xref: /freebsd/sys/dev/mlx/mlx.c (revision dce6e6518b85561495cff38a3074a69d29d58a55)
1 /*-
2  * Copyright (c) 1999 Michael Smith
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  *
26  *	$FreeBSD$
27  */
28 
29 /*
30  * Driver for the Mylex DAC960 family of RAID controllers.
31  */
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/malloc.h>
36 #include <sys/kernel.h>
37 
38 #include <sys/bus.h>
39 #include <sys/conf.h>
40 #include <sys/stat.h>
41 
42 #include <machine/resource.h>
43 #include <machine/bus_memio.h>
44 #include <machine/bus_pio.h>
45 #include <machine/bus.h>
46 #include <machine/clock.h>
47 #include <sys/rman.h>
48 
49 #include <geom/geom_disk.h>
50 
51 #include <dev/mlx/mlx_compat.h>
52 #include <dev/mlx/mlxio.h>
53 #include <dev/mlx/mlxvar.h>
54 #include <dev/mlx/mlxreg.h>
55 
56 #define MLX_CDEV_MAJOR	130
57 
58 static struct cdevsw mlx_cdevsw = {
59 	.d_open =	mlx_open,
60 	.d_close =	mlx_close,
61 	.d_ioctl =	mlx_ioctl,
62 	.d_name =	"mlx",
63 	.d_maj =	MLX_CDEV_MAJOR,
64 };
65 
66 devclass_t	mlx_devclass;
67 
68 /*
69  * Per-interface accessor methods
70  */
71 static int			mlx_v3_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
72 static int			mlx_v3_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
73 static void			mlx_v3_intaction(struct mlx_softc *sc, int action);
74 static int			mlx_v3_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2);
75 
76 static int			mlx_v4_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
77 static int			mlx_v4_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
78 static void			mlx_v4_intaction(struct mlx_softc *sc, int action);
79 static int			mlx_v4_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2);
80 
81 static int			mlx_v5_tryqueue(struct mlx_softc *sc, struct mlx_command *mc);
82 static int			mlx_v5_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status);
83 static void			mlx_v5_intaction(struct mlx_softc *sc, int action);
84 static int			mlx_v5_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2);
85 
86 /*
87  * Status monitoring
88  */
89 static void			mlx_periodic(void *data);
90 static void			mlx_periodic_enquiry(struct mlx_command *mc);
91 static void			mlx_periodic_eventlog_poll(struct mlx_softc *sc);
92 static void			mlx_periodic_eventlog_respond(struct mlx_command *mc);
93 static void			mlx_periodic_rebuild(struct mlx_command *mc);
94 
95 /*
96  * Channel Pause
97  */
98 static void			mlx_pause_action(struct mlx_softc *sc);
99 static void			mlx_pause_done(struct mlx_command *mc);
100 
101 /*
102  * Command submission.
103  */
104 static void			*mlx_enquire(struct mlx_softc *sc, int command, size_t bufsize,
105 					     void (*complete)(struct mlx_command *mc));
106 static int			mlx_flush(struct mlx_softc *sc);
107 static int			mlx_check(struct mlx_softc *sc, int drive);
108 static int			mlx_rebuild(struct mlx_softc *sc, int channel, int target);
109 static int			mlx_wait_command(struct mlx_command *mc);
110 static int			mlx_poll_command(struct mlx_command *mc);
111 static void			mlx_startio(struct mlx_softc *sc);
112 static void			mlx_completeio(struct mlx_command *mc);
113 static int			mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu);
114 
115 /*
116  * Command buffer allocation.
117  */
118 static struct mlx_command	*mlx_alloccmd(struct mlx_softc *sc);
119 static void			mlx_releasecmd(struct mlx_command *mc);
120 static void			mlx_freecmd(struct mlx_command *mc);
121 
122 /*
123  * Command management.
124  */
125 static int			mlx_getslot(struct mlx_command *mc);
126 static void			mlx_mapcmd(struct mlx_command *mc);
127 static void			mlx_unmapcmd(struct mlx_command *mc);
128 static int			mlx_start(struct mlx_command *mc);
129 static int			mlx_done(struct mlx_softc *sc);
130 static void			mlx_complete(struct mlx_softc *sc);
131 
132 /*
133  * Debugging.
134  */
135 static char			*mlx_diagnose_command(struct mlx_command *mc);
136 static void			mlx_describe_controller(struct mlx_softc *sc);
137 static int			mlx_fw_message(struct mlx_softc *sc, int status, int param1, int param2);
138 
139 /*
140  * Utility functions.
141  */
142 static struct mlx_sysdrive	*mlx_findunit(struct mlx_softc *sc, int unit);
143 
144 /********************************************************************************
145  ********************************************************************************
146                                                                 Public Interfaces
147  ********************************************************************************
148  ********************************************************************************/
149 
150 /********************************************************************************
151  * Free all of the resources associated with (sc)
152  *
153  * Should not be called if the controller is active.
154  */
155 void
156 mlx_free(struct mlx_softc *sc)
157 {
158     struct mlx_command	*mc;
159 
160     debug_called(1);
161 
162     /* cancel status timeout */
163     untimeout(mlx_periodic, sc, sc->mlx_timeout);
164 
165     /* throw away any command buffers */
166     while ((mc = TAILQ_FIRST(&sc->mlx_freecmds)) != NULL) {
167 	TAILQ_REMOVE(&sc->mlx_freecmds, mc, mc_link);
168 	mlx_freecmd(mc);
169     }
170 
171     /* destroy data-transfer DMA tag */
172     if (sc->mlx_buffer_dmat)
173 	bus_dma_tag_destroy(sc->mlx_buffer_dmat);
174 
175     /* free and destroy DMA memory and tag for s/g lists */
176     if (sc->mlx_sgtable)
177 	bus_dmamem_free(sc->mlx_sg_dmat, sc->mlx_sgtable, sc->mlx_sg_dmamap);
178     if (sc->mlx_sg_dmat)
179 	bus_dma_tag_destroy(sc->mlx_sg_dmat);
180 
181     /* disconnect the interrupt handler */
182     if (sc->mlx_intr)
183 	bus_teardown_intr(sc->mlx_dev, sc->mlx_irq, sc->mlx_intr);
184     if (sc->mlx_irq != NULL)
185 	bus_release_resource(sc->mlx_dev, SYS_RES_IRQ, 0, sc->mlx_irq);
186 
187     /* destroy the parent DMA tag */
188     if (sc->mlx_parent_dmat)
189 	bus_dma_tag_destroy(sc->mlx_parent_dmat);
190 
191     /* release the register window mapping */
192     if (sc->mlx_mem != NULL)
193 	bus_release_resource(sc->mlx_dev, sc->mlx_mem_type, sc->mlx_mem_rid, sc->mlx_mem);
194 
195     /* free controller enquiry data */
196     if (sc->mlx_enq2 != NULL)
197 	free(sc->mlx_enq2, M_DEVBUF);
198 
199     /* destroy control device */
200     if (sc->mlx_dev_t != (dev_t)NULL)
201 	destroy_dev(sc->mlx_dev_t);
202 }
203 
204 /********************************************************************************
205  * Map the scatter/gather table into bus space
206  */
207 static void
208 mlx_dma_map_sg(void *arg, bus_dma_segment_t *segs, int nseg, int error)
209 {
210     struct mlx_softc	*sc = (struct mlx_softc *)arg;
211 
212     debug_called(1);
213 
214     /* save base of s/g table's address in bus space */
215     sc->mlx_sgbusaddr = segs->ds_addr;
216 }
217 
218 static int
219 mlx_sglist_map(struct mlx_softc *sc)
220 {
221     size_t	segsize;
222     int		error, ncmd;
223 
224     debug_called(1);
225 
226     /* destroy any existing mappings */
227     if (sc->mlx_sgtable)
228 	bus_dmamem_free(sc->mlx_sg_dmat, sc->mlx_sgtable, sc->mlx_sg_dmamap);
229     if (sc->mlx_sg_dmat)
230 	bus_dma_tag_destroy(sc->mlx_sg_dmat);
231 
232     /*
233      * Create a single tag describing a region large enough to hold all of
234      * the s/g lists we will need.  If we're called early on, we don't know how
235      * many commands we're going to be asked to support, so only allocate enough
236      * for a couple.
237      */
238     if (sc->mlx_enq2 == NULL) {
239 	ncmd = 2;
240     } else {
241 	ncmd = sc->mlx_enq2->me_max_commands;
242     }
243     segsize = sizeof(struct mlx_sgentry) * MLX_NSEG * ncmd;
244     error = bus_dma_tag_create(sc->mlx_parent_dmat, 	/* parent */
245 			       1, 0, 			/* alignment, boundary */
246 			       BUS_SPACE_MAXADDR,	/* lowaddr */
247 			       BUS_SPACE_MAXADDR, 	/* highaddr */
248 			       NULL, NULL, 		/* filter, filterarg */
249 			       segsize, 1,		/* maxsize, nsegments */
250 			       BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
251 			       0,			/* flags */
252 			       busdma_lock_mutex,	/* lockfunc */
253 			       &Giant,			/* lockarg */
254 			       &sc->mlx_sg_dmat);
255     if (error != 0) {
256 	device_printf(sc->mlx_dev, "can't allocate scatter/gather DMA tag\n");
257 	return(ENOMEM);
258     }
259 
260     /*
261      * Allocate enough s/g maps for all commands and permanently map them into
262      * controller-visible space.
263      *
264      * XXX this assumes we can get enough space for all the s/g maps in one
265      * contiguous slab.  We may need to switch to a more complex arrangement where
266      * we allocate in smaller chunks and keep a lookup table from slot to bus address.
267      */
268     error = bus_dmamem_alloc(sc->mlx_sg_dmat, (void **)&sc->mlx_sgtable, BUS_DMA_NOWAIT, &sc->mlx_sg_dmamap);
269     if (error) {
270 	device_printf(sc->mlx_dev, "can't allocate s/g table\n");
271 	return(ENOMEM);
272     }
273     bus_dmamap_load(sc->mlx_sg_dmat, sc->mlx_sg_dmamap, sc->mlx_sgtable, segsize, mlx_dma_map_sg, sc, 0);
274     return(0);
275 }
276 
277 /********************************************************************************
278  * Initialise the controller and softc
279  */
280 int
281 mlx_attach(struct mlx_softc *sc)
282 {
283     struct mlx_enquiry_old	*meo;
284     int				rid, error, fwminor, hscode, hserror, hsparam1, hsparam2, hsmsg;
285 
286     debug_called(1);
287 
288     /*
289      * Initialise per-controller queues.
290      */
291     TAILQ_INIT(&sc->mlx_work);
292     TAILQ_INIT(&sc->mlx_freecmds);
293     MLX_BIO_QINIT(sc->mlx_bioq);
294 
295     /*
296      * Select accessor methods based on controller interface type.
297      */
298     switch(sc->mlx_iftype) {
299     case MLX_IFTYPE_2:
300     case MLX_IFTYPE_3:
301 	sc->mlx_tryqueue	= mlx_v3_tryqueue;
302 	sc->mlx_findcomplete	= mlx_v3_findcomplete;
303 	sc->mlx_intaction	= mlx_v3_intaction;
304 	sc->mlx_fw_handshake	= mlx_v3_fw_handshake;
305 	break;
306     case MLX_IFTYPE_4:
307 	sc->mlx_tryqueue	= mlx_v4_tryqueue;
308 	sc->mlx_findcomplete	= mlx_v4_findcomplete;
309 	sc->mlx_intaction	= mlx_v4_intaction;
310 	sc->mlx_fw_handshake	= mlx_v4_fw_handshake;
311 	break;
312     case MLX_IFTYPE_5:
313 	sc->mlx_tryqueue	= mlx_v5_tryqueue;
314 	sc->mlx_findcomplete	= mlx_v5_findcomplete;
315 	sc->mlx_intaction	= mlx_v5_intaction;
316 	sc->mlx_fw_handshake	= mlx_v5_fw_handshake;
317 	break;
318     default:
319 	mlx_free(sc);
320 	return(ENXIO);		/* should never happen */
321     }
322 
323     /* disable interrupts before we start talking to the controller */
324     sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
325 
326     /*
327      * Wait for the controller to come ready, handshake with the firmware if required.
328      * This is typically only necessary on platforms where the controller BIOS does not
329      * run.
330      */
331     hsmsg = 0;
332     DELAY(1000);
333     while ((hscode = sc->mlx_fw_handshake(sc, &hserror, &hsparam1, &hsparam2)) != 0) {
334 	/* report first time around... */
335 	if (hsmsg == 0) {
336 	    device_printf(sc->mlx_dev, "controller initialisation in progress...\n");
337 	    hsmsg = 1;
338 	}
339 	/* did we get a real message? */
340 	if (hscode == 2) {
341 	    hscode = mlx_fw_message(sc, hserror, hsparam1, hsparam2);
342 	    /* fatal initialisation error? */
343 	    if (hscode != 0) {
344 		mlx_free(sc);
345 		return(ENXIO);
346 	    }
347 	}
348     }
349     if (hsmsg == 1)
350 	device_printf(sc->mlx_dev, "initialisation complete.\n");
351 
352     /*
353      * Allocate and connect our interrupt.
354      */
355     rid = 0;
356     sc->mlx_irq = bus_alloc_resource(sc->mlx_dev, SYS_RES_IRQ, &rid, 0, ~0, 1, RF_SHAREABLE | RF_ACTIVE);
357     if (sc->mlx_irq == NULL) {
358 	device_printf(sc->mlx_dev, "can't allocate interrupt\n");
359 	mlx_free(sc);
360 	return(ENXIO);
361     }
362     error = bus_setup_intr(sc->mlx_dev, sc->mlx_irq, INTR_TYPE_BIO | INTR_ENTROPY,  mlx_intr, sc, &sc->mlx_intr);
363     if (error) {
364 	device_printf(sc->mlx_dev, "can't set up interrupt\n");
365 	mlx_free(sc);
366 	return(ENXIO);
367     }
368 
369     /*
370      * Create DMA tag for mapping buffers into controller-addressable space.
371      */
372     error = bus_dma_tag_create(sc->mlx_parent_dmat, 		/* parent */
373 			       1, 0, 				/* alignment, boundary */
374 			       BUS_SPACE_MAXADDR,		/* lowaddr */
375 			       BUS_SPACE_MAXADDR, 		/* highaddr */
376 			       NULL, NULL, 			/* filter, filterarg */
377 			       MAXBSIZE, MLX_NSEG,		/* maxsize, nsegments */
378 			       BUS_SPACE_MAXSIZE_32BIT,		/* maxsegsize */
379 			       0,				/* flags */
380 			       busdma_lock_mutex,	/* lockfunc */
381 			       &Giant,			/* lockarg */
382 			       &sc->mlx_buffer_dmat);
383     if (error != 0) {
384 	device_printf(sc->mlx_dev, "can't allocate buffer DMA tag\n");
385 	mlx_free(sc);
386 	return(ENOMEM);
387     }
388 
389     /*
390      * Create some initial scatter/gather mappings so we can run the probe commands.
391      */
392     error = mlx_sglist_map(sc);
393     if (error != 0) {
394 	device_printf(sc->mlx_dev, "can't make initial s/g list mapping\n");
395 	mlx_free(sc);
396 	return(error);
397     }
398 
399     /*
400      * We don't (yet) know where the event log is up to.
401      */
402     sc->mlx_currevent = -1;
403 
404     /*
405      * Obtain controller feature information
406      */
407     if ((sc->mlx_enq2 = mlx_enquire(sc, MLX_CMD_ENQUIRY2, sizeof(struct mlx_enquiry2), NULL)) == NULL) {
408 	device_printf(sc->mlx_dev, "ENQUIRY2 failed\n");
409 	mlx_free(sc);
410 	return(ENXIO);
411     }
412 
413     /*
414      * Do quirk/feature related things.
415      */
416     fwminor = (sc->mlx_enq2->me_firmware_id >> 8) & 0xff;
417     switch(sc->mlx_iftype) {
418     case MLX_IFTYPE_2:
419 	/* These controllers don't report the firmware version in the ENQUIRY2 response */
420 	if ((meo = mlx_enquire(sc, MLX_CMD_ENQUIRY_OLD, sizeof(struct mlx_enquiry_old), NULL)) == NULL) {
421 	    device_printf(sc->mlx_dev, "ENQUIRY_OLD failed\n");
422 	    mlx_free(sc);
423 	    return(ENXIO);
424 	}
425 	sc->mlx_enq2->me_firmware_id = ('0' << 24) | (0 << 16) | (meo->me_fwminor << 8) | meo->me_fwmajor;
426 	free(meo, M_DEVBUF);
427 
428 	/* XXX require 2.42 or better (PCI) or 2.14 or better (EISA) */
429 	if (meo->me_fwminor < 42) {
430 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
431 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 2.42 or later\n");
432 	}
433 	break;
434     case MLX_IFTYPE_3:
435 	/* XXX certify 3.52? */
436 	if (fwminor < 51) {
437 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
438 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 3.51 or later\n");
439 	}
440 	break;
441     case MLX_IFTYPE_4:
442 	/* XXX certify firmware versions? */
443 	if (fwminor < 6) {
444 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
445 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 4.06 or later\n");
446 	}
447 	break;
448     case MLX_IFTYPE_5:
449 	if (fwminor < 7) {
450 	    device_printf(sc->mlx_dev, " *** WARNING *** This firmware revision is not recommended\n");
451 	    device_printf(sc->mlx_dev, " *** WARNING *** Use revision 5.07 or later\n");
452 	}
453 	break;
454     default:
455 	mlx_free(sc);
456 	return(ENXIO);		/* should never happen */
457     }
458 
459     /*
460      * Create the final scatter/gather mappings now that we have characterised the controller.
461      */
462     error = mlx_sglist_map(sc);
463     if (error != 0) {
464 	device_printf(sc->mlx_dev, "can't make final s/g list mapping\n");
465 	mlx_free(sc);
466 	return(error);
467     }
468 
469     /*
470      * No user-requested background operation is in progress.
471      */
472     sc->mlx_background = 0;
473     sc->mlx_rebuildstat.rs_code = MLX_REBUILDSTAT_IDLE;
474 
475     /*
476      * Create the control device.
477      */
478     sc->mlx_dev_t = make_dev(&mlx_cdevsw, device_get_unit(sc->mlx_dev), UID_ROOT, GID_OPERATOR,
479 			     S_IRUSR | S_IWUSR, "mlx%d", device_get_unit(sc->mlx_dev));
480 
481     /*
482      * Start the timeout routine.
483      */
484     sc->mlx_timeout = timeout(mlx_periodic, sc, hz);
485 
486     /* print a little information about the controller */
487     mlx_describe_controller(sc);
488 
489     return(0);
490 }
491 
492 /********************************************************************************
493  * Locate disk resources and attach children to them.
494  */
495 void
496 mlx_startup(struct mlx_softc *sc)
497 {
498     struct mlx_enq_sys_drive	*mes;
499     struct mlx_sysdrive		*dr;
500     int				i, error;
501 
502     debug_called(1);
503 
504     /*
505      * Scan all the system drives and attach children for those that
506      * don't currently have them.
507      */
508     mes = mlx_enquire(sc, MLX_CMD_ENQSYSDRIVE, sizeof(*mes) * MLX_MAXDRIVES, NULL);
509     if (mes == NULL) {
510 	device_printf(sc->mlx_dev, "error fetching drive status\n");
511 	return;
512     }
513 
514     /* iterate over drives returned */
515     for (i = 0, dr = &sc->mlx_sysdrive[0];
516 	 (i < MLX_MAXDRIVES) && (mes[i].sd_size != 0xffffffff);
517 	 i++, dr++) {
518 	/* are we already attached to this drive? */
519     	if (dr->ms_disk == 0) {
520 	    /* pick up drive information */
521 	    dr->ms_size = mes[i].sd_size;
522 	    dr->ms_raidlevel = mes[i].sd_raidlevel & 0xf;
523 	    dr->ms_state = mes[i].sd_state;
524 
525 	    /* generate geometry information */
526 	    if (sc->mlx_geom == MLX_GEOM_128_32) {
527 		dr->ms_heads = 128;
528 		dr->ms_sectors = 32;
529 		dr->ms_cylinders = dr->ms_size / (128 * 32);
530 	    } else {        /* MLX_GEOM_255/63 */
531 		dr->ms_heads = 255;
532 		dr->ms_sectors = 63;
533 		dr->ms_cylinders = dr->ms_size / (255 * 63);
534 	    }
535 	    dr->ms_disk =  device_add_child(sc->mlx_dev, /*"mlxd"*/NULL, -1);
536 	    if (dr->ms_disk == 0)
537 		device_printf(sc->mlx_dev, "device_add_child failed\n");
538 	    device_set_ivars(dr->ms_disk, dr);
539 	}
540     }
541     free(mes, M_DEVBUF);
542     if ((error = bus_generic_attach(sc->mlx_dev)) != 0)
543 	device_printf(sc->mlx_dev, "bus_generic_attach returned %d", error);
544 
545     /* mark controller back up */
546     sc->mlx_state &= ~MLX_STATE_SHUTDOWN;
547 
548     /* enable interrupts */
549     sc->mlx_intaction(sc, MLX_INTACTION_ENABLE);
550 }
551 
552 /********************************************************************************
553  * Disconnect from the controller completely, in preparation for unload.
554  */
555 int
556 mlx_detach(device_t dev)
557 {
558     struct mlx_softc	*sc = device_get_softc(dev);
559     struct mlxd_softc	*mlxd;
560     int			i, s, error;
561 
562     debug_called(1);
563 
564     error = EBUSY;
565     s = splbio();
566     if (sc->mlx_state & MLX_STATE_OPEN)
567 	goto out;
568 
569     for (i = 0; i < MLX_MAXDRIVES; i++) {
570 	if (sc->mlx_sysdrive[i].ms_disk != 0) {
571 	    mlxd = device_get_softc(sc->mlx_sysdrive[i].ms_disk);
572 	    if (mlxd->mlxd_flags & MLXD_OPEN) {		/* drive is mounted, abort detach */
573 		device_printf(sc->mlx_sysdrive[i].ms_disk, "still open, can't detach\n");
574 		goto out;
575 	    }
576 	}
577     }
578     if ((error = mlx_shutdown(dev)))
579 	goto out;
580 
581     mlx_free(sc);
582 
583     error = 0;
584  out:
585     splx(s);
586     return(error);
587 }
588 
589 /********************************************************************************
590  * Bring the controller down to a dormant state and detach all child devices.
591  *
592  * This function is called before detach, system shutdown, or before performing
593  * an operation which may add or delete system disks.  (Call mlx_startup to
594  * resume normal operation.)
595  *
596  * Note that we can assume that the bioq on the controller is empty, as we won't
597  * allow shutdown if any device is open.
598  */
599 int
600 mlx_shutdown(device_t dev)
601 {
602     struct mlx_softc	*sc = device_get_softc(dev);
603     int			i, s, error;
604 
605     debug_called(1);
606 
607     s = splbio();
608     error = 0;
609 
610     sc->mlx_state |= MLX_STATE_SHUTDOWN;
611     sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
612 
613     /* flush controller */
614     device_printf(sc->mlx_dev, "flushing cache...");
615     if (mlx_flush(sc)) {
616 	printf("failed\n");
617     } else {
618 	printf("done\n");
619     }
620 
621     /* delete all our child devices */
622     for (i = 0; i < MLX_MAXDRIVES; i++) {
623 	if (sc->mlx_sysdrive[i].ms_disk != 0) {
624 	    if ((error = device_delete_child(sc->mlx_dev, sc->mlx_sysdrive[i].ms_disk)) != 0)
625 		goto out;
626 	    sc->mlx_sysdrive[i].ms_disk = 0;
627 	}
628     }
629 
630  out:
631     splx(s);
632     return(error);
633 }
634 
635 /********************************************************************************
636  * Bring the controller to a quiescent state, ready for system suspend.
637  */
638 int
639 mlx_suspend(device_t dev)
640 {
641     struct mlx_softc	*sc = device_get_softc(dev);
642     int			s;
643 
644     debug_called(1);
645 
646     s = splbio();
647     sc->mlx_state |= MLX_STATE_SUSPEND;
648 
649     /* flush controller */
650     device_printf(sc->mlx_dev, "flushing cache...");
651     printf("%s\n", mlx_flush(sc) ? "failed" : "done");
652 
653     sc->mlx_intaction(sc, MLX_INTACTION_DISABLE);
654     splx(s);
655 
656     return(0);
657 }
658 
659 /********************************************************************************
660  * Bring the controller back to a state ready for operation.
661  */
662 int
663 mlx_resume(device_t dev)
664 {
665     struct mlx_softc	*sc = device_get_softc(dev);
666 
667     debug_called(1);
668 
669     sc->mlx_state &= ~MLX_STATE_SUSPEND;
670     sc->mlx_intaction(sc, MLX_INTACTION_ENABLE);
671 
672     return(0);
673 }
674 
675 /*******************************************************************************
676  * Take an interrupt, or be poked by other code to look for interrupt-worthy
677  * status.
678  */
679 void
680 mlx_intr(void *arg)
681 {
682     struct mlx_softc	*sc = (struct mlx_softc *)arg;
683 
684     debug_called(1);
685 
686     /* collect finished commands, queue anything waiting */
687     mlx_done(sc);
688 };
689 
690 /*******************************************************************************
691  * Receive a buf structure from a child device and queue it on a particular
692  * disk resource, then poke the disk resource to start as much work as it can.
693  */
694 int
695 mlx_submit_buf(struct mlx_softc *sc, mlx_bio *bp)
696 {
697     int		s;
698 
699     debug_called(1);
700 
701     s = splbio();
702     MLX_BIO_QINSERT(sc->mlx_bioq, bp);
703     sc->mlx_waitbufs++;
704     splx(s);
705     mlx_startio(sc);
706     return(0);
707 }
708 
709 /********************************************************************************
710  * Accept an open operation on the control device.
711  */
712 int
713 mlx_open(dev_t dev, int flags, int fmt, struct thread *td)
714 {
715     int			unit = minor(dev);
716     struct mlx_softc	*sc = devclass_get_softc(mlx_devclass, unit);
717 
718     sc->mlx_state |= MLX_STATE_OPEN;
719     return(0);
720 }
721 
722 /********************************************************************************
723  * Accept the last close on the control device.
724  */
725 int
726 mlx_close(dev_t dev, int flags, int fmt, struct thread *td)
727 {
728     int			unit = minor(dev);
729     struct mlx_softc	*sc = devclass_get_softc(mlx_devclass, unit);
730 
731     sc->mlx_state &= ~MLX_STATE_OPEN;
732     return (0);
733 }
734 
735 /********************************************************************************
736  * Handle controller-specific control operations.
737  */
738 int
739 mlx_ioctl(dev_t dev, u_long cmd, caddr_t addr, int32_t flag, struct thread *td)
740 {
741     int				unit = minor(dev);
742     struct mlx_softc		*sc = devclass_get_softc(mlx_devclass, unit);
743     struct mlx_rebuild_request	*rb = (struct mlx_rebuild_request *)addr;
744     struct mlx_rebuild_status	*rs = (struct mlx_rebuild_status *)addr;
745     int				*arg = (int *)addr;
746     struct mlx_pause		*mp;
747     struct mlx_sysdrive		*dr;
748     struct mlxd_softc		*mlxd;
749     int				i, error;
750 
751     switch(cmd) {
752 	/*
753 	 * Enumerate connected system drives; returns the first system drive's
754 	 * unit number if *arg is -1, or the next unit after *arg if it's
755 	 * a valid unit on this controller.
756 	 */
757     case MLX_NEXT_CHILD:
758 	/* search system drives */
759 	for (i = 0; i < MLX_MAXDRIVES; i++) {
760 	    /* is this one attached? */
761 	    if (sc->mlx_sysdrive[i].ms_disk != 0) {
762 		/* looking for the next one we come across? */
763 		if (*arg == -1) {
764 		    *arg = device_get_unit(sc->mlx_sysdrive[0].ms_disk);
765 		    return(0);
766 		}
767 		/* we want the one after this one */
768 		if (*arg == device_get_unit(sc->mlx_sysdrive[i].ms_disk))
769 		    *arg = -1;
770 	    }
771 	}
772 	return(ENOENT);
773 
774 	/*
775 	 * Scan the controller to see whether new drives have appeared.
776 	 */
777     case MLX_RESCAN_DRIVES:
778 	mlx_startup(sc);
779 	return(0);
780 
781 	/*
782 	 * Disconnect from the specified drive; it may be about to go
783 	 * away.
784 	 */
785     case MLX_DETACH_DRIVE:			/* detach one drive */
786 
787 	if (((dr = mlx_findunit(sc, *arg)) == NULL) ||
788 	    ((mlxd = device_get_softc(dr->ms_disk)) == NULL))
789 	    return(ENOENT);
790 
791 	device_printf(dr->ms_disk, "detaching...");
792 	error = 0;
793 	if (mlxd->mlxd_flags & MLXD_OPEN) {
794 	    error = EBUSY;
795 	    goto detach_out;
796 	}
797 
798 	/* flush controller */
799 	if (mlx_flush(sc)) {
800 	    error = EBUSY;
801 	    goto detach_out;
802 	}
803 
804 	/* nuke drive */
805 	if ((error = device_delete_child(sc->mlx_dev, dr->ms_disk)) != 0)
806 	    goto detach_out;
807 	dr->ms_disk = 0;
808 
809     detach_out:
810 	if (error) {
811 	    printf("failed\n");
812 	} else {
813 	    printf("done\n");
814 	}
815 	return(error);
816 
817 	/*
818 	 * Pause one or more SCSI channels for a period of time, to assist
819 	 * in the process of hot-swapping devices.
820 	 *
821 	 * Note that at least the 3.51 firmware on the DAC960PL doesn't seem
822 	 * to do this right.
823 	 */
824     case MLX_PAUSE_CHANNEL:			/* schedule a channel pause */
825 	/* Does this command work on this firmware? */
826 	if (!(sc->mlx_feature & MLX_FEAT_PAUSEWORKS))
827 	    return(EOPNOTSUPP);
828 
829 	mp = (struct mlx_pause *)addr;
830 	if ((mp->mp_which == MLX_PAUSE_CANCEL) && (sc->mlx_pause.mp_when != 0)) {
831 	    /* cancel a pending pause operation */
832 	    sc->mlx_pause.mp_which = 0;
833 	} else {
834 	    /* fix for legal channels */
835 	    mp->mp_which &= ((1 << sc->mlx_enq2->me_actual_channels) -1);
836 	    /* check time values */
837 	    if ((mp->mp_when < 0) || (mp->mp_when > 3600))
838 		return(EINVAL);
839 	    if ((mp->mp_howlong < 1) || (mp->mp_howlong > (0xf * 30)))
840 		return(EINVAL);
841 
842 	    /* check for a pause currently running */
843 	    if ((sc->mlx_pause.mp_which != 0) && (sc->mlx_pause.mp_when == 0))
844 		return(EBUSY);
845 
846 	    /* looks ok, go with it */
847 	    sc->mlx_pause.mp_which = mp->mp_which;
848 	    sc->mlx_pause.mp_when = time_second + mp->mp_when;
849 	    sc->mlx_pause.mp_howlong = sc->mlx_pause.mp_when + mp->mp_howlong;
850 	}
851 	return(0);
852 
853 	/*
854 	 * Accept a command passthrough-style.
855 	 */
856     case MLX_COMMAND:
857 	return(mlx_user_command(sc, (struct mlx_usercommand *)addr));
858 
859 	/*
860 	 * Start a rebuild on a given SCSI disk
861 	 */
862     case MLX_REBUILDASYNC:
863 	if (sc->mlx_background != 0) {
864 	    rb->rr_status = 0x0106;
865 	    return(EBUSY);
866 	}
867 	rb->rr_status = mlx_rebuild(sc, rb->rr_channel, rb->rr_target);
868 	switch (rb->rr_status) {
869 	case 0:
870 	    error = 0;
871 	    break;
872 	case 0x10000:
873 	    error = ENOMEM;		/* couldn't set up the command */
874 	    break;
875 	case 0x0002:
876 	    error = EBUSY;
877 	    break;
878 	case 0x0104:
879 	    error = EIO;
880 	    break;
881 	case 0x0105:
882 	    error = ERANGE;
883 	    break;
884 	case 0x0106:
885 	    error = EBUSY;
886 	    break;
887 	default:
888 	    error = EINVAL;
889 	    break;
890 	}
891 	if (error == 0)
892 	    sc->mlx_background = MLX_BACKGROUND_REBUILD;
893 	return(error);
894 
895 	/*
896 	 * Get the status of the current rebuild or consistency check.
897 	 */
898     case MLX_REBUILDSTAT:
899 	*rs = sc->mlx_rebuildstat;
900 	return(0);
901 
902 	/*
903 	 * Return the per-controller system drive number matching the
904 	 * disk device number in (arg), if it happens to belong to us.
905 	 */
906     case MLX_GET_SYSDRIVE:
907 	error = ENOENT;
908 	mlxd = (struct mlxd_softc *)devclass_get_softc(mlxd_devclass, *arg);
909 	if ((mlxd != NULL) && (mlxd->mlxd_drive >= sc->mlx_sysdrive) &&
910 	    (mlxd->mlxd_drive < (sc->mlx_sysdrive + MLX_MAXDRIVES))) {
911 	    error = 0;
912 	    *arg = mlxd->mlxd_drive - sc->mlx_sysdrive;
913 	}
914 	return(error);
915 
916     default:
917 	return(ENOTTY);
918     }
919 }
920 
921 /********************************************************************************
922  * Handle operations requested by a System Drive connected to this controller.
923  */
924 int
925 mlx_submit_ioctl(struct mlx_softc *sc, struct mlx_sysdrive *drive, u_long cmd,
926 		caddr_t addr, int32_t flag, struct thread *td)
927 {
928     int				*arg = (int *)addr;
929     int				error, result;
930 
931     switch(cmd) {
932 	/*
933 	 * Return the current status of this drive.
934 	 */
935     case MLXD_STATUS:
936 	*arg = drive->ms_state;
937 	return(0);
938 
939 	/*
940 	 * Start a background consistency check on this drive.
941 	 */
942     case MLXD_CHECKASYNC:		/* start a background consistency check */
943 	if (sc->mlx_background != 0) {
944 	    *arg = 0x0106;
945 	    return(EBUSY);
946 	}
947 	result = mlx_check(sc, drive - &sc->mlx_sysdrive[0]);
948 	switch (result) {
949 	case 0:
950 	    error = 0;
951 	    break;
952 	case 0x10000:
953 	    error = ENOMEM;		/* couldn't set up the command */
954 	    break;
955 	case 0x0002:
956 	    error = EIO;
957 	    break;
958 	case 0x0105:
959 	    error = ERANGE;
960 	    break;
961 	case 0x0106:
962 	    error = EBUSY;
963 	    break;
964 	default:
965 	    error = EINVAL;
966 	    break;
967 	}
968 	if (error == 0)
969 	    sc->mlx_background = MLX_BACKGROUND_CHECK;
970 	*arg = result;
971 	return(error);
972 
973     }
974     return(ENOIOCTL);
975 }
976 
977 
978 /********************************************************************************
979  ********************************************************************************
980                                                                 Status Monitoring
981  ********************************************************************************
982  ********************************************************************************/
983 
984 /********************************************************************************
985  * Fire off commands to periodically check the status of connected drives.
986  */
987 static void
988 mlx_periodic(void *data)
989 {
990     struct mlx_softc *sc = (struct mlx_softc *)data;
991 
992     debug_called(1);
993 
994     /*
995      * Run a bus pause?
996      */
997     if ((sc->mlx_pause.mp_which != 0) &&
998 	(sc->mlx_pause.mp_when > 0) &&
999 	(time_second >= sc->mlx_pause.mp_when)){
1000 
1001 	mlx_pause_action(sc);		/* pause is running */
1002 	sc->mlx_pause.mp_when = 0;
1003 	sysbeep(500, hz);
1004 
1005 	/*
1006 	 * Bus pause still running?
1007 	 */
1008     } else if ((sc->mlx_pause.mp_which != 0) &&
1009 	       (sc->mlx_pause.mp_when == 0)) {
1010 
1011 	/* time to stop bus pause? */
1012 	if (time_second >= sc->mlx_pause.mp_howlong) {
1013 	    mlx_pause_action(sc);
1014 	    sc->mlx_pause.mp_which = 0;	/* pause is complete */
1015 	    sysbeep(500, hz);
1016 	} else {
1017 	    sysbeep((time_second % 5) * 100 + 500, hz/8);
1018 	}
1019 
1020 	/*
1021 	 * Run normal periodic activities?
1022 	 */
1023     } else if (time_second > (sc->mlx_lastpoll + 10)) {
1024 	sc->mlx_lastpoll = time_second;
1025 
1026 	/*
1027 	 * Check controller status.
1028 	 *
1029 	 * XXX Note that this may not actually launch a command in situations of high load.
1030 	 */
1031 	mlx_enquire(sc, (sc->mlx_iftype == MLX_IFTYPE_2) ? MLX_CMD_ENQUIRY_OLD : MLX_CMD_ENQUIRY,
1032 		    imax(sizeof(struct mlx_enquiry), sizeof(struct mlx_enquiry_old)), mlx_periodic_enquiry);
1033 
1034 	/*
1035 	 * Check system drive status.
1036 	 *
1037 	 * XXX This might be better left to event-driven detection, eg. I/O to an offline
1038 	 *     drive will detect it's offline, rebuilds etc. should detect the drive is back
1039 	 *     online.
1040 	 */
1041 	mlx_enquire(sc, MLX_CMD_ENQSYSDRIVE, sizeof(struct mlx_enq_sys_drive) * MLX_MAXDRIVES,
1042 			mlx_periodic_enquiry);
1043 
1044     }
1045 
1046     /* get drive rebuild/check status */
1047     /* XXX should check sc->mlx_background if this is only valid while in progress */
1048     mlx_enquire(sc, MLX_CMD_REBUILDSTAT, sizeof(struct mlx_rebuild_stat), mlx_periodic_rebuild);
1049 
1050     /* deal with possibly-missed interrupts and timed-out commands */
1051     mlx_done(sc);
1052 
1053     /* reschedule another poll next second or so */
1054     sc->mlx_timeout = timeout(mlx_periodic, sc, hz);
1055 }
1056 
1057 /********************************************************************************
1058  * Handle the result of an ENQUIRY command instigated by periodic status polling.
1059  */
1060 static void
1061 mlx_periodic_enquiry(struct mlx_command *mc)
1062 {
1063     struct mlx_softc		*sc = mc->mc_sc;
1064 
1065     debug_called(1);
1066 
1067     /* Command completed OK? */
1068     if (mc->mc_status != 0) {
1069 	device_printf(sc->mlx_dev, "periodic enquiry failed - %s\n", mlx_diagnose_command(mc));
1070 	goto out;
1071     }
1072 
1073     /* respond to command */
1074     switch(mc->mc_mailbox[0]) {
1075 	/*
1076 	 * This is currently a bit fruitless, as we don't know how to extract the eventlog
1077 	 * pointer yet.
1078 	 */
1079     case MLX_CMD_ENQUIRY_OLD:
1080     {
1081 	struct mlx_enquiry		*me = (struct mlx_enquiry *)mc->mc_data;
1082 	struct mlx_enquiry_old		*meo = (struct mlx_enquiry_old *)mc->mc_data;
1083 	int				i;
1084 
1085 	/* convert data in-place to new format */
1086 	for (i = (sizeof(me->me_dead) / sizeof(me->me_dead[0])) - 1; i >= 0; i--) {
1087 	    me->me_dead[i].dd_chan = meo->me_dead[i].dd_chan;
1088 	    me->me_dead[i].dd_targ = meo->me_dead[i].dd_targ;
1089 	}
1090 	me->me_misc_flags        = 0;
1091 	me->me_rebuild_count     = meo->me_rebuild_count;
1092 	me->me_dead_count        = meo->me_dead_count;
1093 	me->me_critical_sd_count = meo->me_critical_sd_count;
1094 	me->me_event_log_seq_num = 0;
1095 	me->me_offline_sd_count  = meo->me_offline_sd_count;
1096 	me->me_max_commands      = meo->me_max_commands;
1097 	me->me_rebuild_flag      = meo->me_rebuild_flag;
1098 	me->me_fwmajor           = meo->me_fwmajor;
1099 	me->me_fwminor           = meo->me_fwminor;
1100 	me->me_status_flags      = meo->me_status_flags;
1101 	me->me_flash_age         = meo->me_flash_age;
1102 	for (i = (sizeof(me->me_drvsize) / sizeof(me->me_drvsize[0])) - 1; i >= 0; i--) {
1103 	    if (i > ((sizeof(meo->me_drvsize) / sizeof(meo->me_drvsize[0])) - 1)) {
1104 		me->me_drvsize[i] = 0;		/* drive beyond supported range */
1105 	    } else {
1106 		me->me_drvsize[i] = meo->me_drvsize[i];
1107 	    }
1108 	}
1109 	me->me_num_sys_drvs = meo->me_num_sys_drvs;
1110     }
1111     /* FALLTHROUGH */
1112 
1113 	/*
1114 	 * Generic controller status update.  We could do more with this than just
1115 	 * checking the event log.
1116 	 */
1117     case MLX_CMD_ENQUIRY:
1118     {
1119 	struct mlx_enquiry		*me = (struct mlx_enquiry *)mc->mc_data;
1120 
1121 	if (sc->mlx_currevent == -1) {
1122 	    /* initialise our view of the event log */
1123 	    sc->mlx_currevent = sc->mlx_lastevent = me->me_event_log_seq_num;
1124 	} else if ((me->me_event_log_seq_num != sc->mlx_lastevent) && !(sc->mlx_flags & MLX_EVENTLOG_BUSY)) {
1125 	    /* record where current events are up to */
1126 	    sc->mlx_currevent = me->me_event_log_seq_num;
1127 	    debug(1, "event log pointer was %d, now %d\n", sc->mlx_lastevent, sc->mlx_currevent);
1128 
1129 	    /* mark the event log as busy */
1130 	    atomic_set_int(&sc->mlx_flags, MLX_EVENTLOG_BUSY);
1131 
1132 	    /* drain new eventlog entries */
1133 	    mlx_periodic_eventlog_poll(sc);
1134 	}
1135 	break;
1136     }
1137     case MLX_CMD_ENQSYSDRIVE:
1138     {
1139 	struct mlx_enq_sys_drive	*mes = (struct mlx_enq_sys_drive *)mc->mc_data;
1140 	struct mlx_sysdrive		*dr;
1141 	int				i;
1142 
1143 	for (i = 0, dr = &sc->mlx_sysdrive[0];
1144 	     (i < MLX_MAXDRIVES) && (mes[i].sd_size != 0xffffffff);
1145 	     i++) {
1146 
1147 	    /* has state been changed by controller? */
1148 	    if (dr->ms_state != mes[i].sd_state) {
1149 		switch(mes[i].sd_state) {
1150 		case MLX_SYSD_OFFLINE:
1151 		    device_printf(dr->ms_disk, "drive offline\n");
1152 		    break;
1153 		case MLX_SYSD_ONLINE:
1154 		    device_printf(dr->ms_disk, "drive online\n");
1155 		    break;
1156 		case MLX_SYSD_CRITICAL:
1157 		    device_printf(dr->ms_disk, "drive critical\n");
1158 		    break;
1159 		}
1160 		/* save new state */
1161 		dr->ms_state = mes[i].sd_state;
1162 	    }
1163 	}
1164 	break;
1165     }
1166     default:
1167 	device_printf(sc->mlx_dev, "%s: unknown command 0x%x", __func__, mc->mc_mailbox[0]);
1168 	break;
1169     }
1170 
1171  out:
1172     free(mc->mc_data, M_DEVBUF);
1173     mlx_releasecmd(mc);
1174 }
1175 
1176 /********************************************************************************
1177  * Instigate a poll for one event log message on (sc).
1178  * We only poll for one message at a time, to keep our command usage down.
1179  */
1180 static void
1181 mlx_periodic_eventlog_poll(struct mlx_softc *sc)
1182 {
1183     struct mlx_command	*mc;
1184     void		*result = NULL;
1185     int			error;
1186 
1187     debug_called(1);
1188 
1189     /* get ourselves a command buffer */
1190     error = 1;
1191     if ((mc = mlx_alloccmd(sc)) == NULL)
1192 	goto out;
1193     /* allocate the response structure */
1194     if ((result = malloc(/*sizeof(struct mlx_eventlog_entry)*/1024, M_DEVBUF, M_NOWAIT)) == NULL)
1195 	goto out;
1196     /* get a command slot */
1197     if (mlx_getslot(mc))
1198 	goto out;
1199 
1200     /* map the command so the controller can see it */
1201     mc->mc_data = result;
1202     mc->mc_length = /*sizeof(struct mlx_eventlog_entry)*/1024;
1203     mlx_mapcmd(mc);
1204 
1205     /* build the command to get one entry */
1206     mlx_make_type3(mc, MLX_CMD_LOGOP, MLX_LOGOP_GET, 1, sc->mlx_lastevent, 0, 0, mc->mc_dataphys, 0);
1207     mc->mc_complete = mlx_periodic_eventlog_respond;
1208     mc->mc_private = mc;
1209 
1210     /* start the command */
1211     if ((error = mlx_start(mc)) != 0)
1212 	goto out;
1213 
1214     error = 0;			/* success */
1215  out:
1216     if (error != 0) {
1217 	if (mc != NULL)
1218 	    mlx_releasecmd(mc);
1219 	if (result != NULL)
1220 	    free(result, M_DEVBUF);
1221     }
1222 }
1223 
1224 /********************************************************************************
1225  * Handle the result of polling for a log message, generate diagnostic output.
1226  * If this wasn't the last message waiting for us, we'll go collect another.
1227  */
1228 static char *mlx_sense_messages[] = {
1229     "because write recovery failed",
1230     "because of SCSI bus reset failure",
1231     "because of double check condition",
1232     "because it was removed",
1233     "because of gross error on SCSI chip",
1234     "because of bad tag returned from drive",
1235     "because of timeout on SCSI command",
1236     "because of reset SCSI command issued from system",
1237     "because busy or parity error count exceeded limit",
1238     "because of 'kill drive' command from system",
1239     "because of selection timeout",
1240     "due to SCSI phase sequence error",
1241     "due to unknown status"
1242 };
1243 
1244 static void
1245 mlx_periodic_eventlog_respond(struct mlx_command *mc)
1246 {
1247     struct mlx_softc		*sc = mc->mc_sc;
1248     struct mlx_eventlog_entry	*el = (struct mlx_eventlog_entry *)mc->mc_data;
1249     char			*reason;
1250 
1251     debug_called(1);
1252 
1253     sc->mlx_lastevent++;		/* next message... */
1254     if (mc->mc_status == 0) {
1255 
1256 	/* handle event log message */
1257 	switch(el->el_type) {
1258 	    /*
1259 	     * This is the only sort of message we understand at the moment.
1260 	     * The tests here are probably incomplete.
1261 	     */
1262 	case MLX_LOGMSG_SENSE:	/* sense data */
1263 	    /* Mylex vendor-specific message indicating a drive was killed? */
1264 	    if ((el->el_sensekey == 9) &&
1265 		(el->el_asc == 0x80)) {
1266 		if (el->el_asq < (sizeof(mlx_sense_messages) / sizeof(mlx_sense_messages[0]))) {
1267 		    reason = mlx_sense_messages[el->el_asq];
1268 		} else {
1269 		    reason = "for unknown reason";
1270 		}
1271 		device_printf(sc->mlx_dev, "physical drive %d:%d killed %s\n",
1272 			      el->el_channel, el->el_target, reason);
1273 	    }
1274 	    /* SCSI drive was reset? */
1275 	    if ((el->el_sensekey == 6) && (el->el_asc == 0x29)) {
1276 		device_printf(sc->mlx_dev, "physical drive %d:%d reset\n",
1277 			      el->el_channel, el->el_target);
1278 	    }
1279 	    /* SCSI drive error? */
1280 	    if (!((el->el_sensekey == 0) ||
1281 		  ((el->el_sensekey == 2) &&
1282 		   (el->el_asc == 0x04) &&
1283 		   ((el->el_asq == 0x01) ||
1284 		    (el->el_asq == 0x02))))) {
1285 		device_printf(sc->mlx_dev, "physical drive %d:%d error log: sense = %d asc = %x asq = %x\n",
1286 			      el->el_channel, el->el_target, el->el_sensekey, el->el_asc, el->el_asq);
1287 		device_printf(sc->mlx_dev, "  info %4D csi %4D\n", el->el_information, ":", el->el_csi, ":");
1288 	    }
1289 	    break;
1290 
1291 	default:
1292 	    device_printf(sc->mlx_dev, "unknown log message type 0x%x\n", el->el_type);
1293 	    break;
1294 	}
1295     } else {
1296 	device_printf(sc->mlx_dev, "error reading message log - %s\n", mlx_diagnose_command(mc));
1297 	/* give up on all the outstanding messages, as we may have come unsynched */
1298 	sc->mlx_lastevent = sc->mlx_currevent;
1299     }
1300 
1301     /* dispose of command and data */
1302     free(mc->mc_data, M_DEVBUF);
1303     mlx_releasecmd(mc);
1304 
1305     /* is there another message to obtain? */
1306     if (sc->mlx_lastevent != sc->mlx_currevent) {
1307 	mlx_periodic_eventlog_poll(sc);
1308     } else {
1309 	/* clear log-busy status */
1310 	atomic_clear_int(&sc->mlx_flags, MLX_EVENTLOG_BUSY);
1311     }
1312 }
1313 
1314 /********************************************************************************
1315  * Handle check/rebuild operations in progress.
1316  */
1317 static void
1318 mlx_periodic_rebuild(struct mlx_command *mc)
1319 {
1320     struct mlx_softc		*sc = mc->mc_sc;
1321     struct mlx_rebuild_status	*mr = (struct mlx_rebuild_status *)mc->mc_data;
1322 
1323     switch(mc->mc_status) {
1324     case 0:				/* operation running, update stats */
1325 	sc->mlx_rebuildstat = *mr;
1326 
1327 	/* spontaneous rebuild/check? */
1328 	if (sc->mlx_background == 0) {
1329 	    sc->mlx_background = MLX_BACKGROUND_SPONTANEOUS;
1330 	    device_printf(sc->mlx_dev, "background check/rebuild operation started\n");
1331 	}
1332 	break;
1333 
1334     case 0x0105:			/* nothing running, finalise stats and report */
1335 	switch(sc->mlx_background) {
1336 	case MLX_BACKGROUND_CHECK:
1337 	    device_printf(sc->mlx_dev, "consistency check completed\n");	/* XXX print drive? */
1338 	    break;
1339 	case MLX_BACKGROUND_REBUILD:
1340 	    device_printf(sc->mlx_dev, "drive rebuild completed\n");	/* XXX print channel/target? */
1341 	    break;
1342 	case MLX_BACKGROUND_SPONTANEOUS:
1343 	default:
1344 	    /* if we have previously been non-idle, report the transition */
1345 	    if (sc->mlx_rebuildstat.rs_code != MLX_REBUILDSTAT_IDLE) {
1346 		device_printf(sc->mlx_dev, "background check/rebuild operation completed\n");
1347 	    }
1348 	}
1349 	sc->mlx_background = 0;
1350 	sc->mlx_rebuildstat.rs_code = MLX_REBUILDSTAT_IDLE;
1351 	break;
1352     }
1353     free(mc->mc_data, M_DEVBUF);
1354     mlx_releasecmd(mc);
1355 }
1356 
1357 /********************************************************************************
1358  ********************************************************************************
1359                                                                     Channel Pause
1360  ********************************************************************************
1361  ********************************************************************************/
1362 
1363 /********************************************************************************
1364  * It's time to perform a channel pause action for (sc), either start or stop
1365  * the pause.
1366  */
1367 static void
1368 mlx_pause_action(struct mlx_softc *sc)
1369 {
1370     struct mlx_command	*mc;
1371     int			failsafe, i, command;
1372 
1373     /* What are we doing here? */
1374     if (sc->mlx_pause.mp_when == 0) {
1375 	command = MLX_CMD_STARTCHANNEL;
1376 	failsafe = 0;
1377 
1378     } else {
1379 	command = MLX_CMD_STOPCHANNEL;
1380 
1381 	/*
1382 	 * Channels will always start again after the failsafe period,
1383 	 * which is specified in multiples of 30 seconds.
1384 	 * This constrains us to a maximum pause of 450 seconds.
1385 	 */
1386 	failsafe = ((sc->mlx_pause.mp_howlong - time_second) + 5) / 30;
1387 	if (failsafe > 0xf) {
1388 	    failsafe = 0xf;
1389 	    sc->mlx_pause.mp_howlong = time_second + (0xf * 30) - 5;
1390 	}
1391     }
1392 
1393     /* build commands for every channel requested */
1394     for (i = 0; i < sc->mlx_enq2->me_actual_channels; i++) {
1395 	if ((1 << i) & sc->mlx_pause.mp_which) {
1396 
1397 	    /* get ourselves a command buffer */
1398 	    if ((mc = mlx_alloccmd(sc)) == NULL)
1399 		goto fail;
1400 	    /* get a command slot */
1401 	    mc->mc_flags |= MLX_CMD_PRIORITY;
1402 	    if (mlx_getslot(mc))
1403 		goto fail;
1404 
1405 	    /* build the command */
1406 	    mlx_make_type2(mc, command, (failsafe << 4) | i, 0, 0, 0, 0, 0, 0, 0);
1407 	    mc->mc_complete = mlx_pause_done;
1408 	    mc->mc_private = sc;		/* XXX not needed */
1409 	    if (mlx_start(mc))
1410 		goto fail;
1411 	    /* command submitted OK */
1412 	    return;
1413 
1414 	fail:
1415 	    device_printf(sc->mlx_dev, "%s failed for channel %d\n",
1416 			  command == MLX_CMD_STOPCHANNEL ? "pause" : "resume", i);
1417 	    if (mc != NULL)
1418 		mlx_releasecmd(mc);
1419 	}
1420     }
1421 }
1422 
1423 static void
1424 mlx_pause_done(struct mlx_command *mc)
1425 {
1426     struct mlx_softc	*sc = mc->mc_sc;
1427     int			command = mc->mc_mailbox[0];
1428     int			channel = mc->mc_mailbox[2] & 0xf;
1429 
1430     if (mc->mc_status != 0) {
1431 	device_printf(sc->mlx_dev, "%s command failed - %s\n",
1432 		      command == MLX_CMD_STOPCHANNEL ? "pause" : "resume", mlx_diagnose_command(mc));
1433     } else if (command == MLX_CMD_STOPCHANNEL) {
1434 	device_printf(sc->mlx_dev, "channel %d pausing for %ld seconds\n",
1435 		      channel, (long)(sc->mlx_pause.mp_howlong - time_second));
1436     } else {
1437 	device_printf(sc->mlx_dev, "channel %d resuming\n", channel);
1438     }
1439     mlx_releasecmd(mc);
1440 }
1441 
1442 /********************************************************************************
1443  ********************************************************************************
1444                                                                Command Submission
1445  ********************************************************************************
1446  ********************************************************************************/
1447 
1448 /********************************************************************************
1449  * Perform an Enquiry command using a type-3 command buffer and a return a single
1450  * linear result buffer.  If the completion function is specified, it will
1451  * be called with the completed command (and the result response will not be
1452  * valid until that point).  Otherwise, the command will either be busy-waited
1453  * for (interrupts not enabled), or slept for.
1454  */
1455 static void *
1456 mlx_enquire(struct mlx_softc *sc, int command, size_t bufsize, void (* complete)(struct mlx_command *mc))
1457 {
1458     struct mlx_command	*mc;
1459     void		*result;
1460     int			error;
1461 
1462     debug_called(1);
1463 
1464     /* get ourselves a command buffer */
1465     error = 1;
1466     result = NULL;
1467     if ((mc = mlx_alloccmd(sc)) == NULL)
1468 	goto out;
1469     /* allocate the response structure */
1470     if ((result = malloc(bufsize, M_DEVBUF, M_NOWAIT)) == NULL)
1471 	goto out;
1472     /* get a command slot */
1473     mc->mc_flags |= MLX_CMD_PRIORITY | MLX_CMD_DATAOUT;
1474     if (mlx_getslot(mc))
1475 	goto out;
1476 
1477     /* map the command so the controller can see it */
1478     mc->mc_data = result;
1479     mc->mc_length = bufsize;
1480     mlx_mapcmd(mc);
1481 
1482     /* build an enquiry command */
1483     mlx_make_type2(mc, command, 0, 0, 0, 0, 0, 0, mc->mc_dataphys, 0);
1484 
1485     /* do we want a completion callback? */
1486     if (complete != NULL) {
1487 	mc->mc_complete = complete;
1488 	mc->mc_private = mc;
1489 	if ((error = mlx_start(mc)) != 0)
1490 	    goto out;
1491     } else {
1492 	/* run the command in either polled or wait mode */
1493 	if ((sc->mlx_state & MLX_STATE_INTEN) ? mlx_wait_command(mc) : mlx_poll_command(mc))
1494 	    goto out;
1495 
1496 	/* command completed OK? */
1497 	if (mc->mc_status != 0) {
1498 	    device_printf(sc->mlx_dev, "ENQUIRY failed - %s\n", mlx_diagnose_command(mc));
1499 	    goto out;
1500 	}
1501     }
1502     error = 0;			/* success */
1503  out:
1504     /* we got a command, but nobody else will free it */
1505     if ((complete == NULL) && (mc != NULL))
1506 	mlx_releasecmd(mc);
1507     /* we got an error, and we allocated a result */
1508     if ((error != 0) && (result != NULL)) {
1509 	free(result, M_DEVBUF);
1510 	result = NULL;
1511     }
1512     return(result);
1513 }
1514 
1515 
1516 /********************************************************************************
1517  * Perform a Flush command on the nominated controller.
1518  *
1519  * May be called with interrupts enabled or disabled; will not return until
1520  * the flush operation completes or fails.
1521  */
1522 static int
1523 mlx_flush(struct mlx_softc *sc)
1524 {
1525     struct mlx_command	*mc;
1526     int			error;
1527 
1528     debug_called(1);
1529 
1530     /* get ourselves a command buffer */
1531     error = 1;
1532     if ((mc = mlx_alloccmd(sc)) == NULL)
1533 	goto out;
1534     /* get a command slot */
1535     if (mlx_getslot(mc))
1536 	goto out;
1537 
1538     /* build a flush command */
1539     mlx_make_type2(mc, MLX_CMD_FLUSH, 0, 0, 0, 0, 0, 0, 0, 0);
1540 
1541     /* can't assume that interrupts are going to work here, so play it safe */
1542     if (mlx_poll_command(mc))
1543 	goto out;
1544 
1545     /* command completed OK? */
1546     if (mc->mc_status != 0) {
1547 	device_printf(sc->mlx_dev, "FLUSH failed - %s\n", mlx_diagnose_command(mc));
1548 	goto out;
1549     }
1550 
1551     error = 0;			/* success */
1552  out:
1553     if (mc != NULL)
1554 	mlx_releasecmd(mc);
1555     return(error);
1556 }
1557 
1558 /********************************************************************************
1559  * Start a background consistency check on (drive).
1560  *
1561  * May be called with interrupts enabled or disabled; will return as soon as the
1562  * operation has started or been refused.
1563  */
1564 static int
1565 mlx_check(struct mlx_softc *sc, int drive)
1566 {
1567     struct mlx_command	*mc;
1568     int			error;
1569 
1570     debug_called(1);
1571 
1572     /* get ourselves a command buffer */
1573     error = 0x10000;
1574     if ((mc = mlx_alloccmd(sc)) == NULL)
1575 	goto out;
1576     /* get a command slot */
1577     if (mlx_getslot(mc))
1578 	goto out;
1579 
1580     /* build a checkasync command, set the "fix it" flag */
1581     mlx_make_type2(mc, MLX_CMD_CHECKASYNC, 0, 0, 0, 0, 0, drive | 0x80, 0, 0);
1582 
1583     /* start the command and wait for it to be returned */
1584     if (mlx_wait_command(mc))
1585 	goto out;
1586 
1587     /* command completed OK? */
1588     if (mc->mc_status != 0) {
1589 	device_printf(sc->mlx_dev, "CHECK ASYNC failed - %s\n", mlx_diagnose_command(mc));
1590     } else {
1591 	device_printf(sc->mlx_sysdrive[drive].ms_disk, "consistency check started");
1592     }
1593     error = mc->mc_status;
1594 
1595  out:
1596     if (mc != NULL)
1597 	mlx_releasecmd(mc);
1598     return(error);
1599 }
1600 
1601 /********************************************************************************
1602  * Start a background rebuild of the physical drive at (channel),(target).
1603  *
1604  * May be called with interrupts enabled or disabled; will return as soon as the
1605  * operation has started or been refused.
1606  */
1607 static int
1608 mlx_rebuild(struct mlx_softc *sc, int channel, int target)
1609 {
1610     struct mlx_command	*mc;
1611     int			error;
1612 
1613     debug_called(1);
1614 
1615     /* get ourselves a command buffer */
1616     error = 0x10000;
1617     if ((mc = mlx_alloccmd(sc)) == NULL)
1618 	goto out;
1619     /* get a command slot */
1620     if (mlx_getslot(mc))
1621 	goto out;
1622 
1623     /* build a checkasync command, set the "fix it" flag */
1624     mlx_make_type2(mc, MLX_CMD_REBUILDASYNC, channel, target, 0, 0, 0, 0, 0, 0);
1625 
1626     /* start the command and wait for it to be returned */
1627     if (mlx_wait_command(mc))
1628 	goto out;
1629 
1630     /* command completed OK? */
1631     if (mc->mc_status != 0) {
1632 	device_printf(sc->mlx_dev, "REBUILD ASYNC failed - %s\n", mlx_diagnose_command(mc));
1633     } else {
1634 	device_printf(sc->mlx_dev, "drive rebuild started for %d:%d\n", channel, target);
1635     }
1636     error = mc->mc_status;
1637 
1638  out:
1639     if (mc != NULL)
1640 	mlx_releasecmd(mc);
1641     return(error);
1642 }
1643 
1644 /********************************************************************************
1645  * Run the command (mc) and return when it completes.
1646  *
1647  * Interrupts need to be enabled; returns nonzero on error.
1648  */
1649 static int
1650 mlx_wait_command(struct mlx_command *mc)
1651 {
1652     struct mlx_softc	*sc = mc->mc_sc;
1653     int			error, count;
1654 
1655     debug_called(1);
1656 
1657     mc->mc_complete = NULL;
1658     mc->mc_private = mc;		/* wake us when you're done */
1659     if ((error = mlx_start(mc)) != 0)
1660 	return(error);
1661 
1662     count = 0;
1663     /* XXX better timeout? */
1664     while ((mc->mc_status == MLX_STATUS_BUSY) && (count < 30)) {
1665 	tsleep(mc->mc_private, PRIBIO | PCATCH, "mlxwcmd", hz);
1666     }
1667 
1668     if (mc->mc_status != 0) {
1669 	device_printf(sc->mlx_dev, "command failed - %s\n", mlx_diagnose_command(mc));
1670 	return(EIO);
1671     }
1672     return(0);
1673 }
1674 
1675 
1676 /********************************************************************************
1677  * Start the command (mc) and busy-wait for it to complete.
1678  *
1679  * Should only be used when interrupts can't be relied upon. Returns 0 on
1680  * success, nonzero on error.
1681  * Successfully completed commands are dequeued.
1682  */
1683 static int
1684 mlx_poll_command(struct mlx_command *mc)
1685 {
1686     struct mlx_softc	*sc = mc->mc_sc;
1687     int			error, count, s;
1688 
1689     debug_called(1);
1690 
1691     mc->mc_complete = NULL;
1692     mc->mc_private = NULL;	/* we will poll for it */
1693     if ((error = mlx_start(mc)) != 0)
1694 	return(error);
1695 
1696     count = 0;
1697     do {
1698 	/* poll for completion */
1699 	mlx_done(mc->mc_sc);
1700 
1701     } while ((mc->mc_status == MLX_STATUS_BUSY) && (count++ < 15000000));
1702     if (mc->mc_status != MLX_STATUS_BUSY) {
1703 	s = splbio();
1704 	TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
1705 	splx(s);
1706 	return(0);
1707     }
1708     device_printf(sc->mlx_dev, "command failed - %s\n", mlx_diagnose_command(mc));
1709     return(EIO);
1710 }
1711 
1712 /********************************************************************************
1713  * Pull as much work off the softc's work queue as possible and give it to the
1714  * controller.  Leave a couple of slots free for emergencies.
1715  *
1716  * Must be called at splbio or in an equivalent fashion that prevents
1717  * reentry or activity on the bioq.
1718  */
1719 static void
1720 mlx_startio(struct mlx_softc *sc)
1721 {
1722     struct mlx_command	*mc;
1723     struct mlxd_softc	*mlxd;
1724     mlx_bio		*bp;
1725     int			blkcount;
1726     int			driveno;
1727     int			cmd;
1728     int			s;
1729 
1730     /* avoid reentrancy */
1731     if (mlx_lock_tas(sc, MLX_LOCK_STARTING))
1732 	return;
1733 
1734     /* spin until something prevents us from doing any work */
1735     s = splbio();
1736     for (;;) {
1737 
1738 	/* see if there's work to be done */
1739 	if ((bp = MLX_BIO_QFIRST(sc->mlx_bioq)) == NULL)
1740 	    break;
1741 	/* get a command */
1742 	if ((mc = mlx_alloccmd(sc)) == NULL)
1743 	    break;
1744 	/* get a slot for the command */
1745 	if (mlx_getslot(mc) != 0) {
1746 	    mlx_releasecmd(mc);
1747 	    break;
1748 	}
1749 	/* get the buf containing our work */
1750 	MLX_BIO_QREMOVE(sc->mlx_bioq, bp);
1751 	sc->mlx_waitbufs--;
1752 	splx(s);
1753 
1754 	/* connect the buf to the command */
1755 	mc->mc_complete = mlx_completeio;
1756 	mc->mc_private = bp;
1757 	mc->mc_data = MLX_BIO_DATA(bp);
1758 	mc->mc_length = MLX_BIO_LENGTH(bp);
1759 	if (MLX_BIO_IS_READ(bp)) {
1760 	    mc->mc_flags |= MLX_CMD_DATAIN;
1761 	    cmd = MLX_CMD_READSG;
1762 	} else {
1763 	    mc->mc_flags |= MLX_CMD_DATAOUT;
1764 	    cmd = MLX_CMD_WRITESG;
1765 	}
1766 
1767 	/* map the command so the controller can work with it */
1768 	mlx_mapcmd(mc);
1769 
1770 	/* build a suitable I/O command (assumes 512-byte rounded transfers) */
1771 	mlxd = (struct mlxd_softc *)MLX_BIO_SOFTC(bp);
1772 	driveno = mlxd->mlxd_drive - sc->mlx_sysdrive;
1773 	blkcount = (MLX_BIO_LENGTH(bp) + MLX_BLKSIZE - 1) / MLX_BLKSIZE;
1774 
1775 	if ((MLX_BIO_LBA(bp) + blkcount) > sc->mlx_sysdrive[driveno].ms_size)
1776 	    device_printf(sc->mlx_dev,
1777 			  "I/O beyond end of unit (%lld,%d > %lu)\n",
1778 			  (long long)MLX_BIO_LBA(bp), blkcount,
1779 			  (u_long)sc->mlx_sysdrive[driveno].ms_size);
1780 
1781 	/*
1782 	 * Build the I/O command.  Note that the SG list type bits are set to zero,
1783 	 * denoting the format of SG list that we are using.
1784 	 */
1785 	if (sc->mlx_iftype == MLX_IFTYPE_2) {
1786 	    mlx_make_type1(mc, (cmd == MLX_CMD_WRITESG) ? MLX_CMD_WRITESG_OLD : MLX_CMD_READSG_OLD,
1787 			   blkcount & 0xff, 				/* xfer length low byte */
1788 			   MLX_BIO_LBA(bp),				/* physical block number */
1789 			   driveno,					/* target drive number */
1790 			   mc->mc_sgphys,				/* location of SG list */
1791 			   mc->mc_nsgent & 0x3f);			/* size of SG list (top 3 bits clear) */
1792 	} else {
1793 	    mlx_make_type5(mc, cmd,
1794 			   blkcount & 0xff, 				/* xfer length low byte */
1795 			   (driveno << 3) | ((blkcount >> 8) & 0x07),	/* target and length high 3 bits */
1796 			   MLX_BIO_LBA(bp),				/* physical block number */
1797 			   mc->mc_sgphys,				/* location of SG list */
1798 			   mc->mc_nsgent & 0x3f);			/* size of SG list (top 3 bits clear) */
1799 	}
1800 
1801 	/* try to give command to controller */
1802 	if (mlx_start(mc) != 0) {
1803 	    /* fail the command */
1804 	    mc->mc_status = MLX_STATUS_WEDGED;
1805 	    mlx_completeio(mc);
1806 	}
1807 	s = splbio();
1808     }
1809     splx(s);
1810     mlx_lock_clr(sc, MLX_LOCK_STARTING);
1811 }
1812 
1813 /********************************************************************************
1814  * Handle completion of an I/O command.
1815  */
1816 static void
1817 mlx_completeio(struct mlx_command *mc)
1818 {
1819     struct mlx_softc	*sc = mc->mc_sc;
1820     mlx_bio		*bp = (mlx_bio *)mc->mc_private;
1821     struct mlxd_softc	*mlxd = (struct mlxd_softc *)MLX_BIO_SOFTC(bp);
1822 
1823     if (mc->mc_status != MLX_STATUS_OK) {	/* could be more verbose here? */
1824 	MLX_BIO_SET_ERROR(bp, EIO);
1825 
1826 	switch(mc->mc_status) {
1827 	case MLX_STATUS_RDWROFFLINE:		/* system drive has gone offline */
1828 	    device_printf(mlxd->mlxd_dev, "drive offline\n");
1829 	    /* should signal this with a return code */
1830 	    mlxd->mlxd_drive->ms_state = MLX_SYSD_OFFLINE;
1831 	    break;
1832 
1833 	default:				/* other I/O error */
1834 	    device_printf(sc->mlx_dev, "I/O error - %s\n", mlx_diagnose_command(mc));
1835 #if 0
1836 	    device_printf(sc->mlx_dev, "  b_bcount %ld  blkcount %ld  b_pblkno %d\n",
1837 			  MLX_BIO_LENGTH(bp), MLX_BIO_LENGTH(bp) / MLX_BLKSIZE, MLX_BIO_LBA(bp));
1838 	    device_printf(sc->mlx_dev, "  %13D\n", mc->mc_mailbox, " ");
1839 #endif
1840 	    break;
1841 	}
1842     }
1843     mlx_releasecmd(mc);
1844     mlxd_intr(bp);
1845 }
1846 
1847 /********************************************************************************
1848  * Take a command from user-space and try to run it.
1849  *
1850  * XXX Note that this can't perform very much in the way of error checking, and
1851  *     as such, applications _must_ be considered trustworthy.
1852  * XXX Commands using S/G for data are not supported.
1853  */
1854 static int
1855 mlx_user_command(struct mlx_softc *sc, struct mlx_usercommand *mu)
1856 {
1857     struct mlx_command	*mc;
1858     struct mlx_dcdb	*dcdb;
1859     void		*kbuf;
1860     int			error;
1861 
1862     debug_called(0);
1863 
1864     kbuf = NULL;
1865     mc = NULL;
1866     dcdb = NULL;
1867     error = ENOMEM;
1868 
1869     /* get ourselves a command and copy in from user space */
1870     if ((mc = mlx_alloccmd(sc)) == NULL)
1871 	goto out;
1872     bcopy(mu->mu_command, mc->mc_mailbox, sizeof(mc->mc_mailbox));
1873     debug(0, "got command buffer");
1874 
1875     /* if we need a buffer for data transfer, allocate one and copy in its initial contents */
1876     if (mu->mu_datasize > 0) {
1877 	if (mu->mu_datasize > MAXPHYS)
1878 	    return (EINVAL);
1879 	if (((kbuf = malloc(mu->mu_datasize, M_DEVBUF, M_WAITOK)) == NULL) ||
1880 	    (error = copyin(mu->mu_buf, kbuf, mu->mu_datasize)))
1881 	    goto out;
1882 	debug(0, "got kernel buffer");
1883     }
1884 
1885     /* get a command slot */
1886     if (mlx_getslot(mc))
1887 	goto out;
1888     debug(0, "got a slot");
1889 
1890     /* map the command so the controller can see it */
1891     mc->mc_data = kbuf;
1892     mc->mc_length = mu->mu_datasize;
1893     mlx_mapcmd(mc);
1894     debug(0, "mapped");
1895 
1896     /*
1897      * If this is a passthrough SCSI command, the DCDB is packed at the
1898      * beginning of the data area.  Fix up the DCDB to point to the correct physical
1899      * address and override any bufptr supplied by the caller since we know
1900      * what it's meant to be.
1901      */
1902     if (mc->mc_mailbox[0] == MLX_CMD_DIRECT_CDB) {
1903 	dcdb = (struct mlx_dcdb *)kbuf;
1904 	dcdb->dcdb_physaddr = mc->mc_dataphys + sizeof(*dcdb);
1905 	mu->mu_bufptr = 8;
1906     }
1907 
1908     /*
1909      * If there's a data buffer, fix up the command's buffer pointer.
1910      */
1911     if (mu->mu_datasize > 0) {
1912 
1913 	/* range check the pointer to physical buffer address */
1914 	if ((mu->mu_bufptr < 0) || (mu->mu_bufptr > (sizeof(mu->mu_command) - sizeof(u_int32_t)))) {
1915 	    error = EINVAL;
1916 	    goto out;
1917 	}
1918 	mc->mc_mailbox[mu->mu_bufptr    ] =  mc->mc_dataphys        & 0xff;
1919 	mc->mc_mailbox[mu->mu_bufptr + 1] = (mc->mc_dataphys >> 8)  & 0xff;
1920 	mc->mc_mailbox[mu->mu_bufptr + 2] = (mc->mc_dataphys >> 16) & 0xff;
1921 	mc->mc_mailbox[mu->mu_bufptr + 3] = (mc->mc_dataphys >> 24) & 0xff;
1922     }
1923     debug(0, "command fixup");
1924 
1925     /* submit the command and wait */
1926     if ((error = mlx_wait_command(mc)) != 0)
1927 	goto out;
1928 
1929     /* copy out status and data */
1930     mu->mu_status = mc->mc_status;
1931     if ((mu->mu_datasize > 0) && ((error = copyout(kbuf, mu->mu_buf, mu->mu_datasize))))
1932 	goto out;
1933     error = 0;
1934 
1935  out:
1936     mlx_releasecmd(mc);
1937     if (kbuf != NULL)
1938 	free(kbuf, M_DEVBUF);
1939     return(error);
1940 }
1941 
1942 /********************************************************************************
1943  ********************************************************************************
1944                                                         Command I/O to Controller
1945  ********************************************************************************
1946  ********************************************************************************/
1947 
1948 /********************************************************************************
1949  * Find a free command slot for (mc).
1950  *
1951  * Don't hand out a slot to a normal-priority command unless there are at least
1952  * 4 slots free for priority commands.
1953  */
1954 static int
1955 mlx_getslot(struct mlx_command *mc)
1956 {
1957     struct mlx_softc	*sc = mc->mc_sc;
1958     int			s, slot, limit;
1959 
1960     debug_called(1);
1961 
1962     /*
1963      * Enforce slot-usage limit, if we have the required information.
1964      */
1965     if (sc->mlx_enq2 != NULL) {
1966 	limit = sc->mlx_enq2->me_max_commands;
1967     } else {
1968 	limit = 2;
1969     }
1970     if (sc->mlx_busycmds >= ((mc->mc_flags & MLX_CMD_PRIORITY) ? limit : limit - 4))
1971 	return(EBUSY);
1972 
1973     /*
1974      * Allocate an outstanding command slot
1975      *
1976      * XXX linear search is slow
1977      */
1978     s = splbio();
1979     for (slot = 0; slot < limit; slot++) {
1980 	debug(2, "try slot %d", slot);
1981 	if (sc->mlx_busycmd[slot] == NULL)
1982 	    break;
1983     }
1984     if (slot < limit) {
1985 	sc->mlx_busycmd[slot] = mc;
1986 	sc->mlx_busycmds++;
1987     }
1988     splx(s);
1989 
1990     /* out of slots? */
1991     if (slot >= limit)
1992 	return(EBUSY);
1993 
1994     debug(2, "got slot %d", slot);
1995     mc->mc_slot = slot;
1996     return(0);
1997 }
1998 
1999 /********************************************************************************
2000  * Map/unmap (mc)'s data in the controller's addressable space.
2001  */
2002 static void
2003 mlx_setup_dmamap(void *arg, bus_dma_segment_t *segs, int nsegments, int error)
2004 {
2005     struct mlx_command	*mc = (struct mlx_command *)arg;
2006     struct mlx_softc	*sc = mc->mc_sc;
2007     struct mlx_sgentry	*sg;
2008     int			i;
2009 
2010     debug_called(1);
2011 
2012     /* XXX should be unnecessary */
2013     if (sc->mlx_enq2 && (nsegments > sc->mlx_enq2->me_max_sg))
2014 	panic("MLX: too many s/g segments (%d, max %d)", nsegments, sc->mlx_enq2->me_max_sg);
2015 
2016     /* get base address of s/g table */
2017     sg = sc->mlx_sgtable + (mc->mc_slot * MLX_NSEG);
2018 
2019     /* save s/g table information in command */
2020     mc->mc_nsgent = nsegments;
2021     mc->mc_sgphys = sc->mlx_sgbusaddr + (mc->mc_slot * MLX_NSEG * sizeof(struct mlx_sgentry));
2022     mc->mc_dataphys = segs[0].ds_addr;
2023 
2024     /* populate s/g table */
2025     for (i = 0; i < nsegments; i++, sg++) {
2026 	sg->sg_addr = segs[i].ds_addr;
2027 	sg->sg_count = segs[i].ds_len;
2028     }
2029 }
2030 
2031 static void
2032 mlx_mapcmd(struct mlx_command *mc)
2033 {
2034     struct mlx_softc	*sc = mc->mc_sc;
2035 
2036     debug_called(1);
2037 
2038     /* if the command involves data at all */
2039     if (mc->mc_data != NULL) {
2040 
2041 	/* map the data buffer into bus space and build the s/g list */
2042 	bus_dmamap_load(sc->mlx_buffer_dmat, mc->mc_dmamap, mc->mc_data, mc->mc_length,
2043 			mlx_setup_dmamap, mc, 0);
2044 	if (mc->mc_flags & MLX_CMD_DATAIN)
2045 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_PREREAD);
2046 	if (mc->mc_flags & MLX_CMD_DATAOUT)
2047 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_PREWRITE);
2048     }
2049 }
2050 
2051 static void
2052 mlx_unmapcmd(struct mlx_command *mc)
2053 {
2054     struct mlx_softc	*sc = mc->mc_sc;
2055 
2056     debug_called(1);
2057 
2058     /* if the command involved data at all */
2059     if (mc->mc_data != NULL) {
2060 
2061 	if (mc->mc_flags & MLX_CMD_DATAIN)
2062 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_POSTREAD);
2063 	if (mc->mc_flags & MLX_CMD_DATAOUT)
2064 	    bus_dmamap_sync(sc->mlx_buffer_dmat, mc->mc_dmamap, BUS_DMASYNC_POSTWRITE);
2065 
2066 	bus_dmamap_unload(sc->mlx_buffer_dmat, mc->mc_dmamap);
2067     }
2068 }
2069 
2070 /********************************************************************************
2071  * Try to deliver (mc) to the controller.
2072  *
2073  * Can be called at any interrupt level, with or without interrupts enabled.
2074  */
2075 static int
2076 mlx_start(struct mlx_command *mc)
2077 {
2078     struct mlx_softc	*sc = mc->mc_sc;
2079     int			i, s, done;
2080 
2081     debug_called(1);
2082 
2083     /* save the slot number as ident so we can handle this command when complete */
2084     mc->mc_mailbox[0x1] = mc->mc_slot;
2085 
2086     /* mark the command as currently being processed */
2087     mc->mc_status = MLX_STATUS_BUSY;
2088 
2089     /* set a default 60-second timeout  XXX tunable?  XXX not currently used */
2090     mc->mc_timeout = time_second + 60;
2091 
2092     /* spin waiting for the mailbox */
2093     for (i = 100000, done = 0; (i > 0) && !done; i--) {
2094 	s = splbio();
2095 	if (sc->mlx_tryqueue(sc, mc)) {
2096 	    done = 1;
2097 	    /* move command to work queue */
2098 	    TAILQ_INSERT_TAIL(&sc->mlx_work, mc, mc_link);
2099 	}
2100 	splx(s);	/* drop spl to allow completion interrupts */
2101     }
2102 
2103     /* command is enqueued */
2104     if (done)
2105 	return(0);
2106 
2107     /*
2108      * We couldn't get the controller to take the command.  Revoke the slot
2109      * that the command was given and return it with a bad status.
2110      */
2111     sc->mlx_busycmd[mc->mc_slot] = NULL;
2112     device_printf(sc->mlx_dev, "controller wedged (not taking commands)\n");
2113     mc->mc_status = MLX_STATUS_WEDGED;
2114     mlx_complete(sc);
2115     return(EIO);
2116 }
2117 
2118 /********************************************************************************
2119  * Poll the controller (sc) for completed commands.
2120  * Update command status and free slots for reuse.  If any slots were freed,
2121  * new commands may be posted.
2122  *
2123  * Returns nonzero if one or more commands were completed.
2124  */
2125 static int
2126 mlx_done(struct mlx_softc *sc)
2127 {
2128     struct mlx_command	*mc;
2129     int			s, result;
2130     u_int8_t		slot;
2131     u_int16_t		status;
2132 
2133     debug_called(2);
2134 
2135     result = 0;
2136 
2137     /* loop collecting completed commands */
2138     s = splbio();
2139     for (;;) {
2140 	/* poll for a completed command's identifier and status */
2141 	if (sc->mlx_findcomplete(sc, &slot, &status)) {
2142 	    result = 1;
2143 	    mc = sc->mlx_busycmd[slot];			/* find command */
2144 	    if (mc != NULL) {				/* paranoia */
2145 		if (mc->mc_status == MLX_STATUS_BUSY) {
2146 		    mc->mc_status = status;		/* save status */
2147 
2148 		    /* free slot for reuse */
2149 		    sc->mlx_busycmd[slot] = NULL;
2150 		    sc->mlx_busycmds--;
2151 		} else {
2152 		    device_printf(sc->mlx_dev, "duplicate done event for slot %d\n", slot);
2153 		}
2154 	    } else {
2155 		device_printf(sc->mlx_dev, "done event for nonbusy slot %d\n", slot);
2156 	    }
2157 	} else {
2158 	    break;
2159 	}
2160     }
2161     splx(s);
2162 
2163     /* if we've completed any commands, try posting some more */
2164     if (result)
2165 	mlx_startio(sc);
2166 
2167     /* handle completion and timeouts */
2168     mlx_complete(sc);
2169 
2170     return(result);
2171 }
2172 
2173 /********************************************************************************
2174  * Perform post-completion processing for commands on (sc).
2175  */
2176 static void
2177 mlx_complete(struct mlx_softc *sc)
2178 {
2179     struct mlx_command	*mc, *nc;
2180     int			s, count;
2181 
2182     debug_called(2);
2183 
2184     /* avoid reentrancy  XXX might want to signal and request a restart */
2185     if (mlx_lock_tas(sc, MLX_LOCK_COMPLETING))
2186 	return;
2187 
2188     s = splbio();
2189     count = 0;
2190 
2191     /* scan the list of busy/done commands */
2192     mc = TAILQ_FIRST(&sc->mlx_work);
2193     while (mc != NULL) {
2194 	nc = TAILQ_NEXT(mc, mc_link);
2195 
2196 	/* Command has been completed in some fashion */
2197 	if (mc->mc_status != MLX_STATUS_BUSY) {
2198 
2199 	    /* unmap the command's data buffer */
2200 	    mlx_unmapcmd(mc);
2201 	    /*
2202 	     * Does the command have a completion handler?
2203 	     */
2204 	    if (mc->mc_complete != NULL) {
2205 		/* remove from list and give to handler */
2206 		TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
2207 		mc->mc_complete(mc);
2208 
2209 		/*
2210 		 * Is there a sleeper waiting on this command?
2211 		 */
2212 	    } else if (mc->mc_private != NULL) {	/* sleeping caller wants to know about it */
2213 
2214 		/* remove from list and wake up sleeper */
2215 		TAILQ_REMOVE(&sc->mlx_work, mc, mc_link);
2216 		wakeup_one(mc->mc_private);
2217 
2218 		/*
2219 		 * Leave the command for a caller that's polling for it.
2220 		 */
2221 	    } else {
2222 	    }
2223 	}
2224 	mc = nc;
2225     }
2226     splx(s);
2227 
2228     mlx_lock_clr(sc, MLX_LOCK_COMPLETING);
2229 }
2230 
2231 /********************************************************************************
2232  ********************************************************************************
2233                                                         Command Buffer Management
2234  ********************************************************************************
2235  ********************************************************************************/
2236 
2237 /********************************************************************************
2238  * Get a new command buffer.
2239  *
2240  * This may return NULL in low-memory cases.
2241  *
2242  * Note that using malloc() is expensive (the command buffer is << 1 page) but
2243  * necessary if we are to be a loadable module before the zone allocator is fixed.
2244  *
2245  * If possible, we recycle a command buffer that's been used before.
2246  *
2247  * XXX Note that command buffers are not cleaned out - it is the caller's
2248  *     responsibility to ensure that all required fields are filled in before
2249  *     using a buffer.
2250  */
2251 static struct mlx_command *
2252 mlx_alloccmd(struct mlx_softc *sc)
2253 {
2254     struct mlx_command	*mc;
2255     int			error;
2256     int			s;
2257 
2258     debug_called(1);
2259 
2260     s = splbio();
2261     if ((mc = TAILQ_FIRST(&sc->mlx_freecmds)) != NULL)
2262 	TAILQ_REMOVE(&sc->mlx_freecmds, mc, mc_link);
2263     splx(s);
2264 
2265     /* allocate a new command buffer? */
2266     if (mc == NULL) {
2267 	mc = (struct mlx_command *)malloc(sizeof(*mc), M_DEVBUF, M_NOWAIT | M_ZERO);
2268 	if (mc != NULL) {
2269 	    mc->mc_sc = sc;
2270 	    error = bus_dmamap_create(sc->mlx_buffer_dmat, 0, &mc->mc_dmamap);
2271 	    if (error) {
2272 		free(mc, M_DEVBUF);
2273 		return(NULL);
2274 	    }
2275 	}
2276     }
2277     return(mc);
2278 }
2279 
2280 /********************************************************************************
2281  * Release a command buffer for recycling.
2282  *
2283  * XXX It might be a good idea to limit the number of commands we save for reuse
2284  *     if it's shown that this list bloats out massively.
2285  */
2286 static void
2287 mlx_releasecmd(struct mlx_command *mc)
2288 {
2289     int		s;
2290 
2291     debug_called(1);
2292 
2293     s = splbio();
2294     TAILQ_INSERT_HEAD(&mc->mc_sc->mlx_freecmds, mc, mc_link);
2295     splx(s);
2296 }
2297 
2298 /********************************************************************************
2299  * Permanently discard a command buffer.
2300  */
2301 static void
2302 mlx_freecmd(struct mlx_command *mc)
2303 {
2304     struct mlx_softc	*sc = mc->mc_sc;
2305 
2306     debug_called(1);
2307     bus_dmamap_destroy(sc->mlx_buffer_dmat, mc->mc_dmamap);
2308     free(mc, M_DEVBUF);
2309 }
2310 
2311 
2312 /********************************************************************************
2313  ********************************************************************************
2314                                                 Type 3 interface accessor methods
2315  ********************************************************************************
2316  ********************************************************************************/
2317 
2318 /********************************************************************************
2319  * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2320  * (the controller is not ready to take a command).
2321  *
2322  * Must be called at splbio or in a fashion that prevents reentry.
2323  */
2324 static int
2325 mlx_v3_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2326 {
2327     int		i;
2328 
2329     debug_called(2);
2330 
2331     /* ready for our command? */
2332     if (!(MLX_V3_GET_IDBR(sc) & MLX_V3_IDB_FULL)) {
2333 	/* copy mailbox data to window */
2334 	for (i = 0; i < 13; i++)
2335 	    MLX_V3_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2336 
2337 	/* post command */
2338 	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_FULL);
2339 	return(1);
2340     }
2341     return(0);
2342 }
2343 
2344 /********************************************************************************
2345  * See if a command has been completed, if so acknowledge its completion
2346  * and recover the slot number and status code.
2347  *
2348  * Must be called at splbio or in a fashion that prevents reentry.
2349  */
2350 static int
2351 mlx_v3_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2352 {
2353 
2354     debug_called(2);
2355 
2356     /* status available? */
2357     if (MLX_V3_GET_ODBR(sc) & MLX_V3_ODB_SAVAIL) {
2358 	*slot = MLX_V3_GET_STATUS_IDENT(sc);		/* get command identifier */
2359 	*status = MLX_V3_GET_STATUS(sc);		/* get status */
2360 
2361 	/* acknowledge completion */
2362 	MLX_V3_PUT_ODBR(sc, MLX_V3_ODB_SAVAIL);
2363 	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_SACK);
2364 	return(1);
2365     }
2366     return(0);
2367 }
2368 
2369 /********************************************************************************
2370  * Enable/disable interrupts as requested. (No acknowledge required)
2371  *
2372  * Must be called at splbio or in a fashion that prevents reentry.
2373  */
2374 static void
2375 mlx_v3_intaction(struct mlx_softc *sc, int action)
2376 {
2377     debug_called(1);
2378 
2379     switch(action) {
2380     case MLX_INTACTION_DISABLE:
2381 	MLX_V3_PUT_IER(sc, 0);
2382 	sc->mlx_state &= ~MLX_STATE_INTEN;
2383 	break;
2384     case MLX_INTACTION_ENABLE:
2385 	MLX_V3_PUT_IER(sc, 1);
2386 	sc->mlx_state |= MLX_STATE_INTEN;
2387 	break;
2388     }
2389 }
2390 
2391 /********************************************************************************
2392  * Poll for firmware error codes during controller initialisation.
2393  * Returns 0 if initialisation is complete, 1 if still in progress but no
2394  * error has been fetched, 2 if an error has been retrieved.
2395  */
2396 static int
2397 mlx_v3_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2)
2398 {
2399     u_int8_t	fwerror;
2400     static int	initted = 0;
2401 
2402     debug_called(2);
2403 
2404     /* first time around, clear any hardware completion status */
2405     if (!initted) {
2406 	MLX_V3_PUT_IDBR(sc, MLX_V3_IDB_SACK);
2407 	DELAY(1000);
2408 	initted = 1;
2409     }
2410 
2411     /* init in progress? */
2412     if (!(MLX_V3_GET_IDBR(sc) & MLX_V3_IDB_INIT_BUSY))
2413 	return(0);
2414 
2415     /* test error value */
2416     fwerror = MLX_V3_GET_FWERROR(sc);
2417     if (!(fwerror & MLX_V3_FWERROR_PEND))
2418 	return(1);
2419 
2420     /* mask status pending bit, fetch status */
2421     *error = fwerror & ~MLX_V3_FWERROR_PEND;
2422     *param1 = MLX_V3_GET_FWERROR_PARAM1(sc);
2423     *param2 = MLX_V3_GET_FWERROR_PARAM2(sc);
2424 
2425     /* acknowledge */
2426     MLX_V3_PUT_FWERROR(sc, 0);
2427 
2428     return(2);
2429 }
2430 
2431 /********************************************************************************
2432  ********************************************************************************
2433                                                 Type 4 interface accessor methods
2434  ********************************************************************************
2435  ********************************************************************************/
2436 
2437 /********************************************************************************
2438  * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2439  * (the controller is not ready to take a command).
2440  *
2441  * Must be called at splbio or in a fashion that prevents reentry.
2442  */
2443 static int
2444 mlx_v4_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2445 {
2446     int		i;
2447 
2448     debug_called(2);
2449 
2450     /* ready for our command? */
2451     if (!(MLX_V4_GET_IDBR(sc) & MLX_V4_IDB_FULL)) {
2452 	/* copy mailbox data to window */
2453 	for (i = 0; i < 13; i++)
2454 	    MLX_V4_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2455 
2456 	/* memory-mapped controller, so issue a write barrier to ensure the mailbox is filled */
2457 	bus_space_barrier(sc->mlx_btag, sc->mlx_bhandle, MLX_V4_MAILBOX, MLX_V4_MAILBOX_LENGTH,
2458 			  BUS_SPACE_BARRIER_WRITE);
2459 
2460 	/* post command */
2461 	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_HWMBOX_CMD);
2462 	return(1);
2463     }
2464     return(0);
2465 }
2466 
2467 /********************************************************************************
2468  * See if a command has been completed, if so acknowledge its completion
2469  * and recover the slot number and status code.
2470  *
2471  * Must be called at splbio or in a fashion that prevents reentry.
2472  */
2473 static int
2474 mlx_v4_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2475 {
2476 
2477     debug_called(2);
2478 
2479     /* status available? */
2480     if (MLX_V4_GET_ODBR(sc) & MLX_V4_ODB_HWSAVAIL) {
2481 	*slot = MLX_V4_GET_STATUS_IDENT(sc);		/* get command identifier */
2482 	*status = MLX_V4_GET_STATUS(sc);		/* get status */
2483 
2484 	/* acknowledge completion */
2485 	MLX_V4_PUT_ODBR(sc, MLX_V4_ODB_HWMBOX_ACK);
2486 	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_SACK);
2487 	return(1);
2488     }
2489     return(0);
2490 }
2491 
2492 /********************************************************************************
2493  * Enable/disable interrupts as requested.
2494  *
2495  * Must be called at splbio or in a fashion that prevents reentry.
2496  */
2497 static void
2498 mlx_v4_intaction(struct mlx_softc *sc, int action)
2499 {
2500     debug_called(1);
2501 
2502     switch(action) {
2503     case MLX_INTACTION_DISABLE:
2504 	MLX_V4_PUT_IER(sc, MLX_V4_IER_MASK | MLX_V4_IER_DISINT);
2505 	sc->mlx_state &= ~MLX_STATE_INTEN;
2506 	break;
2507     case MLX_INTACTION_ENABLE:
2508 	MLX_V4_PUT_IER(sc, MLX_V4_IER_MASK & ~MLX_V4_IER_DISINT);
2509 	sc->mlx_state |= MLX_STATE_INTEN;
2510 	break;
2511     }
2512 }
2513 
2514 /********************************************************************************
2515  * Poll for firmware error codes during controller initialisation.
2516  * Returns 0 if initialisation is complete, 1 if still in progress but no
2517  * error has been fetched, 2 if an error has been retrieved.
2518  */
2519 static int
2520 mlx_v4_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2)
2521 {
2522     u_int8_t	fwerror;
2523     static int	initted = 0;
2524 
2525     debug_called(2);
2526 
2527     /* first time around, clear any hardware completion status */
2528     if (!initted) {
2529 	MLX_V4_PUT_IDBR(sc, MLX_V4_IDB_SACK);
2530 	DELAY(1000);
2531 	initted = 1;
2532     }
2533 
2534     /* init in progress? */
2535     if (!(MLX_V4_GET_IDBR(sc) & MLX_V4_IDB_INIT_BUSY))
2536 	return(0);
2537 
2538     /* test error value */
2539     fwerror = MLX_V4_GET_FWERROR(sc);
2540     if (!(fwerror & MLX_V4_FWERROR_PEND))
2541 	return(1);
2542 
2543     /* mask status pending bit, fetch status */
2544     *error = fwerror & ~MLX_V4_FWERROR_PEND;
2545     *param1 = MLX_V4_GET_FWERROR_PARAM1(sc);
2546     *param2 = MLX_V4_GET_FWERROR_PARAM2(sc);
2547 
2548     /* acknowledge */
2549     MLX_V4_PUT_FWERROR(sc, 0);
2550 
2551     return(2);
2552 }
2553 
2554 /********************************************************************************
2555  ********************************************************************************
2556                                                 Type 5 interface accessor methods
2557  ********************************************************************************
2558  ********************************************************************************/
2559 
2560 /********************************************************************************
2561  * Try to give (mc) to the controller.  Returns 1 if successful, 0 on failure
2562  * (the controller is not ready to take a command).
2563  *
2564  * Must be called at splbio or in a fashion that prevents reentry.
2565  */
2566 static int
2567 mlx_v5_tryqueue(struct mlx_softc *sc, struct mlx_command *mc)
2568 {
2569     int		i;
2570 
2571     debug_called(2);
2572 
2573     /* ready for our command? */
2574     if (MLX_V5_GET_IDBR(sc) & MLX_V5_IDB_EMPTY) {
2575 	/* copy mailbox data to window */
2576 	for (i = 0; i < 13; i++)
2577 	    MLX_V5_PUT_MAILBOX(sc, i, mc->mc_mailbox[i]);
2578 
2579 	/* post command */
2580 	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_HWMBOX_CMD);
2581 	return(1);
2582     }
2583     return(0);
2584 }
2585 
2586 /********************************************************************************
2587  * See if a command has been completed, if so acknowledge its completion
2588  * and recover the slot number and status code.
2589  *
2590  * Must be called at splbio or in a fashion that prevents reentry.
2591  */
2592 static int
2593 mlx_v5_findcomplete(struct mlx_softc *sc, u_int8_t *slot, u_int16_t *status)
2594 {
2595 
2596     debug_called(2);
2597 
2598     /* status available? */
2599     if (MLX_V5_GET_ODBR(sc) & MLX_V5_ODB_HWSAVAIL) {
2600 	*slot = MLX_V5_GET_STATUS_IDENT(sc);		/* get command identifier */
2601 	*status = MLX_V5_GET_STATUS(sc);		/* get status */
2602 
2603 	/* acknowledge completion */
2604 	MLX_V5_PUT_ODBR(sc, MLX_V5_ODB_HWMBOX_ACK);
2605 	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_SACK);
2606 	return(1);
2607     }
2608     return(0);
2609 }
2610 
2611 /********************************************************************************
2612  * Enable/disable interrupts as requested.
2613  *
2614  * Must be called at splbio or in a fashion that prevents reentry.
2615  */
2616 static void
2617 mlx_v5_intaction(struct mlx_softc *sc, int action)
2618 {
2619     debug_called(1);
2620 
2621     switch(action) {
2622     case MLX_INTACTION_DISABLE:
2623 	MLX_V5_PUT_IER(sc, 0xff & MLX_V5_IER_DISINT);
2624 	sc->mlx_state &= ~MLX_STATE_INTEN;
2625 	break;
2626     case MLX_INTACTION_ENABLE:
2627 	MLX_V5_PUT_IER(sc, 0xff & ~MLX_V5_IER_DISINT);
2628 	sc->mlx_state |= MLX_STATE_INTEN;
2629 	break;
2630     }
2631 }
2632 
2633 /********************************************************************************
2634  * Poll for firmware error codes during controller initialisation.
2635  * Returns 0 if initialisation is complete, 1 if still in progress but no
2636  * error has been fetched, 2 if an error has been retrieved.
2637  */
2638 static int
2639 mlx_v5_fw_handshake(struct mlx_softc *sc, int *error, int *param1, int *param2)
2640 {
2641     u_int8_t	fwerror;
2642     static int	initted = 0;
2643 
2644     debug_called(2);
2645 
2646     /* first time around, clear any hardware completion status */
2647     if (!initted) {
2648 	MLX_V5_PUT_IDBR(sc, MLX_V5_IDB_SACK);
2649 	DELAY(1000);
2650 	initted = 1;
2651     }
2652 
2653     /* init in progress? */
2654     if (MLX_V5_GET_IDBR(sc) & MLX_V5_IDB_INIT_DONE)
2655 	return(0);
2656 
2657     /* test for error value */
2658     fwerror = MLX_V5_GET_FWERROR(sc);
2659     if (!(fwerror & MLX_V5_FWERROR_PEND))
2660 	return(1);
2661 
2662     /* mask status pending bit, fetch status */
2663     *error = fwerror & ~MLX_V5_FWERROR_PEND;
2664     *param1 = MLX_V5_GET_FWERROR_PARAM1(sc);
2665     *param2 = MLX_V5_GET_FWERROR_PARAM2(sc);
2666 
2667     /* acknowledge */
2668     MLX_V5_PUT_FWERROR(sc, 0xff);
2669 
2670     return(2);
2671 }
2672 
2673 /********************************************************************************
2674  ********************************************************************************
2675                                                                         Debugging
2676  ********************************************************************************
2677  ********************************************************************************/
2678 
2679 /********************************************************************************
2680  * Return a status message describing (mc)
2681  */
2682 static char *mlx_status_messages[] = {
2683     "normal completion",			/* 00 */
2684     "irrecoverable data error",			/* 01 */
2685     "drive does not exist, or is offline",	/* 02 */
2686     "attempt to write beyond end of drive",	/* 03 */
2687     "bad data encountered",			/* 04 */
2688     "invalid log entry request",		/* 05 */
2689     "attempt to rebuild online drive",		/* 06 */
2690     "new disk failed during rebuild",		/* 07 */
2691     "invalid channel/target",			/* 08 */
2692     "rebuild/check already in progress",	/* 09 */
2693     "one or more disks are dead",		/* 10 */
2694     "invalid or non-redundant drive",		/* 11 */
2695     "channel is busy",				/* 12 */
2696     "channel is not stopped",			/* 13 */
2697     "rebuild successfully terminated",		/* 14 */
2698     "unsupported command",			/* 15 */
2699     "check condition received",			/* 16 */
2700     "device is busy",				/* 17 */
2701     "selection or command timeout",		/* 18 */
2702     "command terminated abnormally",		/* 19 */
2703     ""
2704 };
2705 
2706 static struct
2707 {
2708     int		command;
2709     u_int16_t	status;
2710     int		msg;
2711 } mlx_messages[] = {
2712     {MLX_CMD_READSG,		0x0001,	 1},
2713     {MLX_CMD_READSG,		0x0002,	 1},
2714     {MLX_CMD_READSG,		0x0105,	 3},
2715     {MLX_CMD_READSG,		0x010c,	 4},
2716     {MLX_CMD_WRITESG,		0x0001,	 1},
2717     {MLX_CMD_WRITESG,		0x0002,	 1},
2718     {MLX_CMD_WRITESG,		0x0105,	 3},
2719     {MLX_CMD_READSG_OLD,	0x0001,	 1},
2720     {MLX_CMD_READSG_OLD,	0x0002,	 1},
2721     {MLX_CMD_READSG_OLD,	0x0105,	 3},
2722     {MLX_CMD_WRITESG_OLD,	0x0001,	 1},
2723     {MLX_CMD_WRITESG_OLD,	0x0002,	 1},
2724     {MLX_CMD_WRITESG_OLD,	0x0105,	 3},
2725     {MLX_CMD_LOGOP,		0x0105,	 5},
2726     {MLX_CMD_REBUILDASYNC,	0x0002,  6},
2727     {MLX_CMD_REBUILDASYNC,	0x0004,  7},
2728     {MLX_CMD_REBUILDASYNC,	0x0105,  8},
2729     {MLX_CMD_REBUILDASYNC,	0x0106,  9},
2730     {MLX_CMD_REBUILDASYNC,	0x0107, 14},
2731     {MLX_CMD_CHECKASYNC,	0x0002, 10},
2732     {MLX_CMD_CHECKASYNC,	0x0105, 11},
2733     {MLX_CMD_CHECKASYNC,	0x0106,  9},
2734     {MLX_CMD_STOPCHANNEL,	0x0106, 12},
2735     {MLX_CMD_STOPCHANNEL,	0x0105,  8},
2736     {MLX_CMD_STARTCHANNEL,	0x0005, 13},
2737     {MLX_CMD_STARTCHANNEL,	0x0105,  8},
2738     {MLX_CMD_DIRECT_CDB,	0x0002, 16},
2739     {MLX_CMD_DIRECT_CDB,	0x0008, 17},
2740     {MLX_CMD_DIRECT_CDB,	0x000e, 18},
2741     {MLX_CMD_DIRECT_CDB,	0x000f, 19},
2742     {MLX_CMD_DIRECT_CDB,	0x0105,  8},
2743 
2744     {0,				0x0104, 14},
2745     {-1, 0, 0}
2746 };
2747 
2748 static char *
2749 mlx_diagnose_command(struct mlx_command *mc)
2750 {
2751     static char	unkmsg[80];
2752     int		i;
2753 
2754     /* look up message in table */
2755     for (i = 0; mlx_messages[i].command != -1; i++)
2756 	if (((mc->mc_mailbox[0] == mlx_messages[i].command) || (mlx_messages[i].command == 0)) &&
2757 	    (mc->mc_status == mlx_messages[i].status))
2758 	    return(mlx_status_messages[mlx_messages[i].msg]);
2759 
2760     sprintf(unkmsg, "unknown response 0x%x for command 0x%x", (int)mc->mc_status, (int)mc->mc_mailbox[0]);
2761     return(unkmsg);
2762 }
2763 
2764 /*******************************************************************************
2765  * Print a string describing the controller (sc)
2766  */
2767 static struct
2768 {
2769     int		hwid;
2770     char	*name;
2771 } mlx_controller_names[] = {
2772     {0x01,	"960P/PD"},
2773     {0x02,	"960PL"},
2774     {0x10,	"960PG"},
2775     {0x11,	"960PJ"},
2776     {0x12,	"960PR"},
2777     {0x13,	"960PT"},
2778     {0x14,	"960PTL0"},
2779     {0x15,	"960PRL"},
2780     {0x16,	"960PTL1"},
2781     {0x20,	"1164PVX"},
2782     {-1, NULL}
2783 };
2784 
2785 static void
2786 mlx_describe_controller(struct mlx_softc *sc)
2787 {
2788     static char		buf[80];
2789     char		*model;
2790     int			i;
2791 
2792     for (i = 0, model = NULL; mlx_controller_names[i].name != NULL; i++) {
2793 	if ((sc->mlx_enq2->me_hardware_id & 0xff) == mlx_controller_names[i].hwid) {
2794 	    model = mlx_controller_names[i].name;
2795 	    break;
2796 	}
2797     }
2798     if (model == NULL) {
2799 	sprintf(buf, " model 0x%x", sc->mlx_enq2->me_hardware_id & 0xff);
2800 	model = buf;
2801     }
2802     device_printf(sc->mlx_dev, "DAC%s, %d channel%s, firmware %d.%02d-%c-%02d, %dMB RAM\n",
2803 		  model,
2804 		  sc->mlx_enq2->me_actual_channels,
2805 		  sc->mlx_enq2->me_actual_channels > 1 ? "s" : "",
2806 		  sc->mlx_enq2->me_firmware_id & 0xff,
2807 		  (sc->mlx_enq2->me_firmware_id >> 8) & 0xff,
2808 		  (sc->mlx_enq2->me_firmware_id >> 24) & 0xff,
2809 		  (sc->mlx_enq2->me_firmware_id >> 16) & 0xff,
2810 		  sc->mlx_enq2->me_mem_size / (1024 * 1024));
2811 
2812     if (bootverbose) {
2813 	device_printf(sc->mlx_dev, "  Hardware ID                 0x%08x\n", sc->mlx_enq2->me_hardware_id);
2814 	device_printf(sc->mlx_dev, "  Firmware ID                 0x%08x\n", sc->mlx_enq2->me_firmware_id);
2815 	device_printf(sc->mlx_dev, "  Configured/Actual channels  %d/%d\n", sc->mlx_enq2->me_configured_channels,
2816 		      sc->mlx_enq2->me_actual_channels);
2817 	device_printf(sc->mlx_dev, "  Max Targets                 %d\n", sc->mlx_enq2->me_max_targets);
2818 	device_printf(sc->mlx_dev, "  Max Tags                    %d\n", sc->mlx_enq2->me_max_tags);
2819 	device_printf(sc->mlx_dev, "  Max System Drives           %d\n", sc->mlx_enq2->me_max_sys_drives);
2820 	device_printf(sc->mlx_dev, "  Max Arms                    %d\n", sc->mlx_enq2->me_max_arms);
2821 	device_printf(sc->mlx_dev, "  Max Spans                   %d\n", sc->mlx_enq2->me_max_spans);
2822 	device_printf(sc->mlx_dev, "  DRAM/cache/flash/NVRAM size %d/%d/%d/%d\n", sc->mlx_enq2->me_mem_size,
2823 		      sc->mlx_enq2->me_cache_size, sc->mlx_enq2->me_flash_size, sc->mlx_enq2->me_nvram_size);
2824 	device_printf(sc->mlx_dev, "  DRAM type                   %d\n", sc->mlx_enq2->me_mem_type);
2825 	device_printf(sc->mlx_dev, "  Clock Speed                 %dns\n", sc->mlx_enq2->me_clock_speed);
2826 	device_printf(sc->mlx_dev, "  Hardware Speed              %dns\n", sc->mlx_enq2->me_hardware_speed);
2827 	device_printf(sc->mlx_dev, "  Max Commands                %d\n", sc->mlx_enq2->me_max_commands);
2828 	device_printf(sc->mlx_dev, "  Max SG Entries              %d\n", sc->mlx_enq2->me_max_sg);
2829 	device_printf(sc->mlx_dev, "  Max DP                      %d\n", sc->mlx_enq2->me_max_dp);
2830 	device_printf(sc->mlx_dev, "  Max IOD                     %d\n", sc->mlx_enq2->me_max_iod);
2831 	device_printf(sc->mlx_dev, "  Max Comb                    %d\n", sc->mlx_enq2->me_max_comb);
2832 	device_printf(sc->mlx_dev, "  Latency                     %ds\n", sc->mlx_enq2->me_latency);
2833 	device_printf(sc->mlx_dev, "  SCSI Timeout                %ds\n", sc->mlx_enq2->me_scsi_timeout);
2834 	device_printf(sc->mlx_dev, "  Min Free Lines              %d\n", sc->mlx_enq2->me_min_freelines);
2835 	device_printf(sc->mlx_dev, "  Rate Constant               %d\n", sc->mlx_enq2->me_rate_const);
2836 	device_printf(sc->mlx_dev, "  MAXBLK                      %d\n", sc->mlx_enq2->me_maxblk);
2837 	device_printf(sc->mlx_dev, "  Blocking Factor             %d sectors\n", sc->mlx_enq2->me_blocking_factor);
2838 	device_printf(sc->mlx_dev, "  Cache Line Size             %d blocks\n", sc->mlx_enq2->me_cacheline);
2839 	device_printf(sc->mlx_dev, "  SCSI Capability             %s%dMHz, %d bit\n",
2840 		      sc->mlx_enq2->me_scsi_cap & (1<<4) ? "differential " : "",
2841 		      (1 << ((sc->mlx_enq2->me_scsi_cap >> 2) & 3)) * 10,
2842 		      8 << (sc->mlx_enq2->me_scsi_cap & 0x3));
2843 	device_printf(sc->mlx_dev, "  Firmware Build Number       %d\n", sc->mlx_enq2->me_firmware_build);
2844 	device_printf(sc->mlx_dev, "  Fault Management Type       %d\n", sc->mlx_enq2->me_fault_mgmt_type);
2845 	device_printf(sc->mlx_dev, "  Features                    %b\n", sc->mlx_enq2->me_firmware_features,
2846 		      "\20\4Background Init\3Read Ahead\2MORE\1Cluster\n");
2847 
2848     }
2849 }
2850 
2851 /*******************************************************************************
2852  * Emit a string describing the firmware handshake status code, and return a flag
2853  * indicating whether the code represents a fatal error.
2854  *
2855  * Error code interpretations are from the Linux driver, and don't directly match
2856  * the messages printed by Mylex's BIOS.  This may change if documentation on the
2857  * codes is forthcoming.
2858  */
2859 static int
2860 mlx_fw_message(struct mlx_softc *sc, int error, int param1, int param2)
2861 {
2862     switch(error) {
2863     case 0x00:
2864 	device_printf(sc->mlx_dev, "physical drive %d:%d not responding\n", param2, param1);
2865 	break;
2866     case 0x08:
2867 	/* we could be neater about this and give some indication when we receive more of them */
2868 	if (!(sc->mlx_flags & MLX_SPINUP_REPORTED)) {
2869 	    device_printf(sc->mlx_dev, "spinning up drives...\n");
2870 	    sc->mlx_flags |= MLX_SPINUP_REPORTED;
2871 	}
2872 	break;
2873     case 0x30:
2874 	device_printf(sc->mlx_dev, "configuration checksum error\n");
2875 	break;
2876     case 0x60:
2877 	device_printf(sc->mlx_dev, "mirror race recovery failed\n");
2878 	break;
2879     case 0x70:
2880 	device_printf(sc->mlx_dev, "mirror race recovery in progress\n");
2881 	break;
2882     case 0x90:
2883 	device_printf(sc->mlx_dev, "physical drive %d:%d COD mismatch\n", param2, param1);
2884 	break;
2885     case 0xa0:
2886 	device_printf(sc->mlx_dev, "logical drive installation aborted\n");
2887 	break;
2888     case 0xb0:
2889 	device_printf(sc->mlx_dev, "mirror race on a critical system drive\n");
2890 	break;
2891     case 0xd0:
2892 	device_printf(sc->mlx_dev, "new controller configuration found\n");
2893 	break;
2894     case 0xf0:
2895 	device_printf(sc->mlx_dev, "FATAL MEMORY PARITY ERROR\n");
2896 	return(1);
2897     default:
2898 	device_printf(sc->mlx_dev, "unknown firmware initialisation error %02x:%02x:%02x\n", error, param1, param2);
2899 	break;
2900     }
2901     return(0);
2902 }
2903 
2904 /********************************************************************************
2905  ********************************************************************************
2906                                                                 Utility Functions
2907  ********************************************************************************
2908  ********************************************************************************/
2909 
2910 /********************************************************************************
2911  * Find the disk whose unit number is (unit) on this controller
2912  */
2913 static struct mlx_sysdrive *
2914 mlx_findunit(struct mlx_softc *sc, int unit)
2915 {
2916     int		i;
2917 
2918     /* search system drives */
2919     for (i = 0; i < MLX_MAXDRIVES; i++) {
2920 	/* is this one attached? */
2921 	if (sc->mlx_sysdrive[i].ms_disk != 0) {
2922 	    /* is this the one? */
2923 	    if (unit == device_get_unit(sc->mlx_sysdrive[i].ms_disk))
2924 		return(&sc->mlx_sysdrive[i]);
2925 	}
2926     }
2927     return(NULL);
2928 }
2929