS_BUSY) {
1704 	s = splbio();
1705 	TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
1706 	splx(s);
1707 	return(0);
1708     }
1709     device_printf(sc->mlx_dev, "command failed - %s\n", mlx_diagnose_command(mc));
1710     return(EIO);
1711 }
1712 
1713 /********************************************************************************
1714  * Pull as much work off the softc's work queue as possible and give it to the
1715  * controller.  Leave a couple of slots free for emergencies.
1716  *
1717  * Must be called at splbio or in an equivalent fashion that prevents
1718  * reentry or activity on the bioq.
1719  */
1720 static void
1721 mlx_startio(struct mlx_softc *sc)
1722 {
1723     struct mlx_command	*mc;
1724     struct mlxd_softc	*mlxd;
1725     struct bio		*bp;
1726     int			blkcount;
1727     int			driveno;
1728     int			cmd;
1729     int			s;
1730 
1731     /* avoid reentrancy */
1732     if (mlx_lock_tas(sc, MLX_LOCK_STARTING))
1733 	return;
1734 
1735     /* spin until something prevents us from doing any work */
1736     s = splbio();
1737     for (;;) {
1738 
1739 	/* see if there's work to be done */
1740 	if ((bp = bioq_first(&sc->mlx_bioq)) == NULL)
1741 	    break;
1742 	/* get a command */
1743 	if ((mc = mlx_alloccmd(sc)) == NULL)
1744 	    break;
1745 	/* get a slot for the command */
1746 	if (mlx_getslot(mc) != 0) {
1747 	    mlx_releasecmd(mc);
1748 	    break;
1749 	}
1750 	/* get the buf containing our work */
1751 	bioq_remove(&sc->mlx_bioq, bp);
1752 	sc->mlx_waitbufs--;
1753 	splx(s);
1754 
1755 	/* connect the buf to the command */
1756 	mc->mc_complete = mlx_completeio;
1757 	mc->mc_private = bp;
1758 	mc->mc_data = bp->bio_data;
1759 	mc->mc_length = bp->bio_bcount;
1760 	if (bp->bio_cmd == BIO_READ) {
1761 	    mc->mc_flags |= MLX_CMD_DATAIN;
1762 	    cmd = MLX_CMD_READSG;
1763 	} else {
1764 	    mc->mc_flags |= MLX_CMD_DATAOUT;
1765 	    cmd = MLX_CMD_WRITESG;
1766 	}
1767 
1768 	/* map the command so the controller can work with it */
1769 	mlx_mapcmd(mc);
1770 
1771 	/* build a suitable I/O command (assumes 512-byte rounded transfers) */
1772 	mlxd = (struct mlxd_softc *)bp->bio_dev->si_drv1;
1773 	driveno = mlxd->mlxd_drive - sc->mlx_sysdrive;
1774 	blkcount = (bp->bio_bcount + MLX_BLKSIZE - 1) / MLX_BLKSIZE;
1775 
1776 	if ((bp->bio_pblkno + blkcount) > sc->mlx_sysdrive[driveno].ms_size)
1777 	    device_printf(sc->mlx_dev, "I/O beyond end of unit (%u,%d > %u)\n",
1778 			  bp->bio_pblkno, blkcount, sc->mlx_sysdrive[driveno].ms_size);
1779 
1780 	/*
1781 	 * Build the I/O command.  Note that the SG list type bits are set to zero,
1782 	 * denoting the format of SG list that we are using.
1783 	 */
1784 	if (sc->mlx_iftype == MLX_IFTYPE_2) {
1785 	    mlx_make_type1(mc, (cmd == MLX_CMD_WRITESG) ? MLX_CMD_WRITESG_OLD : MLX_CMD_READSG_OLD,
1786 			   blkcount & 0xff, 				/* xfer length low byte */
1787 			   bp->bio_pblkno,				/* physical block number */
1788 			   driveno,					/* target drive number */
1789 			   mc->mc_sgphys,				/* location of SG list */
1790 			   mc->mc_nsgent & 0x3f);			/* size of SG list (top 3 bits clear) */
1791 	} else {
1792 	    mlx_make_type5(mc, cmd,
1793 			   blkcount & 0xff, 				/* xfer length low byte */
1794 			   (driveno << 3) | ((blkcount >> 8) & 0x07),	/* target and length high 3 bits */
1795 			   bp->bio_pblkno,				/* physical block number */
1796 			   mc->mc_sgphys,				/* location of SG list */
1797 			   mc->mc_nsgent & 0x3f);			/* size of SG list (top 3 bits clear) */
1798 	}
1799 
1800 	/* try to give command to controller */
1801 	if (mlx_start(mc) != 0) {
1802 	    /* fail the command */
1803 	    mc->mc_status = MLX_STATUS_WEDGED;
1804 	    mlx_completeio(mc);
1805 	}
1806 	s = splbio();
1807     }
1808     splx(s);
1809     mlx_lock_clr(sc, MLX_LOCK_STARTING);
1810 }
1811 
1812 /********************************************************************************
1813  * Handle completion of an I/O command.
1814  */
1815 static void
1816 mlx_completeio(struct mlx_command *mc)
1817 {
1818     struct mlx_softc	*sc = mc->mc_sc;
1819     struct bio		*bp = (struct bio *)mc->mc_private;
1820     struct mlxd_softc	*mlxd = (struct mlxd_softc *)bp->bio_dev->si_drv1;
1821 
1822     if (mc->mc_status != MLX_STATUS_OK) {	/* could be more verbose here? */
1823 	bp->bio_error = EIO;
1824 	bp->bio_flags |= BIO_ERROR;
1825 
1826 	switch(mc->mc_status) {
1827 	case MLX_STATUS_RDWROFFLINE:		/* system drive has gone offline */
1828 	    device_printf(mlxd->mlxd_dev, "drive offline\n");
1829 	    /* should signal this with a return code */
1830 	    mlxd->mlxd_drive->ms_state = MLX_SYSD_OFFLINE;
1831 	    break;
1832 
1833 	default:				/* other I/O error */
1834 	    device_printf(sc->mlx_dev, "I/O error - %s\n", mlx_diagnose_command(mc));
1835 #if 0
1836 	    device_printf(sc->mlx_dev, "  b_bcount %ld  blkcount %ld  b_pblkno %d\n",
1837 			  bp->bio_bcount, bp->bio_bcount / MLX_BLKSIZE, bp->bio_pblkno);
1838 	    device_printf(sc->mlx_dev, "  %13D\n", mc->mc_mailbox, " ");
1839 #endif
1840 	    break;
1841 	}
1842     }
1843     mlx_releasecmd(mc);
1844     mlxd_intr(bp);
1845 }
1846 
1847 /********************************************************************************
1848  * Take a command from user-space and try to run it.
1849  *
1850  * XXX Note that this can't perform very much in the way of error checking, and
1851  *     as such, applications _must_ be considered trustworthy.
1852  * XXX Commands using S/G for data are not supported.
1853  */
1854 static int
1855 mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu)
1856 {
1857     struct mlx_command	*mc;
1858     struct mlx_dcdb	*dcdb;
1859     void		*kbuf;
1860     int			error;
1861 
1862     debug_called(0);
1863 
1864     kbuf = NULL;
1865     mc = NULL;
1866     dcdb = NULL;
1867     error = ENOMEM;
1868 
1869     /* get ourselves a command and copy in from user space */
1870     if ((mc = mlx_alloccmd(sc)) == NULL)
1871 	goto out;
1872     bcopy(mu->mu_command, mc->mc_mailbox, sizeof(mc->mc_mailbox));
1873     debug(0, "got command buffer");
1874 
1875     /* if we need a buffer for data transfer, allocate one and copy in its initial contents */
1876     if (mu->mu_datasize > 0) {
1877 	if (((kbuf = malloc(mu->mu_datasize, M_DEVBUF, M_WAITOK)) == NULL) ||
1878 	    (error = copyin(mu->mu_buf, kbuf, mu->mu_datasize)))
1879 	    goto out;
1880 	debug(0, "got kernel buffer");
1881     }
1882 
1883     /* get a command slot */
1884     if (mlx_getslot(mc))
1885 	goto out;
1886     debug(0, "got a slot");
1887 
1888     /* map the command so the controller can see it */
1889     mc->mc_data = kbuf;
1890     mc->mc_length = mu->mu_datasize;
1891     mlx_mapcmd(mc);
1892     debug(0, "mapped");
1893 
1894     /*
1895      * If this is a passthrough SCSI command, the DCDB is packed at the
1896      * beginning of the data area.  Fix up the DCDB to point to the correct physical
1897      * address and override any bufptr supplied by the caller since we know
1898      * what it's meant to be.
1899      */
1900     if (mc->mc_mailbox[0] == MLX_CMD_DIRECT_CDB) {
1901 	dcdb = (struct mlx_dcdb *)kbuf;
1902 	dcdb->dcdb_physaddr = mc->mc_dataphys + sizeof(*dcdb);
1903 	mu->mu_bufptr = 8;
1904     }
1905 
1906     /*
1907      * If there's a data buffer, fix up the command's buffer pointer.
1908      */
1909     if (mu->mu_datasize > 0) {
1910 
1911 	/* range check the pointer to physical buffer address */
1912 	if ((mu->mu_bufptr < 0) || (mu->mu_bufptr > (sizeof(mu->mu_command) - sizeof(u_int32_t)))) {
1913 	    error = EINVAL;
1914 	    goto out;
1915 	}
1916 	mc->mc_mailbox[mu->mu_bufptr    ] =  mc->mc_dataphys        & 0xff;
1917 	mc->mc_mailbox[mu->mu_bufptr + 1] = (mc->mc_dataphys >> 8)  & 0xff;
1918 	mc->mc_mailbox[mu->mu_bufptr + 2] = (mc->mc_dataphys >> 16) & 0xff;
1919 	mc->mc_mailbox[mu->mu_bufptr + 3] = (mc->mc_dataphys >> 24) & 0xff;
1920     }
1921     debug(0, "command fixup");
1922 
1923     /* submit the command and wait */
1924     if ((error = mlx_wait_command(mc)) != 0)
1925 	goto out;
1926 
1927     /* copy out status and data */
1928     mu->mu_status = mc->mc_status;
1929     if ((mu->mu_datasize > 0) && ((error = copyout(kbuf, mu->mu_buf, mu->mu_datasize))))
1930 	goto out;
1931     error = 0;
1932 
1933  out:
1934     mlx_releasecmd(mc);
1935     if (kbuf != NULL)
1936 	free(kbuf, M_DEVBUF);
1937     return(error);
1938 }
1939 
1940 /********************************************************************************
1941  ********************************************************************************
1942                                                         Command I/O to Controller
1943  ********************************************************************************
1944  ********************************************************************************/
1945 
1946 /********************************************************************************
1947  * Find a free command slot for (mc).
1948  *
1949  * Don't hand out a slot to a normal-priority command unless there are at least
1950  * 4 slots free for priority commands.
1951  */
1952 static int
1953 mlx_getslot(struct mlx_command *mc)
1954 {
1955     struct mlx_softc	*sc = mc->mc_sc;
1956     int			s, slot;
1957 
1958     debug_called(1);
1959 
1960     /* enforce slot-usage limit */
1961     if (sc->mlx_busycmds >= ((mc->mc_flags & MLX_CMD_PRIORITY) ?
1962 			     sc->mlx_maxiop : sc->mlx_maxiop - 4))
1963 	return(EBUSY);
1964 
1965     /*
1966      * Allocate an outstanding command slot
1967      *
1968      * XXX linear search is slow
1969      */
1970     s = splbio();
1971     for (slot = 0; slot < sc->mlx_maxiop; slot++) {
1972 	debug(2, "try slot %d", slot);
1973 	if (sc->mlx_busycmd[slot] == NULL)
1974 	    break;
1975     }
1976     if (slot < sc->mlx_maxiop) {
1977 	sc->mlx_busycmd[slot] = mc;
1978 	sc->mlx_busycmds++;
1979     }
1980     splx(s);
1981 
1982     /* out of slots? */
1983     if (slot >= sc->mlx_maxiop)
1984 	return(EBUSY);
1985 
1986     debug(2, "got slot %d", slot);
1987     mc->mc_slot = slot;
1988     return(0);
1989 }
1990 
1991 /********************************************************************************
1992  * Map/unmap (mc)'s data in the controller's addressable space.
1993  */
1994 static void
1995 mlx_setup_dmamap(void *arg, bus_dma_segment_t *segs, int nsegments, int error)
1996 {
1997     struct mlx_command	*mc = (struct mlx_command *)arg;
1998     struct mlx_softc	*sc = mc->mc_sc;
1999     struct mlx_sgentry	*sg;
2000     int			i;
2001 
2002     debug_called(1);
2003 
2004     /* get base address of s/g table */
2005     sg = sc->mlx_sgtable + (mc->mc_slot * sc->mlx_sg_nseg);
2006 
2007     /* save s/g table information in command */
2008     mc->mc_nsgent = nsegments;
2009     mc->mc_sgphys = sc->mlx_sgbusaddr + (mc->mc_slot * sc->mlx_sg_nseg * sizeof(struct mlx_sgentry));
2010     mc->mc_dataphys = segs[0].ds_addr;
2011 
2012     /* populate s/g table */
2013     for (i = 0; i < nsegments; i++, sg++) {
2014 	sg->sg_addr = segs[i].ds_addr;
2015 	sg->sg_count = segs[i].ds_len;
2016     }
2017 }
2018 
2019 static void
2020 mlx_mapcmd(struct mlx_command *mc)
2021 {
2022     struct mlx_softc	*sc = mc->mc_sc;
2023 
2024     debug_called(1);
2025 
2026     /* if the command involves data at all */
2027     if (mc->mc_data != NULL) {
2028 
2029 	/* map the data buffer into bus space and build the s/g list */
2030 	bus_dmamap_load(sc->mlx_buffer_dmat, mc->mc_dmamap, mc->mc_data, mc->mc_length,
2031 			mlx_setup_dmamap, mc, 0);
2032 	if (mc->mc_flags & MLX_CMD_DATAIN)
2033 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_PREREAD);
2034 	if (mc->mc_flags & MLX_CMD_DATAOUT)
2035 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_PREWRITE);
2036     }
2037 }
2038 
2039 static void
2040 mlx_unmapcmd(struct mlx_command *mc)
2041 {
2042     struct mlx_softc	*sc = mc->mc_sc;
2043 
2044     debug_called(1);
2045 
2046     /* if the command involved data at all */
2047     if (mc->mc_data != NULL) {
2048 
2049 	if (mc->mc_flags & MLX_CMD_DATAIN)
2050 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_POSTREAD);
2051 	if (mc->mc_flags & MLX_CMD_DATAOUT)
2052 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_POSTWRITE);
2053 
2054 	bus_dmamap_unload(sc->mlx_buffer_dmat, mc->mc_dmamap);
2055     }
2056 }
2057 
2058 /********************************************************************************
2059  * Try to deliver (mc) to the controller.
2060  *
2061  * Can be called at any interrupt level, with or without interrupts enabled.
2062  */
2063 static int
2064 mlx_start(struct mlx_command *mc)
2065 {
2066     struct mlx_softc	*sc = mc->mc_sc;
2067     int			i, s, done;
2068 
2069     debug_called(1);
2070 
2071     /* save the slot number as ident so we can handle this command when complete */
2072     mc->mc_mailbox[0x1] = mc->mc_slot;
2073 
2074     /* mark the command as currently being processed */
2075     mc->mc_status = MLX_STATUS_BUSY;
2076 
2077     /* set a default 60-second timeout  XXX tunable?  XXX not currently used */
2078     mc->mc_timeout = time_second + 60;
2079 
2080     /* spin waiting for the mailbox */
2081     for (i = 100000, done = 0; (i > 0) && !done; i--) {
2082 	s = splbio();
2083 	if (sc->mlx_tryqueue(sc, mc)) {
2084 	    done = 1;
2085 	    /* move command to work queue */
2086 	    TAILQ_INSERT_TAIL(&sc->mlx_work, mc, mc_link);
2087 	}
2088 	splx(s);	/* drop spl to allow completion interrupts */
2089     }
2090 
2091     /* command is enqueued */
2092     if (done)
2093 	return(0);
2094 
2095     /*
2096      * We couldn't get the controller to take the command.  Revoke the slot
2097      * that the command was given and return it with a bad status.
2098      */
2099     sc->mlx_busycmd[mc->mc_slot] = NULL;
2100     device_printf(sc->mlx_dev, "controller wedged (not taking commands)\n");
2101     mc->mc_status = MLX_STATUS_WEDGED;
2102     mlx_complete(sc);
2103     return(EIO);
2104 }
2105 
2106 /********************************************************************************
2107  * Poll the controller (sc) for completed commands.
2108  * Update command status and free slots for reuse.  If any slots were freed,
2109  * new commands may be posted.
2110  *
2111  * Returns nonzero if one or more commands were completed.
2112  */
2113 static int
2114 mlx_done(struct mlx_softc *sc)
2115 {
2116     struct mlx_command	*mc;
2117     int			s, result;
2118     u_int8_t		slot;
2119     u_int16_t		status;
2120 
2121     debug_called(2);
2122 
2123     result = 0;
2124 
2125     /* loop collecting completed commands */
2126     s = splbio();
2127     for (;;) {
2128 	/* poll for a completed command's identifier and status */
2129 	if (sc->mlx_findcomplete(sc, &slot, &status)) {
2130 	    result = 1;
2131 	    mc = sc->mlx_busycmd[slot];			/* find command */
2132 	    if (mc != NULL) {				/* paranoia */
2133 		if (mc->mc_status == MLX_STATUS_BUSY) {
2134 		    mc->mc_status = status;		/* save status */
2135 
2136 		    /* free slot for reuse */
2137 		    sc->mlx_busycmd[slot] = NULL;
2138 		    sc->mlx_busycmds--;
2139 		} else {
2140 		    device_printf(sc->mlx_dev, "duplicate done event for slot %d\n", slot);
2141 		}
2142 	    } else {
2143 		device_printf(sc->mlx_dev, "done event for nonbusy slot %d\n", slot);
2144 	    }
2145 	} else {
2146 	    break;
2147 	}
2148     }
2149 
2150     /* if we've completed any commands, try posting some more */
2151     if (result)
2152 	mlx_startio(sc);
2153 
2154     /* handle completion and timeouts */
2155     mlx_complete(sc);
2156 
2157     return(result);
2158 }
2159 
2160 /********************************************************************************
2161  * Perform post-completion processing for commands on (sc).
2162  */
2163 static void
2164 mlx_complete(struct mlx_softc *sc)
2165 {
2166     struct mlx_command	*mc, *nc;
2167     int			s, count;
2168 
2169     debug_called(2);
2170 
2171     /* avoid reentrancy  XXX might want to signal and request a restart */
2172     if (mlx_lock_tas(sc, MLX_LOCK_COMPLETING))
2173 	return;
2174 
2175     s = splbio();
2176     count = 0;
2177 
2178     /* scan the list of busy/done commands */
2179     mc = TAILQ_FIRST(&sc->mlx_work);
2180     while (mc != NULL) {
2181 	nc = TAILQ_NEXT(mc, mc_link);
2182 
2183 	/* Command has been completed in some fashion */
2184 	if (mc->mc_status != MLX_STATUS_BUSY) {
2185 
2186 	    /* unmap the command's data buffer */
2187 	    mlx_unmapcmd(mc);
2188 	    /*
2189 	     * Does the command have a completion handler?
2190 	     */
2191 	    if (mc->mc_complete != NULL) {
2192 		/* remove from list and give to handler */
2193 		TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
2194 		mc->mc_complete(mc);
2195 
2196 		/*
2197 		 * Is there a sleeper waiting on this command?
2198 		 */
2199 	    } else if (mc->mc_private != NULL) {	/* sleeping caller wants to know about it */
2200 
2201 		/* remove from list and wake up sleeper */
2202 		TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
2203 		wakeup_one(mc->mc_private);
2204 
2205 		/*
2206 		 * Leave the command for a caller that's polling for it.
2207 		 */
2208 	    } else {
2209 	    }
2210 	}
2211 	mc = nc;
2212     }
2213     splx(s);
2214 
2215     mlx_lock_clr(sc, MLX_LOCK_COMPLETING);
2216 }
2217 
2218 /********************************************************************************
2219  ********************************************************************************
2220                                                         Command Buffer Management
2221  ********************************************************************************
2222  ********************************************************************************/
2223 
2224 /********************************************************************************
2225  * Get a new command buffer.
2226  *
2227  * This may return NULL in low-memory cases.
2228  *
2229  * Note that using malloc() is expensive (the command buffer is << 1 page) but
2230  * necessary if we are to be a loadable module before the zone allocator is fixed.
2231  *
2232  * If possible, we recycle a command buffer that's been used before.
2233  *
2234  * XXX Note that command buffers are not cleaned out - it is the caller's
2235  *     responsibility to ensure that all required fields are filled in before
2236  *     using a buffer.
2237  */
2238 static struct mlx_command *
2239 mlx_alloccmd(struct mlx_softc *sc)
2240 {
2241     struct mlx_command	*mc;
2242     int			error;
2243     int			s;
2244 
2245     debug_called(1);
2246 
2247     s = splbio();
2248     if ((mc = TAILQ_FIRST(&sc->mlx_freecmds)) != NULL)
2249 	TAILQ_REMOVE(&sc->mlx_freecmds, mc, mc_link);
2250     splx(s);
2251 
2252     /* allocate a new command buffer? */
2253     if (mc == NULL) {
2254 	mc = (struct mlx_command *)malloc(sizeof(*mc), M_DEVBUF, M_NOWAIT);
2255 	if (mc != NULL) {
2256 	    bzero(mc, sizeof(*mc));
2257 	    mc->mc_sc = sc;
2258 	    error = bus_dmamap_create(sc->mlx_buffer_dmat, 0, &mc->mc_dmamap);
2259 	    if (error) {
2260 		free(mc, M_DEVBUF);
2261 		return(NULL);
2262 	    }
2263 	}
2264     }
2265     return(mc);
2266 }
2267 
2268 /********************************************************************************
2269  * Release a command buffer for recycling.
2270  *
2271  * XXX It might be a good idea to limit the number of commands we save for reuse
2272  *     if it's shown that this list bloats out massively.
2273  */
2274 static void
2275 mlx_releasecmd(struct mlx_command *mc)
2276 {
2277     int		s;
2278 
2279     debug_called(1);
2280 
2281     s = splbio();
2282     TAILQ_INSERT_HEAD(&mc->mc_sc->mlx_freecmds, mc, mc_link);
2283     splx(s);
2284 }
2285 
2286 /********************************************************************************
2287  * Permanently discard a command buffer.
2288  */
2289 static void
2290 mlx_freecmd(struct mlx_command *mc)
2291 {
2292     struct mlx_softc	*sc = mc->mc_sc;
2293 
2294     debug_called(1);
2295     bus_dmamap_destroy(sc->mlx_buffer_dmat, mc->mc_dmamap);
2296     free(mc, M_DEVBUF);
2297 }
2298 
2299 
2300 /********************************************************************************
2301  ********************************************************************************
2302                                                 Type 3 interface accessor methods
2303  ********************************************************************************
2304  ********************************************************************************/
2305 
2306 /********************************************************************************
2307  * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2308  * (the controller is not ready to take a command).
2309  *
2310  * Must be called at splbio or in a fashion that prevents reentry.
2311  */
2312 static int
2313 mlx_v3_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2314 {
2315     int		i;
2316 
2317     debug_called(2);
2318 
2319     /* ready for our command? */
2320     if (!(MLX_V3_GET_IDBR(sc) & MLX_V3_IDB_FULL)) {
2321 	/* copy mailbox data to window */
2322 	for (i = 0; i < 13; i++)
2323 	    MLX_V3_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2324 
2325 	/* post command */
2326 	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_FULL);
2327 	return(1);
2328     }
2329     return(0);
2330 }
2331 
2332 /********************************************************************************
2333  * See if a command has been completed, if so acknowledge its completion
2334  * and recover the slot number and status code.
2335  *
2336  * Must be called at splbio or in a fashion that prevents reentry.
2337  */
2338 static int
2339 mlx_v3_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2340 {
2341 
2342     debug_called(2);
2343 
2344     /* status available? */
2345     if (MLX_V3_GET_ODBR(sc) & MLX_V3_ODB_SAVAIL) {
2346 	*slot = MLX_V3_GET_STATUS_IDENT(sc);		/* get command identifier */
2347 	*status = MLX_V3_GET_STATUS(sc);		/* get status */
2348 
2349 	/* acknowledge completion */
2350 	MLX_V3_PUT_ODBR(sc, MLX_V3_ODB_SAVAIL);
2351 	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_SACK);
2352 	return(1);
2353     }
2354     return(0);
2355 }
2356 
2357 /********************************************************************************
2358  * Enable/disable interrupts as requested. (No acknowledge required)
2359  *
2360  * Must be called at splbio or in a fashion that prevents reentry.
2361  */
2362 static void
2363 mlx_v3_intaction(struct mlx_softc *sc, int action)
2364 {
2365     debug_called(1);
2366 
2367     switch(action) {
2368     case MLX_INTACTION_DISABLE:
2369 	MLX_V3_PUT_IER(sc, 0);
2370 	sc->mlx_state &= ~MLX_STATE_INTEN;
2371 	break;
2372     case MLX_INTACTION_ENABLE:
2373 	MLX_V3_PUT_IER(sc, 1);
2374 	sc->mlx_state |= MLX_STATE_INTEN;
2375 	break;
2376     }
2377 }
2378 
2379 /********************************************************************************
2380  * Poll for firmware error codes during controller initialisation.
2381  * Returns 0 if initialisation is complete, 1 if still in progress but no
2382  * error has been fetched, 2 if an error has been retrieved.
2383  */
2384 static int
2385 mlx_v3_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2)
2386 {
2387     u_int8_t	fwerror;
2388     static int	initted = 0;
2389 
2390     debug_called(2);
2391 
2392     /* first time around, clear any hardware completion status */
2393     if (!initted) {
2394 	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_SACK);
2395 	DELAY(1000);
2396 	initted = 1;
2397     }
2398 
2399     /* init in progress? */
2400     if (!(MLX_V3_GET_IDBR(sc) & MLX_V3_IDB_INIT_BUSY))
2401 	return(0);
2402 
2403     /* test error value */
2404     fwerror = MLX_V3_GET_FWERROR(sc);
2405     if (!(fwerror & MLX_V3_FWERROR_PEND))
2406 	return(1);
2407 
2408     /* mask status pending bit, fetch status */
2409     *error = fwerror & ~MLX_V3_FWERROR_PEND;
2410     *param1 = MLX_V3_GET_FWERROR_PARAM1(sc);
2411     *param2 = MLX_V3_GET_FWERROR_PARAM2(sc);
2412 
2413     /* acknowledge */
2414     MLX_V3_PUT_FWERROR(sc, 0);
2415 
2416     return(2);
2417 }
2418 
2419 /********************************************************************************
2420  ********************************************************************************
2421                                                 Type 4 interface accessor methods
2422  ********************************************************************************
2423  ********************************************************************************/
2424 
2425 /********************************************************************************
2426  * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2427  * (the controller is not ready to take a command).
2428  *
2429  * Must be called at splbio or in a fashion that prevents reentry.
2430  */
2431 static int
2432 mlx_v4_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2433 {
2434     int		i;
2435 
2436     debug_called(2);
2437 
2438     /* ready for our command? */
2439     if (!(MLX_V4_GET_IDBR(sc) & MLX_V4_IDB_FULL)) {
2440 	/* copy mailbox data to window */
2441 	for (i = 0; i < 13; i++)
2442 	    MLX_V4_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2443 
2444 	/* memory-mapped controller, so issue a write barrier to ensure the mailbox is filled */
2445 	bus_space_barrier(sc->mlx_btag, sc->mlx_bhandle, MLX_V4_MAILBOX, MLX_V4_MAILBOX_LENGTH,
2446 			  BUS_SPACE_BARRIER_WRITE);
2447 
2448 	/* post command */
2449 	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_HWMBOX_CMD);
2450 	return(1);
2451     }
2452     return(0);
2453 }
2454 
2455 /********************************************************************************
2456  * See if a command has been completed, if so acknowledge its completion
2457  * and recover the slot number and status code.
2458  *
2459  * Must be called at splbio or in a fashion that prevents reentry.
2460  */
2461 static int
2462 mlx_v4_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2463 {
2464 
2465     debug_called(2);
2466 
2467     /* status available? */
2468     if (MLX_V4_GET_ODBR(sc) & MLX_V4_ODB_HWSAVAIL) {
2469 	*slot = MLX_V4_GET_STATUS_IDENT(sc);		/* get command identifier */
2470 	*status = MLX_V4_GET_STATUS(sc);		/* get status */
2471 
2472 	/* acknowledge completion */
2473 	MLX_V4_PUT_ODBR(sc, MLX_V4_ODB_HWMBOX_ACK);
2474 	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_SACK);
2475 	return(1);
2476     }
2477     return(0);
2478 }
2479 
2480 /********************************************************************************
2481  * Enable/disable interrupts as requested.
2482  *
2483  * Must be called at splbio or in a fashion that prevents reentry.
2484  */
2485 static void
2486 mlx_v4_intaction(struct mlx_softc *sc, int action)
2487 {
2488     debug_called(1);
2489 
2490     switch(action) {
2491     case MLX_INTACTION_DISABLE:
2492 	MLX_V4_PUT_IER(sc, MLX_V4_IER_MASK | MLX_V4_IER_DISINT);
2493 	sc->mlx_state &= ~MLX_STATE_INTEN;
2494 	break;
2495     case MLX_INTACTION_ENABLE:
2496 	MLX_V4_PUT_IER(sc, MLX_V4_IER_MASK & ~MLX_V4_IER_DISINT);
2497 	sc->mlx_state |= MLX_STATE_INTEN;
2498 	break;
2499     }
2500 }
2501 
2502 /********************************************************************************
2503  * Poll for firmware error codes during controller initialisation.
2504  * Returns 0 if initialisation is complete, 1 if still in progress but no
2505  * error has been fetched, 2 if an error has been retrieved.
2506  */
2507 static int
2508 mlx_v4_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2)
2509 {
2510     u_int8_t	fwerror;
2511     static int	initted = 0;
2512 
2513     debug_called(2);
2514 
2515     /* first time around, clear any hardware completion status */
2516     if (!initted) {
2517 	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_SACK);
2518 	DELAY(1000);
2519 	initted = 1;
2520     }
2521 
2522     /* init in progress? */
2523     if (!(MLX_V4_GET_IDBR(sc) & MLX_V4_IDB_INIT_BUSY))
2524 	return(0);
2525 
2526     /* test error value */
2527     fwerror = MLX_V4_GET_FWERROR(sc);
2528     if (!(fwerror & MLX_V4_FWERROR_PEND))
2529 	return(1);
2530 
2531     /* mask status pending bit, fetch status */
2532     *error = fwerror & ~MLX_V4_FWERROR_PEND;
2533     *param1 = MLX_V4_GET_FWERROR_PARAM1(sc);
2534     *param2 = MLX_V4_GET_FWERROR_PARAM2(sc);
2535 
2536     /* acknowledge */
2537     MLX_V4_PUT_FWERROR(sc, 0);
2538 
2539     return(2);
2540 }
2541 
2542 /********************************************************************************
2543  ********************************************************************************
2544                                                 Type 5 interface accessor methods
2545  ********************************************************************************
2546  ********************************************************************************/
2547 
2548 /********************************************************************************
2549  * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2550  * (the controller is not ready to take a command).
2551  *
2552  * Must be called at splbio or in a fashion that prevents reentry.
2553  */
2554 static int
2555 mlx_v5_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2556 {
2557     int		i;
2558 
2559     debug_called(2);
2560 
2561     /* ready for our command? */
2562     if (MLX_V5_GET_IDBR(sc) & MLX_V5_IDB_EMPTY) {
2563 	/* copy mailbox data to window */
2564 	for (i = 0; i < 13; i++)
2565 	    MLX_V5_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2566 
2567 	/* post command */
2568 	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_HWMBOX_CMD);
2569 	return(1);
2570     }
2571     return(0);
2572 }
2573 
2574 /********************************************************************************
2575  * See if a command has been completed, if so acknowledge its completion
2576  * and recover the slot number and status code.
2577  *
2578  * Must be called at splbio or in a fashion that prevents reentry.
2579  */
2580 static int
2581 mlx_v5_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2582 {
2583 
2584     debug_called(2);
2585 
2586     /* status available? */
2587     if (MLX_V5_GET_ODBR(sc) & MLX_V5_ODB_HWSAVAIL) {
2588 	*slot = MLX_V5_GET_STATUS_IDENT(sc);		/* get command identifier */
2589 	*status = MLX_V5_GET_STATUS(sc);		/* get status */
2590 
2591 	/* acknowledge completion */
2592 	MLX_V5_PUT_ODBR(sc, MLX_V5_ODB_HWMBOX_ACK);
2593 	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_SACK);
2594 	return(1);
2595     }
2596     return(0);
2597 }
2598 
2599 /********************************************************************************
2600  * Enable/disable interrupts as requested.
2601  *
2602  * Must be called at splbio or in a fashion that prevents reentry.
2603  */
2604 static void
2605 mlx_v5_intaction(struct mlx_softc *sc, int action)
2606 {
2607     debug_called(1);
2608 
2609     switch(action) {
2610     case MLX_INTACTION_DISABLE:
2611 	MLX_V5_PUT_IER(sc, 0xff & MLX_V5_IER_DISINT);
2612 	sc->mlx_state &= ~MLX_STATE_INTEN;
2613 	break;
2614     case MLX_INTACTION_ENABLE:
2615 	MLX_V5_PUT_IER(sc, 0xff & ~MLX_V5_IER_DISINT);
2616 	sc->mlx_state |= MLX_STATE_INTEN;
2617 	break;
2618     }
2619 }
2620 
2621 /********************************************************************************
2622  * Poll for firmware error codes during controller initialisation.
2623  * Returns 0 if initialisation is complete, 1 if still in progress but no
2624  * error has been fetched, 2 if an error has been retrieved.
2625  */
2626 static int
2627 mlx_v5_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2)
2628 {
2629     u_int8_t	fwerror;
2630     static int	initted = 0;
2631 
2632     debug_called(2);
2633 
2634     /* first time around, clear any hardware completion status */
2635     if (!initted) {
2636 	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_SACK);
2637 	DELAY(1000);
2638 	initted = 1;
2639     }
2640 
2641     /* init in progress? */
2642     if (MLX_V5_GET_IDBR(sc) & MLX_V5_IDB_INIT_DONE)
2643 	return(0);
2644 
2645     /* test for error value */
2646     fwerror = MLX_V5_GET_FWERROR(sc);
2647     if (!(fwerror & MLX_V5_FWERROR_PEND))
2648 	return(1);
2649 
2650     /* mask status pending bit, fetch status */
2651     *error = fwerror & ~MLX_V5_FWERROR_PEND;
2652     *param1 = MLX_V5_GET_FWERROR_PARAM1(sc);
2653     *param2 = MLX_V5_GET_FWERROR_PARAM2(sc);
2654 
2655     /* acknowledge */
2656     MLX_V5_PUT_FWERROR(sc, 0xff);
2657 
2658     return(2);
2659 }
2660 
2661 /********************************************************************************
2662  ********************************************************************************
2663                                                                         Debugging
2664  ********************************************************************************
2665  ********************************************************************************/
2666 
2667 /********************************************************************************
2668  * Return a status message describing (mc)
2669  */
2670 static char *mlx_status_messages[] = {
2671     "normal completion",			/* 00 */
2672     "irrecoverable data error",			/* 01 */
2673     "drive does not exist, or is offline",	/* 02 */
2674     "attempt to write beyond end of drive",	/* 03 */
2675     "bad data encountered",			/* 04 */
2676     "invalid log entry request",		/* 05 */
2677     "attempt to rebuild online drive",		/* 06 */
2678     "new disk failed during rebuild",		/* 07 */
2679     "invalid channel/target",			/* 08 */
2680     "rebuild/check already in progress",	/* 09 */
2681     "one or more disks are dead",		/* 10 */
2682     "invalid or non-redundant drive",		/* 11 */
2683     "channel is busy",				/* 12 */
2684     "channel is not stopped",			/* 13 */
2685     "rebuild successfully terminated",		/* 14 */
2686     "unsupported command",			/* 15 */
2687     "check condition received",			/* 16 */
2688     "device is busy",				/* 17 */
2689     "selection or command timeout",		/* 18 */
2690     "command terminated abnormally",		/* 19 */
2691     ""
2692 };
2693 
2694 static struct
2695 {
2696     int		command;
2697     u_int16_t	status;
2698     int		msg;
2699 } mlx_messages[] = {
2700     {MLX_CMD_READSG,		0x0001,	 1},
2701     {MLX_CMD_READSG,		0x0002,	 1},
2702     {MLX_CMD_READSG,		0x0105,	 3},
2703     {MLX_CMD_READSG,		0x010c,	 4},
2704     {MLX_CMD_WRITESG,		0x0001,	 1},
2705     {MLX_CMD_WRITESG,		0x0002,	 1},
2706     {MLX_CMD_WRITESG,		0x0105,	 3},
2707     {MLX_CMD_READSG_OLD,	0x0001,	 1},
2708     {MLX_CMD_READSG_OLD,	0x0002,	 1},
2709     {MLX_CMD_READSG_OLD,	0x0105,	 3},
2710     {MLX_CMD_WRITESG_OLD,	0x0001,	 1},
2711     {MLX_CMD_WRITESG_OLD,	0x0002,	 1},
2712     {MLX_CMD_WRITESG_OLD,	0x0105,	 3},
2713     {MLX_CMD_LOGOP,		0x0105,	 5},
2714     {MLX_CMD_REBUILDASYNC,	0x0002,  6},
2715     {MLX_CMD_REBUILDASYNC,	0x0004,  7},
2716     {MLX_CMD_REBUILDASYNC,	0x0105,  8},
2717     {MLX_CMD_REBUILDASYNC,	0x0106,  9},
2718     {MLX_CMD_REBUILDASYNC,	0x0107, 14},
2719     {MLX_CMD_CHECKASYNC,	0x0002, 10},
2720     {MLX_CMD_CHECKASYNC,	0x0105, 11},
2721     {MLX_CMD_CHECKASYNC,	0x0106,  9},
2722     {MLX_CMD_STOPCHANNEL,	0x0106, 12},
2723     {MLX_CMD_STOPCHANNEL,	0x0105,  8},
2724     {MLX_CMD_STARTCHANNEL,	0x0005, 13},
2725     {MLX_CMD_STARTCHANNEL,	0x0105,  8},
2726     {MLX_CMD_DIRECT_CDB,	0x0002, 16},
2727     {MLX_CMD_DIRECT_CDB,	0x0008, 17},
2728     {MLX_CMD_DIRECT_CDB,	0x000e, 18},
2729     {MLX_CMD_DIRECT_CDB,	0x000f, 19},
2730     {MLX_CMD_DIRECT_CDB,	0x0105,  8},
2731 
2732     {0,				0x0104, 14},
2733     {-1, 0, 0}
2734 };
2735 
2736 static char *
2737 mlx_diagnose_command(struct mlx_command *mc)
2738 {
2739     static char	unkmsg[80];
2740     int		i;
2741 
2742     /* look up message in table */
2743     for (i = 0; mlx_messages[i].command != -1; i++)
2744 	if (((mc->mc_mailbox[0] == mlx_messages[i].command) || (mlx_messages[i].command == 0)) &&
2745 	    (mc->mc_status == mlx_messages[i].status))
2746 	    return(mlx_status_messages[mlx_messages[i].msg]);
2747 
2748     sprintf(unkmsg, "unknown response 0x%x for command 0x%x", (int)mc->mc_status, (int)mc->mc_mailbox[0]);
2749     return(unkmsg);
2750 }
2751 
2752 /*******************************************************************************
2753  * Print a string describing the controller (sc)
2754  */
2755 static struct
2756 {
2757     int		hwid;
2758     char	*name;
2759 } mlx_controller_names[] = {
2760     {0x01,	"960P/PD"},
2761     {0x02,	"960PL"},
2762     {0x10,	"960PG"},
2763     {0x11,	"960PJ"},
2764     {0x12,	"960PR"},
2765     {0x13,	"960PT"},
2766     {0x14,	"960PTL0"},
2767     {0x15,	"960PRL"},
2768     {0x16,	"960PTL1"},
2769     {0x20,	"1164PVX"},
2770     {-1, NULL}
2771 };
2772 
2773 static void
2774 mlx_describe_controller(struct mlx_softc *sc)
2775 {
2776     static char		buf[80];
2777     char		*model;
2778     int			i;
2779 
2780     for (i = 0, model = NULL; mlx_controller_names[i].name != NULL; i++) {
2781 	if ((sc->mlx_enq2->me_hardware_id & 0xff) == mlx_controller_names[i].hwid) {
2782 	    model = mlx_controller_names[i].name;
2783 	    break;
2784 	}
2785     }
2786     if (model == NULL) {
2787 	sprintf(buf, " model 0x%x", sc->mlx_enq2->me_hardware_id & 0xff);
2788 	model = buf;
2789     }
2790     device_printf(sc->mlx_dev, "DAC%s, %d channel%s, firmware %d.%02d-%c-%02d, %dMB RAM\n",
2791 		  model,
2792 		  sc->mlx_enq2->me_actual_channels,
2793 		  sc->mlx_enq2->me_actual_channels > 1 ? "s" : "",
2794 		  sc->mlx_enq2->me_firmware_id & 0xff,
2795 		  (sc->mlx_enq2->me_firmware_id >> 8) & 0xff,
2796 		  (sc->mlx_enq2->me_firmware_id >> 24) & 0xff,
2797 		  (sc->mlx_enq2->me_firmware_id >> 16) & 0xff,
2798 		  sc->mlx_enq2->me_mem_size / (1024 * 1024));
2799 
2800     if (bootverbose) {
2801 	device_printf(sc->mlx_dev, "  Hardware ID                 0x%08x\n", sc->mlx_enq2->me_hardware_id);
2802 	device_printf(sc->mlx_dev, "  Firmware ID                 0x%08x\n", sc->mlx_enq2->me_firmware_id);
2803 	device_printf(sc->mlx_dev, "  Configured/Actual channels  %d/%d\n", sc->mlx_enq2->me_configured_channels,
2804 		      sc->mlx_enq2->me_actual_channels);
2805 	device_printf(sc->mlx_dev, "  Max Targets                 %d\n", sc->mlx_enq2->me_max_targets);
2806 	device_printf(sc->mlx_dev, "  Max Tags                    %d\n", sc->mlx_enq2->me_max_tags);
2807 	device_printf(sc->mlx_dev, "  Max System Drives           %d\n", sc->mlx_enq2->me_max_sys_drives);
2808 	device_printf(sc->mlx_dev, "  Max Arms                    %d\n", sc->mlx_enq2->me_max_arms);
2809 	device_printf(sc->mlx_dev, "  Max Spans                   %d\n", sc->mlx_enq2->me_max_spans);
2810 	device_printf(sc->mlx_dev, "  DRAM/cache/flash/NVRAM size %d/%d/%d/%d\n", sc->mlx_enq2->me_mem_size,
2811 		      sc->mlx_enq2->me_cache_size, sc->mlx_enq2->me_flash_size, sc->mlx_enq2->me_nvram_size);
2812 	device_printf(sc->mlx_dev, "  DRAM type                   %d\n", sc->mlx_enq2->me_mem_type);
2813 	device_printf(sc->mlx_dev, "  Clock Speed                 %dns\n", sc->mlx_enq2->me_clock_speed);
2814 	device_printf(sc->mlx_dev, "  Hardware Speed              %dns\n", sc->mlx_enq2->me_hardware_speed);
2815 	device_printf(sc->mlx_dev, "  Max Commands                %d\n", sc->mlx_enq2->me_max_commands);
2816 	device_printf(sc->mlx_dev, "  Max SG Entries              %d\n", sc->mlx_enq2->me_max_sg);
2817 	device_printf(sc->mlx_dev, "  Max DP                      %d\n", sc->mlx_enq2->me_max_dp);
2818 	device_printf(sc->mlx_dev, "  Max IOD                     %d\n", sc->mlx_enq2->me_max_iod);
2819 	device_printf(sc->mlx_dev, "  Max Comb                    %d\n", sc->mlx_enq2->me_max_comb);
2820 	device_printf(sc->mlx_dev, "  Latency                     %ds\n", sc->mlx_enq2->me_latency);
2821 	device_printf(sc->mlx_dev, "  SCSI Timeout                %ds\n", sc->mlx_enq2->me_scsi_timeout);
2822 	device_printf(sc->mlx_dev, "  Min Free Lines              %d\n", sc->mlx_enq2->me_min_freelines);
2823 	device_printf(sc->mlx_dev, "  Rate Constant               %d\n", sc->mlx_enq2->me_rate_const);
2824 	device_printf(sc->mlx_dev, "  MAXBLK                      %d\n", sc->mlx_enq2->me_maxblk);
2825 	device_printf(sc->mlx_dev, "  Blocking Factor             %d sectors\n", sc->mlx_enq2->me_blocking_factor);
2826 	device_printf(sc->mlx_dev, "  Cache Line Size             %d blocks\n", sc->mlx_enq2->me_cacheline);
2827 	device_printf(sc->mlx_dev, "  SCSI Capability             %s%dMHz, %d bit\n",
2828 		      sc->mlx_enq2->me_scsi_cap & (1<<4) ? "differential " : "",
2829 		      (1 << ((sc->mlx_enq2->me_scsi_cap >> 2) & 3)) * 10,
2830 		      8 << (sc->mlx_enq2->me_scsi_cap & 0x3));
2831 	device_printf(sc->mlx_dev, "  Firmware Build Number       %d\n", sc->mlx_enq2->me_firmware_build);
2832 	device_printf(sc->mlx_dev, "  Fault Management Type       %d\n", sc->mlx_enq2->me_fault_mgmt_type);
2833 	device_printf(sc->mlx_dev, "  Features                    %b\n", sc->mlx_enq2->me_firmware_features,
2834 		      "\20\4Background Init\3Read Ahead\2MORE\1Cluster\n");
2835 
2836     }
2837 }
2838 
2839 /*******************************************************************************
2840  * Emit a string describing the firmware handshake status code, and return a flag
2841  * indicating whether the code represents a fatal error.
2842  *
2843  * Error code interpretations are from the Linux driver, and don't directly match
2844  * the messages printed by Mylex's BIOS.  This may change if documentation on the
2845  * codes is forthcoming.
2846  */
2847 static int
2848 mlx_fw_message(struct mlx_softc *sc, int error, int param1, int param2)
2849 {
2850     switch(error) {
2851     case 0x00:
2852 	device_printf(sc->mlx_dev, "physical drive %d:%d not responding\n", param2, param1);
2853 	break;
2854     case 0x08:
2855 	/* we could be neater about this and give some indication when we receive more of them */
2856 	if (!(sc->mlx_flags & MLX_SPINUP_REPORTED)) {
2857 	    device_printf(sc->mlx_dev, "spinning up drives...\n");
2858 	    sc->mlx_flags |= MLX_SPINUP_REPORTED;
2859 	}
2860 	break;
2861     case 0x30:
2862 	device_printf(sc->mlx_dev, "configuration checksum error\n");
2863 	break;
2864     case 0x60:
2865 	device_printf(sc->mlx_dev, "mirror race recovery failed\n");
2866 	break;
2867     case 0x70:
2868 	device_printf(sc->mlx_dev, "mirror race recovery in progress\n");
2869 	break;
2870     case 0x90:
2871 	device_printf(sc->mlx_dev, "physical drive %d:%d COD mismatch\n", param2, param1);
2872 	break;
2873     case 0xa0:
2874 	device_printf(sc->mlx_dev, "logical drive installation aborted\n");
2875 	break;
2876     case 0xb0:
2877 	device_printf(sc->mlx_dev, "mirror race on a critical system drive\n");
2878 	break;
2879     case 0xd0:
2880 	device_printf(sc->mlx_dev, "new controller configuration found\n");
2881 	break;
2882     case 0xf0:
2883 	device_printf(sc->mlx_dev, "FATAL MEMORY PARITY ERROR\n");
2884 	return(1);
2885     default:
2886 	device_printf(sc->mlx_dev, "unknown firmware initialisation error %02x:%02x:%02x\n", error, param1, param2);
2887 	break;
2888     }
2889     return(0);
2890 }
2891 
2892 /********************************************************************************
2893  ********************************************************************************
2894                                                                 Utility Functions
2895  ********************************************************************************
2896  ********************************************************************************/
2897 
2898 /********************************************************************************
2899  * Find the disk whose unit number is (unit) on this controller
2900  */
2901 static struct mlx_sysdrive *
2902 mlx_findunit(struct mlx_softc *sc, int unit)
2903 {
2904     int		i;
2905 
2906     /* search system drives */
2907     for (i = 0; i < MLX_MAXDRIVES; i++) {
2908 	/* is this one attached? */
2909 	if (sc->mlx_sysdrive[i].ms_disk != 0) {
2910 	    /* is this the one? */
2911 	    if (unit == device_get_unit(sc->mlx_sysdrive[i].ms_disk))
2912 		return(&sc->mlx_sysdrive[i]);
2913 	}
2914     }
2915     return(NULL);
2916 }
2917